EEVblog Electronics Community Forum

Products => Test Equipment => Topic started by: eevblogfan on April 08, 2013, 07:22:59 am

Title: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eevblogfan on April 08, 2013, 07:22:59 am
hey

I know it's stupide/newbie question but I'll ask it anyway ,

as all knows , you buy the base unit witch in terms of HW it has all , but licence is the big deal witch cost you a-lot , the question is : have anyone tried to write he's own version ? have anyone successfully hack the scope andupgraded the BW to say 200Mhz instead of 70 or so on ? or enable the memory function gen etc ?? 

P.S: I don't know if it's related to here or perhaps projects (?) so please move me if I am wrong  :palm:

thank you in advance :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EEVblog on April 08, 2013, 08:38:59 am
Nope, no one has done it yet.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eevblogfan on April 08, 2013, 08:41:44 am
what a buger :(

since I don't know FPGA and al that sort of stuff I can't even try by my own  :'(

it'll be funny if ther's someone who does know how and will manage to do that  :-DD
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: poorchava on April 08, 2013, 09:30:34 am
Since only thing you need to do to activate all the options is to input correct code. So everything is in there. But I'm pretty sure that Agilent uses some sort assymetric public key crypto system. And I'm also quite sure that whichever chip in the scope does that, is probably tamper-protected to prevent key extraction.

And if you find a way to break/bruteforce that sort of crypto be ready for either of those things to happen:
-get a job in CIA/FBI/etc
-get shot by CIA/FBI/etc
-make it public and get a Nobel prize (and then get shot by CIA/FBI/etc)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: _Sin on April 08, 2013, 09:40:04 am
License hacks were fairly trivial on the earlier scopes as the keys used were accidentally exposed in a firmware update. They're apparently using new keys now, so current scopes aren't vulnerable, but the older ones still are, even with the newly released features.

There was quite a discussion about it in the original thread about these scopes.

Of course you don't get the probes if you hack increased b/w or MSO features, and they frequently give away the wavegen + dvm features - the serial decode and memory options are more attractive.


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Someone on April 08, 2013, 12:18:58 pm
License hacks were fairly trivial on the earlier scopes as the keys used were accidentally exposed in a firmware update. They're apparently using new keys now, so current scopes aren't vulnerable, but the older ones still are, even with the newly released features.
Really? I thought most of the options were only embedded in the newer firmware releases?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: _Sin on April 08, 2013, 02:52:05 pm
License hacks were fairly trivial on the earlier scopes as the keys used were accidentally exposed in a firmware update. They're apparently using new keys now, so current scopes aren't vulnerable, but the older ones still are, even with the newly released features.
Really? I thought most of the options were only embedded in the newer firmware releases?

Sure, but putting a newer firmware on an older scope does not alter the keys.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Someone on April 09, 2013, 12:24:06 am
License hacks were fairly trivial on the earlier scopes as the keys used were accidentally exposed in a firmware update. They're apparently using new keys now, so current scopes aren't vulnerable, but the older ones still are, even with the newly released features.
Really? I thought most of the options were only embedded in the newer firmware releases?

Sure, but putting a newer firmware on an older scope does not alter the keys.
But why would they offer a trial matching the keys on a firmware version that doesnt have that option embedded? As far as I can tell the old firmware simply doenst have some of the options, so they might need to continue offering the trials of the options that were available in the leaked key against it for that odd customer who hasnt done a firmware update, but why would they release trials or licenses for the new options against the old keys? since you'd have to have the new firmware installed to use them.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on April 09, 2013, 12:45:54 am
I don't understand why the keys would be persistent in the scope - surely new firmware = (potentially) new keys, if you want a newer option one an old scope you need to update the FW anyway.

I think I'd be looking at how easy it is to load a modified firmware image - finding the "If <something> then <enable funtion>" code and patching it out shoudn't be that hard.     
 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ve7xen on April 09, 2013, 01:26:09 am
I don't understand why the keys would be persistent in the scope - surely new firmware = (potentially) new keys.
I guess if the trusted keys were part of a user-initiated update process they would be much easier to manipulate than if they're stored in some memory that is at least never written from the code, or possibly write-protected or write-once?

If they're doing secure boot from a read-only bootloader it's probably pretty hard to circumvent, depending on how secure their 'read only' is. If the code can be modified relatively easily and the 'scope will accept it, well it's kind of pointless, but why make things easy ;).
Title: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zibadun on April 09, 2013, 01:45:03 am
Actually the private key used to generate the code does not need to be present in the scope at all. Checking validity of the code can be done with a different (public) key. Knowing that key will not help with generating a new code.  All this assuming a correctly implemented public key system. Did they bother to do this or  used the same key for both encryption and validation?  I guess time will tell ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: _Sin on April 09, 2013, 06:10:31 am
I don't understand why the keys would be persistent in the scope - surely new firmware = (potentially) new keys, if you want a newer option one an old scope you need to update the FW anyway.

If they did, every single scope in the field would need new licenses issuing for every enabled feature.

And it's not clear how they would field upgrade scopes without exposing any new keys in the same way as the old keys were (the leak happened because they left the utility which initialises the scope, including the keys, inside the firmware package).

So it may actually involve not only issuing new keys, and new licenses, but recalling every scope so it can be done at the factory...

I guess they're happier just to ignore the small number of people who have both an original scope, and the desire to hack around with it. They're not cheap devices, I doubt it's a huge problem for them.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eevblogfan on April 09, 2013, 06:23:26 am
hey

can you use the 30 day trail and hack the scope to think the 30 day's weren't pass ?

thank you in advance :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: _Sin on April 09, 2013, 06:34:01 am
But why would they offer a trial matching the keys on a firmware version that doesnt have that option embedded? As far as I can tell the old firmware simply doenst have some of the options, so they might need to continue offering the trials of the options that were available in the leaked key against it for that odd customer who hasnt done a firmware update, but why would they release trials or licenses for the new options against the old keys? since you'd have to have the new firmware installed to use them.

The don't issue licenses against firmware versions, they issue licenses against a key, which is stored securely on the scope and (so far) is not updated. Old scopes have one key, which was accidentally published, and new scopes have a different key which AFAIK is still secure.

They likely won't change the keys in a firmware update, and doing so securely would be expensive and awkward for both them and customers (see my previous reply to Mike on why I think that is the case).

They can determine which key your scope uses, presumably just using the serial number, which they need to have in order to issue a license anyway, as it's part of the license string (which is what prevents a license for one scope being any use on another).

Certainly to date, an old scope uses the old keys even with the latest firmware, and so licenses for the new features *need* to be issued with those keys.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on April 09, 2013, 09:09:00 am
I don't understand why the keys would be persistent in the scope - surely new firmware = (potentially) new keys, if you want a newer option one an old scope you need to update the FW anyway.

If they did, every single scope in the field would need new licenses issuing for every enabled feature.

That assumes that installed licenses are stored as-is, and validated at startup, which isn't the only way to do it.
One approach would be that 'feature enable' flags are stored in NVRAM or system-writable flash, and get set by entering the license key. So the key is only needed for the process of activating a new feature, and can live in the firmware. Key updates would only affect the process of  issuing new licenses, which would  be manageable fairly easily, by saying that any new  licenses must be installed under the latest FW version.
 Obviously this assumes a suitably secure nonvolatile store  - NVSRAM in a BGA would be pretty effective.
It also assumes you can't load unauthorised firmware, but if you could, you could patch out the checks so that's no worse.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: _Sin on April 09, 2013, 10:12:22 am
You'd need to store more than a flag, as the license may also contain an expiry date, and the storage would need to be flexible to store any number of licenses, whereas by only storing the key and the serial#, it's fixed, and quite small. By storing the license and validating, it can be as large as there is ordinary flash storage and forward compatible with any new software feature.

And I'm not really making assumptions here - it's been established that license hacking in this way works, so implementation details aside, this is how it is done.

So yes, they could have implemented the system differently, but they didn't. It wouldn't have mattered if they hasn't released their own keys.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on April 10, 2013, 04:18:39 pm
Ha, I almost created the same thread when I started looking at the 2000/3000 X-Series. After quite a bit of searching I was able to find a couple threads that made it sound they had not been hacked. Sort of surprising considering how many very intelligent people buy and use this kind of tool. Oh well, maybe someday. Until then, I guess Agilent just gets more money from me. :(
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: marmad on April 10, 2013, 04:35:07 pm
Sort of surprising considering how many very intelligent people buy and use this kind of tool.

I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on April 10, 2013, 04:56:06 pm
You'd need to store more than a flag, as the license may also contain an expiry date, and the storage would need to be flexible to store any number of licenses, whereas by only storing the key and the serial#, it's fixed, and quite small. By storing the license and validating, it can be as large as there is ordinary flash storage and forward compatible with any new software feature.
True, but I'd guess storing an expiry date still takes less space than a license key, so probably not much difference. Just need to allocate enough fixed locations for the number of envisaged future options, as opposed to the maximum number of keys installable at one time.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grego on April 10, 2013, 05:00:00 pm
Sort of surprising considering how many very intelligent people buy and use this kind of tool.

I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.

What marmad said.

We don't need a philosophical argument here but remember that Agilent maintains its cutting edge because its profitable.  If it wasn't profitable they wouldn't be in that market.  I never understood this really - it's not like Agilent has a lock on the market - if you don't like or can't afford their equipment buy something else.  There's plenty of manufacturers out there.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on April 10, 2013, 05:22:41 pm
Sort of surprising considering how many very intelligent people buy and use this kind of tool.

I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.
Thats what I would assume as well, but the mere concept of "hacking" did not come about from those trying to save money, but for the challenge of undoing what was done and beating a system. Then they typically just give it to the rest.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on April 10, 2013, 05:24:23 pm
Sort of surprising considering how many very intelligent people buy and use this kind of tool.

I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.

What marmad said.

We don't need a philosophical argument here but remember that Agilent maintains its cutting edge because its profitable.  If it wasn't profitable they wouldn't be in that market.  I never understood this really - it's not like Agilent has a lock on the market - if you don't like or can't afford their equipment buy something else.  There's plenty of manufacturers out there.
You cant understand the natural desire to get more for less? Everyone wants that, we just dont always get it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: marmad on April 10, 2013, 05:44:04 pm
Thats what I would assume as well, but the mere concept of "hacking" did not come about from those trying to save money, but for the challenge of undoing what was done and beating a system. Then they typically just give it to the rest.

In general that might be true - but in this context - hacking test and measurement gear (which means you might brick the equipment which you use - i.e. much different possible ramifications than mere software hacking), I think the motives would likely be closer to getting bandwidth, options, etc. that you'd like to have for your own use - but can't readily afford to pay for.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on April 10, 2013, 06:27:30 pm
Thats what I would assume as well, but the mere concept of "hacking" did not come about from those trying to save money, but for the challenge of undoing what was done and beating a system. Then they typically just give it to the rest.

In general that might be true - but in this context - hacking test and measurement gear (which means you might brick the equipment which you use - i.e. much different possible ramifications than mere software hacking), I think the motives would likely be closer to getting bandwidth, options, etc. that you'd like to have for your own use - but can't readily afford to pay for.
Well I was referring to the real first hacking, back in the hardware, phreaking, etc days before there was "software", but yes I understand your point.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 11, 2013, 08:28:52 am
There's no real need to hack them anyway given you can just dial back the clock.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eevblogfan on April 11, 2013, 09:10:44 am
really ?

can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EEVblog on April 11, 2013, 09:25:07 am
You'd need to store more than a flag, as the license may also contain an expiry date

In that case you know the date from the info screen, so you might be able to use that as a baseline to search in the firmware  :-//
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EEVblog on April 11, 2013, 09:28:14 am
Sort of surprising considering how many very intelligent people buy and use this kind of tool.
I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.

Yes, the vast majority have no need nor desire to hack their scope, nor would most even think to look for one. Agilent know that and rely on that. If a hack did eventually happen, I doubt they would bat much of an eyelid.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: marmad on April 11, 2013, 09:57:50 am
Yes, the vast majority have no need nor desire to hack their scope, nor would most even think to look for one. Agilent know that and rely on that. If a hack did eventually happen, I doubt they would bat much of an eyelid.

Honestly, it seems as if even Rigol is not that worried about it (with the DS2000, DS4000, DG4000 series models all being identical inside). It appears as if they've expanded and released better-designed and built lines of test equipment after all of the publicity (and sales) surrounding the DS1000 hack - so I'm guessing it didn't financially damage the company.  ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on April 11, 2013, 12:51:56 pm
really ?

can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?
AFAIK one thing they have done is made it not possible to set the clock back to before the release date fo the current firmware. Not sure if they have done anything else to prevent re-trials. Might also be interesting to see if you can request the same trial more than once.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 11, 2013, 12:54:34 pm
really ?

can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?

Yep, the licenses get deleted once they expire but if you dial the clock back you can install them again. So just dial the clock as far back to the build date of the FW you are on after you install and you are golden, of course the only draw back is that you can't install FW updates that comes later than the trial expiration date.

The reinstall trick doesn't work with the internal 30day full trial since there's no install file, I lost them when I dialed the clock forward so they are gone forever for me. I suspect that if you dial forward to 2099 first before activating them and then dial back it might work.

Quote
Might also be interesting to see if you can request the same trial more than once.

Tried that, no go. They keep a record of your applications on their server.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Fsck on April 11, 2013, 12:57:31 pm
I think only the hobbyists and work for yourself types would ever bother hacking their equipment, and the % of buyers who would do such a hack are probably a negligible (not 0, but not too important) fraction of their sales.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Tooms on April 11, 2013, 01:02:17 pm
really ?

can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?

The reinstall trick doesn't work with the internal 30day full trial since there's no install file, I lost them when I dialed the clock forward so they are gone forever for me. I suspect that if you dial forward to 2099 first before activating them and then dial back it might work.

Quote
Might also be interesting to see if you can request the same trial more than once.

Tried that, no go. They keep a record of your applications on their server.

I have just got an new scope(demo model) with some active trials in it, i dont have the keys so is there any way to export them out for backup ?


Tooms
Title: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zibadun on April 11, 2013, 01:05:26 pm
really ?

can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?

Yep, the licenses get deleted once they expire but if you dial the clock back you can install them again. So just dial the clock as far back to the build date of the FW you are on after you install and you are golden, of course the only draw back is that you can't install FW updates that comes later than the trial expiration date.

The reinstall trick doesn't work with the internal 30day full trial since there's no install file, I lost them when I dialed the clock forward so they are gone forever for me. I suspect that if you dial forward to 2099 first before activating them and then dial back it might work.

Quote
Might also be interesting to see if you can request the same trial more than once.

Tried that, no go. They keep a record of your applications on their server.

This worked for me only once, setting the clock back and run self cal.  The second time they've expired looks like for good. I've tried a couple of different "procedures" but no joy..
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 11, 2013, 01:12:35 pm
really ?

can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?

Yep, the licenses get deleted once they expire but if you dial the clock back you can install them again. So just dial the clock as far back to the build date of the FW you are on after you install and you are golden, of course the only draw back is that you can't install FW updates that comes later than the trial expiration date.

The reinstall trick doesn't work with the internal 30day full trial since there's no install file, I lost them when I dialed the clock forward so they are gone forever for me. I suspect that if you dial forward to 2099 first before activating them and then dial back it might work.

Quote
Might also be interesting to see if you can request the same trial more than once.

Tried that, no go. They keep a record of your applications on their server.

This worked for me only once, setting the clock back and run self cal.  The second time they've expired looks like for good. I've tried a couple of different "procedures" but no joy..

Which one stopped working? The built in one with all features or the downloaded one?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 11, 2013, 01:18:43 pm
really ?

can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?

The reinstall trick doesn't work with the internal 30day full trial since there's no install file, I lost them when I dialed the clock forward so they are gone forever for me. I suspect that if you dial forward to 2099 first before activating them and then dial back it might work.

Quote
Might also be interesting to see if you can request the same trial more than once.

Tried that, no go. They keep a record of your applications on their server.

I have just got an new scope(demo model) with some active trials in it, i dont have the keys so is there any way to export them out for backup ?


Tooms

None that I know of, but since you got a demo unit are you sure it's not full licenses? Demo unit usually come fully activated since they aren't meant to stay in your possession for long. When I bought my 3014A the dealer gave me a demo unit before he got the stock in and that one was fully activated.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zibadun on April 11, 2013, 01:30:15 pm

Which one stopped working? The built in one with all features or the downloaded one?

The built in trial that came with the scope.  What's a "downloaded one"? 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 11, 2013, 01:38:38 pm

Which one stopped working? The built in one with all features or the downloaded one?

The built in trial that came with the scope.  What's a "downloaded one"? 

Ones that you can apply for on the website, they email you an .lic file, if those expire you just dial the clock back and reinstall.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Tooms on April 11, 2013, 02:06:16 pm

None that I know of, but since you got a demo unit are you sure it's not full licenses? Demo unit usually come fully activated since they aren't meant to stay in your possession for long. When I bought my 3014A the dealer gave me a demo unit before he got the stock in and that one was fully activated.

it has the trial for all options for around 90 days and then they will expire.

I can see in the papirs that i got that they install the demo licenser there is having a runtime of 120 days and there is about 90 days left now, but i dont have the key files and was hoping that i can export them some how.

Thanks
Tooms

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 11, 2013, 02:10:27 pm

None that I know of, but since you got a demo unit are you sure it's not full licenses? Demo unit usually come fully activated since they aren't meant to stay in your possession for long. When I bought my 3014A the dealer gave me a demo unit before he got the stock in and that one was fully activated.

it has the trial for all options for around 90 days and then they will expire.

I can see in the papirs that i got that they install the demo licenser there is having a runtime of 120 days and there is about 90 days left now, but i dont have the key files and was hoping that i can export them some how.

Thanks
Tooms



Well, logic dictates that there must be hidden SCPI commands that access what you need. Either way even if you can extract them you have to return the demo unit anyway, and those licenses are locked to the serial of the scope.

Unless you mean you bought an ex-demo?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Tooms on April 11, 2013, 02:18:27 pm

None that I know of, but since you got a demo unit are you sure it's not full licenses? Demo unit usually come fully activated since they aren't meant to stay in your possession for long. When I bought my 3014A the dealer gave me a demo unit before he got the stock in and that one was fully activated.

it has the trial for all options for around 90 days and then they will expire.

I can see in the papirs that i got that they install the demo licenser there is having a runtime of 120 days and there is about 90 days left now, but i dont have the key files and was hoping that i can export them some how.

Thanks
Tooms


Well, logic dictates that there must be hidden SCPI commands that access what you need. Either way even if you can extract them you have to return the demo unit anyway, and those licenses are locked to the serial of the scope.

Unless you mean you bought an ex-demo?

yes i have bought an ex-demo msox3024a there is as good as new but cheaper


Tooms
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 11, 2013, 02:52:41 pm

None that I know of, but since you got a demo unit are you sure it's not full licenses? Demo unit usually come fully activated since they aren't meant to stay in your possession for long. When I bought my 3014A the dealer gave me a demo unit before he got the stock in and that one was fully activated.

it has the trial for all options for around 90 days and then they will expire.

I can see in the papirs that i got that they install the demo licenser there is having a runtime of 120 days and there is about 90 days left now, but i dont have the key files and was hoping that i can export them some how.

Thanks
Tooms


Well, logic dictates that there must be hidden SCPI commands that access what you need. Either way even if you can extract them you have to return the demo unit anyway, and those licenses are locked to the serial of the scope.

Unless you mean you bought an ex-demo?

yes i have bought an ex-demo msox3024a there is as good as new but cheaper

Well then become drinking buddies with the dealer, they probably have the files then.

How much did you pay? My 3014A after taxes came in at 6333K USD (190k NTD at 30/1 exchange rate), this is with the SEGMEM and MEMUP options, I also got the Front Panel Cover for free.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Tooms on April 11, 2013, 03:55:38 pm
Quote
Quote
yes i have bought an ex-demo msox3024a there is as good as new but cheaper
Well then become drinking buddies with the dealer, they probably have the files then.
How much did you pay? My 3014A after taxes came in at 6333K USD (190k NTD at 30/1 exchange rate), this is with the SEGMEM and MEMUP options, I also got the Front Panel Cover for free.

it is an less then 3 month old MSOX 3024A with the LAN/VGA, wavegen, volt meter options and 3 year warrent for the price of 5985$ (with the danish sales tax of 25%)

I also got an front cover and bag for free with the unit and as it is an demo unit then i have all the options for 90 days

it was via the locale agilent partner in Denmark so it is easy for me if there is an issue with


The options that i think i will get leter on for it is I2C, RS232 and maybe the power analyzer option.


Tooms
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on April 11, 2013, 04:27:46 pm
Quote
Well, logic dictates that there must be hidden SCPI commands that access what you need.
Why? There is no legitimite reason to need to read license data out.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: _Sin on April 11, 2013, 09:58:28 pm
True, but I'd guess storing an expiry date still takes less space than a license key, so probably not much difference. Just need to allocate enough fixed locations for the number of envisaged future options, as opposed to the maximum number of keys installable at one time.

For one or two licenses perhaps storing a flag+date would be more compact, but once you need space for several licenses then storing just the key (which is fairly compact and applies to all licenses) ought to be smaller.

The other possible issue I can think of with your suggested scheme is that it means that the scope firmware necessarily contains the ability to write to the secure storage area, which would provide an additional attack surface for a hack attempt. You can either use an exploit in the firmware to flip a flag, or use the knowledge of how the secure-store is written to in order to write it directly.

With their existing scheme, the software only needs to be able to verify a hash using the securely stored key value, and never needs to write anything, so the mechanism to do so can be left out entirely. The full key information required to author the hash in the first place doesn't even need to be present at all.

Until some muppet leaves the scope initialisation tool in the firmware package.

Of course as you said earlier, the firmware itself could be an easier target than the licenses, for the scopes where the key information is unknown. If the only license check is in the software, it could be as simple as changing a branch or two. The only thing to work out would be what verification of the firmware code is done, and how to defeat it. But fiddling with that seems far more likely to lead to a possibly bricked scope, so it's not something I'd necessarily try unless I either had money to burn or a really pressing need for a feature I couldn't afford to buy...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on April 11, 2013, 10:52:23 pm
Of course another entirely practical, and more secure solution would  be for every scope to have a unique key. When they issue a license they just look it up on their internal database of keys vs. serial number. They already program unique serial numbers in, so adding a unique key would be minimal additional hassle.
The only additional effort would be to link the license issuing system with the production key generator.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rufus on April 11, 2013, 11:37:03 pm
With their existing scheme, the software only needs to be able to verify a hash using the securely stored key value, and never needs to write anything, so the mechanism to do so can be left out entirely.

As far as I can tell the existing scheme does not store any key, the public key(s) are in the firmware. Which key to use is determined by something in secure storage. Secure storage holds that something, the scope model and serial number. It looks like licences are pretty much stored as received.

Until some muppet leaves the scope initialisation tool in the firmware package.

I very much doubt it was left. I suspect initially the secure storage was encrypted or signed with the same key used to generate licences. The desire to have the scope model number change to reflect installation of MSO and bandwidth options meant the scope had to re-write secure storage and needed to have the private key. Embedding the initialisation tool was an easy kludge to achieve that. The muppet was the one that wanted to change the model number, or the software guy who didn't tell him it was a gaping security hole. That's my theory anyway.

Has anyone recently installed MSO or bandwidth options with a license? Did the model number change?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 12, 2013, 01:01:43 am
Quote
Well, logic dictates that there must be hidden SCPI commands that access what you need.
Why? There is no legitimite reason to need to read license data out.

There has to be some means to fiddle with the license state when they prep the ex-demo for release at least, granted there might only be overwrite commands available.

"5985$"
Wow, that's an awesome deal!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: _Sin on April 12, 2013, 05:41:24 am
Has anyone recently installed MSO or bandwidth options with a license? Did the model number change?

Neither changes the model number - not with the firmware revision which contained the initialisation tool, nor the very latest.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: amyk on April 12, 2013, 11:53:42 am
Of course as you said earlier, the firmware itself could be an easier target than the licenses, for the scopes where the key information is unknown. If the only license check is in the software, it could be as simple as changing a branch or two. The only thing to work out would be what verification of the firmware code is done, and how to defeat it. But fiddling with that seems far more likely to lead to a possibly bricked scope, so it's not something I'd necessarily try unless I either had money to burn or a really pressing need for a feature I couldn't afford to buy...
Someone who can afford the scope might be more likely to have EEPROM programmers and the like as well, meaning recovery from accidental bricking may not be too difficult. Unless there's some storage that can't be rewritten with external hardware somehow...

Mike makes it look too easy. :D (http://youtu.be/Qjw0NDeP-0Q)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tnt on June 11, 2013, 07:39:47 pm
Just to make it clear:

 * Licenses are stored pretty much as the XML files (same fields) and are loaded/checked from the "Secure NV" on startup
 * There is several public keys used to check the license signature, which key is used is dependent of the serial number of the scope. The secret key for the first public key, which is used for all early scope serials, has been leaked by Agilent themselves as a mistake and so it's trivial to generate your own licenses for those scope. That's been common knowledge forever ... it's explained in the original thread somewhere pretty early. Nobody published an easy tool, probably because :
  - "why risk it": since it deals with "encryption keys" it might have some legal implications that a fw diff doesn't have
  - "why risk agilent fixing the problem": if the problem is not widespread, why bother dedicating resources to fix it thoroughly, their current "work around" works well enough and is safe for all previously issued licenses.

In the worst case, if license code was fixed, attacking the firmware should be possible (despite code signing), but I'm certainly not about to risk bricking a 7k$ piece of test gear ...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rufus on June 11, 2013, 09:06:55 pm
Just to make it clear:
(...)
In the worst case, if license code was fixed, attacking the firmware should be possible (despite code signing), but I'm certainly not about to risk bricking a 7k$ piece of test gear ...
Your last sentence pretty much sums up all I went through. Happy ending though.

Is anything actually signed or just strong named or whatever they call it?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on June 21, 2013, 08:57:58 pm
Just to make it clear:

 * There is several public keys used to check the license signature, which key is used is dependent of the serial number of the scope. The secret key for the first public key, which is used for all early scope serials, has been leaked by Agilent themselves as a mistake and so it's trivial to generate your own licenses for those scope.
I wonder how hard it is to change the serial number.... 8)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on June 22, 2013, 09:45:12 am
My warranty is fixed to the serial number. I am never gonna change it.  :(
If you can change it, you can change it back
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: shadowless on June 23, 2013, 01:38:20 pm
Hey guys,

I am the first one to try the firmware on my 2000x scope and it worked for me. I took the risk of bricking my scope but well I was rewarded with a fully enabled scope.

I don't have a 3000x so I can't say that but I am sure it works on that too since he tested it himself.

So it is a good news for 2000x and 3000x owners.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rkupka on June 23, 2013, 03:32:18 pm
which FW version is this modified firmware based on ?
What is going to happen if I flash this new modded one and afterwards I flash brand new FW when Agilent releases it ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eevblogfan on June 23, 2013, 04:39:23 pm
Hey

can you tell me Why is the BW limit only does 20Mhz and don't ask me if I want 100Mhz , Full BW or 20Mhz ?

Ps , Is it software related ? , Ie , can you add that into new version of your file ?

and is that possible to somehow add say in the coupling menu to say put 50 Ohm impidance ? ( I suspect not right ? , becouse ther's no Hw whos support that ... )

thank you :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on June 23, 2013, 05:33:34 pm
I think that there is no 50ohm input at DSOX2000. DSOX2000 and DSOX3000 have quite different motherboards.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: con-f-use on June 24, 2013, 10:21:10 am
I am the first one to try the firmware on my 2000x scope and it worked for me. I took the risk of bricking my scope but well I was rewarded with a fully enabled scope.

I might have seen it work as well. Just so you know.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rkupka on June 24, 2013, 03:19:27 pm
Confirmed. Works as expected.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on June 24, 2013, 03:30:06 pm
Pretty darn cool. Ill wait till someone releases such a fix for free through. I dont like the idea of having to pay for cracks/hacks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on June 24, 2013, 06:46:30 pm
Does the hacked firmware void the warranty??
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on June 24, 2013, 06:59:45 pm
Does the hacked firmware void the warranty??
More than likely, however like Jailbreaking or something, if you can get the original firmware back on there before you send it in for servicing theyll probably never know you were ever running a customer firmware.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwsoft on June 24, 2013, 07:46:12 pm
Pretty darn cool. Ill wait till someone releases such a fix for free through. I dont like the idea of having to pay for cracks/hacks.

Uhm... how much djvinc charges for this firmware? It's really uncool...

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on June 24, 2013, 08:32:22 pm
Pretty darn cool. Ill wait till someone releases such a fix for free through. I dont like the idea of having to pay for cracks/hacks.

Uhm... how much djvinc charges for this firmware? It's really uncool...
Nevermind, apparently Im not allowed to post the details. PM them for the pricing.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwsoft on June 24, 2013, 09:19:28 pm
Uhm... how much djvinc charges for this firmware? It's really uncool...
The firmware is an initiative that requires a contribution, for many reasons I can't explain easily on this topic. Happy to tell on PM though.

Well, "contribution" should work like "If you like my work - please donate".
It should be all about pride and accomplishment... Making this kind of hacking for living is just low...

I'm surprised, that people on this forum are willing to pay for this - curious what Dave thinks about it  8)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: marmad on June 24, 2013, 10:12:52 pm
Nevermind, apparently Im not allowed to post the details. PM them for the pricing.

Not allowed by whom?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bored@Work on June 24, 2013, 10:14:53 pm
Uhm... how much djvinc charges for this firmware? It's really uncool...
The firmware is an initiative that requires a contribution, for many reasons I can't explain easily on this topic. Happy to tell on PM though.

Oh come on, the reason is you want the money.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EEVblog on June 24, 2013, 11:03:33 pm
Well, "contribution" should work like "If you like my work - please donate".
It should be all about pride and accomplishment... Making this kind of hacking for living is just low...
I'm surprised, that people on this forum are willing to pay for this - curious what Dave thinks about it  8)

I will of course not allow this forum to be used as a basis to peddle anything potentially illegal, either content or services.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on June 24, 2013, 11:19:23 pm
Well, "contribution" should work like "If you like my work - please donate".
It should be all about pride and accomplishment... Making this kind of hacking for living is just low...
I'm surprised, that people on this forum are willing to pay for this - curious what Dave thinks about it  8)

I will of course not allow this forum to be used as a basis to peddle anything potentially illegal, either content or services.
Requiring payment (or not) doesn't affect the legality. Possibly the sentence though.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EEVblog on June 25, 2013, 01:00:55 am
FYI: djvinc's account and posts have been deleted at his request.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on June 25, 2013, 02:08:23 am
Well, now that that's cleaned up, who can provide us with one of the modified firmwares so we can compare it against the original to see what was changed?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: shadowless on June 25, 2013, 02:35:33 am
Well, "contribution" should work like "If you like my work - please donate".
It should be all about pride and accomplishment... Making this kind of hacking for living is just low...
I'm surprised, that people on this forum are willing to pay for this - curious what Dave thinks about it  8)

I will of course not allow this forum to be used as a basis to peddle anything potentially illegal, either content or services.

Dave what about the Rigol Hack? Is that legal?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EEVblog on June 25, 2013, 04:32:17 am
Dave what about the Rigol Hack? Is that legal?

How long is a piece of string?
How far do you want to open the can of worms?
IMO there is a big difference between sending a simple existing serial command down the existing provided interface, and reverse engineering and bypassing an encrypted software feature set.
Argue away...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: shadowless on June 25, 2013, 01:41:13 pm
Dave what about the Rigol Hack? Is that legal?

How long is a piece of string?
How far do you want to open the can of worms?
IMO there is a big difference between sending a simple existing serial command down the existing provided interface, and reverse engineering and bypassing an encrypted software feature set.
Argue away...

Really Dave? Read the first page of Hantek /tekway hack.  Extensive reverse engineering was done.  You have to by past software by renaming. 

Perhaps consider taking down your potentially illegal Rigol hack video in the process :)

"I dont know" in your own tone :)  Argument is not my thing, they are all just mind chatter between individuals trying to affirm their own belief.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rufus on June 25, 2013, 03:14:56 pm
Perhaps consider taking down your potentially illegal Rigol hack video in the process :)

"I dont know" in your own tone :)  Argument is not my thing, they are all just mind chatter between individuals trying to affirm their own belief.

Legality aside there is a moral distinction between providing a platform where discussion of hacks/cracks is not censored and providing a platform where hacks/cracks are offered for sale.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: shadowless on June 25, 2013, 03:43:20 pm
Perhaps consider taking down your potentially illegal Rigol hack video in the process :)

"I dont know" in your own tone :)  Argument is not my thing, they are all just mind chatter between individuals trying to affirm their own belief.

Legality aside there is a moral distinction between providing a platform where discussion of hacks/cracks is not censored and providing a platform where hacks/cracks are offered for sale.

If you own an Agilent perhaps you with think otherwise :) If Dave provide us a free hack I will very happy. Who wants to pay if we can get it free.  If you have strong moral discipline, then don't even think about hacking, it is never morally correct.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on June 25, 2013, 04:22:03 pm
Nevermind, apparently Im not allowed to post the details. PM them for the pricing.

Not allowed by whom?
Not "not allowed" specifically. Perhaps it was a bad choice of words. I was asked not to. And no, it was not by Dave.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: BravoV on June 25, 2013, 04:25:59 pm
Nevermind, apparently Im not allowed to post the details. PM them for the pricing.

Not allowed by whom?
Not "not allowed" specifically. Perhaps it was a bad choice of words. I was asked not to. And no, it was not by Dave.

So is it official now that "Agilent" hack is not allowed here in this forum, while other Chinese's stuff is ok ?  ???
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on June 25, 2013, 04:29:49 pm
Nevermind, apparently Im not allowed to post the details. PM them for the pricing.

Not allowed by whom?
Not "not allowed" specifically. Perhaps it was a bad choice of words. I was asked not to. And no, it was not by Dave.

So is it official now that "Agilent" hack is not allowed here in this forum, while other Chinese's stuff is ok ?  ???
Certainly not. Like I said I was not asked by Dave. As far as I care, he's the only one that makes anything "official" here. Rights of ownership. I just obliged the individual that asked me to edit my post. It's pretty simple to guess who might have asked that and for what reasons. I just dont want to be any further involved in the situation.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Spikee on June 25, 2013, 09:41:23 pm
How many people use this hacked firmware?

And who is willing to release the files here (for free of course) .
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tinhead on June 25, 2013, 10:44:07 pm

Really Dave? Read the first page of Hantek / Tekway hack.  Extensive reverse engineering was done.


you forgot two things:
- in Europe not a big deal, i own it so i can do what ever i wish to do (as long i do on my own device)
- at time of publishing there was no GPL code released, making these DSO illegal in EU, you can't sue someone
  for hacking on not-existing (because illegal) gear.


Well, "contribution" should work like "If you like my work - please donate".


ehm, i give you some stats. I do have "please donate if you like" link, i mentioned it few times here and there (as well poeple who donated did it too) and honestly i did got together less than 300USD - in almost 3yrs. Not that i'm begging now for money, but simply telling the truth about donations.

I have no idea how many hours i spend total on these DSOs, but alone the fact that i reversed the PCB and drew schematics of already 3 hardware revisions was worth more than what i got as donation.

Right, i got now from someone almost brand new Hantek DSO for free (as he bought Rigol DS2202) and another guy was thinking about giving me his Voltcraft DSO for few months. But that's not result of donation but simply people who knows that i fucked up my company :\

Making this kind of hacking for living is just low...

Hardware reversing costs not only time but as well some lab resources, they need to be paid. So it's not for living.
In my case it was a bit different story, i was running my own business in last 10yrs, so for sure i had a chance to pay what was necessary. But other might not have that luck, so yes i understood why "djvinc" asked for money.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mickpah on June 26, 2013, 01:07:37 am
Hi
I've been following a number of these threads. I own some of the test gear in question but not all.

I understand the name hacker comes from the early days of computing when it was done as a challenge or for bragging rights. Personally, that is the way I look at it.
Whether the results are used by other is a personal decision really, googling turns up so much of this stuff anyway
My only concern if that Dave gets caught in the middle some legal thing or suppliers don't send stuff for review. We have a good thing here, open helpful discussion , a bit of fun and no nazi moderators. Lets not stuff it up

my opinion only flame away
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on June 26, 2013, 10:22:52 am
Does anyone have the old firmware which leaked the private keys? Obviously Agilent removed it from the web site. If someone can supply me with it I think I can create a license key generator.

You can indeed, but it will only work on very old scopes because the newer ones (according to serial number) are using new keys. Now, if you've figured a way to change the serial number to use the old key or otherwise get around that, then do please elaborate.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jirikv on June 26, 2013, 10:36:44 am
I found only this:
http://translate.google.cz/translate?sl=auto&tl=en&prev=_t&hl=cs&ie=UTF-8&u=http://zavelos.ru/forum/25389-pomogite-vyitashhit-resurs-iz-dll&act=url (http://translate.google.cz/translate?sl=auto&tl=en&prev=_t&hl=cs&ie=UTF-8&u=http://zavelos.ru/forum/25389-pomogite-vyitashhit-resurs-iz-dll&act=url)

http://www.sendspace.com/file/q9gluq (http://www.sendspace.com/file/q9gluq)

and more discussion here and on following pages:

https://www.eevblog.com/forum/blog/new-agilent-scopes/150/ (https://www.eevblog.com/forum/blog/new-agilent-scopes/150/)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rasz on June 26, 2013, 12:18:33 pm
The way I see it cracking something for profit = illegal.
Hacking something because you are curious and want to really own what you paid for = real spirit of hacking.

In many EU countries (including mine) there are provisions in copyright law that let users copy/share/do whatever they want _as long as its not for profit_.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rufus on June 26, 2013, 02:29:27 pm
I'd still like to get the first key though, if anyone has it.

The file containing it is linked two posts up.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwsoft on June 26, 2013, 03:39:46 pm
Quote from: tinhead
ehm, i give you some stats. I do have "please donate if you like" link, i mentioned it few times here and there (as well poeple who donated did it too) and honestly i did got together less than 300USD - in almost 3yrs. Not that i'm begging now for money, but simply telling the truth about donations.

Well, I know you are somewhat on "the other side", but... $300 isn't that bad. I think about "contribution" for hacking more like a tip, bonus, not real profit...
It was your choice to spend so many hours on this without thinking about future profits like him :)

Quote from: tinhead
Hardware reversing costs not only time but as well some lab resources, they need to be paid. So it's not for living.
[...] But other might not have that luck, so yes i understood why "djvinc" asked for money.

Well, when we are talking in general, I think there are two possible scenarios:
1) Someone already have skills, somewhat equipped lab. Then he buys a product for normal usage and start to tinker with it for pleasure / hobby.
2) Someone targets potentially hackable product, start to learn new skills, "invest" money for lab equipment or even additional people and in the end starts to sell the solution.

First scenario maybe is illigal in some countries, but usually morally acceptable.
But the second one? It's just organized crime...  O0 Just like groups in Europe which hack cars immobilizers. Today you can buy this kind of device for 2003-2010 Volkswagen cars for about €400. You just plug it in OBD port, wait 10 seconds and start car with big screwdriver  :palm: I guess they also spend many hours and many euros for that... ;)

Anyway - let's say 20 people payed him $140. Scope cost is covered (I don't think he had any other real expenses). And what after that? You think he will stop charging money for his solution?  :-DD
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tinhead on June 26, 2013, 05:33:50 pm
I'd still like to get the first key though, if anyone has it.

The file containing it is linked two posts up.

I eventually figured out how to download it from that Russian site yesterday, but it doesn't seem to be a complete archive. I'll have another look later.

i have that file still localy and remote on hotfile

https://hotfile.com/dl/131446259/df706bb/3000XSeries.01.10.2011031600.cab.html

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jirikv on June 26, 2013, 05:35:12 pm
I'd still like to get the first key though, if anyone has it.

The file containing it is linked two posts up.

I eventually figured out how to download it from that Russian site yesterday, but it doesn't seem to be a complete archive. I'll have another look later.

You dont need download from Russian site. I already reupload the file:
http://www.sendspace.com/file/q9gluq (http://www.sendspace.com/file/q9gluq)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on June 26, 2013, 10:10:48 pm
first you need the network module...

Indeed. It begs the question - has anyone whacked in a magjack and gotten the scope to use it yet? Early on I remember there was some effort to inspect the network module to see which pin to pull up/down to tell the scope it had a LAN port hooked up but I don't see whether anyone actually did it.

Or maybe if the scope will detect the LAN/VGA being inserted hot, one could just boot up the scope and run over the connector with a weak pullup/pulldown while watching the network menu to see if it activates. Then again, I wouldn't be surprised if rebooting is required after inserting a module.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on June 27, 2013, 02:25:00 am
Indeed. It begs the question - has anyone whacked in a magjack and gotten the scope to use it yet? Early on I remember there was some effort to inspect the network module to see which pin to pull up/down to tell the scope it had a LAN port hooked up but I don't see whether anyone actually did it.
There is a Xilinx XC3S100 FPGA on the board. Looks like it is for the VGA output (together with an ADV7125 triple DAC and a CY7C1325 RAM on the back), because the ethernet connection is just two wires, as Dave mentioned in one of his videos and as you can see in my photo of it:

http://i.imgur.com/OSoJtll.jpg (http://i.imgur.com/OSoJtll.jpg)

But I wouldn't be surprised, if they implemented some kind of protection in the FPGA. It has lots of LEs to implement even a small microcontroller in it for a simple verification protocol.

Quote
Or maybe if the scope will detect the LAN/VGA being inserted hot, one could just boot up the scope and run over the connector with a weak pullup/pulldown while watching the network menu to see if it activates. Then again, I wouldn't be surprised if rebooting is required after inserting a module.

This could damage the scope, too expensive for me to try it.

In general, I think it is ok to buy the network module. Then hack it :) but of course, don't sell or buy hacks for it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on June 27, 2013, 06:40:17 am
I don't know if we're talking about the same network module, but the only one I know of is the LAN/VGA module which costs $400 USD so buying it is completely out of the question.

At one point I guess I had a brain fart and thought it was under $200, and I was half-seriously toying with the idea of trying to talk myself in to considering it. I looked up the price to get an exact figure for consideration and shat my pants so hard they probably felt the shockwave in china. I still haven't figured out how to cope with the fact that my primary high-end scope is lacking some very basic functionality that even won hung lo scopes usually have.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on June 27, 2013, 06:42:29 am
It's fair to buy it, if you are going to hack the rest :P
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on June 27, 2013, 07:47:31 am

But I wouldn't be surprised, if they implemented some kind of protection in the FPGA. It has lots of LEs to implement even a small microcontroller in it for a simple verification protocol.

I'd say that would be highly unlikely. I really don't think they are too bothered about people making their own LAN interface. It would also be sensible  to keep the LAN and VGA functions seperate in case they wanted to do different permutations in the future.
My money is it's just a mag-jack and a pin pulled. May not even be the latter if the Ethernet Phy can detect presence of the  jack.
 
 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tnt on June 27, 2013, 10:42:00 am
- at time of publishing there was no GPL code released

Not quite true. I addressed a request to Agilent directly to get the source for the GPL software distributed with the scope (u-boot mostly) and I received the source package back. I also posted a link to it in the first topic about this scope, probably more than a year ago.

Cheers,

   Sylvain
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on June 27, 2013, 03:59:30 pm
I don't know if we're talking about the same network module, but the only one I know of is the LAN/VGA module which costs $400 USD so buying it is completely out of the question.

At one point I guess I had a brain fart and thought it was under $200, and I was half-seriously toying with the idea of trying to talk myself in to considering it. I looked up the price to get an exact figure for consideration and shat my pants so hard they probably felt the shockwave in china. I still haven't figured out how to cope with the fact that my primary high-end scope is lacking some very basic functionality that even won hung lo scopes usually have.
I was able to talk AgilentUsed (their eBay selling account) down to $170 for one. Though that was with my MSOX2024A purchase, but maybe it could be done separately or if someone is planning on buying a 2000 X-series from them...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: djghost on July 01, 2013, 07:00:27 am
Hi,

Agilent released a version of the 2000x/3000x firmware : v2.35, with minor enhancements.

For those who wonder / try to solve the puzzle, this new version 2.35 is hackable.
Have fun !
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: shadowless on July 03, 2013, 08:28:06 pm
Wow i saw the Rigol 2000 thread and they are hacking license like nobody's business and reverse engineering I2C info like crazy.

https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg256453/#msg256453 (https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg256453/#msg256453)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwsoft on July 04, 2013, 09:53:50 am
I don't have this scope, but just out of curiosity - I've downloaded X2000 firmaware.

Where is the catch?
It seems, that modification should be really easy:
1. Unpack update file
2. Unpack infiniiVisionSetup.cab
3. Locate infiniivision.lnk file -> INFINI~1.027
4. Open it, add our precious command line switch, count number of characters and correct value in the beginning of file
5. Pack all files back to infiniiVisionSetup.cab
6. Compute MD5 check sum of infiniiVisionSetup.cab and replace it in recipe.xml
7. Pack all files back into update file

Am I missing any additional checksums/signatures somewhere?
The only (and most important) problem for me, it that I can't figure out what this command line switch is. I'm quite new to IDA and PE executables.
infiniiVisionLauncher.exe just passes command line arguments to infiniiVisionCore.dll, and this file is 16,5MB jungle  |O
Nothing obvious popes out right away...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: djghost on July 04, 2013, 10:23:05 am
the cab file is signed, so if you try this you brick your scope  :-\
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwsoft on July 04, 2013, 11:06:22 am
Silly me :) I didn't realized that CAB files can be signed, like exe/msi etc. :)

But what about uboot? Which commands are implemented?
Maybe it will be possible, to modify lnk file via directly digging into file system (loading page from nand, modifying in RAM and writing back).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 04, 2013, 08:50:35 pm

But I wouldn't be surprised, if they implemented some kind of protection in the FPGA. It has lots of LEs to implement even a small microcontroller in it for a simple verification protocol.


I can confirm that the LAN is working when only the ethernet pins are used. Tested with LAN/VGA module when the rest of pins were covered by Kapton tape.
The oscilloscope does not recognize installed module but the telnet, VNC and LXI are working properly. The IP is configurable only through LXI.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on July 04, 2013, 09:11:18 pm
So we can make a LAN plugin ourselves.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Norleif on July 04, 2013, 10:18:52 pm
So if I put together a PCB with a magjack and plug it into the scope, presumably it has a default IP?
From there, it remains to break out the RS232 lines to the CPU and add that magic command line option and everything is up for grabs?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 05, 2013, 02:34:52 pm
I have an idea to try: there is a kind of install batch script - recipe.xml inside the fw update cab. Replace update commands with a single command that starts infiniiVision.exe with that magic parameter, pack that xml into a .cab and try "updating" from it.
Code: [Select]
<?xml version="1.0"?>
<install>
<killProcess>infiniivisionLauncher.exe</killProcess>
<installStep>
        <!-- replace /magicparameter with right one -->
<command>\Secure\infiniiVision\infiniivisionLauncher.exe /magicparameter</command>
</installStep>
</install>

Anyone willing to try? It shouldn't do any harm in any case - no write commands like original "loadP500Flash" there. A quick test can be made without any parameters - it should restart the scope app
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 05, 2013, 07:25:58 pm
So if I put together a PCB with a magjack and plug it into the scope, presumably it has a default IP?
From there, it remains to break out the RS232 lines to the CPU and add that magic command line option and everything is up for grabs?

Yes, you will need just the PCB and MagJack. If you need the status LEDs working you will need few passives.
Default configuration is automatic IP adress from DHCP, so you need just running DHCP on your computer.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 05, 2013, 08:38:59 pm
So if I put together a PCB with a magjack and plug it into the scope, presumably it has a default IP?
From there, it remains to break out the RS232 lines to the CPU and add that magic command line option and everything is up for grabs?

Yes, you will need just the PCB and MagJack. If you need the status LEDs working you will need few passives.
Default configuration is automatic IP adress from DHCP, so you need just running DHCP on your computer.

Thank you!! Do you already have a pinout for the magjack and LEDs? I think there should be sufficient high resolution photos elsewhere to reconstruct it but it sounds like you can save me the trouble with little inconvenience.

I intend to draw up a PCB for this and post the gerbers if no one beats me to it. I guess I'll need to open my scope to get the mechanical dimensions unless someone can provide that as well. That's not a huge deal, but I guess my only hesitation is that if I'm going to make a PCB then I'd much prefer that it be complete with the activation pin to tell the scope to enable the LAN configuration, assuming that even exists.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on July 05, 2013, 09:03:34 pm
I think before doing a PCB it would be worth checking to see if there is a pullup/pulldown used for option detect. (or at least make sure all the pads are broken out to allow experimentation)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 06, 2013, 12:24:44 am
I think before doing a PCB it would be worth checking to see if there is a pullup/pulldown used for option detect. (or at least make sure all the pads are broken out to allow experimentation)

I'm waiting for used MagJack datasheet, after that I will make some schematic.
If following pins connected LAN is working including LEDs
 43   LAN Green

45   GND
47   LAN
49   LAN
51   GND
53   GND
55   LAN
57   LAN
59   GND
61   GND
63   LAN Yellow
65   GND

46   GND   
48   LAN LED Common   0.2uF to GND
50   LAN LED Common   0.2uF to GND
52   GND   
54   GND   

and everything working, including status LEDs.
I tried to connect also pins
78   GND
80   GND
Where seems to be identification and it resulted in LAN/VGA error on startup.
It is not big deal that the IP cannot be modified from scope itself and needs to be modified through LXI, I think.

The pitch of contacts is 0,8mm, does anyone some tips for protoboard with such a contact spacing?

I just find Dave video related to module:
http://www.eevblog.com/2011/02/17/eevblog-145-agilent-lanvga-module-teardown/ (http://www.eevblog.com/2011/02/17/eevblog-145-agilent-lanvga-module-teardown/)



Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 09, 2013, 09:06:18 pm
The magjack pinout.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Norleif on July 10, 2013, 02:21:03 am
Nice pinout of the module. If we only knew the TX+, TX÷, RX+ and RX÷ on those LAN pins we're getting there. If someone has access to a genuine module and a calliper, we could get the proper dimensions for that card-edge connector too. Looking at Dave's video it seems there is a key slot in the middle somewhere.

I just got a MSOX3024A (+ free WaveGen and DVM), but I haven't started playing with it beyond installing the latest official FW. Haven't even activated the full-feature trials.
I'm hoping that if I wait, I don't have to reset the date as often to keep them working... Or did I miss something here?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: KTP on July 10, 2013, 03:02:30 am
Nice pinout of the module. If we only knew the TX+, TX÷, RX+ and RX÷ on those LAN pins we're getting there. If someone has access to a genuine module and a calliper, we could get the proper dimensions for that card-edge connector too. Looking at Dave's video it seems there is a key slot in the middle somewhere.

I just got a MSOX3024A (+ free WaveGen and DVM), but I haven't started playing with it beyond installing the latest official FW. Haven't even activated the full-feature trials.
I'm hoping that if I wait, I don't have to reset the date as often to keep them working... Or did I miss something here?

wait...what?  I have an MSOX3024A also (and have not touched my 30 day trials either).  Do we have an unofficial trial date reset h**k?

(I don't think memup to 4Meg is part of the 30 day trials though...)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jmole on July 10, 2013, 03:24:09 am
I've got access to an official LAN/VGA module. Will high-res photos of the boards help at all? I can't do anything electrical to the boards, as they're not mine and I can't afford to F it up.

Going on vacation for a week and a half or so, but I should be able to get some 25MP pics when I'm back in the last week of July.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 10, 2013, 03:56:27 am
Nice pinout of the module. If we only knew the TX+, TX÷, RX+ and RX÷ on those LAN pins we're getting there. If someone has access to a genuine module and a calliper, we could get the proper dimensions for that card-edge connector too. Looking at Dave's video it seems there is a key slot in the middle somewhere.

I just got a MSOX3024A (+ free WaveGen and DVM), but I haven't started playing with it beyond installing the latest official FW. Haven't even activated the full-feature trials.
I'm hoping that if I wait, I don't have to reset the date as often to keep them working... Or did I miss something here?

I have a the genuine module, so the PCB dimensions are not problem, if someone is going to  make PCB.
Don not forget that we will also need a plastic container, otherwise there will be no mechanical support of the PCB in the scope.
Today I will finish the schematic with passives.

Currenly I have unpacked image and need to modify the registry file default.fdf. For this I tried script fdf2reg.pl from mkrom 1.36, but it only decode few lines of registry file and end up with error message.
If someone know different way how to extract registry from RAM based file it will be helpful.
Registry contains the commads for automatic startup of the appplication. The modifiing the recipe.xml, seem to be the dead end and not working.

For accessing the scope we need to know the telnet password or disable the telnet autentication in the registry and build up the whole image.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ve7xen on July 10, 2013, 04:30:08 am
I've got access to an official LAN/VGA module. Will high-res photos of the boards help at all? I can't do anything electrical to the boards, as they're not mine and I can't afford to F it up.

Going on vacation for a week and a half or so, but I should be able to get some 25MP pics when I'm back in the last week of July.
If you can get photos as straight on as you can (or scans) alongside a ruler they should be usable for duplicating the board shape. The board photos might be enough to figure out the pinout. I'd guess it's two layers?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on July 10, 2013, 04:37:45 pm
Another owner of the VGA/LAN module. I have a high end digital caliper too for dimensioning. Let me know if you guys need that info.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on July 10, 2013, 04:51:33 pm
Why so complicated? Drill a hole in the scope for a magjack, mount it with some hot glue and solder some wires to it :) While you have it open: solder some more wires for the UART connector, maybe even a MAX3232 converter board, because it is 3.3V digital level UART, and then a standard d-sub 9 connector for the case.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 10, 2013, 06:34:50 pm
Who's getting complicated?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tru on July 10, 2013, 07:35:34 pm
Why so complicated? Drill a hole in the scope for a magjack, mount it with some hot glue and solder some wires to it :) While you have it open: solder some more wires for the UART connector, maybe even a MAX3232 converter board, because it is 3.3V digital level UART, and then a standard d-sub 9 connector for the case.
You're kidding right, you own one of these scopes? These scopes aren't budget range, they are £1061 upwards. I don't know who here is willing to drill such a beautiful and expensive machine, but I wouldn't do to mine!   >:D

Best method is to route or saw a pcb of same dimensions as LAN module and then etch, that's why we are waiting for needed pinouts of LAN module connector, so it's nothing to do with complications.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 10, 2013, 07:56:19 pm
Well, to be fair, only the little plastic cover for the expansion port would need a hole drilled in it. That may be what I choose to do since I don't have a 3d printer to make a case for my LAN module.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Norleif on July 11, 2013, 11:06:30 pm
Hmm... In addition to the MagJack on the cheat PCB we might drop in some pin headers (for wiring to the secret UART), a MAX3232 and a DSUB9 connector instead of the VGA port. It might even fit in the original LAN module case :P

I only wish FrankBuss would elaborate on how to utilize that UART...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 11, 2013, 11:39:09 pm
Hmm... In addition to the MagJack on the cheat PCB we might drop in some pin headers (for wiring to the secret UART), a MAX3232 and a DSUB9 connector instead of the VGA port. It might even fit in the original LAN module case :P

I only wish FrankBuss would elaborate on how to utilize that UART...

 :-+ Great idea. (or maybe ft232 and usb instead...)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on July 12, 2013, 07:48:06 am
I only wish FrankBuss would elaborate on how to utilize that UART...

The serial port location:

http://i.imgur.com/yYMV75t.jpg (http://i.imgur.com/yYMV75t.jpg)

All you need are some jumper wires, if you don't want to drill a hole. Fits nicely through the USB connector hole 8)

http://i.imgur.com/9gnsuQh.jpg (http://i.imgur.com/9gnsuQh.jpg)

You can then stop the u-boot with space (can be difficult, you have to be fast, use something like HTerm which has a useful "repeat" function to send a sequence automatically until you stop it, or just hold down space while you boot it). Then you can boot the image from network like this:

Code: [Select]
set serverip 192.168.11.108
dhcp 0x4000000 nk.bin;bootm 0xf8050000

Where 192.168.11.108 is your own server, where TFTP is running and providing nk.bin. You should see something like this:

Code: [Select]
BOOTP broadcast 1
DHCP client bound to address 192.168.11.106
Using smsc device
TFTP from server 192.168.11.108; our IP address is 192.168.11.106
Filename 'nk.bin'.
Load address: 0x4000000
Loading: **#################################################################
#################################################################
...

You get the nk.bin from the nk.bin.comp from the firmware update cab-file with the bincompress.exe tool, which is included in the evaluation version of the WindowsCE development environment. Use http://www.t-hack.com/wiki/index.php/NK.BIN_toolset (http://www.t-hack.com/wiki/index.php/NK.BIN_toolset) to take a look at the content of nk.bin and to modify it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on July 12, 2013, 07:50:41 am
I only wish FrankBuss would elaborate on how to utilize that UART...

The serial port location:

http://i.imgur.com/yYMV75t.jpg (http://i.imgur.com/yYMV75t.jpg)

All you need are some jumper wires, if you don't want to drill a hole. Fits nicely through the USB connector hole 8)
..or an IDC ribbon cable with  IDC D connector, as found on old PCs.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on July 12, 2013, 09:12:31 am
Sorry, was the wrong command line, it still boots from the flash. Found my notes again, this is the right sequence:

Code: [Select]
set serverip 192.168.11.108 ; dhcp 0x361000 nk.nb0 ; go 0x362000

You need cvrtbin.exe from http://www.t-hack.com/wiki/index.php/NK.BIN_toolset (http://www.t-hack.com/wiki/index.php/NK.BIN_toolset) to create nk.nb0 from nk.bin. Use it like this:

Code: [Select]
cvrtbin.exe -r -a 0x80361000 -w 32 -l 0x01248688 nk.bin

The addresses and length is what viewbin.exe shows, just in case it is different for a newer firmware.

In case you wonder about the 0x80361000 and 0x361000 difference: this is because of physical and virtual memory addresses. Fortunately the mapping is really easy in this case.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on July 12, 2013, 09:17:31 am
..or an IDC ribbon cable with  IDC D connector, as found on old PCs.
Right, would be even better, because less danger that it gets lose. You can then cut all the wires except the two you need to thread through some holes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 20, 2013, 08:16:50 am
There is one trick which can help.

Create following structure on USB drive and the scope will run link or whole firmware from USB flash drive.
1. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
2. Create "Startup" directory where you can store link for execution
3. (Optional) Copy the folder "infiniiVision" from infiniiVisionSetup.cab. It can be unpacked e.g with WinCE CAB Manager 3.0). It will make the boot sequence little bit longer but allow you to boot up firmware from USB without flashing it ( tested with 2.35 and  2.30)

I can confirm that scope is hackable without the LAN/VGA module or taking the scope apart. If someone will be still interested in manufacturing LAN module I can post schematic.
Please do not ask me for details related to hacking the scope, I will not share them.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 20, 2013, 11:04:31 am
There is one trick which can help.

Create following structure on USB drive and the scope will run link or whole firmware from USB flash drive.
1. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
2. Create "Startup" directory where you can store link for execution
3. (Optional) Copy the folder "infiniiVision" from infiniiVisionSetup.cab. It can be unpacked e.g with WinCE CAB Manager 3.0). It will make the boot sequence little bit longer but allow you to boot up firmware from USB without flashing it ( tested with 2.35 and  2.30)

I can confirm that scope is hackable without the LAN/VGA module or taking the scope apart. If someone will be still interested in manufacturing LAN module I can post schematic.
Please do not ask me for details related to hacking the scope, I will not share them.

What path to use in the startup link to load from USB?

I don't know when I'll get around to it but I'm still quite interested in making a PCB for the LAN module.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 20, 2013, 12:39:55 pm
The usb drive's root is seen as \usb folder in rootfs, so just add an \usb\ prefix to the path on usb drive
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 20, 2013, 12:50:40 pm
Can someone with opened scope please check where the BOOT_SEL pin (K18) of SPEAr600 goes? Look here for the drawing http://www.st.com/web/en/resource/technical/document/datasheet/CD00248440.pdf (http://www.st.com/web/en/resource/technical/document/datasheet/CD00248440.pdf) pg.93
Grounding this pin at power up should activate USB download mode in cpu's bootrom - an unlimited access to the internals, regardless of fw versions etc, it's in metal
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on July 20, 2013, 01:46:29 pm
Can someone with opened scope please check where the BOOT_SEL pin (K18) of SPEAr600 goes? Look here for the drawing http://www.st.com/web/en/resource/technical/document/datasheet/CD00248440.pdf (http://www.st.com/web/en/resource/technical/document/datasheet/CD00248440.pdf) pg.93
Grounding this pin at power up should activate USB download mode in cpu's bootrom - an unlimited access to the internals, regardless of fw versions etc, it's in metal

How should someone check where the pin goes? The chip is a BGA chip, maybe even with buried vias, if there is a via for this pin at all.

u-boot provides commands to load files over the serial port with y-modem and kermit, maybe even from USB, and you have unlimited access to all internals from it, if you want to dig this deep in the hardware.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 20, 2013, 02:38:37 pm
What path to use in the startup link to load from USB?

I don't know when I'll get around to it but I'm still quite interested in making a PCB for the LAN module.

Folder Startup with file infiniivision.lnk which should contains "45#\usb\infiniiVision\infiniivisionLauncher.exe"

OKI, and do you have any plan for mechanical construction?
Otherwise you can break the DSOX internal connector.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 20, 2013, 02:48:20 pm
FrankBuss,
Dave's teardown video shows that CPU has vias to all pins. Sure, u-boot is enough for now, even that simpler infiniivisionStartupOverride.txt way is enough, but times can change (fixes), but bootrom will still be there forever. Also there is probability that BOOT_SEL is accessible somewhere on lan/vga/gpib slot, who knows. Why not to check?

SPEAr flasher http://www.st.com/web/en/catalog/tools/PF257557 (http://www.st.com/web/en/catalog/tools/PF257557)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 20, 2013, 07:45:01 pm
FrankBuss,
Dave's teardown video shows that CPU has vias to all pins. Sure, u-boot is enough for now, even that simpler infiniivisionStartupOverride.txt way is enough, but times can change (fixes), but bootrom will still be there forever. Also there is probability that BOOT_SEL is accessible somewhere on lan/vga/gpib slot, who knows. Why not to check?

SPEAr flasher http://www.st.com/web/en/catalog/tools/PF257557 (http://www.st.com/web/en/catalog/tools/PF257557)

Thats sounds interesting. It suppose that it should be possible to acces such a pin without dissasembling the scope at least for service purpose, when the UART is not accessible.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on July 20, 2013, 08:43:05 pm
Thats sounds interesting. It suppose that it should be possible to acces such a pin without dissasembling the scope at least for service purpose, when the UART is not accessible.
I doubt it. Usually such complex systems are programmed once, probably with JTAG on the same connector with the UART signals for u-boot and then the other programming over network, then you do all service tasks over network or USB. Developers at Agilent might have bare boards or with an open case lying on their work desks anyway, with all internal connections accessible.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 20, 2013, 11:03:34 pm
The usb drive's root is seen as \usb folder in rootfs, so just add an \usb\ prefix to the path on usb drive
Folder Startup with file infiniivision.lnk which should contains "45#\usb\infiniiVision\infiniivisionLauncher.exe"

Thanks. That was the first thing I tried. Is there any output on the UART about this process? Any change I make from the default \Secure path results in a failure to boot. Without any error messages, I'm left to just guessing as to why.

I can only come up with three possibilities:

1) my installed firmware version 2.00 works differently (seems unlikely since I can indeed cause a boot failure by entering a wrong path or a successful boot by entering \Secure)

2) it doesn't like the filesystem on my flash drives (seems unlikely too since it reads them fine from the save/restore UI and I even tried formatting one from a real windows machine)

3) the installed firmware 2.00 doesn't want to load a different/newer firmware version 2.35 from USB (I don't yet know how the boot process flows but this also seems unlikely. I had the 2.00 firmware cab somewhere but I can't find it now to try it.)


Quote
OKI, and do you have any plan for mechanical construction?
Otherwise you can break the DSOX internal connector.

Not yet but if nothing else I'm pretty sure I can modify the existing plastic cover to support the rear of the PCB. I haven't really taken a close look yet. I use my scope often so I'm not in a hurry to take it down/apart until I'm actually ready to do this.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 20, 2013, 11:19:09 pm
benemorius,
try the same version as inside the scope (or update the scope). There are hardcoded paths to some data files in various places, there are dlls in windows folder (inside nk.bin.comp), so you are trying to start a mix of both versions actually
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on July 20, 2013, 11:28:12 pm
Thanks. That was the first thing I tried. Is there any output on the UART about this process? Any change I make from the default \Secure path results in a failure to boot. Without any error messages, I'm left to just guessing as to why.
No, the UART doesn't show much activity after booting. Maybe the DLLs are missing? I think it searches it in the same directory where the exe file is, and then in \windows, but not in \secure\infiniivision. The easiest way would be to write a cmd-file, which copies the \secure\infiniivision directory to the USB stick, if cmd files can be started with this concept too.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 20, 2013, 11:29:06 pm
benemorius,
try the same version as inside the scope (or update the scope). There are hardcoded paths to some data files in various places, there are dlls in windows folder (inside nk.bin.comp), so you are trying to start a mix of both versions actually
Ok thanks. That must be it. I didn't know if this method interrupted the boot process late enough for that to be possible or not. The firmware I need is probably on my desktop that I haven't unpacked yet since moving so it will have to wait until I have more time to play.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 20, 2013, 11:31:28 pm
The easiest way would be to write a cmd-file, which copies the \secure\infiniivision directory to the USB stick, if cmd files can be started with this concept too.
Hey, that's probably worth trying. :D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 21, 2013, 12:27:39 am
The easiest way would be to write a cmd-file, which copies the \secure\infiniivision directory to the USB stick, if cmd files can be started with this concept too.
Hey, that's probably worth trying. :D

The files are copying, but they aren't making it to the flash drive. (see below) I'd guess it's mounted read only and the writes are going to a ramdisk somewhere. I'm not nearly familiar enough with windows to have a clue as to how to get it mounted properly for writing.

Still, I do wonder what prevents me from using this to overwrite exe or dll files with modified ones now.

Code: [Select]
$cat copy.cmd
dir \ > \usb\root.txt
dir \Secure > \usb\secure.txt
dir \Secure\infiniiVision > \usb\infiniiVision.txt
md \zzz
copy "\Secure\infiniiVision\*" \usb\zzz 1> \usb\out.txt 2>\usb\error.txt
dir \usb\zzz >\usb\zzz.txt
Code: [Select]
$cat out.txt error.txt
Copied 10 file(s).
$ls -a zzz
. ..
$cat zzz.txt

    Directory of \usb\zzz

File not found.

    0 Dir(s) 357945344 bytes free


$cat root.txt

    Directory of \

01/01/98  12:00p    <DIR>              Network
01/01/98  12:00p    <DIR>              Agilent Flash
01/01/98  12:00p    <DIR>              usb
01/01/98  12:00p    <DIR>              Secure
10/29/11  07:03p    <DIR>              Application Data
10/29/11  07:03p    <DIR>              profiles
10/29/11  07:03p    <DIR>              Documents and Settings
10/29/11  07:03p                    23 Control Panel.lnk
10/29/11  07:03p    <DIR>              My Documents
10/29/11  07:03p    <DIR>              Program Files
10/29/11  07:03p    <DIR>              Temp
10/29/11  07:03p    <DIR>              Windows

    Found 12 file(s). Total size 23 bytes.
    1 Dir(s) 27090944 bytes free


$cat secure.txt

    Directory of \Secure

11/14/11  09:38a    <DIR>              infiniiVision
11/14/11  09:38a    <DIR>              Startup
11/14/11  09:38a    <DIR>              cal
11/14/11  09:38a    <DIR>              help
11/14/11  09:38a    <DIR>              bin
11/15/11  09:26a    <DIR>              System

    Found 6 file(s). Total size 0 bytes.
    1 Dir(s) 17625088 bytes free


$cat infiniiVision.txt

    Directory of \Secure\infiniiVision

11/14/11  09:38a    <DIR>              web
11/14/11  09:38a    <DIR>              fpga
10/10/07  07:45p                214552 mscorlib.dll
08/04/11  10:02p               1089536 Agilent.Cdf.Api.dll
03/07/11  01:57p                238080 OpenNETCF.dll
08/04/11  10:02p                  9728 WebPageData.dll
03/07/11  01:57p                398336 SetupConverter.exe
08/05/11  12:38p               1152032 splashImage.bin
10/13/11  04:49p                218624 vncserver.dll
10/13/11  04:55p              14748832 infiniiVisionCore.dll
10/13/11  04:49p                 11112 infiniiVisionLauncher.exe
10/13/11  04:49p                180224 infiniiVisionWebCom.dll

    Found 12 file(s). Total size 18261056 bytes.
    1 Dir(s) 17625088 bytes free


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on July 21, 2013, 01:30:26 am
I don't think the USB drive is write protected, because you can see the logs. "dir /s \" can be interesting too. Maybe update to the the latest firmware 2.35.

One problem in your script: "md \zzz" should be "md \usb\zzz", but I guess you have already created the directory. Also check that it's empty. Sometimes files are write protected in Windows, which you can change with "attrib -r filename" and which you can see with "attrib" (on a Windows machine). Maybe wait a bit longer if the USB drive needs more time to write the files. Windows should mount USB drives without caching, so usually no need to unmount it.

Writing to the \secure directory and subdirectories is possible too. And with the USB startup trick there is no danger to brick the scope, if you have made backups of the files first, because the scope resets, if the application crashes on start, and then it would go into an infinite reset loop. But with the startup file you can restore a non-working executable again.

You could test writing with something non-critical, like replacing the startup image:

Code: [Select]
copy \secure\infiniivision\splashImage.bin \secure\infiniivision\splashImage.bin.org
\windows\compileImageForSplashScreen \usb\yourimage.png \secure\infiniivision\splashImage.bin

yourimage.png works with 800x480 pixels, 24 bit color, no transparency.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 21, 2013, 02:32:13 am
I don't think the USB drive is write protected, because you can see the logs.
Doh! I didn't think that one through at all, did I? :palm:

Assuming I didn't make another gross error, what sort of foolery could cause this behavior of allowing the shell to write files but not the copy binary? I haven't come across any mechanism that could do this in unixland - at least nothing that would output "10 files successfully copied" rather than "permission error" or something.

Quote
One problem in your script: "md \zzz" should be "md \usb\zzz", but I guess you have already created the directory.
Whoops. You're right. I guess it was accidentally changed in one of the many iterations between the first try and the last one which I copied here. It must have been right at first because the directory has in fact been created.

Quote
Also check that it's empty. Sometimes files are write protected in Windows, which you can change with "attrib -r filename" and which you can see with "attrib" (on a Windows machine). Maybe wait a bit longer if the USB drive needs more time to write the files. Windows should mount USB drives without caching, so usually no need to unmount it.
It is indeed empty according to the filesystem. I haven't checked whether any file data was written but I believe a correct FAT implementation should create the file entry before writing any data so worst case should be a 0 byte file reported by the filesystem. I waited about 15 seconds after it should have finished but next time I'll wait longer just in case. I didn't expect a write cache to be enabled either.

Quote
Writing to the \secure directory and subdirectories is possible too. And with the USB startup trick there is no danger to brick the scope, if you have made backups of the files first, because the scope resets, if the application crashes on start, and then it would go into an infinite reset loop. But with the startup file you can restore a non-working executable again.

You could test writing with something non-critical, like replacing the startup image:

Code: [Select]
copy \secure\infiniivision\splashImage.bin \secure\infiniivision\splashImage.bin.org
\windows\compileImageForSplashScreen \usb\yourimage.png \secure\infiniivision\splashImage.bin

yourimage.png works with 800x480 pixels, 24 bit color, no transparency.
I'll test writing next time too and see what happens. I really need to get back to work right now though. I've been distracted long enough already.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 22, 2013, 03:17:51 am
Sigh... it wasn't Murphy this time. It was Heisenberg.

It would seem that the problem was a sort of programatical measurement problem. The copy command works just fine as long as you don't try to observe it. :palm:

functions as intended:
Code: [Select]
copy "\Secure\infiniiVision\*" \usb\zzz
does not function as intended; output in error.txt says it copied files, but they're nowhere to be found:
Code: [Select]
copy "\Secure\infiniiVision\*" \usb\zzz 1>\usb\out.txt 2>\usb\error.txt
As much as I'd like to figure out why, I've got better things to play around with now that I can finally upgrade my firmware.

Incidentally, sucking the firmware out this way and running it from USB worked just fine. :-+

Writing to flash is also uneventful. I haven't overwritten any system or application files yet other than the splashscreen but I'm sure it will work for any file not in use. The registry seems off-limits since windows seems to refuse to copy any file that's open and apparently there's no way around that. :-//

Here's the output of `dir /s /a \` (firmware 2.00)
I snipped out my license files because they're named by guid but they are indeed in that directory and yes you can back them up and reuse them. You just have to rename from *.xml to *.lic and copy the license guid from the filename and put it back in the xml where it belongs. None of the other differences matter. As far as I know, this is the only way to recover the license file for a license that came on the scope from the factory (like a bandwidth upgrade for example)
Code: [Select]

    Directory of \

01/01/98  12:00p    <DIR>              Network
01/01/98  12:00p    <DIR>              Agilent Flash
01/01/98  12:00p    <DIR>              usb
01/01/98  12:00p    <DIR>              Secure
10/30/11  03:35a    <DIR>              Recycled
10/30/11  03:35a    <DIR>              Application Data
10/30/11  03:35a    <DIR>              profiles
10/30/11  03:35a    <DIR>              Documents and Settings
10/30/11  03:35a                    23 Control Panel.lnk
10/30/11  03:35a    <DIR>              My Documents
10/30/11  03:35a    <DIR>              Program Files
10/30/11  03:35a    <DIR>              Temp
10/30/11  03:35a    <DIR>              Windows

    Found 13 file(s). Total size 23 bytes.

    Directory of \Agilent Flash

10/30/11  01:47a    <DIR>              tmp
10/30/11  01:47a    <DIR>              wfmMem
10/30/11  01:47a    <DIR>              setups
10/30/11  01:47a    <DIR>              config
10/30/11  01:47a    <DIR>              data
10/30/11  01:47a    <DIR>              masks
10/30/11  01:47a    <DIR>              arb
10/30/11  03:30a    <DIR>              webupdate
10/30/11  01:47a    <DIR>              LxiMdns

    Found 9 file(s). Total size 0 bytes.

    Directory of \Agilent Flash\setups

10/30/11  01:47a                     0 setup_0.scp
10/30/11  01:47a                     0 setup_1.scp
10/30/11  01:47a                     0 setup_2.scp
10/30/11  01:47a                     0 setup_3.scp
10/30/11  01:47a                     0 setup_4.scp
10/30/11  01:47a                     0 setup_5.scp
10/30/11  01:47a                     0 setup_6.scp
10/30/11  01:47a                     0 setup_7.scp
10/30/11  01:47a                     0 setup_8.scp
10/30/11  01:47a                     0 setup_9.scp

    Found 10 file(s). Total size 0 bytes.

    Directory of \Agilent Flash\config

10/30/11  01:47a                   418 labelList.txt
10/30/11  03:30a                155537 setup.scp

    Found 2 file(s). Total size 155955 bytes.

    Directory of \Agilent Flash\masks

10/30/11  01:47a                     0 mask_0.msk
10/30/11  01:47a                     0 mask_1.msk
10/30/11  01:47a                     0 mask_2.msk
10/30/11  01:47a                     0 mask_3.msk

    Found 4 file(s). Total size 0 bytes.

    Directory of \Agilent Flash\arb

10/30/11  01:47a                     0 arb_0.csv
10/30/11  01:47a                     0 arb_1.csv
10/30/11  01:47a                     0 arb_2.csv
10/30/11  01:47a                     0 arb_3.csv

    Found 4 file(s). Total size 0 bytes.

    Directory of \Secure

11/14/11  09:38a    <DIR>              infiniiVision
11/14/11  09:38a    <DIR>              Startup
11/14/11  09:38a    <DIR>              cal
11/14/11  09:38a    <DIR>              help
11/14/11  09:38a    <DIR>              bin
11/15/11  09:26a    <DIR>              System

    Found 6 file(s). Total size 0 bytes.

    Directory of \Secure\infiniiVision

11/14/11  09:38a    <DIR>              web
11/14/11  09:38a    <DIR>              fpga
10/10/07  07:45p                214552 mscorlib.dll
08/04/11  10:02p               1089536 Agilent.Cdf.Api.dll
03/07/11  01:57p                238080 OpenNETCF.dll
08/04/11  10:02p                  9728 WebPageData.dll
03/07/11  01:57p                398336 SetupConverter.exe
08/05/11  12:38p               1152032 splashImage.bin
10/13/11  04:49p                218624 vncserver.dll
10/13/11  04:55p              14748832 infiniiVisionCore.dll
10/13/11  04:49p                 11112 infiniiVisionLauncher.exe
10/13/11  04:49p                180224 infiniiVisionWebCom.dll

    Found 12 file(s). Total size 18261056 bytes.

    Directory of \Secure\infiniiVision\web

11/14/11  09:38a    <DIR>              Lxi
11/14/11  09:38a    <DIR>              help
11/14/11  09:38a    <DIR>              image
11/14/11  09:38a    <DIR>              lib
11/14/11  09:38a    <DIR>              navbar
03/07/11  02:10p                   222 ClickFix.js
09/30/11  03:22a                  1797 CookieUtils.js
10/10/11  10:02p                349976 InfiniiVision_Quick_Reference.html
09/08/11  10:07p                 19999 appletInstall.jar
04/27/11  10:02p                 26521 appletScpi.jar
07/30/11  10:01p                915251 appletVnc.jar
04/27/11  10:03p                   465 appletsVersion.asp
03/07/11  02:10p                  1472 constant.asp
03/07/11  02:10p                  4117 doModifyConfig.asp
03/07/11  02:10p                  3900 doSave.asp
08/28/11  11:39p                  4084 download.asp
08/18/11  10:01p                   269 enumConst.asp
09/30/11  03:22a                  3635 getImage.asp
03/07/11  02:10p                  1413 home.html
03/07/11  02:10p                   840 homeBottom.asp
03/07/11  02:10p                  3539 homeMiddle.asp
03/07/11  02:10p                 12275 homeTop.asp
06/27/11  10:02p                  1156 index.asp
03/07/11  02:10p                  2975 infoCal.asp
03/07/11  02:10p                  3747 infoLicense.asp
03/07/11  02:10p                  4144 infoNav.html
04/27/11  10:02p                  9940 infoVersion.asp
03/07/11  02:10p                   781 information.html
03/07/11  02:10p                  1175 lanInfo.asp
03/07/11  02:10p                 30473 modifyConfig.asp
03/07/11  02:10p                 25393 navigation.asp
03/07/11  02:10p                  8858 networkStatus.asp
06/16/11  10:02p                  5154 pwdPrompt.asp
06/15/11  11:37a                  3287 pwdVerify.asp
10/05/11  11:35p                  9268 recall.asp
06/15/11  11:37a                  4516 remoteApplet.asp
05/26/11  10:05p                 18473 remoteFrontPanel.asp
09/12/11  10:53a                 12763 remoteSCPICommands.asp
08/18/11  10:01p                 26044 save.asp
06/15/11  11:37a                  1206 saveFrame.asp
10/05/11  11:35p                  4387 saveRecall.asp
03/07/11  02:10p                  2138 scopeInfo.asp
03/07/11  02:10p                  4137 style.css
04/27/11  10:03p                  2347 toolbarHelp.asp
03/07/11  02:10p                  2769 top.asp
04/27/11  10:03p                  1067 utils.js
03/07/11  02:10p                 11491 viewConfig.asp

    Found 47 file(s). Total size 1547464 bytes.

    Directory of \Secure\infiniiVision\web\Lxi

11/14/11  09:38a    <DIR>              Identification

    Found 1 file(s). Total size 0 bytes.

    Directory of \Secure\infiniiVision\web\Lxi\Identification

03/07/11  02:10p                   710 Default.asp
03/07/11  02:10p                 12270 LXIIdentification.xsd

    Found 2 file(s). Total size 12980 bytes.

    Directory of \Secure\infiniiVision\web\help

03/07/11  02:10p                  1308 helpBrowserWebControl.asp
03/07/11  02:10p                  1460 helpGetImage.asp
03/07/11  02:10p                  4666 helpHome.asp
03/07/11  02:10p                  6869 helpHomeAdv.asp
03/07/11  02:10p                  1216 helpInfoCal.html
03/07/11  02:10p                  1359 helpInfoOptions.html
03/07/11  02:10p                  1713 helpInfoVersion.asp
03/07/11  02:10p                  7834 helpModifyConfig.asp
03/07/11  02:10p                  2740 helpNav.asp
03/07/11  02:10p                  1337 helpRecall.asp
03/07/11  02:10p                  5275 helpRemoteFrontPanel.asp
03/07/11  02:10p                  1299 helpRemoteSCPICommands.asp
03/07/11  02:10p                  1242 helpSave.asp
03/07/11  02:10p                  1290 helpSaveRecall.asp
03/07/11  02:10p                  1213 helpStyle.css
03/07/11  02:10p                   102 helpVar.asp
03/07/11  02:10p                  8319 helpViewConfig.asp

    Found 17 file(s). Total size 49242 bytes.

    Directory of \Secure\infiniiVision\web\image

03/07/11  02:10p                  2192 agilent.gif
03/07/11  02:10p                   892 down-over.gif
03/07/11  02:10p                   892 down.gif
03/07/11  02:10p                    43 filltrans.gif
03/07/11  02:10p                  1581 instrumentBanner.gif
03/07/11  02:10p                 25781 instrumentImage.jpg
03/07/11  02:10p                  1064 keyboard.gif
03/07/11  02:10p                    94 line-heading.gif
03/07/11  02:10p                  2576 lxi.jpg
03/07/11  02:10p                 26492 m2XX2A.jpg
03/07/11  02:10p                 28410 m2XX4A.jpg
03/07/11  02:10p                 27057 m3XX2A.jpg
03/07/11  02:10p                 29031 m3XX4A.jpg
03/07/11  02:10p                  6716 popupMenu.jpg
03/07/11  02:10p                  4062 popupMenu_wvga.jpg
03/07/11  02:10p                  3850 softkey.jpg
03/07/11  02:10p                  2558 softkey_wvga.jpg
03/07/11  02:10p                   893 up-over.gif
03/07/11  02:10p                   893 up.gif
03/07/11  02:10p                  1535 web-enable.gif

    Found 20 file(s). Total size 166612 bytes.

    Directory of \Secure\infiniiVision\web\lib

03/07/11  02:10p                176653 edtftpj.jar
03/07/11  02:10p               1897479 plugin.jar

    Found 2 file(s). Total size 2074132 bytes.

    Directory of \Secure\infiniiVision\web\navbar

03/07/11  02:10p                405062 PantherTabs.psd
03/07/11  02:10p                    48 bluebar.gif
03/07/11  02:10p                  1455 config-down.gif
03/07/11  02:10p                  1881 config-over.gif
03/07/11  02:10p                  1862 config.gif
03/07/11  02:10p                  1430 help-down.gif
03/07/11  02:10p                  1858 help-over.gif
03/07/11  02:10p                  1834 help.gif
03/07/11  02:10p                  1425 image-down.gif
03/07/11  02:10p                  1894 image-over.gif
03/07/11  02:10p                  1856 image.gif
03/07/11  02:10p                  1663 printpage-down.gif
03/07/11  02:10p                  2132 printpage-over.gif
03/07/11  02:10p                  2110 printpage.gif
03/07/11  02:10p                  1450 remote-down.gif
03/07/11  02:10p                  1861 remote-only.gif
03/07/11  02:10p                  1899 remote-over.gif
03/07/11  02:10p                  1453 saverecall-down.gif
03/07/11  02:10p                  1910 saverecall-over.gif
03/07/11  02:10p                  1885 saverecall.gif
03/07/11  02:10p                  1541 status-down.gif
03/07/11  02:10p                  1964 status-over.gif
03/07/11  02:10p                  1972 status.gif
03/07/11  02:10p                  1446 utilities-down.gif
03/07/11  02:10p                  1910 utilities-over.gif
03/07/11  02:10p                  1858 utilities.gif
03/07/11  02:10p                  1453 welcome-down.gif
03/07/11  02:10p                  1924 welcome-over.gif
03/07/11  02:10p                  1865 welcome.gif

    Found 29 file(s). Total size 452901 bytes.

    Directory of \Secure\infiniiVision\fpga

08/29/11  09:50p                283776 FPGA2000A.bin
08/29/11  09:50p                480148 FPGA3000A.bin
06/10/10  07:46a                 72668 gpibFPGA.bin
10/24/10  09:51p                 72668 lanFPGA.bin

    Found 4 file(s). Total size 909260 bytes.

    Directory of \Secure\Startup

11/15/11  09:26a                    53 infiniivision.lnk

    Found 1 file(s). Total size 53 bytes.

    Directory of \Secure\cal

11/15/11  09:31a                    76 sernum.dat
11/15/11  08:22a                 27244 framecal.dat
11/15/11  08:22a                 75031 callog.txt
11/15/11  08:22a                   772 factorycal.dat

    Found 4 file(s). Total size 103123 bytes.

    Directory of \Secure\System

11/15/11  09:26a    <DIR>              Licensing

    Found 1 file(s). Total size 0 bytes.

    Directory of \Secure\System\Licensing

11/15/11  09:26a    <DIR>              Store

    Found 1 file(s). Total size 0 bytes.

    Directory of \Secure\System\Licensing\Store

<*snip*>

    Found 14 file(s). Total size 8167 bytes.

    Directory of \Application Data

09/07/06  10:00a                    69 desktop.ini

    Found 1 file(s). Total size 69 bytes.

    Directory of \profiles

10/30/11  03:35a    <DIR>              default

    Found 1 file(s). Total size 0 bytes.

    Directory of \Documents and Settings

10/30/11  03:35a                 53248 default.vol

    Found 1 file(s). Total size 53248 bytes.

    Directory of \My Documents

09/07/06  10:00a                    69 desktop.ini

    Found 1 file(s). Total size 69 bytes.

    Directory of \Program Files

09/07/06  10:00a                    69 desktop.ini
10/30/11  03:35a    <DIR>              Agilent
10/30/11  03:35a                    19 Command Prompt.lnk

    Found 3 file(s). Total size 88 bytes.

    Directory of \Program Files\Agilent

10/30/11  03:35a    <DIR>              IO Libraries Suite

    Found 1 file(s). Total size 0 bytes.

    Directory of \Program Files\Agilent\IO Libraries Suite

10/30/11  03:35a    <DIR>              bin
10/30/11  03:35a    <DIR>              Drivers

    Found 2 file(s). Total size 0 bytes.

    Directory of \Program Files\Agilent\IO Libraries Suite\bin

10/30/11  03:35a                 13312 portmap.exe

    Found 1 file(s). Total size 13312 bytes.

    Directory of \Program Files\Agilent\IO Libraries Suite\Drivers

10/30/11  03:35a                102400 AgilentLan488Server32.dll

    Found 1 file(s). Total size 102400 bytes.

    Directory of \Windows

10/30/11  03:35a                   206 FTPD.tmp
10/30/11  03:35a    <DIR>              StartUp
10/30/11  03:35a    <DIR>              Fonts
10/30/11  03:35a    <DIR>              Favorites
10/30/11  03:35a                    52 System.mky
10/30/11  03:35a                   276 SystemLog.xml
10/30/11  03:35a                     0 ApplicationLog.xml
10/30/11  03:35a                    52 default.mky
10/30/11  03:35a                     0 initobj.dat
10/30/11  03:35a    <DIR>              Recent
10/30/11  03:35a    <DIR>              Programs
10/30/11  03:35a    <DIR>              Desktop
10/30/11  03:35a    <DIR>              www
10/13/11  11:34p                 61440 nk.exe
10/13/11  11:19p                246784 kernel.dll
10/13/11  11:36p                643072 coredll.dll
10/13/11  11:34p                  4096 oalioctl.dll
10/13/11  11:36p                640000 k.coredll.dll
10/13/11  11:20p                 59392 fpcrt.dll
10/13/11  11:20p                 59392 k.fpcrt.dll
10/13/11  11:36p                244736 filesys.dll
10/13/11  11:21p                 10240 romfsd.dll
10/13/11  11:36p                676864 gwes.dll
10/13/11  11:21p                209920 mgtt_o.dll
10/13/11  11:21p                  4096 device.dll
10/13/11  11:21p                 14336 udevice.exe
10/13/11  11:21p                 63488 devmgr.dll
10/13/11  11:21p                  7168 regenum.dll
10/13/11  11:21p                 14336 busenum.dll
10/13/11  11:21p                 48128 pm.dll
10/13/11  11:20p                 14848 servicesEnum.dll
10/13/11  11:20p                 28160 servicesd.exe
10/13/11  11:36p                 11264 services.exe
10/13/11  11:20p                  4096 servicesStart.exe
10/13/11  11:20p                 37888 notify.dll
10/13/11  11:21p                 90112 exfat.dll
10/13/11  11:21p                 11776 diskcache.dll
10/13/11  11:36p                 54784 fatutil.dll
10/13/11  11:36p                 54784 k.fatutil.dll
10/13/11  11:20p                 55808 shell.exe
10/13/11  11:20p                 10752 shellcelog.dll
10/13/11  11:20p                  7168 toolhelp.dll
10/13/11  11:20p                  7168 k.toolhelp.dll
10/13/11  11:21p                 38912 zlib.dll
10/13/11  11:36p                 38912 console.dll
10/13/11  11:36p                 70144 cmd.exe
10/13/11  11:36p                 12288 net.exe
10/13/11  11:36p                388096 commctrl.dll
10/13/11  11:36p                 88576 commdlg.dll
10/13/11  11:20p                  9728 prnport.dll
10/13/11  11:20p                  9728 k.prnport.dll
10/13/11  11:36p                  5120 prnerr.dll
10/13/11  11:36p                  5120 k.prnerr.dll
10/13/11  11:20p                 15872 pcl.dll
10/13/11  11:20p                 15872 k.pcl.dll
10/13/11  11:20p                131584 fsdmgr.dll
10/13/11  11:21p                 21504 mspart.dll
10/13/11  11:20p                 23552 ceddk.dll
10/13/11  11:20p                 23552 k.ceddk.dll
10/13/11  11:36p                  4608 netmui.dll
10/13/11  11:20p                 22016 cxport.dll
10/13/11  11:20p                 55296 iphlpapi.dll
10/13/11  11:20p                 55296 k.iphlpapi.dll
10/13/11  11:20p                 39424 ws2.dll
10/13/11  11:20p                 39424 k.ws2.dll
10/13/11  11:20p                  9216 ws2instl.dll
10/13/11  11:20p                  9216 wspm.dll
10/13/11  11:20p                  9216 k.wspm.dll
10/13/11  11:20p                 10752 nspm.dll
10/13/11  11:20p                 10752 k.nspm.dll
10/13/11  11:20p                 52736 ws2k.dll
10/13/11  11:20p                 33792 ws2serv.dll
10/13/11  11:20p                 32256 ssllsp.dll
10/13/11  11:20p                 32256 k.ssllsp.dll
10/13/11  11:20p                 97280 schannel.dll
10/13/11  11:20p                 97280 k.schannel.dll
10/13/11  11:20p                 56320 credsvc.dll
10/13/11  11:20p                 40448 ipseccfg.exe
10/13/11  11:20p                132608 afd.dll
10/13/11  11:20p                  4608 dnsapi.dll
10/13/11  11:20p                  4608 k.dnsapi.dll
10/13/11  11:20p                 13824 netapi32.dll
10/13/11  11:20p                135168 ndis.dll
10/13/11  11:36p                215552 netui.dll
10/13/11  11:20p                 22528 ndisuio.dll
10/13/11  11:20p                 29184 dhcp.dll
10/13/11  11:20p                335360 tcpstk.dll
10/13/11  11:20p                152576 redir.dll
10/13/11  11:20p                 39936 netbios.dll



<*continued in next post due to 20k character forum post limit*>

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 22, 2013, 03:20:40 am
Code: [Select]
<*continued from last post due to 20k character forum post limit*>

10/13/11  11:20p                163840 wldap32.dll
10/13/11  11:20p                 27136 lpcd.dll
10/13/11  11:20p                  6656 lpcrt.dll
10/13/11  11:20p                 13824 ping.exe
10/13/11  11:20p                 14848 ipconfig.exe
10/13/11  11:20p                 11264 ndisconfig.exe
10/13/11  11:20p                 14848 route.exe
10/13/11  11:20p                 21504 netstat.exe
10/13/11  11:20p                 11776 tracert.exe
10/13/11  11:21p                 29184 serial.dll
10/13/11  11:21p                 25088 usbd.dll
10/13/11  11:21p                 18944 usbhid.dll
10/13/11  11:34p                 20992 usbmsc.dll
10/13/11  11:34p                 21504 usbdisk6.dll
10/13/11  11:21p                 14848 usbprn.dll
10/13/11  11:21p                 29184 hidparse.dll
10/13/11  11:21p                  9216 kbdhid.dll
10/13/11  11:21p                  5120 conshid.dll
10/13/11  11:36p                  6144 MouHid.dll
10/13/11  11:21p                  7168 mmtimer.dll
10/13/11  11:21p                  7168 k.mmtimer.dll
10/13/11  11:36p                 34816 eventlog.dll
10/13/11  11:36p                  6144 eventlogMsgs.dll
10/13/11  11:21p                  4608 uiproxy.dll
10/13/11  11:20p                 12800 secur32.dll
10/13/11  11:20p                 12800 k.secur32.dll
10/13/11  11:20p                194560 kerberos.dll
10/13/11  11:20p                194560 k.kerberos.dll
10/13/11  11:20p                 44032 msasn1.dll
10/13/11  11:20p                 44032 k.msasn1.dll
10/13/11  11:36p                278528 crypt32.dll
10/13/11  11:36p                278528 k.crypt32.dll
10/13/11  11:20p                 24576 cryptdll.dll
10/13/11  11:20p                 24576 k.cryptdll.dll
10/13/11  11:20p                  6656 winsock.dll
10/13/11  11:20p                  6656 k.winsock.dll
10/13/11  11:20p                  6144 credprov.dll
10/13/11  11:20p                 41472 spnego.dll
10/13/11  11:20p                 41472 k.spnego.dll
10/13/11  11:22p                478720 ole32.dll
10/13/11  11:22p                198144 oleaut32.dll
10/13/11  11:22p                 99328 dcomssd.dll
10/13/11  11:22p                  8704 dllhost.exe
10/13/11  11:22p                327168 rpcrt4.dll
10/13/11  11:22p                355840 imaging.dll
10/13/11  11:36p                142848 mlang.dll
10/13/11  11:36p                136192 shlwapi.dll
10/13/11  11:36p                 12800 IECEExt.dll
10/13/11  11:23p                754176 msxml3.dll
10/13/11  11:22p                201728 shdocvw.dll
10/13/11  11:36p                486400 wininet.dll
10/13/11  11:23p                 19456 jsproxy.dll
10/13/11  11:36p                313856 urlmon.dll
10/13/11  11:36p                342528 vbscript.dll
10/13/11  11:36p                103424 httpd.dll
10/13/11  11:36p                 78848 asp.dll
10/13/11  11:23p                 51712 httpdadm.dll
10/13/11  11:23p                 20992 telnetd.dll
10/13/11  11:23p                 50688 ftpd.dll
10/13/11  11:23p                 10240 timesvc.dll
10/13/11  11:36p                289792 ceshell.dll
10/13/11  11:36p                266240 explorer.exe
10/13/11  11:23p                 11264 shcore.dll
10/13/11  11:36p                 17408 control.exe
10/13/11  11:23p                  7680 ctlpnl.exe
10/13/11  11:36p                155136 cplmain.cpl
10/13/11  11:36p                 52224 intll.cpl
10/13/11  11:36p                 49152 wceldcmd.exe
10/13/11  11:23p                 12800 unldcmd.exe
10/10/07  11:58p                 67088 mscoree.dll
10/11/07  12:01a                945176 mscoree3_5.dll
10/11/07  12:02a                256536 netcfagl3_5.dll
10/11/07  12:02a                168480 netcfd3dm3_5.dll
10/10/07  11:56p                 22904 cgacutil.exe
10/13/11  11:34p                 45568 SH600_NandFlash.dll
10/13/11  11:34p                 12288 SH600_gpio.dll
10/13/11  11:34p                  9216 SH600_spi.dll
10/13/11  11:34p                  9728 SH600_i2c.dll
10/13/11  11:34p                  8192 SH600_ADC.dll
10/13/11  11:34p                 29184 P500_gmacndis.dll
10/13/11  11:35p                 73216 SH600_ehci.dll
10/13/11  11:34p                 57344 SH600_ohci.dll
10/13/11  11:35p                 74240 ehci.dll
10/13/11  11:35p                  4096 AgtFlashHelper.dll
10/13/11  11:34p                 45568 Ssh600_nandflash.dll
10/13/11  11:35p                 11776 p500_uboo.dll
10/13/11  11:35p                 36864 TMCP500_CE6_DeviceSideUsb.dll
10/13/11  11:35p                 13312 sh600_serial2.dll
10/13/11  11:35p                  6656 MapMemoryIntoUserSpace.dll
10/13/11  11:35p                  8704 GpibOverSPI_P500_CE6.dll
10/13/11  11:35p                223232 baldwin_ddi.dll
10/13/11  11:35p                126976 loadP500Flash.exe
10/13/11  11:35p                 11776 ubootEnvironment.dll
10/13/11  11:35p                  8192 ProcessStartupFolder.exe
10/13/11  11:35p                 14336 CeCreateUserAccounts.exe
10/13/11  11:35p                 36864 ConfigureNetworkNative.exe
10/13/11  11:35p                  7168 processMgr.exe
10/13/11  11:35p                  3584 rebootInfiniiVision.exe
10/13/11  11:36p                  7168 regsvr32.exe
10/13/11  11:36p                 37888 infiniiVisionInstallHelper.exe
10/13/11  11:36p                129536 infiniiVisionInstallService.exe
10/13/11  11:36p                 36352 libmspack.dll
10/13/11  11:36p                 24576 ubootTools.exe
10/13/11  11:36p                 10240 compileImageForSplashScreen.exe
10/13/11  11:16p                188416 eGalaxTouch.exe
10/13/11  11:16p                100352 DrawTest.exe
10/13/11  11:16p                 93696 Calbration.exe
10/13/11  11:16p                 88064 UpdateEEPROM.exe
10/13/11  11:16p                 17920 USBTouch.dll
10/13/11  11:19p                 19167 ceconfig.h
10/13/11  11:36p                208590 wince.nls
10/13/11  11:36p                170825 default.fdf
10/13/11  11:36p                  8763 initdb.ini
09/07/06  10:00a                   134 close.2bp
09/07/06  10:00a                   134 ok.2bp
09/07/06  10:00a                  1030 stdsm.2bp
09/07/06  10:00a                   838 viewsm.2bp
09/07/06  10:00a                  2038 stdsm.bmp
09/07/06  10:00a                  1654 viewsm.bmp
09/07/06  10:00a                176120 rsaenh.dll
09/07/06  10:00a                  8779 sysroots.p7b
10/13/11  11:20p                 50688 ntlmssp.dll
10/13/11  11:20p                 79360 ntlmssp_svc.dll
09/07/06  10:00a                289940 arialbd.ttf
09/07/06  10:00a                228180 arialbi.ttf
09/07/06  10:00a                209248 ariali.ttf
09/07/06  10:00a                118868 arialk.ttf
09/07/06  10:00a                160724 arial.ttf
09/07/06  10:00a                169464 cour.ttf
09/07/06  10:00a                135848 tahoma.ttf
09/07/06  10:00a                   961 httpd_default.htm
09/07/06  10:00a                  1231 httpd-admin.htm
09/07/06  10:00a                  4035 httpd-home.htm
09/07/06  10:00a                  1710 httpd-logging.htm
09/07/06  10:00a                  3281 httpd-netint.htm
09/07/06  10:00a                  1816 httpd-newwebfinished.htm
09/07/06  10:00a                  1482 httpd-newwebsite.htm
09/07/06  10:00a                  3058 httpd-newwebvdirs.htm
09/07/06  10:00a                  1234 httpd-sites.htm
09/07/06  10:00a                  1385 httpd-ssl.htm
09/07/06  10:00a                  1292 httpd-users.htm
09/07/06  10:00a                  8470 httpd-vroot.htm
09/07/06  10:00a                  2811 httpd-vrootlist.htm
09/07/06  10:00a                  3587 httpd-website.htm
09/07/06  10:00a                  1728 httpd-i-authlevel.htm
09/07/06  10:00a                  2992 httpd-i-authoverview.htm
09/07/06  10:00a                  2313 httpd-i-authtypes.htm
09/07/06  10:00a                  2005 httpd-i-dirbrowse.htm
09/07/06  10:00a                  1972 httpd-i-home.htm
09/07/06  10:00a                  2069 httpd-i-logging.htm
09/07/06  10:00a                  2460 httpd-i-overview.htm
09/07/06  10:00a                  1030 httpd-i-permissions.htm
09/07/06  10:00a                  1772 httpd-i-setpaths.htm
09/07/06  10:00a                  1978 httpd-i-ssl.htm
09/07/06  10:00a                  2446 httpd-i-upload.htm
09/07/06  10:00a                  2570 httpd-i-userlists.htm
09/07/06  10:00a                  3601 httpd-i-vdirs.htm
09/07/06  10:00a                  1831 httpd-i-webadmin.htm
09/07/06  10:00a                  4908 httpd-i-website.htm
09/07/06  10:00a                    69 appdata.ini
09/07/06  10:00a                   144 desktopdirectory.ini
09/07/06  10:00a                    69 favorites.ini
09/07/06  10:00a                    69 fonts.ini
09/07/06  10:00a                    69 mydocuments.ini
09/07/06  10:00a                    69 programfiles.ini
09/07/06  10:00a                    69 programs.ini
09/07/06  10:00a                    69 recent.ini
09/07/06  10:00a                    69 startup.ini
09/07/06  10:00a                    24 explore.lnk
09/07/06  10:00a                 10786 WindowsCE.jpg
09/07/06  10:00a                    19 cmd.lnk
09/07/06  10:00a                    23 control.lnk
09/07/06  10:00a                   739 copyrts.txt
09/07/06  10:00a                  3116 asterisk.wav
09/07/06  10:00a                  3388 close.wav
09/07/06  10:00a                  2970 critical.wav
09/07/06  10:00a                  2682 default.wav
09/07/06  10:00a                  3946 empty.wav
09/07/06  10:00a                  9204 exclam.wav
09/07/06  10:00a                  5656 infbeg.wav
09/07/06  10:00a                  1778 infend.wav
09/07/06  10:00a                  2088 infintr.wav
09/07/06  10:00a                   834 menupop.wav
09/07/06  10:00a                   360 menusel.wav
09/07/06  10:00a                  3388 openprog.wav
09/07/06  10:00a                  1836 question.wav
09/07/06  10:00a                  8508 startup.wav
09/07/06  10:00a                  2712 windmax.wav
09/07/06  10:00a                  2866 windmin.wav
09/07/06  10:00a                  3388 recstart.wav
09/07/06  10:00a                  3388 recend.wav
10/10/07  11:45p                 16936 GAC_CustomMarshalers_v3_5_0_0_cneutral_1.dll
10/10/07  11:46p                349744 GAC_Microsoft.VisualBasic_v8_1_0_0_cneutral_1.dll
10/10/07  11:46p                 34360 GAC_Microsoft.WindowsCE.Forms_v3_5_0_0_cneutral_1.dll
10/10/07  11:46p                185920 GAC_Microsoft.WindowsMobile.DirectX_v3_5_0_0_cneutral_1.dll
10/10/07  11:45p                941592 GAC_mscorlib_v3_5_0_0_cneutral_1.dll
10/10/07  11:46p                709656 GAC_System.Data_v3_5_0_0_cneutral_1.dll
02/09/09  06:51a                527552 GAC_System_v3_5_0_0_cneutral_1.dll
10/10/07  11:45p                 60960 GAC_System.Drawing_v3_5_0_0_cneutral_1.dll
10/10/07  11:46p                 77352 GAC_System.Messaging_v3_5_0_0_cneutral_1.dll
10/10/07  11:46p                 20000 GAC_System.Net.IrDA_v3_5_0_0_cneutral_1.dll
10/10/07  11:45p                 67112 GAC_System.Web.Services_v3_5_0_0_cneutral_1.dll
10/10/07  11:46p                280112 GAC_System.Windows.Forms_v3_5_0_0_cneutral_1.dll
10/10/07  11:45p               1038360 GAC_System.Xml_v3_5_0_0_cneutral_1.dll
10/10/07  11:46p                 88088 GAC_System.Core_v3_5_0_0_cneutral_1.dll
10/10/07  11:46p                 35904 GAC_System.Data.DataSetExtensions_v3_5_0_0_cneutral_1.dll
10/10/07  11:45p                 42048 GAC_System.Runtime.Serialization_v3_5_0_0_cneutral_1.dll
10/10/07  11:45p                474152 GAC_System.ServiceModel_v3_5_0_0_cneutral_1.dll
10/10/07  11:46p                 92704 GAC_System.Xml.Linq_v3_5_0_0_cneutral_1.dll
10/10/07  11:46p                345112 GAC_System.SR_v3_5_0_0_cneutral_1.dll
10/10/07  11:47p                 63032 GAC_Microsoft.VisualBasic.SR_v8_1_0_0_cneutral_1.dll
10/13/11  11:34p                178176 SH600_ddi.dll
10/13/11  11:21p                 23040 kbdmouse.dll
06/16/11  11:56p                102400 AgilentLan488Server32.dll
06/16/11  11:56p                 44032 Agilent.Cdf.Core.Kernel.dll
06/16/11  11:57p                415744 Agilent.Cdf.Api.Unmanaged.dll
06/16/11  11:14p                169984 LxiMdnsResponder.dll
06/16/11  11:14p                 11560 LxiMdnsResponderLicense.txt
06/16/11  11:58p                 11776 Portability.dll
06/16/11  11:59p                 13312 portmap.exe
06/16/11  11:59p                147968 Sicl32.dll
06/16/11  11:59p                 81408 siclland.dll
06/16/11  11:59p                 82432 siclrpc.dll
06/17/11  12:12a                  9216 Agilent.Cdf.Core.Lxi.Web.ComServer.Interop.dll
06/16/11  11:14p                238080 OpenNETCF.dll
06/17/11  12:21a               1089536 Agilent.Cdf.Api.dll
06/17/11  12:21a                 36352 Agilent.Cdf.Api.Gui.dll
06/16/11  11:19p                  9099 PasswordFront.asp
06/16/11  11:19p                 31371 home.asp
06/16/11  11:19p                  2315 index.asp
06/16/11  11:19p                 41690 modify_config.asp
06/16/11  11:19p                  9677 navigation.asp
06/16/11  11:19p                  7905 password.asp
06/16/11  11:19p                  2268 top.asp
06/16/11  11:19p                 23463 view_config.asp
06/16/11  11:19p                   710 Default.asp
06/16/11  11:14p                 12270 LXIIdentification.xsd
06/16/11  11:19p                 38980 QualityLXI.jpg
06/16/11  11:19p                  1004 CookieUtils.js
06/16/11  11:19p                  2192 agilent.gif

<*holy crap... sorry... I should have just attached it*>
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 22, 2013, 03:21:25 am
Code: [Select]
<*holy crap... sorry... I should have just attached it*>

06/16/11  11:19p                   892 down-over.gif
06/16/11  11:19p                   892 down.gif
06/16/11  11:19p                    94 line-heading.gif
06/16/11  11:19p                  3417 lxi.jpg
06/16/11  11:19p                   893 up-over.gif
06/16/11  11:19p                   893 up.gif
06/16/11  11:19p                  1627 web-device.gif
06/16/11  11:19p                  1535 web-enable.gif
06/16/11  11:19p                    48 bluebar.gif
06/16/11  11:19p                  1095 config-down.gif
06/16/11  11:19p                  1068 config-over.gif
06/16/11  11:19p                  1064 config.gif
06/16/11  11:19p                   525 data-down.gif
06/16/11  11:19p                   519 data-over.gif
06/16/11  11:19p                   514 data.gif
06/16/11  11:19p                   650 help-down.gif
06/16/11  11:19p                   679 help-over.gif
06/16/11  11:19p                   666 help.gif
06/16/11  11:19p                   584 image-down.gif
06/16/11  11:19p                   583 image-over.gif
06/16/11  11:19p                   570 image.gif
06/16/11  11:19p                   920 remote-down.gif
06/16/11  11:19p                   907 remote-over.gif
06/16/11  11:19p                   895 remote.gif
06/16/11  11:19p                   620 welcome-down.gif
06/16/11  11:19p                   623 welcome-over.gif
06/16/11  11:19p                   614 welcome.gif
06/17/11  12:21a                  6144 AgilentLxiWebService.exe
06/16/11  11:55p                 70144 AgilentLxiWebComServer.exe
06/16/11  11:57p                 32256 Agilent.Cdf.Core.Lxi.Web.ComServer.ProxyStub.dll
06/16/11  11:57p                 58880 Agilent.Cdf.Core.Lxi.Web.ComServer.dll
06/17/11  12:21a                  6144 AgilentLxiWebStartup.exe
10/13/11  11:16p                    41 ConfigureNetwork.lnk
10/13/11  11:16p                    99 usbUpdateApp.bat
10/13/11  11:16p                    88 usbUpdateFpga.bat
10/13/11  11:36p                   177 infiniiVision.txt

    Found 365 file(s). Total size 26626785 bytes.

    Directory of \Windows\StartUp

09/07/06  10:00a                    69 desktop.ini

    Found 1 file(s). Total size 69 bytes.

    Directory of \Windows\Fonts

09/07/06  10:00a                    69 desktop.ini

    Found 1 file(s). Total size 69 bytes.

    Directory of \Windows\Favorites

09/07/06  10:00a                    69 desktop.ini

    Found 1 file(s). Total size 69 bytes.

    Directory of \Windows\Recent

09/07/06  10:00a                    69 desktop.ini

    Found 1 file(s). Total size 69 bytes.

    Directory of \Windows\Programs

09/07/06  10:00a                    69 desktop.ini
10/30/11  03:35a                    19 Command Prompt.lnk
10/30/11  03:35a                    24 Windows Explorer.lnk

    Found 3 file(s). Total size 112 bytes.

    Directory of \Windows\Desktop

09/07/06  10:00a                   144 desktop.ini

    Found 1 file(s). Total size 144 bytes.

    Directory of \Windows\www

10/30/11  03:35a                    58 current-httpd.log
10/30/11  03:35a    <DIR>              wwwpub

    Found 2 file(s). Total size 58 bytes.

    Directory of \Windows\www\wwwpub

10/30/11  03:35a                     0 ApplicationLog.txt
10/30/11  03:35a    <DIR>              navbar
10/30/11  03:35a    <DIR>              Lxi
10/30/11  03:35a    <DIR>              image
10/30/11  03:35a                  1004 CookieUtils.js
10/30/11  03:35a                 23463 view_config.asp
10/30/11  03:35a                  2268 top.asp
10/30/11  03:35a                  7905 password.asp
10/30/11  03:35a                  9677 navigation.asp
10/30/11  03:35a                 41690 modify_config.asp
10/30/11  03:35a                  2315 index.asp
10/30/11  03:35a                 31371 home.asp
10/30/11  03:35a                  9099 PasswordFront.asp
10/30/11  03:35a                   961 default.htm

    Found 14 file(s). Total size 129753 bytes.

    Directory of \Windows\www\wwwpub\navbar

10/30/11  03:35a                   614 welcome.gif
10/30/11  03:35a                   623 welcome-over.gif
10/30/11  03:35a                   620 welcome-down.gif
10/30/11  03:35a                   895 remote.gif
10/30/11  03:35a                   907 remote-over.gif
10/30/11  03:35a                   920 remote-down.gif
10/30/11  03:35a                   570 image.gif
10/30/11  03:35a                   583 image-over.gif
10/30/11  03:35a                   584 image-down.gif
10/30/11  03:35a                   666 help.gif
10/30/11  03:35a                   679 help-over.gif
10/30/11  03:35a                   650 help-down.gif
10/30/11  03:35a                   514 data.gif
10/30/11  03:35a                   519 data-over.gif
10/30/11  03:35a                   525 data-down.gif
10/30/11  03:35a                  1064 config.gif
10/30/11  03:35a                  1068 config-over.gif
10/30/11  03:35a                  1095 config-down.gif
10/30/11  03:35a                    48 bluebar.gif

    Found 19 file(s). Total size 13144 bytes.

    Directory of \Windows\www\wwwpub\Lxi

10/30/11  03:35a    <DIR>              Identification

    Found 1 file(s). Total size 0 bytes.

    Directory of \Windows\www\wwwpub\Lxi\Identification

10/30/11  03:35a                 12270 LXIIdentification.xsd
10/30/11  03:35a                   710 Default.asp

    Found 2 file(s). Total size 12980 bytes.

    Directory of \Windows\www\wwwpub\image

10/30/11  03:35a                  1535 web-enable.gif
10/30/11  03:35a                  1627 web-device.gif
10/30/11  03:35a                   893 up.gif
10/30/11  03:35a                   893 up-over.gif
10/30/11  03:35a                  3417 lxi.jpg
10/30/11  03:35a                    94 line-heading.gif
10/30/11  03:35a                   892 down.gif
10/30/11  03:35a                   892 down-over.gif
10/30/11  03:35a                  2192 agilent.gif
10/30/11  03:35a                 38980 QualityLXI.jpg

    Found 10 file(s). Total size 51415 bytes.

    Total Files Listed:
        1094 File(s) 102902884 bytes.
        81 Dir(s) 27090944 bytes free
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on July 22, 2013, 04:35:53 am
The registry seems off-limits since windows seems to refuse to copy any file that's open and apparently there's no way around that. :-//
Usually in WindowsCE systems the registry is part of the nk.bin image and can't be changed. It is loaded at boot time from flash in memory, like all the other programs in the \windows directory.
Quote
Here's the output of `dir /s /a \` (firmware 2.00)
Maybe not a good idea to post it all in this forum. You can still edit it: pastebin.com and then a link.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 22, 2013, 08:41:44 am
Yes, the registry is in default.fdf inside nk.bin, but there is no much interesting. "SecureStorage" component looks more promising, needs to be figured out
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on August 05, 2013, 04:34:55 pm
Benemorius, did you tryied change de splash screen?
did you get any results with yours tests?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sumino2000 on August 11, 2013, 01:18:52 pm
I only wish FrankBuss would elaborate on how to utilize that UART...

The serial port location:

http://i.imgur.com/yYMV75t.jpg (http://i.imgur.com/yYMV75t.jpg)

All you need are some jumper wires, if you don't want to drill a hole. Fits nicely through the USB connector hole 8)

http://i.imgur.com/9gnsuQh.jpg (http://i.imgur.com/9gnsuQh.jpg)

You can then stop the u-boot with space (can be difficult, you have to be fast, use something like HTerm which has a useful "repeat" function to send a sequence automatically until you stop it, or just hold down space while you boot it). Then you can boot the image from network like this:

Code: [Select]
set serverip 192.168.11.108
dhcp 0x4000000 nk.bin;bootm 0xf8050000

Where 192.168.11.108 is your own server, where TFTP is running and providing nk.bin. You should see something like this:

Code: [Select]
BOOTP broadcast 1
DHCP client bound to address 192.168.11.106
Using smsc device
TFTP from server 192.168.11.108; our IP address is 192.168.11.106
Filename 'nk.bin'.
Load address: 0x4000000
Loading: **#################################################################
#################################################################
...

You get the nk.bin from the nk.bin.comp from the firmware update cab-file with the bincompress.exe tool, which is included in the evaluation version of the WindowsCE development environment. Use http://www.t-hack.com/wiki/index.php/NK.BIN_toolset (http://www.t-hack.com/wiki/index.php/NK.BIN_toolset) to take a look at the content of nk.bin and to modify it.


Hi, here is info if someone want to make a NAND dump with JTAG debugger:

To Enable JTAG, you need this SPEAr600 TEST[2:0] pin configuration:
TEST_0=1, TEST_1=1, TEST_2=0

With debugger I did 128MB dump from NAND:

0000:0000-005F:FFFF  empty, just 0xFF
0060:0000-00C0:9F61  NK.BIN.COMP, size 12623714 bytes (FW 02.20)

02C2:0000- ????      Other data/files


Now we have NAND dump and need to:
1) hack MD5/RSA file consistency check to enable another files to modify
2) hack RSACryptoServiceProvider::VerifyData() or function which use it (AGILEN~1.003)
With Uboot write modificaton into NAND. Then just install licenses with any signature :-)

Now I'm not able to find MD5/RSA file consistency check. Please help.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on August 11, 2013, 06:48:22 pm
There is no file consistency check afaik. There is no need to use jtag also, just use the infiniivisionstartupoverride.txt method desribed in previous posts and you'll be able to run a patched scope app from usb flash drive whithout opening the case. There is more that enough info posted in this thread already, just nobody wants to post that final "here is .zip, unpack it to usb flash and use"  ;)
Funny situation - dissecting Rigol and Hantek in public is ok, but Agilent's name invokes some kind of shame (or fear?) )))
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on August 11, 2013, 07:36:54 pm
I guess the difference might be that the Hantek and Rigol hacks are just for bandwidth upgrade, all the other features are already included, so it is nice to have it, but most of the time not that important.

Agilent wants even for the voltmeter license EUR 61. And just the RS232/UART decoding license costs EUR 642. You want I2C/SPI, too? Another EUR 642. The sum of all available licenses might be more than EUR 10,000. And there might be people who considers to buy one or more licenses, like I did with the network license. So could be a big loss for Agilent, if there would be a public hack. Which makes it more dangerous to publish such a hack and which might even have negative consequences for Agilent: less money for Agilent means that they have less money for developing more good scopes.

So in my opinion, hack it for fun if you are a hobbyist and if you wouldn't buy one of the expensive licenses anyway, but don't publish the hack.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on August 12, 2013, 03:52:59 pm
There is no file consistency check afaik. There is no need to use jtag also, just use the infiniivisionstartupoverride.txt method desribed in previous posts and you'll be able to run a patched scope app from usb flash drive whithout opening the case. There is more that enough info posted in this thread already, just nobody wants to post that final "here is .zip, unpack it to usb flash and use"  ;)
Funny situation - dissecting Rigol and Hantek in public is ok, but Agilent's name invokes some kind of shame (or fear?) )))

Few reasons:
1. There is security risk when we publish it.
2. Agilent and their engineers are really helpful when I need real assistence.
3. On this forum were hack offered for $$$, so it is under supervision for sure.
4. This thread is in the top when you Google "Agilent DSOX hack".
5. Hack will double or triple the price of hardware.




Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on August 12, 2013, 06:59:39 pm
There is no file consistency check afaik. There is no need to use jtag also, just use the infiniivisionstartupoverride.txt method desribed in previous posts and you'll be able to run a patched scope app from usb flash drive whithout opening the case. There is more that enough info posted in this thread already, just nobody wants to post that final "here is .zip, unpack it to usb flash and use"  ;)
Funny situation - dissecting Rigol and Hantek in public is ok, but Agilent's name invokes some kind of shame (or fear?) )))

Few reasons:
1. There is security risk when we publish it.
2. Agilent and their engineers are really helpful when I need real assistence.
3. On this forum were hack offered for $$$, so it is under supervision for sure.
4. This thread is in the top when you Google "Agilent DSOX hack".
5. Hack will double or triple the price of hardware.
lol you think making a hack public will double or triple the hardware price?! Are you serious? So I guess all the other scopes/phones/tablets/games/consoles/computers/EVERYTHING ELECTRONIC have all doubled and tripled in price right? Since they have ALL been hacked since there was something to hack! Man, guess Ill be paying $599 for my $299 iPhone next time I upgrade since they jailbroke it.

And to you other "statements"

1) Nope, no security risk here, my scope is just as safe and secure as it was. Are you thinking that if the hack got out to the public that some malicious person might write a "virus" for my scope? Well who's to say I trust that the individuals on this site trying to sell me a hack arent going to do the same thing?! Or that they messed up somewhere and they made a mistake that hasnt been found and it might brick my scope?! This is why its better to let everyone look at your work if youre going to do this sort of thing.

2) Yes, they still are and always will be. They are paid to be so. They want to keep selling products. 99.9999% of the owners of electronic devices never hack or mod them anyway.

3) Most feel its insulting to reverse engineer some other work and then try and charge for it. I would never pay to jailbreak my iPhone or mod my Wii for example.

4) So?

5) You have to be kidding me... Already responded to this in the beginning of this post.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on August 12, 2013, 11:18:14 pm
There is no file consistency check afaik. There is no need to use jtag also, just use the infiniivisionstartupoverride.txt method desribed in previous posts and you'll be able to run a patched scope app from usb flash drive whithout opening the case. There is more that enough info posted in this thread already, just nobody wants to post that final "here is .zip, unpack it to usb flash and use"  ;)
Funny situation - dissecting Rigol and Hantek in public is ok, but Agilent's name invokes some kind of shame (or fear?) )))

Few reasons:
1. There is security risk when we publish it.
2. Agilent and their engineers are really helpful when I need real assistence.
3. On this forum were hack offered for $$$, so it is under supervision for sure.
4. This thread is in the top when you Google "Agilent DSOX hack".
5. Hack will double or triple the price of hardware.
lol you think making a hack public will double or triple the hardware price?! Are you serious? So I guess all the other scopes/phones/tablets/games/consoles/computers/EVERYTHING ELECTRONIC have all doubled and tripled in price right? Since they have ALL been hacked since there was something to hack! Man, guess Ill be paying $599 for my $299 iPhone next time I upgrade since they jailbroke it.

And to you other "statements"

1) Nope, no security risk here, my scope is just as safe and secure as it was. Are you thinking that if the hack got out to the public that some malicious person might write a "virus" for my scope? Well who's to say I trust that the individuals on this site trying to sell me a hack arent going to do the same thing?! Or that they messed up somewhere and they made a mistake that hasnt been found and it might brick my scope?! This is why its better to let everyone look at your work if youre going to do this sort of thing.

2) Yes, they still are and always will be. They are paid to be so. They want to keep selling products. 99.9999% of the owners of electronic devices never hack or mod them anyway.

3) Most feel its insulting to reverse engineer some other work and then try and charge for it. I would never pay to jailbreak my iPhone or mod my Wii for example.

4) So?

5) You have to be kidding me... Already responded to this in the beginning of this post.

My opinion, my rulezz... You can try to hack it by yourself and publish it ;-) I will never do that, for the reason above. Every year I spent more than 25k USD for various test equipment. When I really need for business I will buy it.
I posted in this thread lot of tricks which will be quite useful, thats all.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: KTP on August 13, 2013, 02:05:14 am
Bragging about a hack and then refusing to give out information does make you look like a bit of a douche...

But then so does spelling rules with a z...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on August 13, 2013, 03:49:17 am
Read whole thread....
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on August 13, 2013, 04:01:13 am
Benemorius, did you tryied change de splash screen?
did you get any results with yours tests?

Yes, changing the splash screen worked.

I did not attempt to overwrite any .exe or .dll files but I see no reason to doubt that it will work too. Running the firmware from USB is slower (longer boot time and occasional menu lag) and you have to remember not to pull the flash drive or else it crashes, but otherwise it works about like normal. I'm happy enough with that that I'd rather not overwrite any other files until I have NAND access, despite all indications being that there's nothing to worry about really.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on August 13, 2013, 04:24:17 am
Yes, changing the splash screen worked.

Nice, maybe you can provide a zip file with the USB flash drive content and attach it here? It will be small with a simple monochrome image as an example. Then that crazy aussie bloke and others can just replace the splash screen with their favorite image, if they want to.

Quote
I did not attempt to overwrite any .exe or .dll files but I see no reason to doubt that it will work too. Running the firmware from USB is slower (longer boot time and occasional menu lag) and you have to remember not to pull the flash drive or else it crashes, but otherwise it works about like normal. I'm happy enough with that that I'd rather not overwrite any other files until I have NAND access, despite all indications being that there's nothing to worry about really.

There is more than one way to skin a cat, but it is possible with just booting patched files from USB, and all necessary files to patch (one or two, depending on how you hack it) are writable. But needs some work with IDA (https://www.hex-rays.com/products/ida/index.shtml) or other disassemblers. Fortunately the DLLs are not encrypted. With more secure systems like used in iOS, it would be more complicated because of the additional decrypt step.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on August 13, 2013, 04:46:22 am
Yes, changing the splash screen worked.

I did not attempt to overwrite any .exe or .dll files but I see no reason to doubt that it will work too. Running the firmware from USB is slower (longer boot time and occasional menu lag) and you have to remember not to pull the flash drive or else it crashes, but otherwise it works about like normal. I'm happy enough with that that I'd rather not overwrite any other files until I have NAND access, despite all indications being that there's nothing to worry about really.

The boot time is annoying,  I need to restore backup of my USB two times, because the files on flash became corrupted.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on August 13, 2013, 04:52:08 am
There is more that enough info posted in this thread already, just nobody wants to post that final "here is .zip, unpack it to usb flash and use"  ;)
Funny situation - dissecting Rigol and Hantek in public is ok, but Agilent's name invokes some kind of shame (or fear?) )))

Not shame I think, but fear of a couple of things.

Fear of what the response from Agilent might be if the .zip file makes it to Hackaday or wherever things go to get really popular these days. It would be sad enough if Rigol responded to the popularity by patching the recent hacks, but an order of magnitude more sad at least if Agilent did the same. For the Rigol options are at least affordable if you really want them. With Agilent some of the stuff is off limits to a large number of us. As in can't have ever. Like at all. The hacks are the only way for some of us to ever have these things and nobody wants to make them go away for anyone.

There is also some fear of Agilent's attitude toward us individually. It is conceivable that I may actually contact Agilent if I ever have a problem with my scope some day since they're one of those remaining companies with whom that is actually worth doing. Given that possibility, it would be good for me if I haven't pissed them off in such a way that their desire to provide assistance is diminished. This is much less true with Rigol. I wouldn't expect much service there whether I'd pissed them off or not.

Someone will eventually post the damn .zip file. Part of the reason it's taking longer is simply that there are fewer Agilent owners out there than Rigol owners. The Agilent owner who just doesn't give a flying fuck simply hasn't come along yet.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on August 13, 2013, 04:57:40 am
The boot time is annoying,  I need to restore backup of my USB two times, because the files on flash became corrupted.

That's interesting. I've used my scope a lot and haven't encountered any problems with corruption. It doesn't seem like any of the files there are regularly written anyway. I wonder if a different flash drive would change anything?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on August 13, 2013, 02:50:36 pm
The boot time is annoying,  I need to restore backup of my USB two times, because the files on flash became corrupted.

That's interesting. I've used my scope a lot and haven't encountered any problems with corruption. It doesn't seem like any of the files there are regularly written anyway. I wonder if a different flash drive would change anything?

I'm using micro SD Reader and card, not regular USB flash. It can be also source of problems.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on August 15, 2013, 07:32:41 am
I only wish FrankBuss would elaborate on how to utilize that UART...

The serial port location:

http://i.imgur.com/yYMV75t.jpg (http://i.imgur.com/yYMV75t.jpg)

All you need are some jumper wires, if you don't want to drill a hole. Fits nicely through the USB connector hole 8)

http://i.imgur.com/9gnsuQh.jpg (http://i.imgur.com/9gnsuQh.jpg)

You can then stop the u-boot with space (can be difficult, you have to be fast, use something like HTerm which has a useful "repeat" function to send a sequence automatically until you stop it, or just hold down space while you boot it). Then you can boot the image from network like this:

Code: [Select]
set serverip 192.168.11.108
dhcp 0x4000000 nk.bin;bootm 0xf8050000

Where 192.168.11.108 is your own server, where TFTP is running and providing nk.bin. You should see something like this:

Code: [Select]
BOOTP broadcast 1
DHCP client bound to address 192.168.11.106
Using smsc device
TFTP from server 192.168.11.108; our IP address is 192.168.11.106
Filename 'nk.bin'.
Load address: 0x4000000
Loading: **#################################################################
#################################################################
...

You get the nk.bin from the nk.bin.comp from the firmware update cab-file with the bincompress.exe tool, which is included in the evaluation version of the WindowsCE development environment. Use http://www.t-hack.com/wiki/index.php/NK.BIN_toolset (http://www.t-hack.com/wiki/index.php/NK.BIN_toolset) to take a look at the content of nk.bin and to modify it.


Hi, here is info if someone want to make a NAND dump with JTAG debugger:

To Enable JTAG, you need this SPEAr600 TEST[2:0] pin configuration:
TEST_0=1, TEST_1=1, TEST_2=0

With debugger I did 128MB dump from NAND:

0000:0000-005F:FFFF  empty, just 0xFF
0060:0000-00C0:9F61  NK.BIN.COMP, size 12623714 bytes (FW 02.20)

02C2:0000- ????      Other data/files


Now we have NAND dump and need to:
1) hack MD5/RSA file consistency check to enable another files to modify
2) hack RSACryptoServiceProvider::VerifyData() or function which use it (AGILEN~1.003)
With Uboot write modificaton into NAND. Then just install licenses with any signature :-)

Now I'm not able to find MD5/RSA file consistency check. Please help.

Hey Sumino2000,

I found on Agilent site this data sheet containing "memory map", maybe this will help: Link (http://www.google.hr/url?q=http://cp.literature.agilent.com/litweb/pdf/5990-8184EN.pdf&sa=U&ei=GIMMUsWlAYij4gTVu4CYCw&ved=0CBsQFjAA&usg=AFQjCNHoKv1WulM3oR3eRkw5xMyoKsPPzA)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on August 15, 2013, 08:14:39 am
Hi guys!

Recently i bought a 2000 series scope with Lan/Vga option, so i started poking around and this is what i managed to find out.

If you have LAN/VGA option you can boot from USB stick and using VNC get access to windows ce desktop,
windows have frame buffer in RAM for user interface, user interface you see on a scope's LCD is generated by MegaZoom,
and original agilent vnc is transmitting megazoom's frame buffer to computer...

This is how you can do it:

1. Make some batch file in "startup" folder on usb stick containing this code:

taskkill /im infiniivisionLauncher.exe
taskkill /im AgilentLxiWebService.exe

This prevents starting infiniivision application and vnc.

2. Download "mobileVNC", you can find a demo version (you'll need version for ARM). You can search "MobileVNC_Demo.zip" i used that one.

Copy executable somewhere on usb and put shortcut to executable in startup folder.

This is how you do it:
write path to executable, in my case its:

48#\usb\Secure\infiniiVision\ARM\MobileVNC.exe

and save it as ".lnk" file, copy that file to startup folder.


If you don't know ip address you can boot scope normaly and see in options-->IO-->LAN assigned ip address.
Enter this address in vnc viewer and conntect to scope, that's it!

You'll notice that it's imposible to copy any .exe files from windows folder.
There are some hidden folders, for example folder containing license and calibration data, you need to check "view hidden files" in options
and then you can "backup" them on USB drive.


If you ever looked at firmware update you probably noticed in recepie.xml:

   <!-- Try to update DSO2000 FPGA -->
   <installStep>
      <file checksum="c4e300bc784756148a13e95f83cf44da">fpga2000a.bin</file>
      <command>\windows\loadP500Flash -u fpga --target economy %TEMP%\fpga2000a.bin</command>
   </installStep>
   <!-- Try to update DSO3000 FPGA -->
   <installStep>
      <file checksum="12173c04dc2dee18976902c36fc42809">fpga3000a.bin</file>
      <command>\windows\loadP500Flash -u fpga --target performance %TEMP%\fpga3000a.bin</command>
   </installStep>


but when i called "loadP500Flash -help" in command prompt it responded with:

USAGE:

   \Windows\loadP500Flash.exe  [-t <economy|performance|coyote>] [-a
                               <hexidecimal integer>] -u <tloSplash|fpga
                               |ceImage1|ceImage2|ceImage3|custom> [--]
                               [--version] [-h] <filename>


Where:

   -t <economy|performance|coyote>,  --target <economy|performance|coyote>
     FPGA target

   -a <hexidecimal integer>,  --address <hexidecimal integer>
     NAND Flash address for the custom update type.

   -u <tloSplash|fpga|ceImage1|ceImage2|ceImage3|custom>,  --update
      <tloSplash|fpga|ceImage1|ceImage2|ceImage3|custom>
     (required)  Update Type

   --,  --ignore_rest
     Ignores the rest of the labeled arguments following this flag.

   --version
     Displays version information and exits.

   -h,  --help
     Displays usage information and exits.

   <filename>
     (required)  Filename to write to NAND Flash


   updateP500Flash


So what is this "coyote" option? Some model (or series) better than 3000???

What do you think???
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on August 16, 2013, 08:45:55 pm
Coyote is 4000. InfiniiVision is common sw for 2k, 3k, 4k.

Why do you need VNC if there is a built in telnet?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on August 30, 2013, 09:54:58 am
Some "oil into the fire":
telnet login/pass:
infiniivision
skywalker1977
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: punkerdood on September 24, 2013, 05:16:20 am
Apparently djvinc doesnt exist on the interwebs anymore.  I'd be happy to pay $140 for a fix. 

Oh well.  I guess I'll start digging into my 3034. Bummer, I've got better things to do with my time.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on September 24, 2013, 03:10:12 pm
You don't really need to pay, all the required info is in this thread. You can just boot using a USB flash drive to unlock everything.
Someone needs to throw together a thorough walk through for those that arent as savvy in this area.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Lazarus4_ on October 07, 2013, 08:57:27 pm
I don´t really understand what to do in order to "hack" the DSO.
I tried it with the USB method, but I think I haven´t done it the right way.

Maybe someone can help me via private message or so :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on October 07, 2013, 09:28:13 pm
Yea me too please. What exactly has been figured out and what can we get out of it? Of course without having to buy it from someone else I mean.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: romantao on November 02, 2013, 02:10:46 am
I want to buy one of those Agilent oscilloscopes and, as a young academic i'm interested in some particular addons.
I'm not particularly in favor of those who profit with these hacks so i understand all the secrecy about this talk.
However, the way this topic is evolving is putting myself up to the challenge of finding the way to enable some licenses :)

As it seems possible to run the firmware from a USB pen without having to sign any cab and safely make some changes in the files, i ask a naive question that contribute with something (or not) to this topic:

Is it possible to edit one specific binary file in such way that the public key used to verify the license files is changed to the old one so we can use the known private key to sign the licenses?

Since i dont have access to any scope of this range, i have no way to check this idea.... just my two thoughts...

Regards

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 03, 2013, 11:24:37 am
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
    Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
    byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
    Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
    Replace in infiniiVision folder  infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red  message in letf top corner "Unfinalized Software"  and "System Concerns detected: OS version is not correct. Please reload system firmware"

Applications needed:
 WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
 7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on November 04, 2013, 05:19:39 pm
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
    Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
    byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
    Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
    Replace in infiniiVision folder  infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red  message in letf top corner "Unfinalized Software"  and "System Concerns detected: OS version is not correct. Please reload system firmware"

Applications needed:
 WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
 7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
Nice. So what can you do with it from this point?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jrgandara on November 04, 2013, 05:37:33 pm
After all my Sunday afternoon trying these method I finally succeed! Although there was some pit falls. Everything is working, including the MSO. But in this case I think we will not find any connector to insert in the scope to replicate the original, which must have some embedded hardware too. Any ideas?

Anyone have succeeded hacking the bandwidth from 70 to 100 or even 200 MHz?

Thanks a lot Plesa!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on November 04, 2013, 06:09:41 pm
Anyone have succeeded hacking the bandwidth from 70 to 100 or even 200 MHz?
The "-l All" in plesa's hack should enable all licenses. But if you buy a 200 MHz license, you get some new 300 MHz probes. Maybe the scope tests the probe types.

BTW: the 16 channel digital input doesn't need any electronics, it is just ground and the input signals, and you can plug-in an old 40 pin IDE cable.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grego on November 04, 2013, 06:33:49 pm
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
    Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
    byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
    Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
    Replace in infiniiVision folder  infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red  message in letf top corner "Unfinalized Software"  and "System Concerns detected: OS version is not correct. Please reload system firmware"

Applications needed:
 WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
 7Zip http://www.7-zip.org/ (http://www.7-zip.org/)

I'm assuming to back this out you just install the latest official firmware and call it a day?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: olsenn on November 04, 2013, 06:38:47 pm
How would you guys compare the DSOX2000 to the Rigol DS2000, both with all options (freely) activsted? I know that the Agilent scope maintains its waveform update rate much better than Rigol does; however, 1Mpt memory seems kind-of craptastic (how important is this)? Also the Agilent costs about 50% more.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on November 04, 2013, 06:45:11 pm
I'm assuming to back this out you just install the latest official firmware and call it a day?
This is based on the method plesa described in reply #142 in this thread and boots from the USB flash drive. If you unplug the USB flash drive, it boots the old firmware from the internal scope flash. You can add some copy commands in the startup script on the flash drive to install it permanently.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 04, 2013, 11:21:22 pm
Anyone have succeeded hacking the bandwidth from 70 to 100 or even 200 MHz?
The "-l All" in plesa's hack should enable all licenses. But if you buy a 200 MHz license, you get some new 300 MHz probes. Maybe the scope tests the probe types.

BTW: the 16 channel digital input doesn't need any electronics, it is just ground and the input signals, and you can plug-in an old 40 pin IDE cable.

Fo the badwidth upgrade you will need to replace the mainboard, it is not software upgrade only. The 350/500 MHz version shares same probes.  The digital input pinout - upper row signal and the bottom one is ground.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rufus on November 05, 2013, 12:08:55 am
Fo the badwidth upgrade you will need to replace the mainboard, it is not software upgrade only.

The scope bandwidth is a software upgrade with hardware required at 350MHz and 1GHz. The probes change at some frequencies as well.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on November 05, 2013, 06:27:09 am
Looks like there are different bandwidth upgrades. I know this one, from 100 MHz to 200 MHz (http://www.newark.com/agilent-technologies/dsox3bw24/license-b-w-upg-100-mhz-to-200/dp/31T9060). But right, for the bandwidth upgrade to 350 MHz (http://www.datatec.de/cgi-bin/shop/lshop.cgi?action=showdetail&artnum=dsox3bw32), it is not just software and the scope has to be sent to a service center. I guess they really change the mainboard and not set just some jumper, because of the high price :)

The datasheet for the 350 MHz update (http://cp.literature.agilent.com/litweb/pdf/5990-7759EN.pdf) says, that the old 200 MHz update is obsolete, maybe new scopes are shipped with this license now without the need to buy it. And the 350 MHz hardware update allows an additional software license update to 500 MHz.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: fmaimon on November 05, 2013, 03:07:46 pm

The "-l All" in plesa's hack should enable all licenses...


If this command enable all licenses, what does the changes in infiniiVisionCore.dll do?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jrgandara on November 05, 2013, 06:44:36 pm
Anyone have succeeded hacking the bandwidth from 70 to 100 or even 200 MHz?
The "-l All" in plesa's hack should enable all licenses. But if you buy a 200 MHz license, you get some new 300 MHz probes. Maybe the scope tests the probe types.

BTW: the 16 channel digital input doesn't need any electronics, it is just ground and the input signals, and you can plug-in an old 40 pin IDE cable.

Yes, it is all enabled in the Scope About, but the bandwidth still is showing 70MHz. I know the 200MHz need new probes, but those which came with the 70MHz is 150MHz and should work at least up to 100MHz if enabled.

Good to know about the IDE connector! I can´t find the pin out anywhere. Do you have this info to share?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 05, 2013, 06:54:27 pm
Looks like there are different bandwidth upgrades. I know this one, from 100 MHz to 200 MHz (http://www.newark.com/agilent-technologies/dsox3bw24/license-b-w-upg-100-mhz-to-200/dp/31T9060). But right, for the bandwidth upgrade to 350 MHz (http://www.datatec.de/cgi-bin/shop/lshop.cgi?action=showdetail&artnum=dsox3bw32), it is not just software and the scope has to be sent to a service center. I guess they really change the mainboard and not set just some jumper, because of the high price :)

The datasheet for the 350 MHz update (http://cp.literature.agilent.com/litweb/pdf/5990-7759EN.pdf) says, that the old 200 MHz update is obsolete, maybe new scopes are shipped with this license now without the need to buy it. And the 350 MHz hardware update allows an additional software license update to 500 MHz.

Thats really interesting, I did not see such a document. I just remember it from Agilent sales presentation. It needs to be investigated ;-)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grego on November 05, 2013, 07:00:04 pm
Looks like there are different bandwidth upgrades. I know this one, from 100 MHz to 200 MHz (http://www.newark.com/agilent-technologies/dsox3bw24/license-b-w-upg-100-mhz-to-200/dp/31T9060). But right, for the bandwidth upgrade to 350 MHz (http://www.datatec.de/cgi-bin/shop/lshop.cgi?action=showdetail&artnum=dsox3bw32), it is not just software and the scope has to be sent to a service center. I guess they really change the mainboard and not set just some jumper, because of the high price :)

The datasheet for the 350 MHz update (http://cp.literature.agilent.com/litweb/pdf/5990-7759EN.pdf) says, that the old 200 MHz update is obsolete, maybe new scopes are shipped with this license now without the need to buy it. And the 350 MHz hardware update allows an additional software license update to 500 MHz.

Where do you see it's obsolete?  The document you linked to certainly doesn't.

Since the front-end has to change jumping to a 350Mhz scope requires it to be sent back in for a main board change (and new probes).  All the other upgrades are software-only (and new probes).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on November 05, 2013, 08:00:25 pm
The datasheet for the 350 MHz update (http://cp.literature.agilent.com/litweb/pdf/5990-7759EN.pdf) says, that the old 200 MHz update is obsolete, maybe new scopes are shipped with this license now without the need to buy it. And the 350 MHz hardware update allows an additional software license update to 500 MHz.
Where do you see it's obsolete?  The document you linked to certainly doesn't.
There is some big red text in the PDF on the first page: "Obsolete as of July 25".

Good to know about the IDE connector! I can´t find the pin out anywhere. Do you have this info to share?
See reply #196 from plesa.

The "-l All" in plesa's hack should enable all licenses...

If this command enable all licenses, what does the changes in infiniiVisionCore.dll do?
You can try it: it doesn't accept the command line parameters without the patch.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grego on November 05, 2013, 08:43:00 pm
The datasheet for the 350 MHz update (http://cp.literature.agilent.com/litweb/pdf/5990-7759EN.pdf) says, that the old 200 MHz update is obsolete, maybe new scopes are shipped with this license now without the need to buy it. And the 350 MHz hardware update allows an additional software license update to 500 MHz.
Where do you see it's obsolete?  The document you linked to certainly doesn't.
There is some big red text in the PDF on the first page: "Obsolete as of July 25".

Hah - my bad - I was looking for text.  However, I think they are saying the PROCESS is obsolete, not the upgrades.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jrgandara on November 06, 2013, 12:05:04 am
If your don´t like those warning messages, just replace then in infiniiVisionCore.dll with any message you like using HexEdit.   8)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jrgandara on November 12, 2013, 09:27:09 am
Anyone get the bandwidth upgrade with this hack? Mine enabled all the features but the bandwidth. And yes, the "-l All" in Plesa's hack is there there.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rkupka on November 12, 2013, 09:30:51 am
Anyone get the bandwidth upgrade with this hack? Mine enabled all the features but the bandwidth. And yes, the "-l All" in Plesa's hack is there there.

Yes. upped from 100 MHz to 200 MHz on DSO-X2014
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jrgandara on November 12, 2013, 09:35:04 am
Mine is X-2002 and still stuck in 70MHz  :(
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on November 12, 2013, 06:21:47 pm
I tried it in a dsox-2002a, everything worked, except by the bandwidth whic remains 70MHz.
I didnt try a signal with more than 70MHz, but the scope info, show bw: 70.

This work with the dsox3000 too? the changes are the same?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rigby on November 12, 2013, 07:47:38 pm
Anyone get the bandwidth upgrade with this hack? Mine enabled all the features but the bandwidth. And yes, the "-l All" in Plesa's hack is there there.

Yes. upped from 100 MHz to 200 MHz on DSO-X2014

Dammit.  Every time I'm pretty sure I'll be getting a Rigol, I come in this thread and read something compelling enough to make me reconsider.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on November 12, 2013, 08:01:20 pm
Anyone get the bandwidth upgrade with this hack? Mine enabled all the features but the bandwidth. And yes, the "-l All" in Plesa's hack is there there.

Yes. upped from 100 MHz to 200 MHz on DSO-X2014

Dammit.  Every time I'm pretty sure I'll be getting a Rigol, I come in this thread and read something compelling enough to make me reconsider.

It's a beautiful scope, I started with a Rigol, then switched to Agilent and I don't have plans to go back to Rigol for a long period of time, unless there is a very huge reason.

David.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rigby on November 12, 2013, 08:16:50 pm
Dammit.  Every time I'm pretty sure I'll be getting a Rigol, I come in this thread and read something compelling enough to make me reconsider.

It's a beautiful scope, I started with a Rigol, then switched to Agilent and I don't have plans to go back to Rigol for a long period of time, unless there is a very huge reason.

David.

It's probably ultimately going to swing in favor of Rigol again, once I price check a 4-channel Agilent vs. a 4-channel Rigol.  I want the Agilent more, but I can't afford $1900 for a DSOX2004A.

Unless Agilent somehow decide to gift me a scope, it will likely be the Rigol DS1104Z-S for me.  {insert the rare new scope sadface here}
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on November 12, 2013, 10:30:25 pm
Or you can get in on one of their Premium Used units on eBay which are like new and have the new extended warranty on them. I got my MSOX2024 for $1875. I bought the few upgrades I wanted and the VGA/LAN module, but yea getting them from this thread via the hack would be awesome too.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Carrington on November 13, 2013, 04:33:11 pm
Rigol are doing 4 channel 2000 series scopes now, which should be much cheaper than the 4000 series. Even with the eBay used shop it is hard to justify an Agilent with smaller memory and higher cost, even if the interface is a bit more fluid. Even so, they are just such nice scopes...
DS2000 series with 4 Channel?  :o
How do you know that?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dfnr2 on November 14, 2013, 12:37:19 am
I just now scanned this thread with interest, as I just picked up an MS0X3104A on Ebay.   I actually wanted the probes that came with it, and haven't decided if I will keep the scope (I don't plan to.  I plan to play with it for a while, then re-sell it.) 

In the meanwhile, I'd like to explore the LAN/VGA functionality without springing for the module.  So I followed the discussion here with interest.  Did anyone ultimately make a PCB for the LAN/VGA functionality?  If so, I'd like to avoid duplicating the effort.

Thanks for any info.

Dave
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tsmith35 on November 14, 2013, 07:01:02 am
Rigol are doing 4 channel 2000 series scopes now, which should be much cheaper than the 4000 series. Even with the eBay used shop it is hard to justify an Agilent with smaller memory and higher cost, even if the interface is a bit more fluid. Even so, they are just such nice scopes...
I've been wondering why Rigol hasn't had a 4 channel 2000 series scope...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on November 14, 2013, 11:21:30 am
Yesterday I did some investigations to locate the picture for that are used for the screensaver.
The Megazoom logo starts at 0x739E30  and has 22876 Bytes and it's a 266x86 pixel array with 1 byte/pixel
The picture uses the same 8 bit color palette as a saved 8bit color Bitmap.

At the adress 73F78C are some information's of the picture 0A 01 = 0x10a = 266  and 00 56 = 0x56 = 86.

So its possible to create a nice customized Screensvaer

Regards
Kai
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on November 14, 2013, 04:41:53 pm
^^^^^^ Very cool. Thanks for sharing that!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on November 15, 2013, 03:20:59 pm
What means the -l SCPIPS parameter?
I can imagine what the -l ALL do, but not the scpips.
Can someone tell me what it do?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 15, 2013, 08:08:57 pm
It might be SCPI programming standard, not shure yet.

-l ALL enables all "trial" licences but without time limit, that's why there are "*" following each license.

@kilobyte

You can find icon of a starship enterprise at 0x00794018, it's 4032 bytes long, and 478x122 pixels.
It look's like there are more easter eggs hidden, not only "lost" (162342),  etch-a-scope and credits.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on November 15, 2013, 09:01:06 pm
HA! Snap a shot of the Enterprise and post it! I wanna see that one!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: willemite on November 15, 2013, 09:28:37 pm
HA! Snap a shot of the Enterprise and post it! I wanna see that one!
I second that one!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on November 15, 2013, 09:58:08 pm
Thanks wersi.

I didnt know the SCPI programming standard.


The changes in the dll file, is the same to the 3000X series?

Interesting to think in new easter egg...!!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on November 15, 2013, 10:09:21 pm
The option SCPIPS could also be the remote logging option to debug the SCPI commands.

And for all Trekkies
see the attachment  :)

Yes i also think this could be a easter egg.
It a littlebit hard to find out in which case this picture / function will be started.

Maybe i can find more about this in the disassembly.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 16, 2013, 12:11:29 am
That's possible too, i'm not shure but there is RML license which is probably "Remote Logging".

2000 and 3000 series uses same firmware, i have 2000 series 'scope.

On 2000 series you can upgrade bandwidth up to 200MHz, also i found two extra options which can be enabled with -l switch.  ;)

If you dont like "reload firmware" message, you can find it with hex editor and change it, if You need new line write: 0x1B 0x0A....
If you wanna insert for example agilent copyright message write "<0x1B>M608" or if you wanna insert some graphical resource write for example "<0x1B>P1;"
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on November 16, 2013, 12:40:55 am
I can't realize why my (2002A) don't go to 200MHz.
Why some users tell they go to 200MHz with the firmware changes, and some (include me) don't.

Another 2 extra instructions?
Expected to exist in this scopes? or something different?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on November 16, 2013, 01:12:05 am
The option SCPIPS could also be the remote logging option to debug the SCPI commands.

And for all Trekkies
see the attachment  :)

Yes i also think this could be a easter egg.
It a littlebit hard to find out in which case this picture / function will be started.

Maybe i can find more about this in the disassembly.
Ha ha ha! Awesome! Thanks for posting that!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 16, 2013, 11:56:23 pm
When you pass switch SCPIPS to launcher scope returns *** Installing License: Infiniium Mode.
What is infiniium mode?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Carrington on November 18, 2013, 02:38:30 pm
Hi all!

I have a question and, I know that isn't the subject matter of this topic (I apologies), but I hope that someone can help with this, thanks.

Q: The DSOX2000/3000 series gives their maximum waveforms per seconds with auto memory only, or with maximum memory too?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on November 18, 2013, 06:36:55 pm
Muahahaha! :-DD
Agilent DSOX2000/3000 Easteregg Spaceship Screensaver (https://www.youtube.com/watch?v=A4zTj5a7cGU#ws)
Here is it the Enterprise Screensaver.

I did take a look in the dsox4000 dll and there are a lot more debug information and resources.
I opened the 4000 infiniivision with a resource hacker and I was able to extract bitmaps and Winform dialogs.
After disassembling the dll I searched for the text TREK and found the reference to this in a subfunction with other references to ...Screensaver...
So i tried it on my scope and bingo.

Regards
Kai
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on November 18, 2013, 06:45:50 pm
AH HA HA HA!!! Thats AWESOME!!!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 18, 2013, 11:06:32 pm
Good work!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on November 20, 2013, 01:11:40 am
Just tried the USB hack for everything including bandwidth, note to people still struggling: Remember to format the drive to FAT16. Fiddled for half an hour scratching my head before I realized that.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on November 20, 2013, 04:42:54 am
I did the hack with a very old and low capacity USB drive and it works fine.

Today I tried with a low cost PNY 8 GB thumbdrive and the system does not recognize the PNY.

Is there a limitation on the USB thumbdrive size ?

Has anybody tried with a 8 GB thumdrive ?

David.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rigby on November 20, 2013, 01:17:24 pm
I did the hack with a very old and low capacity USB drive and it works fine.

Today I tried with a low cost PNY 8 GB thumbdrive and the system does not recognize the PNY.

Is there a limitation on the USB thumbdrive size ?

Has anybody tried with a 8 GB thumdrive ?

David.

See the above post on formatting FAT16.  Vanilla FAT doesn't support partition sizes over 2GB.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on November 21, 2013, 05:57:07 am
But... the low capacity USB thumdrive is a FAT32 and it works.  :scared:

David.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on November 21, 2013, 06:13:14 am
I did the hack with a very old and low capacity USB drive and it works fine.

Today I tried with a low cost PNY 8 GB thumbdrive and the system does not recognize the PNY.

Is there a limitation on the USB thumbdrive size ?

Has anybody tried with a 8 GB thumdrive ?

David.

See the above post on formatting FAT16.  Vanilla FAT doesn't support partition sizes over 2GB.
I am using a 4GB stick, FAT16 does support partition size above 2GB if you format it with 64KB cluster size.
But... the low capacity USB thumdrive is a FAT32 and it works.  :scared:

David.
All I know is that it didn't work until I reformatted to FAT16.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pinkman on November 24, 2013, 08:01:46 pm
Hi all, 1st post.

I have a newer DSO-X3034A, manufactured 28th week of 2013.

I have tried with the 2.35 Firmware (unpack, modify infiniivisionCore.dll hex data, modify startup .lnk, create startup override .txt file) and my scope simply hangs at the splash screen.  I have tried on many flash drives, new and old, and formatted FAT16 default cluster size and FAT16 with 16kb cluster size.

Has anyone verified this as working for newer 3000X or is this maybe only working on the older models?

Any suggestions for this poor university student are welcome... I have saved a lot of money and used my educational discount to get this scope, but I can not afford any more purchases for a long time :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ixfd64 on November 24, 2013, 08:05:35 pm
To boldly go... where no hack has gone before!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pinkman on November 24, 2013, 10:14:44 pm
I am still learning but if that is what I must do, then I will give it my best.

I am first trying to understand if this is not working because I have a newer scope, or because I have somehow done something incorrectly.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on November 24, 2013, 11:04:06 pm
Hi pinkman,

my usb stick is formatted with FAT32 and works without a problem.
It needs a little bit more time to start the application and the splash screen is not shown on my scope.
The folder structure on the flash drive should be

\
+-infiniiVision
  +-fpga
  +-upgrade
  +-web
  +-css
  +-help
  +-image
  +-include
  +-web-socket-js
  +-lib
  +-Lxi
     +-Identification
  +-navbar
+-Startup


So its possible that you do something wrong.
My first test also didn't work because I mistyped something.

Maybe i can try my USB stick on a newer DSOX2000 series scope at work.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pinkman on November 25, 2013, 12:16:03 am
kilobyte,

Thanks for the reply.  My understanding is that I should extract the contents of infiniivisionSetup.cab, then take contents of the "Secure" folder and copy *only* Secure folder contents to Flash root drive.  I have done this, but my folder structure looks a little bit different than what you have listed.

Are there any files, other than contents of "Secure" folder(including modified infiniivisionCore.dll)  + startupoverride text file that should be on the flash disk?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 25, 2013, 12:47:52 am
kilobyte,

Thanks for the reply.  My understanding is that I should extract the contents of infiniivisionSetup.cab, then take contents of the "Secure" folder and copy *only* Secure folder contents to Flash root drive.  I have done this, but my folder structure looks a little bit different than what you have listed.

Are there any files, other than contents of "Secure" folder(including modified infiniivisionCore.dll)  + startupoverride text file that should be on the flash disk?

Did you copy whole structure from extracted  \3000XSeries.02.35.2013061800.cab\infiniiVisionSetup.cab ? The whole content of \Secure\ folder must be copied to USB flash.
Also check presence of the Startup folder with modified   infiniivision.lnk which contains sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 25, 2013, 12:48:34 am
Muahahaha! :-DD
Agilent DSOX2000/3000 Easteregg Spaceship Screensaver (https://www.youtube.com/watch?v=A4zTj5a7cGU#ws)
Here is it the Enterprise Screensaver.

I did take a look in the dsox4000 dll and there are a lot more debug information and resources.
I opened the 4000 infiniivision with a resource hacker and I was able to extract bitmaps and Winform dialogs.
After disassembling the dll I searched for the text TREK and found the reference to this in a subfunction with other references to ...Screensaver...
So i tried it on my scope and bingo.

Regards
Kai

NICE!!!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pinkman on November 25, 2013, 01:07:54 am
kilobyte,

Thanks for the reply.  My understanding is that I should extract the contents of infiniivisionSetup.cab, then take contents of the "Secure" folder and copy *only* Secure folder contents to Flash root drive.  I have done this, but my folder structure looks a little bit different than what you have listed.

Are there any files, other than contents of "Secure" folder(including modified infiniivisionCore.dll)  + startupoverride text file that should be on the flash disk?

Did you copy whole structure from extracted  \3000XSeries.02.35.2013061800.cab\infiniiVisionSetup.cab ? The whole content of \Secure\ folder must be copied to USB flash.
Also check presence of the Startup folder with modified   infiniivision.lnk which contains sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"

I did copy the entire contents of the \Secure folder.  There were files in the "root" directory of the .CAB file (such as FPGA2000.bin, FPGA3000.bin, etc) which I did not copy - So the entire contents of the \Secure folder are duplicated on the root directory of my flash disk.

Then, I modified the infiniivisionCore.dll file as you described, I modified the \Startup\infiniivision.lnk file as you described, and created a file in in the root directory of my flash disk called "infiniivisionStartupOverride.txt" and put the text "True" inside that file.

It appears that I am following the correct procedure... I have tested quite a few different flash disks, old and new - I will see if I can get some different ones and test, but maybe I am unlucky and the newer scopes will require more work.

My next step will be to gain access to the console via the serial port.  I assume that doing this will allow me to see startup error messages as a result of my flash disk?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jrgandara on November 25, 2013, 08:54:31 am
This Startrek easteregg screen saver worked fine in my 2002! I love it!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on November 25, 2013, 12:18:54 pm
Go further! Somebody take a WinCE toolchain and make an S/N changer, change the last digit to use leaked key.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on November 25, 2013, 09:39:53 pm
I test my usb stick on a dsox2024a at work today.
The DSO is only some month old (July 2013).

It's a pity but it didn't load the firmware from usb stick.
The LED on the flash drive has flashed at startup but after that there was no reaction compared to my DSOX.
Maybe they have changed something in the bootloader or something else.

I think i will buy the LAN Module(as a Christmas gift  ;D), maybe with this its possible to do more research on the scope.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on November 25, 2013, 09:49:16 pm
Huh, now Im more glad I bought a Premium Used from Agilent. Hopefully mine will be an older one and this hack will work on it. Still havent had a change to play with it though as I havent needed anything more than the features Ive already purchased.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on November 26, 2013, 12:36:16 am
But... the low capacity USB thumdrive is a FAT32 and it works.  :scared:

David.

I made my scope work with the 8GB USB drive.

I had to create a primary partition of 7.65 GB (it won't work with 7.7 or higher), and format it to FAT32.

 :-BROKE

David.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pinkman on November 26, 2013, 03:19:49 am
I test my usb stick on a dsox2024a at work today.
The DSO is only some month old (July 2013).

It's a pity but it didn't load the firmware from usb stick.
The LED on the flash drive has flashed at startup but after that there was no reaction compared to my DSOX.
Maybe they have changed something in the bootloader or something else.

I think i will buy the LAN Module(as a Christmas gift  ;D), maybe with this its possible to do more research on the scope.

As I suspected... Agilent probably planned this all along... Release a hackable 1st version of a scope, knowing that newer models will not be hackabe and there will still be a few hackable versions always floating around on the market to generate buzz about hacking... Sales skyrocket with hopeful buyers...  Kill product line after 5 years of better than average sales and provide little or no legacy support.  Lol.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on November 26, 2013, 05:58:48 am
Yea I doubt sales are going to sky rocket on $2000+ oscilloscopes just because there is a hack out there that most will never even hear about.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: vl400 on November 26, 2013, 06:03:36 am
Tried on two July build 3000x scopes and the USB boot method works. Everything except bandwidth upgrade (100MHz still 100MHz and 350MHz still 350MHz) being available.

One is v2.35 and the other v2.30 firmware.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rufus on November 26, 2013, 06:54:51 am
Tried on two July build 3000x scopes and the USB boot method works. Everything except bandwidth upgrade (100MHz still 100MHz and 350MHz still 350MHz) being available.

One is v2.35 and the other v2.30 firmware.

I think the USB port is a bit flaky. There were problems with scopes endlessly cycling the LEDs on boot when a USB stick is inserted. Until a couple of firmware updates ago mine would never show the splash screen if a USB stick was inserted. Comments here about needing FAT16 or FAT32 and not more than 7.9GB etc might just be down to the scope liking some sticks more than others.

The scope isn't going to spend a lot of time checking or waiting for a USB stick during boot.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: willemite on November 26, 2013, 02:52:31 pm
Sounds just like trying to boot other operating systems from USB flash drives. It is always hit or miss for me, some just are not accepted on any given computer at boot time, even though they might work fine once the full O/S is loaded
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pinkman on November 26, 2013, 03:30:09 pm
Tried on two July build 3000x scopes and the USB boot method works. Everything except bandwidth upgrade (100MHz still 100MHz and 350MHz still 350MHz) being available.

One is v2.35 and the other v2.30 firmware.

I think the USB port is a bit flaky. There were problems with scopes endlessly cycling the LEDs on boot when a USB stick is inserted. Until a couple of firmware updates ago mine would never show the splash screen if a USB stick was inserted. Comments here about needing FAT16 or FAT32 and not more than 7.9GB etc might just be down to the scope liking some sticks more than others.

The scope isn't going to spend a lot of time checking or waiting for a USB stick during boot.

That is exactly what mine does.  It boots to the splash screen, and then the LED's cycle... Forever.  Maybe I need to try a few more flash drives.  Have already been through a dozen of them!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 07:23:57 pm
I've noticed that scope hangs if there is missig full path to launcher in .lnk file (in startup folder).

For example if you forgot to add "\usb" to launcher path in the .lnk file on USB stick or if you replaced .lnk file in flash memory with one from usb stick; containing "\usb" path, scope will hang. (I did this by mistake)

If you have used "-All" switch, You probably lost 30 trial option.
In case You don't like a little star you can add separate license switches (-l AUTO, -l MSO,.....).
There are two hidden options -l VID and -l CABLE. You can find them by pressing analyse button ;)
Enjoy!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 07:28:05 pm
I test my usb stick on a dsox2024a at work today.
The DSO is only some month old (July 2013).

It's a pity but it didn't load the firmware from usb stick.
The LED on the flash drive has flashed at startup but after that there was no reaction compared to my DSOX.
Maybe they have changed something in the bootloader or something else.

I think i will buy the LAN Module(as a Christmas gift  ;D), maybe with this its possible to do more research on the scope.

Try to format usb stick, copy override.txt and than other system files.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 07:32:20 pm
Tried on two July build 3000x scopes and the USB boot method works. Everything except bandwidth upgrade (100MHz still 100MHz and 350MHz still 350MHz) being available.

One is v2.35 and the other v2.30 firmware.
You can upgrade 100MHz version only to 200MHz, and 350MHz can go up to 500MHz. (it should..)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: vl400 on November 26, 2013, 07:50:09 pm
You can upgrade 100MHz version only to 200MHz, and 350MHz can go up to 500MHz. (it should..)

Yeah I have, but it is using a different method. Was just pointing out that the USB boot method does not appear to enable the bandwidth upgrade  :--
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rigby on November 26, 2013, 07:58:20 pm
I DO NOT INTEND FOR THIS TO BE TAKEN NEGATIVELY!

I find it... interesting how so many people SEEM TO BE genuinely upset that they are unable to get more scope than they paid for.

I'm not attacking, I'm not criticizing, nothing like it; it is just very interesting to me that people genuinely believe that they should be able to upgrade their scope for free.  Reading that sentence after I typed it out, you may (incorrectly) infer that I am against this point of view; you are wrong.

I guess my interest here comes from the dichotomy between a market that is quickly moving towards software upgrades like this one, and that the market is full of people who believe that once they've purchased something, they own it.

I know in the EU that the "you bought it, you own it" rule applies, but here in the US, that isn't the case.  It should be, but it isn't.

I am just wondering where the split started.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 08:12:17 pm
Dear Rigby,

I guess these guys (me included) can't help You with that problem, since most of us are in to electronic design, hardware and software, and have very little knowledge about sociology and psychology matters.   O0
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 26, 2013, 09:14:59 pm
I've noticed that scope hangs if there is missig full path to launcher in .lnk file (in startup folder).

For example if you forgot to add "\usb" to launcher path in the .lnk file on USB stick or if you replaced .lnk file in flash memory with one from usb stick; containing "\usb" path, scope will hang. (I did this by mistake)

If you have used "-All" switch, You probably lost 30 trial option.
In case You don't like a little star you can add separate license switches (-l AUTO, -l MSO,.....).
There are two hidden options -l VID and -l CABLE. You can find them by pressing analyse button ;)
Enjoy!


I did not fnd anything which is related to -l CABLE.
I can confirm - adding -l BW50 upgraded the 350MHz version to 500MHz, tested with Vincent pulse generator (see attachment).

Fo someone who is going to buy a new scope can be interested current PROMO
https://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2384797&nid=-33573.0.08&id=2384797 (https://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2384797&nid=-33573.0.08&id=2384797)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 09:51:42 pm
It's working on 2000 series, You can find it when you press Analyse button. When you add that switch launcher returns: *** Installing License: Cable Calibration.
-l VID adds HD video trigger and -l CABLE adds that cable calibration option which i'm not shure what's it for, didn't try that option yet.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on November 26, 2013, 09:58:32 pm
Has anyone tested going back to stock after modding the firmware? Any issues there? What about with re-enabling previously purchased upgrades?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 10:00:50 pm
You'll have all options you had before (because they are enabled by license files), except 30 days trial, if you used "-l ALL" Switch.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 26, 2013, 10:02:58 pm
It's working on 2000 series, You can find it when you press Analyse button. When you add that switch launcher returns: *** Installing License: Cable Calibration.
-l VID adds HD video trigger and -l CABLE adds that cable calibration option which i'm not shure what's it for, didn't try that option yet.
You are right, it is also working on 3k series as well.
Feature is called "Ratio and phase Reference".

Has anyone tested going back to stock after modding the firmware? Any issues there? What about with re-enabling previously purchased upgrades?
The original licenses purchased with scope still remains on scope itself.
The "Hack" is just running unlocked firmware from USB drive.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 10:06:56 pm
Plesa, can You please look at 0x007D51C8 in core file, You might find more switches that might work on 3000 series which don't work on 2000 series.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on November 26, 2013, 10:16:07 pm
But... the low capacity USB thumdrive is a FAT32 and it works.  :scared:

David.

I made my scope work with the 8GB USB drive.

I had to create a primary partition of 7.65 GB (it won't work with 7.7 or higher), and format it to FAT32.

 :-BROKE

David.

Well 7.65GB partition was not working all the time, I just randomly set a partition of 7GB and now it boots every single time.

David.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 10:17:57 pm
I'm using Corsairs 32GB flash voyager with FAT32, and it works fine.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 26, 2013, 10:20:42 pm
Plesa, can You please look at 0x007D51C8 in core file, You might find more switches that might work on 3000 series which don't work on 2000 series.

You have a good point.
We have new licence Tomography ( TOM )
So current infiniivision.lnk contains:
254#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l MEMMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l All
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 10:22:58 pm
This is my command line:
62#\usb\secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l memMax -l MEMUP -l EMBD -l AUTO -l COMP -l SGM -l MASK -l EDK -l RML -l ASV -l SGMC -l BW20 -l DIS -l SCPIPS -l VID -l CABLE

This enables all on 2000 series
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 10:31:41 pm
Plesa, have You by any chance figured out what infiniium mode means ???
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 26, 2013, 10:32:04 pm
But... the low capacity USB thumdrive is a FAT32 and it works.  :scared:

David.

I made my scope work with the 8GB USB drive.

I had to create a primary partition of 7.65 GB (it won't work with 7.7 or higher), and format it to FAT32.

 :-BROKE

David.

Well 7.65GB partition was not working all the time, I just randomly set a partition of 7GB and now it boots every single time.

David.

I'm using 8GB and 32 GB flash, both formatted to FAT32 without any issue.
I had only problem during using the USB/MicroSD adaptor ( it was related to microSD connector)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on November 26, 2013, 10:37:10 pm
Mmmmnnn it maybe the fricking brand is a cheapo PNY.

I have bought this one because two reasons:

1.- I like the size of the memory ( small size ), I want it to be permanently installed on the back of the unit and it is short, there are shorter ones, but more pricy.

2.- The price

Well so far with 7 GB has been working fine, if it starts to fail, I will get a quality one.

David.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 26, 2013, 10:38:48 pm
Plesa, have You by any chance figured out what infiniium mode means ???

I suppose that it is related to some compatibility with Infinium family scope and their SCPI commands, I guess.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 10:39:36 pm
DavidDLC, if you can borrow LAN module, you can copy modified infiniivisioncore.dll and infiniivision.lnk to internal flash, this way 'scope will boot much faster...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 10:46:56 pm
Plesa, have You by any chance figured out what infiniium mode means ???

I suppose that it is related to some compatibility with Infinium family scope and their SCPI commands, I guess.

You are probably right.

This is launcher return text:

\> \secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l memMax -l MEMUP -l
EMBD -l AUTO -l COMP -l SGM -l MASK -l EDK -l RML -l ASV -l SGMC -l BW20 -l DIS
-l SCPIPS -l VID -l CABLE --forcemaxmem
Our command line is -l MSO -l memMax -l MEMUP -l EMBD -l AUTO -l COMP -l SGM -l
MASK -l EDK -l RML -l ASV -l SGMC -l BW20 -l DIS -l SCPIPS -l VID -l CABLE --for
cemaxmem
*** Installing License: MSO
*** Installing License: Acq Memory Max
*** Installing License: Acq Memory Max
*** Installing License: Embedded serial decode and trigger
*** Installing License: Automotive serial decode and trigger
*** Installing License: UART/RS232 serial decode and trigger
*** Installing License: Segmented Memory
*** Installing License: Mask limit testing
*** Installing License: 200MHz Bandwidth
*** Installing License: Education kit license
*** Installing License: Distributor license
*** Installing License: Enhanced Video Triggering
*** Installing License: ASV
*** Installing License: Cable Calibration
*** Installing License: Infiniium Mode
*** Installing License: Remote Log
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on November 27, 2013, 12:18:39 am
Any chance the aero command run on 2000X?
Maybe the software is there, just locked too.

Why different numbers in the lnk file? (Plesa has 254 and Wersi 62)
what does this command?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 27, 2013, 08:39:54 am
Intresting question, i looked it up on a MSDN this is what i found:

[number of ASCII characters after pound sign allocated to
command-line arguments]#[command line] [optional parameters]

Looks like i should write at least 187...

It works anyway...  :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sprocket on November 27, 2013, 10:11:48 am
I find it... interesting how so many people SEEM TO BE genuinely upset that they are unable to get more scope than they paid for.

If they bought the scope expecting to do the free upgrade, i.e. that was part of the deliberation when deciding which one to get, I can understand that. For example I am now seriously considering getting an Agilent for my personal use because you can get the free upgrade, otherwise it just isn't worth it.

Upset might be a bit of a strong word. Disappointed would be more accurate.

Quote
I know in the EU that the "you bought it, you own it" rule applies, but here in the US, that isn't the case.  It should be, but it isn't. Might not be as bad as in the states, but it's bad enough.

Damn straight. The EU isn't ruled by corporations.

Emmh not really. Financial, chemical, automotive, agricultural and defense corporations carries a lot of weight in the EU. But that's an entirely different debate.   
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 27, 2013, 01:13:20 pm
Any chance the aero command run on 2000X?
Maybe the software is there, just locked too.

Why different numbers in the lnk file? (Plesa has 254 and Wersi 62)
what does this command?
Unfortunatly AERO does not work on 2000 series, i belive decoding is done by FPGA in cooperation with MEGAZOOM IV (Codename: "Baldwin" i belive), so it's not available in 2000 series.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on November 27, 2013, 02:07:14 pm
To people with fresh scopes worrying about new bootloaders: the startup override hack has nothing with new/old bootloaders, it was found in update files themselves. So if a yesterday's manufactured scope has the same sw version - the hack is also there. So check your USB sticks/folder structure and try again.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 27, 2013, 04:44:20 pm
Bootloader is the same for all 'scopes, it's a u-boot. It's located in separate 512kB memory, You can find all detalis about memory mapping on agilent web site...
Document is called: "5990-8184EN.pdf"
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 27, 2013, 04:46:40 pm
Does anyone have NAND flash image?
There is 2,5MB section with serial and model number.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 27, 2013, 06:30:02 pm
Any chance the aero command run on 2000X?
Maybe the software is there, just locked too.

Why different numbers in the lnk file? (Plesa has 254 and Wersi 62)
what does this command?

Is there any usage of AERO at home lab?
Check the infiniivisioncore.dll file for support on 2k family. I do not see it.

The number is the ammount of characters in .lnk file

I checked all functions of scope and did not find anything related to Tomography option (TOM), so it can be related to some upcoming software package like Agilent Spectrum Visualiser (ASV), I guess.

There two additional options FRC (FlexRay Complance) and TEL (Telecom Mask Test) , both not working.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pmcouto on November 27, 2013, 11:55:33 pm
Hi,

These seem to be the license options recognized by X3000 “infiniivisionLauncher.exe” v2.35:

Fully documented and sold by Agilent
ADVMATH   Advance Math
AERO   1553 & 429 serial decodes
AUDIO   Audio serial decode and trigger
AUTO   Automotive serial decode and trigger
COMP   UART/RS232 serial decode and trigger
EMBD   Embedded serial decode and trigger
Flex           Ray serial decode
Mask   limit testing
MEMUP    Acq Memory Max
PWR          Power application
SGM          Segmented Memory
VID          Enhanced Video Triggering
WAVEGEN   WaveGen license
EDK          Education kit license
BW10   100MHz Bandwidth (BW upgrade for 70 MHz models)   
BW20   200MHz Bandwidth (BW upgrade for 70 and 100 MHz models)   
BW50   500MHz Bandwidth (BW upgrade for 350 MHz models)

Undocumented and/or Not implemented
TOM           Tomotherapy
SGMC   Circular Segmented Memory
SCPIPS   Infiniium Mode
FLEXC   Flex Ray Plus
DIS           Distributor license
FRC           Flex Ray Compliance
TEL           Telecom Mask Test

Unknown (Used for Development/Test?)
RML           ? (Remote Logging?)
CABLE       ? (Calibration?)
ASV           ? (Agilent Spectrum Visualiser?)
ALT            FPGA Altera
FPG            FPGA Probe

(License management?)
memMax   ? (Same as MEMUP?)
memNo   Acq Memory Dflt
rmAll           Remove All Licenses
All            Licenses

Options MSO and DVM, although available in the software, are missing from this list…

Investigation still in progress  >:D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 28, 2013, 03:49:30 pm
FLEXC         Flex Ray Plus ( I did not see any difference with FLEX)
DIS           Distributor license (contains following memMAX,EMBD,AUTO,FLEX,PWR,COMP,SGM,MASK,AUDIO,EDK,WAVEGEN,AERO,VID,ADVMATH,DVM,ASV,RML )
RML           Remote Logging ( create log on USB drive of remote commands - useful for automation)
ASV           Agilent Spectrum Visualiser ( about 2 years on market, useful for spectrum measurements)
TOM           Tomotherapy (As I mentioned probable for some SW like ASV) ????
memMax        Maximal Memory ( increased number of segments 500->1000)
SGMC          Circular Segmented Memory (require memMAX or MEMUP)  - quite usefull, endless loop of segments, require SGM
FRC           Flex Ray Compliance (FLEX,FLEXC required but without any obvious function - probably require MASK??)
TEL           Telecom Mask Test    (unable to boot)
CABLE         Measure delay and delta on phase
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on November 29, 2013, 12:44:01 pm
Any chance the aero command run on 2000X?
Maybe the software is there, just locked too.

Why different numbers in the lnk file? (Plesa has 254 and Wersi 62)
what does this command?

Is there any usage of AERO at home lab?
Check the infiniivisioncore.dll file for support on 2k family. I do not see it.

The number is the ammount of characters in .lnk file

I checked all functions of scope and did not find anything related to Tomography option (TOM), so it can be related to some upcoming software package like Agilent Spectrum Visualiser (ASV), I guess.

There two additional options FRC (FlexRay Complance) and TEL (Telecom Mask Test) , both not working.

No, I've never used aero at home, to be honest, neither on work. The question was purely for to know if the decode option was related to hardware or only software.
I think the diferences between wavegen on 2000 and 3000 might be in hardware (that is able or not to generate arbitrary waveforms), but I tought the decode was only in software...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwilson on November 30, 2013, 08:59:24 pm
if you can borrow LAN module, you can copy modified infiniivisioncore.dll and infiniivision.lnk to internal flash

How does this work? I don't have the LAN module so can't try it out, but this option might convince me to get one. Does the scope have an FTP server or do you telnet in and copy the files around from a command line?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on December 01, 2013, 01:13:38 am
And what is the problem copying files WITHOUT lan module? Why not just build a modified update .cab?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: troth on December 01, 2013, 01:16:46 am
Just tried the hack on a DSOX3034A that I got last week. I think the build week is 43 of 2013 (late October-ish, there is a 1343 under the QR code on the serial #, MAC addr sticker on the back of the unit). The firmware version that came with it is 02.36.2013091301.

Unfortunately, I'm not having any luck getting it to boot from the USB stick with the hacked Core DLL file. I also tried to get it to boot without modifying any of the files except for the override .txt file, again with no luck.

The scope appears to read information from the USB drive (can see the led flashing). Next, all I get is it cycling through lighting up the channel buttons, intensity and wave gen, run stop and single and then ref, math, digital and serial. It goes through about 8 cycles and then reboots itself. No matter what I have tried, I have seen no change in behavior when trying to boot from the usb flash drive.

To verify that the scope can handle the formatting of the drive, I booted the scope without the usb flash drive plugged in. After the scope was up and operating normally, I plugged in the usb drive and was able to browse the directories via the Save/Recall button.

Not really asking for any one to figure this out, just trying to document another data point for a relatively new scope.

I'd be interested to know if anyone else with a newer scope that came with firmware > 2.35 is having any success with the hack.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: B0B45 on December 01, 2013, 04:30:05 am
Hi,

the trick is to use fast USB-Sticks. I use an usb3 32GB (read 30MB/s) Stick without any problems. Yesterday I've tested a Micro USB2 Stick with only 15MB/s. That one only starts the first time, then I have to unplug the Scope to make it work again.

Maybe some of you can make a speed test with your working sticks and post the result to prove me wrong or right.

BTW, a big thanks to the guys who posted the little trick. :-+

regards B0B
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on December 01, 2013, 05:10:43 pm
Just tried the hack on a DSOX3034A that I got last week. I think the build week is 43 of 2013 (late October-ish, there is a 1343 under the QR code on the serial #, MAC addr sticker on the back of the unit). The firmware version that came with it is 02.36.2013091301.

Unfortunately, I'm not having any luck getting it to boot from the USB stick with the hacked Core DLL file. I also tried to get it to boot without modifying any of the files except for the override .txt file, again with no luck.

The scope appears to read information from the USB drive (can see the led flashing). Next, all I get is it cycling through lighting up the channel buttons, intensity and wave gen, run stop and single and then ref, math, digital and serial. It goes through about 8 cycles and then reboots itself. No matter what I have tried, I have seen no change in behavior when trying to boot from the usb flash drive.

To verify that the scope can handle the formatting of the drive, I booted the scope without the usb flash drive plugged in. After the scope was up and operating normally, I plugged in the usb drive and was able to browse the directories via the Save/Recall button.

Not really asking for any one to figure this out, just trying to document another data point for a relatively new scope.

I'd be interested to know if anyone else with a newer scope that came with firmware > 2.35 is having any success with the hack.

Thanks for info. Could you try to downgrade the firmware to the latest version available on website 2.35 and try it again?
Your reported firmware seems to be not released for field.

As BOB reported, I tried some really slow USB sticks (<5MB/s) and it is not working, strange.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: troth on December 05, 2013, 12:38:59 am
Quote
Thanks for info. Could you try to downgrade the firmware to the latest version available on website 2.35 and try it again?
Your reported firmware seems to be not released for field.

As BOB reported, I tried some really slow USB sticks (<5MB/s) and it is not working, strange.

I'd like to try downgrading, but I'm a tad skittish about doing so without having a way to get the scope back to the firmware that came from the factory. I have not been able to find a cab file for the 2.36 firmware the scope shipped with.

I've tried a faster USB drive (> 20MB/s) with no change in results.

What are the symptoms of failure that people are seeing with slow drives (i.e. what does the scope do when it fails to boot from USB drive)? I don't recall seeing anyone state that explicitly in any of the messages I've read on this thread (quite possible I missed it if it is there).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on December 05, 2013, 06:43:12 pm
Huh, mine is still running 2.35. What did they do in version 2.36 I wonder.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on December 06, 2013, 04:10:56 pm
Huh, mine is still running 2.35. What did they do in version 2.36 I wonder.

Perhaps in 2.36 they've addressed the license hack?  I think there's little doubt Agilent reads this forum.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on December 06, 2013, 04:46:56 pm
Huh, mine is still running 2.35. What did they do in version 2.36 I wonder.

Perhaps in 2.36 they've addressed the license hack?  I think there's little doubt Agilent reads this forum.
I doubt that. Arent there already confirmed people in this thread with brand new scopes running 2.36 with a successful hack?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: con-f-use on December 06, 2013, 05:37:50 pm
I doubt that. Arent there already confirmed people in this thread with brand new scopes running 2.36 with a successful hack?
There are.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on December 06, 2013, 07:21:13 pm
I doubt that. Arent there already confirmed people in this thread with brand new scopes running 2.36 with a successful hack?
There are.
Thought so. Thanks for confirming.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: troth on December 06, 2013, 07:39:40 pm
I doubt that. Arent there already confirmed people in this thread with brand new scopes running 2.36 with a successful hack?
There are.

I just read back through the thread and didn't see any evidence that someone has gotten the hack to work with a scope having 2.36 from the factory.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jstarr on December 06, 2013, 08:49:02 pm
whats a good software to use for modifying the infiniiVisionCore.dll ?

tnx
j
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jstarr on December 06, 2013, 10:16:53 pm
I found "OpenFreely" as the hexeditor to modify infiniiVisionCore.dll.  Does the date/time of the edited file have to be identical to the original?  Right now the edited file has today's date.

tnx
j



How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
    Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
    byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
    Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
    Replace in infiniiVision folder  infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red  message in letf top corner "Unfinalized Software"  and "System Concerns detected: OS version is not correct. Please reload system firmware"

Applications needed:
 WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
 7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on December 07, 2013, 06:25:26 pm
I found "OpenFreely" as the hexeditor to modify infiniiVisionCore.dll.  Does the date/time of the edited file have to be identical to the original?  Right now the edited file has today's date.

tnx
j

I'm using PsPad, but there are lot of other hex editors available.
The data and time is not important.

I doubt that. Arent there already confirmed people in this thread with brand new scopes running 2.36 with a successful hack?
There are.

Could you try to downgrade the firmware to 2.35 and try the hack?
Or do you have the LAN module?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: GregerG on December 07, 2013, 08:56:26 pm
Just confirming it works on my 2.35 2012A as well, had some boot issues until I noticed the startup link was wrong and I also partitioned my (11MB/s 32GB FAT32) stick to 4gig at the same time so I can't say for sure if it would have worked with larger than 7.7gig but it works now so I'm a HAPPY camper :D

I also didn't activate all features as I wasn't sure all worked on 2000-series.... didn't want to push my luck :)
Running fine with 62#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l memMax -l MEMUP -l EMBD -l AUTO -l COMP -l SGM -l MASK -l EDK -l BW20 -l VID -l ADVMATH -l DVM
https://www.dropbox.com/s/nlypogw0866xnwi/20131207_212432.jpg (https://www.dropbox.com/s/nlypogw0866xnwi/20131207_212432.jpg)

Noticing now I forgot WAVEGEN but that license was purchased earlier and it's still activated so it clearly reads previously installed licenses.

THANK YOU for sharing this, have been waiting ages *HUGS* (and hopefully this isn't just an activation of the trial license so it stops in a month :D)
(also I was using the backside usb port, and noticed bootup time was a bit slower - cycled the panel LED's 4 times instead of normal 2 times)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tivoi on December 08, 2013, 10:48:24 am
I was try hack,
usb flash can't work with nomal format

i was try format usb flash with hirrent boot USB, it is work

this is flash format process
http://www.hiren.info/pages/bootcd-on-usb-disk (http://www.hiren.info/pages/bootcd-on-usb-disk)

thanks and best regards
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: GregerG on December 08, 2013, 03:28:50 pm
Yes - regular FAT32 format under windows works great...
Just bought a new, faster, 8gig micro usb-stick (sandisc cruzer fit) and it works just fine, no problems what so ever...

Correction to previous post - it cycles the front panel LED's 6 times, so don't be too hasty and turn it off, give it a few seconds :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: willemite on December 09, 2013, 04:47:26 am
silly me.
after many fails thinking it was the USB formating, or the USB drive, finally remember some post way back that suggested using the same firmware--- I was trying 2.35 on stick, with 2.12 (I think) on the scope. Once I realized that, worked on the next try following upgrade.
I looked high and low for some way to unpack the cab file (with proper file names and directories)-- the referenced program refused to install on all my computers here. Finally I just used 7zip, hunted through the folder structure and noticed the xml file that gave the renaming and directory structure. Used excel to concatenate a few "copy" and "mkdir" into a DOS batchfile that made quick work of putting everything where needed.
dsox2004 now shows 200 mhz
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: GregerG on December 11, 2013, 02:28:15 am
I noticed that the enhanced video (VID) trigger work on the 2000 series,
even though it's not sold by agilent, all the way up to 1080p/i...
Perhaps a coming feature?

Also - my scope is flashed with stock firmware 2.35, and booting the usb stick with 2.35 as well,
and I still get a popup the firmwares don't match, however after you click it away it won't re-appear and the calibration and hardware self tests pass just fine.
Maybe because the md5 crc or timestamp isn't matching anymore? Will look into it tomorrow...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on December 11, 2013, 08:34:03 am
I've changed crc (Microsoft PE file spec.) but it still complains about FW....
Looks like its a verisign signature missmatch problem.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwilson on December 12, 2013, 07:42:04 pm
I just got the LAN module for my DSO-X 3014A. I've seen references to loading the modified startup files on my USB key to the internal storage with the LAN module, but when I try FTPing or telneting to the scope I don't know the username or password.

Could someone please point me in the right direction for connecting or replacing the right startup files?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on December 12, 2013, 08:11:56 pm
Oh, I guess I missed that part of this hack. The USB drive with the custom firmware resides on the USB drive so it has the be left connected to the scope all the time doesnt it?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on December 12, 2013, 11:34:04 pm
I don't know the username or password.

Check page 12
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on December 12, 2013, 11:45:42 pm
Oh, I guess I missed that part of this hack. The USB drive with the custom firmware resides on the USB drive so it has the be left connected to the scope all the time doesnt it?
Yes. If the USB is removed the unit will reboot itself in few seconds.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwilson on December 13, 2013, 12:41:26 am
I don't know the username or password.

Check page 12

Thank you! I was searching for "password" in the thread, not "pass". Happy to report I've been able to modify the built-in files and don't have to boot from USB key anymore.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on December 13, 2013, 01:28:07 am
I don't know the username or password.

Check page 12

Thank you! I was searching for "password" in the thread, not "pass". Happy to report I've been able to modify the built-in files and don't have to boot from USB key anymore.
I have the VGA/LAN module for my MSOX2024, any chance you could write out your steps to doing this? Not having to have the USB drive taking up the port would be very nice.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on December 13, 2013, 03:39:42 am
I don't know the username or password.

Check page 12

Thank you! I was searching for "password" in the thread, not "pass". Happy to report I've been able to modify the built-in files and don't have to boot from USB key anymore.
I have the VGA/LAN module for my MSOX2024, any chance you could write out your steps to doing this? Not having to have the USB drive taking up the port would be very nice.

Telnet to the scope, run "ProcessMgr.exe kill infiniivisionLauncher.exe" and execute "\Secure\infiniiVision\infiniivisionLauncher.exe" with parameters you would like to enable.
From my perspective the USB drive is the easiest way and there is no reason to have the hack inside scope ( except you are going to pretend it is genuine :-).
Also you cannot brick the scope this way.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on December 13, 2013, 05:50:07 am
I don't know the username or password.

Check page 12
Are you referring to this post?

Some "oil into the fire":
telnet login/pass:
infiniivision
skywalker1977
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: craftycoder on December 13, 2013, 09:19:27 pm
Can this be done over USB? What is the process to do it?
Telnet to the scope
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwilson on December 14, 2013, 03:17:00 am
I have the VGA/LAN module for my MSOX2024, any chance you could write out your steps to doing this? Not having to have the USB drive taking up the port would be very nice.

Certainly. The way I did it once knowing the telnet username and password (thanks abyrvalg!) was to copy modified files from a USB stick to the internal storage.

I'm assuming you can render your scope unbootable by messing with the internal filesystem. If you have a working boot USB stick you could theoretically boot from it and fix it, but hopefully it doesn't come to that. Obviously proceed at your own risk.

First make a working bootable USB stick to make sure the options you want work and you've modified the DLL correctly as described earlier in this thread.

Once you're sure that's working, move the USB stick back to your PC. I made a directory in the root of my USB stick to store the files I'm going to copy to internal flash for convenience. Let's call it "temp". Copy in the modified infiniiVisionCore.dll. Also make a new modified copy of infiniivision.lnk from the startup folder.

Unlike booting from the USB stick, your new modified infiniivision.lnk needs to refer to the internal storage version of infiniivisionLauncher.exe (so change the "\usb" back to "\Secure" in the infiniivision.lnk that you modified to make your bootable USB stick). I'm using the following on a DSO-X 3014, for example. If you've already made your bootable USB stick you are probably familiar with the options you can use here and can tailor to your liking:

Code: [Select]
196#\Secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l DVM -l ADVMATH -l AERO -l AUDIO -l AUTO -l COMP -l EMBD -l Flex -l Mask -l MEMUP -l PWR -l SGM -l VID -l WAVEGEN -l EDK -l memMax -l BW20
Now you have the files you need in the temp directory of the USB stick.

Boot your scope from the USB stick (if you are running from internal storage you can't replace the DLL since it's in use. There are ways around that like killing the process, but by booting from the USB stick you're also proving to yourself that if you mess something up you still have a fallback plan to boot the thing). Once booted, telnet to the scope and use the username and password provided by abyrvalg (it seems like I always have to try logging in twice. Not sure if I'm that consistently typo-prone or if there's something funny going on).

Now you're at the command prompt. If you do a 'dir' you'll see the \usb directory, which is your USB stick, and the other internal flash directories like 'secure'. Note that even though you're booting from USB, the root of the USB stick is mounted at \usb (so you'd see \usb\infiniivision, \usb\startup, etc.) and the internal flash directories are at the root level.

Copy the modified DLL to replace the internal one. If you used the same temp directory name I did, a command like this should work:

Code: [Select]
copy \usb\temp\infiniiVisionCore.dll \Secure\infiniiVision
Then copy the startup shortcut to the startup directory. The file is read-only, so I removed the read-only flag on the destination file first. Not sure if that's necessary or not:

Code: [Select]
attrib -r \Secure\startup\infiniivision.lnk
copy \usb\temp\infiniivision.lnk \Secure\startup

That should do it. Power off the scope, pull out the USB stick, and turn it on again. Hope it boots (and even better, hope it boots with your additional license options enabled).

Like I said... you can break your scope so that it won't boot from internal memory if this goes wrong. Be careful! I don't know if there's a firmware recovery procedure on these scopes (luckily it's a topic I haven't had to research yet).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on December 14, 2013, 11:53:51 am
I can add to mwilson's excellent description that there is almost nothing to fear. The startup override functionality doesn't depend neither on infiniiVisionCore.dll nor on .lnk, so it will be possible to boot form USB even if these files are totally corrupt/deleted. And more - there is U-Boot functionality (explored by FrankBuss earlier in this thread) that works at early boot stages and doesn't depend on any files at all.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on December 14, 2013, 12:35:26 pm
mwilson, can you please try this:
edit USB .lnk to
Code: [Select]
33#\windows\cmd.exe \usb\autorun.cmdat USB root create autorun.cmd with
Code: [Select]
copy \usb\temp\infiniiVisionCore.dll \Secure\infiniiVision
attrib -r \Secure\startup\infiniivision.lnk
copy \usb\temp\infiniivision.lnk \Secure\startup
\Secure\infiniiVision\infiniivisionLauncher.exe
(no need to say that files in \temp and all startup override stuff must be present too of course)
The last command (normal scope app startup) is there to prevent boot looping.

This can help people w/o LAN/telnet installing the hack - just boot from such prepared USB stick once.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwilson on December 14, 2013, 09:41:42 pm
mwilson, can you please try this:
edit USB .lnk to
Code: [Select]
33#\windows\cmd.exe \usb\autorun.cmdat USB root create autorun.cmd with
[...]
This can help people w/o LAN/telnet installing the hack - just boot from such prepared USB stick once.

Yep. Played around with this and it doesn't look like cmd.exe can take a file as an argument. However, you can execute .cmd files directly. So this method works if you make your startup .lnk something like:

Code: [Select]
18#\usb\temp\foo.cmd
So indeed folks can install modified files internally just by booting a properly prepared USB stick once. No need for the LAN module. (And presumably if something gets messed up, you can boot from the working USB stick and re-install the firmware as normal to get the internal filesystem back to factory condition.)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on December 15, 2013, 12:53:16 am
So is it better to try and do a "permanent" hack via the USB port instead of doing it via the network port?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwilson on December 15, 2013, 01:57:05 am
So is it better to try and do a "permanent" hack via the USB port instead of doing it via the network port?

The end result is the same, so it doesn't really matter. The USB method we just discussed is executing the same commands you'd execute from the telnet session.

If you have the LAN module, I'd probably recommend the telnet approach because then you can actually see if the commands worked and adapt as necessary... but really, if you just put the right commands in the cmd file it'll work so it's probably a wash.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on December 15, 2013, 03:09:08 am
But as far as risk goes, you could potentially brick your scope using either method if it were going to happen correct?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwilson on December 15, 2013, 03:21:04 am
But as far as risk goes, you could potentially brick your scope using either method if it were going to happen correct?

Yes, but to abyrvalg's point, as long as you have a bootable USB stick, anything you can do through telnet/commands you'd be able to undo. If you don't know what you broke, I'm guessing you can boot from your USB stick and just install the original firmware the normal way and it will restore the internal storage.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tsmith35 on December 15, 2013, 05:18:22 am
mwilson, can you please try this:
edit USB .lnk to
Code: [Select]
33#\windows\cmd.exe \usb\autorun.cmdat USB root create autorun.cmd with
Should that be "34#\windows\cmd.exe \usb\autorun.cmd"?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on December 15, 2013, 07:27:48 am
mwilson, can you please try this:
edit USB .lnk to
Code: [Select]
33#\windows\cmd.exe \usb\autorun.cmdat USB root create autorun.cmd with
Should that be "34#\windows\cmd.exe \usb\autorun.cmd"?

No, if you use the cmd exe and not directly call the cmd/bat file, the scope will restart.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on December 15, 2013, 12:30:28 pm
Code: [Select]
16#\usb\autorun.cmd
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tsmith35 on December 16, 2013, 01:38:55 am
mwilson, can you please try this:
edit USB .lnk to
Code: [Select]
33#\windows\cmd.exe \usb\autorun.cmdat USB root create autorun.cmd with
Should that be "34#\windows\cmd.exe \usb\autorun.cmd"?
Replying to my own post... ::) I didn't notice the space between the "exe" and the "\usb". Do spaces count for the command line length?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwilson on December 16, 2013, 05:10:06 am
mwilson, can you please try this:
edit USB .lnk to
Code: [Select]
33#\windows\cmd.exe \usb\autorun.cmdat USB root create autorun.cmd with
Should that be "34#\windows\cmd.exe \usb\autorun.cmd"?
Replying to my own post... ::) I didn't notice the space between the "exe" and the "\usb". Do spaces count for the command line length?

The space does count. The # doesn't count, though; it's the delimiter between the character count and the command. So 33 is correct in the above example. Although I'm not convinced the system actually uses the number, but I haven't played around with it much to know for sure.

WinCE shortcut file definition is here: http://msdn.microsoft.com/en-us/library/ms861519.aspx (http://msdn.microsoft.com/en-us/library/ms861519.aspx)

(But note that as previously discussed the WinCE cmd.exe doesn't take a file argument like this, so the question of whether the number is correct for this particular example is rather academic...)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: baljemmett on December 16, 2013, 04:34:34 pm
(But note that as previously discussed the WinCE cmd.exe doesn't take a file argument like this, so the question of whether the number is correct for this particular example is rather academic...)

Does adding a /C switch help?  "CMD /C <command>" is the usual way (since DOS days, with COMMAND.COM) to get the command processor to accept a command as a parameter, and the CE docs suggest it's supported...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tsmith35 on December 16, 2013, 10:24:56 pm
(But note that as previously discussed the WinCE cmd.exe doesn't take a file argument like this, so the question of whether the number is correct for this particular example is rather academic...)

Does adding a /C switch help?  "CMD /C <command>" is the usual way (since DOS days, with COMMAND.COM) to get the command processor to accept a command as a parameter, and the CE docs suggest it's supported...

http://msdn.microsoft.com/en-us/library/aa453925.aspx (http://msdn.microsoft.com/en-us/library/aa453925.aspx)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on December 20, 2013, 10:39:00 pm
All structure is created automatically by CAB Manager ( just press right mouse button on files and select Extract).
The structure which is in extracted folder subfolder Secure needs to be copied to USB flash.
Attribused does not matter.
LAN module is not necessary, but can be useful if you are gong to investigate further options.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: heynow on December 23, 2013, 05:59:46 pm
A few previous posts said you need a fast usb stick to get this hack to work.  I found the same issue and booting off slow sticks ends in a black screen and hang.  During the boot and right before the hang I saw there were several infiniivisionLauncher.exe processes running.  I only see one during a normal boot.
I came up with this way.  The changes in the other posts are still needed.  On the usb drive, in Startup\infiniivision.lnk:
Code: [Select]
17#\usb\autorun.cmdIn \usb\autorun.cmd:
Code: [Select]
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\usb\infiniiVision\infiniiVisionLauncher.exe -l DIS -l SGMC -l CABLE
The "kills" get rid of any other infiniivisionLauncher.exe that may have started up.  It could be the booting is taking too long and the scope decided to start the built in infiniivisionLauncher.exe as a back up.  But I don't really know.
The "dir /s \" slow things down.  I can't find a sleep or delay command, but then again I know absolutely nothing about windows.  A delay is needed.
Other "-l" options can be used if you want.
The worst possible slowest 64MB USB stick I could find now works.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: taemun on January 06, 2014, 02:47:29 pm
Any news/comments about the 2.36 FW shipping on newer scopes (as per https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097))?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on January 06, 2014, 03:04:40 pm
Any news/comments about the 2.36 FW shipping on newer scopes (as per https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097))?

No, but the user who reported this firmware has only three post and seems to be no longer online. He did not tried the downgrade to 2.35.
According to number it is minor change.
Scope itself is quite robust if you are going to downgrade FW version, e.g you can downgrade from 2.35 only to the 2.30 and not to previous versions.
This firmware is not available on Agilent website which is weird.
Is there anyone else with firmware 2.36 or scope manufactured in Q3/2013 and later? Does not matter if 2000 or 3000 series.
Title: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: plesa on January 08, 2014, 09:27:00 pm
There were several request for hack DSOX2k and MSOX2k. The hack of this scope is also possible, the description of hack is same which were published for DSO3k and MSOX3k.
Whole hack is tested with firmware 2.35 and is fully working.
The whole hack is on USB drive and there is no modification of fles inside scope, so there is no risk of bricking the scope.
When the USB flash is removed the scope use the purchased licenses and not the hacked firmware from USB flash.
After hacked files loading there is message informn about firmware issue. Ths does not affect the performance, only prevent some jerks to sell hacked scope as a fully licensed one.
In forum reported firmware 2.36 by one user has been not tested due to the poor availability of scope with this FW verson.

For hack we higly reccomends to use really fast USB flah drive.
There is also way how to pernamently load hacked firmware into the scope (batch file on USB drive will rewrite the files in internal scope flash with the hacked one)




Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on January 08, 2014, 09:49:08 pm
The warning message about firmware issue remains on screen all the time, or only seen after boot?

Georg

P.S. I waiting for my DSOX3032.
Title: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: plesa on January 08, 2014, 09:53:16 pm
The warning message about firmware issue remains on screen all the time, or only seen after boot?

Georg

P.S. I waiting for my DSOX3032.

Only after boot up, you need to press button to accept it. And the self test did not passed. But we did not encountered any issue with hacked software.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: troth on January 08, 2014, 10:45:12 pm
Any news/comments about the 2.36 FW shipping on newer scopes (as per https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097))?

No, but the user who reported this firmware has only three post and seems to be no longer online. He did not tried the downgrade to 2.35.


I'm still following this thread, but haven't had anything to contribute to the discussion, so have been lurking.

I'm reluctant to downgrade the FW without a path back to the factory FW or a newer FW. I've been watching the agilent website for newer firmware (since 2.35 was released in june, I was hoping there'd be some update soon-ish).

A few weeks ago I wrote a python script that takes the 2.35 cab and explodes it and explodes the cab file within then uses the setup.xml file to populate the Secure directory with the right names and structure. Then the script modifies and creates all the files needed for the hack. Would not be hard to extend it to automate the population of a USB flash drive.

The script is currently in a private git repo on bitbucket.org. I haven't made it public since I have no way of verifying it's correctness and thus didn't want to inflict it on anyone. I can easily make it public if anyone is interested. It currently only works on Linux, put I don't think it would be difficult to port to Windows. I wrote it to avoid having to use the non-free cab program on windows since I'm much more of a Linux geek.
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: GregerG on January 09, 2014, 01:59:58 am
Only after boot up, you need to press button to accept it. And the self test did not passed. But we did not encountered any issue with hacked software.


It should pass all self tests and calibrations... at least they do pass fine for me...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: travisc on January 09, 2014, 02:00:43 am
My new DSO-X-3034A arrived today.  It had firmware 2.35 installed.  It's now 500MHz and fully optioned up thanks to this thread.

Thank you everyone that worked on this!!!

A few notes that might be helpful to others...

I had to add BW50 to the startup shortcut to upgrade from 350MHz to 500MHz.  I thought the -l All would cover that but apparently not.  So my infiniivision.lnk file is now ...
Code: [Select]
62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS -l BW50
The file structure of my startup drive is slightly different than a post I was comparing to in this thread.  It was missing a few indents which threw me for a bit.  The correct structure is ...

Code: [Select]
\
+-infiniiVision
  +-fpga
  +-upgrade
  +-web
     +-css
     +-help
     +-image
     +-include
     +-web-socket-js
     +-lib
     +-Lxi
        +-Identification
     +-navbar
+-Startup
infiniivisionStartupOverride.txt

I had to use a 4GB flash drive, an 8GB I tried at first didn't work.

When using WinCE CAB Manager I also had to turn on "Simulate Folder Names" when extracting the files to get the correct structure.

Thanks again!


Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: plesa on January 09, 2014, 02:19:50 am
This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: taemun on January 09, 2014, 02:20:51 am
I'm still following this thread, but haven't had anything to contribute to the discussion, so have been lurking.

I'm reluctant to downgrade the FW without a path back to the factory FW or a newer FW. I've been watching the agilent website for newer firmware (since 2.35 was released in june, I was hoping there'd be some update soon-ish).

Do you have the Ethernet option? Can you poke around in Telnet?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: troth on January 10, 2014, 01:20:30 pm
Do you have the Ethernet option? Can you poke around in Telnet?

Unfortunately, I do not have the Ethernet module and it's not in the budget to buy any upgrades until later in the year.
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: RF-Engineer on January 10, 2014, 03:37:35 pm
This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

I've seen references to 255#, 256#, 62#.  What do these prefix numbers mean?
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: RF-Engineer on January 10, 2014, 03:48:51 pm
Only after boot up, you need to press button to accept it. And the self test did not passed. But we did not encountered any issue with hacked software.


It should pass all self tests and calibrations... at least they do pass fine for me...

Interesting.  After boot-up, you don't see a red-colored firmware error message?  How did you do that?
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: plesa on January 10, 2014, 05:38:23 pm
Do you have the Ethernet option? Can you poke around in Telnet?

Unfortunately, I do not have the Ethernet module and it's not in the budget to buy any upgrades until later in the year.

Please do not use hacked scope for business, it is for home/ non commercial use only!!
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: plesa on January 10, 2014, 05:41:22 pm
This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

I've seen references to 255#, 256#, 62#.  What do these prefix numbers mean?

Read the whole thread. Briefly it is ammount of characters in link.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ZeroAviation on January 10, 2014, 05:47:40 pm
Hi guys,

So I have read the whole thread. I want to make sure I understand something correctly though.

You can use the shortcut's without modifying the dll? Is that correct?

Thanks all for your work on this.

-Matt
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: plesa on January 10, 2014, 05:51:14 pm
Hi guys,

So I have read the whole thread. I want to make sure I understand something correctly though.

You can use the shortcut's without modifying the dll? Is that correct?

Thanks all for your work on this.

-Matt

No, you need to modify InfiniivisionCore.dll, this will unlok the options which needs to be selected in the link file.
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: RF-Engineer on January 10, 2014, 06:37:54 pm
This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

I've seen references to 255#, 256#, 62#.  What do these prefix numbers mean?

Read the whole thread. Briefly it is ammount of characters in link.

I see that now in your message #282.  However "wersi" used #62 with many switches after, totalling much more than 62 characters.  I've been making changes without changing that parameters and the functions still seem to work.  Perhaps the firmware error message goes away with the correct character count?

To deal with the firmware error message, I used the hex editor that now shows "all options intialized and enabled..."  Same when the scope finishes booting.  This sure does look like a factory issue that way!



 
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: plesa on January 11, 2014, 09:43:28 am
There were several request for the digital probe schematic.The original probe cannot be dissassembled without damage.
So I just found schematic in the Agilent documents
http://cp.literature.agilent.com/litweb/pdf/5968-4632E.pdf (http://cp.literature.agilent.com/litweb/pdf/5968-4632E.pdf)
I saw lot of the probes on ebay and grabbers as well, pretty cheap.
The type is N6459 (8 channels) and N6450 (16 channels)
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: RF-Engineer on January 11, 2014, 01:12:04 pm
There were several request for the digital probe schematic.The original probe cannot be dissassembled without damage.
So I just found schematic in the Agilent documents
http://cp.literature.agilent.com/litweb/pdf/5968-4632E.pdf (http://cp.literature.agilent.com/litweb/pdf/5968-4632E.pdf)
I saw lot of the probes on ebay and grabbers as well, pretty cheap.
The type is N6459 (8 channels) and N6450 (16 channels)

I see many used Agilent "E" series logic probes available.  Anyone know if these are pin-for-pin compatible with the Agilent "N" series for the DSOX/MSOX?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: nowlan on January 11, 2014, 01:24:02 pm
Did anyone look inside the lan/vga adapter?
Not just simple resistors?
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: RF-Engineer on January 11, 2014, 01:36:37 pm
This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

I noticed that when the three relevant files are uploaded direct to the DSOX from the USB stick, the "*" in front of each option in in "About Oscilloscope" is removed as well when using prior characters strings as described in earlier posts.     

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on January 11, 2014, 01:39:41 pm
I've dissembled a logic probe, but I didn't take a good camera yet.
ASAP, I will put the photos from it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on January 11, 2014, 02:01:11 pm
I also found this documentation some times ago.

the Probes with grabbers are not so expensive on ebay.
In the company where i work we have an old E9340A with that 16 channel probes and i mean that i have measured something between the grabbers and the input pins for the flat cable.
But this was some month ago and i can't remember me for the exact value, i think i have measured round about 90kohms.

But now something other:
while i was analysing the dll for the DSOX4000 series i found a different word CAKE in the source.
Is there someone with a DSOX4000 that can try this word in the Screensaver Usertext?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Isamun on January 11, 2014, 02:37:47 pm
Did anyone look inside the lan/vga adapter?
Not just simple resistors?

Dave did a teardown:
EEVblog #145 - Agilent LAN/VGA Module Teardown (https://www.youtube.com/watch?v=hy1TYKetIpM#ws)

LAN goes straight to a MagJack. The VGA part has a bit more to it (screen buffer, driver and fpga for timing)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: RF-Engineer on January 11, 2014, 08:25:15 pm
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600.  I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit.  Impeccable timing, isn't it?   Can anyone else spot its availability?   
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grego on January 12, 2014, 05:12:10 pm
I've been trying to get this to work for a while now - I've tried 3 different USB sticks (1G, 2G and 32G), I've got everything extracted:

infiniiVision/
Startup/
infiniivisionStartupOverride.txt

At the root of my stick.  The Override.txt file just contains "True" on a single line.  The .dll has been modified.  The .lnk file has been altered per instructions.

With the stick in I can see it being accessed when the scope is starting up, after a second or two from reading from it though it moves immediately into it's normal boot cycle and then comes up clean on the internally installed firmware.  Any suggestions?

I'm messing with this just to see how it all works - I actually have licenses installed for the things I really use but this is more intellectual curiousity now and it's frustrating when things don't work. ;-)

Thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: taemun on January 12, 2014, 05:34:00 pm
With the stick in I can see it being accessed when the scope is starting up, after a second or two from reading from it though it moves immediately into it's normal boot cycle and then comes up clean on the internally installed firmware.  Any suggestions?

Which FW are you on?
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: plesa on January 12, 2014, 06:19:45 pm
In attachment is the USB folder structure including the .lnk files for fully enabled licenses and also for automatic copy to flash. Which will not require the presence of USB flash plugged.
You just need to unpack the InfiniiVisionSetup.CAB with the WinCE CAB MAnager ( just press right mouse button on files and select Extract and choose Simulate Folder Names)
Copy the files intoprepared folder structure inside Infiniivision folder.
And choose and rename if necessary the file in the Startup folder ( by default is set the full licence set for 3k series).
The scope should contains firmware 2.35.
Turn scope with this USB flash on.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grego on January 12, 2014, 06:20:56 pm
With the stick in I can see it being accessed when the scope is starting up, after a second or two from reading from it though it moves immediately into it's normal boot cycle and then comes up clean on the internally installed firmware.  Any suggestions?

Which FW are you on?

2.35.2013061800
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Carrington on January 12, 2014, 08:05:41 pm
Hi

I know that the DSOX200*A can be upgrade to DSOX201*A [DSOX2BW1*], and the DSOX201*A can be upgrade to DSOX202*A [DSOX2BW2*].
Now, I know that a DSOX2002A with the hack can become in a DSOX2022A, but its real BW is only 160MHz (-3dB).
Is this also the real BW for a DSOX202*A? The datasheet says 200MHz (-3dB warranted).
Please, can someone with a DSOX201*A or a DSOX202*A measure its bandwidth (without probe, straight to BNC, using a 50 Ohm Feed Through)?

Thanks.

Note: Also, I remember read in the forum that all have the same input stage.
         The input stage is based on the LMH6518?
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: travisc on January 12, 2014, 09:51:08 pm
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600.  I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit.  Impeccable timing, isn't it?   Can anyone else spot its availability?   

I was looking for the logic cable assembly as well.  I ended up buying the one below off ebay the other day for my DSOX3k.  It shipped within 12 hours.  I'll have it in my hands tomorrow and can report back.

http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: taemun on January 13, 2014, 01:43:38 am
Now, I know that a DSOX2002A with the hack can become in a DSOX2022A, but its real BW is only 160MHz (-3dB).

How did you test this? As Agilent are willing to sell a software license key to make a DSOX2002A into a DSOX2022A, I would presume that all of them are capable of the full warranted BW (200MHz -3dB point). It isn't like they are binning the front-end and putting the slow ones in the DSOX2002A models.
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: plesa on January 13, 2014, 07:40:12 am
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600.  I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit.  Impeccable timing, isn't it?   Can anyone else spot its availability?   

I was looking for the logic cable assembly as well.  I ended up buying the one below off ebay the other day for my DSOX3k.  It shipped within 12 hours.  I'll have it in my hands tomorrow and can report back.

http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
Thnaks this type seems to have the same pinout and hopefully will be compatible.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on January 13, 2014, 07:44:21 am
Hi

I know that the DSOX200*A can be upgrade to DSOX201*A [DSOX2BW1*], and the DSOX201*A can be upgrade to DSOX202*A [DSOX2BW2*].
Now, I know that a DSOX2002A with the hack can become in a DSOX2022A, but its real BW is only 160MHz (-3dB).
Is this also the real BW for a DSOX202*A? The datasheet says 200MHz (-3dB warranted).
Please, can someone with a DSOX201*A or a DSOX202*A measure its bandwidth (without probe, straight to BNC, using a 50 Ohm Feed Through)?

Thanks.

Note: Also, I remember read in the forum that all have the same input stage.
         The input stage is based on the LMH6518?

I tested the badwidth and upgrade on 3k series and it was accordng to spec. I used the "FreeElectron" Jim Williams pulse generator. See one of my post in this thread.
How did you measure and calculate BW?
Did you use the Agilent offer for free bandwith upgrade?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: GregerG on January 13, 2014, 12:16:48 pm
Just a quick check with a sweepgenerator my 2012A with BW20 drops off at  ~250MHz.
Make sure you're using good probes if you're not using straight coax, the supplied ones for me was only 150MHz...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Carrington on January 13, 2014, 02:19:36 pm
I tested the badwidth and upgrade on 3k series and it was accordng to spec. I used the "FreeElectron" Jim Williams pulse generator. See one of my post in this thread.
How did you measure and calculate BW?
Did you use the Agilent offer for free bandwith upgrade?

Since Agilent specifies that DSOX2000A response is Gaussian (0.35), yes the "FreeElectron" Jim Williams pulse generator is OK.

But I prefer the traditional method (sweep up to -3dB), because from what I've learned, the set can be a combination between flat and/or Gaussian.

Yes, I know that offer, farnell and rs-online, apply it directly.

Thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Carrington on January 13, 2014, 02:20:54 pm
Just a quick check with a sweepgenerator my 2012A with BW20 drops off at  ~250MHz.
Make sure you're using good probes if you're not using straight coax, the supplied ones for me was only 150MHz...
Exactly, that's what I wanted to know.
Thanks.  ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Carrington on January 13, 2014, 02:32:36 pm
By the way, after ~4 days, Agilent continues without giving me an answer.
Anyone know if the trigger is digital for the 2000X series?

Thanks.
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: RF-Engineer on January 13, 2014, 06:51:40 pm
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600.  I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit.  Impeccable timing, isn't it?   Can anyone else spot its availability?   

I was looking for the logic cable assembly as well.  I ended up buying the one below off ebay the other day for my DSOX3k.  It shipped within 12 hours.  I'll have it in my hands tomorrow and can report back.

http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)

Travisc, please provide us with an update as to whether or not your logic cable is working.  Thank you!
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: Someone on January 13, 2014, 09:34:04 pm
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600.  I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit.  Impeccable timing, isn't it?   Can anyone else spot its availability?   

I was looking for the logic cable assembly as well.  I ended up buying the one below off ebay the other day for my DSOX3k.  It shipped within 12 hours.  I'll have it in my hands tomorrow and can report back.

http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
Or catch them through the forum at a good discount: https://www.eevblog.com/forum/buysellwanted/fs-hpagilent-logic-pods/msg189290/#msg189290 (https://www.eevblog.com/forum/buysellwanted/fs-hpagilent-logic-pods/msg189290/#msg189290)

Tested on a MSOX and work perfectly.
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: plesa on January 13, 2014, 09:59:50 pm
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600.  I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit.  Impeccable timing, isn't it?   Can anyone else spot its availability?   

I was looking for the logic cable assembly as well.  I ended up buying the one below off ebay the other day for my DSOX3k.  It shipped within 12 hours.  I'll have it in my hands tomorrow and can report back.

http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
Or catch them through the forum at a good discount: https://www.eevblog.com/forum/buysellwanted/fs-hpagilent-logic-pods/msg189290/#msg189290 (https://www.eevblog.com/forum/buysellwanted/fs-hpagilent-logic-pods/msg189290/#msg189290)

Tested on a MSOX and work perfectly.
Is it includng grabbers and the grounding extension?
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: travisc on January 13, 2014, 10:15:46 pm
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600.  I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit.  Impeccable timing, isn't it?   Can anyone else spot its availability?   

I was looking for the logic cable assembly as well.  I ended up buying the one below off ebay the other day for my DSOX3k.  It shipped within 12 hours.  I'll have it in my hands tomorrow and can report back.

http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)

Travisc, please provide us with an update as to whether or not your logic cable is working.  Thank you!

Just an update to the logic cable assembly I purchased off eBay.  I received it today.  I tested all 16 lines with my DSOX3 series scope and they worked fine.  The quality of the cables, wires, and probes are excellent.  The probes and connectors all have little Agilent logos on them.  The parts were well packed, and the bags they came in had Agilent part and lot numbers on them.  It's the real deal.  I'm very happy with them.
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: RF-Engineer on January 13, 2014, 10:58:13 pm
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600.  I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit.  Impeccable timing, isn't it?   Can anyone else spot its availability?   

I was looking for the logic cable assembly as well.  I ended up buying the one below off ebay the other day for my DSOX3k.  It shipped within 12 hours.  I'll have it in my hands tomorrow and can report back.

http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)

Travisc, please provide us with an update as to whether or not your logic cable is working.  Thank you!

Just an update to the logic cable assembly I purchased off eBay.  I received it today.  I tested all 16 lines with my DSOX3 series scope and they worked fine.  The quality of the cables, wires, and probes are excellent.  The probes and connectors all have little Agilent logos on them.  The parts were well packed, and the bags they came in had Agilent part and lot numbers on them.  It's the real deal.  I'm very happy with them.

Great.  I just ordered the same set.  Thanks for getting back to us!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on January 13, 2014, 11:31:12 pm
So i ordered now the second last one.
The Original part costs around 900Euros.
http://www.home.agilent.com/myagilent/faces/partDetail.jspx?partNumber=N6450-60001 (http://www.home.agilent.com/myagilent/faces/partDetail.jspx?partNumber=N6450-60001)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on January 14, 2014, 04:49:47 am
There isnt by chance any way to enable 16 digital lines for the X-2000 series instead of the 8 is there?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: taemun on January 14, 2014, 04:57:55 am
There isnt by chance any way to enable 16 digital lines for the X-2000 series instead of the 8 is there?

From Dave's teardown, no. The buffer chips etc aren't loaded.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jurkin on January 14, 2014, 12:08:50 pm
Inside  N6459-61601 (logic analyzer probe cable)

(http://www.imageup.ru/img70/1625605/n6459_1.jpg)
(http://www.imageup.ru/img70/1625606/n6459_2.jpg)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on January 14, 2014, 07:06:46 pm
Thank you for this photo.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on January 15, 2014, 08:14:18 am
Has anyone ordered a new DSOX-3034A from Newark or TEquipment.net in the US?  I wonder if it is likely to have firmware 2.35 or 2.36 on it....

@travisc: you got your DSOX-3034A just last week; was that from a US distributor?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: travisc on January 15, 2014, 12:59:43 pm
Has anyone ordered a new DSOX-3034A from Newark or TEquipment.net in the US?  I wonder if it is likely to have firmware 2.35 or 2.36 on it....

@travisc: you got your DSOX-3034A just last week; was that from a US distributor?

I bought mine at Newark in the US.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bazillus on January 17, 2014, 05:12:49 pm
I just tested, original Firmware 2.36 did not work for USB boot, just resulted in cyclic blinking of the buttons with no software being started.

Then, I "updated" to the latest firmware available from the Agilent homepage (2.35) - as suggested by the scope itself.

Now, USB boot works perfectly fine.

Stick is a SanDisk Extreme USB 3.0 16GB.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on January 24, 2014, 09:39:34 pm
Yay!!!

Just got a customer return DSO-X3000 returned back from Agilent calibration date 2 Jan 2014, they upgraded it to firmware 2.36.

Downgraded to 2.35 from the Agilent website, edited the DLL and created a USB drive and now it's all options enabled!!

Got the 'WARNING: Unfinalised software' message but otherwise perfect!!

Very happy bunny indeed  :)

Anybody now want a Rigol 2072 all options enabled brand new in box never used??!!

Helpful link...
https://dl.dropboxusercontent.com/u/2063383/DSOX3000%20hack.zip
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on January 25, 2014, 12:37:15 am
I had to try about a dozen USB sticks till I finally got one that worked reliably.

Didn't work:
Kingmax 32GB USB3 (50% of the time it was ok)
SanDisk Cruser Edge 8GB
SanDisk Cruser Edge 16GB
pqi 16GB USB3
Verbatim 16GB
PNY 8GB

Worked:
Kingston 4GB microSD with adaptor
DaneElec 2GB SD with cheapo USB card reader
Integral 8GB (Argos £7 cheapest they sold) http://www.argos.co.uk/static/Product/partNumber/9093410.htm (http://www.argos.co.uk/static/Product/partNumber/9093410.htm)

In my experience cheaper slower smaller is better...?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Carrington on January 25, 2014, 02:36:39 pm
Why the trigger jitter is not specified in the datasheet for the DSO-X series?
I can't find its value.  :-//
Thanks.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on January 25, 2014, 03:22:40 pm
I just tested, original Firmware 2.36 did not work for USB boot, just resulted in cyclic blinking of the buttons with no software being started.

Then, I "updated" to the latest firmware available from the Agilent homepage (2.35) - as suggested by the scope itself.

Now, USB boot works perfectly fine.

Stick is a SanDisk Extreme USB 3.0 16GB.

Thanks for testing!! There were several user who affraid to downgrade scope to 2.35. Was there any warnining message?
Prior downgrade I reccomneds to reset scope to factory default, this help during my downgrading experiment with firmwares prior 2.35.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on January 25, 2014, 03:51:43 pm
USB boot loops on 2.36 because of file versions mix I guess. It's no a true boot actually, the OS (and all files in OS directories) from internal flash is used, just the scope app is started from USB, so a mix of 2.36 internal and 2.35 external files occurs.

Somebody with that dreaded 2.36 should pull it out via telnet or USB stick batch copy script for study.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bazillus on January 25, 2014, 08:05:28 pm
Thanks for testing!! There were several user who affraid to downgrade scope to 2.35. Was there any warnining message?
Prior downgrade I reccomneds to reset scope to factory default, this help during my downgrading experiment with firmwares prior 2.35.

Neither problems nor warning messages at all. I expected a message like "you try to downgrade your scope" or "the latest firmware is already installed on your scope" but none of them appeared. I copied the cab file onto a USB stick, followed the original software "upgrade" procedure on the scope, then it copied files for 2-3 minutes, rebooted and the 2.35 version OS started without any hazzle. Also calibration is still fine. I think, it resets to factory default during the "upgrade" process, but I can't confirm.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on January 25, 2014, 10:13:17 pm
Digging around in the software I found an interesting thing...

Dealer ex-demo scopes with all options enabled have a time limit of 9 months on those options.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on January 25, 2014, 10:17:13 pm
The expiration date is built in the key, it is not related to the comandline parameter
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on January 27, 2014, 11:05:16 pm
It should be LAN module for 181 USD
http://www.home.agilent.com/myagilent/faces/partDetail.jspx?partNumber=75019-68705&imageStatus=NO&_afrLoop=1455775011571000&_afrWindowMode=0&_afrWindowId=null#%40%3F_afrWindowId%3Dnull%26_afrLoop%3D1455775011571000%26imageStatus%3DNO%26partNumber%3D75019-68705%26_afrWindowMode%3D0%26_adf.ctrl-state%3D39lnsndix_58 (http://www.home.agilent.com/myagilent/faces/partDetail.jspx?partNumber=75019-68705&imageStatus=NO&_afrLoop=1455775011571000&_afrWindowMode=0&_afrWindowId=null#%40%3F_afrWindowId%3Dnull%26_afrLoop%3D1455775011571000%26imageStatus%3DNO%26partNumber%3D75019-68705%26_afrWindowMode%3D0%26_adf.ctrl-state%3D39lnsndix_58)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on January 28, 2014, 05:21:29 am
It should be LAN module for 181 USD
http://www.home.agilent.com/myagilent/faces/partDetail.jspx?partNumber=75019-68705&imageStatus=NO&_afrLoop=1455775011571000&_afrWindowMode=0&_afrWindowId=null#%40%3F_afrWindowId%3Dnull%26_afrLoop%3D1455775011571000%26imageStatus%3DNO%26partNumber%3D75019-68705%26_afrWindowMode%3D0%26_adf.ctrl-state%3D39lnsndix_58 (http://www.home.agilent.com/myagilent/faces/partDetail.jspx?partNumber=75019-68705&imageStatus=NO&_afrLoop=1455775011571000&_afrWindowMode=0&_afrWindowId=null#%40%3F_afrWindowId%3Dnull%26_afrLoop%3D1455775011571000%26imageStatus%3DNO%26partNumber%3D75019-68705%26_afrWindowMode%3D0%26_adf.ctrl-state%3D39lnsndix_58)
Wait, so Im confused. That LAN module you linked to says that it was replaced by the DSOXLAN-FG, if I already have the DSOXLAN module in my MSOX2024A does that mean that there is a new/updated LAN/VGA module. The link for the DSOXLAN-FG module says: "This part is not available for direct sale but an instrument repair is orderable through our service center. Please contact Agilent to inquire about returning your instrument for repair."
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on January 28, 2014, 11:33:22 am
I wonder what's changed, FG can't stand for Function Gen so what could it be?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on January 28, 2014, 08:01:51 pm
I just contacted Agilent on the DSOXLAN-FG module and apparently those links that were posted were not supposed to be exposed to the general public. He explained that the DSOXLAN-FG is a part reference for the entire assembly that is sold to us as the DSOXLAN. He said there is nothing different about its merely an internal part number.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on January 28, 2014, 10:26:12 pm
I just contacted Agilent on the DSOXLAN-FG module and apparently those links that were posted were not supposed to be exposed to the general public. He explained that the DSOXLAN-FG is a part reference for the entire assembly that is sold to us as the DSOXLAN. He said there is nothing different about its merely an internal part number.

Thanks for check, I just post it when I found it on website.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on January 30, 2014, 10:08:05 pm
My DSOXLAN modul that I have ordered from Datatec a couple of weeks ago was marked with DSOXLAN FG.
 
@abyrvalg
Yes I'm also interested for a 2.36 Firmware packet to look inside the core dll

Also i have prepared a raw image with the Keysight Logo to replace the megazoom screensaver logo but until now i didn't had the time to change the data in the dll :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Matrixx on February 01, 2014, 12:20:43 am
Had version 2.36.
downgraded to 2.35 and now it works :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on February 01, 2014, 07:20:20 am
Hi folks, I'm going to take advantage of the Agilent promo --- I have ordered a DSOX3k + LAN module.  The items are back-ordered 4 wks, so it'll be a bit of a wait...but I expect it to be loaded with v2.36 firmware.  Following what I've read here, I will telnet in, copy the files to a local USB, and share them here.  Hopefully we find a way to make v2.36 work from USB boot with configured options! Thanks people for all the ideas shared so far!  :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on February 03, 2014, 05:36:21 pm
Hi folks, I'm going to take advantage of the Agilent promo --- I have ordered a DSOX3k + LAN module.  The items are back-ordered 4 wks, so it'll be a bit of a wait...but I expect it to be loaded with v2.36 firmware.  Following what I've read here, I will telnet in, copy the files to a local USB, and share them here.  Hopefully we find a way to make v2.36 work from USB boot with configured options! Thanks people for all the ideas shared so far!  :)
Why not just downgrade?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on February 03, 2014, 08:06:53 pm
Why not just downgrade?

Well, since we know that works already it is easy last resort.  I think it will be fun to try 2.36; several people are curious to see the core dll, so I can help with that effort.  And, eventually 2.36 might be on Agilents website for download.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grego on February 03, 2014, 10:26:13 pm
Why not just downgrade?

Well, since we know that works already it is easy last resort.  I think it will be fun to try 2.36; several people are curious to see the core dll, so I can help with that effort.  And, eventually 2.36 might be on Agilents website for download.

I'm still trying to get the modified 2.35 version working on my scope. :(
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grego on February 12, 2014, 04:04:28 pm
Finally got it to work using a podunk 4G USB stick I got from Digikey for attending some training from ST Micro.  Go figure.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eurofox on February 12, 2014, 04:13:41 pm
Hi,

I just wonder if I miss something?

Base on the Quote from: plesa on November 03, 2013, 10:24:37 PM

Instead of moving the startup on the USB key just live on the local disk

How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
    Find \Secure\infiniiVision\infiniiVisionCore.dll
2a. copy infiniiVisionCore.dll to infiniiVisionCore.old
3. Change at location 0x277e50 in infiniiVisionCore.dll
    byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3

To reverse the change infiniiVisionCore.old to infiniiVisionCore.dll
Restart ...

eurofox

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on February 16, 2014, 12:34:59 am
Well only time will tell I suppose. We'll just have to hide and watch what they do.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on February 16, 2014, 08:23:31 pm
Hi,

I just wonder if I miss something?
Base on the Quote from: plesa on November 03, 2013, 10:24:37 PM

Instead of moving the startup on the USB key just live on the local disk
<snip>
To reverse the change infiniiVisionCore.old to infiniiVisionCore.dll
Restart ...

eurofox

I believe that would work, and you could also overwrite the infiniivision.lnk file with the original.  But, I haven't tried any of this yet...still waiting for gear to arrive.

In any case, you would want to make sure you have a failsafe USB boot key in the event something was corrupted on the local disk, and especially if you don't have the LAN module, as you might be unable to boot the scope and/or be "locked out" of it in some way and unable to resolve the problem.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on February 26, 2014, 09:03:05 pm
Muahahaha! :-DD
Agilent DSOX2000/3000 Easteregg Spaceship Screensaver (https://www.youtube.com/watch?v=A4zTj5a7cGU#ws)
Here is it the Enterprise Screensaver.

I did take a look in the dsox4000 dll and there are a lot more debug information and resources.
I opened the 4000 infiniivision with a resource hacker and I was able to extract bitmaps and Winform dialogs.
After disassembling the dll I searched for the text TREK and found the reference to this in a subfunction with other references to ...Screensaver...
So i tried it on my scope and bingo.

Regards
Kai

Today i was at the embedded world fair here in Nürnberg/Germany and i could try the Screensaver Easteregg with the text TREK which will work as seen in my video.
After I started the Preview it will show some credits.

It was a little bit sad that i didn't have a possibility to make a video of this.

It would be nice if someone which have a DSOX4000 available take a video of this easteregg.


 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on February 27, 2014, 06:58:35 pm
Hi folks, I'm going to take advantage of the Agilent promo --- I have ordered a DSOX3k + LAN module.  The items are back-ordered 4 wks, so it'll be a bit of a wait...but I expect it to be loaded with v2.36 firmware.  Following what I've read here, I will telnet in, copy the files to a local USB, and share them here.  Hopefully we find a way to make v2.36 work from USB boot with configured options! Thanks people for all the ideas shared so far!  :)

It's coming next Wednesday (March 5th)! :)

Edit: It has arrived! Niccceeeee! As expected, it has firmware v2.36 on it.  The DSOXLAN module has shipped separately, so I need to wait few more days...  Will update again when I have everything!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 18, 2014, 02:08:43 am
I just contacted Agilent on the DSOXLAN-FG module and apparently those links that were posted were not supposed to be exposed to the general public. He explained that the DSOXLAN-FG is a part reference for the entire assembly that is sold to us as the DSOXLAN. He said there is nothing different about its merely an internal part number.

My DSOXLAN modul that I have ordered from Datatec a couple of weeks ago was marked with DSOXLAN FG.

I can add that the DSOXLAN module that I bought (from ZoroTools) was labeled "DSOXLAN-FG"; it came in a legit Agilent box, sealed and well packaged.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 18, 2014, 02:47:35 am
My Agilent DSO-X 3034A arrived earlier in the month and it took until today to get a DSOXLAN module for it.  The scope is running v2.36 firmware as has been the case for recent folks. It's been a pleasure to use so far, and I'm looking forward to unlock a little extra potential.

For the purpose of exploring v2.36, here is some details (for the complete file listing, see attached FileList.txt):

    Directory of \Secure\infiniiVision

01/01/86  12:04a    <DIR>                    web
01/01/86  12:04a    <DIR>                    fpga
10/10/07  06:45p                       46624 System.Drawing.dll
10/10/07  06:45p                      214552 mscorlib.dll
05/05/13  09:21a                       82432 Agilent.Cdf.Api.Licensing.dll
05/05/13  09:21a                      160256 Agilent.Cdf.Api.Lxi.dll
05/05/13  09:21a                       85504 Agilent.Cdf.Api.Security.dll
05/05/13  09:21a                       28160 Agilent.Cdf.Api.SystemManagement.dll
05/05/13  09:21a                      163840 Agilent.Cdf.Api.dll
05/05/13  09:21a                        9216 Agilent.Cdf.Core.Lxi.Web.ComServer.Interop.dll
08/24/12  03:16p                      238080 OpenNETCF.dll
05/16/13  08:43p                       13312 WebPageData.dll
08/24/12  03:16p                      398336 SetupConverter.exe
01/01/86  12:04a                     1152032 splashImage.bin
08/24/12  03:17p                      251392 dnssd_CE.dll
08/24/12  03:17p                      355840 libcups2.dll
08/24/12  03:17p                       83968 libcups2backend.dll
09/13/13  11:10a                      215040 vncServer.exe
08/24/12  03:20p                       21504 websockify.exe
09/13/13  11:17a                    17312416 infiniiVisionCore.dll
09/13/13  11:10a                       12104 infiniiVisionLauncher.exe
09/13/13  11:10a                      180736 infiniiVisionWebCom.dll


The infiniiVisionCore.dll is the same size (in bytes) as the previous v2.35 release, however the two files are different

The bytes previously mentioned to patch at location 0x277e50 are not there.  My best guess (just by comparing, and noting the same sequence of bytes) is that they are now at 0x277e30.

I patched the bytes at 0x277e30, and setup the USB boot key as per the instructions here.  I tried 3 different USB keys: SanDisk Cruzer 2GB, Kingston DataTraveler 4GB, Transcend 32GB.  All were USB 2.0 drives, and formatted FAT32.  None of these drives worked.  During boot, groups of LEDs on front of the scope would flash in sequence and after a short while the scope would restart and try again.  Removing the USB drive, the scope would boot as normal.

I am not sure if I patched the infiniiVisionCore.dll correctly as it is different to v2.35.  I have uploaded the .dll here. (http://wikisend.com/download/130184/infinii236.zip)  I hope a more knowledgeable person could look at it and provide some comments.  If more files are needed, just let me know. @plesa @abyrvalg hoping you guys might be able to take a look.


Reading back through the thread, people have had success with:
"a podunk 4G USB stick I got from Digikey"
SanDisk Extreme USB 3.0 16GB
Kingston 4GB microSD with adaptor
DaneElec 2GB SD with cheapo USB card reader
Integral 8GB

Hoping I will not have to downgrade --- I will keep trying with other USB drives...

Sparky
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on March 18, 2014, 08:08:21 am
Sparky, let's partition the problem a bit: try booting from USB w/o any patches first (original dll, no added params in .lnk) - the scope should start normally (but slower) using files on USB.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on March 18, 2014, 08:31:56 am
My Agilent DSO-X 3034A arrived earlier in the month and it took until today to get a DSOXLAN module for it.  The scope is running v2.36 firmware as has been the case for recent folks. It's been a pleasure to use so far, and I'm looking forward to unlock a little extra potential.

For the purpose of exploring v2.36, here is some details (for the complete file listing, see attached FileList.txt):

    Directory of \Secure\infiniiVision

01/01/86  12:04a    <DIR>                    web
01/01/86  12:04a    <DIR>                    fpga
10/10/07  06:45p                       46624 System.Drawing.dll
10/10/07  06:45p                      214552 mscorlib.dll
05/05/13  09:21a                       82432 Agilent.Cdf.Api.Licensing.dll
05/05/13  09:21a                      160256 Agilent.Cdf.Api.Lxi.dll
05/05/13  09:21a                       85504 Agilent.Cdf.Api.Security.dll
05/05/13  09:21a                       28160 Agilent.Cdf.Api.SystemManagement.dll
05/05/13  09:21a                      163840 Agilent.Cdf.Api.dll
05/05/13  09:21a                        9216 Agilent.Cdf.Core.Lxi.Web.ComServer.Interop.dll
08/24/12  03:16p                      238080 OpenNETCF.dll
05/16/13  08:43p                       13312 WebPageData.dll
08/24/12  03:16p                      398336 SetupConverter.exe
01/01/86  12:04a                     1152032 splashImage.bin
08/24/12  03:17p                      251392 dnssd_CE.dll
08/24/12  03:17p                      355840 libcups2.dll
08/24/12  03:17p                       83968 libcups2backend.dll
09/13/13  11:10a                      215040 vncServer.exe
08/24/12  03:20p                       21504 websockify.exe
09/13/13  11:17a                    17312416 infiniiVisionCore.dll
09/13/13  11:10a                       12104 infiniiVisionLauncher.exe
09/13/13  11:10a                      180736 infiniiVisionWebCom.dll


The infiniiVisionCore.dll is the same size (in bytes) as the previous v2.35 release, however the two files are different

The bytes previously mentioned to patch at location 0x277e50 are not there.  My best guess (just by comparing, and noting the same sequence of bytes) is that they are now at 0x277e30.

I patched the bytes at 0x277e30, and setup the USB boot key as per the instructions here.  I tried 3 different USB keys: SanDisk Cruzer 2GB, Kingston DataTraveler 4GB, Transcend 32GB.  All were USB 2.0 drives, and formatted FAT32.  None of these drives worked.  During boot, groups of LEDs on front of the scope would flash in sequence and after a short while the scope would restart and try again.  Removing the USB drive, the scope would boot as normal.

I am not sure if I patched the infiniiVisionCore.dll correctly as it is different to v2.35.  I have uploaded the .dll here. (http://wikisend.com/download/130184/infinii236.zip)  I hope a more knowledgeable person could look at it and provide some comments.  If more files are needed, just let me know. @plesa @abyrvalg hoping you guys might be able to take a look.


Reading back through the thread, people have had success with:
"a podunk 4G USB stick I got from Digikey"
SanDisk Extreme USB 3.0 16GB
Kingston 4GB microSD with adaptor
DaneElec 2GB SD with cheapo USB card reader
Integral 8GB

Hoping I will not have to downgrade --- I will keep trying with other USB drives...

Sparky

Read the whole thread. 2.36 is not possible to patch the same way. To hack the scope you need to downgrade the firmware to 2.35 as few members does.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on March 18, 2014, 11:26:55 am
plesa, do you know where is the problem exactly? USB startup override itself doesn't work anymore? Or some problems with patching?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on March 18, 2014, 11:32:36 am
Thanks Sparky for sharing the new dll version.

I copied the dll to my usb stick and i was able to start it but the dll hack at the right position is not working.
Also i didn't see any changes i the near of the Unfinalized Software output.
I will spend some more time today in the evening.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on March 18, 2014, 12:38:49 pm
plesa, do you know where is the problem exactly? USB startup override itself doesn't work anymore? Or some problems with patching?

Currently I do not have the 2.36 but we have discussion and there is blocked USB booting capability. Thats why it can be really dangerous to try to patch it.
If someone has the dll extracted you can send it to me for investigation.

Also bellow is additional change in 2.35 which will enable enable multiple force trigerring by pressing the Force trigger (not need to press the single button).

find position 1F24B4 and change it from

013C A0E3 2700 83E3 0110 A0E3
04E0 9DE4 D160 01EA

to
08E0 8FE2 F041 2DE9 0CD0 4DE2
FEA2 FEEB F4FF FFEA

Try it only from usb, not from scope flash to prevent bricking your scope.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ot1 on March 18, 2014, 02:23:31 pm
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on March 18, 2014, 02:56:19 pm
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.

It is mentioned in different Agilent thread, it has fixed price.
http://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2430287&nid=-33573.970736.00&id=2430287 (http://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2430287&nid=-33573.970736.00&id=2430287)

For someone running Agilent WinXP instruments there is also running promo for the Win7 upgrade for spectrum analyzers.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 18, 2014, 03:48:11 pm
Sparky, let's partition the problem a bit: try booting from USB w/o any patches first (original dll, no added params in .lnk) - the scope should start normally (but slower) using files on USB.

This is a good suggestion!  I will give this a try, as I need to find a USB drive that can actually boot.

Thanks,
Sparky
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 18, 2014, 04:07:34 pm
Read the whole thread. 2.36 is not possible to patch the same way. To hack the scope you need to downgrade the firmware to 2.35 as few members does.

@plesa: I have indeed read the whole thread, but found no discussion about patching 2.36.  I'm aware many people could not USB boot on 2.36 and simply downgraded to 2.35 as a "work around".  As far as I read here, those with 2.36 were trying to boot from a patched 2.35 DLL and system files, but with 2.36 installed on their system.  I thought that may have been causing it not to work.

I thought we could investigate the 2.36 DLL, and a few people requested to see the 2.36 DLL, so I posted it.  I thought it would be interesting to determine how the 2.36 system was different and a new way to patch it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 18, 2014, 04:16:11 pm
Thanks Sparky for sharing the new dll version.

I copied the dll to my usb stick and i was able to start it but the dll hack at the right position is not working.
Also i didn't see any changes i the near of the Unfinalized Software output.
I will spend some more time today in the evening.

Thanks for testing, kilobyte.  Did you try and boot with the un-patched DLL first?  And it booted okay?

I assume you then tried booting with the patch at the new location of 0x277e30 ?  Seems there are more checks in this firmware...

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 18, 2014, 04:20:55 pm
plesa, do you know where is the problem exactly? USB startup override itself doesn't work anymore? Or some problems with patching?
Currently I do not have the 2.36 but we have discussion and there is blocked USB booting capability. Thats why it can be really dangerous to try to patch it.
If someone has the dll extracted you can send it to me for investigation.

@plesa: I posted the 2.36 DLL in my large post above, but here is direct link (http://wikisend.com/download/130184/infinii236.zip).

I presume this "discussion" about 2.36 having blocked USB booting happened outside this thread...I did not read anything about that.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on March 18, 2014, 05:58:25 pm
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.
Yea its been mentioned a couple times in multiple threads, the only issue is many of us have already spent close to or more than the amount Agilent now gives all the options for. Unless there is going to be some plan for crediting those that have already bought hundreds in upgrades this upgrade "deal" just feels like spit in your face.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rigby on March 18, 2014, 07:26:38 pm
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.
Yea its been mentioned a couple times in multiple threads, the only issue is many of us have already spent close to or more than the amount Agilent now gives all the options for. Unless there is going to be some plan for crediting those that have already bought hundreds in upgrades this upgrade "deal" just feels like spit in your face.

I get what you're saying, but not fully.  The stuff you paid for still does what you paid for it to do, and it was enough of a deal that you willingly paid for those options.

I also get that you feel you're being treated unfairly because of the dramatic cost difference between what you paid per option vs. what someone will pay per option until this deal ends.  Technology always gets cheaper, though maybe you didn't expect it to get SO cheap so quickly, I guess.

Either they are about to announce a new scope or line of scopes, or they're doing the rare "Can I More Money Overall If I Lower The Price And Sell More" test.  This is what Steam Sales prove time & time again; that more net revenue is gained by selling at a lower price.  Maybe Agilent is giving that a go. 

I'd put my money on new hardware coming soon, though.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on March 18, 2014, 08:00:13 pm
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.
Yea its been mentioned a couple times in multiple threads, the only issue is many of us have already spent close to or more than the amount Agilent now gives all the options for. Unless there is going to be some plan for crediting those that have already bought hundreds in upgrades this upgrade "deal" just feels like spit in your face.

I get what you're saying, but not fully.  The stuff you paid for still does what you paid for it to do, and it was enough of a deal that you willingly paid for those options.

I also get that you feel you're being treated unfairly because of the dramatic cost difference between what you paid per option vs. what someone will pay per option until this deal ends.  Technology always gets cheaper, though maybe you didn't expect it to get SO cheap so quickly, I guess.

Either they are about to announce a new scope or line of scopes, or they're doing the rare "Can I More Money Overall If I Lower The Price And Sell More" test.  This is what Steam Sales prove time & time again; that more net revenue is gained by selling at a lower price.  Maybe Agilent is giving that a go. 

I'd put my money on new hardware coming soon, though.
FWIW I still havent modded my MSOX2024. I havent needed any of the upgrades I hadnt already purchased. But seeing as how I have had my scope for less than a year and in two weeks for what I paid for 3 upgrades I could have gotten them ALL?! That stings a bit and angers many.

As far as new hardware goes, maybe. Doesnt help me at all though as now the resale value of these scope will be hurt badly as any upgrades wont be worth nearly as much seeing as how the entire suite can be bought for $500 or the thing can be modded for free. It would be interesting to see if they did come out with new scopes as arent 2000X and 3000X series only 3 years old? Seems fast to refresh two lines of oscilloscopes. But mayeb thats where all the competition has driven things.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Zucca on March 18, 2014, 08:47:43 pm
WOW, all the opitions for 800$ on the 3000 X-Series?

Starting April 1, 2014 ehh... April Fools' Day? I hope it is not a joke.
Probably I will spent my money for that. I want to support Agilent when it makes such a good offer to their customer, I hope other companies will follow that good example.

BTW those options are a evil business, man I know it is about money but jeeeeee I personally hate the idea to put on the market something not at the fully potential.... just decide an honest price with everything there and let it go...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Kryan9 on March 18, 2014, 09:21:21 pm
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.
Yea its been mentioned a couple times in multiple threads, the only issue is many of us have already spent close to or more than the amount Agilent now gives all the options for. Unless there is going to be some plan for crediting those that have already bought hundreds in upgrades this upgrade "deal" just feels like spit in your face.

I get what you're saying, but not fully.  The stuff you paid for still does what you paid for it to do, and it was enough of a deal that you willingly paid for those options.

I also get that you feel you're being treated unfairly because of the dramatic cost difference between what you paid per option vs. what someone will pay per option until this deal ends.  Technology always gets cheaper, though maybe you didn't expect it to get SO cheap so quickly, I guess.

Either they are about to announce a new scope or line of scopes, or they're doing the rare "Can I More Money Overall If I Lower The Price And Sell More" test.  This is what Steam Sales prove time & time again; that more net revenue is gained by selling at a lower price.  Maybe Agilent is giving that a go. 

I'd put my money on new hardware coming soon, though.
FWIW I still havent modded my MSOX2024. I havent needed any of the upgrades I hadnt already purchased. But seeing as how I have had my scope for less than a year and in two weeks for what I paid for 3 upgrades I could have gotten them ALL?! That stings a bit and angers many.

As far as new hardware goes, maybe. Doesnt help me at all though as now the resale value of these scope will be hurt badly as any upgrades wont be worth nearly as much seeing as how the entire suite can be bought for $500 or the thing can be modded for free. It would be interesting to see if they did come out with new scopes as arent 2000X and 3000X series only 3 years old? Seems fast to refresh two lines of oscilloscopes. But mayeb thats where all the competition has driven things.

I think they're just trying to pre-empt and kill off any sales of Tektronix's new competitor, the MDO3000. With the options so cheap now, you can get a fully unlocked Agilent for half the price of the comparable Tek, even if the Tek can now have comparable performance.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 18, 2014, 10:34:42 pm
Sparky, let's partition the problem a bit: try booting from USB w/o any patches first (original dll, no added params in .lnk) - the scope should start normally (but slower) using files on USB.

@abyrvalg: I tried booting from 5 different USB drives.  In each case, I used original dll, .lnk and other files from the scope.  The only addition to the USB drive not from the scope is the infiniivisionStartupOverride.txt file, in the root directory.

With or without the USB drive plugged in, the scope boots in ~42sec.  It takes ~31 sec for the "Agilent Technologies" logo to appear, and then another 11-12sec until the main screen appears.  Note: I have the DSOXLAN module installed.  Without the DSOXLAN module it boots to the main screen in about 35sec.

How long (in seconds) does it take the scope to boot on 2.35 when USB drive is plugged in?  In my case, with or without USB drive the time is the same, which makes me think it is not booting from USB drive at all!  When I had "patched" DLL on USB drive, it would not boot at all.

In my case, either none of the USB drives I have are bootable, or there is something else in 2.36 that prevents boot (maybe something in the dll, or elsewhere controlling start-up).  Perhaps this is what plesa was referring to by "blocked USB booting capability".  Perhaps startupOverride txt file does not work like previous?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on March 19, 2014, 01:00:16 am
Sparky, looks like your test is incorrect: if you are using 100% original .lnk then it points to internal folder (\Secure\infiniiVision), so you are starting the same process just a bit differently. You need to try .lnk with modified folder path, but no feature options (they'll cause troubles with unpatched dll):
Code: [Select]
44#\usb\infiniiVision\infiniivisionLauncher.exe
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 19, 2014, 01:09:14 am
Sparky, looks like your test is incorrect: if you are using 100% original .lnk then it points to internal folder (\Secure\infiniiVision), so you are starting the same process just a bit differently. You need to try .lnk with modified folder path, but no feature options (they'll cause troubles with unpatched dll):
Code: [Select]
44#\usb\infiniiVision\infiniivisionLauncher.exe

Oh, of course!  My bad!  I will repeat and report back.

Update:
This time, my USB drives give different results when trying to boot. 

 - Two newest drives (Transcend 32GB "Ultra Speed" and Kingston 4GB "DataTraveler")
   Scope attempts to boot for 62 and 72 sec, respectively, and then the system reboots and tries again.  It appears the scope is really trying to read and boot from these drives, but a new protection method prevents it from doing so.  Note, this is attempting USB boot with unpatched DLL, so there is something other than DLL blocking USB boot in this v2.36 firmware.

 - Two oldest drives (SanDisk 2GB "Cruzer" and no-name 2GB)
   These don't seem to do anything; the system boots in ~45 seconds.  As far as I can tell, the scope couldn't read from these disks during boot and so it started normally.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 19, 2014, 05:52:39 pm
I did a further test to check if the infiniivisionStartupOverride file contents had any effect.  Using my Transcend drive which appears to be the "best bet" as far as boot capability goes, I changed the "True" to "False" in the override text file.  I expected the scope to boot as normal in about 45sec.  Surprisingly, it didn't!  The system continued to try and boot for ~70sec, and then restarted.

Has anyone tested setting "False" in the text file, and did it lead to normal internal boot?  I assume this is what should happen, but would be nice to confirm.

Seems like need to investigate what might be blocking USB boot capability...

Update: Upon further testing, the contents of override file is unimportant; only its existence is checked.  Upon deleting the file, the scope boots as normal, which was the expected behavior.  The presence of the override text file is preventing boot from USB.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 21, 2014, 01:05:11 am
re: USB boot override

With help from another member here, so far it is thought that file "\Windows\ProcessStartupFolder.exe" is possibly responsible for blocking USB boot capability.

In v2.35 ProcessStartupFolder.exe is 12744 bytes; in v2.36 it is a bit bigger.

Unfortunately I can't copy this file off the system; 'copy' and trying to dump the file with 'type' both result in errors.  I also tried 'processMgr.exe kill' before copying and that didn't work.  This may be why Agilent haven't posted the 2.36 update online --- it would be immediate way to obtain ProcessStartupFolder.exe and inspect it.

If anyone has further suggestions for copying this file off the scope let me know and I can try.

If there is no way forward I will likely downgrade to the v2.35 firmware this weekend.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on March 21, 2014, 01:30:07 am
Did you try to kill the InfinivisionLaucher as well?
Can you post the processes running on the 2.36?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 21, 2014, 04:01:19 am
Did you try to kill the InfinivisionLaucher as well?
Can you post the processes running on the 2.36?

Thanks for the suggestion.  I just tried: killed both ProcessStartupOverride and InfiniiVisionLauncher but still got error on copy:
"Cannot copy \Windows\ProcessStartupFolder.exe to \usb"
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on March 21, 2014, 09:12:07 am
Sparky, try attrib -s -h \Windows\ProcessStartupFolder.exe, then copy, maybe some attribute prevents copiing. If attrib fails, try without -s also.

If none will work, try pulling out \Windows\cmd.exe for study - maybe there is some restriction right in the shell itself.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eurofox on March 21, 2014, 12:03:24 pm
Hi,

I got finally my scope and enable the trial, this ways I have all options enabled. ;

In 10 days I will have the permanent options enabled, I suppose everybody know about this promotion from Agilent. :)

eurofox
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: con-f-use on March 21, 2014, 02:41:43 pm
In 10 days I will have the permanent options enabled, I suppose everybody know about this promotion from Agilent. :)
Just the general stuff. What was it they charge for all the options? I remember something like €500?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eurofox on March 21, 2014, 02:44:08 pm
In 10 days I will have the permanent options enabled, I suppose everybody know about this promotion from Agilent. :)
Just the general stuff. What was it they charge for all the options? I remember something like €500?


I think $500 for the 2000 and $800 for the 3000 range.

eurofox
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Frost on March 21, 2014, 06:18:37 pm
DSOX2APPBNDL -> 9 for 1 _-_ 401 Euro + VAT instead of 2735 Euro + VAT

DSOX3APPBNDL -> 15 for 1 _-_ 641 Euro + VAT instead of 9900 Euro + VAT

DSOX4APPBNDL -> 16 for 1 _-_ 1202 Euro + VAT instead of 14779 Euro + VAT
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: elektrinis on March 22, 2014, 08:37:08 am
Guys, thank you very much. I got my 2004A running with all features and 200MHz. Nice!
I had some troubles with cheap uSD card reader - scope did not mount any card even when booted up. But old 256MB USB drive did the job just fine!

BTW, it was already mentioned here, but I remind for those who are considering hacking their scope: you will get a warning text during boot, also in "About" page. Also you will get a prompt after boot up. Fortunately these texts are easy to change or even remove. In my case, I left the warning there, just changed the text with owner's information, in case the scope gets stolen (but it is possible to remove this text, just fill in with spaces or NULL characters). As for prompt after boot up, I did not dig deep in to removing it, just changed the text to something neutral, as you would have to press Back button anyway to get rid of language selection after normal boot (any way to switch off this annoying thing?).
Check pictures below:

https://dl.dropboxusercontent.com/u/68288580/agilent/IMG_20140322_130405_543.jpg
https://dl.dropboxusercontent.com/u/68288580/agilent/IMG_20140322_130427_395.jpg
https://dl.dropboxusercontent.com/u/68288580/agilent/IMG_20140322_130249_858.jpg

However, I have failed with one thing... I wanted to check how downloaded demo license works... So I downloaded a Segmented Memory Application and installed it on the scope (from internal boot). As expected, feature started working even without the hack (with indicated trial end date).
The problem is that SGM is no longer working from hacked boot, even though license is still valid.
What can I do to get this functionality back? Is it possible to disable license check? It is really one of those features that I should not have messed with...

Now... How do we:
1. disable license checking.
2. copy modded files in to internal memory? No LAN card here. Still, it looks like it is possible via USB-only.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 22, 2014, 07:08:15 pm
Sparky, try attrib -s -h \Windows\ProcessStartupFolder.exe, then copy, maybe some attribute prevents copiing. If attrib fails, try without -s also.

If none will work, try pulling out \Windows\cmd.exe for study - maybe there is some restriction right in the shell itself.

I noticed only the "readonly" (R) attribute was set for ProcessStartupFolder.exe, and I tried to remove it, but resulted in an error (cannot set attribute...).

I tried also on \Windows\cmd.exe but same scenario --- cannot be copied...

Thanks everyone, and especially abyrvalg for the help to investigate the v2.36 firmware.  It seems there is some interesting things going on with ProcessStartupFolder.exe, but unfortunately no way to inspect it.

Looks like I will begin the v2.35 downgrade soon...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on March 22, 2014, 07:12:51 pm
What did 2.36 bring for updates anyway? Is there even any reason to try and keep it?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: romantao on March 22, 2014, 07:51:00 pm
soory for jack up the main topic, but in previous posts some users were discussing the possibility of building a pcb with the ethernet connection. Has anyone ended up designing the module?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on March 22, 2014, 08:55:54 pm
Sparky, you have the 2.36 app extracted already, so you can try booting it from USB after downgrade just for curiosity. Please report the results if any.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 22, 2014, 09:15:03 pm
What did 2.36 bring for updates anyway? Is there even any reason to try and keep it?

As 2.36 hasn't been publicly released we don't know for sure, but it's possible it does not contain any enhancements or bug fixes; its purpose may be exclusively for blocking USB boot.  (And because it hasn't been released, we can't get to ProcessStartupFolder.exe from a cab file.)

For reference, 2.35 brought the following:

Enhancements
For both the 2000X and 3000X families:
• Default cursors placement will no longer overlay cursors on the same value.
For the 3000X family:
• N2820A high sensitivity 2 channel current probe support has been expanded to allow for a greater range of user defined resistance.
• LIN error triggering has been added.
• WaveGen modulation frequency now has more granularity for user adjustment.

Defects Addressed
For the 2000X and 3000X family:
• Mask “Save on Error” capability now works for SINGLE acquisitions
• Scope will behave better in higher activity LAN networks
• A number of bitmaps behaviors have been improved for some tablets
For the 3000X family:
• LIN 2.0 decoding now better handles the Checksum field.
• An Arb file import error has been addressed; it no longer skips some time column data.
• For IC2 decoder search: previously, read packets were sometimes erroneously found during write searches.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 22, 2014, 09:17:24 pm
Sparky, you have the 2.36 app extracted already, so you can try booting it from USB after downgrade just for curiosity. Please report the results if any.

I have done the downgrade to 2.35 --- it booted first attempt from USB drive loaded with 2.35 files.  All options and 500MHz BW activated as expected.

I will try the 2.36 app on USB drive and report what happens.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 22, 2014, 09:56:04 pm
I'm now running 2.35 from internal.  I copied the 2.36 files to USB and it booted fine from USB drive.  Same result as noted by kilobyte here (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg408031/#msg408031).

I have not tried booting the patched dll, but as mentioned by kilobyte it is not working.  I wonder if kilobyte made any further discoveries?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on March 23, 2014, 07:53:23 pm
Telnet connection to port 5024 on DSOX3032 doesn't woork.
LAN adapter is self made, other services: ping, WEB and telnet responds normally.
This behavior is common for software running from internal flash and from USB flash.

Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: euzer on March 24, 2014, 09:36:34 am
From what I can gather the soon to be released chargeable DSOX3APPBNDL offers all possible (published) licensable upgrades except for bandwidth and MSO functionality.

Two questions on running the hacked 2.35 firmware from USB.
Is any calibration maintained when running the hacked>?
Is it still possible to save screen images to the USB memory stick?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on March 24, 2014, 11:49:28 am

Is any calibration maintained when running the hacked>?
Is it still possible to save screen images to the USB memory stick?

Yes calibration is maintained, and
you can save/recall data to/from USB stick.

Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on March 24, 2014, 05:07:08 pm
Just finished my LAN module.
Here's some pictures, I see some imperfections.
Module is working with some restrictions described in my previous post, only LEDs no lit.

Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on March 24, 2014, 05:49:16 pm
Lan module looks great! It would be really good to make one. Do you have cad files available?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: M. András on March 24, 2014, 09:21:28 pm
im wondering what are these units are calibrated for, its full hardware capability or for marketed bandwith?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 24, 2014, 09:28:38 pm
im wondering what are these units are calibrated for, its full hardware capability or for marketed bandwith?

Must be full capability, because the higher bandwidths can be unlocked with the purchased bandwidth option, and it doesn't require the unit to be sent for (re)calibration.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on March 24, 2014, 11:28:51 pm
CAD files please... Thank you in advance.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 47MHz on March 28, 2014, 05:58:38 pm
Great job you guys!

In my DSOX there is one problem with this hack - I have all the licenses excluding band. It's still 100MHz instead of 200MHz. My oscilloscope was originally 100MHz. Maybe thats the problem?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwilson on March 28, 2014, 06:16:27 pm
I have all the licenses excluding band. It's still 100MHz instead of 200MHz. My oscilloscope was originally 100MHz. Maybe thats the problem?

What command are you using in the startup .lnk file? You need to add "-l BW20" to the command line, the "-l All" license doesn't cover bandwidth.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 47MHz on March 29, 2014, 10:06:06 am
This is how my file look like:

62#\usb\secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l memMax -l MEMUP -l EMBD -l AUTO -l COMP -l SGM -l MASK -l EDK -l RML -l ASV -l SGMC -l BW20 -l DIS -l SCPIPS -l VID -l CABLE

Still no 200MHz band.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tsmith35 on March 29, 2014, 09:30:40 pm
This is how my file look like:

62#\usb\secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l memMax -l MEMUP -l EMBD -l AUTO -l COMP -l SGM -l MASK -l EDK -l RML -l ASV -l SGMC -l BW20 -l DIS -l SCPIPS -l VID -l CABLE

Still no 200MHz band.

You have 186 characters to the right of the "#", so I think the file should read:

186#\usb\secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l memMax -l MEMUP -l EMBD -l AUTO -l COMP -l SGM -l MASK -l EDK -l RML -l ASV -l SGMC -l BW20 -l DIS -l SCPIPS -l VID -l CABLE
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Zucca on April 04, 2014, 01:37:53 pm
I just got in my email the upgrade code for all the options from Newark, when I go home after work I will upgrade my puppy X3000. It was $760 and not $800 as advertised on the Agilent website.
Thanks Agilent for giving me this opportunity.

Here again the link for the upgrade promotion:

http://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2430287&nid=-33573.970736.00&id=2430287 (http://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2430287&nid=-33573.970736.00&id=2430287)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eurofox on April 04, 2014, 04:16:23 pm
I just got in my email the upgrade code for all the options from Newark, when I go home after work I will upgrade my puppy X3000. It was $760 and not $800 as advertised on the Agilent website.
Thanks Agilent for giving me this opportunity.

Here again the link for the upgrade promotion:

http://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2430287&nid=-33573.970736.00&id=2430287 (http://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2430287&nid=-33573.970736.00&id=2430287)


Got my upgrade on April 1st, not an April joke  :-DD :-DD :-DD
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on April 04, 2014, 07:22:45 pm
Here are Gerber, drill and DXF files for LAN module builders.
I wish to see prettier modules than my!

Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on April 04, 2014, 07:47:26 pm
Hey, Georg. Brilliant, very generous of you.

Thank you

Trev
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Zucca on April 04, 2014, 08:31:07 pm
Very cool Georg!

BTW it´s a shame Agilent didn´t design a digital output for a display (HDMI or a DisplayPort) there.
Since I am not expert on those interfaces do you think it is impossible or just tons of brain, spare time and FPGA jazz would do the trick?

I simply can´t stand to have a poor analog video output in such a beautiful 2014 model DSO. On top of that I know the internal display signals are already digital, so what a shame to convert them in analog ones... It is like to take cold beers, warm them up in a oven and finally serve them...

Maybe if someone else is interested it would be nice to put on the Georg board not only the LAN interface but also:

- the raw video digital signals coming from the mainboard, for possible future development
- JTAG?
- I2C?
- UART? (see also https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260721/?topicseen#msg260721 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260721/?topicseen#msg260721))

Let´s do an EEVBlog Hack board!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on April 04, 2014, 08:49:00 pm
Huh, I wonder when a chinese manufacturer will come up with these boards...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on April 05, 2014, 03:15:58 pm
If you want to see the gerber files, use http://www.gerber-viewer.com (http://www.gerber-viewer.com)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on April 08, 2014, 03:04:07 am
Quote
Huh, I wonder when a chinese manufacturer will come up with these boards...
Quote
Finally found one (a DSOXLAN) on eBay for a good price. Now I just hope the one they send me is in good condition. There are still 3 left if anyone else is looking.
http://www.ebay.com/itm/291108310383 (http://www.ebay.com/itm/291108310383)

I recently purchased a couple of 'real' DSOXLAN from a Chinese seller for less than half retail including free shipping. Seller had 8 of them that I had reported on in the 'Buy/Sell/Wanted' area, but all are gone now. I just got them in today and happily all has tested well with both of them. The $200 US is not too bad of a price for a 'factory' module, and you get the VGA as a bonus, something that would be very difficult to hack. Hopefully the seller will find a few more modules to sell.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: euzer on April 08, 2014, 07:56:26 am
Yay!!!

Just got a customer return DSO-X3000 returned back from Agilent calibration date 2 Jan 2014, they upgraded it to firmware 2.36.

Downgraded to 2.35 from the Agilent website, edited the DLL and created a USB drive and now it's all options enabled!!

Got the 'WARNING: Unfinalised software' message but otherwise perfect!!

Very happy bunny indeed  :)

Anybody now want a Rigol 2072 all options enabled brand new in box never used??!!

Helpful link...
https://dl.dropboxusercontent.com/u/2063383/DSOX3000%20hack.zip
Shows "All options enabled" at power up.
Shows the following features enabled :
MSO, memMax, EMBD, AUTO, FLEX, PWR, COMP, SGM, MASK, AUDIO, DIS, EDK, WAVEGEN, AERO, VID, ADVMATH, DVM, ASV, CABLE, SCPIPS, RML, SGMC, TOM.
No bandwidth increase features shown.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 08, 2014, 08:12:50 am
Quote
Huh, I wonder when a chinese manufacturer will come up with these boards...
Quote
Finally found one (a DSOXLAN) on eBay for a good price. Now I just hope the one they send me is in good condition. There are still 3 left if anyone else is looking.
http://www.ebay.com/itm/291108310383 (http://www.ebay.com/itm/291108310383)

I recently purchased a couple of 'real' DSOXLAN from a Chinese seller for less than half retail including free shipping. Seller had 8 of them that I had reported on in the 'Buy/Sell/Wanted' area, but all are gone now. I just got them in today and happily all has tested well with both of them. The $200 US is not too bad of a price for a 'factory' module, and you get the VGA as a bonus, something that would be very difficult to hack. Hopefully the seller will find a few more modules to sell.


I was the one that bought the last of his stock, was a bit surprising how banged up the module is on the sides. Guess these things were passed around a lot in the lab they came from.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eurofox on April 08, 2014, 08:18:36 am
The last release of the firmware is 2.36 but on the Agilent website only the 2.35 is available.

Where can I get the 2.36?

eurofox
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: euzer on April 08, 2014, 09:30:12 am
This is interesting http://cp.literature.agilent.com/litweb/pdf/DSOX3104A-01.pdf (http://cp.literature.agilent.com/litweb/pdf/DSOX3104A-01.pdf)

Service Note
December 5, 2012
DSOX3014A – Oscilloscope, Mixed Signal, 4 Channel, 100MHz
Serial Numbers: ALL
Corrupted firmware code renders the oscilloscope inoperable.

Situation:
At regular intervals, the scope compares the checksum of the firmware code running in RAM with the checksum in Flash. This allows the detection of inadvertent or unauthorized changes to the files. If the two checksums ever differ, an error message is displayed and the scope becomes inoperable. The error message will read:
The InfiniiVision software has been corrupted. Please contact Agilent Support for help.

Solution/Action:
Go to Agilent.com, reload all files associated with oscilloscope model affected and without opening the file, download it to the scope.

There's also a recommended hardware mod if the scope hisses http://cp.literature.agilent.com/litweb/pdf/DSOX3014A-03.pdf (http://cp.literature.agilent.com/litweb/pdf/DSOX3014A-03.pdf)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on April 08, 2014, 12:55:19 pm
I was the one that bought the last of his stock, was a bit surprising how banged up the module is on the sides. Guess these things were passed around a lot in the lab they came from.

Yea, one of mine was a little rough, but the other was in very good condition. Both worked equally well and look about the same when plugged into the scope (outside condition is very good). I'm all for saving more than a couple hundred bucks on something you can't even see once plugged in anyway... Very happy with the purchase.

Still, I can't believe how UGLY they make the back of an otherwise nice looking scope look. What an awkward design approach to attach a module??? I understand the desire to lock the unit in place, but give me a break... They should have just skipped the locking loop and clips that protrude out of the back of the case and opted for a couple of torx screws to lock down the module flat to the rear surface. Anyone with a torx driver and enough time and wherewithal to remove the module is going to figure out how the get the whole scope anyway. It's even easier and faster to steal by just clipping the stupid loop with a pair of diagonal cutters, probably already sitting on the bench or nearby, and quickly unclip the module. What a DUMB and UGLY engineering idea, and a silly attempt to lock those modules down.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on April 13, 2014, 01:39:28 am
FPG and ALT options grant additional selections for the rear trigger output

utility -> options -> rear panel -> rear panel menu

EDIT: Maybe it's caused by something else anyway. I felt that the scope was not running stable (it would reboot) especially when browsing the serial decode menu so I dropped FPG, ALT and TOM. They're undocumented and at least FPG is not recognised by the N5406A / N5434A FPGA dynamic probe software for the other infiniivision scopes. The Trigger output choices are still available.

CABLE is nice though. The help menu worked, so here's the description:
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=89344;image)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on April 17, 2014, 09:38:45 pm
Has anyone bought the DSOX3APPBNDL ($800) to unlock all the options (except BW and MSO feature)?

If so, I wonder if the boot override infiniivisionLauncher options for BW and MSO still work correctly after installing DSOX3APPBNDL? 

If anyone has done this, can you please test and post about it?

I'm contemplating buying the application bundle, but I don't want to loose BW and MSO ... and I can't afford everything at once!!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on April 18, 2014, 01:05:26 am
I bought the bundle. But unfortunately I do have the 1 GHz MSO version, so I can't try what you want to know without deleting the perpetual license file for the MSO.

I did notice that you can still install the undocumented options though so I imagine that the bandwidth and mixed signal options still work. You won't need all the other command line parameters anymore.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 18, 2014, 03:24:21 am
I just tried out the LAN functions today and noticed some weird errors with the hacked USB method. If I boot from the hacked drive I get hit with errors like these on web page access:
Quote
Parse error in script

Microsoft VBScript runtime error: '800a01ad'

Description: ActiveX component can't create object: 'infiniiVisionWebCom.ScopeInfo'

In file: scopeInfo.asp
On line: 4

Other network functions are fine like telnet, VNC, java and HTML5 based (http://xxx/rfp.html (http://xxx/rfp.html)) remote panels. So it looks like only dynamically generated pages are bad.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on April 18, 2014, 04:33:48 am
check if the file on your usb stick is read only (and remove that flag)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 18, 2014, 05:01:20 am
Didn't work, went into infiniiVision\web and checked them too, they aren't set to read only.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on April 18, 2014, 05:19:00 am
I bought the bundle. But unfortunately I do have the 1 GHz MSO version, so I can't try what you want to know without deleting the perpetual license file for the MSO.

I did notice that you can still install the undocumented options though so I imagine that the bandwidth and mixed signal options still work. You won't need all the other command line parameters anymore.

Thanks for your response Neganur!  :)  I agree with you --- if the undocumented options still work after the bundle license, then it is reasonable to assume the BW and MSO options will be okay, too.

You are most "unfortunate" to have the 1GHz MSO version, eh?  :P
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on April 26, 2014, 02:11:25 am
Anyone looking for a reasonable price DSOXLAN ($200 US) can check this site out. http://www.168electronics.com/agilent-dsoxlan-2000-30000-infiniivision-x-lanvga-module-p-66.html (http://www.168electronics.com/agilent-dsoxlan-2000-30000-infiniivision-x-lanvga-module-p-66.html) (no relationship with the seller)

I purchased two already from his eBay store and they both work perfectly. They are both a little bit tattered, like they were stored in a bin together and moved about a bit, but fully functional. I have not purchased any from his web store, but notice he accepts PayPal, so the buyer protection should be there.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on April 26, 2014, 10:41:33 am
Anyone looking for a reasonable price DSOXLAN ($200 US) can check this site out. http://www.168electronics.com/agilent-dsoxlan-2000-30000-infiniivision-x-lanvga-module-p-66.html (http://www.168electronics.com/agilent-dsoxlan-2000-30000-infiniivision-x-lanvga-module-p-66.html) (no relationship with the seller)

I purchased two already from his eBay store and they both work perfectly. They are both a little bit tattered, like they were stored in a bin together and moved about a bit, but fully functional. I have not purchased any from his web store, but notice he accepts PayPal, so the buyer protection should be there.
I just got an email back from the seller stating that his web store inventory was incorrect, that he does not have them available any longer.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: charliex on April 30, 2014, 04:01:59 am
picked up a new dso-x 2002 from frys for $1000 today, updated firmware to 2.35, applied usb with a transcend 4GB usb formatted as FAT16, worked fine.

neato
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on April 30, 2014, 06:10:40 pm
picked up a new dso-x 2002 from frys for $1000 today, updated firmware to 2.35, applied usb with a transcend 4GB usb formatted as FAT16, worked fine.

So you effectively now have a NEW FULLY LOADED MSOX2022A for $1000... yes, very neato
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Methodical on May 01, 2014, 04:32:21 pm
Does anyone have a rigol 2072a and dso 2000 series scope, and have info on which they prefer?  Seems to me the agilent would be preferred, even at a cost premium.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on May 01, 2014, 05:11:57 pm
They are just different. For general reliability go for Agilent. I chose so.
https://www.eevblog.com/forum/reviews/my-new-toy-)-agilent-dsox2002a-sex-on-a-stick!/msg216361/#msg216361 (https://www.eevblog.com/forum/reviews/my-new-toy-)-agilent-dsox2002a-sex-on-a-stick!/msg216361/#msg216361)

But that Rigol DS2000 has huge 56Mpoints memory, dedicated segmented memory (record) controls, it can have two channel arbitrary generator...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: free_electron on May 08, 2014, 06:44:03 pm
Muahahaha! :-DD
Agilent DSOX2000/3000 Easteregg Spaceship Screensaver (https://www.youtube.com/watch?v=A4zTj5a7cGU#ws)
Here is it the Enterprise Screensaver.

I did take a look in the dsox4000 dll and there are a lot more debug information and resources.
I opened the 4000 infiniivision with a resource hacker and I was able to extract bitmaps and Winform dialogs.
After disassembling the dll I searched for the text TREK and found the reference to this in a subfunction with other references to ...Screensaver...
So i tried it on my scope and bingo.

Regards
Kai

Today i was at the embedded world fair here in Nürnberg/Germany and i could try the Screensaver Easteregg with the text TREK which will work as seen in my video.
After I started the Preview it will show some credits.

It was a little bit sad that i didn't have a possibility to make a video of this.

It would be nice if someone which have a DSOX4000 available take a video of this easteregg.

yep. it works. just tried it
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on May 08, 2014, 10:50:46 pm
Agilent DSOX3000 and Tektronix DPO3000 are just different. I would choose Agilent because it must be easy and fast to use, but that Tektronix has some useful extra features. I like its two big multipurpose knobs.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on May 08, 2014, 10:56:39 pm
Here is Agilent guys' point of view.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tsmith35 on May 09, 2014, 01:10:56 am
I rarely look at parallel busses or that many digital signals at once.

I guess I misread that... ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Smalldog on May 14, 2014, 06:39:13 am
picked up a new dso-x 2002 from frys for $1000 today, updated firmware to 2.35, applied usb with a transcend 4GB usb formatted as FAT16, worked fine.

neato

I saw an open box (not sure if it's a return or not) Agilent DSOX2002A at the Fry's in Phoenix.  I think they wanted $1049 for it.  I looked at the shipping date on the box, and (if memory serves me right) it was shipped to Fry's in October of 2012, so it's been on the shelf for at least 18 months.  It's not listed on the website as available in the store, but I saw it there.  Thinking about seeing if they will discount it to $999 since it's been there so long, and if it's a return, who knows if it has problems because I am pretty sure that Fry's is not competent at testing this kind of equipment other than powering it on and saying "it's works fine".

Out of curiosity, which Fry's did you manage to scoop your scope up at?

Smalldog
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on May 15, 2014, 03:55:40 pm
I am considering making a LAN board from my DSOX2x. Getting the PCB from itead would leave me with 4-9 spares, so I wondered if anyone else is interested in this? The way it would work, I think, is that I would make a board complete with magjack (since trying to find the same one as someone else designed around can be problematic) and sell it on at cost. Modifying the blank panel cover would be your problem, although I might be amenable do that as well.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on May 15, 2014, 06:43:27 pm
I am considering making a LAN board from my DSOX2x.

Where are you located?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on May 15, 2014, 07:03:46 pm
Quote
Where are you located?

I am in the UK.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on May 15, 2014, 08:04:38 pm
How much do you think it could cost at the end? possible with the shipment (to brazil). If I could afford it I'm interested (I've just bought too much gears, so I'm little in trouble about money next 2 months... :) ).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on May 15, 2014, 08:10:05 pm
At a rough guess, the PCB would be about £3-4, the magjack about £8,  (nearly double those for $US) plus shipping.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: fmaimon on May 15, 2014, 09:08:37 pm
Quote from: Sbampato12 on Today at 05:04:38 PM (https://www.eevblog.com/forum/index.php?topic=15764.msg444991#msg444991)
How much do you think it could cost at the end? possible with the shipment (to brazil). If I could afford it I'm interested (I've just bought too much gears, so I'm little in trouble about money next 2 months... :) ).

Try quoting in Agilent's website. You may find it's not that worth the trouble to import it. Yes, it is more expensive than buying in the US, but the difference is less than the shipping and import taxes that you will have to pay...

Brainfart... Somehow I though you were talking about a new oscilloscope...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on May 15, 2014, 09:16:10 pm
Hi. I am interested in a board.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on May 15, 2014, 09:20:13 pm
I thought I saw the magjack at coolcomponents.co.uk? I ordered one but never got the board sorted or tested the magjack itself. This magjack was from the board posted earlier in this forum. It was cheap as well.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on May 15, 2014, 09:48:01 pm
Quote
This magjack was from the board posted earlier in this forum

Yes, I couldn't find that one and the pins looked non-standard. But I've since discovered that the part number on the pdf is incorrect (I think) with a 2 where a 1 should be. So now I've found it and it costs about £4.50 plus VAT.

That makes things a lot easier and I am about to send the gerbers for that board to itead (thanks very much georgd for doing those). But first, could someone with a pukka one confirm that it is 1.6mm PCB, or are we talking thinner stuff?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on May 15, 2014, 09:56:05 pm
Okay great. I am definitely up for a board thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on May 16, 2014, 03:42:40 am
At a rough guess, the PCB would be about £3-4, the magjack about £8,  (nearly double those for $US) plus shipping.
Please put me on your list...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on May 16, 2014, 07:09:20 am
Quote
But first, could someone with a pukka one confirm that it is 1.6mm PCB, or are we talking thinner stuff?

Yes, the PCB must 1.6 mm thick.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on May 16, 2014, 09:39:08 am
Quote
Yes, the PCB must 1.6 mm thick

Cheers :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on May 16, 2014, 10:47:38 am
It's a bit late to worry about this now because itead have the gerbers, but there seems to be a problem with the LEDs on this board:

Quote
Module is working with some restrictions described in my previous post, only LEDs no lit

It seems to me the problem is that the magjack has bi-colour LEDs (i.e. two in reverse parallel) but the layout assumes single ended LEDs (common return). I checked the magjack on the hi-res photo someone posted (thanks!) and that also has bi-colours, so I think the pinout on this board is incorrect for the LED connections.

Not sure how this can be resolved without access to a real unit. Maybe someone with one could trace the connections for us?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on May 16, 2014, 11:24:32 am
Well as long as the network connection works I do no really care about the leds.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on May 16, 2014, 11:29:05 am
Particularly since they're round the back and usually not visible :). But it is the principle of the thing and would be nice to get it right.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on May 16, 2014, 05:21:25 pm

Quote
Module is working with some restrictions described in my previous post, only LEDs no lit

I must correct statement in my previous post, LED are working.
Green for link and Yellow to activity indicator.
Reason for not working is mistake in pin position.
Please study attached images.

Georg


 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on May 16, 2014, 05:38:54 pm
Can you expand on that pin mistake, please? I haven't worked out what it is and what it should be.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: fmaimon on May 16, 2014, 06:10:56 pm
If there is any spare board, I would like one, with the magjack, if possible. These kind of things are hard to come by in Brazil.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on May 16, 2014, 06:31:54 pm
I'd be interested aswell (I'm in .nl).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cyr on May 16, 2014, 08:42:19 pm
Finally got my back-ordered DSOX3034A, downgraded to 2.35 and "upgraded" successfully. An 8GB sandisk cruzer blade USB stick worked fine as boot medium. I did notice this issue though:

I just tried out the LAN functions today and noticed some weird errors with the hacked USB method. If I boot from the hacked drive I get hit with errors like these on web page access:
Quote
Parse error in script

Microsoft VBScript runtime error: '800a01ad'

Description: ActiveX component can't create object: 'infiniiVisionWebCom.ScopeInfo'

In file: scopeInfo.asp
On line: 4

Other network functions are fine like telnet, VNC, java and HTML5 based (http://xxx/rfp.html (http://xxx/rfp.html)) remote panels. So it looks like only dynamically generated pages are bad.

Anyone know a fix for this? Putting the hack in internal flash perhaps?

EDIT in case anyone is looking for info, putting the hacked files into internal flash does fix the issue with the web interface. /EDIT
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on May 16, 2014, 09:13:21 pm
If there is any spare board, I would like one, with the magjack, if possible. These kind of things are hard to come by in Brazil.

I'm sure something can be arranged :)

Thanks for the expressions of interest, everyone. It will take a while for the boards to come through, but once I have them and have figured out the actual costs I will ask for confirmed requirements from those interested.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on May 16, 2014, 09:15:45 pm
Many thanks for getting this sorted. Just let me know when and how you want payment.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: starblue on May 17, 2014, 02:57:05 pm
Does anybody know what a "(d)" following the license names means?

I got my scope back from repairs and most licenses were marked like that, see attached screenshot.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on May 17, 2014, 03:35:52 pm
Activated distributor licence with time limit?
But why not display (d) after MSO, did you purchased MSO licence?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on May 17, 2014, 04:22:25 pm
What was repaired on your scope? Was there a power supply malfunction?
For the (d) mark I recommend you to contact your Agilent authorized distributor.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on May 17, 2014, 05:31:40 pm
I notice a license beginning on the second line that reads DIS(2015-1-27). Could that be a DIStributor License that ends on January 27, 2015?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: starblue on May 17, 2014, 06:39:36 pm
> But why not display (d) after MSO, did you purchased MSO licence?

I added the MSO license today after getting it back.
Also, most of the other d's disappeared after I added the DSOX3APPBNDL license (i.e. for those options that were included in the license). I had done that before the repair, but apparently I needed to load the license file again.

> What was repaired on your scope?

It wouldn't boot most of the time (screen stayed dark, LEDs cycled), so I got it repaired on warranty.
Seems to be OK now, and I got a nice cal certificate for the state after repairs.

> I notice a license beginning on the second line that reads DIS(2015-1-27). Could that be a DIStributor License that ends on January 27, 2015?

I suppose so.

I had the trial licenses activated, which expired during the repair.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on May 17, 2014, 06:47:23 pm
It wouldn't boot most of the time (screen stayed dark, LEDs cycled), so I got it repaired on warranty.
So they did not tell you the exact reason? How old was that scope?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: starblue on May 17, 2014, 06:49:49 pm
> So they did not tell you the exact reason?

No, they didn't.

> How old was that scope?

Brand new.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on May 17, 2014, 06:52:28 pm
It must have been a production failure. It happens. It would be worse, if the fault appeared three years and one month after purchase.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on May 17, 2014, 07:31:50 pm
Just received my msox2024a via agilent's ebay certiprime store. Fantastic scope and of course even more fantastic with the license stuff from this thread (thanks much to the major contributors!).

Now, I'm look at the dsoxlan diy projects and I am going to run some protoboards soon, so figure I may as well roll my own lan adapter board.

My #1 question though is the center tap voltage requirement on the phy side. Looking at pictures/video of the real dsoxlan board I can see what appears to be a 11 ohm resistor (marked 110 on the video) and capacitor joined together to the 2 joined center taps of the amp magjack. This would imply the other end of the cap (likely a 0.01uf) is going to ground and the other end of the 11 ohm resistor is going to VCC (3.3V or ??).

The georgd board appears to have the center taps of his magjack going through a 1uf cap and then to GND on the edge connector?

So, if someone has a real dsoxlan board, what is the other end of the 11 ohm resistor connected to? GND (seems unlikely) or one of the edge pins or one of the regulators on the board?

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: blueindiana on May 19, 2014, 02:31:37 pm
hey
this is chenyi from china   
My English is very poor,so  I used Google to translate Chinese into English? I hope it does not affect your understanding.
I met a  serious problem:
I am trying to update my oscilloscope's firmware(DSOX2012A) tonight,and i ignored the warning following behind:
//CAUTION: When upgrading your oscilloscope, download the .cab file, and load the complete file into the oscilloscope. Please do not “unpack” or “unzip” the .cab upgrade file; you could potentially only load a portion of the required files in the package. This could result in your oscilloscope becoming non-operational, requiring it to be sent to an Agilent service center to be repaired.//
i unziped the file,then the oscilloscope sure enough becoming non-operational. so i was wondering if there's anyone konws how to fix it.   thank you for your Reply
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on May 19, 2014, 04:50:11 pm
Well, what exactly happens when you turn on your scope?
Did you try this?
1) Save the *.cab file on the USB flash disc.
2) Insert the USB flash disc into scope's USB port.
3) Turn on the scope.
4) The scope might boot up from the USB flash disc.
Please note that I do not know if this works. You are doing everything at your own risk!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on May 19, 2014, 06:05:54 pm
Just received my msox2024a via agilent's ebay certiprime store. Fantastic scope and of course even more fantastic with the license stuff from this thread (thanks much to the major contributors!).

Now, I'm look at the dsoxlan diy projects and I am going to run some protoboards soon, so figure I may as well roll my own lan adapter board.

My #1 question though is the center tap voltage requirement on the phy side. Looking at pictures/video of the real dsoxlan board I can see what appears to be a 11 ohm resistor (marked 110 on the video) and capacitor joined together to the 2 joined center taps of the amp magjack. This would imply the other end of the cap (likely a 0.01uf) is going to ground and the other end of the 11 ohm resistor is going to VCC (3.3V or ??).

The georgd board appears to have the center taps of his magjack going through a 1uf cap and then to GND on the edge connector?

So, if someone has a real dsoxlan board, what is the other end of the 11 ohm resistor connected to? GND (seems unlikely) or one of the edge pins or one of the regulators on the board?

cheers,
george.

Anybody??

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jlmoon on May 20, 2014, 02:47:18 pm
Sort of surprising considering how many very intelligent people buy and use this kind of tool.
I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.

Yes, the vast majority have no need nor desire to hack their scope, nor would most even think to look for one. Agilent know that and rely on that. If a hack did eventually happen, I doubt they would bat much of an eyelid.



Sigh!  Nothing like an "Electronic Rubik's Cube"!  The sheer challenge of UN-doing the Done-up!..  :-DD
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HooRide on May 21, 2014, 10:20:30 pm
Does anybody know what a "(d)" following the license names means?

I got my scope back from repairs and most licenses were marked like that, see attached screenshot.

Unless numbers work in a completely different way in Germany; you have a higher firmware version than what is available on their site for us to upgrade to.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: blueindiana on May 22, 2014, 01:14:38 pm
Well, what exactly happens when you turn on your scope?
Did you try this?
1) Save the *.cab file on the USB flash disc.
2) Insert the USB flash disc into scope's USB port.
3) Turn on the scope.
4) The scope might boot up from the USB flash disc.
Please note that I do not know if this works. You are doing everything at your own risk!

thanks for your relay,i've tried the method you told me?i failed .   i posted the scope out to reload the  firmware.Thanks again for your courtesy.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: starblue on May 22, 2014, 06:53:29 pm
Unless numbers work in a completely different way in Germany; you have a higher firmware version than what is available on their site for us to upgrade to.

Yes, new scopes come with 2.36 which is not (yet?) available for download.
That has been discussed on this thread already.

Jürgen
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on June 06, 2014, 08:24:28 pm
Quote
It will take a while for the boards to come through, but once I have them and have figured out the actual costs...

The boards have turned up, and I've built one to verify that it works. It does :)

The pix show the bare board (no silkscreen or solder mask - it is really bare, not just figuratively) and the built one. The built one has a PTH cap because I didn't have a SMT one big enough. Built boards will go out with the right thing.

I can ship these for the following prices (which basically cover my costs). Note that the built units attract VAT since I have to buy the magjacks on a company account.
Item Cost
Bare PCB to UK address £2.50
Built PCB to UK address £9.60
Bare PCB to US address £4
Built PCB to US address £13.50

All prices use untracked shipping, and the US ones will take about 10 days. However, there is a possibility I've screwed up so I will ask for the actual cost once I've sent the items. If you're not in the US or UK I will quote you separately.

I have 9 of these PCBs to go, and my preference is to ship bare PCBs. If you want a built one it will take a little while to ship - I need to order the parts and build them first, and I am a bit busy at the moment, so they won't go out overnight.

PM me with your address and whether you want built or raw, and I'll take it from there.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Zucca on June 07, 2014, 05:35:31 pm
Anybody??

Zucca!

Here just to start:

(http://s2.postimg.org/49xg7cv21/IMG_1375.jpg)
(http://s2.postimg.org/puxxh82ex/IMG_1376.jpg)

if we call

(http://s2.postimg.org/5l0m231a1/IMG_1375_crop.jpg)

and

(http://s2.postimg.org/3uhl0ljqx/IMG_1377.jpg)

Here is when I get continuity:

A with 0,3,4,7,10,14,16,17
B with 1,2

Good luck!

PS: My multimeter shows 10R , not 11...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 07, 2014, 05:46:57 pm
Zucca, thanks!

I received boards back from the pcb house a few days ago, a panel that includes a lan board. I've trimmed it to fit/push into the edge connector, nice snug fit and all the pads line up perfectly. I need to order a magjack - next digikey order - this week.

Edit: Ok, just plugged the board into my dsox and measured power on Pin 1/2 per your annotated pictures and there is 3.3V on those 2 pins. So, that means the terminator power feed in the magjack have a cap to ground (likely 0.01uF) and a series resistor fed from 3.3V which makes perfect sense.

Now I know how to wire the magjack termination. The PCB layout I did has a variety of options including its own terminator regulator (just in case) since I sent it out to fab before anyone (thanks again Zucca) responded to my request.

I've got to figure out the LED polarity on the magjack still. If you have time or get a chance, could you ohm out the LED connections (on the magjack) all the way to the edge connector? TIA.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Zucca on June 07, 2014, 06:34:38 pm
For the LED, If this

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg445541/#msg445541 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg445541/#msg445541)

was not helpful, surely I will. Datasheet?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 07, 2014, 06:59:52 pm
For the LED, If this

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg445541/#msg445541 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg445541/#msg445541)

was not helpful, surely I will. Datasheet?

I've seen that post (I've read all this thread a few times). What wasn't clear was WHICH end of the LED (anode or cathode) was wired to the edge connector. The pictures don't show the internal traces (of course) so I can't tell the anode/cathode connection.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Zucca on June 07, 2014, 08:42:37 pm
Unbeliveable...

Like at work, also in my spare time I have to cover the holes left by someone else. "Do it right or not do it", that´s should be the first teaching to our children.
I´m not irritated at all, just surprised  :o.

Here the Datasheet:

http://www.trpconnector.com/pdfs/6605758.pdf (http://www.trpconnector.com/pdfs/6605758.pdf)

Now it looks like the 5-6605758-2 has already the 250R for the LED inside.

Here we go (see datasheet for the Dx pins):

D1 and D3 to pin 1/2 (3.3V, see posts above).
D2 and D4 see below:

(http://s22.postimg.org/hi43ax4oh/IMG_1376_crop.jpg)

Moreover IMO there are some filtering caps between D1,D3 and ground.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 07, 2014, 10:53:55 pm
Thanks Zucca, that clears things up nicely. I'll put it into a schematic in the next few days and post it up. At least it will then be clear and in one place how the magjack is wired.

Yes, the -2 has the 250 ohm resistors inside. My PCB had work either way, since digikey appears to stock some flavours of the 5-6605758 but not all of them.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 14, 2014, 01:21:43 am
So, I have my LAN board working nicely thanks to Zucca's clarifications of some of the signals. I'll post up a schematic in the next day or three, but here's some pics.

First pic is my lan board (most of the resistor options etc are to cover any cathode/anode polarity issues with the LEDs - before Zucca provided the additional details, and if a regulator would be needed for the termination network in the magjack). This is a picture prior to cutting out a slot in the edge connector and trimming the excess board material. This PCB was on a 'panel', so it was cut from a large rectangular panel of various other test boards etc.

After trimming it was a perfect fit into the edge connector in my dsox scope.

(http://www.taskled.com/leds/aglanpcb.jpg)

I carefully measured the length of the board so that it would fit snugly into the pocket with the plan to cut a hole for the magjack to stick out. By choosing the length 'just right' the original plastic clip/panel snaps nicely into place and supports the magjack end of the board and prevents it moving in any direction. Worked out nearly factory :)

(http://www.taskled.com/leds/aglan.jpg)

LEDs work, board works and I can access it via the webpage for full control. I used telnet to update the 2 required files that open up the licenses inside the scope. This halves the boot time (compared to the USB drive) but more importantly allows the webpage access to work. As someone else in this thread found, if you boot from a USB drive the webpage stuff doesn't work and reports an error.

Of course (as per the other DIY lan boards), the scope doesn't recognise it, so it doesn't appear in the utility->I/O menu, but all the configuration stuff can be done via the webpage server. In my case I put it at a static IP (starts off working since it gets an IP from a DHCP service on the network.

cheers,
george.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on June 14, 2014, 05:22:05 am
< snip >
...This halves the boot time (compared to the USB drive) but more importantly allows the webpage access to work. As someone else in this thread found, if you boot from a USB drive the webpage stuff doesn't work and reports an error.
cheers,
george.

Thank you georges80 for mentioning this information about the webpage!  I encountered the webpage errors two days ago and the situation was just as described earlier in this thread, and it was inconvenient because I could not grab screenshots quickly to the PC.  It's good to know that editing the files on the local system will let the web browser access work as needed.  I have to do this update soon!

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on June 14, 2014, 07:18:41 am
Hi all

I built a board up kindly provided by dunkemhigh. It seems to get an IP address, I can ping it but when I try to load the webpage it just reboots instantly. Is this a known issue when booting from a usb stick?

Thanks

Trev
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 14, 2014, 02:16:03 pm
When running from a USB drive and I try to access the webpage interface I do NOT get a reboot. What I get is an error message from the browser (firefox, IE etc, doesn't matter, same error message).

The solution (maybe there are others) is to transfer the license patches INTO the scope, i.e. the two files (as per mwilson's posts) get written to the scope and then boot from the scope. Does you lan card work ok (accesses the webpage correctly) if you boot from the scope (remove the USB drive)?

Another test to make sure your lan card is working is to telnet to the scope (login/password have been posted earlier in this thread -> infiniivision/skywalker1977 if I remember correctly). Telnet works just fine even if you have booted from a USB drive.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 14, 2014, 10:03:16 pm
So, I made my own LAN card and of course it isn't recognised/displayed in the I/O settings like all the other DIY lan cards. I remember seeing a comment by Plesa about pin 78 appearing maybe like a 'detect' pin. Looking at the pictures Zucca posted, there's a 0 ohm resistor and from his measurements it make pin 78 ground potential.

Plesa mentioned he had issues when he connected pin 78/80 (he used kapton on other pins of his vga/lan card). Anyhow, I figured I'd try to connect pin 78 to pin 80 on my DIY lan board. I get no errors (that he reported), BUT I now have the dsox2000 recognising that there is a LAN card plugged in. Menu now has all the Lan Configuration menu stuff active. The IP address (static in my case) is being populated correctly as per my router setup as soon as I plugged in the lan cable.

I'll post up more details in a bit - just got this working and now need to play with it a little :)

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Zucca on June 14, 2014, 10:31:10 pm
Well done bro! I knew there was potential in you... I'm glad I was a part of this project. The next step would be setting up a HDMI interface there... but it is not as important as a LAN! Well... Who cares now about a external monitor interface...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 14, 2014, 11:04:18 pm
Zucca, thanks for the pics and your connection info, definitely was what I needed to get my lan board running.

Here's the 'patch' to make the dsox recognise the lan card:

(http://www.taskled.com/leds/lan_rec.jpg)

and this is proof :)

(http://www.taskled.com/leds/lan_recs.jpg)

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on June 15, 2014, 04:33:22 am
I am so happy that LAN adapter is fully functional!
Even most wanted feature for me: SCPI over port 5024.
Here is screenshoots taken by VNC.

Many thanks for all contributors in this project.

Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on June 15, 2014, 06:50:25 am
Quote
Here's the 'patch' to make the dsox recognise the lan card:

Blinding work, that man  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on June 15, 2014, 03:20:34 pm
The mod georges80 made to the existing rear panel plug is what I had in mind, but when it came to putting knife to plastic I had a change of heart - it is rather final if one should screw up.

So, instead, I milled a but of PCB to the right size and affixed that to the LAN PCB with a couple of right-angle brackets. If I'd though to do this before sending off the gerbers I would have included the holes in the PCB, but they came out not too badly free-hand.

I used PCB pillars as extensions to have something to grip to pull the card out. They also make it easier to align the card when fitting it, but it now occurs to me that a flat blade could be inserted into the top and bottom cutout (where the clips on the real thing latch), so ejecting it isn't the problem I thought it might be. So at some point I'll remove the pillars and have the screw heads sitting flush.

So, not as pretty as either of the other DIY mods, but it's a bit easier and not fatal if you get it wrong.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Zucca on June 15, 2014, 04:28:17 pm
I ordered a 3D Printer... can´t wait to start to play with and fix all those above described problems about enclosures. I´m quite surprised nobody is already came up with a sketchup .stl file.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on June 15, 2014, 10:06:06 pm
Quote
surprised nobody is already came up with a sketchup .stl file

Don't know about anyone else, but I haven't because I have no experience of designing enclosures for 3D printing. I want to get this done reasonably quickly and then move on to using the scope, rather than spend the next 6 months learning how not to spend as much as the scope cost on making a plastic box to fit in it. But feel free to show us how it's done, optionally offering to sell us said boxes  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on June 16, 2014, 09:05:59 pm
I am in need of some help for booting from a USB Stick on my DSO-X 2002A, that I just bought used.
It came with  Firmware 2.35 is installed.
Options:
- EDK, Wavegen is permanently activated
- LAN/VGA Module is installed.

After reading this thread, I followed the instructions.
First the scope did not want to boot from a USB stick, but after formatting the stick with FAT16 it is booting ok.
After the bootup I am getting the message "All Options enabled"
But when I look in the "About Oscilloscope" window, the options are not installed
Instead I see: BW20, VID, CABLE, SCPIPS

The first picture below is normal bootup
the following three pictures are from the USB bootup.

Can someone explain to me, what I might have done wrong.
In addition to the bootup from the USB stick, do I need to do anything else?
Thanks for any advise



Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on June 19, 2014, 08:12:55 pm
Another dunkemhigh LAN board soldered up and installed :-) It gets recognized by the scope (georges80 hack by shortening the two pins), but during boot it does give an error 'System concers detected -LAN/VGA option module fault'. I guess this is because there's no VGA things happening on the board. Do yours also show the error after booting?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 19, 2014, 08:58:19 pm
No LAN/VGA errors/warning when I boot my scope up. The only 'warning' is the license hack. I have installed the license hack into my scope - rather than booting from a USB flash drive (not sure if that makes any difference). Try booting yours without the USB flash drive (if that's how you are booting)... just as a test.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on June 19, 2014, 09:05:00 pm
My scope is not hacked :-) No usb drives here.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 19, 2014, 09:16:35 pm
Hmm - well, I get no lan/vga errors/concerns/warnings. Maybe check that the card is inserted well and there's no shorts or issues with the edge connector/card mating.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on June 19, 2014, 09:25:31 pm
I just applied the pin 78/80 mod to my PCB, and additionally copied the dll to internal flash so I don't need the USB stick. On boot I still get the message "Booting from USB" although it boots without a USB stick! No LAN/VGA error message, and dropping into the I/O menus I can see and set the LAN parameters fine.

I feel a bit guilty that mine works but two I sent to other people don't. Maybe another recipient could pop up and say if theirs works...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on June 19, 2014, 09:26:41 pm
weird.. double checked my soldering and measured all the values. All values OK and no shorts. Reseated the board, but still the 'concern' remains.. hmmm..

Pulling out the multimeter, I do measure some strange values at the magjack.. when looking at the card from the bottom, with the magjack to the left, I measure the following on the row of 6 pins :

highest pin (closest to capacitor, let's call it pin 1) to pin 2 = 0.4 ohms.
pin 1 to pin 3 also 0.4 ohms!
pin 1 to pin 4 also 0.4 ohms!
pin 1 to pin 5 also 0.4 ohms,
pin 1 to pin 6 0.1 ohms.

but i didnt make any shorts on the bottom side while soldering.. maybe the casing of the magjack is shorting the traces together on the upper side of the board? There's no solder mask here.. No.. between pins and magjack = OL.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on June 19, 2014, 10:45:21 pm
I measure:

1 - 2 = 6R
1 - 3 = 5R8
2 - 3 = 6R7

1,2,3 - 4,5,6 = 0R

6 - 5 = 6R
6 - 4 = 5R8
5 - 4 = 6R7

This is a standalone magjack (same order as the one you have). Yours is shorting somehow - if there is nothing external doing it it has to be a bum magjack. If you can confirm that I'll send you this spare.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on June 20, 2014, 09:01:51 am
Will desolder The magjack andere check it next monday!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on June 20, 2014, 04:10:23 pm
No LAN/VGA errors/warning when I boot my scope up. The only 'warning' is the license hack. I have installed the license hack into my scope - rather than booting from a USB flash drive (not sure if that makes any difference). Try booting yours without the USB flash drive (if that's how you are booting)... just as a test.

cheers,
george.
I thought when you installed the hack directly to the scope it didnt give the warning and booted as normal?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on June 20, 2014, 04:14:32 pm
I get the same values when I measure my board. Magjack code is : RJMG163218101NR

weird.. double checked my soldering and measured all the values. All values OK and no shorts. Reseated the board, but still the 'concern' remains.. hmmm..

Pulling out the multimeter, I do measure some strange values at the magjack.. when looking at the card from the bottom, with the magjack to the left, I measure the following on the row of 6 pins :

highest pin (closest to capacitor, let's call it pin 1) to pin 2 = 0.4 ohms.
pin 1 to pin 3 also 0.4 ohms!
pin 1 to pin 4 also 0.4 ohms!
pin 1 to pin 5 also 0.4 ohms,
pin 1 to pin 6 0.1 ohms.

but i didnt make any shorts on the bottom side while soldering.. maybe the casing of the magjack is shorting the traces together on the upper side of the board? There's no solder mask here.. No.. between pins and magjack = OL.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on June 20, 2014, 04:50:38 pm
pins 1 and 6 are shorted on the PCB, so the 0R1 is expected there. 1 and 6 are also the center tap of the two channel magnetics, so you will see some connection between all pins when it's mounted on the PCB. But 0R4 is rather low.

The datasheet for the magjack is here:

http://www.farnell.com/datasheets/71713.pdf (http://www.farnell.com/datasheets/71713.pdf)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 20, 2014, 06:06:30 pm
No LAN/VGA errors/warning when I boot my scope up. The only 'warning' is the license hack. I have installed the license hack into my scope - rather than booting from a USB flash drive (not sure if that makes any difference). Try booting yours without the USB flash drive (if that's how you are booting)... just as a test.

cheers,
george.
I thought when you installed the hack directly to the scope it didnt give the warning and booted as normal?

No, the hack will give a warning error regardless of USB boot or internal flash boot. Basically the scope likely must checksum/crc or somehow sign the files to determine if something has been 'altered/damaged/changed'.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 20, 2014, 06:11:37 pm
pins 1 and 6 are shorted on the PCB, so the 0R1 is expected there. 1 and 6 are also the center tap of the two channel magnetics, so you will see some connection between all pins when it's mounted on the PCB. But 0R4 is rather low.

The datasheet for the magjack is here:

http://www.farnell.com/datasheets/71713.pdf (http://www.farnell.com/datasheets/71713.pdf)

The magjack magnetics on the phy side are just transformers and I'd expect very low DC resistance. I tested a 1gig magnetics that I have on one of my boards and they basically read near zero ohms (the lead resistance of my fluke 87III has more resistance).

Also, I've noticed on the original DIY design that the center tap of the transformer (on the phy side) is going to a capacitor and then ground.

From measurements by Zucca the agilent unit has 3.3V tied to the center tap pins (via a 10 ohm resistor and a cap, likely 0.1uf, to ground). i.e. the center tap is powered to 3.3V. This is common with the magnetics (some use 0V) - all depends on the actual phy in use. In this case 3.3V to the center taps is the 'correct' voltage. Not sure if that has any bearing in this case since your unit works from your reports.

cheers,
george

Edit: Fix stupid typo - grrr...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on June 24, 2014, 08:16:43 pm
I've received the pcb from dunkemhigh (thank a lot!), but I haven't got the MagJack yet.
But I already did the jumper on 78-80 pins, and connected it to scope, and got a LAN options avaliable.  :-+ :-+

Only waiting the magjack...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on June 30, 2014, 01:35:26 am
Another dunkemhigh LAN board soldered up and installed... but during boot it does give an error 'System concers detected -LAN/VGA option module fault'.

I also received two of the dunkemhigh boards and I am getting the same error on boot 'System concerns detected - LAN/VGA option module fault'. I installed the recommended magjack, pair of 220R and single 1uf components on both boards, but I get the same error on each. Anyone figure this out yet? Any suggestions?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 30, 2014, 02:17:49 am
As per my post #563 I don't believe the cap to ground on the center tap of the magnetics is correct. The original LAN/VGA board has 3.3V going through a 10 ohm resistor to the center taps. Also a cap to ground on the center tap side (just a bit of filtering). The key though is that the center tap is at 3.3V potential.

I'd give that a try and see if it helps. Presumably the scope is doing some checks via the Phy during boot up and sensing something isn't quite right. Given NOTHING is wired to any other pins the detected problem seems more than likely just a LAN issue.

My board (I layed out my own 'version') reports no lan/vga erros and works perfectly. I used the same magjack as the agilent lan/vga board and used the 10 ohm/0.1uf cap to get 3.3V to the two center taps.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on June 30, 2014, 04:03:26 am
Thanks George. I had read your posts, but was under the impression that others had the dunkemhigh board working fine with just the two 220R and a 1uf. It seems that way from other reports about the board anyway.

I'm not sure how to assure that the jack has 3.3 volts to the center tap without actually measuring voltages on the jack while the board is installed and running. And I'm worried about leaving it installed and running in my expensive scope given the error, and then probing around on top of that with power to the scope and board. I'm hoping someone else who has this board can give a more definitive answer about the correct component values, and if another component should be added or not. Alternatively, if someone knows what voltages should be applied to what edge connector pins on the card, I could then check the center taps with the card uninstalled and powered by my bench power supply.

I appreciate your help and comments, but I'm a bit apprehensive, especially remembering that Dave burnt his scope up once on a bad LAN card and had to return it to Agilent to be repaired.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 30, 2014, 04:13:14 am
The 3.3V comes from the edge connect. Go back a few pages in this thread and you'll find the pinout that Zucca posted and voltages he measured.

I soldered a few flying leads to various points on my board and plugged it in to measured and verify the 3.3V pin on the edge connector and it was correct as per Zucca's post.

Seems like quite a few folk have had similar problems to yours - so that's why I'm wondering if the incorrect center tap voltage is the issue.

I'm pretty sure (could be wrong...) that the dunkemhigh board has the center tap pins tied together and ONLY to a cap that is grounded on the other end - i.e. there is no DC bias being injected into the center tap.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on June 30, 2014, 07:36:46 am
I wonder if the board works for me due to the cap I used, which is visible in the photo here: previous EEVblog post (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg457798/#msg457798). Doesn't seem likely, but maybe I should try and break it...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on June 30, 2014, 08:49:35 am
Weird, I haven't got it work yet, wonder why dunkemhigh's board is working. Maybe I should send mine to dunkemhigh to compare in his scope?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on June 30, 2014, 09:29:27 am
Quote
Maybe I should send mine to dunkemhigh to compare in his scope?

If you wanted to do that, I'd be happy to try it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on June 30, 2014, 09:38:47 am
OK, I'll send it to you :-)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on June 30, 2014, 10:54:30 am
OK, I'll send it to you :-)

Great, I guess I will wait to see what dunkemhigh finds out first.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on June 30, 2014, 11:03:35 am
The 3.3V comes from the edge connect. Go back a few pages in this thread and you'll find the pinout that Zucca posted and voltages he measured...

I'm pretty sure (could be wrong...) that the dunkemhigh board has the center tap pins tied together and ONLY to a cap that is grounded on the other end - i.e. there is no DC bias being injected into the center tap.

Thanks, I see those posts and will try and check it out when I get a chance.

It seems several of us are having the same issue with the board. Hopefully WVL_KsZeN can get his board back to dunkemhigh quickly and the problem found.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JimHorn on July 04, 2014, 01:46:48 am
So far, I've found how to set up version 2.35 on a USB drive - but not 2.37 which is the only version Agilent provides anymore. I'd like to try the mods described earlier on my 02.35.201... version DSO 3014A but they don't work with the 2.37 image (I'm sure the infiniiVisionCore.dll locations to change have moved, among other things).

Does anyone have ideas on how to either modify the 2.37 image to enable options -or- where I might find a copy of the 2.35 version?

Many thanks to all -
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on July 04, 2014, 06:16:18 pm
Oh wow, so theres a 2.37 now? When did that come out? Last I had heard of was 2.36. And I have to say, you guys that have been working on the LAN card have been doing an awesome job, but seriously, all that work has made me very glad I just bought the VGA/LAN card when I did and jumped on it when I was able to get a good deal! Keep it up though as Im sure it will help lots of people out there!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Zucca on July 05, 2014, 07:57:20 pm
Here the 2.37

http://www.home.agilent.com/agilent/software.jspx?ckey=2014548&lc=eng&cc=US&nid=-33573.970736&id=2014548 (http://www.home.agilent.com/agilent/software.jspx?ckey=2014548&lc=eng&cc=US&nid=-33573.970736&id=2014548)

Released on the 21st May 2014
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on July 05, 2014, 08:20:43 pm
If someone needs the old 2.35 please send me a pm.
I have uploaded the cab file on my webspace.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on July 06, 2014, 11:02:40 pm
Oh wow, so theres a 2.37 now? When did that come out? Last I had heard of was 2.36....

Some info for all: firmware v2.36 was never available for download from Agilent; it only ever came pre-installed on new units or refurbs.  The previously downloadable version was v2.35.

I've attached the release notes for v2.37 --- there are a few enhancements, especially for power application measurements.

Previous attempts by members in the forum, myself included, were unsuccessful to get v2.36 working with the USB boot for patching options; other than USB boot not working, it appeared changes in "ProcessStartupFolder.exe" were involved, but this file could not be read from flash.  Anyone want to look at v2.37.  I will post back some findings after I look at the new firmware.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on July 11, 2014, 06:31:21 am
For those interested, I have uploaded (http://wikisend.com/download/321628/infiniiVision.rar) the "infiniiVisionCore.dll" from firmware releases 2.35, 2.36 and 2.37.  The file is ~50kB larger in 2.37 than the previous two versions (which are the same size, but different).

Since 2.36 did not allow USB boot it would be surprising if 2.37 allowed it again...  I have not tested installing 2.37 and seeing if a downgrade to 2.35 is possible...

From previous investigation, it seems \Windows\ProcessStartupFolder.exe in 2.36 may have been modified to prevent booting from USB drive.  I made a lot of attempts to copy ProcessStartupFolder.exe from internal flash when I had 2.36 installed, but it was not possible.

Is there any way to obtain this file from the 2.37 CAB?  I could not find it in infiniiVisionSetup.cab, so perhaps it is in another file (NK.BIN.COMP?)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Zucca on July 13, 2014, 08:23:32 pm
After getting a request from someone here what I did:

1) Upgrade from 2.35 to 2.37: OK!
2) Test SCPI on port 5024 with FW 2.37 (require LAN Module): OK!

Code: [Select]
Welcome to Agilent MSOX3054A InfiniiVision - MY5113XXXX
>>*idn?
AGILENT TECHNOLOGIES,MSO-X 3054A,MY5113XXXX,02.37.2014052001

3) downgrade from 2.37 to 2.35: FAILED!

See screenshot below, forgive me for the focus

(http://s18.postimg.org/ihfa8xhq1/Downgrade_failed.jpg)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on July 14, 2014, 12:58:46 am
Quote
3) downgrade from 2.37 to 2.35: FAILED!

Erk! That's a bit of a one-way trip. We should all be grateful you've tested that, at the expense of not being able to muck about with your kit now :(
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eurofox on July 14, 2014, 11:04:01 am
Quote
3) downgrade from 2.37 to 2.35: FAILED!

Erk! That's a bit of a one-way trip. We should all be grateful you've tested that, at the expense of not being able to muck about with your kit now :(

Smart done from Agilent  :-DD :-DD :-DD
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 14, 2014, 01:18:48 pm
Once original Agilent Option Licenses are installed in a scope, there is no need to reinstall them each time the firmware is updated. The new firmware keeps all your existing licenses intact. With this being the case, I’m curious… Has anyone loaded the hacked 2.35 firmware internally to their scope (not just booted from USB), then updated to the 2.37 firmware. If so, were any or all the upgraded options kept, as they would be in a scope with original Agilent licenses?

If so, this would be a good scenario for anyone with 2.35 or lower, as the options could be loaded and then the scope updated as future firmware and features are released. It would not be good for newer scopes already loaded with firmware later than 2.35.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Zucca on July 14, 2014, 01:29:31 pm
were any or all the upgraded options kept, as they would be in a scope with original Agilent licenses?

In my case I paid $$$ for the options and I did not hack the scope. Of course I was not worried at all to test the upgrade to 2.37, since I was sure the options were still there no matter what.

Good Luck for all your hacked scopes, in my experience it is just a matter of time so be patience, don´t give up with the reverse engineering and don´t lose hope.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwilson on July 14, 2014, 10:29:19 pm
I’m curious… Has anyone loaded the hacked 2.35 firmware internally to their scope (not just booted from USB), then updated to the 2.37 firmware. If so, were any or all the upgraded options kept, as they would be in a scope with original Agilent licenses?

Because the hack isn't really "installing" licenses, it's modifying the actual oscilloscope software to make it think certain licenses are enabled, the firmware upgrade will replace that oscilloscope software with a non-modified version, so the scope will no longer think the licenses are enabled. (For example, I did install the modified 2.35 to the internal memory but whenever I wanted to undo it to try a different method or experiment I simply re-installed the 2.35 firmware from Agilent and all the hacked license features were gone.)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 14, 2014, 10:40:41 pm
Because the hack isn't really "installing" licenses, it's modifying the actual oscilloscope software to make it think certain licenses are enabled, the firmware upgrade will replace that oscilloscope software with a non-modified version, so the scope will no longer think the licenses are enabled...

OK, that make sense. I guess keeping 2.35 installed is a good idea, at least until something is able to be done with 2.37 (or later). Don't see any compelling reason to go to 2.37 anyway.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yocheng on July 16, 2014, 01:58:13 pm
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
    Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
    byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
    Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
    Replace in infiniiVision folder  infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red  message in letf top corner "Unfinalized Software"  and "System Concerns detected: OS version is not correct. Please reload system firmware"

Applications needed:
 WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
 7Zip http://www.7-zip.org/ (http://www.7-zip.org/)

These steps can be used in the 2.37 firmware?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on July 16, 2014, 02:40:00 pm
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
    Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
    byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
    Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
    Replace in infiniiVision folder  infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red  message in letf top corner "Unfinalized Software"  and "System Concerns detected: OS version is not correct. Please reload system firmware"

Applications needed:
 WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
 7Zip http://www.7-zip.org/ (http://www.7-zip.org/)

These steps can be used in the 2.37 firmware?

No.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 16, 2014, 02:40:44 pm
These steps can be used in the 2.37 firmware?

No. The structure and length of the new firmware cab is different.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yocheng on July 16, 2014, 03:36:03 pm
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
    Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
    byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
    Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
    Replace in infiniiVision folder  infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red  message in letf top corner "Unfinalized Software"  and "System Concerns detected: OS version is not correct. Please reload system firmware"

Applications needed:
 WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
 7Zip http://www.7-zip.org/ (http://www.7-zip.org/)

These steps can be used in the 2.37 firmware?

No.

My firmware is 2.37 I can drop to 2.35?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yocheng on July 16, 2014, 03:37:53 pm
These steps can be used in the 2.37 firmware?

No. The structure and length of the new firmware cab is different.

My firmware is 2.37 I can drop to 2.35 firmware?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 16, 2014, 03:48:18 pm
My firmware is 2.37 I can drop to 2.35 firmware?

You should go back and read the last couple of pages...

After getting a request from someone here what I did:
1) Upgrade from 2.35 to 2.37: OK!
2) Test SCPI on port 5024 with FW 2.37 (require LAN Module): OK!
3) downgrade from 2.37 to 2.35: FAILED!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 16, 2014, 07:54:46 pm
A quick analysis of 2.37 shows that Startup Override functionality is disabled in ProcessStartupFolder.exe: it still looks for infiniivisionStartupOverride.txt file, but instead of executing lnk/exe files it runs "ipconfig.exe /all > ipconfig.txt" (what is it? a "tampered" mark?), then "rebootInfiniiVision.exe", which surprisingly results in reboot  >:D 2.36 has the same problem I guess.
We should focus on downgrade I think.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on July 16, 2014, 10:58:15 pm
So i did some tests with the "Unfinalized Software" Hack on the 2.37 Firmware.

On my Scope is currently the version 2.35 with the most options enabled by DSOAPP Bundle except the MSO Function.

I extracted the cab file of the 2.37 with this tool MSCEInf - CAB Analyzer (No Setup needed and free)
And searched for the same code location and it has moved to 0x27A9A0, changed the 4 byte to 00 00 A0 E3 and put the whole Infiniivision folder to the usb stick.
The Scope boots the 2.37 and the additional features are enabled. (see Screenshots)

A quick analysis of 2.37 shows that Startup Override functionality is disabled in ProcessStartupFolder.exe: it still looks for infiniivisionStartupOverride.txt file, but instead of executing lnk/exe files it runs "ipconfig.exe /all > ipconfig.txt" (what is it? a "tampered" mark?), then "rebootInfiniiVision.exe", which surprisingly results in reboot  >:D 2.36 has the same problem I guess.
We should focus on downgrade I think.
:wtf: Nice find!
Maybe it's posible the change the exe with an older one that supports usb booting
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yocheng on July 16, 2014, 11:44:25 pm
My firmware is 2.37 I can drop to 2.35 firmware?

You should go back and read the last couple of pages...

After getting a request from someone here what I did:
1) Upgrade from 2.35 to 2.37: OK!
2) Test SCPI on port 5024 with FW 2.37 (require LAN Module): OK!
3) downgrade from 2.37 to 2.35: FAILED!

Thank you for your reply, post too long, not scrutiny. Sorry.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yocheng on July 16, 2014, 11:53:03 pm
So i did some tests with the "Unfinalized Software" Hack on the 2.37 Firmware.

On my Scope is currently the version 2.35 with the most options enabled by DSOAPP Bundle except the MSO Function.

I extracted the cab file of the 2.37 with this tool MSCEInf - CAB Analyzer (No Setup needed and free)
And searched for the same code location and it has moved to 0x27A9A0, changed the 4 byte to 00 00 A0 E3 and put the whole Infiniivision folder to the usb stick.
The Scope boots the 2.37 and the additional features are enabled. (see Screenshots)

A quick analysis of 2.37 shows that Startup Override functionality is disabled in ProcessStartupFolder.exe: it still looks for infiniivisionStartupOverride.txt file, but instead of executing lnk/exe files it runs "ipconfig.exe /all > ipconfig.txt" (what is it? a "tampered" mark?), then "rebootInfiniiVision.exe", which surprisingly results in reboot  >:D 2.36 has the same problem I guess.
We should focus on downgrade I think.
:wtf: Nice find!
Maybe it's posible the change the exe with an older one that supports usb booting

You cracked the 2.37 firmware?
1.I use 4G USB format it FAT16
2.Change at location 0x27A9A0 in infiniiVisionCore.dll byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
3 Edit in Startup folder file infiniivision.lnk to contains following sequence "62#usbinfiniiVisioninfiniivisionLauncher.exe -l All -l SCPIPS"
4.Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
5.5.Plug the USB drive to scope and turn it ON

But I can not hack it , The LED lamp has been circulating blinking, screen also continue to restart.
who can send me the USB file zip. my E-mail: yocheng@163.com      Thank you very much!
               
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 17, 2014, 12:11:33 am
Thank you for your reply, post too long, not scrutiny. Sorry.

You never know what you might be missing by not reading...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 17, 2014, 12:14:11 am
So i did some tests with the "Unfinalized Software" Hack on the 2.37 Firmware.
...
The Scope boots the 2.37 and the additional features are enabled. (see Screenshots)

Nice work!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on July 17, 2014, 06:29:14 am
A quick analysis of 2.37 shows that Startup Override functionality is disabled in ProcessStartupFolder.exe: it still looks for infiniivisionStartupOverride.txt file, but instead of executing lnk/exe files it runs "ipconfig.exe /all > ipconfig.txt" (what is it? a "tampered" mark?), then "rebootInfiniiVision.exe", which surprisingly results in reboot  >:D 2.36 has the same problem I guess.
We should focus on downgrade I think.

@abyrvalg: How did you located the file ProcessStartupFolder.exe in the 2.37 download?  I looked but could not find it in any .cab file, so I assume it is compressed with other /Windows/* files, perhaps in a .BIN file but I don't know.  If you could provide some idea, I would appreciate it so I can understand how it all fits together.

ProcessStartupFolder.exe is one file I could not copy from the scope when I was on 2.36 firmware.  We suspected that it was fundamental to changing the USB boot process, and now thanks to your efforts we have good idea what is happening!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 17, 2014, 09:09:57 am
Tools to extract the firmware/kernel.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: daemon82 on July 17, 2014, 12:51:37 pm
Hello guys!

I seemed to have a FW problem with the oscilloscope and had to upgrade the firmware unfortunately before I found this forum...
Now I have 2.37 fw revision.
I tried to downgrade  by tricking the process into thinking the 2.35 files are 2.37 indeed by changing strings in INFINI~1.028
I have recalculated the MD5 for the infiniVIsionSetup.cab too to set it in the recipe.xml
I unpacked the .cab files with 7zip and packed them back with CABPACK.
It did not work, I get error message about the file loading unsuccessful.
I am not sure though if it was a wrong packing method I used, or something else.

Did anybody approach the downgrade process from this angle?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 17, 2014, 05:40:59 pm
Looks like the problem is here:
2.35 infiniiVisionCore.dll: infiniiVisionInstallService.exe --minimumVersion 2.20.00.00
2.37 infiniiVisionCore.dll: infiniiVisionInstallService.exe --minimumVersion 2.36.00.00
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 17, 2014, 06:32:39 pm
Hello guys!

I seemed to have a FW problem with the oscilloscope and had to upgrade the firmware unfortunately before I found this forum...
Now I have 2.37 fw revision.
I tried to downgrade  by tricking the process into thinking the 2.35 files are 2.37 indeed by changing strings in INFINI~1.028
I have recalculated the MD5 for the infiniVIsionSetup.cab too to set it in the recipe.xml
I unpacked the .cab files with 7zip and packed them back with CABPACK.
It did not work, I get error message about the file loading unsuccessful.
I am not sure though if it was a wrong packing method I used, or something else.

Did anybody approach the downgrade process from this angle?

You can buy the DSOX3APPBNDL and it will unlock almost the same like any hack....
http://www.home.agilent.com/en/pd-2401593-pn-DSOX3APPBNDL/application-bundle-for-infiniivision-3000-x-series-oscilloscopes (http://www.home.agilent.com/en/pd-2401593-pn-DSOX3APPBNDL/application-bundle-for-infiniivision-3000-x-series-oscilloscopes)
Included options
DSOX3ADVMATH Advanced math measurement application
DSOX3AERO A/D trigger and decode (MIL-STD 1553/ARINC 429)
DSOX3AUDIO Audio serial trigger and analysis (I²S)
DSOX3AUTO Automotive trigger and analysis (CAN/LIN)
DSOX3COMP Computer trigger and analysis (RS232/UART)
DSOX3EMBD Embedded trigger and analysis (I²C/SPI)
DSOX3FLEX FlexRay trigger and analysis
DSOX3MASK Mask limit testing
DSOX3MEMUP Memory upgrade to 4 Mpts
DSOX3PWR Power measurements
DSOX3SGM Segmented memory acquisition
DSOX3VID Video trigger and analysis
DSOX3WAVEGEN Integrated 20 MHz function/arbitrary waveform generator
DSOXDVM Integrated digital voltmeter
DSOXEDK Educator’s training kit
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 17, 2014, 06:40:01 pm
Update: not 100% sure, but it looks like this version is checked against the FileVersion field of VS_VERSION_INFO resource of infiniivisionLauncher.exe inside the cab. This exe looks similar for 2.35 and 2.37, just the version string, timestamps and digital signature differs. Anyone to try putting a 2.37 launcher into 2.35 cab and updating? Somebody from Agilent?  >:D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on July 17, 2014, 09:57:11 pm
So I did the update to 2.37 and tried how to downgrad to V2.35.
The first step was a modified cab based on V2.35 and Infiniivision.cab from 2.37 to change the Windows folder with the ProcessStartupFolder.exe
The 2.37 Firmware has loaded the Firmware Update successfully but it takes a couple of minutes before the scope reboots.
This is the simples way to restore the \windows folder to an older version because ist write protected.

The next Step was to rename the 2.37 to 2.35 in the infiniiVisionLauncher and infiniiVisionCore and replaced these files directly over telnet from usb to the \sercure folder.
after a reboot i tried to load a V2.35 Firmware but this didn't works maybe the timestamp was also checked. :(

After I replaced the newest files in the \secure\infiniivision folder direcly with the 2.35 Files I was able to load the old v2.35 setup.

So its posible to go back to the V2.35 with the help of telnet access.

Because i did this with try&error i don't have more details at the moment. For the moment I'm happy that my scope is run with V2.35 again an working Usb Startup. :phew:

btw It's easy the change the Splash Screen \windows\compileImageForSplashScreen.exe \usb\SplashImage.png \Secure\InfiniiVision\splashImage.bin
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 18, 2014, 05:47:01 am
kilobyte, good news!

If someone with telnet access wants to experiment with cab versioning, there seems to be a quick way to test is it accepted w/o installing it: run infiniiVisionInstallService.exe --validateOnly --minimumVersion 2.36.00.00 \usb\your_cab_file
I don't have a scope to try, use infiniiVisionInstallService.exe --help to get more info on that
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on July 20, 2014, 05:54:59 am
So i did some tests with the "Unfinalized Software" Hack on the 2.37 Firmware.

On my Scope is currently the version 2.35 with the most options enabled by DSOAPP Bundle except the MSO Function.

I extracted the cab file of the 2.37 with this tool MSCEInf - CAB Analyzer (No Setup needed and free)
And searched for the same code location and it has moved to 0x27A9A0, changed the 4 byte to 00 00 A0 E3 and put the whole Infiniivision folder to the usb stick.
The Scope boots the 2.37 and the additional features are enabled...

Thanks kilobyte! I'm in the same boat as you --- have 2.35 and most options enabled by DSOAPP bundle, except BW and MSO.  I was able to reproduce your finding by modifying 2.37 as you instruct, and the MSO and BW options activated.  Thanks for the updated memory location to edit.

Tools to extract the firmware/kernel.

Thank you abyrvalg! I appreciate the nice instructions :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mischo22 on July 22, 2014, 07:56:53 pm
I tested the Version 2.37 installed on my usb-stick.

Warning: It change the Telnet Password!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 22, 2014, 09:00:21 pm
It is weird with 2.37 installed on scope telnet password remain unchanged.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 22, 2014, 09:15:17 pm
Telnet password is set at every startup by /windows/createUserAccounts.exe program, which lives inside nk.bin.comp - no way to change it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on July 22, 2014, 10:55:03 pm
I don't have any problems with Telnet login.

But here the first login fail and the second login is working with putty.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on July 23, 2014, 12:49:02 am
Weird, I haven't got it work yet, wonder why dunkemhigh's board is working. Maybe I should send mine to dunkemhigh to compare in his scope?

The board is here and in my scope. It works exactly the same as my board does - that is, there is no discernable problem. I don't get any warning on boot, and I can do the full remote control stuff without error.

This kind of suggests that mys scope is somehow different from everyone elses. I guess I could flog it with a $200 markup like that chap flogging E4's :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Zucca on July 23, 2014, 01:37:03 am
I don't have any problems with Telnet login.

But here the first login fail and the second login is working with putty.

I used kitty but same thing: first no, second yes no problem. I remember I powered the scope down disconnect the AC main and redo the test, it started no problem immediately. As far I remember in my case the problem was just the first telnet after the upgrade to 2.37. It could be I'm wrong...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on July 23, 2014, 08:06:43 am
Weird, I haven't got it work yet, wonder why dunkemhigh's board is working. Maybe I should send mine to dunkemhigh to compare in his scope?

The board is here and in my scope. It works exactly the same as my board does - that is, there is no discernable problem. I don't get any warning on boot, and I can do the full remote control stuff without error.

This kind of suggests that mys scope is somehow different from everyone elses. I guess I could flog it with a $200 markup like that chap flogging E4's :)
Well, that explains why I couldnt find any error.. still, not being the only one with the error there must be something we're overlooking?  :-//

When I'm home, I'll write down the serial of my scope, maybe by comparing we can figure out if it's a hardware thing? Too bad I dont know anybody with an original module to try and see if that works or not..
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mischo22 on July 23, 2014, 08:21:19 pm
I have the solution for the brocken web Interface when the firmware is startet from usb-stick:

Copy the file "/infiniivision/upgrade/infiniiVisionWebCom.dll" from the USB-stick to "/infiniivision" on the stick.
The Webinterface works fine now.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on July 23, 2014, 11:12:56 pm
Quote
The Webinterface works fine now.

Smart work, that man  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 24, 2014, 02:22:51 am
... I ... wonder why dunkemhigh's board is working. Maybe I should send mine to dunkemhigh to compare...

The board is here and in my scope. It works exactly the same as my board does - that is, there is no discernable problem. I don't get any warning on boot, and I can do the full remote control stuff without error.

This kind of suggests that my scope is somehow different from everyone else...

Well, that explains why I couldnt find any error.. still, not being the only one with the error there must be something we're overlooking?  :-//

When I'm home, I'll write down the serial of my scope, maybe by comparing we can figure out if it's a hardware thing? Too bad I dont know anybody with an original module to try and see if that works or not..

I too have been unsuccessful in getting either of my dunkemhigh boards to work.
Before going after serial numbers, perhaps it is a difference between the different scopes models themselves (2000A vs 3000A, or even 100MHz vs 500MHz). There should be no difference between DSOX and MOSX, as both models are the same, only the MSOX has been software enabled on the later.

What models are successful users of dunkemhigh LAN boards using them in?
And what models are unsuccessful users of dunkemhigh LAN boards using them in?
I'm using an MSOX3054A, and I have no issues when using an actual Agilent DSOXLAN module.

I believe dunkemhigh has a 2000A. Is anyone with a 3000A successful in using a dunkemhigh LAN card?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on July 24, 2014, 09:43:32 am
Quote
I believe dunkemhigh has a 2000X

Yes, it is a DSO-X 2004A. Maybe that A is significant.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 24, 2014, 12:49:39 pm
Quote
I believe dunkemhigh has a 2000X

Yes, it is a DSO-X 2004A. Maybe that A is significant.

I think they are all "A" models... My model number has now been appended with the "A".
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on July 24, 2014, 02:47:11 pm
Mine is an msox2024a and my home made lan board works perfectly.

I've mentioned this before...

The dunkemhigh board has one issue that doesn't follow the original design. The original agilent lan board has the magjack center taps connected together and to 3.3V via a 10ohm resistor (and bypass cap). The dunkemhigh magjack (from what I can see and correct me if I'm wrong) has the center tap of each isolation transformer connected together then via a capacitor to ground, no 3.3V connection.

Maybe the 3000 series is more fussy and the phy detects a problem.

It would be worth tying the center taps to a 10 ohm resistor to the 3.3V on the edge connector to see if that fixes anything.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on July 24, 2014, 03:02:20 pm
Quote
I've mentioned this before...

Indeed, and it would be cool if someone could try that. Obviously, it's not much use me doing it... :)

I am not about to complain, but if that is the problem I can't see why mine doesn't suffer, at least some times. It would be conceivable that my board/jack has something different (a short of open, maybe), but I've tried a different board that fails for someone else yet works perfectly for me.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on July 24, 2014, 04:37:50 pm
Dunkemhigh - yes, that's why I mentioned maybe that the 3000 series is more fussy...

At this point yours is a 2000 series and works fine and mine is also a 2000 series and works fine. I DID early on disconnect the 3.3V to the center taps and on my 2000 series it still worked fine... I did put it back to 3.3V to be 'correct'.

Does anyone with a 3000 series have a working diy lan board?

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Antonsio on July 26, 2014, 07:31:14 pm
Hi
I am new in the forum. I designed a LAN board for my DSOX2004 using the gerber files posted in this theme. The LAN connector is different and i made some changes on the board. My problem is the same like with most of the people here - center tap of the isolation transformers. I tried everything, but i can't find where exactly is the 3.3V pin on the edge connector. I saw the pictures here with description of the pins but it didn't work for me. Anyway the PCB is working, but during boot procedure a get a message - "System concerned .... LAN Failure"  or something like that.
If somebody knows which pin exactly is 3.3V i will appreciate it :)
(Sorry for the bad english)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on July 26, 2014, 07:56:39 pm
On my scope from first day, if USB stick unplugged, I also see error message, but LAN module work and recognized by scope! "System concern detected..." hide the LAN error message.

Did you tried to communicate with scope over LAN?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on July 26, 2014, 08:15:23 pm
Hi
I am new in the forum. I designed a LAN board for my DSOX2004 using the gerber files posted in this theme. The LAN connector is different and i made some changes on the board. My problem is the same like with most of the people here - center tap of the isolation transformers. I tried everything, but i can't find where exactly is the 3.3V pin on the edge connector. I saw the pictures here with description of the pins but it didn't work for me. Anyway the PCB is working, but during boot procedure a get a message - "System concerned .... LAN Failure"  or something like that.
If somebody knows which pin exactly is 3.3V i will appreciate it :)
(Sorry for the bad english)

Look at Zucca's post ->

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg458172/#msg458172 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg458172/#msg458172)

"B" in the drawing is the signal that needs to go to 3.3V. All the info is in that post.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Antonsio on July 27, 2014, 07:39:57 am
First of all - thanks for the answers. The communication with the scope is OK. I tried few things from my browser and it works fine. Only the starting process of the scope is  slower than normaly (maybe with 20-30sec). This i think is because of the tests that the system makes during boot for the LAN card. If LAN card is not responding properly the test is made few more times. Again - its not a big problem, but the boot of the scope is relatively slow and now is even slower.
When i try to connect the center taps together and connect them to 1,2 pin (shown on ZUCCA's pictures) i get the same error. I will try few more things and if i clear the error the PCB files will be changed and i will update my version of the project (altium files). By the way the connector that i use is:
http://www.tme.eu/bg/details/rj45-trafo-lt/syediniteli-rj/amphenol/lmj2018814100dl2t1b/ (http://www.tme.eu/bg/details/rj45-trafo-lt/syediniteli-rj/amphenol/lmj2018814100dl2t1b/)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Gandalf_Sr on July 27, 2014, 04:05:24 pm
I'm looking out for a DSOX2xx4 or DSO3xx4 that I could buy and 'upgrade'.  Seems a new one may have 2.37 which may prevent me from doing the USB boot feature - not sure?

I've read the whole thread, but there are a few of basic things I'm not clear on.

1. What are folks using to telnet into the scope?  I know it can be done if there's a LAN card fitted but what if there's no LAN card?  Is it done using the connection to the serial port header on the PCB or can you connect via the USB using an USB-Serial cable?

2. What are the port settings for the serial connection - BAUD rate etc?

3. If you get to the point that you can boot from USB, it seems that the USB stick needs to stay in the scope.  Is there a second USB port or does that mean you can't save stuff to the USB drive?

Thanks,
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on July 27, 2014, 04:47:20 pm
First of all - thanks for the answers. The communication with the scope is OK. I tried few things from my browser and it works fine. Only the starting process of the scope is  slower than normaly (maybe with 20-30sec). This i think is because of the tests that the system makes during boot for the LAN card. If LAN card is not responding properly the test is made few more times. Again - its not a big problem, but the boot of the scope is relatively slow and now is even slower.
When i try to connect the center taps together and connect them to 1,2 pin (shown on ZUCCA's pictures) i get the same error. I will try few more things and if i clear the error the PCB files will be changed and i will update my version of the project (altium files). By the way the connector that i use is:
http://www.tme.eu/bg/details/rj45-trafo-lt/syediniteli-rj/amphenol/lmj2018814100dl2t1b/ (http://www.tme.eu/bg/details/rj45-trafo-lt/syediniteli-rj/amphenol/lmj2018814100dl2t1b/)

Do your magjack LEDs work? Seems you have the pinout in your schematic back to front (anode/cathode flipped). e.g. you have pin 12 as the cathode, but the datasheet has pin 12 as the anode (same mistake in your schemetic for the 2nd LED).

The anode end of both LEDs (connect together) and feed from the 3.3V on the card edge.

I use the same magjack style (AMP part number) and it works perfectly without any errors. Boot up time is 37 seconds to where it says Agilent etc and 45 seconds to being fully booted and displaying a trace etc (msox2024a). I did copy the patched firmware to the internal memory to speed boot time versus a USB stick.

The center taps should connect together and connect to a capacitor (1uF seems fine) and resistor (10 ohms). The other end of the capacitor goes to ground. The other end of the resistor goes to 3.3V on the card edge.

I'll have to draw up a schematic of my lan vga diy card since it does work perfectly without any errors (at least on my msox2024a).

cheers,
george.


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Antonsio on July 27, 2014, 06:38:20 pm
Yes, you are right - the leds are not connected properly. Maybe PCB design for 1 hour is not good idea :D
I will make some cuts on the board when i have spare time and i will try to clear thigs up. Thanks for the answer.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on July 28, 2014, 07:02:41 pm
Just for the record, my scope is an (unhacked) mso-x 2024a, so it's not a case of the 3000 being more fussy.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 28, 2014, 07:45:46 pm
Just for the record, my scope is an (unhacked) mso-x 2024a, so it's not a case of the 3000 being more fussy.

Thanks. That kind of kills the 2000A vs 3000A theory...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 28, 2014, 08:22:33 pm
Just an idea: maybe it depends on sw version?
There is an FPGA in VGA part of original board, so it can be configured and then checked (or not checked, depending on sw inside the scope).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 28, 2014, 09:14:52 pm
Just an idea: maybe it depends on sw version?
There is an FPGA in VGA part of original board, so it can be configured and then checked (or not checked, depending on sw inside the scope).

Good thinking, it may well be a VGA related fault and not necessarily the LAN. After all, the reported error is "LAN VGA option module fault". Perhaps on some scope versions the logic says; if there exists a LAN module, the VGA must exist also, let's check...

I never proceeded further with my card after receiving the error, as I'm very afraid of damaging my expensive scope. But after Antonsio reported he receives the same error and then has good communication with his board, it got me thinking that perhaps the communication with my dunkemhigh board may work just fine also. Your comments only further support the reason why the error may appear and the LAN still work. I will have to test and report back...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on July 28, 2014, 09:41:36 pm
So, folk that have lan/vga problems with the diy board, what is your firmware version on your scope and what model do you have?

Mine works perfect with no error lan/vga error messages (with my diy lan card):

MSOX2024A and firmware version 2.35.2013061800 as reported on the 'about scope' screen. Also with licenses 'enabled' and loaded into the scope (versus usb flash drive).

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on July 28, 2014, 10:39:15 pm
DSO-X 2004A, firmware 02.35.2013061800

Also licenses enabled and loaded into the scope, but I still get the message about booting from USB, and the 'About' screen even says (in red) "Booting from USB device".

It's possible I screwed up somewhere  :-//
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 28, 2014, 11:53:04 pm
MSOX 3054A, firmware 02.35.2013061800
Error with dunkemhigh board, but fine with Agilent DSOXLAN.
No need for other mods, as I already have MSO, max BW for my model, and the DSOX3APPBNDL.

I really don't think that the difference is in the loadable firmware, but could it be hidden in the fixed code of some other piece of hardware in a later (or earlier) revision scope? My scope was new in Nov 2011.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Antonsio on July 29, 2014, 08:14:40 am
I also think that this error may not be related to LAN only. I've tried everything to clear up the error, but nothing work. Anyway - the LAN connection is ok (which is the main point). Instead of this error i've seen something else, which i think is important. When i push in the edge connector the LAN PCB without any component and any pin from 1 to 80 connected together i get strange boot image - one of the colors maybe is missing. We tried everything with my colleague ( he have a DSOX 3024A , not hacked ) and on his scope we get same boot display with "color distortion". Finaly we thought maybe this is related to empty pins for the VGA connection. We cleared them and now everything is ok. The module is installed "tightly" without box and when i need LAN i just remove the original cover (shown in the attached photos) :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on July 29, 2014, 09:07:56 am

3. If you get to the point that you can boot from USB, it seems that the USB stick needs to stay in the scope.  Is there a second USB port or does that mean you can't save stuff to the USB drive?

Can't give you a definitive answer on your first two questions, sorry, but there are three USB ports: a host (A) and  device (B) at the rear, and host (A) at the front.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: euzer on July 29, 2014, 09:37:18 am
3. If you get to the point that you can boot from USB, it seems that the USB stick needs to stay in the scope.  Is there a second USB port or does that mean you can't save stuff to the USB drive?

Thanks,


Is any calibration maintained when running the hacked>?
Is it still possible to save screen images to the USB memory stick?

Yes calibration is maintained, and
you can save/recall data to/from USB stick.

Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Gandalf_Sr on July 29, 2014, 04:26:38 pm
Thanks for the confirmation on multiple USB ports.  I was really trying to understand what I needed to do to get the dll file onto the USB drive, I think am I missing something here.

Is it possible to set up a batch file on the USB drive that issues the command to copy the file onto the drive?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cassiopeia on August 11, 2014, 07:53:34 pm
Dear All,

this is my first post on eevblog forum.
I use firmware 2.35 on a dsox2002a. The trick works only if NO trial license is enable ! With trial license, either it does not work, or only some license are activated, although the scope reports "all license activated" at startup.

Hope this can help.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dundee on August 29, 2014, 06:22:43 pm
kilobyte's way is working for me!
Thank you :)

I'm using an intenso aluline 8gb stick. Formated as Fat32

Is it possible to upgrade the bandwith on my model (3012)?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on August 31, 2014, 05:15:28 am
Follow this link, as I see your problem is exactly same:

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg414813/#msg414813 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg414813/#msg414813)

Goeorg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dundee on August 31, 2014, 11:03:44 pm
Thanks georgd!

It's working!

By the way:
I've  got a few requests about sending a ready hacked zip package. Do it by your own!  :-/O
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: alanambrose on September 27, 2014, 04:42:23 pm
Hi George,

Possible to post your working schematic? - I'm just laying out this board and it would seem a good idea not to reinvent the ... schematic :)

Thanks, Alan
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on September 27, 2014, 05:30:41 pm
This is the final schematic of my working lan card. I'm using an Digikey 1419-1021-ND for the magjack.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yocheng on September 28, 2014, 04:34:04 am
 :-+Thanks to kilobyte for help, and now my oscilloscope has cracked.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: alanambrose on September 28, 2014, 01:22:31 pm
Thanks George, I'll post up my layout when it's back and verified. I'll try the Amphenol part first and then revert to the TRP part if there are problems.

Alan
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pstemari on October 10, 2014, 05:59:24 pm
Yeesh.  I think Agilent/Keysight *wants* people to just hack these scopes.

Tried buying the "ultimate" software bundle, which is cheap enough that for me, at least, hacking the scope isn't really worth the bother.

You would think that you could just put a scope S/N and credit card number into their website and get back a license key. Noooooooo.

If you go the Keysight website to get the bundle, you have to pick a distributor to get a quote from.  Then you get to call the distributor, and they will ship "stock" from their warehouse.  Once you get whatever they ship in the mail, then presumably you use that to go to their website, put in a S/N,, and get back a license key.

 :phew:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on October 10, 2014, 06:38:30 pm
If you go the Keysight website to get the bundle, you have to pick a distributor to get a quote from.  Then you get to call the distributor, and they will ship "stock" from their warehouse.  Once you get whatever they ship in the mail, then presumably you use that to go to their website, put in a S/N,, and get back a license key.

All you need from the certificate that the distributor sends you is your "Agilent order Number" and "Agilent Certificate Number" and most distributors can give you that over the phone or email it to you after payment is made. Make sure that you ask first. I have done this for several machines with no problems. From time to order to time of feature installation was just minutes. Compare that with a company that sells modules you have to install...

If you have a favorite Agilent Distributor already, then you can even skip right to order placement and have all your licenses installed almost as fast as I could type this reply.

Agilent requires you to go through a distributor, because they do not bypass the people that make them sales. Also, you can sometimes get a discount with a distributor that you would not get through a direct purchase. At the same time, Agilent does allow direct purchase of small parts that would be a hassle for you and the distributor to go through channels if you had to.

Thank you Agilent for making the process as easy as possible...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on October 10, 2014, 11:02:36 pm
How interesting, I just noticed that Keysight extended their bundle offer for the option pack until 12-6-2014.

And yes, if you ask your distributor for an additional discount, you probably get it.
At least in Germany they offered it.


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on October 10, 2014, 11:19:12 pm
How interesting, I just noticed that Keysight extended their bundle offer for the option pack until 12-6-2014.

And yes, if you ask your distributor for an additional discount, you probably get it.
At least in Germany they offered it.

Forget asking Newark (Element14). At least here in the US... they said it was already discounted and that they do not offer the bundle at a lower price... hahaha, I got it elsewhere at a good discount.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Zucca on October 10, 2014, 11:39:05 pm
Shh.... I bought it at Newark....
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pstemari on October 18, 2014, 06:20:47 am
All you need from the certificate that the distributor sends you is your "Agilent order Number" and "Agilent Certificate Number" and most distributors can give you that over the phone or email it to you after payment is made. Make sure that you ask first.

No such luck here.  Still no email and no physical certificate. Emailed Techni-Tool with a WTF?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on October 23, 2014, 05:33:40 pm
Ok I've got a DSO-X 3032A on my desk, it's running 2.37 so I'm trying kilobytes method. I'm using the same USB sticks that I've used on previous 2000 and 3000 series scopes so I know they work ok, but I'm having problems. It just keeps rebooting when I power it up with USB stick is in place (with the folder structure on it obviously).

Contents of the USB stick are here:
https://dl.dropboxusercontent.com/u/2063383/3000%20usb%20stick.zip

Free ESD safe bench mat to the first person to help me get this damn thing booting with the options enabled.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on October 23, 2014, 07:55:04 pm
Do you have a LAN Module available?

Because you need to Replace first some Files to downgrade the Firmware.

Without these Steps it is not possible to change the ProcessStartupFolder.exe in the Windows directory

BR
Kai
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on October 23, 2014, 08:38:50 pm
don't remember if it matters, but the path in your .lnk file is not in double quotes, i.e. 64#"\usb....Launcher.exe" (remember to increase the character count)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on October 24, 2014, 08:26:08 am
Do you have a LAN Module available?

Because you need to Replace first some Files to downgrade the Firmware.

Without these Steps it is not possible to change the ProcessStartupFolder.exe in the Windows directory

BR
Kai

Ahhh.. reading back over the previous few pages again (and again, and again) it looks like the scope must be 2.35 in flash to be able to boot 2.37 from the USB stick.

I mistakenly thought your mod allowed me to boot a modified 2.37 from USB when the scope had 2.37 in flash.

I guess I need to get a LAN module and do some more reading then...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on October 26, 2014, 01:06:54 pm
Do you have a LAN Module available?

Because you need to Replace first some Files to downgrade the Firmware.

Without these Steps it is not possible to change the ProcessStartupFolder.exe in the Windows directory

BR
Kai

Ahhh.. reading back over the previous few pages again (and again, and again) it looks like the scope must be 2.35 in flash to be able to boot 2.37 from the USB stick.

I mistakenly thought your mod allowed me to boot a modified 2.37 from USB when the scope had 2.37 in flash.

I guess I need to get a LAN module and do some more reading then...

Right. I've got DSOXLAN module plugged in and have managed to get telnet access. Read through the previous few pages and it looks like there's a significant chance of me bricking this thing if I'm not careful.

If my understanding is correct I need to create a hybrid upgrade CAB based on parts of the 2.35 and 2.35 CABs, specfically replacing the naughty ProcessStartupFolder.exe to enable subsequent downgrade to 2.35.

However, it's not going anywhere so far....

I tried the instructions and tools in TOOLS.ZIP posted by abyrvalg some time ago, trying to find ProcessStartupFolder.exe. The "dosetup.py" Python program fails and produces no output apart from 3 traceback error messages, and the "bincompress.exe" program just moans about "Not an 0x000fff file" or something similar. Not a good start.

Any suggestions or pointers?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on October 26, 2014, 02:27:21 pm
At one time in the past I gave up on my MSOX3104A. I was really afraid that something would go wrong and Agilent would not honor any warranty on this expensive scope. So I bought the option pack in the discounted bundle and it works really well. Sometimes it is not worth the time or effort, as long as the full option pack is so cheap. Unless - of course - we use it to learn and we are willing to take the risk.

On my MSO7104B the "fix" was so much easier and thanks to this forum, it works well with all options enabled.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on October 26, 2014, 06:04:23 pm
Quote from: kilobyte

So I did the update to 2.37 and tried how to downgrad to V2.35.
The first step was a modified cab based on V2.35 and Infiniivision.cab from 2.37 to change the Windows folder with the ProcessStartupFolder.exe
The 2.37 Firmware has loaded the Firmware Update successfully but it takes a couple of minutes before the scope reboots.
This is the simples way to restore the \windows folder to an older version because ist write protected.

The next Step was to rename the 2.37 to 2.35 in the infiniiVisionLauncher and infiniiVisionCore and replaced these files directly over telnet from usb to the \sercure folder.
after a reboot i tried to load a V2.35 Firmware but this didn't works maybe the timestamp was also checked. :(

After I replaced the newest files in the \secure\infiniivision folder direcly with the 2.35 Files I was able to load the old v2.35 setup.

So its posible to go back to the V2.35 with the help of telnet access.


Been for a walk on the beach and I've come back this this with a clear head...

I've done the following:
1) Taken the 2.35 CAB file and extracted the infiniiVisionSetup.cab file
2) Upacked the 2.37 CAB file and replaced its infiniiVisionSetup.cab file with the one I extracted above
3) Used a program called CABPACK to create a new hybrid CAB file from the unpacked 2.37 with its new 2.35 component

The intention is to put this on a USB stick and then do a firmware upgrade, hopefully this is the same thing kilobyte did in the first part of the process he describes above.

I'm a little reluctant to try this, mainly because my new hybrid CAB file is 19 meg in size and the original 2.35 and 2.37 CAB files were 22 meg!!

Might have to have a bottle of vodka to hand before I push the button on this...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on October 26, 2014, 06:59:26 pm
Select MSZIP in the compression type of CABPACK then the file should have near the same size.

The step with a hybrid CAB is not nessesary.
When i did the downgrad on my scope i have tried out different things.
This step is only needed if you need the latest firmware on the scope with USB Boot (issues with different dll versions are posible??)

TO downgrade it must be enough to replace these two file with files from 2.35
infiniiVisionLauncher.exe
infiniiVisionCore.dll

after a reboot it should be possible to load the 3000XSeries.02.35.2013061800.cab

I have to test this on my scope again but this should be the easiest way and should work.

And while downgrade there should be no infiniivisionStartupOverride.txt on the usb drive  :phew:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on October 26, 2014, 07:51:05 pm
Wooo well done Mr Kilobyte!!

From the Agilent 2.35 upgrade CAB I extracted the files you said:
infiniiVisionLauncher.exe
infiniiVisionCore.dll

Put them on a USB stick, booted the 2.37 scope and got telnet access (infiniivision, skywalker1977)

Killed the running version (a step you didn't mention, probably because it was obvious to you!):
processmgr kill infiniiVisionLauncher.exe

Change to application directory
cd \secure\infiniivision

Copy those two old files:
copy \usb\infiniiVisionLauncher.exe
copy \usb\infiniiVisionCore.dll

Reboot and get firmware concerns message, scope still thinks it has 2.37, no problem.

Put Agilent 2.35 upgrade CAB onto USB stick and up(down)grade as normal. Lots of waiting, scope then reboots with 2.35 up and running.

Then reboot with USB stick with modified 2.37 files to get all options including MSO and full bandwidth.


Many, many thanks sir. I owe you something nice from under my desk!!

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rigby on October 27, 2014, 01:02:25 pm
Many, many thanks sir. I owe you something nice from under my desk!!

That took a weird turn...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jmole on October 29, 2014, 01:51:23 am
How interesting, I just noticed that Keysight extended their bundle offer for the option pack until 12-6-2014.

And yes, if you ask your distributor for an additional discount, you probably get it.
At least in Germany they offered it.

sigh.. did this earlier today; really needed the wavegen. TestEquity gave me the package for $450ish. Not too bad since I got the scope on ebay, certified refurbished from Agilent for around $2k two years ago.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2lostkiwis on November 05, 2014, 11:58:59 pm
Wooo well done Mr Kilobyte!!

...

Reboot and get firmware concerns message, scope still thinks it has 2.37, no problem.
Put Agilent 2.35 upgrade CAB onto USB stick and up(down)grade as normal. Lots of waiting, scope then reboots with 2.35 up and running.
Then reboot with USB stick with modified 2.37 files to get all options including MSO and full bandwidth.
Many, many thanks sir. I owe you something nice from under my desk!!

This process worked for me too, my scope that was shipped with 2.37 is now running 2.35. Now I just have to get to work and build the USB stick. Not sure why I am doing this as I bought the app bundle, still I can go from 350MHz to 500MHz. I think it just must be the curiosity...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on November 20, 2014, 01:45:24 pm
I am really close of purchasing a new DSOX2004A (without any options) in the next couple of days.
However I am not sure about the following. Can please somebody confirm:
Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: daemon82 on November 21, 2014, 07:35:47 am
So you are saying that the bundle stayed intact after downgrading?
We also purchased a bundle. I was thinking about downgrading too, just for the logic analyzer. Although we would use it very seldom it would be nice to have the option to it.
If your bundle remained intact I will make the downgrade too.

This process worked for me too, my scope that was shipped with 2.37 is now running 2.35. Now I just have to get to work and build the USB stick. Not sure why I am doing this as I bought the app bundle, still I can go from 350MHz to 500MHz. I think it just must be the curiosity...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on November 21, 2014, 09:52:43 am
I am really close of purchasing a new DSOX2004A (without any options) in the next couple of days.
However I am not sure about the following. Can please somebody confirm:
  • Is it still hackable? By reading this thread I think so -  I just need to add a LAN board. Am I correct?
  • The DSOX2004A (default is 70 Mhz) can be 'enhanced' to 200 Mhz?
  • Any idea where to get the logic probes then (item # N6459-60001, I did not find a price for it). Are there any other (maybe older) logic probes from Agilent usable?
Thanks!

Yes I hacked a 2.37 scope using just a LAN card and telnet. Logic pods are easily bought on ebay for $200 or so. If anybody wants to borrow the LAN card for a day you can, just pay shipping both ways.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on November 21, 2014, 02:24:47 pm
Thanks Toploser!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on November 25, 2014, 12:29:52 pm
I am hoping I can get a good Black Friday deal on an Agilent Keysight DSOX2000/3000.
But the shipping costs can eat up all the savings. As intl. shipping costs are not only calculated by weight but also volume of the box, can somebody please measure the size of the original Agilent/Keysight box (should be identical on 2000/3000 series) and post it here? Thanks!!

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on November 25, 2014, 03:27:41 pm
Outer dimension of DSOX3000 box is 24 x 34 48 cm.

Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on November 25, 2014, 05:49:19 pm
Grrrr :--  Zoro raised the price by exactly 5% this morning ...

Oh, and thank you for the measurements George.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on December 04, 2014, 05:29:49 pm
Yes I hacked a 2.37 scope using just a LAN card and telnet. Logic pods are easily bought on ebay for $200 or so. If anybody wants to borrow the LAN card for a day you can, just pay shipping both ways.

Is there somebody in USA that can offer to borrow a LAN card as TopLoser ? Of course I will pay the shipping both ways.

If yes, I will order an oscilloscope.

Guys, please help here !

David
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tivoi on December 12, 2014, 09:53:41 am
any body try with dsox2000 ver 2.38?
thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: michanisani on December 13, 2014, 11:28:58 am
Hi
Where I get full instructions for DSOX2000 Lan update?
thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Zucca on December 15, 2014, 05:14:38 pm
any body try with dsox2000 ver 2.38?
thanks

Thanks for the head´s up about the new FW. I will install the 2.38 FW soon (BTW I have not a hacked scope).

Here the link for the new FW

http://www.keysight.com/main/software.jspx?id=2014548&nid=-11143.0.00&lc=eng&cc=US (http://www.keysight.com/main/software.jspx?id=2014548&nid=-11143.0.00&lc=eng&cc=US)

Here what´s new:

New Features for 2000A and 3000A

Software is now Keysight Technologies branded.

Trigger Rate SCPI query has been added - TRIGger:FREQuency? <gate time in sec>

New bit rate measurement has been added.

New Features for 3000A

N2804A/N2805A 100MHz/300MHz differentia
l probe support has been added.

N7020A Power Rail probe support has been added.

Bug Fixes

AER/TER behavior is improved.

*STB behavior is improved


See attachments for details.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on December 15, 2014, 08:47:45 pm
The new Splash screen looks a bit boring.
I found the old Agilent Splash screen looks nicer but its simple to change this.

The new Bit-rate measurement is a nice new feature.

I can Start the Modified V2.38  (another Address must be used) from USB with V2.35 on the Scope.

Ok i tested it here the Telnet Downgrade Method back to 2.35 is still working.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on December 16, 2014, 01:16:31 am
I can Start the Modified V2.38  (another Address must be used) from USB with V2.35 on the Scope.

kilobyte: Thanks for the testing and reporting here on v2.38!

Could you mention the updated addresses at which the bytes need to be changes?

Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on December 16, 2014, 07:54:09 pm
I have change the Data At 0x27AF78 to 00 00 A0 E3
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on December 17, 2014, 08:15:25 pm
I modified the keysight logo to a more known brand  >:D

A real HP/Agilent/Keysight product now  ;)

I wrote a little tool to extract the Bitmap data and the location from the dll, not finished yet but it works with 4byte aligned Bitmap data.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on December 17, 2014, 10:31:56 pm
Wow, I love it.  :-+ :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on December 18, 2014, 08:33:04 am
I modified the keysight logo to a more known brand  >:D
This is very impressive!
It would be great to have this on my scope.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: fons on December 23, 2014, 06:19:53 pm
Hi!

Does anybody know where can I find the 2.35 firmware? The keystone website only lets you download the latest one (2.38)

Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Zucca on December 23, 2014, 06:26:42 pm
I wrote a little tool to extract the Bitmap data and the location from the dll, not finished yet but it works with 4byte aligned Bitmap data.

master of disaster... congrats...

(http://www.chiark.greenend.org.uk/scopes/images/teklogo.jpg) on 1st April?

also this one would be good...

(http://cdn.ninjamarketing.it/wp-content/uploads/2014/04/oshw-logo-400-px.png)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on December 30, 2014, 12:00:20 pm
Is there somewhere a comparision of the DSOX3000A board differences between the 100/200 and the 350/500 Mhz version available (e.g. high res pictures of the front end of both versions)? I could not find any.

It is always said that Agilent/Keysight will swap boards if you want to upgrade from 100/200 to 350/500 Mhz. I am wondering if there is really a significant difference or if they just inject some software instead of swapping boards.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dianzimi on January 06, 2015, 06:33:32 am
Wooo well done Mr Kilobyte!!

From the Agilent 2.35 upgrade CAB I extracted the files you said:
infiniiVisionLauncher.exe
infiniiVisionCore.dll

Put them on a USB stick, booted the 2.37 scope and got telnet access (infiniivision, skywalker1977)

Killed the running version (a step you didn't mention, probably because it was obvious to you!):
processmgr kill infiniiVisionLauncher.exe

Change to application directory
cd \secure\infiniivision

Copy those two old files:
copy \usb\infiniiVisionLauncher.exe
copy \usb\infiniiVisionCore.dll

Reboot and get firmware concerns message, scope still thinks it has 2.37, no problem.

Put Agilent 2.35 upgrade CAB onto USB stick and up(down)grade as normal. Lots of waiting, scope then reboots with 2.35 up and running.

Then reboot with USB stick with modified 2.37 files to get all options including MSO and full bandwidth.


Can you send me the 2.15 cab file ?my email address is dian.zi.mi@163.com
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EEVblog on January 06, 2015, 07:16:57 am
It is always said that Agilent/Keysight will swap boards if you want to upgrade from 100/200 to 350/500 Mhz. I am wondering if there is really a significant difference or if they just inject some software instead of swapping boards.

Yes, they have to actually swap boards, the 300/500MHz was a different front end. Although wait a few days and that could be changing...  ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rigby on January 06, 2015, 03:57:42 pm
wait a few days and that could be changing...  ;)

Oh I hate it when you do this.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on January 07, 2015, 07:56:03 am
I'm curious too.
Maybe it has something to do with the two scopes that i can see on the dropcam livestream?
The looks very very similar.  :)

I'll let it be a surprise.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on January 07, 2015, 07:52:17 pm
I'm curious too.
Maybe it has something to do with the two scopes that i can see on the dropcam livestream?
The looks very very similar.  :)

I'll let it be a surprise.

Mmmmh; Dave says "the 300/500MHz was a different front end." I am wondering what that means, especially to my already existing 200 Mhz version...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on January 08, 2015, 09:58:54 am
wait a few days and that could be changing...  ;)

Oh I hate it when you do this.

Maybe to do with the new 3000T series...

http://uk.farnell.com/keysight-technologies/dsox3012t/oscilloscope-2-ch-100mhz-5gsps/dp/2449632 (http://uk.farnell.com/keysight-technologies/dsox3012t/oscilloscope-2-ch-100mhz-5gsps/dp/2449632)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EEVblog on January 08, 2015, 10:01:38 am
Mmmmh; Dave says "the 300/500MHz was a different front end." I am wondering what that means, especially to my already existing 200 Mhz version...

I was given wrong information on that unfortunately.
The new 3000T still has different front end hardware between the 100/200 and 350/500 versions.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on January 08, 2015, 10:59:35 am
Bingo!

https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.hw.cz%2Fprodukty%2Fosciloskopy-keysight-dsox3000t-graficky-trigger-pro-kazdeho-inzenyra.html&edit-text= (https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.hw.cz%2Fprodukty%2Fosciloskopy-keysight-dsox3000t-graficky-trigger-pro-kazdeho-inzenyra.html&edit-text=)

-comes with a touchscreen
-4Mpts memory
-greatly extended match functions
-correlated signal analysis (time and frequency domain)

and the datasheet aswell : Datasheet (https://mega.co.nz/#!M8MEVCjS!m44W76kvGf3Iz0ddv_JUb49vVNBkCTkJL7TuTmp2dmk)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on January 08, 2015, 09:30:28 pm
woah, a proper full bandwidth 1mV front end. What took them so long :P
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on January 08, 2015, 09:35:47 pm
woah, a proper full bandwidth 1mV front end. What took them so long :P
No, it's still magnified : "2. Specifications are valid after a 30-minute warm-up period and ± 10 °C from firmware calibration temperature. 1 mV/div and 2 mV/div are a magnification of 4 mV/div setting. For vertical accuracy calculations, use full scale of 32 mV for 1 mV div and 2 mV/div sensitivity setting."
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on January 08, 2015, 10:03:11 pm
hmm you're right - further down in the characteristics it states the all familiar sentence that you quote. But I don't know what to make of this table then (page 7):
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=128593;image)
vertical setting steps of 1, 2, 5 mV and the noise stays basically the same in those three settings. Is the noise not amplified?
I guess they had to come up with something to compare it to the Tek scope? Poor move Agilent : /
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on January 08, 2015, 10:21:01 pm
It's just a digital amplification (only scaling on the display), so of course the noise in Vpp stays the same.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on January 09, 2015, 01:09:56 am
Yeah I guess I still hoped it had real amplification. Magnified pixels again, boo!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: fons on January 12, 2015, 10:19:54 am
Hi!

Does anybody know where can I find the 2.35 firmware? The keystone website only lets you download the latest one (2.38)

Thanks!

Thanks to those who sent me the firmware in PM. I had version 2.36 in the scope, after downgrading to 2.35 I can use the usb hack without problems. Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Isamun on January 18, 2015, 04:32:58 pm
Last year I was lucky enough to pick up a demo version of a 3034a. All the options where there when I got the unit and are listed with an astrix (*). I haven't updated the firmware yet, due to the fear of loosing my beloved/free options. Anyone know if an update will remove them?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on January 18, 2015, 04:59:52 pm
Last year I was lucky enough to pick up a demo version of a 3034a. All the options where there when I got the unit and are listed with an astrix (*). I haven't updated the firmware yet, due to the fear of loosing my beloved/free options. Anyone know if an update will remove them?

The astrix (*) means that the options are either in DEMO MODE or the scope is a STORE DEMO, and thus in demo mode. There has been posts indicating that the store demo units have a runtime of 120 days, but I cannot say for sure. In either case, updating the firmware should not remove the demo, but again, I cannot say for sure...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ToBeFrank on January 18, 2015, 05:48:15 pm
The astrix (*) means that the options are either in DEMO MODE or the scope is a STORE DEMO, and thus in demo mode. There has been posts indicating that the store demo units have a runtime of 120 days, but I cannot say for sure. In either case, updating the firmware should not remove the demo, but again, I cannot say for sure...

Not necessarily. It could be in distributor mode. If the first item in the list is "All", it's a good bet. My scope has been this way for well over a year. The really cool part is if they put new features in future firmware that require licenses, a distributor scope will automatically turn them on when you upgrade the firmware.

(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=130718)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Isamun on January 18, 2015, 06:58:16 pm
Thank you both.

Last year I was lucky enough to pick up a demo version of a 3034a. All the options where there when I got the unit and are listed with an astrix (*). I haven't updated the firmware yet, due to the fear of loosing my beloved/free options. Anyone know if an update will remove them?

The astrix (*) means that the options are either in DEMO MODE or the scope is a STORE DEMO, and thus in demo mode. There has been posts indicating that the store demo units have a runtime of 120 days, but I cannot say for sure. In either case, updating the firmware should not remove the demo, but again, I cannot say for sure...

Is there a way I can check the runtime? I would presume this would have been reset at their factory when it was "refurbished".

The astrix (*) means that the options are either in DEMO MODE or the scope is a STORE DEMO, and thus in demo mode. There has been posts indicating that the store demo units have a runtime of 120 days, but I cannot say for sure. In either case, updating the firmware should not remove the demo, but again, I cannot say for sure...

Not necessarily. It could be in distributor mode. If the first item in the list is "All", it's a good bet. My scope has been this way for well over a year. The really cool part is if they put new features in future firmware that require licenses, a distributor scope will automatically turn them on when you upgrade the firmware.

(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=130718)

I also have the "All" (no astrix).

(http://i.imgur.com/At0JUB7.png) (http://i.imgur.com/At0JUB7.png)

If I read you correctly, you have performed an update and still kept the options. In your opinion, the case would be the same for me?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ToBeFrank on January 18, 2015, 09:22:07 pm
If I read you correctly, you have performed an update and still kept the options. In your opinion, the case would be the same for me?

You should be fine. Whether they are time limited or not, I don't know. It may be the case that you got lucky and they forgot to clear the licenses out of your scope before sending it to you.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on January 19, 2015, 12:58:25 am
If I read you correctly, you have performed an update and still kept the options. In your opinion, the case would be the same for me?
You got a nice catch then with ALL functions enabled. Upgrading firmware should not disable any legitimate features, demo, distributor, or purchased. I see from the screenshot that your firmware is quite old. You'll have a great incentive to upgrade to the latest firmware, with many new capabilities, improved measurements, and bug fixes... Great Score!

One other nice thing to know about your scope, is that it has the 500MHz front end.  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Isamun on January 20, 2015, 06:32:30 pm
Im happy to report the update went as expected.
Thank you for the confidence boost.

(http://i.imgur.com/DqepazH.png) (http://i.imgur.com/DqepazH.png)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on January 20, 2015, 06:56:53 pm
Im happy to report the update went as expected.
Thank you for the confidence boost.

(http://i.imgur.com/DqepazH.png) (http://i.imgur.com/DqepazH.png)
Excellent!  :-+
Now you can check out your new and free ARB you didn't have yesterday...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oedipe78 on January 21, 2015, 10:02:48 am
Hello everyone,

Explanations are mixed between different versions. I'm afraid to get a stupidity.   :-BROKE

Someone could explain step by step how to change the latest version (2.38)?
And how to load the modified version?

Does anyone want to change the firmware new scope DSOX/MSOX 3000T ?

Thank you in advance.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on January 21, 2015, 11:47:47 am
For the data that have to be modified see here
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg569677/#msg569677 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg569677/#msg569677)

And for Firmware Downgrade see TopLosers summary here
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg537981/#msg537981 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg537981/#msg537981)

Does anyone want to change the firmware new scope DSOX/MSOX 3000T ?
Maybe if you like to buy me one of these...  ;D

I already have a dsox3024a at home so i didn't buy a new one in the next time.

I hope they release a firmware package to have a look into.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oedipe78 on January 21, 2015, 01:40:02 pm
I still have many questions.  :scared:

For the data that have to be modified see here
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg569677/#msg569677 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg569677/#msg569677)

is the infiniiVisionCore.dll (v2.35) file needs to be changed ?

you change address : 0x0x27AF78 , data : 0x00 00 A0 E3 ?

From the Agilent 2.35 upgrade CAB I extracted the files you said:
infiniiVisionLauncher.exe
infiniiVisionCore.dll

Where you find the version 2.35? (it is not available on the official website)

this is the original file?


Put them on a USB stick, booted the 2.37 scope and got telnet access (infiniivision, skywalker1977)

Killed the running version (a step you didn't mention, probably because it was obvious to you!):
processmgr kill infiniiVisionLauncher.exe

Change to application directory
cd \secure\infiniivision

Copy those two old files:
copy \usb\infiniiVisionLauncher.exe
copy \usb\infiniiVisionCore.dll

Reboot and get firmware concerns message, scope still thinks it has 2.37, no problem.
I understood.

Put Agilent 2.35 upgrade CAB onto USB stick and up(down)grade as normal. Lots of waiting, scope then reboots with 2.35 up and running.

Then reboot with USB stick with modified 2.37 files to get all options including MSO and full bandwidth.

you downgrade to version 2.35. This is Original firmware 2.35?

After I upgrade to Version 2.38. This is not the original firmware 2.38, what do I need to change?


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on January 21, 2015, 01:52:12 pm
I still have many questions.  :scared:

Where you find the version 2.35? (it is not available on the official website)

3000 series 2.35 CAB here:
https://dl.dropboxusercontent.com/u/2063383/3000XSeries.02.35.2013061800.cab

Use this CAB file as a source of the two files that will replace the ones on your scope. Then use it to downgrade your scope to 2.35

No need to edit or modify the contents of any of the files yet. That will come later when you have downgraded to 2.35.





Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cassiopeia on February 04, 2015, 01:54:48 pm
Dear all,

I confirmed that it is possible to launch the 2.38 version from USB stick, with 2.35 firmware inside. Anyway, I have a question about changing the splash screen : I found the new one more, humm... serious.
I have of course read the whole thread, but it did not work. I have no LAN adapter, so I try to do this with the USB key.
What I did :
put
Code: [Select]
21#\usb\img.cmd in the Startup\infiniiVision.lnk file of the usb key.
create an img.cmd file, at the root of the USB key, with :
Code: [Select]
\Windows\compileImageForSplashScreen.exe \usb\img.png \Secure\infiniiVision\splashImage.binBut nothing append... Any clue ? Thanks !
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on February 04, 2015, 10:28:27 pm
Hi,

I did a test on my scope and it should work.

My Steps:

1. create a bat file in usb root dir (create_splashscreen.bat)
2. I've insert the following text \windows\compileImageForSplashScreen.exe \usb\splashImage.png \Secure\InfiniiVision\splashImage.bin
3. rename the existing infiniivision.lnk (like infiniivision2.lnk)
4. create a new infiniivision.lnk with 28#\usb\create_splashscreen.bat

Plug the flashdrive into the scope and power up.

Now It takes some time.
Interesting effect is that the hacked Infiniivision Software will be loaded too.
After a reboot with an unplugged usb stick it should show up the new spalshscreen (It's a stupid idea to use a scope screenshot as a splashscreen  ;D)

If you want to try it with my files you can download it here http://kaibareis.de/dsox/Splashscreen_change.zip (http://kaibareis.de/dsox/Splashscreen_change.zip)

Best Regards
Kai
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cassiopeia on February 05, 2015, 06:40:18 pm
Thank you !

Your script works, mine does not... the only differences are some case in path name (Windows vs windows and infiniivision vs Infiniivision). I'll dig into that...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on February 05, 2015, 08:59:44 pm
Try changing .cmd extensions to .bat
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on February 05, 2015, 11:43:00 pm
Please, is anyone able to provide me with the 2.35 files for DSOX2000 series?
Thanks!!!!

Solved - 2000 firmware seems to be identical to the 3000 Firmware, thus Toplosers link above is fine.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yocheng on February 23, 2015, 03:04:30 am
I modified the keysight logo to a more known brand  >:D

A real HP/Agilent/Keysight product now  ;)

I wrote a little tool to extract the Bitmap data and the location from the dll, not finished yet but it works with 4byte aligned Bitmap data.

I upgraded to firmware 2.38, but the Keysight brand too ugly, want to switch back to Agilent, such as the picture red circle place. I would like to ask how to operate?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: srhelio on February 23, 2015, 11:46:05 am
I still have many questions.  :scared:

Where you find the version 2.35? (it is not available on the official website)

3000 series 2.35 CAB here:
https://dl.dropboxusercontent.com/u/2063383/3000XSeries.02.35.2013061800.cab

Use this CAB file as a source of the two files that will replace the ones on your scope. Then use it to downgrade your scope to 2.35

No need to edit or modify the contents of any of the files yet. That will come later when you have downgraded to 2.35.


Hello everyone, I have readed all the post and I have some questions:

 I have got a MSOX-2014A with old firmware 2.20.2012110802. I found  only the above firmware but I don't know if 3000xSeries is the same that 2000xSeries.

First i will update the scope to 2.35 firmware and then i will continue all the process that you wrote, right?

Thanks for your work !!!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on February 23, 2015, 01:09:00 pm
First i will update the scope to 2.35 firmware and then i will continue all the process that you wrote, right?
YES
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on February 24, 2015, 08:13:57 am
Does anyone want to change the firmware new scope DSOX/MSOX 3000T ?

The 3000T looks to be not hackable.
The nk.bin.comp is encrypted (Verisign DIGITAL ID) and it looks like the infiniivisioncore.dll is integrated in the nk.bin.comp file.

I modified the keysight logo to a more known brand  >:D

A real HP/Agilent/Keysight product now  ;)

I wrote a little tool to extract the Bitmap data and the location from the dll, not finished yet but it works with 4byte aligned Bitmap data.

I upgraded to firmware 2.38, but the Keysight brand too ugly, want to switch back to Agilent, such as the picture red circle place. I would like to ask how to operate?

It's a bit complicated but i will create a short guide and some necessary file how to change the logo.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on February 24, 2015, 08:46:10 am
kilobyte, how difficult would you think it would be to add USB mouse support to the 2000A/3000A ? Is it a matter of adding a driver to the embedded 6CE?
Even though the GUI probably has no click-able items, I'd love to be able to use the mouse-wheel. Unfortunately, only very few keys on the keyboard have any function outside of the text entry mode (ESC, arrow keys)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: srhelio on February 24, 2015, 12:25:48 pm
Hello.

Can someone confirm the  firmware 3000XSeries.02.35.2013061800.cab is compatibility for my MSOX 2014A?

If NO, where can I download?

KILOBYTE, I readed that you has got it  in your website but  I don't find it.

Thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yocheng on February 24, 2015, 02:48:53 pm
Does anyone want to change the firmware new scope DSOX/MSOX 3000T ?

The 3000T looks to be not hackable.
The nk.bin.comp is encrypted (Verisign DIGITAL ID) and it looks like the infiniivisioncore.dll is integrated in the nk.bin.comp file.

I modified the keysight logo to a more known brand  >:D

A real HP/Agilent/Keysight product now  ;)

I wrote a little tool to extract the Bitmap data and the location from the dll, not finished yet but it works with 4byte aligned Bitmap data.

I upgraded to firmware 2.38, but the Keysight brand too ugly, want to switch back to Agilent, such as the picture red circle place. I would like to ask how to operate?

It's a bit complicated but i will create a short guide and some necessary file how to change the logo.


Look forward to your tutorial :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oedipe78 on February 27, 2015, 11:36:04 am
The 3000T looks to be not hackable.
The nk.bin.comp is encrypted (Verisign DIGITAL ID) and it looks like the infiniivisioncore.dll is integrated in the nk.bin.comp file.

Hi,
I bought a DSOX3014T and I'm ready to make tests for crack.
I checked too, the files are encrypted  (Verisign DIGITAL ID).
Can you modify the file may be for 30 days license?  :-/O
what do you think?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on February 27, 2015, 01:52:21 pm
If the 30 day period would mean 30x24 = 720 scope working hours, this would be fine for many peoples.

I did not check the PCB pictures (andy maybe something similar was mentioned in the 49 pages above), but somewhere there probably will be a real time clock running. What if this clock is being stopped? Or running very sloooooooooow by changing its crystal?
Then at least the off-time of the scope would not count, which could be sufficent in many cases.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on February 27, 2015, 02:30:47 pm
If the 30 day period would mean 30x24 = 720 scope working hours, this would be fine for many peoples.

I did not check the PCB pictures (andy maybe something similar was mentioned in the 49 pages above), but somewhere there probably will be a real time clock running. What if this clock is being stopped? Or running very sloooooooooow by changing its crystal?
Then at least the off-time of the scope would not count, which could be sufficent in many cases.


Even if this could work, and the software are great tools, you still missing the MSO and BW upgrade...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: deadbeef on February 27, 2015, 10:44:56 pm
The 30 day trial option that comes with the scope is a kind of a "hack" from Agilent's side to give you the options without generating the licences and compromising the private keys used for signing the licenses. At least it was so in fw 2.38...
The scope uses some variables in its "secure storage" (which seems to be encrypted part of the flash).

When starting it checks if the demo was never used before. Then when you start it it remembers when the demo should expire, how many days you have left and current date.
When the scope starts up it checks the time difference between stored "current date" and current time and figures out how many days have passed.
It also checks if you are past the "demo expiry date"

It also remembers the "current date" if you manually set the clock. So dialing forward to 2176 or something like that ans starting the demo, dialing clock back... will not trick it.

So... 30 days trial period does not mean 720 working hours it means 30 realtime days (counted in seconds if I remember correctly)

if infinivision.dll is in the nk.bin.comp and this is encrypted/signed and verified somewhere in the boot process this means that hacking will be very difficult with high potential to brick the scope...

Oh... and the "Unfinalized software" message does not come from any signature and/or checksum failure... it is a side of patching the dll. You basically modify a function to always return false. The true value of that function is otherwise stored in the "secure storage"... :)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on March 15, 2015, 05:31:29 pm
Soo glad to see this thread is still alive and kicking and people are still working on hacking these scopes! Thank you to everyone! Now we just need to get it all consolidated in one tutorial thread/post and itll be complete!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 16, 2015, 01:42:36 am
Firmware revision 2.39 has been released March 10, 2015.

The release notes do not report new features or bug fixes.  Instead only two enhancements are listed:
- Bit rate measurement units have been improved.
- Reference memory skew behavior is improved in some situations.

The update seems rather minor and obscure...I wonder if it contains undocumented changes to the protection mechanisms, or blocking firmware downgrades etc.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on March 16, 2015, 03:04:15 pm
3000T nk.bin.comp decryptor with source. No "illegal numbers" inside, they key is derived from file data.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on March 16, 2015, 06:58:18 pm
More info on kernel/encryption/etc: there are two WinCE images in the scope - main one (nk.bin.comp) and recovery (recover.nk.bin.comp). It is unknown yet when recovery gets activated (this functionality is in bootloader which is not available for study). As far as I can see, recovery asks for USB stick with .ksx/.agx (firmware) file and installs it.
nk.bin.comp is signed and encrypted - can't modify it straight way. recover.nk.bin.comp is neither signed nor encrypted - can be modified.
nk.bin.comp decryption/verification takes place at install time (by LoadP500Flash.exe flasher), signature is not written into flash, so bootloader doesn't verify anything.
Conclusion: modify LoadP500Flash.exe in recovery to bypass sig check, flash modded recovery, enter recovery mode (how?), flash modded main via modded recovery... PROFIT.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on March 16, 2015, 08:13:01 pm
Uboot is released under GPL license.

In the following post tnt wrote:

[url=https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg253106/#msg253106]https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg253106/#msg253106 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg253106/#msg253106)
[/url]
Not quite true. I addressed a request to Agilent directly to get the source for the GPL software distributed with the scope (u-boot mostly) and I received the source package back. I also posted a link to it in the first topic about this scope, probably more than a year ago.


Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on March 17, 2015, 09:01:00 am
Looks like telnet password is changed too. It is generated from instrument id now (still possible to get it, but I don't have a 3000T to try anyway)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on March 20, 2015, 06:01:21 pm
Has anyone tried 2.39 ?

I want to buy an oscilloscope and the vendor has this version.

David.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iankellogg on March 22, 2015, 02:52:36 pm
I managed to get this hack to work with 200mhz bandwidth on my scope but has any one ever figured out how to load the hack to the internal flash?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on March 22, 2015, 04:14:04 pm
I managed to get this hack to work with 200mhz bandwidth on my scope but has any one ever figured out how to load the hack to the internal flash?

I run it in the internal flash. The procedure *IS* documented way back in this loooong thread.... You'll need to look for it just like I did. Speeds up the boot time versus from a flash drive.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cassiopeia on March 23, 2015, 07:44:20 pm
Dear all,

The hack works with 2.39 firmware, the new address in the dll is 0x27B0F4, and the values are always 00 00 A0 E3.
In the picture attached, the bandwidth did not work, because I had BW50, that I changed for BW20, which works fine now.

Edit : when I said "the hack", it means "booting on USB device on a scope with regular firmware 2.35 installed".
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on March 23, 2015, 08:10:14 pm
Blinding work, thanks  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iankellogg on March 24, 2015, 03:19:13 pm
I managed to get this hack to work with 200mhz bandwidth on my scope but has any one ever figured out how to load the hack to the internal flash?

I run it in the internal flash. The procedure *IS* documented way back in this loooong thread.... You'll need to look for it just like I did. Speeds up the boot time versus from a flash drive.

cheers,
george.

this forum thread is a mess to find stuff! I will try to find it. I haven't even figured out how to do the update yet. still running 2.35
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cassiopeia on March 24, 2015, 07:38:21 pm
I'll try to summarize, but only from the point where you have a device with regular 2.35 firmware. If you have a newest version, you have to search this topic (access to scope file system with lan, and fake the firmware version to allow downgrade, then the scope will be able to boot on usb key).
What you need :
* the python script attached to this post (I am *NOT* the author of this useful script. Linux users : replace \ by /...)
* the 2.39 firmware from Agilent
Steps :
* extract Agilent .cab firmware with you favorite program
* extract infiniiVision.cab file : you have now an infiniiVision folder
* chdir to infiniivision folder, copy dosetup.py to this folder
* python  dosetup.py (linux users should chande \ by / in _setup.xml file !!!)
* then chdir to Secure/infiniiVision
* open infiniiVisionCore.dll with hex editor, and at @0x27B0F4, change 04 00 a0 e1 by 00 00 a0 e3, then save (could be a good idea to make a backup before...)
* copy all the infiniiVision and Startup directories to an USB key
* add the infiniivisionStartupOverride.txt (attached to this post) at the root dir of your usb key
* edit Startup/infiniivision.lnk file to your needs (add the options that you want - mine is attached, for 2000 serie).

I hope this is clear (and accurate) and will help.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iankellogg on March 25, 2015, 02:27:44 am
I'll try to summarize, but only from the point where you have a device with regular 2.35 firmware. If you have a newest version, you have to search this topic (access to scope file system with lan, and fake the firmware version to allow downgrade, then the scope will be able to boot on usb key).
What you need :
* the python script attached to this post (I am *NOT* the author of this useful script. Linux users : replace \ by /...)
* the 2.39 firmware from Agilent
Steps :
* extract Agilent .cab firmware with you favorite program
* extract infiniiVision.cab file : you have now an infiniiVision folder
* chdir to infiniivision folder, copy dosetup.py to this folder
* python  dosetup.py (linux users should chande \ by / in _setup.xml file !!!)
* then chdir to Secure/infiniiVision
* open infiniiVisionCore.dll with hex editor, and at @0x27B0F4, change 04 00 a0 e1 by 00 00 a0 e3, then save (could be a good idea to make a backup before...)
* copy all the infiniiVision and Startup directories to an USB key
* add the infiniivisionStartupOverride.txt (attached to this post) at the root dir of your usb key
* edit Startup/infiniivision.lnk file to your needs (add the options that you want - mine is attached, for 2000 serie).

I hope this is clear (and accurate) and will help.

This was pretty good instructions. Only thing for me was, the script didn't work. I didn't need to use it though, it does work with the new firmware.

I haven't been able to find the post where someone installs it to internal flash. Maybe i just don't understand what to do.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 25, 2015, 04:23:42 am
I haven't been able to find the post where someone installs it to internal flash. Maybe i just don't understand what to do.

Read this. (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg347345/#msg347345)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: telectroboy on March 26, 2015, 10:25:27 am
Hello Guys,

I'm lost with this. I try to read and read again this topic but I'm not able to find the way to do.

 So I've got a DSO-X2002A 2.30 and I've hacked it with your help since 1 year and a half. But my USB key is crashed.
I remember that I've downloaded the firmware 2.35 from agilent website (unavailable now) extract it with WinCECAB and modify few hexadecimal word somewhere.

I don't remember a script or something like that.

If someone is able to summarize the way to do with USB key (without flash it inside the scope)
Because what tell cassopieia doesn't work for me. Python script work!
But Scope never boot!


Many Thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: telectroboy on March 26, 2015, 12:12:47 pm
Does someone has a link to 2.35 version official firmware?

For DSO-X 2002A
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on March 26, 2015, 12:40:26 pm
Does someone has a link to 2.35 version official firmware?

For DSO-X 2002A

https://dl.dropboxusercontent.com/u/2063383/2000XSeries.02.35.2013061800.cab
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: telectroboy on March 26, 2015, 12:54:14 pm
OK !!! 8)

Thanks a lot.
I'm upgrading to 2.35 version and I will try again the cassiopieia summary!

I hope it was the problem.


 |O |O |O |O
It wasn't the problem.
So now I've got a 2.35 version but the USB key doesn't want to boot.


Does someone has an idea?
Thx

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on March 26, 2015, 01:03:50 pm
Dear all,

The hack works with 2.39 firmware, the new address in the dll is 0x27B0F4, and the values are always 00 00 A0 E3.
In the picture attached, the bandwidth did not work, because I had BW50, that I changed for BW20, which works fine now.

Edit : when I said "the hack", it means "booting on USB device on a scope with regular firmware 2.35 installed".

Do you need to downgrade the 2.39 ? Or will it boot direct from USB with 2.35 modified ?

David.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on March 26, 2015, 01:06:10 pm
Dear all,

The hack works with 2.39 firmware, the new address in the dll is 0x27B0F4, and the values are always 00 00 A0 E3.
In the picture attached, the bandwidth did not work, because I had BW50, that I changed for BW20, which works fine now.

Edit : when I said "the hack", it means "booting on USB device on a scope with regular firmware 2.35 installed".

Do you need to downgrade the 2.39 ? Or will it boot direct from USB with 2.35 modified ?

David.

You need to downgrade the scope to 2.35. You can then boot the modified 2.39 from USB.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: telectroboy on March 26, 2015, 01:11:40 pm
Which files are at root of USB stick?

Only infiniivisionstartupoverride.txt and directories "startut" and "infiniivision" ??
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on March 26, 2015, 01:14:04 pm
Which files are at root of USB stick?

Only infiniivisionstartupoverride.txt and directories "startut" and "infiniivision" ??

Correct
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: telectroboy on March 26, 2015, 01:38:44 pm
Please could you check this?

I've made something wrong but I don't understand what.

This is an archive of the USB Stick Root.

Thanks again

https://www.wetransfer.com/downloads/51b0840e5968daab35aeac63c9dafc6020150326133429/79eaa210a732573f595c7f0971a5d47320150326133429/1fe488 (https://www.wetransfer.com/downloads/51b0840e5968daab35aeac63c9dafc6020150326133429/79eaa210a732573f595c7f0971a5d47320150326133429/1fe488)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on March 26, 2015, 01:44:00 pm
Please could you check this?

I've made something wrong but I don't understand what.

This is an archive of the USB Stick Root.

Thanks again

https://www.wetransfer.com/downloads/51b0840e5968daab35aeac63c9dafc6020150326133429/79eaa210a732573f595c7f0971a5d47320150326133429/1fe488 (https://www.wetransfer.com/downloads/51b0840e5968daab35aeac63c9dafc6020150326133429/79eaa210a732573f595c7f0971a5d47320150326133429/1fe488)

Contents seem fine. Keep trying different USB sticks. I find that only 1 out of 10 work for me, and I have tried LOTS of different ones from LOTS of different manufacturers. Don't format it NTFS, use FAT.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: telectroboy on March 26, 2015, 02:01:32 pm
SUPER!!!!

You are right.

Manufacturer of USB key is important.



THANKS A LOT to you and all people who create this and help to do.

 :-+ :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on March 26, 2015, 02:07:25 pm
If somebody on this forum has an extra bare board or assembled card for the LAN module, please PM. I prefer bare board with silkscreen and soldermask.

You know sometimes when you have a PCB house making the PCBs for you they sent you more than one.

David.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on March 26, 2015, 06:47:18 pm
If somebody on this forum has an extra bare board or assembled card for the LAN module, please PM. I prefer bare board with silkscreen and soldermask.

You know sometimes when you have a PCB house making the PCBs for you they sent you more than one.

David.

pm sent...

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: aholtzma on March 28, 2015, 04:48:51 pm
This is the final schematic of my working lan card. I'm using an Digikey 1419-1021-ND for the magjack.


Did you release the layout files or gerbers for this?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on March 28, 2015, 05:37:43 pm
This is the final schematic of my working lan card. I'm using an Digikey 1419-1021-ND for the magjack.


Did you release the layout files or gerbers for this?

I thought I did... The design is in PADS, so not sure how useful that is to most. Gerbers and pads file attached. Obviously there's no guarantee etc etc...

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hugoneus on April 01, 2015, 01:55:47 am
Has anyone used the FPGA programming port on the unit? My unit's flash is completely erased (was corrupted). When I turn the unit on, nothing at all happens.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dziobu on April 01, 2015, 01:10:54 pm
So its posible to go back to the V2.35 with the help of telnet access.

Hi!
There is easier way to downgrade.

I have flashed 2.39 a long before I found this site. But now I have 2.35 with just PC and USB-key ;)

All has beed checked today on my MSO-X 2012 (originally it was standard 100MHz + MEMUP update with 2.39 firmware).
1. downgrade to 2.37 (it just works)
2. unpack 2000XSeries.02.37.2014052002.cab (ex with WinRAR)
3. extract file infiniiVisionLauncher.exe from infiniiVisionSetup.cab (2.37) (ex with WinCE CAB Manager)
4. unpack 2000XSeries.02.35.2013061800.cab (ex with WinRAR)
5. open infiniiVisionSetup.cab (from 2.35) file in WinCE CAB Manager, find infiniiVisionLauncher.exe on list and delete it
6. add infiniiVisionLauncher.exe (from 2.37 cab) to file list and set all properties like in old file (flags: uncheck all; location: \Secure\InfiniiVision; Hard-coded path checked)
7. file->save and exit WinCE CAB Manager
8. calc MD5 of edited infiniiVisionSetup.cab and update it in recipe.xml file
9. compress all files (ex with CabPack) from 2.35 firmware with edited infiniiVisionSetup.cab
10. flash new file

After this I reflashed scope once again with untouched 2.35 to update modified file but I don't know if it was necessary.
Also I don't know if there is possibility to downgrade directly from 2.39.

Now I have 2.35 in scope and 2.39 from USB (and I didn't need to use python script).

Starting scope from USB key:
NOT WORKS:
- Kingston DTSE9 (8GB)
- silicon power touch 830 (8GB)
- PQI connect 201 (16GB)
- all my no-name keys... (1GB..16GB)

WORKS:
- LEEF Spark 32GB


And I would like to thank everyone on this forum for files/instructions/descriptions.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on April 01, 2015, 07:05:49 pm
Has anyone used the FPGA programming port on the unit? My unit's flash is completely erased (was corrupted). When I turn the unit on, nothing at all happens.
How did you manage to do this? What FPGA programming port do you mean? Are you sure the u-boot bootloader is corrupted, too? If not, you could enter commands with the serial port (see this post (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895) for the pins) and flash it again over network. Otherwise you really need to find and use some JTAG port.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on April 02, 2015, 12:10:33 am
What a lucky me.

I bought a DSO-X-2014A to replace my DSO-X2012A, I got the cheapest price on the internet for it (first part of been lucky)

I was nervous about it having the latest firmware and have to do the hack using the lan, thanks to georges80 for the board, but.....the unit came with software 2.36 ! I was able to downgrade to 2.35 using only the cab file, and since I already had the usb hacked software for my 2012A it was so easy to convert the new one ! Wooooooraleeee.

 O0 :clap: :clap: :clap:

David.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hugoneus on April 02, 2015, 05:11:02 am
Has anyone used the FPGA programming port on the unit? My unit's flash is completely erased (was corrupted). When I turn the unit on, nothing at all happens.
How did you manage to do this? What FPGA programming port do you mean? Are you sure the u-boot bootloader is corrupted, too? If not, you could enter commands with the serial port (see this post (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895) for the pins) and flash it again over network. Otherwise you really need to find and use some JTAG port.

Unfortunately it is fully erased. It was really badly corrupted. The RS232 port no longer outputs anything. The u-boot is basically completely gone. But there is another port on the PCB which I assume is the JTAG port of the FPGA...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on April 02, 2015, 10:00:36 am
Hugoneus, check this post for CPU JTAG https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg274963/#msg274963 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg274963/#msg274963)

Another possibility is BootROM USB flash loader mode:
ST's flash utility http://www.st.com/web/en/catalog/tools/PF257557 (http://www.st.com/web/en/catalog/tools/PF257557)
This mode should be activated by pulling BOOT_SEL pin (K18, check the picture) low at power on, but no reports on this so far. The PCB picture in JTAG post looks like there is a track in inner layer going to this pin, perhaps you can look closer. If it is tied straight to VCC then bad luck, otherwise try shorting it to GND and turning the scope on with USB cable attached to PC - does something pops up?
Also SPEAr600 RM says that ROM enters USB boot if normal (flash) boot fails regardless of BOOT_SEL state. But this requires primary bootloader in flash to be corrupted "correctly" so ROM doesn't recognize it (briefly shorting some flash DATA lines at power up is common way to simulate this state).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on April 02, 2015, 10:49:27 am
A quick look into xloader_image.bin shows that UBOOT image is loaded from SPI flash rather than from NAND. SOIC8 U3204 25Pxxx (hard to read) near the CPU must be it.
In worst case you can desolder it and program xloader_image.bin (at 0) and u-boot_image.bin (at 0x10000) manually - this should be enough to get u-boot up running.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rickstar on April 03, 2015, 05:52:46 am
Hi, I am loving this thread.

Does anybody have a link to download 2.37 or can I PM them for an email please :-)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dziobu on April 03, 2015, 08:00:49 am
Does anybody have a link to download 2.37 or can I PM them for an email please :-)

https://www.dropbox.com/s/y4y3d2xmj2gmgdb/2000XSeries.02.37.2014052002.cab?dl=0 (https://www.dropbox.com/s/y4y3d2xmj2gmgdb/2000XSeries.02.37.2014052002.cab?dl=0)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rickstar on April 03, 2015, 09:41:25 am
Does anybody have a link to download 2.37 or can I PM them for an email please :-)

https://www.dropbox.com/s/y4y3d2xmj2gmgdb/2000XSeries.02.37.2014052002.cab?dl=0 (https://www.dropbox.com/s/y4y3d2xmj2gmgdb/2000XSeries.02.37.2014052002.cab?dl=0)

Thank you very much, so are a good man  :) :clap:  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oedipe78 on April 09, 2015, 12:20:51 pm
Looks like telnet password is changed too. It is generated from instrument id now (still possible to get it, but I don't have a 3000T to try anyway)

Yes, the telnet password has been changed.
I have a 3000T, what to do to get the password?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mischo22 on April 09, 2015, 04:08:51 pm
It is possible to extract the programm files from an 3000T (Telnet)? can i run the 3000T-Software an an 3000 scope?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on April 09, 2015, 08:53:34 pm
probably not, IIRC there's a bigger FPGA on the T model. I wouldn't mind paying an upgrade fee for the touch though. I keep grabbing the trigger level dial instead of the entry knob >.>
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dianzimi on April 15, 2015, 08:06:43 am
firmware 2.39 is successful crack without usb device and the band is 200Mhz.you can crack all option by the  update the  firmware(it is have changed some parameter of original firmware file).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gts1991 on April 20, 2015, 07:46:33 pm
Can you gentlemen do as unlock? DSOX2002A instructions with pictures ?  ??? Because I do not fully understand how to do it safely .  ;D
Thank you  8)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: klaus11 on April 27, 2015, 10:00:54 am
Today I requested budget for DSOX2024 used, and leave a document fragment.

.........Options                                                 
                    DSOX2MASK Mask Limit Testing                           
                    DSOX3VID  DSOX3VID Video Triggering and Analysis       
                    (this is not a std option availble for   
                    DSOX2000 series but a special version)   
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: v1t0r on April 29, 2015, 01:15:36 pm
I'm about to buy a DSOX2004A but before making a purchase I'd like to know if it's still possible to make the hack in recent firmware or is required to hack the hardware?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: klaus11 on April 29, 2015, 04:20:28 pm
I'm in the same situation, I would buy DSOX2002A.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: GlowingGhoul on May 05, 2015, 02:24:52 am
Is the 3000T series hackable? I read many posts but the answer doesn't seem clear to me.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eman (AKA e-lectric-man) on May 18, 2015, 10:45:17 pm
I've been reading this thread since I got my new MS0-X-3052A about a week ago. I am mostly a hobbyist in my electronics interests and have no commercial use for this equipment. As such I feel fine about using the hacks discussed in this thread.

I wouldn't actually mind paying a fair price to get the scope's features enabled, but I have not found the licenses at anywhere near a reasonable price. So here I am.

The scope I got is apparently been sitting on some shelf for quite a while. It came with FW version 2.10, and it's manufacture date is 2012. It's a fine machine, and I got it for a very good price from eBay. It is completely new and in original packaging, and I'm happy with the purchase. After making my first pass at reading this thread I decided that I needed to upgrade the FW to version 2.35, as this seems to be the most preferred around here. I downloaded a copy from a link provided in https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg616147/#msg616147 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg616147/#msg616147) comment. I installed the upgrade, and it went just fine. So the scope now has FW version 2.35.

Next I proceeded to building a USB stick with the hack discussed earlier in the thread. Thanks to all the people involved in this ongoing project. This is one of the best threads on such a technical subject that I've ever seen, and I'm quite impressed with the fact that it is still active.

So my first version of the USB setup was a total mess, and of course it didn't work at all. Then I hunkered down and figured out the layout of the file system that is required, and I found that all the ones described herein have at least a few minor inaccuracies, and some are outright wrong. I started with the _setup.xml file found in the CAB FW file. I converted a copy of this file in stages into a set of commands for building the directory tree required for the USB stick, and populating it with the files appropriately renamed. The structure of the directories is most closely correctly given in the https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg364171/#msg364171 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg364171/#msg364171) post. It has just one minor inaccuracy. The web-socket-js folder should be inside the include folder. Thus:

Quote
\
+-infiniiVision
  +-fpga
  +-upgrade
  +-web
     +-css
     +-help
     +-image
     +-include
     +-web-socket-js
     +-lib
     +-Lxi
        +-Identification
     +-navbar
+-Startup
infiniivisionStartupOverride.txt

should be:

\
+-infiniiVision
  +-fpga
  +-upgrade
  +-web
     +-css
     +-help
     +-image
     +-include
          +-web-socket-js
     +-lib
     +-Lxi
        +-Identification
     +-navbar
+-Startup
infiniivisionStartupOverride.txt

I'm not actually sure how important this is, but I added this information in case it helps anybody.

Another minor problem I found was the case difference between some file names and references to them. One in particular seemed like a potential deal breaker is the one pointing to the infiniivisionLauncher.exe file in the infiniivision.lnk file in the Startup folder. Either the file was originally spelled with "vision" and the link with "Vision" or the other way around. I can't remember which at the moment. I'm aware that WinCE is most likely case insensitive like Windows, but I remember back in the ancient time when I was a Windows programmer I ran into a variety of exceptions to this rule. So I think some care should be taken here to match the cases properly. As a matter of fact some experimenting I did with testing this match led to USB stick configurations that behaved quite differently as I tried to boot the scope.

At any rate, I am now at the stage that I can produce USB sticks that will either seem to do nothing as I boot the scope, or else they hang it in a boot flashing-lights loop. I don't think I have yet successfully booted from a USB stick, partly because I haven't seen any error messages when I  boot the scope. I also have not seen the list of enabled licenses change. Finally, I can always remove the USB stick after a successful boot without the scope rebooting, which seems to indicate that the scope must have booted from the internal FW.

In the meantime I've also enabled the 30 day trial, which may be affecting me in some way I don't understand yet.

I'll keep playing with this stuff until I get it to work. I think my next step is to setup some way to allow me to telnet to the scope. Then I can play with the internal code, which I have not yet done.

This is a lot of fun. Thanks to all participants!

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on May 18, 2015, 10:55:18 pm
Try lots and lots of different USB sticks, it's hit and miss which types work. For me it's been seriously hit and miss which sticks work with any particular scope. Never found one particular make that works with all scopes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eman (AKA e-lectric-man) on May 18, 2015, 11:42:34 pm
I also initially thought that different sticks behaved differently. However, it seems to me that if I populate a stick in the proper order right after I format it, I get much more consistent behavior. Here's what I do now all the time:

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on May 18, 2015, 11:47:03 pm
I can send you a link to a doenload for a known good and working file structure for a 3000 series scope if you think that would take out one more variable?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eman (AKA e-lectric-man) on May 19, 2015, 02:00:03 am
Sure! I think I've got it right, but I don't really have a way to verify this. It would help either eliminate one avenue, or fix the problem altogether.

I appreciate your offer, and I will look forward to the link.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on May 19, 2015, 02:14:27 am
Try lots and lots of different USB sticks, it's hit and miss which types work. For me it's been seriously hit and miss which sticks work with any particular scope. Never found one particular make that works with all scopes.

My success rate with USB stick was 5 working like charm and one type not. All working units were Kingston. But there were people with USB stick from same vendor, exactly same type only small difference in size (eg 32G and 32G) and the boot does not work at all.
So it is really strange behavioral.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on May 19, 2015, 11:50:54 am
For me, the best rates were with Sandisk ones. And Kingston but the OLD ones, relly old (the first 'generation' of DataTravelers).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on May 19, 2015, 11:55:53 am
Sure! I think I've got it right, but I don't really have a way to verify this. It would help either eliminate one avenue, or fix the problem altogether.

I appreciate your offer, and I will look forward to the link.

https://dl.dropboxusercontent.com/u/2063383/Agilent%20DSOX3000%20237%20cracked.zip
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eman (AKA e-lectric-man) on May 19, 2015, 03:35:09 pm
Quote
Quote
Sure! I think I've got it right, but I don't really have a way to verify this. It would help either eliminate one avenue, or fix the problem altogether.

I appreciate your offer, and I will look forward to the link.
https://dl.dropboxusercontent.com/u/2063383/Agilent%20DSOX3000%20237%20cracked.zip

Thanks for the link. As it turns out, my USB setup was exactly the same as the one in the link. Not :o by this!

So my results are still the same, meaning: I may have a working hack, but I can't tell for sure because of the 30 day trial being active. On the other hand I may be playing the game of "Find the Right USB Stick", since I can in some circumstances get the loop-di-loop behavior.

Thanks a bunch anyway. You have helped me eliminate some variables here!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eman (AKA e-lectric-man) on May 19, 2015, 03:42:39 pm
A question for the experienced among you: How can I tell whether I'm successfully loading the system from USB or from built in FW? I thought that when the system is loaded from the USB, one cannot unplug the USB drive without causing a system reboot. Is this always the case?

My startup is very clean and no different from the internal FW system startup. The only difference I can see is that under File Explorer menu I get a mounted USB as well as the usual "\Agilent Flash" folder, and the default open folder right after startup is the USB folder.

Any ideas?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on May 19, 2015, 03:57:42 pm
My startup is very clean and no different from the internal FW system startup.

Since you are booting a hacked firmware image, you should be getting a warning after boot from the scope:

"System concerns detected:"  etc etc

So, if you aren't getting the warning in the middle of the screen after booting (prior to then touching any button/knob), then you haven't booted the hacked version from the external USB flash drive.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eman (AKA e-lectric-man) on May 19, 2015, 04:11:16 pm
I was afraid you might say that.  :(

So I guess when I get the looping effect during startup then the system is actually trying to boot from the USB drive and failing. Since I am using verified bootable tree in my USB stick, then the only possibility left to explain the failure is the type of USB stick I'm using.

I think I'll order a bunch of different ones today!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eman (AKA e-lectric-man) on May 19, 2015, 06:35:18 pm
 :) ;) SUCCESS!!!  ;) :)

I Have a fully functional scope booting from USB stick. I get no error messages during the boot, I just have to wait for the looping to start, and after approximately 6 or 7 loops, I get a message saying "booting from USB stick" on  the second splash screen. This message is displayed in small red letters on the top left of the screen. Once the boot completes, I get an additional message in the center of the display. this one says "All options enabled" on the first line and "Press any key to continue" on the second line. The message goes away when I press a key.

The next thing I checked was the "About Oscilloscope" screen. Here I found a surprise. I have been populating the USB stick with the software I got from TopUser a few comments back. I had assumed the stuff to be derived from FW version 2.35. But Here I see the system version being 2.37. That's way cool. I may try to build a stick based on 2.39 later...

I went through some changes to my command line specification in infiniivision.lnk file. I ended up with the following command which enables the largest number of licenses:

    86#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS -l CABLE -l TOM -l SGMC

Most of the enabled licenses have a '*' displayed next to them, but there is no expiration date indicated.

So here's what made the stuff work for me: I reformatted one of my USB sticks (on my Apple MacBook Pro) so the single partition present on the stick was modified from "MS-DOS (FAT)" which is FAT32 to "exFAT" which I believe is FAT16. I then loaded the files onto this stick in the order which I described in one of my earlier posts. That did the job. The USB stick I'm using is a very small one made by SanDisk, and it's a 8GB size.

That's way cool!

Thanks to all for the invaluable help.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: drlustig on May 22, 2015, 05:52:53 pm
:) ;) SUCCESS!!!  ;) :)

I Have a fully functional scope booting from USB stick. I get no error messages during the boot, I just have to wait for the looping to start, and after approximately 6 or 7 loops, I get a message saying "booting from USB stick" on  the second splash screen. This message is displayed in small red letters on the top left of the screen. Once the boot completes, I get an additional message in the center of the display. this one says "All options enabled" on the first line and "Press any key to continue" on the second line. The message goes away when I press a key.

The next thing I checked was the "About Oscilloscope" screen. Here I found a surprise. I have been populating the USB stick with the software I got from TopUser a few comments back. I had assumed the stuff to be derived from FW version 2.35. But Here I see the system version being 2.37. That's way cool. I may try to build a stick based on 2.39 later...

I went through some changes to my command line specification in infiniivision.lnk file. I ended up with the following command which enables the largest number of licenses:

    86#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS -l CABLE -l TOM -l SGMC

Most of the enabled licenses have a '*' displayed next to them, but there is no expiration date indicated.

So here's what made the stuff work for me: I reformatted one of my USB sticks (on my Apple MacBook Pro) so the single partition present on the stick was modified from "MS-DOS (FAT)" which is FAT32 to "exFAT" which I believe is FAT16. I then loaded the files onto this stick in the order which I described in one of my earlier posts. That did the job. The USB stick I'm using is a very small one made by SanDisk, and it's a 8GB size.

That's way cool!

Thanks to all for the invaluable help.

Confirmed. This actually works. Thank you! I formatted my 8GB Samsung USB Stick as exFat in Windows and followed your instructions. My 4GB did not seem to work for booting. Needed to upgrade from an earlier FW to 2.35 (link in a post above) to be able to boot from my USB stick. It even boots up reasonably fast, which is nice.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WattsUp on May 29, 2015, 02:05:52 pm
I managed to successfully show the booting from USB message on my (temporary) DSO X 2000. It then booted and showed all options enabled. Is there a way to save this, so USB is not needed for every boot and the options are permanent?
Thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: GlowingGhoul on May 29, 2015, 02:30:29 pm
Do these hacks work on the DSOX3000T series?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on May 29, 2015, 02:32:28 pm
Do these hacks work on the DSOX3000T series?
No
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Andlier on June 04, 2015, 09:36:55 am
So its posible to go back to the V2.35 with the help of telnet access.

Hi!
There is easier way to downgrade.

I have flashed 2.39 a long before I found this site. But now I have 2.35 with just PC and USB-key ;)

All has beed checked today on my MSO-X 2012 (originally it was standard 100MHz + MEMUP update with 2.39 firmware).
1. downgrade to 2.37 (it just works)
2. unpack 2000XSeries.02.37.2014052002.cab (ex with WinRAR)
3. extract file infiniiVisionLauncher.exe from infiniiVisionSetup.cab (2.37) (ex with WinCE CAB Manager)
4. unpack 2000XSeries.02.35.2013061800.cab (ex with WinRAR)
5. open infiniiVisionSetup.cab (from 2.35) file in WinCE CAB Manager, find infiniiVisionLauncher.exe on list and delete it
6. add infiniiVisionLauncher.exe (from 2.37 cab) to file list and set all properties like in old file (flags: uncheck all; location: \Secure\InfiniiVision; Hard-coded path checked)
7. file->save and exit WinCE CAB Manager
8. calc MD5 of edited infiniiVisionSetup.cab and update it in recipe.xml file
9. compress all files (ex with CabPack) from 2.35 firmware with edited infiniiVisionSetup.cab
10. flash new file

After this I reflashed scope once again with untouched 2.35 to update modified file but I don't know if it was necessary.
Also I don't know if there is possibility to downgrade directly from 2.39.

Now I have 2.35 in scope and 2.39 from USB (and I didn't need to use python script).

Starting scope from USB key:
NOT WORKS:
- Kingston DTSE9 (8GB)
- silicon power touch 830 (8GB)
- PQI connect 201 (16GB)
- all my no-name keys... (1GB..16GB)

WORKS:
- LEEF Spark 32GB
 

And I would like to thank everyone on this forum for files/instructions/descriptions.

I can confirm that this downgrade procedure worked on a msox-3054A from 2.37 to 2.35, used the 2000x 2.37-firmware provided somewhere in this thread, and 3000x 2.35 firmware.
Then went on with cassiopeia's guide to boot modded 2.39 firmware from a 4GB kingston usb-stick, worked first try.  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mark on August 01, 2015, 03:30:51 pm
Sorry guys I haven't read the full thread but I wondered if this worked on the MSOX3054A?  Is the MSOX3054A a good buy (refurbished)? 

Does the hack offer all that is included in dsox3appbndl? 

Thanks, I'm still reading and trying to decide if this is as good a deal as it seems. 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on August 01, 2015, 03:54:10 pm
Sorry guys I haven't read the full thread but I wondered if this worked on the MSOX3054A?  Is the MSOX3054A a good buy (refurbished)? 

Does the hack offer all that is included in dsox3appbndl? 

Thanks, I'm still reading and trying to decide if this is as good a deal as it seems.

Farnell are doing a very good deal on the MSOX3054 if you go to the trade counter, I think it's £2800+VAT. Even on the website they are 60% off list price or something crazy.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mark on August 01, 2015, 04:01:50 pm
Sorry guys I haven't read the full thread but I wondered if this worked on the MSOX3054A?  Is the MSOX3054A a good buy (refurbished)? 

Does the hack offer all that is included in dsox3appbndl? 

Thanks, I'm still reading and trying to decide if this is as good a deal as it seems.

Farnell are doing a very good deal on the MSOX3054 if you go to the trade counter, I think it's £2800+VAT. Even on the website they are 60% off list price or something crazy.

It's 3K + vat on the website, any way of getting 2800+ without actually travelling there in person?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on August 01, 2015, 04:08:19 pm
Sorry guys I haven't read the full thread but I wondered if this worked on the MSOX3054A?  Is the MSOX3054A a good buy (refurbished)? 

Does the hack offer all that is included in dsox3appbndl? 

Thanks, I'm still reading and trying to decide if this is as good a deal as it seems.

Farnell are doing a very good deal on the MSOX3054 if you go to the trade counter, I think it's £2800+VAT. Even on the website they are 60% off list price or something crazy.

It's 3K + vat on the website, any way of getting 2800+ without actually travelling there in person?

No, it's a promotion to increase trade counter footfall. Can't help you out because I'm not around this week and I'm not sure when the promotion ends, could be today. Call trade counter and ask, they're open till 5:30. Tell them Mr B sent you!

EDIT: Ooops it's Saturday today, thought it was Friday...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Swonkie on August 09, 2015, 03:33:25 pm
I'm looking for the 2.35 firmware for a 2000 series scope. I only found 2.35 for a 3000 scope. Can someone please post it, because I have built myself a LAN adapter and need to downgrade my current 2.38 firmware so I can boot from USB. That would be awesome.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: stroma on August 10, 2015, 01:17:25 pm
Please, is anyone able to provide me with the 2.35 files for DSOX2000 series?
Thanks!!!!

Solved - 2000 firmware seems to be identical to the 3000 Firmware, thus Toplosers link above is fine.

Swonkie, maybe you didn't read carefully :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Swonkie on August 16, 2015, 07:00:26 pm
Thank you - indeed I didn't see that.
The operation was successful. My thanks to everybody who contributed valuable information to this thread.

I now have two of these unpopulated boards left (ordered from a PCB pool service, so they have soldermask and are cut to the correct shape already):
https://github.com/aewallin/DSOXLAN (https://github.com/aewallin/DSOXLAN)
(Thanks aewallin, although I wish you provided all the required files, ready to order. I also had to fix the soldermask layer over the connector.)

The LAN adapter works, but the scope shows a warning message on boot. Although, if you plan to patch the firmware, you will get a firmware related warning anyway and the LAN adapter warning won't show up anymore.

If anyone is interested in getting one of the PCBs and can suggest a way for me to ship it, without having to spend a lot of money or time, pm me.
I could also send the resistors and capacitor required, if that would help, but you have to order the magjack yourself (see link above).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Campus on August 22, 2015, 09:40:15 pm
Hi,

I am one of the happy recipients of Swonkies PCB. Unfortunately it's not working as expected. I used a RJ45 jack which has no LEDs so I left out the 220Ohms resistors and only soldered the 1nF cap and the 10Ohms resistor. The card is recognized by the device and I can configure the LAN settings as required. My router also seems to somewhat detect the scope as it is shown in the list with the configured IP address.  But I cannot ping it and also the web ui does not return anything. Also telnetting into port 80 does not work.
Would be great if someone has an idea what could be wrong. Maybe I need to emulate the LEDs of the jack?

Thanks,
Campus
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on August 22, 2015, 10:02:32 pm
If LAN settings is available it looks like on scope side it is OK. Did you tried Wireshark to detect the traffic on LAN? It is too long, since I made testing of masked pins on LAN module.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Campus on August 22, 2015, 10:55:08 pm
Hmm, nmap returns no open port and the Message Analyzer shows that the scope never answers any packet. I've seen lots of SYN requests for a new http connection but no reply. Looks like the scope cannot send any packets.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on August 22, 2015, 11:00:17 pm
LEDs aren't needed to make the card work - they are just pretty flashing lights...

Are you sure the PCB is seated well into the edge connector in the scope - it's pretty fine pitch. Contacts on the PCB clean and shiny?

My DIY lan card works just fine on my msox2024a with the latest firmware, so your card should work ok if it's all soldered well and making good contact on the main board.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Campus on August 22, 2015, 11:17:19 pm
LEDs aren't needed to make the card work - they are just pretty flashing lights...

I was also assuming that and because of that I did not solder the 220 Ohm resistors.

Are you sure the PCB is seated well into the edge connector in the scope - it's pretty fine pitch. Contacts on the PCB clean and shiny?

PCB is clean and looks nice and and seems to fit quite exact into the connector. I also tried several times pulling and adding the board again but no change in result.

My DIY lan card works just fine on my msox2024a with the latest firmware, so your card should work ok if it's all soldered well and making good contact on the main board.

Do you know which pins of the RJ45 are used for sending or receiving? Maybe I could beep them back to the contacts of the pcb.

One other thing I noticed is that https://github.com/aewallin/DSOXLAN lists a 100nF instead of the 1nF shown in the pcb layout. Is that an error or does it not matter that much?

Thanks,
Campus
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on August 23, 2015, 03:36:27 am
The resistors are only for the LEDs.

My schematic is attached.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on August 23, 2015, 05:25:53 am
Check if the pcb is installed 'all the way to the end', I've had no response with one scope, that 'missed the last 1mm'.

A little more force, and it worked like a charm....
(please do not make any force that could damage the scope pcb or connector...)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Campus on August 23, 2015, 05:24:48 pm
Hi,

so far no luck here. I checked the connectors on the pcb under a microscope and can see little traces from the connecting pins so the physical layout seems to be ok. Then I replaced the 1nF cap with a 100nF cap as shown in Georges pdf. Then I added some leds and the missing resistors to complete the board. The leds light up but no change in behavior. The card is visible in the network which means arp displays the correct scope MAC address for the configured ip address. But I cannot receive any ip or ping packet back from the scope. I also tried different cables and machines in the network.
In my case both LEDs are always on and never blink or turned off. Is that normal behavior?

Thanks a lot to all of you helping me out with this issue,
Campus
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on August 23, 2015, 06:01:07 pm
Both LEDs off with cable unplugged. One LED lit when cable plugs in then the other LED flashes with various network traffic (just any traffic). My scope has a static IP. Various other devices on my network are also static IP. PC's/laptops/tablets/phones etc are all dynamic IP.

Here's the configuration of my scope in case it helps at all (below).

Anyhow, One LED should be flashing with traffic, not both solid permanently, so you have something not quite right in the hardware (imo).

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Kintekobo on August 23, 2015, 06:44:45 pm
Hi Campus. I would heartily recommend putting WireShark to work here. It would save a lot of guesswork and can usually show the problem area for further investigation.


I am keen to see if you can get this working as I would be very interested in doing the same myself. Is Georges80 the person producing the boards and if so are you planning on producing any more?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Campus on August 23, 2015, 06:56:03 pm
Hi,

I got the pcb from Swonkie who made a small batch of them. I now believe the reason why it's not working is the mag jack. According to the datasheet of the Digikey 1419-1021-ND (http://www.trpconnector.com/pdfs/6605758.pdf (http://www.trpconnector.com/pdfs/6605758.pdf)) the RJ45 pins are re-routed inside the jack, so pin 1 on the pcb is not pin 1 on the RJ45 side. My replacement jack is a simple 1-to-1 jack where each pin goes through directly (http://www.reichelt.de/Modularkabel-stecker-etc-/MEBP-8-8S/3/index.html?&ACTION=3&LA=2&ARTICLE=11372&GROUPID=848&artnr=MEBP+8-8S&SEARCH=Modularkabel%2C+-stecker+etc (http://www.reichelt.de/Modularkabel-stecker-etc-/MEBP-8-8S/3/index.html?&ACTION=3&LA=2&ARTICLE=11372&GROUPID=848&artnr=MEBP+8-8S&SEARCH=Modularkabel%2C+-stecker+etc)).
So I guess I need to find a place where I can get a jack with the same mapping.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Swonkie on August 23, 2015, 07:36:07 pm
I now believe the reason why it's not working is the mag jack.

That's what I would suggest too - compare the exact pinouts of your magjack to the suggested one.
As I said in the PM, I have used the board with a 1nF capacitor and it works very reliably.
By the way, telnet is on the default port 23, not on port 80.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Campus on August 23, 2015, 10:27:19 pm
Hi again,

I finally found a distributor in Europe who ships a pin compatible mag jack.  :-+ When it has arrived I will give it a try and report back whether it works.

@Swonkie: I know that telnet runs on port 23. When saying "telnetting into port 80" I meant redirecting telnet into port 80 because it's the easiest way to check whether a port is open. I could then manually make a HTTP request to check the web server response.

@Kintekobo: I analyzed the network traffic but never saw any reply packet coming from the scope.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Campus on August 26, 2015, 11:21:20 pm
Hi again,

today I received a compatible Mag Jack and I replaced the existing jack and also removed the no longer required LED resistors. And I couldn't believe it but it worked immediately. DHCP works and also static IP works. This is really cool. Thanks a lot to george80 and Swonkie and all the others helping me with this problem.

Has some of you any experience with the performance of the different client UIs available? Is the Java-based client more responsive than the HTML5 one? I don't have Java installed and could not test it so far.

Thanks again,
Campus
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Marchello on December 01, 2015, 01:59:43 pm
Hi folks!

Can I unlock DSOX3104A with FW 2.41?

Mark.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on December 13, 2015, 08:25:48 am
I just downloaded the v2.41 firmware from Keysight --- a lot has changed as far as "infiniiVisionSetup.cab" is concerned: 
 - The file "infiniiVisionCore.dll" no longer exists!  :-\
 - "/Secure/Startup/infiniivision.lnk" is empty (rather than contain default link to infinivisionlauncher.exe, which itself exists)
 - "/Secure/Startup" directory is missing many files present in firmware v2.39 and earlier
 - There is a new "/Secure/help" folder containing what looks like language packs

Did anyone look into changes in the boot process or allowing options in firmware v2.41?  infiniiVisionCore.dll was large file at 16.5MB ...there's no new files anywhere near that size.

I attached the release notes for v2.41.  The enhancements/fixes over v2.40 are pretty minor, but 2.40 introduces some networking improvements:
 + negative duty cycle measurement
 + Ax+B operator now allows negative A
 + DVM handles channel invert more appropriately


Does anyone have the v2.40 firmware update from Keysight?  I would like to take a look; unfortunately no longer available on Keysight website...

Any thoughts about the changes to the firmware, potential to downgrade etc.??
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on December 13, 2015, 05:08:48 pm
Hi folks!

Can I unlock DSOX3104A with FW 2.41?

Mark.

Buy IDA Pro and it can be possible. Downgrade to 2.3x seems to be better option :)
The changes between latest version 2.41 and 2.35 are minor.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: nctnico on December 13, 2015, 05:49:58 pm
A quicker way is to do a binary compare and identify if and where the to-be-patched location has been moved to.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on December 15, 2015, 03:06:08 pm
...
I attached the release notes for v2.41.  The enhancements/fixes over v2.40 are pretty minor, but 2.40 introduces some networking improvements:
 + negative duty cycle measurement
 + Ax+B operator now allows negative A
 + DVM handles channel invert more appropriately
It might not matter much to others, but in 2.41 I'm happy they finally seem to have fixed the bug where the scope issues multiple netbios name queries back to a host connecting to the SCPI port.  If there wasn't a netbios listener on the host, the scope would hang for about 8 seconds each time.  Netbios has nothing to do with SCPI, or TCP connections for that matter.

That only took 2 1/2 years to fix.

It would be nice to have the REAL list of issues fixed and other changes in each release, and not some fluffy little list deemed harmless for public consumption.  Without an option to downgrade, I want to know ALL the changes when I risk a one-way upgrade.


EDIT: minor typo.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mark on December 15, 2015, 06:20:04 pm
Does anyone know if the options will expire if I set the clock forwards before starting the built-in trial?  I set mine to 2115, started the trial, then set the clock back to 2015. Someone mentioned it earlier in the thread but I didn't see an answer, maybe wishful thinking... :-//
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on December 15, 2015, 07:03:29 pm
Setting the clock has no impact on built-in trials.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on December 15, 2015, 07:11:27 pm
Does anyone know if the options will expire if I set the clock forwards before starting the built-in trial?  I set mine to 2115, started the trial, then set the clock back to 2015. Someone mentioned it earlier in the thread but I didn't see an answer, maybe wishful thinking... :-//

This works on 6k series ( non X). But not on 3kX and 2kX series scopes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on December 21, 2015, 12:29:43 am
A quicker way is to do a binary compare and identify if and where the to-be-patched location has been moved to.

Hi nctnico, perhaps you are replyig to me?  If so regarding patch location in v2.41, the binary file infiniiVisionCore.dll is missing from the .cab file.  Perhaps a big restructure of the firmware? I didn't find any other .dll file which could have replaced it.

Does anyone have a copy of firmware v2.40?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wiljan on January 17, 2016, 10:28:35 pm
Hi, just found this great thread.

I do have a DSO-X2014A with FW 2.41, no LAN module.
Are there any way to downgrade to 2.37?

Please advise, thx
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mark41 on January 23, 2016, 09:07:37 pm
Could you please help me to hack my DSO-X 2012A with firmware 02.10. I asked plesa and he said I need 2.35 firmware version to get. Is there anybody who has this firmware and successfully hacked this series and could help with this procedure?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dziobu on January 23, 2016, 10:08:19 pm
There are untouched firmware files:
https://www.dropbox.com/s/mt6w8fj6oqer51g/2000XSeries.02.35.2013061800.cab?dl=0 (https://www.dropbox.com/s/mt6w8fj6oqer51g/2000XSeries.02.35.2013061800.cab?dl=0)
https://www.dropbox.com/s/y4y3d2xmj2gmgdb/2000XSeries.02.37.2014052002.cab?dl=0 (https://www.dropbox.com/s/y4y3d2xmj2gmgdb/2000XSeries.02.37.2014052002.cab?dl=0)
https://www.dropbox.com/s/c4u6zukxjthj76a/2000XSeries.02.39.2015022602.cab?dl=0 (https://www.dropbox.com/s/c4u6zukxjthj76a/2000XSeries.02.39.2015022602.cab?dl=0)

And read this:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/585/ (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/585/)
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/735/ (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/735/)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wiljan on January 24, 2016, 11:11:57 am
When I'm trying to load FW 2.35, 2.37, or 2.39 instead of current fw 2.41 on DSOX2014

I do get this "Error: The file did not load correctly" after a while
I did try the 'Secure Erase'  as sugested in another thead for the same error but lower fw, it did not help.

Would it be possible to go back from 2.41 if I had a LAN card?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on January 24, 2016, 06:01:07 pm
Hi all

It looks like I might have to send my scope in for repair under warranty. Bit concerned that they might upgrade the firmware whilst it is there. Has anyone been able to downgrade from the latest firmware to 2.35 successfully?

Thanks

Trev
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on January 24, 2016, 06:47:24 pm
I did an update to 2.41 on my scope.
The good news: Still the same telnet login :), Star Trek Screensaver still working and a hacked infiniivision with all options can be started over telnet.
The bad news: The infiniivision exe & dll is now in the \windows folder. So it's not possible to change the files because this folder is "read only".

I tried also infiniiVisionInstallService.exe from an older version to load an older firmware version but the exe doesn't run.
I think the only way to downgrade is to try directly \windows\loadP500Flash -u ceImage1 %TEMP%\nk.bin.comp with the high risk to brick the scope.  :-BROKE

At the moment I won't risk to brick my scope because i have the license bundle on it and the only option that is missing is the MSO option which is rarely used.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mark41 on January 24, 2016, 07:15:38 pm
Still I cant get my oscilloscope boot from usb that has hacked 2.39. I get black background and agilent logo only only, it takes I while, longer then normal boot but it boots into 2.35. My structure on the usb looks like this:

Code: [Select]
L:\
????Agilent Flash
?   ????config
?   ????wfmMem
????Secure
?   ????infiniiVision
?   ?   ????fpga
?   ?   ????upgrade
?   ?   ????web
?   ?       ????css
?   ?       ????help
?   ?       ????image
?   ?       ????include
?   ?       ?   ????web-socket-js
?   ?       ????lib
?   ?       ????Lxi
?   ?       ?   ????Identification
?   ?       ????navbar
?   ????Startup
????Temp
Is it correct ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on January 24, 2016, 07:19:19 pm
Do you have infiniivisionStartupOverride.txt file in root?
Upgrade to 2.35 firmware and try multiple USB sticks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mark41 on January 24, 2016, 07:21:50 pm
Yes I do. It's different from the normal boot because it takes a bit longer time and the logo with mountains doesn't show up.
I managed to make it work with a help of my friend.  :-+  I wonder why nobody made and posted a link to a usb image to make it easier for people. Is it forbidden or what ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wiljan on January 25, 2016, 01:11:29 pm
Did build a LAN interface and it does work  :) Still on FW2.41 I can use the scope over WEB

If I go for the "Firmware Version" and browse the the filter are Keysight X-Series files(*.ksx) or Agilent X-Series files (*.agx), so here it will not work with 2.37 cab file

I can telnet on port: 5024 no password required and I can controll the scope in respec to "Oscilloscopes Programmer's Guide"  like :SINGLe or :RUN

If I telnet on port 23 I'm required to enter user/ pass and the infiniivision / skywalker1977 are incorrect

Any hint?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on January 25, 2016, 03:15:00 pm
The first login on telnet will fail every time on my scope.
The second login should work.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wiljan on January 25, 2016, 05:39:38 pm
Thx kilobyte, you are right the login / pass needs to be typed twice  :)
So now I have access for the promt

Pocket CMD v 6.00
\> dir

    Directory of \

01/01/98  12:00p    <DIR>                    Network
01/26/16  01:27a    <DIR>                    Application Data
01/26/16  01:27a    <DIR>                    profiles
01/26/16  01:27a    <DIR>                    Documents and Settings
01/26/16  01:27a                          23 Control Panel.lnk
01/26/16  01:27a    <DIR>                    My Documents
01/26/16  01:27a    <DIR>                    Program Files
01/26/16  01:27a    <DIR>                    Temp
01/26/16  01:27a    <DIR>                    Windows

    Found 9 file(s). Total size 23 bytes.
    1 Dir(s) 15499264 bytes free


I can kill infiniivisionLauncher and start it again ...
processMgr.exe kill infiniivisionLauncher.exe
infiniiVisionLauncher -l All

When the soft restarts I still only have the few original options

I also tried FTP standard port as well and it only gives access for 2 folders called webdata and webupdate ... both empty

Any idea how to move on from here?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wiljan on January 25, 2016, 05:53:24 pm
Ok... got a bit futher  8)

So basic the scope do have FW2.41 installed

I hava a USB stict with the modified FW2.37

From telnet
\windows> cd \usb
\usb> cd infiniiVision
\usb\infiniiVision> processMgr.exe kill infiniivisionLauncher.exe
\usb\infiniiVision> infiniiVisionLauncher -l All
Our command line is -l All
*** Installing License: All Licenses

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on January 26, 2016, 10:48:09 am
Wiljan, can I just confirm that over Telnet with FW 2.41 you are able to enable all licenses? You have to telnet and do the procedure each time you power up but it does work?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wiljan on January 26, 2016, 11:29:09 am
Wiljan, can I just confirm that over Telnet with FW 2.41 you are able to enable all licenses? You have to telnet and do the procedure each time you power up but it does work?
Yes I have FW2.41 flashed in scope and a USB stick with FW2.37 modified.
I have to Telnet into the scope and run the FW2.37 from USB each time if I want all licenses enabled.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on January 26, 2016, 11:32:51 am
That is awesome!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on January 26, 2016, 11:35:33 am
Awesome indeed, might have to bump up the price of that MSO-X-3054 I've got posted for sale now!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 29, 2016, 09:22:46 pm
Ok... got a bit futher  8)

So basic the scope do have FW2.41 installed

I hava a USB stict with the modified FW2.37

From telnet
\windows> cd \usb
\usb> cd infiniiVision
\usb\infiniiVision> processMgr.exe kill infiniivisionLauncher.exe
\usb\infiniiVision> infiniiVisionLauncher -l All
Our command line is -l All
*** Installing License: All Licenses

I have a 2.41 scope too, and I took your directions and wrapped it up into a VBScript to do this automatically. Note: I am NOT a VBScript programmer, in fact it's a technology that I've spent a good deal of my career avoiding, mostly but not always successfully. However, if you want to script up a nasty macro key pusher to an async telnet interface, sometimes needs must.

First, I formatted a USB stick as exFAT and copied the contents of the zip file in this post https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg535755/#msg535755 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg535755/#msg535755)

I renamed the infiniivisionStartupOverride.txt file on the root of the usb stick with .old on the extension so the scope doesn't just loop at bootup, and I can just leave the USB stick permanently plugged in.

You will need to make sure Windows has its Telnet client installed, you do this from Control Panel -> Programs -> Programs and Features -> Turn Windows features on or off, and select the Telnet client.

Copy the attached file to your computer and remove the .txt extension.

You can run the x3000a.vbs directly from the command line or make up a shortcut, but either way you need to specify on the command line the IP address or hostname of the scope, for example

Code: [Select]
x3000a.vbs a-mx3054a-12345

or

Code: [Select]
x3000a.vbs 192.168.50.123

Note that because it's a dumb key pusher, it has limitations. Firstly you might need to alter the delays for your particular PC, and secondly if you change focus to a different app or window, it'll start pumping in characters into that window rather than the telnet session, so I'd let it do its stuff until someone better than me can come up with something better. You could also significantly reduce the "WScript.Sleep 45000", but I left it like that because there is some useful feedback to the end user.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on January 29, 2016, 10:10:35 pm
Great work, thanks for this script.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wiljan on January 30, 2016, 09:51:28 am
Thx Howardlong, script works here as well  :) I made a small bat file with the IP address included

I have been thinking when having 2.41 on scope and loaded 2.37 from usb stick.
If it would be save to flash the 2.37 (and if that not possible since it's already loaded than take the FW2.35) first and then 2.37 ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on January 30, 2016, 10:27:39 am
Ok... got a bit futher  8)

So basic the scope do have FW2.41 installed

I hava a USB stict with the modified FW2.37

From telnet
\windows> cd \usb
\usb> cd infiniiVision
\usb\infiniiVision> processMgr.exe kill infiniivisionLauncher.exe
\usb\infiniiVision> infiniiVisionLauncher -l All
Our command line is -l All
*** Installing License: All Licenses

This can be easily ported to Python and RPi2 platform which can be powered from scope itself. And run on startup or by Cron.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 30, 2016, 01:31:03 pm
Indeed, this morning I finally found a use for one my original RPi's that's been stuck in a drawer.

It all sits in the probe compartment and runs automatically at scope boot up.

The RPi is powered from a hub that's connected to the rear USB port. This hub also has the USB stick with the 2.37 code.

I wrote an "expect" script (attached) and added it to the rc.local so it runs on boot up.

Quick setup

Install Rasbian Jessie
sudo apt-get install telnet
sudo apt-get install expect

Place the attached x3000a.txt script in your /home/pi directory, and rename it to x3000a.

To run it immediately from your /home/pi directory, run the following (setting your scope's IP address or host name as appropriate):

  expect x3000a 192.168.50.123

Next steps (running automatically at power up)

Power your RPi from one of the USB ports so it powers up and boots when the scope initially boots.

Raspberry pi configuration changes in GUI:
   set to cli only (Note that you can always go back into the gui with startx from the command line)
   wait for network

I recommend using a static IP address on the RPi and the scope so this will work without a DHCP server if you're off your LAN (a straight through CAT5 patch cable between Pi and scope works in this case). It looks like some well meaning individual chose to change how static addresses are set up in RPi, rendering hundreds of pages on the subject obsolete. It's now in /etc/dhcpcd.conf.

Add to the bottom of /etc/dhcpcd.conf file your Pi's static IP address details:

   interface eth0
   static ip_address=192.168.50.123/24
   static routers=192.168.50.1
   static domain_name_servers=192.168.50.1

To make it work automatically at boot* add the following to your /etc/rc.local file before the "exit 0", setting the IP address to your scope's, and note the "&" on the end, it is not a typo!

  /usr/bin/expect /home/pi/x3000a 192.168.50.123 &

*I strongly recommend getting it to work from the command line first with a monitor before setting it up to work "headless" at boot time in case some of the timings don't work out for you.

One caveat: remove any USB stick in the front before boot, that appears as \usb with the rear one \usb2.

Edit: added some clarifications and one correction to a typo on the static IP address config.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on January 30, 2016, 02:00:00 pm
Indeed, this morning I finally found a use for one my original RPi's that's been stuck in a drawer.

It all sits in the probe compartment and runs automatically at scope boot up.

The RPi is powered from a hub that's connected to the rear USB port. This hub also has the USB stick with the 2.37 code.

I wrote an "expect" script (attached) and added it to the rc.local so it runs on boot up.

In brief:

Install Rasbian Jessie
sudo apt-get install telnet
sudo apt-get install expect

Raspberry pi configuration in GUI (Note that you can always go back into the gui with startx from the command line)
   set to cli only
   wait for network

Place the attached x3000a.txt script in your /home/pi directory, and rename it to x3000a.

I recommend using a static IP address on the RPi and the scope so this will work without a DHCP server if you're off your LAN. It looks like some well meaning individual chose to change how static addresses are set up in RPi, rendering hundreds of pages on the subject obsolete. It's now in /etc/dhcpcd.conf

   add to the bottom of /etc/dhcpcd.conf file

   interface wlan0
   static ip_address=192.168.50.123/24
   static routers=192.168.50.1
   static domain_name_servers=192.168.50.1

To make it work at boot, add the following to your /etc/rc.local file before the "exit 0", setting the IP address to your scope's:

  /usr/bin/expect /home/pi/x3000a 192.168.50.123 &

One caveat: remove any USB stick in the front before boot, that appears as \usb with the rear one \usb2.

You are pretty fast, well done!!  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 31, 2016, 03:48:31 pm
Edit: the following only applies if your scope already has 2.41 installed.

Interestingly, the telnet kill-and-launch-from-USB method  (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg850610/#msg850610)works with a USB key made with the current 2.41 3000XSeries.02.41.2015102200.cab (http://www.keysight.com/main/software.jspx?ckey=2014548&lc=eng&cc=GB&nid=-32540.1150205&id=2014548) firmware directly downloaded from Keysight extracted with the Python script too.

But, with 2.41, there is apparently no need to add any additional files to the USB root, patch a dll, or change any .lnk file.

In short, copy just the infiniiVision directory generated by the dosetup.py script to the USB root.

dosetup.py is in the agilent.zip attachment in this post (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg636470/?topicseen#msg636470).

Here are modified instructions to prepare a clean FAT32 formatted USB stick (my modifications in bold italics), and assumes that you have Python 2.7 installed in the default C:\Python27 in Windows.

* extract Agilent .cab firmware with you favorite program (I used 7zip)
* extract infiniiVisionSetup.cab file : you have now an infiniiVisionSetup folder
* chdir to infiniivisionSetup  folder, copy dosetup.py to this folder
* c:\Python27\python dosetup.py (linux users should chande \ by / in _setup.xml file !!!)
* then chdir to Secure/infiniiVision
* copy all the infiniiVision and Startup directories directory to an USB key (ie, there should be a single infiniiVision directory on the root of the USB key with a bunch of files and directories within it)

To run:


Notes:

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 31, 2016, 10:27:35 pm
Thx Howardlong, script works here as well  :) I made a small bat file with the IP address included

I have been thinking when having 2.41 on scope and loaded 2.37 from usb stick.
If it would be save to flash the 2.37 (and if that not possible since it's already loaded than take the FW2.35) first and then 2.37 ?

I haven't figured out how to downgrade a 2.41 scope's flash, it doesn't seem to like it from USB stick or via the web interface as far as I can see, operator error excepted of course!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on February 02, 2016, 05:43:45 pm
This has turned out to be even easier than I thought on a 2.41 scope, you don't even need a USB stick, just a telnet connection.

A VBscript "x3000aV2.vbs.txt" is attached. Remove the ".txt' from the file name. Setup a shortcut to x3000aV2.vbs with the IP address or hostname of your scope as the first parameter. You will need Windows' Telnet client installed (in Windows Features).

It turns out that the \secure folder is still there but hidden, the script runs the following from telnet:

Code: [Select]
cd \secure\infiniivision
processmgr kill infiniivisionlauncher.exe
infiniivisionlauncher -l all


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mark on February 02, 2016, 06:12:11 pm
Thanks for your hard work Howard!  I have one possibly stupid question, is this all possible without a DSOXLAN or home-made equivalent? 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on February 02, 2016, 07:23:53 pm
Thanks for your hard work Howard!  I have one possibly stupid question, is this all possible without a DSOXLAN or home-made equivalent?

No, because you cannot connect to telnet over USB :( Homemade DSOXLAN adapter will work.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on February 02, 2016, 09:03:40 pm
Thanks for your hard work Howard!  I have one possibly stupid question, is this all possible without a DSOXLAN or home-made equivalent?

I don't know what's available on the board itself other than a serial line that I am sure will work with u-boot. Whether it offers a serial terminal in Windows CE, I don't know, but Windows isn't Linux so I wouldn't be at all surprised if that's not available. The last time I did anything seriously with Windows CE was about 1997 when it first came out! I do have two Windows CE 6.0 dev boards here gathering dust, if I get chance I'll try to blow off the cobwebs.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: chromex on February 02, 2016, 09:57:17 pm
Do these hacks work on the DSOX3000T series?
No

Did someone manage to make these hacks work on the DSOX3000T series now?  ::)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on February 04, 2016, 01:52:19 pm
I followed the instructions HowardLong put up using the Lan connector and the VB script. Interestingly my scope is a 3024A but when I did the -l all option it downgraded me to 100Mhz. I had to change the command to "-l BW20 l-all"

This then worked. When I reboot after the script the network card needs its configuration reset to auto as all the options are lost. Within a few seconds though all is back up again.

Regarding the DIY Lan card. After reading through this thread I picked up the bit about the DIY lan cards and found the difference between the center tap configurations. My original card had a 1uF connected to ground and was rebooting the scope. It seems the more successful versions have the 10R and 1nF circuit connected to the center tap. I modded my card to that configuration and the card does work but I get the message indicating the card is faulty upon boot. My wiring is the same has georges80 circuit but maybe its because its a 3000 series and not the 2000? Has anyone got a 3000 series scope working with a diy lan card and do not get the error message?


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on February 04, 2016, 05:40:26 pm
I followed the instructions HowardLong put up using the Lan connector and the VB script. Interestingly my scope is a 3024A but when I did the -l all option it downgraded me to 100Mhz. I had to change the command to "-l BW20 l-all"

This then worked. When I reboot after the script the network card needs its configuration reset to auto as all the options are lost. Within a few seconds though all is back up again.


Doh! Schoolboy error, sorry. My 3054A dropped to 350MHz. "-l bw50" added after the "-l all" fixed it. Sorry for missing that.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on February 04, 2016, 05:44:52 pm
What you created is fantastic, thank you.

Howard, did you buy the proper LAN adapter? Does the scope forget its network setting when you execute the script?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on February 04, 2016, 10:07:14 pm
What you created is fantastic, thank you.

I merely follow in the footsteps of giants. Almost all of the work was already done.

Quote
Howard, did you buy the proper LAN adapter? Does the scope forget its network setting when you execute the script?

I do have a proper Keysight DSOXLAN. I don't know where it's getting the LAN data from, it's showing nonsense but I can still telnet into the address I originally set up in the standard boot. It prints too, so I guess there's something else going on which is cosmetic only as far as I can see, but stand to be corrected.

I have a CE 6.0 dev environment up now, and an ARM demo board running it which it doesn't matter if I brick, I can always bring that back to life. I can create my own .exe's that run fine on the scope, in console mode at any rate. To their credit Agilent/Keysight threw out the standard Windows UI and copied pretty faithfully their awesome Ui from their previous vxWorks scopes, so I'm not even sure yet if they use the Windows GDI, the consistent API that sits between programmer and graphics device.

The problem of the IP address and the way the scope starts up in default mode I feel maybe related, perhaps it's simple and just needs to be started in a particular directory to pick up the settings, I don't know.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on February 05, 2016, 09:18:45 pm
Okay, I think I have gotten to the bottom of the DIY Lan cards.

From reading back through this thread ( again ) I noticed that some people who did not see the error message regarding the LAN card were running hacked software.

I find that after I did the mod to correct the centre tap of the transformers and shorted pins 78/80 my lan card works perfectly but I get the error message on first boot for firmware 2.41 ( unhacked ). But when I run Howards script, the scope reboots with all licenses and does not display the error.

So I think the error is software related and not hardware. Not sure if anyone else can prove this but I feel comfortable the LAN card is working fine on 3000x scopes
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ECEdesign on February 26, 2016, 06:18:37 pm
What would be the best firmware version to upgrade a DSOx2000 scope with current firmware version 1.21.2011072803?  The only firmware on Keysight's page is 2.41 and that firmware does not seem to be hack-able.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on February 26, 2016, 06:56:39 pm
Everything is hackable, question is only time and effort including 2.41.
The best will be 2.36 or 2.36 booted from USB stick.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on February 26, 2016, 09:37:36 pm
What would be the best firmware version to upgrade a DSOx2000 scope with current firmware version 1.21.2011072803?  The only firmware on Keysight's page is 2.41 and that firmware does not seem to be hack-able.

2.41 is easily liberated but you need a LAN card and be able to double click an icon on your desktop once the scope's booted to the second splash screen with the black background. Depending on your setup that may or may not be easily feasible: as I work in mixed signal I always have a PC permanently at the bench so it's not a big deal.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ECEdesign on February 27, 2016, 01:27:53 am
I don' have a LAN card for my scope.  I did some digging through this thread it looks like 2.35 is the best version.  I will probably start by booting from a USB drive since its a bit safer see if it works out.  I found the original 2.35 firmware in the thread I still need to find what needs to be modified to get the hack to work.

Also I saw a teardown of the agilent MSO probes, it doesn't look like there is any circuitry in them so would any header extension get MSO capability once the MSO function is unlocked?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on February 27, 2016, 01:39:11 am
I don' have a LAN card for my scope.  I did some digging through this thread it looks like 2.35 is the best version.  I will probably start by booting from a USB drive since its a bit safer see if it works out.  I found the original 2.35 firmware in the thread I still need to find what needs to be modified to get the hack to work.

Also I saw a teardown of the agilent MSO probes, it doesn't look like there is any circuitry in them so would any header extension get MSO capability once the MSO function is unlocked?

There is step by step description in this thread.
For MSO just the header will do the job, no identification of genuine probe.
Check ebay for original MSO probe.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on February 27, 2016, 02:01:12 am
There *IS* circuitry in the MSO probe - it's a 90k (nominal) resistor in series with the signal and INSIDE each of the flying lead (grey plastic ends) where the little ground pins go. So you can't just take a header and wires and call it done.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on February 27, 2016, 06:34:17 am
There *IS* circuitry in the MSO probe - it's a 90k (nominal) resistor in series with the signal and INSIDE each of the flying lead (grey plastic ends) where the little ground pins go. So you can't just take a header and wires and call it done.

cheers,
george.

That is correct. I also suspect that the wires in the ribbon cable itself may be resistive/lossy. If all you're doing is low speed stuff it's certainly possible you could sling something together, but georges80 is correct, the probes are not just a ribbon cable.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jay_Diddy_B on February 27, 2016, 07:11:07 am
Hi,

I haven't checked but some of the cables and probes from the old logic analyzer might work. I am think 1650, 1660 series instruments. They have a similar divider.

Regards,

Jay_Diddy_B
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on February 27, 2016, 11:34:53 am
Certainly those from the old 54622d and 54642d work.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on February 27, 2016, 05:23:32 pm
There *IS* circuitry in the MSO probe - it's a 90k (nominal) resistor in series with the signal and INSIDE each of the flying lead (grey plastic ends) where the little ground pins go. So you can't just take a header and wires and call it done.

cheers,
george.

That is correct. I also suspect that the wires in the ribbon cable itself may be resistive/lossy. If all you're doing is low speed stuff it's certainly possible you could sling something together, but georges80 is correct, the probes are not just a ribbon cable.

The weaved cable signal wires are resistive/lossy. They are nominal 190 ohm wires on mine. The ground wires in the weave ARE zero ohms.

I did some research/discovery of the cables, since I used them with an adapter I made to allow me to use them into the msox2000 analog front end for serial decoding. The 2000 series performs serial decode using the 4 channel analog inputs unlike the 3000 that uses the LA inputs.

cheers,
george.

Edit to correct that the signal wires are resistive. (The ground wires are NOT).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on February 28, 2016, 06:44:12 am

The weaved cable wires are not resistive/lossy. They are just nominal 0 ohm wires.
george.

The weaved cable are resistive and forms lossy transmission line, patendted by HP enginner:
http://www.google.com/patents/US4777326 (http://www.google.com/patents/US4777326)

My cable has 120 cm long an has 180 Ohms.

Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on February 28, 2016, 10:38:22 pm
Has anyone figured out howmtomtalemthe pod thingy apart on these? I have an old wone that's missing a couple of final probe leads, I don't mind taking it apaaaaarrt (TM) and measuring it if it's easy enough, but an obvious non-destructive disassembly alluded me last time I looked.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jay_Diddy_B on February 28, 2016, 10:55:28 pm
Hi Howard and the group,

I am not entirely sure which 'thingy-ma-bob' you are talking about. If you are talking about this part:

(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=204770;image)

These photographs will help you unlock the secrets.

(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=204772;image)

(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=204774;image)



Regards,

Jay_Diddy_B

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on February 28, 2016, 11:07:51 pm

The weaved cable wires are not resistive/lossy. They are just nominal 0 ohm wires.
george.

The weaved cable are resistive and forms lossy transmission line, patendted by HP enginner:
http://www.google.com/patents/US4777326 (http://www.google.com/patents/US4777326)

My cable has 120 cm long an has 180 Ohms.

Georg

Yes, you are correct, around 190 ohms for the data wire on the cable and zero ohms for the interleaved ground wires. Even more magic than I thought to maintain good impedance match along the cable.

...and thus an even better reason to source the correct cables for the scope if one purchased the none msox version.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on February 28, 2016, 11:38:11 pm

The weaved cable wires are not resistive/lossy. They are just nominal 0 ohm wires.
george.

The weaved cable are resistive and forms lossy transmission line, patendted by HP enginner:
http://www.google.com/patents/US4777326 (http://www.google.com/patents/US4777326)

My cable has 120 cm long an has 180 Ohms.

Georg

Yes, you are correct, around 190 ohms for the data wire on the cable and zero ohms for the interleaved ground wires. Even more magic than I thought to maintain good impedance match along the cable.

...and thus an even better reason to source the correct cables for the scope if one purchased the none msox version.

cheers,
george.

Genuine cable N6459 has input resistance 90k.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on February 28, 2016, 11:41:04 pm
The CABLE is around 180 ohms on the 'signal' lines, and zero ohms on the ground lines.

The test PIN/HEADS are 90K. i.e. the part that unclips from (as in Jay's picture).

We're talking two different parts....

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on February 29, 2016, 03:43:37 pm
http://www-d0.fnal.gov/trigger/stt/commiss/agilent/agilentprobing.pdf (http://www-d0.fnal.gov/trigger/stt/commiss/agilent/agilentprobing.pdf)

Page 9:

The Standard Probing System

The standard probing system
consists of IC clips, probe leads,
probe housing and probe cable.
Because it is passive, the standard
probing system is smaller,
lighter, and much easier to use
than active probing systems. This
passive probing system is similar
to a probing system used on a
high frequency oscilloscope. It
consists of an isolation network
(as shown in figure 3) at the
probe tip and a shielded resistive
transmission line
.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jay_Diddy_B on February 29, 2016, 04:14:17 pm
Hi group,

This document shows a picture of this special cable:

http://cp.literature.agilent.com/litweb/pdf/5968-8153EN.pdf (http://cp.literature.agilent.com/litweb/pdf/5968-8153EN.pdf) page 14.

Here is the picture:

(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=204925;image)

The part number: 01650-61607 suggests that has been used since the 1650 series of LAs.

Some of the connections will measure low resistance, other higher resistance. There is a mixture of low resistance and resistance wire connections.

The manual describes the Logic inputs as 1GSa/s sample rate and 50 MHz toggle rate.

Regards,

Jay_Diddy_B

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on February 29, 2016, 09:52:37 pm
This is the cable I'm talking about with the woven cable:

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg367778/#msg367778 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg367778/#msg367778)

There are two central rivets hidden beneath the label which is the reason I'm reticent to go medieval on it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mykeil on March 12, 2016, 09:20:54 pm
I am trying to unlock Agilent 54831D Infiniium MSO. It is running Windows XP.
Did someone did this?

Can someone show me the way? Thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on March 12, 2016, 09:38:21 pm
I am trying to unlock Agilent 54831D Infiniium MSO. It is running Windows XP.
Did someone did this?

Can someone show me the way? Thanks.

Is it Windows 95 or XP?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mykeil on March 12, 2016, 09:51:07 pm
It is Windows XP.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on March 12, 2016, 10:06:59 pm
It is Windows XP.

You might want to look at this thread https://www.eevblog.com/forum/testgear/agilent-hp-54831d-advice/ (https://www.eevblog.com/forum/testgear/agilent-hp-54831d-advice/)

User Blacknoise was very helpful.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mykeil on March 12, 2016, 10:12:58 pm
Thank you a lot. I will contact him.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: keitheevblog on March 29, 2016, 04:37:51 am
Howardlong and friends: you guys simply kick a**.

The posts here were fantastic.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: elliotb on April 05, 2016, 08:28:07 pm
I recently scored a cheap dsox2004a in ebay and upgraded the software to 2.35. I've read through the thread (a few times) but I'm stuck unpacking the cab file... I can extract it fine but I don't have a way to do the numerous copies necessary to create the /Secure file structure. I tried installing cab manager 3.0 but the website it gone and all the installers I can find are just bloatware... I work in linux mostly but can run Windows 8.1 in a vm. Does anyone have a python script to unpack the files using _setup.xml?

Thanks,
Elliot
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on April 05, 2016, 09:15:36 pm
Hi Elliot,

 you can use this tool here http://www.codeppc.com/telechargements/msceinf/msceinf.htm (http://www.codeppc.com/telechargements/msceinf/msceinf.htm) to extract the cab file
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: elliotb on April 05, 2016, 09:54:58 pm
Thanks kilobyte! Didn't see this so I ended up just hacking up a python script (after spending over an hour trying to get the damn cab manager installed). Inline below in case it's useful for anyone else. Just takes a single arg which is the extracted infiniiVisionSetup.cab directory. Looks like its all working now!  :-+

#!/usr/bin/python
#
# Parse xml into cab file system
#
import sys
import os
import shutil
from xml.etree import ElementTree

# Dir name
dir = None

# get root
root = sys.argv[1]

if root is None:
    os.exit ("Must specify root")

with open (root + "/_setup.xml", 'rt') as f:
    tree = ElementTree.parse (f)

for node in tree.iter():

    if node.attrib.get ('type') is not None:

        # Check if we should get new base dir
        if node.attrib.get ('type')[0] == '\\':
            dir = node.attrib.get ('type')
            dir = dir.replace ("\\", "/")
            dir = dir[1:]
            print "mkdir %s" % dir
            if not os.path.exists (dir):
                os.makedirs (dir)

        # Check if we found a destination dir
        else:
            if node.attrib.get ('translation') == 'install':
                dest = dir + '/' + node.attrib.get ('type')
#                print "Dest: %s" % dest

    # Check if we have a source
    if node.tag == 'parm' and dir is not None:
        src = root + "/" + node.attrib.get ('value')
        print "cp %s %s" % (src, dest)
        shutil.copyfile (src, dest)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on April 06, 2016, 12:55:59 am
Man its been forever since I last checked this thread! Gotta scan through it and see whats new and whats changed in the game!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mongo on April 06, 2016, 05:30:40 am
As someone whom had to pay the price for the "NEW" official MSO cable for the DSOX2000, which I hope actually works (as you cannot access the digital lines from the serial key enabled)  I wanted to upload a picture of the latest shipping cable. Note it does come with a licensed entitlement that you have to register but I did not try it without the key.

Note that it is not braided cable, but I am unwilling to pull it apart until I make sure I can decode SPI/I2C while watching the digital channels for timing.

(http://s24.postimg.org/jxklzgar9/2000_XMSO.jpg)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mongo on April 06, 2016, 04:38:38 pm
Note that if you have a DSOX2000 series scope the $700 cable is not worth your time, even if the cost isn't an issue and you need a MSO for slow speed serial will be better off writing a sketch on an Arduino Uno.  The MSO functionality on this series is less capable than anything else that dares to claim to be an MSO.  Despite all of the marketing fluff you can't even have the digital channels on while decoding serial and you cannot decode serial on the digital lines. 

This means that if you wanted to check your chip select timing on a SPI bus you are SOL.  Apparently the "hardware serial decoding" is done by something with less horsepower than an AVR.  As I do lots of slow speed serial work I will be putting the cable in a box next to my bus pirate as a reminder to remind myself the the glory days of HP/Agilent are gone.  :--

And yes it is my fault I thought it was a good thing they quit reselling Rigol at this price point, and was willing to wait 45 days for them to ship me a breakout cable and a sheet of paper.  But that delay removes any ability to return the main unit to a retailer.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: elliotb on April 07, 2016, 04:15:20 pm
Thank you for sharing that mongo. Good to know... I've been looking for a used one online but based on your review I will abandon all hope for the digital lines.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Keysight DanielBogdanoff on April 07, 2016, 05:14:06 pm
Hi mongo,

I'll follow up with you on the message you sent us, I'm sorry that the MSO isn't living up to what you need.

Some history on this, when we started shipping the 2000 X-Series scopes there was no decoding at all. After a lot of customer feedback, we enabled serial decoding with the 2.30 firmware release, but the caveat was that the 2000 X-Series only have one of the MegaZoom ASICs. The digital lines and serial decoding use the same block in the ASIC, so it's a physical impossibility to enable the decoding and the digital channels simultaneously.  The 3000T and up have two ASICs, which is why we support that in those scopes. It makes us sad, too.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on April 07, 2016, 05:26:23 pm
For the avoidance of doubt, the older 3000A also supports full decode on analogue and digital channels.  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Keysight DanielBogdanoff on April 07, 2016, 05:44:51 pm
For the avoidance of doubt, the older 3000A also supports full decode on analogue and digital channels.  :-+

Yes, correct.

It's also worth noting that if you are looking at a new scope, the MSO is free until September.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on April 07, 2016, 05:46:32 pm
LOL anyone else find it odd that a Keysight/Agilent rep comments in a thread about hacking their device to get upgrades for free? Ha ha
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on April 07, 2016, 05:55:50 pm
I appreciate Daniel's presence and his valuable input. Hope he does not take your comment seriously.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on April 07, 2016, 06:04:16 pm
I appreciate Daniel's presence and his valuable input. Hope he does not take your comment seriously.
What?! Take what seriously exactly?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on April 07, 2016, 06:08:45 pm
Daniel's presence here and on the forum as a whole is indeed appreciated: he has a thicker skin than me that's for sure. Sometimes, things are just better left unsaid though if you know what I mean  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on April 07, 2016, 06:08:59 pm
LOL anyone else find it odd that a Keysight/Agilent rep comments in a thread about hacking their device to get upgrades for free? Ha ha

It is only odd if he was to encourage or help with a hack. In this case it is simply a refreshing change from the stance companies often take.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on April 07, 2016, 06:13:21 pm
LOL anyone else find it odd that a Keysight/Agilent rep comments in a thread about hacking their device to get upgrades for free? Ha ha

It is only odd if he was to encourage or help with a hack. In this case it is simply a refreshing change from the stance companies often take.
Okay. But there was nothing offensive or "warding off" in the statement, so there was nothing "to be taken seriously". It was merely a humorous observation. I too enjoy the different stance they are taking on the matter. But dont forget, as MANY companies in MANY different industries are learning, be electronics, woodworking, guns, photography, crafts, you name it, it is done because it helps sell products. My guess is none of them are going anywhere despite any statements a random person on the internet might make. They are here because their company wants the representation here. Unless that changes, they arent going anywhere.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Keysight DanielBogdanoff on April 07, 2016, 08:10:34 pm
We're good, Ben. I also think it's ironic that I'm present on this thread (and yes, I think I'm using "ironic" correctly  :-//)

Honestly, I'm here with a Keysight username because I want to be here in a professional capacity and I'm in a place here that will make it sustainable. I've lurked for a long time on this blog and other social media sites, but decided to finally take the plunge and create an "official" account.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on April 07, 2016, 08:15:29 pm
We're good, Ben. I also think it's ironic that I'm present on this thread (and yes, I think I'm using "ironic" correctly  :-//)

Honestly, I'm here with a Keysight username because I want to be here in a professional capacity and I'm in a place here that will make it sustainable. I've lurked for a long time on this blog and other social media sites, but decided to finally take the plunge and create an "official" account.
Ironic! Yes thats the term I was looking for, not odd. And glad I didnt offend you, I certainly didnt mean any offense with my post. I think it's kinda cool and forward thinking of a company to remember what it is like on the other side (the consumer/hobbyist side). These days the big selling idea fueled buy what is now coined "The Maker Movement" everyone expected things to be fully open source and its making a lot of startups lots of money doing so when they release new products. Its only a matter of time before all the big dogs join in. Having online representation is IMO a step in that direction. It can only help us all. :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mongo on April 07, 2016, 09:32:48 pm
To be fair, I only responded to this thread because people were wondering what the cable looked like and I had found the thread while researching the current MSOs after my trusty old TEK died, sorry if it derailed the thread but I will give Keysight credit for being willing to respond to a thread of this nature.

sorry if I caused any derailment here.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on April 07, 2016, 09:46:24 pm
To be fair, I only responded to this thread because people were wondering what the cable looked like and I had found the thread while researching the current MSOs after my trusty old TEK died, sorry if it derailed the thread but I will give Keysight credit for being willing to respond to a thread of this nature.

sorry if I caused any derailment here.

I've both seen and perpetrated far worse transgressions of off topicary on this forum!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mongo on April 08, 2016, 12:19:08 am
Hi mongo,

I'll follow up with you on the message you sent us, I'm sorry that the MSO isn't living up to what you need.

Some history on this, when we started shipping the 2000 X-Series scopes there was no decoding at all. After a lot of customer feedback, we enabled serial decoding with the 2.30 firmware release, but the caveat was that the 2000 X-Series only have one of the MegaZoom ASICs. The digital lines and serial decoding use the same block in the ASIC, so it's a physical impossibility to enable the decoding and the digital channels simultaneously.  The 3000T and up have two ASICs, which is why we support that in those scopes. It makes us sad, too.

To avoid any confusion by other readers and googlers, this is not a bad scope and everyone would expect some limitations at this price point.  The problem I had could be fixed with just some edits to the webpage.   here is a screenshot from the click through from the DSOX2012A product page to the DSOX2EMBD option.  With the highlighted text I don't think it is unreasonable for a customer to expect the product to support at least decoding the MISO MOSI and CLK lines on an SPI bus with the MSO upgrade.

Hopefully you can get a (*) put on that page fairly quickly and we will chat outside of this thread.

(http://s17.postimg.org/yegdictv3/Screen_Shot_2016_04_07_at_4_47_12_PM.png)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Keysight DanielBogdanoff on April 08, 2016, 10:46:07 pm
Yes, I'm working with the team here to make sure we are more clear on the web page.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ECEdesign on May 07, 2016, 02:17:33 am
So it seems like this is not a very hard task but I'm having trouble with this.  I have read most of this thread the instructions from Kilobite, plesa, and cassiopeia.  I have not found the files that are talked about or any of this HEX addressing. My scope is running 2.35 and I am using a Mac to try and get a USB drive ready.  I have formatted the USB as exFAT (FAT 16 I believe) and downloaded the 2.35 and 2.39 firmware.  I unpacked the InfiniiVisionSetup using the unarchiver but then I just get a bunch of random files.

 \Secure\infiniiVision\infiniiVisionCore.dll  does not exist from what I can see. I tried to use my windows partition but Win CAB manager isn't around anymore apparently and I don't have very much experience with Windows.  I am much more familiar with mac/linux and can work in the terminal environment pretty well.
Any help would be appreciated I'm pretty lost!


Never mind I figured it out with a little more careful reading and I found a zipfile with the file names.  For any Mac users trying to do this hack, I found an app called Hex Fiend that you can use to edit the .dll files and it worked a treat!  Thanks everyone!  ;D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: giasis on June 05, 2016, 01:04:57 am
I recently scored a cheap dsox2004a in ebay and upgraded the software to 2.35. I've read through the thread (a few times) but I'm stuck unpacking the cab file... I can extract it fine but I don't have a way to do the numerous copies necessary to create the /Secure file structure. I tried installing cab manager 3.0 but the website it gone and all the installers I can find are just bloatware... I work in linux mostly but can run Windows 8.1 in a vm. Does anyone have a python script to unpack the files using _setup.xml?

Thanks,
Elliot


Elliot. Where did you download old 2.35 firmware? It seems that keysight website doesn't provide old version firmware, but the latest one (2.41)?
http://www.keysight.com/main/software.jspx?cc=CA&lc=eng&nid=-32976.973676&id=2014479&pageMode=PV (http://www.keysight.com/main/software.jspx?cc=CA&lc=eng&nid=-32976.973676&id=2014479&pageMode=PV)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on June 05, 2016, 02:28:43 am
There are various links to older firmware in this thread - just tour through it. It makes for good reading too.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: giasis on June 08, 2016, 04:14:03 am
It turns out the link for the old firmware was in the later part of the threads, while I was searching for it in the beginning part. :)
I finally found it! And thanks for all good info Guys. I am super excited.

giasis
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on June 15, 2016, 01:44:13 am
Bumping this thread up.

Just wondering if anyone has further experimented with version 2.41. Being all licenses can be enabled without patching the DLL it seems like the only thing needed is an automatic way to restart the infiniivision.exe or to start it initially with -l all.(if it was linux it would be symbolic link time)
I realize 2.41 can have all options enabled via telnet quite easily but it would be much nicer to have it fully automatic.
I'd experiment myself but my scope has version 2.39 on it which is easy to downgrade etc. If I install 2.41 I will be stuck there. Running the newest firmware would be optimal but not at the expense of the ease of "liberation".

btw, I'd like to offer an "Infiniian" of thanks to all of those who pioneered the early work on this, there is amazing and very useful information in this thread.
To anyone who has an official or basic network card I think running the patched files directly off internal flash is a great option and it lets you run version 2.39.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on June 15, 2016, 07:28:24 am
Bumping this thread up.

Just wondering if anyone has further experimented with version 2.41. Being all licenses can be enabled without patching the DLL it seems like the only thing needed is an automatic way to restart the infiniivision.exe or to start it initially with -l all.(if it was linux it would be symbolic link time)
I realize 2.41 can have all options enabled via telnet quite easily but it would be much nicer to have it fully automatic.
I'd experiment myself but my scope has version 2.39 on it which is easy to downgrade etc. If I install 2.41 I will be stuck there. Running the newest firmware would be optimal but not at the expense of the ease of "liberation".

btw, I'd like to offer an "Infiniian" of thanks to all of those who pioneered the early work on this, there is amazing and very useful information in this thread.
To anyone who has an official or basic network card I think running the patched files directly off internal flash is a great option and it lets you run version 2.39.

Thanks, TheSteve, for your summary post.  I'm in the same boat, so to speak.  I currently have the patched 2.39 booting from flash (I have the official LAN card, and 3000X app bundle so I load just MSO and 500MHz bandwidth options, rather than -l All.)  I find loading the patched firmware from flash most convenient since network access might not always be available (e.g. if working mobile), or I'd prefer not to have a Raspberry Pi hanging on the back. 

I'm not so concerned about the need to downgrade from 2.41, but would prefer a simpler solution for loading options than a restart via an external mechanism (if it were possible).  I really appreciate the great work done [thanks HowardLong and others] in finding a way to boot 2.41 with options --- not having to patch any DLL is a great find and makes some steps much easier!  I may eventually end up going this route since I do have Ethernet where the scope is 90% of the time, and not having any patched DLLs stored in flash permanently has a nice clean feeling to it. :)

If Keysight offered a heavy discount on MSO and BW options (like they did app bundle) I might bite and go above board...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benSTmax on June 20, 2016, 09:38:34 pm
Just bumped into this recently.
I looked for the "WinCE CAB MAnager", however it seems it isn't available anymore?  :-//
Is there another similar tool available?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on June 20, 2016, 09:56:47 pm
Just bumped into this recently.
I looked for the "WinCE CAB MAnager", however it seems it isn't available anymore?  :-//
Is there another similar tool available?

Which part of the process did you need it for? If you unpack the original cab file and run the python script it extracts the inifiniivision.dll etc which you can use.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benSTmax on June 20, 2016, 10:28:06 pm
Thanks.  :-+ I just finished reading the 2nd half of this interesting thread and indeed the python script is the one to use.

and there's also this tool mentioned by kilobyte. I tried it just now and it works
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg912303/#msg912303 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg912303/#msg912303)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on June 20, 2016, 11:23:21 pm
Excellent! Glad to hear you got it sorted out. There is a wealth of info in this thread. I think I've gone through it page by page a few times now.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 09, 2016, 09:29:00 am
Hello!
What's about a real thing - getting some 1GHz 5GSa/s from 100MHz 4GSa/s? Anyone tried that already? I suspect some input circuitry could be different to accomodate new sampling rate. Or even a better grade ADC.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 09, 2016, 08:11:11 pm
Ok, I've found the straps and modified my 100MHz scope to mimic 1GHz 5 GSa model. Of course, it didn't worked as intended.

Setting 5GSa straps on 4GSa board is accepted but software gives out "PLL Unlocked" error. I hope it's a matter of PLL loop or divider setup to enable 5GSa.

1GHz BW is more complicated. Although accepted by software, 1GHz feature is broken. Frontend seem to be much different from it's 200MHz counterpart. I've got 500 ps/div zoom, but 50ohm coupling mode went crazy giving out a blank screen without channel's ground line (like input overload condition). At 1MOhm 700MHz signal was barely seen on the screen with extremely low amplitude due to frontend BW limit and impedance imbalance.

I still think the scope hardware could be carefully modified to turn on 5GSa mode and to improve final bandwidth, at least to 500 MHz.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on July 10, 2016, 12:39:15 am
Certainly sounds like you've found some interesting info. Keysight firmly maintains the front ends are not all the same. For the 3000X series there is a 70/100/200 MHz version, a 350/500 MHz version and a 1 GHz version(with the higher sampling rate).
Of course I've also had Keysight firmly maintain there is a hardware different between a certain model spectrum analyzer's 3 and 6 GHz versions when they are in fact the same.
I have a DSOX3014A I may entertain having a go at the mods with - please do share the strapping info and post pics if possible.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 10, 2016, 06:21:31 am
These series use 8 resistor-divider based analog pinstraps. Each strap configures one integer value in 0-8 interval. I'll annotate and post pictures asap.
Straps are indeed indicate differencies in hardware. For example, with 1GHz version you don't need any license to activate full bandwidth. With 500Mhz version I think no-license BW would be 350Mhz with possible software extension.
The question is how big these hardware differencies are. If it's the matter of passive component values, why not try to change them. Sure, intervention to test and control equipment's sensitive paths is the last thing you would like to do. That's a kind of dirty practice. But for a home use the prize could be quite challenging.

Too bad there are no 3104A teardown photos, heh.

Here are Dave's VCO photos from 3024A (4GSa) and 4024A (5GSa) scopes.
Can you notice the difference between VCO's inductors? 4GSa version is a Coilcraft's 0603CS (?) inductor with a yellow dot. For 5GSa version I can't identify this black V-marked inductor. What do you think about it? Is it Coilcraft's too?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 10, 2016, 07:00:51 am
I've noticed range reduction in 1 GHz mode for 50 Ohm coupling. Its now 1V/div MAX compared to previous 5V/div.
Indeed, following datasheet:
100 MHz ~ 500 MHz models: 1 mV/div to 5 V/div (1 M? and 50 Ohm)
1 GHz models: 1 mV/div to 5 V/div (1 M?), 1 mV/div to 1 V/div (50 Ohm)

50 Ohm coupling must be different in 1 GHz model, that's why I'm loosing signal in 50 Ohm mode. Need to try 500MHz strapping now.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 10, 2016, 08:02:52 am
Here is 3000 series board strapping info. 2000 series and 4000 series are pretty much the same. Pin strapping is done with 8 pairs of resistors. Each pair encode an integer value in 0 to 8 range.
Attached photos were annotated with strap resistor positions. Ln stands for Low (GND) side resistor and Hn is High (2V5) side resistor.
Based on analysis of Dave's teardown photos and my own board I've filled full resistor encoding table and believe it to be correct.
Note the L7 resistor is missing. I think it's routed to external module connector and it's encoding is fixed with 10k ohm high side on the main board.

You can't upgrade your scope just by altering these settings! Strapping represents the real difference in hardware!

Code: [Select]
Strapping resistor encoding
Value - Voltage - Lr/Hr
0 - 0.00V - 10k / none
1 - 0.23V - 10k / 100k
2 - 0.69V - 46,4k / 121k
3 - 0.98V - 64,9k / 100k
4 - 1.25V - 100k / 100k
5 - 1.52V - 100k / 64,9k
6 - 1.81V - 121k / 46,4k
7 - 2.27V - 10k / 100k
8 - 2.50V - none / 10k

Incomplete table of strap functions:
Code: [Select]
Strap 0 (CH 0) Channels:
  0 - 2 Channels
  1 - 4 Channels
Strap 1 (CH 1) Bandwidth
  0 - 100MHz
  1 - 200MHz
  2 - 500MHz
  3 - 1GHz
  4 - 1.5GHz (4000 series only)
Strap 2 (CH 2) Sample Rate:
  0 - 5GSa
  1 - 4GSa
Strap 3 (CH 3) Gating ?
Strap 4 (CH 4) Board Revision ?
Strap 5 (CH 5) Family:
  1 - 3000 series
  2 - 4000 series
  3 - 2000 series
Strap 6 (CH 7) MSO revision ? - not for 4000 series
Strap 7 (CH 6) External module - not for 4000 series:
  0 - LAN
  1 - GPIB
  8 - No External Module

On external module 0 Ohm to GND should set LAN module (pin short on the DIY LAN may be for this strap) and 1k should be for GPIB module.

For experiments you only want to alter Strap 1 and Strap 2 to update the Sample Rate and Bandwidth.
Have fun!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on July 10, 2016, 08:50:32 am
Excellent information - thank you!
It does seem like you could go 100 to 200 MHz without needing to alter the firmware at all, and possibly enable the MSO option. For the MSO it may just change the model number and still require the license though.

I assume you tried leaving the sample rate at 4 and only updating the bandwidth to 500 MHz?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 10, 2016, 09:52:53 am
It does seem like you could go 100 to 200 MHz without needing to alter the firmware at all, and possibly enable the MSO option.
No. My 3014A was already strapped to 200MHz. Straps are set to indicate hardware features. 20MHz hardware BW was downgraded by software to 100 MHz allowing the license-based upgrade.
Same with MSO, MSO strap is always 0 (no other options supported). Looks like it's just a revision of MSO hardware. You need a license to enable it.

My next steps are to try 500MHz strap and to replace VCO inductors. I assume VCO frequency is 1GHz for 4GSa models, so I'll try to set it to 1.25GHz. Bad thing I can't directly check VCO output frequency so 1GHz is just a guess. And inductor's yellow color coding doesn't fit well to that guess.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 10, 2016, 03:22:39 pm
Just tried 500MHz strapping. Results are exactly as expected - 350MHz of reported BW (unlicensed base for 500MHz model).
Real BW at -3 dB is about 240MHz on 50 ohm direct coax. 50 Ohm coupling works well.
Conclusions:
- 500MHz model must have the same input topology with alternative LPF.
- LPF upgrade is required to try to get the real BW.
- 1GHz model differs in input topology at least in 50 ohm portion.
- 5GSa/s mode leads to non-locking PLL (VCO tuning may be required).

100 MHz -> 500 MHz upgrade should be doable. Input filter schematic and component values are to be reversed.
1GHz / 5GSa/s looks to be more complicated but not impossible atm. Need an input stage photos from 1GHz model to see the difference.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on July 10, 2016, 06:01:05 pm
When the DSOX3000A series was released by Agilent it only went to 500 MHz with 4 GS/s. Sometime later they released the 1 GHz model with 5 GS/s. This does back up the theory that there are more significant changes to the 1 GHz hardware. 200 to 500 MHz would already be an amazing upgrade. Finding someone to open a 500 MHz model and take some detailed front end pics/measurements is what we need.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on July 10, 2016, 10:43:11 pm
Finding someone to open a 500 MHz model and take some detailed front end pics/measurements is what we need.
... or a 350 Mhz model, as it is the same hardware as the 500 Mz model, just the firmware is crippling the scope to 350 Mhz.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 11, 2016, 06:59:05 am
4000 series scopes share that 50 Ohm range difference: 5V/div for 100-500MHz and 1V/div for 1-1.5GHz versions.
I doubt they use different PCBs to implement that. Too bad no 1GHz model teardowns were made.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 11, 2016, 07:21:28 am
When the DSOX3000A series was released by Agilent it only went to 500 MHz with 4 GS/s. Sometime later they released the 1 GHz model with 5 GS/s. This does back up the theory that there are more significant changes to the 1 GHz hardware. 200 to 500 MHz would already be an amazing upgrade. Finding someone to open a 500 MHz model and take some detailed front end pics/measurements is what we need.

I did start taking mine apart yesterday, but was short of time. Do I need to take the PSU off, or can you get to the board just by taking off the four screws that hold the back on, then the 8 or 9 T10 screws plus the 2xBNC nuts? That's what I tried but it didn't want to budge much, I then ran out of time.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on July 11, 2016, 07:32:03 am
I haven't pulled my DSOX3014A apart yet to know for sure. I also suspect to know the true differences we'll need to remove the covers from the front ends(something Dave didn't do).

I'm thinking the 100/200 and 350/500 MHz models must only have a few passive part differences between them. I know if we get info on the 350/500 MHz models I have no problem removing the cans from the front ends of my scope to compare detailed notes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 11, 2016, 07:33:36 am
I did start taking mine apart yesterday, but was short of time. Do I need to take the PSU off, or can you get to the board just by taking off the four screws that hold the back on, then the 8 or 9 T10 screws plus the 2xBNC nuts? That's what I tried but it didn't want to budge much, I then ran out of time.
3000 series could be taken apart as easy as 1-2-3. Just screws and BNC nuts and ATX-like power connector. No need to remove PSU or line filter.
If you'll go further to remove the main board, be sure to remove 13 more screws and detach 3 flex cables.
Service guide:
http://cp.literature.agilent.com/litweb/pdf/75019-97084.pdf (http://cp.literature.agilent.com/litweb/pdf/75019-97084.pdf)

What model do you plan to look inside?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 11, 2016, 07:35:57 am
I haven't pulled my DSOX3014A apart yet to know for sure. I also suspect to know the true differences we'll need to remove the covers from the front ends(something Dave didn't do).
I'll remove them on my 3014A and take photos. Too bad you can't read marking off any chip capacitor inside.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 11, 2016, 07:54:03 am
I also suspect to know the true differences we'll need to remove the covers from the front ends(something Dave didn't do).
Do you have a 1GHz scope or SA to check PLL output clock (should be in 500-1000Mhz range)?
PLL is on the top layer, just between two ADC chips. No need to remove the main board.
See the photo (circled). Both single-ended or differential probe will catch the frequency.

That could be acq. clock (1GHz) or memory clock (667MHz) PLL.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 11, 2016, 12:23:55 pm
I did start taking mine apart yesterday, but was short of time. Do I need to take the PSU off, or can you get to the board just by taking off the four screws that hold the back on, then the 8 or 9 T10 screws plus the 2xBNC nuts? That's what I tried but it didn't want to budge much, I then ran out of time.
3000 series could be taken apart as easy as 1-2-3. Just screws and BNC nuts and ATX-like power connector. No need to remove PSU or line filter.
If you'll go further to remove the main board, be sure to remove 13 more screws and detach 3 flex cables.
Service guide:
http://cp.literature.agilent.com/litweb/pdf/75019-97084.pdf (http://cp.literature.agilent.com/litweb/pdf/75019-97084.pdf)

What model do you plan to look inside?

Aha, RTFM! Looks like there's a screw inside the LAN/VGA module receptacle area that I missed.

Unit is MSOX3054A.

I have a 20GHz sampling scope, and a 22GHz spec an, both boat anchors but they should just about cope  >:D

If I get time I'll take a look later today.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 11, 2016, 12:50:54 pm
Unit is MSOX3054A.
Nice! For this scope a closeup photo of anti-aliasing filter would be very useful. You don't need to remove main board or desolder channel frontend shields. At the top of the shielding there are two thick diff traces going to ADC. Just under the shields there are 3-pole filter on these traces: cap + two inductors + another cap. Would be very good to get a sharp photo of these inductors to see a color of their dots and number of turns. There are plenty of room and a big side opening in the input shield.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on July 11, 2016, 02:03:52 pm
I also suspect to know the true differences we'll need to remove the covers from the front ends(something Dave didn't do).
Do you have a 1GHz scope or SA to check PLL output clock (should be in 500-1000Mhz range)?
PLL is on the top layer, just between two ADC chips. No need to remove the main board.
See the photo (circled). Both single-ended or differential probe will catch the frequency.

That could be acq. clock (1GHz) or memory clock (667MHz) PLL.
If it's of any help, that PLL in an MSO X3104A is operating at 625MHz, as detailed here:

  https://www.eevblog.com/forum/blog/eevblog-683-rigol-ds1000z-ds2000-oscilloscope-jitter-problems/msg587159/#msg587159 (https://www.eevblog.com/forum/blog/eevblog-683-rigol-ds1000z-ds2000-oscilloscope-jitter-problems/msg587159/#msg587159)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 11, 2016, 02:34:45 pm
If it's of any help, that PLL in an MSO X3104A is operating at 625MHz, as detailed here:

  https://www.eevblog.com/forum/blog/eevblog-683-rigol-ds1000z-ds2000-oscilloscope-jitter-problems/msg587159/#msg587159 (https://www.eevblog.com/forum/blog/eevblog-683-rigol-ds1000z-ds2000-oscilloscope-jitter-problems/msg587159/#msg587159)

Thanks! Extremely useful. PLL inductor should be in 9-10nH range I suppose?
4GSa models should use 500 MHz then (1/8 of sampling rate). Needs to be confirmed too.
BTW, how did you manage to get register values? SPI bus tap? Any chance you've got some photos of 3104A's main board?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Keysight DanielBogdanoff on July 11, 2016, 06:45:18 pm
Keysight firmly maintains the front ends are not all the same. For the 3000X series there is a 70/100/200 MHz version, a 350/500 MHz version and a 1 GHz version(with the higher sampling rate).

Can confirm that this is definitely the case. There's a hardware difference.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Keysight DanielBogdanoff on July 11, 2016, 06:46:44 pm
I'd also say that we're generally pretty conservative with our bandwidth ratings, so I'm interested to see what bandwidth you guys can coax out of the 70-200 MHz board.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 11, 2016, 07:10:29 pm
I'd also say that we're generally pretty conservative with our bandwidth ratings, so I'm interested to see what bandwidth you guys can coax out of the 70-200 MHz board.
Hello Daniel! Thank you for not being angry at us for all these hardware modifications.
Default 70-200MHz board gives out roughly 240MHz at -3dB level.
I think the board could be pushed to 500MHz level by component replacement but final re-calibration may become be a very serious issue.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 11, 2016, 07:20:28 pm
If it's of any help, that PLL in an MSO X3104A is operating at 625MHz, as detailed here:

5GSa/s done!

Great help MarkL!
I've successfully pushed my board to 5GSa by inductor replacement. I've used 9.1nH Murata LQW18A for a center frequency of 639MHz. Coilcraft 0603CS-10NXGE or Murata's 2% LQW18A 10nH 2% must be the best choice.
Original inductors must be Coilcraft 0603CS-15NX or 0603CS-12NX. 15nH makes more sense for 500MHz output, but I'm sure I see some yellow (not green) dot on them.

Works w/o issues at 5GSa and different donwnsample rates. Time measurements are perfect.

I'm now on chimera with 5GSa/s sample rate and 350MHz software bandwidth. Extra sample rate makes no real sense for this BW, but it's a step forward.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on July 11, 2016, 07:24:29 pm
If it's of any help, that PLL in an MSO X3104A is operating at 625MHz, as detailed here:

  https://www.eevblog.com/forum/blog/eevblog-683-rigol-ds1000z-ds2000-oscilloscope-jitter-problems/msg587159/#msg587159 (https://www.eevblog.com/forum/blog/eevblog-683-rigol-ds1000z-ds2000-oscilloscope-jitter-problems/msg587159/#msg587159)

Thanks! Extremely useful. PLL inductor should be in 9-10nH range I suppose?
4GSa models should use 500 MHz then (1/8 of sampling rate). Needs to be confirmed too.
BTW, how did you manage to get register values? SPI bus tap? Any chance you've got some photos of 3104A's main board?
Sorry, I didn't measure the inductors while I was in there, but I did take some photos.  They're not the greatest quality in terms of lighting.  I've put them here for you (18MB is way beyond the eevblog posting limit):

  http://www.employees.org/~markl/msox3104a_pics.zip (http://www.employees.org/~markl/msox3104a_pics.zip)

Space on that server is fairly limited, so don't expect the file to stick around for more than a week or two.

I captured the SPI bus with either a Saleae Logic 8 or Logic Pro 16; I can't remember which one I pulled out of the drawer.

Great - you figured it out as I was typing this!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 11, 2016, 08:00:11 pm
Space on that server is fairly limited, so don't expect the file to stick around for more than a week or two.
Thanks again MarkL! Fetched that.

(http://www.nooooooooooooooo.com/vader.jpg)
MarkL's photos indicate a sure difference in frontend zone's PCB topology for 1GHz version.
Too bad there are no photos without the shields.

Good news: 500MHz board is the same (but components are not). Hope input ASIC is the same too.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on July 11, 2016, 08:03:09 pm
Amazing progress in a short amount of time. Fingers crossed a 200 to 500 MHz upgrade is possible without extreme part changes.

btw, I do have a spectrum analyzer good to 6 GHz and signal gen to 8 GHz for testing. I have no probe for the spectrum analyzer but am sure a small loop would still pickup the PLL frequency.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 11, 2016, 08:18:17 pm
btw, I do have a spectrum analyzer good to 6 GHz and signal gen to 8 GHz for testing. I have no probe for the spectrum analyzer but am sure a small loop would still pickup the PLL frequency.
PLL part is done thanks to MarkL who reported the exact frequency.
Here is my current chimera (I'll be shy on the serial number for Keysight not to ban my unit for unauthorized mods). Unit is fed with 100Mhz 0 dBm. Note the sampling rate  :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 11, 2016, 08:18:55 pm
FWIW these are the pics of the 3054a. If you open them in photobucket (yes, I know  :-\) then you can get higher definition.

The PLL output was probed with a 1131A with differential browser and MSO7104B, it doesn't look great. It was similar on the sampling scope.

(http://i34.photobucket.com/albums/d123/photobucket391/msox3054a/scope_2_zpsda05hvcq.png) (http://s34.photobucket.com/user/photobucket391/media/msox3054a/scope_2_zpsda05hvcq.png.html)

(http://i34.photobucket.com/albums/d123/photobucket391/msox3054a/P1000271_zpsfbqocv9j.jpg) (http://s34.photobucket.com/user/photobucket391/media/msox3054a/P1000271_zpsfbqocv9j.jpg.html)

(http://i34.photobucket.com/albums/d123/photobucket391/msox3054a/P1000270_zpsteilrplc.jpg) (http://s34.photobucket.com/user/photobucket391/media/msox3054a/P1000270_zpsteilrplc.jpg.html)

(http://i34.photobucket.com/albums/d123/photobucket391/msox3054a/P1000272_zpssygs0ciq.jpg) (http://s34.photobucket.com/user/photobucket391/media/msox3054a/P1000272_zpssygs0ciq.jpg.html)

(http://i34.photobucket.com/albums/d123/photobucket391/msox3054a/P1000273_zpst935c1vc.jpg) (http://s34.photobucket.com/user/photobucket391/media/msox3054a/P1000273_zpst935c1vc.jpg.html)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 11, 2016, 08:21:41 pm
FWIW these are the pics of the 3054a. If you open them in photobucket (yes, I know  :-\) then you can get higher definition.

Awesome! Thank you very much for the clock and amazing photos!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 11, 2016, 08:42:10 pm
Better snap here of the anti aliasing filter, photobucket seems to have dropped the resolution significantly even if you download it rather than use the embedded version. Orginal pics were at 20M pixels.

(http://i34.photobucket.com/albums/d123/photobucket391/msox3054a/P1000272crop_zpsfrsy3zha.jpg) (http://s34.photobucket.com/user/photobucket391/media/msox3054a/P1000272crop_zpsfrsy3zha.jpg.html)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 11, 2016, 08:52:59 pm
Better snap here of the anti aliasing filter, photobucket seems to have dropped the resolution significantly even if you download it rather than use the embedded version. Orginal pics were at 20M pixels.
All I download is 1024 x something, even marked by photobucket as "original".
Last pic is the best btw.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 11, 2016, 09:21:39 pm
Unshielded 200MHz board frontend pictured.
Note the output coils difference on 3054A and this 3014A: 5 wire turns vs. 9 turns. Different cutoff frequency guaranteed.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 11, 2016, 10:09:07 pm
Here is a part of MarkL's photo with the best view to 1GHz front stage.
Looks like a "side ways" of AA filter are partially mounted here.
Would be nice to get any better photos  :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on July 11, 2016, 11:05:47 pm
I have the 1 GHz version MSO-X 3104A and can take some pictures tomorrow.
May be that helps you.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on July 12, 2016, 01:40:50 am
Here is a part of MarkL's photo with the best view to 1GHz front stage.
Looks like a "side ways" of AA filter are partially mounted here.
Would be nice to get any better photos  :)
Hint taken, and I'm willing to take photos of any area you'd like in more detail if you want to describe it.  But if it means unsoldering the front end shield, I'm afraid I'm not up for that.  The scope is in daily use for business and has a service contract.  I don't want to mess with it that much.

Perhaps HighVoltage is braver than I.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 12, 2016, 06:35:58 am
I have the 1 GHz version MSO-X 3104A and can take some pictures tomorrow.

Hint taken, and I'm willing to take photos of any area you'd like in more detail if you want to describe it.  But if it means unsoldering the front end shield, I'm afraid I'm not up for that.

Thanks for your will to help!
Where are still much interesting with the shields intact:
- AA filter in fine details via the top side window (like Howardlong's);
- relays photo from the smaller bottom windows;
- photo of the board's bottom side (need to remove the main board);
- you can also try to read ASIC marking via the top window.

I'm pretty sure 3000 series 200-500MHz boards are trimmed of 1GHz 50 Ohm signal path routing. Like K201 unpopulated relay switching signal to the dead end.
This Dave's photo from 4000 series could be useful as a reference:
https://www.flickr.com/photos/eevblog/8181526726/in/album-72157631997535516/ (https://www.flickr.com/photos/eevblog/8181526726/in/album-72157631997535516/)
That's 200MHz board of 1.5GHz capable series. I think the alternative way for 50 Ohm coupling goes through K201 and further to that big 6 pin through-hole component. K203 may be left unpopulated on 1GHz board.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on July 12, 2016, 10:45:21 am
Works w/o issues at 5GSa and different donwnsample rates. Time measurements are perfect.

I'm now on chimera with 5GSa/s sample rate and 350MHz software bandwidth. Extra sample rate makes no real sense for this BW, but it's a step forward.
Did you measure how hot it gets now? Be careful not to burn up your scope.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 12, 2016, 02:25:24 pm
Did you measure how hot it gets now? Be careful not to burn up your scope.
Nope. 5GSa version use the same heatsinks so I don't bother atm.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 12, 2016, 06:50:39 pm
I've tried to relax output AA filter, but Agilent wins this round. No bandwidth improvement at all. Should be another filter in input path or software-enforced limit.
Maybe some new photos from 3054A or 3104A would show what to do next.
Unshielded input photo seem to be needed too :(
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on July 12, 2016, 08:17:12 pm
How do they do the 20 MHz bw limit? And is the upper end limited in a similar way.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 12, 2016, 08:45:29 pm
How do they do the 20 MHz bw limit? And is the upper end limited in a similar way.
It's 200MHz upper limit, exactly as declared for this board. No low end limit here.

Is it possible to dump all internal files to USB drive on 2.41 without the LAN module? I'd like to examine the filesystem, but some time is required to make a DIY LAN.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on July 12, 2016, 09:21:16 pm
How do they do the 20 MHz bw limit? And is the upper end limited in a similar way.
It's 200MHz upper limit, exactly as declared for this board. No low end limit here.

Is it possible to dump all internal files to USB drive on 2.41 without the LAN module? I'd like to examine the filesystem, but some time is required to make a DIY LAN.

You can switch in a 20 MHz bandwidth limiter though on all versions - is that handled by discrete hardware in the front end, the Agilent branded chip or possibly even in megazoom asic?
And if you buy a 100 MHz scope is the front end still running at the 200 MHz bandwidth or is it limited? I can check that tonight on my scope if needed. If they don't limit it then the only difference would be a timebase setting which seems silly.

You can easily unpack the firmware to take a look at the files on your PC. It is the same steps needed to make a bootable usb drive etc, the info is all in this thread a number of pages back.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jjoonathan on July 12, 2016, 10:43:46 pm
When the Keysight salesman dropped by work a few months ago, he was demoing MSOX4000s (IIRC, might have been higher, out of my price range at any rate) and he mentioned that bandwidth limiting was done by way of a FIR filter in the ASIC, the idea being that you would get a couple extra bits of precision from the high sample rate even if you were using a low-bandwidth model. He was quite specific - FIR filter in the ASIC - although I obviously can't personally vouch for his accuracy.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: nctnico on July 12, 2016, 11:51:07 pm
I doubt they use FIR filtering. It is much easier to accomplish in the analog frontend.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jjoonathan on July 13, 2016, 12:26:07 am
How would you get the extra bit depth from oversampling without one?

I don't doubt that there is bandwidth limiting in the analog front end (last few pages of thread), but wouldn't the extra samples otherwise just contribute noise?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jay_Diddy_B on July 13, 2016, 01:36:28 am
Hi group,

I could see doing the 20 MHz limit with a FIR, but not the scopes bandwidth.

The Tektronix TDS744A and TDS754 are 1GHz scopes, turned down to 500MHz by a filter between the front end and the ADC.

I described this in this thread:

https://www.eevblog.com/forum/testgear/conversion-of-500mhz-tds744a-to-1ghz-tds784a/msg568463/#msg568463 (https://www.eevblog.com/forum/testgear/conversion-of-500mhz-tds744a-to-1ghz-tds784a/msg568463/#msg568463)

Regards,

Jay_Diddy_B

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on July 13, 2016, 04:46:32 am
OK, I verified that a DSOX3014A with a 100 MHz rated bandwidth has its -3dB point right around 130 MHz. If the same scope is then given then 200 MHz license its -3 dB point goes to 230 MHz. This is all rather logical and what we would expect to see. I am sure the behavior of the 350/500 MHz board/models are inline with this. So whatever portion of the circuit is able to switch between 100 and 200 MHz is where we need to look to modify the upper bandwidth limit.
As jumper values are used to set the model bandwidth/minimum displayed timebase but not the actual front end bandwidth it would seem the physical bandwidth limits are "programmed" via resistor/capacitor/inductor in the front end or a different front end ASIC is used for each of the model series and those fixed limits are simply selected via the processor.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on July 13, 2016, 08:24:53 am
As jumper values are used to set the model bandwidth/minimum displayed timebase but not the actual front end bandwidth it would seem the physical bandwidth limits are "programmed" via resistor/capacitor/inductor in the front end or a different front end ASIC is used for each of the model series and those fixed limits are simply selected via the processor.
Right, I doubt too it is in done software. There is no reason for this jumper/resistor ladder to differentiate different models if the information about the model (bandwidth) is available in the software anyway.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 13, 2016, 09:22:52 am
OK, I verified that a DSOX3014A with a 100 MHz rated bandwidth has its -3dB point right around 130 MHz. If the same scope is then given then 200 MHz license its -3 dB point goes to 230 MHz.
I think that software-based bandwidth reduction is made by digital filtering in ASIC.
Still there are frontend BW and system BW. I'll try to measure frontend BW by probing its output.
I hope some new pictures from 3104A or unsheilded 3054A would arrive soon.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 13, 2016, 11:30:14 am
OK, I verified that a DSOX3014A with a 100 MHz rated bandwidth has its -3dB point right around 130 MHz. If the same scope is then given then 200 MHz license its -3 dB point goes to 230 MHz.
I think that software-based bandwidth reduction is made by digital filtering in ASIC.
Still there are frontend BW and system BW. I'll try to measure frontend BW by probing its output.
I hope some new pictures from 3104A or unsheilded 3054A would arrive soon.

When I get a moment I will take it apaaaart again and see how easy it is to remove a shield. Let me know what tests you'd like me to run. I could, for example, try to find out if the 350/500MHz bandwidth switch is implemented at the AFE.

Regarding the 50 ohm path, you mentioned earlier that this is different between various BW versions, what was it that leads you to this conclusion? I am not saying you're wrong, just interested to understand.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 13, 2016, 12:38:39 pm
When I get a moment I will take it apaaaart again and see how easy it is to remove a shield. Let me know what tests you'd like me to run. I could, for example, try to find out if the 350/500MHz bandwidth switch is implemented at the AFE.

Regarding the 50 ohm path, you mentioned earlier that this is different between various BW versions, what was it that leads you to this conclusion? I am not saying you're wrong, just interested to understand.

Shileds are on 4 surface-only solder points (by corners), very easy to unsolder.
Both side photos of unshielded input path would be very useful to check for possible component difference between 200 MHz and 500 MHz versions.

50 Ohm path is different for 1GHz version only. I think something like on this photo:
https://www.flickr.com/photos/eevblog/8181526726/in/album-72157631997535516/ (https://www.flickr.com/photos/eevblog/8181526726/in/album-72157631997535516/)
could be found inside 3104A. K201 and 6-pin through hole relay should be used in 1 GHz 50 ohm path.
500 MHz version use simplified 50 Ohm path via K203. Note that K201 and K203's control paths are the same. So K203 should be unpopulated in 1 GHz version.
Unfortunately 200 - 500 MHz boards miss most of required components and routes. You can examine unshielded photo to see some unpopulated components and even floating pads near input ASIC. Floating pads may indicate that AFE PCB design was imported from full-featured scope version and cut down to remove 1GHz path components.

BTW, I've read through MSO7000 series upgrade thread. Looks like BW hack wasn't finally found for these series.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 13, 2016, 12:53:49 pm
Let me know what tests you'd like me to run. I could, for example, try to find out if the 350/500MHz bandwidth switch is implemented at the AFE.
If you have a sig gen and 1GHz scope with differential probe you can tap AFE's output just before and/or after output AA filter. Try to feed in 100 MHz, 500MHz and 1GHz sine signals of the same amplitude and measure output amplitude. I'll try to do the same on my 200MHz board. I think I'll be able to arrange such setup with an extra scope at the end of the week.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 13, 2016, 09:16:05 pm
From the 3054a. Sorry about the picture quality today, my decent camera seems to be DoA today :-(

(https://cv8qna-bn1306.files.1drv.com/y3mKhTWBsoGV-Wncv_huEgLebHKOyMxwTtvjmLC7tQLtxMMMgexqpkBf5Nt94pAPx1rDWlmUXXodoFqrkzl3qzrKvz013LtQ2pPb2uLkZVfry-h7tHZ0yt5GpkPhP2VaqHttPteD3-Jf_9Qcgn275Wkb_Qw-RHkhiCisCMCsKBMdFU)

(https://cv8ona-bn1306.files.1drv.com/y3mFDmi_S7_9FhgqQLfOmkk41MWEh9NdIoDD94RI3swVwTcc_odlf0owMyvojQgq5l-Ltx6YFyBw9aFbohT41SGE9xyhL-nsjEAiMbT9MID77gkSGS3qpguLaQqj02s4Z1ZD3AAWLSvs9xnoaTTJTsVRnLSNMieP_ByWcLIpE7EQvQ)

(https://cv8nna-bn1306.files.1drv.com/y3m1LUUBU7e--Vc2TXYqvWdi3fPD08kPMMq3oY0--OKHiHCB4OcDqEIiJ0eNYowP5vI7dQ5fazI_TlP4t_9rgY2pdcSI_rQ17QfzRDpDZ4l8H6QMsYkVCUJc1W6UMre7nQeAW1BobRCfD5rXGurPjS8RzxaXT_FEEDymWSxS6rO8n0)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on July 13, 2016, 09:49:06 pm
Excellent pictures Howard - a quick scan shows there is a different value inductor near C520 and a different resistor(2150 vs 1100). The Agilent part # on the ASIC looks to be the same - 2AD2-0001. I am sure there are more differences but those few jumped out at me.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Carrington on July 13, 2016, 10:08:17 pm
I was planning to do the same with my MSO6034A. Now I have a good LCR/Impedance analyzer (see link below) to measure some critical components (inductors). But I need a good RF signal generator.

www.thestuffmade.com/ImpedanceAnalyzer (http://www.thestuffmade.com/ImpedanceAnalyzer)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 13, 2016, 11:02:51 pm
Amazing photos, Howardlong!
Definitely some (filter?) networks are different.

Before I've got your pictures I've used Dave's 3054A backside photo to see different inductors on this big star-shaped network.
After some reversing I've found the top network of C520-inductor-110R and bottom network of R519-inductor-STAR-inductor-162R are switched at C520/R519 end via K502 relay directly to the input BNC, regardless of AC/DC and impedance settings. Interestingly, all 3 capacitor-coupled parts of the star are grounded at capacitor ends.
K502 relay is an attenuation selector. Main 1Mohm signal path goes via the second part of K502.
Just to try I've replaced the inductor near C520 to the lesser one and got zero change in the bandwidth.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Carrington on July 13, 2016, 11:04:07 pm
Is the same ASIC?

(https://www.eevblog.com/forum/repair/keysight-mso7034b-teardown-and-repair/?action=dlattach;attach=234348;image)

Source: https://www.eevblog.com/forum/repair/keysight-mso7034b-teardown-and-repair/msg964822/#msg964822 (https://www.eevblog.com/forum/repair/keysight-mso7034b-teardown-and-repair/msg964822/#msg964822)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 13, 2016, 11:07:09 pm
I think I'll need to determine capacitor values in these C520/R519 networks and replace everything: resistors, inductors and caps.
The problem is I don't understand the schematic and purpose behind these C520/R519 things.

Is the same ASIC?

Yep, that's the same ASIC.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Carrington on July 13, 2016, 11:20:13 pm
A simulation can give you some ideas. But yes, you need the correct values.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 13, 2016, 11:21:44 pm
From the 3054a.

Do you have any means to measure capacitors? Without desoldering ofc.
Could you please measure C520 and star's capacitors?

Without desoldering I've got (using Mastech MS8910 handheld smd tester):
C520 - 590pF
star center cap - 18 pF
star rays caps - all 39pF (maybe that's a sum).

A simulation can give you some ideas. But yes, you need the correct values.

Nice! Did you measured the caps or that's some guessed values?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on July 14, 2016, 12:49:09 am
I have the 1 GHz version MSO-X 3104A and can take some pictures tomorrow.

Hint taken, and I'm willing to take photos of any area you'd like in more detail if you want to describe it.  But if it means unsoldering the front end shield, I'm afraid I'm not up for that.

Thanks for your will to help!
Where are still much interesting with the shields intact:
- AA filter in fine details via the top side window (like Howardlong's);
- relays photo from the smaller bottom windows;
- photo of the board's bottom side (need to remove the main board);
- you can also try to read ASIC marking via the top window.

I'm pretty sure 3000 series 200-500MHz boards are trimmed of 1GHz 50 Ohm signal path routing. Like K201 unpopulated relay switching signal to the dead end.
This Dave's photo from 4000 series could be useful as a reference:
https://www.flickr.com/photos/eevblog/8181526726/in/album-72157631997535516/ (https://www.flickr.com/photos/eevblog/8181526726/in/album-72157631997535516/)
That's 200MHz board of 1.5GHz capable series. I think the alternative way for 50 Ohm coupling goes through K201 and further to that big 6 pin through-hole component. K203 may be left unpopulated on 1GHz board.
Ok, here ya go:

  http://www.employees.org/~markl/msox3104a_pics_2.zip (http://www.employees.org/~markl/msox3104a_pics_2.zip)

The photos of the back are right half, left half, then 6 more zoomed in on a 2x3 grid.  And then a final closeup of a front end from the back (picked Ch4) since that's of most interest.

The relay photo might be a little hard to read and it was impossible to get a clean shot of the second one.  But they're both Panasonic AGQ210S4H (qty 2 per channel).

There's a large metal encased something, 6-pin thru hole device under the shield (img_4238.jpg).  The number must be on the top.  It's connected to the 50 ohm terminator and is numbered K504, K404, etc.  Very likely it's the relay for the terminator.  I don't see it in the 500Mhz and less photos.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 14, 2016, 01:07:46 am
There's a large metal encased something, 6-pin thru hole device under the shield (img_4238.jpg).  The number must be on the top.  It's connected to the 50 ohm terminator and is numbered K504, K404, etc.  Very likely it's the relay for the terminator.  I don't see it in the 500Mhz and less photos.

Whoa! Exactly as expected, completely different 50 Ohm signal path.
Big through hole device must be a Teledyne GHz attenuator relay.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Carrington on July 14, 2016, 07:57:40 am
Do you have any means to measure capacitors? Without desoldering ofc.

Not a good idea, is better measure everything off the board.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 14, 2016, 09:24:11 am
Yes, measured from a DSO610xA.
Was you able to improve BW on your scope?

Not a good idea, is better measure everything off the board.
I can't ask people to unsolder their scopes into pieces. Also, that's not absolutely necessary for the task.

BTW, I've tried to do some semi-random mods on these networks and got zero change in the BW. Current -3dB frequency is so stable so I'm almost sure it's limited by the software.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 14, 2016, 10:13:03 am
How are you starting the firmware, and what version? Do you have a LAN card so you can telnet into the unit?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 14, 2016, 10:34:14 am
From the 3054a.

Do you have any means to measure capacitors? Without desoldering ofc.
Could you please measure C520 and star's capacitors?

Without desoldering I've got (using Mastech MS8910 handheld smd tester):
C520 - 590pF
star center cap - 18 pF
star rays caps - all 39pF (maybe that's a sum).


I'm not too averse to desoldering to measure, I have a pretty decent E12 stock of Ls (WW as well as ML), Cs and Rs in stock if necessary. In the event of disaster, there's always another channel ;-)

I do have a Keysight U1733C LCR with SMD tweezers, and a pair of Smart Tweezers. The Keysight will measure nH, but not accurately single figure nH, and certainly not in circuit (I tried!). If necessary for the low value Ls I can put the part a calibrated test fixture and measure on a VNA. I suspect that from the coloured dot and # of turns we can ascertain the L values anyway. Lifted Cs are very easy to measure.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 14, 2016, 11:09:25 am
How are you starting the firmware, and what version? Do you have a LAN card so you can telnet into the unit?
ATM I don't have a LAN and my FW is 2.41.
I've never touched the software part yet.
I think I'll replicate most of the values from your photos on one of the channel and try to directly measure ASIC output bandwidth with another scope. I don't think the ASIC itself could be digitally controlled for BW limit.

I'm not too averse to desoldering to measure, I have a pretty decent E12 stock of Ls (WW as well as ML), Cs and Rs in stock if necessary. In the event of disaster, there's always another channel ;-)
Nice! You seem to have a great reverser's setup. Although I feel I maybe asking too much about desoldering.
I don't think inductors needed be measured since they are marked and you can tell their value by both marks and number of wire turns. But capacitors are real headache. I can't measure single pF's accurately.

BTW, what do you think about these C-L-R networks? Are they some kind of feedback paths? I don't think they are direct signal paths.
Also, did you notice difference in MarkL's 1GHz AA filter? They use a kind of parallel path C-R path in addition to usual LC ladder scheme.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 14, 2016, 03:50:25 pm
BTW, what do you think about these C-L-R networks? Are they some kind of feedback paths? I don't think they are direct signal paths.

They are balanced filters, as opposed to single ended ones.

Quote
Also, did you notice difference in MarkL's 1GHz AA filter?

Hmm, that's a bit scary. It seems unlikely to be a simple upgrade to 1GHz in that case. 1GHz on a HiZ input is of little value, most high speed probing systems are 50 ohm.

Quote
They use a kind of parallel path C-R path in addition to usual LC ladder scheme.

It looks like it's just trying to boost the HF end a bit. What's nice to see is that they do what I do in these situations with lumped filters, model a reasonable attempt but leave plenty of optional pads for improvement after the spin for the real world.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 14, 2016, 04:05:30 pm
Before I disassemble the scope and lift the shield again, can you identify all the parts you need to know?

Lifting the shield isn't hard but it's a bit fiddly and time consuming as the gap between shields doesn't leave much room to get a decent amount of localised heat on the mounting joints.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 14, 2016, 04:27:23 pm
Before I disassemble the scope and lift the shield again, can you identify all the parts you need to know?

Hmm, should I be greedy or conservative?
Please look at attached photos. Red dots are for possibly critical components, yellow it for just interesting.
Top layer: 5 red, 4 yellow.
Bot layer: 4 red, 3 yellow.
Fell free to discard yellow comps if that would take too much time.

Thanks in advance!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on July 14, 2016, 04:48:00 pm
How are you starting the firmware, and what version? Do you have a LAN card so you can telnet into the unit?
ATM I don't have a LAN and my FW is 2.41.
I've never touched the software part yet.
I think I'll replicate most of the values from your photos on one of the channel and try to directly measure ASIC output bandwidth with another scope. I don't think the ASIC itself could be digitally controlled for BW limit.

I'm not too averse to desoldering to measure, I have a pretty decent E12 stock of Ls (WW as well as ML), Cs and Rs in stock if necessary. In the event of disaster, there's always another channel ;-)
Nice! You seem to have a great reverser's setup. Although I feel I maybe asking too much about desoldering.
I don't think inductors needed be measured since they are marked and you can tell their value by both marks and number of wire turns. But capacitors are real headache. I can't measure single pF's accurately.

BTW, what do you think about these C-L-R networks? Are they some kind of feedback paths? I don't think they are direct signal paths.
Also, did you notice difference in MarkL's 1GHz AA filter? They use a kind of parallel path C-R path in addition to usual LC ladder scheme.

I think you need to get a LAN card - you could then easily switch between 100 and 200 MHz bandwidth and probe to see where the bandwidth is actually changing.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 14, 2016, 05:55:34 pm
I think you need to get a LAN card - you could then easily switch between 100 and 200 MHz bandwidth and probe to see where the bandwidth is actually changing.
I expect to make a DIY board in a week.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 14, 2016, 06:36:49 pm
WOW, thanks guys for this thread resurrection, quite amazing findings.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tonyc on July 14, 2016, 09:15:52 pm
How are you starting the firmware, and what version? Do you have a LAN card so you can telnet into the unit?
ATM I don't have a LAN and my FW is 2.41.
I've never touched the software part yet.
I think I'll replicate most of the values from your photos on one of the channel and try to directly measure ASIC output bandwidth with another scope. I don't think the ASIC itself could be digitally controlled for BW limit.

I'm not too averse to desoldering to measure, I have a pretty decent E12 stock of Ls (WW as well as ML), Cs and Rs in stock if necessary. In the event of disaster, there's always another channel ;-)
Nice! You seem to have a great reverser's setup. Although I feel I maybe asking too much about desoldering.
I don't think inductors needed be measured since they are marked and you can tell their value by both marks and number of wire turns. But capacitors are real headache. I can't measure single pF's accurately.

BTW, what do you think about these C-L-R networks? Are they some kind of feedback paths? I don't think they are direct signal paths.
Also, did you notice difference in MarkL's 1GHz AA filter? They use a kind of parallel path C-R path in addition to usual LC ladder scheme.

I think you need to get a LAN card - you could then easily switch between 100 and 200 MHz bandwidth and probe to see where the bandwidth is actually changing.

How do you switch from 100 to 200Mhz with a LAN card?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 14, 2016, 10:20:39 pm
How do you switch from 100 to 200Mhz with a LAN card?

there are BW comandline parameters, for instance BW50 switch bandwidth to 500MHz.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 15, 2016, 09:06:29 am
i have that file still localy and remote on hotfile

https://hotfile.com/dl/131446259/df706bb/3000XSeries.01.10.2011031600.cab.html

Do someone still have this file or url to download it?
Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 15, 2016, 09:33:48 pm
I have the 1 GHz version MSO-X 3104A and can take some pictures tomorrow.
May be that helps you.

Any news by the chance?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on July 15, 2016, 09:53:46 pm
Will try my best to get to it in the next two days
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 15, 2016, 10:00:56 pm
Can confirm that this is definitely the case. There's a hardware difference.
Not sure if I have the right to ask, but I'll try  ;)
What's the difference between factory and user calibration for 3000-series? Do I need to use high-grade BNC cables and fixtures for user calibration? How critical are they?

Are there any factory-only calibrations I can ruin so hard so user calibration won't help to recover accuracy?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 16, 2016, 03:35:18 am
http://www.filedropper.com/3000xseries01102011031600 (http://www.filedropper.com/3000xseries01102011031600)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 16, 2016, 07:52:34 am
http://www.filedropper.com/3000xseries01102011031600 (http://www.filedropper.com/3000xseries01102011031600)
:-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on July 17, 2016, 12:37:21 pm
Ok, I took my Agilent MSOX-3104A apart
Here are the pictures.
Is this what you are looking for?
Any details I need to look for?
Anything in detail that needs to be taking pictures of?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on July 17, 2016, 12:45:56 pm
more
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on July 17, 2016, 12:47:46 pm
And more....

By removing the can, I think I lifted one of the ground pads.
Solderwick did not help to remove all the solder
I had to add some leaded solder to make it flow easier
Hopefully this is not a problem for the re-Assembly

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on July 17, 2016, 12:49:11 pm
And here are some details from under the can.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wiljan on July 17, 2016, 02:27:55 pm
For those who want to see how to disassemble the 2000/3000 and who want to some details on boards difference have a look in the part list in this pdf.

"Agilent 2000/3000 X-Series Oscilloscopes Service Guide http://cp.literature.agilent.com/litweb/pdf/75019-97038.pdf (http://cp.literature.agilent.com/litweb/pdf/75019-97038.pdf)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 17, 2016, 03:37:40 pm
And here are some details from under the can.

Thank you!
Could you please confirm top marking on this SOT-23 device (see attachment)?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on July 17, 2016, 04:09:26 pm
More details
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on July 17, 2016, 04:11:43 pm
Looking at my own pictures, I am surprised how many fibers are hanging there on the components.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 17, 2016, 04:31:18 pm
More details

Amazing! Thank you!
Looks like it would be possible to boost any board to 1GHz. This will require building of additional circuit around Teledyne attenuator relay.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on July 17, 2016, 05:14:01 pm
So, I can re-assemble my scope?
Or do you need anything else, while it is open
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 17, 2016, 06:02:03 pm
So, I can re-assemble my scope?
Or do you need anything else, while it is open
Sure. I don't think anything else is needed.
Thank you very much for your help!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 17, 2016, 07:11:21 pm
Just completed upgrade to 500MHz on one channel.

Since I don't have a license for 500MHz, my scope became 350MHz.
Effective -3 dB bandwidth is ~400 MHz now. Tested on periodic signal only.
I'll try a 500MHz license command line option later when I'll get possibility to change command line in software.

My next steps are to document changes and revert the scope back to 4GSa/s.
200->500MHz upgrade seems to be easy for anyone with decent smd soldering skill. Upgrade price is negligible as only cheap passive components are to be replaced.

Later I'll continue research on 200MHz -> 1GHz upgrade, as it was my original goal (I want to get good DDR3 debugging capabilities).
For sure 1GHz upgrade its going to be for real nerds only since required components are not routed on the board.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on July 17, 2016, 07:15:36 pm
Okay this is seriously impressive, well done!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on July 18, 2016, 09:32:23 am
It works again,
- 500 ps rise time
- 2 ns fall time
Both are the same as before I opened the case and can.

And the seal is not even broken.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 18, 2016, 10:08:13 am
Nice to hear your scope is OK after reassembly!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 18, 2016, 06:29:22 pm
I've updated all channels now to 500MHz with ch 4 left for experiments on 1GHz BW.
I'm surprised how I see 2nd Nyquist frequency on this channel.

Can someone with 3104A (1GHz model) and 3054A (500 MHz model) and a 2.5GHz signal generator try to do a test:
- connect sig gen to one input via direct coax;
- select 50Ohm coupling and turn on both adjacent channels (1 & 2 or 3 & 4) to get half of the sampling freq (2GS/a or 2.5GSa/s) on each channel;
- set sig gen to 10 MHz 0 dBm and make sude incoming signal is ~220mV RMS;
- set sig gen to: 2010 MHz for 3054A and 2510 MHz for 3104A.
- can you see anything like an untriggered 10MHz signal at 5mV/div? If yes, stop acquisition and get an RMS reading.

Note: even on 2GSa/s you'll need to use 2010MHz, not 1010MHz due to specific ADC.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 18, 2016, 06:50:57 pm
Also I need to note my trigger went a little crazy displaying some voltage and/or time offset compared to displayed signal.
Hope user calibration will be able to fix it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on July 18, 2016, 07:20:34 pm
Ok, Up to your part with the 10 MHZ I got it done and 220 mV RMS confirmed on Channel 2.

But where would you expect the un-triggered 10 MHZ at Channel 1 and Channel 3?
While the Channel 2 will get 2510 MHz on the input?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 18, 2016, 07:29:27 pm
Ok, Up to your part with the 10 MHZ I got it done and 220 mV RMS confirmed on Channel 2.

But where would you expect the un-triggered 10 MHZ at Channel 1 and Channel 3?
While the Channel 2 will get 2510 MHz on the input?

Thank you for the test! I expect in on the same channel, ch 2 in your case. Very little amplitude. Just keep ch 1 on to downgrade sampling rate.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on July 18, 2016, 07:42:05 pm
Ahh, ok.

Well there seems to be a 10 MHz signal in the hiding
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 18, 2016, 08:01:26 pm
Well there seems to be a 10 MHz signal in the hiding
Oh, thanks for the test!
Now I better understand why they use 5GSa/s on 1GHz model. 1GHz's output LPF is slow fading. For 4 GSa's 2010 MHz signal can clearly be seen via 1 GHz-like filter. It's much better at 2510 MHz - almost nothing could be seen.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 19, 2016, 07:42:49 pm
Also I need to note my trigger went a little crazy displaying some voltage and/or time offset compared to displayed signal.
Hope user calibration will be able to fix it.

A follow-up for the previous info: after user cal trigger is back to normal timing.
Still I can see how the signal curve fluctuates around trigger point as I change test signal frequency from 10MHz to 350MHz. Total drift is about 1ns. Can't say yet if it's normal or not because all my channels are now modified. Could be result of unexpected phase response of the new filters. Need to check pulse response to see the edge.
Also I see some BW decrease after user cal. It was like 400MHz at -3 dB level. Now its 360MHz at -3dB level.

My user cal fixture was of awful quality and scope remained in a half-disassembled state. I'll rerun user cal after the scope is fully reassembled, shielded and equipped with better user cal fixture. That's my last chance to improve accuracy.

Anyway, I consider 500 MHz upgrade to be done, although it would possibly compromise scope's accuracy  :-BROKE
Will post upgrade details asap.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 19, 2016, 08:14:19 pm
Let me know if you want any trigger tests on a kosher unit. 1ns is quite a way out.

In addition, I'd see how you get on with -bw50.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 19, 2016, 09:19:14 pm
As expected from Agilent/Keysight, they seem to use top-notch components in sensitive paths. I've used random quality parts from several local shops, like unknown tolerance caps from unnamed sources, etc.
I'll redo the mod using better components when I'll get them in hands. That should improve results a bit.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 20, 2016, 02:02:58 pm
3000A-series 200MHz board to 500MHz board upgrade how-to.
Similar procedure can be applied to 3000T and 4000A series.

To extend 100/200MHz board to 350/500MHz you'll need to perform serious hardware modification of the main board.
Decent SMD soldering skill and soldering equipment are required to perform this modification.
Thus, it's not recommended to try this mod unless you're really desperate to get extra bandwidth.

This is a description of hardware modifications on sensitive signal paths of the scope!
Applying any of these mods will void your warranty and calibration!
Loss of factory calibration and accuracy is inevitable!
DISCLAIMER: do this at your own risk only! Irreversible damage may be caused by these modifications. You've been warned!

Required materials for 4-channel models:
1. Coilcraft 0603CS-15NXG 0603 15nH 2% inductors - 12 pcs
2. Coilcraft 0603CS-27NXG 0603 27nH 2% inductors - 4 pcs
3. 0603 2.2pF NP0 capacitors - 4 pcs
4. 0603 2.0pF NP0 capacitors - 4 pcs
5. 1206 110R 1% resistor - 4 pcs
6. 0603 162R 1% resistor - 4 pcs
7. 0603 121K 1% resistor - 1 pcs
8. 0603 46.4K 1% resistor - 1 pcs

User cal fixture is required for post-modification calibration.

BACKUP NOTE: save all removed components in separate places for each position and channel to secure way back to original values!

Modification process (see attachments for pictures):
1. For each channel replace yellow-marked parts as follows:
AFE top layer (afe_top_layer_mod.jpg):
L1: 100nH(?) -> 15nH
R1: 215R -> 110R
L2, L3: 47nH(?) -> 15nH
C1: 4.7pF -> 2.2pF
C2: 4.7pF -> 2.0pF
AFE bottom layer (afe_bot_layer_mod.jpg):
L4: 100nH(?) -> 27nH
R2: 261R -> 162R
2. Replace two board strap resistors:
Top layer near CPU (gnd_straps.jpg):
Strap resistor L1: 10K -> 46.4K
Bottom layer under CPU (2v5_straps.jpg):
Strap resistor H1: 100K -> 121K

NOTE: all capacitor values are guessed or measured and may not be 100% correct.

Run a brief per channel check of scope functionality before fully reassembling the scope. For a final assembly be sure to mount all shields and covers. Run User cal procedure with a high-quality user cal fixture to compensate replacement of AFE components.
Done, you'll get a 350MHz scope. 350MHz to 500MHz upgrade is software-only and possibly discussed elsewhere.

I'd like to thank all eevblog members who contributed to this mod with their knowledge and time and did measurements on their scopes.
This wouldn't be possible without their kind help.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on July 20, 2016, 08:06:11 pm
Thank you for your efforts memset and to those who bravely opened up their scopes.

I was pondering a few things though before I order parts.

The resistor values are obviously all correct.
There are only two caps per channel that are changed which is pretty minimal - I was thinking of ordering several capacitor values around 2 to 2.2 pF so I can experiment if needed.
The inductor values appear to be easy to determine based off the color dot but am wondering how you decided on the CS series of parts versus say the HP series.

Do you see any value in upgrading the sample rate from 4 to 5 GS/s?

Lastly I am hoping Howard can do one more favor for us and that is to measure the 3dB point of his scope at both 350 and 500 MHz bandwidths so we know exactly what we should be aiming for.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 20, 2016, 08:40:33 pm
There are only two caps per channel that are changed which is pretty minimal - I was thinking of ordering several capacitor values around 2 to 2.2 pF so I can experiment if needed.
The inductor values appear to be easy to determine based off the color dot but am wondering how you decided on the CS series of parts versus say the HP series.

Do you see any value in upgrading the sample rate from 4 to 5 GS/s?

Lastly I am hoping Howard can do one more favor for us and that is to measure the 3dB point of his scope at both 350 and 500 MHz bandwidths so we know exactly what we should be aiming for.

If you're up to perform the mod, sacrifice single less-used channel first to check results. But I think you'll need to modify all channels to run user cal with meaningful results. And w/o user can the scope won't behave properly.
For caps I'm not even sure in that 2.2pF/2.0pF difference. These caps well may be the same value ranging from 1.8pF to 2.2pF.
About inductors, CS series is just a guess. For <500MHz range HP shouldn't have any real preference. But if you'll buy both and try to find any visible difference between them we'll maybe able to distinguish them better. As for me I've used Murata LQW18A series because Coilcraft wasn't available in local stores.

On -3dB BW, right after the mod I've got 400MHz at -3dB. After user cal BW has been decreased to 360MHz (no 500MHz license in my scope). I have no idea why.

Do you see any value in upgrading the sample rate from 4 to 5 GS/s?
I don't think its a good idea for 500MHz BW because there are no such model in 3000 series and its software may behave erroneously in such a chimera. But you can give it a try if you want. It works.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 20, 2016, 09:21:28 pm
Thank you for your efforts memset and to those who bravely opened up their scopes.

I was pondering a few things though before I order parts.

The resistor values are obviously all correct.
There are only two caps per channel that are changed which is pretty minimal - I was thinking of ordering several capacitor values around 2 to 2.2 pF so I can experiment if needed.
The inductor values appear to be easy to determine based off the color dot but am wondering how you decided on the CS series of parts versus say the HP series.

Do you see any value in upgrading the sample rate from 4 to 5 GS/s?

Lastly I am hoping Howard can do one more favor for us and that is to measure the 3dB point of his scope at both 350 and 500 MHz bandwidths so we know exactly what we should be aiming for.

2pF and 2.2pF were measured out of circuit and cross checked using three testers, and Agilent U1733C with SMD tweezers at 100kHz, Smart Tweezer ST5L at 10kHz and a Peak LCR40 at 200kHz with SMD tweezers. Parasitic capacitances on the measurement probes were either nulled out or measured and subtracted from result. There could reasonably be a 5 or even 10% tolerance mismatch there.

I also measured one of the inductors to align with the Coilcraft colour dot codes, and the CS and HP (the CS and HP series seem to share the same colour coding) were the closest correlation. Other series did not correlate with the measurements.

3dB 500MHz bw: 584MHz
3dB 350MHz bw: 377MHz

Measured with HP 8656B 2Vpp, 2m Suhner RG58-sized BNC-BNC cable, and averaging 8 acquisitions. Scope settings 50 ohm, 500mV/div and 1ns or 2ns/div depending on bandwidth limitation.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 20, 2016, 09:37:37 pm
Rise times:

500MHz: 640ps
350MHz: 970ps

Source is HP 54121T in TDR mode with system rise time measured at 33ps.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on July 20, 2016, 09:44:20 pm
Thank you for the information guys. It is very tempting to use Murata inductors here as well. I can buy them direct from Digikey for 10% of the price of Coilcraft who insist anyone in US/Canada must order direct from them.
Ideally I'd like to see if I can match Howard's 3dB numbers and then provide the exact manufacturer/part number for each part I used for others who want to do the mod. I will order the resistors/capacitors from Digikey either way so I may throw the Murata parts in the order, all of them are only a few dollars.

Once the bandwidth mod is done I may experiment with the 5 GS/s mod as well. The 3000t series uses 5 GS/s on all models. Obviously stable performance is the most important aspect of the mod.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on July 22, 2016, 04:48:17 pm
I've ordered all of the parts needed for the mod. I also ordered the parts needed to build a Jim Williams pulse generator so I can check rise times as well as 3dB bandwidth with a signal gen. Already had the parts in stock to build the needed BNC patch cables to run user calibration.
I can hopefully build the pulse gen this weekend and then do the scope mod the following weekend once the Coilcraft order arrives.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 22, 2016, 06:51:47 pm
Meanwhile I've tried 500MHz mode and it works well.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 23, 2016, 04:43:08 pm
I have a quick comment about reworking these high impedance front ends.

Avoid cleaning the board with anything more than the absolute minimum of IPA or flux cleaner/solvent, and any you do use scrub it off with qtips etc, because residues are conductive enough to very significantly affect things like DC offsets. Once it's found itself inside shelters like relays, it will take a long time to evaporate.

Put some IPA into a small petri dish or other contianer and measure it with your DMM. If you're probing two close pins the resistance can drop to low single digit meg ohms.

Let's just say I discovered that the hard way, and it took a long time for the penny to drop.  :'(
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 23, 2016, 06:44:36 pm
I've done some research on how to install arbitrary command line without having the lan module on version 2.41 and came to this simple solution.
This solution will add extra lnk file to the internal ROM to alter the startup process.
That's quite dangerous because you can brick your unit by copying overlong or incorrect lnk file. Prepare lnk file carefully!
I wasn't able to find something different because USB boot is incapacitated in v2.41.

As v2.41's boot process differ from older softwares, this method fits v2.41 ONLY.

Readily included lnk file contains no command line.
Add any options you need, but READ THE INSTRUCTIONS FIRST.

This method works via running supplied 3ka_v241_linkinstall.cab file as software update.
NOTE: supplied .cab file mimics software update process, but contains NO original proprietary files from authentic software update packages.
DISCLAIMER: Use at your own risk only. No one else is responsible for what you do with this software.

!!! READ BEFORE USE !!!
!!! 3000A v2.41 ONLY ! 3000A v2.41 ONLY ! 3000A v2.41 ONLY !!!


"3ka_v241_linkinstall.cab" file is made to install extra link file into internal ROM's filesystem.
For v2.41 this will enable firmware to run with arbitrary command line string.

Applying this mod to any software prior to v2.41 may lead to unpredictable consequences.
DO NOT use with older software!


Integrity check for cabinet file:
2b75c5ecaecd0837ec8cbd819715a907951bb119  3ka_v241_linkinstall.cab

Code: [Select]
How to install extra link to run firmware with custom command line:
------------------------------------------------------------------
1. Prepare infiniivision.lnk: add desired command line options after .exe file name and recalculate string length.
   lnk format: N#\path\to\file.exe -command_options
   N is 2-3 digits of length value of the following string, including '#' char.
   After lnk file contents are edited replace N with corrent number.
   Maximum lnk file size is 260 bytes including size field itself. Do not exceed this value!
   !!! WARNING Maximum lnk file size is 260 bytes total !!!
   !!! WARNING Incorrect lnk file contents may brick your unit !!!
2. Copy 3ka_v241_linkinstall.cab and infiniivision.lnk to the root folder of USB drive.
3. Insert USB drive to the unit and run software update process. Wait until device reboot.
   !!! WARNING It's extremely dangerous to run cab files from unknown sources as they may contain malicious instruction to the unit !!!
4. Unit should reboot and work with extra warning about Unfinalized software.

How to remove extra link to revert to original firmware startup:
---------------------------------------------------------------
1. Copy 3ka_v241_linkinstall.cab to the root folder of USB drive.
2. Delete infiniivision.lnk from the root folder of USB drive or make sure it's not present there.
3. Insert USB drive to the unit and run software update process. Wait until device reboot.
4. Unit should reboot and work without any extra warnings.

Troubleshooting:
----------------
1. The hardest problem would be incorrect lnk file leading unit to hang on boot (brick!).
It's only possible to solve that by connecting to the unit via Telnet and removing that incorrect link file:
del \f \Secure\Startup\infiniivision_ext.lnk
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 23, 2016, 07:28:37 pm
I've done some research on how to install arbitrary command line without having the lan module on version 2.41 and came to this simple solution.
....

Wow!

My infiniivsion.lnk (edit: on an MSOX3054a)
Code: [Select]
63#\secure\infiniivision\infiniivisionlauncher.exe -l all -l bw50
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tonyc on July 23, 2016, 08:28:13 pm
This is really awesome!

I have to specify SCPIPS manually after the -l all argument. Here is my command:

72#\Secure\infiniiVision\infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tonyc on July 23, 2016, 08:38:57 pm
Hi Folks,
Does anybody know what kind of Windows CE version and SDK that the 3000 series scope uses? I am interested in hack to scope to run my own code. One example I had in mind is to write a program to enable telnet over USB connection.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on July 24, 2016, 12:29:42 am
Top work memset, you continue to impress!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 24, 2016, 05:26:35 am
Hi Folks,
Does anybody know what kind of Windows CE version and SDK that the 3000 series scope uses? I am interested in hack to scope to run my own code. One example I had in mind is to write a program to enable telnet over USB connection.

It is CE Embedded 6.0.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 24, 2016, 10:19:22 am
Does anybody know what kind of Windows CE version and SDK that the 3000 series scope uses?
2000, 3000, 4000 series are Microsoft Windows CE 6.0 R3 based. BSP for SPEARHEAD600 CPU is from Adeneo (not public).
6000 model runs Microsoft Compact Embedded 7 (WINCE7) on i.MX6 CPU.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wiljan on July 24, 2016, 06:11:04 pm
Nice to see new progress here  :)

!!! READ BEFORE USE !!!
!!! 3000A v2.41 ONLY ! 3000A v2.41 ONLY ! 3000A v2.41 ONLY !!!


Will this work for MSO-X2014A V2.41 as well?
or will there be a need to a 2ka_v241_linkinstall.cab version?

Thank you
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on July 24, 2016, 06:35:12 pm
I've done some research on how to install arbitrary command line without having the lan module on version 2.41 and came to this simple solution.

Incredible work, memset!   This seems to be the "holy grail" method to activate options when upgraded firmware to v2.41, which until now would require LAN module to telnet into scope after it boot.  I will look forward to testing this out! :D

Best,
Sparky
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 24, 2016, 07:12:44 pm
Will this work for MSO-X2014A V2.41 as well?
or will there be a need to a 2ka_v241_linkinstall.cab version?

Hmm. This should work on 2000X as well, but I can't be sure about it. I don't have 2000 so it's not tested.
If you'd like to try, make sure you have a LAN module ready to undo changes via telnet if something goes wrong.
Generally, lnk file contents should be the same as for 3000A series.

For sure this cab should NOT work on 3000T and 4000X / 6000X series because of different version requirements.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on July 25, 2016, 04:36:57 am
So for those of you who have 2.41 and a dsoxlan card it looks like you could just copy the .lnk file you make from the USB drive to \Secure\Startup\infiniivision_ext.lnk using telnet or use memset's cab file upgrade.
At this point it is looking like there isn't too much incentive to stay on 2.39 or older unless you want to be able to boot directly from a USB drive.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wiljan on July 25, 2016, 07:25:27 pm
Just installed the usb update lnk file from memset on DSOX2014A and it works great on v2.41.Thx 😀
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 26, 2016, 07:37:59 am
So for those of you who have 2.41 and a dsoxlan card it looks like you could just copy the .lnk file you make from the USB drive to \Secure\Startup\infiniivision_ext.lnk using telnet or use memset's cab file upgrade.
At this point it is looking like there isn't too much incentive to stay on 2.39 or older unless you want to be able to boot directly from a USB drive.

FWIW, to switch it off, I have been renaming the new .lnk file to .xxx via telnet

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on July 29, 2016, 12:53:35 am
I'm pleased to report that I performed the mod this afternoon on my DSOX3014A and it is working perfectly(as far as I can tell anyway!).

After swapping the parts I fully reassembled the scope and verified all channels worked - everything actually seemed to still be bang on where it should be as far as triggering and levels go. I let it warm up and then performed a user cal. It passed with no problems. For the user cal I made 4 BNC patch cables each 10 inches long and used the recommended splitters to connect all 4 channels to trigger out. I used RG142 for all cables.

Here are my numbers so far:

3 dB point measured by inputting 1 Vpp and then increasing frequency until the signal level was .707 Vpp.
Signal gen is an HP 8921A with 4 feet of RG142.

Pre mod 100 MHz was 131 MHz
Pre mod 200 MHz was 227 MHz

Post mod 350 MHz is 389 MHz
Post mod 500 MHz is 593 MHz

I also tested it with a Jim Williams style pulse generator - these numbers are certainly not correct as the pulse needs a flatter top. It does show a quicker time as the bandwidth is increased though.
The pulse gen performance was verified using a 1 GHz TDS7104 which indicated a 350 ps rise, again though no flat top was observed. I'll work on improving the pulse gen.

100 MHz - 2 ns rise
200 MHz - 1.16 ns rise
350 MHz - 690 ps rise
500 MHz - 520 ps rise

All channels were verified to perform the same.

So things are looking extremely positive. As memset mentioned you really need to be confident in your abilities before taking on this mod. The parts are cheap enough but they aren't the easiest to swap. The pads are very small and the differential lines actually sink quite a bit of heat. On the plus side working space isn't too bad. You want to be sure you can handle delicate 0603 parts.

Thank you again to memset for attacking this project and Howard who was willing to desolder and measure parts on a perfectly good(and far from cheap) scope as well as the others who provided pictures.

For anyone interested in performing this mod here are the exact parts I used in my DSOX3014A:

H1 strap resistor - 121K 0603 1%, Vishay # CRCW0603121KFKEA, Digikey # 541-121KHCT-ND, quantity 1
L1 strap resistor - 46.4K 0603 1%, Vishay # CRCW060346K4FKEA, Digikey # 541-46.4KHCT-ND, quantity 1
R1 - 110 ohm 1206 1%, Vishay # CRCW1206110RFKEA, Digikey # 541-110FCT-ND, quantity 4
R2 - 162 ohms 0603 1%, Vishay # CRCW0603162RFKEA, Digikey # 541-162HCT-ND, quantity 4
C1 - 2.2 pF 0603, 100V NPO, Murata # GQM1885C2A2R2BB01D, Digikey # 490-4838-1-ND, quantity 4
C2 - 2 pF 0603, 100V NPO,  Murata # GQM1885C2A2R0BB01D, Digikey # 490-6092-1-ND, quantity 4
L1,L2,L3 - 15nH 0603 2%, Coilcraft 0603CS-15NXGEU, quantity 12 (ordered direct from Coilcraft)
L4 - 27nH 0603 2%, Coilcraft 0603CS-27NXGEU, quantity 4 (ordered direct from Coilcraft)

Any questions/comments let me know.

edit - just updated to version 2.41, my infiniivision_ext.lnk file contains the following:

217#\Secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l DVM -l ADVMATH -l AERO -l AUDIO -l AUTO -l COMP -l EMBD -l Flex -l Mask -l MEMUP -l PWR -l SGM -l VID -l WAVEGEN -l EDK -l memMax -l DIS -l ASV -l RML -l BW50

edit #2:
Compared rise times, amplitudes etc to my TDS7104A using a pulse/pattern gen and all of the numbers are exactly as they should be. I also tried the 20 MHz bw limiter and it is working perfectly as well.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on July 29, 2016, 05:18:30 pm
Nice work, TheSteve!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on July 29, 2016, 05:26:42 pm
Yeah, well done everyone. It really is impressive, I am asking myself should I do it and do I really need to. I have a DSOX3024A and it does what I need it to. I think I might just hold off until such a time as I need the extra bandwidth. I suppose the other thing would be scope probes for such a modification. Upping to 500Mhz, what probes are people using?

Trev
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on July 29, 2016, 05:37:14 pm
I bought my DSOX3014A direct from Keysight as a refurb so it came with no probes(price was great though). I was then lucky and found as new Agilent 1161A 500 MHz probes for 40 bucks each in the original pouch with all accessories so I grabbed those as my passive probes. Now that I have 500 MHz of bandwidth I'm also looking for some affordable active probes. There are some reasonable options if you're willing to modify an older probe to work with the DSOX3000 series. The 1152A is an example of that.

I have attached a picture of the removed parts in case I needed I hit the "undo" button.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 29, 2016, 06:08:51 pm
Another vote for the 1160A series, I use the 1165A here for a day to day passive probe because they are small and light weight. The stock probes that come with the x3054a are Duplo size in comparison.

Although I have a selection of lo-z and FET probes, they don't come out very often, but it depends what you're doing, my work is almost all low impedance digital and mixed signal stuff.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on July 29, 2016, 08:14:30 pm
There was this article written by someone who made a power supply interface for the smart probe (auto probe?) interface. I think that's a better solution than opening the 1152A since you won't be able to use them with scopes that did support the probe anymore.

I'll see if I can find it once I'm back home.

Ps, keysight's new 1GHz 1M/0.7pF active probes are nice in principle and sometimes can be had for ~500 but they are really unwieldy, impossible to probe two test points next to each other. Also the GND clip pisses me off regularly since it turns in all directions.

EDIT (link): http://www.alciom.com/images/stories/downloads/powerprobe%201a.pdf (http://www.alciom.com/images/stories/downloads/powerprobe%201a.pdf)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on July 30, 2016, 05:03:44 am
I'd also say that we're generally pretty conservative with our bandwidth ratings, so I'm interested to see what bandwidth you guys can coax out of the 70-200 MHz board.

So I guess the answer is 500 MHz (closer to 600 really). Of course memset might further impress us all and still wire in the Teledyne relays to push his scope to 1 GHz. Wiring it in doesn't look too bad, maintaining proper impedance along the way is another story.
Too bad there isn't a way to mod only a single channel.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on August 01, 2016, 07:21:20 am
I've done some research on how to install arbitrary command line without having the lan module on version 2.41 and came to this simple solution.
...

Fantastic work, memset

I gave this a go on my DSO-X 3034A, which was previously running the v2.39 firmware.  I upgraded to v2.41 and then used the cab file to install the link.  In my .lnk file I have:
Code: [Select]
96#\Secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l BW50 -l memMAX -l ASV -l CABLE -l SGMC
In the past I bought the DSOX3k app bundle so I only needed to activate a few options.  When on firmware v2.39 or earlier the existing licenses are kept and the options (-l MSO etc.) add the additional licenses.  However, in this case for firmware v2.41 I found that only the options I listed were installed.  All the options I have installed via the app bundle license did not appear.  Did anyone notice this?  Did anyone else notice this?  Is that why people are using -l All, or specifying all the options?


By the way, according to Microsoft (https://msdn.microsoft.com/en-us/library/ms861519.aspx) the number before the # is the number of characters *after* (not including) the pound sign.  Perhaps it's not so critical, though, as the default .lnk on the scope seems to get it "wrong", too...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 01, 2016, 07:38:39 am
I didn't notice that as I have no factory licenses. I would think it is related to the changes Keysight made between 2.39 and 2.41. The biggest being that no binary needs to be patched to enable all licenses.
I specify all of the licenses I want simply so I don't see the * beside everything on the about screen.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on August 02, 2016, 06:37:30 am
@TheSteve: Thanks for the follow-up.  I too prefer not having * beside all the options.

I removed the _ext.lnk file via USB "uninstall" and that worked with all my licensed options back.  Then I modified the .lnk with all options and "installed" again, and that worked like a charm :)

There's a modern HTML5 web front end now -- I hadn't seen it before!  Pretty neat!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 07, 2016, 02:27:42 am
Was playing around some more and decided to look at the trigger out from my pulse/pattern gen. In ECL mode it is spec'd for a typical rise time of 600ps. Connecting it to my TDS7104(1GHz scope) I see a rise time of 500ps. Connecting it to the modified DSOX3014A I see rise times between 600 and 660 ps. I believe this represents a very realistic value you can expect to see in real world use and is right inline with what we would expect with the mod.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on August 07, 2016, 05:49:20 am
This is from a kosher MSOX3054A. Source is HP 54121T with a system rise time of <33ps.

The measured rise time varies between 630 and 670ps on the 3054a with the fastest timebase (1ns/div).

If you reduce the timebase to 5ns/div it flucuates between either 600 or 700ps, I'd suggest due to more limited resolution as ISTR these scopes measure using the screen data rather than directly the samples themselves.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 07, 2016, 06:00:06 am
Perfect -  exactly what I see with my "special edition". Thanks Howard!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on August 08, 2016, 06:37:18 am
Anyone having troubles with LAN on v2.41 or after the new patch method?

I found today that the LAN interface is not being configured -- see the photo below.

I've not had this happen before.  Everything seemed fine just a few days ago.  I plugged the Ethernet into a switch; my router handles the IP address assignments using DHCP.  I've always used this setup without problems.

I tried the "reset LAN" option from soft-button menu but it leads to the same result.

I tried removing and VGA/LAN card and plugging it back in.  Also tried different sockets in my switch and different Ethernet cables...

Has anyone seen this before?  Is the IP address shown (92.251.81.2) typical in the case of not being able to obtain IP address from DHCP server?  Other instruments seem to be working fine...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 08, 2016, 07:04:33 am
I'm seeing the same thing. It was fine with 2.39 - not sure if it is 2.41 with a home brew dsox2lan or if it is using the external link. Either way mine still works fine via DHCP even though the IP information on screen is not displayed correctly.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on August 08, 2016, 07:21:34 am
I'm seeing the same thing. It was fine with 2.39 - not sure if it is 2.41 with a home brew dsox2lan or if it is using the external link. Either way mine still works fine via DHCP even though the IP information on screen is not displayed correctly.

@TheSteve: Thanks for the confirmation.  I'm using the Agilent VGA/LAN module and since the problem exists even in this case it doesn't seem related to the home brew LAN modules.

I've not seen this problem on v2.39 or any earlier firmware.  I will try again tomorrow...  I wonder if this is a bug in v2.41?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on August 08, 2016, 10:19:18 am
The LAN interface is configured according to how it was set up in the unanointed setup, but it shows nonsense once anointed. I've only set LAN parameters when in a standard config. I can connect with a browser using the settings originally made, ignoring what's displayed.

I also suspect there may be other things that might be affected, such as cal settings (not yet certain about this) so I only do a cal in basic config as a result.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on August 08, 2016, 07:15:43 pm
Has anyone seen this before?  Is the IP address shown (92.251.81.2) typical in the case of not being able to obtain IP address from DHCP server?  Other instruments seem to be working fine...
Default, DHCP-failed IP should be 196.254.x.y (/16 subnet mask). Maybe your unit have some static configuration defaulted in.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 09, 2016, 04:22:44 am
Just to confirm 100% the odd looking LAN settings only occur when using a infiniivision_ext.lnk with firmware 2.41.
The displayed network information will be incorrect but the scope will still grab an IP via DHCP and communicate fine. If you need to use a static IP it should be configured with unpatched firmware(disable the lnk file). You will also find "User Cal Status" is always shown as unprotected when using the infiniivision_ext.lnk file - I believe this was the case with previous patched versions as well. A User Cal will still complete successfully and be displayed properly, if you boot unpatched the scope will show that User Cal Status is protected.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on August 10, 2016, 04:25:56 am
The LAN interface is configured according to how it was set up in the unanointed setup, but it shows nonsense once anointed...

...Maybe your unit have some static configuration defaulted in.

Just to confirm 100% the odd looking LAN settings only occur when using a infiniivision_ext.lnk with firmware 2.41...

Thanks, Howardlong, memset, TheSteve for the follow-up and confirmations.  I tested again myself by removing the _ext.lnk and the IP configuration is immediately back to normal.  It's not any static configuration I had. 

I set the hostname while 'unanointed' and reserved a static IP on my router so the scope is still using DHCP but will always get the same IP.  I then put back the _ext.lnk.  Sure enough the nonsense network information is back but at least I can communicate with the scope at a known address.  The web interface still works but instead of responsive like it was, it is very sluggish, there is missing data (see picture attached), and somethings don't work any more (e.g. "Identification = On" in the picture attached).

It's unfortunate there is some broken functionality with _ext.lnk :(  Oh well...it's still much easier than previous methods.

Best,
Sparky
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 10, 2016, 04:59:49 am
The screen you're showing does seem pretty sluggish to respond but I find the screen grab and the full remote control scope seems the same speed as always(the HTML 5 version anyway).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mischo22 on August 10, 2016, 08:13:43 am
I found the Problem with the LAN:

Normaly the scope starts the \Windows\infiniivisionlauncher.exe.
The .lnk file points to \secure\infiniivision\infinnivisionlauncher.exe.
The files aren't the same!

if i start the /Windows/infiniivisionlauncher.exe, the command "-l all" is ignored. No lan problem.
if i start the file from the secure-path the "-l all" is accepted, but with the lan Problem.

I copied the infiniivisionlauncher.exe from \Windows to \secure\infiniivision.
The file doesn't start. dll not found.


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on August 10, 2016, 09:33:44 am
Normaly the scope starts the \Windows\infiniivisionlauncher.exe.
The .lnk file points to \secure\infiniivision\infinnivisionlauncher.exe.
The files aren't the same!

Not 100% correct.

Original startup launcher is:
\Program Files\InfiniiVision\infiniivisionLauncher.exe
Original launcher is .NET-based, other (in \Secure) is native.
I don't know why there are two of them, nor I've tested \Program Files\InfiniiVision\infiniivisionLauncher.exe to work with non-empty command line string.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mischo22 on August 10, 2016, 12:08:56 pm
The directory \program files\infiniivision is a ramdisk. on boot the files from \Windows are copied to them.
You can see it on the filetimestamp.

It is possible to copy own files to the path. so it isn't a readonly filesystem.

i copied the infiniivisionlauncher.exe from the secure path to the "program files" path and started it manually.
same result: "-l all" accepted, but lan-display-problem.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on August 10, 2016, 01:46:37 pm
Two years ago in this thread someone reported a problem with patched firmware running from USB stick and the WEB interface, the link below points to the solution:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg484234/#msg484234 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg484234/#msg484234)

Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mischo22 on August 10, 2016, 03:37:57 pm
Two years ago in this thread someone reported a problem with patched firmware running from USB stick and the WEB interface, the link below points to the solution:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg484234/#msg484234 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg484234/#msg484234)

Georg

This was only necessary, when the program starts from USB-Stick.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mischo22 on August 10, 2016, 03:59:55 pm
I have tested the following solution to run the Scope with all licenses and without lan-problems:

First, you need telnet access to perform the hack (in future a CAB were nice) und running Firmware 2.41.

1. Login with telnet in your scope
2. Stop software with "processmgr kill infiniivisionlauncher.exe"
3. Copy the file \program files\infiniivision\infiniivisioncore.dll to the usb stick
4. Patch the dll at position 0x027C0E8. Change the bytes from "04 00 a0 e1" to "00 00 a0 e3"
5. Copy the patched dll to "\secure\"
6. Create a file "startinfiniivision.cmd" with this content:
Code: [Select]
processmgr kill infiniivisionlauncher.exe
copy \secure\InfiniiVisionCore.dll "\program files\infiniivision\InfiniiVisionCore.dll"
"\program files\infiniivision\infiniivisionlauncher.exe" -l all -l BW50 -l SCPIPS -l SGMC -l CABLE
7. Copy this file to "\secure\"
8. Create a link file with the following content and install the link with the LinkInstallerCab:
Code: [Select]
50#\windows\cmd.exe /c \Secure\startinfiniivision.cmd9. done!

Your Scope runs without problems and all liceses are activated
 :)


Uninstall the hack:
1. Remove the link with the linkInstallerCab
2. Login into the scope
3. Delete created files on with "del \secure\startinfiniivision.cmd" and "del \secure\InfiniiVisionCore.dll"
4. Done!


Is it possible to create a CAB-Installfile with this steps like the LinkInstallerCab, but i don't know how i can create the CAB-File
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on August 12, 2016, 08:05:09 am
Normaly the scope starts the \Windows\infiniivisionlauncher.exe.
The .lnk file points to \secure\infiniivision\infinnivisionlauncher.exe.
The files aren't the same!

mischo22: Seems like you've made some important discoveries here!  It's first time I've read that there are two versions of infiniivisionlauncher.exe ...and even more weird they are not the same, and that trying to use one instead of the other causes the LAN problem but allows various license activation (-l switch)!  In summary you found:

1) \Windows\infiniivisionLauncher.exe (is copied to ramdisk \Program Files\InfiniiVision\infiniivisionLauncher.exe) : LAN works, but -l options ignored

2) \Secure\Infiniivision\infinnivisionLuncher.exe : LAN doesn't work, but -l options accepted

It is mystery why there are two versions, but clear that they provide different functionality.  I think you discovered the first version must be used for functioning LAN, and though I don't know how (or my understanding might be wrong) it seems patching the dll allows the -l options to be accepted.  Furthermore, the dll must be in the same directory as infiniivisionLauncher.exe

I have tested the following solution to run the Scope with all licenses and without lan-problems:
...

Wow!  I think it's first time someone showed how to have modified dll on v2.41!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 14, 2016, 05:52:58 am
Played with the 2.41 patched dll version tonight - it does work as it should. It adds about 10 seconds to the scopes boot time. Cal status still displays as unprotected but that has always occurred when adding options.

Many pages back in this thread there are instructions for connecting to the scope via JTAG to dump the entire flash. Has anyone entertained the idea of dumping the flash and adding our own public key. Perhaps even using the original pair that was leaked years ago. Yes it would mean opening the scope but if it was only a one time operation after that licenses would be permanent and no firmware mods would be needed. It should also survive firmware updates forever.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on August 14, 2016, 09:59:01 am
Has anyone entertained the idea of dumping the flash and adding our own public key.
Personally I'm fine with the current solution. I really dislike the possibility of hacking the scopes without clear traces left because that will spoil the second hand market. Just imagine eBay flooded with unlegit scopes...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 14, 2016, 11:13:43 pm
Has anyone entertained the idea of dumping the flash and adding our own public key.
Personally I'm fine with the current solution. I really dislike the possibility of hacking the scopes without clear traces left because that will spoil the second hand market. Just imagine eBay flooded with unlegit scopes...

Well I don't see there being any flood of scopes with bogus licenses added. Not that many people will open their scope, jtag it to read the flash, alter it and then rewrite the flash. It could happen though. To that end I've already seen a DSOX2K on ebay that had all options enabled in firmware and they were open about advertising it - not something I support obviously. In my case my scope will never look 100% legit as the model # is DSOX3014A yet it will always show bandwidth as 350 or 500 MHz. The current hacks are easy enough and simple - but it seems the biggest issue with the DSOX2K/3K series is corrupted flash images or bad flash parts altogether, so anything we can do to help prevent that might be in our own best interest. I know I wouldn't mind having a 100% backup of my flash image.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Keysight DanielBogdanoff on August 19, 2016, 07:10:30 pm

Well I don't see there being any flood of scopes with bogus licenses added. Not that many people will open their scope, jtag it to read the flash, alter it and then rewrite the flash. It could happen though. To that end I've already seen a DSOX2K on ebay that had all options enabled in firmware and they were open about advertising it - not something I support obviously. In my case my scope will never look 100% legit as the model # is DSOX3014A yet it will always show bandwidth as 350 or 500 MHz. The current hacks are easy enough and simple - but it seems the biggest issue with the DSOX2K/3K series is corrupted flash images or bad flash parts altogether, so anything we can do to help prevent that might be in our own best interest. I know I wouldn't mind having a 100% backup of my flash image.

Trying to buy & flip hacked scopes is a good way to get a nasty-gram from our legal department. Don't do it. We can tell when a scope's been hacked and will fight to stop people from making money off of hacking our scopes.

I personally am all for buying and ...er... upgrading a scope, but don't try to make money off of it. It's been tried before and we intervened.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 19, 2016, 07:55:53 pm

Well I don't see there being any flood of scopes with bogus licenses added. Not that many people will open their scope, jtag it to read the flash, alter it and then rewrite the flash. It could happen though. To that end I've already seen a DSOX2K on ebay that had all options enabled in firmware and they were open about advertising it - not something I support obviously. In my case my scope will never look 100% legit as the model # is DSOX3014A yet it will always show bandwidth as 350 or 500 MHz. The current hacks are easy enough and simple - but it seems the biggest issue with the DSOX2K/3K series is corrupted flash images or bad flash parts altogether, so anything we can do to help prevent that might be in our own best interest. I know I wouldn't mind having a 100% backup of my flash image.

Trying to buy & flip hacked scopes is a good way to get a nasty-gram from our legal department. Don't do it. We can tell when a scope's been hacked and will fight to stop people from making money off of hacking our scopes.

I personally am all for buying and ...er... upgrading a scope, but don't try to make money off of it. It's been tried before and we intervened.

I agree someone hacking scopes to resell for profit does deserve a nasty-gram from your legal department - that hasn't been suggested in this thread at all though Daniel.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: matthieu.e on August 22, 2016, 06:25:30 am
Hi,

I just receive my used DSOX 2002 scope and I like it a lot !  :) I am in version 1.00.20 and I think it as never been updated.
I read the whole thread but I am a little confuse on how to unlock it.
Is there only a software hack to do on the scope or a software and hardware update to do ? (I am no afraid to do a hardware update in second time).

Can someone could resume me how to do the software update on my scope (I do not have the ethernet card for now, I plan to make one...). Thanks !
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: matthieu.e on August 23, 2016, 07:50:08 am
Do I have to make the Ethernet card first or is there a pre hacked software I can put into a USB key ?
Thanks a lot  ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on August 23, 2016, 07:59:48 am
Do I have to make the Ethernet card first or is there a pre hacked software I can put into a USB key ?
Thanks a lot  ;)
All the information is in this thread.
Read carefully everything!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mischo22 on August 23, 2016, 08:01:37 am
You can update to firmware version 2.35 and run the hacked software on USB-Stick. On this solution, you don't need a lan-card.
For the newer firmware, you need the lan-card.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: matthieu.e on August 23, 2016, 11:37:46 am
Thanks for the answer  :-+

Where can I find the 2.35 firmware ? There only 2.41 and and previous version on the keysight website.
http://www.keysight.com/main/software.jspx?cc=FR&lc=fre&nid=-32542.1150180&id=2014479&pageMode=CV (http://www.keysight.com/main/software.jspx?cc=FR&lc=fre&nid=-32542.1150180&id=2014479&pageMode=CV)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: aholtzma on August 23, 2016, 04:22:05 pm
Somewhere in this thread is a link to a zip file on Dropbox. You just need to unzip this file to a USB key and you're done.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on August 23, 2016, 04:24:25 pm
Thanks for the answer  :-+

Where can I find the 2.35 firmware ? There only 2.41 and and previous version on the keysight website.
http://www.keysight.com/main/software.jspx?cc=FR&lc=fre&nid=-32542.1150180&id=2014479&pageMode=CV (http://www.keysight.com/main/software.jspx?cc=FR&lc=fre&nid=-32542.1150180&id=2014479&pageMode=CV)

try this
http://www.filedropper.com/3000xseries02352013061800 (http://www.filedropper.com/3000xseries02352013061800)
Link few pages back is not working.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 23, 2016, 04:39:24 pm
Version 2.41 can also have all features enabled without a lan card - details are in the last few pages.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: matthieu.e on August 24, 2016, 07:00:55 am
Hi,

Thanks for the upload. I successfully updated my scope to 2.35. I now have to modify the .dll.  :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: millerni on August 26, 2016, 10:53:27 am
Hi,

I'm new in this Forum.
Found this Thread after I bought a DSO-X 2002 on Ebay.   ^-^
Now I'm looking for a DOSXLAN Adapter to access the Telnet interface...
Has anyone a PCB or even a stocked PCB left and would sell it to me?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: matthieu.e on August 26, 2016, 11:48:40 am
Hi,

I am looking for one too. I will perhaps launch a 5x batch. If it is the case I will tell you.
Send me a message if you find a way to have the PCB  ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on August 26, 2016, 02:22:05 pm
See here: https://www.eevblog.com/forum/projects/lan-adapter-for-the-agilent-keysight-dso-x-3000-2000/msg1012397/ (https://www.eevblog.com/forum/projects/lan-adapter-for-the-agilent-keysight-dso-x-3000-2000/msg1012397/)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: matthieu.e on August 30, 2016, 12:13:48 pm
Hi,

I successfully upgrade my dsox2002A to 200MHz with 2.35 firmware. I order a lan card and will receive it next week normally.  :)
I have a question after reading the last few pages. Is the 500MHz mod from Memset is possible on the 2002A ? Thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on August 30, 2016, 12:56:57 pm
at least you cannot purchase a 350 / 500 Mhz DSOX2000 series scope from Keysight.
So probably you need to open your scope and check the PCB if it will allow such modification.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 30, 2016, 04:44:05 pm
It is an interesting thought. I would think the front ends should be similar(but not the same, the 3000 series has a 50 ohm termination option). You would need to compare the strapping/jumper options and if they look similar enough try changing the jumpers to tell the scope it is 350/500 MHz. If it boots up and says the BW is 350 MHz then the software happens to support it and you will get the faster time base etc. Then you can look at the front end.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: matthieu.e on August 30, 2016, 05:17:03 pm
Thanks for the answer  ;)
Yes, I should look at the RF front end. I just reassemble my scope yesterday after my repair on the generator output  :palm:
Is there any picture of the 2002A front end somewhere ?

Where is the strapping/jumper options area ? Inside the front end cover ?

Linked a photo of my scope.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 30, 2016, 05:40:16 pm
I compared pics of the 2000 to the 3000 PCB(on the top side anyway) and the strapping resistors do look the same. So you you can trying swapping the same two parts as we did on the 3000 mod to switch the board to 350/500 MHz. Then boot the scope up and go to the about screen to see if it gives an error or says 350 MHz.
I haven't see any detailed pics of the 2000 front end as it is hidden under the cans - it will certainly be different then the 3000 front end but you never know what might be possible with some luck.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on August 30, 2016, 07:39:57 pm
How hard can it be?  :-//

I just tried memset's method of installing the lnk file from a USB dongle:

MSOX3034A - check
Firmware 2.41 - check
Link 63#\Secure\infiniiVision\infiniivisionLauncher.exe -l all -l bw50 - check
Load the cab from the scope menu - check
Scope reboots but hangs either on the splash screen or the next one with the software warning  :'( - no check

I understand what's going on in the recipe.xml file, it should work fine. Now I have to wait for my LAN kit to arrive  :(

What could be the problem? Caps? I've seen people posting their links with either bw50 or BW50 so that doesn't seem to be the problem. Also, there's no CR/LF at the end of the link text if I'm correct? To be continued after arriving of the kit and some soldering... I hate to wait!

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 30, 2016, 08:09:14 pm
Shouldn't the link file be:
62#\Secure\infiniiVision\infiniivisionLauncher.exe -l all -l bw50

edit: - just looked back at the last few pages of this thread and it looks like the link Howard said he was using is wrong. As I posted above the character count is off by one, it starts after the # sign.

Should be an easy fix once you have your lan card.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on August 30, 2016, 08:21:10 pm
Shouldn't the link file be:
62#\Secure\infiniiVision\infiniivisionLauncher.exe -l all -l bw50

I don't think so, see https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg989301/#msg989301 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg989301/#msg989301)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 30, 2016, 08:23:02 pm
Shouldn't the link file be:
62#\Secure\infiniiVision\infiniivisionLauncher.exe -l all -l bw50

I don't think so, see https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg989301/#msg989301 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg989301/#msg989301)

Howard's character count is wrong in that post unfortunately.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on August 30, 2016, 09:01:15 pm
N is 2-3 digits of length value of the following string, including '#' char.

63#\Secure\infiniiVision\infiniivisionLauncher.exe -l all -l bw50 is 65 bytes, so subtracting the first 2 gives 63... ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on August 30, 2016, 09:11:38 pm
Is it

"the following string, including '#' char"

or

" 2-3 digits of length value ...  including '#' char"

English is a bit more flexible than code :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on August 30, 2016, 09:16:06 pm
I have no idea, but Howard's link seems to work and reading the posts I get the idea that the correct length does not really matter... anyway, hard to tell without the LAN adapter.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 30, 2016, 09:26:34 pm
It is the number or characters *after* the # sign.

From the MS website:
[number of ASCII characters after pound sign allocated to
command-line arguments]#[command line] [optional parameters]

https://msdn.microsoft.com/en-us/library/ms861519.aspx

As to what happens exactly if the character count is wrong I can't say - but it seems quite likely it would lead to the problem you're having.
Perhaps Howard had some other character in his original file that wasn't carried over with a cut&paste.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on August 30, 2016, 09:31:05 pm
Quote
Perhaps Howard had some other character in his original file

A cr/lf perhaps. That could make up the extra character and be ignored to boot.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bg8up on August 31, 2016, 03:25:25 am
Looks like telnet password is changed too. It is generated from instrument id now (still possible to get it, but I don't have a 3000T to try anyway)

Telnet passwd is changed on 3000T.Creatuseraccount need invoking get-model&sernm,doesn't like 3000A or 4000A.Shall we try to replace 3000T's FW with 4000A?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on August 31, 2016, 05:09:07 am
It's the number of characters after the #:

https://blogs.msdn.microsoft.com/mikehall/2007/07/26/adding-applications-to-the-windows-ce-start-menu/

In the example, I think it should be 62. Whether it's a material difference or no I don't know, I do tend to add a CR/LF at the end of a file as a natural practice, from the days when some C compilers complained if you didn't!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on September 01, 2016, 03:28:41 pm
To be continued after arriving of the kit and some soldering... I hate to wait!
You can use any suitable cut of 0.8mm pitch PCB edge connector for urgent repair. Only one half of the connector is needed to get the LAN to work.

I've also put my scope to hang while working on the cab file. Without LAN adapter in hands I've cut a PCB edge connector line from crossfire connector of some old AMD videocard. It was the same pitch/thickness and almost the same width. All traces from edge fingers to the remaining part of PCB were carefully cut to make a clean connector. Next I've soldered short wires from connector to MagJack (only power and data lanes). It worked flawlessly and the scope was fixed via telnet.

Also you can attach 3.3V LVTTL RS232 port to scope's debug connecter (see the first pages of this thread for a pinout picture). By observing COM-port output you'll be able to find the exact problem with the lnk file. Probably you'll get an exception if your lnk file wasn't well-formatted.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 01, 2016, 07:09:02 pm
Hi memset, thanks for joining in. I decided that I can wait a little longer (I have more scopes) but I indeed already looked into other options, including a temporary magjack connection.
I'm still wondering about the link, should the count include the # character or not? I included the # and the only reason I can think of why it went wrong is that it should not be included. However, the majority of the links other people posted include the # in the count, and even your 'empty'  link in the zip file includes the # in the count:

48#\Secure\infiniiVision\infiniivisionLauncher.exe

So... what should it be?  :-//
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on September 01, 2016, 07:46:49 pm
So... what should it be?  :-//
Here is pin header pinout (wasn't found by me, check first pages for the source).
Find some 3.3V LVTTL level COM-port converter to connect to the board's TX and GND pins and take a look on the debug output (AFAIR its 115200 8N1).
DO NOT use conventional +/-12V COM/RS232 converters because you'll probably burn your CPU. The best choice is bare USB-RS converter like FT232R or PL2303H without companion level converter IC (NO MAX3232!)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wiljan on September 02, 2016, 12:15:36 pm
I did use 72#\Secure\infiniiVision\infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS
no cr/lf and the count 72 does not include the # that did work

If you use eg. notpad++ and select after the # to the end of line you can see the numbers (length) of the selection in the buttom bar of notepad++
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: matthieu.e on September 02, 2016, 05:58:33 pm
Hi,

I collected all the components to make the Memset mod on my DSOX2002A.  :)
I will first change the two strap resistors and try to convert the 200 MHz bandwidth to 350 MHz.
I have a question : do I have to put the 3000 firmware or will it be detected with the 2000 firmware ? Perhaps it is the same ?

I a second time I will upgrade the front end. What is the functionality of the components we are changing ? Is it a low pass filter ? If yes, what is cut-off frequency point before and after the mod ? Thanks.

PA0PBZ, have you fix your scope ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 02, 2016, 06:08:48 pm
The 2000 and 3000 use the same firmware. But there is no official 350 MHz 2000 series. If changing the strap resistors enabled 350 MHz then I'd say you can continue, if it gives an error or makes no change then I would stop.

The parts changed are low pass filters and the anti alias filter as far as I know.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 02, 2016, 06:13:34 pm
PA0PBZ, have you fix your scope ?

Not yet, I've been waiting for my DXOLAN kit which unfortunately has not arrived yet. I'm getting a bit impatient so I might go for the RS232 port this weekend.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 03, 2016, 07:45:17 pm
Well, that is kind of ' interesting'...
Hooked up the RS232 TTL port and I can see the following:
Code: [Select]
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2016-9-3   20:57:30.34 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
RTC: 2016-9-3   20:57:30.38 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOXOXOOOOXXXOOOOOOOOOXOOOOXOXXOXXOXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOXOXXOOOXOXOOOXXOOOXOOOOXOXOOOOOXOOOXOOXOXOXOXXXXXXXOXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOX
OOOXOOXOOOOXOOOOXOXOOOXXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXXOOOOXOXOOOXOOOXOOXXOXOOOOXXXOXXXXXXOXOXXOXXXXXOXOXXOXXOOXXXOOXXOXXOXOOXXOXXXXOXXOOXOOOXOXXXXOOXXXOOOXOXOOOXOOXXXXXXXX
XXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x15264A8, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x15264A8  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2016-9-3   20:57:33.31 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Oct 22 2015)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:XX:XX:XX
Phy found addr 31 (ticks=6612)
WaitForLink Start (ticks=6614)
No Link (ticks=7617)
<--EDeviceInitialize

GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Time for NANDFLASH to load: 1 ms.
Time for SNANDFLASH to load: 1 ms.
Our command line is
Performing Startup
Our command line is -l all -l bw50
Released build, Oct 22 2015, 11:30:59
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
Performing Startup
Released build, Oct 22 2015, 11:30:59
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\sh600_serial\.\sh600_serial_drv.cpp line 661: SER2 SER Driver: does not support multiple Open()'s
Error opening UART Driver.
*** Installing License: All Licenses
*** Installing License: 500MHz Bandwidth
No option module detected
No option module detected
Front Panel UART driver reset -- Contact ChrisG
ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\sh600_serial\.\sh600_serial_drv.cpp line 661: SER2 SER Driver: does not support multiple Open()'s
Error opening UART Driver.
Front Panel UART driver reset -- Contact ChrisG
ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\sh600_serial\.\sh600_serial_drv.cpp line 661: SER2 SER Driver: does not support multiple Open()'s
Error opening UART Driver.
Front Panel UART driver reset -- Contact ChrisG

(This repeats until the cows come home)

So it at least recognizes the command line ("Our command line is -l all -l bw50"), it's happy to install the licenses ("*** Installing License: All Licenses","*** Installing License: 500MHz Bandwidth") but then where is the UART driver error coming from? Time to contact ChrisG maybe  :-\

I can stop the boot loader but then it has no useful options for me:

Code: [Select]
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2016-9-3   21:5:45.25 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008



P500 Boot Loader Configuration :

Mac address .......... (00:30:D3:XX:XX:XX)
Ip address ........... (192.168.1.190)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0600000)
        2 (0xd1600000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images

I tried the usual Ctrl-C's at boot but it refuses to stop loading the application and I reseated the front panel cable (because of the "Front Panel UART driver reset" but no difference. So, any idea apart from waiting for my LAN connection?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 03, 2016, 07:59:46 pm
Looks like there may be some file corruption. Being the 2.41 link loads a different infiniivision file hopefully removing the link once you get the lan card will allow you to reload the 2.41 firmware.
Or perhaps some hardware failed, I assume you haven't taken the unit apart at all.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 03, 2016, 08:11:54 pm
I assume you haven't taken the unit apart at all.

Not before it started to error, but you have to take it apart to get to the serial debug port.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 03, 2016, 08:20:30 pm
How much longer until your lan card arrives, this must be driving you bonkers. Hopefully 2.41 can be reinstalled once it does arrive and that fixes it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 03, 2016, 09:30:08 pm
How much longer until your lan card arrives, this must be driving you bonkers. Hopefully 2.41 can be reinstalled once it does arrive and that fixes it.
I'm not really in panic mode yet  :scared: it's one of the small lessons you learn getting older. The kit should have been posted the 26th but it got delayed a little bit so I now expect to get it Tuesday at latest. Then I of course have to assemble it, see if it works and then remove the link and hope that the scope boots again. I don't think there is anything wrong with the firmware because this scope came directly from Keysight, but then again what the problem is I have no idea yet. Oh well, another learning experience both for me and others that are following this thread.

*To be continued*
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on September 05, 2016, 06:57:04 am
I can stop the boot loader but then it has no useful options for me:
An interesting thing to do is to load a patched version of the WindowsCE image, as I described here (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/125/). Probably also possible with an USB stick, not only from network. I did this for a patched telnetd version without password (before the password was published in this thread). You could backup and restore the NAND flash as well.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: matthieu.e on September 05, 2016, 07:29:55 am
Hi,

I took picture of the strap resistors of my 2002A. I change the 10K L1 to 46,6K. I was going to change H1 but I realize that I have not got H0.
What do you think. Should I put the good value to H0 too ? Do you know the value ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 05, 2016, 07:41:09 am
An interesting thing to do is to load a patched version of the WindowsCE image, as I described here (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/125/). Probably also possible with an USB stick, not only from network. I did this for a patched telnetd version without password (before the password was published in this thread). You could backup and restore the NAND flash as well.

Would you be willing to detail the command sequence needed to backup/restore the NAND flash?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 05, 2016, 07:47:37 am
Hi,

I took picture of the strap resistors of my 2002A. I change the 10K L1 to 46,6K. I was going to change H1 but I realize that I have not got H0.
What do you think. Should I put the good value to H0 too ? Do you know the value ?

You're in uncharted territory so you may need to experiment.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: matthieu.e on September 05, 2016, 08:01:23 am
Yes, I made the changes and it activate the 500 MHz bandwidth on the 2002A. I rapidly put a signal on channel 1 and all seems to be OK.

The only problem is that I now have the 4 channels activated but I only have 2  :D
I soldered a 100K on H0, so I conclude H0 enable the 4 channel. What do you think ?

What is the next step, upgrade the front-end ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: matthieu.e on September 05, 2016, 08:55:34 am
Ok, I removed H0 and I am back to two channels.

Do I have to upgrade the front end to have the 500 MHz BW ? Thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: matthieu.e on September 05, 2016, 09:44:17 am
Here the pictures of the DSOX2002A front-end.  :)
Do the modification seems possible ?

All the components you have changed seems to be on the top of this PCB version. It miss one resistor on the input.
Implantation seems to be different. What are your opinions ? I go in standby mode for now.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on September 05, 2016, 11:40:40 am
An interesting thing to do is to load a patched version of the WindowsCE image, as I described here (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/125/). Probably also possible with an USB stick, not only from network. I did this for a patched telnetd version without password (before the password was published in this thread). You could backup and restore the NAND flash as well.

Would you be willing to detail the command sequence needed to backup/restore the NAND flash?
I don't know it for the scope, but there are the tftpput and tftpget commands to load and write from a TFTP-server to RAM and from RAM (if the u-boot was compiled with support for it). And then there are the flash write and read commands: http://www.denx.de/wiki/view/DULG/UBootCmdGroupFlash (http://www.denx.de/wiki/view/DULG/UBootCmdGroupFlash) I used this for another embedded platform to flash the initial filesystem from TFTP and worked well.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: matthieu.e on September 05, 2016, 05:07:27 pm
I try to match the DSOX3000 components with the DSOX2000 components but I am not sure about L4 and R2.
What is your opinion ?

What is the Agilent 2AD2-0001 ? Is that the ASIC and have we got a datasheet ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 05, 2016, 07:12:33 pm
I compared front ends and I agree with your value designation(assuming L4 is an inductor, it is hard to be certain from the quality of the picture). It is hard to say if every value will directly translate but most look pretty close. They may also not be quite the same because the 2000 series offers a 70 MHz front end option. I don't think there is any datasheet on the Agilent front end ASIC. Do you have a signal generator to verify performance if you make the mod?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 05, 2016, 07:27:31 pm
Well, no panic yet but let's say slightly nervous  :-\

Got the DSOXLAN kit today so I assembled and tested it and it works okay. However...  Scope gets DHCP lease, I can ping it fine, it opens the telnet port, it acks at every telnet packet but it doesn't send anything back. Am I missing something essential here? I guess it should prompt for a login either directly after making the connection or after sending <Enter>, but nothing.  :-//
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 05, 2016, 07:51:20 pm
Yes, if you telnet to it you should get a login prompt right away.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on September 05, 2016, 08:43:10 pm
Hello!
Something goes really wrong in your case.
Actually, your scope tries to run two instances of it's main application - default (?), marked green and one more with extra command line string (blue).
And they two race for never-tested concurrent access to some shared resources and both fail. That's a really expected outcome then you load several instances of some designed to be exclusive application.

That may put a huge load on your CPU, that's thy telnet may work very slow.

I suggest you to connect the telnet and try to wait for the server's welcome message. If you'll get it (maybe in minutes after connection), login, inspect and clean Secure\Startup folder.

Time for NANDFLASH to load: 1 ms.
Time for SNANDFLASH to load: 1 ms.
Our command line is
Performing Startup
Our command line is -l all -l bw50
Released build, Oct 22 2015, 11:30:59
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
Performing Startup
Released build, Oct 22 2015, 11:30:59
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on September 05, 2016, 08:52:37 pm
I try to match the DSOX3000 components with the DSOX2000 components but I am not sure about L4 and R2.
What is your opinion ?

What is the Agilent 2AD2-0001 ? Is that the ASIC and have we got a datasheet ?

That's an ASIC, yes.
Frontend seem to be very similar to 3000-series, further simplified to remove 50-ohm paths.
Both the anti-aliasing filter and low-pass filter are clearly seen and similar to 3000-series. Attenuated low-pass signal path is somewhat different though. I think you can boost it to 350-500MHz as 1-2-3, but that's not doing to be very useful without 50-Ohm coupled input.
Use 500MHz 3000-series component values as a reference for your upgrade and save all the original parts in separate marked containers to secure your way back. You'll need a signal generator to get this work properly done.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on September 05, 2016, 09:02:56 pm
Got the DSOXLAN kit today so I assembled and tested it and it works okay. However...  Scope gets DHCP lease, I can ping it fine, it opens the telnet port, it acks at every telnet packet but it doesn't send anything back. Am I missing something essential here? I guess it should prompt for a login either directly after making the connection or after sending <Enter>, but nothing.  :-//

That could be because the OS is busy dealing with two fighting main apps and flooding debug port with messages. Telnet server is started - that's why you can connect and interact with kernel's TCPIP stack. After that it could take some time to get CPU ticks for userspace telnet server process. If the scope's OS isn't completely blocked you'll be able to get telnet welcome message (maybe in several minutes after connection). If so - you're saved.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 05, 2016, 09:05:34 pm
Something goes really wrong in your case.

Hi memset,

Yes, I was already wondering why I had 2 command line messages, and that would also explain why it complains about multiple open()'s. The only mystery is why does it do that?
I will see if eventually the telnet prompt is going to show up, thank you for giving it your attention.
 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on September 05, 2016, 09:10:23 pm
Yes, I was already wondering why I had 2 command line messages, and that would also explain why it complains about multiple open()'s. The only mystery is why does it do that?
V 2.41 seem to scan Secure\Startup folder for any executable files like .lnk and starts all of them. If it finds none, default registry-based startup process is executed. Possibly in your case you're got two lnk files in startup folder or starter process falls back to default start (for unknown reason) after actually running the file from startup folder.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 05, 2016, 10:09:40 pm
If the scope's OS isn't completely blocked you'll be able to get telnet welcome message (maybe in several minutes after connection). If so - you're saved.

I waited for more than 15 minutes but the telnet connection didn't show anything, and the RS232 debug port is still flooded with the "does not support multiple Open()'s" message.
It looks like this is blocking the other processes from doing anything.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 05, 2016, 10:21:44 pm
This is a total long shot as the telnet port doesn't work but have you tried the web interface?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dav on September 06, 2016, 07:27:53 am
Is the new 3000T "upgradable" in the same way?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Faith on September 06, 2016, 07:35:46 am
Is the new 3000T "upgradable" in the same way?

Would be interesting to know. While the 3000T is very similar to the 3000A in terms of hardware there are differences.

And likewise the 3000T follows a different firmware branch (same as the 4000A) which again while based on the original 3000A there are differences.

Just tried to search around and can't seem to find any information directly related to the 4000A.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on September 06, 2016, 12:06:28 pm
Is the new 3000T "upgradable" in the same way?
Should be even easier, up to 1GHz.
Post frontend pictures to make sure.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on September 06, 2016, 12:10:34 pm
I waited for more than 15 minutes but the telnet connection didn't show anything, and the RS232 debug port is still flooded with the "does not support multiple Open()'s" message.
It looks like this is blocking the other processes from doing anything.
Try to disconnect front panel's flex cables. Chances are low, but worth trying.
Probably you'll need to load patched CE core via COM port to fix this problem.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: matthieu.e on September 06, 2016, 01:54:10 pm
I try to match the DSOX3000 components with the DSOX2000 components but I am not sure about L4 and R2.
What is your opinion ?

What is the Agilent 2AD2-0001 ? Is that the ASIC and have we got a datasheet ?

That's an ASIC, yes.
Frontend seem to be very similar to 3000-series, further simplified to remove 50-ohm paths.
Both the anti-aliasing filter and low-pass filter are clearly seen and similar to 3000-series. Attenuated low-pass signal path is somewhat different though. I think you can boost it to 350-500MHz as 1-2-3, but that's not doing to be very useful without 50-Ohm coupled input.
Use 500MHz 3000-series component values as a reference for your upgrade and save all the original parts in separate marked containers to secure your way back. You'll need a signal generator to get this work properly done.

Yes I will have a generator to test the 2002A up to 500 MHz. I will study the schematic before to do the mod because it is the the only good scope I have on my workbench.
Memset, have you trace the schematic of the front-end on paper ? Could you send me a picture ? Thanks .
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 06, 2016, 02:49:29 pm
Try to disconnect front panel's flex cables. Chances are low, but worth trying.
I already disconnected the front panel -> no difference
Quote
Probably you'll need to load patched CE core via COM port to fix this problem.
I wonder if the 'startup' folder on USB is still valid, that way I could kill the infiniivision process - maybe.
I'm reading the complete thread again and also looking into the CE boot process. If I could disable the automatic startup of infiniivison (either one of the 2 :) ) I would be fine.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on September 06, 2016, 03:41:27 pm
Memset, have you trace the schematic of the front-end on paper ? Could you send me a picture ? Thanks .
No, I don't have any schematics.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on September 06, 2016, 03:44:33 pm
I wonder if the 'startup' folder on USB is still valid, that way I could kill the infiniivision process - maybe.
I don't think its possible on V2.41. The better way should be to use patched core (with a patch to remove the main application from startup process).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 06, 2016, 05:07:08 pm
Try to disconnect front panel's flex cables. Chances are low, but worth trying.
I already disconnected the front panel -> no difference
Quote
Probably you'll need to load patched CE core via COM port to fix this problem.
I wonder if the 'startup' folder on USB is still valid, that way I could kill the infiniivision process - maybe.
I'm reading the complete thread again and also looking into the CE boot process. If I could disable the automatic startup of infiniivison (either one of the 2 :) ) I would be fine.

You did try the web interface on the one in a million chance it still happens to work right - you can use it to update firmware.

Has anyone looked into if there is a key sequence at boot that would force the bootloader to install new firmware? I am thinking something like that must exist, not sure it is meant for the end user of course.

If you can't inject a patched file via the serial port perhaps you could jtag the entire image, patch the file system and reflash it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on September 06, 2016, 05:24:13 pm
Try to disconnect front panel's flex cables. Chances are low, but worth trying.
I already disconnected the front panel -> no difference
Quote
Probably you'll need to load patched CE core via COM port to fix this problem.
I wonder if the 'startup' folder on USB is still valid, that way I could kill the infiniivision process - maybe.
I'm reading the complete thread again and also looking into the CE boot process. If I could disable the automatic startup of infiniivison (either one of the 2 :) ) I would be fine.

You did try the web interface on the one in a million chance it still happens to work right - you can use it to update firmware.

Has anyone looked into if there is a key sequence at boot that would force the bootloader to install new firmware? I am thinking something like that must exist, not sure it is meant for the end user of course.

If you can't inject a patched file via the serial port perhaps you could jtag the entire image, patch the file system and reflash it.
The Flir E4, which also uses CE, has an early boot-up menu on the serial port  that appears to allow an update from USB
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 06, 2016, 05:30:36 pm
Killing the infiniivision process using the usb startup folder doesn't work for this version.
The web interface does the same thing as the telnet connection, it ACKs but that's it.
How do you guys interact with UBoot? All I get is the custom menu and all I can do is one of the keys in the menu:

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>

No ? or help or anything else...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 06, 2016, 05:48:46 pm
I've not tried the bootloading yet. It is reasons like this I'd like to make a full backup of my NAND flash using the serial port or JTAG though.
Pages 6/7 of this thread seem to give enough info to boot an image into ram. If you can boot an image via tftp over the network hopefully you can edit the flash memory or reinstall version 2.41. I have a feeling it will require quite a bit of experimentation to get the network boot working properly but am sure you can do it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Keysight DanielBogdanoff on September 06, 2016, 05:49:20 pm

Has anyone looked into if there is a key sequence at boot that would force the bootloader to install new firmware? I am thinking something like that must exist, not sure it is meant for the end user of course.


Nope
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 06, 2016, 06:03:01 pm
Nope

Is that like "It doesn't exist" or any of the other options?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 06, 2016, 06:06:12 pm
Pages 6/7 of this thread seem to give enough info to boot an image into ram.

I know, but you have to interact with UBoot and it looks like I'm too stupid to find out how to do that  :-//
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on September 07, 2016, 07:04:44 pm
I know, but you have to interact with UBoot and it looks like I'm too stupid to find out how to do that  :-//
Press 'u' and stop u-boot while its booting. Or reset and try to stop u-boot earlier.
I think your chance for easy win is to load nk.bin from older version, like 2.35 since it use different startup logic. You can even try to load nk.bin from Eth and boot application from USB.
Ethernet boot process was already described here.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 08, 2016, 08:53:38 am
Press 'u' and stop u-boot while its booting. Or reset and try to stop u-boot earlier.
I think your chance for easy win is to load nk.bin from older version, like 2.35 since it use different startup logic. You can even try to load nk.bin from Eth and boot application from USB. Ethernet boot process was already described here.

Uboot only stops on a space, Agilent modified the working:

Code: [Select]
#if defined CONFIG_ZERO_BOOTDELAY_CHECK
/*
* Check if key already pressed
* Don't check if bootdelay < 0
*/
if (bootdelay >= 0) {
if (tstc()) { /* we got a key press */
#ifdef CONFIG_AGILENTP500
if( getc() == ' '){  /* stop on space only */
puts ("\b\b\b 0");
abort = 1; /* don't auto boot */
}
#else
(void) getc();  /* consume input */
puts ("\b\b\b 0");
abort = 1; /* don't auto boot */
#endif

I tried 'u' but as expected it does nothing. The only way I can stop Uboot is with a space and then I get the menu with just a few choises, nothing else works.
So I still have no idea how to remove the malicious link...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on September 08, 2016, 09:07:28 am
Uboot only stops on a space
Yes, it is. Just hit space while scope boots. If not sure, hold space and press power on.
Post your serial output starting right from the power on moment.

Like this:
Code: [Select]
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0  0
p500>       help
?       - alias for 'help'
adc     - performs A/D conversion on channel
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
cdp     - Perform CDP network configuration
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dcache  - enable or disable data cache
dhcp    - boot image via network using DHCP/TFTP protocol
echo    - echo args to console
editenv - edit environment variable
erase   - erase FLASH memory
expi    - program EXPI Clock
flinfo  - print FLASH memory information
fpga    - loadable FPGA image support
fsinfo  - print information about filesystems
fsload  - load binary file from a filesystem image
go      - start application at address 'addr'
help    - print command description/usage
hwreset - Perform HW RESET of the CPU
icache  - enable or disable instruction cache
iminfo  - print header information for application image
imls    - list all images found in flash
imxtract- extract a part of a multi-image
itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
ls      - list files in a directory (default /)
md      - memory display
mm      - memory modify (auto-incrementing address)
mtest   - simple RAM read/write test
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
rtc     - print time from RTC
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
saves   - save S-Record file over serial line
setenv  - set environment variables
sleep   - delay execution for some time
source  - run script from memory
splash  - load splash image on display
tftpboot- boot image via network using TFTP protocol
version - print monitor version
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 08, 2016, 09:18:44 am
This is what I see, could it be bad 'space' timing? Looks like I'm already in the next bootloader?
I have to try again when I'm home.
I've made it stop many times but never seen anything else than this:
Code: [Select]
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2016-9-3   21:5:45.25 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008



P500 Boot Loader Configuration :

Mac address .......... (00:30:D3:XX:XX:XX)
Ip address ........... (192.168.1.190)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0600000)
        2 (0xd1600000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images

>
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on September 08, 2016, 09:30:30 am
This is what I see, could it be bad 'space' timing? Looks like I'm already in the next bootloader?
Yes, for some reason all output after that NAND string is missing until you're booted into the next (CE) loader. It could be your RS232 adapter issue like buffer overflow, flow control turned on or something like that. Make sure any type of flow control is turned off in the port settings.
Then you try 'u' in CE loader, does it reboot and print more lines?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 08, 2016, 09:41:38 am
Then you try 'u' in CE loader, does it reboot and print more lines?

When I do the 'u' it starts again from the top ('U-Boot 2010.03...'), then goes into normal boot if I don't touch anthing. I will experiment some more when I'm home tonight, thanks so far!

(Edit: I have never seen the text you see after the NAND string)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wiljan on September 08, 2016, 12:14:09 pm
Just a shoot on the U-boot 

I do recall another project while ago where the only way to break the U-boot was to send a real "break" cmd
In some terminal software you can send a "break" cmd with alt+ b and in other you have to select it in a menu.

A break cmd are forcing the TX data low for a certain time (much longer than a normal byte)
Sometimes the uart are not able to send the break, try to monitor it on another scop.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 08, 2016, 07:10:26 pm
And.... FIXED!  :phew:

There was no way I could stop UBoot, I have no idea why but I tried everything, even 2 different RS232 TTL interfaces. So I realized I had to work with what they offered me, the CE loader menu. One thing caught my attention:

d) Download from platform builder now

Hmm, I don't have platform builder, I wonder what it does. Wireshark to the rescue - it looks like TFTP on a non-standard port (980). Well, I could of course code something together but am I the first one to look at this? Apparently not, because a quick google found CELoader, which is a standalone program (oh wait, app these days) to do exactly that, offer an NK.BIN to anything asking. Only source code, well I can do that. So I built the CELoader.exe, extracted the NK.BIN.COMP from the 2.35 cab,  decompressed it to NK.BIN and put it in the CELoader.exe folder. Started CELoader, halted the scope on the CE loader menu and pressed <d>. It works.... well, sort of. The scope hangs on the splash screen but the RS232 is not flooded with error messages this time, so who knows? Fired up PuTTY and yes, we have a telnet connection. The rest is simple, there where 2 .lnk files in Secure\Startup, one infiniivision.lnk and one infiniivision_ext.lnk. Why? You tell me. Renamed infiniivision_ext.lnk to infiniivision_ext.xxx and rebooted the scope. Bingo! That's enough for this evening, I'll try the -l all -l bw50 tomorrow  ;)

Thanks for all the comments, specially from memset who made me not give up and admit defeat.  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 08, 2016, 07:23:07 pm
Well done! There is always a link file in that directory, but it should be empty and not pointing to anything.
Maybe before trying anything else out do a reinstall of a version 2.41, then put the link file on a flash drive and copy it over when logged in via telnet.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on September 08, 2016, 07:39:04 pm
The rest is simple, there where 2 .lnk files in Secure\Startup, one infiniivision.lnk and one infiniivision_ext.lnk. Why? You tell me. Renamed infiniivision_ext.lnk to infiniivision_ext.xxx and rebooted the scope. Bingo! That's enough for this evening, I'll try the -l all -l bw50 tomorrow  ;)

Gratz on the fix!
BTW, its possible what you've got two lnk files because the scope was upgraded to 2.41 at some point of time and for some reason old lnk file was left in its startup folder.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 08, 2016, 07:46:42 pm
Attached is the CELoader.exe for anyone running into the same problem. Please read the thread how to get an older firmware and how to extract the NK.BIN.COMP and decompress it into NK.BIN.
I have no idea what OS you need to run the exe, but it works fine in Windows 10. You can always download the source yourself and compile.
https://celoader.codeplex.com/

(Edit: WTF? Why does it say "downloaded 3 times" right after posting?  :-// )
(Edit 2: WTF!!! "downloaded 66 times"  10 seconds later??? )
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wiljan on September 09, 2016, 04:33:30 am
@PA0PBZ Great news for you and thanks for sharing 😀
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gbyleveldt on September 09, 2016, 05:16:56 am
Yes, an excellent result and a close shave!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 09, 2016, 05:17:12 pm
Aftermath:

First I tested the options manually:

 - processmgr kill infiniivisionlauncher.exe
 - infiniivisionlauncher -l all -l bw50

That worked as expected so:

- ren infiniivision.lnk infiniivision.xxx
- ren infiniivision_ext.xxx infiniivision_ext.lnk
- reboot scope

Works fine, I didn't bother to change the 63# count as I was expecting it doesn't matter and it didn't.
Now please excuse me, I'm going to play with my new toy  8)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 09, 2016, 05:25:16 pm
Now please excuse me, I'm going to play with my new toy  8)

About time! :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on September 10, 2016, 06:08:26 am
Aftermath:

First I tested the options manually:

 - processmgr kill infiniivisionlauncher.exe
 - infiniivisionlauncher -l all -l bw50

That worked as expected so:

- ren infiniivision.lnk infiniivision.xxx
- ren infiniivision_ext.xxx infiniivision_ext.lnk
- reboot scope

Works fine, I didn't bother to change the 63# count as I was expecting it doesn't matter and it didn't.
Now please excuse me, I'm going to play with my new toy  8)

I am sure I've missed it somewhere, but do you know what did cause the problem?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 10, 2016, 07:57:56 am
I am sure I've missed it somewhere, but do you know what did cause the problem?

Basically the 2 links in the startup folder, but apart from memset's suggestion in #1151 I have no idea why that happened.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dav on September 11, 2016, 09:17:00 am
Is the new 3000T "upgradable" in the same way?
Should be even easier, up to 1GHz.
Post frontend pictures to make sure.

Sorry, I haven't got it.
Just curiosity.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 12, 2016, 04:53:03 am
DSOX3000 series logic analyzer cable on ebay for $155.00 USD shipped(in the US) if someone needs one. It isn't mine, I don't know the seller. You'd also still need the little grabber hooks. Still a pretty decent deal though - http://www.ebay.com/itm/351837124622 (http://www.ebay.com/itm/351837124622)

edit - it has been sold.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: stubbsd on September 24, 2016, 01:40:56 pm
Stupid Muppet Bricked their scope :palm: Suggestions Welcome

Hello all, I used the USB boot file "3ka_v241_linkinstall.cab" with the intention of "cough, cough" upgrading my scope.

I thought I'd upgraded my scope to 2.41, but like a complete numpty, I didn't check, it was, in fact, running 2.37.

So, now I have a bricked scope. It loads, shows the boot screen, then black screen with "Agilent Technoliges", then the screen goes blank.

Any suggestions on how to unbrick it?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 24, 2016, 03:00:29 pm
Any suggestions on how to unbrick it?

Do you have the LAN interface or can you get hold of one? If yes, can you get a telnet prompt?
Otherwise open the scope and get the TTL RS232 port connected to your PC, see around second page of this thread.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on September 24, 2016, 03:03:39 pm
Stupid Muppet Bricked their scope :palm: Suggestions Welcome

Hello all, I used the USB boot file "3ka_v241_linkinstall.cab" with the intention of "cough, cough" upgrading my scope.

I thought I'd upgraded my scope to 2.41, but like a complete numpty, I didn't check, it was, in fact, running 2.37.

So, now I have a bricked scope. It loads, shows the boot screen, then black screen with "Agilent Technoliges", then the screen goes blank.

Any suggestions on how to unbrick it?

You can try to prepare complete firmware on USB flash drive and boot from it (use same FW 2.37).
Otherwise you needs to disassemble scope and use PA0PBZ tool....
If you have new scope I will rather try to contact official support, rather than loosing warranty.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: deanflyer on September 26, 2016, 05:22:47 pm
Just got a 2022A, used the 3ka_v241_linkinstall.cab and scope is bricked. Scope does have 2.41 firmware.

I#m assuming its due to the .lnk file not being the correct length as per previous posts. (#63 instead of #62).

I do have a LAN card but cant get a telnet connection. I've tried rebooting with the base 2.41 firmware and it hangs on the keysight logo screen. From here I can ping the scopes IP address, but still cant get a Telnet session.

Ideas?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 26, 2016, 05:28:40 pm
Ouch - based on PA0PBZ's experience you will need to to open it up and connect to the serial port so you can load a file off the network. Once the file is loaded you will be able to telnet in, remove the link file that was added and reboot which should get you right back to an unmodified version 2.41. His experience is detailed over the past two pages or so.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on September 26, 2016, 05:35:15 pm
Just got a 2022A, used the 3ka_v241_linkinstall.cab and scope is bricked. Scope does have 2.41 firmware.

I#m assuming its due to the .lnk file not being the correct length as per previous posts. (#63 instead of #62).

I do have a LAN card but cant get a telnet connection. I've tried rebooting with the base 2.41 firmware and it hangs on the keysight logo screen. From here I can ping the scopes IP address, but still cant get a Telnet session.

Ideas?

OUCH, you used the version for 3k series :(
Can you open scope or it has any warranty sticker? First I will try USB boot and in case it will fail dismantle scope and upload FW by PA0PBZ tool.
Description how to make USB bootable flash is almost on beginning of this thread. You do not need any hacked files, just extract files from 2.41 firmware.
Do not give up in case first flash will not work and try faster USB drive.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 26, 2016, 05:36:50 pm
Just got a 2022A, used the 3ka_v241_linkinstall.cab and scope is bricked. Scope does have 2.41 firmware.

I#m assuming its due to the .lnk file not being the correct length as per previous posts. (#63 instead of #62).

I do have a LAN card but cant get a telnet connection. I've tried rebooting with the base 2.41 firmware and it hangs on the keysight logo screen. From here I can ping the scopes IP address, but still cant get a Telnet session.

You probably have the same problem I had, 2 links in the folder so the scope is trying to run 2 instances of the infiniivision executable. See this post how I fixed it:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022248/#msg1022248 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022248/#msg1022248)
A few posts below that I attached the tool, and the howto for the RS232 connection can be found somewhere around page 2 of this thread.

Edit: the length (#) is not the problem, as far as I can see it is not even checked.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 26, 2016, 05:39:51 pm
OUCH, you used the version for 3k series :(

AFAIK that is perfectly fine, I've seen a post of someone who did exactly that and succeeded.
Quote
Can you open scope or it has any warranty sticker? First I will try USB boot and in case it will fail dismantle scope and upload FW by PA0PBZ tool.
Description how to make USB bootable flash is almost on beginning of this thread. You do not need any hacked files, just extract files from 2.41 firmware.
Do not give up in case first flash will not work and try faster USB drive.

Version 2.41 will not boot from USB.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: deanflyer on September 26, 2016, 05:46:07 pm
Thanks for that PAOPBZ, saw your previous posts on this. Think i've got a RS232 knocking around somewhere. Sigh....

Just so that ive got it straight, you cant boot 2.41 from USB?



Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 26, 2016, 05:49:41 pm
Thanks for that PAOPBZ, saw your previous posts on this. Think i've got a RS232 knocking around somewhere. Sigh....

Just so that ive got it straight, you cant boot 2.41 from USB?

If you have a 2.41 scope it will not boot from USB, not sure if it is the firmware, an updated bootloader or something else. So... you can boot 2.41 from USB as long as your scope has a previous firmware version, but the "boot from USB" no longer works in the current firmware.

Edit: Please note that the RS232 is 3.3V level, not RS232 level.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on September 26, 2016, 06:34:51 pm
Quote
OUCH, you used the version for 3k series :(
AFAIK the firmware files for 2000 and 3000 series are the same - this will not be the problem.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: deanflyer on September 26, 2016, 07:08:04 pm
PAOPBZ,

What term package did you use? Im trying HTERM (recommended earlier in the thread) and I cant get it to pause the boot process.

This is the error its giving though:-

Performing Startup
Exception 'Raised E|ception' (-1-:Thread-Id=05d5000a(pth=84a19000), Proc-Id=05d4000a(pprc=8419cb08) 'infiniivisionlauncher.exe', VM-active=05d4000a(pprc=8419cb08) 'infiniivisionlauncher.exe'
PC=40068ag0(coredll.dll+0x00058ae0) RA=803782c8(kernel.dll+0x000062c8) SP=0002f9b0, BVA=0002fabc
PARSE ERROR: Argument: ⬐l
  $          Couldn't find match for argument

As per your experience it then goes into a loop with this:-

ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\sh600_serial\.\sh600_serial_drv.cpp line 661: SER2 SER Driver: does not support multiple Open()'s




Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on September 26, 2016, 07:10:41 pm
Quote
OUCH, you used the version for 3k series :(
AFAIK the firmware files for 2000 and 3000 series are the same - this will not be the problem.
Just confirming... I did a compare on 2000XSeries.02.41.2015102200.cab and 3000XSeries.02.41.2015102200.cab.  They are identical.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 26, 2016, 07:19:02 pm
PAOPBZ,

What term package did you use? Im trying HTERM (recommended earlier in the thread) and I cant get it to pause the boot process.

This is the error its giving though:-

Performing Startup
Exception 'Raised E|ception' (-1-:Thread-Id=05d5000a(pth=84a19000), Proc-Id=05d4000a(pprc=8419cb08) 'infiniivisionlauncher.exe', VM-active=05d4000a(pprc=8419cb08) 'infiniivisionlauncher.exe'
PC=40068ag0(coredll.dll+0x00058ae0) RA=803782c8(kernel.dll+0x000062c8) SP=0002f9b0, BVA=0002fabc
PARSE ERROR: Argument: ⬐l
  $          Couldn't find match for argument

As per your experience it then goes into a loop with this:-

ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\sh600_serial\.\sh600_serial_drv.cpp line 661: SER2 SER Driver: does not support multiple Open()'s

Hi Dean,

I use PuTTY http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html (http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html)
Start sending <space> at the very moment you turn on the scope. What do you see on the serial port when the scope is switched on?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: deanflyer on September 26, 2016, 07:26:51 pm
This is the output:-

U-B닁’‚Š‚r‚šBz5с‹Â’‚ŠŠjŠ¢Ò’ÂÒ‚²J
u¥±•¹ÑƒÕƒ‚jöÔHhU•šAÉÙÂjöDJªJŠ’Âj¥   5RþFlash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2016-9-26   19:43:43.86 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built MX^ˆ7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
RTC: 2016-9-26   19:43:43.90 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOXOXOOOOXXXOOOOOOOOOXOOOOXOXXOXXOXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOXOXXOOOXOXOOOXXOOOXOOOOXOXOOOOOXOOOXOOXOXOXOXXXXXXXOXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOX
OOOXOOXOOOOXOOOOXOXOOOXXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXXOOOOXOXOOOXOOOXOOXXOXOOOOXXXOXXXXXXOXOXXOXXXXXOXOXXOXXOOXXXOOXXOXXOXOOXXOXXXXOXXOOXOOOXOXXXXOOXXXOOOXOXOOOXOOXXXXXXXX
XXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x15264A8, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
  • : Address=0x80361000  Length=0x15264A8  Name="" Target=RAM

 Loading image 1 succeeded.
ROMHDR at Addres{ 80361044h
Preparing launch...
RTC: 2016-9-26   19:43:46.83 UTC
Launching windows CE image jy jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Bui¶t on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Oct 22 2015)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size"0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:21:28:BB
Phy found addr 31 (ticks=6588)
WaitForLink Start (ticks=6590)
No Link (ticks=7592)
<--EDeviceInitialize

GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Time for NANDFLASH to load: 1 ms.
Time for SNANDFLASH to load: 1 ms.
Our command line is
Performing Startup
Our command line is ⬐l all ⬐l b
Released build, Oct 22 2015, 11:30:59
Initializing FPGA...
****
FPGA Type: Kdaho
Ver: 2.027 Released
Build Time: Tue Oct 13 16:48:05 2015
Build Machine:"TS2404M
****
Performing Startup
Exception 'Raised E|ception' (-1-:Thread-Id=05d5000a(pth=84a19000), Proc-Id=05d4000a(pprc=8419cb08) 'infiniivisionlauncher.exe', VM-active=05d4000a(pprc=8419cb08) 'infiniivisionlauncher.exe'
PC=40068ag0(coredll.dll+0x00058ae0) RA=803782c8(kernel.dll+0x000062c8) SP=0002f9b0, BVA=0002fabc
PARSE ERROR: Argument: ⬐l
  $          Couldn't find match for argument

Brief USAGE:
   infiniivision0 [--ExtTalClk] [--IntTalClk] [--4GSa] [--5GSa]
                  [--flushNetwork] [--gpibModule] [--lanModule]
                  [--debugTestAddress <debugTestAddress>] [--noAdcResync]
                  [--noBlanketInit] [--noScreenSaver] [--twoChan] [-f
                  <string>] [--sliceid2] [--sliceid1]([--sliceid]
                  [--mondll] [--disdcc] [--oldadcstartup] [--noadcreset]
 "   $            [--forcemaxmem] [--newVga] [--invsoft] [--probecomp]
                  [/-calChannel <Channel Number>] [--codeSnitch] [-u <3
          0       character string>] ...  [-l <3 character string>] ...
                  [--traceFlags <Base10 number>] [--str] [--ctrlDiagStr
                  <Binary string>] [--ctrlDiagVal <Base10 number>] [--perf]
                  [--msg] [--dflt] [--noScoðe] [--srv] [--] [--version]
                  [-h]

For complete USAGE and HELP type:
   infiniZWkWëË R©   « 5{j¤üRelgased build, jŸ$&&H&LLM–11:30:59
Initializing FPGA...
****
FPGA Type: Idaho
Ver: 2.027 Released
Build Tioe: Tue Oct 13 16:48:05 2015
Build Machine: TS2404M
****
ERROR: c:\WRjT”'&W&*ª(*UÅê+‹«ß‹q!AAq
½µµ½¹qÉ¥Ù•ÉÍqÍ¡Ù‚‚ú5•É¥…±q¹âÍ¡Ù‚‚ú5•É¥…±}‘ÉÙ¹ÁÁ±ine 661: SER2 SER Driver: does not support multiple Open()'s
Error opening UART Driver.
No option module detected
No option module"öetected
Front Panel UART driver reset -- Contact ChrisG
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 26, 2016, 07:36:04 pm
Looks like you have some serial issues, it spits out garbage at the start and randomly further down.
But yes, you have 2 links:
> Our command line is
and
> Our command line is ⬐l all ⬐l b

Not sure what happened there with the -l all -l bw50 though. It complains about it even: PARSE ERROR: Argument: ⬐l so it doesn't look like a serial problem here.
Can you get the output text right using PuTTY or even another interface?



Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: deanflyer on September 26, 2016, 07:44:07 pm
HTERM isnt very pretty, heres a dump from PUTTY.

U-Boot ;010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2016-9-26   20:40:47.62 UTC

Microsoft Windows CE Bootloader Common Librcry Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
RTC: 2016-9-26   20:40:47.65 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOXOXOOOOXXXOOOOOOOOOXOOOOXOXXOXXOXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOXOXXOOOXOXOOOXXOOOXOOOOXOXOOOOOXOOOXOOXOXOXOXXXXXXXOXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOX
OOOXOOXOOOOXOOOOXOXOOOXXOOOOOO?OOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXXOOOOXOXOOOXOOOXOOXXOXOOOOXXXOXXXXXXOXOXXOXXXXXOXOXXOXXOOXXXOOXXOXXOXOOXXOXXXXOXXOOXOOOXOXXXXOOXXXOOOXOXOOOXOOXXXXXXXX
XXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x15264A8, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
  • : Address=0x80361000  Length=0x15264A8  Name="" Target=RAM

 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2016-9-26   20:40:50.58 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Oct 22 2015)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
[ER2(got!sysintr?0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 I?VE:0xLX??BRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:34:D3:21:28:JB
Phy found addr 31 (ticks=6610)
WaitForLink Start (ticks=6612)
No Link (ticks=7614)
<--EDeviceInitmalize

GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBamdwi?HwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0xc982
Rewriting Block at Sector Address 0xc982. 9089
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0xc982
Read Block SUCCEEDED 9133
Erased Block SUCCEEDED 9135
Completed rewriting Block SUCCEEDED 9182
Running infiniiVisionInstallHelper
Failed to start/configure network.
Time for NANDFLASH to load: 0 ms.
Time for SNANDFLASH to load: 0 ms.
Our command line is
Performing Startup
Our command line is ?l all ?l b
Performing Startup
Exception 'Raisef Exception' (-1): Thread-Id=05dc000a(pth=84a19000), Proc-Id=05d4000a(pprc=8419caf8) 'infiniivisionlauncher.exe', VM-active=05d4000a(pprc=8419caf8) 'infiniivisionlau?cher.exe'
PC=40068ae0(coredll.dll+0x00058ae0) RA=803782c8(kernel.dll+0x000062c8) SP=0002f9b0, BVA=0002fabc
PARSE ERROR: Argument: ?l
             Couldn't find match for argument

Brief USAGE:
   infiniivision  [--ExtTalClk] [--IntTalClk] [--4GSa] [--5GSa]
        !         [--flushNetwork] [--gpibModule] [--lanModule]
                  [--debugTestAddress <debugTestAddress>] [--noAdcResync]
                  [--noBlanketInit] [--noScreenSaver] [--twoChan] [-f
                  <string>] [--sliceid2] [--sliceid1] [--sliceid]
                  [--mondll] [--disdcc] [--oldadcstartup] [--noadgrmseu]
                  [--forcemaxmem] [--newVga] [--invsoft] [--probecomp]
                  [--calChannel <Channel Number>] [--codeSnitch] [-u <3
                  character string>] ...  [-l <3 character string>] ...
                  [--traceFlags <Base10 number>] [--str] [--ctrlDiagStr
                  <Binary string>] [--ctrlDiagVal <Base10 number>] [--perf]
                  [--msg] [--dflt] [--noScope] [--srv] [--] [--version]
                  [-h]

For complete USAGE and HELP type:
   infiniivision --help

Released build, Oct 22 2015, 11:30:59
Initializing FPGA...
****
FPGA Type: Idaho
Ver: 2.027 ReleX?YYC!?]Z?? Time: Tue Oct 13 16:48:05 2015
Build Machine: TS2404M
****
Released build, Oct :2 2015, 11:30:59
Initializing FPGA...
****
FPGA Type: Idaho
Ver: 2.027 Released
Build Time: Tue Oct 13 16:48:05 2015
Build Machine: TS2404M
****
ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\sh600_serial\.\sh600_serial_drv.cpp line 661: SER2 SER Driver: does not supqort multiple Open()'s
Error opening UART Driver.
No ottio? module detected
No option module detected
Front Panel UART driver reset -- Contact ChrisG
ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\sh600_serial\.\sh604_serial_drv.cpp line 661: SER2 SER Driver: does not support multiple Open()'?C?Q.?K?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 26, 2016, 07:49:41 pm
Yes, that looks better although there are still a few framing errors.

Not sure what happened to your lnk file but the '-' changed into a '?' and the bandwidth command is missing apart from the b: Our command line is ?l all ?l b
But the real issue here is that you have 2 lnk files. Easy to fix when you can stop the CE loader.
So switch on the scope and immediately put a foot on the space bar.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 26, 2016, 07:53:48 pm
you should see this when you are able to stop the CE bootloader:

Code: [Select]
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2016-9-3   21:5:35.81 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008



P500 Boot Loader Configuration :

Mac address .......... (00:30:D3:xx:xx:xx)
Ip address ........... (192.168.1.190)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0600000)
        2 (0xd1600000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: deanflyer on September 26, 2016, 08:11:43 pm
Ive tried about 20 times so far to interrupt u-boot, no luck

When do you hit the space bar?

Did you use the same pinouts as shown here (board layout is different on my scope, probably as its a 2 channel version):-

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895)

Im using only the TX and RX lines.

Thanks for all your help.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 26, 2016, 08:17:02 pm
This part is a little concerning:

ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0xc982
Rewriting Block at Sector Address 0xc982. 9089
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0xc982
Read Block SUCCEEDED 9133
Erased Block SUCCEEDED 9135
Completed rewriting Block SUCCEEDED 9182
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 26, 2016, 08:18:04 pm
Ive tried about 20 times so far to interrupt u-boot, no luck

I was not able to interrupt uboot, but I could interrupt the ce loader, see my previous post.

Quote
When do you hit the space bar?

Immediately after turning on the scope, just keep it pressed down for the auto repeat.

Quote
Did you use the same pinouts as shown here (board layout is different on my scope, probably as its a 2 channel version):-
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895)

Im using only the TX and RX lines.

Yes, I used the same pinout but... I hope you are also using the GND....? :-\
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 26, 2016, 08:20:01 pm
This part is a little concerning:

I've seen the same, not sure why and with a normal boot it does not show up.
There is some kind of trick where after a number of unsuccessful boots it tries an alternative.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: deanflyer on September 26, 2016, 08:26:24 pm
Ive tried about 20 times so far to interrupt u-boot, no luck

I was not able to interrupt uboot, but I could interrupt the ce loader, see my previous post.

Quote
When do you hit the space bar?

Immediately after turning on the scope, just keep it pressed down for the auto repeat.

Quote
Did you use the same pinouts as shown here (board layout is different on my scope, probably as its a 2 channel version):-
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895)

Im using only the TX and RX lines.

Yes, I used the same pinout but... I hope you are also using the GND....? :-\

Im using a laptop, no mains.

I've tried keeping the space key pressed down, nothing happens.

Worst case I send it back to Agilent I suppose.....

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 26, 2016, 08:29:49 pm

Im using a laptop, no mains.

I mean the GND connection on the header in the scope, where you have the TX and RX connections. You need to connect the GND too!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: deanflyer on September 26, 2016, 08:36:40 pm
yes Ive got that too. Been a long day!

Might try another UART board, just trying a cheapy FTDI I had lying around.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 26, 2016, 08:39:51 pm
Might try another UART board, just trying a cheapy FTDI I had lying around.

I used kind of the same, but I see errors in your RX data so it's not perfect. Maybe the TX <space> does not make it to the scope? Did you try holding down the space bar before switching on the scope?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: deanflyer on September 26, 2016, 08:57:13 pm
Found another FTDI board, worked first time!  :-+

So im assuming I now have to use "download from platform builder", the scope picks up a DHCP address and I upload the compiled file (unfortunately im a Windows man, so will have to dig out a copy of Linux to compile it)?

Edit - Skip that, realised this is a Win source file (CE, doh!). So just a quick compile with Visual C then?



Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 26, 2016, 09:07:20 pm
Found another FTDI board, worked first time!  :-+

Finally!  :-+

Quote
So im assuming I now have to use "download from platform builder", the scope picks up a DHCP address and I upload the compiled file (unfortunately im a Windows man, so will have to dig out a copy of Linux to compile it)?

No... the compiled version is in this post: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022267/#msg1022267 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022267/#msg1022267)

Put it in a folder together with the nk.bin (how to get it is here: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022248/#msg1022248 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022248/#msg1022248) ) run the executable and it will wait for the scope asking for the nk.bin. Switch on the scope, halt the CE loader and use the Download from platform builder. The scope will boot and maybe or maybe not hang at the splash screen. Now you can get a telnet connection to remove the malicious .lnk file you copied over from the USB stick. Now the scope should boot as it did before. If you get this far we'll discuss the next step  ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tomaz on September 26, 2016, 09:09:47 pm
Is it possible to load 2.41 on USB, if you have 2.35,2.37,2.39 firmware version?

Found tools online how to extract nk.bin.comp to nk.bin and then extract all files in nk.bin:
Tools used: https://www.samkear.com/hardware/depth-analysis-motorola-vip2250-dvr-receiver (https://www.samkear.com/hardware/depth-analysis-motorola-vip2250-dvr-receiver) (search for "nkbintools and CreateDump.bat")
splashce.zip->\splashce\SplashGenerator\Resources\bincompress.exe from http://www.java2s.com/Open-Source/CSharp_Free_Code/File/Download_Windows_CE_Splash_Generator.htm (http://www.java2s.com/Open-Source/CSharp_Free_Code/File/Download_Windows_CE_Splash_Generator.htm)

d:\temp>bincompress.exe /d nk.bin.comp nk.bin
d:\temp>CREATEDUMP.bat


I have tried to prepare bootable USB but don't know file structure of nk.bin. CreateDump will dump all files in one folder. Now I have two files with same name:
size: 11.584 infiniiVisionLauncher.exe (in .cab)
size: 5.632 infiniiVisionLauncher.exe (in nb.bin.comp)

I tried copying files from 2.41 to USB, but USB didn't boot on 2.35 fw :(
Also tried copying all .dll's from (nb.bin) to USB (\Secure\infiniiVision\)

Any idea how would convince infiniiVisionLauncher.exe to launch new infiniiVisionCore.dll (v2.41, size: 10.472.256).
Tried to use infiniiVisionLauncher.exe from older versions with new 2.41 infiniiVisonCore.dll - also didn't work :(
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: deanflyer on September 26, 2016, 09:17:34 pm
Found another FTDI board, worked first time!  :-+

Finally!  :-+

Quote
So im assuming I now have to use "download from platform builder", the scope picks up a DHCP address and I upload the compiled file (unfortunately im a Windows man, so will have to dig out a copy of Linux to compile it)?

No... the compiled version is in this post: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022267/#msg1022267 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022267/#msg1022267)

Put it in a folder together with the nk.bin (how to get it is here: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022248/#msg1022248 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022248/#msg1022248) ) run the executable and it will wait for the scope asking for the nk.bin. Switch on the scope, halt the CE loader and use the Download from platform builder. The scope will boot and maybe or maybe not hang at the splash screen. Now you can get a telnet connection to remove the malicious .lnk file you copied over from the USB stick. Now the scope should boot as it did before. If you get this far we'll discuss the next step  ;)

Okay, got that. Do I need to use 2.35, seeing as the original firmware was 2.41?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 26, 2016, 09:20:30 pm
@tomaz:

I'm not familiar with creating a bootable USB stick because I started tinkering with version 2.41 which doesn't support booting from USB. If you want to know how to do it read this thread from the beginning, it is explained very clearly. The tools I used to decompress nk.bin can also be found in this thread.
So, if you want to experiment read the whole thread and you will find all the information you need.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 26, 2016, 09:23:04 pm
Okay, got that. Do I need to use 2.35, seeing as the original firmware was 2.41?

I used 2.35 and it worked for me, so if you want to play safe just use that version. Having said that I did choose it randomly, I'm sure other versions will work also.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: deanflyer on September 26, 2016, 09:55:01 pm
Okay, stupid question time. Which tool do I use to extract mk.bin from mk.bin.comp.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 26, 2016, 10:04:20 pm
Okay, stupid question time. Which tool do I use to extract mk.bin from mk.bin.comp.

See attached.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: deanflyer on September 26, 2016, 10:21:21 pm
Woohoo! Im in, new image transferred across. I can now telnet into the scope using standard user/pass.

Wnet to Secure/Startup, deleted the additional .lnk and its now working.

Cant thank you enough PAOPBZ. Was sweating for a while.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on September 26, 2016, 10:31:16 pm
I feel a bit responsible for these recent  'issues', I supplied the 2 scopes that have been troublesome. They were both very recent returns repaired by Keysight and with 2.41 installed by Keysight. They seem to be doing something odd now, I've sold lots of other scopes with Keysight installed 2.41 that people have played with without problems.

I have one more of these recent 2.41 scopes on my desk. I have a LAN card as well. Is there anything I could look at to see why these recent versions are causing problems? Maybe delete or rename the rogue LNK file and then attempt the option installation?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 26, 2016, 10:49:28 pm
I feel a bit responsible for these recent  'issues', I supplied the 2 scopes that have been troublesome. They were both very recent returns repaired by Keysight and with 2.41 installed by Keysight. They seem to be doing something odd now, I've sold lots of other scopes with Keysight installed 2.41 that people have played with without problems.

I have one more of these recent 2.41 scopes on my desk. I have a LAN card as well. Is there anything I could look at to see why these recent versions are causing problems? Maybe delete or rename the rogue LNK file and then attempt the option installation?

I don't think you should feel responsible for people hacking their scopes, lol. I also can't help but wonder why it seems to work 99% of the time but now and then it fails.
Is it possible people aren't waiting long enough at some point and rebooting too soon? I know that if you have a lan card it seems much better to copy the link file manually.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 27, 2016, 06:47:09 am
I feel a bit responsible for these recent  'issues', I supplied the 2 scopes that have been troublesome. They were both very recent returns repaired by Keysight and with 2.41 installed by Keysight. They seem to be doing something odd now, I've sold lots of other scopes with Keysight installed 2.41 that people have played with without problems.

The only one responsible for the 'issues' is the person bricking the scope unless you did set up a booby trap :)

Quote
I have one more of these recent 2.41 scopes on my desk. I have a LAN card as well. Is there anything I could look at to see why these recent versions are causing problems? Maybe delete or rename the rogue LNK file and then attempt the option installation?

Use telnet to see if there is a infiniivision.lnk  in Secure\Startup. If so, then using the USB key to copy the infiniivision_ext.lnk will end up in the scope trying to run the infiniivision exe twice and give you the problem we found.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 27, 2016, 07:13:17 am
I feel a bit responsible for these recent  'issues', I supplied the 2 scopes that have been troublesome. They were both very recent returns repaired by Keysight and with 2.41 installed by Keysight. They seem to be doing something odd now, I've sold lots of other scopes with Keysight installed 2.41 that people have played with without problems.

The only one responsible for the 'issues' is the person bricking the scope unless you did set up a booby trap :)

Quote
I have one more of these recent 2.41 scopes on my desk. I have a LAN card as well. Is there anything I could look at to see why these recent versions are causing problems? Maybe delete or rename the rogue LNK file and then attempt the option installation?

Use telnet to see if there is a infiniivision.lnk  in Secure\Startup. If so, then using the USB key to copy the infiniivision_ext.lnk will end up in the scope trying to run the infiniivision exe twice and give you the problem we found.

There is always an infiniivision.lnk in \secure\startup with version 2.41.
It is an empty file though, and it doesn't need to be removed for the hack to work, so it being there is not the cause of the problem.
The mod is nothing more then copying infiniivision_ext.lnk to \secure\startup
No files get removed.

From my scope:

    Directory of \secure\startup

07/07/15  07:32p                           0 infiniivision.lnk
08/13/16  10:06p                          53 infiniivision_ext.lnk
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 27, 2016, 07:28:19 am
Yes, I should have been more clear. On my scope the infiniivision.lnk was not empty but contained something like "#\folder\infiniivisionLauncher.exe" (forgot what exactly was in there) so that's why it was trying to run the launcher twice after copying the infiniivision_ext.lnk.
So check for a not-empty infiniivision.lnk

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on September 27, 2016, 08:13:36 am
Just packing some boxes this morning, this afternoon I'll have a poke about in this virgin 2.41 scope thats just come back from Keysight.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: deanflyer on September 27, 2016, 08:40:48 am
Just having a look at /secure/startup and I have:-

06/24/16  05:06p                          59 infiniivision.lnk
09/26/16  05:49p                          69 infiniivision_ext.xxx (originally infiniivision_ext.lnk)


As per previous threads, on boot the scope tries booting two instances and hangs.

Interestingly, infiniivision.lnk is not empty on my scope, but contains:-

56#"\Program Files\InfiniiVision\infiniiVisionLauncher.exe"


Also, for some reason the infiniivision_ext.lnk file was corrupted with the - (hyphen) character being a non printable character. Not sure how that happened.



Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on September 27, 2016, 04:03:26 pm
Ok...

DSOX2002A with 2.41 just back from Keysight....

Use cheapo LAN card (thanks Trevor White!) and Telnet to get inside it.

Telnet
Code: [Select]
o hostname
infiniivision
skywalker1977
cd \secure\startup

Sure enough, an infiniivision.lnk file 50 something bytes long containing a command line that launches the program.

Lets not be doing that, get it out of the way...

Code: [Select]
ren infiniivision.lnk infiniivision.xxx
Then make a new infiniivision.lnk on USB stick containing

Code: [Select]
63#\secure\infiniivision\infiniivisionlauncher.exe -l all -l bw20
Copy it onto the scope

Code: [Select]
copy usb\infiniivision.lnk
Reboot and job done.

What were you lot playing about at  ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 27, 2016, 04:44:34 pm
So maybe there are two versions of 2.41 floating around, or the contents of the original link file depend on how/when 2.41 was installed/upgraded etc.
Perhaps memset can make an upgraded install cab that overwrites that file with an empty one just to make sure.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on September 27, 2016, 05:02:59 pm
I couldn't be bothered before but I just followed the very helpful instructions and it works straight away. No problems. I think my scope was repaired and updated by Keysight some time this year I think? Maybe it was last year. I cant remember but they put Keysight branding and 2.41 firmware on it.

Many thanks Ian.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 27, 2016, 05:20:09 pm
What were you lot playing about at  ;)

That's not fair, we told you what to look for and you did :P Not much choice for me back when I tried to unlock it because I had no LAN module, so all I could try was the USB stick.
Anyway, maybe it's safer to change the USB stick method to use infiniivision.lnk and not infiniivision_ext.lnk.
A common thing of all the troubled scopes is that they had a short stay at Keysight recently, so my bet is that they are having a lot of fun reading this thread...

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 27, 2016, 05:31:20 pm
TopLoser

This is interesting, I don't know why but I was under the impression that 2.41 couldn't be "unlocked" by editing the \secure\startup link as it was done with previous versions of firmware because it was ignored. However based on your post it seems it is working just fine.
Can you confirm if you go to the web interface it will display the IP address properly?
For those using the infiniivision_ext.lnk the web interface has some issues unless a bunch of "work arounds" are done.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 27, 2016, 05:45:49 pm
For those using the infiniivision_ext.lnk the web interface has some issues unless a bunch of "work arounds" are done.

AFAIK if you just use DHCP the only issue is that it does not display the IP address correctly, but it will work fine.

The _ext part of the lnk is just a name, nothing else. The difference is the launcher exe that is called from the link, either the one in program files (will not respond to the -all and other options) or the one in the secure folder which is fine with the options but gives the wrong display of the IP address.

Correct me if I'm wrong of course...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 27, 2016, 05:59:45 pm
Ahh, ok, so it is just the name of the file. It is more then just the IP not displaying properly. A lot of the web interface is very slow as well.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on September 27, 2016, 07:20:45 pm
What were you lot playing about at  ;)

That's not fair, we told you what to look for and you did :P Not much choice for me back when I tried to unlock it because I had no LAN module, so all I could try was the USB stick.
Anyway, maybe it's safer to change the USB stick method to use infiniivision.lnk and not infiniivision_ext.lnk.
A common thing of all the troubled scopes is that they had a short stay at Keysight recently, so my bet is that they are having a lot of fun reading this thread...

There are a lot of very intelligent and creative people on this thread, and you're very much one of them. I just take advantage of what you do, and it's very much appreciated by a lot of people.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on September 27, 2016, 09:05:45 pm
So maybe there are two versions of 2.41 floating around, or the contents of the original link file depend on how/when 2.41 was installed/upgraded etc.
...

...
A common thing of all the troubled scopes is that they had a short stay at Keysight recently, so my bet is that they are having a lot of fun reading this thread...

Hmmm...  this reminded me...

When I had a problem a couple of years ago, Keysight tech support helped me and they told me to download a copy of 2.20 (3000XSeries.02.20.2012110802.cab) from their FTP site because the web site had already been updated to a new version.

I happened to already have a copy of 3000XSeries.02.20.2012110802.cab (because I never delete anything it seems), so I decided to compare them.  Surprisingly, they were different.

There's a precedent by Keysight to change the binaries and call it the same version, AND with the same date code.  So much for version control.


Additional info: I don't think it matters which files were different since this was an ancient version, but someone's going to ask.  The different files were:

  NK.BIN.COMP
  infiniiVisionSetup/build/Secure/infiniiVision/infiniiVisionCore.dll
  infiniiVisionSetup/build/Secure/infiniiVision/infiniiVisionLauncher.exe
  infiniiVisionSetup/build/Secure/infiniiVision/infiniiVisionWebCom.dll
  infiniiVisionSetup/build/Secure/infiniiVision/upgrade/infiniiVisionWebCom.dll
  infiniiVisionSetup/build/Secure/infiniiVision/vncserver.dll





Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Uup on September 29, 2016, 02:45:21 pm
I've been looking at the firmware for the MSOX4k series (4.08). Much like 2.41 for the 2k/3k it has two different infiniivisionlauncher.exe files and the infiniivision.lnk file is not empty either.

Interestingly, the infiniiVisionLauncher.exe file in the secure/infiniivision directory crashes with an error when executed, so it doesn’t appear to be compatible with the 4K series. The infiniivisionlauncher.exe file that is used is located in the Program Files directory.

It appears as though the bytes to change in infiniivisioncore.dll start at location 0x407a50. Can someone confirm that location?

http://www.filedropper.com/4kcore (http://www.filedropper.com/4kcore)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: [IDC]Dragon on October 08, 2016, 07:26:09 am
Hi, I'm "new" to this looong thread and would appreciate a summary, what's the status with unlocking the DSOX3000T scopes? Is it possible, or at least some light at the end of tunnel?
The impression I got is that the older, non-touch predessor can be unlocked by booting an alternative firmware from a USB stick. For the current models, all my googling hasn't found a solution. Is that true?

It's kind of crucial for my buying decision, which scope can/should I get. As a hobbyist, the premium for digital channels, bandwidth unlocks and serial decoding is way out of reach. Currently, I'm close to getting a Tek MDO3014 because of available upgrade ability, althought the scope has inferior (UI) performance compared to Keysight.

Thanks a lot!
(Forgive me if this is kind of RTFM)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on October 08, 2016, 07:36:24 am
At the moment the DSOX3000T is not hacked - I'd still recommend reading through this entire thread even though it may take a few hours - there is tons to learn and if you're going to hack something you should spend the time to read about it so you know what you're actually doing and what the potential issues etc might be.

You may want to consider a used DSOX3000A series - deals on them do show up quite often.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ogoun on October 14, 2016, 04:23:27 am
I've been looking at the firmware for the MSOX4k series (4.08). Much like 2.41 for the 2k/3k it has two different infiniivisionlauncher.exe files and the infiniivision.lnk file is not empty either.

Interestingly, the infiniiVisionLauncher.exe file in the secure/infiniivision directory crashes with an error when executed, so it doesn’t appear to be compatible with the 4K series. The infiniivisionlauncher.exe file that is used is located in the Program Files directory.

It appears as though the bytes to change in infiniivisioncore.dll start at location 0x407a50. Can someone confirm that location?

http://www.filedropper.com/4kcore (http://www.filedropper.com/4kcore)

I can confirm that the 4K series operates the same way as the 2k and 3k series. V3.21 can be patched and operates as per the descriptions here. Patch location for DSOX40x4A  infiniivisioncore.dll is 0x355180. As with the 2k and 3k series, replace 04 00 a0 e1  to 00 00 a0 e3.

Will be testing v4.08 soon.

Can anyone confirm that v4.08 has the same telnet user/pass as the 2k and 3k series? V3.21 is the same (I want to avoid flashing the new firmware into it if I will lose telnet access...).

Also, for those who have old versions of the firmware, for any model (2k, 3k, 4k).. PLEASE post them somewhere that doesn't delete the files after a couple of weeks.. All the filedropper links older than a few weeks are dead.

l8r,
o
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Uup on October 15, 2016, 11:09:35 am
I can confirm that the telnet login is unchanged on 4.08.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Uup on October 15, 2016, 11:38:38 am

Also, for those who have old versions of the firmware, for any model (2k, 3k, 4k).. PLEASE post them somewhere that doesn't delete the files after a couple of weeks.. All the filedropper links older than a few weeks are dead.


This link should stay valid. The password is: eevblog

https://mega.nz/#!LEJDBAyJ!wZrQn57wSkuRRLZ5bRvVrPOqpfyWcZ1r-Mclo07hVSQ
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: [IDC]Dragon on November 02, 2016, 09:21:24 pm
The tread convinced my to buy a DSOX3014A.
(Read this, Keysight, I bought your product because of the marvellous findings in this thread)
Currently there is a buy-in discount of 30%, which helped the decision even more.
The A model is still available, although for pretty much the same price as the T (touchscreen) model, which unfortunately AFAICT can't be unlocked as of now. Feels subobtimal to buy a brand new older model, but I didn't want to bet on achievements about the T.
A used one would have been fine with me, I've looked for quite some time, but haven't found a good offer.

Anyway, shiny new scope arrived today. I briefly tested it. Quickly came the urge to uncripple it. It has firmware 2.41.something, so I went ahead with memset's link method. I used a command line another user already reported working:
Code: [Select]
72#\Secure\infiniiVision\infiniivisionLauncher.exe -l all -l BW20 -l SCPIPSMainly because of all options plus 200MHz bandwidth, admittedly I don't know what SCPIPS is supposed to do.
But nooo, the scope is bricked now. The restart after the firmware update was already unsuccessful, hanging with the greet splashscreen but a "light show" of the front panel LEDs. I turned it off after a while, on further attempts it was showing a black screen with Keysight logo, and the somewhat comforting "unfinalized software" warning, on another attempt the warning quickly went away. Currently, it always does the splash screen light show.

I have no network interface yet. Hopefully that can fix it. Would it work straight away without ever being configured?
The magjack is ordered, no PCB yet. Does anybody have a leftover one to sell, or the other way round: If I have to order a couple, any other takers? Less urgent: did anybody bother to construct a 3D model for the module enclosure?

Would the serial port help to unlock me? I've opened the device to connect it, but the header J3402 is unpopulated, instead its neighbor.

(Bummer, I feel so stupid about bricking this thing on its very first day...  :-[ )

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on November 02, 2016, 09:39:04 pm
The previous couple of pages of this thread contain all the information you need about your problem and the solution. It's really unfortunate you didn't read it all first, but you can bring it back to life the hard way.

3D models are available, in fact you can buy the parts directly from Shapeways if you want.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on November 02, 2016, 09:51:46 pm
There is a 3D printed faceplate and spacers available for one of the PCB's that has been designed. It isn't a full enclosure but fits and looks great. The files can be downloaded so you can print it yourself.
Your scope will come back to life once you get a network card.

I don't recommend anyone try enabling features unless they have a network card.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on November 02, 2016, 09:55:14 pm
http://www.shapeways.com/search?q=dsoxlan&type=product (http://www.shapeways.com/search?q=dsoxlan&type=product)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: deanflyer on November 02, 2016, 10:01:46 pm
Dont feel too bad, I did the same. Read my previous posts (PAOPBZ did all the hard work after he bricked his). Basically you will need to use the serial port to get the scope in a position to download an image over Ethernet.

Where are you? I can loan you my LAN card if you are stuck.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on November 02, 2016, 10:06:29 pm
http://www.shapeways.com/search?q=dsoxlan&type=product (http://www.shapeways.com/search?q=dsoxlan&type=product)

Here is a link with the .stl files so you can print your own. Again be sure the PCB you get matches, there are many different dsoxlan PCB designs out there.
http://anagram.net/nuts/DSOXLAN/ (http://anagram.net/nuts/DSOXLAN/)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: [IDC]Dragon on November 03, 2016, 10:05:08 pm
Today I got the serial connected. (Header was alright, only the orientation was flipped...)
Indeed it seems I 've got the same problem, the application tries to start twice, logs attached. There are two flavours, probably depending on the race outcome:
- The black screen with the logo repeatedly asks to contact Chris G.
- The Keysight splash screen just hangs.

Did I do something wrong to provoke this, or could the cab file be improved to avoid that situation?
The leading number in the .lnk file was excluding the # char and the file had no CR LF.

Thanks for the LAN 3D design link. Tempting to just order it from Shapeways. It seems to match the anagram.net PCB, but not the aewalin github.
Also thanks for the loaner offer. I'm from germany, profile updated. Prefer to buy a spare PCB, though.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: delphi_firebird on November 04, 2016, 10:54:43 am
@[IDC]Dragon

@hax129 forum member  ( https://www.eevblog.com/forum/profile/?u=25498 (https://www.eevblog.com/forum/profile/?u=25498) ) sold me a LAN kit for a very good price
he shipped it last monday from Denmark to France ( it is on the way )
You can contact him by PM if you are interested

The kit contains :
Main PCB
Back-plate PCB
LAN connector
1 x 10R resistor (R200)
2 x 300R resistors (R201+R202)
2 x 100nF capacitors (C200+C201)

Good luck
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: [IDC]Dragon on November 07, 2016, 09:53:19 pm
A total of 3 friendly forum members did offer me a LAN interface, thank you guys!
I've decided for the nice one with the Shapeways cover, so it can snap in and stay in place even under cable stress.
Now eagely waiting for it to arrive.

So, I understand I have to do the following after it arrives:
- using the serial, interrupt the boot with space, which brings me to CE loader (not uboot, like I first thought)
- it tells me the scope has address 192.168.1.131, so I have to prepare a little network for that
- on a PC, start the CELoader tool from ninja user PA0PBZ, with a NK.BIN.COMP file from some firmware cab renamed to NK.BIN and placed next to it
- hit 'd' at the CE loader prompt to download it
- edit: I see it tries some DHCP, so above IP may not be the final one, I may attach it to my regular network
- anyway: how to specify the server?
- it should load the firmware and make the scope temporarily useable again
- telnet into the scope (perhaps configure network first?) and fix a dual link problem
- be good again

Did I get that correctly?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on November 07, 2016, 10:13:48 pm
- using the serial, interrupt the boot with space, which brings me to CE loader (not uboot, like I first thought)
- it tells me the scope has address 192.168.1.131, so I have to prepare a little network for that
- on a PC, start the CELoader tool from ninja user PA0PBZ, with a NK.BIN.COMP file from some firmware cab renamed to NK.BIN and placed next to it

Not rename but decompress, a link to the tools can be found in this thread.

Quote
- hit 'd' at the CE loader prompt to download it
- edit: I see it tries some DHCP, so above IP may not be the final one, I may attach it to my regular network
- anyway: how to specify the server?

The scope will find the celoader tool as long as it is on the same network. (think dhcp and tftp)

Quote
- it should load the firmware and make the scope temporarily useable again
- telnet into the scope (perhaps configure network first?) and fix a dual link problem

Network should be fine already otherwise it will not load the firmware.
Quote
- be good again

Did I get that correctly?

Enjoy  ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ogoun on November 10, 2016, 08:11:07 am
For those interested, the firmware for the 4000 series v4.08 does NOT allow the command line switches to work.
So, it is similar to the 3000a firmware v2.41 in structure, but the dll would need to be modified in the usual way at the appropriate location to allow the lic hack switches to work.

FWIW, the infiniivisionlauncher.exe file exists in both \secure\infiniivision, and \windows. They are different sizes, and the one in the infiniivision folder throws an error box if you try to launch it (cmd line switches or not). This is after killing the currently running instance of infiniivisioncore.dll, of course.

The one in \windows works as expected, except cmd line switches not working.

Of course, the \windows directory files are all RO, and probably some hidden ones too. ATTRIB refuses to make them RW, probably since the structure now in use with 4.08 (and I imagine 2.41) makes the \windows directory part of flash rom, not RAM.
Apparently, this also means that the files and file structure in this directory is somehow "munged", in a way that the CE OS knows how to deal with, but that the FS cant handle (?? headers stripped, etc).

Upshot: No easy way to copy or replace the files there.

If anyone has looked into the infiniivisioncore.dll code (ida, etc), drop me a PM. I am trying to find out where the string compared with "true" comes from. The routine is common to all versions, and 3 such routines are close to each other. Only one is relevant to this discussion (cmd line switch processing), AFAIK.

I would imagine that the string likely comes from a config or debug file, but I haven't managed to trace the flow back.


cya
o   
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: [IDC]Dragon on November 11, 2016, 08:43:28 pm
The network interface was in the mail today.
Thanks to the tools and descriptions from PA0PBZ, the scope was quickly back to life, with all features working.
Now I'm exploring...
(Great scope, quick display and reactions. Guess I'm glad I didn't pick the Tek MDO.)

Thanks again, guys!

PS: Looking behind the scenes of the "link method" CAB file, it should be easy to modify it such that it moves an existing link away, preventing this brick problem in future. After re-gaining confidence, I'll probably try to come up with such.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: [IDC]Dragon on November 13, 2016, 10:21:02 pm
In case I'm not the last noob to join the party, hope to close the boobytrap.
Here is a refined procedure, see attached. No benefit for existing users, this is rather for newcomers, to prevent bricking with the dual link problem.
The readme file is updated, all credits for the method in general to user "memset".

I've split the procedure into an install CAB which moves away the factory link (if present) and copies the .lnk file from USB, and an uninstall CAB which removes the added .lnk and restores the original link, if one was present.
The supplied .lnk file should be a useful template on how to set all options:
Code: [Select]
121#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l TOM -l BW20It's using "-l DIS" to enable most of them (instead of "-l all" which gives asterisk marks in the about box), then filling up the rest. You may want to edit your bandwidth at the end.

I've tested uninstall, install and more install to update on my 3014A. So far not tested on a 2000 series model, but according to previous postings that should work, too.
Use at your own risk, of course.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: [IDC]Dragon on December 10, 2016, 04:51:26 pm
I'm pleased to report that I've also done the frontend upgrade. Kudos to the brave members who reverse engineered the differences!
Here's my Mouser shopping cart:
http://www.mouser.com/ProjectManager/ProjectDetail.aspx?AccessID=BF470B281D (http://www.mouser.com/ProjectManager/ProjectDetail.aspx?AccessID=BF470B281D)
It also includes the 2 inductors for the 5 GSa/s PLL mod, which I haven't done yet. What's the experience with that?

Some testing with a "Jim Williams" avalanche pulse generator. The difference is quite stunning, the vision clears like putting on the correct glasses.

Before, with 200 MHz bandwidth option:
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=277028;image)

After frontend mod, with 500 MHz bandwidth option (same amplitude and timebase, although better would be possible):
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=277030;image)

Good old analog Tektronix 2467B (400 MHz bandwidth):
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=277032;image)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on December 10, 2016, 06:12:24 pm
Awesome, congrats on the mod! I've been waiting for someone else to take the plunge.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on December 10, 2016, 09:52:57 pm
:TheSteve

I have to say first many thanks for your effort and for all other members on front-end upgrade procedure.

I'm really thinking on doing a 3000T front-end upgrade from 100Mhz to 350 Mhz, and I would really appreciate some help from you. Are the parts needed the same as those for 3000A Series?
Has anyone completed a 3000T frontend upgrade?

All my regards.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on December 11, 2016, 12:29:50 am
:TheSteve

I have to say first many thanks for your effort and for all other members on front-end upgrade procedure.

I'm really thinking on doing a 3000T front-end upgrade from 100Mhz to 350 Mhz, and I would really appreciate some help from you. Are the parts needed the same as those for 3000A Series?
Has anyone completed a 3000T frontend upgrade?

All my regards.

I'm not aware of anyone who has attempted the mod. I think you'd need to open it up and take some good quality pictures of the PCB(especially under the front end cans) and post them so we can compare.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on December 11, 2016, 08:43:05 am
I hope to find some time to start this mod. Will keep you updated. Thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on December 11, 2016, 09:25:05 am
How are you going to enable the 350MHz option in software first?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Someone on December 11, 2016, 10:13:52 am
How are you going to enable the 350MHz option in software first?
On the basis that the 3000T has the same "return to service center" requirement as the 3000A when you go from 100MHz to 350MHz:
http://www.keysight.com/en/pdx-x205434-pn-DSOXT3B1T34U/3000t-x-series-4-channel-bandwidth-upgrade-100-to-350-mhz?cc=US&lc=eng (http://www.keysight.com/en/pdx-x205434-pn-DSOXT3B1T34U/3000t-x-series-4-channel-bandwidth-upgrade-100-to-350-mhz?cc=US&lc=eng)
It wont need a license as the scope will jump right to 350MHz. Even with a 200MHz license installed the 3000X still enables 350MHz when it sees the board coding/strapping for the 350/500MHz acquisition front end. Hardware hacking for the win.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on December 11, 2016, 10:25:18 am
So going from 100MHz to 200MHz is a software only option but 100/200 to 350 is hardware enabled?

Thats very convenient.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on December 11, 2016, 12:34:18 pm
So going from 100MHz to 200MHz is a software only option but 100/200 to 350 is hardware enabled?

Thats very convenient.

Looking back retrospectively it is a bit strange that they didn't just put in the parts for a 500MHz scope and cripple it in the same way as they did for 100 vs 200 or 350 vs 500. I am not sure if the software configured bandwidth limitations are implemented in the analogue or digital domains.

If it's in the analogue domain, then I'd imagine there's a limitation in the front end ASIC that only supports two filter settings largely determined by the parts around it. If all the filtering is done in the digital domain then I don't know why they didn't just place the 500MHz parts in at manufacturing and use software switchable digital filtering for all four options. As I recall, there was no apparent cost difference for the front end BOM for the 500MHz scope compared to the 100MHz scope.

There is a third posibility, and that's a marketing one, but as we're predominantly engineers here, I won't pretend to understand how that bit might work, but we can all speculate!

This of course may be all moot, as we don't know that the front end in the 3000T is sufficiently similar to that of a 3000A.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on December 11, 2016, 01:40:41 pm
Marketing sound reasonable.
Look for how long the DSOX series was being sold and nobody did this kind of hardware mod (at least they did not talk about it on the net) or even a comparision of the two front ends. Agilent came out 2010 (or 2011) with the DSOX3000 series, thus it took 6 years for this (again: thank you memset and howard and all others who provided their knowledge and risking their hardware to achive this).

If you then look for the price differences (actual pricing) of a DSOX3000
100 Mhz: 3672€
200 Mhz: 4095€
350 Mhz: 7638€
500 Mhz: 10306€
1 Ghz: 12791€

it is be much easier for the sales people to explain the huge price difference between e.g. a 200 and 350 Mhz with "different hardware" which sounds like / implicates (and maybe the sales people are also saying this*) a huge amound of expensive extra circuitry inside the scope which is just too complex and too expensive to be included in all units. This makes it easy for them to justify the price gap.

* but maybe we are all wrong and in real, all 350 Mhz and higher scopes had to be manually carefully calibrated by elf-like virgins and this works best only in August-full moon nights on a small Malaysian island.....
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on December 11, 2016, 06:29:28 pm
It's quite entertaining to read the other main thread about the DSOX3000 series and how even Dave posted that the 500 MHz model had a much more expensive front end then the 100/200 MHz after speaking to a contact at Agilent. And I think a number of years back we all would have believed it. Fast forward to 2016 and I'd find it odd if they used more then a single PCB rev to do the entire 3000T series.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on December 11, 2016, 06:51:59 pm
Exactly as it was said already, there are 3 versions of the frontend
1) 100 (HW) and 200Mhz (software option)
2) 350 (HW) and 500 Mhz (software option)
3) 1 Ghz (HW)

I, like :TheSteve said, believe they are using 1 PCB for all versions. The big cost difference on the frontend hardware upgrade, is not coming from the hardware. The BOM won't be much different for any of the higher bandwidth versions (look at :[IDC]Dragon shopping cart and you'll see under 50EURO cost for the parts)  , though they would charge for calibration and workmanship , which can go very high. Workforce is now the main cost in many servicing businesses.

I'm really interested in trying to go even to 1Ghz if possible. I'll post pro quality pictures of my 3014T frontend soon. If anyone is kind enough to post 3054T or 3104T frontend pictures I'd be really be indebted.


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on December 11, 2016, 06:54:44 pm
1 GHz would be awesome - we would have gone there with the original 3000 series if the PCB had been the same. Tough to properly shoe-horn in the 50 ohm attenuator relays with no footprint for them.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on December 11, 2016, 09:17:02 pm
Indeed, and the difference in BOM cost between 100MHz and 1GHz is probably ITRO $20. This is assuming there's no difference in the ADCs, ASICs and FPGAs to support 5GSa/s vs 4GSa/s, and it's just the front end relays.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Zucca on December 15, 2016, 07:54:17 am
I have a stock 500MHz, I keep watching here to make the big jump to the Ghz moon... so far no big news as I understand. Do you need high res pics of the 500Mhz front end? IMO no, in any case PM me I'll do my best to support you talented guys.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on December 15, 2016, 08:46:52 am
I have a stock 500MHz, I keep watching here to make the big jump to the Ghz moon... so far no big news as I understand. Do you need high res pics of the 500Mhz front end? IMO no, in any case PM me I'll do my best to support you talented guys.
what I understood is that:
1) the boards for 100 - 500 Mhz are the same, 350/500 Mhz are just using some different capacitor/inductor values at the front end compared to the 100/200 Mhz boards.
Thus upgrade 100->200 and 350->500 Mhz can be done by software. 100/200 -> 350/500 Mhz will just need a few some parts replaced.
2) the 1 GHz board is indeed different (addl. relay etc.), thus an 'upgrade'  will not be possible (at least not an easy upgrade).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on December 15, 2016, 10:14:19 am
I have a stock 500MHz, I keep watching here to make the big jump to the Ghz moon... so far no big news as I understand. Do you need high res pics of the 500Mhz front end? IMO no, in any case PM me I'll do my best to support you talented guys.
what I understood is that:
1) the boards for 100 - 500 Mhz are the same, 350/500 Mhz are just using some different capacitor/inductor values at the front end compared to the 100/200 Mhz boards.
Thus upgrade 100->200 and 350->500 Mhz can be done by software. 100/200 -> 350/500 Mhz will just need a few some parts replaced.
2) the 1 GHz board is indeed different (addl. relay etc.), thus an 'upgrade'  will not be possible (at least not an easy upgrade).
That is also my understanding, plus that the sampling rate is 5GSa/s compared to 4GSa/s, so I don't know if there is anything different beyond the AFE such as ADC, FPGA or ASIC speed grades.

One thing I had considered is whether or not the Teledyne relay is really required, or it can use the existing relays with some degradation to 1GHz. At the time we were looking at the part differences between the 100/200 and 350/500, I'm not aware of a full schematic being made, although I remember the question being asked among the interested parties. I can't remember if the Teledyne relay is an additional one, or a replacement of an existing relay. Either way, the boards are _definitely_ different, it's not just an unpopulated part. Trying to run bodge wires at this kind of frequency isn't going to end well, which is why I'm wondering if just running the existing relays out of spec and any appropriate L/C changes would be enough.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Luminax on December 15, 2016, 11:18:35 am
I'm kinda wondering what those series number meant... the firmware/categorizing is usually 2XX2/2XX4 which usually denotes 2 channels against 4 channels... but what about the numbers in between, hmmm
I have a stock DSOX2014A which, in a company working with remotes and digitals and such, I really can't see how this company of mine hopes to get away with no Digital or Serial functions  :palm:

I'm poking the upper management for an upgrade, in the meantime... *ahem*
 >:D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: azer on December 15, 2016, 02:55:23 pm
It's the bandwidth of the scope
00 = 70MHz
01 = 100MHz
02 = 200MHz
03 = 350MHz
05 = 500MHz
10 = 1000MHz
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on December 15, 2016, 05:11:40 pm
I have a stock 500MHz, I keep watching here to make the big jump to the Ghz moon... so far no big news as I understand. Do you need high res pics of the 500Mhz front end? IMO no, in any case PM me I'll do my best to support you talented guys.
what I understood is that:
1) the boards for 100 - 500 Mhz are the same, 350/500 Mhz are just using some different capacitor/inductor values at the front end compared to the 100/200 Mhz boards.
Thus upgrade 100->200 and 350->500 Mhz can be done by software. 100/200 -> 350/500 Mhz will just need a few some parts replaced.
2) the 1 GHz board is indeed different (addl. relay etc.), thus an 'upgrade'  will not be possible (at least not an easy upgrade).
That is also my understanding, plus that the sampling rate is 5GSa/s compared to 4GSa/s, so I don't know if there is anything different beyond the AFE such as ADC, FPGA or ASIC speed grades.

One thing I had considered is whether or not the Teledyne relay is really required, or it can use the existing relays with some degradation to 1GHz. At the time we were looking at the part differences between the 100/200 and 350/500, I'm not aware of a full schematic being made, although I remember the question being asked among the interested parties. I can't remember if the Teledyne relay is an additional one, or a replacement of an existing relay. Either way, the boards are _definitely_ different, it's not just an unpopulated part. Trying to run bodge wires at this kind of frequency isn't going to end well, which is why I'm wondering if just running the existing relays out of spec and any appropriate L/C changes would be enough.

In the 3000A model the Teledyne relay is the big change to the PCB. They also one regular relay in a different location but the footprint is present on the 500 MHz and lower PCB's. Memset did try strapping his as a 1 GHz model but it didn't work because it couldn't find the relays properly. With some time spent it may be possible to jumper the existing relays to work with some degraded performance - and of course you need to change the LC networks. If the scopes didn't cost as much as they do I think it would be great to further experiment.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Luminax on December 16, 2016, 09:10:43 am
It's the bandwidth of the scope
00 = 70MHz
01 = 100MHz
02 = 200MHz
03 = 350MHz
05 = 500MHz
10 = 1000MHz

Ah, so mine would be 2014A => 100MHz
I think that would means that it can accurately, within 2% accuracy, measure up to 20MHz sinewave
What about square wave, though? I had dug up an old EXO3 CMOS oscillator with max 20MHz squarewave clock pulse and it seems the resulting waves are quite jagged... maybe I need more expensive probe... hmmm
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PioB on December 16, 2016, 09:17:43 am
It's the bandwidth of the scope
00 = 70MHz
01 = 100MHz
02 = 200MHz
03 = 350MHz
05 = 500MHz
10 = 1000MHz

Ah, so mine would be 2014A => 100MHz
I think that would means that it can accurately, within 2% accuracy, measure up to 20MHz sinewave
What about square wave, though? I had dug up an old EXO3 CMOS oscillator with max 20MHz squarewave clock pulse and it seems the resulting waves are quite jagged... maybe I need more expensive probe... hmmm
That is the analog bandwidth,  tho. Check that vs x GSamples/second.

Sent from my SM-N9005 using Tapatalk

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on December 16, 2016, 09:20:32 am

I had dug up an old EXO3 CMOS oscillator with max 20MHz squarewave clock pulse and it seems the resulting waves are quite jagged... maybe I need more expensive probe... hmmm

How are you probing? You should pull off the clip probe, attach the ground spring clip, and probe directly on the chip (pin 4 for ground if it's the device I think you're using), and the pointy tip on the output to see anything sensible. If you're using the ~4 inch fly lead for grounding, it won't show nice edges.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Luminax on December 16, 2016, 10:21:15 am
Yep pin 4 ground, and I've probed directly and still get some overshoot/undershoot...

The 200MHz version with digital enabled (MSOX) is almost double the price of what I currently have.... dayum...

That reminded me... the bandwidth is hardwired/board dependent was it?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on December 16, 2016, 11:39:41 am
Yep pin 4 ground, and I've probed directly and still get some overshoot/undershoot...

The 200MHz version with digital enabled (MSOX) is almost double the price of what I currently have.... dayum...

That reminded me... the bandwidth is hardwired/board dependent was it?

If you can attach a screenshot we can see if it looks reasonable of not. It's never going to look perfect.

I believe that the 100MHz 2000 can be liberated to 200MHz in software, as can the MSO option, but I don't have any direct experience with the 2000.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: azer on December 16, 2016, 01:21:27 pm
I think that would means that it can accurately, within 2% accuracy, measure up to 20MHz sinewave
No, you can measure 100MHz quite accurately as the sampling rate is much higher.
All of the 2000 series is 2GS/s, the 3000 (non T version) up to 500MHz is 4GS/s and the 3000 1GHz is 5GS/s

That reminded me... the bandwidth is hardwired/board dependent was it?

All the official options on the 2000 series can be upgraded with software with the fixes mentioned earlier in the thread. 3000 can be software upgraded to 500MHz, 1Ghz is hardware change.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Luminax on December 17, 2016, 12:09:13 pm
Yep pin 4 ground, and I've probed directly and still get some overshoot/undershoot...

The 200MHz version with digital enabled (MSOX) is almost double the price of what I currently have.... dayum...

That reminded me... the bandwidth is hardwired/board dependent was it?

If you can attach a screenshot we can see if it looks reasonable of not. It's never going to look perfect.

I believe that the 100MHz 2000 can be liberated to 200MHz in software, as can the MSO option, but I don't have any direct experience with the 2000.

I'll get a screenshot on monday.

I think that would means that it can accurately, within 2% accuracy, measure up to 20MHz sinewave
No, you can measure 100MHz quite accurately as the sampling rate is much higher.
All of the 2000 series is 2GS/s, the 3000 (non T version) up to 500MHz is 4GS/s and the 3000 1GHz is 5GS/s

That reminded me... the bandwidth is hardwired/board dependent was it?

All the official options on the 2000 series can be upgraded with software with the fixes mentioned earlier in the thread. 3000 can be software upgraded to 500MHz, 1Ghz is hardware change.


I'll try to dig back into the thread, but do you happen to remember the options?

Also, isn't the bandwidth have somethi g to do with Frontline input bandwidth and what it's capable of responding to, as in slew rate, rise time, fall time etc etc?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Luminax on December 19, 2016, 09:53:00 am
Man... it took me a full day to re-read the whole thread... awesome stuffs!

I've also dug up some old switches from a while back and mine have this :

Quote
189#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO -l memMax -l MEMUP -l ADVMATH -l SGM -l SGMC -l AUTO -l COMP -l TOM -l EMBD -l VID -l COMP -l SCPIPS -l WAVEGEN -l MASK -l BW20

Unfortunately, no ADVMATH... hmmmmmm could it be an fpga hardcode or an entirely different beast altogether?

Anyway, seems like I don't need to further bandwidth upgrade anyway as 200MHz + 150Mhz probe seems to be quite sufficient for my current need.

Great work guys, thank you
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: azer on December 19, 2016, 01:13:06 pm
ADVMATH seems to only be available on the 3000 series and up
What you get access to is generally what is available in the appbundle package (DSOX2APPBNDL)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlan on December 26, 2016, 03:55:49 pm
I can't believe no one on this thread ever mentioned using '--perf' on a 2000. It works miracles! (sort of...)
The command line description is:
   --perf
     make entry like performance

In other words: make a 2000 behave like a 3000.
It has always been there in plain sight. It will not enable specific 3000 licenses though, but it does enable extra maths, triggers and stats, including overlay stats. Just like a 'vanilla' 3000.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on December 26, 2016, 04:23:34 pm
I can't believe no one on this thread ever mentioned using '--perf' on a 2000. It works miracles! (sort of...)
The command line description is:
   --perf
     make entry like performance

In other words: make a 2000 behave like a 3000.
It has always been there in plain sight. It will not enable specific 3000 licenses though, but it does enable extra maths, triggers and stats, including overlay stats. Just like a 'vanilla' 3000.

Thanks for post Christmas gift for 2000-X owners :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on December 27, 2016, 02:13:51 am
I can't believe no one on this thread ever mentioned using '--perf' on a 2000. It works miracles! (sort of...)
The command line description is:
   --perf
     make entry like performance

In other words: make a 2000 behave like a 3000.
It has always been there in plain sight. It will not enable specific 3000 licenses though, but it does enable extra maths, triggers and stats, including overlay stats. Just like a 'vanilla' 3000.

Sounds good. Exactly where does that command go and what is the actual syntax?

Does it get added to the -l ALL etc string in the Startup infiniivision.lnk file or ?? i.e. do we end up with -l ALL -l PERF or ??

Does it work with 2.39 or is it version specific.

Few more details please...

thanks,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlan on December 27, 2016, 02:51:39 am
Sounds good. Exactly where does that command go and what is the actual syntax?

Does it get added to the -l ALL etc string in the Startup infiniivision.lnk file or ?? i.e. do we end up with -l ALL -l PERF or ??

Does it work with 2.39 or is it version specific.

The parameter is just  --perf  and can be appended to the command just like all the other parameters.
It is available in all versions.

When you manually execute   infiniivisionLauncher.exe --help   from the command line you will get a list of all available options.

There is also a  --4GSa  and  --5GSa  option, which might be interesting for the 3000.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on December 27, 2016, 03:05:58 am
Ok, I've added --perf at the end of my infiniivision.lnk file (with correct count nnn#/usb/....

Boots as normal from my USB stick, but I don't see anything additional in my 2024A trigger menu or math menu.

This is v2.39 with all features 'enabled' in the lnk file.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlan on December 27, 2016, 03:20:42 am
George,

Try to move the --perf to the front or remove all other parameters. I've heard before that some options don't work when appended to a long list. And double check your number before the #.

This should work:  -l MSO -l DIS --perf --forcemaxmem
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on December 27, 2016, 03:24:35 am
:)

Just had the same exact thought and moved the --perf as the first option in the LNK file. All works now - EXCELLENT.

Have all the trigger features (runt etc), also the differentiate, integrate etc extra math stuff. Thanks much for finding the --perf option and posting to this thread. Much appreciated!

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Luminax on December 27, 2016, 06:39:40 am
Excellent!
I'm glad I'm the only one who use this scope

 :-+ :-+ :-+ :-+ :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dubbie on December 27, 2016, 07:25:43 am
I have a 3024T that I'd love to up to 500Mhz.
I will take pix of the board when I get back from holidays. I'm not at the level where I would be able to figure this out for myself, so I'd be relying on someone else taking the plunge first.


Sent from my phone using Tapatalk
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on December 28, 2016, 12:14:45 pm
In case I'm not the last noob to join the party, hope to close the boobytrap.
Here is a refined procedure, see attached. No benefit for existing users, this is rather for newcomers, to prevent bricking with the dual link problem.
The readme file is updated, all credits for the method in general to user "memset".

I've split the procedure into an install CAB which moves away the factory link (if present) and copies the .lnk file from USB, and an uninstall CAB which removes the added .lnk and restores the original link, if one was present.
The supplied .lnk file should be a useful template on how to set all options:
Code: [Select]
121#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l TOM -l BW20It's using "-l DIS" to enable most of them (instead of "-l all" which gives asterisk marks in the about box), then filling up the rest. You may want to edit your bandwidth at the end.

I've tested uninstall, install and more install to update on my 3014A. So far not tested on a 2000 series model, but according to previous postings that should work, too.
Use at your own risk, of course.

It works on my DSOX2002, thank you so much!  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on January 03, 2017, 04:19:19 pm
George,

Try to move the --perf to the front or remove all other parameters. I've heard before that some options don't work when appended to a long list. And double check your number before the #.

This should work:  -l MSO -l DIS --perf --forcemaxmem

Make me think what more could be 'hidden' on 2000 and 3000?

Thank you by the help!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlan on January 04, 2017, 05:17:45 pm

Make me think what more could be 'hidden' on 2000 and 3000?

Thank you by the help!

From the command line there are no more out-of-the-box real surprises.
InifiniivisionLaucher.exe --help  gives you a list of all the available switches.
But remember, almost all functionality is a software implementation, and the 2000 and 3000 software is identical... thus...
Even digital input selection for serial decoding should be possible, including I2S.
With a lot of perseverance, it should be possible to make the 2000 behave (almost) identical as the 3000, except for its obvious hardware limitations:
- 200MHz frontend
- no 50ohm input
- No probe detection
- 2GSa/s
- 50,000 waveforms/sec
- one ASIC (which halves the sample-rate, 8 digital inputs and 1Mpts memory depth)


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on January 04, 2017, 05:22:00 pm
Quote
Even digital input selection for serial decoding should be possible, including I2S

Would really like that one - wouldn't need to have the PC and Logic on standby.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlan on January 04, 2017, 06:40:39 pm
Quote
Even digital input selection for serial decoding should be possible, including I2S

Would really like that one - wouldn't need to have the PC and Logic on standby.

Which FW version do you have? And are you able to patch it?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on January 04, 2017, 06:59:12 pm
Quote
Even digital input selection for serial decoding should be possible, including I2S

Would really like that one - wouldn't need to have the PC and Logic on standby.

Which FW version do you have? And are you able to patch it?

2.41 and probably, given instructions.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlan on January 04, 2017, 07:07:30 pm
Can anyone explain me how it is possible to add options to the .lnk file without patching the internal v2.41 infiniiVisionCore.dll file?  It first has to be 'unlocked', right?
Or did I miss something?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: [IDC]Dragon on January 04, 2017, 08:00:52 pm
Today my 3014 got the other hardware upgrade of the current portfolio: Upping the sample rate from 4 to 5 GSa/s. Kudos to user "memset".
Originally I wanted to do that together with the frontend upgrade, but ordered only one inductor, didn't knew there's another on the backside.  :palm:
For the record, I used Coilcraft 0603CS-10NXGLU (10 nH), and of course removed the strapping resistor H2. I was a bit tempted to try 12 nH and hope this would do both frequencies, so I could change the sample rate back and forth, but from the ADF4360 datasheet this looked too marginal to be safe. The lock range of the oscillator is rather small.

After that mod, the trigger position was way off, the scope needs a new user calibration, which fixed it.
BTW, the calibration can be backed up with telnet and USB, it resides in the hidden folder "\secure\cal\", the two *cal.dat files. There's also a logfile from the calibration run, it seems Keysight does the same at their manufacturing site.

The scope seems to do well with the unusual rate from its biggest cousin, measured timings and display are correct. As expected, the effect of 25% finer sampling is not dramatic. The hardware rendering does a good job on sinc interpolation already. It's slightly visible on direct comparison. Again pictures of a "Jim Williams" pulse, 500 MHz bandwidth, before and after.
Slightly more amplitude of the pulse gets captured, the dip behind the pulse is a bit deeper. (We're talking about 4 vs. 5 samples per nanosecond division grid here, everything else is the sinc interpolation...)

Before, 4GSa/s:
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=282997;image)

After, 5 GSa/s:
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=282999;image)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: [IDC]Dragon on January 04, 2017, 09:21:58 pm
Can anyone explain me how it is possible to add options to the .lnk file without patching the internal v2.41 infiniiVisionCore.dll file?  It first has to be 'unlocked', right?
Or did I miss something?
No patching required. The .lnk file starts a different executable, which allows command line parameters. The only and slight drawback is a nag message after boot.
You need firmware 2.41 installed beforehand. It was reported to work with 2K scopes:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1100759/#msg1100759 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1100759/#msg1100759)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 04, 2017, 09:24:27 pm
The other drawback are issues with network connections to the scope - it has all been covered before.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlan on January 05, 2017, 07:12:27 am
Can anyone explain me how it is possible to add options to the .lnk file without patching the internal v2.41 infiniiVisionCore.dll file?  It first has to be 'unlocked', right?
Or did I miss something?
No patching required. The .lnk file starts a different executable, which allows command line parameters. The only and slight drawback is a nag message after boot.
You need firmware 2.41 installed beforehand. It was reported to work with 2K scopes:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1100759/#msg1100759 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1100759/#msg1100759)

Ok, it seems that \Secure\infiniiVision\infiniivisionLauncher.exe will start infiniiVisionCore.dll without any secure storage, and thus the FW falls back to 'unsecure' mode and will accept parameters (Hence the warning message). Very convenient behavior!
And \program files\infiniivision\infiniiVisionLauncher.exe will start infiniiVisionCore.dll with the correct secure storage context and thus will only accept officially installed licenses.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 10, 2017, 12:43:48 pm
I have a 3024T that I'd love to up to 500Mhz.
I will take pix of the board when I get back from holidays. I'm not at the level where I would be able to figure this out for myself, so I'd be relying on someone else taking the plunge first.
Would be really nice to get good pics from DSOX-T. T-versions should be relatively easy to push to 1Ghz by adding Teledyne attenuator relays. PCB topology should be "ghz-ready".
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Luminax on January 11, 2017, 12:36:23 am
Can anyone explain me how it is possible to add options to the .lnk file without patching the internal v2.41 infiniiVisionCore.dll file?  It first has to be 'unlocked', right?
Or did I miss something?

If you go digging some posts back, you'll notice someone from Keysight posting. Their attitude seems to be "You guys are hacking our scope? cool, show me what you can accomplish" and is generally taking the silent assent stance unless you start 'selling' the 'hacked' product and THEN they go to town.
So my guess is, they're worried about people bricking their oscilloscope and them getting swamped with repair request that they somehow made it easier(?) to hack... I guess?  :-//
Eeeeey as long as I get my functions, I'm happy!b :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on January 11, 2017, 02:32:36 am
As I have promised, please see the MSO-X 3014T detailed pictures. I did not have time to make a complete photo-session for the PCB, but I managed to snap pictures for one analog-frontend and a general view (front + back).

Please tell me what sections do you consider worthy pictured and I'll take them. It would be easy to use the two pcb general view pictures and draw there the sections of interest.

The pictures can be found here: http://www.idsys.ro/public/MSO-3014T-1.zip (http://www.idsys.ro/public/MSO-3014T-1.zip)

:TheSteve - Could you be kind and throw an eye on the analog front-end and tell me your opinion? I did not have time yet to compare it with your mod but I'll do it in a couple of days surely.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 11, 2017, 04:41:31 am
At a quick glance it looks pretty darn promising to me. As memset predicted it looks as though they are using a single PCB for all of the T series scopes. You can see where the Teledyne attenuator relay would mount which is needed to go above 500 MHz.
The mod to 500 MHz looks identical to the 3000A series - the 1 GHz mod would be more work as we need to know the proper part values, it would also need the additional relay per channel and the drive circuitry(looks pretty simple). Moving one of the existing relays is probably also required.
Being there is no open hack for the T series the jumper config will only get you to 350 MHz with the 500 MHz mod, so if we can determine the proper part values it makes sense to go right to 1 GHz as that can configured via jumper with no license needed(if the strapping jumpers are the same - it is very likely they are).
If I had a T series I'd be compiling the parts to order list right now.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on January 11, 2017, 10:28:16 am
:TheSteve - Great.. I'd be willing to look at the 1Ghz mod if we could sort out the part needed (attenuator relay). I assume it's position would be at K504 silkscreen marking.. Right?
What relay are you talking about moving? I assume you're talking about one of the two white/yellowish Japan made, in the frontend.. Where would these need to be moved?

:memset - Any help would greatly be appreciated. Waiting any questions or ideas.

Is anyone willing to open up a 1GHz 3104T version to help us out in finding out the exact part needed?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 11, 2017, 05:17:05 pm
The relay is likely the same as the 3000a model, it is the inductors/capacitors that could be tougher to determine.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on January 11, 2017, 06:49:09 pm
Here you go...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dubbie on January 12, 2017, 04:21:13 am
Not particularly useful at this stage, but here is the frontend of the 200Mhz model.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 12, 2017, 06:49:29 am
Interesting that they're using what appears to be the same board: on the 3000A the Teledyne relay didn't have any placement lands on the 500MHz and below units that I've seen.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on January 12, 2017, 09:55:50 am
Interesting that they're using what appears to be the same board: on the 3000A the Teledyne relay didn't have any placement lands on the 500MHz and below units that I've seen.
Maybe when they did the T version PCB they combined the versions
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 12, 2017, 12:58:04 pm
Great work with all these pictures, adranp, mikeselectricstuff, Dubbie!
Looks like for 1GHz 3000T-version upgrade K503 should be moved to K501 with K504 added alongside with corresponding replacement of several passive components. Also, antialiasing filter for 1Ghz looks to be significantly different from <1GHz version with extra RC link.
As I thought before, PCB topology is the same so the 1GHz upgrade is definitely possible. Same must be true for 4000X-series.

And for 3000A-series they decided to erase some components from PCB design like Teledyne relay signal/control paths, so part of topology is missing from PCB.
I still think it should be possible to upgrade 3000A to 1GHz, but presonally I gave up on 1GHz because I need my only scope to be in working condition instead of being disassembled permanently for all these experiments.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on January 12, 2017, 05:41:08 pm
As always :mikeelectricstuff is helping big time. All my regards.

I've looked for the Teledyne attenuator relay and it seems quite hard to procure (no stocks). Any ideas?
Also there are quite a lot of passives there to plant.
There's a transistor there at Q501 also needed. I've tried looking for the marking (N1 v) and there are a few possible matches for that. Anyone know what that could be?

Let's start to put together the list for all the parts needed and I'm willing to look into modding to 1Ghz.  :box:


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 12, 2017, 07:14:40 pm
Let's start to put together the list for all the parts needed and I'm willing to look into modding to 1Ghz.  :box:

To try the 1GHz mod we'll need to find out correct 1GHz-variant values for these 5 unknown caps (look at the picture for 5 caps marked with big red dots).
To read out their values one need to desolder them one by one and measure with some very precise sub-pF cap meter.
I think both types of AA filter symmetric caps should have the same low-pF value. Also, AA shunt caps are expected to be less than 2.0pF. Attenuator RC cap is also low-pF, but the value could be up to 100's of pF.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 12, 2017, 07:31:29 pm
There's a transistor there at Q501 also needed. I've tried looking for the marking (N1 v) and there are a few possible matches for that. Anyone know what that could be?
Q501 should be Teledyne's control N-MOSFET. I think it's MMBF0201NL. Unfortunately, P-MOSFET Si2301CDS also fits for N1 marking, but only N-fet seems to be sane to use for relay switching control.
To make it sure one needs to check if Q501's Source pin is grounded.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: nctnico on January 12, 2017, 07:57:50 pm
If Q501 is only there to drive the relay then any jelly bean MOSFET would do. In case of N channel the 2N7002 or SI2302 are good candidates.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dubbie on January 12, 2017, 08:08:58 pm
Is your scope still apart Mike?

If so are you willing to measure the caps?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on January 12, 2017, 08:32:10 pm
Is your scope still apart Mike?
Sorry no.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 12, 2017, 09:40:59 pm
I have two comments about reverse engineering the front end from some work we did a few months ago on the 3000A.

Firstly, you need to take the greatest of care when removng the metal cans, it is all too easy to inadvertently break the ground track and vias on the lugs. Repeated removal and replacement weakens these tracks and vias, and repair isn't the easiest.

Secondly, take care about cleaning the board. There is some high impedance stuff going on and any ionic residue will cause the front end to oscillate, that took me a looooong time to figure out. If you do use any cleaning agents, be aware that getting them out of an encapsulated relay is going to be bloody hard work.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on January 12, 2017, 09:59:00 pm
:memset

"To make it sure one needs to check if Q501's Source pin is grounded." -> The source pin (the upper left pad) of Q501 is grounded. Just checked that now.


:Howardlong

What you are saying is very very true.. One ground pad for the metal cans in my case raised slightly at disassembly.. Solved that easy in my case, but anyone trying this should take great care not prying the metal cans too hard.

Clearly, pcb cleaning is very very important.. Though, my question to you, is what cleaning agent would you recommend in this case?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dubbie on January 12, 2017, 10:30:54 pm
Thanks for the warning Howard.
I was too afraid to clean my board so left it.
It's quite tricky getting the can off. I lifted it gently with forceps while holding the iron on the joint. Getting the iron in the right position isn't easy.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 12, 2017, 10:31:52 pm

Clearly, pcb cleaning is very very important.. Though, my question to you, is what cleaning agent would you recommend in this case?

I think if done again, I would avoid cleaning agents at all, as once it's in the relays it'll take ages to dissipate/evaporate. In my case I had intermittent self-oscillation on the channel that was reverse engineered for some weeks despite several attempts resolve. I used Fluxclene and IPA, both are somewhat ionic (think in terms of them leaving measurable resitances in the megohms range), but wish I hadn't: the problem is that I've used these by habit for a long time after working on boards to remove flux residue. In the end it resolved itself but it took some weeks, as well as a lot of head scratching trying to figure out what was going on. I don't routinely work on high impedance stuff, so this was a new phenomenon to deal with for me.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 13, 2017, 02:48:43 am
Howard - it is unfortunate that you had issues after making such a massive sacrifice for the forum. So once again let me say thank you for your efforts which went above and beyond. I found my DSOX3000 was harder to rework then the average device(because of the small thin traces/pads and knowing the cost of the device) which makes your efforts even greater.

All that said I'd certainly perform the mod again as having a 500 MHz scope instead of a 100/200 MHz scope rocks.
When I did mine I used no-clean solder and didn't add any flux - I didn't do much cleaning other then some gentle wipes with an alcohol soaked q-tip. It is clear Keysight isn't afraid of the solder/flux they use - look at how much there is around the Teledyne relay.

At this point I'd say it wouldn't be too bad too to mod a 3014T/3024T the same as has been done with the 3000A, the hardware would be 500 MHz but without the license you'd be stuck at 350 MHz.
Someone could guess at the capacitor values to perform the 1 GHz mod - do the math on the values used for 100/200 MHz and 350/500 MHz and see if you could determine some logical 1 GHz values. Knowing the value of the scope though and the cost of the Teledyne relays you'd have to be pretty bold.

Keysight probably isn't up for donating a 100 MHz scope to experiment on...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on January 13, 2017, 09:48:35 am
Keysight probably isn't up for donating a 100 MHz scope to experiment on...

I am though... There's a spare MSOX3024T under my desk.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on January 13, 2017, 06:16:49 pm
As usual Ian is here to help. My opinion is that you should keep that in case something goes terribly wrong and one of the "lab rat" scopes we are trying to mod dies irreparably.

:TheSteve

As you are saying, going to 350/500 Mhz is indeed a very good upgrade. A tempting one at least. From my position I can tell you I'm not doing the mod necessarily for me, as I'm doing it for the community. I learned a lot from the community and there's a time to give something back.

If we find a way to determine the capacitor/inductors values and I manage to procure 4 Teledyne relays, I'm willing to try the mod to 1Ghz.

The easiest way would be someone with a 1Ghz scope do these measurements so we compile the BOM. Otherwise it would be a hit and miss operation for determining the right values.

As a side note for all interested parties.. Moving the K503 relay into the K501 position requires hot air desoldering.. I would add that to the BOM to swap it as
desoldering and resoldering might have unknown consequences as the part is rated at maximum 5s 250degrees reflow. These are specified as flux resistant but non-cleanable inside.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 13, 2017, 06:28:36 pm
The easiest way would be someone with a 1Ghz scope do these measurements so we compile the BOM. Otherwise it would be a hit and miss operation for determining the right values.
Even better option is to leak these values from scope's schematics. Or leak the schematics.
Why the hell every iPhone's schematic is leaked while Apple is known to be total paranoid about secrecy.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 13, 2017, 06:31:00 pm
Clearly, pcb cleaning is very very important.. Though, my question to you, is what cleaning agent would you recommend in this case?
Just don't use any cleaning agent and use very small amounts of no-clean flux for any soldering.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on January 13, 2017, 06:44:43 pm
:Memset

I think the answer to the iPhone schematics leak is that the interest for those is huge, and the money that can be earned based on that through repairs can be more than significant. Cannot say the same for our case.
As we go more into the consumer society concept, people refuse to think at repairing stuff. 

If someone is kind enough to help us with a 1ghz scope disassembly and removal of the interesting parts in our mod, can ship them to me (on my expense) and I can measure them with a precision LCR meter and return them fast. This is the case with someone that does not have access to a sub-pF meter.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 13, 2017, 07:16:11 pm
As a side note for all interested parties.. Moving the K503 relay into the K501 position requires hot air desoldering.
Not necessary. It's possible to desolder these relays side by side using good soldering iron with some wide blade tip. Or even with common tip using additional wire to separate pin from its pad. Pretty doable without melting the whole package.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 13, 2017, 07:23:08 pm
At this point I'd say it wouldn't be too bad too to mod a 3014T/3024T the same as has been done with the 3000A, the hardware would be 500 MHz but without the license you'd be stuck at 350 MHz.
Another good thing about 1 GHz mod is getting the whole bandwidth without affecting any software licenses. You'll loose MSO license (if any), but scope will work at 1GHz and 5GSa/s out of the box - without any SW mods.
I think it's still legal to replace chip passives in the equipment you own, even in US.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 13, 2017, 08:32:42 pm
Another good thing about 1 GHz mod is getting the whole bandwidth without affecting any software licenses. You'll loose MSO license (if any), but scope will work at 1GHz and 5GSa/s out of the box - without any SW mods.

Why does the MSO licence break?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dubbie on January 14, 2017, 04:45:15 am
Yeah I don't want to lose my mso license. I use it all the time. It is a legit one from Keysight.


Sent from my phone using Tapatalk
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cgroen on January 14, 2017, 10:12:18 am
Sorry for this "beginner question", but what is the default userid/password for the 3024T. My googling didn't bring it up... ?
(I have a brand new MSOX3024T with the APP2BNDL, and I'm getting curious ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on January 14, 2017, 11:48:46 am
Quote
.....and I'm getting curiousous
You are not the only one. But........ the login id/password are currently unknown (or at least not public).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cgroen on January 14, 2017, 11:51:41 am
Thanks Pinkus,
then it is not just my lack of skills  :'(
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 14, 2017, 12:06:46 pm
ISTR there was some suggestion in this thread the credentials are unique to the scope, I imagine tied into the serial number or MAC address (assuming there's a MAC address without the LAN card, I would imagine there is).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 14, 2017, 04:19:34 pm
Sorry for this "beginner question", but what is the default userid/password for the 3024T. My googling didn't bring it up... ?
Telnet password for T-series is unique and Serial / MAC address based.
Same is true for 6000X and maybe 4000X series.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 14, 2017, 04:24:34 pm
Why does the MSO licence break?
As far as I remember from my earlier experiments, 1GHz version use different MSO license. So if you change strapping to 1GHz, original MSO license will not be used anymore.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dubbie on January 14, 2017, 06:48:26 pm
That's a shame. MSO is probably more useful to me at the moment than 1Ghz


Sent from my phone using Tapatalk
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 14, 2017, 08:09:33 pm
That's a shame. MSO is probably more useful to me at the moment than 1Ghz
-l MSO than.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 14, 2017, 08:17:32 pm
That's a shame. MSO is probably more useful to me at the moment than 1Ghz
-l MSO than.

Hard to do on the 3000T model when we can't login.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on January 14, 2017, 08:47:08 pm
Hard to do on the 3000T model when we can't login.

Apart from that I don't think we know if it is possible to activate the options like that on a T model.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on January 14, 2017, 09:35:14 pm
:memset  - Is strapping for 1Ghz the same as for 350/500Mhz ? I was under this impression..

Regarding user/pass - has anyone tried a brute force dictionary based attempt to enter the device?

I'm thinking that I could try to mod to 350/500Mhz until I find a way to get my hands on the Teledyne relays needed for 1Ghz.
:Memset  - Do you happen to have the values of your original parts in 3000A scope so I can compare it with mine's? I looked in the thread but I did see just values for upper bandwidth scopes.  If the values will be different I'm thinking that values of 350/500 mod might be different also. Correct me if I'm wrong.

Thanks..

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 14, 2017, 11:40:27 pm
Compare the color dots on the inductors - if they are the same the the capacitors will be the same.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on January 16, 2017, 01:44:30 am
user: "infiniivision"
pass: "skywalker1977"+hash(ModelName, SerialNumber, MACAddress)

Need to figure out how to hash that data exactly
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 16, 2017, 09:02:14 am
user: "infiniivision"
pass: "skywalker1977"+hash(ModelName, SerialNumber, MACAddress)

Need to figure out how to hash that data exactly

Please don't, I don't need to buy any more scopes!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 17, 2017, 06:54:15 am
Apart from that I don't think we know if it is possible to activate the options like that on a T model.
I think it's all the same.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 17, 2017, 10:50:55 am
:memset  - Is strapping for 1Ghz the same as for 350/500Mhz ? I was under this impression..

:Memset  - Do you happen to have the values of your original parts in 3000A scope so I can compare it with mine's? I looked in the thread but I did see just values for upper bandwidth scopes.

Strapping description:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg980404/#msg980404 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg980404/#msg980404)

Some values for 100/200MHz and 350/500Mhz frontends:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg987126/#msg987126 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg987126/#msg987126)

For 3000-series there are 3 types for frontend:
- 100/200MHz - software upgradeable
- 350/500MHz - also software upgradeable
- 1GHz

You can jump from 100MHz to 200MHz (or from 350MHz to 500MHz) via the license, but you can't jump from 100/200 to 350 or 500 or 1GHz without board replacement or HW mod.
Note that for 3000X-series and up: 100MHz scope would be strapped to 200MHz and 350MHz scope would be strapped to 500MHz.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 17, 2017, 12:05:02 pm
Please don't, I don't need to buy any more scopes!

Why not? Buying scopes is fun!

I think I saw some code example there:
https://repl.it/FLUQ (https://repl.it/FLUQ)
http://pastebin.com/2NJjMTxQ (http://pastebin.com/2NJjMTxQ)

Not sure whether it works or not.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cgroen on January 17, 2017, 01:10:10 pm
Please don't, I don't need to buy any more scopes!

Why not? Buying scopes is fun!

I think I saw some code example there:
https://repl.it/FLUQ (https://repl.it/FLUQ)
http://pastebin.com/2NJjMTxQ (http://pastebin.com/2NJjMTxQ)

Not sure whether it works or not.

It does :)
Thanks !!!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 17, 2017, 01:32:52 pm
I predict a rapid sales rise in the MSOX3014T.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cgroen on January 17, 2017, 01:37:31 pm
I predict a rapid sales rise in the MSOX3014T.

Oh yes, I could have saved a good amount of money going with a 100MHz and no APP2BNDL  :-DD
Anyway, no regrets, its a wonderful scope !!

EDIT: But boy it would be wonderful to get 500 MHz, I did not in the first place as that was a major price increase, but would be very very nice....
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 17, 2017, 08:55:44 pm
I predict a rapid sales rise in the MSOX3014T.

Oh yes, I could have saved a good amount of money going with a 100MHz and no APP2BNDL  :-DD
Anyway, no regrets, its a wonderful scope !!

EDIT: But boy it would be wonderful to get 500 MHz, I did not in the first place as that was a major price increase, but would be very very nice....

It is starting to look like this might be a possible reality. Can you give us details on the internal file structure of the "T" series.
The hardware mod to 500 MHz so far looks identical to the 3000A series.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dubbie on January 17, 2017, 11:19:39 pm
So I have logged into my 3024T!

The python script worked great.

I used infiniivision for the username and the hash as the password

Now what?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on January 17, 2017, 11:27:50 pm
So I have logged into my 3024T!

The python script worked great.

I used infiniivision for the username and the hash as the password

Now what?

Let the game commence!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 17, 2017, 11:31:48 pm
So I have logged into my 3024T!

The python script worked great.

I used infiniivision for the username and the hash as the password

Now what?

Let the game commence!

How much for that scope you mentioned under your desk?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dubbie on January 17, 2017, 11:37:36 pm
If I understand correctly I can get 350Mhz without any hardware modifications, is that correct?

If that is the case, what is the command for that? -bw35?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on January 17, 2017, 11:38:17 pm
So I have logged into my 3024T!

The python script worked great.

I used infiniivision for the username and the hash as the password

Now what?

Let the game commence!

How much for that scope you mentioned under your desk?

A lot less than you can buy it anywhere else, but there's a sale pending so I won't be listing it for a couple of days.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tautech on January 17, 2017, 11:42:33 pm
If I understand correctly I can get 350Mhz without any hardware modifications, is that correct?

If that is the case, what is the command for that? -bw35?
Can I sense which of your instruments will get improved next ?  :box:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on January 17, 2017, 11:42:46 pm
If I understand correctly I can get 350Mhz without any hardware modifications, is that correct?

If that is the case, what is the command for that? -bw35?

No, you can get a maximum of 200MHz with a stock 3024 or 3014, you need a stock 3034 if you want to push it to 500MHz without hardware mods. That's my understanding anyway...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dubbie on January 17, 2017, 11:47:51 pm
Ah ok, Well in that case, onto the Hardware mods.

Need to find those Teledyne relays!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 18, 2017, 12:17:28 am
I am thinking the MSO feature will not be lost if a T series 100/200/350/500 MHz scope is strapped for 1 GHz. The T series uses a single part number for the MSO upgrade. The A series used two numbers, one for the 100-500 MHz scopes and one for the 1 GHz. I expect the two versions use different licenses which could explain why the MSO feature was no longer enabled when memset tried it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 18, 2017, 12:20:17 am
Ah ok, Well in that case, onto the Hardware mods.

Need to find those Teledyne relays!

The relays are only needed if you want to go to 1 GHz - if 500 MHz is enough then the existing mod for the 3000A series should be fine. Of course I think we'd all like to go to 1 GHz - assuming we can determine the proper capacitor values(and get the relays).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on January 18, 2017, 12:46:05 am
I am thinking the MSO feature will not be lost if a T series 100/200/350/500 MHz scope is strapped for 1 GHz. The T series uses a single part number for the MSO upgrade. The A series used two numbers, one for the 100-500 MHz scopes and one for the 1 GHz. I expect the two versions use different licenses which could explain why the MSO feature was no longer enabled when memset tried it.

I can test that theory if needed....
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cgroen on January 18, 2017, 08:31:40 am
I predict a rapid sales rise in the MSOX3014T.

Oh yes, I could have saved a good amount of money going with a 100MHz and no APP2BNDL  :-DD
Anyway, no regrets, its a wonderful scope !!

EDIT: But boy it would be wonderful to get 500 MHz, I did not in the first place as that was a major price increase, but would be very very nice....

It is starting to look like this might be a possible reality. Can you give us details on the internal file structure of the "T" series.
The hardware mod to 500 MHz so far looks identical to the 3000A series.


Attached is a dump of the file structure of my MSOX3024T (3 months old approx). Scope has all features enabled (APP2BNDL).
The folder \Secure\System\Licensing\Store has been changed by me, there was a list of hex keys (I guess) and I changed these to something else.


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on January 18, 2017, 11:05:26 am
Attached is a dump of the file structure of my MSOX3024T (3 months old approx).

So, the infiniivisionlauncher.exe is missing from the \Secure\infiniiVision folder:

Code: [Select]
Directory of \Secure\infiniiVision

10/18/11  08:47p    <DIR>                    web
10/18/11  08:47p    <DIR>                    fpga
10/06/16  04:48p                     1152032 splashImage.bin
12/29/15  10:27a                      105160 symbols.tte
12/29/15  10:27a                        1891 usbDemoData.html
12/29/15  10:27a                      822702 usbDemoDataEye.png
12/29/15  10:27a                      822702 usbDemoDataPlot.png

Found 7 file(s). Total size 2904487 bytes.

But apart from the Program Files\infiniiVision folder there is another infiniivisionlauncher.exe in the \Windows folder... Interesting.
Can you show the content of the infiniivision.lnk in the \Secure\Startup folder? I bet it is pointing to the launcher in Program Files.


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cgroen on January 18, 2017, 11:09:55 am
Attached is a dump of the file structure of my MSOX3024T (3 months old approx).

So, the infiniivisionlauncher.exe is missing from the \Secure\infiniiVision folder:

Code: [Select]
Directory of \Secure\infiniiVision

10/18/11  08:47p    <DIR>                    web
10/18/11  08:47p    <DIR>                    fpga
10/06/16  04:48p                     1152032 splashImage.bin
12/29/15  10:27a                      105160 symbols.tte
12/29/15  10:27a                        1891 usbDemoData.html
12/29/15  10:27a                      822702 usbDemoDataEye.png
12/29/15  10:27a                      822702 usbDemoDataPlot.png

Found 7 file(s). Total size 2904487 bytes.

But apart from the Program Files\infiniiVision folder there is another infiniivisionlauncher.exe in the \Windows folder... Interesting.
Can you show the content of the infiniivision.lnk in the \Secure\Startup folder? I bet it is pointing to the launcher in Program Files.

Here you go Paul:


\> type secure\startup\infiniivision.lnk
56#"\Program Files\infiniiVision\infiniivisionLauncher.exe"
\>


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cgroen on January 18, 2017, 11:14:33 am
This is the "about" screen from my scope with firmware version number etc:

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on January 18, 2017, 11:24:57 am
As I expected it starts the launcher in the Program Files folder.

If you feel like doing a little experiment you can try the following:

taskkill /im infiniivisionLauncher.exe

\windows\infiniivisionlauncher.exe -bw35

Your hardware is not 350MHz but I wonder if it will show the 350MHz on the info screen, and also it could warn about 'unfinished software' like it does on the non-T version.

After that reboot the scope or kill the launcher again and start the one in Program Files\infiniiVision.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cgroen on January 18, 2017, 11:30:11 am
As I expected it starts the launcher in the Program Files folder.

If you feel like doing a little experiment you can try the following:

taskkill /im infiniivisionLauncher.exe

\windows\infiniivisionlauncher.exe -bw35

Your hardware is not 350MHz but I wonder if it will show the 350MHz on the info screen, and also it could warn about 'unfinished software' like it does on the non-T version.

After that reboot the scope or kill the launcher again and start the one in Program Files\infiniiVision.

I'm not able to execute "taskkill" ? If I search for taskkill as an exe it is not found, and it is also not listed as a builtin command in the telnet ??
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on January 18, 2017, 11:45:16 am
I'm not able to execute "taskkill" ? If I search for taskkill as an exe it is not found, and it is also not listed as a builtin command in the telnet ??

Sorry, not sure what OS was in my mind when I typed that, it should be:

ProcessMgr.exe kill infiniivisionLauncher.exe

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cgroen on January 18, 2017, 11:48:46 am
I'm not able to execute "taskkill" ? If I search for taskkill as an exe it is not found, and it is also not listed as a builtin command in the telnet ??

Sorry, not sure what OS was in my mind when I typed that, it should be:

ProcessMgr.exe kill infiniivisionLauncher.exe

No worries :)
This is the result:

\> ProcessMgr.exe kill infiniivisionLauncher.exe
\> \windows\infiniivisionlauncher.exe -bw35
Our command line is -bw35
cCanineCalMgr::cCanineUserCalFactors::cCanineUserCalFactors size 27872
cCanineCalMgr::cCanineServiceCalFactors::cCanineServiceCalFactors size 704
cCanineCalMgr::cCanineFactoryCalFactors::cCanineFactoryCalFactors size 708
System has been running 2459.378906 seconds


But the "about" screen still says 200 MHz (assuming thats were you want me to look)


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on January 18, 2017, 11:57:11 am
But the "about" screen still says 200 MHz (assuming thats were you want me to look)

Yes, I sort of expected that to change. Did you see the 350MHz in the listed options?
Can you try:

\windows\infiniivisionlauncher.exe --help?

That should show the valid options
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cgroen on January 18, 2017, 12:11:36 pm
But the "about" screen still says 200 MHz (assuming thats were you want me to look)

Yes, I sort of expected that to change. Did you see the 350MHz in the listed options?
Can you try:

\windows\infiniivisionlauncher.exe --help?

That should show the valid options

Unfortunately not! it just gives:

\> ProcessMgr.exe kill infiniivisionLauncher.exe
\> \windows\infiniivisionlauncher.exe --help
Our command line is --help
cCanineCalMgr::cCanineUserCalFactors::cCanineUserCalFactors size 27872
cCanineCalMgr::cCanineServiceCalFactors::cCanineServiceCalFactors size 704
cCanineCalMgr::cCanineFactoryCalFactors::cCanineFactoryCalFactors size 708
System has been running 119.515244 seconds

also tried -help and -?, both with same result!

Just noticed that there also is a infiniivisionlauncher.exe in the "program files\infiniivision" folder, but same size as the one in the windows folder (5632 bytes)



Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on January 18, 2017, 12:16:10 pm
Just noticed that there also is a infiniivisionlauncher.exe in the "program files\infiniivision" folder, but same size as the one in the windows folder (5632 bytes)

Yes, that is the one that is started when you boot the scope, it is in the .lnk file in startup remember?

Well, I'm out of ideas for the moment, let's wait for a few other eyes, but it looks like the process is different in the T series.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cgroen on January 18, 2017, 12:29:15 pm
Just noticed that there also is a infiniivisionlauncher.exe in the "program files\infiniivision" folder, but same size as the one in the windows folder (5632 bytes)

Yes, that is the one that is started when you boot the scope, it is in the .lnk file in startup remember?

Well, I'm out of ideas for the moment, let's wait for a few other eyes, but it looks like the process is different in the T series.

Yup, got it! (its been 20 years since I have been messing with WinCE  :-+

Lets see if some other have any ideas, I can copy files from the scope to a USB stick if anything can help in the process...
(just don't want to brick my scope  ::) )
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on January 18, 2017, 05:06:31 pm

Unfortunately not! it just gives:

\> ProcessMgr.exe kill infiniivisionLauncher.exe
\> \windows\infiniivisionlauncher.exe --help
Our command line is --help
cCanineCalMgr::cCanineUserCalFactors::cCanineUserCalFactors size 27872
cCanineCalMgr::cCanineServiceCalFactors::cCanineServiceCalFactors size 704
cCanineCalMgr::cCanineFactoryCalFactors::cCanineFactoryCalFactors size 708
System has been running 119.515244 seconds

also tried -help and -?, both with same result!

Just noticed that there also is a infiniivisionlauncher.exe in the "program files\infiniivision" folder, but same size as the one in the windows folder (5632 bytes)

On my version (an old 2.35 firmware) the "--help" option works, see below for some interesting options to play with. On my scope you could enable all licences with "-l All", but maybe this was changed in later versions, and probably for the bandwidth you need some extra parameters.

Code: [Select]
\secure\infiniivision> infiniivisionlauncher.exe --help
Our command line is --help

USAGE:

   infiniivision  [--ExtTalClk] [--IntTalClk] [--4GSa] [--5GSa]
                  [--flushNetwork] [--gpibModule] [--lanModule]
                  [--debugTestAddress <debugTestAddress>] [--noAdcResync]
                  [--noBlanketInit] [--noScreenSaver] [--twoChan] [-f
                  <string>] [--sliceid2] [--sliceid1] [--sliceid]
                  [--mondll] [--disdcc] [--oldadcstartup] [--noadcreset]
                  [--forcemaxmem] [--newVga] [--invsoft] [--probecomp]
                  [--calChannel <Channel Number>] [--codeSnitch] [-u <3
                  character string>] ...  [-l <3 character string>] ...
                  [--traceFlags <Base10 number>] [--str] [--ctrlDiagStr
                  <Binary string>] [--ctrlDiagVal <Base10 number>] [--perf]
                  [--msg] [--dflt] [--noScope] [--srv] [--] [--version]
                  [-h]


Where:

   --ExtTalClk


   --IntTalClk


   --4GSa


   --5GSa


   --flushNetwork


   --gpibModule


   --lanModule


   --debugTestAddress <debugTestAddress>
     debug test address

   --noAdcResync
     disables periodic adc resync

   --noBlanketInit
     disables blanket init

   --noScreenSaver
     disables screen saver

   --twoChan


   -f <string>,  --family <string>
     product family

   --sliceid2
     enable slice id

   --sliceid1
     enable slice id

   --sliceid
     enable slice id

   --mondll
     enable monDLL

   --disdcc
     enable disDCC

   --oldadcstartup
     old ADC startup

   --noadcreset


   --forcemaxmem


   --newVga


   --invsoft


   --probecomp


   --calChannel <Channel Number>
     Channel to calibrate (0 = ALL CHANS, 1=CHAN1, ect.)

   --codeSnitch
     collapse thread priorities for CodeSnitch

   -u <3 character string>,  --disableLicense <3 character string>
      (accepted multiple times)
     disable licence XXX

   -l <3 character string>,  --enableLicense <3 character string>
      (accepted multiple times)
     enable licence XXX

   --traceFlags <Base10 number>
     mask for DebugPrint

   --str
     CMD_LINE_STR_DEFAULT_STR_DB

   --ctrlDiagStr <Binary string>
     control system diagnostics

   --ctrlDiagVal <Base10 number>
     control system diagnostics

   --perf
     make entry like performance

   --msg
     logs generic diagnostics

   --dflt
     default setup

   --noScope
     no scope mode

   --srv
     runs scope in service mode

   --,  --ignore_rest
     Ignores the rest of the labeled arguments following this flag.

   --version
     Displays version information and exits.

   -h,  --help
     Displays usage information and exits.


   infiniiVision

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on January 18, 2017, 06:41:32 pm
On my version (an old 2.35 firmware) the "--help" option works, see below for some interesting options to play with. On my scope you could enable all licences with "-l All", but maybe this was changed in later versions, and probably for the bandwidth you need some extra parameters.

Frank,

Did you notice that his scope is the T version? I think they changed the way we could fool adjust the system...  :--
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 18, 2017, 06:57:57 pm
Has anyone archived the older firmware revs for the T series?
Current is 4.08 and that is the only rev on the Keysight website.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 18, 2017, 07:40:53 pm
I predict a rapid sales rise in the MSOX3014T.

I think the best prize in mid-class would be for DSOX4024A. This model could possibly go all the way up to 1.5GHz.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on January 18, 2017, 08:36:15 pm
Try exe from 3000(non-T) copied to usb? The main part of the software is in infiniivision.dll, so there is a chance
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 18, 2017, 08:41:53 pm
But the "about" screen still says 200 MHz (assuming thats were you want me to look)

Yes, I sort of expected that to change. Did you see the 350MHz in the listed options?
Can you try:

\windows\infiniivisionlauncher.exe --help?

That should show the valid options

With the A version I thought if you tried a bandwidth option higher then the board strapping would allow it would ignore it.
So the same test might need to be re-run with a different option.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on January 20, 2017, 04:58:19 pm
I can confirm that the hashing script worked for me also and I'm able to access the T model through telnet. Running 4.06 here.
I can also confirm all the details :cgroen posted already referring to the fact that there is no --help or -?.

As I did not upgrade any A series scope, I do have a few questions for you guys.

Killing the running instance of infinnilauncher.exe and running it again with other options, can brick the scope? As I'm an IT guy, I presume this might just either not work or just throw an exception about not recognising other parameters i might try.
Does this interfere in any way with the booting process? I do understand that Windows CE executes the value from the .lnk file. Unless I change that, just by killing the running instance and trying different parameters might get me in trouble? I assume not, but it's better to ask.

As I don't have the APPBNDL I'm looking to try the options for enabling different scope options.

Does anyone have the infiniivisionlauncher.exe from the A series at hand so I can try that as well, or should I just extract it from the latest .bin file?

Also I'm in the process of doing the hardware mod for upgrading to 350/500 Mhz as my parts just arrived. Will keep you updated on this also.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on January 20, 2017, 05:14:03 pm
Killing the running instance of infinnilauncher.exe and running it again with other options, can brick the scope? As I'm an IT guy, I presume this might just either not work or just throw an exception about not recognising other parameters i might try.

Yes, in theory it can brick your scope, or it can catch fire etc., because some options might be just for a special debug hardware, we don't know. But it is not likely, I guess worst case might be that you have to reboot it because it locks up, unless you don't overwrite the flash. Then you might need to restore it from the bootloader over the serial port, or even with JTAG.

Quote
Does anyone have the infiniivisionlauncher.exe from the A series at hand so I can try that as well, or should I just extract it from the latest .bin file?

There is not much in infiniivisionlauncher.exe, IIRC most of the functionality is in the DLLs. And you shouldn't mix different versions of the program, and the DLLs and image.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 20, 2017, 05:19:27 pm
If you manually kill the process and just try restarting it with options yourself it should be quite safe to do. Just don't delete anything :)
As for your mod I think your first step is to try strapping the board for a 350/500 MHz unit. Then boot it up and verify it thinks it should be 350 MHz. At that point you can also try enabling 500 MHz via telnet and added the -BW 50 option.(same as the 3000A series).

For now if you may want try the following after logging in via telnet:

ProcessMgr.exe kill infiniivisionLauncher.exe
\windows\infiniivisionlauncher.exe -l all

I doubt it will enable all licenses though without a file being patched(the same dll that needs to be patched on most firmware versions from the A series).

I wouldn't run any files from the A series at this point.

btw do you have the 4.06 install file?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 20, 2017, 05:56:29 pm
Looking for /Secure/cal folder contents from DSOX20x2A and DSOX20x4A (both of them). MSO will also be good. If you have one of these scopes and can share cal, please PM.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on January 20, 2017, 06:09:45 pm
:FrankBuss Thanks for the message. I was just interested in known cases of bricking.

I saw an earlier post by :ogoun after my message regarding no success on passing options through infiniivisionlauncher.exe. I'll try as :TheSteve suggested after hw strapping. I'll look into 4kinfiniiVisionCore.dll with IDA soon if I have some time.

If anyone looked at that DLL and has any ideas please let me know.

Does anyone have any un-bricking procedure through serial or JTAG?  Just in case.

:TheSteve Thanks and that was exactly what I had in mind. Will try that and I'll keep everyone updated. I don't have the 4.06 install file unfortunately. This is what the scope came with.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on January 20, 2017, 06:15:12 pm
Just FYI:

ProcessMgr.exe kill infiniivisionLauncher.exe
\windows\infiniivisionlauncher.exe -l all

has no effect on enabled options without other changes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 20, 2017, 06:35:12 pm
\windows\infiniivisionlauncher.exe -l all

has no effect on enabled options without other changes.
You can try to copy infiniivisionLauncher.exe from 3000A (not sure if it works for T) to USB, attach USB flash and run:

ProcessMgr.exe kill infiniivisionLauncher.exe
\usb\infiniivisionlauncher.exe -l all
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 20, 2017, 06:51:23 pm
Adranp - I do think a full JTAG backup of the flash would be great. I know others have done it with the 3000a series.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: arlvaljr on January 22, 2017, 03:54:39 pm
Does anyone still have the original update file "3000XSeries.01.10.2011031600.cab to provide?

All references are broken by now and I would like to study it a litle.

Thanks ;D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on January 23, 2017, 09:50:35 pm
Happy to report that strapping works as in 3000A series mod. I've been able to mod to 350/500 Mhz version as previously reported.
Going to mod 1 channel tonight and will report back the results.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 23, 2017, 10:48:57 pm
Sounds good - any questions you know how to get ahold of me.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 23, 2017, 11:03:27 pm
I think the Teledyne relay is actually a 20dB switchable attenuator with a 12V coil.

A150-20-12

http://www.teledynerelays.com/pdf/electromechanical/a150.pdf (http://www.teledynerelays.com/pdf/electromechanical/a150.pdf)

Avnet have them unstocked at $61, single unit MOQ, 16 week lead time.

Edit: I see someone beat me to it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 23, 2017, 11:12:26 pm
The 5v coil version, A150-20-5, is showing availabilty, it's not beyond the wit of man to pop a resistor in there.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on January 24, 2017, 05:19:32 pm
Why do you think the Teledyne part is an attenuator?  I see that physically it looks like an A150 and the pinout looks right, but I'm not figuring how it could be used in this circuit.

Referring to the picture Scope-07.jpg here:

  https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg985356/#msg985356 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg985356/#msg985356)

And attached below is the underside of that area.  It looks to me like it's only switching the terminator resistor in and out of circuit.

On the <=500MHz, it would seem K203 and R218 do this task but they are unpopulated in the 1GHz.  500MHz photos here:

  https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg983501/#msg983501 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg983501/#msg983501)


Perhaps the Teledyne relay is based on the A150 part, but it's been customized with no attenuator section.  I think it's just a relay.

Opening a MSO/DSO3104A and checking when the coil is engaged could confirm this theory (no need to take off the shield can).


EDIT: This is wrong.  It is an attenuator.  Read on...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 24, 2017, 06:30:13 pm
If you look at this post from Mike https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1111386/#msg1111386 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1111386/#msg1111386)

You'll see this pic:

(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=284528;image)

and in another pic showing the underside, and the following post showing the unpopulated version, it's a six pinner: I was expecting to see an eight pin device, i.e., dpdt relay.

(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=284618;image)

Being only a six pinner got my head scratching, but then looking through the Teledyne catalogue I came across the A150 series, and the part number on the side of the part links in with the data sheet part numbers.

http://www.teledynerelays.com/pdf/electromechanical/a150.pdf (http://www.teledynerelays.com/pdf/electromechanical/a150.pdf)

This is for the 3000T though, not the 3000A

How does that sound?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 24, 2017, 06:50:42 pm
Why do you think the Teledyne part is an attenuator?
That's definitely an attenuator. In 1GHz model 50Ohm terminated DC path completely bypasses default R-L-C attenuation network and switches to this Teledyne relay for -20dB and to direct path for zero attenuation). Also, alternative input pins are used in frontend ASIC. That's why datasheet max vertical range is different for <1Ghz and 1GHz models at 50Ohm.

Also true what this 1GHz path could be tested without Teledynes on high vertical gains only (there will be loss of signal for attenuated path). I was too lazy to test all of this. I also need this scope to be assembled and ready for use.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on January 24, 2017, 06:55:27 pm
Quote
and in another pic showing the underside, and the following post showing the unpopulated version, it's a six pinner

I don't think it is showing the underside - looks to me like it's showing the top, just not populated.

If you check the two vias, no matter how you turn the board over they can't migrate from bottom left to top right. Just a small point of order :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 24, 2017, 07:00:50 pm
Small note: K501 relay is used to switch between 50 Ohm DC path and anything else on 1 GHz version. That's why K501 is missing (short in predefined position) on lower BW models. K503 is not used in 1GHz because K501 already switches input path to 50Ohm termination (directly or via Teledyne). Big termination resistor is also replaced to sit at the end of signal path.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on January 24, 2017, 07:08:09 pm
How does that sound?
Sounds right.  I'm sure they used the same relay for the A and T.  And the photo with the part number is particularly telling.  I looked for a photo with the number but I missed it.

I'm wrong.  Thanks everyone for the explanations.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 24, 2017, 09:28:49 pm
Quote
and in another pic showing the underside, and the following post showing the unpopulated version, it's a six pinner

I don't think it is showing the underside - looks to me like it's showing the top, just not populated.

If you check the two vias, no matter how you turn the board over they can't migrate from bottom left to top right. Just a small point of order :)

There were two pics I referred to (in addition to the top pic) only the second one I showed. If you follow the link I gave to Mike's post you'll see it, but here it is for completeness.

(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=284530;image)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 24, 2017, 10:03:55 pm
So who has a DSOX/MSOX3104A/T and is brave enough to measure a few critical parts for the greater good?
What if I throw in a bribe to make it happen?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on January 24, 2017, 10:05:24 pm
Quote
only the second one I showed

OK. Sorry for misreading it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on January 26, 2017, 09:14:51 pm
So who has a DSOX/MSOX3104A/T and is brave enough to measure a few critical parts for the greater good?
What if I throw in a bribe to make it happen?
Do you have a list of values you need and a picture of where they are located?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 26, 2017, 09:16:02 pm
So who has a DSOX/MSOX3104A/T and is brave enough to measure a few critical parts for the greater good?
What if I throw in a bribe to make it happen?
Do you have a list of values you need and a picture of where they are located?

I will confirm the list we need with memset and post when we're done.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: arlvaljr on January 27, 2017, 07:08:33 pm
Does anyone stil can provide the original update file "3000XSeries.01.10.2011031600.cab?

I want an opportunity to check its contents.

Thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 27, 2017, 08:23:48 pm
Do you have a list of values you need and a picture of where they are located?
Hello! I'll prepare some pictures on this weekend.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 29, 2017, 05:08:29 pm
Here is a list of unknown AFE caps for 1 GHz AFE.
Look for red dots on pictures to find them.

Where are 3 on bottom layer, two near Teledyne (of the same value, suspected to be like 0.1uF) and one near 50 Ohm termination resistor. I suspect it to be 0.01 - 0.1 uF.

On the top layer there are 5 unknown caps. 4 of them are on the anti-aliasing filter. I suspect them to be in single picofarad range so a very good cap meter is required to measure them). Also I think they are two pairs of equal value, but that's not necessary true. 5th cap is near big relays. It should be in ~100 pF range, but maybe anything around 1pF - 1000pF.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 29, 2017, 05:28:00 pm
Among other parts required for 1GHz upgrade are:
1. 3x inductors, suspected to be 6.8nH Coilcraft - from 0603CS or 0603HP series.
2. 1x BAV99 diode.
3. 1x HSMP-3892 RF pin diode.
4. 1x MMBF0201NL N-channel logic FET (replace with anything in SOT-23 with 300mA / 20V, 1.7V Gth and <1 Ohm Rds_on). Like IRLML2402, etc.
5. 1x A150-20-12 Teledyne attenuator relay.
6. Caps
7. Resistors

Not included are strapping resistors and a subset of parts originally required for 200Mhz to 500 MHz upgrade.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on January 29, 2017, 05:33:41 pm
I have added some points of interest on my front-end pictures among others :memset already highlighted.

:memset - From your list of other components can you place them on my image and see if what I highlighted might be of interest ?

(http://)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on January 29, 2017, 05:36:38 pm
Also there are plenty of resistors changed or which should be added.

:Memset Do you think we can easily find their values or should we think about highlighting them for measurement also?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on January 29, 2017, 05:54:57 pm
Also I'm able to report now that the 350Mhz/500Mhz works as previously reported for 3000A.

I have modded one of my channels and here are some tests. Haven't been able to close the scope or user calibrate it though.

Images are after strapping and two tests at 350Mhz one on an unmodded channel and one on the modded channel.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 29, 2017, 05:59:13 pm
:Memset Do you think we can easily find their values or should we think about highlighting them for measurement also?
All resistors are directly marked, nothing but a good photo is required to identify them. And the photos are already here.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on January 29, 2017, 06:03:47 pm
There is a resistor (??) missing in the lower bandwidth configs near the AD8034 and it has no marking (I've highlighted it in my pic).
Or is it another component there?

Thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 29, 2017, 06:09:06 pm
There is a resistor (??) missing in the lower bandwidth configs near the AD8034 and it has no marking (I've highlighted it in my pic).
I can't see the pic but I've got your point. It's the same part as two on other side of afe block (near two big caps). Could be power inductor for relay.
This component is not required to be tested on 1 GHz model because its present on all models.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on January 29, 2017, 06:13:29 pm
In my 3014T this component I'm talking about is missing (not-populated). I've reattached the image maybe you can see it now.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 29, 2017, 06:16:20 pm
Yes, that's the part I was talking about.
BTW, do you have a good picture of the bottom layer of your AFE zone?
I've browsed a pile of photos and I see there are no good close up pic of the back side of <1GHz T-model.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on January 29, 2017, 06:33:50 pm
Here's a high-res back AFE zone. I have more in different lighting angles. Let me know if this suits your needs or I'll prepare an archive with few of them and put it online.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on January 29, 2017, 06:42:27 pm
Here's a high-res back AFE zone. I have more in different lighting angles. Let me know if this suits your needs or I'll prepare an archive with few of them and put it online.
Good enough, but somewhat worse than your superb photo of the top layer. The interesting part is readable, but being on the periphery its blurred and causes some dizziness while looked at narrowly.
Do you have a better (not blurred) photo of this zone (to be consistent with your top layer photo):
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on January 29, 2017, 06:56:59 pm
The blurring is due to DOF (depth of field). I've had a slight angle when taking these pictures and I have thought that I won't need the ch4 AFE because the CH3 is in perfect quality.

I've linked a lower compression picture with ch3+ch4 AFE.

I'll take a CH4 back AFE picture when I open my scope again.

https://www.idsys.ro/public/IMG_9839_1.jpg (https://www.idsys.ro/public/IMG_9839_1.jpg)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 29, 2017, 07:54:30 pm
To be fair, I find taking good close in board photos to be very time consuming, and usually take multiple attempts before getting it right.

My better ones are done with a tripod, macro lens, tight aperture, long exposure, and ambient light. But that takes time to set up, turning a 10 second phone camera shot into a fifteen minute extravaganza.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on January 29, 2017, 08:06:54 pm
:Howardlong Not necessarily time consuming but needs at least a few advanced level tips. My setup is DSLR + tripod + off-bracket (wirelessly triggered lighting) flashes. Macro is not a must. For example I've shot these with 17-40 wide lens which offers 0.28m minimum focusing distance.

The most important thing is lighting. Off camera bracket flash offers different lighting angles and gives the ability to use small aperture (high F-stops) which provides larger DOF and sharpness.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 29, 2017, 11:12:44 pm
In my 3014T this component I'm talking about is missing (not-populated). I've reattached the image maybe you can see it now.

I would think the part in question is a ferrite bead - an ohm meter should be all that is needed to verify.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 30, 2017, 09:44:26 am
:Howardlong Not necessarily time consuming but needs at least a few advanced level tips. My setup is DSLR + tripod + off-bracket (wirelessly triggered lighting) flashes. Macro is not a must. For example I've shot these with 17-40 wide lens which offers 0.28m minimum focusing distance.

The most important thing is lighting. Off camera bracket flash offers different lighting angles and gives the ability to use small aperture (high F-stops) which provides larger DOF and sharpness.

I think that actually reflects my point perfectly, by the time you've set all that paraphernalia up and have a reasonable shot, then packed it all away again it's easily 15 minutes! ;-)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on February 07, 2017, 07:01:00 pm
heavy idling is detected on this thread
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cgroen on February 07, 2017, 07:02:42 pm
heavy idling is detected on this thread

Yeah, would love to (eventually) get my 3024T to work at 500 MHz  8)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on February 07, 2017, 07:11:37 pm
I'm still happy with my 3000A and I've no T model around, otherwise I would have had a look at the liberation possibilities already.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on February 07, 2017, 07:14:56 pm
Personally I was waiting for some CAP / INDUCTOR values  ;D

Still hoping for that..
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on February 07, 2017, 07:41:15 pm
I've been working on a list of component designators for each part that needs to be added, changed or removed between the 200 MHz and 1 GHz versions. Once that is nailed down and easy to follow we can probably get the needed values. Until then if someone opens a 1 GHz scope and measures parts for us an important one might get missed. It's a big enough ask to get someone to open a scope once and measure some values, it's even bigger to want them to do it twice. This is all for the 1 GHz upgrade.

The values to go to 500 MHz should be the same as the A series. Of course at this point they will only get you to 350 MHz as nobody has figured out how to add licences using the telnet login.

The 1 GHz mod seems more ideal as there will be no licenses needed. It won't be cheap though because of the needed Teledyne attenuators.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dubbie on February 07, 2017, 08:07:56 pm
It won't be cheap though because of the needed Teledyne attenuators.

A good deal cheaper than buying a 1Ghz scope. Thats for sure!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on February 07, 2017, 08:13:48 pm
:TheSteve "The values to go to 500 MHz should be the same as the A series." -> This has been confirmed by me (100->350Mhz) - It's clear the 350Mhz limiting is done in the fpga as it's exactly there, and not limited by actual hardware. 350->500 is done by software license.

:memset has put a nice list for 1Ghz upgrade, although the values of the caps and inductors are unknown. Hoping for help here. This would be really a beer giving opportunity minimum. :)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on February 07, 2017, 09:11:43 pm
Someone who likes to live dangerously will have to experiment with the firmware if they want to enable licenses. I am sure it is possible, but so far it isn't as easy as the 3000A series.

memset did do a nice job of marking parts of interest. It would be easier for everyone involved to reference the mod though if we have consistent component designators we can refer to. A master parts list would also be nice to have as it would show the exact value/part # of each part as we discover them.
There are quite a few changes made between the 200 MHz and 1 GHz versions.
And the easier we make it for someone willing to measure parts for us the better.

:TheSteve "The values to go to 500 MHz should be the same as the A series." -> This has been confirmed by me (100->350Mhz) - It's clear the 350Mhz limiting is done in the fpga as it's exactly there, and not limited by actual hardware. 350->500 is done by software license.

:memset has put a nice list for 1Ghz upgrade, although the values of the caps and inductors are unknown. Hoping for help here. This would be really a beer giving opportunity minimum. :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on February 28, 2017, 06:03:43 am
Four little Teledyne beauties arrived today. They were the only part I wasn't sure about getting so now that they are here it is time to keep the project moving forward.

I have edited part designators into the pictures that Mike shared of his MSOX3104T. The convention used follows the same as memset originally gave for the 500 MHz A series mod. At some point we can create a table with parts for each bandwidth without duplicate component names.

Here are what I believe are the known components for the 1 GHz mod:

R1 110 ohms
R2 162 ohms
R3 100K
R4 23.7 ohms
R5 23.7 ohms
R6 50 ohms 3024T only
R7 50 ohms 3104T only
R8 68.1 ohms
R9 51.1K
R10 51.1K 3104T only
R11 51.1K 3024T only

C1 ?
C2 ?
C3 ?
C4 ?
C5 ?
C6 ?
C7 ?
C8 ? assume 0.1 uF
C9 ? assume 0.1 uF
C10 ?
C11 ?
C12 ? 3024T only
C13 ?
C14 ? 3024T only

L1 green dot ~ 5 turns 15nH?
L2 red dot ~ 3 turns 6.8nH?
L3 red dot ~ 3 turns 6.8nH?
L4 likely 47nH(based off DSO6104A known values and color dot)
L5 red dot ~ 3 turns 6.8nH?

Q1 MMBF0201NL
D1 HSMP-3892
CR1 BAV99

BD1 - ferrite bead(resistance measurement will confirm)

K1 - Teledyne A150-20-12
K2 - AGQ210S4H 3024T only
K3 - AGQ210S4H 3104T only

Hopefully someone else can double check my work and comment on the values I have indicated. I am guessing several of the capacitors are likely 0.1 uF or similar for noise bypass. Once we have narrowed it down as far as possible and know the bare minimum we need measured I believe HighVoltage will measure the critical needed values for us.
At that point I'll do some performance measurements of my MSOX3024T and modify one channel. If it looks promising I will modify the other three channels and do performance measurements again.
At this point my performance measurements will include the 3dB point, rise time and input impedance vs frequency in 50 ohm mode. If there is anything else I should be checking before/after feel free to make suggestions.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cgroen on February 28, 2017, 08:19:15 am
Very nice!
I hope I have the courage to do this mod on my 3024T at some point !
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dubbie on March 01, 2017, 01:25:49 am
Nice work Steve!

I'm eager to see if this works!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 02, 2017, 03:44:40 pm
I find this thread absolutely amazing and awful in the same time.
I spent few hours several of days reading through the pages.
It is an amazing job, knowledge, interactivity and solutions found.
It is awful for a new comer which would like to follow and understand the proposed solutions.
I have read so many times the same words similar with “read few pages back”, “somewhere in thread if you read it through”. It is totally unorganized from my point of view. It is awful.
I can understand that is related with how the solutions evolved based on tests, experiments, trails, communications, but once a solution is found, it should stay somewhere easy to be found by a new reader.
I have seen new comers on the topic asking the same questions and sometimes a good willing older user copied and pasted the solution, because the new user is lost in the forest of trials. After the solution was found, some other guys still had all kind of problems and others not. Then all these important info spread along many pages is a headache. It is like half of job done.
Why is it like that? Is it on purpose? Or is no one able to organize and publish the solution as top line, a header, a new thread, a link with simply steps organized? It would be helpful at least to understand why. In the end are not so many versions of the firmware. The version 2.35 is an important step and then comes later 2.41. Then is USB method for old and LAN card for new. USB requires downgrade for versions above 2.35 to the version 2.35. Then are all kind of tricks and mistakes done by different users. It is a headache.
I was thinking once reading through the pages, why is it so unorganized after the solutions were found and can someone tell if it is true at least the ideas below that came into my mind?
It is spread and unorganized, because:
-   No one care to do it organized.
-   It is easy to hide the solution/hack for the other search engines or other technical people outside the forum (from Agilent?), because they must spend also hours and go through so many pages to understand what solutions have been found here.
-   After so many hours of trails and tests, the experienced users who found the solutions, decided that at least this is what other new readers can do when receive the solution for free without their own brain work: to read the pages back and find the solutions spread along the xx pages. That would be fine, but still is a big headache because is spread and twisted along so many pages. If it is meant to be free for others, then to whom does it help to not be organized?
Reading the pages back to find the solution produces only frustration until you find and understand the procedure.
I have a Rigol DS4034, for which was far easy to read and follow the unlocking procedure. For that I am thankful to the guys that did it and share it. My Rigol has all the functions unlocked.
https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg523679/#msg523679 (https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg523679/#msg523679)
https://www.eevblog.com/forum/projects/software-tips-and-tricks-for-rigol-ds200040006000-ultravision-dsos/ (https://www.eevblog.com/forum/projects/software-tips-and-tricks-for-rigol-ds200040006000-ultravision-dsos/)
https://www.eevblog.com/forum/testgear/rigol-mso4000-and-ds4000-tests-bugs-firmware-questions-etc/?all (https://www.eevblog.com/forum/testgear/rigol-mso4000-and-ds4000-tests-bugs-firmware-questions-etc/?all)

Beside that I have one Agilent DSO-X-2002A, but I never tried yet the proposed solutions.
If I will do it, then I will make a step by step tutorial, if it is necessary with screenshots and video recording, so any new reader will able to follow it in less than 15min, without reading xx pages back.
I have the firmware version 2.36.
https://goo.gl/yvf7Of (https://goo.gl/yvf7Of)
If I understood right I have 2 options: I downgrade to 2.35 and I use the USB stick trick, with the proper USB drive – here trials are waiting for me, or the hack with LAN card and telnet software/commands.
After so much reading I still have some basic questions:
-   What do I lose if I downgrade to 2.35 from 2.36 or any other firmware higher than 2.35? I mean besides the advantage of being able to unlock the oscilloscope when I have the firmware 2.35, what do I miss? What advantages offers 2.36 or 2.37 or the latest 2.41? Is it really important to have the latest 2.41 unlocked? Or are the people happy with downgrade to 2.35 and being unlocked with all the features?
-   Agilent offers LAN/VGA card at over 400€. Is that card that is needed? Or do I need a special hand-made one? If I need a special made one, who is selling it here on forum and at around what price?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 03, 2017, 12:24:13 pm
One question is answered.
What do I miss if I will have firmware version 2.35 compared with latest 2.41, what is the difference?
Below are a link and the pdf file with changes from one version to another.
http://www.keysight.com/upload/cmc_upload/All/Keysight_2000A_3000A_X_Series_Oscilloscope_Release_Notes_02_41.pdf (http://www.keysight.com/upload/cmc_upload/All/Keysight_2000A_3000A_X_Series_Oscilloscope_Release_Notes_02_41.pdf)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on March 03, 2017, 01:39:57 pm
I find this thread absolutely amazing and awful in the same time.
I spent few hours several of days reading through the pages.
It is an amazing job, knowledge, interactivity and solutions found.
It is awful for a new comer which would like to follow and understand the proposed solutions.
I have read so many times the same words similar with “read few pages back”, “somewhere in thread if you read it through”. It is totally unorganized from my point of view. It is awful.
I can understand that is related with how the solutions evolved based on tests, experiments, trails, communications, but once a solution is found, it should stay somewhere easy to be found by a new reader.
I have seen new comers on the topic asking the same questions and sometimes a good willing older user copied and pasted the solution, because the new user is lost in the forest of trials. After the solution was found, some other guys still had all kind of problems and others not. Then all these important info spread along many pages is a headache. It is like half of job done.
Why is it like that? Is it on purpose? Or is no one able to organize and publish the solution as top line, a header, a new thread, a link with simply steps organized? It would be helpful at least to understand why. In the end are not so many versions of the firmware. The version 2.35 is an important step and then comes later 2.41. Then is USB method for old and LAN card for new. USB requires downgrade for versions above 2.35 to the version 2.35. Then are all kind of tricks and mistakes done by different users. It is a headache.
I was thinking once reading through the pages, why is it so unorganized after the solutions were found and can someone tell if it is true at least the ideas below that came into my mind?
It is spread and unorganized, because:
-   No one care to do it organized.
-   It is easy to hide the solution/hack for the other search engines or other technical people outside the forum (from Agilent?), because they must spend also hours and go through so many pages to understand what solutions have been found here.
-   After so many hours of trails and tests, the experienced users who found the solutions, decided that at least this is what other new readers can do when receive the solution for free without their own brain work: to read the pages back and find the solutions spread along the xx pages. That would be fine, but still is a big headache because is spread and twisted along so many pages. If it is meant to be free for others, then to whom does it help to not be organized?
Reading the pages back to find the solution produces only frustration until you find and understand the procedure.
....

While I understand your frustration, here are two reasons. Firstly, a forum simply doesn't work like a wiki does, where multiple editors can modify a single resource. Second, much of this is work in progress by several contributors. As you will have seen, over time solutions become more tailored, and there is usually room for further continuous improvement.

This is not the only forum thread like this. Almost all hacking threads end up this way. If you've found one or two that don't then you have been lucky. I'm not excusing it, it's just that there isn't really a mechanism that allows several individuals to edit the first post of a thread in the same way that multiple editors can manage a wiki.

We have sometimes seen the first post of a thread being maintained by the OP, but that assumes that the OP's still interested in maintaining it, and will continue to be. It may well be that their original question has already been answered to their satisfaction. Again, this is the limitation of the single editor/post paradigm of a forum.

Sometimes you see well-meaning secondary threads attempting to summarise, but this rarely ends well, typically diluting the information across multiple threads, particularly if it is still a work in progress.

If you have a reasonable solution, then feel free to do it. What this isn't, although it's suggested in your post, is laziness or a deliberate attempt by contributors to obfuscate information. It's simply that a forum format doesn't lend itself to an immediate answer on a plate.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 06, 2017, 07:42:17 am
Thank you for your explanations, which are quite satisfactory.
In my opinion, I still consider it would be very useful if it would be open a dedicated thread only to verified solutions, described in detail by each user who verified/applied that particular solution and is willing to present it nice, monitored and closed by a moderator. Only the moderator would be able to append new verified solutions, if are nice and clear described. Definitely would be shorter and easier to follow.
All the other threads, as the present one for example, can be considered main research work, or the others collateral threads and it should be a final closed thread only with verified solutions.
But maybe no one is willing to invest time to prepare and maintain such thread, which is also understandable when the users are satisfied because already found for themselves a working solution after hours of trial and error.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: luisprata on March 06, 2017, 08:18:46 am
Hi all,

Using WaveGen in 2000-x series 2.35 version... it's possible to add noise to signals? The option is there but doesnt seem to work... Any ideas?

Thank you.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: carl_lab on March 06, 2017, 01:59:17 pm
While I understand your frustration, here are two reasons. Firstly, a forum simply doesn't work like a wiki does, where multiple editors can modify a single resource. Second, much of this is work in progress by several contributors. As you will have seen, over time solutions become more tailored, and there is usually room for further continuous improvement.

This is not the only forum thread like this. Almost all hacking threads end up this way. If you've found one or two that don't then you have been lucky. I'm not excusing it, it's just that there isn't really a mechanism that allows several individuals to edit the first post of a thread in the same way that multiple editors can manage a wiki.

We have sometimes seen the first post of a thread being maintained by the OP, but that assumes that the OP's still interested in maintaining it, and will continue to be. It may well be that their original question has already been answered to their satisfaction. Again, this is the limitation of the single editor/post paradigm of a forum.

Sometimes you see well-meaning secondary threads attempting to summarise, but this rarely ends well, typically diluting the information across multiple threads, particularly if it is still a work in progress.

If you have a reasonable solution, then feel free to do it. What this isn't, although it's suggested in your post, is laziness or a deliberate attempt by contributors to obfuscate information. It's simply that a forum format doesn't lend itself to an immediate answer on a plate.
Everything you said is correct.

You could separate a topic into discussion sub thead and a solutions sub thread.
If you have any questions you can ask in discussion sub thread, if you got some working solutions you can copy/move to solutions sub thread.
Problem: More administrative work to manage it...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on March 06, 2017, 02:19:54 pm
 
Quote
Problem: More administrative work to manage it...
Exactly, someone still need to do it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on March 06, 2017, 08:48:07 pm
Thank you for your explanations, which are quite satisfactory.
In my opinion, I still consider it would be very useful if it would be open a dedicated thread only to verified solutions, described in detail by each user who verified/applied that particular solution and is willing to present it nice, monitored and closed by a moderator. Only the moderator would be able to append new verified solutions, if are nice and clear described. Definitely would be shorter and easier to follow.
All the other threads, as the present one for example, can be considered main research work, or the others collateral threads and it should be a final closed thread only with verified solutions.
But maybe no one is willing to invest time to prepare and maintain such thread, which is also understandable when the users are satisfied because already found for themselves a working solution after hours of trial and error.

Maybe you could do it?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: BFX on March 06, 2017, 11:00:25 pm
Thank you for your explanations, which are quite satisfactory.
In my opinion, I still consider it would be very useful if it would be open a dedicated thread only to verified solutions, described in detail by each user who verified/applied that particular solution and is willing to present it nice, monitored and closed by a moderator. Only the moderator would be able to append new verified solutions, if are nice and clear described. Definitely would be shorter and easier to follow.
All the other threads, as the present one for example, can be considered main research work, or the others collateral threads and it should be a final closed thread only with verified solutions.
But maybe no one is willing to invest time to prepare and maintain such thread, which is also understandable when the users are satisfied because already found for themselves a working solution after hours of trial and error.

Hi,

there is also another reason for that, I think because it's lot of gamblers which would like to reach lot of money for nothing, like hack some gear a sell for much more, but they are not usualy too much technicaly skilled and it's a litle barrier to do that.  8)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: BFX on March 06, 2017, 11:02:22 pm
Thank you for your explanations, which are quite satisfactory.
In my opinion, I still consider it would be very useful if it would be open a dedicated thread only to verified solutions, described in detail by each user who verified/applied that particular solution and is willing to present it nice, monitored and closed by a moderator. Only the moderator would be able to append new verified solutions, if are nice and clear described. Definitely would be shorter and easier to follow.
All the other threads, as the present one for example, can be considered main research work, or the others collateral threads and it should be a final closed thread only with verified solutions.
But maybe no one is willing to invest time to prepare and maintain such thread, which is also understandable when the users are satisfied because already found for themselves a working solution after hours of trial and error.

Hi,

there is also another reason for that, I think because also here is lot of gamblers which would like to reach lot of money for nothing, like hack some gear a sell for much more, but they are not usualy too much technicaly skilled and it's a litle barrier to do that.  8)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Keysight DanielBogdanoff on March 06, 2017, 11:05:31 pm
Thank you for your explanations, which are quite satisfactory.
In my opinion, I still consider it would be very useful if it would be open a dedicated thread only to verified solutions, described in detail by each user who verified/applied that particular solution and is willing to present it nice, monitored and closed by a moderator. Only the moderator would be able to append new verified solutions, if are nice and clear described. Definitely would be shorter and easier to follow.
All the other threads, as the present one for example, can be considered main research work, or the others collateral threads and it should be a final closed thread only with verified solutions.
But maybe no one is willing to invest time to prepare and maintain such thread, which is also understandable when the users are satisfied because already found for themselves a working solution after hours of trial and error.

Hi,

there is also another reason for that, I think because also here is lot of gamblers which would like to reach lot of money for nothing, like hack some gear a sell for much more, but they are not usualy too much technicaly skilled and it's a litle barrier to do that.  8)

It's been done, and we've stepped in. Hacking your scope is one thing, buying -> hacking -> reselling is another. Save yourself some legal fees and just don't do that.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 07, 2017, 01:32:48 pm
Daniel, could you please tell us and elaborate what is Keysight ready to do (legally) when you say "we've stepped in"?

I personally dislike the idea of making money out of hacks "buying -> hacking -> reselling".
But if I buy a device, no matter what is it, and own it, then is mine and I do what I want with it. If I want to hack it and reverse engineering it, then I do it and I see no legal reason why not as long as is for yourself and you do not make money out of it.
It is the same as iPhone and Jailbreak. Who has the biggest brain will win.
what will Keysight do if I decide to hack my own oscilloscope without selling it?
What will Keysight do if the guys from here decide to "upgrade" hardware their own oscilloscope by changing components, let's say to make it "better"? Is it anything illegal in that? If not, then why would it be for the software change/hack when smart guys change some bits around instead of components?
Of course I understand that Keysight is upset because some technical guys outside of the company found their "little secret"  of certain Agilent/ Keysight oscilloscopes, but you should see it different. Maybe you just found a better way to improve your scope firmware security and why not, you may recruit your future development engineers from here.
I think many people will be happy if you can provide some answers to the questions above.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cgroen on March 07, 2017, 02:36:12 pm
Daniel, could you please tell us and elaborate what is Keysight ready to do (legally) when you say "we've stepped in"?

I personally dislike the idea of making money out of hacks "buying -> hacking -> reselling".
But if I buy a device, no matter what is it, and own it, then is mine and I do what I want with it. If I want to hack it and reverse engineering it, then I do it and I see no legal reason why not as long as is for yourself and you do not make money out of it.
It is the same as iPhone and Jailbreak. Who has the biggest brain will win.
what will Keysight do if I decide to hack my own oscilloscope without selling it?
What will Keysight do if the guys from here decide to "upgrade" hardware their own oscilloscope by changing components, let's say to make it "better"? Is it anything illegal in that? If not, then why would it be for the software change/hack when smart guys change some bits around instead of components?
Of course I understand that Keysight is upset because some technical guys outside of the company found their "little secret"  of certain Agilent/ Keysight oscilloscopes, but you should see it different. Maybe you just found a better way to improve your scope firmware security and why not, you may recruit your future development engineers from here.
I think many people will be happy if you can provide some answers to the questions above.

Isn't that what Daniel answered with his previous post already? He says that if one hacks his own scope that's "one thing" but if you are buying->hacking->selling to earn money on it, they (Keysight) will come after you...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on March 07, 2017, 02:52:15 pm
If it's purely a hardware mod, and you are not attempting to pass something off as something it's not, then there is nothing they can do ( though the might still try intimidation tactics).
However in most cases it will also involve software, which may have various legal issues due to specific legislation, depending on what country you are in.

However the long term effect is that if it's seen as a problem, a manufacturer is more likely to make things harder to hack.

Flir have tried it, both stopping sales of hacked E4s, and making them harder to hack,  and failed on both counts. One aspect in that case is that no changes to the software were required, just enabling existing functionality. I doubt they'd want to test it in court due to the risk of setting a precedent if they lost.


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jay_Diddy_B on March 08, 2017, 03:21:00 am
Hi group,

Take a look at this eBay item 172559013145

http://www.ebay.ca/itm/KEYSIGHT-Infiniivision-MSOX3034T-Mixed-signal-Oscilloscope-350Mhz-MEGA-ZOOM-/172559013145?hash=item282d519519:g:GqYAAOSwhlZYuQIj (http://www.ebay.ca/itm/KEYSIGHT-Infiniivision-MSOX3034T-Mixed-signal-Oscilloscope-350Mhz-MEGA-ZOOM-/172559013145?hash=item282d519519:g:GqYAAOSwhlZYuQIj)


I have good reason to believe that it has been 'hacked'.

Regards,

Jay_Diddy_B

(It may have been an extreme teardown)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jjoonathan on March 08, 2017, 06:18:08 am
:o Looks like it MEGA ZOOMed straight into a brick wall!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 08, 2017, 07:25:15 am
Maybe Keysight stepped in, too fast and...with their boots.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on March 08, 2017, 09:15:55 am
Looks like it may be a divorce scope, with the wife coming home to find her husband entertaining himself with the new model that he's spent her housekeeping on.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 08, 2017, 10:32:08 am
Then for sure was a new married couple after honeymoon.
She is waiting for him in bed and he, a Keysight engineer working overtime home,  says: honey I just need a bit more time to fix the firmware for this lovely oscilloscope and I am coming.
 After few minutes she says: I am coming! So she stepped in…
In the end it seems was not the Keysight engineer who “stepped in”, but his wife…
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on March 08, 2017, 11:46:21 pm
My MSOX3024A with lots of options but all original = (still) unhacked & unmodified just showed an error message after switching it on (and it does again after another off-on cycle):
OS version is not correct. Please reload system firmware
What? Where does this come from? Corrupted flash memory? Shall I be worried? :scared:

I did not reinstall the firmware (currently running 2.39) yet.
May I ask the experts: shall I do any precautions or may I just reinstall 2.39?
Thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on March 08, 2017, 11:59:34 pm
That sounds like it may be the beginning of the known flash corruption problem. I believe 2.39 may have been the first version where Keysight changed the boot process to make it more resistant to not booting at all when it occurs(we don't have all the details on what exactly they did).
The obvious answer is to reload firmware - but then there is a chance it might fail during the install depending on how the flash is managed etc and brick itself.
Hopefully Daniel from Keysight can offer his guidance here.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pieterc on March 09, 2017, 09:09:49 am
Greetings everyone,

Thanks for sharing so freely! I've got an MSO-X 3014A with 02.41 FW and spent the whole of yesterday unsuccessfully trying to get the scope to boot from a USB stick (using infiniivisionStartupOverride.txt, modified infiniivision.lnk, infiniiVision directory extracted from _setup.xml, etc.). FYI, I do not have the LAN extension card, so I can't telnet. Would telnet still be a possibility with 02.41 FW?

After scanning through the posts, it seems that it can't be done with 02.41 FW (correct?). I must downgrade to 02.35 FW (correct?). It also looks like my efforts were academic anyway, because 02.41 FW does not have an "infiniiVisionCore.dll" file. To make matters worse, I do not have the 02.35 FW, only 02.12 and 02.41.

Probably not right to ask publicly (in fear of the hole being fixed so feel free to ignore), but has anyone had any success with 02.41 FW?

Anyway, thanks and good luck!

Regards,
Pieter
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MrBungle on March 09, 2017, 09:32:39 am
Take a look at this eBay item 172559013145
...
I have good reason to believe that it has been 'hacked'.
...
(It may have been an extreme teardown)

That's been under a car.
Rubber rash on the front, gravel/concrete rash on the back.
Ouch.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on March 09, 2017, 10:25:32 am
Greetings everyone,

Thanks for sharing so freely! I've got an MSO-X 3014A with 02.41 FW and spent the whole of yesterday unsuccessfully trying to get the scope to boot from a USB stick (using infiniivisionStartupOverride.txt, modified infiniivision.lnk, infiniiVision directory extracted from _setup.xml, etc.). FYI, I do not have the LAN extension card, so I can't telnet. Would telnet still be a possibility with 02.41 FW?

After scanning through the posts, it seems that it can't be done with 02.41 FW (correct?). I must downgrade to 02.35 FW (correct?). It also looks like my efforts were academic anyway, because 02.41 FW does not have an "infiniiVisionCore.dll" file. To make matters worse, I do not have the 02.35 FW, only 02.12 and 02.41.

Probably not right to ask publicly (in fear of the hole being fixed so feel free to ignore), but has anyone had any success with 02.41 FW?

Anyway, thanks and good luck!

Regards,
Pieter

I can't remember ever having any luck booting my MSOX3054A from a USB stick which is just over a year old, but I did try many times with various different USB sticks. I believe I came to the conclusion that you needed to be on an earlier firmware version to begin with to support USB boot.

Telnet through the LAN works a treat though.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 09, 2017, 01:19:14 pm
@pieterc
I tell you what I understood so far.
My firmware is 2.37. The scope works fine now, but has no special licenses.
I have tried several hours during several days to read this forum. It is not easy. It just make me the impression that I understood few things, but is not clear how shall I hack the scope to unlock all its features.
Even with 2.37 is hard with USB stick boot. My understanding is this: 2.37 can be hacked and I can have it in scope using USB stick method, if the scope was previous flashed with 2.35. But as it is now, flashed with 2.37 from factory,I definitely cannot do it only with USB stick method. I need the LAN card first.
In your case, with 2.39, is the same or even worse. You need the LAN card for sure.
It seems the best way for 2.37 and above is to upgrade to 2.41 and then to use the LAN card to unlock all the features. So, it makes no sense to search more for a method using USB stick only and having the scope with 2.39. Anyway, I will not try the USB method with 2.37. I will upgrade to 2.41 and then I will try the LAN card method suggested here in forum.
A new LAN card from Keysight is over 400€ because has this VGA output and because is the brand, the name. I hope everyone understands that at manufacturer factory site, somewhere in Taiwan, the same card costs at least 10 times less.
Then, the smart guys from here found an alternative, a cheap LAN card, no VGA, only few components and mostly tracks and it works for the purpose of communicating with the scope and unlock its features using telnet protocol. You may find here on forum some users that can sell you that cheap card at that low price of less than 10 times the LAN card from Keysight, which is a reasonable price when you think what you can do with it. There are also technical files, diagrams and Gerber files in case you want to make by yourself that cheap card.
I do not know what telnet software others use, I think I have read somewhere PuTTY mentioned (http://www.putty.org/ (http://www.putty.org/) ), but here is a list with such free software:
https://sourceforge.net/directory/terminals/telnet/os:windows/ (https://sourceforge.net/directory/terminals/telnet/os:windows/)
I used in the past for different purpose and I liked it the RealTerm.
Besides the telnet software you need some other programs around, just in case, as WinCE CAB Manager, because the scope has Windows CE as operating system. You may still need a USB stick around.
WinCE CAB Manager was discontinued by the manufacturer (OCP Software) but you can still find it on internet.
Maybe some alternatives work too, but not tried yet:
https://msdn.microsoft.com/en-us/library/aa448616.aspx (https://msdn.microsoft.com/en-us/library/aa448616.aspx)
http://www.mobilepackager.com/ (http://www.mobilepackager.com/)
http://www.softpedia.com/get/Programming/Other-Programming-Files/Cab-O-Matic.shtml (http://www.softpedia.com/get/Programming/Other-Programming-Files/Cab-O-Matic.shtml)
http://www.hjgode.de/wp/2010/02/26/pocketpc-and-windowsce-essential-tools/ (http://www.hjgode.de/wp/2010/02/26/pocketpc-and-windowsce-essential-tools/)
A suggestion to help reading the forum: as it is now, you read on pages and sometimes the posts have links that makes you jump back and forth, but if you want a flat read with search within all the pages then you just go on Print at the bottom of the page and you “print” it as pdf file. Then you have the entire discussion on your PC for further readings as pdf and maybe it is even easier to follow and search, except the links which will point always online.
I did not try any hack up to now, but I ordered a cheap LAN card.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on March 09, 2017, 01:51:18 pm
I have tried several hours during several days to read this forum. It is not easy. It just make me the impression that I understood few things, but is not clear how shall I hack the scope to unlock all its features.

Depending on your usual hourly rate, might be cheaper just to buy the licences you want, but of course not as much fun :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 09, 2017, 01:55:04 pm
Frank, the guys from here do not want to buy the license, because is way too expensive and that's why they opened the thread, let's don't hide behind the finger and try to say the fun part, because is not, it makes you gray hair.
The fun part is that broken oscilloscope discussion above... for us, not for the owner.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on March 09, 2017, 04:15:57 pm
try to say the fun part, because is not, it makes you gray hair.

I guess I did look too much at ARM disassembly of C++ code of DLLs in IDA Pro, just look at my hair :-DD
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JPortici on March 09, 2017, 04:22:05 pm
Hi group,

Take a look at this eBay item 172559013145

http://www.ebay.ca/itm/KEYSIGHT-Infiniivision-MSOX3034T-Mixed-signal-Oscilloscope-350Mhz-MEGA-ZOOM-/172559013145?hash=item282d519519:g:GqYAAOSwhlZYuQIj (http://www.ebay.ca/itm/KEYSIGHT-Infiniivision-MSOX3034T-Mixed-signal-Oscilloscope-350Mhz-MEGA-ZOOM-/172559013145?hash=item282d519519:g:GqYAAOSwhlZYuQIj)


I have good reason to believe that it has been 'hacked'.

Regards,

Jay_Diddy_B

(It may have been an extreme teardown)



look out for the wave SUFFER http://www.ebay.ca/itm/LeCroy-waveSuffer-434-350Mhz-Oscilloscope-Not-working/112325885768 (http://www.ebay.ca/itm/LeCroy-waveSuffer-434-350Mhz-Oscilloscope-Not-working/112325885768)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on March 09, 2017, 04:48:36 pm
BTW, is there the source code for u-boot for the scopes somewhere? It is GPL code, so any modification (like how to access the flash, or interesting test commands) has to be made public with a description how to compile it (e.g. all configure settings), if someone asks nicely.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on March 09, 2017, 06:54:21 pm
BTW, is there the source code for u-boot for the scopes somewhere?
I have it, I think for the 2000/3000X series. No idea how I got it and it's 55MB so a bit hard to attach.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PioB on March 09, 2017, 07:18:00 pm
BTW, is there the source code for u-boot for the scopes somewhere?
I have it, I think for the 2000/3000X series. No idea how I got it and it's 55MB so a bit hard to attach.
Dropbox or Google drive and share the link, please?

Sent from my SM-N9005 using Tapatalk

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on March 09, 2017, 08:52:01 pm
Dropbox or Google drive and share the link, please?

Here: https://www.dropbox.com/s/9w565yk5jn1p0er/Uboot_Source_2.4.14526.11931.zip?dl=0 (https://www.dropbox.com/s/9w565yk5jn1p0er/Uboot_Source_2.4.14526.11931.zip?dl=0)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dr.Bar-Mental on March 10, 2017, 01:13:51 am
Hi guys, thank you for the such interesting topic.
I have learned a lot about my MSOX3024 scope and it convinced me to move forward with some improvements (you can call it hacks  ;) ) to this beautiful machine.
As I work primarily on switch mode power supplies and have PWR license already the rest of "bells and whistles" is not quite exiting for me but what I personally miss is a battery option which is not available for X3000 series.

Today I have teared my scope apart and found that the battery option can be relatively easily implemented with no modification to the original design (just addition of battery module connections). Proper battery module has to be built, of course, and it would be no software support but scope can be used on the field, cope with power outages and (what is practically important to me) can be isolated from Earth allowing you to do floating measurements on live equipment (if you are trained to do so, of course).

Does any one here tried it already?

And may be Daniel will explain why Keysight abandoned this option for X-series? It cost almost nothing (at least for electrical part) to implement that option to existing design.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on March 10, 2017, 02:31:13 am
Because you really should be using a (HV)differential probe instead of defeating the grounding of your scope?
But since your primary work is with SMPS I guess you know that :)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dr.Bar-Mental on March 10, 2017, 03:46:49 am
Sure I do.  :D

But due to Agilent decision to save some money on adjustable SmartProbe (tm) power supply for IfiniiVision models (it fixed to +/-5V), my beautiful HP1153A probe is collecting dust now...  >:(
At least till I finish this project - https://www.eevblog.com/forum/projects/agilent-probe-interface-(-autoprobe-and-probe-id)/ (https://www.eevblog.com/forum/projects/agilent-probe-interface-(-autoprobe-and-probe-id)/)

I know, N2804A is an alternative but check the price!

And sometimes I have to troubleshoot some mixed signal systems where ground plane is not connected to Earth/chassis and shouldn't be connected. Isolation transformer helps but leaves opportunity for pushing up noise floor.

I've used TPS series from Tektronix before (battery powered) but Agilent X3000 series with PWR option is much better choice in my opinion.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: laserK on March 11, 2017, 09:52:30 pm
Hi everybody,

I started looking into my 4024A with Firmware 4.07. I can confirm that the TX/RX pins for the debug serial are identical to the 3000A series. From comparing boot sequences of a 3014A (FW 2.35) with this rather new 4024A I found that the option to stop the u-boot with space is gone. Pressing space will always bring you to the CE loader (the next loader after uboot). Option "u)" in the CE loader is supposed to bring you back to u-boot but doesn't work (see log below). It tries a soft and a hard reset, both seem to fail. I tried pressing "u" and a lot of spaces. Didn't help either. The only interesting thing so far has been that loading the second image in the CE loader brings you to some hidden firmware recovery tool stating that the firmware is corrupted and needs to be reloaded. I guess it's a fallback solution in case the first option doesn't boot.
It asks for a .agx or .ksx file. It would be interesting if a downgrade is possible this way. Does anyone have an older fw (<4.07) version for the 4000 series that he/she could PM me?

Code: [Select]
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 256 MiB

Debug serial initialized ........OK
RTC: 2017-3-11   19:20:23.24 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008



P500 Boot Loader Configuration :

Mac address .......... (XX:XX:XX:XX:XX:XX)
Ip address ........... (192.168.1.175)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0400000)
        2 (0xd4400000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>Soft reset of CPU
Soft reset failed. Trying HW reset.
HW reset failed.

P500 Boot Loader Configuration :

Mac address .......... (XX:XX:XX:XX:XX:XX)
Ip address ........... (192.168.1.175)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0400000)
        2 (0xd4400000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on March 12, 2017, 12:49:12 am
BTW, is there the source code for u-boot for the scopes somewhere?
I have it, I think for the 2000/3000X series. No idea how I got it and it's 55MB so a bit hard to attach.

Thanks. Looks like you have it from here:

https://www.eevblog.com/forum/blog/new-agilent-scopes/msg43179/?topicseen#msg43179 (https://www.eevblog.com/forum/blog/new-agilent-scopes/msg43179/?topicseen#msg43179)

Interestingly there is a .git directory in it, too. It has a references to http://git.stlinux.com/spear/u-boot (http://git.stlinux.com/spear/u-boot) in the config file. Anyone tried to run Linux on it? This would be fun.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 15, 2017, 10:51:23 am
This is my 1st tutorial about how to unlock the DSO-X 2002A based on simple method provided by TopLoser page 49 of the forum on 28 Sept 2016:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/1200/ (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/1200/)
I hope every new user can follow it and in 15min can understand how to do it without the frustration of “read back few pages, it is on the forum”.

https://goo.gl/E57hPM (https://goo.gl/E57hPM)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 15, 2017, 02:20:52 pm
After I applied the TopLoser’s method from tutorial above and from link below:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1036134/#msg1036134 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1036134/#msg1036134)

I noticed the problem with IP garbage and very slow communication with the scope.
I have a series of questions that maybe someone is willing to answer if knows the answer:
1)   Are any other methods to unlock the firmware 2.41 beside TopLoser’s method and the following:

memset:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg989285/#msg989285 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg989285/#msg989285)

mischo22:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1001661/#msg1001661 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1001661/#msg1001661)

[IDC]Dragon:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1070250/#msg1070250 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1070250/#msg1070250)

If there are any other methods on the forum that I skipped by mistake, could you please point to them with a link as I did above?

2)   Using other methods (not TopLoser’s method), as one of the 3 mentioned above, would that help to solve the IP garbage and very slow communication with the scope using the LNA card?

It seems the method presented by “mischo22” solves the problem.
Did anyone else test it?
What about the other methods? Do they solve the IP/LAN problem?

3)   How to get rid of the Warning message with Unfinalized software and all that bla bla bla?

It seems, in the beginning were 2 answers to that:
Jrgandara:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg324104/#msg324104 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg324104/#msg324104)

elektrinis:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg410709/#msg410709 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg410709/#msg410709)

Does anyone else tried to get rid of those warning messages with the firmware 2.41?
How should that be changed? Patching “infiniiVisionCore.dll”?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on March 15, 2017, 04:48:15 pm
The lan solution suggested by mischo22 works great.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 15, 2017, 08:23:16 pm
I would like to test the method presented by mischo22.

I have 2 questions:
1) At next steps:
     “3. Copy the file \program files\infiniivision\infiniivisioncore.dll to the usb stick
     4. Patch the dll at position 0x027C0E8. Change the bytes from "04 00 a0 e1" to "00 00 a0 e3"
     ”
     Do I need a HEX editor to do that?
     If yes, which one did you use?

2) At next step.
     “8. Create a link file with the following content and install the link with the LinkInstallerCab”

     Where so I find LinkInstallerCab? Where can I find more info/procedure about how to install and uninstall/remove .lnk files with LinkInstallerCab?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on March 15, 2017, 08:35:42 pm
You can use any hex editor that will do the job.

I don't recommend the cab installer (had you read through all of the thread you'd know what it is) - just copy the file into place.

Do all of this carefully and only if you really need full LAN functionality - you don't want to brick the scope which can easily happen.

btw, I know there are many pages. It takes a long time to read through all of it - but then it should be worth it as you're getting features without paying for them.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 16, 2017, 07:36:02 am
I was afraid I will hear that advice of reading back pages again and again, instead of direct answer.
I was afraid because I have read and I still do it. In fact I downloaded all the pages as pdf and I read offline and I search through it.
But that does not help sometimes. Maybe I do not know the words or I cannot make the connection between them.
That’s why I decided to make tutorials, like the one above, easy accessible for everyone new, understandable in max 15-20min, easy to follow step by step with pictures and video.
And if I succeed to apply mischo22 solution, then I will do a tutorial also for that, for beginners, to avoid bricking the scope if it is followed step by step.
I know it takes time; it took me hours to prepare the 1st one above, but it’s worth it. It seems nobody wants to do it, but rather give the advice “go back and read”. I want to change that for future new readers: my time of few hours once with your previous sweat of probably more hours before.
I want to see only one place, one post with one or more tutorials, which can be easy followed without going to read some pages back. I am willing to do that. I just need some short answers to some of the questions which are not very clear for me now, but for sure I will understand with a bit of help from your side.
Is it possible to have direct answers without reading back advice and knowing that I am ready to prepare an easy to follow tutorial for everyone else?
Is anyone upset if I do that? Happy? Doesn’t care?

For example, reading through and searching for words, from beginning of the thread, I could not find any reference to the “LinkInstallerCab”.
Is the “LinkInstallerCab” the same as “WinCE CAB Manager” or any other cab manager as for example “MSCEInf - CAB Analyzer”?
The name “LinkInstallerCab” is found only in one place of the thread and forum. What other name do you use for it? Are any examples how to use it? I would like to know more about it, especially the suggested procedure to install and uninstall/remove .lnk files.

And I am very thankful that you told me that actually I do not need to use it and is enough to just copy the file into place. I will try to follow that.
Nevertheless, it would be good for me to understand what mischo22 intended to say when he mentioned “LinkInstallerCab”.
Any suggestion is appreciated.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 16, 2017, 11:50:24 am
I have made a short video with half of the steps suggested by mischo22:
https://goo.gl/co62DQ (https://goo.gl/co62DQ)

I did not change anything in my scope so far, until I understand everything what is happening.
I have a problem with step 8. from mischo22's method:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1001661/#msg1001661 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1001661/#msg1001661)
8. Create a link file with the following content and install the link with the LinkInstallerCab:
Code: [Select]
50#\windows\cmd.exe /c \Secure\startinfiniivision.cmd

My questions here are:
- Do I need to make the link file with the code above if I do not use the impossible to find LinkInstallerCab?
- If I make the link file with the code above, where do I place it? Again in the "\secure\"?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 16, 2017, 12:41:49 pm
It seems that “LinkInstallerCab” that I did not understand is in fact “linkinstall.cab” made by memset here:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg989285/#msg989285 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg989285/#msg989285)
At the end of his method is shown the place for the link file, similar with TopLoser method.
Therefore the link file with the following content:

Code: [Select]
50#\windows\cmd.exe /c \Secure\startinfiniivision.cmd
It should be placed in “\Secure\Startup\” and we do not need “LinkInstallerCab” for that. It is enough to copy it there with DOS commands using telnet.
Is that right?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 16, 2017, 01:41:16 pm
Yes, that is right.
The link file with the content:
Code: [Select]
50#\windows\cmd.exe /c \Secure\startinfiniivision.cmdmust be placed in “\Secure\Startup\” using simple copy command.

I successfully unlocked the scope using mischo22 method.
The LAN card works fine now, fast and showing the right IP address.
Before I started the unlocking procedure, I reverted back to locked state the already unlocked scope using TopLoser method. That was simple using telnet, just deleting “infiniivision.lnk” from “\secure\startup” and renaming the “infiniivision.xxx” to “infiniivision.lnk” using the dos command “ren infiniivision.xxx infiniivision.lnk ”. Then I restarted the scope and was like new from factory, without any licenses installed and without any warning messages. Then I started mischo22’s method and worked from 1st time if the steps were clear.
If I have time during the next days, I will make a tutorial with videos about it, step by step.

Because I started to play with that HEX editor when I patched the “infiniivisioncore.dll”, it seems the warning messages that we see are inside to that dll and in fact can be removed. Have a look at the screenshots below.

Has anyone tried to remove them?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 17, 2017, 10:20:05 am
This is my 2nd tutorial about how to unlock the DSO-X 2002A based on the method provided by mischo22  page 43 of the forum on 11 August 2016:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1001661/#msg1001661 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1001661/#msg1001661)

I hope every new user can follow it and in 15min can understand how to do it without the frustration of “read back few pages, it is on the forum” and without bricking (making unusable) the oscilloscope.
This method solves the problem of the oscilloscope IP slow communication and garbage info that we may get with other methods.

https://goo.gl/DNfZdv (https://goo.gl/DNfZdv)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 17, 2017, 11:40:43 am
Here are few more comments from my side.
-   I am sorry if for experienced users I spoiled all the fun when you are prepared to reply “read back few pages”. If there are free solutions, then let them be free and easy to follow and not free and twisted, jumping back and forth in the forum as a bunny or a grasshopper. Obviously the new user/reader must read otherwise is in trouble and cannot perform the unlocking properly. But the words “read back few pages” became a generic answer, a status quo. Just think logical: the energy and the number of words used for direct answer would be many times the same, but still people prefer “read back few pages, it is on the forum”; unbelievable.
-   Let’s don’t laugh by the new users who do not know or understand how to do it or if by mistake they made their scope unusable. I am really glad that I see how certain users helped others which were in trouble and then the solution was posted. It is hard to follow, because is not organized properly, but at least good hints are there.
-   I will not make any further tutorials.
-   The initial method found by “memset” using only the USB stick is definitely nice for 3000 series oscilloscopes. Later “[IDC]Dragon” improved that method by adding an easier install/uninstall procedure also for the 2000 series oscilloscopes. These methods do not require LAN card. It is enough a USB stick, a proper one that must be tested by each user individually, but some tested brands and types/sizes are listed on the forum. I do not like these methods for a single reason: if something goes wrong when you prepare the files, then you must have the LAN card and use Telnet to correct the files inside the oscilloscope. That does not mean these methods do not work. It just means you have to be careful. I like always a safe method, especially if I do this hack only once, for one oscilloscope in my case. Therefore I decided for LAN card, a cheaper one and the proposed methods “TopLoser” and “mischo22” worked fine for me from 1st time. In fact TopLoser method seems that does the same as “memset” and “[IDC]Dragon” methods, only that TopLoser requires the LAN card. It just seemed safer for me than initial USB stick only method proposed by “memset” and “[IDC]Dragon”. That’s why I decided for LAN card approach and I will not try the USB stick only method and no further video tutorials.
-   I consider, may be subjective, TopLoser’s method the most simple one and mischo22’s method the most satisfactory one.
-   For the new readers, when you will read about “link file” it means a file with the extension “.lnk”, which usually refers to “infiniivision.lnk” file that is placed in the folder “\secure\startup” inside the oscilloscope with firmware version 2.41. You need the oscilloscope LAN card and Telnet client to access it. When you make new files with the content and extension required by the proposed solution, you always start with New Text file and then you paste in the required text/commands and after you save, then you change the extension .txt with the required one and obviously the name of the file.
-   When I logged into oscilloscope with telnet, in my case, the first attempt gave me always error, even if I did not input any wrong characters. It always asked me 2 times, I do not know why and I do not care too much, but it was so.
-   The nag screen text with all the warnings can be removed. In fact I did it for my scope, but I will not explain here how for a single reason: I dislike the idea of hack-sell the scope and I do not want simple users which will follow step by step my video tutorials to make money out of this by selling the scope without any warning message looking as a new original scope. Who is a bit smart can figure it out alone. But even if the warning messages are removed, anyone, meaning also the Keysight engineers can find out easy if it is a hacked oscilloscope or one with proper licenses.  It is easy, jut log into the oscilloscope with telnet and check some files, that’s all. So in the end it does not matter too much if the warning message is there or not, I did it only for curiosity.

I received that DSO-X 2002A for free couple of years ago and did not use it, almost at all, maybe 1-2 times per year. Was sitting on the shelf besides other instruments and is less likely that I will use it in future, maybe the digital port will be interesting to be tested, but on the summer time. I do not really need this oscilloscope. I made the unlocking only by curiosity, as technical change.
I have a better scope that I use more often, it is a higher class, Rigol DS4034 (price is half compared with Keysight 3000 series) and has a huge advantage over the Keysight: it has a memory of 140 Million points.
When we unlock the 100K to 1M for DSO-X 2002A, it is a joke compared with Rigol 140M.
This huge memory is a very important feature when we need longer capture time with high sampling rate. I use that for non-repetitive signals.
I never understand these guys from Agilent and LeCroy and Tektronik and Yokogawa…why they do not implement higher memory cheap, why they ask so much for it as upgrade when the memory today became so cheap? It is not a logical reason behind. The same was LeCroy and their hard drives. I worked with LeCroy several years and they could not answer why they use low capacity drives in the past, most probably economical/stock reason. I mean low capacity hard drive when SSD were common with higher capacity on the market? Anyway, it does not matter; it is just a money game. Look at your hardware. It is sold with a certain price and with that price Keysight makes profit; otherwise they will not sell it. And you do not have all the options activated maybe for the rest of your life, because you do not need them for example, but the box is sold, it is in your hands. First of all you need to realize that the box without options activated is anyway far higher price compared with the price at the factory gate, higher than you can imagine. Adidas made sport shoes with 6$ and sold with more than 60$. A new car have the price drastically reduced after is out of the factory, is considered already 2nd hand. With what do you think is different a digital oscilloscope? with nothing. Then, if anyone has a moral problem about hacking the scope to unlock its options, should think twice at the money game and what a price means and how the price is set on the market when they trade. Box in the hand, sold, payed and they ask more money for it? Where is their moral side and why do they hide behind a trade system?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on March 17, 2017, 12:33:29 pm
I have great sympathy with your posting.

However, many of your analogies and comparisons just don't work like that. An oscilloscope does not wear out the same way a car does. A shoe is much less complex than a scope. On top of that think of the volume at which a shoe or a car is manufactured compared to a scope. Why are science books so much more expensive than steamy romance novels...? Because they can? Because they must?

Similarly to memory...if they were using the same memory modules other industries are using (e.g. computers) then perhaps it could work. However, the system design of measurement acquisition is very different from computers. Perhaps that could be changed I don't know. I just think that there may very well be a reason why things are designed the way they are. I'm sure Keysight could drop an 8 GB DDR4 module onto the pcb of a scope. But would it be fast? Would it be useful?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 17, 2017, 12:53:52 pm
Speaking about memory, how about 50% lower price and 7000% more memory when you compare Rigol 4000 series with Keysight 3000 series?
What magic memory uses Keysight compared with Rigol? And why Keysight should not use the same memory as Rigol?
Just go here and click “Compare Rigol”:
https://www.rigolna.com/products/digital-oscilloscopes/4000/ (https://www.rigolna.com/products/digital-oscilloscopes/4000/)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on March 17, 2017, 01:19:26 pm
May i give you a counteroffer: search for my "Project Yaigol" post on this forum. Perhaps it will give you a different angle of view on rigol crap.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on March 17, 2017, 01:23:26 pm
What do you want me to say? The Rigol specs sure look nice on paper.

Perhaps it has something to do with the performance (speed among others) of the Keysight compared to the 4k Rigol. I think to recall the Rigol is really terribly slow when you enable MSO or math functions or longer memory.

I also believe that has something to do with how the memory is accessed in the scope (which is in the ASIC of Keysight's).

What's the waveform update rate of the Rigol at that memory depth anyway? ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Someone on March 17, 2017, 11:39:07 pm
What do you want me to say? The Rigol specs sure look nice on paper.

Perhaps it has something to do with the performance (speed among others) of the Keysight compared to the 4k Rigol. I think to recall the Rigol is really terribly slow when you enable MSO or math functions or longer memory.
I've worked with the Rigol scopes a long time, it is still funny to see the 4000's stutter on the display (watch the traces they pause momentarily even in roll mode). We've had a flood of users all saying how deep memory is the essential feature and they want Mpts in their low end scopes but almost complete silence on what they want to use it for, specmanship is a sport in its own and the rest of us evaluate the produce for our uses and then get on with work.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: fanOfeeDIY on March 18, 2017, 04:36:19 am
Because I started to play with that HEX editor when I patched the “infiniivisioncore.dll”, it seems the warning messages that we see are inside to that dll and in fact can be removed. Have a look at the screenshots below.

Has anyone tried to remove them?

Yes, I have done it and booted successfully without the warning message.
I might post it here when I have time.

I lost my job few month ago and made me very busy and have not finished updating the oscilloscope chart,
so please be patient.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 20, 2017, 09:34:07 am
Do I smell here a Rigol-Agilent debate?
This is not my intention. I am not a Rigol advocate, even if I use one and I consider it good for my type of measurements.
You understood me wrong. I have said: Rigol D4034 is a higher class than Agilent DSO-X 2002A, which is true. And then my focus was on memory size compared with overall price of the instrument. It still makes no sense for me to put so small RAM memory in DSO today, when you look at the price of memory on the market and compare it with overall price of the instrument and particularly how much each DSO company asks for memory upgrade; it is ridiculous. Besides that, the price of the instrument is totally unreal.
I will answer to each of you individually, but only once, because I am not going to change this thread about Agilent in a Rigol analysis, even if deviation with jokes seems that are allowed as long as are about Agilent/Keisight…

@ Someone
Hello Someone, I am someone that can answer to your question:
Quote
“We've had a flood of users all saying how deep memory is the essential feature and they want Mpts in their low end scopes but almost complete silence on what they want to use it for”
I need it and I used it for non-repetitive asymmetrical “long” time signals/events. More or less a DAQ with high speed digitizers would definitely fit better to such analysis, but they were too expensive and I need it once in a while, maybe couple up to several times per year, so occasionally and for the rest of time a simple DSO is just fine. In a previous job I had in my hands for 2 weeks a Yokogawa DL850E scopecorder which was quite good for what I needed, but was around 25K €, quite expensive, but 16 channels with continuous recording at 100MSa/s was good. We were almost ready to buy it together with other instruments, but some things changed in the company and the project of improving the lab stopped and later I left that company. In fact I wanted initially to transform a high end PC into s signal recorder by adding high speed digitizers and dedicated software. A second option was to use frame for digitizers from National Instruments, but the price with software and setup time came close to a ready-made system as the one from Yokogawa.
 I will not provide here full details of the application(s), but I will provide below setup examples.

@Neganur
I never said that overall Rigol is a better instrument than Agilent at the same class/band width.
My point was strictly realted to the memory.
My scope is not MSO, so I cannot say if it is terrible slowly. At math functions is still all right for what I need and I do not use them often. For such situations I prefer to export the waveform and analyze it external on PC with dedicated software. In the past I have worked several years with Lecroy Waverunner 6030a oscilloscope and I did the same even if the math functions were there and complex and not slowly.
Quote
“I also believe that has something to do with how the memory is accessed in the scope”.
You may be right, but perhaps Bud can help us more here.
Quote
“What's the waveform update rate of the Rigol at that memory depth anyway?”
That is not fair and not a good comparison to decide over the acquisition of the signal. Here it is why.
When you click compare Rigol on the next link: https://www.rigolna.com/products/digital-oscilloscopes/4000/ (https://www.rigolna.com/products/digital-oscilloscopes/4000/) and you look at the >110K waveforms/s for Rigol (6.5K $) and then >1M waveforms/s for Agilent (11.7K $) then you conclude that is 9 times slower. How about Tektronix in the middle with the >280K waveforms/s (11.5K $)? Who is cheating here? Has Tektronix a slow memory, it is bad scope with high price? You cannot say that.
First of all, this parameter is not important for me at all.
Let’s picture it: you start the acquisition of the signal, lets’ say based on triggering event and not continuous roll mode: we suppose is continuous run and not on single. Then, when one screen is captured, or a segment of memory in case the memory is segmented, that signal is considered a waveform and then the next waveform is captured and we have many waveforms until the memory is full. This is more or less similar with frames in a video. What you show with the parameters above is the “frame rate” of the video, which I agree it may be very important in situations when in a repetitive signals comes once in a while a glitch, a noise, something abnormal and you want to detect it.  But this is not my case. This refers refresh rate of the waveforms, how fast are recorded and placed in memory the waveforms, but is not so important (at least not for me) as sampling rate for acquisition of one single waveform, especially when I set the oscilloscope on single acquisition mode. Just follow me few more sentences.
I do not know about your signals, but I work in the range 40Hz-100KHz with repetitive and non-repetitive signals, at which, sometimes/occasionally I detect signal event superimpose noise/pulses of max, 100MHz and even narrower pulses. The problem is that I need to see if these non-repetitive abnormalities of high frequency are maintained for longer period of time.
Here is the example: the time base is 10ms; Agilent DSO-X 2002A can have the sampling rate of 5Msa/s on normal run and 10Msa/s on single; Rigol can have 1Gsa/s sampling rate at 10ms time base.
The point is that there is a direct relation between sampling rate, the time base and the length of the memory of the scope.
As you go to longer time base settings, the sampling rate goes down from 2Gas/ or 4Ga/s to very low values only because there is not enough memory to store the sample.
How stupid is that when the memory is not so expensive today?
I know what you will say as the 1st thought, because I have heard it several times up to now: with the proper triggering setting, you can reduce the time base, increase the sampling rate and you will capture that event, which is true, because I have done that, but that does not show you how long time the non-repetitive abnormalities are maintained. It gives you only info about the signal/pulses in terms of peak, width and when are superimposed over the normal signal, like you know the volts or amperes with whatever values you need, but does not tell you how long time, because you cannot capture long time. And time means energy, which is an important parameter to evaluate how certain device behave or fail.
As you see, I need it on single, long time base, high sampling rate – from here deep memory, more or less as DAQ. For me this is an important feature for a DSO and just few months ago I had a debate over failures of certain devices from which we won 15K € compensations. They used this Agilent DSO-X 2002A and another LeCroy low end, low memory and I used Rigol. The 3rd party, manufacturer of the semiconductor used in the devices voted on our side as customer of the device with a written paper. Of course, the manufacturer of the device detected the abnormalities, not with Agilent, but with LeCroy in their R&D lab, but could not say too much about energy, duration of the pulses.
I am not saying a moment that Rigol is a better instrument than Agilent or LeCroy when we speak about overall design of the instrument and the components used inside, but deep memory is very good many times ( at least in my case) and should be implemented cheap.


@ Bud
I am really impressed about your work and your findings. I have only bravo and applause. It is a Master work.
https://www.eevblog.com/forum/projects/project-yaigol-fixing-rigol-scope-design-problems/ (https://www.eevblog.com/forum/projects/project-yaigol-fixing-rigol-scope-design-problems/)

Since I have read your discoveries I have a nail in my stomach and thoughts flies trough my head: is my scope also with open PLL? How can rely on any signal acquisition/measurement? How bad is it?...

That is an R&D “crime”, “suicide” and should be addressed adequately with a market recall as Toyota did with their cars few years ago.
I bought our Rigol online few years ago from next website: http://www.batronix.com/shop/oscilloscopes/Rigol-DS4034.html (http://www.batronix.com/shop/oscilloscopes/Rigol-DS4034.html)

My panic increased when I have seen these days next offer:
Quote

Bandwidth upgrade for free!
Bandwidth upgrade for Rigol DS/MSO403X from 350 MHz up to 500 MHz, with a total value of € 2487.10 (incl. VAT)

All Options for free!
Get all options with a total value of € 3429,58 (incl. VAT) for free with the purchase of a new device. Offer valid until June 30th, 2017!

Suddenly came into my mind: do Rigol and/or distributors know about your PLL discovery and they try to get rid of the existing oscilloscope stock or is just because they found out that Rigol Option Key Codes are published free on different websites, including on this forum and nobody buys them anymore?

After adrenaline came to normal levels, my mind started asking questions, which I realize are for you:
1) You mentioned DS1000 was initially fund with problems and later based on your analysis DS2000, particularly DS2072A.
Do you know if DS4000, particularly DS4034 has the same PLL, the ADC clock and power supplies/regulator problems?

2) Can you publish the serial number of your DS2072A oscilloscope and maybe the manufacture date?
3) Did you try to speak/inform Rigol about your findings? If yes, did you get any answer?
4) How do we know if the problems are not related only with a certain oscilloscope series or production series/batch or maybe they have been just corrected in mean time?
I would like to know that and I would like to know if Rigol have made any official statement or they try to cover up everything.
I would like to contact them.
5) Could you tell us what RAM memory is inside to DS2072A?

Does anyone else found similar critical problems with their Rigol?
If yes, could you provide the model and serial number?
I almost forgot, we are on Agilent discussion, but I was caught by the fever of PLL open loop.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on March 20, 2017, 10:03:10 am
Do I smell here a Rigol-Agilent debate?

Ah come on, you brought up the comparison to the Rigol yourself. Asking what "magic memory" the Keysight uses that makes it so expensive.

The memory is inside an ASIC vs. something slower on the Rigol. I thought you had understood that by now, but apparently not since you ask the same question again.

Maybe this helps: http://cp.literature.agilent.com/litweb/pdf/5991-1024EN.pdf (http://cp.literature.agilent.com/litweb/pdf/5991-1024EN.pdf)

I'm not interested in a pissing contest between scope brands either, sorry if the comments I threw in weren't actually spelling out what I meant: The Rigol is slow and sluggish due to many reasons, memory architecture being one of them. Consequently, the Rigol has a lower update rate with deep memory enabled. That's it.

Neither was my intention to say 1M wfm/s is the most important thing nor the best metric to measure scopes. But a consequence of the memory (and price) differences is due to this different design. (and really has nothing to do with it being fair or not)

 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 20, 2017, 11:55:37 am
I am glad that you pointed to the pdf file above.
On the page 2, table from right side, bottom of the table. Think of one single waveform acquisition, scope set on single, time base 20ms, Agilent has only 2MS/s sampling rate at 4Mpts memory, while Rigol has 500MS/s sampling rate at 140Mpts memory.
Between samplings the ADC is blind and the points are shown only with interpolation.
Why is then the Rigol memory slow?
It is good enough.
The only problem is at waveforms/s, which is not important for me.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on March 20, 2017, 01:14:24 pm
The only problem is at waveforms/s, which is not important for me.

Depends on your application for which you use the scope, but with higher waveform per second update rates you can see glitches which are not visible with other scopes. I think Dave compared a Rigol with a Agilent scope and demonstrated this feature, I tested it too on my Agilent:

https://www.youtube.com/watch?v=qxmpRoAkfMY (https://www.youtube.com/watch?v=qxmpRoAkfMY)

Even if you don't need it and you measure something different, it is very useful if your scope can show you such glitches, and you can see it by accident before it gets a problem for a customer of your product. If you know what you are searching, you don't need it, as I demonstrated at the end of the video, you can just trigger on pulse width etc.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: hs3 on March 20, 2017, 02:01:45 pm
Since I have read your discoveries I have a nail in my stomach and thoughts flies trough my head: is my scope also with open PLL? How can rely on any signal acquisition/measurement? How bad is it?...
I haven't read the PLL thread in a long time but if I remember correctly it seemed that there were issues due to unstable voltage regulator which was because in some manufacturing batches an incorrect "equivalent" substitute part had been used. And that only some were affected by the issue and most didn't experience it.

There are some forum users who like to often post that link but choose to not mention the above. If I remember it wrong I'm happy to take these words back.

Neither was my intention to say 1M wfm/s is the most important thing nor the best metric to measure scopes. But a consequence of the memory (and price) differences is due to this different design. (and really has nothing to do with it being fair or not)
This mention about architecture, memory and price made me think. Would it be completely wrong to say that the Keysight Megazoom ASIC based scopes might actually be cheaper to manufacture than the Rigol DS4000 series scopes that use 5 pieces of expensive Xilinx Virtex 5 XC5VLX30-1FFG676C parts to implement similar functionality that in the Keysight scope is handled by their own ASIC?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on March 20, 2017, 03:15:31 pm
Even if you don't need it and you measure something different, it is very useful if your scope can show you such glitches, and you can see it by accident before it gets a problem for a customer of your product.

While that is true, and just like memory depth, it's very application dependent, as well as being a bit of an arms race.

The difference between 100kWfm/s and 1MWfm/s is nice to have, but realistically how often are you going to be the situation where you have a glitch that benefits from this? How about 10MWfm/s? 100MWfm/s?

The same applies to deep memory, how much you need is roughly as long as a piece of string, and largely adheres to the law of diminishing returns.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on March 20, 2017, 03:46:41 pm
@viki2000,  as DSOX2000 owner have you tried --perf option mentioned in post below:

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1099382/#msg1099382 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1099382/#msg1099382)

Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 20, 2017, 06:40:08 pm
@ FrankBuss
I understand that and I agree.
You show me repeated signals with superimposed noise, which is not always my case.
My case is with the non-repetitive asymmetrical signals during normal operation mode, which happens/repeat only under certain conditions, for example during startup of a device.
Each system, electrical or mechanical, has during startup time a strange behavior before stabilization state is achieved.  I am looking many times at the startup process and for that a DSO with deep memory and high sampling rate for long time base is helpful, more like a DAQ, digitizer. From here my initial question about why not the long cheap memory is not installed by default in many DSO. I understand the trick done by Keysight with segmented memory, but is still not what I expect.
I heard all the time up to now all kind of explanations why you do not need deep memory and how other functions can complement that.

Why there is so low memory with only several million of points in today’s DSO when the DDRAM todays is so cheap for tenths of GB? But how much can really cost few GB of RAM for these DSO? What is so special about them? What is the price of existing RAM memory chips in Agilent and/or Rigol or other known oscilloscopes? What is their type, model, brand? Why they ask so much money for memory upgrade?

@ georgd
No, I have not tried “--perf” option. I have read about it, but was not essential at the moment of my unlocking trials.
I will try it and I will let you know.
Actually I want to reopen a discussion and clarify also for new readers the content of the link file.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on March 20, 2017, 07:01:18 pm
I give up!

Quote
What is the price of existing RAM memory chips in Agilent


The acquisition RAM is inside the ASIC for the InfiniiVision series.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 20, 2017, 07:14:11 pm
That is good to know and explains why is low memory and high price.
If the architecture/design would be with external RAM blocks/slots then it could be lots of high speed RAM with cheaper price, but then who would make money out of RAM upgrade?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on March 20, 2017, 07:34:02 pm
@ Bud
I am really impressed about your work and your findings. I have only bravo and applause. It is a Master work.
https://www.eevblog.com/forum/projects/project-yaigol-fixing-rigol-scope-design-problems/ (https://www.eevblog.com/forum/projects/project-yaigol-fixing-rigol-scope-design-problems/)

Since I have read your discoveries I have a nail in my stomach and thoughts flies trough my head: is my scope also with open PLL? How can rely on any signal acquisition/measurement? How bad is it?...
One method used to determine PLL stability during the Rigol thing was to capture a maximum length record from a known stable source such as a crystal oscillator, and then examine the FFT on an external computer.

Unlocked PLLs and other instabilities would be quite obvious, but whether the user actually notices it depends on: 1) what they are trying to measure and, 2) the severity of the instability.  (But it's still no excuse for poor PLL design.)

You could check your scope using this method if you are concerned.  It is discussed in the longer thread referenced in the first post of the Yaigol thread if you need more detail.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Keysight DanielBogdanoff on March 20, 2017, 08:17:15 pm
Trust me, if we could feasibly put a memory controller on that ASIC and have a deeper acquisition we'd do it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Someone on March 20, 2017, 10:11:43 pm
Quote from: Someone
“We've had a flood of users all saying how deep memory is the essential feature and they want Mpts in their low end scopes but almost complete silence on what they want to use it for”
I need it and I used it for non-repetitive asymmetrical “long” time signals/events. More or less a DAQ with high speed digitizers would definitely fit better to such analysis, but they were too expensive and I need it once in a while, maybe couple up to several times per year, so occasionally and for the rest of time a simple DSO is just fine. In a previous job I had in my hands for 2 weeks a Yokogawa DL850E scopecorder which was quite good for what I needed, but was around 25K €, quite expensive, but 16 channels with continuous recording at 100MSa/s was good. We were almost ready to buy it together with other instruments, but some things changed in the company and the project of improving the lab stopped and later I left that company. In fact I wanted initially to transform a high end PC into s signal recorder by adding high speed digitizers and dedicated software. A second option was to use frame for digitizers from National Instruments, but the price with software and setup time came close to a ready-made system as the one from Yokogawa.
 I will not provide here full details of the application(s), but I will provide below setup examples.
You do need to be very specific, as there are ways to trigger on most problems with sufficient memory around the trigger to get context.
but I work in the range 40Hz-100KHz with repetitive and non-repetitive signals, at which, sometimes/occasionally I detect signal event superimpose noise/pulses of max, 100MHz and even narrower pulses. The problem is that I need to see if these non-repetitive abnormalities of high frequency are maintained for longer period of time.
Filters and acquisition modes should be able to extract the information without needing to store all the high frequency information if that high frequency information is no useful.

Between samplings the ADC is blind and the points are shown only with interpolation.
It depends which acquisition mode you are in, very few requests I've seen for deep memory couldn't be solved with peak detect or envelope mode. There are applications for deep memory where you are needing to extract the high frequency information but it tends to be limited to RF/telco uses.

Why is then the Rigol memory slow?
It is good enough.
The only problem is at waveforms/s, which is not important for me.
Great, then its probably a good scope for you. Rent/borrow/evaluate (don't buy yet) one and share your thoughts about it with us. Or try one of the PC based scopes, at these lower sample rates they can often stream direct to the PC for practically infinite memory depths.

And then my focus was on memory size compared with overall price of the instrument. It still makes no sense for me to put so small RAM memory in DSO today, when you look at the price of memory on the market and compare it with overall price of the instrument and particularly how much each DSO company asks for memory upgrade; it is ridiculous.
Memory is not cheap compared to the cost of the product, and just the memory alone is not the limiting factor. There is a long thread recently on this hence my dismay you bring it up again so quickly:
https://www.eevblog.com/forum/testgear/oscilliscope-memory-type-and-why-so-small/?all (https://www.eevblog.com/forum/testgear/oscilliscope-memory-type-and-why-so-small/?all)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on March 20, 2017, 11:07:14 pm
My case is with the non-repetitive asymmetrical signals during normal operation mode, which happens/repeat only under certain conditions, for example during startup of a device.

I've used one of the bigger scopes at a clients site, don't remember the model, but it was one of these scopes that costs as much as a house, is as loud as a lawnmower because of all the fans, but you can record seconds of a signal and zoom into it endlessly, perfect for analyzing startup sequences. But you can do this with less memory, too, if you set the right trigger points, trigger delay, output some debug signals etc., you just need longer for it. But I don't know a workaround if your scope doesn't have the millions of waveforms per second update, you simply don't see as much of what is going on.

My first digital scope was a TDS1002 and I thought it was a nice scope after I sold my analog Hameg scope. But when I bought my DSO-X 3012A it was like magic :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on March 21, 2017, 08:55:27 am
@georgd
I have tried the „--perf“
It adds 3 more functions in math menu and several more in trigger menu.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Luminax on March 24, 2017, 12:46:26 am
Hmm.... I saw Dave's 1000x hacking video and I wonder... Mine's a DSOX2014A with Firmware 'hack' for firmware version 02.41.
Interestingly... I could've sworn I patched it for 200 MHz B/W or something but it's showing 70MHz and I don't have a capable frequency gen to check it out, but I do notice the horizontal scale goes down to 5 ns so mayhaps...

Anyway, I'm wondering if there's any other capabilities that I can explore without making some major modifications to the board or even if I should open this thing at all, hmm... granted a few bodge wires and some resistor divider swap isn't going to likely cause any major fault or anything, hmmmmm....  :scared:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on March 24, 2017, 12:49:14 am
If it is showing 70 MHz then it likely is, the model # won't change with a hack but the usable bandwidth will be reported correctly in the system info screen. You probably need to check what options you've used with the hack.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Luminax on March 24, 2017, 01:29:42 am
A-ha! I don't know how that BW100 options got there... should've been BW20  :palm:
Did someone document all the switches somewhere? I remember there's a post somewhere in this thread... time to go digging!  :scared:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on March 25, 2017, 10:57:54 pm
I am still working on the 1 GHz mod. I am confident we have all of the info needed to do it except for some capacitor values. If someone with a 1 GHz 3000A or 3000T scope can remove and measure some caps I am prepared to offer a reward :)

I have also been playing with LTspice to simulate the balanced front end low pass filter - I could probably approximate some of the values but that likely isn't as ideal as having the proper ones.

edit - it appears the extra capacitor and resistors in the 1 GHz model balanced filter add a gain hump after 500 MHz - possibly to compensate for non-linearities in the rest of the circuit.

Attached some LTspice samples - this is the first time I have used it. I am assuming they use a 50 ohm input to the Megazoom ASIC. The circuit has been redrawn as two single ended filters. I am quite sure the inductor values are 6.8nH, and we know the resistor values. I basically halved the capacitor values from the 500 MHz model in the first simulation and then added the extra resistors(R7.R8) and capacitors(C5,C6) used only in the 1 GHz model in the second simulation. I experimented with the values and settled on 1 pF for C5/C6 which gives a flatter response. I'd like to think I'm in the ballpark but could also be dreaming.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on March 27, 2017, 09:38:34 pm
:TheSteve is doing an excellent job on trying to do this reverse engineering job. Reverse engineering the entire front-end is quite a task and can be easily bypassed by having the required caps measured.

The result is not very far.  There is surely an incentive from Steve and I may also come with something along that.

We just need those caps measured. If anyone is able to do that on a 3104A or 3104T scope please help to do this mod.

As :TheSteve explained keep in mind that it's also possible to have a mod which would raise the bandwidth to 1.5 Ghz, so not just those with lower end scopes can benefit.
Title: Are the hacks still live?
Post by: Thermodynamics on April 05, 2017, 11:24:42 pm
Hi,
I am considering a new x2002, but only if the hacks are still live. Otherwise it's the rigol..... can someone confirm the hacks are still golden with the latest firmware on that unit?
Title: Re: Are the hacks still live?
Post by: mikeselectricstuff on April 05, 2017, 11:26:07 pm
Hi,
I am considering a new x2002, but only if the hacks are still live. Otherwise it's the rigol..... can someone confirm the hacks are still golden with the latest firmware on that unit?
I saw on another thread that there is new 2000/3000 FW just out today.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dubbie on April 06, 2017, 01:56:02 am
Mike, Is that just for the A version? Not the T?

I can't find any new firmware for the 3000T anywhere.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on April 06, 2017, 06:52:35 am
The hacks have been confirmed up to now with firmware 2.41.
It seems now the firmware 2.42 has been released:
http://www.keysight.com/main/software.jspx?cc=DE&lc=ger&ckey=2014479&nid=-32976.973676&id=2014479 (http://www.keysight.com/main/software.jspx?cc=DE&lc=ger&ckey=2014479&nid=-32976.973676&id=2014479)
http://www.keysight.com/main/software.jspx?cc=DE&lc=ger&ckey=2014548&nid=-32976.970765.02&id=2014548 (http://www.keysight.com/main/software.jspx?cc=DE&lc=ger&ckey=2014548&nid=-32976.970765.02&id=2014548)
Here you may see the differences between 2.42 and the previous versions:
http://www.keysight.com/upload/cmc_upload/All/Keysight_2000A_3000A_X_Series_Oscilloscope_Release_Notes_02_42.pdf (http://www.keysight.com/upload/cmc_upload/All/Keysight_2000A_3000A_X_Series_Oscilloscope_Release_Notes_02_42.pdf)

The 3000-T version firmware:
http://www.keysight.com/main/software.jspx?ckey=2573488&lc=ger&cc=DE&nid=-32541.1150442&id=2573488 (http://www.keysight.com/main/software.jspx?ckey=2573488&lc=ger&cc=DE&nid=-32541.1150442&id=2573488)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: azer on April 06, 2017, 01:50:06 pm
I notice the firmware files for the X series are also "ksx" files now, though they are not encrypted so you can rename to zip.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on April 06, 2017, 04:05:03 pm
I notice the firmware files for the X series are also "ksx" files now, though they are not encrypted so you can rename to zip.
In the Release Notes it says to rename to .cab for scopes with firmware older than 2.41
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: m00wn on April 06, 2017, 06:42:51 pm
Just in case: I have a couple of original license files for my 3000T series scope, if someone is interested/capable in reverse engineering.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: januszb on April 07, 2017, 01:16:56 pm
Does anyone have the 2000X 2.41 firmware cab to hand?  It has been pulled off the Keysight website since 2.42 has been put up and I unfortunately didn't keep a copy...  :(  Would be most grateful if anyone could share!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on April 07, 2017, 03:39:31 pm
Firmware 2.41 for DSO-X 2000 series:
https://goo.gl/gj3NJ7
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tridentsx on April 08, 2017, 04:43:36 am

Has anyone tested the hack with 2.42 f/w version ? I just got a DSO-X 2012A from Frys for a low cost. Would like to enhance its capabilities.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on April 08, 2017, 09:55:18 am
I updated my scope to the 2.42 Firmware this week, because they now allow a probe attenuation down to 0.001 which is quite useful.

Telnet Login an the "\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO -l memMax -l MEMUP -l ADVMATH -l SGM -l SGMC -l AUTO -l COMP -l TOM -l EMBD -l VID -l COMP -l SCPIPS -l WAVEGEN -l MASK -l BW20" Hack still works on my scope.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on April 08, 2017, 10:31:50 am
Oh finally a lower multiplier, useful for items like amplifiers (think uCurrent). I still wish it would be arbitrary for odd divisions.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on April 08, 2017, 01:08:58 pm
Oh finally a lower multiplier, useful for items like amplifiers (think uCurrent). I still wish it would be arbitrary for odd divisions.
I think the range still needs to be larger in both directions.  0.001 seems arbitrary since all the scope is doing is helping with the math.  A Tek AM502 amplifier, for example, ranges up to x100k and would need 0.00001.

If it helps, non-decade values can be entered by switching the Probe Ratio units to Decibels and adjusting the dB.  You can probably get close to the ratio you want, and it nicely displays the ratio as you change the dB.

You can also enter an exact number via the SCPI command:

  CHANnel<n>:PROBe <ratio>

but the ratio is still limited to 0.001 - 10000.


In the same vein as an arbitrary ratio from the front panel, I've been asking for an error offset adjustment.  An error offset would be almost the same as the regular offset but it would not be included in the display offset, measurements, or math calculations.  It's primary use would be to zero out small offset errors at the input, such as from external active probes.

The uCurrent is a good example of where this would be used.  You could zero out any drift or offset right before you take a measurement.  Another use of this is to zero out short-term front end errors before making a particularly sensitive measurement, without having to sit through a full self-cal.

In general, a way to adjust the slope and intercept of inputs before any processing has been on my request list for a long time.  It's not rocket science for any DSO/MSO manufacturer.  I don't know why it's not standard.

EDIT: That last statement was a little ambiguous.  What I'm saying is that I think there needs to be a way to define: 1) an arbitrary input multiplication factor and, 2) what input voltage level that scope should use as zero.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on April 10, 2017, 11:24:30 am
I updated my scope to the 2.42 Firmware this week, because they now allow a probe attenuation down to 0.001 which is quite useful.

Telnet Login an the "\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO -l memMax -l MEMUP -l ADVMATH -l SGM -l SGMC -l AUTO -l COMP -l TOM -l EMBD -l VID -l COMP -l SCPIPS -l WAVEGEN -l MASK -l BW20" Hack still works on my scope.

But you still needing to alter the hex info on dll file, or just add these options on the command line?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on April 10, 2017, 08:16:13 pm
I updated my scope to the 2.42 Firmware this week, because they now allow a probe attenuation down to 0.001 which is quite useful.

Telnet Login an the "\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO -l memMax -l MEMUP -l ADVMATH -l SGM -l SGMC -l AUTO -l COMP -l TOM -l EMBD -l VID -l COMP -l SCPIPS -l WAVEGEN -l MASK -l BW20" Hack still works on my scope.

But you still needing to alter the hex info on dll file, or just add these options on the command line?

For the basic hack just add the options at the command line.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on April 10, 2017, 08:34:42 pm
I've missed that info somewhere.

I thought it was necessary to change the dll file on every case.

Will try it this week.  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on April 10, 2017, 08:42:57 pm
Won't work on T series though
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on April 10, 2017, 11:56:19 pm
Won't work on T series though
Mine is an A model (I have an 2002A and a 3014A), but the 3014 have the bundle... And I've been using the 2002A just a little, but this weekend It showed when booting, that the firmware has some kind of problem.... Maybe I finally will discover how is the warranties service around here...

(PS: it was not changed firmware, I occasionally boot with a usb stick, so this problem is not correlated)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on April 11, 2017, 12:49:08 am
Won't work on T series though
Mine is an A model (I have an 2002A and a 3014A), but the 3014 have the bundle... And I've been using the 2002A just a little, but this weekend It showed when booting, that the firmware has some kind of problem.... Maybe I finally will discover how is the warranties service around here...

(PS: it was not changed firmware, I occasionally boot with a usb stick, so this problem is not correlated)

Well if you're booting with a USB drive that means you have older firmware(probably 2.35). Staying with the older firmware increases the odds of having a flash problem. I believe it is firmware 2.40 and newer that helps prevent/recover from the flash corruption issue so hack or not I recommend updating all scopes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dotto on April 11, 2017, 01:53:53 am
I have a DSOX3024A and I'm looking for links to download firmware v2.35 from DSOX3000 series but most of them don't work.... Anybody  has a valid link to download old firmware (2.35) from DSOX3000 series?? On the website from Keysight the current version is 2.42... Could I do downgrade from 2.42 to 2.35 and hack the firmware like 2.37, 2.38 and 2.39 version? Does it works?
Sorry for my English...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kada on April 12, 2017, 03:13:30 am
Untouched firmwares:
2.35 (https://drive.google.com/file/d/0BzPC3Qe5sA9tX29aVEx6VTFpMFU/view?usp=sharing&resourcekey=0-fGSqKFsY3MEJXvlODnaGzQ)
2.37 (https://drive.google.com/file/d/0BzPC3Qe5sA9tTHg1UlJzd3pCTm8/view?usp=sharing&resourcekey=0-l6iziDpRjNPcYYEsaiAKZQ)
2.39 (https://drive.google.com/file/d/0BzPC3Qe5sA9tNEVjVUt3ZExFcFU/view?usp=sharing&resourcekey=0-vqkbJIPNpaeRjSCFZCbj_A)
2.41 (https://drive.google.com/file/d/0BzPC3Qe5sA9tQURuM2k3S0Vrc3c/view?usp=sharing&resourcekey=0-EpjhSotppL7pyUqstd5usQ)
2.42 (https://drive.google.com/file/d/0BzPC3Qe5sA9tUHA0a3VIdzc4VTQ/view?usp=sharing&resourcekey=0-gOw2wKLSErhb8HMjG7b-tg)
2.43 (https://drive.google.com/file/d/1Hvry6tEI9LlEueveD6agtO1QxA-hBKl1/view?usp=sharing)
2.50 (https://drive.google.com/file/d/1RP67aM20Z9_dXESJqMpS-yyyDr-6yrFn/view?usp=sharing)
2.65 (https://drive.google.com/file/d/13ZEWKXzSN3rEwhmAwtu-AumhERJEeroE/view?usp=sharing)
DSO3000-Update-Ver-04-02-15 (https://drive.google.com/file/d/1ZRsXcOzIqJ5UaVGa5S1G0mTGjCVG4LKQ/view?usp=sharing)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Luminax on April 12, 2017, 07:13:19 am
I'm on 2.41 with 'hacked' firmware, meaning I have MSOX capabilities, and the lots (EMBD, AUTO, COMP, SGM, MASK etc etc).
Curious as to what's considered 'hacked' since I was just using someone's shortcut loader with modified startup parameter...
Haven't been reading this thread in a while, anyone keeping tracks of all the goodies?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ogoun on April 12, 2017, 09:03:39 am
Now if only someone would do that for the 4000 series :)

Untouched firmwares:
2.35 (https://drive.google.com/file/d/0BzPC3Qe5sA9tX29aVEx6VTFpMFU/view?usp=drivesdk)
2.37 (https://drive.google.com/file/d/0BzPC3Qe5sA9tTHg1UlJzd3pCTm8/view?usp=drivesdk)
2.39 (https://drive.google.com/file/d/0BzPC3Qe5sA9tNEVjVUt3ZExFcFU/view?usp=drivesdk)
2.41 (https://drive.google.com/file/d/0BzPC3Qe5sA9tQURuM2k3S0Vrc3c/view?usp=drivesdk)
2.42 (https://drive.google.com/file/d/0BzPC3Qe5sA9tUHA0a3VIdzc4VTQ/view?usp=drivesdk)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sany1984 on April 12, 2017, 08:15:52 pm
Hello Volks,

I want to use the USB Method with the USB.zip with my EDUX1002A.
My Problem is ( USB Stick 4 GB) when the Osci is Starting up with Stick, he hangs up:

Code: [Select]
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2024-17-4   5:84:14.2 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

PHY not found.

System ready!
Preparing for download...
RTC: 2024-17-4   5:84:14.2 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOXXOOOOXOOXXOOOXOOOOXOXOOOOOXOOOXOOXOXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXX
OOOXOOXOOOOXOOOOXOOXXOOXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXXOOXOOXOXOOOXOOOXOOXXOXOXOOOXOXXXXXOXOXXXOXXXXOXOXXOOOXXXXOXXXXOXXXXXXXOXXXXXXOXXOXXOXXOOXXOXXXOXXXXOOOXXX
OOOXXXOXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXXOOOXOXOOXOOXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1A80C40, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1A80C40  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2024-17-4   5:84:14.5 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Sep 28 2016)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
LAN PHY NOT detected.
DeleteP500EnetRegistry:
   \Comm\GMAC 0x0
   \Comm\GMAC1 0x0
   \Comm\Tcpip\Linkage 0x0
   \Drivers\Virtual 0x0
   \Drivers\BuiltIn\LIN 0x5
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Device load time:
   NANDFLASH: 0 ms
   SNANDFLASH: 0 ms
   USB Hard Disk Drive: 0 ms

i wait for 60 seconds, and the device is rebooting again....
my cmd file:

Code: [Select]
dir \ > \usb\root.txt

can any one help me?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on April 12, 2017, 08:44:03 pm
I am not sure if current EDUX firmware supports booting from USB
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Luminax on April 13, 2017, 07:51:57 am
Does the 2000-X method of Firmware overload not working on EDUX1002A? hmmm...
My method, courtesy of someone whose name I can't remember right now from quite some post back, is to copy :

v241_link_install.cab
v241_link_uninstall.cab
infiniivision.lnk

to my USB drive after modifying infiniivision.lnk to suit my purpose.
On the scope after it loads, I go to Utility->File Explorer and browse to the USB stick then load the install cab.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on April 13, 2017, 01:39:05 pm
Does the 2000-X method of Firmware overload not working on EDUX1002A? hmmm...
My method, courtesy of someone whose name I can't remember right now from quite some post back, is to copy :

v241_link_install.cab
v241_link_uninstall.cab
infiniivision.lnk

to my USB drive after modifying infiniivision.lnk to suit my purpose.
On the scope after it loads, I go to Utility->File Explorer and browse to the USB stick then load the install cab.
This method can brick the scope if it does not like the content of infiniivision.lnk and it has no LAN port to bring it back to life.  Has anyone tried it?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sany1984 on April 13, 2017, 03:26:56 pm
Hello,

The EDUX1002A has the Same Firmware as the DSOX1102A/DSOX1102G...

Daves Firmware has the Version 01.01.2016092800, with Licenses: All, EMBD*, AUTO*,SGM,MASK,BW10,EDK,WAVEGEN,DiS*,DVM*,RML.

My EDUX1002A has the Same Firmware: 01.01.2016092800 with Licenses: EDK, RML.
The Mainboard and BT Module is originally the Same...
And the Boot Procedure is only the Same, with the DSOX, only the Product Configuration is different, and the installed licenses....
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on April 13, 2017, 07:31:55 pm
The Mainboard and BT Module is originally the Same...
The EDUX and DSOX mainboards are different (same PCB, but different/missing/additional components)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on April 13, 2017, 08:50:09 pm
Hello,

The EDUX1002A has the Same Firmware as the DSOX1102A/DSOX1102G...

Daves Firmware has the Version 01.01.2016092800, with Licenses: All, EMBD*, AUTO*,SGM,MASK,BW10,EDK,WAVEGEN,DiS*,DVM*,RML.

My EDUX1002A has the Same Firmware: 01.01.2016092800 with Licenses: EDK, RML.
The Mainboard and BT Module is originally the Same...
And the Boot Procedure is only the Same, with the DSOX, only the Product Configuration is different, and the installed licenses....
I suggest moving this discussion about 1000X series here: https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/ (https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bitbanger on April 16, 2017, 01:06:08 pm
Anyone in need of a DSOXLAN module? I spun off some PCBs but no need for the extra two (and only two) from the min 3 order. Fully assembled/tested/with mounting hardware. PM if interested.

Thank you to all the contributors - 2.41 via telnet works well.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yelong98 on April 19, 2017, 12:46:13 am
can anyone hack DSOX2002A V2.41 without LAN card ? i took a lot time to find the clue but you know this thread is so long
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yelong98 on April 19, 2017, 01:19:38 am
Thanks to all the contributors ,at lest we can hack high version with a LAN card
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on April 19, 2017, 02:05:56 am
Version 2.4x can be hacked without a lan card - but it has bricked several scopes. It was possible to recover them but it is quite the process. If people are going to hack their version 2.4x scope please only do it via a lan card.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Luminax on April 19, 2017, 04:38:35 am
Like I've already mentioned, I used the link installer someone posted somewhere in this thread on my DSOX 2014A 2.41 Firmware and it's fine and dandy.
If anyone want, I can re-upload my known good configuration files and links from my usb pen-drive...

Disclaimer, of course, that any bricking that might occurs is out of my hands...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on April 19, 2017, 06:27:17 am
Like I've already mentioned, I used the link installer someone posted somewhere in this thread on my DSOX 2014A 2.41 Firmware and it's fine and dandy.
If anyone want, I can re-upload my known good configuration files and links from my usb pen-drive...

Disclaimer, of course, that any bricking that might occurs is out of my hands...

That's the thing - the known good file worked for several people, but then it also bricked a few scopes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yelong98 on April 19, 2017, 08:44:30 am
you mentioned "bricked the scope" ,i'm not good at english ,does it mean this way may be harmful to scope  ,such as breaking the scope ?
DE BD7JAT
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yelong98 on April 19, 2017, 08:51:54 am
Like I've already mentioned, I used the link installer someone posted somewhere in this thread on my DSOX 2014A 2.41 Firmware and it's fine and dandy.
If anyone want, I can re-upload my known good configuration files and links from my usb pen-drive...

Disclaimer, of course, that any bricking that might occurs is out of my hands...
could you pls upload the files here ?if you can paste some instructions about how to use ,it would be wonderful !
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Luminax on April 19, 2017, 09:53:29 am
you mentioned "bricked the scope" ,i'm not good at english ,does it mean this way may be harmful to scope  ,such as breaking the scope ?
DE BD7JAT
Yes, a wrong step or wrong link might lead to your scope being unusable, and you'd need to send it back to the factory for repair.
That being said... has anyone actually BRICKED their scope yet? I don't remember of one but eh... it's quite a long thread.

Also, I've attached the file all inside a zip. The steps are basically :

1) Extract all files (including the .lnk) to the root of your usb drive
2) From the scope's front panel, press Utility ->File Explorer -> Press to go to: <USB Drive label>(usually "usb")
3) From the drop down, scroll to the v241_link_install.cab to select
4) Press Load file

The scope will ask for your confirmation and then it will load/update and reboot.

FYI, my link file is :
160#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO --perf -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l TOM -l BW20 -l ADVMATH -l EMBD -l EDK -l VID

the other cab uninstall the link file and restores your previous setting.

Cheers
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yelong98 on April 19, 2017, 10:27:51 am
you reply so quickly , thanks so much. I wanna make sure all i need to do is load the file"v241_link_install.cab" from USB  ? Do i need to modify any file first?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Luminax on April 20, 2017, 01:10:53 am
The .lnk file is already included and gives you all options (I think I have them all covered) so it turns DSOX into MSOX, gives up to 200MHz bandwidth, etc etc.

Yes, all you have to do is just load the install .cab
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on April 20, 2017, 01:15:34 am
you mentioned "bricked the scope" ,i'm not good at english ,does it mean this way may be harmful to scope  ,such as breaking the scope ?
DE BD7JAT
Yes, a wrong step or wrong link might lead to your scope being unusable, and you'd need to send it back to the factory for repair.
That being said... has anyone actually BRICKED their scope yet? I don't remember of one but eh... it's quite a long thread.

Also, I've attached the file all inside a zip. The steps are basically :

1) Extract all files (including the .lnk) to the root of your usb drive
2) From the scope's front panel, press Utility ->File Explorer -> Press to go to: <USB Drive label>(usually "usb")
3) From the drop down, scroll to the v241_link_install.cab to select
4) Press Load file

The scope will ask for your confirmation and then it will load/update and reboot.

FYI, my link file is :
160#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO --perf -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l TOM -l BW20 -l ADVMATH -l EMBD -l EDK -l VID

the other cab uninstall the link file and restores your previous setting.

Cheers
Wow, thats it now huh? From what I recall it was quite a bit more complicated years ago when I looked into it. So this will work with any version of the X2000 series? I have a stock Agilent MSOX2024A that has a few options I paid for.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Luminax on April 20, 2017, 03:08:12 am
As mentioned way way way waaaaay back at the start of the thread, Agilent's flagship InfiniiVision scope is just a custom program running on WinCE and, as with any properly programmed windows executable, they can take startup arguments.
Previously some of the 'hackers' in this thread was hacking into the scope and uses the LAN module to replace the built-in .lnk with the modified version. As the scope is mainly all-features-included but firmware/program locked, the modified link can 'unlock' those.
Later on in the line, someone made some modifications to the firmware installer cab itself and modified the link INSIDE the cab, then used the scope's built-in USB boot feature to load the new firmware. This, as far as I've remembered, has been patched.
A little further down the line was the post that contains the cab files I linked, which is basically a way to load firmware from your USB drive, but the 'firmware' in question just copy the modified .lnk and renaming the original one in the scope to something else.

aaand I just went into rantmode again  :palm: I'm getting old...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yelong98 on April 20, 2017, 03:40:12 am
I really need to say thanks again. So another things is i wanna make sure does the ZIP file you uploaded here is suitable for all dsox2000 series ? or just for some specific one . my scope is dsox2002a ,does this file  fits for my scope ? Since you mentioned any mistake will brick the scope ,so i have to make all information clearly .

Have a good day !
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Luminax on April 20, 2017, 04:08:53 am
It should work as long as you have the 2.41 Firmware.
Not sure if there's any new firmware since then... hmmm

As far as I've remembered, someone with 3000X also tried this method some time back with success, and the command in the switches in the link are taken from the 3000X series with trial and error to see which options works for the 2000X series.

New 1000X series is another different can of worms but might work... who wants to be the sacrificial lamb and test it on their 1000X ?  :-/O
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tridentsx on April 20, 2017, 08:03:41 am

There is a 2.42 f/w now, would it work with this version ?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Luminax on April 20, 2017, 10:00:51 am
Since the files inside the cabs are just fake and dummies, I'd be willing to bet it would work.
I'd try myself but I'm kind of afraid it'll take my 'features' and run with it... what's updated on 2.42? I might give it a miss altogether
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tridentsx on April 20, 2017, 12:54:15 pm
Release note for 2.42
http://www.keysight.com/upload/cmc_upload/All/Keysight_2000A_3000A_X_Series_Oscilloscope_Release_Notes_02_42.pdf (http://www.keysight.com/upload/cmc_upload/All/Keysight_2000A_3000A_X_Series_Oscilloscope_Release_Notes_02_42.pdf)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Windfall on April 20, 2017, 08:36:04 pm
I updated my scope to the 2.42 Firmware this week, because they now allow a probe attenuation down to 0.001 which is quite useful.

Telnet Login an the "\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO -l memMax -l MEMUP -l ADVMATH -l SGM -l SGMC -l AUTO -l COMP -l TOM -l EMBD -l VID -l COMP -l SCPIPS -l WAVEGEN -l MASK -l BW20" Hack still works on my scope.

But you still needing to alter the hex info on dll file, or just add these options on the command line?

For the basic hack just add the options at the command line.

My DSOX2024A was delivered today (with LAN/VGA module, for the web interface, I love web interfaces on hardware). Updated firmware from 2.41 to 2.42.

Playing around with this telnet trick, but when I execute the quoted commandline, my screen goes black. Am I missing something ?

<never mind though, see next message !>

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Windfall on April 20, 2017, 08:48:06 pm
Never mind, I realized pretty quickly I had to kill some old copy of the executable.

ProcessMgr.exe kill infiniivisionLauncher.exe

then

\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO -l memMax -l MEMUP -l ADVMATH -l SGM -l SGMC -l AUTO -l COMP -l TOM -l EMBD -l VID -l COMP -l SCPIPS -l WAVEGEN -l MASK -l BW20

works, although it gives me a warning :

'System concerns detected: OS version is not correct. Please reload system firmware.'

(I wonder who it's talking to, the developers or me ?  ;)).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grenert on April 21, 2017, 12:40:16 am
Do you have to telnet in every time you boot to run that command line?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Windfall on April 21, 2017, 12:51:39 am
Do you have to telnet in every time you boot to run that command line?
Of course. I kill some already running executable, then rerun it with other parameters (which enable licensed features). I gather from earlier messages that the firmware can be changed to make it start with those other parameters (probably by changing some embedded script somewhere), but, personally, I'd rather not do that.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlan on April 21, 2017, 02:11:22 am
When you have a 2000X don't forget to add the --perf parameter, but ADVMATH, TOM and all other 3000X specific licences will have no effect.

The following parameters will enable everything available on a 2000X with standard 2.4x firmware:
 -l MSO -l BW20 -l DIS --perf --forcemaxmem

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Luminax on April 21, 2017, 03:17:36 am
'System concerns detected: OS version is not correct. Please reload system firmware.'
This amounts to "you hax0r! go back to the crippled version!"

A bit of fiddling with the recipes and switches might make this message go away forever (as in, matching the OS version and firmware version check in software and hardware) but as it's not really hindering anything, why bother?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Windfall on April 21, 2017, 09:38:36 am
When you have a 2000X don't forget to add the --perf parameter, but ADVMATH, TOM and all other 3000X specific licences will have no effect.

The following parameters will enable everything available on a 2000X with standard 2.4x firmware:
 -l MSO -l BW20 -l DIS --perf --forcemaxmem

Thanks.

Would be nice for us to, sometime, have an account somewhere of those parameters and what they relate to.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Windfall on April 21, 2017, 09:44:51 am
'System concerns detected: OS version is not correct. Please reload system firmware.'
This amounts to "you hax0r! go back to the crippled version!"

Heh. Most likely just a cross-check, that the executable has been compiled for the right Windhoze.

A bit of fiddling with the recipes and switches might make this message go away forever (as in, matching the OS version and firmware version check in software and hardware) but as it's not really hindering anything, why bother?

Indeed. Although it would be nice to find out how the OS version is passed, and if there are any other executables that should be run before and after this one (you never know, there might be some order issues).

Ah well, I bought it with the options I actually use. I'm kind of a digital only man, and only the occasional brush with analog. The wavegen is probably nice to have, on occasion. The rest doesn't really interest me (although why they'd cripple memory use is beyond me ...).

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on April 21, 2017, 02:13:05 pm
When you have a 2000X don't forget to add the --perf parameter, but ADVMATH, TOM and all other 3000X specific licences will have no effect.

The following parameters will enable everything available on a 2000X with standard 2.4x firmware:
 -l MSO -l BW20 -l DIS --perf --forcemaxmem

Thanks.

Would be nice for us to, sometime, have an account somewhere of those parameters and what they relate to.
Look back in this very thread; here's many of the options:

  https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg338246/#msg338246 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg338246/#msg338246)

An easy way to search this thread is to hit the PRINT button, which gives you all the posts, and then use your browser to search for specific text.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: RossS on April 21, 2017, 02:21:46 pm
Is there any harm in going from 100 -> 200 MHz on a 3000T series via a strapping resistor change (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg980404/#msg980404) to make it think it's a 350/500 MHz board? Will this screw up accuracy or make user calibration fail? I'm wondering as there are no software hacks for the T series yet...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grenert on April 21, 2017, 06:10:44 pm
Do you have to telnet in every time you boot to run that command line?
Of course. I kill some already running executable, then rerun it with other parameters (which enable licensed features).
I see.  Thank you for the explanation.

Ah well, I bought it with the options I actually use. I'm kind of a digital only man, and only the occasional brush with analog. The wavegen is probably nice to have, on occasion. The rest doesn't really interest me (although why they'd cripple memory use is beyond me ...).
Yes, I also bought my scope with the features that are most useful for me (mostly analog ones like channels and bandwidth, and ponied up for the max memory  :-[ ; got the AWG as a free bonus as an early adopter).  I can see how this telnet method could be useful on the very rare occasion when I might need the various MSO/serial decode functions.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Windfall on April 21, 2017, 06:46:01 pm
Would be nice for us to, sometime, have an account somewhere of those parameters and what they relate to.
Look back in this very thread; here's many of the options:

  https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg338246/#msg338246 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg338246/#msg338246)

Thanks, that seems very useful.

In case anyone was wondering why the first telnet login fails, I found it's because there are 9 characters already in the input buffer. If you delete these first, the first login will work.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on April 22, 2017, 12:09:27 am
It should work as long as you have the 2.41 Firmware.
Not sure if there's any new firmware since then... hmmm

As far as I've remembered, someone with 3000X also tried this method some time back with success, and the command in the switches in the link are taken from the 3000X series with trial and error to see which options works for the 2000X series.

New 1000X series is another different can of worms but might work... who wants to be the sacrificial lamb and test it on their 1000X ?  :-/O
Looks like 1000X series has a different firmware update approach.  I tried running the uninstall.cab and 1000X does not know what to do with it.  I changed the extension to .ksx (like the new 2.42 2000X / 3000X firmware) and the same error.  I also created new .cab file trying to verify directory content of \Secure and write the content to \usb and I get the same error.  Until a new firmware is released by Keysight for the 1000X series, it is an unknown territory...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on April 22, 2017, 05:43:47 pm
Ok, so thanks to the folk that have gone the 2.41 path. After digesting the various approaches, this is my version of the condensed instructions (note the extra 8a step I needed to do):

This with Firmware 2.41 and on my msox2024a:


1. Login with telnet in your scope, with infiniivision and password skywalker1977
2. Stop software with "processmgr kill infiniivisionlauncher.exe"
3. Copy the file \program files\infiniivision\infiniivisioncore.dll to the usb stick
4. Patch the dll at position 0x027C0E8 with your hex editor of choice. Change the bytes from "04 00 a0 e1" to "00 00 a0 e3"
5. Copy the patched dll to "\secure\"
6. Create a file "startinfiniivision.cmd" with the following content:

processmgr kill infiniivisionlauncher.exe
copy \secure\InfiniiVisionCore.dll "\program files\infiniivision\InfiniiVisionCore.dll"
"\program files\infiniivision\infiniivisionlauncher.exe" -l MSO -l BW20 -l DIS --perf --forcemaxmem

7. Copy this file to "\secure\"
8. Create infiniivision.lnk with contents

50#\windows\cmd.exe /c \Secure\startinfiniivision.cmd

8a. You want to then copy infiniivision.lnk to \Secure\Startup except in my case there was already an infiniivision.lnk file (zero length) in there and a) copy wouldn't overwrite and b) del wouldn't delete. So, I renamed the existing infiniivision.lnk file (the zero length one) to x.txt (just a different name) and that was allowed. Then I copied the infiniivision.lnk file from step 8a into the \Secure\Startup directory and that worked fine.

9. done!


-------------------------------------------------------------------------------------------
Or for folk that don't want to patch the dll (but must be done every re-boot of the scope):

1. Login with telnet in your scope, with infiniivision and password skywalker1977
2. ProcessMgr.exe kill infiniivisionLauncher.exe
3. \Secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l BW20 -l DIS --perf --forcemaxmem

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on April 22, 2017, 07:49:26 pm
Telnet option sounds like job for a dedicated Raspberry Pi.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on April 22, 2017, 10:55:29 pm
With version 2.41 there is no need for any hex editing of infiniivisioncore.dll.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on April 22, 2017, 11:30:42 pm
With version 2.41 there is no need for any hex editing of infiniivisioncore.dll.

You sure of that? Tested? What steps are necessary then?

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on April 23, 2017, 12:39:36 am
With version 2.41 there is no need for any hex editing of infiniivisioncore.dll.

You sure of that? Tested? What steps are necessary then?

cheers,
george.
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1189010/#msg1189010 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1189010/#msg1189010)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on April 23, 2017, 01:28:41 am
Ok, so, with a LAN card, all that is 'necessary' then is to rename the infiniivision.lnk file in \secure\startup and copy the 'new/updated' infiniivision.lnk file into \secure\startup ?

This for 2.41.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Luminax on April 27, 2017, 06:57:50 am
From link_install recipe.xml :

<command>\windows\cmd.exe /c copy \usb\infiniivision.lnk \Secure\Startup\infiniivision_ext.lnk</command>
<command>\windows\cmd.exe /c ren \Secure\Startup\infiniivision.lnk infiniivision.lnk.original</command>

and link_uninstall recipe.xml :

<command>\windows\cmd.exe /c del /f \Secure\Startup\infiniivision_ext.lnk</command>
<command>\windows\cmd.exe /c ren \Secure\Startup\infiniivision.lnk.original infiniivision.lnk</command>

The answer to your question would be a yes.
Although, following the steps above by backing up the existing .lnk before copying yours over would be a safer option than overwriting.
Also, no idea why it's named as infiniivision_ext.lnk but still launches. My guess would be an argument procedure in the start-up of the scopes that looks for certain sets of .lnk and the _ext.lnk is one of them? hmmm
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on April 27, 2017, 09:43:01 am
For the LAN card hack, why don’t you follow these video tutorials?
https://goo.gl/E57hPM (https://goo.gl/E57hPM)
https://goo.gl/DNfZdv (https://goo.gl/DNfZdv)
The 2nd one helps with garbage on IP, you could see proper IP address. The 1st one gives garbage on IP.
It should work also with 2.42 according with kyílobyte, but I have tested only with 2.41:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1181607/#msg1181607 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1181607/#msg1181607)
Don’t forget to add “--perf” to the .lnk file if need a bit more functions:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1166295/#msg1166295 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1166295/#msg1166295)
And the warning message can be removed if you patch the “infiniivisioncore.dll” ina HEX editor:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1161897/#msg1161897 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1161897/#msg1161897)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on April 27, 2017, 04:22:23 pm
So, again, the consensus for a fully operational 'upgrade' with NO Lan IP garbage etc., is to follow the steps with including patching the inifi....dll file.

Which is the choice I made and works perfectly (for 2.41 on my msox2024a). Essentially the equivalent of the 2nd video above but with the 'optimised' option flags: -l MSO -l BW20 -l DIS --perf --forcemaxmem

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on April 27, 2017, 06:19:42 pm
got 2012a stuck on splash and pairs of led cycling from bottom to top
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on April 27, 2017, 06:22:06 pm
got 2012a stuck on splash and pairs of led cycling from bottom to top

Something you did? Still warranty?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on April 27, 2017, 06:26:01 pm


Something you did? Still warranty?
[/quote]

None i did nothing it started itself like this and  warranty expired alredy ,  just ask here because i read all 3ad seems a lot of very expert hope somebody might help me
i guess leds is diagnostic routines but cannot find any info about
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on April 27, 2017, 06:39:59 pm
What firmware version are you on, can you remember? If it is anything like the flash problem with the 3000A series it could be warranty.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on April 27, 2017, 06:49:12 pm
What firmware version are you on, can you remember? If it is anything like the flash problem with the 3000A series it could be warranty.
Sorry i can't remember but i guess old release , want to try to upgrade if ever corrupted flash , its enough to put cab image on usb stick
and switch on or better unpack and boot ? yesterday i tried with cab on usb stick no more image splash but ''Agilent Tecnologies'' text in the middle of lcd .. but stuck too
without leds cycling.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on April 27, 2017, 07:06:51 pm
What firmware version are you on, can you remember? If it is anything like the flash problem with the 3000A series it could be warranty.
Sorry i can't remember but i guess old release , want to try to upgrade if ever corrupted flash , its enough to put cab image on usb stick
and switch on or better unpack and boot ? yesterday i tried with cab on usb stick no more image splash but ''Agilent Tecnologies'' text in the middle of lcd .. but stuck too
without leds cycling.

For proper booting from USB you needs the same nor similar version. It was not possible to boot from USB when on flash was older or newer firmware ( I assume you have version <2.4). Also try different USB flash.
Do you remember if you firmware was with Keysight or Agilent logo?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on April 27, 2017, 07:13:05 pm
Quote
For proper booting from USB you needs the same nor similar version. It was not possible to boot from USB when on flash was older or newer firmware ( I assume you have version <2.4). Also try different USB flash.
Do you remember if you firmware was with Keysight or Agilent logo?


Agilent logo and scope production is 2013
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on April 27, 2017, 07:18:22 pm

For proper booting from USB you needs the same nor similar version. It was not possible to boot from USB when on flash was older or newer firmware ( I assume you have version <2.4). Also try different USB flash.
Do you remember if you firmware was with Keysight or Agilent logo?
[/quote]

Agilent logo and scope production is 2013
[/quote]

OK, so try all firmware which you will be able to download since 1.10 through 2.10, 2.20, 2.30, 2.35 and 2.35.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on April 27, 2017, 07:31:15 pm
Quote
OK, so try all firmware which you will be able to download since 1.10 through 2.10, 2.20, 2.30, 2.35 and 2.35.

Ok i can do that no problems , but where to download all of them?

here short video with 2.35 on usb stick with led cycling and stuck boot  https://drive.google.com/open?id=0B7SMkPohCf_AN0p1OUpob0FhRGc (https://drive.google.com/open?id=0B7SMkPohCf_AN0p1OUpob0FhRGc)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grenert on April 28, 2017, 05:38:31 am
Daxxin, you need to check out this thread:
https://www.eevblog.com/forum/testgear/agilent-dsox2024-won't-boot/ (https://www.eevblog.com/forum/testgear/agilent-dsox2024-won't-boot/)

This is a known problem with earlier firmware revisions.  You can see that they are currently repairing these scopes with this problem regardless of warranty status.  I had the same problem and contacted Keysight.  They agreed to free repair (my warranty had expired already), I sent it to them and had it back in perfect working order in a week or so.  Excellent service!   :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on April 28, 2017, 05:46:06 pm
Thanks for the hints maybe i contact soon keysight , anyway i tried to boot with all fw's only with 2.37 different situation no more leds cycling but screen remain black
just arrived the usb - serial 3.3v converter now i try to log
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on April 28, 2017, 05:51:53 pm
Quote
U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2011-01-27  11:38:14 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    36703 Bytes = 35.8 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Jan 27 2011 02:04:15
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOOXOXOXXXOOXOXXOXXXXXXOOOXXXOOOOOXOOXOXXXOOOXXOOOXXOOOOXOOXOOXXOOOXOOOOOXOOOXOOOXXXXXXOXOXXOXXXXXXXOXXXXOOOXOOOOXOXOOOXOOOOXOXOXOOOOOOXOOOOXOXOOOOOXXOOOOOXX
OOOOXXOOOOOOOOOXOXOOOXOOOOOOOXXOOOOOXXOOOOXOXOXOOXOXOOOXOOOXOOOXXXOXOOOXOXXXXOXOOXXOXXOXXOOOXXOXOXXOXXXXXOOXOXXXXOXOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOOXXXXXXXXXXXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1248684, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
  • : Address=0x80361000  Length=0x1248684  Name="" Target=RAM

 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Jun 16 2009 at 10:08:15
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Apr 18 2012)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
-EDeviceLoadEeprom 00:30:D3:20:E7:70
Phy found addr 31 (ticks=2789)
WaitForLink Start (ticks=2790)
No Link (ticks=3793)
<--EDeviceInitialize

GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Starting ProcessStartupFolder
running \Secure\Startup\infiniivision.lnk...
Ending ProcessStartupFolder
                           Before P/Invoke
Exception 'Undefined Instruction' (1): Thread-Id=03530006(pth=837d0a5c), Proc-Id=03500006(pprc=837d0744) 'infiniivisionLauncher.exe', VM-active=03500006(pprc=837d0744) 'infiniivisionLauncher.exe'
PC=4122dcf0(infiniivisioncore.dll+0x0051dcf0) RA=411b557c(infiniivisioncore.dll+0x004a557c) SP=0002f1d4, BVA=00000000
Exception 'Undefined Instruction' (1): Thread-Id=03530006(pth=837d0a5c), Proc-Id=03500006(pprc=837d0744) 'infiniivisionLauncher.exe', VM-active=03500006(pprc=837d0744) 'infiniivisionLauncher.exe'
PC=4122dcf0(infiniivisioncore.dll+0x0051dcf0) RA=411b557c(infiniivisioncore.dll+0x004a557c) SP=0002f1d4, BVA=00000000
System.MissingMethodException: Can't find PInvoke DLL 'infiniiVisionCore.dll'.
   at Agilent.InfiniiVision.infiniiVisionLauncher.Main(String[] args)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on April 28, 2017, 06:09:00 pm
Looks to me that it can't find the infiniiVisionCore.dll, do you get the same when booting 2.37 from USB?
Contact Keysight and try to find out if this (likely flash corruption) is covered by warranty, I know they do this for the 3000X series. If that is a dead end we can find other ways to boot the scope but you will need the LAN option or one of the clones.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on April 28, 2017, 06:20:33 pm
Looks to me that it can't find the infiniiVisionCore.dll, do you get the same when booting 2.37 from USB?
Contact Keysight and try to find out if this (likely flash corruption) is covered by warranty, I know they do this for the 3000X series. If that is a dead end we can find other ways to boot the scope but you will need the LAN option or one of the clones.

with the 2.37 same messages with 2.35 the following ..im not in hurry to contact keysight and this scope not my primary instruments i m using older scopes as primary..lets experiments

Quote
U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2011-01-27  11:38:14 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    36703 Bytes = 35.8 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Jan 27 2011 02:04:15
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOOXOXOXXXOOXOXXOXXXXXXOOOXXXOOOOOXOOXOXXXOOOXXOOOXXOOOOXOOXOOXXOOOXOOOOOXOOOXOOOXXXXXXOXOXXOXXXXXXXOXXXXOOOXOOOOXOXOOOXOOOOXOXOXOOOOOOXOOOOXOXOOOOOXXOOOOOXX
OOOOXXOOOOOOOOOXOXOOOXOOOOOOOXXOOOOOXXOOOOXOXOXOOXOXOOOXOOOXOOOXXXOXOOOXOXXXXOXOOXXOXXOXXOOOXXOXOXXOXXXXXOODeCompressFlash: CeCompressDecode() failed
 CeDecompressFlashBlock failed
****** Data record 123 corrupted, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
  • : Address=0x80361000  Length=0x1248684  Name="" Target=RAM

 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1600000

BL_IMAGE_TYPE_UNKNOWN

 Loading image 2 failed, trying next one
 All images failed

Press r to reset
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on April 28, 2017, 06:36:02 pm
im not in hurry to contact keysight and this scope not my primary instruments i m using older scopes as primary..lets experiments

Alright, get a LAN card an read this: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022248/#msg1022248 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022248/#msg1022248)

and this: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022267/#msg1022267 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022267/#msg1022267)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on April 29, 2017, 08:39:17 am
Hello all
Fight now with MSOX3034T. Did the 350mHz -> 1Ghz bandwidth successfully - mega-thanks to memset  (resolder just one strap resistor only, 46.4K to 78K.  In the channel filters was already the coils with 5 turns).

Now want to add licenses to my scope. Try to disassembly the dll extracted from last update pack for my MSOX3000. I see that now this DLL have much increased size against same DLL by pack 2.42 for MSOX3000A (40mb against just 10mb)...

By the way, for version 2.42 the patch address in the infiniiVisionCore.dll will be 0x27C7A4 ("04 00 a0 e1" to "00 00 a0 e3")
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pacmac on April 29, 2017, 12:45:41 pm
Finally decided today to try and enable the un-enabled modules on my 2000 series, which thanks to @memset worked great.

The only problem I have (which I can live with) is that during bootup I get a warning:

Code: [Select]
System concerns detected
OS Version is not correct, please reload system firmware.

Now before the attempted the usb mod, I had already updated to version 42 and reading thru the threads found that 42 was not mentioned, so first I downgraded to version 41 before starting, that succeed with no warnings.

So I have 2 questions:

1) Does everyone else also get this warning message ?
2) If I re-upgrade to 42, will the mod persist and will it break it ?

Update

I can confirm that @memset's 2.41 fix also works on 2.4.2.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: RossS on April 29, 2017, 01:20:49 pm
Now want to add licenses to my scope. Try to disassembly the dll extracted from last update pack for my MSOX3000. I see that now this DLL have much increased size against same DLL by pack 2.42 for MSOX3000A (40mb against just 10mb)...

Are you working with firmware version 4.08.2016071801?

I've been trying at this, but even an unpatched infiniiVisionCore.dll from the firmware image is giving me issues. With CFF Explorer, you can see its header has the machine type set to MIPS R4000, yet the disassembled instructions only make sense if you treat it as ARM.

Putting the DLL as-is into \program files\infiniiVision\ and re-launching infiniiVisionLauncher.exe gives this error:
Code: [Select]
System.MissingMethodException: Can't find PInvoke DLL 'infiniiVisionCore.dll'.
   at Agilent.InfiniiVision.infiniiVisionLauncher.Main(String[] args)

Forcibly setting the machine type to ARM Thumb in the DLL header (matching the DLL for the 2000X series) with no other changes and re-launching causes an immediate crash with the scope rebooting after checking file system integrity.

The file size of the DLL from the firmware image is actually slightly smaller than what's on the scope in ROM under \windows\ (36315896 bytes vs. 37348672). Unfortunately with the scope's copy in ROM, there's no easy way to copy it off. I haven't yet found a recovery program compiled for windows CE on ARM that can do this successfully.

I've found what appears to be the correct place in the file to patch, but that's useless without without being able to run it.

Can anyone theorize on why the DLL from the firmware image appears slightly malformed? Most other DLLs are like that as well, but some of them have the correct ARM Thumb header. There's also some infiniivision stuff on .NET that's completely intact which I've been able to patch and make the scope run successfully, but I haven't yet found anything actually useful to patch there.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on April 30, 2017, 06:55:49 am
while waiting for lan card i try some ...I think last time i tried usb 2.35 usb mod not prepared the stick in a proper way now i guess is ok but i get this..

Quote
GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Starting ProcessStartupFolder
ProcessStartupFolder: \usb\Startup\
                                   running \usb\Startup\infiniivision.lnk...
System.MissingMethodException: Can't find PInvoke DLL 'AgilentLicensingUnmanaged.dll'.
   at Agilent.Cdf.Api.Licensing.Compact.LicenseSupervisor.b.a.f()
   at Agilent.InfiniiVision.infiniiVisionLauncher.Main(String[] args)

Ending ProcessStartupFolder

where's the _setup.xml file? cant find it
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on April 30, 2017, 08:09:59 am
where's the _setup.xml file? cant find it

It's inside the infiniiVisionSetup.cab which is inside the firmware update .cab

I attached the 2.35 one as .txt
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on April 30, 2017, 07:21:36 pm
while waiting for lan card build from prof pcb fab i have build my own this the log now..
sorry PA0PBZ to bother u ..can u make short description or pm.. me about celoader ip..folders files etc

Quote
GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Running ConfigureNetworkNative
Loading \Agilent Flash\config\networkSettings.xml configuration file.
Waiting for network to configure.
<?xml version="1.0"?>
<networkConfig><dhcp>true</dhcp>
<ipAddress>146.223.229.241</ipAddress>
<subnet>255.255.255.0</subnet>
<gateway>146.223.229.1</gateway>
<dnsServer>192.25.42.10</dnsServer>
<hostName>a-dx2012a-64560</hostName>
<domainName></domainName>
<adapterName>GMAC1</adapterName>
</networkConfig>

Failed to start/configure network.
Starting ProcessStartupFolder
running \Secure\Startup\infiniivision.lnk...
Before P/Invoke
Ending ProcessStartupFolder
                           Exception 'Undefined Instruction' (1): Thread-Id=033f000e(pth=837d0a5c), Proc-Id=03f900ba(pprc=837d0744) 'infiniivisionLauncher.exe', VM-active=03f900ba(pprc=837d0744) 'infiniivisionLauncher.exe'
PC=4122dcf0(infiniivisioncore.dll+0x0051dcf0) RA=411b557c(infiniivisioncore.dll+0x004a557c) SP=0002f1d4, BVA=00000000
Exception 'Undefined Instruction' (1): Thread-Id=033f000e(pth=837d0a5c), Proc-Id=03f900ba(pprc=837d0744) 'infiniivisionLauncher.exe', VM-active=03f900ba(pprc=837d0744) 'infiniivisionLauncher.exe'
PC=4122dcf0(infiniivisioncore.dll+0x0051dcf0) RA=411b557c(infiniivisioncore.dll+0x004a557c) SP=0002f1d4, BVA=00000000
System.MissingMethodException: Can't find PInvoke DLL 'infiniiVisionCore.dll'.
   at Agilent.InfiniiVision.infiniiVisionLauncher.Main(String[] args)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on May 01, 2017, 08:55:02 am
Ok, short description of celoader, not in pm because others could be interested too.

If you boot the scope and halt the boot process by pressing <space> (RS232) you either end up in uboot (something I never managed to do) or in the celoader menu, depending on timing. One of the options in the celoader menu is "Download from platform builder", where you can boot from another system file by presenting a NK.BIN file over the LAN. Offering the file is what the celoader.exe I posted does: it listens for a BOOTME request and then sends the file to the target.

So what you have to do is uncompress the NK.BIN.COMP from one of the firmware update files into NK.BIN, put celoader.exe and NK.BIN in the same folder on a windows machine and start celoader.exe using the dos prompt. Uncompressing the COMP file can be done by a tool posted earlier in this thread, or I can post the tool when I'm home if you can't find it.

Now boot the scope, halt the boot process in the ce loader using <space> and select option d) Download from platform builder.
Once the scoop has booted your screen will stay blank (it will not run the infiniivision stuff) but you will be able to telnet into the scope.

After that you can/will have to find out what is wrong with your file system.
However, it could be that you are able to telnet into the scope as it is now because it looks like it fails to load the scope software and Windows CE could be fine.


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on May 01, 2017, 10:52:08 am
thanks i did some steps but still not yet focused , i can stop serial connection in two way ..if i press space very early it stop to boot on uboot
where u have lots commands  with help.. i was even able to change ip with 'setenv ipaddr xxx.xxx.xxx.xxx'
here:

Quote
Using smsc device
TFTP from server 146.223.241.7; our IP address is 192.168.1.212; sending through gateway 192.168.1.35
Filename 'nk.bin.comp'.
Load address: 0x800000
Loading: T T T T T T T T T T

even i changed ipaddress , serverip and gatewayip (pointing to my pc with nk.bin) and saved with saveenv it still looking for old env


If i type space key a little bit late it stop in an advanced step where is shown 4 options
Quote
Mac address .......... (00:30:D3:20:E7:70)
Ip address ........... (192.168.1.36)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0600000)
        2 (0xd1600000)

l) Load flash resident image now
d) Download from ethernet now
u) Start u-boot by resetting
v) Verify Images
>System ready!
Preparing for download...
 Downloading image from platform builder
Setting MAC address GMAC_MAC_ADDR_HI_LO[0] = 0x800070E7, GMAC_MAC_ADDR_HI_LO[1] = 0x20D33000
Auto Negotiation complete in 170353 iterations
Link up
AutoNegotiate Full Duplex
AutoNegotiate 100 Base T
Reading MAC address 0x30 0xD320 0xE770
Setting MAC address GMAC_MAC_ADDR_HI_LO[0] = 0x800070E7, GMAC_MAC_ADDR_HI_LO[1] = 0x20D33000
INFO: GMAC Ethernet controller initialized.
InitDHCP():: Calling ProcessDHCP()
ProcessDHCP()::DHCP_INIT
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)

typing 'd' hangs after this messages .. . im monitoring with wiresharks there activity from scope ipaddress to pc ip

ps.s i start celoader.exe without params ..is that correct?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on May 01, 2017, 11:07:13 am
typing 'd' hangs after this messages .. . im monitoring with wiresharks there activity from scope ipaddress to pc ip
ps.s i start celoader.exe without params ..is that correct?

Yes, just celoader without params should work. Did you place NK.BIN (not NK.BIN.COMP!) in the same folder?
Are both the scope and celoader on the same subnet?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on May 01, 2017, 11:16:00 am
yes same subnet but with the advanced boot when i oress 'd' in wireshark i get request from ip 0.0.0.0 thats weird
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on May 01, 2017, 11:33:20 am
Strange... This is what my scope does when halted in the CE Loader:
(As said earlier, I was never able to stop it in uboot)

Quote
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2016-9-3   21:5:45.25 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008



P500 Boot Loader Configuration :

Mac address .......... (00:30:D3:XX:XX:XX)
Ip address ........... (192.168.1.190)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0600000)
        2 (0xd1600000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on May 01, 2017, 11:39:08 am
yes same subnet but with the advanced boot when i oress 'd' in wireshark i get request from ip 0.0.0.0 thats weird

Do you have a DHCP server?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on May 01, 2017, 12:13:14 pm
i was able to boot from tftpd64 the nk.bin.com it loaded successful but i cannot connect with telnet
if i ping pc from scope is alive but if i ping the scope from pc unrearchable ..from wireshark boot address visible  ..very confused

no dhcp installed , or maybe my adapter not working fine.. tx or rx wrong wont able to load nk.bin.comp image too i guess
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on May 01, 2017, 12:30:09 pm
Quote
nk.bin.comp

As far as I know you can't use nk.bin.comp, see above.

Quote
if i ping pc from scope

How can you do that if you can't login?

Quote
no dhcp installed

You need DHCP to give the scope an IP address
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on May 01, 2017, 12:39:46 pm
Quote
nk.bin.comp

As far as I know you can't use nk.bin.comp, see above.

Quote
if i ping pc from scope

How can you do that if you can't login?

Quote
no dhcp installed

You need DHCP to give the scope an IP address

what i did i just loaded nk.bin.com through ftpd server and sending/checking through serial terminal connection from the earlier
uboot interface just type ftpboot after assigned all the ip's with 'setenv' + 'saveenv' for sure something is wrong even all files transfered
it cant ping itself looks like a firwall armored ip   :P

to assign ip by dhcp you set your scope ip 0.0.0.0 ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on May 01, 2017, 01:08:28 pm
OK now i was able to assign ip and load image to scope with celoader but still get errors

Quote
[0]: Address=0x80361000  Length=0x130656C  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
Got EDBG_CMD_JUMPIMG
Got EDBG_CMD_CONFIG, flags:0x00000000
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built May 20 2014)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:20:E7:70
Phy found addr 31 (ticks=2891)
WaitForLink Start (ticks=2893)
Link Detected (ticks=2896)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Autonegociation Start (ticks=4919)
+StartAutoNegotiation: pDeviceContext 0xd0578fa0
Autonegociation End (ticks=7930)
WaitForLink Start (ticks=7931)
Link Detected (ticks=7934)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
cable attached
Running infiniiVisionInstallHelper
Running launchNetworkServices
Starting Agilent LXI Services.
Time for NANDFLASH to load: 0 ms.
Time for SNANDFLASH to load: 0 ms.
System.MissingMethodException: Can't find an Entry Point 'RegisterNativeCompactLicensingCallbacks' in a PInvoke DLL 'Agilent.Cdf.Api.Unmanaged.dll'.
   at Agilent.Cdf.Api.Licensing.Compact.LicenseSupervisor.g.a.c()
   at Agilent.Cdf.Api.NativeInterop.RegisterNativeCallbacks()
   at Agilent.InfiniiVision.infiniiVisionLauncher.Main(String[] args)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on May 01, 2017, 01:13:52 pm
to assign ip by dhcp you set your scope ip 0.0.0.0 ?

No, you set DHCP ON in the scope app, but yeah...
Fortunately it's on by default, so if you have a DHCP server in your network it should assign an IP address.

Quote
OK now i was able to assign ip and load image to scope with celoader but still get errors

Does telnet work now?

Are you using a NK.BIN from the same firmware version that is installed on the scope?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on May 01, 2017, 01:22:04 pm
Quote
Are you using a NK.BIN from the same firmware version that is installed on the scope?

to tell  dont know yet what firmware is installed there is a way to discover ?
this error because i forgot to plug usb stick ..maybe?
my wince cab manager seems don't extract all files ..all files with truncked file names and _setup.xml
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on May 01, 2017, 03:11:13 pm
really dont know what i did exactly but the scope is started after i load 1.10 nk.bin and inserted the usb stick with extracted infiniivision and startup folder

Quote
Windows CE Kernel for ARM (Thumb Enabled) Built on Jun 16 2009 at 10:08:15
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Mar 16 2011)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
-EDeviceLoadEeprom 00:30:D3:20:E7:70
Phy found addr 31 (ticks=2757)
WaitForLink Start (ticks=2759)
Link Detected (ticks=2762)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running ceCreateUserAccounts...
Creating infiniivision user account: SUCCESS
Running infiniiVisionInstallHelper
Autonegociation Start (ticks=4786)
+StartAutoNegotiation: pDeviceContext 0xd0573960
Running ConfigureNetworkNative
Autonegociation End (ticks=7797)
WaitForLink Start (ticks=7798)
Link Detected (ticks=7801)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
cable attached
Loading \Agilent Flash\config\networkSettings.xml configuration file.
TIMEOUT waiting for IsNetworkReady
<?xml version="1.0"?>
<networkConfig><dhcp>true</dhcp>
<ipAddress>146.223.229.241</ipAddress>
<subnet>255.255.255.0</subnet>
<gateway>146.223.229.1</gateway>
<dnsServer>192.25.42.10</dnsServer>
<hostName>a-dx2012a-64560</hostName>
<domainName></domainName>
<adapterName>GMAC1</adapterName>
</networkConfig>

Failed to start/configure network.
Starting ProcessStartupFolder
ProcessStartupFolder: \usb\Startup\
                                   running \usb\Startup\infiniivision.lnk...
Ending ProcessStartupFolder
                           Before P/Invoke
Our command line is -l All -l SCPIPS
Performing Startup

      creating \Agilent Flash\webupdate\Released build, Mar 16 2011, 10:32:42
Initializing FPGA...
****
FPGA Type: Idaho
Ver: 1.087 Released
Build Time: Wed Jan 04 19:40:14 2012
Build Machine: DW3647M2
****
Programming LAN option module...
Module option FPGA DONE bit should be LOW at this pointKeyboard firmware version mismatch, 26 (binary) vs 31 (keyboard)
Programming keyboard firmware...
  Initializing UART... ok
  Unlocking flash memory... ok
  Erasing flash memory... ok
  Blank checking... ok
  Writing memory... ok
  Verifying memory... ok
New keyboard firmware version 1.026... ok
Keyboard Info: Firmware version 26, Board id 7, Board rev 2
Startup sequence is complete.
Saved configuration invalid
System has been running 81.905029 seconds
Start Up Sequence 58.996056
Memory Load 49%
   System Physical Memory 38.336 / 79.695 MB
   Process Virtual Memory 43.250 / 1024.000 MB
-----> InfiniiVision is running <-----
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on May 01, 2017, 03:13:55 pm
Congratz. So I will guess that scope was using 1.10 before bricking :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheAmmoniacal on May 01, 2017, 03:27:19 pm
Anyone got recommendations (tips/tricks) on how to attack the InfiniiVision 1000 X-Series? Unlock the three licenses DSOX1EMBD, DSOX1B7T102 and DSOX1AUTO.

USB connection only, no firmware available yet.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on May 01, 2017, 05:52:25 pm
Anyone got recommendations (tips/tricks) on how to attack the InfiniiVision 1000 X-Series? Unlock the three licenses DSOX1EMBD, DSOX1B7T102 and DSOX1AUTO.

USB connection only, no firmware available yet.

thanks but i think this old version infiniivision/skywalker1977 password is incorrect ..cannot log in telnet
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on May 01, 2017, 05:57:17 pm
Congratz. So I will guess that scope was using 1.10 before bricking :)

I don't think so, it downgraded the keyboard firmware:
Quote
Keyboard firmware version mismatch, 26 (binary) vs 31 (keyboard)

thanks but i think this old version infiniivision/skywalker1977 password is incorrect ..cannot log in telnet

Did you try twice? If that doesn't work try a more recent nk.bin?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on May 01, 2017, 05:58:42 pm
Anyone got recommendations (tips/tricks) on how to attack the InfiniiVision 1000 X-Series? Unlock the three licenses DSOX1EMBD, DSOX1B7T102 and DSOX1AUTO.

Does it have a RS232 console port? I'd start by logging the boot sequence.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on May 01, 2017, 06:00:04 pm
Our command line is -l All -l SCPIPS

I see you have been playing already :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on May 01, 2017, 06:18:44 pm
Quote
I see you have been playing already :)

 :-DD Done ..tried another nk.bin but crashed too ..so i put 2.35 inside a folder  and with booted scope i did the update to 2.35 everything fine  :P

thanks a lot for helping guys
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on May 01, 2017, 06:28:25 pm
Done ..tried another nk.bin but crashed too ..so i put 2.35 inside a folder  and with booted scope i did the update to 2.35 everything fine  :P

Well done... any idea what caused this? Probably not but good to see that you made it this far  :-+

You might as well update a bit further to get the corruption prevention, 2.41 should be fine.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on May 01, 2017, 06:57:02 pm
Anyone got recommendations (tips/tricks) on how to attack the InfiniiVision 1000 X-Series? Unlock the three licenses DSOX1EMBD, DSOX1B7T102 and DSOX1AUTO.

Does it have a RS232 console port? I'd start by logging the boot sequence.
Keysight 1000X hack attempts: https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg1154923/#msg1154923 (https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg1154923/#msg1154923)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on May 01, 2017, 07:01:27 pm
Done ..tried another nk.bin but crashed too ..so i put 2.35 inside a folder  and with booted scope i did the update to 2.35 everything fine  :P

Well done... any idea what caused this? Probably not but good to see that you made it this far  :-+

You might as well update a bit further to get the corruption prevention, 2.41 should be fine.

really no idea what i happened , now i need to read well the 3ad if and how prepare modified stick
and let untouched internsl flash ...by the way this the orrible self made home lan card

 ::)
(http://oi65.tinypic.com/fthptx.jpg)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on May 01, 2017, 07:09:50 pm
Anyone got recommendations (tips/tricks) on how to attack the InfiniiVision 1000 X-Series? Unlock the three licenses DSOX1EMBD, DSOX1B7T102 and DSOX1AUTO.

Does it have a RS232 console port? I'd start by logging the boot sequence.
Keysight 1000X hack attempts: https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg1154923/#msg1154923 (https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg1154923/#msg1154923)

Ah yes, I totally forgot about that one  :palm:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on May 01, 2017, 07:12:09 pm
by the way this the orrible self made home lan card

Well, it did the job so it's excellent :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheAmmoniacal on May 02, 2017, 02:13:50 pm
Anyone have a good photo (high res, IC models visible) of the 2000 X series, PCB area where the LAN connects?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on May 02, 2017, 04:48:10 pm
Anyone have a good photo (high res, IC models visible) of the 2000 X series, PCB area where the LAN connects?
Lan card have a edge connector 80pin its very well visible in the right hand side around the center in vertical
but they asked if you have serial connector inside my 2012a there only 1 connector 2 rows with 5 pin if you look at this
3ad past pics there also pinout.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on May 03, 2017, 04:37:34 pm
Are you working with firmware version 4.08.2016071801?

I've been trying at this, but even an unpatched infiniiVisionCore.dll from the firmware image is giving me issues. With CFF Explorer, you can see its header has the machine type set to MIPS R4000, yet the disassembled instructions only make sense if you treat it as ARM.

About version 4.08 - no, sorry, have no any versions older than 7.10 for my scope. Very interest to look at this update pack.

By the way, have anyone the oldest update files by these MSOX300T? Will be great if you can share older files here.

About dll.
Mmm.. Yes, I saw this strange thing with it (MIPS), but after editing of one sign byte in this .dll file, the IDA detects this dll properly and disassemble it successfully, as ARM. Say more, the lot of DLLs inside nk.bin are have sign "MIPS" but have a code absolutely not for MIPS MCU. I think, the WinCE core ignore this sign byte, maybe this byte was maded for us, for make disassembly impossible. It's my opinion only.

Now, because have no DSOXLAN, I have a fight with MagJack for LAN pcb - can't found it somewhere not far from me... Thinking, for the first probe, use the usual separated pair of LAN frontend: transformer pack + usual LAN connector.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Daxxin on May 03, 2017, 04:47:37 pm
For what i remember MIPS R4000 was the chip of playstation 1 ..so far away years ago  or SGI graphics workstation Unix Irix driven.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on May 03, 2017, 05:20:02 pm
I got the same when working on the Flir E4, also WinCE:

https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg317292/#msg317292 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg317292/#msg317292)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on May 03, 2017, 06:33:01 pm
Tested here in a 2014A, firmware 2.42 the LAN hack still working to me.

I don't remember if it is discussed before, but when --help, it has --4GSa and --5GSa, but seens to take no effect on DSOX2000.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on May 03, 2017, 06:57:14 pm
I don't remember if it is discussed before, but when --help, it has --4GSa and --5GSa, but seens to take no effect on DSOX2000.

There's no need for --help, when you do something invalid like --eevblog it will spit out the options also :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on May 03, 2017, 07:53:56 pm
I don't remember if it is discussed before, but when --help, it has --4GSa and --5GSa, but seens to take no effect on DSOX2000.

There's no need for --help, when you do something invalid like --eevblog it will spit out the options also :)

Yep, it did it with the --forcemaxmem option. But the --perf is ok.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Ivan7enych on May 10, 2017, 07:46:32 am
Thanks to all, who made this mod possible!

I've got on ebay DSOX3014 model, already unlocked to 200MHz.

with -l BW20 unlock it shows 1.7ns rise time,
after all required components replacement to 350MHz model it shows 940ps rise time,

with -l BW50 option it shows 660ps rise time
and 600MHz signal looks very good (little amplitude drop) and trigger is very stable (actually trigger works well up to 1GHz, but amplitude drops significantly).

It was tested with NWT6000 board (25M-6GHz), it generates good rectangular shape signals, at least my old tek 744 -> 784 sees 350ps rise time.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sportq on May 11, 2017, 02:42:45 pm
If anyone needs a DSOXLAN I've got 2 left over from an OSHPark order (minimum order is 3 pcbs). Assembled and tested.

UPDATE: Both boards now sold.

Pete
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on May 11, 2017, 03:37:27 pm
The "tramp" version of DSOXLAN PCB, with standalone pulse transformer and SMD RJ45 Jack. Was made for the items from my trash under the table  :D
If anyone have interest, I can present the gerbers of this pcb.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tivoi on May 17, 2017, 04:26:35 pm
you mentioned "bricked the scope" ,i'm not good at english ,does it mean this way may be harmful to scope  ,such as breaking the scope ?
DE BD7JAT
Yes, a wrong step or wrong link might lead to your scope being unusable, and you'd need to send it back to the factory for repair.
That being said... has anyone actually BRICKED their scope yet? I don't remember of one but eh... it's quite a long thread.

Also, I've attached the file all inside a zip. The steps are basically :

1) Extract all files (including the .lnk) to the root of your usb drive
2) From the scope's front panel, press Utility ->File Explorer -> Press to go to: <USB Drive label>(usually "usb")
3) From the drop down, scroll to the v241_link_install.cab to select
4) Press Load file

The scope will ask for your confirmation and then it will load/update and reboot.

FYI, my link file is :
160#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO --perf -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l TOM -l BW20 -l ADVMATH -l EMBD -l EDK -l VID

the other cab uninstall the link file and restores your previous setting.

Cheers

i was test with dsox2014 V2.42 , it work well
thanks you
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on May 20, 2017, 02:52:29 am
Bumping up this thread again. I am still dreaming of the 1 GHz mod for the 3000T series - we're still looking for someone to remove and measure a few capacitors from the front end of one channel(from a 3104A or 3104T). Or someone sell me one for a reasonable price and I'll measure the caps. I am also offering a reward of an Agilent 2.5 GHz active probe with case and accessories to the person who gets the values for us. I'll pay for shipping anywhere in the world as well.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheCloser on May 21, 2017, 04:37:50 am
Hi guys,
please forgive me if this question has been asked and answered before (I have read the last 30 pages or so) - How can you tell which number to put at the beginning of the the file - I've seen all sorts of numbers - 53#, 160# and etc.
Thanks in advanced!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on May 21, 2017, 04:41:16 am
The number in front of command line is the count of characters in it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheCloser on May 21, 2017, 05:23:05 am
Great!
Many many thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on May 21, 2017, 11:43:58 am
Count of all symbols after #
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: daflory on May 21, 2017, 07:26:13 pm
The "trump" version of DSOXLAN PCB, with standalone pulse transformer and SMD RJ45 Jack.   :D
If anyone have interest, I can present the gerbers of this pcb.

This a beautiful LAN card. I especially like the fact that it has LED's and nicely radiused edges. That big pulse transformer also inspires confidence.
Did you design this yourself? Do you have any for sale, or that gerbers you mentioned with a BOM?
Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on May 28, 2017, 08:15:47 am
Thanks for your kind words, but this pcb and schematics are really simplest.  ;D
It was developed for my MSOX3034T, I will post the gerbers and schematics of this pcb, just need to collect all in a pile and organize...  :D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on June 02, 2017, 10:00:25 pm
It should work as long as you have the 2.41 Firmware.
Not sure if there's any new firmware since then... hmmm

As far as I've remembered, someone with 3000X also tried this method some time back with success, and the command in the switches in the link are taken from the 3000X series with trial and error to see which options works for the 2000X series.

New 1000X series is another different can of worms but might work... who wants to be the sacrificial lamb and test it on their 1000X ?  :-/O
Looks like 1000X series has a different firmware update approach.  I tried running the uninstall.cab and 1000X does not know what to do with it.  I changed the extension to .ksx (like the new 2.42 2000X / 3000X firmware) and the same error.  I also created new .cab file trying to verify directory content of \Secure and write the content to \usb and I get the same error.  Until a new firmware is released by Keysight for the 1000X series, it is an unknown territory...
Well, I tested again today.  It looks like on 1000X the recipe.xml file was renamed install.xml (Thanks Daniel for posting the FRA patch).  Regenerated the .ksx file using makecab on windows and I was able to install the infiniiVision.lnk file from USB (Using v241_link_install.cab hack method).  The only problem is that it activates 200MHz but does not take any other option like the 2000X / 3000X. I tried -l DIS, -l ALL, -l EMBD, -l COMP, -l AUTO... and I cannot enable serial decode.  I even removed -l BW10 and still get 200MHz activated (but I think it is limited by hardware to 70-100MHz... I have a modded EDUX1002G).

It adds an interesting Attenuation Compensation Test to the Service Menu (picture attached)

Note: same information was posted in the 1000X hacking thread.  I recommend posting followup discussions on this thread: https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg1224021/#msg1224021 (https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg1224021/#msg1224021)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: BlueX on June 05, 2017, 01:03:09 am
Please could anyone confirm that the hack (lan/telnet) works for the model DSOX 3014T? Thank you.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on June 05, 2017, 11:50:37 am
About MSOX3000 - Yes, confirmed.
By my opinion, no difference between MSOX, DSOX or other similar tool in plane of licensing.

p.s. Please don' ask me "how", because our "serene" life will end quickly. Just read carefully all pages of this thread, from start to end, and do not be afraid to make experiments with your scope. :D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jwalling on June 05, 2017, 06:54:16 pm
Yes, confirmed.
Please don' ask me "how", because our "serene" life will end quickly. Just read carefully all pages of this thread, from start to end. :D

Yeah, it's only 1600+ posts to read. Don't be lazy!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on June 05, 2017, 06:57:52 pm
Yes, confirmed.
Please don' ask me "how", because our "serene" life will end quickly. Just read carefully all pages of this thread, from start to end. :D

I wouldn't buy a T series scope hoping to hack the software options right now...  I'm not aware that anybody has done it and yes I've read all the pages of this thread since the beginning.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on June 05, 2017, 07:44:09 pm
I wouldn't buy a T series scope hoping to hack the software options right now...  I'm not aware that anybody has done it and yes I've read all the pages of this thread since the beginning.

+1

but if anyone wants to send me a T version I'd be happy to give it a try :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: [IDC]Dragon on June 05, 2017, 08:57:57 pm
Yes, confirmed.
Huh, did I miss something? At least I'm not not aware of a way to unlock the T, deliberately bought a non-T last model year.
Quote
Please don' ask me "how", because our "serene" life will end quickly.
C'mon, we've also had this.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: BlueX on June 06, 2017, 01:15:42 am
ELIK, do you have a 3000T series oscilloscope? I read almost half of the posts and could not find references about someone who has played with a 3000T.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on June 06, 2017, 10:48:48 am
ELIK, do you have a 3000T series oscilloscope? I read almost half of the posts and could not find references about someone who has played with a 3000T.

- Yes I have it now.  :D




Hi group,

Take a look at this eBay item 172559013145

http://www.ebay.ca/itm/KEYSIGHT-Infiniivision-MSOX3034T-Mixed-signal-Oscilloscope-350Mhz-MEGA-ZOOM-/172559013145?hash=item282d519519:g:GqYAAOSwhlZYuQIj (http://www.ebay.ca/itm/KEYSIGHT-Infiniivision-MSOX3034T-Mixed-signal-Oscilloscope-350Mhz-MEGA-ZOOM-/172559013145?hash=item282d519519:g:GqYAAOSwhlZYuQIj)


I have good reason to believe that it has been 'hacked'.

Regards,

Jay_Diddy_B

(It may have been an extreme teardown)

A time to open a small secret: I am a "happy buyer" of this item... (laugh and tears).
Tears really, because it was wounded hardly inside and outside.
By the black spots on the face of tool, I think someone was drive on the car across this oscilloscope, the face had a tire tracks crossing of front panel.
My eyes see a picture - the man left so crazy expensive tool on the road behind his car. And while bla-bla-bla via the phone, he forgot that the device is not in the trunk, he sat behind the wheel and drive the car back.

1. Was sacked inside - there is no AC power module, no cables by the power module, no vent.fan inside. Not fatally, because this AC-DC power module produces just one voltage (13V), can be changeable with other with 100W and more power, same as vent.fan. The multi-wire power cable between the main pcb and the secondary power board was maded simply, was cutted by the 2 dead computer 24-pin ATX power supplies - they have absolutely similar connectors(!).

2. The PCB has a deep crack near of LAN box - butnot fatally. As it turned out, no really important wires are not interrupted.

3. All 4 big BGA MCUs was detouched with copper padstacks (partially) due to strong bending of the Board. Padstacks of BGAs was partially stay on the pcb but detouched, partially was torn and stay on the chip's balls. Horror of course, but week of hard job with microscope, and all 4 chips was soldered back on repaired padstacks.  :D

Thank to all Gods that the thieves-repairmen not stuck their noses under the aluminum cover of the main Board, otherwise if just one of detouched MCU have been lost, then there would be no chances in repairing of this tool.

The LCD 8.5" (without touch panel - it so rare, can't found cheap) was ordered in Ebay, 45USD with delivery.
"8.5" Original AUO G085VW01 V.3 INDUSTRY LCD Screen Display"
http://www.ebay.com/itm/381681332559?_trksid=p2057872.m2749.l2649&ssPageName=STRK%3AMEBIDX%3AIT (http://www.ebay.com/itm/381681332559?_trksid=p2057872.m2749.l2649&ssPageName=STRK%3AMEBIDX%3AIT)
-if someone will be need it, but I think be better to find V.1 or V.2 version, because this smooth V.3 by my tests and even by it's datasheet, have no pin used for turning image upside down, need to turn this display physically...

There was many of not so fatal damages inside, I am lazy to describe all. The back cover was repaired too, by me.
But now I can tell one - the tool is working now. It's really great tool, I am in love!! :D

Could anyone explain me exactly, what is the MAIN difference between MSOX3000T and MSOX3000A?  :popcorn:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: lowimpedance on June 06, 2017, 12:12:08 pm
Jeez I would love to see a photo of the 'lazarus' 3000T now functional after that horrid treatment.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on June 06, 2017, 01:07:04 pm
 :-DD
No problem, but just after june 8th. Now I am still in vacation, not at home.
Because I do not had the hope to revive him, did not make pictures of the destruction and recovery, have only a few pictures, all pictures are left in my home PC.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: azer on June 06, 2017, 04:42:38 pm
Could anyone explain me exactly, what is the MAIN difference between MSOX3000T and MSOX3000A?  :popcorn:

The main difference is that the "T" has a touch screen. Except for that I believe they should be mostly the same spec and functionality wise.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on June 06, 2017, 05:43:31 pm
Absolutely TRUE!
So, therefore, why you are believe that for the oscilloscope that just have a touchscreen panel with small additional pcb inside, such tool must have a super-mega improved licensing software inside, against of tools without touchscreen???  ;) :D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on June 06, 2017, 06:13:17 pm
The T series also has a higher sample rate then the A for the 100/200/350/500 MHz models, it can display 8 measurements on screen instead of 4 and has zone triggering which is setup by the touchscreen. It probably has other additional features, maybe Daniel will chime in.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on June 06, 2017, 06:26:39 pm
It really doesn't matter in the case of a system of licensing in the firmware of scope. All these "increased speeds and channels" - are all just a nice bonuses for owners. There, according to all our experiments so far, the licensing ways are absolutely common for all known models 1000, 2000, 3000.
Here is the gerbers of my DSOXLAN card (version with SMD JACK) (DSOXLAN_SMD.zip)

Here is the picture of DSOX3000T PCB, array of 4 MCUs, one of them (padstacks) already repired
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on June 08, 2017, 03:50:25 pm
Jeez I would love to see a photo of the 'lazarus' 3000T now functional after that horrid treatment.

All that is left in my PC
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on June 08, 2017, 07:46:32 pm
Does the 3000T have a VESA mount or was that a DIY enhncement?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on June 08, 2017, 07:53:06 pm
Does the 3000T have a VESA mount or was that a DIY enhncement?

That was his own DIY mod.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on June 08, 2017, 09:00:18 pm
Can anyone please measure the approx. height of knobs?
I want to try to find something like original...
Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on June 09, 2017, 09:45:28 am
For the achievement of getting that working again , I'm sure  Daniel would be happy to throw some knobs & cosmetic parts your way...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on June 09, 2017, 09:50:45 am
Can anyone please measure the approx. height of knobs?
I want to try to find something like original...
Thanks!

about 13.2mm

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cgroen on June 09, 2017, 09:52:21 am
Can anyone please measure the approx. height of knobs?
I want to try to find something like original...
Thanks!

about 13.2mm

Oh yes, ELIK should get a prize for that work :)
(A bag of knobs etc would be the right thing to do from Keysight  8) )
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: memset on June 09, 2017, 11:43:19 am
All that is left in my PC
OMG, that's prosto ofigenno, tovarisch!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on June 09, 2017, 12:10:27 pm
Ha-ha-ha, yes, crazy job.
Thanks for knobs measuring
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on June 09, 2017, 12:36:46 pm
Well looks this Keysight baby put in dust Dave's oscilloscope mud drugging survival test.  :clap:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Marchello on June 09, 2017, 12:38:31 pm
to ELIK:
Snimay shlyapu!!!
BEST WORK!!!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Andrey_irk on June 09, 2017, 01:28:13 pm
Ha-ha-ha, yes, crazy job.
Thanks for knobs measuring
Congratulations!

But how did you repair the case? I mean, at the back of the instrument. It looked exploded.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on June 09, 2017, 08:36:03 pm
Thanks for your kind words.
Yes, next step will be mount of touchscreen (one version by tablet may be applicable, just in a way from china), and soldering of new BNC connector "Gen.Out" - it was was hardly damaged. After ending of all internal repairs - yes of course, I will work with a file in hands...  ;D


But how did you repair the case? I mean, at the back of the instrument. It looked exploded.

- all pictures have names, please see carefully.  :D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HardDrive on June 10, 2017, 08:38:51 pm
The infiniivisionLauncher.exe --help on the latest firmware for the MSO3000T Series 7.10.2017042905 seems to display the help menu.
As was hinted by ELIK, there is a way to unlock the options on the MSOX3000T series.

I have not yet been able to make it permanant, but what I have done is:
1. Extract infiniiVisionLauncher.exe from 3000XSeriesT.7.10.2017042905.ksx -> infiniiVisionSetup\%InstallDir%\infiniiVisionLauncher.exe using the tools from abyrvalg's post
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg480432/#msg480432 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg480432/#msg480432)

2. Login with telnet with username:infiniivision and password from your scope mac address, using scripts posted by memset
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1115338/#msg1115338 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1115338/#msg1115338)

3. Copy the extracted infiniiVisionLauncher.exe to "\Program Files\infiniiVision\infiniivisionLauncher.exe" (via usb)
4. Execute "\Program Files\infiniiVision\infiniivisionLauncher.exe" -l WAVEGEN (or whatever options you want)
Code: [Select]
\windows> "\Program Files\infiniiVision\infiniivisionLauncher.exe" -l WAVEGEN
System has been running 1475.297974 seconds
*** Installing License: WaveGen license
System has been running 1484.592041 seconds

I do get some "System concerns detected" relating to Secure Storage being uninitialized. But the WAVEGEN option works now :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on June 10, 2017, 10:26:53 pm
:HardDrive

Excellent discovery, though I have one question for you..

Have you installed the new fw 7.10 before doing this test? Or are you using the infiniiVisionLauncher.exe from 7.10 in a scope with older fw?

Thanks in advance.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on June 10, 2017, 11:51:22 pm
Oh, I hope that your new scope will work OK after that terrible incident and surgery.
It is like some people in Russia never give up.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dubbie on June 10, 2017, 11:51:46 pm
Has anyone managed to do the 1Ghz upgrade yet?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on June 11, 2017, 03:01:09 am
3. Copy the extracted infiniiVisionLauncher.exe to "\Program Files\infiniiVision\infiniivisionLauncher.exe" (via usb)
Thank you for this information.  Was there a file named infiniiVisonLauncher.exe in the target directory before you did the copy?  What size does the extracted infiniiVisionLauncher.exe have?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HardDrive on June 11, 2017, 03:53:38 am
Have you installed the new fw 7.10 before doing this test? Or are you using the infiniiVisionLauncher.exe from 7.10 in a scope with older fw?
This is after upgrading the scope's FW to 7.10, did not try using the exe directly. Seem remembering --help not returning anything on 4.08.
However, on my scope, there were more features enabled in 7.10 compared to 4.08. I did not have the 'Training Signals' EDK option on 4.08.

Was there a file named infiniiVisonLauncher.exe in the target directory before you did the copy?
Yes, there was a file with the same name. I just replaced it, but it wont be permanent. Going to try the 'modified startup lnk files' way.

What size does the extracted infiniiVisionLauncher.exe have?
The extracted infiniiVisionLauncher.exe is 402376 bytes; the one in '\Program Files\InfiniiVision' is 5632 bytes; and another one in '\Secure\InfiniiVision' is 12104 bytes.
Strange thing about this is that I couldn't find the larger infiniiVisionLauncher.exe anywhere in the scope. The 12104 bytes one '\Secure\InfiniiVision' in doesn't start.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on June 11, 2017, 04:26:43 am
I have not yet been able to make it permanant,

What do you mean ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on June 11, 2017, 04:40:52 am
I have not yet been able to make it permanant,

What do you mean ?

He means having it enabled automatically every boot.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on June 11, 2017, 07:54:51 am
:HardDrive - thanks for your reply.. Starting with 7.10 Training Signals EDK  is a free option..

Probably the \Program Files\InfiniiVision file is just an envelope for the real executable and does strip the possibility to issue options..

I'll try this myself soon.. Thanks again..
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on June 13, 2017, 12:29:33 am
Ha-ha-ha, yes, crazy job.
Thanks for knobs measuring
Vpechatlyaet.....

Is it Tek mod BNC on 3d channel?[emoji15]

Sent via Tapatalk

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on June 13, 2017, 09:35:52 am
???
Please don't crypt your talk, it's a public forum.
Use traditional english.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on June 13, 2017, 09:41:24 am
???
Please don't crypt your talk, it's a public forum.
Use traditional english.
No problem :) It's like "so impressive"

And is it Tek mod indeed?

Sent via Tapatalk

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on June 13, 2017, 10:12:22 am
Sorry, understand now.  :D
Yes, channels 3 and 4 was moded for TEK differential probes like P5205.
I thought no one will notice...  :o
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on June 13, 2017, 10:24:40 am
Sorry, understand now.  :D
Yes, channels 3 and 4 was moded for TEK differential probes like P5205.
I thought no one will notice...  :o
Very interesting. Is it DIY PCB or you mounted standard Tek connector?
I have several Tek probes, and think about same mod.

Sent via Tapatalk

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on June 13, 2017, 10:39:20 am
There is no additional DIY pcbs. Just the sectors cutted of copper ring with CNC router, the holes drilled  at the outer edges of sectors, powered by the small wires soldered thru these holes. all additional was soldered at the bottom side of main buttons pcb. On the buttons pcb already mounted inverter with -14v output, I use it for cooking of +14V (shottky diode +inductor +tantal capacitor). And resistor for detect of probe by the tool, of course.
It's not best solution but enough for powering of P5205 probe.
I can do the pictures when open the tool next time.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on June 13, 2017, 11:21:10 am
I can do the pictures when open the tool next time.
Perfect! Very interesting mod. And picture also.

I think that +-12V would be enough for my probe (6245, 6249, 6330 - actually there only +15V pin used for convert it to +7V, so it work perfectly on +12V, and +-5V of course).

Anyway I think that your work deserve for separate topic (especially since we slightly deviated from this one). I believe that everyone will be interested to see this restoration.

Sent via Tapatalk

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on June 13, 2017, 11:25:37 am
Yes, you right. Little bit later will do it.

On the face pcb, the +12v and -12v is presented and stable (regulated) as I remember, will be good to use it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on June 13, 2017, 12:44:22 pm
Yes, you right. Little bit later will do it.

On the face pcb, the +12v and -12v is presented and stable (regulated) as I remember, will be good to use it.
Yes here was topic with Autoprobe interface description (hp patent actually), but 3000 series have lite version. There are  +-12 and -+5V unregulated and 400mA on all ports summary

Sent via Tapatalk

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on June 13, 2017, 12:59:11 pm
1. Extract infiniiVisionLauncher.exe from 3000XSeriesT.7.10.2017042905.ksx -> infiniiVisionSetup\%InstallDir%\infiniiVisionLauncher.exe using the tools from abyrvalg's post

I did with no tools, just rename .ksx to .zip, dive into it and in the .CAB file find the file with 402.376 bytes size. Extract and rename to infiniiVisionLauncher.exe

In subsequent firmware revisions the size may change though, but you get the idea.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on June 14, 2017, 05:41:44 pm
4. Execute "\Program Files\infiniiVision\infiniivisionLauncher.exe" -l WAVEGEN (or whatever options you want)

Did you try other options, can you confirm they work?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on June 14, 2017, 06:54:04 pm
I can confirm - BW50 and -ALL

Do any of you found a way to make this permanent? Haven't had the time to do some tests myself but I will soon if no one found a solution already..

Thanks..
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: laserK on June 14, 2017, 08:49:42 pm
Hi,

after some further digging I found a way into the 4000 series scopes. I can only speculate,but from the similarities of the firmware I assume that this way works also with the 3000T series. I have no hardware to test this.
The command line switch has moved, but it is still present. Since usb booting is not enabled you need a telnet login.
I patched the dll inside the nk.bin file. This is rather simple as the nk.bin is not compressed and you can just search for the binary values from the infiniivisioncore.dll rather than unpacking, paching, and repacking a new nk.bin. CRC32 values need to be computed correctly for each block in the nk.bin. viewbin.exe from the nkbintools was helping here (at least displaying block offsets and checksums).
The patched nk.bin can be booted from the WinCE bootloader with the help of CELoader. Therefore a serial adapter is necessary to stop the bootloader with "space". The pinout for the 115200 8N1 serial debug connection is the same as for the 2000/3000 series.
Once booted, the scope app can be killed and restarted with the command line options.
Alternatively to the CELoader one can also flash the patched nk.bin.comp (compressed with bincompress after patching) from usb via telnet:
Code: [Select]
\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
To undo, one just needs to do a firmware update (with same version number).

The above method works for v4.07. Not sure about v7.06 and v7.10.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on June 14, 2017, 09:07:18 pm
Hi :laserK,

As it seems for 7.10 there is no need to patch the .dll. Just swap the infinivisionLoader.exe and everything is working.

I'll try hopefully at the end of this week the usb method to see if there's any chance it was re-enabled in 7.10.

Thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on June 14, 2017, 09:53:13 pm
One thing I encountered in 7.10 and someone kind of confirmed it, is telnet login failing with "Logon Incorrect".

Let me know if anyone else encountered this and I can provide my take on it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on June 15, 2017, 05:57:00 am
Answer is already presented in this thread.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HardDrive on June 15, 2017, 11:34:02 am
One thing I encountered in 7.10 and someone kind of confirmed it, is telnet login failing with "Logon Incorrect".
The first login always return "Logon Incorrect". Just perform the login again, it should work the second time.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on June 15, 2017, 12:37:29 pm
I recall this is has to do with telnet having an extra character in the buffer at start. Just hit Enter to clear the buffer, then login. No need to type login information twice.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on June 16, 2017, 07:14:43 pm
Hi :Bud and :HardDrive,

I know what you are talking about, but this is not the case I have encountered.. "Login Incorrect" goes on until you need to restart the scope multiple times until it works..
I use a Mac terminal so there is no extra character at start.. 

Is any of you using the scope with a valid internet access gateway? It seems to me that after I disabled the valid gateway on the scope the issue vanished.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on June 16, 2017, 07:42:34 pm
I do not have a 3K yet, can't comment at this time.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on June 16, 2017, 10:52:33 pm
One thing I encountered in 7.10 and someone kind of confirmed it, is telnet login failing with "Logon Incorrect".

Let me know if anyone else encountered this and I can provide my take on it.

Too less info by you, there is no any source data for your case, just a result only. What you want by the people with such question???  :-//
Why do we need your "take on it"?
If you have a problem with that - please give a bit more information then someone can help you. There are no magicans, guess what you do there, what you use as "login/password" in your telnet as example.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on June 16, 2017, 11:36:01 pm
:ELIK

Read all my posts and you'll have all the info needed. No need to get upset in any way  ;)

I had a problem and I solved it.. Just wanted to let ppl know that if someone else has this issue I can provide my "take" (read solution) for it..
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on June 17, 2017, 12:14:49 pm
Okey, sorry for my misinterpretation of your messages.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on June 21, 2017, 06:18:21 am
Has anyone accurately measured the -3dB point of a 3104A or 3104T?
If not, is anyone up for checking it for me?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on June 21, 2017, 07:05:25 am
I did the A some years ago, it drops off brick wall like after 1.1 GHz. At 1GHz it was less than 0.8 dB down.

Will see if I have the screenshot
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Someone on June 21, 2017, 07:48:41 am
I did the A some years ago, it drops off brick wall like after 1.1 GHz. At 1GHz it was less than 0.8 dB down.

Will see if I have the screenshot
You posted it up and came to a very similar result to the unit I measured:
https://www.eevblog.com/forum/testgear/frequency-response-of-your-dso/msg192576/#msg192576 (https://www.eevblog.com/forum/testgear/frequency-response-of-your-dso/msg192576/#msg192576)
https://www.eevblog.com/forum/testgear/frequency-response-of-your-dso/msg427701/#msg427701 (https://www.eevblog.com/forum/testgear/frequency-response-of-your-dso/msg427701/#msg427701)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on July 06, 2017, 09:25:09 am
Hello all
I see the trouble: MSO-X3024A version of firmware 2.42, the try to adding anything to the empty "infiniivision.lnk" (INFINI~1.018) file in the infiniiVisionSetup.cab, causes after restart always the message on the screen "System concerns detected: OS version is not correct. Please reload system firmware". MD5 sum is correct, the content of .lnk is correct too ( lnk was checked on the previous versions - work well).

If I do the stop and restart infiniivisionlauncher.exe with options manually, via Telnet - all works fine.
The trouble come is only if I try to change this lnk file right in the filesystem (use permanent way without usb)...

Could anyone fix this problem in the installer pack?
Sorry, let me asking another: This trouble is only in my tool, or someone have it too?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bg8up on July 07, 2017, 03:03:14 am
The MSOX3000T's Nk include infiniiviaionlauncher.exe which decompress into folders /Windows and /program files/infiniivision everyboot,excep Version 3.xx.
In Version 4.xx or 7.xx, the infiniivisionlaunch is different as infiniivision.cab,it doesn't accept -l parameter.

Version3.xx is defined by /secure/startup/infxxx.lnk.
Version 4.xx and 7.xx,which define the startup parameter is not clear
The way to permanent options,should find out startup process and parameter in Nk.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on July 07, 2017, 11:11:58 am
Question is closed, trouble was fixed.  ::) My mistake was next: I am used the TotalCommander for packing back the content of "infiniiVisionSetup.cab".
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 13, 2017, 07:09:43 pm
Regarding the timebase quadrature encoder on the MSOX3000A, is it just mine/me, or does this very frequently miss clicks? It's my only irritation in an otherwise slick UI. Other knobs work fine.

In comparison, the MSO7000B and 54642D are perfect in this respect. Even the Tek MDO3000, renowned for its sedentary nature, doesn't actually miss QE inputs, although it might take a while to respond.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on July 13, 2017, 07:13:53 pm
Regarding the timebase quadrature encoder on the MSOX3000A, is it just mine/me, or does this very frequently miss clicks?

I never noticed this, but let's see what others think.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 13, 2017, 07:42:59 pm
Regarding the timebase quadrature encoder on the MSOX3000A, is it just mine/me, or does this very frequently miss clicks?

I never noticed this, but let's see what others think.

I am wondering if it's the encoder itself, the behaviour is sporadic but frequent and easy to reproduce, apparently aggravated by recent use, and doesn't seem to be affected by how much activity is actually going on on the scope.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on July 14, 2017, 01:47:23 am
I never noticed this, but let's see what others think.

Work well in my DSOX3034A
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 14, 2017, 06:01:31 am
I never noticed this, but let's see what others think.

Work well in my DSOX3034A

It seems to be much worse very recently, I am thinking now it may be a physical fault, hopefully a bit of switch cleaner will resolve.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on July 14, 2017, 07:28:40 am
I never noticed this, but let's see what others think.

Work well in my DSOX3034A

It seems to be much worse very recently, I am thinking now it may be a physical fault, hopefully a bit of switch cleaner will resolve.
Could also be a cracked solder joint or PCB track near the encoder. One way to diagnose this is to see if it gets better or worse if you apply a slight sideways force in various directions while turning
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 14, 2017, 07:30:52 pm
I never noticed this, but let's see what others think.

Work well in my DSOX3034A

It seems to be much worse very recently, I am thinking now it may be a physical fault, hopefully a bit of switch cleaner will resolve.
Could also be a cracked solder joint or PCB track near the encoder. One way to diagnose this is to see if it gets better or worse if you apply a slight sideways force in various directions while turning

The symptoms you mention were indeed there, however when I disassembled the unit there was no evidence of any bad joints. Rather than just re-touch them and re-assemble, I had a look in the parts drawers and found I had almost identical device in stock that fits perfectly and functions identically electrically with the right number of detents (24) and a push switch. Even the shaft is the right length and type. So I replaced the knob. It works perfectly.

The part is RS part number 6234237, and the manufacturer's details are Alps EC12E2424407.

The problem has been there since I bought the scope 18 months ago, but it wasn't that bad, I just put it down to Windows CE. It seems like it's been getting worse over time, but only now I've done anything about it as it became bad enough.

Edit: the job took about an hour and a half in total. Getting the old switch out is a chore, I snipped the leads in the end rather than risk ruining the PCB by trying to reflow it.

Edit 2: Coincidentally, this is the same encoder I used on a Rigol MSO1074z for the multi-finction knob mod.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on July 15, 2017, 03:44:28 pm
Regarding the timebase quadrature encoder on the MSOX3000A, is it just mine/me, or does this very frequently miss clicks? It's my only irritation in an otherwise slick UI. Other knobs work fine.

In comparison, the MSO7000B and 54642D are perfect in this respect. Even the Tek MDO3000, renowned for its sedentary nature, doesn't actually miss QE inputs, although it might take a while to respond.
I have an MSOX3104A and the timebase encoder gradually got worse over time with missing clicks.  At about 2.5 years old it was so bad I sent it back to Agilent for repair.  They confirmed the problem and replaced the encoder.  Plus refreshed the cal (that was nice since I wasn't expecting it.)

The encoder replacement was almost 3 years ago and now it's getting bad again.  Fortunately I have a service agreement, but I think it will be going back again within the next couple of months.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 15, 2017, 05:16:45 pm
Regarding the timebase quadrature encoder on the MSOX3000A, is it just mine/me, or does this very frequently miss clicks? It's my only irritation in an otherwise slick UI. Other knobs work fine.

In comparison, the MSO7000B and 54642D are perfect in this respect. Even the Tek MDO3000, renowned for its sedentary nature, doesn't actually miss QE inputs, although it might take a while to respond.
I have an MSOX3104A and the timebase encoder gradually got worse over time with missing clicks.  At about 2.5 years old it was so bad I sent it back to Agilent for repair.  They confirmed the problem and replaced the encoder.  Plus refreshed the cal (that was nice since I wasn't expecting it.)

The encoder replacement was almost 3 years ago and now it's getting bad again.  Fortunately I have a service agreement, but I think it will be going back again within the next couple of months.

Mine's still under its three year warranty, but I can't be bothered with the effort of sending it back, plus there's also the minor gratification of resolving myself. I am sure if it were someone else's company's scope I'd be doing a return but as I'm a one man band I don't mind having a go.

I looked at the service manual just before I started, looks like tere are no user serviceable parts, even at the module/board level, in Keysight's eyes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JeffreyLatter on July 17, 2017, 07:49:10 pm
Regarding the permanent mod on the 3000T series - Anyone managed succesfully to edit/replace files inside the nk.bin file?

BTW - Big thank you to all, who made these mods and discoveries available to us all!  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bigeblis on July 18, 2017, 01:07:53 pm
Today, when using the DSOX3012A measurement, inadvertently found that the signal input to the instrument more than 2Vpp, the offset will be too large when the wrong waveform. Specific settings and waveform parameters see figure.
Because my oscilloscope is MOD after upgrading the bandwidth, it can not confirm the BUG will not be the result of MOD. Have the original machine friends, you can test it?

English is not my mother tongue, so it may be bad to understand?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bigeblis on July 18, 2017, 01:19:58 pm
After I repeatedly tested, the key is the vertical sensitivity is equal to less than 200mV, the input signal amplitude is greater than 1.3Vpp, and then as long as the waveform is offset by a certain value, it will be seriously distorted.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on July 18, 2017, 05:14:10 pm
After I repeatedly tested, the key is the vertical sensitivity is equal to less than 200mV, the input signal amplitude is greater than 1.3Vpp, and then as long as the waveform is offset by a certain value, it will be seriously distorted.

The scope is warning you that you have CLIPPED the signal.  You are overloading the input of the scope by having a signal that is a greater voltage span (including your offset adjustment) than the range of the input circuitry.

This is a common mistake folk make that aren't aware of the scope's input working range.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bigeblis on July 19, 2017, 12:52:59 pm
Agilent is the same explanation.
But with such a setting to observe the bottom of the waveform details are very common operation, Tektronix models do not have such a problem.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on July 20, 2017, 11:52:24 am
Comrades,

Can anybody tell me is there exist patched version of infiniiVisionCore.dll for 2.42 DSOX3000A or something for fix LAN problem. It seems like this lib is not used in this firmware. I can't found it in the scope (in any places). And with unpacked one from 2.42 fw file I get critical error while loading scope with restart scope. Even with unpatched version.

And by some reason I put it not to Program Files/infiniivision/ only and to /secure section also and get cyclic restarting scope  :palm:

u-boot via CELoader and other "shaman medicines" did not help for me unfortunately (thanks guys for all advices in this mater). Seems like reloading kernel do not rewrite nand (think /secure section here)

Fortunately scope restarted cyclically and in shot time (several seconds) telnet server was started. I wrote macro for ttempro with log/pass and del infiniiVisionCore.dll from /secure. And it help for me (and spend about 6 hours) :D

So, best way for test - load only to Program Files which reloaded in each start.

Edit:

infiniiVisionCore.dll in \Windows folder and I can't copy it. When I try extract it from kernel files it doesn't work at all even unpatched. infiniiVisionCore.dll from v2.41 extracted by the same way worked normally.

Just tried patched infiniiVisionCore.dll from 2.41 - work good with 2.42 on my DSO3000 (but v2.41 in About and Web Interface and Probe only x0.1 :-[)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on July 21, 2017, 07:30:23 pm
I looked inside 2.42 and 2.41 NK.bin (or nb0) and found that difference is infiniiVisionCore.dll packed as "File" in 2.41 and as "Module" in 2.42. Files can be extracted normally and they have allocation table for normal run in each place, but Module don't have, it builded to specific address in ROM and contain several section (code, data, tables etc) in different addresses in ROM. Beside extracting it from ROM it is need to make allocation table.

This reason that extracted file infiniiVisionCore.dll from 2.42 image don't work and that I described in prev post
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on July 27, 2017, 02:50:47 pm
Hi,

I maked patch for infiniiVisionCore.dll directly in nk.bin in v2.42 (2017032900) FW for DSOX3000A. There 4 bytes for patch "04 00 a0 e1" to "00 00 a0 e3" in start address FBC7FFh and checksum in address D40457h changed from "EB" to "E9". Actually checksum contain 4 bytes, but changed only this last byte (first in file as it's little endian). Checksum algorithm is UByte8bit.

infiniiVisionCore.dll placed in Record [164]: Start in memory = 81111000h, Length = 55D528h, Chksum  of original nk.bin = 2604E8EBh
In nk.bin file this block started in D4045Bh and ended in 129D982h

Then nk.bin compressed by bincompress
Code: [Select]
bincompress.exe /c patched_nk.bin patched_nk.bin.comp
And flash it by loadP500Flash via telnet in scope
Code: [Select]
\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp

Think that replace nk.bin.comp in CAB file (with original name of course) should work also, but didn't try.

After this mod scope work normally and LAN also. I just make this start link in \secure\startup
Code: [Select]
211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

Don't included EDK and DVM as it is standard options in 2.42

Of course scope indicate that this FW is Ufinalized

Thanks laserK (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1233784/#msg1233784) and Elik for advices.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on August 14, 2017, 07:10:55 am
Just tried to upgrade my DSOX3032A firmware from 2.35 to 2.24 but scope refuses the upgrade with a message that the file format (.ksx) is unknown for it.
Could someone help me to post one of previous install package?

Thank you in advance.

Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on August 14, 2017, 07:13:40 am
Just tried to upgrade my DSOX3032A firmware from 2.35 to 2.24 but scope refuses the upgrade with a message that the file format (.ksx) is unknown for it.
Could someone help me to post one of previous install package?

Thank you in advance.

Georg
just rename it to .cab

Sent via Tapatalk
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sany1984 on September 01, 2017, 08:40:38 pm
Hello Guys,

I extracted kernel files and more via jtag nand dump, from my DSOX1102A, i have a correct nk0.bin file, the Content with this file Starts with B000FF, but the "bin2nb.py" says its not a B000FF image...
So okay, now i downloaded the WinCE Tools binmod....

Now, i used cvrtbin to convert the .bin to a nk.nb0 file, i wan't to extract the files via dumprom, but this not works, the program does nothing over 10 minutes... takes this longer or can any one help me?

Thanks! :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on October 08, 2017, 04:44:53 pm
Is it established that the only way to hack the 3000 series scope after firmware 2.4x is through the LAN? Is there a USB method which works without giving the OS error?

Thank you everyone for all your work.
It works with 2.41 and 2.42  https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg989285/?topicseen#msg989285 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg989285/?topicseen#msg989285)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JeffreyLatter on October 11, 2017, 09:39:50 pm
I managed to make the mod permanent on the 3000T series, I will write up a little post about it, if it's of any interest?.  :)

But basically, the short version:
I compiled a exe that executes the extracted infiniivisionlauncher with the commandlines, placing this in the secure folder and my own exe in the startup folder, deleting the .lnk, modifying the registrylines for processStartupFolder.exe  and replacing the registry file in the nk.bin image, using a modified binmod.exe, finally reflashing the modified firmware package...  :-+

I am although not sure, if modifying the registry is needed - will need to do a reflash and test that....  ^-^
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on October 12, 2017, 09:49:14 am
I will write up a little post about it, if it's of any interest?.  :)
I assume, this is just a rhetorical question, isn't it?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: darkstar49 on October 18, 2017, 01:54:59 pm

maybe I missed something in this (very long) thread... but did anyone find out why the 100-200 (bandwidth upgrades) and 350-500 are given as 'field upgrades', while 200-350 and 500-1000 (are supposed to) require servicing ??? Was it 'just' to perform a (re)calibration, thereby justifying the steep prices ?? (ok, for 500-1000, there's apparently an acquisition board replacement with a 5GS/s board...)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on October 22, 2017, 10:41:59 am

maybe I missed something in this (very long) thread... but did anyone find out why the 100-200 (bandwidth upgrades) and 350-500 are given as 'field upgrades', while 200-350 and 500-1000 (are supposed to) require servicing ??? Was it 'just' to perform a (re)calibration, thereby justifying the steep prices ?? (ok, for 500-1000, there's apparently an acquisition board replacement with a 5GS/s board...)
Yes, board is replaced in 200-350 and 500-1000. Actually, different boards have same PCB and same ASICs with different frontend and switches sets. So it is possible DIY (I'm don't now details)

Sent via Tapatalk

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: darkstar49 on October 22, 2017, 07:32:09 pm

"board replaced for 200-350" ??? Are you sure ?? Many people have reported 3024 to 3054 upgrades without a problem...   hence my question...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on October 22, 2017, 07:57:57 pm
You can do it with component level replacements from 100/200 to 350/500. I would not say it's for a beginner, it needs reasonable SMD rework soldering equipment and skills. Considering the cost of failure, it's a risky endeavour.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on October 22, 2017, 08:01:34 pm
You can do it with component level replacements from 100/200 to 350/500. I would not say it's for a beginner, it needs reasonable SMD rework soldering equipment and skills. Considering the cost of failure, it's a risky endeavour.
I am so tempted to do this on my 3024a but I just don't want to take the risk on such an expensive piece of kit.

Thanks

Trev

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on October 22, 2017, 08:08:19 pm

"board replaced for 200-350" ??? Are you sure ?? Many people have reported 3024 to 3054 upgrades without a problem...   hence my question...

100% we are sure. It is all very well documented in this thread and I have extreme first hand experience with the mods. :):):)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on October 22, 2017, 08:20:33 pm

"board replaced for 200-350" ??? Are you sure ?? Many people have reported 3024 to 3054 upgrades without a problem...   hence my question...

If I understand "soft" upgrade is possible for 1 step only (and not for all steps), and I believe it is just relay connection different components for anti-aliasing filter.
Think that covering all possible steps is very complex solution for "software only" switching...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on November 02, 2017, 11:01:47 pm
Just finished my DIY project, dsox lan interface with usb console interface. 

What I've to do next is to buy a 3D printer :-DD
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on November 02, 2017, 11:06:47 pm
Just finished my DIY project, dsox lan interface with usb console interface. 

What I've to do next is to buy a 3D printer :-DD

Sweet!!!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on November 03, 2017, 02:44:44 am
Just finished my DIY project, dsox lan interface with usb console interface. 

What I've to do next is to buy a 3D printer :-DD

Did you join the  2 pins on the 'finger connector' for auto detect - can't tell since it's the 'other side' of the picture you posted.

No 3D printer really needed... I cut my original back/cover plate to hold my diy lan card - works just fine. Though I'm sure you could still use it as an excuse to get a 3D printer :)

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bicycleguy on November 03, 2017, 05:46:22 am
gamalot,
I have a DSOX2014A and am looking to make a dsox lan interface.  I think I missed somewhere in this little thread why a usb console interface might be useful.  Could you please illuminate me.

thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on November 03, 2017, 09:16:25 am
Just finished my DIY project, dsox lan interface with usb console interface. 

What I've to do next is to buy a 3D printer :-DD

Sweet!!!

Thank you!  :)

Just finished my DIY project, dsox lan interface with usb console interface. 

What I've to do next is to buy a 3D printer :-DD

Did you join the  2 pins on the 'finger connector' for auto detect - can't tell since it's the 'other side' of the picture you posted.

No 3D printer really needed... I cut my original back/cover plate to hold my diy lan card - works just fine. Though I'm sure you could still use it as an excuse to get a 3D printer :)

cheers,
george.

Yes, I did, it's on the bottom side.

About the 3D printer, I found a much better reason - I will buy it for my son!  :-DD

gamalot,
I have a DSOX2014A and am looking to make a dsox lan interface.  I think I missed somewhere in this little thread why a usb console interface might be useful.  Could you please illuminate me.

thanks

There 2 simple reasons to have a USB console interface:

1) the board looks empty if there is a LAN interface only

2) Just in case the LAN interface doesn't work
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Zucca on November 03, 2017, 11:27:29 am
There 2 simple reasons to have a USB console interface:

1) the board looks empty if there is a LAN interface only

2) Just in case the LAN interface doesn't work

2) doesn't work on the PC side?

So it is just a USB to ethernet converter? Confused.  :-\
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on November 03, 2017, 11:55:51 am
There 2 simple reasons to have a USB console interface:

1) the board looks empty if there is a LAN interface only

2) Just in case the LAN interface doesn't work

2) doesn't work on the PC side?

So it is just a USB to ethernet converter? Confused.  :-\

No, it is a  USB to UART converter.

Sometimes you may need the console, before the system starts successfully.

(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=57253;image)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on November 03, 2017, 01:32:56 pm
One more picture, no more confusion.  ;D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bicycleguy on November 03, 2017, 05:51:14 pm
One more picture, no more confusion.  ;D
Wow, your right, thats worth 1000 replies  :)

There 2 simple reasons to have a USB console interface:

1) the board looks empty if there is a LAN interface only

Looks are definitely important, even in test equipment!  Your board is really beautifully designed.  Have any extra you want to get rid of?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on November 04, 2017, 08:37:19 am
One more picture, no more confusion.  ;D
Wow, your right, thats worth 1000 replies  :)

There 2 simple reasons to have a USB console interface:

1) the board looks empty if there is a LAN interface only

Looks are definitely important, even in test equipment!  Your board is really beautifully designed.  Have any extra you want to get rid of?

I am very sorry to tell everyone a bad news - I've made a big mistake. This console interface does not work as expected.

When I designed it, I wanted to try my best to use the existing components on hand, so I chose STM32F072 for USB to UART conversion.

I chose to power it from the oscilloscope because that would simplify the circuit (an additional 3.3V regulator would be needed if power from the USB).

Now the problem is when the oscilloscope power is off, I can not see the virtual serial port on my PC, I need to modify the design to fix this bug.|O |O |O
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bicycleguy on November 04, 2017, 04:40:31 pm
... Now the problem is when the oscilloscope power is off, I can not see the virtual serial port on my PC, I need to modify the design to fix this bug.|O |O |O

I have another stupid question.  Why would this matter?  I guess maybe you want to play with the STM32F072 removed from the scope?

Still think it's pretty cool.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on November 04, 2017, 05:26:45 pm
was gonna say, if the scope is off anyway you can't use the port for anything. Once the scope is powered the port enumerates again, or..?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on November 04, 2017, 05:28:46 pm
It would, but it would likely take too long to be useful. If you're using the console port you probably want to be able to send a break within a second or two of power on when the bootloader runs. That means the port needs to exist and the terminal program should be ready and waiting.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on November 04, 2017, 05:48:26 pm
It would, but it would likely take too long to be useful. If you're using the console port you probably want to be able to send a break within a second or two of power on when the bootloader runs. That means the port needs to exist and the terminal program should be ready and waiting.

Yes, you are RIGHT!  :-+

That's the reason why I need to fix this bug, otherwise it's useless.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bicycleguy on November 04, 2017, 07:06:59 pm
I would think that the STM32F072 could be programmed to put out the req'd characters at the appropriate time after it's boot.  It could certainly beat a human.  You would have to set some non-volatile variable to whether you wanted it to do so or not.  It wouldn't have to wait for the terminal to come up, maybe just bit-banging the transmit pin before even starting the terminal would be the easiest
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on November 04, 2017, 10:20:30 pm
I would think that the STM32F072 could be programmed to put out the req'd characters at the appropriate time after it's boot.  It could certainly beat a human.  You would have to set some non-volatile variable to whether you wanted it to do so or not.  It wouldn't have to wait for the terminal to come up, maybe just bit-banging the transmit pin before even starting the terminal would be the easiest
Think that  more easy just feed STM from USB. And hope that cut pcb track and resold LDO to USB connector would be enough
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on November 04, 2017, 10:30:06 pm
Think that  more easy just feed STM from USB
And add a 500mA PTC fuse to the 5V line.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bicycleguy on November 07, 2017, 12:12:15 am
Thought I'd look at my suggestion of a few posts ago.  I don't have a STM32F072.  Just for fun I tested an Arduino nano and a Teensy 3.6 to see how long it takes them after power up to put out a character.  The nano  1.45 seconds,  the Teensy 402ms.  I'm not ready to try this inside my scope yet.

Made a scope trace:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on November 07, 2017, 08:48:12 am


Thought I'd look at my suggestion of a few posts ago.  I don't have a STM32F072.  Just for fun I tested an Arduino nano and a Teensy 3.6 to see how long it takes them after power up to put out a character.  The nano  1.45 seconds,  the Teensy 402ms.  I'm not ready to try this inside my scope yet.

Made a scope trace:

Is it processor start time on UART side only? Or with USB wakeup and send some info from terminal app on PC? (but IMO USB response strongly depending from PC, OS etc)

Sent via Tapatalk

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bicycleguy on November 07, 2017, 05:23:29 pm
Is it processor start time on UART side only? Or with USB wakeup and send some info from terminal app on PC? (but IMO USB response strongly depending from PC, OS etc)
This is just the time for his UART chip (which is really a 32 bit ARM microprocessor that contains a UART  :) ) to boot up and serial.write("    ..") to the I/O pins.  All the time is the normal boot stuff required for the chip to determine the voltages and clocks are stable enough to run.  This would all happen before any USB comm is established.  You just need to know what to print (spaces?) and when to print it to get the DSOX in the right state.  You don't even care what the response is.  After that you'd start the USB stuff and takeover the same I/O pins for the regular comm session.

I'm pretty sure the STM32F072 chip could do the same and beat the micro in the DSOX to the point the input is needed.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on November 07, 2017, 06:52:02 pm
Thank you guys for all your suggestions and advice, I have ordered a new version of the PCB yesterday, hope to get them next Monday.  ;D

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on November 07, 2017, 07:19:47 pm


This is just the time for his UART chip (which is really a 32 bit ARM microprocessor that contains a UART  :) ) to boot up and serial.write("    ..") to the I/O pins.  All the time is the normal boot stuff required for the chip to determine the voltages and clocks are stable enough to run.  This would all happen before any USB comm is established.  You just need to know what to print (spaces?) and when to print it to get the DSOX in the right state.  You don't even care what the response is.  After that you'd start the USB stuff and takeover the same I/O pins for the regular comm session.

I'm pretty sure the STM32F072 chip could do the same and beat the micro in the DSOX to the point the input is needed.

And don't forget that after stop command Scope bootloader send some info that need to saved in buffer and sent it to PC after USB has been connected AND AFTER opened Term App (or Opened it before).

It is also can used as solution but I think that it is little bit complex. In my opinion UART here should be a "border" interface between Scope and PC+USB2UART converter. Not USB. For this is enough just feed converter from PC side (USB).

In this case you can use it like  standalone USB2UART Conv.

For me personally is enough 3wired DuPont cable that I hide in VGA slot (as there a lot of space) as I needed it one time only. And I have several converters that I can also use in another projects.

In any way I still consider this solution interesting




Sent via Tapatalk

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hugoneus on November 08, 2017, 04:13:09 am
Can you kindly share the schematic and layout files of your network interface card? Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on November 08, 2017, 09:47:21 am
Can you kindly share the schematic and layout files of your network interface card? Thanks!

Yes, I'm very happy to share my design, I'll do it (schematic, PCB layout, and firmware) once I get the new PCB and make sure it works.

Just out of curiosity, I've watched almost all your videos and I feel like I've never seen any DSOX2000/3000 oscilloscope in your lab.

 ;D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: hv222 on November 12, 2017, 11:53:20 pm
Hi,

Could someone check connection between LAN8700C and SPEAR600-2, please? I'm want to add LAN to 1000x series scope, but it don't have PHY, but it have unmounted connector with MII ethernet pins. I'm not sure about pull up and pull down resistors. I colored expected connections on Dave teardown pictures. Please measure value of pull up or pull down resistor on LAN8700C pins: 3, 9, 10,11, 12, 15, 16, 17,18 and 36 if they exist. Expected resistance between LAN8700C and SPEAR600-2 is around 51ohm.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JeffreyLatter on November 15, 2017, 07:44:06 pm
So - I've been a little busy, but as promised - the permanent mod for the 3000T series. - Tested on 3000XSeriesT.7.10.2017042905.ksx  :-+

After some testing, I found out that the registry edits to the regdb wasn't needed and all the mod takes is a exe, that call the infiniivisionlauncher.exe with our commandlines.
As I am no programmer, I found a source code in the CE sdk to do the job, compiled a exe and deleted the lnk in the startup folder, placing the exe here and copying the full infiniivisionlauncher.exe to the secure folder, as all exe's in the startup folder will be launched and as a result creating the "bootloop" problem.

I have created a zipfile with the needed exe's, a readme file and a script to do the job of copying.
The script will also copy a backup of cal-data to the usb stick, as I had a incident during all this testing, where the scope reported it gone, sp just to be safe.  :-BROKE

Use it at your own risk! - But I have done quite some testing using the script, after reflashing firmware and no problems.  :)


EDIT:
New version of the mod available for the 3000T Series - Tested on 3000XSeriesT.7.10.2017042905.ksx!
After a couple of PM's from Pinkus, I have modified the application to read the commands from a textfile for easy modification.
Futhermore the application will check for existing infiniivision.lnk and infiniiVisionLauncher.exe in the \Secure\Startup folder and delete if any, as to avoid a bootloop situation after a system update.
(I will advise to remove the mod prior to updating just to be safe, but anyway)

Also if no command.txt is found, a new will be created with a default option of "-l all".
 :-+

As always - Use it at your own risk!
REMOVED ATTACHMENT FOR REVISION OF README
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on November 15, 2017, 08:11:56 pm
So - I've been a little busy, but as promised - the permanent mod for the 3000T series.  :-+

After some testing, I found out that the registry edits to the regdb wasn't needed and all the mod takes is a exe, that call the infiniivisionlauncher.exe with our commandlines.
As I am no programmer, I found a source code in the CE sdk to do the job, compiled a exe and deleted the lnk in the startup folder, placing the exe here and copying the full infiniivisionlauncher.exe to the secure folder, as all exe's in the startup folder will be launched and as a result creating the "bootloop" problem.

I have created a zipfile with the needed exe's, a readme file and a script to do the job of copying.
The script will also copy a backup of cal-data to the usb stick, as I had a incident during all this testing, where the scope reported it gone, sp just to be safe.  :-BROKE

Use it at your own risk! - But I have done quite some testing using the script, after reflashing firmware and no problems.  :)

You should probably mention which version of firmware this has been tested with. The 3000T received an update last week.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JeffreyLatter on November 15, 2017, 08:17:39 pm
TheSteve - Great point! - it's tested on the 3000XSeriesT.7.10.2017042905.ksx
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: hv222 on November 22, 2017, 05:06:09 pm
Hi,

Could someone check connection between LAN8700C and SPEAR600-2, please? I'm want to add LAN to 1000x series scope, but it don't have PHY, but it have unmounted connector with MII ethernet pins. I'm not sure about pull up and pull down resistors. I colored expected connections on Dave teardown pictures. Please measure value of pull up or pull down resistor on LAN8700C pins: 3, 9, 10,11, 12, 15, 16, 17,18 and 36 if they exist. Expected resistance between LAN8700C and SPEAR600-2 is around 51ohm.

Schematic look good, because it works. However infiniivisionlauncher.exe in 1000x series is not supporting -l command. Is any other option in 2000/3000/4000/6000x series to enable license?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: big5824 on November 24, 2017, 10:47:24 am
I'm trying to find a copy of the DSOX2002A v2.35 firmware, but it doesn't appear to be available on the keysight website anymore. Has anybody got a saved copy they can share?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on November 24, 2017, 11:46:55 am
I'm trying to find a copy of the DSOX2002A v2.35 firmware, but it doesn't appear to be available on the keysight website anymore. Has anybody got a saved copy they can share?

https://www.dropbox.com/s/syr4fwujkcdcwu8/2000XSeries.02.35.2013061800.cab?dl=0 (https://www.dropbox.com/s/syr4fwujkcdcwu8/2000XSeries.02.35.2013061800.cab?dl=0)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on November 27, 2017, 02:47:39 am
If anyone wants a quick and dirty USB to UART converter, just use one of the FTDI USB to serial cables.  Their 3.3V version is PN: TTL-232R-3V3.  It's around $20 at Digikey and others.  It has a type A plug at the USB end and a single in line female 0.1" OC at the other end.  You need to install the FTDI driver on your PC but is handles many (most) FTDI devices.

We use them all the time with Putty.

Den
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on November 27, 2017, 03:05:20 am
If anyone wants a quick and dirty USB to UART converter, just use one of the FTDI USB to serial cables.  Their 3.3V version is PN: TTL-232R-3V3.  It's around $20 at Digikey and others.  It has a type A plug at the USB end and a single in line female 0.1" OC at the other end.  You need to install the FTDI driver on your PC but is handles many (most) FTDI devices.

We use them all the time with Putty.

Den
SparkFun sells a similar cable for only $17.95.  Available on amazon prime for the same price.

https://www.amazon.com/SparkFun-4446819-FTDI-Cable-5V/dp/B00DJBNDHE/ref=sr_1_4?ie=UTF8&qid=1511751898&sr=8-4&keywords=ftdi+cable (https://www.amazon.com/SparkFun-4446819-FTDI-Cable-5V/dp/B00DJBNDHE/ref=sr_1_4?ie=UTF8&qid=1511751898&sr=8-4&keywords=ftdi+cable)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on December 02, 2017, 02:09:40 pm
DSOXLAN just showed up this morning for $201 at Newark.  It was $402 yesterday !

Someone was watching over me (besides my wife) when I did not click the submit order button  :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on December 02, 2017, 02:53:20 pm
DSOXLAN just showed up this morning for $201 at Newark.  It was $402 yesterday !

Someone was watching over me (besides my wife) when I did not click the submit order button  :)

I see a lower price on the Keysight website as well.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Xavier64 on December 05, 2017, 04:55:08 pm
a BIG BIG thank you to all who made this possible.


I like to share my knowledge:

I have a MSOX3034A with Firmware 2.42


I used this infiniivision.lnk

98#\secure\infiniivision\infiniivisionlauncher.exe -l all -l bw50 -l SCPIPS -l SGMC -l CABLE -l PERF


along with the .lnk installer from 2.41:

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=309258 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=309258)

and..... It worked and is permanent on every restart. NO telnet :-)



Thanks again to all of you!

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Zucca on December 05, 2017, 05:07:23 pm
Nope, no one has done it yet.

 ;D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on December 08, 2017, 05:45:47 pm
Does anyone know if the 50ohm term in sub GHz models has the same control signal as the 1ghz?  If so, would it suffice for an upgrade, perhaps with degraded return loss ... But I guess in time domain you're gonna get poor pulse response.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on December 08, 2017, 06:00:25 pm
You’re asking if the 2000X model has the trace for the 50 ohm path?

Since all the 3000X models have it, also the 100MHz bandwidth one.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on December 08, 2017, 06:16:59 pm
Not the 2000.  I was wondering if the 3024 or 54 have the rf relay (Teledyne)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on December 08, 2017, 08:43:40 pm
Not the 2000.  I was wondering if the 3024 or 54 have the rf relay (Teledyne)

For the 3000A series only the 1 GHz model supports the Teledyne attenuator.
For the 3000T series all bandwidth models use the same PCB which have the pads for the Teledyne attenuator but you can't use it with a model under 1 GHz as the attenuation ratios/switch points are different.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on December 09, 2017, 01:10:39 am
Thanks.  I forgot that the part was an attenuator.  Has anyone tested the response of a 500MHz front end to a 1GHz signal?  It sounds like some wanted to but having a working scope was a higher priority  :)



Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on December 09, 2017, 03:08:04 am
The signal will be heavily attenuated at 1 GHz. I don't think there is any realistic way to actually mod a 100-500 MHz 3000A to 1 GHz because of the firmware changes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on December 11, 2017, 02:55:48 am
It's only a couple of bits ... in the right places.  Thanks for answering my poorly worded post.  This thread has me thinking in multiple parallel and orthogonal directions  :)  I did go back through the thread and found your comments from last year on the problem with sensing the relays.

I wonder how Tek pulled off using plain old Aromat relays for the TDS784D (1GHz) and lower BW models.  The front ends are in overall Faraday cages and I suppose if they behave consistently, you can model and compensate for their transmission path.  But then again, I've never compared high speed signal faithfulness of an Agilent to the Teks.  I have compared Agilent triggers to Tek triggers but we don't want to go there.  I still have a TDS694C that triggers up to 3GHz with ease.



Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on December 11, 2017, 06:09:54 am
It's only a couple of bits ... in the right places.  Thanks for answering my poorly worded post.  This thread has me thinking in multiple parallel and orthogonal directions  :)  I did go back through the thread and found your comments from last year on the problem with sensing the relays.

I wonder how Tek pulled off using plain old Aromat relays for the TDS784D (1GHz) and lower BW models.  The front ends are in overall Faraday cages and I suppose if they behave consistently, you can model and compensate for their transmission path.  But then again, I've never compared high speed signal faithfulness of an Agilent to the Teks.  I have compared Agilent triggers to Tek triggers but we don't want to go there.  I still have a TDS694C that triggers up to 3GHz with ease.

You could change the filters on the 500 MHz model and likely get usable or close to usable 1 GHz bandwidth. The only thing you'd still be missing is the fastest timebase.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on December 12, 2017, 03:19:38 am
That's pretty much what I was thinking.  Not going to do it though, may pick up a 500MHz unit after I assess my needs, and stick with that as I have faster scopes.

Not to shift gears here but I popped a new DSOXLAN into my new (NOS) 2000a scope.  Prints fine across the LAN but very disturbing to see the LAN "bugs".  The scope had 2.41 "upgrades" applied which worked fine (though "unfinalized" ...)

Attempts to change LAN settings each resulted in a "may take time to apply" message, and were never applied.

Reading the entire thread answered all questions.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on December 12, 2017, 04:13:32 am
Interesting, ran the 2.41 uninstall cab and the LAN settings all work correctly.  The random information is gone.

What's up with that ?

Reading the entire thread answered all questions.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on December 12, 2017, 12:16:14 pm
LAN bugs is "normal" for this option of start scope. You need to patch infiniivisioncore.dll for kill this bug. As 2000 and 3000a series use same firmware, as I remember, you can use some receipt described in this topic for fix it. I wrote one some times ago for last 3000a FW.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on December 12, 2017, 02:06:36 pm
Thank you.  I've found prior references as you mention.
Title: WinCE Cab Manager
Post by: Pinkus on December 16, 2017, 09:03:45 am
On my system I have a WinCE Cab Manager 3 which I installed three years ago and used only one time then. Of course it has expired three years minus 30 days ago. Uninstall and Reinstall does not make a difference - it recognizes (even after deleting registry entries etc.) a preceding installation and will not work.

OCP Software, the creator of the WinCE Cab Manager does not exist anymore. So I dare to ask: does anybody have an idea how/where I can get a working version (probably this means hacked) of the WinCE Cab Manager 3?

If you have one, please copy to my dropbox here: https://www.dropbox.com/request/gXBLFQiV4J4YANQiyLZp (https://www.dropbox.com/request/gXBLFQiV4J4YANQiyLZp)
Thank you!

Edit: I received misc. versions/cracks now. No need to send more. A big 'Thank you' to Ricardo, Safar, Marsh, Mark and Andy! For anybody who had the same problem and who need the software only for a short time and not frequently: You may install the trial on a virtual Windows machine. If you need it for longer, you just set up a new virtual machine after 30 days.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on December 17, 2017, 08:16:04 pm
On my system I have a WinCE Cab Manager 3 which I installed three years ago and used only one time then. Of course it has expired three years minus 30 days ago. Uninstall and Reinstall does not make a difference - it recognizes (even after deleting registry entries etc.) a preceding installation and will not work.

OCP Software, the creator of the WinCE Cab Manager does not exist anymore. So I dare to ask: does anybody have an idea how/where I can get a working version (probably this means hacked) of the WinCE Cab Manager 3?

If you have one, please copy to my dropbox here: https://www.dropbox.com/request/gXBLFQiV4J4YANQiyLZp (https://www.dropbox.com/request/gXBLFQiV4J4YANQiyLZp)
Thank you!
Hi,

What purpose for? If you want compress/decompress, assemble/disassemble cab contains then I can advice GUI tools for this.

But if you want cab manager (Russian forum):
https://4pda.ru/forum/index.php?showtopic=10659&st=320#entry2677275
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on December 18, 2017, 08:55:06 am
I found this 4pdu.ru website of course, but all links are broken (I only get 404 notes, no matter which link I click on). Also the shown serials (and the ones somebody placed on the dropbox - thank you anyway) are not working with my 3.0.0.22
Anyway - I now installed my trial version in a virtual XP machine. So I have 30 days and if I need it again later I just set up a new virtual machine.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JeffreyLatter on January 06, 2018, 07:40:13 pm
Update to my previous post:

New version of the mod available for the 3000T Series - Tested on 3000XSeriesT.7.10.2017042905.ksx!
After a couple of PM's from Pinkus (thank you for the sparring!), I have modified the application to read the commands from a textfile for easy modification.
Futhermore the application will check for existing infiniivision.lnk and infiniiVisionLauncher.exe in the \Secure\Startup folder and delete if any, as to avoid a bootloop situation after a system update.
(I will advise to remove the mod prior to updating just to be safe, but anyway)

Also if no command.txt is found, a new will be created with a default option of "-l all".
 :-+
Feedback is greatly appreciated!

As always - Use it at your own risk!
REMOVED ATTACHMENT FOR REVISION OF README
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on January 08, 2018, 01:14:25 pm
Much appreciation for the great work  :-+   Tested on 7.20.  You must use the launcher from the version you are using, if it is not 7.10.  Also, I performed the cmd operations manually but they look correct.  LAN settings appeared as zeros until 2nd boot.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on January 17, 2018, 10:32:01 pm
I am slowly getting familiar with my first 3D printer.  :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on January 17, 2018, 10:53:20 pm
Nice  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on January 18, 2018, 12:08:46 am
I am slowly getting familiar with my first 3D printer.  :)

Color like... first channel. Hope you will make three else in known colors :))

BTW how your USB converter?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: KrudyZ on January 18, 2018, 01:41:41 am
I am slowly getting familiar with my first 3D printer.  :)
Looks very nice.
How do you remove it from the housing, since the spring clips don't look accessible from the outside?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on January 18, 2018, 02:04:19 am
Nice  :-+

Thank you  :)

I am slowly getting familiar with my first 3D printer.  :)

Color like... first channel. Hope you will make three else in known colors :))

BTW how your USB converter?

There will be hig-tech silver grey and EEVBLOG blue.  :)

It's a USB to UART converter connect to the console port on main PCB.

I am slowly getting familiar with my first 3D printer.  :)
Looks very nice.
How do you remove it from the housing, since the spring clips don't look accessible from the outside?

A slotted screwdriver or something like that will help.  :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on January 18, 2018, 02:36:54 am


BTW how your USB converter?

It's a USB to UART converter connect to the console port on main PCB.


Yes, I remember.
I mean that you fed it from the PC side in last version.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on January 18, 2018, 02:41:16 am
This version is isolated, so I feed them from both side.  :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on January 18, 2018, 02:53:13 am
This version is isolated, so I feed them from both side.  :)

Yes, I see. Very interesting. For what 3d isolated channel?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on January 18, 2018, 03:15:17 am
This version is isolated, so I feed them from both side.  :)

Yes, I see. Very interesting. For what 3d isolated channel?

There will be a problem if it's not isolated.

When the USB port has been connected to PC and oscilloscope has been turned off, the oscilloscope will steal power from the STM32 MCU I used as converter.  :(
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on January 18, 2018, 10:47:22 am
This version is isolated, so I feed them from both side.  :)

Yes, I see. Very interesting. For what 3d isolated channel?

There will be a problem if it's not isolated.

When the USB port has been connected to PC and oscilloscope has been turned off, the oscilloscope will steal power from the STM32 MCU I used as converter.  :(
You don't need isolation, just a series resistor to limit current drawn by the TXD line.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on January 18, 2018, 01:55:04 pm
This version is isolated, so I feed them from both side.  :)

Yes, I see. Very interesting. For what 3d isolated channel?

There will be a problem if it's not isolated.

When the USB port has been connected to PC and oscilloscope has been turned off, the oscilloscope will steal power from the STM32 MCU I used as converter.  :(
You don't need isolation, just a series resistor to limit current drawn by the TXD line.

I  believe that your solution should work very well, but for me things are a little bit different, usually I power my oscilloscope from an isolation transformer (I know it's not recommended for safety reason but I hardly touch any dangerous voltages) :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PixieDust on January 30, 2018, 01:21:30 pm
Hi Guys,

Interested in the 2000 X. Can someone give me the cliff notes for this thread? 72 pages will probably take a week to read from start to finish.

I'm looking at this:

https://www.keysight.com/en/pcx-x205206/infiniivision-2000-x-series-oscilloscopes?cc=US (https://www.keysight.com/en/pcx-x205206/infiniivision-2000-x-series-oscilloscopes?cc=US)

for reference about features.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on January 30, 2018, 06:07:11 pm
Hi Guys,

Interested in the 2000 X. Can someone give me the cliff notes for this thread? 72 pages will probably take a week to read from start to finish.

I'm looking at this:

https://www.keysight.com/en/pcx-x205206/infiniivision-2000-x-series-oscilloscopes?cc=US (https://www.keysight.com/en/pcx-x205206/infiniivision-2000-x-series-oscilloscopes?cc=US)

for reference about features.
I think this thread is mostly for hacking the DSOX2000 and 3000 series... I don't recall reading anything about features
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rkupka on January 30, 2018, 06:15:42 pm
You can find very thorough review and teardown videos on  EEVBlog  Youtube channel.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PixieDust on January 31, 2018, 01:36:06 am
Yes, that's what I'm interested in, to see whether people have managed to unlock the features.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 31, 2018, 01:42:11 am
All the info you need is in the thread - reading it all will take a long time. Probably worth it all though for 3K + in "free" features. Maybe start with the last 20/30 pages, it will have the most up to date information. Be sure to understand any changes you are making before you do it to prevent a brick.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on January 31, 2018, 01:58:33 am
Read the thread backwards.  You will find the latest hack method around page 60-65
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on January 31, 2018, 09:56:56 am
Read the thread backwards.  You will find the latest hack method around page 60-65
Page numbers are meaningless as they depend on the user's posts-per-page setting - use post numbers
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on January 31, 2018, 11:35:46 am
Read the thread backwards.  You will find the latest hack method around page 60-65
Page numbers are meaningless as they depend on the user's posts-per-page setting - use post numbers
@mikeselectricstuff, you are right.  Post number 1529 shows the steps and includes the link to download the CAB file.  Read from there forward and backward to get some background information about the hack.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on February 03, 2018, 04:10:36 pm
Google the apps bundle for the 2000 x to learn about the features.  If you read the thread, you'll get extra joy out of it  :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: salvagedcircuitry on February 04, 2018, 07:14:56 am
Is it still best to attempt this hack through the USB method and keep 2.35 firmware: (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg322242/#msg322242 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg322242/#msg322242))
or upgrade to 2.41 / 2.42 and use the v241_link_install method: (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1189010/#msg1189010 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1189010/#msg1189010))?
Are there issues with garbage on LAN with the USB method?
I am leaning more toward the USB method as it seems to be less intrusive and reversible.

A friend of mine has a 3034a and I'm lending a hand. 02.35 firmware. no installed licenses. No lan card

Thanks everybody  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on February 05, 2018, 09:44:47 pm

Are there issues with garbage on LAN with the USB method?


LAN garbage issue will be in any FW when you try start scope app (infiniivisionLauncher.exe) with keys. Any hack method do this actually.

For eliminate this issue you should patch infiniiVisionCore.dll.

Not sure about 2.35, but 2.41 and 2.42 patch methods still in this topic. Think is better to use for search "infiniiVisionCore.dll".

infiniiVisionCore.dll in 2.41 packed in FW as File and in 2.42 packed as Module, so methods and patch addresses is differ.

I patched 2.42 in nk.bin directly, and flashed it to scope via LAN telnet command, but hope that is possible just replace nk.bin in CAB file and flash scope as usually. And ksx file in 2.42 is cab actually, so just rename it.

But anyway LAN strongly recommend for use these patches.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on February 05, 2018, 11:01:44 pm
and remember, at scopes with firmware versions below 2.4x the flash will be corrupted after RND(TIME). The scope will not boot anymore and is bricked and needs to be serviced by Keysight. After firmware 2.4x the scope will detect this and repairs itself .... somehow.
Thus with 2.35 or 2.38 there is the constant danger, that your scope (DSOX2000a and DSOX3000a series) won't boot anymore at some day.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on February 05, 2018, 11:10:19 pm
Since firmware version 2.4x I haven’t seen a single 2000 or 3000 series scope as a customer return, they seem to be incredibly robust and reliable now. Keysight certainly sorted any problems out and have exceptional customer support.

I’ve seen quite a few new R&S RTB 2000 series ones being returned with issues though, they seem to be having some teething problems. Good warranty support from R&S as well though.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: salvagedcircuitry on February 06, 2018, 01:54:33 am
and remember, at scopes with firmware versions below 2.4x the flash will be corrupted after RND(TIME). The scope will not boot anymore and is bricked and needs to be serviced by Keysight. After firmware 2.4x the scope will detect this and repairs itself .... somehow.
Thus with 2.35 or 2.38 there is the constant danger, that your scope (DSOX2000a and DSOX3000a series) won't boot anymore at some day.

I remember reading that post. I totally forgot about it. I was hoping 2.35 was patched to fix it. Well, I guess I'm going to snag a DSOXLAN module or build one.

Thanks for the input safar, Pinkus and TopLoser
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: markb82 on February 06, 2018, 03:40:39 am
I’ve seen quite a few new R&S RTB 2000 series ones being returned with issues though, they seem to be having some teething problems. Good warranty support from R&S as well though.

Not to hijack the thread but can you give us any more details on issues with the RTB2000 series ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on February 06, 2018, 09:46:12 am
I’ve seen quite a few new R&S RTB 2000 series ones being returned with issues though, they seem to be having some teething problems. Good warranty support from R&S as well though.

Not to hijack the thread but can you give us any more details on issues with the RTB2000 series ?

50/50 dead power supplies and touch screen faults. One with all inputs dead.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: markb82 on February 06, 2018, 07:19:37 pm
50/50 dead power supplies and touch screen faults. One with all inputs dead.

Thanks.  I just got one and the power supply is humming (high pitch whine) when the scope is in standby mode.  Sound like a vibrating ceramic cap or inductor.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jwalling on February 06, 2018, 07:30:52 pm
50/50 dead power supplies and touch screen faults. One with all inputs dead.

Thanks.  I just got one and the power supply is humming (high pitch whine) when the scope is in standby mode.  Sound like a vibrating ceramic cap or inductor.

I *think* there may be a service note on that...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on February 06, 2018, 07:35:32 pm
50/50 dead power supplies and touch screen faults. One with all inputs dead.

Thanks.  I just got one and the power supply is humming (high pitch whine) when the scope is in standby mode.  Sound like a vibrating ceramic cap or inductor.

I *think* there may be a service note on that...

Pretty sure he is talking about an RTB2000, not a DSOX2000/3000(which does have an old service note about a power supply update because of an audible noise).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: markb82 on February 06, 2018, 07:58:00 pm
Pretty sure he is talking about an RTB2000, not a DSOX2000/3000(which does have an old service note about a power supply update because of an audible noise).

You're right, I'm talking about the RTB2000.  End of thread hijack, will go over to the RTB2000 thread. :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on February 06, 2018, 09:46:13 pm
Here patched kernel file for 2.42 3000A series FW (- LAN garbage issue)

GDisk (https://drive.google.com/file/d/1_rSakzZerat8lkXNfZ-Vae1fWvWWfnvS/view?usp=sharing)

Flash via TelNet session on scope from USB
Code: [Select]
\windows\loadP500Flash -u ceImage1 \usb\nk_patched.bin.comp
This is exactly the same as the installer does, but it makes it two times:
Code: [Select]
<!-- Update CE Kernel (backup) -->
\windows\loadP500Flash -u ceImage2 \usb\nk_patched.bin.comp
<!-- Update bootloader -->
blah...blah...blah...
<!-- Update CE Kernel -->
\windows\loadP500Flash -u ceImage1 \usb\nk_patched.bin.comp

So I suppose that possible make CAB with patched NK and recipe.xml with this code (MD5 checksum is actual for patched kernel) and flash it just from USB without LAN
Code: [Select]
<install>
<!-- Set the ramdisk to 68MB -->
<ramdiskSize>71303168</ramdiskSize>
<!-- Stop the scope application -->
<killProcess>infiniivisionLauncher.exe</killProcess>
<killProcess>AgilentLxiWebService.exe</killProcess>
<killProcess>vncServer.exe</killProcess>
<killProcess>websockify.exe</killProcess>
<!-- ******** -->
<!-- Update CE Kernel -->
<installStep>
<file checksum="03929973A08EFEB08FB31DA8B2AAF200">nk.bin.comp</file>
<command>\windows\loadP500Flash -u ceImage1 %TEMP%\nk.bin.comp</command>
<onFailure>
<filePath>\Agilent Flash\config\errorLog.txt</filePath>
<message>Firmware update failed (0x0422). Please retry firmware update.</message>
<action>reboot</action>
</onFailure>
</installStep>
<!-- Reboot -->
<installStep>
<command>\windows\rebootInfiniivision.exe</command>
</installStep>
<boardLoadOptions>
<ECC>4</ECC>
</boardLoadOptions>
</install>

Not sure but may be better make it like in original recipe.xml and add code before "Update CE Kernel" section (just past instead of <!-- ******** -->). But in this case also need to pack updateBootLoaders2.exe and pboot_rel.bin in CAB.
Code: [Select]
<!-- Update CE Kernel (backup) -->
<installStep>
<file checksum="03929973A08EFEB08FB31DA8B2AAF200">nk.bin.comp</file>
<command>\windows\loadP500Flash -u ceImage2 %TEMP%\nk.bin.comp</command>
<onFailure>
<filePath>\Agilent Flash\config\errorLog.txt</filePath>
<message>Firmware update failed (0x0420). Please retry firmware update.</message>
<action>reboot</action>
</onFailure>
</installStep>
<!-- Update bootloader -->
<installStep>
<file checksum="7ccacd88343adb62f9276a362bc7f5d3">updateBootLoaders2.exe</file>
<file checksum="33bb47d750ae3732cd8657f407008ef0">pboot_rel.bin</file>
<command>%TEMP%\updatebootloaders2.exe</command>
<onFailure>
<filePath>\Agilent Flash\config\errorLog.txt</filePath>
<message>Firmware update failed (0x0421). Please retry firmware update.</message>
<action>reboot</action>
</onFailure>
</installStep>

And of course it is need to check paths and filenames.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: maxpayne on February 10, 2018, 08:28:02 am
you mentioned "bricked the scope" ,i'm not good at english ,does it mean this way may be harmful to scope  ,such as breaking the scope ?
DE BD7JAT
Yes, a wrong step or wrong link might lead to your scope being unusable, and you'd need to send it back to the factory for repair.
That being said... has anyone actually BRICKED their scope yet? I don't remember of one but eh... it's quite a long thread.

Also, I've attached the file all inside a zip. The steps are basically :

1) Extract all files (including the .lnk) to the root of your usb drive
2) From the scope's front panel, press Utility ->File Explorer -> Press to go to: <USB Drive label>(usually "usb")
3) From the drop down, scroll to the v241_link_install.cab to select
4) Press Load file

The scope will ask for your confirmation and then it will load/update and reboot.

FYI, my link file is :
160#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO --perf -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l TOM -l BW20 -l ADVMATH -l EMBD -l EDK -l VID

the other cab uninstall the link file and restores your previous setting.

Cheers

Does this hack work with DSOX2012A ? I am planning to buy one :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on February 10, 2018, 04:38:39 pm
Has anyone performed (and can you post)  a response sweep on their improved BW 3000A or T?  I'm interested on seeing how well behaved the response is after a 500M or 1G upgrade.  I synch a generator sweep with a slow sweep on the scope.  Normally I turn on <peak> just to be safe but the 2000 and 3000 seem to show the envelope properly either way, with BW where I expect it (50% point around 265MHz for a 200MHz scope, same as by actual BW measurement, on a 3000T and 2000A).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on February 10, 2018, 05:28:12 pm
Does this hack work with DSOX2012A ? I am planning to buy one :)
Sure, it will work with all versions. However, I would strongly advice not to purchase one: The DSOX2000 series does not allow serial protocoll analysis on the digital channels (only analogue channels) and with only two analogue channels you will be stucked quickly (e.g. with a simple SPI protocol).

My advice: either get a 2-channel 3000-series scope (they allow protocol analysis on digital channels) or go for the 4-channel version of the DSOX2K. The 2-channel version of a DSOX2K should be purchased only if it comes with a massive price reduction, as selling this later will become very difficult.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: maxpayne on February 11, 2018, 10:05:01 am
Does this hack work with DSOX2012A ? I am planning to buy one :)
Sure, it will work with all versions. However, I would strongly advice not to purchase one: The DSOX2000 series does not allow serial protocoll analysis on the digital channels (only analogue channels) and with only two analogue channels you will be stucked quickly (e.g. with a simple SPI protocol).

My advice: either get a 2-channel 3000-series scope or go for the 4-channel version. The 2-channel version should be purchased only if it comes with a massive price reduction as selling this later will become very difficult.

I think I should wait then.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on February 13, 2018, 10:44:14 am
Quote
Hugoneus, check this post for CPU JTAG https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg274963/#msg274963 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg274963/#msg274963)

Another possibility is BootROM USB flash loader mode:
ST's flash utility http://www.st.com/web/en/catalog/tools/PF257557 (http://www.st.com/web/en/catalog/tools/PF257557)
This mode should be activated by pulling BOOT_SEL pin (K18, check the picture) low at power on, but no reports on this so far. The PCB picture in JTAG post looks like there is a track in inner layer going to this pin, perhaps you can look closer. If it is tied straight to VCC then bad luck, otherwise try shorting it to GND and turning the scope on with USB cable attached to PC - does something pops up?
Also SPEAr600 RM says that ROM enters USB boot if normal (flash) boot fails regardless of BOOT_SEL state. But this requires primary bootloader in flash to be corrupted "correctly" so ROM doesn't recognize it (briefly shorting some flash DATA lines at power up is common way to simulate this state).


And this one is awesome as well, just putting the patch right into flash..
Quote
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1419736/#msg1419736


Hi All,

I'm finally joining in on this fun, just got a used 3024A..... I plan on 'playing' with it as well, and doing the bw mods, etc..


So, I do want to look deeper into this JTAG and flashing functionality, just thinking ahead a bit.  I know the one thread referenced in this post (way back on page 6 or 7 of this thread), a poster said he dumped some of the flash, so it should be possible, and probably can be done through openOCD with a standard arm jtag device.

We really have no idea as to what the mfr. will end up doing in future firmwares, maybe they don't care all that much about what we are doing here?  but we know for sure they are on here paying attention!  So if anything, they are reporting this info back to the devs, which may end up in some of our avenues to get in being tightened even further...

So, I'll be looking at this avenue some more, as soon as my LAN board shows up and I can get things rolling....


But, something funny to show, my scope came with this GPIB board in the slot, didn't even know they made this thing?  wonder what things out there you can interface to it?

At least I can use this board for tracing references, etc, if we need any more pinouts of the GPIB bus on the scope...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: KrudyZ on February 13, 2018, 04:25:05 pm
Looks like they had to take a serial interface from the scope and turn it into GPIB using an FPGA on this board.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on February 13, 2018, 04:41:27 pm
Looks like they had to take a serial interface from the scope and turn it into GPIB using an FPGA on this board.
FPGAs are probably cheaper than mostly-obsolete dedicated GPIB chips these days
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on February 14, 2018, 08:25:55 am
Hello
Earlier I promises to share my project of LAN card.
Here is my pcb and schematic (version with simple LAN connector and separated transformer).
This pcb was completed with parts from my garbage, therefore have no BOM, sorry.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on February 19, 2018, 03:02:33 pm

The message about the "System OS concerns detected...", that still comes up, that may be a check against the file that's in the flash, I'm not sure, but haven't figured out yet how to remove that message.. but I'm curious if that one doesn't appear if we flash the patched DLL into the ceimage1 in flash...?  I will be trying that soon...


I suppose that this message can appear when loader checking rom for checksum and as DLL has been patched then loader write this message. I saw some table with all checksums in filesystem, but I don't remember exact place. Hope it is possible eliminate this message if makes correction there.

When you flash patched kernel via telnet command you do not mention MD5 for this, so no error here. But installer use this MD5 information when do command from recipe.XML script.

And sorry but I slightly misunderstand about VNC. DSOX already have VNC server (vncServer.exe), and you can use it without any restrictions (>1 min). If you trying to start another one it would be conflicted as they use one port
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on February 20, 2018, 02:06:39 am
Yeah,

I just verified your method of flashing 'ceimage1' with the patched nk.bin worked perfect.. I put both of the .dll patches in there, the one patch for the cmd line args, and the 2nd patch I mentioned to disable the 'Warning: Unfinalized Software'....

I also fixed the checksum in the file as you mentioned how to do... I didn't do anything with the MD5 since I was not doing a full install from a cab, I just flashed the fixed nk.bin file using the 'loadp500 flash.exe' as you described...

So, that 'System OS concerns' detected only seems to come up if you run the 'launcher' from in the \secure\infiniivision folder.. if you run the launcher from the \program files\infiniivision folder, than there are no warning messages at all.. (except of course for the VGA/LAN card, because we have custom lan cards.. haha)


As far as the 'mobileVNC.exe', the reason I mentioned it is if anyone wanted to see the real 'Windows CE desktop', which is what this mobileVNC takes you to when you login with it.. the 'vncserver.exe' that the scope already runs, just gives you a VNC connection to control the scope itself..  I wanted to see if there was anything interesting to look at with the actual windows CE desktop... there really isn't much to see, I was hoping to be able to view some registry data from there, but no luck..

So, from what I can tell, this 'infiniivisionlauncher.exe' is really just a wrapper file, it doesn't do much except load up the infiniivisioncore.dll and call it's single export 'start'... the core.dll is hardly even a DLL, it really could probably be converted to an EXE and executed directly, with some code changes of course.. but anyhow.. just from what I've observed..
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on February 20, 2018, 12:47:00 pm



As far as the 'mobileVNC.exe', the reason I mentioned it is if anyone wanted to see the real 'Windows CE desktop', which is what this mobileVNC takes you to when you login with it.. the 'vncserver.exe' that the scope already runs, just gives you a VNC connection to control the scope itself..  I wanted to see if there was anything interesting to look at with the actual windows CE desktop... there really isn't much to see, I was hoping to be able to view some registry data from there, but no luck..



Now it's clear, thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mythos1453 on February 23, 2018, 10:19:52 pm
Hi all,

Has anyone been succesful in hacking the 4000's series? I tried to go through the whole thread but I'm still a bit confused. It seems that the 3000 series shares the same hardware as the 4000. But does that mean that changing the firmware is the same?

I've been offered a great deal on a MSOX4024A and I wanted to see if its hackable. Thanks!

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Gandalf_Sr on February 23, 2018, 11:48:08 pm
Here's a tip, hit the [Print] button which gives you the whole thread in text only format - then use Ctrl+F to search for "4000", there are 78 hits and one pf them gives you what you want.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Andrew on March 05, 2018, 06:25:24 am
The latest firmware 2.43 (5 March 2018) according to the release notes:

Added support for DSOX2PLUS.

The user guide has been update and includes additional math functions and triggers. ;D

Updating my scope now....

Edit: Sorry, false alarm, no early chrissy present from Keysight for X2000A owners...

Page 313 of version "Ninth edition, February 2018" of the user manual:

Licence Options Available
PLUS = 2000 X-Series Enhancements
Provides additional math functions, triggers, measurements,
memory, segmented memory, and waveform update rate.

...and in the "After purchase model number, notes" column:

Order DSOX2PLUS.

Too bad if you already bought the app bundle. :'(
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on March 05, 2018, 11:24:07 am
The latest firmware 2.43 (5 March 2018) according to the release notes:


New Features for the 2000A
 This software revision includes the following new capabilities:
– Added support for DSOX2PLUS.  See product page on www.keysight.com for details.

Enhancements for the 3000A
- Support for the N7026A probe was added. 
- The ability to calibrate the offset was added for the N2820/1A probe.

Enhancements for the 2000A
- The following measurements have been added to the 2000A:
o “X@Max”
o “X@Min”
o “Positive Pulse Count”
o “Negative Pulse Count”
o “Rising Edge Count”
o “Falling Edge Count”

Bug Fixes for both 2000A and 3000A
- An issue preventing a full waveform export in Roll-mode has been corrected.
- An issue preventing DVM’s Auto Range from operating correctly in certain acquisition
modes has been corrected.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Andrew on March 05, 2018, 12:07:26 pm
Found a document "Keysight Technologies Distribution Products Catalog" for March 2018.

literature.cdn.keysight.com/litweb/pdf/5991-4833ENDI.pdf

For the X2000 it lists:

Quote
2000 X-Series Enhancements
All 2000 X-Series oscilloscopes manufactured after
March 5, 2018 now have:
- Increased waveform update rate of
200,000 wfms/s
- Standard memory upgrade: 1 Mpts
- Standard segmented memory
- Additional trigger modes
- Additional math functions
Any 2000 X-Series oscilloscopes manufactured
before March 5, 2018 can be upgraded using the
DSOX2PLUS option.
See pages 16 and 18.
For more information
www.keysight.com/find/2000X-Series (http://www.keysight.com/find/2000X-Series)

Assuming the USA website would be updated first, it still shows 50,000wfms/s and no DSOX2Plus info.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Petter on March 05, 2018, 01:00:50 pm
infiniivisioncore.dll [snip] ** note:  in 2.42, the dll is no longer on disk, so you have to patch this directly in the nk.bin, and write to flash **

Where does one find the the dll in question?

All the best
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on March 05, 2018, 01:42:26 pm
I've always thought the 50,000 waveforms/s of the 2000 was an artificial limit vs the 3000 series. And now they raised it to 200,000 for new units to make them competitive again. I wonder how much they will ask for the dsox2plus option..

I also wonder about the memory, the 2000 now has 1mb vs the 4mb (?) of the 3000. Maybe they will raise this to 2mb in the future (that would be most welcome!)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Andrew on March 05, 2018, 03:07:39 pm
...I wonder how much they will ask for the dsox2plus option...

If it is still the case that 3000A owners who had already purchased the app bundle don't get the FRA option then I suspect 2000A owners who want 200,000 wfms/s will have to hand over more cash for DSOX2PLUS or keep a watch on this thread. :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on March 06, 2018, 12:27:15 am
Upgraded to 2.43  :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Andrew on March 06, 2018, 08:12:32 am
Upgraded to 2.43  :)

That was quick  :D Are you able to confirm the increased update rate?

From http://www.datatec.de/Keysight-Upgrade-2000X-Oszilloskop-2018.htm (http://www.datatec.de/Keysight-Upgrade-2000X-Oszilloskop-2018.htm)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on March 06, 2018, 09:20:40 am
Upgraded to 2.43  :)

That was quick  :D Are you able to confirm the increased update rate?

From http://www.datatec.de/Keysight-Upgrade-2000X-Oszilloskop-2018.htm (http://www.datatec.de/Keysight-Upgrade-2000X-Oszilloskop-2018.htm)

Be honest, I don't know how.  :-[
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on March 06, 2018, 09:46:42 am
Upgraded to 2.43  :)

That was quick  :D Are you able to confirm the increased update rate?

From http://www.datatec.de/Keysight-Upgrade-2000X-Oszilloskop-2018.htm (http://www.datatec.de/Keysight-Upgrade-2000X-Oszilloskop-2018.htm)

Be honest, I don't know how.  :-[

OK, I've watched Daniel's video, according to his instructions:

"You take the trigger out from your scope and you plug it into a frequency counter"

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on March 06, 2018, 11:36:30 am
infiniivisioncore.dll [snip] ** note:  in 2.42, the dll is no longer on disk, so you have to patch this directly in the nk.bin, and write to flash **

Where does one find the the dll in question?

All the best

Hi,

so basically you need to unpack the firmware image, decompress the nk.bin, and then extract the files from it, so you can get to the DLL...then from there, you can disassemble the DLL  and find the patch point(s). 

I have't had a chance to look at 2.43 yet, so if no one else already knows the 2.43 patch points, I'll get to it this week...

but once you have the patch point (or points if you want to also disable that 'unfinalized software' nag message), you can just find that code by doing a hex search in the uncompressed 'nk.bin' file, and modify the code right in that file. **** note, you MUST fix the checksum for this .dll in the nk.bin uncompressed file after making this change ***

then re-compress it, and write/flash the compressed 'nk.bin' to 'ceimage1' & 'ceimage2'


ie follow these 2 posts by Safar, as he was the one that showed exactly how to do it, and I verified that what he did does indeed work perfect.

** you MUST follow his instructions and FIX that checksum after you patch the 'nk.bin', before you recompress it **


https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1262075/#msg1262075 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1262075/#msg1262075)

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1266429/#msg1266429 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1266429/#msg1266429)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Andrew on March 07, 2018, 07:17:34 am
Test Equity is listing the new option "Keysight DSOX2PLUS Enhancement Suite" at USD 250.

"Increases waveform update rate to 200,000 wfm/s, includes DSOX2SGM (segmented memory) and DSOX2MEMUP (deep memory upgrade), math functions from DSOX3ADVMATH, and all the advanced triggers from the 3000A X-Series (not TX). Included on 2000 X-Series oscilloscopes shipped after March 5, 2018."

https://www.testequity.com/products/3763/ (https://www.testequity.com/products/3763/)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pamphonica on March 07, 2018, 01:31:15 pm
I'm trying to telnet into a new-ish MSOX4034A (f/w 7.11).  I'm having problems generating an acceptable telnet password.
(Web access works fine)
I tried multiple times (as per Read Me file in zip in previous thread) -  Post #1774 - but no good.
What format should the model number be in to get the correct password?
Anyone got any ideas?
And has anyone successfully liberated a DSOX/MSOX4000A?
thanks
Jeremy
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on March 08, 2018, 12:33:41 am
I know someone back in this thread did it on a 4k series.....


are you sure the login/password is not just the basic ones as in the 3000A series?  (ie the password+hash was ONLY for the newer 3000T series)

also remember, when launching telnet, the first user/login attempt will always fail, just type in garbage for user/pass, let it fail, then login again...


ie this combo:

Code: [Select]
infiniivision
skywalker1977

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: klaus11 on March 08, 2018, 05:54:50 am
FYI:

The patch locations for firmware 2.43:

But 4000 series never had a 2.43 firmware, it started from fw 3.00.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on March 08, 2018, 04:10:32 pm
FYI:

The patch locations for firmware 2.43:

But 4000 series never had a 2.43 firmware, it started from fw 3.00.

This is a 2000/3000 thread and PhillyFlyers is providing patch details for 2.43 since he had just posted above that he had successfully installed it on his 2000 series. i.e. his patch info is not in the context of the 4000 question...

Thank PhillyFlyers for the details, I'll look to update/install on my 2000 this w/end.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jasonbrent on March 08, 2018, 10:59:10 pm
Those with a liberated 3000 series scope... to use the MSO portion, what cable are you using? Whats a reasonably priced alternative?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on March 09, 2018, 12:32:56 am
I picked up one of these, for about $115.. I know people have been selling them from time to time on here as well, but this seems to be the cheapest route.. Agilent has a replacement model# for this part, basically same thing, but it's $600 from them I believe... good grief.
No active logic in them..


Hp/Agilent 54620-61601

https://www.ebay.com/itm/Agilent-54620-61601-Logic-Analyzer-Probe-Cable-54620-61801-54620-61601/152928938063?epid=1041904829&hash=item239b46684f:g:H7AAAOSwB09YEjxE (https://www.ebay.com/itm/Agilent-54620-61601-Logic-Analyzer-Probe-Cable-54620-61801-54620-61601/152928938063?epid=1041904829&hash=item239b46684f:g:H7AAAOSwB09YEjxE)


There was discussion somewhere back in this thread talking about these, and members verified they work fine, I haven't had a chance to actually use mine yet...

FYI, I actually have a DSOX-3024A for my scope...

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on March 09, 2018, 01:28:33 am
No active logic but the original HP (etc.) part has a 90k series resistance.  This give a good measure of protection against over-voltage, over-current and to some degree, ESD.

You could plug in anything that fits, including individual female 0.025" square connectors such as the ones on Chinese ribbon cables with male or female, or both, ends at real low prices.

Just use caution with any direct cable as it would hurt to blow the ASIC IF the connection from the front panel is not buffered  :bullshit:

I couldn't afford a new cable but also bought a like new on ebay.  The Agilent or KS $600 or $800 is a fair price.  The cable is US made (still was 2 years ago), has the woven ribbon construction as well as custom cable ends with precision female sockets.  They last for years without excessive abuse.  Sure, it would cost $75 or so if made in China and sold by XYZ scopes but then you wouldn't have KS anymore  :'(
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jasonbrent on March 09, 2018, 03:37:13 am
That price point isn't too far from the MSO option itself... It looks like the probes from my Tektronix TLA5202 might would work also... looks kind of like an IDE/40pin connector. I'm -> <- close to getting a DSOX3014T with their current "30% off" promotion trade in... they accepted something I didn't expect as a trade which makes it very very tempting. I figured it can be liberated and/or upgraded over time as the need arises.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on March 09, 2018, 04:37:31 am
Used MSO cables pop up for good deals all the time on ebay - it is totally worth buying the proper one.

Here are the various part numbers you're looking for for a 3000 series scope:

54620-68701 - original part #
N6450-60001 - newer part #
N2756A / N2756-60001 -  updated logic probe cable, newest version.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jasonbrent on March 09, 2018, 04:55:05 am
Used MSO cables pop up for good deals all the time on ebay - it is totally worth buying the proper one.

Here are the various part numbers you're looking for for a 3000 series scope:

54620-68701 - original part #
N6450-60001 - newer part #
N2756A / N2756-60001 -  updated logic probe cable, newest version.

Awesome, thank you. I think I'm going to pick up the DSOX3014T+DSOXLAN then... and try to figure out how to explain it to my wife. :)

By the time I need >200Mhz analog, prices will magically have come down (ha) or I'll enjoy some SMD rework.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on March 09, 2018, 04:06:02 pm
No active logic but the original HP (etc.) part has a 90k series resistance.  This give a good measure of protection against over-voltage, over-current and to some degree, ESD.

You could plug in anything that fits, including individual female 0.025" square connectors such as the ones on Chinese ribbon cables with male or female, or both, ends at real low prices.

Just use caution with any direct cable as it would hurt to blow the ASIC IF the connection from the front panel is not buffered  :bullshit:
...

The 90k embedded in the logic probe tip makes a voltage divider with the 10k input impedance of the scope's logic inputs, so the combination makes a x10 probe.  And the woven ribbon is a lossy transmission line, similar to a regular analog probe cable, to maintain signal integrity.

A cheap straight-thru 40-pin ribbon connector will give you the wrong voltage levels, and also would degrade the signal integrity if you're dealing with high speed signals.  Not to mention expose the digital front end to more risk of damage, as you point out.

I would get the genuine cable and probes, even if it's somewhat pricey.  The 54620-61601 is what was supplied by Agilent/Keysight when I ordered a 3000X with the logic option several years ago.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on March 09, 2018, 05:07:28 pm
Quote
The 90k embedded in the logic probe tip makes a voltage divider with the 10k input impedance of the scope's logic inputs, so the combination makes a x10 probe.  And the woven ribbon is a lossy transmission line, similar to a regular analog probe cable, to maintain signal integrity.

A cheap straight-thru 40-pin ribbon connector will give you the wrong voltage levels, and also would degrade the signal integrity if you're dealing with high speed signals.  Not to mention expose the digital front end to more risk of damage, as you point out.

I would get the genuine cable and probes, even if it's somewhat pricey.  The 54620-61601 is what was supplied by Agilent/Keysight when I ordered a 3000X with the logic option several years ago.


Oh yeah, absolutely, I agree with you all 100%.  Definitely buy an official HP/Agilent probe set, don't buy some 3rd party knockoff.   For the cost of these scopes, it makes no sense to cheap out on the probe tips and wreck the input logic.

 But just shop around and find a used set or even new set on ebay or here, and pay 1/6 of the cost!  I just wanted to emphasize to NOT buy it direct from Agilent, and pay $600 or more.  No need for that nonsense.  You can buy an entire scope for $600!  (lol, NOT one of these scopes, but maybe a Rigol :)  )

I got the 54620-61601 MSO probe set for my 3024A from ebay, it was new still in package, for $120....


I'm just curious if anyone actually located where they have this probe resistance at, as someone already disassembled one of the pod modules, and there was nothing in it at all...maybe it's in the 40-pin IDE header, as I don't see any pics of anyone opening that up?

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg367778/#msg367778 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg367778/#msg367778)


Also, btw, the newer/replacement probe packages do not have that braided cable as the older ones did, it's just straight up wire...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on March 09, 2018, 05:27:08 pm
You can also keep your eyes open for a dirt cheap, parts only, older HP scope (green CRT, 54622D, many others).  You might find a scope with the logic probe included !

MarkL - all true.  Thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on March 09, 2018, 05:43:45 pm

I'm just curious if anyone actually located where they have this probe resistance at, as someone already disassembled one of the pod modules, and there was nothing in it at all...maybe it's in the 40-pin IDE header, as I don't see any pics of anyone opening that up?


You made me  do it ... measured the probe ends instead of going back to work.  The 90k is actually in each channel lead, measured from the female socket for the micro grabber clips, to the dual gold pin end which I unplugged from the body. 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on March 09, 2018, 06:07:46 pm
I believe the equivalent circuit of the probes is in their manual (at least for the woven ones)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on March 09, 2018, 06:32:11 pm
I got the 54620-61601 MSO probe set for my 3024A from ebay, it was new still in package, for $120....
That's a good find.  For some reason sellers of the later version of the cable are asking a lot more.  They're all the same electrically.

Quote
I'm just curious if anyone actually located where they have this probe resistance at, as someone already disassembled one of the pod modules, and there was nothing in it at all...maybe it's in the 40-pin IDE header, as I don't see any pics of anyone opening that up?
See below.  The 90k resistor is the one with the strange symbol and you can see it in parallel with a compensation cap.  There's also a 249R in series with the tip.

Quote
Also, btw, the newer/replacement probe packages do not have that braided cable as the older ones did, it's just straight up wire...
You'll find that those "straight up wires" are tiny lossy coax, except for the outermost ones.  This is the same logic probing system HP/Agilent/Keysight has been selling for 20+ years.

Below is a photo of a broken one where I decided to drill out the rivets to get the shell open.  This is actually from a logic analyzer and not a scope, but it uses the same probes.  You can see some of the tiny coax center conductors.  Apparently someone yanked this connector out by the ribbon and some of the center conductors snapped and were pulled back into the cable.  That's why some are missing.

Moral of the story: If you buy a used logic cable, test *all* the data and clock channels.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pamphonica on March 09, 2018, 07:54:12 pm
I know someone back in this thread did it on a 4k series.....


are you sure the login/password is not just the basic ones as in the 3000A series?  (ie the password+hash was ONLY for the newer 3000T series)

also remember, when launching telnet, the first user/login attempt will always fail, just type in garbage for user/pass, let it fail, then login again...


ie this combo:

Code: [Select]
infiniivision
skywalker1977

Yes, thank you very much.  This worked just fine and I can see everything I need.  I am checking with Pinkus as he's been this route before.
Don't want to brick a new/used scope!

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jasonbrent on March 10, 2018, 01:40:07 am
Ended up ordering a DSOX3014T+DSOXLAN and picked up a N6450-60001 from rebay, new. Now, I wait for Agilent^WKeysight to ship.. they estimate April(!@#!@#) currently. What's really insane is they let me trade in my dslogic/oscilloscope combo that I backed via kickstarter and never used to get 30% off. =)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JonM on March 10, 2018, 04:04:17 am
Ended up ordering a DSOX3014T+DSOXLAN and picked up a N6450-60001 from rebay, new. Now, I wait for Agilent^WKeysight to ship.. they estimate April(!@#!@#) currently. What's really insane is they let me trade in my dslogic/oscilloscope combo that I backed via kickstarter and never used to get 30% off. =)

That is a wonderful trade-in! I traded in a pristine Agilent scope for a DSOX3024T about 18 months ago. They asked a lot of questions about the scope and wanted to be sure that it was working. Supposedly someone was going to pick up the Agilent scope from me but then they asked me to ship it from New Jersey to California. Luckily I got the distributor to pay the $150 shipping cost, but I pad FedEx about $30 for the packing.

Of course I was worried that something would go wrong in shipping, so I took photos  of the scope running next to the the current day's New York Times front page. I did not want to get a bill from Keysight for $1400! Apparently it arrived OK, I never heard from them.

In any case, I 'm surprised that a "non-top tier" scope would get the 30% discount since the offer says "up to 30%". When I did my trade-in there was also a free MSO option but they would not allow the offers to be combined.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on March 10, 2018, 04:10:51 am
Ended up ordering a DSOX3014T+DSOXLAN and picked up a N6450-60001 from rebay, new. Now, I wait for Agilent^WKeysight to ship.. they estimate April(!@#!@#) currently. What's really insane is they let me trade in my dslogic/oscilloscope combo that I backed via kickstarter and never used to get 30% off. =)

You will find it a joy to use!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jasonbrent on March 10, 2018, 05:09:20 am

That is a wonderful trade-in! I traded in a pristine Agilent scope for a DSOX3024T about 18 months ago. They asked a lot of questions about the scope and wanted to be sure that it was working. Supposedly someone was going to pick up the Agilent scope from me but then they asked me to ship it from New Jersey to California. Luckily I got the distributor to pay the $150 shipping cost, but I pad FedEx about $30 for the packing.

Of course I was worried that something would go wrong in shipping, so I took photos  of the scope running next to the the current day's New York Times front page. I did not want to get a bill from Keysight for $1400! Apparently it arrived OK, I never heard from them.

In any case, I 'm surprised that a "non-top tier" scope would get the 30% discount since the offer says "up to 30%". When I did my trade-in there was also a free MSO option but they would not allow the offers to be combined.

Indeed, I was surprised and this may be a one-off! It took a few days for them to approve it... their T&Cs for the trade in didn't suggest there were any limits other than certain frequency for frequency bands. i.e., 0-100Mhz could get 0-100Mhz at 30%, but 0-100Mhz for 1Ghz would get 5%. I offered up 3 possible trades in preference of dslogic/rigol1052e/rigol1054z. Once I submitted, however, I was informed that none were on their list of scopes and would be handled as a "custom trade in". Took about 2 days to get an approved response and they'd accepted the dslogic; no further questions were asked about it.

Heck, if they had said the 1052e, I was going to just buy a new one to trade in since I don't have my old one anymore, lol!

Now, the wait. I'm hoping they beat the heck out of their 1+ month lead time estimate.

-j


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on March 10, 2018, 01:30:09 pm
I got sales order acknowledge just before Christmas week, shipped 10 days later (Fedex received in MY), arrived the next evening !   From MY to Northeast US.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: corn11 on March 12, 2018, 02:09:32 pm
Hi,

concerning the hack for 2.42/2.43:
Does anyone knows if it's possible to use the modded nk.bin (modding just the specific locations through searching for a unique data string around the locs and identintifying them in the nk.bin) without changing the checksum of the infiniiVisionCore.dll contained in the nk.bin file ? I'm asking because I only have the binmod tool version with the known extraction bug so I can't get the modified dll back into the nk.bin file and I haven't managed to find the plattform builder tools eval version online so I can't fix binmod myself.

Thank you in advance ! :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on March 13, 2018, 06:57:43 am
Keysight just listed a DSOX3024T for 40% off on the ebay store(and you can make an offer) for anyone who might be looking for one.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rhythmp on March 14, 2018, 09:21:22 am
Thanks for the info!
Could you also show us the checksum patch?

FYI:

The patch locations for firmware 2.43:



Code: [Select]
1) options patch:  0x280940:  change "04 00 A0 E1" -> "00 00 A0 E3"
2) nag patch:       0x2a9f38:   change "66 5A FF EB" -> "01 00 A0 E3"
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Vespian on March 15, 2018, 03:23:35 am
I assume that in order to telnet into my MSOX-2024A I have to have the LAN module? Is that correct, or can you get COM port functionality out of one of these USB ports?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on March 15, 2018, 10:34:55 pm
Thanks for the info!
Could you also show us the checksum patch?

FYI:

The patch locations for firmware 2.43:



Code: [Select]
1) options patch:  0x280940:  change "04 00 A0 E1" -> "00 00 A0 E3"
2) nag patch:       0x2a9f38:   change "66 5A FF EB" -> "01 00 A0 E3"


So, doing these patches for 2.42 and above, requires going through a bunch of steps, which you really just need to walk through yourself, to see how it all works, versus writing up an entire novel on here trying to explain it...

You need to follow the steps for unpacking the firmware file, de-compressing the 'nk.bin'  WindowsCE image, and locating the DLL within that image, you can just find it by using a hex editor, etc, and finding hex patterns...

As safar explained, the 'nk.bin' has checksums for blocks of data, so when you apply the patches into the DLL spots within the nk.bin (decompressed), you need to also fix the checksum for that block.  It's a standard 'checksum' algorithm, using single byte as input data (ie versus 16-bit, 32-bit etc 'symbols' for checksum), ie in Safar's post he called it 'UByte8Bit', as other programs tend to say that as well..


A trial one I found that makes it easy is the '010 Editor', it does that checksum calc, as well as many others..

If I were you, I'd download the 2.42 firmware, unpack it, and follow the info that Safar mention in his post... once you can understand what he did, and the locations he patched, you can do it to 2.43 as well....


Quote
Hi,

I maked patch for infiniiVisionCore.dll directly in nk.bin in v2.42 (2017032900) FW for DSOX3000A. There 4 bytes for patch "04 00 a0 e1" to "00 00 a0 e3" in start address FBC7FFh and checksum in address D40457h changed from "EB" to "E9". Actually checksum contain 4 bytes, but changed only this last byte (first in file as it's little endian). Checksum algorithm is UByte8bit.

infiniiVisionCore.dll placed in Record [164]: Start in memory = 81111000h, Length = 55D528h, Chksum  of original nk.bin = 2604E8EBh
In nk.bin file this block started in D4045Bh and ended in 129D982h

Then nk.bin compressed by bincompress
Code: [Select]

bincompress.exe /c patched_nk.bin patched_nk.bin.comp

And flash it by loadP500Flash via telnet in scope
Code: [Select]

\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp


Think that replace nk.bin.comp in CAB file (with original name of course) should work also, but didn't try.

After this mod scope work normally and LAN also. I just make this start link in \secure\startup
Code: [Select]

211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC


Don't included EDK and DVM as it is standard options in 2.42

Of course scope indicate that this FW is Ufinalized

Thanks laserK and Elik for advices.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on March 15, 2018, 10:39:32 pm
I make patched.bin.comp with PhillyFlyers info and with corrected checksum:

Patched2.43 (https://drive.google.com/open?id=1I9oKjkdXK2EAJUqVkxMCGuBAsmk1ugyZ)

MD5 of file for check: 1CA34A1B837B075133BE53B379749BBB

You can flash it as usual by loadP500Flash via telnet in scope
Code: [Select]
\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp

Checked on my DSOX3034A

FYI:

The patch locations for firmware 2.43:

Code: [Select]
1) options patch:  0x280940:  change "04 00 A0 E1" -> "00 00 A0 E3"
2) nag patch:       0x2a9f38:   change "66 5A FF EB" -> "01 00 A0 E3"
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on March 15, 2018, 11:25:58 pm

So, doing these patches for 2.42 and above, requires going through a bunch of steps, which you really just need to walk through yourself, to see how it all works, versus writing up an entire novel on here trying to explain it...

You need to follow the steps for unpacking the firmware file, de-compressing the 'nk.bin'  WindowsCE image, and locating the DLL within that image, you can just find it by using a hex editor, etc, and finding hex patterns...

As safar explained, the 'nk.bin' has checksums for blocks of data, so when you apply the patches into the DLL spots within the nk.bin (decompressed), you need to also fix the checksum for that block.  It's a standard 'checksum' algorithm, using single byte as input data (ie versus 16-bit, 32-bit etc 'symbols' for checksum), ie in Safar's post he called it 'UByte8Bit', as other programs tend to say that as well..


A trial one I found that makes it easy is the '010 Editor', it does that checksum calc, as well as many others..

If I were you, I'd download the 2.42 firmware, unpack it, and follow the info that Safar mention in his post... once you can understand what he did, and the locations he patched, you can do it to 2.43 as well....


Hi, yes I use IDA for find code and 010 Editor for patch.

I try to explain algorithm (with all steps as it can used by somebody else):
1. Get nk.bin.comp from FW file (ksx = cab) - I use WinRAR, but many arc programs can extract files from CAB.
2. Decompress nk.bin.comp by "bincompress.exe /d nk.bin.comp nk.bin".
3. Extract infiniiVisionCore.dll with Remaker for WinCE5.
4. Open dll in IDA and find asm code for patch - Sorry, but I don't explain how as it need to write lot info here.
5. With sync screens in HexView of IDA I look for patch hex code and for nearest area "signature" code also for find it in nk.bin (12..20 bytes for unique found result).
6. (As I lazy for remember bin structure I just to) Make DataTable with "viewbin.exe -d nk.bin > data.txt" - beware output file is very big - about 113 MB for 2.43.
7. Open nk.bin in Hex Editor and use "signature" code for find patch place (actually I use "find all" and if here is more than 1 result I try to expand "signature" for search).
8. Make patch in this place.
9. Open data.txt and find same "signature" - you found it in some Record [  ] block ([160] for 2.43). Here we need start Record signature for find it in Hex Editor, Record Length And Checksum (checksum is backwards in file as it LittleEndian code). Of course you can look for bin structure and make it more smart.
10. Find Record start signature - 4 bytes before start position is Checksum - compare it with data.txt (remember for back order). Here I bookmarked position.
11. Select block in editor with start on start Record position and Length from data.txt.
12. Calc checksum UByte8Bit.
13. Turn back to bookmark and correct checksum (4 bytes before start, and remember for back order).
14. Save as patched_nk.bin.
15. Compress it to nk.bin.comp by "bincompress.exe /c nk.bin nk.bin.comp".
16. Flash scope, but kill infiniiVision process before.
17. Reboot scope.

I attach all tools here
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on March 15, 2018, 11:56:28 pm

So, doing these patches for 2.42 and above, requires going through a bunch of steps, which you really just need to walk through yourself, to see how it all works, versus writing up an entire novel on here trying to explain it...

You need to follow the steps for unpacking the firmware file, de-compressing the 'nk.bin'  WindowsCE image, and locating the DLL within that image, you can just find it by using a hex editor, etc, and finding hex patterns...

As safar explained, the 'nk.bin' has checksums for blocks of data, so when you apply the patches into the DLL spots within the nk.bin (decompressed), you need to also fix the checksum for that block.  It's a standard 'checksum' algorithm, using single byte as input data (ie versus 16-bit, 32-bit etc 'symbols' for checksum), ie in Safar's post he called it 'UByte8Bit', as other programs tend to say that as well..


A trial one I found that makes it easy is the '010 Editor', it does that checksum calc, as well as many others..

If I were you, I'd download the 2.42 firmware, unpack it, and follow the info that Safar mention in his post... once you can understand what he did, and the locations he patched, you can do it to 2.43 as well....


Hi, yes I use IDA for find code and 010 Editor for patch.

I try to explain algorithm (with all steps as it can used by somebody else):
1. Get nk.bin.comp from FW files (ksx = cab) - I use WinRAR, but many arc programs can extract files from CAB
2. Decompress nk.bin.comp by "bincompress.exe /d nk.bin.comp nk.bin"
3. Extract infiniiVisionCore.dll with Remaker for WinCE5
4. Found code in IDA - Sorry, but I don't explain how as it need to write lot info here
5. With sync screens in IDA I look for patch hex code and for nearest area "signature" code also for find it in nk.bin (12..20 bytes for unique found result)
6. (As I lazy for remember bin structure I just to) Make DataTable with "viewbin.exe -d nk.bin > data.txt" - beware file is very big - about 113 MB for 2.43
7. Open nk.bin in Hex Editor and use "signature" code for found patch place (actually I use "find all" and if here is more than 1 result I try to expand "signature" for search)
8. Make patch in this place.
9. Open data.txt and find same "signature" - you found it in some Record [  ] block ([160] for 2.43). Here we need start Record signature for find it in Hex Editor, Record Length And Checksum (checksum is backwards in file as it LittleEndian code). Of course you can look for bin structure and make it more smart.
10. Find Record start signature - 4 bytes before start position is Checksum - compare it with data.txt. Here I bookmarked position.
11. Select block in editor with start on start Record position and Length from data.txt.
12. Calc checksum UByte8Bit
13. Turn back to bookmark and correct checksum (4 bytes before start, and remember for back order)
14. Save patched_nk.bin
15. Compress it to nk.bin.comp by "bincompress.exe /c nk.bin nk.bin.comp"
16. Flash scope, but kill process before

I attach all tools here

Nice Safar!  Great writeup, that's an awesome (and fast) writeup!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on March 16, 2018, 12:03:43 am
Quote

I make patched.bin.comp with PhillyFlyers info and with corrected checksum:

Patched2.43

You can flash it as usual by loadP500Flash via telnet in scope
Code: [Select]

\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp


Checked on my DSOX3034A


*** FYI ****

The file you posted is the 'uncompressed' and patched nk.bin, so make sure anyone, you do the

'bincompress /d patched_nk.bin patched_nk.bin.comp'  first!!  as you don't want to flash the uncompressed image, the scope will not boot...

************
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on March 16, 2018, 12:42:41 am
Quote

I make patched.bin.comp with PhillyFlyers info and with corrected checksum:

Patched2.43

You can flash it as usual by loadP500Flash via telnet in scope
Code: [Select]

\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp


Checked on my DSOX3034A


*** FYI ****

The file you posted is the 'uncompressed' and patched nk.bin, so make sure anyone, you do the

'bincompress /d patched_nk.bin patched_nk.bin.comp'  first!!  as you don't want to flash the uncompressed image, the scope will not boot...

************

Ohhh, sorry, I will change it
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on March 16, 2018, 12:55:59 am

Nice Safar!  Great writeup, that's an awesome (and fast) writeup!

U Welcome!

BTW, I try to find some points in IDA for patch message "LAN VGA option module fault", but it seems like one subroutine which select all "System concerns detected" error messages from different enter points. It difficult to understand source for me without real debugger.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rstoer on March 16, 2018, 02:43:34 am
This post is not about a hack so I hope this is the right thread but this is where I learned of the DSOX2PLUS option for the X2000 series scopes and I don’t see it mentioned elsewhere...
I recently installed the DSOX2PLUS upgrade on my Keysight MSOX2024A. I purchased it from Test Equity who as of this date are the only ones listing it on their website. I did get a 10% discount by asking for a quote so it wound up costing $225.00 + tax, which I have to say is quite a bargain (not as cheap as hacking but Keysight has treated me well in the past and I wanted to keep my scope legit).
 
Results: Unfortunately I didn’t check my waveform count before the upgrade but I’ll take them at their word that it topped out at about 50,000 wf/sec. It now tops out at about 250,000 wf/sec (even better than the claimed 200k). But the real reason I ordered it was for the extra trigger options as that’s what has bothered me the most about this scope since I’ve owned it. Five hundred dollar Chinese scopes had more extensive triggering options. That is now fixed! The menu options went from 5 to 12. Math options increased from 5 to 21! (see the  photos for details). The upgrade also is supposed to include the record memory upgrade (to 1 Meg) and the segmented memory option. I already had these but I don’t feel cheated as the features I got are well worth the money spent.
For me, this is like having a new scope. Thanks Keysight!
(http://)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rstoer on March 16, 2018, 02:50:31 am
Here's the changes to the Math Menu after the DSOX2PLUS upgrade...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Vespian on March 16, 2018, 03:18:28 pm
Thanks for posting these photos about the upgrade. I learned about that PLUS upgrade from this thread as well. I saw references to it in the PDF manual, but I couldn't find it as an available option to upgrade on Keysight's website.  :wtf:

I was getting quite frustrated that I couldn't find the integration functionality in the math menu. The manual goes over how to use it, and I didn't see that it required an activated option to use.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on March 16, 2018, 05:31:46 pm
For DSOX2PLUS use option -l PLUS.

List of all 2.43 keys in attachment.

Almost all of these was early documented in this topic (1 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg338246/#msg338246), 2 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg338637/#msg338637)) but question for me is option FWD with lic name "F8AEAE82"
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on March 16, 2018, 05:59:57 pm

Nice Safar!  Great writeup, that's an awesome (and fast) writeup!

U Welcome!

BTW, I try to find some points in IDA for patch message "LAN VGA option module fault", but it seems like one subroutine which select all "System concerns detected" error messages from different enter points. It difficult to understand source for me without real debugger.
I am wondering: if these files were patched wrong, will the scope still start up (at least to allow the telnet access)?`
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on March 16, 2018, 06:29:17 pm

I am wondering: if these files were patched wrong, will the scope still start up (at least to allow the telnet access)?`


I test it before on my scope, but on your question - think it depend of patch place. If patched wrong some OS kernel modules (it will possible by mistake as from 2.42 we need to patch in nk.bin directly) it will be problem, but this DLL patch not influenced on telnet functionality even if it wrong. Think infiniivision app just hung. Anyway you can use bootloader (you need RS232 terminal connection on PCB) for load correct NK.bin via TFTP.

But problem may be if scope will reboot immediately after App hung. Sometime ago I get this case. Even reflashing via uBoot do not fix problem. But fortunately infiniivision app loads last and network connection (telnet) appeared on several seconds and I wrote macros for TeraTerm for fix it.

But just in case MD5 of patched nk.bin.comp from 2.43: 1CA34A1B837B075133BE53B379749BBB
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: corn11 on March 16, 2018, 06:56:17 pm

So, doing these patches for 2.42 and above, requires going through a bunch of steps, which you really just need to walk through yourself, to see how it all works, versus writing up an entire novel on here trying to explain it...

You need to follow the steps for unpacking the firmware file, de-compressing the 'nk.bin'  WindowsCE image, and locating the DLL within that image, you can just find it by using a hex editor, etc, and finding hex patterns...

As safar explained, the 'nk.bin' has checksums for blocks of data, so when you apply the patches into the DLL spots within the nk.bin (decompressed), you need to also fix the checksum for that block.  It's a standard 'checksum' algorithm, using single byte as input data (ie versus 16-bit, 32-bit etc 'symbols' for checksum), ie in Safar's post he called it 'UByte8Bit', as other programs tend to say that as well..


A trial one I found that makes it easy is the '010 Editor', it does that checksum calc, as well as many others..

If I were you, I'd download the 2.42 firmware, unpack it, and follow the info that Safar mention in his post... once you can understand what he did, and the locations he patched, you can do it to 2.43 as well....


Hi, yes I use IDA for find code and 010 Editor for patch.

I try to explain algorithm (with all steps as it can used by somebody else):
1. Get nk.bin.comp from FW file (ksx = cab) - I use WinRAR, but many arc programs can extract files from CAB.
2. Decompress nk.bin.comp by "bincompress.exe /d nk.bin.comp nk.bin".
3. Extract infiniiVisionCore.dll with Remaker for WinCE5.
4. Open dll in IDA and find asm code for patch - Sorry, but I don't explain how as it need to write lot info here.
5. With sync screens in HexView of IDA I look for patch hex code and for nearest area "signature" code also for find it in nk.bin (12..20 bytes for unique found result).
6. (As I lazy for remember bin structure I just to) Make DataTable with "viewbin.exe -d nk.bin > data.txt" - beware output file is very big - about 113 MB for 2.43.
7. Open nk.bin in Hex Editor and use "signature" code for find patch place (actually I use "find all" and if here is more than 1 result I try to expand "signature" for search).
8. Make patch in this place.
9. Open data.txt and find same "signature" - you found it in some Record [  ] block ([160] for 2.43). Here we need start Record signature for find it in Hex Editor, Record Length And Checksum (checksum is backwards in file as it LittleEndian code). Of course you can look for bin structure and make it more smart.
10. Find Record start signature - 4 bytes before start position is Checksum - compare it with data.txt (remember for back order). Here I bookmarked position.
11. Select block in editor with start on start Record position and Length from data.txt.
12. Calc checksum UByte8Bit.
13. Turn back to bookmark and correct checksum (4 bytes before start, and remember for back order).
14. Save as patched_nk.bin.
15. Compress it to nk.bin.comp by "bincompress.exe /c nk.bin nk.bin.comp".
16. Flash scope, but kill infiniiVision process before.
17. Reboot scope.

I attach all tools here


Thank you very much @Safar and @PhillyFlyers for your awesome work!   :-+

I've went through the patch process myself according to your guide and got the same file (SHA1 hashed).

Flashed the ceimage1, adjusted the lnk-file and now it works on my DSOX2004A!   :)

Just in case someone is intrested my lnk-file for the DSOX2k :
Code: [Select]
88#infiniivisionLauncher.exe -l MSO -l BW20 -l DIS -l PLUS -l SCPIPS -l VID -l CABLE --perf
Based on the function names, which can be found in the .dll, those arguments should enable all options which currently work on the DSOX2k.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grenert on March 18, 2018, 01:10:22 am
But the real reason I ordered it was for the extra trigger options as that’s what has bothered me the most about this scope since I’ve owned it. Five hundred dollar Chinese scopes had more extensive triggering options. That is now fixed! The menu options went from 5 to 12. Math options increased from 5 to 21! (see the  photos for details). The upgrade also is supposed to include the record memory upgrade (to 1 Meg) and the segmented memory option. I already had these but I don’t feel cheated as the features I got are well worth the money spent.
For me, this is like having a new scope. Thanks Keysight!
(http://)

Yes, I totally agree.  For only $250 (didn't think to ask for a quote) I feel like I got what I most wanted from the 3000 series, which cost so much more when I bought my scope.  I also paid twice for the memory upgrade, but not too bad considering I had the extra benefit of it for a few years.  Pretty good deal without doing scope brain surgery!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on March 20, 2018, 09:21:21 pm
Quote

I make patched.bin.comp with PhillyFlyers info and with corrected checksum:

Patched2.43

You can flash it as usual by loadP500Flash via telnet in scope
Code: [Select]

\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp


Checked on my DSOX3034A


*** FYI ****

The file you posted is the 'uncompressed' and patched nk.bin, so make sure anyone, you do the

'bincompress /d patched_nk.bin patched_nk.bin.comp'  first!!  as you don't want to flash the uncompressed image, the scope will not boot...

************

Ohhh, sorry, I will change it

Ok, so I assume the minimal steps are:

0) Install correct Firmware version first (i.e. in this case 2.43)
1) Download Safar's patched_nk_bin.comp file and copy to a USB stick and plug in.
2) Telnet into the scope.
3) Login infiniivision / skywalker1977
4) processmgr kill infiniivisionlauncher.exe
5) \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
6) Create a file on the USB stick called infiniivision.lnk with contents (e.g.) "88#infiniivisionLauncher.exe -l MSO -l BW20 -l DIS -l PLUS -l SCPIPS -l VID -l CABLE --perf"
7a) delete (or rename) any other lnk in \secure\startup folder. Should be only one file with lnk extension here.
7b) copy \usb\infiniivision.lnk to \secure\startup
8 ) reboot and good to go

Do I have the basic steps correct or ???

tia,
george.

Edited as per Safar. Thanks!!


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on March 20, 2018, 11:32:57 pm



tia,
george.

Mind you
0) Install correct version FW

7b) delete (or rename) any another lnk in startup folder. Should be only one file with lnk extension here.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jasonbrent on March 21, 2018, 02:30:57 am

That is a wonderful trade-in! I traded in a pristine Agilent scope for a DSOX3024T about 18 months ago. They asked a lot of questions about the scope and wanted to be sure that it was working. Supposedly someone was going to pick up the Agilent scope from me but then they asked me to ship it from New Jersey to California. Luckily I got the distributor to pay the $150 shipping cost, but I pad FedEx about $30 for the packing.

Of course I was worried that something would go wrong in shipping, so I took photos  of the scope running next to the the current day's New York Times front page. I did not want to get a bill from Keysight for $1400! Apparently it arrived OK, I never heard from them.

In any case, I 'm surprised that a "non-top tier" scope would get the 30% discount since the offer says "up to 30%". When I did my trade-in there was also a free MSO option but they would not allow the offers to be combined.

Indeed, I was surprised and this may be a one-off! It took a few days for them to approve it... their T&Cs for the trade in didn't suggest there were any limits other than certain frequency for frequency bands. i.e., 0-100Mhz could get 0-100Mhz at 30%, but 0-100Mhz for 1Ghz would get 5%. I offered up 3 possible trades in preference of dslogic/rigol1052e/rigol1054z. Once I submitted, however, I was informed that none were on their list of scopes and would be handled as a "custom trade in". Took about 2 days to get an approved response and they'd accepted the dslogic; no further questions were asked about it.

Heck, if they had said the 1052e, I was going to just buy a new one to trade in since I don't have my old one anymore, lol!

Now, the wait. I'm hoping they beat the heck out of their 1+ month lead time estimate.

-j

DSOX3014T arrived today; ~12 days after they processed the order, not bad. Unfortunately the "DSOXLAN" module is still waiting for shipment with the same ETA of April 6th. Liberation will have to wait... now to go turn it on! :-)

-j
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bigeblis on March 21, 2018, 02:15:11 pm
Quote

I make patched.bin.comp with PhillyFlyers info and with corrected checksum:

Patched2.43

You can flash it as usual by loadP500Flash via telnet in scope
Code: [Select]

\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp


Checked on my DSOX3034A


*** FYI ****

The file you posted is the 'uncompressed' and patched nk.bin, so make sure anyone, you do the

'bincompress /d patched_nk.bin patched_nk.bin.comp'  first!!  as you don't want to flash the uncompressed image, the scope will not boot...

************

Ohhh, sorry, I will change it

Ok, so I assume the minimal steps are:

0) Install correct Firmware version first (i.e. in this case 2.43)
1) Download Safar's patched_nk_bin.comp file and copy to a USB stick and plug in.
2) Telnet into the scope.
3) Login infiniivision / skywalker1977
4) processmgr kill infiniivisionlauncher.exe
5) \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
6) Create a file on the USB stick called infiniivision.lnk with contents (e.g.) "88#infiniivisionLauncher.exe -l MSO -l BW20 -l DIS -l PLUS -l SCPIPS -l VID -l CABLE --perf"
7a) delete (or rename) any other lnk in \secure\startup folder. Should be only one file with lnk extension here.
7b) copy \usb\infiniivision.lnk to \secure\startup
8 ) reboot and good to go

Do I have the basic steps correct or ???

tia,
george.

Edited as per Safar. Thanks!!

Excuse me, after following your steps, will there be a "Firmware error" prompt at startup?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on March 21, 2018, 02:22:51 pm
Excuse me, after following your steps, will there be a "Firmware error" prompt at startup?

No, something wrong. Tell all possible details. Which model? Is OS loaded? Can you connect scope via network?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on March 21, 2018, 10:14:04 pm
Excuse me, after following your steps, will there be a "Firmware error" prompt at startup?

No, something wrong. Tell all possible details. Which model? Is OS loaded? Can you connect scope via network?

Yeah, agreed, something is definitely corrupt to screwed up there, are you sure you installed firmware 2.43 before doing anything else??

FYI, I'll post much more detailed info once I get done putting everything together, but the nice thing about this scope and the SPEAR600, is that it is essentially bullet-proof from completely bricking the scope.   ST did quite a nice job setting up the internal BootROM in the SPEAR600 itself...

spelled out in the documentation is the boot flow process, since in these scopes the boot pins are setup to boot to NOR flash.. the SPEAR600 will follow this path:
(I simplified it a bit, but when I get all my info together, I will post more specifics)

Code: [Select]
1) Attempt to locate 'Xloader' in NOR flash...  if fail, goto USB BOOT
    if OK, goto step 2

2) Attempt to locate 'U-Boot' in NOR flash, if fail, goto UsB BOOT
    if OK, goto step 3

3) boot up OS from NAND flash

** For all NOR boot failures (XLOADER/UBOOT), the scope will sit at USB Boot, waiting for the USB-Flasher program to communicate back, upon which you can then reflash NOR & NAND to recover... ***

In this case though, if the OS (Windows CE - nk.bin.comp) is corrupt, it will be beyond USB boot, and prob. as you noticed, just hang at OS failure.   But for these cases, you can easily get into UBoot Loader or CE-Boot loader by just having the 3.3v RS232 to USB cable... of course you have to open up the scope to connect to the header.

USB-Flasher is available from the ST-Micro web-site under the SPEAR600 page..


I haven't myself tried this out, as I didn't want to purposely corrupt my flash, but the docs in the flasher tool explain how to use it, but basically you connect USB right from back of scope to your PC...

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on March 22, 2018, 12:15:42 am
USB-Flasher is available from the ST-Micro web-site under the SPEAR600 page..
But is a compatible image available to flash with this tool ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on March 22, 2018, 08:59:57 am
You don’t need to write corrupt flash data to enter USB loader. Just short some flash data pins with tweezers at poweron.

Edit: there is a BOOT_SEL pin also, search the thread.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bigeblis on March 22, 2018, 12:24:09 pm
Excuse me, after following your steps, will there be a "Firmware error" prompt at startup?

No, something wrong. Tell all possible details. Which model? Is OS loaded? Can you connect scope via network?
Sorry
my English is not good.
I mean, after this operation, is there a warning that the firmware version is incorrect? The previous crack was like this.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: corn11 on March 22, 2018, 01:10:50 pm
When you've the original LAN/VGA module installed there should be no warning but with the DIY module there is a little popup saying the LAN/VGA module has a fault but you can skip that by pressing any key
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on March 22, 2018, 01:17:58 pm
When you've the original LAN/VGA module installed there should be no warning but with the DIY module there is a little popup saying the LAN/VGA module has a fault but you can skip that by pressing any key
What I read, not on all scopes. The reason why this happens on some scopes and on some scopes not is still unknown.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bigeblis on March 22, 2018, 02:10:29 pm
When you've the original LAN/VGA module installed there should be no warning but with the DIY module there is a little popup saying the LAN/VGA module has a fault but you can skip that by pressing any key
This means that the latest crack will not have the "Firmware incorrect" warning?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on March 22, 2018, 03:23:45 pm
When you've the original LAN/VGA module installed there should be no warning but with the DIY module there is a little popup saying the LAN/VGA module has a fault but you can skip that by pressing any key
This means that the latest crack will not have the "Firmware incorrect" warning?

Yes, last 2.43 FW DLL patched in two places in BIN file: NETWORK patch and NAG patch. NAG patch eliminate any FW warning messages (in start and in about screen IIR).
Edit: and these messages shows if you start infiniivisionloader.exe with any params (with normal unpatched DLL)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on March 22, 2018, 04:13:31 pm
When you've the original LAN/VGA module installed there should be no warning but with the DIY module there is a little popup saying the LAN/VGA module has a fault but you can skip that by pressing any key
What I read, not on all scopes. The reason why this happens on some scopes and on some scopes not is still unknown.

This is long known! The error occurs because there is a jumper which tells the scope the card is present but of course it can't find the VGA driver hardware. If you remove that jumper(or cut a trace) on your lan card you will get no error. The lan will still work for web access, telnet etc but you will see no config option in the scope menu's. You will also not be able to control the scope with BenchVue etc(generally no big deal).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on March 22, 2018, 08:38:06 pm
You don’t need to write corrupt flash data to enter USB loader. Just short some flash data pins with tweezers at poweron.

Edit: there is a BOOT_SEL pin also, search the thread.


LOL, nice, that will do the trick!


Also, I know there was much discussion about the BOOL_SEL pin, but I don't recall anyone ever verifying if the pin was actually brought out to a via?

And if so, is the pin pulled via a resistor, or is it tied directly to VCC rail?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on March 22, 2018, 08:44:18 pm
USB-Flasher is available from the ST-Micro web-site under the SPEAR600 page..
But is a compatible image available to flash with this tool ?


Well, technically we have all of the 'pieces' in order to flash, as most of the pieces are in the firmware file... but we still have to construct the image files first, but I haven't figured all of the mapping out yet, unless someone else knows offhand the flat file arrangement of the NOR & NAND flashes...

I've dumped the NOR flash via JTAG, and see the XLOADER, UBOOT, PBOOT, and MAC address locations in there, but I haven't finished going over it..

to dump NAND I believe I have to configure the spear600 memory controller (FSMC) to be able to read NAND, and you have to read it out in pages... I haven't done anything with that yet...

Also, with that USB flasher tool it looks like you need to know exact mem locations, etc for each part, so we'd have to spell all that out... but from what I see, it should be do-able... but hopefully we'd never have to get that far down the rabbit hole...

It's probably not a common thing to have the NOR flash corrupted, I think all the issues people have mentioned about 'corrupt flash' have been with the NAND flash, which is all OS components.

UBOOT/CEBoot should still be available via RS232 to reload a new OS image (nk.bin), and fix the NAND flash from there...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on March 22, 2018, 10:41:25 pm
USB-Flasher is available from the ST-Micro web-site under the SPEAR600 page..
But is a compatible image available to flash with this tool ?

Well, technically we have all of the 'pieces' in order to flash

Very possible it is .NB0 file as it ROM image (and it used in uBoot for flash via TFTP IIR). You can convert it from .BIN file with cvrtbin.exe
Cvrtbin need start address and image length that can be viewed with viewbin.exe
Code: [Select]
cvrtbin -r -a start_in_hex -w 32 -l length_in_hex nk.bin
-w 32 is length of block (4 bytes)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on March 22, 2018, 10:59:34 pm

Well, technically we have all of the 'pieces' in order to flash, as most of the pieces are in the firmware file... but we still have to construct the image files first, but I haven't figured all of the mapping out yet, unless someone else knows offhand the flat file arrangement of the NOR & NAND flashes...

I've dumped the NOR flash via JTAG, and see the XLOADER, UBOOT, PBOOT, and MAC address locations in there, but I haven't finished going over it..

to dump NAND I believe I have to configure the spear600 memory controller (FSMC) to be able to read NAND, and you have to read it out in pages... I haven't done anything with that yet...

Also, with that USB flasher tool it looks like you need to know exact mem locations, etc for each part, so we'd have to spell all that out... but from what I see, it should be do-able... but hopefully we'd never have to get that far down the rabbit hole...

It's probably not a common thing to have the NOR flash corrupted, I think all the issues people have mentioned about 'corrupt flash' have been with the NAND flash, which is all OS components.

UBOOT/CEBoot should still be available via RS232 to reload a new OS image (nk.bin), and fix the NAND flash from there...

May be dumprom can help. This utility can make dump of files and modules from NB0 file and out txt file with address map

Code: [Select]
dumprom -d files_dump -5 NK.nb0 >> map.txt
files_dump is subdirectory for files output (should be exist)
-5 - WinCE5 compression mode

Edit: one more util that can extract one file from NB0
Code: [Select]
dumpromx -f file_name -d files_dump -5 NK.nb0
files_dump - destination subdirectory (should be exist)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bigeblis on March 24, 2018, 06:19:17 am
When you've the original LAN/VGA module installed there should be no warning but with the DIY module there is a little popup saying the LAN/VGA module has a fault but you can skip that by pressing any key
This means that the latest crack will not have the "Firmware incorrect" warning?

Yes, last 2.43 FW DLL patched in two places in BIN file: NETWORK patch and NAG patch. NAG patch eliminate any FW warning messages (in start and in about screen IIR).
Edit: and these messages shows if you start infiniivisionloader.exe with any params (with normal unpatched DLL)

Thank you for sharing! Perfect crack! Thank you!
Can I share it with my friends?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: udhay_cit on March 27, 2018, 02:37:21 pm
Hi, I'm new to this forum and its my first post. I'm too late to visit here and the discussions are extended to 70+ pages.

Is it finally the DSOX3000 hacked? My firmware version is 2.36.2013091201. I'm looking for bandwidth upgradation from 100MHz to any higher. If it is hackable, please any one redirect me to a right post.

Regards
Udhay
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jasonbrent on March 27, 2018, 03:19:21 pm
Hi, I'm new to this forum and its my first post. I'm too late to visit here and the discussions are extended to 70+ pages.

Is it finally the DSOX3000 hacked? My firmware version is 2.36.2013091201. I'm looking for bandwidth upgradation from 100MHz to any higher. If it is hackable, please any one redirect me to a right post.

Regards
Udhay

Hint: Print button at the top right gets it all into one page, then search using CTRL-F/CMD-F.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on March 27, 2018, 03:36:39 pm
Hi, I'm new to this forum and its my first post. I'm too late to visit here and the discussions are extended to 70+ pages.

Is it finally the DSOX3000 hacked? My firmware version is 2.36.2013091201. I'm looking for bandwidth upgradation from 100MHz to any higher. If it is hackable, please any one redirect me to a right post.

Regards
Udhay

Hint: Print button at the top right gets it all into one page, then search using CTRL-F/CMD-F.

Short answer is yes, you can release ALL features of your scope. The 2000/3000 share the exact same firmware/software.

Read backwards and you'll get the latest information on the latest firmware update. You really need to get yourself a LAN card (either a DIY version of which gerbers etc are in this thread, OR, the Keysight VGA/LAN). The LAN card lets you telnet into the scope to initiate the steps necessary to release all the features . Again, read backwards from this point, won't take you more than 30 mins or so to get the most recent firmware update sequence (using a LAN card and an external USB flash drive).

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jasonbrent on March 27, 2018, 03:41:08 pm
Hi, I'm new to this forum and its my first post. I'm too late to visit here and the discussions are extended to 70+ pages.

Is it finally the DSOX3000 hacked? My firmware version is 2.36.2013091201. I'm looking for bandwidth upgradation from 100MHz to any higher. If it is hackable, please any one redirect me to a right post.

Regards
Udhay

Hint: Print button at the top right gets it all into one page, then search using CTRL-F/CMD-F.

Short answer is yes, you can release ALL features of your scope. The 2000/3000 share the exact same firmware/software.

Read backwards and you'll get the latest information on the latest firmware update. You really need to get yourself a LAN card (either a DIY version of which gerbers etc are in this thread, OR, the Keysight VGA/LAN). The LAN card lets you telnet into the scope to initiate the steps necessary to release all the features . Again, read backwards from this point, won't take you more than 30 mins or so to get the most recent firmware update sequence (using a LAN card and an external USB flash drive).

cheers,
george.

The 3KT firmware is 7.x. .. but otherwise, I expect what you said is correct. My DSOXLAN is awaiting customs clearance at the moment before I experiment with my 3KT.

*EDIT*: DSOXLAN arrived. I've been able to telnet in, but haven't had time to try other options yet. Perhaps tomorrow.

-j
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on April 01, 2018, 11:35:40 pm
Hi All,


I put together a 3-in-1 DSOX LAN board, to incorporate the LAN setup everyone is already using, plus a USB-UART

setup and JTAG buffer, to have all 3 interfaces available via the LAN card faceplate. 

(Thanks to everyone on here that did the real work getting the LAN card figured out, all the hard work.  I just

incorporated those setups, and tacked on an RS232 setup and JTAG setup.)


The USB uart setup pulls the 3.3v power for the chip from the HOST USB 5v power, so that the serial port can be up

and connected to, before the scope is powered on.  This makes it super easy to power on the scope and immediately

halt in UBOOT. (hitting spacebar while you power on the scope)

The JTAG buffer setup just provides a nice buffered setup (same buffer setup that's been used in numerous other

jtag projects, etc)


I found that the 'SEGGER JLINK-EDU' is a very nice and super easy device to use, and it already has defines setup

for the SPEAR600.  (no defined setup for programming flash or reading the NAND flash, as the SPEAR600-FSMC needs to

be setup manually, but you can easily dump the NOR flash, the most important anyhow).

JLINK-EDU is same as JLINK-BASE, but meant for non-commerical use, which is fine for us.  And it's only $60 from

Digi-key and others.


In order to use JTAG, you have to pull up those two pins as was shown way back around page 6 I think of this

thread, so I added a dip-switch onto the board for all 3 locations, and you can actually run wires from those 3

pads to the board, and use the dipswitches to turn on/off those enable pins.

But since they are by default pulled LO by 81 ohm resistors, you have to remove them, and either replace with 10k,

or just leave open, and let the board do the pullup/pulldown.


You can also just build the board and only populate what you want, ie you can leave JTAG un-populated, and also

don't need to populate any of the LEDs, I just did that for fun, and it looks pretty when they light up :)



Attached are some pics of the board, the initial UBOOT menu (when halted via the serial port), etc..

(see the hackaday link for all the files)


https://hackaday.io/project/114593-dsoxlanplus (https://hackaday.io/project/114593-dsoxlanplus)


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on April 02, 2018, 06:30:50 am
Hi All,


I put together a 3-in-1 DSOX LAN board, to incorporate the LAN setup everyone is already using, plus a USB-UART

setup and JTAG buffer, to have all 3 interfaces available via the LAN card faceplate. 

(Thanks to everyone on here that did the real work getting the LAN card figured out, all the hard work.  I just

incorporated those setups, and tacked on an RS232 setup and JTAG setup.)


The USB uart setup pulls the 3.3v power for the chip from the HOST USB 5v power, so that the serial port can be up

and connected to, before the scope is powered on.  This makes it super easy to power on the scope and immediately

halt in UBOOT. (hitting spacebar while you power on the scope)

The JTAG buffer setup just provides a nice buffered setup (same buffer setup that's been used in numerous other

jtag projects, etc)


I found that the 'SEGGER JLINK-EDU' is a very nice and super easy device to use, and it already has defines setup

for the SPEAR600.  (no defined setup for programming flash or reading the NAND flash, as the SPEAR600-FSMC needs to

be setup manually, but you can easily dump the NOR flash, the most important anyhow).

JLINK-EDU is same as JLINK-BASE, but meant for non-commerical use, which is fine for us.  And it's only $60 from

Digi-key and others.


In order to use JTAG, you have to pull up those two pins as was shown way back around page 6 I think of this

thread, so I added a dip-switch onto the board for all 3 locations, and you can actually run wires from those 3

pads to the board, and use the dipswitches to turn on/off those enable pins.

But since they are by default pulled LO by 81 ohm resistors, you have to remove them, and either replace with 10k,

or just leave open, and let the board do the pullup/pulldown.


You can also just build the board and only populate what you want, ie you can leave JTAG un-populated, and also

don't need to populate any of the LEDs, I just did that for fun, and it looks pretty when they light up :)



Attached are some pics of the board, the initial UBOOT menu (when halted via the serial port), etc..

(see the hackaday link for all the files)


https://hackaday.io/project/114593-dsoxlanplus (https://hackaday.io/project/114593-dsoxlanplus)

WOW, looks much better than mine!  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eevfans on April 09, 2018, 10:41:57 am
Hi guys, I have a DSO-X 3034A, unfortunately the firmware was down. The xloader, pboot and uboot works fine. I have updated the pboot and the uboot with the same file in the update packet 3000XSeries.02.43.2018020635.ksb (use uboot with uart to stop booting pboot progress and use kermit protocol to transfer files to memory and use cp command to overwrite the old pboot and uboot).And the nand memory should flash too, but I don't know how and where to get the nand data? In other words how can I fix it by my hand. Have any ideas? (PS: the nand has been erased and I don't have a lan module)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on April 09, 2018, 01:12:59 pm
Hi guys, I have a DSO-X 3034A, unfortunately the firmware was down. The xloader, pboot and uboot works fine. I have updated the pboot and the uboot with the same file in the update packet 3000XSeries.02.43.2018020635.ksb (use uboot with uart to stop booting pboot progress and use kermit protocol to transfer files to memory and use cp command to overwrite the old pboot and uboot).And the nand memory should flash too, but I don't know how and where to get the nand data? In other words how can I fix it by my hand. Have any ideas? (PS: the nand has been erased and I don't have a lan module)
Not sure but is "start usb" works in uboot prompt? (With USB flash connected)

Otherwise you should take LAN for TFTP upload kernel.

Edit: it should be .NB0 file for upload. You can find convert utilities in this topic.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eevfans on April 09, 2018, 01:29:52 pm
Hi guys, I have a DSO-X 3034A, unfortunately the firmware was down. The xloader, pboot and uboot works fine. I have updated the pboot and the uboot with the same file in the update packet 3000XSeries.02.43.2018020635.ksb (use uboot with uart to stop booting pboot progress and use kermit protocol to transfer files to memory and use cp command to overwrite the old pboot and uboot).And the nand memory should flash too, but I don't know how and where to get the nand data? In other words how can I fix it by my hand. Have any ideas? (PS: the nand has been erased and I don't have a lan module)
Not sure but is "start usb" works in uboot prompt? (With USB flash connected)

Otherwise you should take LAN for TFTP upload kernel.
the uboot don't support usb device and I used three versions uboot, the version from the factory (unknown),the version which in 3000XSeries.02.35.2013061800 certainly support boot from usb and the last update packet 3000XSeries.02.43.2018020635 version uboot.All of these cannot boot from the usb disk which can boot on my friend's same DSO-X 3034A with version 02.35.2013061800. I need to modify the lan board and submit to the factory to production, it may be a few days.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on April 09, 2018, 05:01:21 pm



I does not mean boot OS from USB. I know that is impossible in last versions. I mean that some uboot version (in general) can load kernel file from USB and write it to NAND. So is "start usb" command work in uboot? If yes you can try "usb write"
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jasonbrent on April 10, 2018, 01:57:11 am
DSOX3014T running 07.20.2017102614 "liberated".
Unsure how to get rid of "WARNING: Unsealed Instrument".. which also seems to cause "Hardware Self Test" to fail with "Self test failed: Firmware Status".

Some of my licenses still show a * beside them, but i think that's because it has "valid" trial licenses in place when it was liberated.

Thank you to those who have shared.

-j
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on April 10, 2018, 09:47:23 am



Some of my licenses still show a * beside them, but i think that's because it has "valid" trial licenses in place when it was liberated.

Thank you to those who have shared.

-j

In 3000A scope this sign * is appear if I use group license ("-All").

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jasonbrent on April 11, 2018, 03:22:20 am



Some of my licenses still show a * beside them, but i think that's because it has "valid" trial licenses in place when it was liberated.

Thank you to those who have shared.

-j

In 3000A scope this sign * is appear if I use group license ("-All").

Ah ha, ok, makes sense.

If there are any ambitious folk, Microsoft Research released an API/toolchain called "Detours" (a.k.a. "trampolines") years ago that allows for interception of an API call, inserting your own code, then jumping (trampolining) to the original API call. It's available here: https://www.microsoft.com/en-us/research/project/detours/ (https://www.microsoft.com/en-us/research/project/detours/)

Detours API 3.0 apparently works on ARM/WindowsCE.

With some work, the code paths that check for the validity of licenses or the checks or "Unsealed Instrument" could be dynamically skipped instead of the actions of manually patching the checks.

(There are reasonably large projects that use this library to greatly extend the original intended function of some windows softwares...).

-j
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jasonbrent on April 11, 2018, 08:22:17 pm
Cool deal with those offsets, yes, the 3KT firmware version is the same, I can't confirm it's the same _image_ for the 4K series though.

Perhaps I'm missing something, but one could just telnet in, copy from USB and replace the "link" file with a more intelligent executable stub which also handled the detouring. No need to rebuild the image in that scenario, right?

I refreshed my IDA pro license to current yesterday hoping to get some time to have "fun" with all of these images soon-ish.

-j
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on April 11, 2018, 08:28:38 pm
Cool deal with those offsets, yes, the 3KT firmware version is the same, I can't confirm it's the same _image_ for the 4K series though.

The download/install images are different but the changes are quite subtle I believe.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on April 11, 2018, 08:36:21 pm
Has anyone looked at the 1000X firmware patch?  It is not taking the options like the 2000X or the 3000X when loaded from \Secure...  Wondering why Keysight is keeping it more protected than the more expensive 2000X or 3000X series
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlloyd1 on April 11, 2018, 11:32:46 pm

That's a good question.
I might guess they'll sell A LOT more 1000 than 2000 & 3000 (combined?).

mlloyd1
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: utmba95 on April 15, 2018, 12:47:06 am
Hi,

On a 3000A model I've tried both 2.42 and 2.43, but I've been unable to make the changes sticky.  I'm using these instructions:

0) Install correct Firmware version first (i.e. in this case 2.43)
1) Download Safar's patched_nk_bin.comp file and copy to a USB stick and plug in.
2) Telnet into the scope.
3) Login infiniivision / skywalker1977
4) processmgr kill infiniivisionlauncher.exe
5) \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
6) Create a file on the USB stick called infiniivision.lnk with contents (e.g.)
7a) delete (or rename) any other lnk in \secure\startup folder. Should be only one file with lnk extension here.
7b) copy \usb\infiniivision.lnk to \secure\startup
8 ) reboot and *not* good to go

This is what my infiniivision.lnk looks like:
\secure\startup> type infiniivision.lnk

211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

When I reboot, it comes up without any licenses enabled.  If I telnet in and run these two commands, I get a session with the licenses enabled.
processmgr kill infiniivisionlauncher.exe
infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

Anybody know what I'm doing wrong?  It doesn't seem to be executing the .lnk file.

\> dir \secure\startup

    Directory of \secure\startup

03/03/18  07:18p                         217 infiniivision.lnk
01/27/17  02:51p                           0 orig.sav
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on April 16, 2018, 03:06:02 pm
This is what my infiniivision.lnk looks like:
\secure\startup> type infiniivision.lnk

211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

\> dir \secure\startup

    Directory of \secure\startup

03/03/18  07:18p                         217 infiniivision.lnk
01/27/17  02:51p                           0 orig.sav

Strange. All looks correct.
Not sure for help but... I have absolutely the same string but file length is 215 bytes, not 217. It may be LFCR in the end disturb?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on April 16, 2018, 03:09:28 pm
5) \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
Can this step be run from a custom made install script instead of telnet?  1000X series does not have LAN interface.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on April 16, 2018, 03:33:34 pm


5) \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
Can this step be run from a custom made install script instead of telnet?  1000X series does not have LAN interface.

Think it possible, you need make some fake cab file with xml script.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on April 16, 2018, 05:55:48 pm


5) \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
Can this step be run from a custom made install script instead of telnet?  1000X series does not have LAN interface.

Think it possible, you need make some fake cab file with xml script.
Is the patch just to avoid the unfinished software error message or open all options?  the infiniivisionLauncher application (or infiniivisionCore.DLL) on the 1000X does not take any options
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on April 16, 2018, 06:13:45 pm




5) \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
Can this step be run from a custom made install script instead of telnet?  1000X series does not have LAN interface.

Think it possible, you need make some fake cab file with xml script.
Is the patch just to avoid the unfinished software error message or open all options?  the infiniivisionLauncher application (or infiniivisionCore.DLL) on the 1000X does not take any options

Just avoid error message only (and patch network subsystem). Options opens by start infiniivisionLauncher with switches
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: utmba95 on April 17, 2018, 01:01:06 am
This is what my infiniivision.lnk looks like:
\secure\startup> type infiniivision.lnk

211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

\> dir \secure\startup

    Directory of \secure\startup

03/03/18  07:18p                         217 infiniivision.lnk
01/27/17  02:51p                           0 orig.sav

Strange. All looks correct.
Not sure for help but... I have absolutely the same string but file length is 215 bytes, not 217. It may be LFCR in the end disturb?

Thanks!  I had a *leading* LFCR that I hadn't noticed.  :-[  I had actually checked for one at the end.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: edyno on April 17, 2018, 04:10:28 pm
Hi All,
I have a new DSOX2002A. During the short time I needed upgrade from 2ch to 4ch. After disassembly the device, I did investigate what all I need to buy. Semiconductors, relays and resistors are clear. But, for example, I do not know all the capacitor values now. If you ever know the order numbers or values, I'll be happy. Thanks in advance for every tip.

I attach some photos DSOX2002A  if someone wants to do a similar job in the future.
** I am working on list of parts **
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlloyd1 on April 26, 2018, 03:12:14 am
Very interesting stuff here.
Has anybody successfully hacked the DSO-X 3024T running FW version 7.20.20171026?

mlloyd1

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Netroman on May 05, 2018, 06:29:37 am
Hi guys - please allow me to ask one question: If I update my MSOX3024T with latest firmware 2.43 - is logging in via telnet still possible? Or possibly they modified the updates to prevent telnet access?

Absolutely great work! Because of this thread I just ordered this (for hobby) not very cheap puppy ;-)

Thanks, best regards Josef
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JeffreyLatter on May 05, 2018, 07:11:58 am
The 3000T X-series runs the 7.xx firmwares and at least with the 7.20.20171026 firmware, telnet access and modification is possible  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on May 05, 2018, 10:17:33 am
Hi guys - please allow me to ask one question: If I update my MSOX3024T with latest firmware 2.43 - is logging in via telnet still possible? Or possibly they modified the updates to prevent telnet access?

2.43 is a latest FW for "A" version (not for T). Telnet still here:
infiniivision/skywalker1977
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Netroman on May 05, 2018, 10:30:26 am
Thanks a lot for your important hint - I did get the wrong firmware though searched for my scope on keysight site.

Now I downloaded the 7.20 from keysight.

So I guess, it will be much more difficult to patch the soft for my scope - because I have to find the right Hex-Locations for patching? Your tutorials were related most to the other variants  :(

Thanks again, Josef
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlloyd1 on May 07, 2018, 08:58:43 pm
Thanks again Jeffrey.
 :-+
I suspected this would work.
I'll try this on mine in a few weeks and report back.
In the middle of a move right now.

mlloyd1
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jasonbrent on May 08, 2018, 03:18:51 am

...snip....

Code: [Select]

3000T series:

firmware 7.20
----------------


1) options patch:  0x486f3c  --> "04 00 A0 E1" --> "00 00 A0 E3"
2) nag patch:      0x4f22c8  --> "A8 F1 93 E5" --> "01 00 A0 E3"




To understand how to apply these patches, best way is to follow safar's post, details here... they seem to have taken the same approach with all of the firmware's now, the DLL is NO longer on disk, it has to be modified directly in the Windows CE image (nk.bin)


https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1453285/#msg1453285 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1453285/#msg1453285)

@PhillyFlyers, @Safar - Thank you.

7.20 on 3KT now has the nag gone.. I patched "options" and "nag".

Using Safar's instructions, it took me a bit to realize that I needed to use the offsets provided by Philly in infiiniivision.dll to get a signature to match in the uncompressed.bin, plus the viewbin's data dump to get the "Record" (Record[173 for 7.2/3KT), use the hex in that data dump to get the offset in nk.bin to find the beginning/end of the dll in the bin, patch up the 2 locations, update checksum, compress, copy to usb, flash via telnet... (hopefully this very quick chain of thought helps someone else later...).

What is unexpected is on boot I'm now seeing "System concerns detected: - Secure Storage is uninitialized. Please set instrument serial and licensing model numbers." as a per-boot popup. Once I close that, about shows the proper serial#/model/bandwidth and all options.

I'm using the simple loader that jeffrey helped with along with the patched offsets.

I don't see any direct reference to that string/message in the (printed) thread, although there are some similar messages.... I didn't get this before patching nk.bin -- did I hose the patch or just needed to expect "secure storage is uninitialized"?

Thanks,

-j

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JeffreyLatter on May 08, 2018, 02:07:36 pm

...snip....

Code: [Select]

3000T series:

firmware 7.20
----------------


1) options patch:  0x486f3c  --> "04 00 A0 E1" --> "00 00 A0 E3"
2) nag patch:      0x4f22c8  --> "A8 F1 93 E5" --> "01 00 A0 E3"




To understand how to apply these patches, best way is to follow safar's post, details here... they seem to have taken the same approach with all of the firmware's now, the DLL is NO longer on disk, it has to be modified directly in the Windows CE image (nk.bin)


https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1453285/#msg1453285 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1453285/#msg1453285)

@PhillyFlyers, @Safar - Thank you.

7.20 on 3KT now has the nag gone.. I patched "options" and "nag".

Using Safar's instructions, it took me a bit to realize that I needed to use the offsets provided by Philly in infiiniivision.dll to get a signature to match in the uncompressed.bin, plus the viewbin's data dump to get the "Record" (Record[173 for 7.2/3KT), use the hex in that data dump to get the offset in nk.bin to find the beginning/end of the dll in the bin, patch up the 2 locations, update checksum, compress, copy to usb, flash via telnet... (hopefully this very quick chain of thought helps someone else later...).

What is unexpected is on boot I'm now seeing "System concerns detected: - Secure Storage is uninitialized. Please set instrument serial and licensing model numbers." as a per-boot popup. Once I close that, about shows the proper serial#/model/bandwidth and all options.

I'm using the simple loader that jeffrey helped with along with the patched offsets.

I don't see any direct reference to that string/message in the (printed) thread, although there are some similar messages.... I didn't get this before patching nk.bin -- did I hose the patch or just needed to expect "secure storage is uninitialized"?

Thanks,

-j



When using the patched offsets, you don't need to use the launcher but just the .lnk with added options and character count, this will remove any message in my experience.
When starting using the launcher, the popup occurs with my scope too, but then patched offsets is not neccesary for added options.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cisco on May 16, 2018, 06:50:40 am
can you please tell me how i can punch for my friend and my friend punch for thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: SUKA_KRYSA on May 16, 2018, 11:41:51 am
First, I wanna say big thanks to all of you guys and especially to Safar for all of your help!
I've succesfully liberated pair of DSO-X 2012A and MSO-X 4034A respectively, and they works just fine.

As PhillyFlyers stated two posts earlier, 4k series can be succesfully hacked with the .bin.comp file that he generously provided. As .lnk file, I simply used that one for 3k series and it suites just well, thanks again to Safar. The license list is enormous, as you can see.


Sorry for my english though.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Netroman on May 16, 2018, 12:49:29 pm
Does the 4k patched file also work for MSOX3000T series  :-// (because it has the same firmware revision number and date)?

Thanks in advance, Josef
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Netroman on May 17, 2018, 08:22:42 am
Thank you so much - great work.  :-+ :-BROKE :-+
In the meanwhile I'm working on the 1 GHz mod, then Comes the Firmware hack  :box:
Best regards from Austria, Josef
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on May 17, 2018, 07:24:50 pm
Heya All,

Does anyone know the scoop on the 4k series, in regards to the PCB and bandwidth upgrades?


Is it the same as the 2k/3k setup, where 200mhz can go up to 350mhz?  ie is there different filters needed to go from 350 to 500, and then to 1Ghz or 1.5Ghz?



So if for example you have a DSOX4024, can it only go up to 350Mhz without frontend changes... just wondering what fun things can be done with a 4k series...





Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on May 17, 2018, 08:14:06 pm
Heya All,

Does anyone know the scoop on the 4k series, in regards to the PCB and bandwidth upgrades?


Is it the same as the 2k/3k setup, where 200mhz can go up to 350mhz?  ie is there different filters needed to go from 350 to 500, and then to 1Ghz or 1.5Ghz?



So if for example you have a DSOX4024, can it only go up to 350Mhz without frontend changes... just wondering what fun things can be done with a 4k series...

The 4000 series hardware/software bandwidth limits are the same as a 3000 series with the exceptions the 4000 series has one extra step to 1.5 GHz and they don't sell a 100 MHz version. That means a DSOX4024 can go to 200 MHz max without a hardware upgrade. There are 4 hardware versions in the 4000 series - 200 MHz, 350/500 MHz, 1 GHz and 1.5 GHz.
So the only software bandwidth upgrade supported in the 4000 series is if you have the 350 MHz model, a software license can upgrade it to 500 MHz. Any other bandwidth upgrade requires a new mainboard from Keysight.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on May 17, 2018, 08:49:13 pm
Heya All,
Does anyone know the scoop on the 4k series, in regards to the PCB and bandwidth upgrades?
Is it the same as the 2k/3k setup, where 200mhz can go up to 350mhz?  ie is there different filters needed to go from 350 to 500, and then to 1Ghz or 1.5Ghz?
So if for example you have a DSOX4024, can it only go up to 350Mhz without frontend changes... just wondering what fun things can be done with a 4k series...

I was wondering this too... thanks TheSteve for the reply.  I attached some clips about upgrades from the Keysight documents.

I don't believe we have any info here about specific hardware mods that would be needed to upgrade a, say 500MHz model to 1GHz.  Is it likely to be just a few missing or different components?  Or, major differences necessitating complete board swaps?

Aside: The included probes (all models I believe) are N2894A (700MHz bandwidth)...so even if possible to do upgrade to 1GHz or more one will need to buy some new probes...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on May 17, 2018, 09:44:22 pm
Was just looking back over this..

back in MemSet's instructions for the 350/500Mhz mod, he did say the upgrade can be applied to 3000A and 4000A models, so the frontend filter components are prob. the same... I also remember someone saying the 3000T and 4000 mainboards are pretty much the same, except the extra memory sizes (ram/flash), and the larger screen on the 4k..

I'm willing to bet the 3000T 1Ghz upgrade components would be the same if doing it to a 4k series scope...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on May 17, 2018, 11:00:35 pm
Active probes are generally used above 500 MHz so that isn't really an issue.
The part swap to go to 1 GHz should be the same or nearly the same as the 3000T however the PCB layout isn't identical so some research is needed in that area.
I would have tried it already but I don't seem to have a 4000 series scope on the bench.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on May 18, 2018, 09:30:17 am
I do  :)
I sold my DSOX3024a and purchased a DSOX4024a instead.
The larger screen (though unfortunately not higher resolution) and the touch (not always, but perfect for dragging or entering numbers/characters) are a really nice improvement over the 3000 series. And I compared it to an R&S RTB2004: the Keysight is way better suited for daily work (easier and quicker to use, more and better functionality, not artificially crippled as the RTB).

Btw, Keysight does have a nice offer of a DSOX4024a including a fresh calibration at the moment: (https://www.ebay.com/itm/183228321094 (https://www.ebay.com/itm/183228321094)) for approx. 3000 Euro including world wide shipping! This is a really nice deal! And you can make an offer. 10%-15% off is usually no problem at the Keysight store.
If you read the posts above: transforming it into a MSOX4024a with all options enabled is not too difficult.
I will do the 500Mhz modification in a month or maybe two and will make photos of all needed steps then and post them here.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: AcepilotNRW on May 18, 2018, 02:25:42 pm
Can anyone give me a hint how to log in into my scope using telnet?
I am sitting in front of an DSOX3012T
On that scope the Firmware 2017.1026 is allready installed, never the less i prepared the hacked firmware to get all options.
Login into to scope using user infiniivision and pass skywalker1977 is not working, even when i try it more the one time.
Is there a need to flash an old firmeware to the scope to get the login running?
If yes it would be fine if someone will have an old working firmware

Kind regards
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JeffreyLatter on May 18, 2018, 03:03:57 pm
Can anyone give me a hint how to log in into my scope using telnet?
I am sitting in front of an DSOX3012T
On that scope the Firmware 2017.1026 is allready installed, never the less i prepared the hacked firmware to get all options.
Login into to scope using user infiniivision and pass skywalker1977 is not working, even when i try it more the one time.
Is there a need to flash an old firmeware to the scope to get the login running?
If yes it would be fine if someone will have an old working firmware

Kind regards

Use this script to generate correct password for the 3000T series.

https://repl.it/repls/FrostyUnsungAcrobat (https://repl.it/repls/FrostyUnsungAcrobat)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on May 18, 2018, 04:18:28 pm
I do  :)
I sold my DSOX3024a and purchased a DSOX4024a instead.
The larger screen (though unfortunately not higher resolution) and the touch (not always, but perfect for dragging or entering numbers/characters) are a really nice improvement over the 3000 series. And I compared it to an R&S RTB2004: the Keysight is way better suited for daily work (easier and quicker to use, more and better functionality, not artificially crippled as the RTB).

Btw, Keysight does have a nice offer of a DSOX4024a including a fresh calibration at the moment: (https://www.ebay.com/itm/183228321094 (https://www.ebay.com/itm/183228321094)) for approx. 3000 Euro including world wide shipping! This is a really nice deal! And you can make an offer. 10%-15% off is usually no problem at the Keysight store.
If you read the posts above: transforming it into a MSOX4024a with all options enabled is not too difficult.
I will do the 500Mhz modification in a month or maybe two and will make photos of all needed steps then and post them here.

Very nice! If I didn't have a 3000T series already I'd be very interested in that scope.  If you run into any issues with the upgrade you think I can help with let me know. Looking forward to the pictures and results.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on May 19, 2018, 03:27:48 pm
Btw, Keysight does have a nice offer of a DSOX4024a including a fresh calibration at the moment: (https://www.ebay.com/itm/183228321094 (https://www.ebay.com/itm/183228321094)) for approx. 3000 Euro including world wide shipping! This is a really nice deal! And you can make an offer. 10%-15% off is usually no problem at the Keysight store.
Was sold just a few hours after I mentioned it, for only 3200 USD = 2700 Euro. What a snatch! Congratulations to the buyer!
Usually you never ever get a 4000 series scope for this price. Well done. To be honest, I thought a moment of buying it myself, keeping it (because of the fresh calibration) and selling my own DSOX4024a with a profit, but my very limited time let me decide against this. (But the little devil  >:D in my head now is nagging me: 'look - it could have been yours')
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: maxpayne on May 19, 2018, 04:09:22 pm
I m sure someone from here bought it after seeing your post ! ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on May 19, 2018, 04:57:47 pm
I know who bought it(not me). At the price it sold for I was very tempted as well.
Hopefully we will end up with some good pictures and perhaps some mod info.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on May 20, 2018, 07:20:19 pm
Well the buyer chickened out so it has been relisted - anyone else interested?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on May 20, 2018, 07:27:37 pm
Well the buyer chickened out so it has been relisted - anyone else interested?

I don't see it?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on May 20, 2018, 07:30:10 pm
Well the buyer chickened out so it has been relisted - anyone else interested?

I don't see it?

https://www.ebay.com/itm/192545547880 (https://www.ebay.com/itm/192545547880)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on May 20, 2018, 07:37:50 pm
https://www.ebay.com/itm/192545547880 (https://www.ebay.com/itm/192545547880)

"This item does not ship to Netherlands "  :-//
That's why it didn't show up for me.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on May 20, 2018, 08:05:25 pm
https://www.ebay.com/itm/192545547880 (https://www.ebay.com/itm/192545547880)

"This item does not ship to Netherlands "  :-//
That's why it didn't show up for me.

That is a shame. I still want it too, but then I'd have to sell my 3000t series.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: KrudyZ on May 20, 2018, 09:53:52 pm
What does it really add over the 3000T, though?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on May 20, 2018, 09:58:29 pm
What does it really add over the 3000T, though?

Bigger screen, builtin VGA and network, second waveform gen and 10 MHz ref in. Nothing I really need, the bigger screen is always nice of course. I'd just like to mod another scope and it would be fun to livestream the entire process.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: KrudyZ on May 20, 2018, 10:07:07 pm
What does it really add over the 3000T, though?

Bigger screen, builtin VGA and network, second waveform gen and 10 MHz ref in. Nothing I really need, the bigger screen is always nice of course. I'd just like to mod another scope and it would be fun to livestream the entire process.

Well, if it's just for fun, then by all means get it!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on May 20, 2018, 11:38:51 pm
What does it really add over the 3000T, though?

Bigger screen, builtin VGA and network, second waveform gen and 10 MHz ref in. Nothing I really need, the bigger screen is always nice of course. I'd just like to mod another scope and it would be fun to livestream the entire process.

Well, if it's just for fun, then by all means get it!

Selling a modded scope isn't always an easy process, anyone looking for a MSOX3024t with full properly licensed app bundle that's been modded to 1 GHz? :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on May 21, 2018, 10:24:06 am
https://www.ebay.com/itm/192545547880 (https://www.ebay.com/itm/192545547880)

"This item does not ship to Netherlands "  :-//
That's why it didn't show up for me.

They will ship to the EU but you'll have to pay them some VAT on top of the listed price.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on May 21, 2018, 10:45:54 am
https://www.ebay.com/itm/192545547880 (https://www.ebay.com/itm/192545547880)

"This item does not ship to Netherlands "  :-//
That's why it didn't show up for me.

They will ship to the EU but you'll have to pay them some VAT on top of the listed price.

Funny, now the (ended) listing says: "Shipping: Will ship to Netherlands" while yesterday it clearly said it would not. Anyway, I only mentioned it to explain why it didn't show up for me in a search.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on May 21, 2018, 11:29:28 am
sold again for exactly $3200. Probably somebody asked them about the shipping and they changed it back. I was wondering too about the excluded shipping. Beside some African and some other obscure countries, Europe was completely excluded. Strange.
@Toploser: why should they add VAT for European countries when they ship from Malaysia (the auctions says: Item location: Keysight Factory, Penang, Malaysia)? (the only reason I can think of is, that the unit is already in an European Keysight facility).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on May 21, 2018, 11:37:42 am
Message for SUKA_KRYSA:
FYI: your mailbox is now quoted "full" if anybody tries to send you a PM. As a new user you will now need at least 5 posts before anybody will be able to send you a PM again.
I am writing this, as this security precaution from the admin is pretty unknown (I ran into this before with another new user).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on May 21, 2018, 11:47:27 am
sold again for exactly $3200. Probably somebody asked them about the shipping and they changed it back. I was wondering too about the excluded shipping. Beside some African and some other obscure countries, Europe was completely excluded. Strange.
@Toploser: why should they add VAT for European countries when they ship from Malaysia (the auctions says: Item location: Keysight Factory, Penang, Malaysia)? (the only reason I can think of is, that the unit is already in an European Keysight facility).

I presume they collect the VAT that would be due when the scope was imported on behalf of DPD or whoever they use for shipping, so it can be delivered direct to the buyers door without being delayed while the shipper tries to get the VAT out of the buyers reluctant fingers...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on May 21, 2018, 09:19:01 pm
Yeah, it was quite tempting, but same here, I already got a 3k recently and did all the mods for 500Mhz.    I was intrigued by the 12" screen, but it seems like they made this the 'cadillac variant'  of the 2k/3k series.  LOL

Having that extra real estate sure would be nice, but why do they leave that stupid menu bar on the right of the screen that you can't hide?  At least maybe they can improve this in future software if they care too.. but just seems like a pure waste of screen space..

Dave's writeup/teardown was a nice synopsis of what you are really getting, which ended up being a larger screen that should really be more than 800x600, and a built-in vga/lan port, plus some extra trigger/zoom options.  What you really get is a nice sticker shock!  LOL

(and the MSO port on the back top is kind of a PITA)

At least this used one above sold for somewhat of a decent price, but still, 3kT series seems the better deal.


Dave's summary in case anyone missed it:

https://www.youtube.com/watch?v=WhAWwomKRaE (https://www.youtube.com/watch?v=WhAWwomKRaE)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: NorcalNerd on May 27, 2018, 05:30:35 pm
Hello all,

Please advise if my re-hashed steps below are good (or not) -- I've read through this blog, combined Safar's, PhillyFlyers (thanks!) and others posts into a guide I hope I can follow but if anyone with experience can please "sanity check" it I would appreciate it.

I probably paid too much for a (very clean) DSOX3024A, so I'm hoping to avoid bricking it (at my age I may never be able to replace it) -- no worries, I accept any/all responsibility for bricking my scope, but I'm thinking it should go fine, I'm just not 100% certain I have all of the steps right...

Can I ever recover if the flash doesn't work -- and can I get back to "official" 2.43 if I need to send it in for repair or cal?

This is NOT for a commercial application, I'm an electronic tech, reasonably confident I won't make a major mistake.....

Thanks in advance for your review of the below!   I am hoping the latest 2.43 image attached to #msg1453247 has already been "liberated", as I'm not sure I would undertake the entire process "end to end".

Starting with an DSOX3024A I recently updated to Agilent 2.43 -- it has an Agilent DSOXLAN.

Using Patched2.43 attached here https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1453247/#msg1453247 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1453247/#msg1453247):

0/ Telnet to DSOX3024A.  Do the following in WindowsCE:

1/ Copy the uncompressed 2.43 patched.bin.comp attached to #msg1453247 from Windows PC to the scope

2/ Compress the uncompressed posted 2.43 patched.bin.comp:

   compress  bincompress /d patched_nk.bin patched_nk.bin.comp

3/   Kill infiniivisionLauncher.exe process:

   processmgr kill infiniivisionlauncher.exe

4/ Flash: 

   \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
   
5/ Save the original link and make the new startup link:

   save the original infiniivision.lnk renaming it to something like "orig.sav".
   
   NOTE: the \secure\startup folder should contain ONLY ONE .lnk file, named infiniivision.lnk, with the below command line (do not add quotes):
   
   "211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"
   
   Note: the above link file is 215 bytes in length (thanks to utmba95 and Safar https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1479144/#msg1479144 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1479144/#msg1479144)).
   
6/   Reboot the Scope (and pray).

What else am I forgetting?

Is this a "one way" flash or is there any way I can get back to "vanilla" 2.43 in case I need to send it in for repair/cal?  I'm seriously intrigued that it appears the patched 2.43 in #msg1453247 is already "fixed", as if this is the case, the steps I need to perform are far fewer, much less to go wrong...

Thank you kindly,

NorcalNerd
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on May 27, 2018, 11:39:12 pm
Hello all, ...

(at my age I may never be able to replace it)

Too young or too old to replace it ?   :-DD

Too young:  forego house, marriage, kids
Too old: forego maintenance on house, marriage kids

Since it's for your own use anyway, I'd suggest one of the less invasive and reversible approaches.  The last 20% of this thread should cover it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on May 28, 2018, 01:35:11 am
Hello all,



You don't need 2 action, as it already compressed, iir

All another looks good (if you know that you doing of course)

And yes you can flash factory fw for wipe all "crimes" :)

Edit: and BW50 option do not work on DSOX3024A, this code for 350 Mhz version.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: SUKA_KRYSA on May 31, 2018, 11:14:01 am
My bad.
I was very busy recently, and did not have the opportunity to check the forum.

So, did you manage to successfully hack your scope?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: NorcalNerd on June 03, 2018, 06:31:44 pm
Thanks for asking SUKA_KRYSA,

I am continuing to research though Safar's recent reply indicates recover to factory-default 2.43 should be no problem.

Am I reading correctly that with the newer versions of the firmware, booting from "fixed" firmware on USB isn't possible; that 2.42 (or perhaps older) firmware could boot and run from USB -- but 2.43 cannot?  I may not have the correct firmware version where I recall this changed.

The longer boot time (for me) would not be a problem.

Thank you
NorcalNerd
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: SUKA_KRYSA on June 04, 2018, 07:14:49 am
Thanks for asking SUKA_KRYSA,

I am continuing to research though Safar's recent reply indicates recover to factory-default 2.43 should be no problem.

Am I reading correctly that with the newer versions of the firmware, booting from "fixed" firmware on USB isn't possible; that 2.42 (or perhaps older) firmware could boot and run from USB -- but 2.43 cannot?  I may not have the correct firmware version where I recall this changed.

The longer boot time (for me) would not be a problem.

Thank you
NorcalNerd

To be honest, I'm completely confused about what you want to do. As far as I understand, you got perfectly working scope, you've succesfully updated it to the latest firmware (2.43 in our case) and everything is fine for now. And you want to hack it by the Safar's method with no troubles e.g. breaking the scope, am I right?

If so, you don't need to decompress and compress that Patched2.43 file, you simply drop it onto the USB stick, boot up, telnet and further on. The only files that must be on the stick is infiniivision.lnk and patched_nk.bin.comp. Note: you create them on your PC, not on the scope via Telnet!

Don't know about older versions, I'm personally flashed straight on 2.43 and evertythibg works just fine. Boot time is the same.

The only issue is a repair/cal process. The patched firmware have no differences with the original one as long Keysight's certified technics don't digs into the code. Don't think they will do it with no reason, too much wasting their precious time. So I believe you can telnet again and overwrite infiniivision.lnk file with empty one before the call process. And again after. Great scheme, huh?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: edyno on June 07, 2018, 05:21:19 pm
Work on my DSOX2002A continues. The front panel was able to operate. Remaining add main PCB components ...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on June 07, 2018, 05:35:37 pm
Work on my DSOX2002A continues. The front panel was able to operate. Remaining add main PCB components ...
Cool! I assume you are the first who upgrades from 2 to 4 channels (at least I know nobody else).
If you dare to move to 500 Mhz for all channels, then some of the capacitors are already known. You may also PM Steve or Memset, they might have measured all capacitors and inductors from the input stage.
Where did you get the original knobs from? Are these spare parts which can be ordered?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: edyno on June 07, 2018, 07:32:24 pm
Hi Pinkus, Yes, knobs are from keysight. Today I received shipment.

Small knob::  OrderNr. = 75019-47402
Big knob:: OrderNr. = 75019-47401
Keyboard keypad:: OrderNr. = 75019-41901

Other parts are from mouser.com
(Rotary encoders, color leds, resistors, diodes, transistors ..)

As far as the main PCB is concerned, I have already measured almost the capacitors from the channels. I will continue when all parts come to me.

But I have trouble getting a twin BNC connector from the main PCB :(
Do you have an idea where is possible this twin BNC connector obtain?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dubbie on June 07, 2018, 09:45:44 pm
Having that extra real estate sure would be nice, but why do they leave that stupid menu bar on the right of the screen that you can't hide?  At least maybe they can improve this in future software if they care too.. but just seems like a pure waste of screen space..

I'm pretty sure that this is a limitation of the ASIC. I think it draws the pixels directly, so there is pretty much no chance that the screen will ever get any bigger.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on June 07, 2018, 10:16:47 pm
Having that extra real estate sure would be nice, but why do they leave that stupid menu bar on the right of the screen that you can't hide?  At least maybe they can improve this in future software if they care too.. but just seems like a pure waste of screen space..

I'm pretty sure that this is a limitation of the ASIC. I think it draws the pixels directly, so there is pretty much no chance that the screen will ever get any bigger.

That’s my reading of it too, the space for the waveform display is baked in. Before I became the owner of the 3000, I too was sceptical about the apparent waste of screen real estate, but to be honest I’ve not really found it a big deal. The alternative is the way the Tek MDO3000 does it where you get all sorts of nonsense invading your waveform display, which I find more irritating, having to continually clear the clutter off manually to be able to see the waveforms.

This is a side effect of using 16:9 displays, the 4:3 aspect ratio displays seem a better solution for a scope UI in my experience.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on June 07, 2018, 10:28:54 pm
But I have trouble getting a twin BNC connector from the main PCB :(
Do you have an idea where is possible this twin BNC connector obtain?
These connectors are probably a custom Keysight part = unobtainium. But as you can see, these connectors does have unusual long connection wires (> 1 cm), you probably can use regular single BNC connectors (e.g. Amphenol 162109) and a peace of metal you need to mill and drill, where you then screw the mentioned Amphenol connectors to (such as the other photo shows).
(Photos taken from Daves teardown of a 4000 series scope)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: edyno on June 11, 2018, 08:01:43 am
Yes, I agree with you. I will have to improvise somewhat with the connectors.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydron on June 11, 2018, 10:20:02 am
From the earlier pics it seems there is a custom Keysight front-end chip - how did you go about getting these? Just asking out of interest (don't own a Keysight scope), but am impressed with your ambitious product hacking project!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: edyno on June 11, 2018, 11:10:40 am
If you mean the chip: 2AD2-0001?
I bought 2pcs on aliexpress.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on June 12, 2018, 03:58:44 am
Where on earth did they get the chips from?  Are they bootleg from the foundry which Agilent used?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: edyno on June 12, 2018, 06:19:14 am
Good question, but I hope it's not fake and that the chips will work :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on June 12, 2018, 09:13:22 pm
Where on earth did they get the chips from?  Are they bootleg from the foundry which Agilent used?

In China, we try to find everything on Taobao.  :)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: lowimpedance on June 13, 2018, 02:21:10 am
Ahh.......definitely used then .. :-DD .

Nothing a band saw can't fix  :P.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: KrudyZ on June 13, 2018, 02:42:10 am
On the plus side, they're very likely to be the genuine article.
Who would go through the trouble of putting a fake chip on a PCB and then cut it out with a band saw...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydron on June 13, 2018, 07:00:02 am
Honestly I'm pretty glad someone is doing this and selling them. Assuming they work, it's much better someone is recycling and selling it for use in fixing stuff than having to toss out a scope because you can't buy one unobtanium chip from the manufacturer.

Just a shame that in the same market there's millions of fakes waiting to fuck up your project/product.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Saa1206 on June 13, 2018, 09:22:43 am
Sorry for newbe question, but do I get it right that telnet to XSO is only possible by LAN and not USB?
If so could someone be so kind as to point me at the cheapest and to some extent relaible way to get the DSOXLAN or it's clone?
Regards.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on June 13, 2018, 11:58:23 am
I purchased mine from user 'romantao'. This unit is good quality one and is working just fine. Just PM him to get one.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: NorcalNerd on June 15, 2018, 09:12:52 am
Thanks for asking SUKA_KRYSA,

I am continuing to research though Safar's recent reply indicates recover to factory-default 2.43 should be no problem.

Am I reading correctly that with the newer versions of the firmware, booting from "fixed" firmware on USB isn't possible; that 2.42 (or perhaps older) firmware could boot and run from USB -- but 2.43 cannot?  I may not have the correct firmware version where I recall this changed.

The longer boot time (for me) would not be a problem.

Thank you
NorcalNerd

To be honest, I'm completely confused about what you want to do. As far as I understand, you got perfectly working scope, you've succesfully updated it to the latest firmware (2.43 in our case) and everything is fine for now. And you want to hack it by the Safar's method with no troubles e.g. breaking the scope, am I right?

If so, you don't need to decompress and compress that Patched2.43 file, you simply drop it onto the USB stick, boot up, telnet and further on. The only files that must be on the stick is infiniivision.lnk and patched_nk.bin.comp. Note: you create them on your PC, not on the scope via Telnet!

Don't know about older versions, I'm personally flashed straight on 2.43 and evertythibg works just fine. Boot time is the same.

The only issue is a repair/cal process. The patched firmware have no differences with the original one as long Keysight's certified technics don't digs into the code. Don't think they will do it with no reason, too much wasting their precious time. So I believe you can telnet again and overwrite infiniivision.lnk file with empty one before the call process. And again after. Great scheme, huh?

To clarify, I was hoping to boot directly from USB where the USB stick would have Safar's patched_nk.bin.comp and the modified infinivision.lnk -- and then after the expected long "boot from USB" process, I would  evaluate the new features -- assuming all worked as I expected, I would then proceed to flash Safar's firmware overwriting the Keysight 2.43, replacing the original infinivision.lnk with the modified link.

Is "boot from USB" possible if the 3024A was upgraded to Keysight's latest 2.43 or am I misreading the blog?

Thanks kindly,
NorcalNerd

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on June 15, 2018, 09:31:20 am
AFAIR it is not possible anymore. However, it is all buried in this thread many pages above. Hint: if you click on 'print' on the top or bottom of this thread, you will get the whole thread on one (though loooong) single page which makes it much easier to search the whole thread for specific terms.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: f14 on June 17, 2018, 02:27:11 pm
Hi Guys,
I just got Dsox3054a some days ago . the firmware version is 2.36 and after read a lot of page in this topic . I think need to downgrade to 2.35 ( USB ) take 2.35 file from this Reply #1511 ( many thanks Kada) . write it to USB and "downgrade" like the keysight
Quote
How to Install
To update your oscilloscope's firmware, do one of the following:
Place the file on a USB flash drive, connect it to the oscilloscope, press [Utility] > File Explorer, select the file; then, press Load File.
If your oscilloscope is on the network: you can place the file on your computer, access the oscilloscope's Web Interface (see the User's Guide for details), click Instrument Utilities, select Firmware Version, browse to select the file; then, click Install.
after some minutes waiting and  now my scope have 2.35 firmware .  :wtf:
next I hack this scope like this
Quote
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
    Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
    byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
    Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
    Replace in infiniiVision folder  infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red  message in letf top corner "Unfinalized Software"  and "System Concerns detected: OS version is not correct. Please reload system firmware"

Applications needed:
 WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
 7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
but the link of WinCE CAB Manager is dead.  :( anybody have this software ?
and the step 4&5 I dont know how do it , Maybe use WinCE CAB software to do this step ?
Thank you very much for help!
edit: I found WinCE cab manager from russia website. and changed hex code
next step is root of usb. I mean the scope will boot from file in usb . not from internal scope firmware?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: SUKA_KRYSA on June 19, 2018, 11:48:46 am
Thanks for asking SUKA_KRYSA,

I am continuing to research though Safar's recent reply indicates recover to factory-default 2.43 should be no problem.

Am I reading correctly that with the newer versions of the firmware, booting from "fixed" firmware on USB isn't possible; that 2.42 (or perhaps older) firmware could boot and run from USB -- but 2.43 cannot?  I may not have the correct firmware version where I recall this changed.

The longer boot time (for me) would not be a problem.

Thank you
NorcalNerd

To be honest, I'm completely confused about what you want to do. As far as I understand, you got perfectly working scope, you've succesfully updated it to the latest firmware (2.43 in our case) and everything is fine for now. And you want to hack it by the Safar's method with no troubles e.g. breaking the scope, am I right?

If so, you don't need to decompress and compress that Patched2.43 file, you simply drop it onto the USB stick, boot up, telnet and further on. The only files that must be on the stick is infiniivision.lnk and patched_nk.bin.comp. Note: you create them on your PC, not on the scope via Telnet!

Don't know about older versions, I'm personally flashed straight on 2.43 and evertythibg works just fine. Boot time is the same.

The only issue is a repair/cal process. The patched firmware have no differences with the original one as long Keysight's certified technics don't digs into the code. Don't think they will do it with no reason, too much wasting their precious time. So I believe you can telnet again and overwrite infiniivision.lnk file with empty one before the call process. And again after. Great scheme, huh?

To clarify, I was hoping to boot directly from USB where the USB stick would have Safar's patched_nk.bin.comp and the modified infinivision.lnk -- and then after the expected long "boot from USB" process, I would  evaluate the new features -- assuming all worked as I expected, I would then proceed to flash Safar's firmware overwriting the Keysight 2.43, replacing the original infinivision.lnk with the modified link.

Is "boot from USB" possible if the 3024A was upgraded to Keysight's latest 2.43 or am I misreading the blog?

Thanks kindly,
NorcalNerd

You are not booting from USB. You just boot uoyr scope as is, telnet, disable some minor features and hacking it. In any case, your USB stick will perform nos as a booting drive you're booting from, bus as a simple external memory stick.

Anyway, the hack is possible on the latest firmware.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on July 01, 2018, 12:40:33 am
I finally managed to buy a 3000 series scope that looked to have the NAND corruption problem. In this case it was specifically a DSOX3024A. It gave the Agilent text splash screen, then the megazoom IV image and then a few seconds later would reboot and start the process over again. I've wanted one for quite a while to see what it would take to fix it.

I was able to fully recover the scope with nothing more then a flash drive. This process will likely work for any 2000a or 3000a series scope that has NAND corruption and has firmware 2.35 or below. I am not breaking any new ground here, just using the tools already provided in this thread a few years ago.

Firmware versions 2.35 and below allow the scope to partially boot from the USB drive if a properly constructed image is created for it. This was used quite nicely to hack the scope early on, I am pleased that the same process also works to recover from a NAND corruption failure.

Plesa describes how to create the USB image in this post:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg322242/#msg322242 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg322242/#msg322242)

To recover the scope though you don't need to patch the .dll file, just use it as it is as we're trying to recover the scope, not hack it.

For the USB drive to boot you need to have the same version of firmware on the flash drive as is already installed in the scope, or a very close version. So if you don't know what was installed you may need to try several versions. If you use the wrong version the scope will likely hang during the boot process at some point.
You can find an archive of older firmware versions in this thread and on xdevs.com. For a mostly complete list of firmware versions you can check the firmware release notes on the Keysight website.
You should also put a copy of version 2.35 firmware on the flash drive - we'll use this image to recover the scope once it has booted.

If you build the USB drive image correctly the scope should boot to the normal operating screen with the flash drive plugged into the front USB slot. It may give an error or two but at this point you can update the firmware from the 2.35 image you copied to the flash drive. I recommend version 2.35 in case something goes wrong and you encounter further errors. It is the newest version that allows booting from the flash drive. You will need to remove the flash drive when the scope reboots as part of the firmware update or it may want to try booting from it again. Once the scope is recovered and running version 2.35 with no errors you can then update it to the newest firmware(2.43 at this time) which will keep the corruption issue from reoccurring.

I don't know if the NAND corruption issue is identical for every scope so it is possible this won't work for all problems but it is certainly worth a try if you have the boot loop. If your scope has versions 2.36-2.39 then recovery will likely require a network card and the serial console connection. Keysight has so far also replaced/repaired scopes that have this problem for no charge even if out of warranty so that is certainly an option as well.

I did connect to the serial console while doing this, but again, it wasn't needed.
This is what the error looked like on the serial console before it rebooted:

Exception 'Data Abort' (4): Thread-Id=05d40002(pth=837d59e4), Proc-Id=03500006(pprc=837d17ac) 'infiniivisionLauncher.exe', VM-active=03500006(pprc=837d17ac) 'infiniivisionLauncher.exe'
PC=40d13c28(infiniivisioncore.dll+0x00003c28) RA=40d917bc(infiniivisioncore.dll+0x000817bc) SP=02a9fb08, BVA=00000000
The exception 0x80000002 occurred at address 0x40D13C28.


After loading version 2.43 I see this:

-----> InfiniiVision is running <-----
failed open \Secure\InfiniiVision\LudicrousSpeed.usb

So I guess my scope does not contain a Tesla :)

Now, to leave the scope stock at 200 MHz, or is the 500 MHz mod calling?

For anyone trying to fix a corruption issue by all means post any questions or PM, I'm always happy to help.

Pic of the happy patient attached.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: salvagedcircuitry on July 26, 2018, 05:21:53 pm
Hello all,

5/ Save the original link and make the new startup link:

   save the original infiniivision.lnk renaming it to something like "orig.sav".
   
   NOTE: the \secure\startup folder should contain ONLY ONE .lnk file, named infiniivision.lnk, with the below command line (do not add quotes):
   
   "211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

If anyone is stuck on this step, type "help" into the telnet command line interface. This will bring up all the commands that are available for use within the telnet session.

I tried using "mv" for move and "cp" for copy. Those commands are not windows CE commands and are not acceptable arguments for this telnet session. Simple miastake. Use "ren" for rename and "copy" for copy.

More information on how to use the ren and other telnet commands here:
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/ren

Good luck everybody!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: f14 on July 29, 2018, 03:58:01 pm
I want to say thank you all guys
finally my dsox3052a had upgraded !
(https://scontent.fsgn2-2.fna.fbcdn.net/v/t1.0-9/37948193_2158493317748754_5471417533397467136_n.jpg?_nc_cat=0&oh=0c5790821ad5b63e492a6903cf3a9a23&oe=5C06DC99)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on August 22, 2018, 07:37:10 am
Insert a USB stick with 2.35 firmware and try again.  :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 23, 2018, 02:32:00 am
Bought another broken 3000 series scope. This one hardly booted at all. A few lights would turn on and that was it, no splash screen at all.

Here is the boot log from serial console:

Code: [Select]
U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2011-01-27  11:38:14 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    36703 Bytes = 35.8 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Jan 27 2011 02:04:15
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXOOOOOOOOXOXXOOOOOOOOXOOXOXOOOOXXXOOOOOOOOOXOOOOXOXXOXXOXOOOXOXXXXXXOOXXOOOOOOXOOXXOXXOOOXOXXOOXXOXOOOXOOXOOXXOOOXOOOOXOXOOOOOXOOXOOOXOXXXXXOXOXOXOXXXXXXOXXXOOOXOOOOXXOOOOXOOOOXOXOXOOOOOOXOOOOXOXOOOOOXX
OOOOOXOOXOOXXOOOOOOOOOOXOOOXOOOOOOOXXOOOOOXXOOOOOOOXOOXXOOOXOOOOXOOOXOOXOOXOOXOXXOXOOXOXOXOXOOOXXOOXXXOOOOXXXXOXOOOXXOOOOOXOOOXOOOXOOXOOOXOOXOOXXXXXXXXXERROR: Checksum failure (expected=0x1ED617A  computed=0x1ED617B)
****** Checksum failure on record 134, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x12F9870  Name="" Target=RAM
 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1600000

BL_IMAGE_TYPE_UNKNOWN

 Loading image 2 failed, trying next one
 All images failed

Press r to reset


I was able to get into u-boot and platform builder no problem.
I used the info provided by FrankBuss(in reply #125) to boot version 2.30 via tftp.

The scope fully booted with only an unsealed error.
I then updated the firmware in the normal manor via USB stick.
With version 2.43 installed I could see that is did find a bad bit/block in the NAND flash. However it corrected it and all booting is now error free.
This is what it looks like when it sees a failed checksum:

Code: [Select]
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-05-07   8:18:27 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37749 Bytes = 36.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
RTC: 2018-8-22   16:29:21.79 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
RTC: 2018-8-22   16:29:21.83 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOXXOOOOXOOXXOOXOXOOORewrite recommended, internal ECC corrected data at 0x1184
OXOXOOOOOXOOOXOOXOXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXOOOX
OOXOOOOXOOOOXOOXXOOXOOOOOOOOOXOXOOOXOOOOOOXOXXOOOOXOXOOOOOOOXXOOXOOXOXOOOXOOOXOOXXOXOXOOOXOXXXXOXOXXOXXXXXOXOXXOOOXXXOXXXXXXOXXXXXXOXXXXOXOXXOXOOOXXXXOXXXXOOOXOOOXXXOXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOX
XOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXORewrite recommended, internal ECC corrected data at 0x233a
OOXXOOOXOOXXXXXXXXXXXXXXrom_offset=0x0.
XOXImageStart = 0x80361000, ImageLength = 0x1AD2DB8, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1AD2DB8  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2018-8-22   16:29:25.19 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Feb  6 2018)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1460: RewriteEbootBlocks from 0x1184 to 0x233a
                                                             Rewriting Block at Sector Address 0x233a. 3346
Read Block SUCCEEDED 3375
Erased Block SUCCEEDED 3376
Completed rewriting Block SUCCEEDED 3418
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:20:DA:0B
Phy found addr 31 (ticks=5178)
WaitForLink Start (ticks=5180)
Link Detected (ticks=5182)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
phyCfg->bFullDuplex 0x1
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Autonegociation Start (ticks=7208)
Autonegociation End (ticks=9713)
WaitForLink Start (ticks=9714)
Link Detected (ticks=9717)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
cable attached
Running infiniiVisionInstallHelper
Running launchNetworkServices
Starting Agilent LXI Services.
Device load time:
   NANDFLASH: 0 ms
   SNANDFLASH: 0 ms
   USB Hard Disk Drive: 0 ms
Summary of scan:

All FATs on volume agree

Percent Fragmentation: 0
Invalid Directories: 0
Invalid Files: 0
Invalid Clusters: 0
Lost Cluster Chains: 0

ScanVolume \Agilent Flash (NANDFLASH) 0.281000
Summary of scan:

All FATs on volume agree

Percent Fragmentation: 0
Invalid Directories: 0
Invalid Files: 0
Invalid Clusters: 0
Lost Cluster Chains: 0

ScanVolume \Secure (SNANDFLASH) 0.433000
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
Our command line is
Performing Startup
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses

      creating \Secure\bin\Released build, Feb  6 2018, 19:47:18
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
Programming LAN option module...
Module option FPGA DONE bit should be LOW at this point
Keyboard firmware version 32... ok
Keyboard Info: Board id 1, Board rev 3
Startup sequence is complete.
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
System has been running 27.213392 seconds
Start Up Sequence 12.658394
Memory Load 59%
   System Physical Memory 42.645 / 73.230 MB
   Process Virtual Memory 49.188 / 1024.000 MB
-----> InfiniiVision is running <-----


It also appears the full boot image is now stored twice in flash, so if the first image fails it will move on the second and attempt to fix the first one.
From the platform builder menu you can select either image and both boot the same.

Now that the scope was working again I thought I'd experiment a little further with network booting.
There are no problems getting u-boot to tftp the nk.bb0 image however the scope will not fully boot anymore via the network image. It will hang at a splash screen. It also shows the Keysight splash instead of the Agilent splash so I know it is loading from flash, or perhaps both the ram image and flash.
When I performed the firmware update to version 2.43 u-boot was updated to a newer version.
Old version - U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500
New version - U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
Code: [Select]
Update UBOOT at address f8010000.
Date in resource is newer than date stored in NOR
DO NOT DISTURB.
Sector 1 Erasing Writing succeeded
Sector 2 Erasing Writing succeeded
Sector 3 Erasing Writing succeeded
Verifying boot loader in NOR
ERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\MapMemoryIntoUserSpace\.\MapMemoryIntoUserSpace.cpp line 153: VirtualFreeEx() failed
Updating UBOOT complete
Update PBOOT at address f8050000.
Date in resource is newer than date stored in NOR
DO NOT DISTURB.
Sector 5 Erasing Writing succeeded
Verifying boot loader in NOR
ERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\MapMemoryIntoUserSpace\.\MapMemoryIntoUserSpace.cpp line 153: VirtualFreeEx() failed
Updating PBOOT complete


It seems the updated u-boot version does not allow the scope to fully boot from an image transferred via network, it does get far enough to allow telnet access to the scope if some manual file system recovery is needed. However recovering a scope with a bad NAND block might not be possible. Or perhaps if NAND is totally corrupted it would still allow the full network boot.
While I still have the scope open and a terminal connected to the debug port I am happy to try some other commands etc to try to get a full network boot if anyone has any suggestions. The scope works 100% so this isn't needed but could be very useful for others going forward should someone experience a NAND corruption issue. It would be nice to have a solution that always works.
I can boot nk.nb0 via tftp or nk.bin via bootp/platform builder. Both get to the exact same place.
Thoughts/suggestions?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on August 23, 2018, 07:35:55 am
What happens if you use the nk.nb0 from 2.43, or did you already try that? Do you have the boot log when it fails?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 23, 2018, 08:31:40 am
With the NK.bin from 2.43 it will fully boot.

edit:

Perhaps it only completed the boot originally because I used version 2.30 which was the same or similar to what was on the flash to begin with. Even though it was corrupted it may have been able to access non corrupted portions to get what it needed to boot.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on August 23, 2018, 07:03:49 pm
With the NK.bin from 2.43 it will fully boot.

Yes, that is what I was expecting.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: B0B45 on August 26, 2018, 08:46:23 pm
Hey everbody,

I did the USB-Hack v02.37 and the hardware mod to my MSO3014A to get the 500MHz a year ago. Everthing is working fine  :-+  I just wonder if the mod increases the noise of the input chanels. So I took a picture of all 4 chanels to compare with your scopes. Is the level of noise ok for a 500MHz scope or did the mod make it worse?

Kindly regards
B0B   
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on August 26, 2018, 09:16:33 pm
I did the USB-Hack v02.37 and the hardware mod to my MSO3014A to get the 500MHz a year ago. Everthing is working fine  :-+  I just wonder if the mod increases the noise of the input chanels. So I took a picture of all 4 chanels to compare with your scopes. Is the level of noise ok for a 500MHz scope or did the mod make it worse?

Firstly I recommend you flash newly FW as this old have some bug with lost FW image. If I understand newly FW doubled kernel image in memory.

I also was surpriced of this noise level for this scope family. But if you compared with your old config (100 MHz) it is not be so surprising since noise power usually proportional to the frequency band.

If I remember I have same level on 500 MHz.

Edit: and do not forget that at such sensitivity the scopre works like a wideband receiver! I perfectly observe the all spectrum of FM stations for example. I think that using 50Ohm terminator caps is the better way for "analyze noise".
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 26, 2018, 10:16:01 pm
More bandwidth does equal higher noise. I saw this as well going 100 to 500 MHz and 200 to 1000 MHz.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 02, 2018, 08:05:21 pm
Hello
In first i wan't to apologize for my poor english and because i'm a dummy in informatic because i program only in assembler.
I have buy a agilent dsox2024a from 2011, since 6 month, without warranty and i have try to update it with 2,41, i found the update somewhere in the thread.

I have read a lot off this thread, and i see somewhere that not be possible to brick it with update, so i do it, i brick it.
After update and reboot the buttons blink at boot and the logo agilent appear, but nothing else.
I try to do what i can do, i have do what is it in this tuto by Plesa:


How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
    Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
    byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
    Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
    Replace in infiniiVision folder  infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red  message in letf top corner "Unfinalized Software"  and "System Concerns detected: OS version is not correct. Please reload system firmware"


 I have open the infiniiVisionSetup.cab with mcsinf because i can't find WinCE CAB Manager 3.0, i have modified the dll with hexedit, i have modified the inf with atmel studio, i have edited the txt, i have try this with version 2.35, 2.37, 2.39, 2.41and  2.43 have not the infiniiVisionCore.dll.
i try with fat and fat 32 format, nothing work.

i have try only with the contenu of secure folder and the txt file, the scope have the  red  message in letf top corner "Unfinalized Software"  WITHOUT "System Concerns,  detected: OS version is not correct. Please reload system firmware" .

after this message the scope reboot and display this message an infini loop
that work for 2.35, 2.37, 2.39.
other version make nothing.

i have try with:
"62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
"48#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS" because that what it is in the origine

i have try the method of TheSteve but i can't make a bootable usb flash for recover my scope.
perhaps the version of my scope is too old, and 2.35 and  newers can't boot?
i have not find the older firmware in the web.Someone have them please?

 I'm very disapointed, and i hope somewone can help me, please help me, i don't know how can i do.

i have sell my old techtronix tds210 and i have spend all my money in this scope, i have it since six month, all was working and i brick it with update.
i have no possibility to buy another one, or send it for repair
i have contact keysight, and they said that i must send my scope to be repaired.

Thanks a lot for every help

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 04, 2018, 12:41:36 am
Did the scope stop working after a normal firmware update or after you tried to hack the scope?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 04, 2018, 06:45:39 am
When i try to update with 2.41
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 04, 2018, 06:46:44 am
When i try to update with 2.41

What firmware did you have before you tried to update to 2.41?
Do you have a network card?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 04, 2018, 02:22:54 pm
I don't know between 1.0 to 2.10, it old (2011)  :palm:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 04, 2018, 02:27:31 pm
I have not a network card, so i wan't to try with old version, but i don't find them in the web,.
Have you these version please?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 04, 2018, 04:29:00 pm
I have not a network card, so i wan't to try with old version, but i don't find them in the web,.
Have you these version please?

You will need the network card and a serial console to recover the scope most likely.
Once you connected to the serial console post the output and we'll see where it stops in the boot process. If it is far enough along a USB drive may be able to recovery it but chances are you will need a network card.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 04, 2018, 06:36:21 pm
But have you these firmware please?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 04, 2018, 06:45:13 pm
But have you these firmware please?

No, I don't have them. But if you look in the firmware release notes for the exact file names of the older releases you can do a google search for them and often find copies.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on September 04, 2018, 06:48:54 pm
The oldest I have is 02.35.2013061800
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 04, 2018, 06:57:50 pm
I have do that, i try the chinese site too with google translate
 - - > nothing
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 04, 2018, 07:04:24 pm
Thank you TheSteeve and Paopbz for help
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 04, 2018, 07:07:45 pm
Pleasa have them, i send it a PM, but he has not answer me
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 04, 2018, 09:44:52 pm
I think there is something to do, because the scope boot in the usb stick.
When i put the firmware 2.35 unchanged, the led of the usb key blink a little time and it reboot with red warning, agilent logo and the 1988 2011 in the bottom of the screen.
When i put the 2.35 firmware "modified", the led of the usb stick blink a long time, that mean it load something, and after, the scope stay at blinking cycle without reboot.
When i stop and start the scope, then,  it reboot with red warning, agilent logo and the 1988 2011 in the bottom of the screen.
I don't know how force the scope to upload the firmware.
Maybe someone can do something for me please?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 04, 2018, 09:55:00 pm
For the USB boot to work you need the same version(or very close) that was on the scope before it became corrupted.
Also note you don't need to patch the infiniiVisionCore.dll - that is only to hack the scope to enable features, it is not needed to recover the scope and boot from USB.

You can find the older firmware - but you need to look for the exact file name.

Here is version 2.20 to try:
https://xdevs.com/doc/HP_Agilent_Keysight/DSOX/3000XSeries.02.20.2012110802.cab
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 04, 2018, 10:02:30 pm
Thank TheSteeve, but i read 3000series and i have a 2000 series
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on September 04, 2018, 10:03:16 pm
I have a version 1.1 (from 2011) for you. Do you have a dropbox or something similar where I can upload it to?
Firmware for 2000 or 3000 series is the same.

Edit: if you want to google, the file name is 3000XSeries.01.10.2011031600.cab
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 04, 2018, 10:04:21 pm
Thank TheSteeve, but i read 3000series and i have a 2000 series

As Pinkus stated the firmware is the same.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 04, 2018, 10:05:26 pm
Thank the steeve, i try it and i reply
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 04, 2018, 10:17:41 pm
Hello Pinkus, no i haven't, can you make please a wetransfer?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 04, 2018, 10:43:21 pm
That read the usb stick, that say "Finishing update" with 2012" , the scope boot, i have the screen of the scope with this msg"system concerns detected:OSversion is not correct. Please reload system firmware". But when i pull the stick and i push a button the scope restart.
I observ that the usb stick blink when i touch the button, i think the scope read only the firmware in the usb stick.
The system version is 02.20.2012110802
When i pull the usb stick, the scope hang, an i have the warning msg with 2011 version
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 04, 2018, 11:00:35 pm
Thanks a lot of Pinkus TheSteeve an Paobz, i have a lot of work, to try all.
Here the link for the firmwares
https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 04, 2018, 11:06:44 pm
That read the usb stick, that say "Finishing update" with 2012" , the scope boot, i have the screen of the scope with this msg"system concerns detected:OSversion is not correct. Please reload system firmware". But when i pull the stick and i push a button the scope restart.
I observ that the usb stick blink when i touch the button, i think the scope read only the firmware in the usb stick.
The system version is 02.20.2012110802
When i pull the usb stick, the scope hang, an i have the warning msg with 2011 version

You can't remove the USB stick after the scope has booted - it is using it for the OS !

You need to put the firmware update file on the same drive and once the scope is booted install it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 04, 2018, 11:43:06 pm
Thanks a lot of Pinkus TheSteeve an Paobz, i have a lot of work, to try all.
Here the link for the firmwares
https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/

That woooooork guys tank you a lot of👍👍👍👍👍👍👍👍
Im very haaaaaaappy.
Here the procedure:

You must have 2 usb stick because the scope boot in the usb stick.
TheSteeve method in first, that permit to boot the scope with the first usb stick, in my case, 2. 20.202110802 version.

That read the usb stick, that say "Finishing update" with 2012" , the scope boot, you have the screen of the scope with this msg"system concerns detected:OSversion is not correct. Please reload system firmware.

In this state the scope read his OS, in the usb stick.
If you remove the usb stick, the scope hang.

You introduce the second usb stick with original firmware, in my case 2.35 version, go to "utility" , select the. cab, install it, that done!

Thanks thanks thanks 👏👏👏👏👏👏👏👏👏
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 04, 2018, 11:52:55 pm
Excellent - you only need 1 USB stick though, just put the update file on the same flash drive as the boot files.
Please be sure to install the newest version 2.43 - it will prevent further NAND memory corruption issues.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 05, 2018, 12:11:27 am
TheSteeve, can i "modify" the 2.43 version? If yes, the warning message would be present at any boot?

I have read somwhere that, it not be possible to boot with usb with version after 2.35, i'm afraid 😨
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 05, 2018, 01:31:00 am
In case of nand corruption
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on September 05, 2018, 07:17:04 am
You NEED to upgrade from 2.35 and below as you are in a constant risk that your scope will be bricked one day due to nand corruption. So an update to 2.4x is strongly recommended.
Though for any 'improvement' of 2.4x firmware you will need a LAN card.

It is all in this thread, probably the last 20-25 pages is all what you need to read.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 05, 2018, 09:43:37 am
Yes Pinkus, but i prefered a nand corruption that i can be able to repair with a usb stick,  in place of 2.43 that i must have a lan card
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on September 05, 2018, 11:10:06 am
You can get a homemade LAN card (without video) for around $25
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 05, 2018, 12:11:52 pm
TK, thanks i have seen that somwhere in this thread, but i prefer stay like that and attempt to modify the firmware.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 05, 2018, 06:03:09 pm
Hello
I need help, please
When i attempt to load the "modification" all work like Plesa method, but the soft isnt load in the memory scope, the scope read the "modification" only with the usb stick.
If i pull the usb stick, the scope hang and reboot without "modification"
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on September 05, 2018, 06:29:01 pm
This is why you need the LAN card.

Apart from that, where is the problem? There is another USB port in the back of the unit where you can place your boot stick and use the one in the front for screen shots etc.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 05, 2018, 07:07:34 pm
Because It is more convenient to have all in the scope memory, no?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on September 05, 2018, 09:38:29 pm
Did you read this post?

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1453285/#msg1453285 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1453285/#msg1453285)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 05, 2018, 10:48:14 pm
Thanks TK, but it's 2.43 version and i don't want to update to 2, 43 because if i have a corruption software with this version, without the usb boot, i recognize that i do not have the technical level for recover it, and do that.
But if you can make this for me to 2.35 version, that would really make me happy.
Have you seen my avatar?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on September 05, 2018, 10:55:15 pm
Do you mean flash corruption?  I think it was fixed in 2.43

Anyway, I think flash corruption is covered by Keysight service note even when the scope is out of warranty... they are fixed for free by Keysight (at least in the US)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 05, 2018, 11:06:35 pm
Yes, a nand corruption  :scared: :scared: :scared:
In France i have contact keysight, when i brick my scope, and they say me that i must send my scope for repair, and, after diagnostic, they will say me how much for repair.
Honestly i'm scared
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on September 05, 2018, 11:18:24 pm
No, there is a service note and the NAND flash corruption is repaired for free.  I had used this service once on a bricked scope. 

You need to ask for: Factory Warranty per Service Note: MSOX3024A-05A (or something similar depending on the model)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 05, 2018, 11:31:02 pm
Thanks TK, but when i call them they said me that the diagnose and after they say me how much, i tell them of the warranty of nand corruption, but they say the same thing.
  :scared: :scared: :scared:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on September 05, 2018, 11:47:58 pm
When they diagnose and confirm it is NAND corruption then the cost of repair is ZERO.

If (worst case) they say it is some other problem (maybe corrupted because of an attempt to get free options) then you will have the option to have it returned to you without being repaired, at no cost.

Upgrade to 2.43 and the risk of corruption becomes almost zero.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 06, 2018, 12:06:53 am
But not zero.
I have find the nk. Bin.comp patched for 2.43
I have try to integrate in in the original firmware 2.43 with IZArc.
But i can't update the scope with this solution.
I don't know how to force the scope to copy the "modification" from the usb stick to his memory
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 06, 2018, 01:14:29 am
When NAND corruption occurs there is no guarantee that you can fix it with a USB drive. You are far better off running version 2.43.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 06, 2018, 02:55:40 am
Thats what's happened to me, a nand corruption, and i recover the scope with TheSteeve method and Pinkus provide me an old firmware
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 06, 2018, 10:43:31 am
Someone have an idea to force the scope to copy the"modification" to his memory With usb only?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on September 08, 2018, 09:30:27 pm
Someone have an idea to force the scope to copy the"modification" to his memory With usb only?
Perhaps you can make cab with modified bin.comp but you should to modify also recipe XML script for correct checksum of bin.comp. I wrote it some times ago. Bin.comp flashed twice so you should correct XML in two places
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on September 09, 2018, 09:15:48 am
Ok thanks, i will try later
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Gribo on September 10, 2018, 07:26:13 pm
Does anyone has the complete pin out of the internal expansion slot?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: B0B45 on September 14, 2018, 04:47:35 pm
Hey everybody,

I just wanna say Thank you to all the supporter of this topic. Yesterday I did the upgrade to 2.43 and everythings works fine  :-+

Kindly regards
B0B
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Gribo on September 19, 2018, 10:07:25 pm
Here is my version of the DSOXLAN board. Improvements from previous boards - 4 layer stack up for better impedance matching, clearance around the Ethernet connector, no vias on the differential pairs. https://github.com/GriboNexGen/DSOXLAN (https://github.com/GriboNexGen/DSOXLAN)

I plan to produce ~40 boards of this design. If you are interested in a bare board, send me a PM.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JJalling on September 20, 2018, 08:46:27 pm
Anybody tried to flash the scope to fw version 1.10 and use the leaked key?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on September 21, 2018, 11:56:06 am
Anybody tried to flash the scope to fw version 1.10 and use the leaked key?
Are you asking about 1000X series scopes or 2000X/3000X?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JJalling on September 21, 2018, 12:31:36 pm
Anybody tried to flash the scope to fw version 1.10 and use the leaked key?
Are you asking about 1000X series scopes or 2000X/3000X?
Well I'm mostly interested from a technical point, as I don't have any of the three. But the private keys for the 2000x and 3000x licenses was leaked with the 1.10 firmware for the scopes, so I thought it was a possibility.

BR Jonas

Edit: misspellings
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on September 27, 2018, 11:02:54 am
When they diagnose and confirm it is NAND corruption then the cost of repair is ZERO.
Upgrade to 2.43 and the risk of corruption becomes almost zero.

I can confirm this!
My DSOX3034A suddenly was in a boot loop and did not want to turn on.
Warranty had expired 1/2017 and Keysight inspected it first and then decided to repair it at no cost to me.

Thank you Keysight!
 
I just upgraded the FW on my other 2000 and 3000 series scopes and hope this error will not happen again.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: armmcu on September 28, 2018, 12:49:03 pm
Hello everyone , is it possible to remove  "unsealed instrument" warning away from a hacked MSOX3104T ? just want to reset to  manufactory settings, disable all of the hacked license.

Thank you in advance for any help
Title: Firmware 7.10 needed for the 3000T Series
Post by: Xavier64 on September 28, 2018, 08:41:31 pm
Good day,

does anyone have the old 7.10 Firmware for the 3000T Series!? I only can download the NEW 7.20 on the Keysight Website.


Many thanks.


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JeffreyLatter on September 29, 2018, 10:41:19 am
As to older version of firmware for the 3000T

https://drive.google.com/drive/folders/0B1zyLRNonVMFY3V1Z3hXUDNtRnc?usp=sharing
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on October 03, 2018, 06:08:47 pm
I do  :)
I sold my DSOX3024a and purchased a DSOX4024a instead.
The larger screen (though unfortunately not higher resolution) and the touch (not always, but perfect for dragging or entering numbers/characters) are a really nice improvement over the 3000 series. And I compared it to an R&S RTB2004: the Keysight is way better suited for daily work (easier and quicker to use, more and better functionality, not artificially crippled as the RTB).

If you read the posts above: transforming it into a MSOX4024a with all options enabled is not too difficult.
I will do the 500Mhz modification in a month or maybe two and will make photos of all needed steps then and post them here.

Hi Pinkus, I was wondering if you went ahead with the 500MHz to 1GHz mod for your 4k X-series scope?  I currently have DSO-X3034A (non-touch screen).  I bought the application bundle for it and use MSO and 500MHz bandwidth options from this thread.  I like it a lot but sometimes wonder about a step up for higher sample rate, more bandwidth, and better support for some probes.  A 4k series at a good price...and up-cycled to higher bandwidth, seems like an option I would consider....so I'm curious if you (or anyone) made progress in this regard.

I also wonder when Keysight would refresh the 4000 X series.  The big screen is great but its low resolution and the 5GSa/s is starting to look a bit long in the tooth...

Sparky
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlan on November 06, 2018, 05:22:08 pm
The 'FWD' license allows you to downgrade the firmware, which is otherwise locked to a minimum version number.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on November 06, 2018, 06:06:36 pm
Hi Pinkus, I was wondering if you went ahead with the 500MHz to 1GHz mod for your 4k X-series scope?
Hi Sparky,
I would like to, however my DSOX4000, running with the latest firmware version, sometimes needs 2-3 attempts to boot up. I suspect an starting NAND corruption. Right now I am not sure what to do with this scope and how to fix it. This is right now more important than getting 500 Mhz or 1 GHz. Next will be to log the UART output and see it this helps to nail down the problem. Maybe mlans post might help to allow another firmware update with the latest version, even if I already have it installed. My hope is to rewrite NAND.
I will definitively post here if I did the upgrade (also the outcome of a firmware rewrite will be posted).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on November 06, 2018, 06:20:34 pm
Please log the serial data so we can determine the cause of the problem. I'd suggest reinstalling the newest firmware but logging data should be done first.
Btw, I've never seen a scope with the NAND corruption issue that would boot on occasion, they never booted. It is possible of course.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on November 06, 2018, 06:30:40 pm
My scope would intermittently boot. Then one day stopped booting completely. Thankfully it was under warranty but that was nand memory issue.

Sent from my SM-G950F using Tapatalk

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: GregerG on November 06, 2018, 06:51:45 pm
Which is the latest 2000X firmware you can usb boot? I don't feel like permanently modifying it and I don't have the lan module anyways....
Cheers!
//Greg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on November 07, 2018, 05:03:20 am
Hi Pinkus, I was wondering if you went ahead with the 500MHz to 1GHz mod for your 4k X-series scope?
Hi Sparky,
I would like to, however my DSOX4000, running with the latest firmware version, sometimes needs 2-3 attempts to boot up. I suspect an starting NAND corruption. Right now I am not sure what to do with this scope and how to fix it. This is right now more important than getting 500 Mhz or 1 GHz. Next will be to log the UART output and see it this helps to nail down the problem. Maybe mlans post might help to allow another firmware update with the latest version, even if I already have it installed. My hope is to rewrite NAND.
I will definitively post here if I did the upgrade (also the outcome of a firmware rewrite will be posted).

Hi Pinkus, sorry to hear you have a problem with booting your DSOX4k scope.  That's really unfortunate news and I definitely understand it's a more urgent and important problem to fix than the bandwidth mod.  I hope you are able post the u-boot messages here and hopefully someone can help identify the problem and fix it.

Sparky
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: lzqing on November 10, 2018, 03:27:31 am
Thank you all ! Thank you Safar , https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1453247/#msg1453247 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1453247/#msg1453247)
The 2.43 after hack is perfect, it is working well with my DSOX2022A , I like "PLUS"  option ,let me use more enhanced trigger function  .


Best Regards
Andy Lu
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dwaine on November 11, 2018, 06:59:16 am
I just bought a DSOX2004A 70mhz scope.  Can this scope be hacked up to 200mhz bandwidth.   I can't seem to find anything relating to the bandwidth upgrade for the 2004a.

Maybe the resister config on the board?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on November 11, 2018, 07:35:47 am
I just bought a DSOX2004A 70mhz scope.  Can this scope be hacked up to 200mhz bandwidth.   I can't seem to find anything relating to the bandwidth upgrade for the 2004a.

Maybe the resister config on the board?

There is the option "BW20".
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rramirez on November 21, 2018, 10:58:17 pm
I have a DSOX2000 with 2.43.2018020635 FW. I followed the steps in post #1876 to the letter, except my selected options string was:

"88#infiniivisionLauncher.exe -l ALL -l BW20 -l DVM -l PLUS -l SCPIPS -l CABLE --perf"

and everything went smoothly. Are the quotes supposed to be there? What is the significance of the 88# before the launcher program?

UPDATE: it dawned on me that the 88# was referencing the byte count of the string, so once I used the correct number in the infiniivision.lnk file, (81#, no quotes) it all worked fine.

Russ
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kennyhan on November 23, 2018, 05:47:33 pm
Thank you all,Today I was hacked my scope dsox3014t,but the scope "User Cal Status" is always shown as "unprotected",What should I do?Very thank you all again.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on November 23, 2018, 06:57:09 pm
Thank you all,Today I was hacked my scope dsox3014t,but the scope "User Cal Status" is always shown as "unprotected",What should I do?Very thank you all again.

That is a byproduct of the hack. It is actually a good thing as it makes for an easy way to verify externally if licenses are valid/real or have been hacked.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kennyhan on November 26, 2018, 10:55:59 am
Thank you all,Today I was hacked my scope dsox3014t,but the scope "User Cal Status" is always shown as "unprotected",What should I do?Very thank you all again.

That is a byproduct of the hack. It is actually a good thing as it makes for an easy way to verify externally if licenses are valid/real or have been hacked.
^-^
Thank you Steve. I think I don't should always look at the calibration menu.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wutieru on November 29, 2018, 09:40:38 am
I try to crack a DSOX 2002 with the tutorial step by step. It seems that everything is correct, but when I restart Oscilloscope, the message is displayed on the screen: "Firmware checksum error, need to be fixed." and the machine has no reaction, only restore firmware. The Oscilloscope's firmware is newest,and before I hack this,I have successfully hacked 2 sets(one is DSOX 2004 and the other is DSOX 2012).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: schmike on December 11, 2018, 05:18:23 am
Dear Safar

I just recviced the 3014A with firmware 01.10
Updated the firmware to 2.43
And download the patch from you and push on the usb flash.
I telnet to 3014A with port 5024
After I type the code
\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
[/code]
No following action on screen or on the scope
Any suggestion for me to do for update for all option?
Thanks alot.

I make patched.bin.comp with PhillyFlyers info and with corrected checksum:

Patched2.43 (https://drive.google.com/open?id=1I9oKjkdXK2EAJUqVkxMCGuBAsmk1ugyZ)

MD5 of file for check: 1CA34A1B837B075133BE53B379749BBB

You can flash it as usual by loadP500Flash via telnet in scope
Code: [Select]
\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp

Checked on my DSOX3034A

FYI:

The patch locations for firmware 2.43:

Code: [Select]
1) options patch:  0x280940:  change "04 00 A0 E1" -> "00 00 A0 E3"
2) nag patch:       0x2a9f38:   change "66 5A FF EB" -> "01 00 A0 E3"
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: schmike on December 11, 2018, 07:58:06 am
Screen CAP

(http://)
Dear Safar

I just recviced the 3014A with firmware 01.10
Updated the firmware to 2.43
And download the patch from you and push on the usb flash.
I telnet to 3014A with port 5024
After I type the code
\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
[/code]
No following action on screen or on the scope
Any suggestion for me to do for update for all option?
Thanks alot.

I make patched.bin.comp with PhillyFlyers info and with corrected checksum:

Patched2.43 (https://drive.google.com/open?id=1I9oKjkdXK2EAJUqVkxMCGuBAsmk1ugyZ)

MD5 of file for check: 1CA34A1B837B075133BE53B379749BBB

You can flash it as usual by loadP500Flash via telnet in scope
Code: [Select]
\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp

Checked on my DSOX3034A

FYI:

The patch locations for firmware 2.43:

Code: [Select]
1) options patch:  0x280940:  change "04 00 A0 E1" -> "00 00 A0 E3"
2) nag patch:       0x2a9f38:   change "66 5A FF EB" -> "01 00 A0 E3"
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: januszb on December 13, 2018, 08:30:05 pm
Schmike,
You're telnetting to the wrong port.  5024 is for SCPI (which is why *idn? works).  For the patch you need to telnet to the normal port (23), login, then do the necessary commands.
Janusz
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dwaine on December 17, 2018, 04:22:39 pm
Stupid question....  I see the DSOX3000 series you can upgrade the front-end to 500mhz.   Can the DSOX2000 series front-end be upgrade to 500mhz too?    I would love to complete a front-end upgrade to my DSOX2014a to 500mhz.   I have not seen a complete parts list.

Has anyone figured out how to get the DSOX2000 series to display 1 million waves?

I just got my first Keysight scope.   Upgraded from the Rigol DS1054Z.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on December 17, 2018, 05:12:22 pm
Stupid question....  I see the DSOX3000 series you can upgrade the front-end to 500mhz.   Can the DSOX2000 series front-end be upgrade to 500mhz too?    I would love to complete a front-end upgrade to my DSOX2014a to 500mhz.   I have not seen a complete parts list.

Has anyone figured out how to get the DSOX2000 series to display 1 million waves?

I just got my first Keysight scope.   Upgraded from the Rigol DS1054Z.

I know someone posted about performing the 500 MHz upgrade on a 2000 series in the past, not sure if he did it or not. It should be possible from what I have seen but you won't find an easy howto. It also has no builtin 50 ohm termination but you can use an external one. Using pics of the PCB's we can probably determine what needs to be changed.
I don't think the 2000 can process 1 million waveforms per second as it only has one Megazoom IV ASIC instead of the 2 used in the 3000 series. I believe Keysight has updated the 2000 from 50k to 200k waveforms/sec though.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on December 17, 2018, 06:50:13 pm
Since the 2000 series only goes up to 200 MHz officially how are you going to tell the scope it is capable of 500MHz? I mean in terms of vertical speed, anti-aliasing and such?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on December 17, 2018, 07:25:04 pm
The 2000 series still respects the hardware jumpers that select the base speed and configure the firmware. So that part is no problem.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dwaine on December 17, 2018, 09:50:14 pm
So you would configure the hardware jumpers to bump it up to 500mhz for the frontend and then install the necessary parts into the 4 front-ends.   Is it the same parts list as the DSOX3000A?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: BFX on December 20, 2018, 11:38:13 pm
DSO-X3014T arrived yesterday. Today "upgrade" done  8)  Thank you so much Steve :-+
Next task HW mod >:D

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: hv222 on December 30, 2018, 07:17:44 pm
Did someone have a full front-and schematic?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: NorcalNerd on January 06, 2019, 02:23:31 pm
Hello again, and thanks for your help.

Acquiring a DSOXLAN, I'm finally ready to do the upgrade to my 3024A running "factory" 2.43, applying the latest patched 2.43 (and it is a rainy weekend) -- I have a couple of questions please.

1/ Can anyone clarify the contents of the link file to enable all features available in the patched firmware -- for the 3024A?

From previous responses, I am not clear on if my modified link contents (cmd line) is correct -- specifically, the preceding "211#..." which I  think would have been OK if I had the 350MHz model, and appears to represent the length of the infiniivisionLauncher.exe cmd line not including the preceding "211#".

"211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

The above (not for my scope) is indeed 211 characters in length so it makes sense (to me) I need to change that number.

Is the below correct (I removed "-l BW50" alone) -- with the # of characters now being 203? :

"203#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

As I am now clear I can revert back to the factory v2.43 if I am to sell the scope or send it in for cal, there's just one more thing:

2/ Should I expect the "unsealed instrument" warning to appear after in the liberated 2.43 -- and if so, can I ignore it (will it impact anything) or is there another patch to make that warning disappear?

Thank you kindly for verifying this and your help, best to all in 2019!

NorcalNerd


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: NorcalNerd on January 13, 2019, 09:03:07 pm
If anyone who knows can please clarify -- thank you,

NN
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Gandalf_Sr on January 14, 2019, 09:33:11 pm
Picked up an MSOX4054A today on eBay with the DSOX4APPBNDL (BDL) included which is supposed to enable all of the InfiniiVision 4000 X-Series software applications listed below.

DSOX4AERO A/D trigger and decode (MIL-STD 1553/ARINC 429)
DSOX4AUDIO Audio serial trigger and analysis (I²S)
DSOX4AUTO Automotive trigger and analysis (CAN/LIN/CANdbc)
DSOX4COMP Computer trigger and analysis (RS232/UART)
DSOX4EMBD Embedded trigger and analysis (I²C/SPI)
DSOX4FLEX FlexRay trigger and analysis
DSOX4NRZ User-definable Manchester/NRZ trigger and analysis
DSOX4CXPI CXPI trigger and analysis
DSOX4MASK Mask limit testing
DSOX4PWR Power measurements
DSOX4FRA Frequency Response Analysis (FRA)
DSOX4SENSOR SENT serial trigger and analysis
DSOX4USBFL Low and full-speed USB 2.0 trigger and analysis
DSOX4USBH Hi-speed USB 2.0 trigger and analysis (1 GHz and 1.5 GHz models only)
DSOX4USBSQ USB 2.0 signal quality test
DSOX4VID Video trigger and analysis
DSOX4WAVEGEN2 Integrated 20 MHz dual-channel function/arbitrary waveform generator
DSOX4NFC NFC trigger and automated test software
DSOX4UPD USB Power Delivery (USB PD) trigger and analysis

Other than a bandwidth upgrade from 500 MHz (which I think needs to be done by Keysight (PCB change), is anything missing from the list above that is an option for this scope?

I have an MSO7104B that I'll be selling
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 14, 2019, 09:52:44 pm
MSO cable could be handy if you don't have a compatible one. An upgrade beyond 500 MHz does require a hardware change. Most of your probes should be compatible.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Keysight DanielBogdanoff on January 14, 2019, 11:38:26 pm
Congrats @Gandalf_Sr

The App Bundle license turns on all the things you'd ever need. There are a couple discovered by this form somewhere(like RML), but there's no real use for those other than for our developers/debugging.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Gandalf_Sr on January 15, 2019, 12:07:32 am
Thanks guys.  I already have an MSO cable set with grabbers.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: maxpayne on January 15, 2019, 12:14:09 am
Congrats @Gandalf_Sr

The App Bundle license turns on all the things you'd ever need. There are a couple discovered by this form somewhere(like RML), but there's no real use for those other than for our developers/debugging.

As an oscilloscope owner, can the buyer get free license for Benchvue software all modules ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: titiris on January 19, 2019, 01:34:22 pm
Hi!
I'm new here, and still excited reading and reading and doing more. Thanks to all for sharing. :clap:
I bought a bricked DSOX2014   :-BROKE and after 4 nights reading hundreds (no cheating!) of posts, without any previous WinCE knowledge, I learned:
- what is U-Boot
- what is the nk.bin
- where to connect the serial port
- how the v2.35 runs from an USB drive

and I was able to recover the scope WITHOUT network connection, in one hour, without any failure or drawback, at the first try.  8)
I will write the procedure step by step today or tomorrow.

thank you all again, without your time, my time will be useles in this adventure.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: titiris on January 20, 2019, 11:47:39 pm
here's the guide to follow my steps to unbrick a DSOX2K after flash corruption.

I received the scope with a frequent failure, that is:
green lights near the buttons (ref. to serial) light on in sequence, then RUN/STOP and SINGLE light on, and stay. At this point, the scope doesn't respond and stay forever. The failure repeats exactly the same way, same timing, every time you turn it on.

The procedure. (using my old lab PC, running Win7, and a cheap prolific-based USB to serial cable)

open the scope, and connect a 3.3V level serial cable as depicted here:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895)
(Thanks FrankBuss)
In my unit, the connector is in a different position and rotated 90º. If it happens to you, it's very easy to locate the ground pins with a multimeter then and count, the pins scheme is the same.

You could test the connection with PuTTy @115200,8,N,1, but I recommend to download TeraTerm for later use of YMODEM.
You can locate TeraTerm here:
https://osdn.net/projects/ttssh2/releases/ (https://osdn.net/projects/ttssh2/releases/)
or just google Tera Term download
Note: I tried first with ExtraPuTTy, but (at least in my computer) it hangs during the binary transfer, after 20 minutes or more! a real pain.
If your connection works, you should get something like:

U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  128 MiB
In:    serial
Out:   serial

(...)
it continues until giving you a CRC error or something that aborts your booting process (that's the problem, right?)

Turn off the scope and forget it for a while.

Download a firmware v2.35 from here:
https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/ (https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/)
(thank to Alanme, the "donkey" ;))
...many posts say that this is the last version that boots from the USB, it's mandatory because your flash is corrupted.

Decompress it with 7-Zip or whatever application that can deal with .cab files
You will need two files from here:
   nk.bin.comp, to get the kernel image and recover the WinCE
   infiniiVisionSetup.cab, to get the oscilloscope application

Download the tools from here:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1035636/#msg1035636 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1035636/#msg1035636)
(thanks PA0BZ)
or simply use my own set, attached below.
   
Following the instructions from FrankBuss, modified by  ^-^ me:
use bincompress.exe to get nk.bin from nk.bin.com

X:\yourfolder>bincompress /d nk.bin.comp nk.bin

then use viewbin.exe to get the info from nk.bin that we will use later

X:\yourfolder>viewbin nk.bin

ViewBin... nk.bin
Image Start = 0x80361000, length = 0x013064D4
                Start address = 0x80362000
Checking record #24 for potential TOC (ROMOFFSET = 0xFF010694)
Checking record #39 for potential TOC (ROMOFFSET = 0xFF1126A4)
Checking record #144 for potential TOC (ROMOFFSET = 0x00000000)
NOTICE! Record 144 looked like a TOC except DLL first = 0x4001C001, and DLL last
 = 0x40C4C094
Done.


Using the data we got from viewbin.exe, convert the nk.bin in the nk.nb0 (the binary) with cvrtbin.exe, to be uploaded later

X:\yourfolder>cvrtbin.exe -r -a 0x80361000 -w 32 -l 0x013064D4 nk.bin

This will result in a nk.nb0 in the same folder. Check it and remember the location.

Run TeraTerm with the same serial port parameters, 115200, 8, N, 1
Place something heavy, or your finger, on your keyboard space bar and turn on the scope. This will interrupt the bootloader (das U-boot), showing a prompt:

U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
p500>


Now use the loady function, if you're curious, use the U-boot help first:
p500> help loady
loady - load binary file over serial line (ymodem mode)

Usage:
loady [ off ] [ baud ]
    - load binary file over serial line with offset 'off' and baudrate 'baud'


at the prompt, type

p500> loady 0x0361000 115200

Note from FrankBuss: In case you wonder about the 0x80361000 and 0x361000 difference: this is because of physical and virtual memory addresses. Fortunately, the mapping is really easy in this case.
you should get this:

## Ready for binary (ymodem) download to 0x00361000 at 115200 bps...
CC


the CCCC will continue until you start to send a file, or a timeout happens after a couple of minutes, maybe.

In Tera Term go to File->Transfer->YMODEM->Send... and open the nk.nb0 that you have prepared before
This process is about 45 minutes long, keep in mind that YMODEM is a fast protocol, but the serial connection is 1000 times slower compared with a 100BaseT

The time consumed by the transmission must be enough to prepare the USB.
There are specific tools  mentioned in old posts, to extract the files from infiniiVisionSetup.cab, that I was unable to find (like WinCE CAB Manager 3.0)
Fortunately, in the PA0BZ tools.zip, there is a Python script that to the job, in a tricky way that works for me
the steps are:
   1- Decompress  infiniiVisionSetup.cab into an empty folder, you wil get many files with scrambled names, don't worry.
   2- copy dosetup.py into the same folder
   3- run python dosetup.py or simply double click on dosetup.py if the .p extension is already assigned (in any case, you need Python 2.x.x installed)
Just in case you need it, the instructions are in the readme.txt in the same tools.zip

Now you have the contents of  infiniiVisionSetup.cab exploded in a tree. The next step is to copy this folder and its contents to the USB pendrive, following the structure found here:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg364171/#msg364171 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg364171/#msg364171)
It's simple, just:
   1- copy the contents of the Secure folder in your USB root.
   2- copy the Temp folder in your USB root. (I don't know if it's really necessary, perhaps a guru can tell me "the truth")
   3- make a folder name Startup in your USB root.
   4- create a file inside the folder Startup, named infiniivision.lnk, containing 48#\Secure\infiniiVision\infiniivisionLauncher.exe
   5- create a file in your USB root, named infiniivisionStartupOverride.txt, containing True
   6- copy the complete cab AS-IS (I used 3000XSeries.02.35.2013061800.cab) that you downloaded before in your USB root

the last point is mandatory because once you get your scope resurrected, you must reflash your flash, using the scope utilities, like if you were updating the firmware!
For instructions, go to the Keysight site. You must go anyway later... :-//
(credits for 4 and 5 to plesa, from his several posts about how to start the scope from a USB drive)

Remove safely your USB and plug it into the scope (I used the front panel USB, I don't know if rear USB do the same)

Return to Tera Term, that was transferring the nk.bin...
At the end of the transfer, your screen should show:

CCCxyzModem - CRC mode, 1(SOH)/19482(STX)/0(CAN) packets, 5 retries
## Total Size      = 0x013064d4 = 19948756 Bytes


...right after the last C, without any CR/LF

Check if the bytes received are the same, in this case 0x013064d4

The last step: Use the go U-boot command to execute the kernel just downloaded
Cross your fingers, pray, say thanks to James Clerk Maxwell, or whatever your belief recommend, and type at the prompt:

p500> go 0x00362000

The terminal should start echoing a long list of messages, starting with...

## Starting application at 0x00362000 ...
Windows CE Kernel for ARM (Thumb Enabled) Built on Jan 24 2013 at 14:52:37
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init

(...)

396 lines after the "go" command, you should see the last line:

-----> InfiniiVision is running <-----

and your scope is running!  :clap:

Before turning off the scope, remember to update to 2.35 from the .cab already copied in your USB drive!

Several guys here recommend updating to the last version (as I did) to avoid another flash corruption.
To get the guide for updating, go by yourself to the Keysight site.

that's all folks

Thanks to:
  FrankBuss for the instructions to convert nk.bin.comp in nk.nb0, and for uploading the serial port picture
  PA0PBZ for uploading the nk tools and recommending to use 2.35
  travisc for cleaning up and sharing the correct structure to get a bootable USB
  plesa for sharing so many examples about the .cab and .lnk, impossible to name them one by one here
  TheSteve, for remembering to put the full .cab in the USB, to update after the resurrection
sorry if I forgot someone between the hundreds of inspiring posts, I come from the era of embedded systems with 2Kbytes of EEPROM and 256bytes of RAM, my memory is not as big as needed to remember you all  :-DD

 P.S.: some of the tools and ideas were taken from here  https://forum.xda-developers.com/showthread.php?t=656086 (https://forum.xda-developers.com/showthread.php?t=656086)
 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 21, 2019, 12:36:38 am
Thanks for the post, I have only transferred via network.
Something to keep in mind is that recovering as you did generally only works if you had 2.35 to begin with or maybe a version very close to it. It also depends on where in the boot process your original corruption occurred. Often the scope will not fully boot which means you can't reinstall the firmware from the usb drive.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: titiris on January 21, 2019, 01:06:21 am
I'm not sure that you need any particular version before the corruption, because this method overwrites the previous software, whatever it is. I must test it in the future (or someone else?)
To be useful, you need at least das U-boot working, of course, otherwise, you have a real brick. JTAG is the only one way to debrick it (or a soldering iron!  :P)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 21, 2019, 01:11:56 am
I'm not sure that you need any particular version before the corruption, because this method overwrites the previous software, whatever it is. I must test it in the future (or someone else?)
To be useful, you need at least das U-boot working, of course, otherwise, you have a real brick. JTAG is the only one way to debrick it (or a soldering iron!  :P)

The problem is that when you execute the uploaded image it will not boot fully if the original image is too corrupted or there is a version mismatch. The image transferred still relies on data from the original image in flash to fully boot and operate.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Gandalf_Sr on January 21, 2019, 09:27:50 am
Wow titiris, only 3 posts and you're giving us such great detail.  Well done sir!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: edyno on January 24, 2019, 08:05:25 am
Here are the values of the components on the main board::
(see attached pictures)

The resistors "RED-COLOR" values are clear.
All capatitors "YELLOW-COLOR" I dismount and measure.
The coils "BLUE-COLOR values" are only compared with cataloque.
E1-E4 are ferrite balun 0805 SMD

Others:
K301   AGQ210S4H
U301   AHCT594
U302   AD8034
U303   2AD2-0001
T   1AM   MBT3904   NPN
D   G2Y   ??? (double D)
U300   AQY214
U601   AD706J
CR301   BAV99W

All results are without guarantee.
I wish you good luck :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Blue on January 30, 2019, 08:28:45 pm
Hi everyone,

I obtained a lan board from Gribo. Thanks!  :)

Since the information in this thread is quite cluttered, I'll write up what I did (sort of note to myself).

I have a DSO-X-3014A with some preinstalled options like wavegen, edu, etc.

Upgraded to the latest 2.43 firmware (from Keysight website).
Got the patched_nk.bin.comp file with a MD5 of: 1CA34A1B837B075133BE53B379749BBB

with putty telnet to ip port 23

user: infiniivision
pw: skywalker1977

First login attempt always fails. Just type some rubbish

Put in usb stick containing 2 files:

patched_nk.bin.comp
infiniivision.lnk

execute the following commands:

processmgr kill infiniivisionlauncher.exe
\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
copy \usb\infiniivision.lnk to \secure\startup
         (note: Only 1 lnk file in this directory)
type \secure\startup\infiniivision.lnk
         (just to check it)
exit
reboot scope.

contents of infiniivision.lnk (one line only)
211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW20 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC



I tried also with some additional options like -l FRA -l DVMCTR -l SENSOR -l CANFD -l CXPI -l NFC -l NRZ -l USBPD

It resulted in flashing leds and sweat on my forehead... Fortunately I could get into the scope using telnet and removed those additional items.

Questions
- What does that 211 number mean?
- Are there other options I could/should install?
- Hardware self test: I do not hear any relays clicking anymore. Is this normal?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on January 30, 2019, 09:12:55 pm
contents of infiniivision.lnk (one line only)
211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW20 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

Questions
- What does that 211 number mean?
211 is the number of characters after #
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on January 31, 2019, 10:30:02 am
afair there is a maximum number of characters (255?) the scope will recognize. I remember that adding each single license resulted in some missing licenses as the string was too long.
Just use -l ALL -l BW20 -l SCPIPS and you are all set.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: GregerG on January 31, 2019, 10:50:53 am
Doesn't -l PLUS work?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bicycleguy on January 31, 2019, 07:14:08 pm
I've been using a DSOX2014A I upgraded around version 2.41.  Yesterday upgraded using the Safar method to 2.43 to get the PLUS+ stuff.

Now it seems like I'm missing an info screen that overlaid statistics I regularly used.
This is what it used to look like:
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=639922;image)

The Statistics button is missing from the bottom right so no overlay.  Is this maybe the problem with to long a script?  I used;
211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW20 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dougberc on January 31, 2019, 07:43:35 pm
Ok guys, here goes. I've got a brand spankin' new... well, ok no. (but hey, it's new to me!) ...used DSOX4034. It's dying to be upgraded. Current firmware is 07.20.2017102615. I've looked at post #1931 where PhillyFlyers has graciously contributed an nk.bin.comp specifically for this situation (if I'm reading all of this right; there are a LOT of posts and a LOT of details).

Sooo.... from various posts:

0) Install correct Firmware version first (I'm already on the 7.20... as stated above)
1) I've already downloaded the patched 4k_7.20_nk.bin.comp; copy to a USB stick and plug in.
2) Telnet into the scope.
3) Login infiniivision / skywalker1977
4) processmgr kill infiniivisionlauncher.exe
5) \windows\loadP500Flash -u ceImage1 \usb\4k_7.20_nk.bin.comp
6) Create a file on the USB stick called infiniivision.lnk with contents (e.g.) "88#infiniivisionLauncher.exe -l MSO -l BW50 -l DIS -l PLUS -l SCPIPS -l VID -l CABLE --perf"
7a) delete (or rename) any other lnk in \secure\startup folder. Should be only one file with lnk extension here.
7b) copy \usb\infiniivision.lnk to \secure\startup
8 ) reboot and good to go

BUT.. I have a few concerns. My \secure\startup contains NOTHING. Even with a "dir /ah". It seemed from the other posts that this part of the hack was a replacement. Is it an addition? If I read this wrong I appologize. Or is there another way to check that I'm missing? Also shouldn't step 6 be done really as 1a or am I confused?

ALSO, I tried just killing the infiniivisionlauncher.exe - screen goes black - and then relaunching with options (to test the command line) but the scope just reboots with from-factory options installed. I'm assuming this is because the hack isn't done yet. But there DID appear to be posts with earlier firmware that COULD be optioned up this way; (but were temporary in nature). is that correct?

Finally if this really dorks something up, what are the odds you can reverse it? I'm capable of surface mount work and have tools like USB-serial, another scope, etc. Just want to know the sweat factor.

Very, very thankful for any help!
-d
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on January 31, 2019, 11:34:18 pm
I can confirm that \secure\startup  is empty on my scope too and afair (I will check my notes tomorrow) only flashing of the new .bin file is needed, nothing else.  Thus step 6 and 7 will not be needed. Maybe somebody has his note ready and can confirm/correct me.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bicycleguy on January 31, 2019, 11:47:50 pm
afair there is a maximum number of characters (255?) the scope will recognize. I remember that adding each single license resulted in some missing licenses as the string was too long.
Just use -l ALL -l BW20 -l SCPIPS and you are all set.

Think your missing a few.  After a bit of fun this seems optimum on a DSOX2014A with firmware 2.43:
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID

Some reasoning:
DIS adds a bunch of options like ALL without adding a * to each feature in the about screen
MSO does its name
--perf is req'd to get the Meas/Statistics button and screen shown at https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2166070/#msg2166070 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2166070/#msg2166070)
CABLE is req'd for Analyze/'Ratio and Phase Ref' menu
VID is req'd for extra video triggers and features

Any missed?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bicycleguy on February 01, 2019, 12:31:41 am
Doesn't -l PLUS work?

That only gets you: MEMUP,SGM,EDK,DVM,RML,PLUS

USE
...  After a bit of fun this seems optimum on a DSOX2014A with firmware 2.43:
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID

Some reasoning:
DIS adds a bunch of options like ALL without adding a * to each feature in the about screen
MSO does its name
--perf is req'd to get the Meas/Statistics button and screen shown at https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2166070/#msg2166070 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2166070/#msg2166070)
CABLE is req'd for Analyze/'Ratio and Phase Ref' menu
VID is req'd for extra video triggers and features

Any missed?

to get this:
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=640090)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Blue on February 01, 2019, 04:55:48 am
I have a DSOX3014A.

I cannot get -l CABLE to be sticky.
If I telnet into the scope:

Pocket CMD v 6.00
\> ProcessMgr.exe kill infiniivisionLauncher.exe
\> \secure\infiniivision\infiniiVisionLauncher.exe -l ALL -l BW20 -l SCPIPS -l CABLE --perf
Our command line is -l ALL -l BW20 -l SCPIPS -l CABLE --perf
*** Installing License: All Licenses
*** Installing License: 200MHz Bandwidth
*** Installing License: Cable Calibration
*** Installing License: Infiniium Mode
System has been running 91.553528 seconds

I get the cable menu in the analyze submenu. But if I put
65#infiniivisionLauncher.exe -l ALL -l BW20 -l SCPIPS -CABLE --perf
 into a file called \usb\infiniivision.lnk and copy it to \Secure\Startup then it does not register.

Does anyone know why?
Does --perf do anything in this scope?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on February 01, 2019, 05:04:33 am
Quote
Our command line is -l ALL -l BW20 -l SCPIPS -l CABLE --perf
Quote
65#infiniivisionLauncher.exe -l ALL -l BW20 -l SCPIPS -CABLE --perf

Your programmed command line isn't the same as your manually entered one :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Blue on February 01, 2019, 05:21:09 am
Hi Dunkemhigh,

You are absolutely right. I made a stupid mistake. Thanks.

My scope:

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dougberc on February 01, 2019, 10:18:37 pm
Well, after sitting on my hands a bit I took the plunge and.... IT WORKS!! ;D

Absolutely amazing and I really cannot thank everyone in this forum enough! Just WOW!!

I followed my previous post as far as flashing the firmware goes but I didn't add the infiniivision.lnk. I went ahead and rebooted the scope and it came up like normal with the default options that it shipped with. So I telnet'd in, and killed the process and started experimenting with launcher commands. For my scope - a Keysight DSOX4034A - I ended up settling on this for the infiniivision.lnk:

73#infiniivisionLauncher.exe -l DIS -l MSO -l BW50 -l SCPIPS -l CABLE -l VID

The "-l DIS" and "-l PLUS" seem to replicate each other to a large extent, and "-l DIS" seemed to include more by itself. Also the "--perf" that some people have added causes my scope to barf. Along those same lines, if you add any parameter to that string of options that causes an error it will stop parsing the line right there. For example, if I were to use: "73#infiniivisionLauncher.exe -l MSO --perf -l BW50 -l SCPIPS -l CABLE -l VID" then the parser would error out on the "--perf" part and the only option installed would be the MSO one. This was probably mentioned in the 80+ pages somewhere but I'll repeat it here just in case.

So again,

THANK YOU!! THANK YOU!! THANK YOU!!


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Blue on February 01, 2019, 11:19:06 pm
I've been playing with the lnk file.
Now it contains: 68#infiniivisionLauncher.exe -l ALL -l BW20 -l SCPIPS -l CABLE -l TOM

and the result is:

Suddenly I get Tomotherapy and SGMC as additions.
Does anyone know what these are?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Blue on February 01, 2019, 11:36:25 pm
Does anyone knows where to get the 64997A Oscilloscope Spectrum Visualizer (OSV) Software software?

https://www.keysight.com/en/pd-2118936-pn-64997A/agilent-spectrum-visualizer-asv-software?nid=-32448.1011140&cc=NL&lc=dut (https://www.keysight.com/en/pd-2118936-pn-64997A/agilent-spectrum-visualizer-asv-software?nid=-32448.1011140&cc=NL&lc=dut)

https://www.youtube.com/watch?v=FiONiksiQDs (https://www.youtube.com/watch?v=FiONiksiQDs)

Or is there a newer version?
This software is used with the ASV option.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on February 02, 2019, 12:40:56 am
Does anyone knows where to get the 64997A Oscilloscope Spectrum Visualizer (OSV) Software software?

Or is there a newer version?
This software is used with the ASV option.

It's obsolete now, but you can try this (https://www.keysight.com/main/software.jspx?ckey=2168167&lc=eng&cc=US&nid=-11143.0.00&id=2168167).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Blue on February 02, 2019, 01:11:27 am
Download does not work.
Any other options?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on February 02, 2019, 01:34:25 am
Download does not work.
Any other options?

It downloads just fine for me; "Keysight_OSV_1_9_20.zip" 129MB
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Blue on February 02, 2019, 02:15:15 am
Thanks for the update.
I had to register before I could download it. Duh...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on February 02, 2019, 02:20:41 am
Thanks for the update.
I had to register before I could download it. Duh...

Glad you figured it out!  You also need the Keysight IO Libraries Suite, and make sure your scope is detected and listed in the Connection Expert utility, and then start the OSV program.  Its a bit clunky operationally...

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Blue on February 02, 2019, 02:38:45 am
Very clunky is an understatement.
Pretty useless.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rizal5478 on February 11, 2019, 05:10:09 pm
The Steve, I've my MSO-X 3012A hang and no display during start up. After read the thread I've done extracting through serial on the board and result as below. By the way I've no idea what is the version before the scope spoilts.

U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
failed: 597 0
Could not copy from NAND offset 0x60000. Error -74 With ECC
failed: 1192 597
Could not copy from NAND offset 0x60000. Error -74 NO ECC
FPGA programming FAILED!
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2011-01-27  11:38:14 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    36703 Bytes = 35.8 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Jan 27 2011 02:04:15
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0600000
ODeCompressFlash: CeCompressDecode() failed
 EBOOT_ReadFlash failed

ERROR: Unable to read image signature.

BL_IMAGE_TYPE_UNKNOWN

 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1600000
ODeCompressFlash: CeCompressDecode() failed
 EBOOT_ReadFlash failed

ERROR: Unable to read image signature.

BL_IMAGE_TYPE_UNKNOWN

 Loading image 2 failed, trying next one
 All images failed

Press r to reset

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on February 11, 2019, 05:17:20 pm
Yep, that is the NAND corruption issue. You can try recovering it yourself using a network or serial connection. Or contact Keysight as they should repair it for free for you.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rizal5478 on February 11, 2019, 05:19:47 pm
The Steve, I've my MSO-X 3012A hang and no display during start up. After read the thread I've done extracting through serial on the board and result as below. By the way I've no idea what is the version before the scope spoilts.

U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
failed: 597 0
Could not copy from NAND offset 0x60000. Error -74 With ECC
failed: 1192 597
Could not copy from NAND offset 0x60000. Error -74 NO ECC
FPGA programming FAILED!
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2011-01-27  11:38:14 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    36703 Bytes = 35.8 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Jan 27 2011 02:04:15
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0600000
ODeCompressFlash: CeCompressDecode() failed
 EBOOT_ReadFlash failed

ERROR: Unable to read image signature.

BL_IMAGE_TYPE_UNKNOWN

 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1600000
ODeCompressFlash: CeCompressDecode() failed
 EBOOT_ReadFlash failed

ERROR: Unable to read image signature.

BL_IMAGE_TYPE_UNKNOWN

 Loading image 2 failed, trying next one
 All images failed

Press r to reset


I've done base from the thread using version 2.35 with USB and it show error as below:-

U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
failed: 597 0
Could not copy from NAND offset 0x60000. Error -74 With ECC
failed: 1192 597
Could not copy from NAND offset 0x60000. Error -74 NO ECC
FPGA programming FAILED!
Press space to stop autoboot:  0
p500> loady 0x0361000 115200
## Ready for binary (ymodem) download to 0x00361000 at 115200 bps...
CCxyzModem - CRC mode, 6(SOH)/19482(STX)/0(CAN) packets, 8 retries
## Total Size      = 0x013064d4 = 19948756 Bytes
p500> go 0x00362000
## Starting application at 0x00362000 ...
Windows CE Kernel for ARM (Thumb Enabled) Built on Jan 24 2013 at 14:52:37
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jun 18 2013)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600                                                      _gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600                                                      _gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:20:79:89
Phy found addr 31 (ticks=2590)
WaitForLink Start (ticks=2591)
No Link (ticks=3594)
<--EDeviceInitialize

GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jens01 on February 11, 2019, 07:29:43 pm
Not really on-topic, but not worth creating a new topic:

@Daniel, will the FRA plugin become available for the non-T DSOX3k series? In my case that would be a instant-buy. It is a bit strange that the FRA is (default) supported by the cheaper DSOX1200 series, but not on the more expensive serie.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: titiris on February 12, 2019, 08:48:12 pm
Hi Rizal5478,
just in case, I have the full session saved from my successful recovery. Here is the segment from the loady to the happy end

p500> loady 0x0361000 115200
## Ready for binary (ymodem) download to 0x00361000 at 115200 bps...
CCxyzModem - CRC mode, 1(SOH)/19482(STX)/0(CAN) packets, 5 retries
## Total Size      = 0x013064d4 = 19948756 Bytes
p500> go 0x00362000
## Starting application at 0x00362000 ...
Windows CE Kernel for ARM (Thumb Enabled) Built on Jan 24 2013 at 14:52:37
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jun 18 2013)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:20:1A:5B
Phy found addr 31 (ticks=2638)
WaitForLink Start (ticks=2640)
No Link (ticks=3643)
<--EDeviceInitialize

GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
ERROR: OALIoCtlHalGetDeviceInfo: Device doesn't support IOCTL_HAL_GET_DEVICE_INFO::SPI_GETBOOTMENAME
Failed to start/configure network.
Time for NANDFLASH to load: 0 ms.
Time for SNANDFLASH to load: 0 ms.
Starting ProcessStartupFolder
ProcessStartupFolder: \usb\Startup\
                                   running \usb\Startup\infiniivision.lnk...
Ending ProcessStartupFolder
                           Our command line is
Performing Startup
Released build, Jun 18 2013, 12:31:00
Initializing FPGA...
****
FPGA Type: Idaho
Ver: 1.094 Released
Build Time: Wed Oct 24 15:40:11 2012
Build Machine: DW3647M2
****
No option module detected
Keyboard firmware version 32... ok
Keyboard Info: Board id 7, Board rev 2
Startup sequence is complete.
System has been running 70.717255 seconds
Start Up Sequence 56.031798
Memory Load 54%
   System Physical Memory 42.551 / 79.086 MB
   Process Virtual Memory 45.688 / 1024.000 MB
-----> InfiniiVision is running <-----


I also get the same errors as you, but the scope end running flawlessly.
Hope it helps  :-//
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wrieken on February 13, 2019, 04:20:48 pm
Hi,

Were you able to fix your problems and also, if you don't mind, could you please let me know what would be a good set of probes without paying the Keysight US 600USD tax for them?

Thanks,

William
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dwaine on February 14, 2019, 02:10:39 am
A little bit off topic...

  I went from the Rigol 4 channel scope to the DSOX2004.  After patching and upgrading it, I can see what people have been saying about the differences between the Rigol and Keysight scopes.   It's really night and day.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rizal5478 on February 15, 2019, 11:20:44 am
Thanks Titiris, At least I knew how far that I'm right now.. Do you know this method only can use for certain version of software? As I didn't aware before my existing version.. I just use this 2.35 version for my trial.. Would this able to solve if existig has version higher than 2.35?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlloyd1 on February 15, 2019, 06:26:01 pm
 
welcome to the light
 ;D

sorry, i just couldn't help it ...

mlloyd1
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rizal5478 on February 26, 2019, 05:53:25 pm
I just got DSOXLAN module. Anyone did through telnet with unit hang and no display issue?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Xavier64 on March 06, 2019, 03:16:10 pm
For all Keysight 3000A uses who have the startupmessage:

Firmware OS error detected



this infiniivision.lnk is the solution:


119#\Windows\cmd.exe /c infiniivisionlauncher.exe -l ALL -l BW50 -l SCPIPS -l SGMC -l CABLE -l PERF -l TOM -l CABLE --perf




I assume you followed this steps



0) Install correct Firmware version first (i.e. in this case 2.43)
1) Download Safar's patched_nk_bin.comp file and copy to a USB stick and plug in.
2) Telnet into the scope.
3) Login infiniivision / skywalker1977
4) processmgr kill infiniivisionlauncher.exe
5) \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
6) Create a file on the USB stick called infiniivision.lnk with contents (e.g.) "88#infiniivisionLauncher.exe -l MSO -l BW20 -l DIS -l PLUS -l SCPIPS -l VID -l CABLE --perf"
7a) delete (or rename) any other lnk in \secure\startup folder. Should be only one file with lnk extension here.
7b) copy \usb\infiniivision.lnk to \secure\startup
8 ) reboot and good to go



I did it with Firmware 2.43


LAN module is working fine and NO red warning appears.

Thanks to all who made this possible.




Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dwaine on March 07, 2019, 07:39:22 am
I just got DSOXLAN module. Anyone did through telnet with unit hang and no display issue?

Hanging happens, just try to connect again.  It will work the second time.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on March 09, 2019, 08:17:21 am
Firmware version 2.50 was released today for the 2000A/3000A series.

Major release details:

Bug Fixes for both 2000A and 3000A
- Fixed an issue of an unrelated error message showing when adjusting the UART/CAN/LIN
baud-rate.
- Fixed an issue of the Reference Waveform file (.h5) incorrectly saving data with twice the
timebase delay when there is a non-zero delay on the displayed waveform.
- Fixed an issue of the inverted channel mode not displaying the waveform correctly in
Averaging Mode.

Changes for both 2000A and 3000A
- Due to a lack of browser support for Java-based applications, support for the legacy Javabased remote front panel has been removed. A modern HTML5-based remote front panel is available.
- As of version 2.50, the VNC server software for the remote front panel functionality is no
longer bundled with the scope software by default. Upgrading to 2.50 will not delete the
VNC server software from the scope, but new scopes will no longer ship with the VNC
server software installed. For scopes without the software installed, the Browser Web
Control page will provide a link for installing the software.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on March 09, 2019, 12:33:49 pm
Firmware version 2.50 was released today for the 2000A/3000A series.

Major release details:

Bug Fixes for both 2000A and 3000A
- Fixed an issue of an unrelated error message showing when adjusting the UART/CAN/LIN
baud-rate.
- Fixed an issue of the Reference Waveform file (.h5) incorrectly saving data with twice the
timebase delay when there is a non-zero delay on the displayed waveform.
- Fixed an issue of the inverted channel mode not displaying the waveform correctly in
Averaging Mode.

Changes for both 2000A and 3000A
- Due to a lack of browser support for Java-based applications, support for the legacy Javabased remote front panel has been removed. A modern HTML5-based remote front panel is available.
- As of version 2.50, the VNC server software for the remote front panel functionality is no
longer bundled with the scope software by default. Upgrading to 2.50 will not delete the
VNC server software from the scope, but new scopes will no longer ship with the VNC
server software installed. For scopes without the software installed, the Browser Web
Control page will provide a link for installing the software.

Enhancements for both 2000A and 3000A
- Added support for High-Speed LAN Instrument Protocol (HiSLIP).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: NorcalNerd on March 11, 2019, 12:22:48 pm
If anyone could please check my steps/understanding on my Jan 7 post -- a couple of questions I'd appreciate it much

Should I image the 3024A with 2.50 instead of 2.43?

Spring is here, I'll be out hiking...

Thank you,
NN


Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2084 on: January 07, 2019, 01:23:31 am »
ReplyQuoteModifyRemove
Hello again, and thanks for your help.

Acquiring a DSOXLAN, I'm finally ready to do the upgrade to my 3024A running "factory" 2.43, applying the latest patched 2.43 (and it is a rainy weekend) -- I have a couple of questions please.

1/ Can anyone clarify the contents of the link file to enable all features available in the patched firmware -- for the 3024A?

From previous responses, I am not clear on if my modified link contents (cmd line) is correct -- specifically, the preceding "211#..." which I  think would have been OK if I had the 350MHz model, and appears to represent the length of the infiniivisionLauncher.exe cmd line not including the preceding "211#".

"211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

The above (not for my scope) is indeed 211 characters in length so it makes sense (to me) I need to change that number.

Is the below correct (I removed "-l BW50" alone) -- with the # of characters now being 203? :

"203#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

As I am now clear I can revert back to the factory v2.43 if I am to sell the scope or send it in for cal, there's just one more thing:

2/ Should I expect the "unsealed instrument" warning to appear after in the liberated 2.43 -- and if so, can I ignore it (will it impact anything) or is there another patch to make that warning disappear?

Thank you kindly for verifying this and your help, best to all in 2019!

NorcalNerd
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: schmike on March 12, 2019, 02:26:02 pm
Hi
Just brought the 3014T
Can you explain the procedure of hack the 3014T?
Thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: schmike on March 12, 2019, 02:31:57 pm
Hi
Will the DSOX3014A HAVE THE FRA Function?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: schmike on March 12, 2019, 02:34:07 pm
Thanks
I have finish on 3014A
Thanks again
But still have the 3014T want to hack
I need the fra function
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dsmay4 on March 12, 2019, 07:31:49 pm
I'm close to pulling the trigger on a new MSOX4024A, but I wanted to ping the experts here to see if the same hack is feasible on this model before I blow all that money... 

I know a lot of folks have talked about doing it on the 1000/2000/3000 series and on the DSOs, but wasn't sure if the same technique works for the 4000 series and the MSO specifically, especially with recent firmware releases (want to make sure no holes were closed).

Also is the file still available?

TIA, you guys have done some awesome work here!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on March 12, 2019, 10:16:22 pm
somewhere above the prodedures for the 4000 series is explained. Hint: click on "Print" and then do a search with CRTL-F through all pages looking for 4000 or 4024 etc.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dsmay4 on March 14, 2019, 02:44:25 am
Will do and thanks. I should have thought of that.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on April 01, 2019, 11:26:42 pm
Greetings folks,

I just purchased a very lightly used DSOX3024A oscilloscope on ebay for $3750 USD (a bargain, I would think). This scope already includes the DSOX3APPBNDL, which includes the following options:

DSOX3ADVMATH Advanced math measurement application
DSOX3AERO A/D trigger and decode (MIL-STD 1553/ARINC 429)
DSOX3AUDIO Audio serial trigger and analysis (I²S)
DSOX3AUTO Automotive trigger and analysis (CAN/LIN)
DSOX3COMP Computer trigger and analysis (RS232/UART)
DSOX3EMBD Embedded trigger and analysis (I²C/SPI)
DSOX3FLEX FlexRay trigger and analysis
DSOX3MASK Mask limit testing
DSOX3MEMUP Memory upgrade to 4 Mpts
DSOX3PWR Power measurements
DSOX3SGM Segmented memory acquisition
DSOX3VID Video trigger and analysis
DSOX3WAVEGEN Integrated 20 MHz function/arbitrary waveform generator

I have read through some of this thread but there is so much to dig through. I would like to hack the scope to add the MSO option at the very least. I would also love to upgrade from 200MHz to 500MHz, but that is not a priority. Anything else beyond that is frosting on the cake. I imagine if any thread has the information required to do this, it would be this one, but like I said there's a lot of pages to pore over. I was wondering if someone happens to have answered this question already, and would be able to point me to that post? In the meantime I'll keep looking on my own.

Thanks very much,
Matt
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dwaine on April 03, 2019, 01:34:52 am
If anyone could please check my steps/understanding on my Jan 7 post -- a couple of questions I'd appreciate it much

Should I image the 3024A with 2.50 instead of 2.43?

Spring is here, I'll be out hiking...

Thank you,
NN


Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2084 on: January 07, 2019, 01:23:31 am »
ReplyQuoteModifyRemove
Hello again, and thanks for your help.

Acquiring a DSOXLAN, I'm finally ready to do the upgrade to my 3024A running "factory" 2.43, applying the latest patched 2.43 (and it is a rainy weekend) -- I have a couple of questions please.

1/ Can anyone clarify the contents of the link file to enable all features available in the patched firmware -- for the 3024A?

From previous responses, I am not clear on if my modified link contents (cmd line) is correct -- specifically, the preceding "211#..." which I  think would have been OK if I had the 350MHz model, and appears to represent the length of the infiniivisionLauncher.exe cmd line not including the preceding "211#".

"211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

The above (not for my scope) is indeed 211 characters in length so it makes sense (to me) I need to change that number.

Is the below correct (I removed "-l BW50" alone) -- with the # of characters now being 203? :

"203#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

As I am now clear I can revert back to the factory v2.43 if I am to sell the scope or send it in for cal, there's just one more thing:

2/ Should I expect the "unsealed instrument" warning to appear after in the liberated 2.43 -- and if so, can I ignore it (will it impact anything) or is there another patch to make that warning disappear?

Thank you kindly for verifying this and your help, best to all in 2019!

NorcalNerd

Does the new firmware 2.50 work with the hack?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: KC0PPH on April 03, 2019, 02:10:19 am
I searched this thread looking for info on a 1204G but do not see that in here. Is it too new to have been hacked? It is a bit above what I wanted to spend but thinking its much better than the MSO5000 from Rigol. If the Keysight one is hackable to full specs id gladly go for it over the Rigol as its having some issues.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on April 03, 2019, 02:19:36 am
I don't think the 1204G is at the level of the Rigol MSO5000 in terms of features (sample rate, memory, math, serial decode options, etc).  I was attracted to the MSO5074 features, purchased it but ended up returning it... having all the fancy features but the basic stuff not working reliably was a big NO for me. 

I would consider a used 4 channel 2000X or 3000X instead of the MSO5074 or 1204G, but it is not easy to get hand on a cheap one these days... the used test equipment market these days is crazy expensive.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Joee on April 03, 2019, 09:56:04 am
Hello guys,

I managed to telnet to port 23 on oscilloscope startup but after boot the session quits. What am I doing wrong?

I got a MSO-X 3034A, FW 2.50
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on April 04, 2019, 12:38:23 am
Hello guys,

I managed to telnet to port 23 on oscilloscope startup but after boot the session quits. What am I doing wrong?

I got a MSO-X 3034A, FW 2.50

Hi,

wait until the scope is all booted up, then attempt to telnet in, remember, the first telnet attempt always immediately disconnects.
Just telnet in again and try the usual login/pwd...

Also, I don't know if anyone on here has taken the 2.50 SW upgrade yet and tried it with the hacks, to see if it still works?

I haven't taken a look at it myself yet.... so hopefully you can still get in and do the usual magic :)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Joee on April 04, 2019, 10:46:17 am
I tried many times. Only at the first boot seconds I get a connection.

Does anybody still have the 2.43 Firmware file?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on April 04, 2019, 04:17:07 pm
I tried many times. Only at the first boot seconds I get a connection.

Does anybody still have the 2.43 Firmware file?

I have it at home if no one else is able to post it here beforehand, I can put it up later...

Wow, I wonder if they actually went on the aggressive and are attempting to put down this hacking path? 

Although I still think we can get in from the uboot menu and write flash that way, but then that would require the executable to still be patchable with the options enables, that could be changed as well?

it's been so long since I played with this now, anyone remember if it's easy to go back to lower firmware versions? 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on April 05, 2019, 08:15:13 am
I updated a DSOX2024A (no hack needed because the APP Bundle and MSO option is installed) to 2.50 and did a port scan.
The result was that the telnet port 23 is no longer active. No further investigation yet.

So i will not update the 2.43 firmware on my own DSOX3024A.
I only use the hack to enable the MSO option because I already have the APP Bundle installed.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Xavier64 on April 05, 2019, 08:51:03 am
Firmware 2.43

https://mega.nz/#!lSJwDAzK!YQSZ0AnbJ7rloFFBDppx7iaGKqcftTBsGBUjhnez_bk


and the patched nk.bin for 2.43

https://mega.nz/#!1GIAlaqY!AbS8cnGSqtntFIgGVGeTM3YNNWoBcHaEUNvuj80B7kg




@kilobyte

Can you double check the telnet issue please ?!
If this is correct than no more hacks possible. Maybe Telnet is only on a different port now...




Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on April 05, 2019, 10:37:31 am
Firmware 2.43

https://mega.nz/#!lSJwDAzK!YQSZ0AnbJ7rloFFBDppx7iaGKqcftTBsGBUjhnez_bk


and the patched nk.bin for 2.43

https://mega.nz/#!1GIAlaqY!AbS8cnGSqtntFIgGVGeTM3YNNWoBcHaEUNvuj80B7kg

You, Sir, are a gentleman and a scholar!

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on April 05, 2019, 11:43:28 am
A portscan and testing the other ports showed no other telnet port except the SCPI Telnet port.

With V2.50 the Telnet port is only available for a short time before the infiniiVisionLauncher kills the service and starts the scope app.
But it is possible to kill the launcher if the login and process kill command is handled by a python script running directly after the network connection has been established. (ping /t)

using the launcher from here still allows to start the App with different Options
\Secure\infiniiVision\infiniiVisionLauncher.exe
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on April 05, 2019, 11:46:12 am
Firmware 2.43

https://mega.nz/#!lSJwDAzK!YQSZ0AnbJ7rloFFBDppx7iaGKqcftTBsGBUjhnez_bk


and the patched nk.bin for 2.43

https://mega.nz/#!1GIAlaqY!AbS8cnGSqtntFIgGVGeTM3YNNWoBcHaEUNvuj80B7kg

I have read back quite a ways and unfortunately I am still unclear as to how to apply this firmware and patch. My new DSOX3024A will be here early next week. It currently has firmware version 2.37, and has the DSOX3APPBUNDL installed. I want to add the MSO option using the hack. How exactly would I do that with the above files?

Thanks,
Matt
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Xavier64 on April 05, 2019, 02:26:38 pm
The hack works without the patched file, but with the patched file all RED errors will be NOT shown.

Ok, so I assume the minimal steps are:

0) Install correct Firmware version first (i.e. in this case 2.43)
1) Download Safar's patched_nk_bin.comp file and copy to a USB stick and plug in.
2) Telnet into the scope.
3) Login infiniivision / skywalker1977
4) processmgr kill infiniivisionlauncher.exe
5) \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
6) Create a file on the USB stick called infiniivision.lnk with contents (e.g.) "88#infiniivisionLauncher.exe -l MSO -l BW20 -l DIS -l PLUS -l SCPIPS -l VID -l CABLE --perf"
7a) delete (or rename) any other lnk in \secure\startup folder. Should be only one file with lnk extension here.
7b) copy \usb\infiniivision.lnk to \secure\startup
8 ) reboot and good to go


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on April 05, 2019, 02:35:04 pm
Attached is the litte script, mostly the telnet client example from the python documentation, to login and kill the process.
If the program doesn't exit with an error message then its a good sign that the launcher was kill successfully and you can login with the known credentials.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on April 05, 2019, 03:01:13 pm
The hack works without the patched file, but with the patched file all RED errors will be NOT shown.

Ok, so I assume the minimal steps are:

0) Install correct Firmware version first (i.e. in this case 2.43)
1) Download Safar's patched_nk_bin.comp file and copy to a USB stick and plug in.
2) Telnet into the scope.
3) Login infiniivision / skywalker1977
4) processmgr kill infiniivisionlauncher.exe
5) \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
6) Create a file on the USB stick called infiniivision.lnk with contents (e.g.) "88#infiniivisionLauncher.exe -l MSO -l BW20 -l DIS -l PLUS -l SCPIPS -l VID -l CABLE --perf"
7a) delete (or rename) any other lnk in \secure\startup folder. Should be only one file with lnk extension here.
7b) copy \usb\infiniivision.lnk to \secure\startup
8 ) reboot and good to go
Thanks a ton, this is very helpful. I guess I'm hung up on how to Telnet into the scope though. Without having it here next to me (still being half way across the country) I'm a bit confused about the connections required. I admit I know absolutely nothing about Telnet....
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on April 06, 2019, 12:05:37 pm
Apologies for the double-post, but something I forgot to mention (probably a biggie) is that the scope I'm getting does not have a network module. Telnet will be a bit tricky without an internet connection  :P

Perhaps I should focus on how to apply the hack permanently through USB. I think that was mentioned earlier in this thread but I couldn't find enough details to allow me to replicate the process accurately.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on April 06, 2019, 01:31:49 pm
I'm going to test something out later today, I belive it should work just making the patched 'nk.bin.comp', and then re-packing all the files into a new cab file..

This cab packer seems to work awesome, I see the final created cab files look good.. so I'm going to try this out later today..this way we can just install the patched firmware from a UsB stick..

BUT, that still leaves you with having to modify the lnk file?  so you may have to buy the homebrew lan board...


but if anyone wants to try this now, this tool is pretty sweet..

(you can get the full suite from here)

https://www.softpedia.com/get/File-managers/CabPack.shtml (https://www.softpedia.com/get/File-managers/CabPack.shtml)
Sounds good, I'm looking forward to hearing the results of your testing.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on April 06, 2019, 06:22:07 pm
FYI..

here's the patches for 2.50 (3000A)

Code: [Select]
3000A series:

firmware: 2.50
------------------
1) options patch:  0x2815f4  --> "04 00 A0 E1" --> "00 00 A0 E3"
2) nag patch:      0x2aae50  --> "CD 59 FF EB" --> "01 00 A0 E3"
This is great. Where exactly are these addresses? Are they on the scope, or are they in one of the files that come with the firmware? Please bear with me, I am a complete noob when it comes to this sort of thing.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on April 06, 2019, 11:42:12 pm
Ok Guys, got it all working:

Code: [Select]
1) patching the nk.bin.comp, fixing the two MD5 entries in the 'recipe.xml', and re-building the cab file with little CAB builder I posted worked perfect
(just make sure to choose MSZIP for the compression type)

2) the LAN connection did NOT get shutoff for me after I upgraded to the patched 2.50 FW.. it worked fine after the scope finished bootingup..

3) The initial upgrade wiped out any existing .lnk file, it went back to the stock empty .lnk file, which is why my options disappeared..

4) So I re-copied my .lnk file over to \Secure\Startup, (renamed the orignal empty one to some garbage name to basically get rid of it, or you can just delete it), and all options are back.

So as far as I can tell, there was nothing done to the Telnet session???  at least nothing different occured for me?


If anyone wants, I can post the CAB file patched for 2.50?  you'll still have to fix your .lnk file to enable options again... but telnet works fine as usual...

So PCB GUY, only thing you need to do is buy a homebrew LAN card, guys on here can sell them privately if any still have the parts, or you can make one yourself, I posted the OshPark links for one I did back in this thread, that's the board I use now.. has LAN, USB, and JTAG all on the card..
You are awesome! I'm currently in the process of drawing up my own LAN card in Altium. Is that all it is, just a couple of connectors and a few passives? I don't remember stumbling across your design, though I'm sure I must have at some point (I've been through most of this thread already). I don't know if I'll bother adding all three right away though, depending on the complexity. I'll be getting 10 bare boards for less than $20 delivered from my PCB house, so all I'll need to do is stuff the components.

Best,
Matt

A patched CAB file would be awesome, as it would certainly save a lot of hassle.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Xavier64 on April 07, 2019, 06:07:50 am
@PhillyFlyers

very good news. Thanks a lot.

Please be so kind an post the patched .cab file

I would like to install it on my scope too.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on April 07, 2019, 12:54:29 pm
Could someone confirm the following steps please?

_________________________________________________________________________

1. On PC, create a file called "infiniivision.lnk" with the following contents (do not include quotes):

   "211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW20 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

2. Copy "infiniivision.lnk" and "patched_nk.bin.comp" files to an empty flash drive formatted as FAT16

3. On the scope, telnet into Port 23 (user: infiniivision, pw: skywalker1977)
4. Plug in the USB drive containing the "patched_nk.bin.comp" and "infiniivision.lnk" files
5. Run following commands between < > brackets (do not include brackets):

   <processmgr kill infiniivisionlauncher.exe>
   <\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp>
   <\secure\startup\infiniivision.lnk>

   (third command just checks that file was properly copied)

   <exit>

6. Reboot scope

_________________________________________________________________________

One more question, how exactly do I find the IP address of the scope so that I can telnet into it?

Thanks,
Matt
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on April 07, 2019, 01:21:12 pm
So, if you want to use the 'patched' FW image I posted, you don't have to do any of the above steps except for #1 & #2 (and BTW your lnk contents look good)...and for step 2 ONLY need to copy the .lnk' file you don't need to do anything with the 'nk.bin.comp', as that is part of the patched 2.50 FW image...

 but of course you still need to Telnet in.
I have seen two different ways of doing this - one is simply running the OS from the flash drive, which I am not terribly interested in doing because I would like to be able to use a flash drive to capture screenshots. The other is a permanent change that does not require the USB drive to be plugged in for operation. Is this method the former or the latter?

Quote
The IP Address of the scope you set yourself, it's in the "I/O" submenu, I think you click "utility" first, then go there, I can't remember exactly, I always just push buttons until I get there :)


Anyhow, you pick your IP address, gateway, & mask yourself.  I always just LAN cable up my scope right to my laptop, but them both on some fake network segment you make up, obviously both at different IPs, but on the same net..

ie for mike like:

1) scope:  192.168.5.10
2) laptop:  192.168.5.1
3) mask:255.255.255.0

or something along those lines!
Perfect, that clears that up!

Quote
BTW, since you are a hardware guy, you should check out the mods on here to push your BW up to 500Mhz, just requires you taking apart the scope, breaking the warranty of course and replacing some surface mount components, it's honestly not bad if you have decent soldering tools?

I did it to mine as was not painful at all..
I considered it but I'm always hesitant to modify the hardware of such an expensive piece of equipment. Maybe someday, but probably not right away. 200MHz bw will most likely meet all of my needs for the near future.

Quote
Also, once you get a homebrew LAN board in, it will give you a nag message that pops up about a LAN board malfunction or whatever it says, but that's just because our board doesn't have the VGA chip on it that the real board has, but doesn't matter, all we need is ethernet..

And also, your other prior question, YeS, all that LAN board really needs is the ethernet connector and a few passives, all the other crap I added was just as a bonus, but not necessary at all.  And you have to open up your scope anyhow to connect up any JTAG or USB boot stuff.. so LAN is really all you need.
I can put up with a recurring warning. I'd love to add VGA sometime though. I'll save that for a future rev!

Quote
Also, I love Altium, its a bad-ass tool, I'm slowly doing training to try and switch over to it, as I've been using nothing but eagle the last 10+ years.  So i'm sooo used to it, but Altium has so much more power.
My first few PCB designs were done in Eagle and I loved the tool, but once I started using Altium it was hard to look back. Altium has all sorts of functions and features that speed up the design process and significantly improve throughput and efficiency. There are definitely more bugs in Altium than in Eagle, but regardless it is still a great tool. I would highly recommend it to anyone who can afford a license. I am fortunate enough to have a license through my job.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on April 07, 2019, 01:38:05 pm
Once again I apologize for the double-post, but I just wanted to attach my LAN module design for review. It would be great to have another set of eyes on the schematic to make sure all of the connections are correct.

The full design will be on GitHub once completed.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on April 07, 2019, 02:09:14 pm
Here ya guys go..

Patched 3000X 2.50 Firmware with 'options' and 'nag' patch already applied..

https://mega.nz/#!eqg0yYJK!l73FwnABwNBNsl_l_2fAC8Md8PCVEEBgZ-u0T1eNZ08

It works on my 2002A, thank you very much!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: odessa on April 08, 2019, 08:33:42 am
Edited:

Could I use the above on my 2012A ? and would I need to still telnet in ?

Jay

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on April 08, 2019, 08:57:48 pm
Quote
I have seen two different ways of doing this - one is simply running the OS from the flash drive, which I am not terribly interested in doing because I would like to be able to use a flash drive to capture screenshots. The other is a permanent change that does not require the USB drive to be plugged in for operation. Is this method the former or the latter?


The latter method is what you want, installing the OS just like a real one, booting it from a UsB stick would just be annoying, might as well install it permanent like it's supposed to be... basically you are installing the OS just like the real one, except the one file has a few bytes patches to skip those certain things :)

So just install that update file I posted via USB drive (format it to FAT32)... you just browse to the USB drive via the I/O menu, and select the file and run it...

once it reboots you should be able to telnet in a drop your lnk file, and then reboot,and all should be there...

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on April 08, 2019, 09:22:00 pm
So just install that update file I posted via USB drive (format it to FAT32)... you just browse to the USB drive via the I/O menu, and select the file and run it...

once it reboots you should be able to telnet in a drop your lnk file, and then reboot,and all should be there...
Brilliant, that's way easier than I thought it was going to be. So to be clear:

1. COn PC, create file called "infiniivision.lnk" with the following contents (do not include quotes):

   "211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW20 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

2. Copy the update file and the .lnk file to a flash drive formatted as FAT32.
3. Make sure LAN card is installed in the scope. Turn on the scope and enter the Utility menu. Go into the I/O settings and configure the scope's IP address.
4. Plug in the flash drive. Navigate to the USB drive from within the I/O menu.
5. Run the update file saved on the flash drive.
6. Allow the scope to reboot. When finished, connect a cable between the PC and the LAN module.
7. Telnet into Port 23 using the IP address configured in Step #3. Log in with the username infiniivision and the password skywalker1977.

Is this correct so far?

Finally, having absolutely zero experience with telnet, what command do I use to copy over the .lnk file from the flash drive into the \secure\startup\ folder on the scope? is it simply:

copy \usb\infiniivision.lnk \secure\startup\

?

Thanks again for your help (and your patience with a noob).

Best,
Matt
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Joee on April 09, 2019, 11:53:53 am

Firmware 2.43


@Xavier64
Thank you very much

I couldt install the old firmware without any problems.
Telnet is working again like before I updated to 2.50.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on April 09, 2019, 02:01:15 pm
My homebrew LAN PCB is on order from China, along with the components. Should be here in about a week. My scope arrived yesterday and seems to work great. Once I receive the board I'll be able to try the hack. I'm still not sure how to copy files from the flash drive to the scope's startup folder though.

Thanks,
Matt
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: odessa on April 09, 2019, 02:31:13 pm
There's a list of the Telnet instructions here

https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/ren

I think what you posted looks correct, but I would try and rename the old one first by navigating to the secure folder then renaming it using the rename command.

I've ordered the stuff for the DIY LAN too. I have hacked my scope but want to get rid of the nag messages.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on April 09, 2019, 02:39:15 pm
There's a list of the Telnet instructions here

https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/ren

I think what you posted looks correct, but I would try and rename the old one first by navigating to the secure folder then renaming it using the rename command.

I've ordered the stuff for the DIY LAN too. I have hacked my scope but want to get rid of the nag messages.
That's very helpful. The syntax looks familiar, I've used something very similar. So if I'm not mistaken, the commands I want to execute are:

ren \secure\startup\infiniivision.lnk \secure\startup\infiniivision.lnk.bak
copy \usb\infiniivision.lnk \secure\startup\


Does that look about right?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: odessa on April 09, 2019, 03:12:40 pm


Yes looks ok to me, I would rename to:

ren \secure\startup\infiniivision.lnk \secure\startup\infiniivision.bak   ... probably makes no difference but just in case having 2 file extensions causes problems :)

I'm sure someone will correct it if its wrong.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlan on April 09, 2019, 06:37:37 pm
You can just add a new start.lnk file (any name you want) next to the empty official infiniiVision.lnk file.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on April 09, 2019, 06:40:26 pm
You can just add a new start.lnk file (any name you want) next to the empty official infiniiVision.lnk file.
I already have the DSOX3APPBNDL installed, so I'm not sure my official infiniivision.lnk file is empty....

Don't know if that makes any difference whatsoever.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on April 10, 2019, 01:10:50 am
I got the re-built CAB file to work

Hi Mike,
Its very good news

just allow me for two suggestions

- May be flush modified nk.bin.comp in one area only (not in backup) as it more robust solution I think. But in this case backup area should be flushed first with non modified nk.bin.comp. Or user should flush original FW first.

- It is possible make CAB with lnk installer commands in script like in "old usb installer" (new lnk should be in USB root) - then all hack can make without LAN.

But of course this can be left in different "installer".

Code: [Select]
<command>\windows\cmd.exe /c copy \usb\infiniivision.lnk \Secure\Startup\infiniivision_ext.lnk</command>
-<onFailure>
<filePath>\usb\errorLog.txt</filePath>
<message>lnk copy from USB failed.</message>
<!-- do not continue, without new valid link file -->
<action>reboot</action>
</onFailure>
</installStep>
<!-- Move away a perhaps existing factory link -->
-<installStep>
<command>\windows\cmd.exe /c ren \Secure\Startup\infiniivision.lnk infiniivision.lnk.original</command>
-<onFailure>
<filePath>\usb\errorLog.txt</filePath>
<message>No factory lnk to move away.</message>
<action>continue</action>
</onFailure>
</installStep>
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gaminn on April 11, 2019, 03:17:30 pm
Hi,
I have MSOX2024A with 02.43.2018020635 firmware.

1) I downloaded patched 2.43 file: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1453247/#msg1453247 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1453247/#msg1453247) on my flash drive.
2) I created infiniivision.lnk file that contains: 69#infiniivisionLauncher.exe -l MSO -l BW20 -l DIS --perf --forcemaxmem
3) I telnet my scope via LAN.
4) I run ProcessMgr.exe kill infiniivisionLauncher.exe
5) I run \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
 - it writes and verifies the file
6) I renamed /secure/startup/infiniivision.lnk to xxx.xxx
7) I copied my .lnk file: cd \usb          copy infiniivision.lnk \secure\startup\
8) I verify that \secure\startup contains xxx.xxx and my new infiniivision.lnk file.
9) I reboot. It displays " System concerns detected: OS version is not correct. Please reload system firmware." and no new options are installed. I can use my scope.

How can I upgrade my scope?

I can temporarily enable options by:
ProcessMgr.exe kill infiniivisionLauncher.exe
\Secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l BW20 -l DIS --perf --forcemaxmem

If it is not possible to upgrade my scope how can I restore the changes I made? I deleted my inifiinivision.lnk and renamed xxx.xxx to infiniivision.lnk but still "System concerns detected:..." is displayed.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Xavier64 on April 11, 2019, 03:46:05 pm
For all Keysight 3000A uses who have the startupmessage:

Firmware OS error detected



this infiniivision.lnk is the solution:


119#\Windows\cmd.exe /c infiniivisionlauncher.exe -l ALL -l BW50 -l SCPIPS -l SGMC -l CABLE -l PERF -l TOM -l CABLE --perf




I assume you followed this steps



0) Install correct Firmware version first (i.e. in this case 2.43)
1) Download Safar's patched_nk_bin.comp file and copy to a USB stick and plug in.
2) Telnet into the scope.
3) Login infiniivision / skywalker1977
4) processmgr kill infiniivisionlauncher.exe
5) \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
6) Create a file on the USB stick called infiniivision.lnk with contents (e.g.) "88#infiniivisionLauncher.exe -l MSO -l BW20 -l DIS -l PLUS -l SCPIPS -l VID -l CABLE --perf"
7a) delete (or rename) any other lnk in \secure\startup folder. Should be only one file with lnk extension here.
7b) copy \usb\infiniivision.lnk to \secure\startup
8 ) reboot and good to go



I did it with Firmware 2.43


LAN module is working fine and NO red warning appears.

Thanks to all who made this possible.


Quote from: Xavier64 on April 05, 2019, 07:51:03 pm

    Firmware 2.43

    https://mega.nz/#!lSJwDAzK!YQSZ0AnbJ7rloFFBDppx7iaGKqcftTBsGBUjhnez_bk


    and the patched nk.bin for 2.43

    https://mega.nz/#!1GIAlaqY!AbS8cnGSqtntFIgGVGeTM3YNNWoBcHaEUNvuj80B7kg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gaminn on April 11, 2019, 04:55:17 pm
For all Keysight 3000A uses who have the startupmessage:

Is there any solution for Keysight 2000A users?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: odessa on April 11, 2019, 05:23:55 pm
In the last 3 pages of this thread there are versions 2.43 and 2.5 with the nag patch applied already. I've run both these on my 2102A and my 2004A and both worked without a problem. Just waiting for my LAN pcb's to telnet in and fix the nag issue.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gaminn on April 11, 2019, 05:24:19 pm
OK, I tried to revert all back. I loaded original nk.bin.comp from 2000XSeries.02.43.2018020635.ksx archive to USB. Using telnet and usb drive I loaded it in the scope:

\windows\loadP500Flash -u ceImage1 \usb\nk.bin.comp

I restored original /secure/startup/infiniivision.lnk

Stil "....OS version is not correct...."

Please advise how to restore it, it is quite a problem for me.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gaminn on April 11, 2019, 05:34:20 pm
It seems I partially bricked my scope. I'm unable to upgrade firmware to 2000XSeries.02.50.2019022736.ksx. I always get: "Error: The file did not load correctly"... :/

EDIT: It is weird, but another USB flash drive solved this issue. I upgraded my scope to 2.50.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: odessa on April 11, 2019, 05:49:11 pm
Did you get rid of the nag message ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gaminn on April 11, 2019, 05:55:00 pm
Yes. The scope is in its original state. Keysight's 2.50 original firmware loaded.

I still would like to try enable all options for my scope. Can someone please help me with that and write exact steps needed to upgrade the scope? What files do I have to load to usb flash drive? My scope is MSOX2024A.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gaminn on April 11, 2019, 06:50:24 pm
It was 50 : 50 to connect to my scope during startup via telnet (2.50 firmware) using telnet_dsox.py. Also it didn't automatically launch the scope with all options enabled.  I modified the file a little, this version is able to connect everytime. Just launch it and then turn on the scope.

pip install pyping is required
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on April 17, 2019, 12:52:39 am
Hi all,

I received my LAN boards in the mail today so I went ahead and built one up and plugged it in. I updated my scope to the patched v2.50 firmware that PhillyFlyers provided and that seemed to work just fine. I then went into the scope's I/O menu and got the IP address (I left it as auto-config, I hope that's ok) and took note of the given IP. I then connected my laptop to the LAN card via an ethernet cable and used PuTTY to telnet into the scope. I was able to log in. However, I then tried to run the following command:

ren \secure\startup\infiniivision.lnk \secure\startup\infiniivision.bak

This returned an error:

REN: Cannot form path from \secure\startup\infiniivision.bak. Name too long or malformed.

Suspecting it couldn't find the directory I simply typed "dir" and sure enough, "\secure" was not in there.


    Directory of \

01/01/98  12:00p    <DIR>                    Network
01/01/98  12:00p    <DIR>                    usb
04/16/19  08:33a    <DIR>                    Application Data
04/16/19  08:33a    <DIR>                    profiles
04/16/19  08:33a    <DIR>                    Documents and Settings
04/16/19  08:33a                          23 Control Panel.lnk
04/16/19  08:33a    <DIR>                    My Documents
04/16/19  08:33a    <DIR>                    Program Files
04/16/19  08:33a    <DIR>                    Temp
04/16/19  08:33a    <DIR>                    Windows

    Found 10 file(s). Total size 23 bytes.
    1 Dir(s) 24293376 bytes free


Where is the "\secure" directory, exactly?

Thank you,
Matt
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on April 17, 2019, 10:09:07 am
Hi all,

I received my LAN boards in the mail today so I went ahead and built one up and plugged it in. I updated my scope to the patched v2.50 firmware that PhillyFlyers provided and that seemed to work just fine. I then went into the scope's I/O menu and got the IP address (I left it as auto-config, I hope that's ok) and took note of the given IP. I then connected my laptop to the LAN card via an ethernet cable and used PuTTY to telnet into the scope. I was able to log in. However, I then tried to run the following command:

ren \secure\startup\infiniivision.lnk \secure\startup\infiniivision.bak

This returned an error:

REN: Cannot form path from \secure\startup\infiniivision.bak. Name too long or malformed.

Suspecting it couldn't find the directory I simply typed "dir" and sure enough, "\secure" was not in there.


    Directory of \

01/01/98  12:00p    <DIR>                    Network
01/01/98  12:00p    <DIR>                    usb
04/16/19  08:33a    <DIR>                    Application Data
04/16/19  08:33a    <DIR>                    profiles
04/16/19  08:33a    <DIR>                    Documents and Settings
04/16/19  08:33a                          23 Control Panel.lnk
04/16/19  08:33a    <DIR>                    My Documents
04/16/19  08:33a    <DIR>                    Program Files
04/16/19  08:33a    <DIR>                    Temp
04/16/19  08:33a    <DIR>                    Windows

    Found 10 file(s). Total size 23 bytes.
    1 Dir(s) 24293376 bytes free


Where is the "\secure" directory, exactly?

Thank you,
Matt

I believe that folder is hidden, so it won't show in a 'dir' listing..

sorry we all missed noticing the lower-case spelling in your questions before... the folder is:

"\Secure"
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on April 17, 2019, 10:40:08 pm
Did I miss something? I renamed the old .lnk file to .bak and copied the new .lnk file to the correct file, and got confirmation that it copied properly. I then rebooted my scope and immediately went into Utility -> Service -> About Oscilloscope. Unfortunately I am missing quite a few options, most notably the MSO option which is really the one I'm looking for:


I previously just had the DSOX3APPBNDL which had the following:


As you can see, I definitely have some new options installed but I'm still missing some others. What happened to the MSO option? My scope is a DSO but has the connections for the digital leads, so I assumed it was supported.

Thoughts?

Otherwise, all seems to be well!

UPDATE
I guess my .lnk file wasn't written properly or something, because it did not seem to apply the way it was supposed to. Instead I used PhillyFlyers' .lnk file contents and I am fully upgraded! Thanks a lot everyone!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on April 18, 2019, 08:51:38 am
A question:

What does SCPIPS (Infiniium Mode) do?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: odessa on April 18, 2019, 10:59:14 am
Ok,

This is interesting ... just updated my 2012A with Phillyflyers 2.5 firmware with patched comp file. Then added this lnk file to the old USB 2.41 lnk install hack  ( On page 62, posted by Luminax )

Code: [Select]
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID
The scope is now fully unlocked and I have no red nag messages, this was done without telnet.

(https://i.imgur.com/M9A8oph.jpg)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on April 18, 2019, 11:01:56 am
A question:

What does SCPIPS (Infiniium Mode) do?
I presume it has something to do with SCPI (Standard Commands for Programmable Instruments).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: scribble on April 23, 2019, 12:21:55 am
Ok,

This is interesting ... just updated my 2012A with Phillyflyers 2.5 firmware with patched comp file. Then added this lnk file to the old USB 2.41 lnk install hack  ( On page 62, posted by Luminax )

Code: [Select]
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID
The scope is now fully unlocked and I have no red nag messages, this was done without telnet.


I have the exact same scope and also want to upgrade but it's very confusing as to which posters instructions to use... :-\
Can you tell me which official firmware you had installed before starting the upgrade and which firmware you used to do the unlock as I can only see a v2.5 for the 3000 series on the previous page?
What sequence did you follow?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: odessa on April 23, 2019, 07:24:45 am
Hi,
The 2000 and 3000 are the same firmware. I used the 2.5 firmware posted by phillyflyers to upgrade to 2.5.

Then I created the lnk file using the code I posted and replaced the one in the hack posted by Luminax.

After the scope rebooted I ran the install.cab in Luminax's hack and that's it.

I also unlocked my 2004A using the above and it works perfectly, no nag messages, fully unlocked.

Edit: To answer your question about which firmware I started with, I used official 2.41 but I've flashed modded 2.43 and modded 2.5 whilst trying different things. The scope accepted them all without a problem.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: scribble on April 24, 2019, 02:01:16 am
Thank You!
Worked perfectly :-+

For others wanting to do this, the Scopes for Dummies version as follows:

Download Phillyflier's patched firmware from post #2167 on page 87
Download Luminax's license patch from post #1529 on page 62
Extract license patch, open cmd window (if using MS Windows), navigate to license patch folder and rename infiniivision.lnk to .txt
Edit infiniivision.txt and replace text in the file with Odessa's modification from post#2197 on page 88
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID
Save and rename file back to .lnk
Copy firmware file (rename from .ksx to .cab if current scope fireware is older than v2.41) to FAT32 formatted USB drive
Copy licence files (2x .cab files and .lnk file) to same USB drive

Now go to your scope, turn on and plug in USB drive to front USB port
Press [Utility] > File Explorer, select the firmware file (3000XSeries.02.50.2019022736_patched.cab); then, press Load File, wait for scope to load and reboot.
Check firmware has updated to v2.5, if successful continue
Press [Utility] > File Explorer, select v241_link_install.cab file; then, press Load File, wait for scope to load and reboot.
Check licenses have all been added and if so... :clap: :phew:

Thank you to all those that made this possible  8)
 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: news9801 on May 08, 2019, 03:59:24 am
The 3000 series cannot be used in this way.

 :palm:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on May 08, 2019, 01:34:11 pm
The 3000 series cannot be used in this way.

 :palm:

Cannot be used in what way? I have a 3024 and I was able to update to the hacked firmware and install the other licenses.
Title: DSOX4000 almost dead - flash corruption?
Post by: Pinkus on May 10, 2019, 12:42:59 pm
My DSOX4000 is causing more and more problems. It often took several (up to 10x) power-ups until it booted up. Usually the LEDs only flashed briefly 1x or 2x. I already mentioned it a few months ago here or in another thread. Looks like the well known flash corruption of many Keysight products.

Unfortunately it now almost doesn't start anymore. Sometimes I need to switch on/off 100x to get it running and often even this does not work :scared:
When it is finally running, it can run for days without any problems - just booting is a problem.

Today it luckily started again and I quickly installed the latest firmware (7.20.2017102615) over the existing one hoping, that the flash memory would be rewritten and OK again - but unfortunately it didn't work out. I had the feeling that the firmware installation tried it 2 or 3 times and then the scope was dead. I was scared it would be now dead forever. I tried it 100x yesterday without any luck ... fortunately it booted today after a few tries - it came up with the new firmware, i.e. it was installed.  :phew:

The question now is, can I do anything myself (read data, rewrite Flash, etc.) or shall I just send it to the Keysight service praying that they know about the service note for a free repair of a damaged flash?
Does anybody know the exact service note # for the 4000 series?
It might help to point it out to them.

Maybe someone has a hint for me?

Thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on May 10, 2019, 01:25:11 pm
Try the Keysight route first, as they will replace the full PCB as part of the service note
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on May 10, 2019, 02:43:37 pm
Try the Keysight route first, as they will replace the full PCB as part of the service note
I should note, this scope is from 2013. I am just afraid they will deny any Nand flash problem and sending me a $3000 quote.
Scope lights up very shortly some LEDs (not all) after pressing the power switch and thats it. I stays completely dark (no LEDs, no re-boot etc.), power supply and fan are working.
If these LEDs are indicating anything and if somebody has more details, I can send post list which LEDs are lit for 0.1 seconds after switching the unit on.

At the weekend I will try to record the output of the serial interface to see where it stops. I know, I should have done this before, but there is always some work getting in the way and/or I am just to lazy. But now, the scope is dead I will have to bite.....
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on May 10, 2019, 04:05:28 pm
I've never seen a nand corruption fault like that, post the boot log and we'll hopefully know for sure.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on May 10, 2019, 05:18:19 pm
What is the firmware version?  I don't think it matters how old the scope is.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: news9801 on May 13, 2019, 04:02:29 am
The 3000 series cannot be used in this way.

 :palm:

Cannot be used in what way? I have a 3024 and I was able to update to the hacked firmware and install the other licenses.

Do you have to use LAN CARD and use Telnet to crack the version you said?

The current method of using #2201 cannot be successfully cracked.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on May 14, 2019, 11:54:01 pm
Do you have to use LAN CARD and use Telnet to crack the version you said?

The current method of using #2201 cannot be successfully cracked.

Oh, I'm not sure about the procedure in post #2201. I used the USB + telnet method and it worked just fine.

What's wrong with the all-USB method? I haven't tried that one.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: januszb on May 15, 2019, 10:51:22 am
news9801:
Note that the post refers to the 2000/3000A series of scopes and not the 3000T scopes which have different firmware and a different procedure.

It would be interesting and more helpful if you indicate exactly what happens rather than simply that it does not work - the procedure is fairly tried and tested now.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on May 19, 2019, 04:21:35 pm
I've never seen a nand corruption fault like that, post the boot log and we'll hopefully know for sure.
So finally I took the time and disassembled my (99,9% of the time) non starting DSOX4024a and recorded the boot log:
Code: [Select]
U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 256 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-10-29   8:22:14 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37935 Bytes = 37 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
RTC: 2019-5-19   17:56:28.13 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Oct 29 2015 01:39:04
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

image2 value is out of range 0 so it will be ignored.
  It must be a hexadecimal integer between 0xd00000000 and 0xd7ffffff or between 0x800000000 and 0x87ffffff.

System ready!
Preparing for download...
RTC: 2019-5-19   17:56:28.18 UTC
 Loading image 1 from memory at 0xD0400000

-->>> [Note: here it stops booting, no LEDs are lighting]  <<<--
Of course I hoped my scope would start today that I have a comparison, but I had no luck. I tried it 100 times....

So anybody who can read this boot log and give an advise?
As noted before: the scope is running the latest unhacked firmware 7.20.2017102615  and I also tried a re-installation of the firmware.

Thanks in advance for any help/advise

Edit: In case this helps. I stopped the bootloader and got this from the P500 after stopping the boot loader:
Code: [Select]
Press space to stop autoboot: 

p500> imls
Legacy Image at F8000000:
   Image Name:   XLOADER
   Created:      2010-09-24  21:30:18 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    5370 Bytes = 5.2 KiB
   Load Address: d2800b00
   Entry Point:  d2800b00
   Verifying Checksum ... OK
Legacy Image at F8010000:
   Image Name:   UBOOT
   Created:      2017-05-18   3:33:11 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    195988 Bytes = 191.4 KiB
   Load Address: 03f00000
   Entry Point:  03f00000
   Verifying Checksum ... OK
Legacy Image at F8050000:
   Image Name:   PBOOT
   Created:      2015-10-29   8:22:14 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37935 Bytes = 37 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on May 19, 2019, 06:48:36 pm
So finally I took the time and disassembled my (99,9% of the time) non starting DSOX4024a and recorded the boot log....

I know absolutely nothing about the firmware/software on these scopes, but the line saying the serial number is not set seems wrong. I wonder if somehow your serial number got wiped and that prevents it from booting most of the time?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on May 19, 2019, 07:59:34 pm
The no serial message is normal. However if I had to guess I'd say the issue is not NAND corruption. Most of the time an image can be read and part way through fails with a checksum message. Your issue seems more like it can't read the flash at all. I've also never seen one that can boot once in a while, every corrupted scope I've seen never boots, no matter the number of attempts(although I assume it could happen).
Lastly any corrupted scope I have seen when a recovery and update with current firmware is performed it fixes the issue 100%.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on May 19, 2019, 09:50:49 pm
Not exactly what I wanted to hear.....
Now, I do not know how I got there (just trying to stop uboot with 'space' as before), another screen came up
Code: [Select]
U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 256 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-10-29   8:22:14 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37935 Bytes = 37 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
RTC: 2019-5-19   22:59:58.49 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Oct 29 2015 01:39:04
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

image2 value is out of range 0 so it will be ignored.
  It must be a hexadecimal integer between 0xd00000000 and 0xd7ffffff or between 0x800000000 and 0x87ffffff.


P500 Boot Loader Configuration :

Mac address .......... (00:30:D3:20:29:C0)
Ip address ........... (192.168.1.164)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0400000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
[b]>System ready![/b]
Preparing for download...
RTC: 2019-5-19   23:0:52.60 UTC
 All images failed

Press r to reset
 
After the system ready I sent a '3' just getting the message 'all images failed'.
Maybe I should have used option "d".
Anybody with experience/advise on this?

Obviously these questions now came on my mind:
Can I write an image/file to the flash with the P500? This should help if it is just corrupted.
Or maybe the flash is somehow damaged. Thus:is this flash an external single memory chip or is it embedded?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on May 19, 2019, 10:06:02 pm
So @kilobyte mentioned problems with Telnet in v2.50 here:

A portscan and testing the other ports showed no other telnet port except the SCPI Telnet port.

With V2.50 the Telnet port is only available for a short time before the infiniiVisionLauncher kills the service and starts the scope app.
But it is possible to kill the launcher if the login and process kill command is handled by a python script running directly after the network connection has been established. (ping /t)

using the launcher from here still allows to start the App with different Options
\Secure\infiniiVision\infiniiVisionLauncher.exe

But I don't see anyone else mentioning a problem with Telnet access, and @PhillyFlyers explicitly says that it is working fine (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2325420/#msg2325420).

Is the issue with Telnet access in v2.50 firmware still a question?  Or enough people have used v2.50 with Telnet and say its all good?  Hope we can clear that up! :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on May 20, 2019, 03:52:18 am

Obviously these questions now came on my mind:
Can I write an image/file to the flash with the P500? This should help if it is just corrupted.
Or maybe the flash is somehow damaged. Thus:is this flash an external single memory chip or is it embedded?

The firmware can be reflashed via network - as far as I know anyway, I've only done it on 2000a/3000a models. However firmware alone will not restore your scope. The nand also contains the serial #, cal data and license data - vital machine unique info you require. My gut still tells me it is a hardware issue and not nand corruption.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on May 20, 2019, 07:25:32 am
Maybe I should have used option "d".
Anybody with experience/advise on this?

I played with that, see https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022248/#msg1022248 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022248/#msg1022248)

The software: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022267/#msg1022267 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022267/#msg1022267)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on May 20, 2019, 11:04:05 am
Thanks for your informations. I can now give you some more input. After many many tries (at least 200-300 tries) my DSOX4024a started up correctly,  giving me this UART ouput:
Code: [Select]
U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 256 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-10-29   8:22:14 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37935 Bytes = 37 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
RTC: 2019-5-20   12:38:24.19 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Oct 29 2015 01:39:04
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

image2 value is out of range 0 so it will be ignored.
  It must be a hexadecimal integer between 0xd00000000 and 0xd7ffffff or between 0x800000000 and 0x87ffffff.

System ready!
Preparing for download...
RTC: 2019-5-20   12:38:24.24 UTC
 Loading image 1 from memory at 0xD0400000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXXOOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOXXOOXXXOOOXOOOXOXOXOOXXOOOOXOXOOOOOXOOOXOOOXXXXXXXXOXOXOXXOXOXXXXXXXX
XOOOXOOOXOOXOOOOXOOOOXXOXOOOOOOOXOOOXOXOOOOOXXOOOOOXOOXOOXOOOOOOOOOOXOXOOXOOOOOOOXXOOOOOXXOOOOOOOXOXOXXOOXOXOOOXOOOOXOOXXXXOXOOOXOXXXOXOXOXXXXXXXOOXXXOOOXOXXXXXOXXXXXXXXOXXXXOXOXOXXXXOOOXXXOX
XXXXXOOOXOOOXXOXOOOXOXXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXXOXOOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXXXXXXXXXXXXXXXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x53CEC54, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x53CEC54  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2019-5-20   12:38:33.84 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Oct 26 2017)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:20:29:C0
Phy found addr 31 (ticks=3979)
WaitForLink Start (ticks=3981)
No Link (ticks=4984)
<--EDeviceInitialize

GMAC DMA status register = 0x0
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
SHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]
SHIM [AgilentPalWin32.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
AgilentLxiWebStartUp successfully started LXI web service.
Device load time:
   NANDFLASH: 0 ms
   SNANDFLASH: 0 ms
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
System has been running 24.332512 seconds
Performing Startup
Initializing FPGA at base address 0x850000 or 8716288
****
FPGA Type: Oregon
Ver: 2.055 Released
Build Time: Mon Jul 31 17:34:24 2017
Build Machine: 12345678 (removed, might include show serial number)
****
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
Exception 'Raised Exception' (-1): Thread-Id=04ac005e(pth=8992e2ec), Proc-Id=04640066(pprc=898b6000) 'infiniivisionLauncher.exe', VM-active=04640066(pprc=898b6000) 'infiniivisionLauncher.exe'
PC=40068ae0(coredll.dll+0x00058ae0) RA=803782c8(kernel.dll+0x000062c8) SP=0002cb34, BVA=0002cb98
Keyboard firmware version 35... ok
Keyboard Info: Board id 0, Board rev 2
Cal Date Sat Jan 12 00:47:44 2013
Startup sequence is complete.
No registry path: Drivers\USB\FunctionDrivers\USB488, no workaround
no workaround for USB phy
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
Building initial GUI layout...complete.
System has been running 38.022915 seconds
Start Up Sequence 13.690000
Memory Load 58%
   System Physical Memory 66.188 / 115.957 MB
   Process Virtual Memory 71.250 / 1024.000 MB
-----> InfiniiVision is running <-----

There is still the message "image2 value is out of range 0 so it will be ignored." at the beginning. I assume, this is not normal.
It really looks like the flash is not OK.
The question is, would this fall under Keysights service note for non booting DSOX2000/3000/4000/6000 scopes?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: goldsun on May 29, 2019, 01:11:33 pm
mark,thinks ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on May 29, 2019, 03:03:33 pm
So @kilobyte mentioned problems with Telnet in v2.50 here:

A portscan and testing the other ports showed no other telnet port except the SCPI Telnet port.

With V2.50 the Telnet port is only available for a short time before the infiniiVisionLauncher kills the service and starts the scope app.
But it is possible to kill the launcher if the login and process kill command is handled by a python script running directly after the network connection has been established. (ping /t)

using the launcher from here still allows to start the App with different Options
\Secure\infiniiVision\infiniiVisionLauncher.exe

But I don't see anyone else mentioning a problem with Telnet access, and @PhillyFlyers explicitly says that it is working fine (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2325420/#msg2325420).

Is the issue with Telnet access in v2.50 firmware still a question?  Or enough people have used v2.50 with Telnet and say its all good?  Hope we can clear that up! :)

Following up: I did the update to v2.50 and Telnet worked perfectly --- no difference than previous firmware.  It seems @kilobyte is the only one who had a problem.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on May 29, 2019, 07:59:41 pm
Today I did the update from 2.43 to v2.50 on my own DSOX-3024A.
But before that I did a port scan with the old 2.43 and after the update with the 2.50
This is the second scope where the telnet port isn't available after the infiniivision launcher has starter.
But telnet is still available for a short time.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on May 30, 2019, 03:35:56 am
Today I did the update from 2.43 to v2.50 on my own DSOX-3024A.
But before that I did a port scan with the old 2.43 and after the update with the 2.50
This is the second scope where the telnet port isn't available after the infiniivision launcher has starter.
But telnet is still available for a short time.

Interesting kilobyte, and thanks for the screenshot result.  When you say "...telnet is still available for a short time...." what do you mean by "short time"?  Is that 1 sec, 1 min or 10 min after the scope has started?

I try the telnet login within 1 min or so of when it boots -- no problems for me.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on May 30, 2019, 07:18:02 am
New firmware was released for the 3000T and 4000A series.

Version 7.30.2019051434

New Features:
This software revision includes the following new capabilities:
- Added support for the following new models:
o D3000AUTA, D3000GENA, D3000AERA, D3000PWRA, D3000NFCA, D3000BDLA

Enhancements
This software revision includes the following new enhancements:
- Added Digitizer Mode where you specify the sample rate and memory depth instead of
having them automatically be determined by the time/division setting.
- Frequency Response Analysis (FRA):
o The sweep frequency range is no longer limited to decade values – it can now be
set to any frequency within the WaveGen’s limits.
o The “points per decade” setting has been changed to “total points” for ease of use.
o Chart:
 Minor gridlines for the horizontal axis are now shown to improve readability
of the plot.
 The chart’s horizontal display range is now independent of the Start/Stop
Frequency setting in the Setup Menu.
- The full waveform data can now be exported while in Roll Mode.
- The :WAV subsystem now includes commands to download all segmented memory data in
one shot.
- Measurement Trend Math can now be applied on Digital channels.
- The “:MEASure:YATX” and “:MEASure:TEDGe” measurements, previously a SCPI-only
operation, are now accessible from the Measurement Menu.
- Added Slew Rate measurement.
- The Delay and count-based measurement can now be applied on Digital channels.

Bug Fixes:
This software revision includes the following Bug fixes:
- Corrected the NRZ serial decode from having an extra bit than the frame size when the
Start-Bit is 0.
- Corrected “:MEASure:DELay:DEFine” for not accepting a definition that includes the
“FALLing” edge parameter.
- Corrected the Reference Waveform data (.h5) from incorrectly saving data with twice the
delay where is a delay on the displayed waveform.
- Corrected ":MEAS:SHOW?" always returning "1" regardless of the actual state.
- Fixed various LIN LDF file-parsing bugs.
- Fixed various issues related to the N7026A probe.

Changes:
- As of version 7.30, the VNC server software for the remote front panel functionality is no
longer bundled with the scope software by default. Upgrading to 7.30 will not delete the
VNC server software from the scope, but new scopes will no longer ship with the VNC
server software installed. For scopes without the software installed, the Browser Web
Control page will provide a link for installing the software.


The key takeaway of the update for me is that they are now allowing manual sample rate/memory depth adjustment - will need to have a play with this to see what advantage it might offer.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on May 30, 2019, 12:43:19 pm
New firmware was released for the 3000T and 4000A series.

Version 7.30.2019051434

.....

Enhancements
This software revision includes the following new enhancements:
- Added Digitizer Mode where you specify the sample rate and memory depth instead of
having them automatically be determined by the time/division setting.
- Frequency Response Analysis (FRA):
o The sweep frequency range is no longer limited to decade values – it can now be
set to any frequency within the WaveGen’s limits.
o The “points per decade” setting has been changed to “total points” for ease of use.
o Chart:
 Minor gridlines for the horizontal axis are now shown to improve readability
of the plot.
 The chart’s horizontal display range is now independent of the Start/Stop
Frequency setting in the Setup Menu....

I'm intrigued about the part regarding the Frequency Response Analysis (FRA). Is it possible to add this feature to my DSOX3000 scope using existing hacks? I don't recall ever seeing this as an option in the past.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on May 30, 2019, 02:33:46 pm
Can't find explanation what are: D3000AUTA, D3000GENA, D3000AERA, D3000PWRA, D3000NFCA, D3000BDLA

Also I'm not sure if all is all right with my licenses after upgrade. It shows them all like this:

MSO   MSO   Yes   N/A   Expired

Meaning installed but status is expired.. What???
I don't remember well but I don't remember that before..

I don't know what new options are , but it is time to revisit old question to Keysight.
I bought scope with full bundle only 6 months ago. Will I be able to upgrade to new definition of full bundle, and how?


As for Digitizer mode, just took a quick peek, you can set maximum sampling rate an mem length. If you set it to max both, it seems to manage memory an sampling rate same as always, but it will show you mem length used.  I like that.
I was wrong. It will get samples exactly like you set. It will even stop you to set timebase to setting you can't get with digitizer settings.. Of course with 2ch sample rate am memory will halve. So it will with single/run

Regards,
Sinisa

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on May 30, 2019, 06:23:21 pm
I suspect (but don't know for sure) that the reason the license screen has changed is because in the future you'll see more options that are subscription based. This is not something I approve of, but seems to be the way forward for so many things.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on May 30, 2019, 10:38:04 pm
I suspect (but don't know for sure) that the reason the license screen has changed is because in the future you'll see more options that are subscription based. This is not something I approve of, but seems to be the way forward for so many things.

Unfortunately, that seems like a plausible theory.

And all those new options have A suffix end seem to be some kind of advanced version of existing options:

D3000AUTA   Automotive Software for 3000 X-Series
D3000GENA   Embedded Software for 3000 X-Series   
D3000AERA   Aerospace Software for 3000 X-Series   
D3000PWRA   Power Supply Test Software for 3000 X-Series
D3000NFCA   NFC Software for 3000 X-Series      
D3000BDLA   Ultimate Bundle Software for 3000 X-Series
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on May 31, 2019, 03:44:18 am
Installed the new v7.30 3000T firmware.
The regular about screen hasn't changed. The web interface information is where it indicates all of the licenses are expired(even though they aren't and they still function). I would say this is a bug.
I did test telnet for those who might need it, after the scope has booted it is *not* available. It is there for a brief period during the boot process but is then terminated(along with any connection you might have).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: arlvaljr on June 01, 2019, 07:39:50 pm
I also installed the v.7.30 on my 3000T yesterday and Telnet is not available anymore.:scared:
It seems ports 22 and 23 Telnet uses to connect, are now closed and any connection tentative is denied.
I could connect Telnet on port 5024 (SCPI Telnet Port) but this connection just gives a prompt and not accept any regular command.:horse:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on June 01, 2019, 09:10:26 pm
New options seem not to be new options but new bundles:

D3000AERA - DSOX3AERO, DSOX3VID, DSOX3MASK, DSOXT3FRA and DSOX3ADVMATH
D3000AUTA - DSOX3AUTO, DSOX3FLEX, DSOX3MASK, DSOXT3SENSOR, DSOXT3NRZ, DSOXT3CXP, DSOXT3FRA and DSOX3ADVMATH
D3000GENA - DSOX3EMBD, DSOX3COMP, DSOX3AUDIO, DSOX3VID, DSOX3MASK, DSOXT3UPD, DSOXT3FRA and DSOX3ADVMATH
D3000PWRA - DSOX3PWR, DSOXT3UPD, DSOX3MASK, DSOXT3FRA and DSOX3ADVMATH
D3000BDLA - Ultimate bundle (whatever that is)
D3000NFCA - NFC replacement

EDIT:
Also my scope is not responding to VNC anymore, only remote is one in Web browser

On a first boot after upgrade my scope didn't have VNC server active, so I couldn't connect with external RealVNC Viewer.  Today, it works, so I guess either i made some user error (not very likely, all other net comm with scope on same IP was working, internal web pages, SCPI, even built in HTML5 remote control), or maybe on a first boot it was still shuffling things around (it does say "Finishing installation") and VNC server didn't start for some reason.

But now after second reboot it works normally.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gslick on June 02, 2019, 12:55:52 am
Also my scope is not responding to VNC anymore, only remote is one in Web browser

According to the Release Notes if the firmware previously had VNC server functionality, it should still have the VNC server functionality after the firmware upgrade. But maybe you need to reinstall the VNC software anyway?

https://www.keysight.com/upload/cmc_upload/All/Keysight_3000T_X_Series_Oscilloscope_Release_Notes_07_30.pdf (https://www.keysight.com/upload/cmc_upload/All/Keysight_3000T_X_Series_Oscilloscope_Release_Notes_07_30.pdf)

Changes
- As of version 7.30, the VNC server software for the remote front panel functionality is no
longer bundled with the scope software by default. Upgrading to 7.30 will not delete the
VNC server software from the scope, but new scopes will no longer ship with the VNC
server software installed. For scopes without the software installed, the Browser Web
Control page will provide a link for installing the software.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on June 02, 2019, 09:40:38 am
Also my scope is not responding to VNC anymore, only remote is one in Web browser

According to the Release Notes if the firmware previously had VNC server functionality, it should still have the VNC server functionality after the firmware upgrade. But maybe you need to reinstall the VNC software anyway?

https://www.keysight.com/upload/cmc_upload/All/Keysight_3000T_X_Series_Oscilloscope_Release_Notes_07_30.pdf (https://www.keysight.com/upload/cmc_upload/All/Keysight_3000T_X_Series_Oscilloscope_Release_Notes_07_30.pdf)

Changes
- As of version 7.30, the VNC server software for the remote front panel functionality is no
longer bundled with the scope software by default. Upgrading to 7.30 will not delete the
VNC server software from the scope, but new scopes will no longer ship with the VNC
server software installed. For scopes without the software installed, the Browser Web
Control page will provide a link for installing the software.

I read release notes before upgrading. I saw that. But with previous firmware I was able to simply connect to the scope with RealVNC VNC viewer (that had performance than remote control from scope in browser) and after firmware update it didn't accept connections anymore.

UPDATE:  I just went to troubleshoot further (maybe they moved to another port or something) and now it DID CONNECT. I can connect with RealVNC like before. I guess maybe it didn't work on the first boot after update, or something was wrong with my net config (although that is not wera likely because I could browse internal pages and remote control it with internal HTML5 remote control).
I will update my previous post.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wutieru on June 03, 2019, 12:08:55 am
Hi,
where can I download the file  "patched_nk.bin.comp",version 2.50?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on June 03, 2019, 12:52:14 am
Totally off-topic, but any thoughts on when there might be a replacement to 4000X series?  ;D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on June 03, 2019, 12:58:06 am
Hi,
where can I download the file  "patched_nk.bin.comp",version 2.50?

Not sure the individual file, but you could extract it from the patched installer (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2326575/#msg2326575).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wutieru on June 03, 2019, 01:19:18 am
Hi,
Thanks for reply.
After patched installer ,it's only need a replaced .link file?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on June 03, 2019, 03:01:23 am
Hi,
Thanks for reply.
After patched installer ,it's only need a replaced .link file?

Yes.  The installer linked above already includes the patched nk.bin.comp.  Once it's installed replace the empty .lnk with your customized one.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wutieru on June 03, 2019, 11:23:57 pm
Thanks!
I got it.
Now my dsox is full functionly.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bitbanger on June 06, 2019, 06:16:18 am
What's the status of 3000T series option mods? If potential for options I'll read back through the 90 pages but I haven't been in the loop since my 2000A. TIA.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on June 06, 2019, 06:31:37 am
What's the status of 3000T series option mods? If potential for options I'll read back through the 90 pages but I haven't been in the loop since my 2000A. TIA.

Several people here have done it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ahakman on June 09, 2019, 07:51:07 am
Pinkus: If it doesn't start and it gets stuck with some of the front panel lights on, that sounds like the flash corruption problem. There's a few threads about it on the official keysight forums too that mention "try to start it 10 times - if you can start it, upgrade the firmware - it should be fine going forward. If you can't, send it in for replacement", so the intermittent starting issue that you're seeing is normal for the flash corruption issue. If you have to start it 200 or 300 times to get it to boot, I'd definitely get it replaced under the service note.

I just sent in a DSOX2012A with the non-booting flash corruption problem too a couple weeks ago, and got back essentially a brand new scope. Just opened up the box today and checked it out. I think the only thing that's original is the back cover with the original s/n sticker. Maybe the power supply too, but not sure, didn't take the cover off. The one I sent in had some scuffs on the front, and a little crack on the side where the front plastic meets the back cover. It's entirely replaced now.

When I sent it in, I told them, "If it's not covered by the service note for the flash, please let me know BEFORE you go ahead and repair under the fixed price repair", and they said they would do that. Wasn't contacted by them, other than an email confirming that it was indeed a flash problem and covered under the service note, and they were shipping it back to me.

Grabbed my probes from my 54645D, did the "upgrades" mentioned in this thread, and I'm a super happy camper now!

If I was you, I'd go ahead and send it on in! Was the best customer service I've gotten from any company in a very long time (though to be fair, I don't deal with many companies in a customer service type way - I either fix things myself, or if I can't, they go to "the parts pile")
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Gribo on June 14, 2019, 12:36:17 am
Is there any more interest in DSOXLAN boards? I just managed to sell my last one.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jeccylx on June 18, 2019, 01:58:54 pm
Has anyone cracked 3034T?I downloaded the upgrade firmware, referring to 3034A, I modified two places, but the LNK file can not open option.who can hlep me?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JeffreyLatter on June 18, 2019, 04:55:29 pm
Has anyone cracked 3034T?I downloaded the upgrade firmware, referring to 3034A, I modified two places, but the LNK file can not open option.who can hlep me?

Jeccylx The offsets should be those from PhillyFlyers Post on April 12, 2018, 06:13:47 am.

Code: [Select]
1) options patch: 0x486d00: change "04 00 A0 E1" -> "00 00 A0 E3"
2) nag patch: 0x4f24e0: change "A8 F1 93 E5" -> "01 00 A0 E3"

But check up on the thread, as I can't remember it precisely - But I can confirm the permanent mod via offsets works on the 3024T.
Otherwise, look at p71 at the end for quick 'n dirty workaround - But with a ng message.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jeccylx on June 19, 2019, 12:27:35 am
Thanks very much!!! JeffreyLatter ,When I download firmware,The version is 3000XSeriesT.7.30.2019051434, my patch is:
option:00494E74 : 04 00 A0 E1 -> 00 00 A0 E3
nag   :00502350:  AC F1 93 E5 -> 01 00 A0 E3
i read P71,it must use "42.exe"?can not modify lnk file?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gmaker on June 19, 2019, 07:44:44 am
Thank You!
Worked perfectly :-+

For others wanting to do this, the Scopes for Dummies version as follows:

Download Phillyflier's patched firmware from post #2167 on page 87
Download Luminax's license patch from post #1529 on page 62
Extract license patch, open cmd window (if using MS Windows), navigate to license patch folder and rename infiniivision.lnk to .txt
Edit infiniivision.txt and replace text in the file with Odessa's modification from post#2197 on page 88
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID
Save and rename file back to .lnk
Copy firmware file (rename from .ksx to .cab if current scope fireware is older than v2.41) to FAT32 formatted USB drive
Copy licence files (2x .cab files and .lnk file) to same USB drive

Now go to your scope, turn on and plug in USB drive to front USB port
Press [Utility] > File Explorer, select the firmware file (3000XSeries.02.50.2019022736_patched.cab); then, press Load File, wait for scope to load and reboot.
Check firmware has updated to v2.5, if successful continue
Press [Utility] > File Explorer, select v241_link_install.cab file; then, press Load File, wait for scope to load and reboot.
Check licenses have all been added and if so... :clap: :phew:

Thank you to all those that made this possible  8)

It works! Thank you guys!

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ahakman on June 20, 2019, 06:21:39 pm
Is there any more interest in DSOXLAN boards? I just managed to sell my last one.

Yes, I'd be interested in one. How much are they? Is this just bare PCB and I get the rest of the stuff, or is it a kit, or pre-assembled?

I was going to look into it, but I'm in the process of getting my office re-organized, so the scope isn't even on the bench yet
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on June 20, 2019, 06:26:23 pm
I also have several DIY LAN modules available now, either as a bare PCB, a kit, or fully assembled (price/lead times vary accordingly). PM me if you are interested.

- Matt
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Xavier64 on June 21, 2019, 09:01:12 am
Thanks very much!!! JeffreyLatter ,When I download firmware,The version is 3000XSeriesT.7.30.2019051434, my patch is:
option:00494E74 : 04 00 A0 E1 -> 00 00 A0 E3
nag   :00502350:  AC F1 93 E5 -> 01 00 A0 E3
i read P71,it must use "42.exe"?can not modify lnk file?

Would someone be so kind and upload the patched nk.bin for firmware 3000XSeriesT.7.30.2019051434 ?!

Many thanks.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wade2019 on June 21, 2019, 02:52:32 pm
Hi,

I own a DSOX4024A , unfortunately my firmware version is “04.08.2016071800”。Because #1931 requires 7.20.2017102615 version to crack.

where can I download the firmware to"7.20.2017102615 "? 

Keysight can download firmware version 7.30.20190514, but can't download version 7.20.2017102615.

Thank you。 :) :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlloyd1 on July 02, 2019, 04:20:34 am
I'm not sure what happened.
I tried installmodV2 posted earlier for a 3000T running 7.20.xxxx and got the "Unsealed Instrument" warning during booting and the "Systems concern detected: -Secure storage is unititialized. Please set instrument serial and licensing model numbers" error.
You can also see my BW and memory is chopped down as well.

Thanks for any ideas for recovery.

mlloyd1
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlloyd1 on July 02, 2019, 04:22:07 am
Sorry, I couldn't figure out how to attach 2 pictures to a posting.
This is the view during booting for my previous post.

mlloyd1
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JeffreyLatter on July 02, 2019, 05:21:47 am
Mlloyd1 - Thank you for the pictures. - Don't worry - I have had all of the above messages during my efforts.
I still got it recovered  :-+

For everyone else - We're working in the PM's on this - my initial solution is to remove the mod and reestablish the original *.lnk - It should fix the serial etc. message.

I will be removing the mod-package for the 3000T series for a while, as I have had a couple of users with difficulties after installing since releasing it - So I will re-think the readme file and maybe update the package for safety.
I do state that using the installer is on your own risk, but I must admit, I do feel real bad, whenever there is a problem after trying it out.
 :-[
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlloyd1 on July 02, 2019, 06:02:48 am
And I want to state that this tinkering is fun and educational (otherwise, why do it!) and I do not blame anybody for anything.
I read everything here (more than a few times) and decided to take the risk and learn something
This is MY scope and I decided what to do to it all on my own.
OK, is that enough disqualifiers?
 :-DD

To all the early adopters who sacrificed hardware and shared their knowledge, THANKS!!!!

mlloyd1
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlloyd1 on July 02, 2019, 06:10:34 am
Jeffrey:

After some playing around, I was able to get reconnected via telnet and also connected again to the device web pages.
So, I reran the installer and added the command.txt file to the USB drive this time.
After the reinstall and reboot, I still get the warning and error messages, but am very happy with the results in the "About Oscilloscope" screen.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pquadrat on July 02, 2019, 07:10:38 pm
Thanks very much!!! JeffreyLatter ,When I download firmware,The version is 3000XSeriesT.7.30.2019051434, my patch is:
option:00494E74 : 04 00 A0 E1 -> 00 00 A0 E3
nag   :00502350:  AC F1 93 E5 -> 01 00 A0 E3
i read P71,it must use "42.exe"?can not modify lnk file?

Would someone be so kind and upload the patched nk.bin for firmware 3000XSeriesT.7.30.2019051434 ?!

Many thanks.

I tried to do the patching on 7.30, but I do not understand the instructions about the checksum. Is this only to be done with IDA (freeware ok?) ?
All other steps are clear.

Thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlloyd1 on July 03, 2019, 01:24:20 am
Jeffrey,

Yes, i still have the same error messages, including the one about "uninitialized secure storage" from message 2252: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2521839/#msg2521839 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2521839/#msg2521839)

I also did a Hardware Self Test and got the "Self test failed: Firmware Status" error as shown in the image below.

mlloyd1
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on July 07, 2019, 03:08:15 am
Probably a silly question, but I noticed the 2000X series having a signal generator instead of an AWG. Considering the signal generation appears to be done by the ASIC, is the lack of an AWG on the 2000X series a matter of software?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pquadrat on July 10, 2019, 06:46:18 pm
Jeffrey,

Yes, i still have the same error messages, including the one about "uninitialized secure storage" from message 2252: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2521839/#msg2521839 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2521839/#msg2521839)

I also did a Hardware Self Test and got the "Self test failed: Firmware Status" error as shown in the image below.

mlloyd1

I think the method from Jeffrey is obsolete, I used it also, but removed it because of the error messages.

Then I used this method:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2166124/#msg2166124 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2166124/#msg2166124)
with the correct nk.bin.comp file, and modify the inf file to your needs, it works without any issues.

Still looking for a nk.bin.com file for the newest firmware (7.30).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlloyd1 on July 10, 2019, 09:35:45 pm
pquadrat:

you were working on a "T" (touch) series, correct?

mlloyd1
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pquadrat on July 11, 2019, 07:15:52 am
pquadrat:

you were working on a "T" (touch) series, correct?

mlloyd1
Yes, it is a DSOX-3104T.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on July 13, 2019, 12:05:06 am
I've skimmed through the thread and have learned a lot. Can anyone please confirm the following?

*Any oscilloscope still on Agilent firmware should be upgraded to modern firmware to prevent NAND issues and possibly add extra features
*To enable features as described in this thread on recent firmware you need a DSOXLAN module or equivalent alternative. Enabling without a LAN module is no longer possible
*When enabled there is a feature which allows downgrading of the oscilloscope back to stock for the purposes of warranty or selling it.

Is this current and correct for a 2000X series?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on July 13, 2019, 12:21:58 am
*To enable features as described in this thread on recent firmware you need a DSOXLAN module or equivalent alternative. Enabling without a LAN module is no longer possible

It might be possible to poke around with the UBOOT booloader over serial port, see here (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895) for the pins. I loaded a modified nk.bin over ethernet with the telnet password disabled this way (this was at a time when the Star Wars password was not known). But might be possible to do something over the serial port, only, as well, like patching some bytes in the flash, if you know the right locations and values.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on July 13, 2019, 04:52:24 pm
Is there a way of backing up the current firmware? I can't seem to find any older firmware versions being available, which makes me nervous. As a side note, is it possible to change the logos out in the newer firmware? I can see the splash screen being an easy fix, but the right corner logo isn't as obvious.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on July 13, 2019, 07:10:00 pm


I've skimmed through the thread and have learned a lot. Can anyone please confirm the following?

*Any oscilloscope still on Agilent firmware should be upgraded to modern firmware to prevent NAND issues and possibly add extra features
*To enable features as described in this thread on recent firmware you need a DSOXLAN module or equivalent alternative. Enabling without a LAN module is no longer possible
*When enabled there is a feature which allows downgrading of the oscilloscope back to stock for the purposes of warranty or selling it.

Is this current and correct for a 2000X series?

1. New firmwares core flash twice in different memory regions

2. PhillyFlyers maked CAB file with all corrections in DLL (look in ~April), so you can just flash it like factory FW. For install different start options also exist special CAB that copy your LNK file to Secure directory. So you need only usb flash device.

3. Just use factory FW
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on July 18, 2019, 12:51:15 pm
Does anyone happen to have original Agilent era firmware or a good source for older firmware versions?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on July 18, 2019, 09:09:40 pm
Does anyone happen to have original Agilent era firmware or a good source for older firmware versions?

Which version do you want?  I have all the X3000A versions going back to 1.10.  As far as I know they are identical to the downloads for the X2000A.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: whatguy on July 22, 2019, 02:18:04 am
Today I applied the steps

and was able to update my scope

The .ink file includes
160#\....exe -l ALL - TOM -l DIS -l MSO -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l BW20 -l ADVMATH -l EMBD -l EDK -l VID --perf

I have a 200MHz DSOx3024A

I was wondering could I increase the frequency?

I get an warning at boot;
"System concerns detected:
OS version is not correct. Please reload system firmware."

Other than those two issues the scope seems to have unlocked a bunch of features.
[attachimg=1]
Can I get rid of the nag screen at startup and does this DSOX3024A support higher Frequency?


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Safar on July 23, 2019, 08:10:04 am


...and does this DSOX3024A support higher Frequency?

Unfortunately not.

Next step 350/500MHz have another motherboard (actually the same, but with different input circuit elements)

You can shift by program mod only in 1 step from 100 to 200 (for DSOX301xx) and from 350 to 500MHz (for DSOX303xx)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jashugan on July 26, 2019, 09:00:54 am
Hello,
I'm owning a new DSOX3014T, I have a new LAN card, I have FW 7.20.2017102614, but I'm not able to enter into telnet...

For password, I used this website to generate the password: https://repl.it/repls/FrostyUnsungAcrobat

I filled the following fields:
MODEL  = "DSOX3014T"
SERIAL = my serial, MYxxxxxxxx
MAC    = my xx-xx-xx-xx-xx-xx

then run the script and get the password.

In telnet, I put "infiniivision" as user name.
For password I tried both the skywalker1977+password generated and password generated only, but it failed...

Just to be sure I'm not missing something, if my serial was MY12345678 and my MAC was 00-11-22-33-44-55, what should be the password to write into the telnet?
Thank you
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rattnallen on July 26, 2019, 10:33:29 am
Try to enter the password directly after boot, there seems to be an timeout.
The password should be the password generated only, no skywalker1977 in front.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on July 26, 2019, 01:51:06 pm
If I remember correctly the password attempt always fails the first time. You may have to try twice before it'll let you in using Telnet.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jashugan on July 26, 2019, 02:09:39 pm
Both of you were right: there is a time and password appears to fail first time. Now I have successfully cracked my DSOX3014T. Thanks!!!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on July 26, 2019, 02:13:05 pm
Both of you were right: there is a time and password appears to fail first time. Now I have successfully cracked my DSOX3014T. Thanks!!!
Glad to hear it!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on July 28, 2019, 03:22:21 pm
Is it possible to enable the FRA (frequency response analysis) function on 3000A series?

According to the datasheet it seems that it doesn't exist but I am hoping it could still be possible
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: lukier on July 28, 2019, 04:06:57 pm
Is it possible to enable the FRA (frequency response analysis) function on 3000A series?

According to the datasheet it seems that it doesn't exist but I am hoping it could still be possible

I would like to know the answer to that question as well. 1000X series have it, despite having less capable HW inside, so it doesn't sound like HW limitation (which was the case with 2000A MSO + decoding for example).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlloyd1 on July 28, 2019, 06:18:49 pm
Keysight told me the answer is no.
I enabled everything on an MSO-X3024A that I have access to and FRA does not show up.
Really disappointing considering the nice function generator app that works just fine.
 :(

mlloyd1

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on July 28, 2019, 07:08:04 pm
It is like this:

2000 and 3000A are same codebase, with model differences.

3000T and 4000A are same codebase, with model differences.

Sorry!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on July 28, 2019, 07:12:37 pm
Keysight told me the answer is no.
I enabled everything on an MSO-X3024A that I have access to and FRA does not show up.
Really disappointing considering the nice function generator app that works just fine.
 :(

mlloyd1
Agreed, it seems disappointing lower models get better features based on effectively the same hardware. It appears Keysight has trouble differentiating the very similar model ranges. Obviously there's always the option of adding it in a future firmware upgrade like they've done with various features or upgrades in the past.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Altemir on July 29, 2019, 08:27:43 am
Hi All!
Are model DSOX3034T will be hackable?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 29, 2019, 11:57:21 am
Hello guys, i am in a big disaster  :palm: :palm: :palm::
I have update my DSOX 2024 to 2.5 firmware patched, with usb stick, but no licences was activated.
I have try to modifiy my infiniivision.ink and brick my scope in a continual restart. :scared: :scared: :scared:
I haved brick my scope before with a 2.35, and with the help of the community, i haved recovered my scope.
After several attemps the scope have reboot.
I have try the franckbusses serial port, but nothing appear in the terminal.
I have try with tera term, putty, and tty emulator: no way.
I have scope the RX and TX with my very old scope, when the dsox boot, i have a trame.
When i send a command, i have a trame : the serial connection work.
Why i haven' the boot sequence appearing in the terminal ?
Someone have one solution for enable licences please?
I haved all enabled, in the 2.35 firmware, and i can,t downgrade to.
I am in a very difficult situation, and a help will be very apreciate, please.
thank you by advance
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 29, 2019, 01:10:49 pm
Hello guys, i am in a big disaster  :palm: :palm: :palm::
I have update my DSOX 2024 to 2.5 firmware patched, with usb stick, but no licences was activated.
I have try to modifiy my infiniivision.ink and brick my scope in a continual restart. :scared: :scared: :scared:
I haved brick my scope before with a 2.35, and with the help of the community, i haved recovered my scope.
After several attemps the scope have reboot.
I have try the franckbusses serial port, but nothing appear in the terminal.
I have try with tera term, putty, and tty emulator: no way.
I have scope the RX and TX with my very old scope, when the dsox boot, i have a trame.
When i send a command, i have a trame : the serial connection work.
Why i haven' the boot sequence appearing in the terminal ?
Someone have one solution for enable licences please?
I haved all enabled, in the 2.35 firmware, and i can,t downgrade to.
I am in a very difficult situation, and a help will be very apreciate, please.
thank you by advance
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 29, 2019, 01:12:27 pm
my(old) mother board
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on July 29, 2019, 01:13:21 pm
Why i haven' the boot sequence appearing in the terminal ?

Exactly how did you connect the scope serial port to the PC?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 29, 2019, 01:14:33 pm
my serial connection
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 29, 2019, 01:16:43 pm
my professionnal connector :-// :-//
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 29, 2019, 01:21:37 pm
my old max 232
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 29, 2019, 01:24:14 pm
my screen
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on July 29, 2019, 01:34:11 pm
1) your pictures are WAY TOO BIG! About 10% of the size would be enough to show what you are showing. Also, you could then have posted all pictures at the same time.

2) If you remove the RX and TX cables from the scope and connect them together, can you see an echo of what you type in your terminal program?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 29, 2019, 01:37:21 pm
the tx scope
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 29, 2019, 01:40:08 pm
the rx scope
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 29, 2019, 01:42:23 pm
Hello Paobz, how are you ?
sorry for the size, would you i remove the pictures ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 29, 2019, 01:45:16 pm
yes, i have an echo
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: The_PCB_Guy on July 29, 2019, 01:47:25 pm
Any chance you could retake the pictures with a camera rather than a potato?  :palm:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on July 29, 2019, 01:51:07 pm
yes, i have an echo

If you have an echo and you have TX and RX activity from the scope (as shown on the Hameg) then there's not much left than baudrate etc. settings...

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 29, 2019, 01:51:48 pm
 Any chance you could retake the pictures with a camera rather than a potato?  :palm:


 :-DD sorry, i have a honor x2, more big than a potatoes
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 29, 2019, 01:53:43 pm
yes, 115200 bauds, no parity, one stop bit, 8 data bits, but when i turn on my scope, nothing appear in the terminal
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on July 29, 2019, 02:19:14 pm
yes, 115200 bauds, no parity, one stop bit, 8 data bits, but when i turn on my scope, nothing appear in the terminal

Alright, last thoughts:

 - If you connect the TX and RX lines from the MAX-232 NOT to the scope but together you have an echo. If you measure with the Hameg on the point where the wires are connected to each other (and GND of course), do you see the same level as when you measure on the DSOX? Is it the same HIGH or LOW level when there is no data? How about the bit time, is it the same? If all that is yes then I give up...

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 29, 2019, 03:08:19 pm
 :-DD, this i the cable, no tx output side pc. i will buy another one.
Thank you.
I have past my night with my scope, when i bricked it, and i admite that i,m very tired.

What can i do for enable all the licences with usb stick please ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Altemir on July 29, 2019, 03:12:03 pm
Is the oscilloscope DSOX3034T susceptible to hacking?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 29, 2019, 03:35:19 pm
i think the community have the capability to do this, or have do this
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on July 29, 2019, 04:11:29 pm
Is the oscilloscope DSOX3034T susceptible to hacking?
If I read this thread correctly, yes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Fixalot on July 30, 2019, 11:37:55 am
Most likely. I recently hacked my MSOX3014T with the latest firmware (7.30).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Fixalot on July 30, 2019, 02:48:56 pm
I also get the "System Concerns detected" message at startup with both LAN and Secure storage nags. On top of that the scope always asks me (on startup) if I would like to run the scope demo.

The scope seems to work as expected and shows 200 MHz and all the options work. The sample rate and bandwidth shows the expected values in all places but I haven't done any physical testing to see if it is true. It feels true however  :-DD
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 30, 2019, 08:49:31 pm
Nobody can help me please ? I'm afraid to make a mistake and brick my scope another time.
How can i activate my licences please?  i have order the db9 wire, for do that, but i need the wave generator and the logic analyzer for a project for my job urgently.
Can somedy help me to make this with an USB stick?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Fixalot on July 30, 2019, 09:34:01 pm
Nobody can help me please ? I'm afraid to make a mistake and brick my scope another time.
How can i activate my licences please?  i have order the db9 wire, for do that, but i need the wave generator and the logic analyzer for a project for my job urgently.
Can somedy help me to make this with an USB stick?

Did I understand correctly that your scope is in a boot loop at the moment? Maybe the same trick I used to gain access to Telnet for 7.30 in the 3000T model works so that you then can fix the startup.

Try booting with a USB stick where you only have the infiniivisionStartupOverride.txt file in the root. This should give you about one minute to login through Telnet and kill the processStartupFolder.exe process (processmgr kill processStartupFolder.exe).
When you are this far the only thing left should be to fix the lnk file, but I can't help you here because I haven't done it on an A-series scope.

As usual, everything you do is at your own risk.  :-BROKE
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Fixalot on July 30, 2019, 10:16:03 pm
I created a binary patch file for easy patching of the nk.bin.comp for 3000T series firmware version 7.3 (3000XSeriesT.7.30.2019051434.ksx).

Just extract the nk.bin.comp from 3000XSeriesT.7.30.2019051434.ksx (rename to .cab) and patch it using the included patch and tool courgette64.exe in the attached zip.

The usage is "courgette64.exe -applybsdiff <old_in> <patch_in> <new_out>", example in windows command prompt: courgette64.exe -applybsdiff nk.bin.comp nk.bin.comp.bsdiff nk.bin.patched.comp

Does anyone know of a good and free diff and patch tool for Windows, Mac and Linux/Unix that is easy to use and has ready binaries to download if one does not want to compile from source?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 30, 2019, 10:58:44 pm
Thank you for jour help, no i haved unbrick it, but i was scared, because without, lan o serial connections, that was an pain.
I wan't to unable my licences, i have try the 2.50 patched by Phillyfler and the
Luminax license patch, but only EDK, DVM, and RML, was activated.

I have try to modify the .ink and.. :palm: :palm: :palm: brick my scope
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on July 30, 2019, 11:12:31 pm
Thank you for jour help, no i haved unbrick it, but i was scared, because without, lan o serial connections, that was an pain.
I wan't to unable my licences, i have try the 2.50 patched by Phillyfler and the
Luminax license patch, but only EDK, DVM, and RML, was activated.

I have try to modify the .ink and.. :palm: :palm: :palm: brick my scope
Maybe it's because you called the file .ink instead of .lnk? That's .LNK in lowercase letters. There's no i in there. If Windows sees it as a shortcut file you're good.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 30, 2019, 11:19:04 pm
No i have change the include inside the infiniivision.ink
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on July 30, 2019, 11:38:30 pm
No i have change the include inside the infiniivision.ink
The file shouldn't be called "infiniivision.ink", but "infiniivision.lnk". The extension is not INK, it's LNK. You can capitalize the letters if you like as that will still work, but you can't spell it with an "i". I assume you named the file incorrectly and the .cab couldn't find the file it was expecting. Use the correct filename.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 31, 2019, 12:28:48 am
Sorry
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 31, 2019, 12:30:37 am
That is the good filename, i have not make mistake
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 31, 2019, 12:33:50 am
That is the original patch, look by yourself
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on July 31, 2019, 12:36:28 am
That is the good filename, i have not make mistake

NO it is not. Look, they are telling you change the filename to INFINIIVISION.LNK (with lower case letters)
Your file is not named correctly

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 31, 2019, 12:40:06 am
Sorry, perhaps i have not understand.
Do you wan't to say that the original name of the patch is wrong
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on July 31, 2019, 12:43:49 am
Sorry, perhaps i have not understand.
Do you wan't to say that the original name of the patch is wrong

as far as I know it has always been infiniivision.LNK.

Just search this thread/topic for this filename and you will see
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on July 31, 2019, 12:54:25 am
Sorry
You wrote "infiniivision.ink". This is wrong. It should be "infiniivision.lnk" It's different. I don't know where you got "ink" from but I just downloaded the original file and it has the correct extension. See the screenshot attached to this post. The procedure isn't going to work if you don't follow the instructions precisely and are using the wrong file names.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 31, 2019, 01:06:53 am
Thank you a lot, i will try and i'll say if thats' work
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 31, 2019, 02:28:25 am
That work  :-- :-+, Thank you a lot  :clap: :clap: :clap: i go to sleep 2 jours before go to my job.
I have only this message, i dont Know why, but all seem work
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on July 31, 2019, 10:45:40 am
That work  :-- :-+, Thank you a lot  :clap: :clap: :clap: i go to sleep 2 jours before go to my job.
I have only this message, i dont Know why, but all seem work
Glad to hear it worked out. I'm not sure what causes that message. Maybe reapplying the procedure after your job is done would improve the situation, but maybe others here have an idea why the issue arises.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jens01 on July 31, 2019, 07:15:24 pm
If keysight released the FRA option for the DSOX3000A series that would be an instant-buy for me. As keysight is active on this forum, maybe they can clarify if they will roll out this option in the future?

I'm thinking of selling my scope and switch to R&S as they provide a really nice FRA option.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on July 31, 2019, 07:20:35 pm
If keysight released the FRA option for the DSOX3000A series that would be an instant-buy for me. As keysight is active on this forum, maybe they can clarify if they will roll out this option in the future?

I'm thinking of selling my scope and switch to R&S as they provide a really nice FRA option.
The 3000T seems to have the option.

http://literature.cdn.keysight.com/litweb/pdf/5992-2209EN.pdf (http://literature.cdn.keysight.com/litweb/pdf/5992-2209EN.pdf)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on July 31, 2019, 09:07:24 pm
I have try to reapplying the procedure, without succes.The message appear after licences patch activation but all seem working
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on August 01, 2019, 02:12:23 pm
Keysight ebay store promo on now, MSOX3104T fully loaded as far as I can see, US $6,848.28. Four now available (It was five, I just bought one!).

Keysight Used MSOX3104T Oscilloscope, mixed signal, 4+16 channel, 1GHz - e-Promo Incl. Probes, Application Bundle and 1 year warranty (https://www.ebay.com/itm/193024964977)

I had to purchase it from my local ebay.co.uk site as from ebay.com it wouldn't let me pay or request invoice. Note that Keysight use DDP Incoterms so you pay taxes to them through an ebay invoice, so it arrives customs cleared.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on August 01, 2019, 02:25:23 pm
Keysight ebay store promo on now, MSOX3104T fully loaded as far as I can see, US $6,848.28. Four now available (It was five, I just bought one!).

That is a good deal.
And you don't need to hack it!  :-DD
I bought the MSOX3104A a few years the same way for a similar discount and I am still happy with that scope.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on August 01, 2019, 04:08:07 pm
Keysight ebay store promo on now, MSOX3104T fully loaded as far as I can see, US $6,848.28. Four now available (It was five, I just bought one!).

Keysight Used MSOX3104T Oscilloscope, mixed signal, 4+16 channel, 1GHz - e-Promo Incl. Probes, Application Bundle and 1 year warranty (https://www.ebay.com/itm/193024964977)

I had to purchase it from my local ebay.co.uk site as from ebay.com it wouldn't let me pay or request invoice. Note that Keysight use DDP Incoterms so you pay taxes to them through an ebay invoice, so it arrives customs cleared.

Congrats!
I'm really happy with mine.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 01, 2019, 04:33:32 pm
Keysight ebay store promo on now, MSOX3104T fully loaded as far as I can see, US $6,848.28. Four now available (It was five, I just bought one!).

Keysight Used MSOX3104T Oscilloscope, mixed signal, 4+16 channel, 1GHz - e-Promo Incl. Probes, Application Bundle and 1 year warranty (https://www.ebay.com/itm/193024964977)

I had to purchase it from my local ebay.co.uk site as from ebay.com it wouldn't let me pay or request invoice. Note that Keysight use DDP Incoterms so you pay taxes to them through an ebay invoice, so it arrives customs cleared.

Absolutely the best deal they have ever had on the scope. It has been that price in the past but did not have the app bundle or probes/MSO cable.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on August 03, 2019, 06:59:38 am
Keysight ebay store promo on now, MSOX3104T fully loaded as far as I can see, US $6,848.28. Four now available (It was five, I just bought one!).

Keysight Used MSOX3104T Oscilloscope, mixed signal, 4+16 channel, 1GHz - e-Promo Incl. Probes, Application Bundle and 1 year warranty (https://www.ebay.com/itm/193024964977)

I had to purchase it from my local ebay.co.uk site as from ebay.com it wouldn't let me pay or request invoice. Note that Keysight use DDP Incoterms so you pay taxes to them through an ebay invoice, so it arrives customs cleared.

Absolutely the best deal they have ever had on the scope. It has been that price in the past but did not have the app bundle or probes/MSO cable.

Yeah, that is incredible deal!  I have MSOX3054A (only MSO and BW options I applied from here; others I got in app bundle) and I love it.  The -T series definitely has more (& better?) software/apps but not something I could justify upgrading to at the moment.

There's also this MSOX4154A on eBay (https://www.ebay.com/itm/183868079044) (no probes; limited apps) for $9,116.40 .  I don't have money to buy it but (for future reference) is it an exceptional deal?  Or there's better to be had?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on August 03, 2019, 07:49:19 am
This might be a little old but looks like Keysight have new app bundles. Here is links related to 3000 A/T X-Series:

OLD: DSOXT3APPBNDL (https://www.keysight.com/en/pd-2494939-pn-DSOXT3APPBNDL/application-bundle-for-infiniivision-3000t-x-series-oscilloscopes?cc=US&lc=eng) $3600

NEW: D3000BDLA (https://www.keysight.com/en/pd-2990560-pn-D3000BDLA/ultimate-software-bundle-for-the-3000a-t-x-series?cc=US&lc=eng) $2530

I compared the app/software packages contained in each (listed in the brochure on each page) and didn't notice any difference.  Are they the same and this is just a revised SKU?  The new one is significantly cheaper -- is it missing something?

Or have the apps been revamped with new capability and you can only get it with purchasing the NEW app bundle?  I hope not!!

Anyone know details of this?

Similar situation for the 4000A series.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on August 03, 2019, 07:50:05 am

There's also this MSOX4154A on eBay (https://www.ebay.com/itm/183868079044) (no probes; limited apps) for $9,116.40 .  I don't have money to buy it but (for future reference) is it an exceptional deal?  Or there's better to be had?
The 4000 series is more or less the same as the 3000A series with a larger screen.
If you are looking for an upgrade, look at the 6000 X series, that is a real upgrade from the 3000 series.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on August 03, 2019, 08:05:37 am

There's also this MSOX4154A on eBay (https://www.ebay.com/itm/183868079044) (no probes; limited apps) for $9,116.40 .  I don't have money to buy it but (for future reference) is it an exceptional deal?  Or there's better to be had?
The 4000 series is more or less the same as the 3000A series with a larger screen.
If you are looking for an upgrade, look at the 6000 X series, that is a real upgrade from the 3000 series.

The sample rate and bandwidth of the 6000 X series is impressive, but max memory depth is 4Mpts (same as 3000/4000 X series), and the waveform update rate is 450k/sec (< half of 3000/4000 X series), which seem a bit limiting.  I'm isolating those things...maybe unfairly...

The apps/software for 4000A are just a bit more extensive than 3000T.  I'm not sure if there's any difference in probe support between 3000T and 4000A series...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on August 03, 2019, 10:29:09 am

There's also this MSOX4154A on eBay (https://www.ebay.com/itm/183868079044) (no probes; limited apps) for $9,116.40 .  I don't have money to buy it but (for future reference) is it an exceptional deal?  Or there's better to be had?
The 4000 series is more or less the same as the 3000A series with a larger screen.
If you are looking for an upgrade, look at the 6000 X series, that is a real upgrade from the 3000 series.
The apps/software for 4000A are just a bit more extensive than 3000T.  I'm not sure if there's any difference in probe support between 3000T and 4000A series...

It is actually the other way around. All the options for the 3000T and 4000A are identical. On the other hand, 4000A has full Autoprobe interface, while 3000T has limited current, so you cannot use all the probes and cannot use some combinations because you run out of current budget. It is explained in  detail in interface and accessories datasheet.

Also 3000A and 2000 series are based on same software base. That is why 3000A doesn't have same options as 3000T.
3000T and 4000A are based on same software base, hence all the same software options..

There is still not much details about new software bundle policy, but it seems that Keysight will , in addition to current options, offer an subscription based, and floating licenses for Infiniivision series.
Hence the new option codes. I have yet to see Keysight new official explanation how it will work.

Maybe Daniel will come up with a little explanation/presentation.....

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on August 03, 2019, 01:12:26 pm
Subscription based oscilloscope software?  :palm:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on August 03, 2019, 01:49:15 pm
Subscription based oscilloscope software?  :palm:
Not basic scope. Options and decodes. It might make sense for large companies.
Imagine you have 10 3000T scopes. You get them with some basic functions and protocols, and get few floating licenses for stuff you don't use every day, and shuffle them around as needed.
It is same as renting scopes for a project.

I don't have use for it, but I can see it being useful to some.
Keysight did this great: you can still buy perpetual license, or a temporary one that will expire. Your choice.

It seems that we will be able to get an maintenance license too for bundle. That would take care of upgrading bundle when they add new features that didn't exist when you bought bundle. If the price is right, I'll get that one for sure..
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: BillB on August 03, 2019, 01:52:13 pm
Subscription based oscilloscope software?  :palm:

It's the way of things these days.  Manufacturers have realized that they can make things only so cheap, with only so much planned obsolescence.  They'd love for people to throw away their perfectly good hardware and buy this year's model (not every company can be Apple). 

So, the next best thing is a continuous revenue stream through software subscription licensing.

I envision a world where you'll be effectively renting everything.  Your TV, refrigerator, car, and pacemaker will all require annual software licensing to continue to work.   >:(   
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on August 03, 2019, 02:41:14 pm
Not basic scope. Options and decodes. It might make sense for large companies.
Imagine you have 10 3000T scopes. You get them with some basic functions and protocols, and get few floating licenses for stuff you don't use every day, and shuffle them around as needed.
It is same as renting scopes for a project.

I don't have use for it, but I can see it being useful to some.
Keysight did this great: you can still buy perpetual license, or a temporary one that will expire. Your choice.

It seems that we will be able to get an maintenance license too for bundle. That would take care of upgrading bundle when they add new features that didn't exist when you bought bundle. If the price is right, I'll get that one for sure..
It could make sense but as BillB points out correctly it tends to end up as some kind of horror show where you end up leasing the equipment you pay for. I was hoping the embedded world would escape this madness but it seems I may have been too optimistic.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on August 03, 2019, 06:51:38 pm
It seems that we will be able to get an maintenance license too for bundle. That would take care of upgrading bundle when they add new features that didn't exist when you bought bundle. If the price is right, I'll get that one for sure..

Is this for real that we will have to update our software bundle license to upgrade the 'scopes internal apps to get new features?  Like the scope is going to have the old serial decode options as part of DSOXT3APPBNDL , and if you buy the new bundle D3000BDLA , then you get some new features?  It's like the scope could potentially have two versions of each software app...  it sounds kinda nuts...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on August 03, 2019, 07:32:39 pm

Yeah, that is incredible deal!  I have MSOX3054A (only MSO and BW options I applied from here; others I got in app bundle) and I love it.  The -T series definitely has more (& better?) software/apps but not something I could justify upgrading to at the moment.

There's also this MSOX4154A on eBay (https://www.ebay.com/itm/183868079044) (no probes; limited apps) for $9,116.40 .  I don't have money to buy it but (for future reference) is it an exceptional deal?  Or there's better to be had?

I am in the same position, I have an MSOX3054A, and like it, but I also have an MSO7104B permanently on the bench and that’s the one that’s been my go to scope for about three or four years now.

In the process of moving the lab, I have been playing with an MDO4054C-SA6, liberated to 1GHz. Just like the MDO3000, which I do have a fair bit of experience with, the UI is a b!tch to deal with, it has slow responsiveness, and has the same random UI not helped with two multi function buttons, which sometimes you use, sometimes you don’t.

In comparison, I really like the automatic acquisition and snappy and intuitive feel of the Keysights.

I note that the much acclaimed time and frequency correlation feature combined with the SA of the MDO4000 has been dropped in the new Tek Series 4.

I was looking at the MSOX4000s too: unlike he 3000 they offer USB HS decode. Then the loaded 3104T offer came in...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on August 03, 2019, 07:59:46 pm

Yeah, that is incredible deal!  I have MSOX3054A (only MSO and BW options I applied from here; others I got in app bundle) and I love it.  The -T series definitely has more (& better?) software/apps but not something I could justify upgrading to at the moment.

There's also this MSOX4154A on eBay (https://www.ebay.com/itm/183868079044) (no probes; limited apps) for $9,116.40 .  I don't have money to buy it but (for future reference) is it an exceptional deal?  Or there's better to be had?

I am in the same position, I have an MSOX3054A...
<snip>
I was looking at the MSOX4000s too: unlike he 3000 they offer USB HS decode. Then the loaded 3104T offer came in...

Ahh, so may I ask your comparison of 3054A and 3104T?  Is the software and features of 3000T a big step from 3000A?  What do you love on 3000T that 3000A can't do?  Just curious! :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on August 03, 2019, 08:22:45 pm
It seems that we will be able to get an maintenance license too for bundle. That would take care of upgrading bundle when they add new features that didn't exist when you bought bundle. If the price is right, I'll get that one for sure..

Is this for real that we will have to update our software bundle license to upgrade the 'scopes internal apps to get new features?  Like the scope is going to have the old serial decode options as part of DSOXT3APPBNDL , and if you buy the new bundle D3000BDLA , then you get some new features?  It's like the scope could potentially have two versions of each software app...  it sounds kinda nuts...

No, that is not what I meant. People that bought bundle 3 years ago, didn't get  Manchester/NRZ serial decode option (DSOXT3NRZ) (there wasn't one yet). When DSOXT3NRZ protocol was released, if you bought bundle after that, you got it, but people that had bundle from before didn't get it enabled.
If they release new protocol, you don't get that now despite bundle. If they update protocol that you have, you get all upgrades inside that.

If you buy those two bundles today, there is no difference. But one of those will be scope full unlock whatever they add the scope as long you are in active subscription, and other unlock all that scope has today, and if they add protocol you don't have it..

Although it is kinda questionable what new options they might add that scope doesn't already have now. I would like histograms and jitter analysis, but I doubt they will add that, but that would be valuable. Protocol list is already best in class, I don't see much that can be added either..
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on August 03, 2019, 08:30:12 pm
Ahh, so may I ask your comparison of 3054A and 3104T?  Is the software and features of 3000T a big step from 3000A?  What do you love on 3000T that 3000A can't do?  Just curious! :)

Apart from few protocols and FRA they are exactly the same.
Biggest difference is in touch screen.  Being able to type values directly is really helpful. Also you have zone trigger.
All the rest it is pretty much same scope to the user...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on August 03, 2019, 09:57:59 pm
Ahh, so may I ask your comparison of 3054A and 3104T?  Is the software and features of 3000T a big step from 3000A?  What do you love on 3000T that 3000A can't do?  Just curious! :)

Apart from few protocols and FRA they are exactly the same.
Biggest difference is in touch screen.  Being able to type values directly is really helpful. Also you have zone trigger.
All the rest it is pretty much same scope to the user...

Compared to the X3000T, the X3000A series is lacking FRA, zone trigger, math on ref channels, simultaneous math functions (3000T can do two), math cascading, gated FFT, and spectrum analyzer-like FFT functions.  No decoders for NRZ, NFC, USB PD, SENT, and CXPI.

It seems the X3000A was kicked into the development gutter years ago.  Software updates have consisted mostly of minor bug fixes and support for new, expensive probes.  I'm not sure why they still sell it since it's the same price as the X3000T.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on August 04, 2019, 05:49:52 am
Ahh, so may I ask your comparison of 3054A and 3104T?  Is the software and features of 3000T a big step from 3000A?  What do you love on 3000T that 3000A can't do?  Just curious! :)

For me, 1GHz and USB PD. Plus my 3054A has an intermittent fault on Ch4 which usually fixes itself after it’s been on a while, or, of course, when you take the lid off the AFE section to isolate it! I suspect it’s a cracked compensation ceramic cap as it seems to be thermally related, and it’s either there or it’s not, basically the channel goes into oscillation. It’s on the ADC side of the attenuator as changing the vertical gain has no significant effect.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bitbanger on August 12, 2019, 01:37:13 am
Guys I hate to have to ask for help but I think I borked my 2014A.

About a year ago I "manually" patched 2.41.2015102200 dll using telnet and using "startinfiniivision.cmd" and a infiniivision.lnk w/
Code: [Select]
50#\windows\cmd.exe /c \Secure\startinfiniivision.cmdThe start file contained:
Code: [Select]
processmgr kill infiniivisionlauncher.exe
copy \secure\InfiniiVisionCore.dll "\program files\infiniivision\InfiniiVisionCore.dll"
"\program files\infiniivision\infiniivisionlauncher.exe" -l all -l BW20 -l SCPIPS -l SGMC -l CABLE

This was working great for a year or better, albeit a nag warning.

Today I tried to patch to 2.5 by using Luminax's v241_link_install cab, the below infiniivision.lnk, and Phillyflier's patched firmware.

Code: [Select]
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID
Installed firmware via USB. Scope reverted all options to stock, w/2.41 reported.

I telnet in and killed infiniivisionlauncher.exe
Copied the above lnk to \secure\startup

Before I copied I didn't see any .lnk files in that directory (just .backup and something like .lnk_external).

Now at power on scope shows Infiniivision splash, cycles button LED, displays Keysight logo, then hangs. On the second cold boot, same but black screen after keysight logo.

:edit: Telnet only works for a few seconds after the first splash - enough time for my to type in username but the connection drops.

Any suggestions on where to start? Thank you in advance!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on August 12, 2019, 02:03:42 am
There's no Telnetting required for the 2.50 upgrade. Forget the earlier procedure and follow the instructions in the post in the link below.

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363)

I realise you still have a hang to fix first but at least you know where the issue may have come from.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bitbanger on August 12, 2019, 02:17:57 am
Right - those were the instructions I was following. My mistake was that when I didn't see the options enabled, I assumed I still had to copy the .lnk file over.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bitbanger on August 12, 2019, 02:21:39 am
Ok being quick on the draw I was able to log in and quickly kill infiniivisionlauncher.exe

Scope then booted into UI.

From there I tried to re-apply patch as described in post 2201 via USB. Scope rebooted, same result, hang.

I think I need to delete infiniivision.lnk from \Secure\Startup. Can anyone confirm?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on August 12, 2019, 02:39:22 am
Right - those were the instructions I was following. My mistake was that when I didn't see the options enabled, I assumed I still had to copy the .lnk file over.
You do, by means of the .cab file. Open it up to see what it does.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bitbanger on August 12, 2019, 02:49:25 am
SMH.... I just realized I never loaded the 2.5 cab file... went straight for the 2.41.

Was able to get booted to UI by again quickly killing infiniivisionLauncher.exe. Loaded 2.5, reboot, confirmed 2.5. Loaded 2.41 patch, worked.

Thanks for the help realizing my mistake. :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jeccylx on August 14, 2019, 04:18:13 am
Can anyone help me? I have an oscilloscope of 3054A, and it keeps bootloop.
The following is the data output of the serial port.
Code: [Select]


U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2019-8-13   19:47:31.91 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
RTC: 2019-8-13   19:47:31.95 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOOOXOOXOOXXOOXOXOOOOXOXOOOOOXOOOXOOXOXOXOXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXOOOXOOX
OOOOXXXOOOOXOOXOOXOOOOOOOOOXOXOOOXOOOOOOXOXOOOOOXXOOOOOOOXOXOXXOOXOXOOOXOOOXOOXOXXXOXOOOXOXXXXOXOXXOXXXXXOXOXXOOOXXXOXXXXXXOXXXXXXOXXXXOXOXOXOOOXXXXOXXXXXOOOXXOXXOOXXOX
XXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOOXOXOOXOOXXXXXXXXXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1ACA724, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1ACA724  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2019-8-13   19:47:35.40 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Feb 27 2019)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:21:61:2F
Phy found addr 31 (ticks=3030)
WaitForLink Start (ticks=3032)
No Link (ticks=4047)
<--EDeviceInitialize

GMAC DMA status register = 0x0
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Device load time:
   NANDFLASH: 0 ms
   SNANDFLASH: 0 ms
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
Our command line is
Performing Startup
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
Released build, Feb 27 2019, 20:34:05
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
No option module detected
Keyboard firmware version 32... ok
Keyboard Info: Board id 1, Board rev 3
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Gribo on August 17, 2019, 09:11:22 pm
2nd batch of my DSOXLAN boards is ready. If anyone is interested, send me a PM. Will ship worldwide.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on August 17, 2019, 09:19:39 pm
Hello
@ jeccylx
I think you must try the method describe in Page 89 reply 2201
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jeccylx on August 18, 2019, 01:03:46 am
@ Alanme
Thank you for your reply. I have upgraded the firmware several times. It should not be the problem with the firmware. |O |O
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Frank_Canada on August 28, 2019, 06:28:35 pm
Can anyone tell me where to download previous firmware files (2000XSeries.02.01.2011111500.cab, 2000XSeries.02.43.2018020635.ksx)?

I am trying to fix my scope using titiris method (thanks by the way) but I think there is a compatibility issue.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on August 28, 2019, 06:59:05 pm
hello
here:
https://mega.nz/#!GGBWFCya!QhTD1PbSSD753mwuejnXR7dUQ2gMqvfx-esg3uzI3qM
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Frank_Canada on August 29, 2019, 11:39:53 am
Merci!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Alanme on August 29, 2019, 12:38:42 pm
De rien
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Frank_Canada on August 29, 2019, 01:09:19 pm
@jeccylx I ran into the same kind of problem and I think the NAND chip is corrupted (reflashed many times with different firmware versions). I am replacing the NAND flash memory by a brand new one and I'll let you know whether or not it works.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on August 29, 2019, 01:15:58 pm
If you contact Keysight service, they should be able to repair it for free.  They just swap the whole board and recalibrate the scope for you.  Even if the scope is out of warranty, this fault is covered.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 29, 2019, 05:02:22 pm
@jeccylx I ran into the same kind of problem and I think the NAND chip is corrupted (reflashed many times with different firmware versions). I am replacing the NAND flash memory by a brand new one and I'll let you know whether or not it works.

Don't do it unless you've backed up the entire memory. More then just the base firmware is stored in the flash, it also has your serial #, calibration data and license files.
What is the exact problem you're having with the scope?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Frank_Canada on August 29, 2019, 05:43:08 pm
@theSteve Blank screen problem.
The Uboot stops after: "BALDWIN_DDI: cBaldwinHwIf::Init: Success!"

U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  128 MiB
...
...
GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 29, 2019, 06:08:27 pm
That is most likely is a NAND memory corruption issue. If it is then Keysight should repair/replace the scope for no charge. It is possible to also fix it yourself if needed and the information on doing it is in this thread. However it isn't always simple. I recommend calling Keysight and asking them about having it repaired because of a NAND corruption fault.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Frank_Canada on August 30, 2019, 01:10:49 pm
I followed the instructions of Titiris and reloaded the nk.nb0 file (loady 0x0361000 115200) of the firmware (and also tried different versions of firmware) but the same problem remains: U-Boot stops at the same place.
So bought brand new NAND memory, replaced the old NAND by the new one on the board and redid the same process (loady 0x0361000 115200). Now U-boots goes further but is kind of stock in a loop:

BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
Exception 'Data Abort' (4): Thread-Id=04100002(pth=8371a340), Proc-Id=00400002(pprc=816a8308) 'NK.EXE', VM-active=01e40002(pprc=87fcbeac) 'udevice.exe'
PC=c08fa088(baldwin_ddi.dll+0x0000a088) RA=c08fa07c(baldwin_ddi.dll+0x0000a07c) SP=d137f660, BVA=00000000
Exception 'Data Abort' (4): Thread-Id=04100002(pth=8371a340), Proc-Id=00400002(pprc=816a8308) 'NK.EXE', VM-active=01e40002(pprc=87fcbeac) 'udevice.exe'
PC=c01a5d84(gwes.dll+0x00055d84) RA=c01a5d6c(gwes.dll+0x00055d6c) SP=d137fdd8, BVA=00000104
Autonegociation Start (ticks=4633)
+StartAutoNegotiation: pDeviceContext 0xd05694c0
Exception 'Raised Exception' (-1): Thread-Id=047a0002(pth=8372bc20), Proc-Id=03a50006(pprc=837eeee0) 'recoverInfiniiVision.exe', VM-active=03a50006(pprc=837eeee0) 'recoverInfiniiVision.exe'
PC=400233d0(coredll.dll+0x000133d0) RA=803782c8(kernel.dll+0x000062c8) SP=0005fd1c, BVA=00000000
Exception 'Raised Exception' (-1): Thread-Id=04820002(pth=8372bc20), Proc-Id=03a5000a(pprc=837eeee0) 'recoverInfiniiVision.exe', VM-active=03a5000a(pprc=837eeee0) 'recoverInfiniiVision.exe'
PC=400233d0(coredll.dll+0x000133d0) RA=803782c8(kernel.dll+0x000062c8) SP=0005fd1c, BVA=00000000
Exception 'Raised Exception' (-1): Thread-Id=048a0002(pth=8372bc20), Proc-Id=03a5000e(pprc=837eeee0) 'recoverInfiniiVision.exe', VM-active=03a5000e(pprc=837eeee0) 'recoverInfiniiVision.exe'
PC=400233d0(coredll.dll+0x000133d0) RA=803782c8(kernel.dll+0x000062c8) SP=0005fd1c, BVA=00000000
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on August 30, 2019, 06:41:37 pm
 :popcorn:It is probably because of something TheSteve already said... there is scope data stored at the factory on the NAND that is not going to be restored if you replace the memory chip
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 30, 2019, 07:25:07 pm
I've never tried installing a new NAND(as it is not needed for the corruption issue) but if I did I don't know how it would get formatted into a proper filesystem unless u-boot can do that automagically. And reading the needed information off the old NAND is also tough as it needs to be mounted as a filesystem so the scope unique data can be backed up.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on September 10, 2019, 02:33:55 pm
Hello, I have a DSOX2002A since 2013. https://www.eevblog.com/forum/reviews/my-new-toy- (https://www.eevblog.com/forum/reviews/my-new-toy-))-agilent-dsox2002a-sex-on-a-stick!/25/
There is an old cracked firmware in my scope that somebody gave me back in 2013 or so. I loaded it into my scope and it works since then. All options from 2013 are unlocked for me. :-) My 5 year warranty expired in 2018.
Is there a new cracked firmware available now? Or is it more complicated and I need a LAN board to do some dangerous steps? Is there a danger of bricking my scope?
Yes, I have read last posts and the process seems to be dangerous and complicated for me now. Thanks for help.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on September 10, 2019, 02:59:42 pm
Hello, I have a DSOX2002A since 2013. https://www.eevblog.com/forum/reviews/my-new-toy- (https://www.eevblog.com/forum/reviews/my-new-toy-))-agilent-dsox2002a-sex-on-a-stick!/25/
There is an old cracked firmware in my scope that somebody gave me back in 2013 or so. I loaded it into my scope and it works since then. All options from 2013 are unlocked for me. :-) My 5 year warranty expired in 2018.
Is there a new cracked firmware available now? Or is it more complicated and I need a LAN board to do some dangerous steps? Is there a danger of bricking my scope?
Yes, I have read last posts and the process seems to be dangerous and complicated for me now. Thanks for help.
Firmware 2.50 is available and can be installed through the menu system with no LAN required. As always there are no guarantees and you do this at your own risk but most if not all issues seem to stem from people not RTFM. Read the post linked below.

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on September 11, 2019, 02:36:06 pm
OK, I did the upgrade with a help from a forum member. My scope seems to be working OK. There is now a 200 000 waveforms / sec update rate.
As scribble wrote, rename from .ksx to .cab if current scope fireware is older than v2.41. I had to do it!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on September 11, 2019, 02:55:47 pm
Does anyone have an idea what the official bandwidth upgrades for the 3000T series cost? As far as I can tell no one lists the actual prices which is utterly annoying.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on September 11, 2019, 03:04:48 pm
Does anyone have an idea what the official bandwidth upgrades for the 3000T series cost? As far as I can tell no one lists the actual prices which is utterly annoying.

https://www.altoo.dk/Oscilloscopes/Medium+3000T-4000X/Options+and+Upgrades/ (https://www.altoo.dk/Oscilloscopes/Medium+3000T-4000X/Options+and+Upgrades/)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on September 12, 2019, 01:02:26 am
In the US, Newark, for  one, lists them.  DSOXT3B1T104U = $10,564 for the 1GHz upgrade, returned to service center.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: B0B45 on September 12, 2019, 11:07:45 am
Hey Guys,

I consider to send my scope to Keysight for calibration.
The scope is hw and sw modded from 100Mhz to 500Mhz and has FW 2.50.
My plan is to reinstall the origial FW 2.50 before i sent it in.
Question: Can I always change back from the origial fw 2.50? Will there be leftovers of the fw hack after the FW update on the scope?
Do you think its a good idea to do a full calibration after the scope has been modified in general?

Regards B0B
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on September 12, 2019, 03:47:24 pm
Hey Guys,

I consider to send my scope to Keysight for calibration.
The scope is hw and sw modded from 100Mhz to 500Mhz and has FW 2.50.
My plan is to reinstall the origial FW 2.50 before i sent it in.
Question: Can I always change back from the origial fw 2.50? Will there be leftovers of the fw hack after the FW update on the scope?
Do you think its a good idea to do a full calibration after the scope has been modified in general?

Regards B0B
A 100MHz to 500MHz hack? Is that even possible?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlloyd1 on September 12, 2019, 04:34:25 pm
allegedly, the HW BW hack is possible if the hacker is skilled enough and uses the appropriate parts.

the question i have is if one performs the HW BW improvement hack, modifies the FW to include use HW BW improvement hack, then removes the modified FW hack by "downgrading" to the OEM FW before sending the unit in for servicing/calibration, won't the "downgraded" software be unhappy about the HW change and flag this for servicing when it goes in for calibration, causing a "warranty issue"?

mlloyd1
 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on September 12, 2019, 06:41:01 pm
There is no downgraded software, it is the same firmware for both the modded and original HW.

The HW mod to bring 100MHz - 200MHz to 500MHz involves changing the front end and also the resistors that change the model to be at least 350MHz base, so it is impossible to send it back to Keysight, even with the original factory firmware unless you replace back all the components to be the original 100MHz - 200MHz model.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rodpp on September 12, 2019, 07:45:20 pm
If you are paying for the calibration service, I see nothing wrong in sending a DSOX3014A hacked to 500MHz to calibrate as a DSOX3054A, of course paying for a DSOX3054A calibration service.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: B0B45 on September 12, 2019, 08:15:27 pm
Well, the problem is, if I send it in with just a altered Hardware they only can deny the service. But if the Firmware on this scope is manipulated I can get into real trouble because of copyright laws.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 12, 2019, 09:33:08 pm
The automated calibration routines they likely use won't work properly I don't think. A 200 MHZ scope modified to 500 MHz reports it is still a dsox3024 - so the cal computer interface won't go above 200 MHz. There won't be an override button for hacked scopes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rodpp on September 12, 2019, 09:39:52 pm
I don't think so, because one can buy a bandwidth upgrade. So a hacked DSOX3014A probably behaves like a upgraded DSOX3014A.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 12, 2019, 10:34:44 pm
I don't think so, because one can buy a bandwidth upgrade. So a hacked DSOX3014A probably behaves like a upgraded DSOX3014A.

That is different as the 100/200 MHz are always calibrated as a 200 MHz unit. The 350/500 are always calibrated as a 500 MHz model. So if you did buy the BW upgrade they are ready to go. But there is no official 200-500 upgrade that doesn't require returning the scope to Keysight which would change the official model # as well.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rodpp on September 12, 2019, 11:54:21 pm
Are you sure that the bandwidth upgrade changes the model #?

Be it a SW upgrade (100MHz to 200MHz) or a HW upgrade (100/200MHz to 350/500MHz), I suppose that the model number (and serial # too) does not change.

If they change model and/or serial #, it has potential to cause problems because: a) the model printed in front of the instrument will not match with the SW number anymore, including if you query it remotely; b) all papers related with that instrument will not match too, including proof of purchase, calibration data, etc; c) companies would must update their inventory, and changes in model and serial # could not be allowed.


EDIT: Anyone with a HW upgraded bandwidth or HW hacked could inform what model # the scope is showing?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on September 13, 2019, 12:19:49 am
I don't think the model number changes with the hardware mod.  When I modded my EDUX1002G to DSOX1102G, it still showed as EDUX1002G in the display.  The model number and serial number is written somewhere in the NAND memory.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 13, 2019, 01:11:35 am
The model number doesn't change when the BW is hacked via hardware or software. But if you send your scope back for an upgrade from 200 to 500 MHz the model number will change as they replace the entire mainboard.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rodpp on September 13, 2019, 01:58:07 pm
Ok, but if I remember correctly, inside the first firmware update package there was a tool to change the model number...

Does anyone knows a scope that had the bandwidth upgraded by Keysight (replacing the board) to confirm that?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dwaine on September 13, 2019, 02:44:46 pm
I would think that Keysight would be more than happy taking your money for a cal.  If it fails cal and the hardware BW hack is there.  They will just laugh and ship the scope back to you and charge your credit card for the cal.

Or if the tech is bored.  They will try to sell you a new board for more $$$$.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rodpp on September 13, 2019, 07:54:41 pm
The model number doesn't change when the BW is hacked via hardware or software. But if you send your scope back for an upgrade from 200 to 500 MHz the model number will change as they replace the entire mainboard.

I checked with Keysight, the model number remains the same.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: B0B45 on September 29, 2019, 11:16:46 pm
End of story: calibration successful, no adjustment required.

Edited because we have some experts here :D

I noticed some time ago that the screen (as shown in the appendix) is getting blury. My guess, there is moisture between the front glass and the screen itself. Does anyone have any idea how to clean it up? By disassembling the scope, I could not separate the screen and the glass.

With best regards
B0B
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 30, 2019, 01:39:15 am
You can remove the front glass - it is held in place with double sided tape around the edges on the LCD's I have seen.
I have used fishing line or dental floss between the glass and tape to remove it. You can then clean it and put the glass back in place.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: B0B45 on October 02, 2019, 11:27:46 pm
Hey Steve,
thanks for the tipp, the screen is now nice and clean.

But I noticed after the assembly my channel 4 is now high senitive to shocks on the surface of the scope. I added a screenshot of a singleshot.
Does somebody have an idee what causes this?
edit: It's fine on 50 Ohms or terminal resistor.

Best regards
B0B
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on October 02, 2019, 11:31:48 pm
I'd think a cold solder joint or cracked component.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jwalling on October 03, 2019, 08:59:59 am
A relay contact bouncing?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: B0B45 on October 03, 2019, 01:09:36 pm
Hey,

guess i found the error. It's the BNC connector.
I used a 1:1 probe on channel 1 on the solder spot on BNC and got the same result.
As soon as i touch the white isolator of the BNC the effect is gone.

Edit: I fixed it. It was the (too tight) screw next to the solder spot.   

-B0B
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: swineone on October 04, 2019, 10:53:37 pm
Hello everyone!

Sorry that I'm late to the party. I just got a used DSOX2004A and I'm interested in enabling some of the options, in particular the wave generator.

After reading back a few pages starting from the end, I found this extremely helpful post:

Thank You!
Worked perfectly :-+

For others wanting to do this, the Scopes for Dummies version as follows:

Download Phillyflier's patched firmware from post #2167 on page 87
Download Luminax's license patch from post #1529 on page 62
Extract license patch, open cmd window (if using MS Windows), navigate to license patch folder and rename infiniivision.lnk to .txt
Edit infiniivision.txt and replace text in the file with Odessa's modification from post#2197 on page 88
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID
Save and rename file back to .lnk
Copy firmware file (rename from .ksx to .cab if current scope fireware is older than v2.41) to FAT32 formatted USB drive
Copy licence files (2x .cab files and .lnk file) to same USB drive

Now go to your scope, turn on and plug in USB drive to front USB port
Press [Utility] > File Explorer, select the firmware file (3000XSeries.02.50.2019022736_patched.cab); then, press Load File, wait for scope to load and reboot.
Check firmware has updated to v2.5, if successful continue
Press [Utility] > File Explorer, select v241_link_install.cab file; then, press Load File, wait for scope to load and reboot.
Check licenses have all been added and if so... :clap: :phew:

Thank you to all those that made this possible  8)

I did a dry run (download files, edit .lnk file, etc.) but I'm a little bit afraid of actually going ahead with this and bricking my shiny new toy (used, actually, but whatever...) Hence I came to check with you guys, since a few of you have done this so often I imagine it's second nature by now.

First of all, has anyone ever heard of this process bricking any scopes? I know there's no such thing as 0% probability in this case, but if it hasn't happened yet, I'll feel better about trying it.

My scope, like I said, is a DSOX2004A, and is currently at FW version 02.41.2015102200. I understand I can still use the patched images even though they refer to 3000X since, according to another poster here:

Hi,
The 2000 and 3000 are the same firmware. I used the 2.5 firmware posted by phillyflyers to upgrade to 2.5.

Then I created the lnk file using the code I posted and replaced the one in the hack posted by Luminax.

After the scope rebooted I ran the install.cab in Luminax's hack and that's it.

I also unlocked my 2004A using the above and it works perfectly, no nag messages, fully unlocked.

Edit: To answer your question about which firmware I started with, I used official 2.41 but I've flashed modded 2.43 and modded 2.5 whilst trying different things. The scope accepted them all without a problem.

Is that correct? Can I use the instructions above by scribble in my DSOX2004A with 02.41 FW?

Finally, although it appears to be implied, I just wanted to make extra sure no hardware hacks are required, no LAN/VGA modules, etc. Can I do the process above on a bare scope that's never been tinkered with?

If anyone helps me I'd be immensely grateful -- and should you ever stop by Brazil I promise to cook you a marvelous dinner and make some strong caipirinhas!

EDIT: one last question: from the instructions, I shouldn't have to rename the .ksx file to .cab since I'm on FW 02.41 -- if anyone could confirm this is the case I'd also be grateful.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on October 04, 2019, 11:37:17 pm
You should be fine. As far as I'm aware anyone who ran into trouble neglected to follow instructions carefully. The upgrade works on 2000X models too.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: swineone on October 05, 2019, 12:11:25 am
You should be fine. As far as I'm aware anyone who ran into trouble neglected to follow instructions carefully. The upgrade works on 2000X models too.

It worked! I can't thank you enough! I owe you this!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on October 05, 2019, 02:34:30 am
It worked! I can't thank you enough! I owe you this!
I'm just a parrot. Thank the people who made this all possible. Enjoy your scope!  :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on October 08, 2019, 08:32:54 pm
Just for the record, I include a list of the Options as seen in the FW of the 3000/4000.

BTW, I have looked at FERCSA hack for the 1002X series and I would be very surprised if his hack couldn't be applied to the 3000 and 4000 series.

Seems a simple and clean solution.

Edit: an updated list is here (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3823583/#msg3823583).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on October 08, 2019, 11:01:06 pm
Jitter mode is available only in 6000.. Enabling jitter on 3000T would be epic ..
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on October 09, 2019, 01:12:06 am
I tried FERCSA's hack on my 1000X and it enables a lot of options, but most of them do not work.  The options are in the firmware probably because they share codebase with other models, but the hardware is not the same.  But definitely was a 1000X on steroids after the hack
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on October 09, 2019, 07:52:28 am
I tried FERCSA's hack on my 1000X and it enables a lot of options, but most of them do not work.  The options are in the firmware probably because they share codebase with other models, but the hardware is not the same.  But definitely was a 1000X on steroids after the hack

The hack enables all the options present in the FW (it's easier to do like that). The same would happen in the 3000/4000, as you say, because they all share the codebase. Of course, if the HW doesn't support them, no need to try those options.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on October 09, 2019, 11:10:05 am
I tried FERCSA's hack on my 1000X and it enables a lot of options, but most of them do not work.  The options are in the firmware probably because they share codebase with other models, but the hardware is not the same.  But definitely was a 1000X on steroids after the hack

sorry, I am late to this party and I am still reading the thread from the start, but I cannot figure out what FERCSA hack is. I did a search in the thread but FERCSA doesn't show up. Could you please explain which hack you are referring to?
thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on October 09, 2019, 11:40:49 am
I tried FERCSA's hack on my 1000X and it enables a lot of options, but most of them do not work.  The options are in the firmware probably because they share codebase with other models, but the hardware is not the same.  But definitely was a 1000X on steroids after the hack

sorry, I am late to this party and I am still reading the thread from the start, but I cannot figure out what FERCSA hack is. I did a search in the thread but FERCSA doesn't show up. Could you please explain which hack you are referring to?
thanks
https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg2062735/#msg2062735 (https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg2062735/#msg2062735)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on October 09, 2019, 11:49:42 am
It should be easy to transpose the hack to 3000/4000.

In the meantime, i'll try a different approach.

If anybody could provide me of an example of an official license, that would be awesome.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on October 09, 2019, 12:23:52 pm
It should be easy to transpose the hack to 3000/4000.

In the meantime, i'll try a different approach.

If anybody could provide me of an example of an official license, that would be awesome.
PM sent
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yngndrw on November 16, 2019, 01:09:32 am
Perhaps a silly question but I've hacked my DSO-X 2002A and it's now running v2.50, but the serial LED doesn't illuminate when you enter the serial decode menu like they do for the digital, math and ref menus. Is that an issue with the hacked firmware or does this LED mean something else?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on November 16, 2019, 01:39:50 am
If I remember correctly, the LED will light when the two knobs are in alternate mode for DIGITAL, MATH and REF where they are scale factor (top knob) and position (lower knob).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yngndrw on November 16, 2019, 02:28:27 am
Just had another play with it.

The LEDs for digital, math and ref seem to light when that waveform is displayed, not when in the menu as I first thought. The knobs don't seem to affect them including the fine mode. (Unless you meant something else by alternate mode? Fine is the only mode I know about) The knobs in digital mode allow you to re-order or combine each individual signal, but the UI for it is horrible as you have to switch between the knobs to select the signal and press "enter".

No-matter what I tried, I couldn't get the serial LED to light.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on November 16, 2019, 04:24:54 pm
What I meant was that when a light is on, the upper knob adjust scale and the lower knob adjusts position, both for the selected function.

On my 4000A, which has the same keys in that area, I cannot find any way to turn on the serial LED.  I don't believe it is used.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yngndrw on November 16, 2019, 05:43:34 pm
Oh I see, so the LED signifies the function of the knobs rather than the on/off status of the function - That makes a lot of sense and certainly matches the behaviour of my scope. I guess they just didn't find reasonable functionality that the knobs could perform for the serial decoder.

Thank you for your help, you've cleared up that mystery.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on November 16, 2019, 06:34:06 pm
In a discussion with Agilent support several years ago:
Quote
Me: The green arrow LED next to the Serial button does not come on when a serial decode is being displayed.

Support person:  It's not supposed to.  The arrow indicates what those extra controls are operating on: digital channels, math, or reference.  They never apply to the serial stuff, so the light never comes on.

FYI.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yngndrw on November 16, 2019, 10:17:46 pm
Thanks for the confirmation, I wonder why they added the LED in the first place? Maybe they had a plan for those controls in the serial decoder and dropped them towards the end of the development?

Ah well, as long as the scope isn't broken that's the main thing.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bicycleguy on November 20, 2019, 10:42:56 pm
Thanks,
I learn something new about my 2014 every time I read this thread.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on November 21, 2019, 01:46:31 am
This might be a little old but looks like Keysight have new app bundles. Here is links related to 3000 A/T X-Series:

OLD: DSOXT3APPBNDL (https://www.keysight.com/en/pd-2494939-pn-DSOXT3APPBNDL/application-bundle-for-infiniivision-3000t-x-series-oscilloscopes?cc=US&lc=eng) $3600

NEW: D3000BDLA (https://www.keysight.com/en/pd-2990560-pn-D3000BDLA/ultimate-software-bundle-for-the-3000a-t-x-series?cc=US&lc=eng) $2530

I compared the app/software packages contained in each (listed in the brochure on each page) and didn't notice any difference.  Are they the same and this is just a revised SKU?  The new one is significantly cheaper -- is it missing something?

Or have the apps been revamped with new capability and you can only get it with purchasing the NEW app bundle?  I hope not!!

Anyone know details of this?

Similar situation for the 4000A series.

A little late on the reply here but I discovered that these ultimate bundles DO NOT INCLUDE WAVEGEN or the DUAL WAVEGEN2   :palm:  :palm:

But the new ultimate bundle plus wavgen add up to a bit less than the old full bundle (at least for the 4000A).

Edited to remove all rant material  :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cgz2001 on November 30, 2019, 10:26:27 pm
theSteve,

I have spent hours on this thread and am having trouble getting the information I need (I'm new to this).

1.) I have a DSOX2002A which will not boot up.  I'm not interested in hacking the instrument but rather simply getting it working again.
2.) I don't have a telnet ability as I don't have the LAN option installed.
3.) I also cannot find winCE cab manager 3.0 on the internet.

What steps can I take?  Can I simply place the .cab file onto a flash drive, formatted to FAT32, with the .txt file as previously indicated with 'TRUE' placed inside to boot up the instrument through the USB drive?  I suspect I need a link file in the USB drive but I am not clear on this.  Can you help me out?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on November 30, 2019, 11:17:30 pm
It probably has the NAND Flash problem, you could send it to Keysight for a free repair.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on December 01, 2019, 06:30:22 pm
Once in a while a NAND corruption issue can be fixed solely with a USB drive. When that isn't possible the lan option is preferred but the recovery image can be transferred via the serial connection.
If you did want to try fixing it yourself the first step would be to post exactly what it does, and then connect to the internal serial port.
As TK mentioned Keysight will often fix a NAND corrupted scope for free so may want to use that option.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Ordinaryman1971 on December 11, 2019, 04:44:07 pm
does anybody have a usb stick with "all I need" on it so I can upgrade my poor dsox3034a :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on January 18, 2020, 07:54:25 pm
DSOX2000 series is 9 years old now. Will Keysight release a new model soon??
Dave´s video was released on 15. 2. 2011

https://www.youtube.com/watch?v=S62G0F4B1q0 (https://www.youtube.com/watch?v=S62G0F4B1q0)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: myhobo on January 21, 2020, 08:35:16 pm
do you have msox4000 firmware version 7.20.20171026
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jrgandara on January 26, 2020, 03:35:08 pm
Hello all!

Need a little help from who have all this huge thread fresh in mind. 7 years ago I successfully re-flash my DSO-X2004A with the hack. Have being working great until last week when I get this message: "System concerns detected: OS version is not correct. Please reload system firmware". I ignored the message and keep using it. Today it will not boot. I tried reboot several times and finally it boot again with that system concerns alert". Well, it is time to take care of this problem before it stops completely.

I recall at that time to telnet the scope for the modified firmware. I get my files from that time and in the instructions say telnet the scope... Well, looking at the back panel, there is not LAN port. So I´m wondering if I did that of other manner, like with flash drive, or really by telnet. Reading my old instructions says telnet... But how? I´m very confident with a firmware update will fix this problem. So I have the following questions:

1) I really need a LAN board now? Why in the past it was not needed?

2) Is possible to do this using flash drive by the USB port?

2) How do you recommend perform this task today?

Ps: My firmware version is 2.35.20013061800

Thank you!


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on January 26, 2020, 07:17:56 pm
You don't need a LAN board any more, just a prepared thumb drive. See the message linked for the steps. I've seen that system concerns message before but I'm uncertain whether the booting issues might spoil your fun.

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jrgandara on January 26, 2020, 09:25:06 pm
Wow! Thank you a lot Mr. Scram!

You save me a lot of trouble. I remember last time a lot of reading to realize the correct procedure. This recipe is great! I will let you know later if fix the problem.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jrgandara on January 27, 2020, 01:20:51 am
Successfully updated and the firmware error message gone.

Thank you again!!!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on January 29, 2020, 11:29:49 pm
Successfully updated and the firmware error message gone.

Thank you again!!!
I'm glad things worked out!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sbvr4 on February 07, 2020, 02:49:20 pm
Hi all,
I have a DSOX3024T fw 7.20 that I am currently trying to access via Telnet. I am using a 3rd party LAN card. The screen displays System Concern: Faulty Network Card at start up. When I check the network settings, it displays a Network Failed status. Occasionally it will work right and display the IP address. Has anyone experienced this issue? May be my cheap RJ45 to usb converter.

Also, Does fw 7.20 end telnet access after booting, like 7.30? If so, what is the timing for accessing prior to the port being turned off at boot up? Has everyone changed the IP to a static address, so to enter it in Telnet prior to the unit booting? I only get the login failed notification after entering
login: infiniivision
pw: _________   

Any help would be greatly appreciated.

Thank you
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on February 08, 2020, 03:24:06 am
The 3000T with 7.20 does not timeout on access via Telnet.  Only for the T series, you do need to generate an appropriate PW.  Search the thread as it's easy to find.  I've always run a static IP.

Sorry can't help with debugging of the card.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on February 09, 2020, 11:09:37 am
......I have an original Keysight VGA+LAN card for the DSOX2000/3000 (a or T) series for sale......
Edit: Sold within minutes to a nice eevblog member from Hamburg.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sbvr4 on February 10, 2020, 11:02:52 pm
Does the 4k patched file also work for MSOX3000T series  :-// (because it has the same firmware revision number and date)?

Thanks in advance, Josef

Hey All,

the 3000T series is NOT quite the same, at least for the DLL, so here is the patched image for the 3kT series...7.20.2017102614

*** please notice:  3000T firmware is:  7.20.2017102614  *** (notice the 614 ending! ***
(*** 4000A firmware is:  7.20.2017102615  *** (notice the 615 ending! ***)


(same as before, patches and checksum already done)
Code: [Select]
1) options patch:  0x486f3c  --> "04 00 A0 E1" --> "00 00 A0 E3"
2) nag patch:      0x4f22c8  --> "A8 F1 93 E5" --> "01 00 A0 E3"

just unzip this file, and flash it to your scope (*MUST* already have the above firmware installed!)


http://www.mediafire.com/file/y18w4c6hxw85jt8/3kT_7.20_nk.bin.zip (http://www.mediafire.com/file/y18w4c6hxw85jt8/3kT_7.20_nk.bin.zip)


MD5 of the extracted .comp file:  <1B 76 32 CE FF 69 62 85 38 20 D3 E6 D2 5F E4 BC>


Thank you all for making this possible.
How should I go about flashing my 3000T with the patched firmware? I currently have the the unpatched  7.20.2017102615 loaded. I unzipped the .comp file and loaded it on a USB, but my scope doesn't recognize the file type. Any help would greatly appreciated. I need to do some more research. Sorry. 

Thank you
sdvr4
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jake111 on February 12, 2020, 06:31:22 am
Hi All,

I've recovered my DSO-X 3034A that suffered the crappy NAND problem.  However now my serial number and model number are gone.  Haven't had luck in getting the SCPI commands to set these from Keysight contact, does anyone know these commands?  I have found them for many other products but not these.  I assume they don't publish them to prevent duplication of serial numbers and corresponding multi-machine use of the same license key, however with these scopes being hacked six ways from sunday, I'm hoping someone here knows them and can help me out.

Otherwise, should I assume it's time to start digging through the firmware?

Or maybe someone knows the memory address where they are stored (must be in NAND?) and I can reconstruct this area from a dump that someone could kindly provide in exchange for my eternal gratitude :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: SrS on February 16, 2020, 10:31:28 pm
If you have access to the console you should have a hidden directory "\secure\cal" containing:
sernum.dat
framecal.dat
callog.txt
factorycal.dat

However the file doesn't contain the serial number in the usual format but might be worth experimenting, replace the '#' in attached file with numbers (ASCII)
Or try to get the first public firmware update and read from here (https://www.eevblog.com/forum/blog/new-agilent-scopes/msg39428/#msg39428)
Both methods are untested AFAIK

Hope your cal data is still intact :-BROKE
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kawal on February 23, 2020, 01:08:26 am
Thank you all for the knowledge.
Another successful hacked DSO-x-2012A  using USB only . 
The trick is to have files in the main directory not in any sub folders. It fails every time when files are not in the main directory.

 
I followed these instructions from page 89  written by scribble - thank you man - much easier to have it all in one place.


Download Phillyflier's patched firmware from post #2167 on page 87
Download Luminax's license patch from post #1529 on page 62
Extract license patch, open cmd window (if using MS Windows), navigate to license patch folder and rename infiniivision.lnk to .txt
Edit infiniivision.txt and replace text in the file with Odessa's modification from post#2197 on page 88
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID
Save and rename file back to .lnk
Copy firmware file (rename from .ksx to .cab if current scope fireware is older than v2.41) to FAT32 formatted USB drive
Copy licence files (2x .cab files and .lnk file) to same USB drive

Now go to your scope, turn on and plug in USB drive to front USB port
Press [Utility] > File Explorer, select the firmware file (3000XSeries.02.50.2019022736_patched.cab); then, press Load File, wait for scope to load and reboot.
Check firmware has updated to v2.5, if successful continue
Press [Utility] > File Explorer, select v241_link_install.cab file; then, press Load File, wait for scope to load and reboot.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on March 01, 2020, 01:58:17 am
DSOX 1000X Series:  FW:  01.20.2019061038_patched  https://mega.nz/#!DuIxzA7Q!8wYfTlHPuc4hF3UFPLoq0FOgylfsSVur4B5YSdCTn2I (https://mega.nz/#!DuIxzA7Q!8wYfTlHPuc4hF3UFPLoq0FOgylfsSVur4B5YSdCTn2I)
md5: <5A48A3492AD5BB23336236FDC6A12738>
AFAIK DSOX 1000X Series cannot be hacked using the infiniivision.lnk method.  The only known software hack is the modded firmware by FARCSA.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on March 01, 2020, 01:02:52 pm
Please let me know if there are any issues with any of these!
Unfortunately on a DSOX4000a: yes, there are issues
I had a (working) patched 7.20 before and installed your 7.30 with the result that the scope showed an error message (corrupted firmware) during the boot process. Next try will be a manual installation of your patched xxx.comp file ... but due to lack of time it will have to wait.
EDIT: I took the time and installed the original 7.30 (scope was working then) and then to write only the patched nk.bin.comp file (extracted from your patched KSX file) to the system like I did with the 7.20 firmware. Same result: after booting up -immediately after the Keysight logo is shown- the error message appears.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on March 01, 2020, 04:00:13 pm
It works now. Thanks a lot! :-+
Photo shows Firmware V7.30 with the new digitizer option where memory depth and sample rate can be selected manually (though time will show if this is really useful, as the scope did/does a good job by selecting it automatically so far and I seldom missed the manual option).

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on March 01, 2020, 09:01:35 pm
Thank you PhillyFlyers ! ! !

Keysight posted 7.31 just 4 days ago and the 7.30 cab is gone.

Just a reminder to always archive every new version  :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on March 01, 2020, 11:10:10 pm
Thank you PhillyFlyers ! ! !

Keysight posted 7.31 just 4 days ago and the 7.30 cab is gone.

Just a reminder to always archive every new version  :)

Wow, they released that fast, strange, as the changelog for 7.31 was kinda small.. oh well.. 7.31 was released for both 4000x and 3000x, so I put those two up in my post as well..

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on March 01, 2020, 11:20:55 pm
I'm getting the firmware error message for 7.30 on a 3000T.  Does that also have a checksum problem?

Thanks for the 7.31 update.  This is awesome  :-+

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on March 02, 2020, 12:17:25 am
There seems to be an issue with 7.31 for the 3000T.  The flash loader throws a parsing error on the image file.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on March 02, 2020, 01:18:33 am
I sent you a PM but will repeat here.

For 7.31 on the 3000T, the flash program throws a parsing error and constraint issues.  My PM lists the constraints (not met??).

Scope works ok after power cycling, but without any mods made.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on March 02, 2020, 01:35:52 am
Sorry about the tools problem but glad you found a possible cause !

Have you tried the "010 Editor" ?  It seems quite capable but I don't know if it has all the tools you need.  Comparisons, searches and checksums in any form are straightforward.


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on March 03, 2020, 12:05:09 am
Sorry about the tools problem but glad you found a possible cause !

Have you tried the "010 Editor" ?  It seems quite capable but I don't know if it has all the tools you need.  Comparisons, searches and checksums in any form are straightforward.

Yeah, I use the 010 editor for doing checksums and things, but I like a nice simple/raw hex editor for doing other tasks, I found HxD was fine, pretty much same as HexWorkshop but without mem bugs :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on March 03, 2020, 03:10:45 am
3000T and 4000A MD5s are not matching for me.  They did on the first set.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: travisc on March 03, 2020, 05:36:59 pm
So let's try this again... please try them and let me know....

Just updated my DSOX3034A using the new file (USB Method) and it worked great.  All options enabled.

Thanks!!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Caliaxy on March 04, 2020, 01:55:39 am
Great thread. I am not sure I am getting this right, but would hacking a DSOX2000 (using the USB-only method, which seems simpler to me) change the serial number of the oscilloscope? Is there any way to get back to the original configuration (serial number and official licenses already installed before hacking) if something goes wrong, or if you want to send the oscilloscope back to Keysight for service or calibration at a later time? Would you need a LAN board for that (saving/restoring the original configuration)?

Also, does the DSOX1000X hack refer exclusively to two channel version, i.e. DSOX1102A and DSOX1102G (but not the 4 channel versions, i.e. DSOX1204A and DSOX1204G)?

Sorry if the answers are supposed to be obvious from the previous posts.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 04, 2020, 05:47:53 am
Would be awesome if @Pinkus can report back on PhillyFlyers's latest v7.31 for DSOX4000A series  8)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HardDrive on March 04, 2020, 03:05:48 pm
DSOX 3000T Series:  FW:  7.31.2020012842_patched https://mega.nz/#!37BkWaCQ!JFJtIdT1p4m1BtULjw503jLpQDMjIV_cyzHRglBET-0 (https://mega.nz/#!37BkWaCQ!JFJtIdT1p4m1BtULjw503jLpQDMjIV_cyzHRglBET-0)
md5: <63DDE0129A9516C81DCF380F228BB08A>

Can confirm that this works on a MSOX3104T.
@PhillyFlyers, thank you very much for the easy to use package  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: travisc on March 04, 2020, 04:29:24 pm
Great thread. I am not sure I am getting this right, but would hacking a DSOX2000 (using the USB-only method, which seems simpler to me) change the serial number of the oscilloscope?
Using the USB method on my DSOX3034A did not change my serial number.

Is there any way to get back to the original configuration (serial number and official licenses already installed before hacking)
Yes.  Luminax's license patch from post #1529 on page 62 includes two .cab files.  One is used to change the license file, the other one can be used to restore the original file.  If you then installed an unpatched version of the firmware I'm assuming the scope would appear untouched.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: imett on March 07, 2020, 09:25:09 pm
Hi, i've some news about unbrick the 4000A series..(maybe someone know that  :-+)
Inside the cab 7.31.2020012900 there is a special bin , named "recover.nk.bin.comp" you can decompress and than convert into  "recover.nb0". With that you can use teraterm and load with YMODEM and command "loady 0x0361000 115200"

With "go 0x00362000" starts one application that permit upolad a standard firmware and so on..

Now my request, I need an old firmware for the 4000A, can someone help me?
Online there is only 7.31.2020012900  :-\
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 07, 2020, 10:32:09 pm
Hi, i've some news about unbrick the 4000A series..(maybe someone know that  :-+)

What "unbrick" are you trying to accomplish?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on March 07, 2020, 11:25:03 pm
Would be awesome if @Pinkus can report back on PhillyFlyers's latest v7.31 for DSOX4000A series  8)
I haven't installed 7.31 yet as the latest version doesn't show anything interesting for me. Thus I stay at 7.30 right now .... never change a running/working system if there is no need.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on March 08, 2020, 12:40:49 am
I can confirm that 7.31 works fine on an MSOX4000A.  Thanks PhillyFlyers !
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: imett on March 08, 2020, 06:36:07 am
Yeessss!! i confirm that the 7.31 works well.

I've a lot of trouble with my 4024A because  for mistake i put different files in startup with .lnk  |O (infinivision.lnk... old_infinivision.lnk...)
My 4024A resuscitate with the procedure above (it works 10's time)  but before understand my mistake i was thinking about the old firmare, for that reason my request..
In my experience with unbrick 2000A you could upoload the firmware (with YMODEM..) only with the same revision firmware  of the dead 2000A.

Thanks to everyone !! :scared: :scared:


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: vjcmain on March 16, 2020, 07:21:30 am
Can anyone tell me where to download previous firmware files (  Phillyflier's patched firmware from post #2167 on page 87 )?

I am trying to fix my scope using scribble method (thanks by the way)

Thanks to everyone !! :scared: :scared:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Gandalf_Sr on March 29, 2020, 11:12:56 am
If anyone wants to pick up a really nice MSOX4054A with the full APP bundle (not hacked), I just listed it here in the FS/W section (https://www.eevblog.com/forum/buysellwanted/fs-(us)-used-keysight-msox4054a-with-msox4000-bdl-calibrated/)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on March 29, 2020, 12:37:54 pm
Hello everyone,

Just updated my fw to 7.31 thanks to @PhillyFlyers.

Everything was ok with the file provided by our collegue, though I'm unable to have the .lnk correctly installed. I can manually run the infiniivisionlauncher.exe with all the licenses but my .lnk file copied to /secure/startup does not work as intended (it loads the os but with basic options).

Do those who installed successfully 7.31 on 3000T series, used the v241_link_install cab ?

Thanks..
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: stafil on April 05, 2020, 06:43:12 am
Anyone trying to hack the DSOX1204?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on April 13, 2020, 01:48:53 am
Hello everyone,

Just updated my fw to 7.31 thanks to @PhillyFlyers.

Everything was ok with the file provided by our collegue, though I'm unable to have the .lnk correctly installed. I can manually run the infiniivisionlauncher.exe with all the licenses but my .lnk file copied to /secure/startup does not work as intended (it loads the os but with basic options).

Do those who installed successfully 7.31 on 3000T series, used the v241_link_install cab ?

Thanks..

The manual install worked for me.  Be sure the count is correct and also, if you have an incorrect option, it may revert to a default set.  I made the mistake of not saving my prior, working .lnk so had to figure it out again  :-/O
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dmendesf on April 14, 2020, 11:34:15 pm
I have a 3024A with 2.35 stock firmware and a LAN card. I plan to upgrade it to 2.50 with all possible options. In the near future I plan to change resistors/inductors/capacitors in order to go to 5GSPS / 500MHz. Questions:

a) Can I use a .cmd script to copy the hacked files to flash?

b) or should I upgrade first to stock 2.50 and then use the LAN to upload the hacked files?

c) When I hack it can I add a key to upgrade to 500MHz (that will do nothing until I change the hardware) or this wouldn't work?

Thanks for your help....
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dmendesf on April 15, 2020, 02:59:25 am
Well I coudn't wait and decided to use PhillyFlyers's firmware for 3000X to update. I worked well, now I have firmware V2.50 hacked (I presume). Seems the only missing thing is a infiniivision file inside \Secure with a carefully constructed line. Question: Can I make a file like this:

CopyToFlash.cmd
---------------------------------------------------------------------
attrib -r \Secure\startup\infiniivision.lnk
copy \usb\infiniivision.lnk. \Secure\startup\infiniivision.lnk
---------------------------------------------------------------------

Can this script be run from USB? Do I need more commands do stop processes before copying the file?

Thanks for you all.....
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Gandalf_Sr on April 15, 2020, 11:34:11 am
I've got some Agilent 1156A and 1165A probes for sale (just listed) here in the FSW section (https://www.eevblog.com/forum/buysellwanted/fs-(us)-agilent-infiniium-compatible-scope-probes/msg3016572/#msg3016572) if anyone needs any?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: BaG on April 21, 2020, 02:37:08 pm
Hi Friends,

First thank you all for this great post and this great experience. I have a problem with my DSO-X 3014A that have a boot loop process problem (I don't know firmware version) and I don't like to hack it !! I just need to make it work again.

Boot description : 1- all Leds work 2- MegaZoom Screen with led process 3-Agilent technologies screen and reboot.

USB method : I tried 4 different USB in FAT32 format with Correct structure and I tired different firmware versions but not work and the USB blinking only at the start-up and end blinking when MegaZoom screen show-up and no more blinking after that like the system ignore it and not booting on USB.

Network method : I have a LAN module installed I can make a Telnet with login and password and I got : Pocket CMD v 6.00 and I can't do nothing because it's reboot quickly.

I hope that you can help me with your advice, I read all this thread and I see my similar case, but it's not working for me.

I still don't have firmware version 2.36 and 2.38 tested because I don't found them anymore if someone can share them please it's will useful.

Thank you so muck.


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: BaG on April 21, 2020, 07:50:48 pm
Hello Friend,

Python script solved the problem : telnet_dsox.py it's allow me to make telnet to DSOX and everything work fine but I can't make it to 2.35 (error loading firmware) and it's accept 2.37.

Now I have a question : it's will be better to upgrade it 2.5 to prevent Flash corruption again ?? because I don't need to patch it. and I need to calibrate it because I got an error "instrument uncalibrated"

Thank you so much for your help.

Best regards
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on April 21, 2020, 08:21:49 pm
Absolutely install version 2.50 to prevent further corruption.



Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: BaG on April 22, 2020, 12:29:56 pm
Hi my friends;

Today I will try new experience with another DSOX-2014A with boot problem and it's a nand corruption. I would like to try Steve Guide but before doing something wrong I have some questions and I need your advice :

1- The motherboard of the DSOX2014A it's not the same like FrankBuss demonstrated and I need a confirmation from expert about TX RX position (see image attached)
2- Important point : did the RS232 TX RX Male (2,3) can work in this situation? as I see there are some difference in voltage output in forums. and did Cisco RJ45 console cable can work in this situation? because I don't have the adapter with 3.3V.
3- If it's work, I need to start Putty serial connection first before starting DSOX and wait response?? because DSOX bug very quickly after 1-Ref  2-Math 3-digital and that all.

Thank you so much for your help.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on April 22, 2020, 12:57:55 pm
1) I do not know about the position on the DSOX2000 board. Somebody else must help.
2) DON'T / NEVER connect real RS232 Rx and Tx to the scope! The level will usually be somewhere between +- 5V and +-12V.
You MUST use a RS232-UART adapter with 3.3V signal level. Otherwise you will damage the microcontroller.
I do not know about this Cisco cable but it does not look like as there would be any electronics in it.
3) Yes, you will see immediate output after starting.

Hint: If you have a spare scope around, you should be able to measure the voltage level of your Cisco cable and also to find/check the Rx pin at your scopes motherboard. I am adding a picture (not mine - credits unknown) of the 3000a series, 2000 will probably the same connection scheme (though different position on the board).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: BaG on April 22, 2020, 01:31:23 pm
Thank you a Lot Pinkus,

1- Maybe I found a solution for the Serial communication : I have a Raspberry PI 3 with UART_TXD0 and UART_RXD0 Pins 3.3V, I think I will try Putty in Unix to test the connection with DSOX.
2- in my DSOX image do you think serial is in J2701 pins or in J2300 holes ??

Any help are welcome, Thank you !!

Regards.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on April 22, 2020, 02:18:36 pm
I do not know, but the two barley visible wires in layer 2 (which I marked red in my picture) will be very probably the UART lines. Thus the connection as shown should be correct.
But this is just a guess: you should measure the lines first!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: BaG on April 22, 2020, 09:53:08 pm
Thank you Pinkus a lot, I confirm it's correct TX/RX for model DSOX2014A.

Raspberry PI it's an alternative for serial cable because it's provide 3.3V UART voltage. now everything is correct and DSOX started an working again  :box: with TheSteve Guide  :-+.

Thank you ALL so much for this great work  :clap: . best regards.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: syw6616 on April 30, 2020, 04:01:12 pm
DSOX2012? Using  " 3000XSeries.02.50.2019022736_patched.ksx",Why?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on April 30, 2020, 06:49:27 pm
DSOX2012? Using  " 3000XSeries.02.50.2019022736_patched.ksx",Why?

I'm not sure what your question is but the firmware for the 2000 and 3000 series is the same.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: stafil on May 04, 2020, 08:37:52 pm
Ok,

So let's try this again... please try them and let me know....

I did NOT put any of the 7.30 patches up, as I assume just going with the latest 7.31 is fine?  (I can put up 7.30 if anyone still wants it)



These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things


*** Note:  ***

Upgrading the firmware ALWAYS replaces the .lnk file with the stock one, I didn't look into putting our custom .ink files into the .CAB/.KSX file (even though I'm sure we can), so REMEMBER to SAVE OFF your .lnk file somewhere before doing the upgrade.  This way after the upgrade is done, telnet in and copy/move your .lnk file back over..



DSOX 1000X Series:  FW:  01.20.2019061038_patched  https://mega.nz/#!mjB0FAQa!8wYfTlHPuc4hF3UFPLoq0FOgylfsSVur4B5YSdCTn2I (https://mega.nz/#!mjB0FAQa!8wYfTlHPuc4hF3UFPLoq0FOgylfsSVur4B5YSdCTn2I)
md5: <5A48A3492AD5BB23336236FDC6A12738>

DSOX 2000X Series:  FW:  02.50.2019022736_patched  https://mega.nz/#!HiBAEIrZ!gydBKQMpH93kKwPUog3e2dGR1eWTIglZbL2kwd6dRxk (https://mega.nz/#!HiBAEIrZ!gydBKQMpH93kKwPUog3e2dGR1eWTIglZbL2kwd6dRxk)
md5: <22E2508172382996B9ACF2852DB011F8>

DSOX 3000A Series:  FW:  02.50.2019022736_patched https://mega.nz/#!zmBkHCba!TK5Vf0N0LCeR3vYwx1fa41OekFXqg1psCYN-eagnvdY (https://mega.nz/#!zmBkHCba!TK5Vf0N0LCeR3vYwx1fa41OekFXqg1psCYN-eagnvdY)
md5: <CB931D537544D51D4EFFF44633506780>

DSOX 3000T Series:  FW:  7.31.2020012842_patched https://mega.nz/#!37BkWaCQ!JFJtIdT1p4m1BtULjw503jLpQDMjIV_cyzHRglBET-0 (https://mega.nz/#!37BkWaCQ!JFJtIdT1p4m1BtULjw503jLpQDMjIV_cyzHRglBET-0)
md5: <63DDE0129A9516C81DCF380F228BB08A>

DSOX 4000X Series:  FW:  7.31.2020012900_patched  https://mega.nz/#!7nQC0YYA!LN8kMBfHrh_OHCrrLKaHmJl6zxRhSQanycLwwnTLidA (https://mega.nz/#!7nQC0YYA!LN8kMBfHrh_OHCrrLKaHmJl6zxRhSQanycLwwnTLidA)
md5: <6F94C7500AF7D129B28F75DD0E35AE9D>

Please let me know if there are any issues with any of these!

Just installing this firmware didn't help much for me for a DSOX3014T. Are there more steps needed other than using this firmware?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: BaG on May 06, 2020, 05:11:54 pm
Hi friends,

One of my DSO-X3014A seems to have Calibration problem !! when I go to Cal Status : Failure: Factory Cal Failed !!  I explore the \secure\cal folder it's missing factorycal.dat !! I found only :
sernum.dat
framecal.dat
callog.txt

I am sure it's was factory calibrated before Nand Corruption and after correction each time I reboot the Scope I got the message : "Instrument is uncalibreated" !! and the auto scale not working any more message :"The Instrument must be calibrated".

I make a "User Cal" with BNC cables and everything passed fine but the message is not removed !!

Please my friends any chance to copy a new factorycal.dat from other Scope or there are a solution for this situation.

Thank you experts ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: skander36 on May 11, 2020, 10:02:36 am
Ok,

So let's try this again... please try them and let me know....

I did NOT put any of the 7.30 patches up, as I assume just going with the latest 7.31 is fine?  (I can put up 7.30 if anyone still wants it)



These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things


*** Note:  ***

Upgrading the firmware ALWAYS replaces the .lnk file with the stock one, I didn't look into putting our custom .ink files into the .CAB/.KSX file (even though I'm sure we can), so REMEMBER to SAVE OFF your .lnk file somewhere before doing the upgrade.  This way after the upgrade is done, telnet in and copy/move your .lnk file back over..



DSOX 1000X Series:  FW:  01.20.2019061038_patched  https://mega.nz/#!mjB0FAQa!8wYfTlHPuc4hF3UFPLoq0FOgylfsSVur4B5YSdCTn2I (https://mega.nz/#!mjB0FAQa!8wYfTlHPuc4hF3UFPLoq0FOgylfsSVur4B5YSdCTn2I)
md5: <5A48A3492AD5BB23336236FDC6A12738>

DSOX 2000X Series:  FW:  02.50.2019022736_patched  https://mega.nz/#!HiBAEIrZ!gydBKQMpH93kKwPUog3e2dGR1eWTIglZbL2kwd6dRxk (https://mega.nz/#!HiBAEIrZ!gydBKQMpH93kKwPUog3e2dGR1eWTIglZbL2kwd6dRxk)
md5: <22E2508172382996B9ACF2852DB011F8>

DSOX 3000A Series:  FW:  02.50.2019022736_patched https://mega.nz/#!zmBkHCba!TK5Vf0N0LCeR3vYwx1fa41OekFXqg1psCYN-eagnvdY (https://mega.nz/#!zmBkHCba!TK5Vf0N0LCeR3vYwx1fa41OekFXqg1psCYN-eagnvdY)
md5: <CB931D537544D51D4EFFF44633506780>

DSOX 3000T Series:  FW:  7.31.2020012842_patched https://mega.nz/#!37BkWaCQ!JFJtIdT1p4m1BtULjw503jLpQDMjIV_cyzHRglBET-0 (https://mega.nz/#!37BkWaCQ!JFJtIdT1p4m1BtULjw503jLpQDMjIV_cyzHRglBET-0)
md5: <63DDE0129A9516C81DCF380F228BB08A>

DSOX 4000X Series:  FW:  7.31.2020012900_patched  https://mega.nz/#!7nQC0YYA!LN8kMBfHrh_OHCrrLKaHmJl6zxRhSQanycLwwnTLidA (https://mega.nz/#!7nQC0YYA!LN8kMBfHrh_OHCrrLKaHmJl6zxRhSQanycLwwnTLidA)
md5: <6F94C7500AF7D129B28F75DD0E35AE9D>

Please let me know if there are any issues with any of these!

Just installing this firmware didn't help much for me for a DSOX3014T. Are there more steps needed other than using this firmware?

Hi Stafil ,
I don't know for sure if the process for the 3000 series is the same as for 2000 series , but after installing patched firmware , is not necesary to install v241_link_install.cab file from usb along with infiniivision.lnk ?

I think the procedure must be like this in post 2433 on page 88  - https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2932770/#msg2932770 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2932770/#msg2932770)

If you already did that please ignore this post ...
 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: stafil on May 13, 2020, 12:45:30 am
Ok,

So let's try this again... please try them and let me know....

I did NOT put any of the 7.30 patches up, as I assume just going with the latest 7.31 is fine?  (I can put up 7.30 if anyone still wants it)



These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things


*** Note:  ***

Upgrading the firmware ALWAYS replaces the .lnk file with the stock one, I didn't look into putting our custom .ink files into the .CAB/.KSX file (even though I'm sure we can), so REMEMBER to SAVE OFF your .lnk file somewhere before doing the upgrade.  This way after the upgrade is done, telnet in and copy/move your .lnk file back over..



DSOX 1000X Series:  FW:  01.20.2019061038_patched  https://mega.nz/#!mjB0FAQa!8wYfTlHPuc4hF3UFPLoq0FOgylfsSVur4B5YSdCTn2I (https://mega.nz/#!mjB0FAQa!8wYfTlHPuc4hF3UFPLoq0FOgylfsSVur4B5YSdCTn2I)
md5: <5A48A3492AD5BB23336236FDC6A12738>

DSOX 2000X Series:  FW:  02.50.2019022736_patched  https://mega.nz/#!HiBAEIrZ!gydBKQMpH93kKwPUog3e2dGR1eWTIglZbL2kwd6dRxk (https://mega.nz/#!HiBAEIrZ!gydBKQMpH93kKwPUog3e2dGR1eWTIglZbL2kwd6dRxk)
md5: <22E2508172382996B9ACF2852DB011F8>

DSOX 3000A Series:  FW:  02.50.2019022736_patched https://mega.nz/#!zmBkHCba!TK5Vf0N0LCeR3vYwx1fa41OekFXqg1psCYN-eagnvdY (https://mega.nz/#!zmBkHCba!TK5Vf0N0LCeR3vYwx1fa41OekFXqg1psCYN-eagnvdY)
md5: <CB931D537544D51D4EFFF44633506780>

DSOX 3000T Series:  FW:  7.31.2020012842_patched https://mega.nz/#!37BkWaCQ!JFJtIdT1p4m1BtULjw503jLpQDMjIV_cyzHRglBET-0 (https://mega.nz/#!37BkWaCQ!JFJtIdT1p4m1BtULjw503jLpQDMjIV_cyzHRglBET-0)
md5: <63DDE0129A9516C81DCF380F228BB08A>

DSOX 4000X Series:  FW:  7.31.2020012900_patched  https://mega.nz/#!7nQC0YYA!LN8kMBfHrh_OHCrrLKaHmJl6zxRhSQanycLwwnTLidA (https://mega.nz/#!7nQC0YYA!LN8kMBfHrh_OHCrrLKaHmJl6zxRhSQanycLwwnTLidA)
md5: <6F94C7500AF7D129B28F75DD0E35AE9D>

Please let me know if there are any issues with any of these!

Just installing this firmware didn't help much for me for a DSOX3014T. Are there more steps needed other than using this firmware?

Hi Stafil ,
I don't know for sure if the process for the 3000 series is the same as for 2000 series , but after installing patched firmware , is not necesary to install v241_link_install.cab file from usb along with infiniivision.lnk ?

I think the procedure must be like this in post 2433 on page 88  - https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2932770/#msg2932770 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2932770/#msg2932770)

If you already did that please ignore this post ...

Hey, thanks! I ended up getting a network card and following the steps your described. Basically just get the password from the password generator, telnet, and change the .lnk.

Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: skander36 on May 15, 2020, 02:03:27 pm


Hey, thanks! I ended up getting a network card and following the steps your described. Basically just get the password from the password generator, telnet, and change the .lnk.

Thanks!

Actually I used just the USB stick method .
As someone here said previously , I am just a parrot here . People that make this possible deserve thousands of thanks !
 :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pepperoni7 on May 15, 2020, 05:42:00 pm
Hi all,

first I want to thank all the contributors here doing a great job!
I have been following this topic as a silent reader almost from the beginning, but losing track here and then...
Now it's overwhelming to read through 100 pages!  :o  :phew:

I searched this topic a lot for answers to my questions, but unfortunately I could not find the solution that I was looking for.
So maybe someone can help me?!

I was wondering if it is already possible to add the licenses/options to a MSOX3104T (i.e 3000T series) only by FW update via USB?
It's suggested that it could be done in post#2448, page 98 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2945740/#msg2945740 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2945740/#msg2945740))
by including the modified .lnk file, but obviously was not done yet. How could one implement the options in the .lnk permanently?

In post #2201, page 89 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363))
such a process is described, but it seems this is only valid for a 2000A (maybe also 3000A), but not confirmed for 3000T series. Am I wrong?

And either way... what would be the options settings for 3000T series?
Regarding newest FW 7.31, I suspect D3000BDLA and WAVEGEN should enable all possible SW/HW features. Are there other (hidden/secret) switches to enable, to get everthing to work? How would the .lnk file would look like?

Any light into the dark would be highly appreciated!
Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: stafil on May 15, 2020, 09:13:28 pm
Hi all,

first I want to thank all the contributors here doing a great job!
I have been following this topic as a silent reader almost from the beginning, but losing track here and then...
Now it's overwhelming to read through 100 pages!  :o  :phew:

I searched this topic a lot for answers to my questions, but unfortunately I could not find the solution that I was looking for.
So maybe someone can help me?!

I was wondering if it is already possible to add the licenses/options to a MSOX3104T (i.e 3000T series) only by FW update via USB?
It's suggested that it could be done in post#2448, page 98 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2945740/#msg2945740 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2945740/#msg2945740))
by including the modified .lnk file, but obviously was not done yet. How could one implement the options in the .lnk permanently?

In post #2201, page 89 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363))
such a process is described, but it seems this is only valid for a 2000A (maybe also 3000A), but not confirmed for 3000T series. Am I wrong?

And either way... what would be the options settings for 3000T series?
Regarding newest FW 7.31, I suspect D3000BDLA and WAVEGEN should enable all possible SW/HW features. Are there other (hidden/secret) switches to enable, to get everthing to work? How would the .lnk file would look like?

Any light into the dark would be highly appreciated!
Thanks!

You will have to mess about with the .CAB files.

The rough steps would be:

1. Download the patched version.

2. Rename it to .CAB and extract it

3. Go in the folder and extract infiniiVisionSetup.CAB

4. Go in that folder and open the "INFINI~1.064" file and add the options you need.

5. Save it and do the opposite of steps 3 & 2. I.e. re-create the CAB files.


Or just buy a LAN card and do it over telnet. That's what I did.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pepperoni7 on May 16, 2020, 12:28:06 pm

You will have to mess about with the .CAB files.

The rough steps would be:

1. Download the patched version.

2. Rename it to .CAB and extract it

3. Go in the folder and extract infiniiVisionSetup.CAB

4. Go in that folder and open the "INFINI~1.064" file and add the options you need.

5. Save it and do the opposite of steps 3 & 2. I.e. re-create the CAB files.


Or just buy a LAN card and do it over telnet. That's what I did.

Thanx stafil,

the steps 1 -4 I could also find out in the meantime by myself.
But the Options in INFINI~1.064 are empty, although my scope tells me I have MSO, MEMUP, SGM, EDK, ADVMATH, DVMCTR and RML.
If I would miss these options in the -lnk file, would they get lost then or are they fixed in FW?

BTW, one of the main questions still is: What are the valid options to include in .lnk for a 3000T?
I found some hints here in this topic, but only saying "... 3000T uses same as 4000A" or vice versa, but no details  :-//

Or can the .lnk file on a 3000T also be applied (using v241_link_install.cab) like described here?
Post #2201, (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363))

Thanx
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on May 16, 2020, 03:41:55 pm
Pepperoni7

With regards to our PM, here are the resulting options ...


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pepperoni7 on May 16, 2020, 04:16:30 pm
EE-digger,

thank you! :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: stafil on May 16, 2020, 05:53:28 pm

You will have to mess about with the .CAB files.

The rough steps would be:

1. Download the patched version.

2. Rename it to .CAB and extract it

3. Go in the folder and extract infiniiVisionSetup.CAB

4. Go in that folder and open the "INFINI~1.064" file and add the options you need.

5. Save it and do the opposite of steps 3 & 2. I.e. re-create the CAB files.


Or just buy a LAN card and do it over telnet. That's what I did.

Thanx stafil,

the steps 1 -4 I could also find out in the meantime by myself.
But the Options in INFINI~1.064 are empty, although my scope tells me I have MSO, MEMUP, SGM, EDK, ADVMATH, DVMCTR and RML.
If I would miss these options in the -lnk file, would they get lost then or are they fixed in FW?

BTW, one of the main questions still is: What are the valid options to include in .lnk for a 3000T?
I found some hints here in this topic, but only saying "... 3000T uses same as 4000A" or vice versa, but no details  :-//

Or can the .lnk file on a 3000T also be applied (using v241_link_install.cab) like described here?
Post #2201, (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363))

Thanx

It's normal for the .lnk to not have an arguments in the original FW. The options are installed by the licenses.

Not sure about all the valid options. But when I would put a non valid options, it would just ignore it. So don't worry about it. The options I put for my case were:

MSO, MEMUP, SGM, BW20, EMBD and WAVEGEN as those were the ones I cared about.

Thanks,
Stavros
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on May 17, 2020, 03:21:12 pm
sorry, I am late to this party and I am still reading the thread from the start, but I cannot figure out what FERCSA hack is. I did a search in the thread but FERCSA doesn't show up. Could you please explain which hack you are referring to?

FERCSA's hack was done for the 1000X series. 

If I'm not mistaken, it's basically the same hack that is currently implemented in Rigol's MSO5000/7000 scopes: all the options available are enabled by default.

The difference between that hack and the current one that PhillyFliers applied to all KS models (that you all seem to be using in this thread) is that you don't need to mess with the .lnk file. Nonetheless I also like the simplicity of this hack.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on May 17, 2020, 03:30:42 pm
The options that people usually activate in 3000/4000 are: DIS, MSO, BW20/BW50, VID, SCPIPS

Looking at this table (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2729844/#msg2729844), there are some options that none of you enable:

FPGAX, TEL, FRC and RAST

Has anyone experimented with them?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: arlvaljr on May 20, 2020, 07:58:57 pm
I just want to report a tip I used to hack my MSOX 3022T.

After install the PhillyFliers modified update 7.31 (Thanks a lot to him) , I tried to place the new infiniivision.lnk to work on the "Secure\Startup" folder but it fails all the time, no matter the script I used. On every boot the scope just returned its original licenses.

In the other hand, after kill the running infiniivisionLauncher.exe on the scope and put a command to run the infiniivisionLauncher.exe with options directly from the Telnet , it worked perfectly opening every license requested.

Researching the internet about WinCE lnk files structure, I found a note about fail to transfer or copy WinCE 6.0 lnk files from a Windows 10 system, that was my case. In this note, there was a recommendation to transfer or copy the lnk files named as .txt file to the WINCE system and then, rename the txt file to lnk file from inside the WinCE system.

Also I noticed that the recommended structure for the WinCE lnk file was like the example bellow:

81#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l D3000BDLA - l WAVEGEN

Note the quotes around “\Program Files\infiniiVision\infiniivisionLauncher.exe".

The number in the beginning is just the total number of characters after the "#" sign ("\Program Files\infiniiVision\infiniivisionLauncher.exe" –l D3000BDLA - l WAVEGEN).

So, I placed my modified  .lnk file named as .txt on a USB drive, and via Telnet renamed the original Secure\Startup\infiniivision.lnk file to Secure\Startup\infiniivision.bak, copied from the USB drive plugged on the scope the new infiniivision.txt file to the Secure\Startup folder and then, also via Telnet, renamed the infiniivision.txt to infiniivision.lnk. “BINGO”, all options were enabled together with the already installed licenses at the scope boot up.

Regarding the options, the D3000BDLA is the new bundle name to enable all possible options. Only need to add the WAVEGEN, that is not part of the new bundle. For reference download the May 2019 revised User Manual from Keysight, and check on “License Options Available” (stays around page 399 of User Manual), for the old license names and the replacement new licenses available. Of course, the old names still works but, use just one option name is easier  ;D ;D ;D.

Sorry for the long text, but may be usefull.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pepperoni7 on May 21, 2020, 07:01:18 am
Think it rather should be
80#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l D3000BDLA -l WAVEGEN
instead of
81#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l D3000BDLA - l WAVEGEN
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: arlvaljr on May 21, 2020, 03:20:27 pm
Correct Pepperoni7 I wrote an extra space after the minus simbol on this post by mistake. Should't have this space and the count goes to 80 not 81.

The file I installed on my Scope is correct and working.

I used the "010 Editor" to easy count the number of characters when I was preparing the post example, I didn't realize about the extra space.

Sorry for the mistake  :palm:.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: arlvaljr on May 21, 2020, 04:53:12 pm
Regarding the list of options I downloaded the "User Manual" in English and took pictures from the list of options to show which replaces which one.

The post of tv84 have more options but several of them do not work on my model and there are some that becomes annoying like the DIS (Distribution). When I tried the DIS, as the license is installed every boot, it brings a demonstration screen that need to be switched off every boot.

Most of the licenses on the tv84 post, which works on my model (MSOX 3022T), seems to be inside of one of the new options given in the User Manual.

Sincerely, I am very happy with the D3000BDLA and WAVEGEN options, there is a lot o functionalities to be searched on them for a while.

PS: The -l ALL still works if wanted.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on May 21, 2020, 05:14:47 pm
Most of the licenses on the tv84 post, which works on my model (MSOX 3022T), seems to be inside of one of the new options given in the User Manual.

Sincerely, I am very happy with the D3000BDLA and WAVEGEN options, there is a lot o functionalities to be searched on them for a while.

PS: The -l ALL still works if wanted.

You don't need to install DIS, just the ones missing in the D3000BDLA bundle.

From my table I would say ALL shouldn't work (and if it works by itself then that's a mystery for me).

The table should represent which licenses are inside others...

But you, owners of the equipment, should know that better than me.

Additionally, I would say that manual pages have other information that is not corroborated by the table (for example: VID - I think there is no bundle that contains VID option, except by explicitly enabling VID).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: arlvaljr on May 21, 2020, 08:32:01 pm
Most of the licenses on the tv84 post, which works on my model (MSOX 3022T), seems to be inside of one of the new options given in the User Manual.

Sincerely, I am very happy with the D3000BDLA and WAVEGEN options, there is a lot o functionalities to be searched on them for a while.

PS: The -l ALL still works if wanted.

You don't need to install DIS, just the ones missing in the D3000BDLA bundle.

From my table I would say ALL shouldn't work (and if it works by itself then that's a mystery for me).

The table should represent which licenses are inside others...

But you, owners of the equipment, should know that better than me.

Additionally, I would say that manual pages have other information that is not corroborated by the table (for example: VID - I think there is no bundle that contains VID option, except by explicitly enabling VID).

The VID triggering option is now part of D3000GENA that is also inside D3000BDLA.

The only thing that seems not to be inside D3000BDLA is the WAVEGEN that you must still order the old DSOX3WAVEGEN.

About the option -ALL, yes it works, at least on my scope, I tested it. May be newer manufacured sets do not accept this command, mine was purchased in 2015, if it makes any difference.

Anyway, everyone are free to make their own choice of options what I think it's great, isn't it! :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on May 22, 2020, 08:01:48 am
@arlvaljr

Please show a printscreen of your license list in the boot screen, with just D3000BDLA and WAVEGEN enabled.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: arlvaljr on May 22, 2020, 02:05:52 pm
@arlvaljr

Please show a printscreen of your license list in the boot screen, with just D3000BDLA and WAVEGEN enabled.

If I change my .lnk, I will just add -l SCPIPS like bellow:

90#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l D3000BDLA -l SCPIPS -l WAVEGEN

The other licences that apears on the screen are native from my scope, it’s not necessary  to add on my .lnk, they come anyway.

Follows the printscreen
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Cretone on June 01, 2020, 01:54:32 am
Hi all,

Been following this thread for years and I am about to embark on hacking my 4022a.  It currently has FW version 4.08.2016071800.  I have so far verified that I can telnet into the scope no problem.  As I see it, the following steps should get me where I want to be:


So, a few questions:
How are you guys copying files without a protocol to transfer such as ftp?
Do I really need to kill infiniivisionLauncher.exe before copying?
Does my .lnk file look correct?  The D4000BDLA is the current 4000 series bundle, so I figured I would go with that.

Many thanks to all contributing to this thread!  Amazing.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adranp on June 01, 2020, 06:47:05 am
:Cretone

You don't need ftp. You are copying from /usb (on the scope) within telnet console. The usb stick is connected to the scope when you need to copy.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Cretone on June 01, 2020, 12:36:10 pm
:adranp

Thank you for that.  Did not realize that I had access to the usb drive from telnet.  Feeling a little stupid, of course!

However, I am very happy to report that I have successfully "enabled" my 4022a and have all applications operating, although waveform gen was the one I was really interested in.

Note, I followed the steps above in my previous post except that I did not bother to kill infiniivision.exe.

I will post below the steps I followed for posterity and for anyone else that comes along looking to enable a 4000 series scope:


Much gratitiude to PhillyFlyers, arlvaljr and the community!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yingziwin on June 03, 2020, 01:56:20 pm
Hi!

Does anybody know where can I find the DSOX2K 2.35  firmware? The keystone website only lets you download the latest one (2.50).And I can't download from this thread.My e-mail address is 522384387@qq.com.

Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pilatus on June 05, 2020, 08:35:52 pm
That work  :-- :-+, Thank you a lot  :clap: :clap: :clap: i go to sleep 2 jours before go to my job.
I have only this message, i dont Know why, but all seem work

If you or anyone had the following message:
 
"System concerns detected:
OS version is not correct. Please reload system firmware"

... then you should try another set of infiniivision.lnk file parameters. The scope likely had issue with a parameter mis-match

What worked for me (2000 series), and cleared the warning was:
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID

I also tried the following one successfully:
108#infiniivisionLauncher.exe -l DIS -l MSO --perf -l MEMUP -l BW20 -l ADVMATH -l SCPIPS -l CABLE -l VID -l EMBD

This one, for instance, created the OS mismatch nag/warning (I believe it was meant for the 3000A series):
160#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO --perf -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l TOM -l BW20 -l ADVMATH -l EMBD -l EDK -l VID

I used the USB memory stick option. Worked a treat.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pilatus on June 07, 2020, 03:06:59 pm
After upgrading my 2000A scope and plugging in a USB keyboard ... it works! Now I can select drop-downs and enter characters for labels and such. 

Wish there was mouse support as well, or at least "real" Left/Right keyboard cursor support. Still.... happy camper :clap:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: albertr on June 20, 2020, 06:30:40 am

Hey, thanks! I ended up getting a network card and following the steps your described. Basically just get the password from the password generator, telnet, and change the .lnk.

Thanks!

stafil: So your MSOX3104T is running firmware 7.31 and you still can telnet into it???

I had very old 4.xx firmware on my 3000T series scope originally (hasn't been updated since 2015) and telnet was working fine. However, after upgrading to firmware 7.31 (from keysight, not patched one from PhillyFlyers user) I cannot telnet into it anymore. Telnet port becomes available for just a few seconds before the main GUI app starts, but even this is not long enough for me to telnet into it. I've tried to use telnet_dso.py python script posted on this thread and even wrote my own python script, but still cannot get into it. Does anyone have the same issue with newer firmware and telnet? I'm hesitant with trying any mods if I cannot telnet into the scope to revert or fix it.
Any suggestions are much appreciated!
-albertr
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pepperoni7 on June 20, 2020, 07:12:54 am

@stafil: So your MSOX3104T is running firmware 7.31 and you still telnet into it?
I had very old 4.xx firmware on my 3000T series scope and telnet was working fine. However, after upgrading to firmware 7.31 I cannot telnet into it anymore. Telnet port becomes available for a few seconds before the main GUI app starts, but even this is not long enough for me to telnet into it. I've tried to use telnet_dso.py python script posted on this thread and even wrote my own python script, but still cannot get it. Does anyone have the same issue with newer firmware? I'm hesitant on trying to modify options if I cannot telnet into the scope to revert it.
Any suggestions are much appreciated!
-albertr

You should use "optimized" FW, then Telnet is no problem:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2945740/#msg2945740 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2945740/#msg2945740)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: albertr on June 20, 2020, 07:43:11 am
So, are you saying that PhillyFlyers made some hacks in this firmware to specifically "fix" telnet server? I think I read all posts on this thread (took a few days), but don't recall anyone mentioning that...

PhillyFlyers, can you confirm whether your 7.31 firmware includes "fix" for the telnet availability issue? I'm eager to try it, but I need to make sure that telnet would work when I need it. Right now, on a stock 7.31 firmware for 3000T from Keysight website (ver. 07.31.2020012842) telnet gets enabled for just a few seconds which is not long enough for me to get in. I'm using a stock LAN/VGA card on MSOX3034T if it matters. Never had problems with telnet on the old 4.xx firmware running on this scope before I upgraded to 7.31.

BTW, big thanks to everybody for sharing the information!

-albertr
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pepperoni7 on June 20, 2020, 08:46:01 am
I'm talking about my own experience with both the FW versions.
With PhillyFlyers' one you can Telnet in with no problem and (I suppose alsmost) no timeout restrictions.
At least I  could not experience a timeout for Telnet session.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: albertr on June 20, 2020, 04:42:46 pm
Yes, I'm happy to confirm that PhillyFlyers's modified firmware fixed the telnet issue on my scope!
Now it's time to liberate some options...

Thank you PhillyFlyers and other helpful members of this forum!

-albertr
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: albertr on June 20, 2020, 07:25:39 pm
The scope was liberated. Big thanks to everybody who made it happen!

-albertr
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: hugo on July 06, 2020, 03:01:22 pm
Has anyone done it for a DSOX 1000 scope?

It seems that 1000XSeries.01.20.2019061038_patched.ksx is not better than the stock 1000XSeries.01.20.2019061038.ksx in terms of the features installed ... :(

DSOX1102G

Bandwidth: 70MHz

Installed licenses: SGM, MASK, EDK,  WAVEGEN, DVM, RML
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on July 06, 2020, 05:52:34 pm
I dont think the hack works for the 1000x series. Look for FERCSA hack instead
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on July 06, 2020, 06:21:40 pm
I suspect PhillyFlyers's patch could work on a WinCE 1000X. FERCSA patch works (maybe the current FW is not publicly patched).

There is no solution for a Linux 1000X without JTAG access.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on July 07, 2020, 02:44:48 am
I am not sure. Infiniivion.lnk hack never worked on the 1000x
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pion on July 24, 2020, 08:49:27 pm
For anyone who's tried this on a 4000-series scope, could you clarify two things for me?
(I have a DSOX4024a at the base 200 MHz and I already purchased the app bundle for it, so the only things missing are MSO capability and a higher bandwidth.)

Also, as I've never unlocked anything previously – is it safe to assume that by going this route, I will effectively never be able to send my scope in to Keysight for calibration / repair / 1+ GHz hardware upgrades in the future because they'll see the non-factory firmware and punish me somehow? Or can I reflash the stock firmware before sending it in?

Thank you!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on July 24, 2020, 09:10:03 pm
1) Yes, 350 Mhz is a different board; though hacking from 350->500 Mhz would be possible
1a) if you dare: search EEVBlog for changing the input circuitry from 200 to 350 Mhz (probably explained for 3000a or 3000t which are using the same input circuitry)
2) Yes, no problem at all.
3) Reflashing the original firmware is no problem.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on August 06, 2020, 02:48:58 am
Hi,everyone.
Based on PhillyFlyers's file,I modified some file to realize hacking 3000T and 4000A osc with only one step.
Especially,I hack 3000T osc without using LAN module,I just using usb flash disk.
I notice that PhillyFlyers's file modified the infiniivisioncore.dll.
But for DSOX3024A,when I use the patched 2.50 firmware to hack it,and wirte the lnk file with
160#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO --perf -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l TOM -l BW20 -l ADVMATH -l EMBD -l EDK -l VID
it will display
System conerns detected:
OS version is not correct.Please reload system firmware.

but it does not impact using the osc.
when I write the lnk file with
211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC
the osc's BW will drop to 100MHz!!!

I have found the method to resolve System conerns detected problem,but I have not resolved BW50.

By the way,special thanks to PhillyFlyers.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 06, 2020, 03:10:15 am
You selected "BW50" for 500 MHz of bandwidth but your scope hardware can only do 200 MHz.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rodpp on August 06, 2020, 05:52:38 am

2. Have you been able to test the unlocked MSO feature with the actual MSO hardware cable? I'm happy to buy the ~$800 cable from Keysight but the $3100 SW unlock cost for it is a little prohibitive for home use!


If you don't care buying used stuff and can wait a good opportunity, ebays always have genuine used ones (branded HP, Agilent or Keysight) for as low as 1/10 of that price.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on August 07, 2020, 07:39:56 am
If anyone could please check my steps/understanding on my Jan 7 post -- a couple of questions I'd appreciate it much

Should I image the 3024A with 2.50 instead of 2.43?

Spring is here, I'll be out hiking...

Thank you,
NN


Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2084 on: January 07, 2019, 01:23:31 am »
ReplyQuoteModifyRemove
Hello again, and thanks for your help.

Acquiring a DSOXLAN, I'm finally ready to do the upgrade to my 3024A running "factory" 2.43, applying the latest patched 2.43 (and it is a rainy weekend) -- I have a couple of questions please.

1/ Can anyone clarify the contents of the link file to enable all features available in the patched firmware -- for the 3024A?

From previous responses, I am not clear on if my modified link contents (cmd line) is correct -- specifically, the preceding "211#..." which I  think would have been OK if I had the 350MHz model, and appears to represent the length of the infiniivisionLauncher.exe cmd line not including the preceding "211#".

"211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

The above (not for my scope) is indeed 211 characters in length so it makes sense (to me) I need to change that number.

Is the below correct (I removed "-l BW50" alone) -- with the # of characters now being 203? :

"203#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

As I am now clear I can revert back to the factory v2.43 if I am to sell the scope or send it in for cal, there's just one more thing:

2/ Should I expect the "unsealed instrument" warning to appear after in the liberated 2.43 -- and if so, can I ignore it (will it impact anything) or is there another patch to make that warning disappear?

Thank you kindly for verifying this and your help, best to all in 2019!

NorcalNerd

Does the new firmware 2.50 work with the hack?

I use the new firmware 2.50 to hack the 3024A,but I cannot open BW50
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on August 07, 2020, 07:46:15 am
If anyone could please check my steps/understanding on my Jan 7 post -- a couple of questions I'd appreciate it much

Should I image the 3024A with 2.50 instead of 2.43?

Spring is here, I'll be out hiking...

Thank you,
NN


Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2084 on: January 07, 2019, 01:23:31 am »
ReplyQuoteModifyRemove
Hello again, and thanks for your help.

Acquiring a DSOXLAN, I'm finally ready to do the upgrade to my 3024A running "factory" 2.43, applying the latest patched 2.43 (and it is a rainy weekend) -- I have a couple of questions please.

1/ Can anyone clarify the contents of the link file to enable all features available in the patched firmware -- for the 3024A?

From previous responses, I am not clear on if my modified link contents (cmd line) is correct -- specifically, the preceding "211#..." which I  think would have been OK if I had the 350MHz model, and appears to represent the length of the infiniivisionLauncher.exe cmd line not including the preceding "211#".

"211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

The above (not for my scope) is indeed 211 characters in length so it makes sense (to me) I need to change that number.

Is the below correct (I removed "-l BW50" alone) -- with the # of characters now being 203? :

"203#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

As I am now clear I can revert back to the factory v2.43 if I am to sell the scope or send it in for cal, there's just one more thing:

2/ Should I expect the "unsealed instrument" warning to appear after in the liberated 2.43 -- and if so, can I ignore it (will it impact anything) or is there another patch to make that warning disappear?

Thank you kindly for verifying this and your help, best to all in 2019!

NorcalNerd

Does the new firmware 2.50 work with the hack?

I use the new firmware 2.50 to hack the 3024A,but I cannot open BW50

You cannot and you never will this way. It has been said many times here before.
100 and 200 MHz is one mainboard,  350 and 500Mhz is different board.  Only way to go to 500 MHz is to make changes to mainboard (with soldering iron, changing components) and then, with software set it to 500 MHz.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on August 07, 2020, 10:26:29 am
If anyone could please check my steps/understanding on my Jan 7 post -- a couple of questions I'd appreciate it much

Should I image the 3024A with 2.50 instead of 2.43?

Spring is here, I'll be out hiking...

Thank you,
NN


Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2084 on: January 07, 2019, 01:23:31 am »
ReplyQuoteModifyRemove
Hello again, and thanks for your help.

Acquiring a DSOXLAN, I'm finally ready to do the upgrade to my 3024A running "factory" 2.43, applying the latest patched 2.43 (and it is a rainy weekend) -- I have a couple of questions please.

1/ Can anyone clarify the contents of the link file to enable all features available in the patched firmware -- for the 3024A?

From previous responses, I am not clear on if my modified link contents (cmd line) is correct -- specifically, the preceding "211#..." which I  think would have been OK if I had the 350MHz model, and appears to represent the length of the infiniivisionLauncher.exe cmd line not including the preceding "211#".

"211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

The above (not for my scope) is indeed 211 characters in length so it makes sense (to me) I need to change that number.

Is the below correct (I removed "-l BW50" alone) -- with the # of characters now being 203? :

"203#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

As I am now clear I can revert back to the factory v2.43 if I am to sell the scope or send it in for cal, there's just one more thing:

2/ Should I expect the "unsealed instrument" warning to appear after in the liberated 2.43 -- and if so, can I ignore it (will it impact anything) or is there another patch to make that warning disappear?

Thank you kindly for verifying this and your help, best to all in 2019!

NorcalNerd

Does the new firmware 2.50 work with the hack?

I use the new firmware 2.50 to hack the 3024A,but I cannot open BW50

You cannot and you never will this way. It has been said many times here before.
100 and 200 MHz is one mainboard,  350 and 500Mhz is different board.  Only way to go to 500 MHz is to make changes to mainboard (with soldering iron, changing components) and then, with software set it to 500 MHz.
Thank you.
I hacked a DSOX3034A,and its bandwidth reaches 500MHz.
But I see Keysight's web,200MHz to 350MHz for 3024A,does not need change board.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on August 07, 2020, 12:32:42 pm
..............
Thank you.
I hacked a DSOX3034A,and its bandwidth reaches 500MHz.
But I see Keysight's web,200MHz to 350MHz for 3024A,does not need change board.

Not correct.

DSOX3BW34 3000A X-Series 4-Channel Oscilloscope Bandwidth Upgrade: 200 MHz to 350 MHz:
 Return to service center required

DSOX3BW54 3000A X-Series 4-Channel Oscilloscope Bandwidth Upgrade: 350 MHz to 500 MHz:
 Upgrade instantly with the license-only upgrade. No return to service center required

From Keysight site.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on August 07, 2020, 01:24:05 pm
..............
Thank you.
I hacked a DSOX3034A,and its bandwidth reaches 500MHz.
But I see Keysight's web,200MHz to 350MHz for 3024A,does not need change board.

Not correct.

DSOX3BW34 3000A X-Series 4-Channel Oscilloscope Bandwidth Upgrade: 200 MHz to 350 MHz:
 Return to service center required

DSOX3BW54 3000A X-Series 4-Channel Oscilloscope Bandwidth Upgrade: 350 MHz to 500 MHz:
 Upgrade instantly with the license-only upgrade. No return to service center required

From Keysight site.
OK!
Thank you.
I see.
I know what is wrong.
I see the message in Keysight Chinese site,it said:
3000A X 系列 4 通道示波器带宽升级:200 MHz 至 350 MHz
通过在您的需求变化时将示波器带宽增加到 350 MHz,为您提供充分的投资保护
仅需许可证便可立即进行升级 无需送回服务中心
带宽升级适用于 DSO 和 MSO 型号
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on August 07, 2020, 02:58:06 pm
Help!
I have known how to convert nk.bin.comp to nk.bin,and how to convert nk.bin to  nk.nb0,and how to extract files from nk.nb0,and how to modify the infiniivisioncore.dll,but how to do the reverse process?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yingziwin on August 10, 2020, 01:55:50 pm
I've done extracting through serial on the board And I meet the same problem with you.All the LEDs don't light on.It show the same error and stops at BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.Do you solve it with the DSOXLAN module?Can you share the procedure?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on August 10, 2020, 02:47:29 pm
I've done extracting through serial on the board And I meet the same problem with you.All the LEDs don't light on.It show the same error and stops at BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.Do you solve it with the DSOXLAN module?Can you share the procedure?
If it is a NAND corruption problem, you can solve it following this guide: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on August 14, 2020, 02:54:56 pm
I made a file,and that file let MSOX2024A jump into WinCE UI.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on August 14, 2020, 02:59:16 pm
让是德Infiniivision DSOX/MSOX2000A示波器从正常界面跳到winCE界面的文件,感兴趣的朋友可以下载玩玩。
已在MSOX2024A(固件版本2.50)上测试有效。
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ElectronMan on September 07, 2020, 12:03:53 am
It appears I've managed to FUBAR the front panel on my 3034T by attempting installation of the "fixed" 7.31 firmware (from this post https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2945740/#msg2945740 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2945740/#msg2945740)). I can re-load different firmwares, but no more lights on the front-panel, and when I can get it to boot at all, it complains that there is no front-panel.

The touchscreen works fine.

UART console shows this:

Quote
WaitForKeyboardEvent FAILED
WaitForKeyboardEvent FAILED
Keyboard firmware version mismatch, 35 (binary) vs 255 (keyboard)
Programming keyboard firmware...
  Initializing UART...Exception 'Raised Exception' (-1): Thread-Id=0439001e(pth=89633780), Proc-Id=0436001e(pprc=8973daec) 'infiniivisionLauncher.exe', VM-active=0436001e(pprc=8973daec) 'infiniivisionLauncher.exe'
PC=40068ae0(coredll.dll+0x00058ae0) RA=803782c8(kernel.dll+0x000062c8) SP=0002cb34, BVA=0002cb98
SER2 Serial Port, new baud rate:0x2580  (UARTCLK:48000000 IBRD:0x138 FBRD:0x20)
SER2 Serial Port, new baud rate:0xe100  (UARTCLK:48000000 IBRD:0x34 FBRD:0x5)
 ok
  Unlocking flash memory... failed
Unsucessful programming of the keyboard (MicroCIdCheck failed)
Retry 1 keyboard firmware updating
Programming keyboard firmware...
  Initializing UART...SER2 Serial Port, new baud rate:0x2580  (UARTCLK:48000000 IBRD:0x138 FBRD:0x20)
Programming LAN option module...
Option module FPGA programing DONE...
SER2 Serial Port, new baud rate:0xe100  (UARTCLK:48000000 IBRD:0x34 FBRD:0x5)
SHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]
SHIM [AgilentPalWin32.dll] Get Process Addresses
 ok
  Unlocking flash memory... failed
Unsucessful programming of the keyboard (MicroCIdCheck failed)
Retry 2 keyboard firmware updating
Programming keyboard firmware...
  Initializing UART...SER2 Serial Port, new baud rate:0x2580  (UARTCLK:48000000 IBRD:0x138 FBRD:0x20)
SER2 Serial Port, new baud rate:0xe100  (UARTCLK:48000000 IBRD:0x34 FBRD:0x5)
 ok
  Unlocking flash memory... failed
Unsucessful programming of the keyboard (MicroCIdCheck failed)
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
Front Panel UART driver reset -- Contact ChrisG
ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\sh600_serial\.\sh600_serial_drv.cpp line 661: SER2 SER Driver: does not support multiple Open()'s
Error opening UART Driver.
Front Panel UART driver reset -- Contact ChrisG
ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\sh600_serial\.\sh600_serial_drv.cpp line 661: SER2 SER Driver: does not support multiple Open()'s
Error opening UART Driver.


My best guess here is that the firmware for the front panel is corrupted, and no longer responding to attempts to re-flash it. I'm currently trying to find the firmware in the installer, in case I need to try manually flashing it onto the chip (last resort).

Anyone have any other ideas?

I started from version 7.30, which unfortunately I don't seem to have archive anywhere. I've tried firmware 7.10, and the official 7.31 firmware, they all fail when attempting to reflash the front panel firmware.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 07, 2020, 02:03:20 am
Sounds like the processor on the front panel packed it in during the update process.
You should be able to remove the front panel, replace the processor, then boot up the scope and it will auto-program the processor for you. The part # I've seen previously is R5F212A7SNFP or R5F212A7SNFP#V2.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ElectronMan on September 07, 2020, 02:11:09 am
Oddly enough, I just took it apart and could not find a processor on the front panel... It is definitely talking to something over the SPEAR's 2nd UART, but I am having trouble finding the bugger so far.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ElectronMan on September 07, 2020, 03:28:14 am
Found it, apparently a Renesas R5F212A7 microcontroller. The NAND flash endurance in these chips is only 100 erasures. I wonder if it attempted to erase and reflash it one-too-many times while it was having the UART issues.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 07, 2020, 04:04:18 am
Told ya :)

Swap it out and it will magically come back to life on the next boot, no need to worry about programming it manually.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ElectronMan on September 07, 2020, 04:59:05 am
Sounds like the processor on the front panel packed it in during the update process.
You should be able to remove the front panel, replace the processor, then boot up the scope and it will auto-program the processor for you. The part # I've seen previously is R5F212A7SNFP or R5F212A7SNFP#V2.

How did I completely miss that when I read your post the first time?  :palm: Thanks for the info. Sounds a lot simpler than trying to get a front panel replacement.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on September 09, 2020, 01:57:16 pm
I see something in a DLL file:
   infiniiVisionWebCom.ScopeInfo.1 = s 'ScopeInfo Class'
   {
      CLSID = s '{DED1059F-0BB5-46D1-BDED-9A72968FD7AE}'
   }
   infiniiVisionWebCom.ScopeInfo = s 'ScopeInfo Class'
   {
      CLSID = s '{DED1059F-0BB5-46D1-BDED-9A72968FD7AE}'
      CurVer = s 'infiniiVisionWebCom.ScopeInfo.1'
   }
what does CLSID = s '{DED1059F-0BB5-46D1-BDED-9A72968FD7AE}' mean?
I believe that this information is very important,it is related to the change of scope model number.
And when I go into WinCE of DSOX2002A,I found a HostIDChangedHandler.exe file.when I run this exe file,it refers SecureDataTool!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ElectronMan on September 09, 2020, 08:42:30 pm
I see something in a DLL file:
   infiniiVisionWebCom.ScopeInfo.1 = s 'ScopeInfo Class'
   {
      CLSID = s '{DED1059F-0BB5-46D1-BDED-9A72968FD7AE}'
   }
   infiniiVisionWebCom.ScopeInfo = s 'ScopeInfo Class'
   {
      CLSID = s '{DED1059F-0BB5-46D1-BDED-9A72968FD7AE}'
      CurVer = s 'infiniiVisionWebCom.ScopeInfo.1'
   }
what does CLSID = s '{DED1059F-0BB5-46D1-BDED-9A72968FD7AE}' mean?
I believe that this information is very important,it is related to the change of scope model number.
And when I go into WinCE of DSOX2002A,I found a HostIDChangedHandler.exe file.when I run this exe file,it refers SecureDataTool!

The CLSID stuff is just a Windows COM object ID. These get registered in Windows on installation of the DLL (regsvr32, etc) and allow applications to load the COM object API interface by the class name (infiniiVisionWebCom.ScopeInfo). The CLSID is then looked up in the registry to find the appropriate DLL file. Nothing too interesting there.

Not sure about the HostIDChanged tool.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ElectronMan on September 11, 2020, 03:46:35 pm
Has anyone with a 3000 or 4000 series ever tried "CAKE" or "AFTER DUSK" as the screensaver text?

I saw CAKE mentioned previously but never saw a response. These don't work on my 1102G, but are in the DLL alongside TREK. Hopefully I can try them on my 3034T once I get it repaired.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on September 18, 2020, 12:22:27 pm
Jumped to this thread late, but can anyone point me a path to unlock some of the features of my DSOX3054T?

I ordered it with APPBNDL, but my distributor f*ed up and gave me the newer BDLA, which has all APPBNDL has but rest of WAVEGEN.

My distributor is not able to order a new license without hardware (some Keysight distro weirdness in China), and we don't have a plan for new hardware purchase.

The only he can do is to give me a credit of the same license in my next order, but that would be months if not years ahead.

I paid for WAVEGEN, and I want it enabled. How can I generate this option without risking bricking my scope?


Never mind. My distributor offered me one Rigol DG2052 per lost Keysight license to make up. Free 8-bit to 16-bit upgrade and 25MHz o 50MHz upgrades at the cost of some additional bench space is okay to me.
I think you cannot run Bode plot with external awg. Ask for the wavegen license or your scope will miss a valuable tool
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on September 18, 2020, 12:27:27 pm
Jumped to this thread late, but can anyone point me a path to unlock some of the features of my DSOX3054T?

I ordered it with APPBNDL, but my distributor f*ed up and gave me the newer BDLA, which has all APPBNDL has but rest of WAVEGEN.

My distributor is not able to order a new license without hardware (some Keysight distro weirdness in China), and we don't have a plan for new hardware purchase.

The only he can do is to give me a credit of the same license in my next order, but that would be months if not years ahead.

I paid for WAVEGEN, and I want it enabled. How can I generate this option without risking bricking my scope?


Never mind. My distributor offered me one Rigol DG2052 per lost Keysight license to make up. Free 8-bit to 16-bit upgrade and 25MHz o 50MHz upgrades at the cost of some additional bench space is okay to me.
I think you cannot run Bode plot with external awg. Ask for the wavegen license or your scope will miss a valuable tool

That is correct, you cannot.. FRA is pretty  much most important use of that AWG..
Other is realy easy way to clone channel capture into AWG and use variable noise addition...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on September 18, 2020, 02:24:44 pm
I think you cannot run Bode plot with external awg. Ask for the wavegen license or your scope will miss a valuable tool

Nah, I've never used it, and if I ever needed, there's the Analog Discovery for me.

At 20MHz, despite the beefy size and cost, the 8-bit Keysight doesn't stand a chance against 14-bit ADC and DAC.
I know there are other options, but OP paid for a feature and was given an alternative that is not the same value, that was my point

EDIT: @blueskull, you were the OP, sorry.  If the alternative works for you, then everything is OK
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 20, 2020, 02:37:55 am
Has anyone with a 3000 or 4000 series ever tried "CAKE" or "AFTER DUSK" as the screensaver text?

I saw CAKE mentioned previously but never saw a response. These don't work on my 1102G, but are in the DLL alongside TREK. Hopefully I can try them on my 3034T once I get it repaired.

CAKE = Text with the developer names and other text which changes.

AFTER DUSK = Flying scopes with wing and scope probes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ElectronMan on September 20, 2020, 02:56:27 am
Thanks, I saw a lot of that text from CAKE in the binary, and the AFTER DUSK is obviously a reference to the windows After Dark screen saver.

I've been digging into the R&S RTB2004 firmware and one thing I've noticed immediately is the complete lack of "Easter Eggs." They are all business.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on September 20, 2020, 03:36:32 am
Thanks, I saw a lot of that text from CAKE in the binary, and the AFTER DUSK is obviously a reference to the windows After Dark screen saver.

I've been digging into the R&S RTB2004 firmware and one thing I've noticed immediately is the complete lack of "Easter Eggs." They are all business.

Shame, it is always good to have a little fun.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on September 20, 2020, 02:47:01 pm
https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/
This link is void,who can give a new link?
Thank you!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on September 26, 2020, 10:32:10 pm
Has anyone with a 3000 or 4000 series ever tried "CAKE" or "AFTER DUSK" as the screensaver text?

I saw CAKE mentioned previously but never saw a response. These don't work on my 1102G, but are in the DLL alongside TREK. Hopefully I can try them on my 3034T once I get it repaired.

CAKE = Text with the developer names and other text which changes.

AFTER DUSK = Flying scopes with wing and scope probes.
Will this work on a DSOX2000A series scope??
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JFJ on September 27, 2020, 12:05:09 am
https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/
This link is void,who can give a new link?
Thank you!

The Internet Archive has cached that page, but not its linked files:
https://web.archive.org/web/20190411134148/https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/

However, the archived links do work on the original site (with the https://web.archive.org/web/20190411134148/ prefix removed), e.g:
https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/3000XSeries.01.10.2011031600.cab
https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/3000XSeries.02.10.2012022200.cab
https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/3000XSeries.02.20.2012110802.cab
https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/3000XSeries.02.30.2013032600.cab
https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/3000XSeries.02.35.2013061800.cab
https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/3000XSeries.02.37.2014052002.cab
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on September 28, 2020, 09:12:48 pm
CAKE = Text with the developer names and other text which changes.

AFTER DUSK = Flying scopes with wing and scope probes.
OK, this does not work on my DSOX2002A. :-( Are there any other possible secret passwords? (Yes, TREK works for me.)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bmwman91 on September 29, 2020, 08:32:19 pm
Hello! I have been lurking off & on in this thread for quite a while and finally decided to jump in since I am looking to "upgrade" from my Rigol DS1104Z-S Plus. It has served me well, but the ergonomics & speed just are not quite cutting it, at least not compared to the Agilent/Keysight stuff I get to use at work. I have an opportunity to get a pretty good deal on a used MSOX2024A, and I remembered this thread from a couple of years ago. My question is regarding which v2.5 firmware to use from this post:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2945740/#msg2945740 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2945740/#msg2945740)

I see there is FW for DSOX2000X, and DSOX3000A. It has been mentioned in here in a few places that the FW for 2000A & 3000A are the same, but I wanted to confirm that I will want to use the 3000A file on a 2024A, not the 2000X FW.

Thanks for all of the curiosity and hard work in here! I am continually impressed and encouraged by what the DIY community does!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bill Woodbridge on October 12, 2020, 07:34:21 am
A quick question on this well-worn topic please, with apologies as although I’ve studied this thread for about 3 weeks I’m still not absolutely sure of the answer.

Does PhillyFlyer’s patched firmware (2.50 for the 3000A series, in my case, details below) preserve the original .lnk file and its command line options once it is installed?  My understanding is that it does, and that the process of changing/fiddling about with the .lnk file happens as a second stage after the firmware installation.

I ask because I want to capture and preserve the scope’s original .lnk file in case I need to revert to it if I encounter problems, but I need the PhillyFlyer patched firmware installed first in order to be able to Telnet in reliably and copy off the original .lnk to USB (if I’ve understood correctly).

Other than this question I think I’m ready to dive in for a full ‘enhancement’ project.  If anyone can recommend the latest brew for the .lnk command line options I’d also be very grateful please.  I am unclear on the best ‘bundle’ option to use, as many of them seem to overlap:  D3000BDLA, ALL (I gather this achieves permanently enabled trial licenses with the * displayed, so I’d prefer not to go for that one), or DIS?  (I know BW20 and MSO, at least, must be included separately)

Many thanks for clarification and to all previous researchers - 'standing on the shoulders of giants' springs to mind.


DSOX3014A (100MHz)
Firmware 2.50 (recently installed successfully from the Keysight website)
LAN/VGA module fitted
Installed licenses shown on the ‘About’ screen: EDK, SGM, WAVEGEN, DVM, RML
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bill Woodbridge on October 13, 2020, 09:26:51 am

An update: I took the plunge and have now achieved a fantastic result (eventually, after a few pitfalls).  Here they are, based on my experience in the hope they might be useful for others.

I based my procedure on Cretone’s list post 2504 for which many thanks (modified for the 3000A obviously).  My own observations, setbacks, pitfalls etc in italics after each step

1.   Download PhillyFlyers’ 3000A series patched firmware 2.50 from the web to a FAT32 USB stick.

The hosting site mega.nz was blocked by my ISP – I needed to temporarily switch DNS servers to Google’s public DNS (8.8.8.8 and 8.8.4.4) to overcome this

2.   Plug the USB stick into the front USB port of the (running) scope, install the patched firmware via the standard firmware update procedure (Utility / File Explorer / goto USB / Load File).  Once the reboot is complete, keep the scope powered up.

Flawless update, scope rebooted immediately, no visible changes or warning messages – excellent. 

3.   Create a file infiniivision.txt with a raw text editor on a PC containing the infiniivisionLauncher command line with the options required (not forgetting to adjust the character count, ie the no. of characters to the right of the #).  Mine was:

93#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW20 -l MSO -l MEMUP

This was the biggest pitfall which took me a day to resolve.  The syntax for each option is hyphen then lowercase l then space then option code.  However, in most forum posts, the lowercase l looked to me like the pipe (vertical bar) character and even though I copied and pasted from the forum into my text editor and ended up (correctly) with lowercase ls, I was convinced it had translated them incorrectly and laboriously went through with a hex editor changing them back to pipes (unicode 7C).  (Eventually, through Telnet / CMD, I found the syntax for the infiniivisionLauncher.exe command and the penny finally dropped)

4.   Unplug the USB stick from the scope, save this infiniivision.txt file onto it, then replug it into the scope.  The file should now be visible through Utility / File Explorer.

Don’t be tempted to try and load the file into the scope like in step 2 – it’s not firmware!

5.   Time for Telnet: plug the scope into your local Ethernet, make sure the LAN config is set to automatic (Utility / I/O / LAN settings) wait for it to acquire an IP address (assuming you have a hub or similar with DHCP server capability connected).  Then Telnet into the IP address shown on the I/O information screen, username and password as per previous posts.  The Telnet window should then give the Windows CE command prompt:

Pocket CMD v 6.00
\>

Telnet was rock-solid throughout, and thanks to the patched firmware there seemed to be no restriction on having to time it to coincide with the boot-up phase of the scope.  I was dreading the networking, being an amateur, but simply plugging in to a typical home broadband network with a DHCP-serving hub it was incredibly easy and the scope sorted out its config automatically within seconds.  Alternatives are fiddling with static IP addresses, subnet masks etc and point-point Ethernet (scope – PC) with a crossover cable …

6.   Use the Telnet / CMD session to backup the existing .lnk, then transfer the .txt file from USB and rename it to .lnk thus:

rename \Secure\Startup\infiniivision.lnk \Secure\Startup\infiniivision.bak
copy \usb\infiniivision.txt \Secure\Startup\infiniivision.txt
cd \Secure\Startup
rename infiniivision.txt infiniivision.lnk

An initial worry was that even dir /a /s did not reveal the \Secure directory, however using cd \Secure will navigate to it and then enable dir to list its contents.  The original infiniivision.lnk file was present, but empty (0 bytes) and with the archive flag set - I backed it up nevertheless!  Note the copy command requires the full path and filename for both source and destination – just specifying the destination directory isn’t sufficient.  The cd into \Secure\Startup was necessary because attempting the rename from the root directory gave an error message that the command line (with the full path included in the filenames) was too long.  Finally, there are lots of ‘i’s in infiniivision, I lost count of the number of times I forgot the double i in the middle.

Historically the advice on the forum has been to kill the running inifiniivision.exe instance before doing the file manipulation, but lately this step seems to have been omitted in most recommendations.  I didn’t kill it, because I simply forgot all about that step.  Leaving it running didn’t seem to cause any problems, but of course the scope requires a reboot to pick up the new .lnk file and enable the options.


7.   Turn off the scope – a tense moment for potential bricking, as the die is now cast.  Turned on again, flawless and fast boot up, with all the newly-enabled options present and correct on the About screen (and enabled on the appropriate buttons etc).

This happy result was only after I had fixed the l / | confusion in the .lnk file of course.  When I was still blundering about with the pipe character, the scope booted up correctly (luckily) but naturally none of the additional options appeared on the About screen.

So thanks once again for all the contributions that helped me get to this point. 

I have a horrible temptation to start poking about with the 350MHz hardware mods now ...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bmwman91 on November 04, 2020, 12:24:55 am
I also successfully upgraded my MSOX2024A using only USB and the instructions found in this post:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2932770/#msg2932770 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2932770/#msg2932770)

Necessary files / option strings were pulled from these posts:
Firmware: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2945740/#msg2945740 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2945740/#msg2945740)
Option strings for infiniivision.lnk: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2351031/#msg2351031 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2351031/#msg2351031)
Link file install scripts: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-ser (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-ser)[attach=1]ies-licence-have-anyone-tried-to-hack-that-scope/msg1189010/#msg1189010
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on November 05, 2020, 05:51:59 am
The latest 2000X firmware is 2.60 in KeySight web site.
Also the 3000X firmware.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tabajaralabs on November 05, 2020, 08:08:49 pm
Greetings from Brazil!
I got my own DSO-X2002A =) and with lots of licences and 200MHz upgrade!  :-+ :-*
Firstly, I came to thank who made this possible. I have no enough words to say THANKS to all who helped to hack the planet...eh, the scope

I'd like to add some words to the "Power-super-scope for dummies" instructions. I had lots of questions and the procedure is really simple.
So, to make it easy for dummies like me:

1 - Download Phillyflier's patched firmware from post #2167 on page 87.  Seems the link is dead but you can find it here in the forum

2 - Download Luminax's license patch from post #1529 on page 62

3 - IN THE LUMINAX'S PATCH, Extract license patch. You'll have 3 files. One for install the patch, one for uninstall the patch, and the infinitiivision.lnk file which is the licence itself. Since the file is a LNK file, it will be extracted in windows as a extensionless file and you will not edit it easily. Open cmd window (if using MS Windows), navigate to WHERE YOU EXTRACTED the license patch folder and rename infiniivision.lnk to .txt

4 - Edit infiniivision.txt and replace EVERYTHING in the file with Odessa's modification from post#2197 on page 88 which is written below
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID

5 - Save and rename file back to .lnk

6 - Copy firmware file (rename from .ksx to .cab if current scope fireware is older than v2.41) to FAT16 OR FAT32 ROOT DIRECTORY formatted USB drive

7 - IN THE SAME ROOT DIRECTORY Copy licence files (2x .cab files and .lnk file) to same USB drive

Now go to your scope, turn on and plug in USB drive to front USB port
Press [Utility] > File Explorer, select the firmware file (3000XSeries.02.50.2019022736_patched.cab); then, press Load File, wait for scope to load and reboot.
Check firmware has updated to v2.5, if successful continue
Press [Utility] > File Explorer, select v241_link_install.cab file; then, press Load File, wait for scope to load and reboot.
Check licenses have all been added and if so... :clap: :phew:

Hope that helps to make the procedure less confusing =)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tabajaralabs on November 05, 2020, 10:56:46 pm
My scope uses the 2.50 hacked firmware
What happens if I upgrade it to 2.60? Will I loose all licenses?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on November 06, 2020, 12:40:08 am
My scope uses the 2.50 hacked firmware
What happens if I upgrade it to 2.60? Will I loose all licenses?
Yes
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: msuthar on November 06, 2020, 01:58:20 pm
I upgraded  to 2.60, I lost all licenses !... Revert back to patched 2.50 ,put back the lnk file and got  all licenses back in working condition.
Now strange thing I have noticed ,when I press Serial decode key it starts the decoding but the green triangle light is not getting lit !
Unit is Agilent DSO-X 2004A
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: msuthar on November 06, 2020, 02:09:44 pm
this is how I get the character count

120#infiniivisionLauncher.exe -l MSO -l WAVEGEN --perf -l D2000BDLA -l BW10 -l BW20 -l SCPIPS -l PLUS -l VID -l CABLE -l ASV
xxxx12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
                     10               20              30               40              50               60              70               80              90             100             110            120             130
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on November 06, 2020, 02:36:35 pm
this is how I get the character count

I don't think the character count is checked anywhere so it does not matter.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on November 08, 2020, 12:31:24 am
when I press Serial decode key it starts the decoding but the green triangle light is not getting lit !
Unit is Agilent DSO-X 2004A
I think that this is normal function. Can someone confirm it please?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on November 08, 2020, 01:48:19 am
when I press Serial decode key it starts the decoding but the green triangle light is not getting lit !
Unit is Agilent DSO-X 2004A
I think that this is normal function. Can someone confirm it please?
It's normal.

The green triangles are only on when the knobs to the right (vertical position and size) are active.  The knobs don't do anything for serial decoding, so the indicator is off.

As told to me by an Agilent support engineer.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tabajaralabs on November 08, 2020, 03:13:01 am
In the video analysis of the X2024A  by Dave, he had the serial funcion enabled and the green triangle also didn't lit. So I believe this is the common (albeit stupid) way it works.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tabajaralabs on November 10, 2020, 03:41:15 pm
A question for the people who understands better the inner workings of these scopes than me:
Is there a way I can hack the 2.50 patched firmware to change branding/boot screen back to Agilent?
I confess it was a way more beautiful boot screen an logos =)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on November 13, 2020, 08:01:35 am
A question for the people who understands better the inner workings of these scopes than me:
Is there a way I can hack the 2.50 patched firmware to change branding/boot screen back to Agilent?
I confess it was a way more beautiful boot screen an logos =)
Yes,you can change boot screen back to Aglient.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tabajaralabs on November 13, 2020, 03:56:26 pm
I discovered how to change the boot logo, but unfortunately I wasn't able to save the old firmware boot screen. It isn't avaiable in any firmware update I found. I know of one scope that has the old firmware here, but it will be a lot of work for just one screen :\
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tabajaralabs on November 16, 2020, 02:24:06 pm
Uh Oh...
A friend of mine has a DSO-X2012A which is already on version 02.50.2019022736 (which is the same of the hacked firmware avaiable here)
He tried to update with the pached firmware and had no success.
Any tips? Maybe the scope isn't storing the firmware because it is already the same version?
Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 16, 2020, 03:36:05 pm
I discovered how to change the boot logo, but unfortunately I wasn't able to save the old firmware boot screen. It isn't avaiable in any firmware update I found. I know of one scope that has the old firmware here, but it will be a lot of work for just one screen :\
Is that the one you want?

https://www.eevblog.com/forum/testgear/agilentkeysight-dsox-20003000-custome-boot-screens/msg909912/#msg909912 (https://www.eevblog.com/forum/testgear/agilentkeysight-dsox-20003000-custome-boot-screens/msg909912/#msg909912)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tabajaralabs on November 16, 2020, 05:24:27 pm
Nop...this one!
[attach=1]
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 16, 2020, 05:40:02 pm
I see. Great image, let us know if you find it.

If you have Telnet access to the scope that has it, you could extract the compiled splashimage.bin file and implant it on the new scope directly. I believe the .bin file is stored in \secure\infiniivision folder.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: uski on November 16, 2020, 05:45:18 pm
Hi! Any hack for the MSO4000A series? Thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dwaine on November 16, 2020, 10:31:54 pm
The latest 2000X firmware is 2.60 in KeySight web site.
Also the 3000X firmware.

Does anyone know what changes are in version 2.60?

Release Date   Version   Version Description
2020-10-30   2.60   This is the firmware for the 2000 X-Series oscilloscopes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tabajaralabs on November 16, 2020, 11:22:20 pm
They are listed on ReadMe: Corrections on Help for foreign languages
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on November 17, 2020, 05:42:21 am
Hi! Any hack for the MSO4000A series? Thanks
I have helped my friend to hack MSOX4000A.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tabajaralabs on November 18, 2020, 03:12:15 pm
Found it
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tabajaralabs on November 19, 2020, 04:14:18 am
How did I extracted the screen?
The file \secure\infiniivision\splashImage.bin is a planar BGR (not rgb, it is inverted) file with a 32 bytes header
Here it is, how I extracted the screen from a "virgin" scope:
https://tabajara-labs.blogspot.com/2020/11/salvando-tela-de-boot-do-osciloscopio.html (https://tabajara-labs.blogspot.com/2020/11/salvando-tela-de-boot-do-osciloscopio.html?fbclid=IwAR1NY_CbKKFf3bchJq20D0zP8SEMfzaM81hoye3WohdYx-noSGgg9rL1jZc)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: phatpaul on November 20, 2020, 10:05:06 pm
I followed the USB-only guides in posts #2560 and #2562 on my DSOX3014T (with purchased 200MHz upgrade, no Eth jack). 

The 3000XSeriesT.7.31.2020012842_patched.ksx installed OK, but the next step to install v241_link_install.cab doesn't seem to work.  I just get error message on the scope screen: "Error: The file did not load correctly."

I tried the process twice with the same result.  I also tried a couple different link strings from this forum.
Ideas?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dwaine on November 21, 2020, 03:13:33 am
They are listed on ReadMe: Corrections on Help for foreign languages

Ummm.. That's it..  I guess I'll stick to 2.50
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Kibabalu on November 21, 2020, 05:28:54 am
They are listed on ReadMe: Corrections on Help for foreign languages

Ummm.. That's it..  I guess I'll stick to 2.50

somewhat more:

Enhancements for 3000A
- New SCPI command to start the probe degauss operation for the N7026A and N2893A probes.
   
Enhancements for both 2000A and 3000A
- Completed software and built-in online help localization.
- New SCPI commands for clearing persistence data from the display and querying the run state.

Bug Fixes for both 2000A and 3000A
- Fixed network print issue where a valid printer address format was not accepted.


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on November 22, 2020, 12:02:22 am
Well, both 2000A and 3000A scopes will be 10 years old in February 2021. Is there a successor coming?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 25, 2020, 08:29:29 pm
If I remember correctly the password attempt always fails the first time. You may have to try twice before it'll let you in using Telnet.

I've seen this more then once in this thread, so here is the explanation for all of you:  this is a quirk of the Putty software that people often use for telnet connectivity.  It spits some garbage from the buffer first time you use it, so password entry always fails the first time. Use built-in Telnet utility in Windows and your authentication will be fine from the first try.

Edit: alternatively, if you still want to use Putty, after connecting to the scope press Enter, then proceed with entering the credentials.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on November 25, 2020, 08:34:10 pm
Well, both 2000A and 3000A scopes will be 10 years old in February 2021. Is there a successor coming?
I remember that question being asked many years back.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on November 25, 2020, 08:37:56 pm
Well, both 2000A and 3000A scopes will be 10 years old in February 2021. Is there a successor coming?

Did KS include a time bomb in the devices?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 25, 2020, 10:31:12 pm
To a certain extent, possibly. There are digital certificates there that have expiry.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on November 25, 2020, 10:40:59 pm
I think it's pretty clear that the 3000T series is the replacement for the 3000A.  If I recall correctly, at one point the A and T even had the same price for the same combinations of channels, MSO option, and bandwidth.  Looking at it now, the T series is slightly cheaper and also has more decode and other licensable options.

The 3000A series can still be found by searching for it, but it does not appear on the main scope web page.  Amongst others, it now shows the 3000T along with the 2000A series

I'm not sure why they're continuing to sell the 3000A series.  It hasn't had any significant new features added to it for years and only a minor bug fix here and there.

To a certain extent, possibly. There are digital certificates there that have expiry.
I can only speak for the 3000A because I have one:  The purchased licenses do not expire.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 25, 2020, 11:37:31 pm
I do not mean licences, i mean digital x509 certificates. There are a few Root ones from the Public Certificate Authorities and a few issued to Keysight , at least one for code signing.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dorofteius on December 02, 2020, 05:02:41 pm
Thank you all for the knowledge.
Another successful hacked DSO-x-2012A  using USB only . 
The trick is to have files in the main directory not in any sub folders. It fails every time when files are not in the main directory.

 
I followed these instructions from page 89  written by scribble - thank you man - much easier to have it all in one place.


Download Phillyflier's patched firmware from post #2167 on page 87
Download Luminax's license patch from post #1529 on page 62
Extract license patch, open cmd window (if using MS Windows), navigate to license patch folder and rename infiniivision.lnk to .txt
Edit infiniivision.txt and replace text in the file with Odessa's modification from post#2197 on page 88
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID
Save and rename file back to .lnk
Copy firmware file (rename from .ksx to .cab if current scope fireware is older than v2.41) to FAT32 formatted USB drive
Copy licence files (2x .cab files and .lnk file) to same USB drive

Now go to your scope, turn on and plug in USB drive to front USB port
Press [Utility] > File Explorer, select the firmware file (3000XSeries.02.50.2019022736_patched.cab); then, press Load File, wait for scope to load and reboot.
Check firmware has updated to v2.5, if successful continue
Press [Utility] > File Explorer, select v241_link_install.cab file; then, press Load File, wait for scope to load and reboot.

Today I received my 2002A from Ebay at 490 E.
I followed this instruction, and it worked perfectly. 5 minutes later I had a unlocked scope.
Thanks to all for the good work.

(https://i.ibb.co/KLCpKFf/20201202-124651.jpg) (https://ibb.co/0FPRsh6)
(https://i.ibb.co/VWzgmLh/20201202-160415.jpg) (https://ibb.co/N6J9SFk)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Greybeard on December 04, 2020, 07:07:40 pm
Well, both 2000A and 3000A scopes will be 10 years old in February 2021. Is there a successor coming?

Did KS include a time bomb in the devices?
Electrolytic caps in the power supplies...?   >:D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: msuthar on December 05, 2020, 05:12:33 pm
  DSO-X 2004A  after updating  Version 2.60   port 23 for telnet is not possible. Port scanner do not find port 23 open for telnet.
  There is one port open which is 21 and if it is telnet then shows  below image:[attachimg=1]   
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on December 05, 2020, 07:07:54 pm
Port 21 is normally used for FTP, give it the ls command and see what happens
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mshaban on December 15, 2020, 01:47:47 pm
thank you for your post, i need to try your steps to my DSOX2014a model withe the same proplem. the firmware available on Firmware for Keysight is ver 2.6, i am not sure it will be work or no, ver 2.35 no longer available, and dont know if it can be found in other site
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: markus354 on December 15, 2020, 06:39:47 pm
There was someone before to downgrade the scope to 2.35
Try to find I'm sure there is a way.
If I find it I will send you a link.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: markus354 on December 15, 2020, 06:46:40 pm
Hello guys.

I try to unlock my scope MSOX3034A  and after update to 2.50 patched i don know why I can't login to telnet. infiniivision / skywalker1977
Wrong login/ pass


I have Keysight LAN module.

Any help please.

I have try on another scope on DSOX3034T and I've get to this same point.


What I doing wrong
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: markus354 on December 15, 2020, 07:13:52 pm
It is not that straight forward

There is whole procedure to downgrade.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: markus354 on December 15, 2020, 07:57:53 pm
Ok.

False alarm.

It's be me stupid and sticky keyboard  :horse:

full unlock and 500MHz

Thank you for all work you have done here.

and Thank you for help me to go trough even those who want to charge me 650 for someone else work. :-+

I try to contribute more to this forum to pay back


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on December 15, 2020, 08:03:55 pm
Ok.

False alarm.

It's be me stupid and sticky keyboard  :horse:

full unlock and 500MHz

Thank you for all work you have done here.

and Thank you for help me to go trough even those who want to charge me 650 for someone else work. :-+

I try to contribute more to this forum to pay back

Who was trying to charge you $650 to hack your scope?

edit - I was sent a PM with the username of the person, all I can say is that it is disgusting that someone would offer such a service.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Xavier64 on December 19, 2020, 10:31:31 am
Does anyone have the 7.35 Firmware already patched ?


Thanks in advance.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on December 20, 2020, 04:36:05 pm
Who was trying to charge you $650 to hack your scope?

edit - I was sent a PM with the username of the person, all I can say is that it is disgusting that someone would offer such a service.
Consider informing Dave. That's not even a silly overstepping of boundaries, but ruthless exploitative behaviour.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Saskia on December 24, 2020, 07:25:49 pm
Who was trying to charge you $650 to hack your scope?

edit - I was sent a PM with the username of the person, all I can say is that it is disgusting that someone would offer such a service.
Consider informing Dave. That's not even a silly overstepping of boundaries, but ruthless exploitative behaviour.

I'd say it's not just disgusting, but outright criminal.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: olento on December 25, 2020, 04:49:07 pm

An update: I took the plunge and have now achieved a fantastic result (eventually, after a few pitfalls).  Here they are, based on my experience in the hope they might be useful for others.

I based my procedure on Cretone’s list post 2504 for which many thanks (modified for the 3000A obviously).  My own observations, setbacks, pitfalls etc in italics after each step

1.   Download PhillyFlyers’ 3000A series patched firmware 2.50 from the web to a FAT32 USB stick.

The hosting site mega.nz was blocked by my ISP – I needed to temporarily switch DNS servers to Google’s public DNS (8.8.8.8 and 8.8.4.4) to overcome this

2.   Plug the USB stick into the front USB port of the (running) scope, install the patched firmware via the standard firmware update procedure (Utility / File Explorer / goto USB / Load File).  Once the reboot is complete, keep the scope powered up.

Flawless update, scope rebooted immediately, no visible changes or warning messages – excellent. 

3.   Create a file infiniivision.txt with a raw text editor on a PC containing the infiniivisionLauncher command line with the options required (not forgetting to adjust the character count, ie the no. of characters to the right of the #).  Mine was:

93#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW20 -l MSO -l MEMUP

This was the biggest pitfall which took me a day to resolve.  The syntax for each option is hyphen then lowercase l then space then option code.  However, in most forum posts, the lowercase l looked to me like the pipe (vertical bar) character and even though I copied and pasted from the forum into my text editor and ended up (correctly) with lowercase ls, I was convinced it had translated them incorrectly and laboriously went through with a hex editor changing them back to pipes (unicode 7C).  (Eventually, through Telnet / CMD, I found the syntax for the infiniivisionLauncher.exe command and the penny finally dropped)

4.   Unplug the USB stick from the scope, save this infiniivision.txt file onto it, then replug it into the scope.  The file should now be visible through Utility / File Explorer.

Don’t be tempted to try and load the file into the scope like in step 2 – it’s not firmware!

5.   Time for Telnet: plug the scope into your local Ethernet, make sure the LAN config is set to automatic (Utility / I/O / LAN settings) wait for it to acquire an IP address (assuming you have a hub or similar with DHCP server capability connected).  Then Telnet into the IP address shown on the I/O information screen, username and password as per previous posts.  The Telnet window should then give the Windows CE command prompt:

Pocket CMD v 6.00
\>

Telnet was rock-solid throughout, and thanks to the patched firmware there seemed to be no restriction on having to time it to coincide with the boot-up phase of the scope.  I was dreading the networking, being an amateur, but simply plugging in to a typical home broadband network with a DHCP-serving hub it was incredibly easy and the scope sorted out its config automatically within seconds.  Alternatives are fiddling with static IP addresses, subnet masks etc and point-point Ethernet (scope – PC) with a crossover cable …

6.   Use the Telnet / CMD session to backup the existing .lnk, then transfer the .txt file from USB and rename it to .lnk thus:

rename \Secure\Startup\infiniivision.lnk \Secure\Startup\infiniivision.bak
copy \usb\infiniivision.txt \Secure\Startup\infiniivision.txt
cd \Secure\Startup
rename infiniivision.txt infiniivision.lnk

An initial worry was that even dir /a /s did not reveal the \Secure directory, however using cd \Secure will navigate to it and then enable dir to list its contents.  The original infiniivision.lnk file was present, but empty (0 bytes) and with the archive flag set - I backed it up nevertheless!  Note the copy command requires the full path and filename for both source and destination – just specifying the destination directory isn’t sufficient.  The cd into \Secure\Startup was necessary because attempting the rename from the root directory gave an error message that the command line (with the full path included in the filenames) was too long.  Finally, there are lots of ‘i’s in infiniivision, I lost count of the number of times I forgot the double i in the middle.

Historically the advice on the forum has been to kill the running inifiniivision.exe instance before doing the file manipulation, but lately this step seems to have been omitted in most recommendations.  I didn’t kill it, because I simply forgot all about that step.  Leaving it running didn’t seem to cause any problems, but of course the scope requires a reboot to pick up the new .lnk file and enable the options.


7.   Turn off the scope – a tense moment for potential bricking, as the die is now cast.  Turned on again, flawless and fast boot up, with all the newly-enabled options present and correct on the About screen (and enabled on the appropriate buttons etc).

This happy result was only after I had fixed the l / | confusion in the .lnk file of course.  When I was still blundering about with the pipe character, the scope booted up correctly (luckily) but naturally none of the additional options appeared on the About screen.

So thanks once again for all the contributions that helped me get to this point. 

I have a horrible temptation to start poking about with the 350MHz hardware mods now ...


Thank you Bill for your precise instructions!  :-+

I'd like to share my experiences with DSOX3014T hacking with few additions to the one above:  Original FW was 07.20.2017102614 when I bought it. I purchased also DIY LAN card, so I went with the LAN route upgrading (via USB stick would have maybe worked as well). There is an error message about LAN/VGA card problem when booting, but that's normal for the DIY LAN option  (because VGA circuitry is not present).  I tried to telnet it and it worked (without any post-boot timeout) with infiniivision/skywalker1977 password.

I got the patched FW from PhillyFlyers with the same version as the old FW was (because I was in the assumption that it was required, a misunderstanding from my part). However when trying to install this version via Utility menu the scope always would complain "could not load file. File type not detected" or something (cannot remember anymore the exact error message). 

At this point I tried a patched version of 07.31.2020012842, which upgraded and booted without any complaints (LAN/VGA nagging is still there of course).  However the skywalker password would not work anymore with this version, so I had to generate the new one and that worked ok.  I'm going to re-share the Python script here (a link posted previously now requires one to create an account):
Code: [Select]
#!/usr/bin/env python
from hashlib import md5
from base64 import b64encode

# Type in the real parameters here
MODEL  = "DSOX3014T"
SERIAL = "MY12345678"
MAC    = "00-12-34-56-78-90"

def makepwd( model, serial, mac ):
    mac  = mac.translate( None, ':- ' ).upper()
    hstr = md5( model + serial + mac ).digest()
    pwd  = b64encode( hstr, 'a1' )[7::-1]
    print 'Model : {0}\nSerial: {1}\nMAC   : {2}\nPasswd: {3}'.format(model, serial, mac, pwd)
    return pwd

makepwd( MODEL, SERIAL, MAC )
Get the IP and MAC addresses from DHCP page of your WiFi/LAN router/DHCP server (the scope uses a DHCP client name such as "k-dx3014t-12345").  Modify the python script and run it.  Use the same username (infiniivision) and the generated password and you can log in.

For enabling options I used the following infiniivision.lnk:
Code: [Select]
104#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW20 -l MSO -l MEMUP -l WAVEGEN
(the D3000BDLA does not contain WAVEGEN option)

Now I have 200mhz 4-channel scope with all the bells and whistles. Merry christmas everyone  8)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on December 28, 2020, 01:51:39 am
...AFAIK the 1k series still cannot be hacked because the cmdline options do not work on that series scope?  I believe that is what others have been saying on here?

It's done, mate  :D

https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg3383650/#msg3383650 (https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg3383650/#msg3383650)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: msuthar on December 28, 2020, 03:25:03 am

It worked on  DSO x 2004A  !!
the Telnet is also back !

73

de VU2EHY
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dwaine on December 29, 2020, 03:15:46 am

It worked on  DSO x 2004A  !!
the Telnet is also back !

73

de VU2EHY

+1  Upgrade worked perfectly on a DSOX2004A
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on December 29, 2020, 05:31:08 am
Successful upgrade (have patience, it takes several minutes). MSO-X 2024A.

Thanks much!

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pepperoni7 on December 29, 2020, 11:36:33 am
Works fine on my MSOX 3104T, thanks!
If someone needs enhanced security features, use "-l SECA" switch.
It was not obvious (at least for me) since option itself is called DSOXT3SECA
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: xXxzZz on December 30, 2020, 06:22:05 pm
Hello.

First of all, thank you so much for making this possible!

I have DSOX-3034T with WAVEGEN and MSO licenses installed (purchased) + VGA/LAN module. Original latest Firmware 7.35 installed

Can you please make a step by step guide + telnet commands?

I am new to this and afraid to make mistake and brick my scope.

Thank you. 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on December 31, 2020, 05:29:08 am

Wow, this is impressive.. someone did some excellent RE work and I would assume live debugging on the target.  Did you do these patches yourself?   I would love to know the debugging setup, ie what debugger did they use, etc...

This is not an easy small patch like all the others, this is some extensive patching and custom routines, etc... I'll have to spend some time looking at this one..

unless you of course can keep making these whenever updates come in?  then I'll just stick to the easy ones :)

The original patch was done to the previous version by user FERCSA  :-+.  I capitalized on his method to make a patch for the latest version. I did all in may head looking at the code and reading between the lines, that was my setup  :D . I did a bit of hardware hacking to access Uboot, but nothing like hooking up a JTAG  or something.

I do not think another one will need to be patched because 1000X models are discontinued. It is unlikely Keysight would release another firmware update.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on December 31, 2020, 05:34:26 am
umm... Honestly, this is all I know, is making these patches and using the cmd-line options via the link file..

If you know something much easier, please explain how to do it!   I really have no idea what the ":SYSTem:PRODuction:SSCRipt" is, or how you do it.... I only know the methods we've been using forever to enable the options... if there is a better and simpler way please explain and we can work on doing it that way!

I too would like to hear what "activate the options the way it should be" and " officially establish the "Boot Command Line" means.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on December 31, 2020, 05:38:35 am
Hello.

First of all, thank you so much for making this possible!

I have DSOX-3034T with WAVEGEN and MSO licenses installed (purchased) + VGA/LAN module. Original latest Firmware 7.35 installed

Can you please make a step by step guide + telnet commands?

I am new to this and afraid to make mistake and brick my scope.

Thank you.

I only visit this thread once in a while but I think I've seen "step by step guides" here more than stars in the night sky. You can start by reading the topic backwards to find out if a patch exists for your version of firmware in the first place, then continue from there.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mark on December 31, 2020, 04:01:06 pm
Successfully upgraded mine, thanks to everyone, especially PhillyFlyers. 

It seems there is no option for Bode plot on MSOX3000A series, only 3000T series, even though the app note 5992-0593 "Power Supply Control Loop Response (Bode Plot) Measurements 5992-0593" shows an MSOX3054A   ???

 

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: xXxzZz on December 31, 2020, 08:29:54 pm
Happy New Year Dear All!!!

DSOX-3034T Successfully upgraded!

With:
DSOX 3000T Series:  FW:  7.35.2020120822_patched

infinivision.lnk:
95#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW50 -l SCPIPS -l SEC

Best wishes and Endless thanks all of you!
[attach=1]
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on January 01, 2021, 11:24:21 pm
Successfully upgraded mine, thanks to everyone, especially PhillyFlyers. 

It seems there is no option for Bode plot on MSOX3000A series, only 3000T series, even though the app note 5992-0593 "Power Supply Control Loop Response (Bode Plot) Measurements 5992-0593" shows an MSOX3054A   ???
I always wondered how hard it would be to add a Bode plot to the 2000X and 3000A series. All the other models have the capability and the software platform is fairly similar. It always struck me as odd Keysight ignored these two series despite the hardware being present.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Saskia on January 02, 2021, 10:54:24 am
a Bode plot for the 2000 series, that would be fantastic ...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on January 02, 2021, 12:03:07 pm
Successfully upgraded mine, thanks to everyone, especially PhillyFlyers. 

It seems there is no option for Bode plot on MSOX3000A series, only 3000T series, even though the app note 5992-0593 "Power Supply Control Loop Response (Bode Plot) Measurements 5992-0593" shows an MSOX3054A   ???
I always wondered how hard it would be to add a Bode plot to the 2000X and 3000A series. All the other models have the capability and the software platform is fairly similar. It always struck me as odd Keysight ignored these two series despite the hardware being present.

2000X and 3000A are same older platform.  3000T is same platform as 4000 and 6000, so it has it.
It might as well be that 2000X and 3000A simply have no resources (memory, CPU, ASIC) to put in other stuff.
Or it can be simply that that those are legacy products, on it's last leg, and significant new development is just not going to happen.

At this point 1200X series is much more powerful than 2000X, except for smaller form factor, which might be pro or con depending on usage..
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zqcao on January 13, 2021, 03:36:42 pm
I have the same problem, do you repair it?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Saskia on January 14, 2021, 10:05:10 pm
I think I read somewhere that someone upgraded his 2 channel DSOX2000 to a 4 channel.

Can anyone point me to that particular post, please ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hexley on January 15, 2021, 12:22:44 am
I recently had an incident wherein my DSOX3024A lost cal on a couple of channels. Channel 3 was down in amplitude by 10% or so. Channel 2 was showing alarming behavior -- extremely reduced bandwidth and some timing jitter.

Fearing an issue in the front end, I decided to run a user calibration to see if it confirmed a failure. Fortunately, the user cal fixed the issue and restored normal operation. The attached pictures show before and after. The jitter on CH2 was not captured in this screen grab, but the low bandwidth is obvious.

Perhaps this is an indication that the flash memory dropped some bits in the calibration tables. Makes me wonder if that memory is on borrowed time.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on January 22, 2021, 03:03:36 am
Successfully upgraded mine, thanks to everyone, especially PhillyFlyers. 

It seems there is no option for Bode plot on MSOX3000A series, only 3000T series, even though the app note 5992-0593 "Power Supply Control Loop Response (Bode Plot) Measurements 5992-0593" shows an MSOX3054A   ???
I always wondered how hard it would be to add a Bode plot to the 2000X and 3000A series. All the other models have the capability and the software platform is fairly similar. It always struck me as odd Keysight ignored these two series despite the hardware being present.

2000X and 3000A are same older platform.  3000T is same platform as 4000 and 6000, so it has it.
It might as well be that 2000X and 3000A simply have no resources (memory, CPU, ASIC) to put in other stuff.
Or it can be simply that that those are legacy products, on it's last leg, and significant new development is just not going to happen.

At this point 1200X series is much more powerful than 2000X, except for smaller form factor, which might be pro or con depending on usage..

even 1000X has FRA. I think it's just a software thing not a hardware limitation. This scope is definitely more powerful than some other new chinese scopes that do have FRA now. It must be a marketing issue perhaps. The actual software is probably in there already.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Someone on January 22, 2021, 07:27:37 am
Successfully upgraded mine, thanks to everyone, especially PhillyFlyers. 

It seems there is no option for Bode plot on MSOX3000A series, only 3000T series, even though the app note 5992-0593 "Power Supply Control Loop Response (Bode Plot) Measurements 5992-0593" shows an MSOX3054A   ???
I always wondered how hard it would be to add a Bode plot to the 2000X and 3000A series. All the other models have the capability and the software platform is fairly similar. It always struck me as odd Keysight ignored these two series despite the hardware being present.

2000X and 3000A are same older platform.  3000T is same platform as 4000 and 6000, so it has it.
It might as well be that 2000X and 3000A simply have no resources (memory, CPU, ASIC) to put in other stuff.
Or it can be simply that that those are legacy products, on it's last leg, and significant new development is just not going to happen.

At this point 1200X series is much more powerful than 2000X, except for smaller form factor, which might be pro or con depending on usage..

even 1000X has FRA. I think it's just a software thing not a hardware limitation. This scope is definitely more powerful than some other new chinese scopes that do have FRA now. It must be a marketing issue perhaps. The actual software is probably in there already.
There is an early implementation of the bode plotter on the 3000A models, hidden away in the power analysis package as the Power Supply Rejection Ratio (PSRR) analysis.

Even on the other scopes that have more recent implementations of the bode plot, its still not great. Acquisition time is relatively slow/inefficient and the auto scaling can fail (with no way to override or fix it). For most real use cases its better off automating the measurements from a user programmable environment:
https://www.eevblog.com/forum/testgear/faster-fra-from-scope-by-external-control-over-visa/msg2282465/#msg2282465 (https://www.eevblog.com/forum/testgear/faster-fra-from-scope-by-external-control-over-visa/msg2282465/#msg2282465)
(entirely practical for a raspberry Pi etc to be dedicated to these tasks and kept on the back of the scope)

The resources/capabilities are certainly there on the 3000A/2000A but they aren't getting software features in updates. All run the same SPEAR600 SoC:
1000A/G https://www.flickr.com/photos/eevblog/32335665684/ (https://www.flickr.com/photos/eevblog/32335665684/)
2000A https://www.flickr.com/photos/eevblog/5736055359/ (https://www.flickr.com/photos/eevblog/5736055359/)
3000A https://www.flickr.com/photos/eevblog/5736041287/ (https://www.flickr.com/photos/eevblog/5736041287/)
3000T https://www.flickr.com/photos/eevblog/16055812200/ (https://www.flickr.com/photos/eevblog/16055812200/)
4000A https://www.flickr.com/photos/eevblog/8181547458/ (https://www.flickr.com/photos/eevblog/8181547458/)
and all those (but 1000A/G ?) scopes run the same windows CE 6.0 operating system.

different to lower end instruments:
https://www.flickr.com/photos/eevblog/9090298350/ (https://www.flickr.com/photos/eevblog/9090298350/)
or higher end instruments:
https://www.flickr.com/photos/eevblog/13985658872/ (https://www.flickr.com/photos/eevblog/13985658872/)
where there are slightly different processor platforms.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wavylogic on January 23, 2021, 05:20:39 am
Hello, this is my first blog posting.  Many, many thanks to all the people who have been doing the excellent reverse engineering work on this series of scopes.  I have read through parts of this blog searching for general information on the MSOX3000 series and finally decided to get one.  I purchased a new (Keysight demo at 50% off) to me scope from Keysight, and of course it came without any probes or cables.  Probes are not so much of a problem, there are many sources for those.  But the MSO cable is a problem because it is less common. 

After reading through this blog and doing other research on the Keysight web site, I found that the MSO probe cable requirement seens to be the same as used for a series of HP logic analyzers with the same 40 pin pinout, as has been pointed out previously.

An excellent document for this type of cable and its circuit requirements is the Keysight document "Probing Solutions for Logic Analyzers", document number 5968-4632E.  This can be downloaded from the Keysight web site.  In particular, the section from page 47 onward gives a lot of information about this probe system, such as the typical clip lead nose termination network in Fig. 9.1 and 9.36.  All of the networks shown in this document assume use of the 'woven cable' special 40 pin cable to connect the isolation networks for the clip leads to the input of the logic analyzer. 

Figure 9.37 on page 71 shows the signal connections as viewed from the end of the MSO cable connector.  Therefore looking at the front of the scope, pin 1 is at the top right towards the USB connector (top left square pin in the main board top side photo), and pins 1,3,5, and 39 are not connected inside the scope.  You can verify this in some of the main board photos.  Note the black 'key' indicator is at the top of the socket, and Fig. 9.37 is as if you are looking at the end of the cable.  In the scope, all the grounds are on the bottom side. 

The signal paths in this logic probing system are set up the same as normally used in a 10X oscilloscope probe, and require particular conditions to be met to get good bandwidth and transient response at the input of the logic analyzer.  Each of the 16 signal paths (the clock path in a cable from a logic analyzer is not used) consists of the isolation network at the clip end, one signal wire in the cable, and a termination network in the logic analyzer or MSO scope input.  The signal wire is a special type of pseudo coaxial cable made with very fine resistive wire for the center conductor, so that the 1 meter (~40 inch) long woven cable signal path has an end to end DC resistance of about 180 ohms.  The grounds of the paths have very low resistance from end to end.  The measured low frequency capacitance of one signal path to ground is about 50 pF,  and the transmission line TDR surge impedance Zo measures as about 180 ohms also (coincidence?). 

You can see in some previously posted photos of the MSO region of the 3000 series that U1401 to U1404 used as receivers for the MSO signals are MAX9201 quad comparators.  Part of the circuitry used with these comparators is visible on the top side of the PC board, but apparently the remainder is on the bottom side.  I have not been able to find any high resolution photos of the bottom side of the PC board. 

If someone can point to where the backside area under these ICs can be seen, I would greatly appreciate that information.  I am reluctant to disassemble the scope I just bought since it is still in warranty.  Any information on component values would be a bonus.

My goal is to design a replacement for the standard MSO cable which anyone can duplicate.  Obtaining satisfactory frequency response when using a standard ribbon cable for the 'woven cable' requires adding additional compensation networks at each end of the cable.  The values of these networks can be obtained from simulations, but the ones already present in the scope, which cannot be altered, must be known in advance.

Making one's own cable fixtures has the feature that specialized cables can be made for common usage situations, such as using a smaller number of channel connections or using a ganged connector to the target breadboard to make usage easier.  For instance, a pad pattern for a vertical mounting through hole micro USB connector could be added to a PC board design and connected to otherwise unused pins of a CPLD.  In this case, you would have a 5 channel gang connection, which by programming can monitor any signals in the CPLD.  Just alter the CPLD program to move your hardware probe points and reprogram without taking it off of the PC board.  The connector would be left unloaded on boards after the debugging is complete. 

Or you could use an 8 channel connection with a 10 pin header location on the PC board to probe 8 signals as desired, or have only 8 clip leads flying about. 

So what I am asking for is any information that someone can give to help determine the termination networks internal to the MSO 3000 series oscilloscopes.

Thanks for your help!


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hexley on January 24, 2021, 09:00:59 pm
For instance, a pad pattern for a vertical mounting through hole micro USB connector could be added to a PC board design and connected to otherwise unused pins of a CPLD.  In this case, you would have a 5 channel gang connection, which by programming can monitor any signals in the CPLD.  Just alter the CPLD program to move your hardware probe points and reprogram without taking it off of the PC board.
Welcome to the forum.

Your idea for dedicated MSO connections using a micro USB connector on the target system seems like it would be great for CPLD development work.

I hope someone can provide pix of the bottom side of the board near the MSO connector, so you can figure out the scope's internal termination. That would be a nice contribution to knowledge.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: LA7SJA on January 25, 2021, 07:55:09 am
This is what I manage to collect so far:

MSO (digital channels). Upgradable from DSO. MSO channels 8 channels (D0 to D7)
Maximum sample rate 1 GSa/s Maximum record length 500 kpts per channel (digital channels only).
125 kpts per channel (analog and digital channels). Threshold selections TTL (+1.4 V),CMOS (+2.5 V), ECL (-1.3 V), User-definable (± 8.0 V in 10 mV stops). Threshold accuracy 1 ± (100 mV + 3% of threshold settings)

You don't need any special digital probe. The digital connector on the DSOX2000 scope has this layout: The input resistance is about 10kΩ to ground and 90kΩ to probe end.


Maximum input voltage ± 40 V peak CAT I Maximum input dynamic range ± 10 V about threshold Minimum voltage swing 500 mVpp. Input impedance 100 kΩ ± 2% at probe tip, ~8 pF Minimum detectable pulse width 5 ns. Channel-to-channel skew 2 ns (typical), 3 ns (maximum)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Matt Coates on January 26, 2021, 06:27:37 pm
Hi all,

Apologies for the laziness but I didn't fancy reading through 106 pages of posts to get to the bottom of my query.

Can anybody familiar with the topic please let me know where I can find details on how to unlock the options for my DSO2024A scope?

Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: LA7SJA on January 26, 2021, 06:54:56 pm
I would start about here https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3388792/#msg3388792 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3388792/#msg3388792)

LA7SJA
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wavylogic on January 27, 2021, 05:43:07 am
Hello LA7SJA, is it possible for you to post higher resolution photo sections for the part of the main board surrounding U1104?  I need about 2x or better resolution for that part of the photos "MSO Input PCB backside.jpg" and "MSO Input PCB toppside.jpg which surrounds U1104 and for about 1/2 inch past the group of components which surrounds the chip.

I see that this section seems almost identical to the one previously seen in teardown photos of an MSO3104 on the site, there are a few small unimportant differences.  I'm pretty sure the layout was copied and modified.
 
On your other comments about MSO, from what I read going through the site it appears that the 2000 series (which this board is from) has only 8 MSO channels because it has only one set of acquisition chips, whereas the 3000 series has two sets of acquisition chips and support 16 channels as a result.  Is that right?

Then the question is:  Since a 3xx2 has 16 MSO channels but only 2 analog signal inputs, does it have 1 or 2 sets of acquisition chips?  I have found that if you use 2 inputs simultaneously on the 3022, its maximum sampling rate drops in half, which is the same result as can happen on a 4 channel unit because 1 & 2 share one acquisition chip set, and 3 & 4 share the second.

This all points to the possibility that a 2xx4 machine could theoretically handle 16 MSO channels if the parts were installed and the software changed.  Have you seen anything about this?

The threshold ratings, hysteresis, and maximum voltage are all at the effective 10X probe division ratio formed by the MSO cable and its 90K series pods.  The values are 10 times smaller at the front panel connector, and the ESD protection is a lot less.  If you don't use the cable with 90K resistors, operation will be different.  The usable signal range is only +/-1 volt.

If you use ordinary ribbon cable without correct compensation networks to connect to 90K at the probe end, the frequency response will be wrong.  It may have excessive peaking, or it may have greatly reduced bandwidth.  The result is that the logic inputs will not be able to provide the nanosecond signal measurements which the 1 GHz sampling would imply.  In the worse case, ringing could cause entirely erroneous logic signal indications.

For these reasons, I am trying to determine by simulation what termination networks are needed to get 1 nanosecond response when using ordinary ribbon cable.  I think it is possible based on similar work I have done in previous years.  This eliminates the need to have the special 'woven cable' or its equivalent used on the original logic analyzers.

My intention is that when this design research is finished then I will publish it on this blog so that all those who have MSO enabled but need a cable can then make their own easily and get good response.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: LA7SJA on January 27, 2021, 07:40:00 am
Quote
On your other comments about MSO, from what I read going through the site it appears that the 2000 series (which this board is from) has only 8 MSO channels because it has only one set of acquisition chips, whereas the 3000 series has two sets of acquisition chips and support 16 channels as a result.  Is that right?
Yes that is right! Dave compared the MSO on x2000 and X3000 https://www.youtube.com/watch?v=os1agF35jxU&t=498s (https://www.youtube.com/watch?v=os1agF35jxU&t=498s)  @ 07:00
If I have enough lighting and find the old macro lens and intermediate rings then I will try to get time to open my DSO-2024 and get some better pictures. Have you tryed to put a small compensation capacitor parallel to the 90k resistor and used a active probe to look at the signal on the MSO input? The wire used in the original cable is of the "Lossy" type (as in oscilloscope cables and it's "pure unobtainium").

LA7SJA
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: IUST on January 27, 2021, 11:09:48 am
I have failed in Bandwidth upgrading of my DSOX3024T. It is stuck at 200MHz and -l -BW50 is not working for it.
The activated license always show the BW20.
What is wrong with me?

In the .dll file, there is a branch that judge about passing through bw20_3k or bw50_3k. for bandwidth upgrading, Should  I have to force the code to pass through the bw50_3k section?

Bandwidth of DSOX3024T is not license only up gradable according to the manufacturer information.  I know that for BW upgrading the scope may need to send to the manufacturer for calibration and whatever But I am just curious about the possibility of this bandwidth up-gradation.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: LA7SJA on January 27, 2021, 12:05:20 pm
There is notting wrong with you!
But you need different hardware (Return-to-Keysight bandwidth upgrade) to go over 200MHz bandwith!

These are permitted license updates on the M/DSO-X 3XXX:
License only bandwidth upgrade models

3000T X-Series
DSOXT3B1T22 License only 100 to 200 MHz upgrade, 2 ch
DSOXT3B1T24 License only 100 to 200 MHz upgrade, 4 ch
DSOXT3B3T52 License only 350 to 500 MHz upgrade, 2 ch
DSOXT3B3T54 License only 350 to 500 MHz upgrade, 4 ch

Return-to-Keysight bandwidth upgrade models
3000T X-Series
DSOXT3B1T32U Service center 100 to 350 MHz upgrade, 2 ch
DSOXT3B1T52U Service center 100 to 500 MHz upgrade, 2 ch
DSOXT3B1T102U Service center 100 to 1 GHz upgrade, 2 ch
DSOXT3B1T34U Service center 100 to 350 MHz upgrade, 4 ch
DSOXT3B1T54U Service center 100 to 500 MHz upgrade, 4 ch
DSOXT3B1T104U Service center 100 to 1 GHz upgrade, 4 ch
DSOXT3B2T32U Service center 200 to 350 MHz upgrade, 2 ch
DSOXT3B2T52U Service center 200 to 500 MHz upgrade, 2 ch
DSOXT3B2T102U Service center 200 MHz to 1 GHz upgrade, 2 ch
DSOXT3B2T34U Service center 200 to 350 MHz upgrade, 4 ch
DSOXT3B2T54U Service center 200 to 500 MHz upgrade, 4 ch
DSOXT3B2T104U Service center 200 MHz to 1 GHz upgrade, 4 ch
DSOXT3B3T102U Service center 350 MHz to 1 GHz upgrade, 2 ch
DSOXT3B3T104U Service center 350 MHz to 1 GHz upgrade, 4 ch
DSOXT3B5T102U Service center 500 MHz to 1 GHz upgrade, 2 ch
DSOXT3B5T104U Service center 500 MHz to 1 GHz upgrade, 4 ch

LA7SJA
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wavylogic on January 27, 2021, 08:42:33 pm
I looked at the video #148, I had missed that one.  But looking closely at the 3000 back side, all the MSO signals go into the 'master' Megazoom chip, supposedly therefore this could also have been done on the 2000 scope.  I didn't see the back side on that one.  The choice of 8 channels on the 2000 looks mainly like a marketing decision, since the board is an almost all new layout, and yet they did include positions for 16 channel buffers.

On setting up the MSO cable compensation, I did consider using an active probe as you mention, but the internal circuit is complex, and may be doing some frequency shaping of its own.  So getting a good transient response at the front panel 40 pin connector may not actually give the best system response.  That is what I am investigating.

The goal here is to obtain good performance without using the lossy cable design.  It should be possible, its just not as easy.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: LA7SJA on January 27, 2021, 09:19:30 pm
I gave up finding "lossy" cable after just few years. The input have som signal cleanup on the signal before the ASIC. Later when I take som new pictrures I wil try to measure the differens betwen  1 meter of flat cable and 1 meter old scope lossy cable with a 10MHz, 20, 40, 50 and 60Mhz good square-wave just on one MSO input. Do you still need better pictures? I don't want to remove the mainboard so only pictures from componet side of the 40pin connector.


LA7SJA
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wavylogic on January 28, 2021, 01:21:11 am
Hi LA7SJA, I already have good high resolution pictures of the side with the ICs for the MSO input, the problem is that about 1/2 of the circuitry is on the side against the front panel, and no one seems to make pictures of that side.  The pictures you had when blown up just didn't have enough resolution to see some of the fine traces reliably. Hopefully someone else will have a board they can photograph.  Even photos of a dead board would suffice for this purpose.  Any version of the DSO or MSO 2000 or 3000 series would suffice, they seem to all use the same MSO input circuitry, which is all I need to see.

On the lossy cable, I already have complete characterization as needed for simulations, so don't worry about measuring that.  It is easy to model and simulate using LT Spice. 

Thanks for your help.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on January 28, 2021, 02:37:05 am
I gave up finding "lossy" cable after just few years.
...
One way to get some lossy coax is to buy a used logic analyzer cable that's the tiny coax ribbon type (not the woven type).  You can then peel it apart in singles or in groups as desired.  The cable in the photo is a 16715-61601 which has 36 lossy coax runs, 1.3M long (it's in 2 ribbons, each having 18 each plus 4 regular conductors).  The cable can be had for around US$25-$30 each (hint: try searching for "(hp,agilent) logic analyzer cable", not the part number).

I realize the goal here is to replace these lossy coaxes with a suitable termination network, but if you can get the coax easily maybe it's worth re-purposing it for your specific applications.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tabajaralabs on January 29, 2021, 06:29:00 am
I believe I've written about this, I''ll create a blog post
To create a cable set for the scope, get an HP logic analyser cable, cut the CONNECTOR (pay attention to that) that goes to the logic analyser blade, where the two flat cables enter, and solder a 40 pin (2x20) connector routing the signals D0-D7 to the proper pads on PCB. In the other side of the cable, use an HP "hydra" connector, but with just 8 wires. It is THAT simple.
DON'T TRY TO SOLDER THE WIRES, USE THE HP BOARD WHICH WENT TO THE HIGH DENSITY CONNECTOR. The wires are so small they are IMPOSSIBLE to solder.
DON'T USE NORMAL WIRES FROM THE SCOPE TO THE PROBES, THE NOISE WILL DRIVE THE SCOPE NUTS.
ASAP I'll publish a complete tutorial with photos.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on February 02, 2021, 11:27:19 pm
Here ya guys go..

Patched 3000X 2.50 Firmware with 'options' and 'nag' patch already applied..

https://mega.nz/#!eqg0yYJK!l73FwnABwNBNsl_l_2fAC8Md8PCVEEBgZ-u0T1eNZ08

can someone kindly send me a link to the patched firmware please? the above link has been removed
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: LA7SJA on February 03, 2021, 09:55:29 am
This one worked for me:

https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0 (https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0)

LA7SJA
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on February 03, 2021, 11:54:27 am
This one worked for me:

https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0 (https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0)

LA7SJA

thanks so much
just to be sure, should I follow step by step procedure in post #2201 on page 89?
I have been reading this thread for a couple of days but I am confused with several methods that are proposed
I dont have the LAN card but I do have access to the serial console
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Gribo on February 03, 2021, 04:21:40 pm
I still have some DSOXLAN cards available. PM me if you want some.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on February 06, 2021, 10:19:49 pm
Successfully upgraded mine, thanks to everyone, especially PhillyFlyers. 

It seems there is no option for Bode plot on MSOX3000A series, only 3000T series, even though the app note 5992-0593 "Power Supply Control Loop Response (Bode Plot) Measurements 5992-0593" shows an MSOX3054A   ???

this is interesting? so where is the FRA on 3000A? is it a hidden option that only Keysight guys know about?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: LA7SJA on February 08, 2021, 07:04:35 am
@wavylogic
Her are some photos from Dave's teardowns you could use:
https://www.flickr.com/photos/eevblog/5736597744/in/album-72157626755861230/ (https://www.flickr.com/photos/eevblog/5736597744/in/album-72157626755861230/)

LA7SJA
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Kibabalu on February 08, 2021, 08:32:59 am
Ok,

Here are the latest patched firmwares, for the 1000X, 2000X, 3000A, 3000T, 4000X......



These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things


*** Note:  ***

I have made these installs even EASIER, after the upgrade completes the install process will also make a backup of the oem lnk file that it installs during the upgrade, and then attempt to copy 'infiniivision.lnk' from the same USB stick you are doing the upgrade with...

so in otherwords, have your 'infiniivision.lnk' file READY, and on the root of your USB drive along with the patched firmware upgrade!
(this replaces having to telnet into your scope after the upgrade and having to put the .lnk file back on)

The install script at the end does these two actions:

copy \Secure\Startup\infiniivision.lnk infiniivision.lnk.original  (backs up oem file being replaced)
copy \usb\infiniivision.lnk \Secure\Startup\infiniivision.lnk     (copies .lnk file from your USB to the startup folder)

So have these TWO files on your USB:

1) infiniivision.lnk
2) upgrade_file.ksx




*** NOTE:  FOR THE 1000X....  ************************************
      This is 'BUD's' patched firmware!!  All credit goes to him and the 1000x hacking folks!  there is NO .LNK file required for this patch, just install the FW!  I repeat, there is NO .lnk file required for the
      1000x hacking

DSOX 1000X Series:  FW:  01.20.2019061038_patched  https://mega.nz/file/nrpW3T4Z#gLnn__QchpYL5FuQXLawyso2_ReaXgn-jF4MzcRZSAA
md5: <8D128F5691BCB7D178CFB8E48F3784B9>

*************************************************************

DSOX 2000X Series:  FW:  02.60.20201011001_patched  https://mega.nz/file/OjAhhAjI#o6s6Fi4cGhxN0v6jgJOVAxhNNk33qv_w46eiO_QyEhc
md5: <2B8FFCC4D5963FC9277AEBDD61CCC5B1>

DSOX 3000A Series:  FW:  02.60.20201011001_patched https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0
md5: <531BD46EF73E8C570922AF3AD4A9A8D9>

DSOX 3000T Series:  FW:  7.35.2020120822_patched https://mega.nz/file/nmJliKrJ#iMkMhe6xWFkJLJH7rgbh-QoFvRjzfVbsXhOOgu-5osc
md5: <D430C8F87A3865B48E035A1B99B0A421>

DSOX 4000X Series:  FW:  7.35.2020120823_patched  https://mega.nz/file/q3ABzQ5b#BH08CEf_Q0T7Z3kQMOzmHZTGubIGKPanCiq8my69TyM
md5: <04D0B52B8400F03B3EA87B90DE8FC004>


Please let me know if there are any issues with any of these!

For a DSO-X 2000A model I have to use

DSOX 3000A Series:  FW:  02.60.20201011001_patched https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0
md5: <531BD46EF73E8C570922AF3AD4A9A8D9>

right?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: LA7SJA on February 09, 2021, 06:27:11 am
On my (M)DSO-X 2024A I use this one.

DSOX 2000X Series:  FW:  02.60.20201011001_patched  https://mega.nz/file/OjAhhAjI#o6s6Fi4cGhxN0v6jgJOVAxhNNk33qv_w46eiO_QyEhc
md5: <2B8FFCC4D5963FC9277AEBDD61CCC5B1>

LA7SJA


Quote
Kibabalu
For a DSO-X 2000A model I have to use

DSOX 3000A Series:  FW:  02.60.20201011001_patched https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0
md5: <531BD46EF73E8C570922AF3AD4A9A8D9>

right?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on February 15, 2021, 05:12:14 pm
I have a question about the upgrades on Agilent 3000A:
now that I am on FW 2.6 and upgraded, what happens if a next firmware is released and I want to update the firmware?
Do the options disappear and need a patched firmware or I can install future firmwares with no issue?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Kibabalu on February 15, 2021, 05:34:09 pm
I have a question about the upgrades on Agilent 3000A:
now that I am on FW 2.6 and upgraded, what happens if a next firmware is released and I want to update the firmware?
Do the options disappear and need a patched firmware or I can install future firmwares with no issue?

At least for the last two FW updates a special patched firmware was necessary to keep all the 'hacked' options. Most likely this will also the case for future FW updates.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: LA7SJA on February 17, 2021, 03:18:19 pm
Quote
Enhancements for 3000A
- New SCPI command to start the probe degauss operation for the N7026A and N2893A probes.
Enhancements for both 2000A and 3000A
- Completed software and built-in online help localization.
- New SCPI commands for clearing persistence data from the display and querying the run state.
Bug Fixes for both 2000A and 3000A
- Fixed network print issue where a valid printer address format was not accepted.

I do not want to replace all options turned on with "update" above! Maybe if they remove the automatic language help at startup / screensaver exit. I can manage with the version 2.5 v software for the life of the oscilloscope. I think no revolutionary changes for the better will come to an 11 year old instrument (HP, Agilent, Keysight prove me wrong, I challenge you).

LA7SJA
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Miketee on February 18, 2021, 10:12:36 am
Here are the latest patched firmwares, for the 1000X, 2000X, 3000A, 3000T, 4000X......

These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things

*** Note:  ***
I have made these installs even EASIER, after the upgrade completes the install process will also make a backup of the oem lnk file that it installs during the upgrade, and then attempt to copy 'infiniivision.lnk' from the same USB stick you are doing the upgrade with...  so in otherwords, have your 'infiniivision.lnk' file READY, and on the root of your USB drive along with the patched firmware upgrade!
(this replaces having to telnet into your scope after the upgrade and having to put the .lnk file back on)

So have these TWO files on your USB:

1) infiniivision.lnk
2) upgrade_file.ksx


DSOX 3000A Series:  FW:  02.60.20201011001_patched https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0
md5: <531BD46EF73E8C570922AF3AD4A9A8D9>


Please let me know if there are any issues with any of these!

Thanks PhillyFlyers, I did the patch on my DSO-X 3034A and it works!

I used the following infiniivision.lnk file:
93#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW50 -l SCPIPS -l SEC -l MSO -l MEMUP -l WAVEGEN

It is now upgraded to 500 MHz and includes the very rich D3000BDLA, which includes D3000AUTA, D3000GENA, D3000AERA, D3000PWRA, D3000NFCA, and all hardware based serial decoding (RS-232, I2C etc.), mask testing, video analysis, and even advanced math.

This is already great, again thanks.

However, the last 3 options in the file (MSO, MEMUP and WAVEGEN) did not work.
Did I do something wrong? It would be nice to have WAVEGEN and MEMUP... ;-)

cheers

MT
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on February 18, 2021, 12:44:24 pm
Here are the latest patched firmwares, for the 1000X, 2000X, 3000A, 3000T, 4000X......

These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things

*** Note:  ***
I have made these installs even EASIER, after the upgrade completes the install process will also make a backup of the oem lnk file that it installs during the upgrade, and then attempt to copy 'infiniivision.lnk' from the same USB stick you are doing the upgrade with...  so in otherwords, have your 'infiniivision.lnk' file READY, and on the root of your USB drive along with the patched firmware upgrade!
(this replaces having to telnet into your scope after the upgrade and having to put the .lnk file back on)

So have these TWO files on your USB:

1) infiniivision.lnk
2) upgrade_file.ksx


DSOX 3000A Series:  FW:  02.60.20201011001_patched https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0
md5: <531BD46EF73E8C570922AF3AD4A9A8D9>


Please let me know if there are any issues with any of these!

Thanks PhillyFlyers, I did the patch on my DSO-X 3034A and it works!

I used the following infiniivision.lnk file:
93#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW50 -l SCPIPS -l SEC -l MSO -l MEMUP -l WAVEGEN

It is now upgraded to 500 MHz and includes the very rich D3000BDLA, which includes D3000AUTA, D3000GENA, D3000AERA, D3000PWRA, D3000NFCA, and all hardware based serial decoding (RS-232, I2C etc.), mask testing, video analysis, and even advanced math.

This is already great, again thanks.

However, the last 3 options in the file (MSO, MEMUP and WAVEGEN) did not work.
Did I do something wrong? It would be nice to have WAVEGEN and MEMUP... ;-)

cheers

MT
the number 93 is wrong. I counted over 110 characters in your lnk file
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Miketee on February 18, 2021, 03:10:09 pm
Argh thanks TK, was wondering what  that number was... ;-)

Now I have:
122#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW50 -l SCPIPS -l SEC -l MSO -l MEMUP -l WAVEGEN

This installs MSO and MEMUP but not WAVEGEN. I checked the number of characters after # and it is indeed 122.

Bizarre. Any ideas?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on February 18, 2021, 03:49:49 pm
Argh thanks TK, was wondering what  that number was... ;-)

Now I have:
122#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW50 -l SCPIPS -l SEC -l MSO -l MEMUP -l WAVEGEN

This installs MSO and MEMUP but not WAVEGEN. I checked the number of characters after # and it is indeed 122.

Bizarre. Any ideas?
I don't remember if it includes the '#' character in the count.  Anyway, you can try moving the WAVEGEN option to the front and see what  happens
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Miketee on February 18, 2021, 04:17:33 pm
You are right again. I moved SCPIPS to the end, now it loads everything except SCPIPS.

I don't even know what SCPIPS is... does anyone? I find nothing on Google.

Anyhow thanks, great forum, I will try to contribute some useful stuff here.

all the best

Mike
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hexley on February 18, 2021, 04:20:00 pm
Argh thanks TK, was wondering what  that number was... ;-)

Now I have:
122#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW50 -l SCPIPS -l SEC -l MSO -l MEMUP -l WAVEGEN

This installs MSO and MEMUP but not WAVEGEN. I checked the number of characters after # and it is indeed 122.

Bizarre. Any ideas?
I get 121 characters in your string; you might try with that number.

Also, you can trim the path from the filename. So this should also work, if you want to try it:

90#infiniiVisionLauncher.exe -l D3000BDLA -l BW50 -l SCPIPS -l SEC -l MSO -l MEMUP -l WAVEGEN
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Blue on February 23, 2021, 05:10:29 am
Thanks,

I just updated my DSO-X 3014A and it works. I'm very happy!  :)

I used:
90#infiniiVisionLauncher.exe -l D3000BDLA -l BW20 -l SCPIPS -l SEC -l MSO -l MEMUP -l WAVEGEN
with the 3000XSeries.02.60.20201011001_patched.ksx file.

 :-+ :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Venturi962 on March 06, 2021, 02:47:39 pm
Performed the 350MHz hardware mod / 500MHz license on my 4024A and now have a 500MHz bandwidth scope.  Rise times are in the 570 to 580ps range.  Stock rise times were ~1.30ns.

Some changes to the BOM originally posted by TheSteve:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg993078/#msg993078 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg993078/#msg993078)

Capacitors:
C1 - 2.2 pF 0603, 100V NPO, Murata # GQM1885C2A2R2BB01D, Digikey # 490-4838-1-ND, quantity 4 -> Marked obsolete, replacement 490-13316-1-ND
C2 - 2 pF 0603, 100V NPO,  Murata # GQM1885C2A2R0BB01D, Digikey # 490-6092-1-ND, quantity 4 -> Marked obsolete, replacement 490-8124-1-ND

Inductors:
I wanted to use the Murata parts, as they were available from Digikey and cheaper.  27nH Inductor is out of stock seemingly, so had to order that from Coilcraft directly.

L1,L2,L3 - 15nH 0603 2%, Coilcraft 0603CS-15NXGEU, quantity 12 -> Murata Equivalent, 490-15800-1-ND
L4 - 27nH 0603 2%, Coilcraft 0603CS-27NXGEU, quantity 4 (ordered direct from Coilcraft) -> Murata Equivalent, 490-15814-1-ND

Resistors: No changes

Under the shielding can the 4000 AFE looks somewhat different to the 3000 photos which gave some concern but turned out alright.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on March 07, 2021, 09:24:21 am
Nicely done!
The most interesting part is K504, it confirms they use a single PCB layout for 200 MHz to 1.5 GHz. If I ever get a 4000 series I will figure out the part swaps needed to mod to 1.5 GHz. It sure is hard to get a great deal on a 4000 series machine though, maybe Daniel has one he wants to sacrifice. I won't add any lights or water cooling to it though, just pure delightful bandwidth.   >:D >:D >:D >:D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Someone on March 07, 2021, 11:20:34 am
Nicely done!
The most interesting part is K504, it confirms they use a single PCB layout for 200 MHz to 1.5 GHz. If I ever get a 4000 series I will figure out the part swaps needed to mod to 1.5 GHz. It sure is hard to get a great deal on a 4000 series machine though, maybe Daniel has one he wants to sacrifice. I won't add any lights or water cooling to it though, just pure delightful bandwidth.   >:D >:D >:D >:D
I remember some marketing material talking about a 1.5GHz 3000 series (extra bandwidth for USB2.0 measurements/decode) but it seems like that was pushed up/out to segment the market. Or perhaps it never quite worked reliably! Dunno.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on March 07, 2021, 11:38:46 am
Nicely done!
The most interesting part is K504, it confirms they use a single PCB layout for 200 MHz to 1.5 GHz. If I ever get a 4000 series I will figure out the part swaps needed to mod to 1.5 GHz. It sure is hard to get a great deal on a 4000 series machine though, maybe Daniel has one he wants to sacrifice. I won't add any lights or water cooling to it though, just pure delightful bandwidth.   >:D >:D >:D >:D
I remember some marketing material talking about a 1.5GHz 3000 series (extra bandwidth for USB2.0 measurements/decode) but it seems like that was pushed up/out to segment the market. Or perhaps it never quite worked reliably! Dunno.
Not only marketing material. In some early manuals for 3000T series, 1.5 GHz was mentioned, and also realtime sampling and ETS is mentioned. I think it is just marketing segmentation.  There is a considerable difference between 4000 and 3000A series. 3000T is literally identical, simply a hardware variant of 4000.
It seems to me that, under pressure to refresh 3000 series line, they simply took 4000, removed one siggen ch, and crammed 4000 into 3000 case. It might be even that on siggen channel was removed simply because there was no place  for BNC.
But 1.5 GHz is not that much more useful than 1GHz (which goes to 1.1, 1.2 GHz anyways), and even with 1 GHz it is struggling not to alias with all 4 CH on. On 1.5 GHz they recommend to use ETS if you need all 4 ch to avoid aliasing.
If it had 4 A/D converters, than it would be different story...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on March 07, 2021, 08:10:56 pm
The 3000T can certainly do 1.5 GHz - that is what my MSOX3024T currently shows :)
The 4000A is pretty much the same unit with the second AWG and built in VGA/Lan.
Going from 200/500MHz to 1/1.5 GHz requires quite a few parts to be changed(~160). I think it is very likely all of the same parts my 3000T needed but they are in different locations so it would take some time to verify everything. I have no doubt it could be done, just need a patient.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on March 07, 2021, 08:36:25 pm
When you do such drastic upgrade, how's trigger stability go ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on March 07, 2021, 08:55:15 pm
Nicely done!
The most interesting part is K504, it confirms they use a single PCB layout for 200 MHz to 1.5 GHz. If I ever get a 4000 series I will figure out the part swaps needed to mod to 1.5 GHz. It sure is hard to get a great deal on a 4000 series machine though, maybe Daniel has one he wants to sacrifice. I won't add any lights or water cooling to it though, just pure delightful bandwidth.   >:D >:D >:D >:D
I remember some marketing material talking about a 1.5GHz 3000 series (extra bandwidth for USB2.0 measurements/decode) but it seems like that was pushed up/out to segment the market. Or perhaps it never quite worked reliably! Dunno.

While I understand the market segmentation aspect, a feature of the competitor Tek MDO3000/3 series is that the 1GHz/5Gsa/s model does USB 2.0 trigger/decode. I use this feature on the MDO4000, it's one of the very few reasons that scope even earns its place on the bench! FWIW, the MDO4000 also offers Ethernet 10BASE-T and 100BASE-TX trigger/decode, something that I don't believe the KS 4000 offers. However unlike the Tek 3/4 series, the KS 3000T & 4000 do offer USB PD.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Someone on March 07, 2021, 10:21:31 pm
Nicely done!
The most interesting part is K504, it confirms they use a single PCB layout for 200 MHz to 1.5 GHz. If I ever get a 4000 series I will figure out the part swaps needed to mod to 1.5 GHz. It sure is hard to get a great deal on a 4000 series machine though, maybe Daniel has one he wants to sacrifice. I won't add any lights or water cooling to it though, just pure delightful bandwidth.   >:D >:D >:D >:D
I remember some marketing material talking about a 1.5GHz 3000 series (extra bandwidth for USB2.0 measurements/decode) but it seems like that was pushed up/out to segment the market. Or perhaps it never quite worked reliably! Dunno.
Not only marketing material. In some early manuals for 3000T series, 1.5 GHz was mentioned, and also realtime sampling and ETS is mentioned.
... I was thinking back to the 3000A release!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on March 07, 2021, 10:46:16 pm
When you do such drastic upgrade, how's trigger stability go ?

I suppose it is a drastic upgrade but the Keysight selfcal takes care of everything very nicely. The trigger stability isn't fantastic 1 GHz and above, but that seems to be all 3000/4000 series modded or factory.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sievil on March 10, 2021, 07:31:40 am

So have these TWO files on your USB:

1) infiniivision.lnk
2) upgrade_file.ksx


DSOX 4000X Series:  FW:  7.35.2020120823_patched  https://mega.nz/file/q3ABzQ5b#BH08CEf_Q0T7Z3kQMOzmHZTGubIGKPanCiq8my69TyM
md5: <04D0B52B8400F03B3EA87B90DE8FC004>[/b]

Please let me know if there are any issues with any of these!


Things went south my my MSOX4054A. "System concerns detected: -[2] Firmware update failed (aux -v)"
Now this message pop up even using the official firmware “4000X.7.35.2020120823.ksx”.

Before update, version : 2.xx (I can not remenber)
After update, version: 7.35
Yep, big jump, maybe this is how this flaut come ?

infiniivision.lnk : 38#infiniiVisionLauncher.exe -l D4000BDLA
 and
4000X.7.35.2020120823_patched.ksx
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on March 13, 2021, 01:44:11 pm
My friend has a DSOX3034A.
It has NAND corruption problem.
Now,I need 3000A v2.36 firmware to help my friend to repair it.
Can you send the 3000A v2.36 firmware to me?
Thank you.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on March 13, 2021, 10:45:55 pm

So have these TWO files on your USB:

1) infiniivision.lnk
2) upgrade_file.ksx


Please let me know if there are any issues with any of these!


Things went south my my MSOX4054A. "System concerns detected: -[2] Firmware update failed (aux -v)"
Now this message pop up even using the official firmware “4000X.7.35.2020120823.ksx”.

Before update, version : 2.xx (I can not remenber)
After update, version: 7.35
Yep, big jump, maybe this is how this flaut come ?

infiniivision.lnk : 38#infiniiVisionLauncher.exe -l D4000BDLA
 and
4000X.7.35.2020120823_patched.ksx

Wow, that is quite an old firmware you had on there!   Any idea how long ago that 2.xx firmware was installed?  or what year that is from?

I have no idea what that error could be, but that really is a large version jump... maybe you should try to find a version or two in between, like 3.xx or 4.xx?  wonder if anyone on here has a real old version you could try to go to, before going straight to 7.xx?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on March 13, 2021, 11:04:29 pm
It would be good to connect to the internal UART while performing the firmware update, it will likely indicate what the problem is.
Also, did you perform the update with patched firmware or factory firmware? I'd always start with factory firmware first to verify it is all good.
I've never heard of or seen 2.x for the 4000 series and think it started with 3.x, went to 4.x and then quickly jumped to 7.x.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kimwu on March 16, 2021, 08:49:40 am
Here you are 4000x firmware
InfiniiVision 4000 X-Series Oscilloscope v3.20
http://jays.co.kr/1_keysight/Oscilloscope-4000X.asp?layer=1 (http://jays.co.kr/1_keysight/Oscilloscope-4000X.asp?layer=1)
4000XSeries.04.08.2016071801.agx
https://drivers.plus/es/keysight-msox4032a-oscilloscope-firmware-4-08/273190/ (https://drivers.plus/es/keysight-msox4032a-oscilloscope-firmware-4-08/273190/)

that I can find old version in WEB
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mark on March 16, 2021, 09:45:13 am
My friend has a DSOX3034A.
It has NAND corruption problem.
Now,I need 3000A v2.36 firmware to help my friend to repair it.
Can you send the 3000A v2.36 firmware to me?
Thank you.

This any good?
3000XSeries.02.35.2013061800.cab
https://www.dropbox.com/s/2jq5uskjo85smz8/3000XSeries.02.35.2013061800.cab?dl=0 (https://www.dropbox.com/s/2jq5uskjo85smz8/3000XSeries.02.35.2013061800.cab?dl=0)


I also have 2.37, but not 2.36. 

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on March 18, 2021, 03:18:58 pm
My friend has a DSOX3034A.
It has NAND corruption problem.
Now,I need 3000A v2.36 firmware to help my friend to repair it.
Can you send the 3000A v2.36 firmware to me?
Thank you.

This any good?
3000XSeries.02.35.2013061800.cab
https://www.dropbox.com/s/2jq5uskjo85smz8/3000XSeries.02.35.2013061800.cab?dl=0 (https://www.dropbox.com/s/2jq5uskjo85smz8/3000XSeries.02.35.2013061800.cab?dl=0)


I also have 2.37, but not 2.36.
Thank you,Mark.
I also have 2.35 and 2.37,but not 2.36.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on March 18, 2021, 04:10:14 pm
There are some releases that were shipped with scopes from the factory but were never posted for download as they were superseded quickly. Usually one rev newer or older will still work to recovery the scope.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on March 18, 2021, 07:42:54 pm
My friend has a DSOX3034A.
It has NAND corruption problem.
Now,I need 3000A v2.36 firmware to help my friend to repair it.
Can you send the 3000A v2.36 firmware to me?
Thank you.

This any good?
3000XSeries.02.35.2013061800.cab
https://www.dropbox.com/s/2jq5uskjo85smz8/3000XSeries.02.35.2013061800.cab?dl=0 (https://www.dropbox.com/s/2jq5uskjo85smz8/3000XSeries.02.35.2013061800.cab?dl=0)


I also have 2.37, but not 2.36.
Thank you,Mark.
I also have 2.35 and 2.37,but not 2.36.
I fixed 2-3 scopes with the NAND issue and I don't recall having to match the exact firmware that was installed to recover them.  I know it is recommended in some posts, but I could not confirm it, as I repaired 2 scopes (probably with different firmware vesions) using the same USB drive
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on March 18, 2021, 07:56:16 pm
My friend has a DSOX3034A.
It has NAND corruption problem.
Now,I need 3000A v2.36 firmware to help my friend to repair it.
Can you send the 3000A v2.36 firmware to me?
Thank you.

This any good?
3000XSeries.02.35.2013061800.cab
https://www.dropbox.com/s/2jq5uskjo85smz8/3000XSeries.02.35.2013061800.cab?dl=0 (https://www.dropbox.com/s/2jq5uskjo85smz8/3000XSeries.02.35.2013061800.cab?dl=0)


I also have 2.37, but not 2.36.
Thank you,Mark.
I also have 2.35 and 2.37,but not 2.36.
I fixed 2-3 scopes with the NAND issue and I don't recall having to match the exact firmware that was installed to recover them.  I know it is recommended in some posts, but I could not confirm it, as I repaired 2 scopes (probably with different firmware vesions) using the same USB drive

yes you are not alone. In the course of fixing mine I also realized the FW on the USB stick does not need to match whatever is on the scope. At least I think there is a good margin of error in terms of FW versions on the USB and in the scope
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kwc on March 26, 2021, 01:48:41 am
I was able to resurrect a 3000 series scope with 2.12 firmware installed using 2.20 on serial/USB (after failing with 2.35 and 2.10). Thanks to titiris for the instructions and to everyone else who contributed info and resources for the fix!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JoeB83 on March 28, 2021, 03:12:20 pm
Hi all, I originally posted in the repair sub but I was pointed here for some help. I'm having trouble with my DSOX2022A, it won’t load past the load screen. When I hit the power button some of the front panel lights turn on and a few seconds later the Agilent load screen shows, then front panel lights cycle infinitely. I tried loading the firmware onto a USB drive and the same thing happens, only with the Agilent logo instead of the standard load screen. I’m hoping it’s something fixable by me but I have a feeling I’m either going to have to send it to Keysight for repair or sell it as broken. I’ve included two YouTube links so you can see what it’s doing. I did look at the service manual, and there’s no mention of a no-boot condition.

Attempt to load with no USB with firmware: https://youtu.be/IvfEGOL7GaU

Attempt to load with USB and firmware loaded: https://youtu.be/vETqq8jvtOE

Thank you so very much for any info at all.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on March 28, 2021, 06:29:50 pm
Did you already open the case? (What happened to the knobs?)
If you can connect to the serial port it would give information about the nature of the problem.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JoeB83 on March 28, 2021, 11:56:44 pm
I opened it to see if there was anything very obviously wrong like a blown component or disconnected connector, but no such luck.

How can I attach to the serial port? Unfortunately I don’t have the LAN extension card, I’m guessing that’s how?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on March 29, 2021, 07:26:45 am
There is a header connector on the main pcb which gives you access to a TTL level serial console port.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JoeB83 on March 31, 2021, 04:19:23 am
I have no idea how to connect to the serial port or how to read it but I’m happy to learn. I’m assuming it’s been covered in this thread somewhere, but my search leads nowhere, any hints?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on March 31, 2021, 07:16:46 am
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895)
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JoeB83 on March 31, 2021, 07:29:29 pm
Oh boy. I have some heavy duty learning to do. Thank you!

If I can’t figure it out, it may be for sale....
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on March 31, 2021, 08:56:49 pm
Oh boy. I have some heavy duty learning to do. Thank you!

If I can’t figure it out, it may be for sale....
Have you checked it is not a NAND corruption issue?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JoeB83 on April 01, 2021, 03:52:09 am
Oh boy. I have some heavy duty learning to do. Thank you!

If I can’t figure it out, it may be for sale....
Have you checked it is not a NAND corruption issue?

I have not. Honestly I don’t know how, I normally make simple analog stuff, this type of thing is pretty new to me.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on April 01, 2021, 04:20:31 am
Oh boy. I have some heavy duty learning to do. Thank you!

If I can’t figure it out, it may be for sale....

I have a bit of a long shot for you to try with a special USB image - will send you a PM with a download link.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JoeB83 on April 01, 2021, 04:51:43 am
That’s very kind of you, I’ll give it a shot. Thank you!!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JoeB83 on April 02, 2021, 03:21:13 am
Oh boy. I have some heavy duty learning to do. Thank you!

If I can’t figure it out, it may be for sale....

I have a bit of a long shot for you to try with a special USB image - will send you a PM with a download link.

Unfortunately it did not work, thank you so much for the help though.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on April 03, 2021, 08:05:21 pm
Hello, a new 2.65 firmware was released. https://www.keysight.com/zz/en/lib/software-detail/instrument-firmware-software/installing-infiniivision-2000-xseries-oscilloscope-firmware-2014479.html (https://www.keysight.com/zz/en/lib/software-detail/instrument-firmware-software/installing-infiniivision-2000-xseries-oscilloscope-firmware-2014479.html)
I wonder what this is.
Quote
New Features for 2000A This software revision includes the following new capabilities: -Added support for the following new perpetual software licenses: D2000GENB, D2000AUTB, D2000BDLB
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Dwaine on April 04, 2021, 02:32:52 am
Hello, a new 2.65 firmware was released. https://www.keysight.com/zz/en/lib/software-detail/instrument-firmware-software/installing-infiniivision-2000-xseries-oscilloscope-firmware-2014479.html (https://www.keysight.com/zz/en/lib/software-detail/instrument-firmware-software/installing-infiniivision-2000-xseries-oscilloscope-firmware-2014479.html)
I wonder what this is.
Quote
New Features for 2000A This software revision includes the following new capabilities: -Added support for the following new perpetual software licenses: D2000GENB, D2000AUTB, D2000BDLB

Anybody try and upgrade their device?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on April 04, 2021, 04:22:16 am
7.40 was also released for the 3000t series etc.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on April 04, 2021, 07:29:02 am
7.40 was also released for the 3000t series etc.
Yes,
7.40 brings two bug fixes, but it is mostly for support their current license model changes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: msuthar on April 10, 2021, 01:30:15 pm

For Firmware 2.65 
D2000GENB, D2000AUTB, D2000BDLB  for DSO X 2000 series.

What is this new B version ?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: moloko on April 16, 2021, 08:17:53 pm
Hi guys, its my first post here on EEVblog forum.

Got myself a Keysight DSO-X 2002A and it got me thinking to upgrade my scope to 4 channels, as I have seen it done by somebody here.

Since the 3000 series has the same frontend amplifier ASIC (the 2AD2-0001) as the 2000 series, the difference between these two basically boils down to the additional 50 ohm input  for the 3000?

Would it be possible to change the passive components to allow for 350 Mhz bandwidth, for example? (I suppose that the component swap can bring you all the way up to 500 MHz but I suppose without real 50 ohm input it's not really that useful anyway?)

Does it mean that I have to also change the resistors to make the firmware think its a 3000 scope?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on April 17, 2021, 05:43:41 pm
I think that the 3000 series has a lot different PCB than the 2000 series.
https://www.flickr.com/photos/eevblog/albums/72157626755861230 (https://www.flickr.com/photos/eevblog/albums/72157626755861230)
https://www.flickr.com/photos/eevblog/albums/72157626631250619 (https://www.flickr.com/photos/eevblog/albums/72157626631250619)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on April 17, 2021, 07:27:37 pm
I believe the 3000X has 2 ASICs and the 2000X only 1, i.e. the 2000X has only 8 digital channels and you cannot have both serial decoding and digital channels at the same time.

I don't think you can convert a 2000X to a 3000X.  What probably is possible is adding the additional 2 channels if you add all the missing components and it also might require changing some resistors to indicate it is a 4 channel model
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: felixsys on April 21, 2021, 11:59:02 am
Successfully patch my MSOX3032T without LAN!

The only option that I failed to install is the 500mhz upgrade option.

Anyone already did it on this model ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pquadrat on April 24, 2021, 09:45:41 am
Succesfully loaded the patched firmware to my DSOX3014T, and activated the options in the infiniivision.lnk file.

And I also did the HW modification for 500MHz Bandwith, wich is also (after some trouble with a bad solder joint) working fine.

Before self calibration, bandwith was even higher.

Scope triggers above 1GHz without problems.

Maybe I should try the self cal with something limiting the bandwith above 500MHz a little bit, so the algorithm configures the build-in software filters a little bit more "open"?

-Peter
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hexley on April 27, 2021, 12:02:45 am
Speaking of calibration, is anyone aware of a way to read back the calibration constants from a DSOX3000-series scope?

I am investigating a situation where Channel 3 of my DSOX3024A (liberated to MSOX3054A) repeatedly does the following:

It would be very helpful if there were a way to read back the calibration data right after the user cal, then again after the channel develops its issues and see if the cal data has flipped a bit somewhere.

I searched the web, but found nothing. Any help would be much appreciated.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Saskia on April 27, 2021, 07:50:26 am
did you perform the hw upgrade to the 350 MHz version before trying to push it to 500 MHz ?
 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: felixsys on April 27, 2021, 08:32:06 pm

infiniivisionLauncher.exe -l all -l BW50 -l SCPIPS

With this command, all all existing mso3000x options :)) and 500mhz are unlocked ! perfect.

Installed Options


Support ID : MSO-X 3032T

           
ModelDescriptionInstalledSupport ExpirationStatus
D3000AUTAAutomotive Software for 3000 X-SeriesYes
D3000GENAEmbedded Software for 3000 X-SeriesYes
D3000AERAAerospace Software for 3000 X-SeriesYes
D3000PWRAPower Supply Test Software for 3000 X-SeriesYes
D3000USBAUSB Test Software for 3000 X-SeriesYes
D3000NFCANFC Software for 3000 X-SeriesYes
D3000BDLAUltimate Bundle Software for 3000 X-SeriesYesEnable all software applications on the InfiniiVision 3000A X- and 3000T X-Series oscilloscopes

MSOMSOYesN/AN/A
MEMUPAcq Memory 4MYesN/AN/A
SGMSegmented MemoryYesN/AN/A
BW50500MHz BandwidthYesN/AN/A
EDKEducation kit licenseYesN/AN/A
WAVEGENWaveGen licenseYesN/AN/A
ADVMATHAdvanced MathYesN/AN/A
DVMCTRDigital Voltmeter and CounterYesN/AN/A
SCPIPSInfiniium ModeYesN/AN/A
RMLRemote LogYesN/AN/A
     
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Palidubi on April 29, 2021, 04:44:38 pm
I did what Titiris wrote step by step but with some changes and it worked for a DSO-X2024. The point is that the .py script gave a little trouble maybe due to the python version I used (the last one): I had to add parenthesis to delimite the strings. I used the new firmware 2.65 (because v2.35 is not available anymore) but without the line ' infiniivisionStartupOverride.txt ' (USB pendrive). At the end I updated via USB using the .ksx file. Everything was ok and the important thing...with the firmware available on the Keysight web right today.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on May 03, 2021, 09:56:42 am
Is it any patch for DSOX 2000X Series,  Firmware  02.65?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on May 04, 2021, 06:57:24 pm
Quote
Is it any patch for DSOX 2000X Series,  Firmware  02.65?


Hi All,


I did all the new FWs... I'll have these posted up tomorrow...


(2.65 & 7.40)

is it gonna be on the same post #2606?
thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on May 04, 2021, 08:00:31 pm
the new firmware refers to D3000BDLB bundle option but I cannot find any information on that.
Previously it was D3000BDLA and I have it on my scope (2.60)

anybody knows what the difference is?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on May 04, 2021, 09:22:04 pm
It was my understanding that the 2000 and 3000 shared the same firmware, why the different 2000X and 3000A files?

Thanks in advance
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Venturi962 on May 04, 2021, 10:53:25 pm
Tried to update on my 4024A w/ patched 7.40, got the error message previously shared:

"System concerns detected: -[2] Firmware update failed (aux -v)"

Switched out the license file for a default one without any options via Telnet and got the same thing.  So remain on 7.35 with options unlocked.

If anyone has UART Pinout for 4000X please share and I will try and see if anything useful is being outputted.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on May 05, 2021, 12:38:19 am
Tried to update on my 4024A w/ patched 7.40, got the error message previously shared:

"System concerns detected: -[2] Firmware update failed (aux -v)"

Switched out the license file for a default one without any options via Telnet and got the same thing.  So remain on 7.35 with options unlocked.

If anyone has UART Pinout for 4000X please share and I will try and see if anything useful is being outputted.
Same here with a 3000T
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on May 05, 2021, 01:01:35 am
No problem with 3000A here.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: msuthar on May 05, 2021, 01:47:55 am
No problem with DSO-X 2004A here.
Update with D2000AUTB,D2000GENB,D2000BDLB
Could not find any difference with older D2000XXXA Version
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on May 05, 2021, 09:06:53 am
If anyone has UART Pinout for 4000X please share and I will try and see if anything useful is being outputted.
Its J3402. See photos attached. Thankfully Agilent fitted the connector already with pins.
These are 3.3V (I guess) signals. You need an UART<>USB adapter, never connect RS232 directly.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on May 05, 2021, 12:13:41 pm
I also didnt notice any difference between D3000BDLB and D3000BDLA
but why did they change the name?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: viki2000 on May 05, 2021, 01:56:11 pm
It is been written so for 2.65:
New Features for 3000A
This software revision includes the following new capabilities:
- Added support for the following new perpetual software licenses:
o D3000GENB, D3000AERB, D3000AUTB, D3000PWRB, D3000BDLB
New Features for 2000A
This software revision includes the following new capabilities:
- Added support for the following new perpetual software licenses:
o D2000GENB, D2000AUTB, D2000BDLB
Bug Fixes for both 2000A and 3000A
- Corrected wrong number of points returned for the first acquisition after changing
acquisition settings.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Venturi962 on May 05, 2021, 06:06:11 pm
Thanks Pinkus.  Grabbed output from UART, seems to fail when trying to delete this symbols.tte file:

** BEGIN ** ExtractFileFromCabFile: auxInstallStep.exe
** END   ** ExtractFileFromCabFile: auxInstallStep.exe: 43 ms
** BEGIN ** ProcessRecipeStep: \TEMP\{DDCB3794-591A-81FE-C17A-0BE1729F178D}\auxInstallStep.exe -v -s
=== Aux Step: -v -s ===
Skipped.
Deleting existing symbols.tte.old file.
Failed to moved symbols.tte.
ERR: 2
** END   ** ProcessRecipeStep: \TEMP\{DDCB3794-591A-81FE-C17A-0BE1729F178D}\auxInstallStep.exe -v -s: 30 ms

I can't manually delete it either, located at \Secure\infiniivision

'del symbols.tte.old'
'Cannot remove symbols.tte.old'

Update

Was able to rename the file, looks like FW update is proceeding:

'rename symbols.tte.old symbols.tte.old2'

Update 2

Unlocked:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on May 05, 2021, 11:10:51 pm
Thanks Pinkus.  Grabbed output from UART, seems to fail when trying to delete this symbols.tte file:

** BEGIN ** ExtractFileFromCabFile: auxInstallStep.exe
** END   ** ExtractFileFromCabFile: auxInstallStep.exe: 43 ms
** BEGIN ** ProcessRecipeStep: \TEMP\{DDCB3794-591A-81FE-C17A-0BE1729F178D}\auxInstallStep.exe -v -s
=== Aux Step: -v -s ===
Skipped.
Deleting existing symbols.tte.old file.
Failed to moved symbols.tte.
ERR: 2
** END   ** ProcessRecipeStep: \TEMP\{DDCB3794-591A-81FE-C17A-0BE1729F178D}\auxInstallStep.exe -v -s: 30 ms

I can't manually delete it either, located at \Secure\infiniivision

'del symbols.tte.old'
'Cannot remove symbols.tte.old'

Update

Was able to rename the file, looks like FW update is proceeding:

'rename symbols.tte.old symbols.tte.old2'

Update 2

Unlocked:


Nice, that's a good find!!  I wonder if this is an unexpected firmware bug, or some 'artifact' that is added because of the 'patched' functions... interesting... I've restored the links for 3000T and 4000X, as doing this will probably fix the install issues the others were having with 3000T and 4000X..

if this issue stays in future firmwares, maybe need a pre-install step added to the recipe.xml to automatically do that 'rename' of that file as you showed..
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on May 21, 2021, 01:49:32 am
Thanks Pinkus.  Grabbed output from UART, seems to fail when trying to delete this symbols.tte file:

** BEGIN ** ExtractFileFromCabFile: auxInstallStep.exe
** END   ** ExtractFileFromCabFile: auxInstallStep.exe: 43 ms
** BEGIN ** ProcessRecipeStep: \TEMP\{DDCB3794-591A-81FE-C17A-0BE1729F178D}\auxInstallStep.exe -v -s
=== Aux Step: -v -s ===
Skipped.
Deleting existing symbols.tte.old file.
Failed to moved symbols.tte.
ERR: 2
** END   ** ProcessRecipeStep: \TEMP\{DDCB3794-591A-81FE-C17A-0BE1729F178D}\auxInstallStep.exe -v -s: 30 ms

I can't manually delete it either, located at \Secure\infiniivision

'del symbols.tte.old'
'Cannot remove symbols.tte.old'

Update

Was able to rename the file, looks like FW update is proceeding:

'rename symbols.tte.old symbols.tte.old2'

Update 2

Unlocked:
It looks like the auxInstallStep.exe in \TEMP\ stays forever until it successfully deletes the symbols.tte.old file.  After the failed attempt to install 7.40 patched on my 3000T, it does not install any other firmware, not even the factory unpatched file.

@Venturi962: Do you need LAN access to be able to rename the file or is it something that can be done with UART access?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Venturi962 on May 21, 2021, 10:34:59 pm
TK - I used Telnet over LAN (4000X) to do the file rename.  Not sure if it's possible via UART.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on May 22, 2021, 12:24:50 am
TK - I used Telnet over LAN (4000X) to do the file rename.  Not sure if it's possible via UART.
I ordered the LAN adapter PCB to build one.  Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zhangmi2021 on May 22, 2021, 10:38:32 am
Ok,

Here are the latest patched firmwares, for the 1000X, 2000X, 3000A, 3000T, 4000X......



These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things


*** Note:  ***

I have made these installs even EASIER, after the upgrade completes the install process will also make a backup of the oem lnk file that it installs during the upgrade, and then attempt to copy 'infiniivision.lnk' from the same USB stick you are doing the upgrade with...

so in otherwords, have your 'infiniivision.lnk' file READY, and on the root of your USB drive along with the patched firmware upgrade!
(this replaces having to telnet into your scope after the upgrade and having to put the .lnk file back on)

The install script at the end does these two actions:

copy \Secure\Startup\infiniivision.lnk infiniivision.lnk.original  (backs up oem file being replaced)
copy \usb\infiniivision.lnk \Secure\Startup\infiniivision.lnk     (copies .lnk file from your USB to the startup folder)

So have these TWO files on your USB:

1) infiniivision.lnk
2) upgrade_file.ksx




*** NOTE:  FOR THE 1000X....  ************************************
      This is 'BUD's' patched firmware!!  All credit goes to him and the 1000x hacking folks!  there is NO .LNK file required for this patch, just install the FW!  I repeat, there is NO .lnk file required for the
      1000x hacking

DSOX 1000X Series:  FW:  01.20.2019061038_patched  https://mega.nz/file/nrpW3T4Z#gLnn__QchpYL5FuQXLawyso2_ReaXgn-jF4MzcRZSAA
md5: <8D128F5691BCB7D178CFB8E48F3784B9>

*************************************************************

DSOX 2000X Series:  FW:  02.65.20210307001_patched  https://mega.nz/file/mzgGjBpC#yLNWn8cGjJlsLeH_fVZ3tYyPZILYJ3EtGK8F84oEFw8
md5: <AF47DDB93F9CC88911ADC65F4E55F97D>

DSOX 3000A Series:  FW:  02.65.20210307001_patched  https://mega.nz/file/j3hEzbCa#4sYGoVawZt62XnoC3ZZvUAEyf575Q6o_-iYIr-whH4w
md5: <B5EBDEEA00BCBF4DCE77D173F212B8F6>

DSOX 3000T Series:  FW:  7.40.2021031200_patched  https://mega.nz/file/rz5UXbrL#FXRPSRjLlFN16amBWt_Si74-nS8OjW5xWZPLqmBeynU
md5: <C1AA8839085890FC058D27C501AF4F08>

DSOX 4000X Series:  FW:  7.40.2021031202_patched  https://mega.nz/file/nrxwAb6R#gNp4CCdwl_oyhAzxuJSI9OopUPjbmnu7fn8E8ejeGDg
md5: <7C30FD851FB6A4B461130D61FE9C0E0C>

Please let me know if there are any issues with any of these!
Excuse me, My oscilloscope model is dsox2012A .
According to your method, I first brush the firmware version 2.65 provided by you, and then brush the ink.
The ink file I use is:
160#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO --perf -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l TOM -l BW20 -l ADVMATH -l EMBD -l EDK -l VID
After brushing the ink file, the oscilloscope  restart automatically. After the oscilloscope measurement interface pops up, an error  pop up:  “OS version is not correct.Please reload system firmware”.
Almost at the same time, the oscilloscope screen is black, and any key will not respond.
Every time the oscilloscope restarts, it's like this. How should I deal with it next? Thank you very much
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: msuthar on May 23, 2021, 05:27:57 am
The link file you used is for 3000 series.
for 2000 use this one

146#infiniivisionLauncher.exe -l MSO -l WAVEGEN --perf -l D2000AUTB -l D2000GENB -l D2000BDLB -l BW10 -l BW20 -l SCPIPS -l PLUS -l VID -l CABLE -l ASV

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zhangmi2021 on May 23, 2021, 08:26:10 am
The link file you used is for 3000 series.
for 2000 use this one

146#infiniivisionLauncher.exe -l MSO -l WAVEGEN --perf -l D2000AUTB -l D2000GENB -l D2000BDLB -l BW10 -l BW20 -l SCPIPS -l PLUS -l VID -l CABLE -l ASV
thanks so much .
As the oscilloscope screen is in a black screen state, any key does not respond, I can not carry out any operation.
So I tried to modify the ink file through telnet. I opened the oscilloscope and connected the UART port on the motherboard,plug the homemade LAN card (without video) into the oscilloscope.
At the moment of power on, pause the oscilloscope to continue to start through UART, get the IP address(192.168.1.109) , IP address of my computer is configured as:192.168.1.1.
and then enter u-boot mode. After the operation is completed, I try to log in through Telnet, but I can't connect. I use my computer to connect directly through the network cable instead of through the router. If I use the homemade LAN card, do I have to go through the router?
 I write the wrong ink file, which leads to the start failure of the oscilloscope .In this case, can homemade LAN card still be used? Or only the original LAN card of Agilent can be telnet?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on May 23, 2021, 08:50:08 am
At the moment of power on, pause the oscilloscope to continue to start through UART, get the IP address(192.168.1.109) , IP address of my computer is configured as:192.168.1.1.
and then enter u-boot mode. After the operation is completed, I try to log in through Telnet, but I can't connect. I use my computer to connect directly through the network cable instead of through the router. If I use the homemade LAN card, do I have to go through the router?
 I write the wrong ink file, which leads to the start failure of the oscilloscope .In this case, can homemade LAN card still be used? Or only the original LAN card of Agilent can be telnet?

Don't make the situation worse: it's better to use it via the router.  Are you able to ping the scope? No need to use an original card.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zhangmi2021 on May 23, 2021, 08:57:13 am
At the moment of power on, pause the oscilloscope to continue to start through UART, get the IP address(192.168.1.109) , IP address of my computer is configured as:192.168.1.1.
and then enter u-boot mode. After the operation is completed, I try to log in through Telnet, but I can't connect. I use my computer to connect directly through the network cable instead of through the router. If I use the homemade LAN card, do I have to go through the router?
 I write the wrong ink file, which leads to the start failure of the oscilloscope .In this case, can homemade LAN card still be used? Or only the original LAN card of Agilent can be telnet?

Don't make the situation worse: it's better to use it via the router.  Are you able to ping the scope? No need to use an original card.

I can't Ping this oscilloscope.
My network cable is direct connection network cable, not cross network cable. I don't have cross network cable, so I can't test it
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on May 23, 2021, 11:29:41 am
My network cable is direct connection network cable, not cross network cable. I don't have cross network cable, so I can't test it

Then you should connect via router/switch, just in case.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zhangmi2021 on May 26, 2021, 11:07:18 am
My network cable is direct connection network cable, not cross network cable. I don't have cross network cable, so I can't test it

Then you should connect via router/switch, just in case.
I connected the oscilloscope through the router
When I use Ping or Telnet, UART receives a prompt: not UDP
What is the problem? Do I have any way to repair this oscilloscope?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on May 26, 2021, 04:35:40 pm
My network cable is direct connection network cable, not cross network cable. I don't have cross network cable, so I can't test it

Then you should connect via router/switch, just in case.
I connected the oscilloscope through the router
When I use Ping or Telnet, UART receives a prompt: not UDP
What is the problem? Do I have any way to repair this oscilloscope?
My guess is that it is trying to boot from a network server to download and flash a new firmware image
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zhangmi2021 on May 30, 2021, 01:17:20 pm
My network cable is direct connection network cable, not cross network cable. I don't have cross network cable, so I can't test it

Then you should connect via router/switch, just in case.
I connected the oscilloscope through the router
When I use Ping or Telnet, UART receives a prompt: not UDP
What is the problem? Do I have any way to repair this oscilloscope?
My guess is that it is trying to boot from a network server to download and flash a new firmware image
yes ,I have succeeded. Download the firmware from the network, start it, and then fix the ink
thanks every one
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jean-Michel on June 09, 2021, 12:39:12 pm
Hello,
Being new to the site, please be patient with me :-)

I have a DSOX4024A and I managed to unlock the options according to your messages, except the bandwidth which remains at 200 mhZ, even with the BW50 option.

Is it possible to unlock the BW apr soft or must it be done by Hard?

Thank you for your return

Jean-michel
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on June 09, 2021, 12:51:11 pm
Hello,
Being new to the site, please be patient with me :-)

I have a DSOX4024A and I managed to unlock the options according to your messages, except the bandwidth which remains at 200 mhZ, even with the BW50 option.

Is it possible to unlock the BW apr soft or must it be done by Hard?

Thank you for your return

Jean-michel

200MHz cannot be upgraded to higher BW by software alone. Needs circuit modifications on all 4 front ends
100MHz->200MHz software only
350MHz->500MHz software only
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jean-Michel on June 09, 2021, 02:31:38 pm
Many thanks

It’s difficult to modify ?

Jm
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on June 09, 2021, 02:34:37 pm
Many thanks

It’s difficult to modify ?

Jm

yes it is in my view. I have never done it but TheSteve has implemented and posted full details on the forum . I dont have the link at hand.
I think it was for a 3000X but it should be the same for 4000X front end. Others may correct me.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mortys on June 15, 2021, 06:42:33 am
Ok,

Here are the latest patched firmwares, for the 1000X, 2000X, 3000A, 3000T, 4000X......



These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things


*** Note:  ***

I have made these installs even EASIER, after the upgrade completes the install process will also make a backup of the oem lnk file that it installs during the upgrade, and then attempt to copy 'infiniivision.lnk' from the same USB stick you are doing the upgrade with...

so in otherwords, have your 'infiniivision.lnk' file READY, and on the root of your USB drive along with the patched firmware upgrade!
(this replaces having to telnet into your scope after the upgrade and having to put the .lnk file back on)

The install script at the end does these two actions:

copy \Secure\Startup\infiniivision.lnk infiniivision.lnk.original  (backs up oem file being replaced)
copy \usb\infiniivision.lnk \Secure\Startup\infiniivision.lnk     (copies .lnk file from your USB to the startup folder)

So have these TWO files on your USB:

1) infiniivision.lnk
2) upgrade_file.ksx




*** NOTE:  FOR THE 1000X....  ************************************
      This is 'BUD's' patched firmware!!  All credit goes to him and the 1000x hacking folks!  there is NO .LNK file required for this patch, just install the FW!  I repeat, there is NO .lnk file required for the
      1000x hacking

DSOX 1000X Series:  FW:  01.20.2019061038_patched  https://mega.nz/file/nrpW3T4Z#gLnn__QchpYL5FuQXLawyso2_ReaXgn-jF4MzcRZSAA
md5: <8D128F5691BCB7D178CFB8E48F3784B9>

*************************************************************

DSOX 2000X Series:  FW:  02.65.20210307001_patched  https://mega.nz/file/mzgGjBpC#yLNWn8cGjJlsLeH_fVZ3tYyPZILYJ3EtGK8F84oEFw8
md5: <AF47DDB93F9CC88911ADC65F4E55F97D>

DSOX 3000A Series:  FW:  02.65.20210307001_patched  https://mega.nz/file/j3hEzbCa#4sYGoVawZt62XnoC3ZZvUAEyf575Q6o_-iYIr-whH4w
md5: <B5EBDEEA00BCBF4DCE77D173F212B8F6>

DSOX 3000T Series:  FW:  7.40.2021031200_patched  https://mega.nz/file/rz5UXbrL#FXRPSRjLlFN16amBWt_Si74-nS8OjW5xWZPLqmBeynU
md5: <C1AA8839085890FC058D27C501AF4F08>

DSOX 4000X Series:  FW:  7.40.2021031202_patched  https://mega.nz/file/nrxwAb6R#gNp4CCdwl_oyhAzxuJSI9OopUPjbmnu7fn8E8ejeGDg
md5: <7C30FD851FB6A4B461130D61FE9C0E0C>

Please let me know if there are any issues with any of these!

good morning I have a dso 2002A I have read all the messages and I still do not know how to do it right I am afraid of blocking my oscilloscope
  I don't know where to get the files from
  1) infiniivision.lnk
2) upgrade_file.ksx
Could you help me, I am very clumsy with this programming thing, I am already an elderly person
thanks for your understanding and a greeting
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tian1043 on June 15, 2021, 01:24:25 pm
I tried the corresponding patch file on my DSOX3012T machine, it can be upgraded normally, but the option has not changed, I am sure the accuracy of the lnk file, and then I try to log in to the device via telnet, and find that the password is wrong, which prevents me from logging in to the device. It is estimated that this is why the upgrade is not successful, whether the machine has changed the telnet password and all subsequent file operations have not been completed

Ok,

Here are the latest patched firmwares, for the 1000X, 2000X, 3000A, 3000T, 4000X......



These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things


*** Note:  ***

I have made these installs even EASIER, after the upgrade completes the install process will also make a backup of the oem lnk file that it installs during the upgrade, and then attempt to copy 'infiniivision.lnk' from the same USB stick you are doing the upgrade with...

so in otherwords, have your 'infiniivision.lnk' file READY, and on the root of your USB drive along with the patched firmware upgrade!
(this replaces having to telnet into your scope after the upgrade and having to put the .lnk file back on)

The install script at the end does these two actions:

copy \Secure\Startup\infiniivision.lnk infiniivision.lnk.original  (backs up oem file being replaced)
copy \usb\infiniivision.lnk \Secure\Startup\infiniivision.lnk     (copies .lnk file from your USB to the startup folder)

So have these TWO files on your USB:

1) infiniivision.lnk
2) upgrade_file.ksx




*** NOTE:  FOR THE 1000X....  ************************************
      This is 'BUD's' patched firmware!!  All credit goes to him and the 1000x hacking folks!  there is NO .LNK file required for this patch, just install the FW!  I repeat, there is NO .lnk file required for the
      1000x hacking

DSOX 1000X Series:  FW:  01.20.2019061038_patched  https://mega.nz/file/nrpW3T4Z#gLnn__QchpYL5FuQXLawyso2_ReaXgn-jF4MzcRZSAA
md5: <8D128F5691BCB7D178CFB8E48F3784B9>

*************************************************************

DSOX 2000X Series:  FW:  02.65.20210307001_patched  https://mega.nz/file/mzgGjBpC#yLNWn8cGjJlsLeH_fVZ3tYyPZILYJ3EtGK8F84oEFw8
md5: <AF47DDB93F9CC88911ADC65F4E55F97D>

DSOX 3000A Series:  FW:  02.65.20210307001_patched  https://mega.nz/file/j3hEzbCa#4sYGoVawZt62XnoC3ZZvUAEyf575Q6o_-iYIr-whH4w
md5: <B5EBDEEA00BCBF4DCE77D173F212B8F6>

DSOX 3000T Series:  FW:  7.40.2021031200_patched  https://mega.nz/file/rz5UXbrL#FXRPSRjLlFN16amBWt_Si74-nS8OjW5xWZPLqmBeynU
md5: <C1AA8839085890FC058D27C501AF4F08>

DSOX 4000X Series:  FW:  7.40.2021031202_patched  https://mega.nz/file/nrxwAb6R#gNp4CCdwl_oyhAzxuJSI9OopUPjbmnu7fn8E8ejeGDg
md5: <7C30FD851FB6A4B461130D61FE9C0E0C>

Please let me know if there are any issues with any of these!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on June 16, 2021, 04:48:38 am
I tried the corresponding patch file on my DSOX3012T machine, it can be upgraded normally, but the option has not changed, I am sure the accuracy of the lnk file, and then I try to log in to the device via telnet, and find that the password is wrong, which prevents me from logging in to the device. It is estimated that this is why the upgrade is not successful, whether the machine has changed the telnet password and all subsequent file operations have not been completed

Ok,

Here are the latest patched firmwares, for the 1000X, 2000X, 3000A, 3000T, 4000X......



These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things


*** Note:  ***

I have made these installs even EASIER, after the upgrade completes the install process will also make a backup of the oem lnk file that it installs during the upgrade, and then attempt to copy 'infiniivision.lnk' from the same USB stick you are doing the upgrade with...

so in otherwords, have your 'infiniivision.lnk' file READY, and on the root of your USB drive along with the patched firmware upgrade!
(this replaces having to telnet into your scope after the upgrade and having to put the .lnk file back on)

The install script at the end does these two actions:

copy \Secure\Startup\infiniivision.lnk infiniivision.lnk.original  (backs up oem file being replaced)
copy \usb\infiniivision.lnk \Secure\Startup\infiniivision.lnk     (copies .lnk file from your USB to the startup folder)

So have these TWO files on your USB:

1) infiniivision.lnk
2) upgrade_file.ksx




*** NOTE:  FOR THE 1000X....  ************************************
      This is 'BUD's' patched firmware!!  All credit goes to him and the 1000x hacking folks!  there is NO .LNK file required for this patch, just install the FW!  I repeat, there is NO .lnk file required for the
      1000x hacking

DSOX 1000X Series:  FW:  01.20.2019061038_patched  https://mega.nz/file/nrpW3T4Z#gLnn__QchpYL5FuQXLawyso2_ReaXgn-jF4MzcRZSAA (https://mega.nz/file/nrpW3T4Z#gLnn__QchpYL5FuQXLawyso2_ReaXgn-jF4MzcRZSAA)
md5: <8D128F5691BCB7D178CFB8E48F3784B9>

*************************************************************

DSOX 2000X Series:  FW:  02.65.20210307001_patched  https://mega.nz/file/mzgGjBpC#yLNWn8cGjJlsLeH_fVZ3tYyPZILYJ3EtGK8F84oEFw8 (https://mega.nz/file/mzgGjBpC#yLNWn8cGjJlsLeH_fVZ3tYyPZILYJ3EtGK8F84oEFw8)
md5: <AF47DDB93F9CC88911ADC65F4E55F97D>

DSOX 3000A Series:  FW:  02.65.20210307001_patched  https://mega.nz/file/j3hEzbCa#4sYGoVawZt62XnoC3ZZvUAEyf575Q6o_-iYIr-whH4w (https://mega.nz/file/j3hEzbCa#4sYGoVawZt62XnoC3ZZvUAEyf575Q6o_-iYIr-whH4w)
md5: <B5EBDEEA00BCBF4DCE77D173F212B8F6>

DSOX 3000T Series:  FW:  7.40.2021031200_patched  https://mega.nz/file/rz5UXbrL#FXRPSRjLlFN16amBWt_Si74-nS8OjW5xWZPLqmBeynU (https://mega.nz/file/rz5UXbrL#FXRPSRjLlFN16amBWt_Si74-nS8OjW5xWZPLqmBeynU)
md5: <C1AA8839085890FC058D27C501AF4F08>

DSOX 4000X Series:  FW:  7.40.2021031202_patched  https://mega.nz/file/nrxwAb6R#gNp4CCdwl_oyhAzxuJSI9OopUPjbmnu7fn8E8ejeGDg (https://mega.nz/file/nrxwAb6R#gNp4CCdwl_oyhAzxuJSI9OopUPjbmnu7fn8E8ejeGDg)
md5: <7C30FD851FB6A4B461130D61FE9C0E0C>

Please let me know if there are any issues with any of these!
Read post https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3563584/#msg3563584 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3563584/#msg3563584)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 18, 2021, 08:26:55 pm
Hi.
I have a corrupted firmware on a DSOX2024A.
It does not boot. I would need the 2.35 firmware to fix it.
I can not find it to dowload. If you have a link please?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 18, 2021, 10:27:55 pm
Sorry but I was typing wrong. Was reading too much posts. :)
I need the 2.35 firmware for the DSO4024A. if you have it please?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on June 19, 2021, 03:58:26 am
Sorry but I was typing wrong. Was reading too much posts. :)
I need the 2.35 firmware for the DSO4024A. if you have it please?

I'd be surprised if 2.35 existed for a 4000 series scope, and I assume you mean a DSOX4024A. I've never seen anything lower then 3.x for the 4000 series.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on June 19, 2021, 04:47:08 am
Sorry but I was typing wrong. Was reading too much posts. :)
I need the 2.35 firmware for the DSO4024A. if you have it please?
for the 4000A X-series scopes,the first firmware is 4000XSeries.03.00.201209XXXX.agx
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 19, 2021, 06:28:17 am
Hi Wp_Wp
My issue is the flash got corrupted. I was reading a post how to fix it trhough serial connection.
And it said the 2.35 firmware was the last one that accepted the boot from USB.

Is there other method to fix my firmwre?
Or the 3.0 is the way to go'?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on June 19, 2021, 10:46:32 am
For 4000X series scope,if it has NAND corruption problem,you can have two method to repair it:
1.from v3.12 or older firmwares to make a set files to recover it
2.from newer(maybe v7.31 or later)firmware,you can get a special kernel file to recover it
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on June 19, 2021, 11:38:03 am
Hi Wp_Wp
My issue is the flash got corrupted. I was reading a post how to fix it trhough serial connection.
And it said the 2.35 firmware was the last one that accepted the boot from USB.

Is there other method to fix my firmwre?
Or the 3.0 is the way to go'?
V2.35 is for 2000X、3000X,not for 3000X-T and 4000X.
For 4000X,as far as I know,V3.12 firmware is the last one that accepted the boot from USB.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 19, 2021, 12:33:42 pm
Do you have any of those file or the description of the method?
Pllease?
I do not know what the firmware was on it originally. I did not see that information in the serial com.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 19, 2021, 12:46:47 pm
Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Aug 12 2011 11:03:19
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

image2 value is out of range 0 so it will be ignored.
  It must be a hexadecimal integer between 0xd00000000 and 0xd7ffffff or between 0x800000000 and 0x87ffffff.

System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0400000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXXOOOOOOOOXOXXOOOOOOOIncorrect Data 1 EccResult: 3c3330 EccError: c0c03c EccRead: fcf30c
 EBOOT_ReadFlash failed offset 4ad764
 EBOOT_ReadFlash failed location d04b4000
ODeCompressFlash: CeCompressDecode() failed
 CeDecompressFlashBlock failed
****** Data record 11 corrupted, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------

 Loading image 1 failed, trying next one
 All images failed

Press r to reset

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on June 19, 2021, 02:02:17 pm
Do you have any of those file or the description of the method?
Pllease?
I do not know what the firmware was on it originally. I did not see that information in the serial com.
what the firmware was on it is not important.
the important thing is when you press space in keyboard,and turn on the scope,can you see P500> prompt,or other information,for example, d)download from ethernet now,or d)download from platform builder now.
the information will determine what method you should use.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on June 19, 2021, 02:08:40 pm
Search this thread for "Ymodem" to learn how upload firmware via serial.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 19, 2021, 02:45:29 pm
I presedd space. That stopped the boot.
And i have got the prompt. But I do not see any options.

Press space to stop autoboot:  0
p500>
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 19, 2021, 02:51:38 pm
I went to help

There is an option to load the bin from serial or ymodem mode.

I will read a bit so as suggested. ymodem I guess way faster than serial.
How can I get to find the bin file?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 19, 2021, 03:02:42 pm
I have read the firmware version I transfer over to the unit has to be similar to the (corrupted) one on the NAND, or the boot may not get far.
????? How will I know wat was on it?
I was reading about how to load binary file over serial line (ymodem mode).
But I would need the firmware file. The one can boot from USB.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on June 19, 2021, 05:18:29 pm
I have read the firmware version I transfer over to the unit has to be similar to the (corrupted) one on the NAND, or the boot may not get far.
????? How will I know wat was on it?

Your serial log says:
Quote
: Address=0x80361000  Length=0x4E09D90  Name="" Target=RAM
You will need to find the firmware version which bin file matches the Length.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on June 19, 2021, 05:21:43 pm
I went to help

There is an option to load the bin from serial or ymodem mode.

I will read a bit so as suggested. ymodem I guess way faster than serial.
How can I get to find the bin file?

Serial is a type of connection. Ymodem  is  a protocol. Saying Ymodem is faster than serial does not make sense. It is like saying TCP is faster than Ethernet.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on June 19, 2021, 05:25:41 pm
I have read the firmware version I transfer over to the unit has to be similar to the (corrupted) one on the NAND, or the boot may not get far.
????? How will I know wat was on it?
I was reading about how to load binary file over serial line (ymodem mode).
But I would need the firmware file. The one can boot from USB.
This is the most detailed post about how to repair a NAND corrupted scope: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on June 19, 2021, 05:29:44 pm
The 4000 series does have the network card built in, so the file can be transferred via network which only takes a few seconds. All info for that and the tools needed are also shared/posted in this thread.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 19, 2021, 05:56:04 pm
I have read that  allready.
But I do not have the firmware for 4000x. I need the version boot from usb drive.
I would be happy if someone has a working version.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 19, 2021, 05:59:50 pm
I was reading about the telnet option through the lan. But you have to have a working scope for that?
My firmware is corrupted. Can i telnet in?
But still my question is. Can I flash the newest firmware. Even the one was on the scope was a very early version?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 19, 2021, 06:19:39 pm
Bud You are right about the  serial and ymodem :)
Just the ymodem was sounds to be something like a network protocol. After I saw that is a serial protocol. :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 19, 2021, 06:28:57 pm
Bud
So the question is who has the matching firmware?
Address=0x80361000  Length=0x4E09D90  Name="" Target=RAM

0x4E09D90(Hex)=81,829,264(dec)   

I have a 4.08 version   48,886,006  in size  when it is unpacked 62,130,090
7.4 version 49,908,286  is size when is unpacked 63,572,647

Am I wrong somewhere?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on June 20, 2021, 01:58:44 am
Bud
So the question is who has the matching firmware?
Address=0x80361000  Length=0x4E09D90  Name="" Target=RAM

0x4E09D90(Hex)=81,829,264(dec)   

I have a 4.08 version   48,886,006  in size  when it is unpacked 62,130,090
7.4 version 49,908,286  is size when is unpacked 63,572,647

Am I wrong somewhere?
The image you need to flash is not the full upgrade package. I think it is the nk.bin (or something similar) file. The network method is not telnet, is using bootp protocol to get the image to flash from a bootp server
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on June 20, 2021, 04:06:15 am
oaba, you have to do your homework. I do not have a  4000 machine. Read the posts where people did Ymodem download and pay attention to image file extension they used. Was it nk.bin or some other image file. You've got to learn how to extract image file from update package and how to convert it to the format Ymodem is expecting. Same applies if you use tftp to boot from network instead of serial. You can use an image you have, worst case it won't load it will not do any damage.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 20, 2021, 05:15:17 am
Thanks BUD
:) I have got it now. Just worried, I will over write valuable calibration data. Screw somwthing up even further if I do not use the right firmware,
 :palm:
I got the lenght of the nk.nb0 :) 
4.08  81508824
7.4    88100356
So the original was 81829264 (seems newer than 4.08 but older than 7.4)
And i am doing the rest. Will see.
I had to modify the dosetup.py. That is writen in python 2.  And python 3 throw faults.
line 8 print (" "),
line 19 print ("mkdir "+path)
line 26 print ("mv "+parm.get("value")+" -> "+path)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 20, 2021, 01:35:59 pm
The serial upload always fail at 75.4percent.
The window of transfer stop to count. After couple seconds waiting and closes.
Ater restart the serial com says.
It fails exactly at the same place.
EBOOT_ReadFlash failed offset 4ad764
EBOOT_ReadFlash failed location d04b4000
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on June 20, 2021, 02:03:27 pm
Not good....looks like some flash is damaged. I'd still try TFTP boot to see if get same error.
If so, focus may need to shift to use bootloader's flash commands to see if bad flash sectors are detected, and/or manually mark bad sectors. For that you may need brighter minds than me.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 20, 2021, 02:32:59 pm
Actually I have got it to work.   :phew:
After 3 times try (2 hours each) The upload failed at about 75 percent. The scope did not start.
In the terminal window I was getting the same message.
I tryed before to turn the scope on and off. I have read sometimes the scope can boot up. but no effect.
What I did after this turmoil.
I pressed the r  (reset) 10-15 times. And suddenly I have seen in the serial com.
The scope started to boot.
When the scope was fully booted up. I did not turn it off. I downloaded the new firmware from keysight to an USB. And upgraded the firmware.
Scope is back to business.
Thanks for every one to helping me out.
Especially BUD.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on June 20, 2021, 04:27:52 pm
Not sure i understand the turning the thing off and on and resetting  but glad it worked in the end!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 20, 2021, 06:20:56 pm
I was just reading about it. If you turn it OFF and ON a couple times the scope can boot suddenly.
That did not work for me.
But with the serial connection. I was using the r command to keep reseting it. And it was booting up. That was enough for me to do a firmware upgrade from the usb stick.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on June 20, 2021, 06:40:20 pm
I see. Did you monitor the first "good" startup log? I've seen something that may be interpreted as sort of "self healing" of the flash, when during boot if the scope cant read flash it pulls the second image and if successful, marks failed flash sectors on the first image.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on June 21, 2021, 12:11:48 pm
I was just reading about it.
He probably read my comments somewhere about when my DSOX4000 had flash problems. My scope often started 1 times out of 10 when switched on, the other 9 times it hung after a while. Though it got worse and finally, sometimes it needed 100 tries. Sending a Reset through UBOOT will do the same but is quicker and healthier for the electronics than 100x switch-off / switch-on.

@oaba: do not feel too lucky and be prepared: rewriting/updating the firmware did help for a few weeks at the beginning but my scope quickly failed again. Later, even this flash-rewrite did not help anymore (neither USB or UART or ethernet).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 21, 2021, 05:16:29 pm
Pinkus.
What was at the end? Because I contacted Keysight they not interested.
Only if I pay for the diagnostic, post, and at the end the new board.  (thousands)

I am thinking to replace the flash. Is there anyone did that before?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 21, 2021, 06:53:56 pm
I celebrate with a flash cake. To keep the boys cool :popcorn:.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 21, 2021, 07:17:32 pm
Something interesting about the RAM-s
Data sheet:
https://www.micron.com/products/dram/ddr2-sdram/part-catalog/mt47h128m16rt-25e (https://www.micron.com/products/dram/ddr2-sdram/part-catalog/mt47h128m16rt-25e)
Failure note:
https://media-www.micron.com/-/media/client/global/documents/products/customer-service-note/csn37_95nm_legacy_dram.pdf?rev=374aa0a8dae04ea982f086cb7d042cad (https://media-www.micron.com/-/media/client/global/documents/products/customer-service-note/csn37_95nm_legacy_dram.pdf?rev=374aa0a8dae04ea982f086cb7d042cad)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 21, 2021, 07:34:08 pm
256Mbyte NAND Flash
H4 = 63-ball VFBGA (9 x 11 x 1.0mm)

https://www.micron.com/products/nand-flash/slc-nand/part-catalog/mt29f2g08abaeah4 (https://www.micron.com/products/nand-flash/slc-nand/part-catalog/mt29f2g08abaeah4)
Data sheet:
https://eu.mouser.com/datasheet/2/671/micron_technology_mict-s-a0001032698-1-1759218.pdf (https://eu.mouser.com/datasheet/2/671/micron_technology_mict-s-a0001032698-1-1759218.pdf)
Programmer adapter:
https://www.aliexpress.com/i/32998635330.html (https://www.aliexpress.com/i/32998635330.html)
https://www.aliexpress.com/i/32844081561.html (https://www.aliexpress.com/i/32844081561.html)
https://www.elnec.com/en/device/Micron/MT29F2G08ABAEAH4-IT+%5BVFBGA63%5D/ (https://www.elnec.com/en/device/Micron/MT29F2G08ABAEAH4-IT+%5BVFBGA63%5D/)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on June 21, 2021, 07:41:41 pm
I am not sure you can replace the flash without loosing calibration and serial number information...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on June 21, 2021, 10:15:03 pm
Pinkus.
What was at the end? Because I contacted Keysight they not interested.
Only if I pay for the diagnostic, post, and at the end the new board.  (thousands)
I asked Keysight about the repair and of course I also was afraid, that the examination alone would cost a fortune. But no, it was not. This is what they answered:
Within approx. 4 working days after receiving your device , we will perform a technical examination and send you an offer for repair and calibration.  There are no costs for the examination.

Fortunately, they identified the flash as the cause and applied the service note regarding corrupted flash. Result: free repair  :phew:
To be honest: I knew the problem was caused by the flash chip. If they would have tried to sneak out, I would be a Keysight hater by now. Now I am the opposite as I honor companies that take responsibility for such problems. Win-Win  :D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on June 22, 2021, 06:00:40 pm
TK
You have to dump the content first.
1: with a programmer. (Elnec can program and read this flash.)
2:If you good enough. You can write your own code to make your micro to read the flash  and send it to the JTAG. Trough the JTAG you can have a full controll of you controller. First you have to put it on halt. And after you can run your own software on it. Example read the flash memory and send it to the JTAG.
We should  find someone who has tis programmer with the bga63  adapter.
So you always have a safety net. Even when your scope going to be 20 years old.  You can recover it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 04, 2021, 08:04:30 pm
I just realised that in 7.40 Keysight have added USB trigger/decoding, including HS for >=1GHz scopes.

On my MSOX3104T, which already has a kosher factory installed bundle, upgrading to 7.40 didn't enable USB trigger/decode.

I enabled it using the patched 7.40 .ksx with the following infiniivision.lnk:

Code: [Select]
69#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l D3000USBB

Note that this only applies if you already have the original bundle installed on a >=1GHz scope. The original 1GHz bandwidth and bundle options remain installed.

If you have a different starting point such as bandwidths and/or pre-installed options, different settings may apply.

Note that HS requires a high speed differential probe, whereas FS and LS work on all analogue & digital channels.

Hmm... that feature was pretty much the only reason I have a Tek MDO4000 on the bench, and an expensive Tek differential probe.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Electrojunky on July 05, 2021, 12:47:10 am
A big thank you to all of the people that have made this possible! You guys are truly amazing.

Does anyone know if this method will work on Keysight's S series oscilloscope? I've searched the forums but wasn't able to find any mention of it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 18, 2021, 04:34:28 pm
Has anyone had any luck doing USB HS triggers or decode on the 3104T?

I can get full- and low-speed to work no problem.

I'm using an 1130A calibrated 1.5GHz probe with E2675A differential browser with 01131-62102 91 ohm tips. Scope's calibrated and passes self test. The same happens with an 1131A 3.5GHz probe with differential browser.

An MDO4104C with P6330 3.5GHz differential probe & TPA-BNC adapter decodes just fine.

Screenshots attached...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 29, 2021, 12:07:55 pm
Has anyone had any luck doing USB HS triggers or decode on the 3104T?

I can get full- and low-speed to work no problem.

I'm using an 1130A calibrated 1.5GHz probe with E2675A differential browser with 01131-62102 91 ohm tips. Scope's calibrated and passes self test. The same happens with an 1131A 3.5GHz probe with differential browser.

An MDO4104C with P6330 3.5GHz differential probe & TPA-BNC adapter decodes just fine.

Screenshots attached...


I installed the USB trial licence, and it turns out it's a bug, USB HS trigger/decode doesn't work yet on MSOX3104T, this from KeysightCare Technical and Application Support:

Quote
We could reproduce the issue and found out that the 4000A x-series scope is working fine, but the 3000T x-series scope, which you use, is not and we also got the red lines. Therefore we logged a defect report to our R&D and they will fix it in the next releases. To set the priority to our R&D correctly, could you please let me know if you have any deadline in your projects that prevents you from doing your work or are you able to work with the TEK scopes while we are fixing the issue?

Thank you very much for bringing this to our attention. We are always looking forward to customers feedback to improve our software and hardware.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 30, 2021, 11:21:34 am
Turns out it's a bit more than a bug...

Quote
Unfortunately I don't have good news to share.

R&D looked into the issue with the 3000T x-series scope and USB 2.0 HS and found out that 3000T x-series scopes can’t support USB High Speed due to HW limitations. SW support for USB HS was accidentally added in the 7.35 GUI along with the intended and working USB LS and FS support.

In summary, USB LS and FS all work in the following.  As far as USB HS…
•   The 3000T Series FPGA cannot handle USB HS.
•   The 4000X Series has a secondary FPGA that handles USB HS in 1GHz+ models
•   The 6000X Series can handle USB HS it in its main FPGA.
R&D is investigating the changes to remove USB HS support from the 3000T Series GUI (targeted for the 7.50 release) while Marketing is reviewing the changes needed to customer facing documents.

My apologies for the mistake which we did in our documentation and software. This will be corrected soon.

Do you also have a 4000X or 6000X series scope from us?

Let me know if I can assist you any further in getting a 4000X or 6000X scope from one of our partners in the UK or with any other question. I hope we didn't loose your trust and you are still interested in ditching the TEKs ;)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on July 30, 2021, 12:04:39 pm
Turns out it's a bit more than a bug...

Quote
Unfortunately I don't have good news to share.

R&D looked into the issue with the 3000T x-series scope and USB 2.0 HS and found out that 3000T x-series scopes can’t support USB High Speed due to HW limitations. SW support for USB HS was accidentally added in the 7.35 GUI along with the intended and working USB LS and FS support.

In summary, USB LS and FS all work in the following.  As far as USB HS…
•   The 3000T Series FPGA cannot handle USB HS.
•   The 4000X Series has a secondary FPGA that handles USB HS in 1GHz+ models
•   The 6000X Series can handle USB HS it in its main FPGA.
R&D is investigating the changes to remove USB HS support from the 3000T Series GUI (targeted for the 7.50 release) while Marketing is reviewing the changes needed to customer facing documents.

My apologies for the mistake which we did in our documentation and software. This will be corrected soon.

Do you also have a 4000X or 6000X series scope from us?

Let me know if I can assist you any further in getting a 4000X or 6000X scope from one of our partners in the UK or with any other question. I hope we didn't loose your trust and you are still interested in ditching the TEKs ;)


Well, I don't buy it..

They created D3000USBB USB 2.0 Trigger and Decode for 3000T X-Series license type, datasheets, and whole infrastructures...

You tell me they did all that and didn't test it just a bit.. You managed to find a problem, in what, 2 hours....

It's either political, or we have a bigger problem, that they don't test as they used to....

Anyways, I saved some money...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on July 30, 2021, 12:37:12 pm
Sinisa,

It's just HS limitation, or I'm seeing it wrong?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on July 30, 2021, 02:20:07 pm
Sinisa,

It's just HS limitation, or I'm seeing it wrong?
No  I think you're right.. Only HS is problem. If it is technical, this is one place where hardware decode is a problem, not a solution..
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 30, 2021, 02:36:35 pm
You tell me they did all that and didn't test it just a bit.. You managed to find a problem, in what, 2 hours....

Probably in total. I went back to it about three or four times... sometimes it's, you know, operator error. Sleeping on these things or trying it a day or two later you sometimes get a light bulb switch on in your head.

I have to say when I put in the ticket originally, I was still pretty sure they were going to tell me it was operator error.

As previously mentioned in my note on 18th, yes, it does work in both LS & FS. It's just HS that's the problem. It'd be a bit of a pain if you'd shelled out for both the option and a diff probe...

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on July 30, 2021, 07:51:03 pm
Turns out it's a bit more than a bug...

Quote
Unfortunately I don't have good news to share.

R&D looked into the issue with the 3000T x-series scope and USB 2.0 HS and found out that 3000T x-series scopes can’t support USB High Speed due to HW limitations. SW support for USB HS was accidentally added in the 7.35 GUI along with the intended and working USB LS and FS support.

In summary, USB LS and FS all work in the following.  As far as USB HS…
•   The 3000T Series FPGA cannot handle USB HS.
•   The 4000X Series has a secondary FPGA that handles USB HS in 1GHz+ models
•   The 6000X Series can handle USB HS it in its main FPGA.
R&D is investigating the changes to remove USB HS support from the 3000T Series GUI (targeted for the 7.50 release) while Marketing is reviewing the changes needed to customer facing documents.

My apologies for the mistake which we did in our documentation and software. This will be corrected soon.

Do you also have a 4000X or 6000X series scope from us?

Let me know if I can assist you any further in getting a 4000X or 6000X scope from one of our partners in the UK or with any other question. I hope we didn't loose your trust and you are still interested in ditching the TEKs ;)


Maybe they want to trade your MSOX3104T for a MSOX4104A
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on July 30, 2021, 08:00:07 pm
USB HS is a complex protocol, very verbose and probably cumbersome to debug on a DSO screen, except for some specific bug chasing using triggers.  I use an old Lecroy CATC USB 2.0 protocol analyzer I got on eBay for around $150 and software is still available for download from Lecroy and it runs on Windows 10.  It can capture full USB HS and some units even comes with exerciser that allows you to generate USB signals.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on July 30, 2021, 08:03:24 pm
Turns out it's a bit more than a bug...

Quote
Unfortunately I don't have good news to share.

R&D looked into the issue with the 3000T x-series scope and USB 2.0 HS and found out that 3000T x-series scopes can’t support USB High Speed due to HW limitations. SW support for USB HS was accidentally added in the 7.35 GUI along with the intended and working USB LS and FS support.

In summary, USB LS and FS all work in the following.  As far as USB HS…
•   The 3000T Series FPGA cannot handle USB HS.
•   The 4000X Series has a secondary FPGA that handles USB HS in 1GHz+ models
•   The 6000X Series can handle USB HS it in its main FPGA.
R&D is investigating the changes to remove USB HS support from the 3000T Series GUI (targeted for the 7.50 release) while Marketing is reviewing the changes needed to customer facing documents.

My apologies for the mistake which we did in our documentation and software. This will be corrected soon.

Do you also have a 4000X or 6000X series scope from us?

Let me know if I can assist you any further in getting a 4000X or 6000X scope from one of our partners in the UK or with any other question. I hope we didn't loose your trust and you are still interested in ditching the TEKs ;)


Maybe they want to trade your MSOX3104T for a MSOX4104A

Yeah, if they'll do it for the price of USB option.. >:D I'll be interested too...  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on July 30, 2021, 08:05:43 pm
And a question to gurus here:

what is MSOX3104G ?

What kind of model is that?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tsmith35 on July 31, 2021, 12:47:05 am
what is MSOX3104G
Just Google for this: Keysight "G models" (https://www.google.com/search?q=Keysight+%22G+models%22)

Looks like it indicates the inclusion of "Frequency response analysis - Bode plot"
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on July 31, 2021, 05:43:43 am
what is MSOX3104G
Just Google for this: Keysight "G models" (https://www.google.com/search?q=Keysight+%22G+models%22)

Looks like it indicates the inclusion of "Frequency response analysis - Bode plot"

Read carefully. A MSOX3104G, a 1 GHz MSO device from 3000 series with a G suffix....not a 3000A or 3000T but 3000G device..
Of course I googled first...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on July 31, 2021, 02:43:33 pm
USB HS is a complex protocol, very verbose and probably cumbersome to debug on a DSO screen, except for some specific bug chasing using triggers.  I use an old Lecroy CATC USB 2.0 protocol analyzer I got on eBay for around $150 and software is still available for download from Lecroy and it runs on Windows 10.  It can capture full USB HS and some units even comes with exerciser that allows you to generate USB signals.

They are two different tools, like a hammer and a screwdriver.

I have a Teledyne Lecroy Mercury T2C to trigger the scope to determine latencies in USB driver code. The Lecroy analyser software is useless for seeing timing trends and bandwidth utilisation on its own.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ikutyrev on August 02, 2021, 03:56:20 pm
Hi guys,

I'm trying to save a DSO-X 2012A with suspected NAND flash issue, before dealing with sending it to Keysight (already had a bit of back and forth with them and that RMA setup is ongoing...).

I'm trying to boot off a USB drive so that I can just boot in once and then update firmware to the latest one. So far I haven't had any luck booting off flash drive, wanted to check here to see if I'm missing any steps.

My process so far:
-Take a fresh flash drive, formatted FAT16
-Create file infiniivisionStartupOverride.txt with content "True" (excluding quotations)
-Extract contents of 2000XSeries.02.35.2013061800 to flash drive
-Plug in flash drive, power on scope

It seems to try something with the flash drive, I see some activity on the flash drive LED, and then the scope just cycles through the button LED's and does nothing. This is different from powering the scope without a USB, it will attempt to boot then power cycle. When I had the UART debug connected it would read the flash drive, but gave some error message that made it seem like I had missed something in the file structure. I have the UART cable removed for now, or I'd pull up the exact output. I've tried a few different flash drives, all with the same result.

The posts I've seen on booting from USB mentioned unpacking the CAB inside the firmware contents and editing some data, but that seemed oriented towards unlocking features, which I'm not trying to get into (yet), just get the scope working. Also, opening up that CAB shows a bunch of files ending in 3-digit numbers, no folder structure.

Anything I'm missing here?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on August 02, 2021, 06:17:45 pm
Hi guys,

I'm trying to save a DSO-X 2012A with suspected NAND flash issue, before dealing with sending it to Keysight (already had a bit of back and forth with them and that RMA setup is ongoing...).

I'm trying to boot off a USB drive so that I can just boot in once and then update firmware to the latest one. So far I haven't had any luck booting off flash drive, wanted to check here to see if I'm missing any steps.

My process so far:
-Take a fresh flash drive, formatted FAT16
-Create file infiniivisionStartupOverride.txt with content "True" (excluding quotations)
-Extract contents of 2000XSeries.02.35.2013061800 to flash drive
-Plug in flash drive, power on scope

It seems to try something with the flash drive, I see some activity on the flash drive LED, and then the scope just cycles through the button LED's and does nothing. This is different from powering the scope without a USB, it will attempt to boot then power cycle. When I had the UART debug connected it would read the flash drive, but gave some error message that made it seem like I had missed something in the file structure. I have the UART cable removed for now, or I'd pull up the exact output. I've tried a few different flash drives, all with the same result.

The posts I've seen on booting from USB mentioned unpacking the CAB inside the firmware contents and editing some data, but that seemed oriented towards unlocking features, which I'm not trying to get into (yet), just get the scope working. Also, opening up that CAB shows a bunch of files ending in 3-digit numbers, no folder structure.

Anything I'm missing here?
Follow instructions posted here: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ikutyrev on August 03, 2021, 04:39:43 pm
I tried to follow those instructions, but I'm only given a few options for actions, not allowed to enter any commands. I've attached a txt file of the output I get when holding down space on power on. Pressing "u" to enter U-boot just ends in a HW reset.

I've reconnected the TTL UART cable, the message given after it reads the USB (when I'm trying to boot off USB) is "Incorrect Parameters" then it just spins for a while, and eventually power cycles.

EDIT: empty file uploaded, see next post
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 03, 2021, 05:10:46 pm
The file you attached is empty with no contents.

I tried to follow those instructions, but I'm only given a few options for actions, not allowed to enter any commands. I've attached a txt file of the output I get when holding down space on power on. Pressing "u" to enter U-boot just ends in a HW reset.

I've reconnected the TTL UART cable, the message given after it reads the USB (when I'm trying to boot off USB) is "Incorrect Parameters" then it just spins for a while, and eventually power cycles.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ikutyrev on August 03, 2021, 06:22:28 pm
Sorry, fixed file attached to this post
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on August 03, 2021, 06:46:02 pm
infiniivisionStartupOverride.txt function changed time ago, it won't work with newer firmware in the way you expect.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on August 03, 2021, 11:59:37 pm
Sorry, fixed file attached to this post
In this situation,you can not see P500 prompt.
You need upload kernel file by Ethernet to scope.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Volchenok82 on August 09, 2021, 06:51:40 pm
Hello everyone!
 :)
I skimmed through this topic, but I still don't quite understand how I can unlock my device!  :-BROKE

There is an MSOX3024T oscilloscope with an installed DSOXLAN module and a set of the following options: MSO, MEMUP, SGM, BW20, EDK, ADVMATH, DVMCTR, RML.
The device is manufactured in 2016. I updated the factory firmware (I don't remember the revision) long ago to version 7.30.2019051434. And then I read your messages and got fired up with the idea of ​​how to completely unlock it ...

I have not tried Telnet access yet - this option is more difficult for me.
After reading PhillyFlyers' answer # 2746, I tried to install the original new firmware 7.40.2021031200 on it first, and then uploaded the patched version of the same firmware to it. I used the following set of parameters in the .lnk file:
90 # infiniiVisionLauncher.exe -l D3000BDLB -l BW20 -l SCPIPS -l SEC -l MSO -l MEMUP -l WAVEGEN

The firmware got up without any problems, but the set of options in the device remained the same!

I also tried to slip him an earlier patched firmware 7.35.2020120822 with a different set of parameters:
106 # "\ Program Files \ infiniiVision \ infiniiVisionLauncher.exe" -l D3000BDLA -l BW35 -l SCPIPS -l SEC С -l WAVEGEN

Music again failed!  :-//

Maybe I'm doing something wrong? I put both files (firmware and shortcut) on an empty medium, and then feed them to him ... But after flashing and rebooting, the device returns to me with a set of the same options ...


Please help me figure out how to hack it!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on August 09, 2021, 09:52:21 pm
There should be no space before and after the # character in the .lnk file
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Volchenok82 on August 10, 2021, 12:07:13 am
Thanks for the answer! Then the parameter string should look like this:

90#infiniiVisionLauncher.exe -l D3000BDLB -l BW20 -l SCPIPS -l SEC -l MSO -l MEMUP -l WAVEGEN

107#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW35 -l SCPIPS -l SEC С -l WAVEGEN


Tell me, do you need to specify only additional options in the parameter line, or should all existing ones also be prescribed?
Does it make a difference which form of writing the string to use - the first or the second?
...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Volchenok82 on August 10, 2021, 05:02:49 am
I did it, I did it !!! :phew:
Many thanks to everyone, especially PhillyFlyers and his team! :-+
The most recent firmware they patched works as it should! 8)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on August 10, 2021, 01:59:42 pm
I did it, I did it !!! :phew:
Many thanks to everyone, especially PhillyFlyers and his team! :-+
The most recent firmware they patched works as it should! 8)
which .lnk configuration did you end up using?  You can add BW35 to enable 350MHz option

EDIT: 350MHz option requires the HW mod in addition to the SW hack
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 10, 2021, 02:43:29 pm
I did it, I did it !!! :phew:
Many thanks to everyone, especially PhillyFlyers and his team! :-+
The most recent firmware they patched works as it should! 8)
which .lnk configuration did you end up using?  You can add BW35 to enable 350MHz option

He was adding it before but it will never work as his scope is limited to 200 MHz without a hardware mod.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on August 10, 2021, 02:56:21 pm
I did it, I did it !!! :phew:
Many thanks to everyone, especially PhillyFlyers and his team! :-+
The most recent firmware they patched works as it should! 8)
which .lnk configuration did you end up using?  You can add BW35 to enable 350MHz option

He was adding it before but it will never work as his scope is limited to 200 MHz without a hardware mod.
Yes, you are right...  350MHz needs the hw mod
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Volchenok82 on August 10, 2021, 05:42:37 pm
I used this set of parameters:

90#infiniiVisionLauncher.exe -l D3000BDLB -l BW35 -l SCPIPS -l SEC -l MSO -l MEMUP -l WAVEGEN

But as you correctly noted, it did not work, because there is a hardware limitation in the bandwidth of this model!  If someone wrote here that he managed to programmatically increase the bandwidth from 200 to 350 or even up to 500 MHz - do not believe ...
 :popcorn:

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on August 11, 2021, 01:03:46 am
With HW mod,you can hack MSOX3024T to 500MHz。
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 11, 2021, 06:18:53 am
With HW mod,you can hack MSOX3024T to 500MHz。

Or 1 GHz, or even 1.5 GHz :)

https://www.eevblog.com/forum/testgear/keysight-3000t-scope-1-ghz-hardware-upgrade-mod/ (https://www.eevblog.com/forum/testgear/keysight-3000t-scope-1-ghz-hardware-upgrade-mod/)

500 MHz is much less work though.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Volchenok82 on August 11, 2021, 09:32:18 am
With HW mod,you can hack MSOX3024T to 500MHz。

Thanks for the offer!   :P

I saw post  #1013 how this can be done, I will think about it in the future - I am not yet mature enough to open it and re-solder something there!   :-/O
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Volchenok82 on August 11, 2021, 09:36:56 am
With HW mod,you can hack MSOX3024T to 500MHz。

Or 1 GHz, or even 1.5 GHz :)

https://www.eevblog.com/forum/testgear/keysight-3000t-scope-1-ghz-hardware-upgrade-mod/ (https://www.eevblog.com/forum/testgear/keysight-3000t-scope-1-ghz-hardware-upgrade-mod/)

500 MHz is much less work though.

  ^-^ :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: lzqing on August 13, 2021, 03:19:37 am
I am try to write serial number to my DSOX2022A, when i fix it from corrupted NAND flash ,but now the serial number is Unset status;
I plan to try leaked SecureDataTool , get error below , anybody has old files backup and could you share me 'Agilent.Cdf.Core.Kernel.dll'. I think FW2.0 or 1.10 include this file.


\usb> \usb\AgilentConfidential_SecureDataTool_Client.exe Get-SerialNumber -ResultFile "\usb\GetSerialNumberResult.txt" -ErrorFile "\usb\GetSerialNumberErrorFile.txt"
Caption: AgilentConfidential_SecureDataTool_Client.exe
Title  : Error
Text   : An unexpected error has occurred in AgilentConfidential_SecureDataTool_Client.exe.
Select Quit and then restart this program, or select Details for more information.

Can't find PInvoke DLL 'Agilent.Cdf.Core.Kernel.dll'.

Details: AgilentConfidential_SecureDataTool_Client.exe
MissingMethodException
Can't find PInvoke DLL 'Agilent.Cdf.Core.Kernel.dll'.

   at Agilent.Cdf.Api.Security.P500SecureStream.get_Length()
   at eh.aa(SecureStreamId A_0, ci A_1)
   at eh.p()
   at Agilent.Cdf.Api.Security.SecureStorage.ReadCommonArea()
   at Agilent.Cdf.Tools.SecureDataTool.GetSerialNumberCommand.BeginProcessing()
   at b2.a.p(b2 A_0)
   at b2.a.n(IEnumerable`1 A_0, b A_1)
   at b2.b.e(a A_0, IEnumerable`1 A_1)
   at b2.h(IEnumerable`1 A_0)
   at g2.a(String[] A_0)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: lzqing on August 13, 2021, 10:07:44 am
No,should be Agilent.Cdf.Core.Kernel.dll 。
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on August 13, 2021, 03:43:24 pm
Have you tested?
I tested.
With Agilent.Cdf.Api.dll,you can not modify serial number and model number.
You must have Agilent.Cdf.Core.Kernel.dll also.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dagolard on August 19, 2021, 07:56:46 am
Hi all.

I´m not the big hacker, so I hope you forgive me my dumb question.

I have a MSO-X 2014A with blackscreen and want to find out, it´s the NAND Error or something else. If NAND, I want to send it in for free repair.

- installed TERA TERM
- Connected serial PC port to the PCB with settings 115200/8/0/1
- switched on the scope.

Result - see picture

What I´m doing wrong?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on August 19, 2021, 12:35:25 pm
Quote
- Connected serial PC port to the PCB with settings 115200/8/0/1

Should that be 115200/8/N/1 ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dagolard on August 19, 2021, 01:07:21 pm
You are right. It is 8/N/1. Sorry.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on August 19, 2021, 01:24:29 pm
No problem. That kind of thing is easy (for others) to spot since we've all done it enough to recognise it quickly :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dagolard on August 19, 2021, 02:07:58 pm
So - except of the wrong term any ideas?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on August 19, 2021, 02:29:22 pm
Try a different terminal software.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hexley on August 19, 2021, 03:46:09 pm
- Connected serial PC port to the PCB with settings 115200/8/0/1

Did you use a logic-level serial adapter? The scope has 3V3 signals, so a standard serial port is not compatible.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dagolard on August 19, 2021, 04:45:24 pm
No, I didn´t. :(
So I have to get one...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dagolard on August 19, 2021, 04:51:21 pm
I think that should work...

https://homediyelectronics.com/projects/arduino/seriallevelconverter/
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hexley on August 19, 2021, 06:08:57 pm
Or this https://www.amazon.com/DSD-TECH-SH-U09C5-Converter-Support/dp/B07WX2DSVB/ (https://www.amazon.com/DSD-TECH-SH-U09C5-Converter-Support/dp/B07WX2DSVB/) if you set the jumper to 3.3V you should be OK.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 19, 2021, 07:08:36 pm
If you also connected the TX line from the PC to the scope then you tortured the processor UART a little - but it likely survived just fine.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dagolard on August 19, 2021, 07:41:28 pm
I hope I didn't destroy anything...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dagolard on August 20, 2021, 06:40:46 am
Ready for weekend...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dagolard on August 20, 2021, 04:57:07 pm
Okay, that´s the result I get....

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2011-08-24  22:35:34 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    36045 Bytes = 35.2 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Aug 24 2011 15:15:48
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOXOXOOOOERROR: Checksum failure (expected=0x167CF58  computed=0x167D64E)
****** Checksum failure on record 13, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
  • : Address=0x80361000  Length=0x13064E8  Name="" Target=RAM

 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1600000

BL_IMAGE_TYPE_UNKNOWN

 Loading image 2 failed, trying next one
 All images failed

Press r to reset


NAND or no NAND Failure?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on August 20, 2021, 05:03:23 pm
Yes, that is typical NAND corruption.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: NEDM64 on August 27, 2021, 06:15:17 pm
Okay, that´s the result I get....

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2011-08-24  22:35:34 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    36045 Bytes = 35.2 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Aug 24 2011 15:15:48
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOXOXOOOOERROR: Checksum failure (expected=0x167CF58  computed=0x167D64E)
****** Checksum failure on record 13, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
  • : Address=0x80361000  Length=0x13064E8  Name="" Target=RAM

 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1600000

BL_IMAGE_TYPE_UNKNOWN

 Loading image 2 failed, trying next one
 All images failed

Press r to reset


NAND or no NAND Failure?

Hi! Where did you connect the TX/RX lines?

I also have a scope (DSOX2002A) with apparently NAND corruption...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dagolard on August 27, 2021, 08:08:43 pm
Read this...

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on September 07, 2021, 12:54:20 pm
I have a quick question
Can 350MHz 4000A series be upgraded to 500MHz with only a license? The last page of the 4000A datasheet
does not have this particular upgrade in the table and all the others require sending to service center so I got confused...
just to be sure, the methods discussed in this thread can upgrade BW on 4034A to 500MHz, am I correct?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Venturi962 on September 07, 2021, 01:07:29 pm
"Can 350MHz 4000A series be upgraded to 500MHz with only a license?"  Yes.  I did the HW mod on a 4024A and used the BW50 License to enable 500MHz bandwidth:

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3497278/#msg3497278 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3497278/#msg3497278)

memset describes the strapping here:

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1115301/#msg1115301 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1115301/#msg1115301)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on September 07, 2021, 02:01:46 pm
oh and one more question about 4000A. Can 350/500MHz model trigger and decoce on USB (LS/FS/HS?)
it is a bit confusing because I saw a video that the guy used 4024A to decode USB but then the datasheet says only >1GHz models can do that
so if someone can clarify it would be great.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on September 07, 2021, 06:06:32 pm
is there any ftp access to the WinCE file system on 2000A/3000A/4000A?
I know there is a telnet that people use for upgrading or unbricking (I did that via UART) but is there a ftp access
that allows to transfer files from/to the scope?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Venturi962 on September 07, 2021, 06:58:45 pm
I have access to LS / FS USB decoding on mine.  Perhaps HS is tied to Scope Bandwidth. 

Easiest way to transfer files is with USB, will appear as a directory over Telnet.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on September 07, 2021, 07:29:33 pm
I have access to LS / FS USB decoding on mine.  Perhaps HS is tied to Scope Bandwidth. 

Easiest way to transfer files is with USB, will appear as a directory over Telnet.

thanks. yes it seems LS/FS are ok on all models but HS needs an extra FPGA to be on the board and is only available in 1G/1.5G models

so when you telnet you can copy any system file on USB?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Venturi962 on September 07, 2021, 08:09:03 pm
Yes, can copy files using 'copy' command
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wheedal on September 17, 2021, 08:07:13 pm
Re: MSO logic analyzer function cables
Nice! --someone on Ebay has new old stock 54620-61601 kits for $80.
------------------------------
and Gone.
wow, that was fast --they had quite a few --someone bought them all.  Guess I'm glad I got mine
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on September 17, 2021, 10:16:29 pm
I have access to LS / FS USB decoding on mine.  Perhaps HS is tied to Scope Bandwidth. 

Easiest way to transfer files is with USB, will appear as a directory over Telnet.

Yes, you need (a) 1GHz sample rate or greater and (b) at least a 4000A. HS doesn't work on a 3000T. There's no USB trigger/decode at all on 3000A or 2000.

There is some marketing material out there that suggested the 3104T would support it. When I evaluated it, I couldn't get HS to work, although the DUT decoded fine on a Tek MDO4000.

In the end it turned out to be an error in the marketing material.

Even with HS, you're still going to need expensive diff probes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: lastguy on September 19, 2021, 10:16:26 pm
Where can I found instructions on how to use PhillyFlyers' patches? which eth card or telnet etc s/w tool shall I use? do I need to hard wire the serial port on PCB? Do I still need USB boot when power cycle?

Highest affordable one for me might be 2000x, I'm a slave of Fannie&Freddie.  SynGen h/w is built in but no AWG capability? Can 2CH be upgraded to 4CH? DSO2002a (not MSO) can also unlock logic channel?
I looked h/w modification, photos seems to be 3000x, are they same for 2000x? Digikey 0603 resistors needs 5K pcs, aliexpress kit are E24. Where did you get parts from ? I'm in California.

More important, acc name and passwd for telnet?

thanks the building is too high to climb might take me months。

 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dagolard on September 23, 2021, 04:17:54 pm
My scope is back. Repaired and calibrated. ;)

Now a question: is there a "easy way" to activate missing licenses? Actually I have only MSO, BW10, EDK, DVM and RML.
I.e. OSV and the Generator I would like to have...

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: CebroEtec on September 23, 2021, 05:51:45 pm
hello!


I have a DSO-X-2002A oscilloscope with problably a NAND problem, but i am not sure, could you guys help me? It stays like in the picture below...

I have some USB to TTL boards, could i connect it to the points in the pcb of the oscilloscope and conect via usb port in my pc to check the boot problem or i am missing something?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on September 23, 2021, 07:41:02 pm
hello!


I have a DSO-X-2002A oscilloscope with problably a NAND problem, but i am not sure, could you guys help me? It stays like in the picture below...

I have some USB to TTL boards, could i connect it to the points in the pcb of the oscilloscope and conect via usb port in my pc to check the boot problem or i am missing something?
Get the 3.3V version of the USB to TTL adapter or board.  USB voltage still 5V, but RX and TX levels must be 3.3V
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: YetAnotherTechie on September 23, 2021, 09:02:18 pm
start here https://www.eevblog.com/forum/testgear/agilent-dsox3054a-not-booting-possible-nand-corruption-help!/msg3449794/#msg3449794 (https://www.eevblog.com/forum/testgear/agilent-dsox3054a-not-booting-possible-nand-corruption-help!/msg3449794/#msg3449794)
and go here too
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181)

Search "eevblog nand" on google and "keysight nand" here on the top right.
Your very first action should be make a full backup of the nand, before you start issuing commands that change the flash system.  It's a filesystem, and it's corrupted, every write is unpredictable, even reading is dangerous if the system does on the fly ECC writes. If you don't have a backup and discover that your factory calibration or identity files are corrupted or missing no one will be able to help you.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: CebroEtec on September 23, 2021, 09:47:48 pm
Thank for the advices!

So, I will connect my USB to TTL board using 3.3v for the oscilloscope pcb.

@YetAnotherTechie, thanks for the help. I am reading all the posts in this sub since a week ago, and i am learning a lot! But I do not remember anyone saying how can we backup the NAND, or am i missing something? What i understood was that by the serial connection we can read the system doing the boot up, and uploading new firware files, am i wrong?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: YetAnotherTechie on September 24, 2021, 01:43:44 am
its in the code section of the first message of the first link i gave you......
also see
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1021864/?topicseen#msg1021864 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1021864/?topicseen#msg1021864)
stop uboot enter "help"
use commands bdinfo, coninfo, flinfo,fsinfo,iminfo,imls,printenv to get information.

use nand info
from there nand read to the offset of free ram mentioned in the posts, and transfer to the pc, using "saves"

Unless you've used putty before i recommend you practice using it somewhere else, or use another program, it's very easy to let muscle memory make a right click, and in putty that pastes everything on the clipboard to the command line followed by enter. It's a Murphy incarnated.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dagolard on September 25, 2021, 03:25:26 pm
Nobody?  :'(
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on September 25, 2021, 03:42:03 pm
Nobody?  :'(
Nobody?  There is plenty of information on this exact same thread on how to achieve what you are looking for. If by “easy way” you mean not even looking back posts, then you will not get any help here..,
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dagolard on September 25, 2021, 05:53:25 pm
These are 115 pages, and english isn´t my native language. That´s why a hint to the page would be helpful. But if you don´t want to help simply ignore my request.

By the way: even I helped others with a link, see page 114... 🙄
 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on September 25, 2021, 08:01:41 pm
These are 115 pages, and english isn´t my native language. That´s why a hint to the page would be helpful. But if you don´t want to help simply ignore my request.

By the way: even I helped others with a link, see page 114... 🙄
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3562918/#msg3562918 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3562918/#msg3562918)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: lastguy on September 29, 2021, 02:18:46 am
These are 115 pages, and english isn´t my native language. That´s why a hint to the page would be helpful. But if you don´t want to help simply ignore my request.

By the way: even I helped others with a link, see page 114... 🙄
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3562918/#msg3562918 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3562918/#msg3562918)
TK,
thanks I did see this while I'm still climbing the floor.
I tried to telnet using Eth card, holding down space while boot scope, yet whenever the remote session got activated on my laptop, the scope boot already done, so I see ">" then no cmd can be used. (1st msg is "Welcome to Keysight...")

Anybody can package installed folder of cab mgr and upload here? the company is not more thus no download - all US web just link to this co.
Another question is, what is the last version can boot from USB?

thx for any help
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: lastguy on September 29, 2021, 09:13:22 pm
These are 115 pages, and english isn´t my native language. That´s why a hint to the page would be helpful. But if you don´t want to help simply ignore my request.
below is initial steps, then read the link TK given above for latest s/w.
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg322242/#msg322242 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg322242/#msg322242)

do you have the cab mgr s/w? if yes then you can export the .cab (use 7zip for release file first) and modify the .lnk file by adding at the end:-l All -l BW20 -l SCPIPS
a safe way is to boot from USB, I've not able to try whether it is ok for latest version. what's your s/w version?

simplest way as you asked is on floor #301: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/300/ (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/300/)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: lastguy on September 30, 2021, 07:13:43 pm
I read original 7.40 or PhillyFlyers packed, both .lnk shows: 56#"\Program Files\infiniiVision\infiniivisionLauncher.exe"
and now infiniiVisionLauncher.exe is in folder named [INSTALLDIR], which seems, during boot the [INSTALLDIR] content will be copied to \Program Files\infiniiVision\ before .lnk cmd be called.
Thus previous USB boot won't work, any work around? I'm not familiar with WINCE.

Does PhillyFlyers' pkg unlocked all features or need user to repack the pkg? what is the BW? which USB format tool shall be used? is Rufus (FreeDOS style boot) ok?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: lastguy on October 01, 2021, 11:34:43 pm
No body want to help me?
I got non-English version cab manager installation pkg, if someone sent me a link to download English one - just zip the installed folder, I'd be able to release a pkg to be installed on windows 10.
Original pkg cannot be installed on windows 10, and no pkg can be downloaded from US web, all are links to original company web which is non existed.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on October 01, 2021, 11:57:26 pm
In my case, I don't know how to help because I don't understand what you are trying to accomplish.  There is a hack already that enables all the options you like and I included the link for you to download the files.  It is as simple as downloading the installation file, then copy it to the USB stick and copy also the infiniivision.lnk file with the options you want to enable.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on October 02, 2021, 03:40:35 pm
I read original 7.40 or PhillyFlyers packed, both .lnk shows: 56#"\Program Files\infiniiVision\infiniivisionLauncher.exe"
and now infiniiVisionLauncher.exe is in folder named [INSTALLDIR], which seems, during boot the [INSTALLDIR] content will be copied to \Program Files\infiniiVision\ before .lnk cmd be called.
Thus previous USB boot won't work, any work around? I'm not familiar with WINCE.

Does PhillyFlyers' pkg unlocked all features or need user to repack the pkg? what is the BW? which USB format tool shall be used? is Rufus (FreeDOS style boot) ok?
You don't need to boot from the USB.  Just copy the patched firmware and the desired infiniivision.lnk file (where you indicate which options you want to enable), power on the scope, when boot is finished, insert the USB drive, then go to utility -> file browser, select the patched firmware and voila, options enabled after scope reboots.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2lostkiwis on October 04, 2021, 01:38:02 am
I have been following this thread for a long time. And have the latest firmware patched on my DSO-X 3034A. I got the 500MHz upgrade which I tested with fast rise time pulse generator from Leo Bodnar. Really appreciate eveyones work on getting this working. One thing that is not clear to me, is exactly what options I should have in the link file. I currently have:

Code: [Select]
50#infiniivisionLauncher.exe -l all -l BW50 -l SCPIPS
Can anyone give me the correct list of what I should have? Just in case I am missing anything...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: msuthar on October 05, 2021, 04:29:36 am
Hi,
You can try this :

32#infiniivisionLauncher.exe -l ALL

-l ALL   enables all "trial" licences but without time limit, that's why there are "*" following each license.
or
-l DIS    Distributor license (memMax,EMBD,AUTO,COMP,SGM,MASK,WAVEGEN,ASV,PLUS) 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: msuthar on October 05, 2021, 04:59:21 am
Add more if any item  is missing :

-l D2000AUTA   Automotive Software for 2000 X-Series      (Automotive Software Package CAN LIN  ,serial trigger,Mask limit testing )
-l D2000GENA   General purpose Software for 2000 X-Series           (Embeded Software Package I2C,SPI,UART-RS232/422/485 serial trigger Mask limit testing )
-l D2000BDLA   Software Bundle for 2000 X-Series              (Ultimate Bundle Software Package I2C,SPI,UART(RS232/422/485) CAN LIN serial trigger Mask limit testing )
-l D2000AUTB   Automotive Software for 2000 X-Series      (Automotive Software Package CAN LIN  ,serial trigger,Mask limit testing )
-l D2000GENB   General purpose Software for 2000 X-Series           (Embeded Software Package I2C,SPI,UART-RS232/422/485 serial trigger Mask limit testing )
-l D2000BDLB   Software Bundle for 2000 X-Series              (Ultimate Bundle Software Package I2C,SPI,UART(RS232/422/485) CAN LIN serial trigger Mask limit testing

-l All              All Licenses
-l rmAll           No Licenses
-l DIS      Distributor license
-l MSO      MSO
-l FPG      FPGA Probe ??
-l ALT      FPGA Altera ??
-l memNo           Acq Memory Dflt
-l MEMUP           Acq Memory Max
-l memMax   Acq Memory Max
-l EMBD      Embedded serial decode and trigger
-l AUTO      Automotive serial decode and trigger
-l AUDIO           Audio serial decode and trigger
-l AERO      1553 & 429 serial decodes
-l FLEX      Flex Ray serial decode
-l FRC      Flex Ray Compliance
-l FLEXC           Flex Ray Plus
-l PWR      Power application
-l COMP      UART/RS232 serial decode and trigger
-l SGM      Segmented Memory
-l SGMC      Circular Segmented Memory
-l MASK      Mask limit testing
-l TEL      Telecom Mask Test
-l BW50      500MHz Bandwidth
-l BW20      200MHz Bandwidth
-l BW10      100MHz Bandwidth
-l WAVEGEN   WaveGen license
-l ADVMATH   Advance Math
-l VID      Enhanced Video Triggering
-l ASV      Agilent  Spectrum Visuliser  license for OSV -Oscilloscope Spectrum Visualizer PC Software
-l TOM      Tomotherapy
-l FWD      F8AEAE82 ??
-l PLUS      Enhancements - math, memory, update rate For DSOX2000 PLUS
-l CABLE           Cable Calibration, Ratio and Phase measure in Analyse Menu
-l SCPIPS           Infiniium Mode SCPI Commands supports
-l RML      Remote Log
-l DVM      Digital Voltmeter
-l EDK      Education kit license
--perf               adds more items  in measure display
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on October 05, 2021, 07:12:48 pm
...
-l FWD      F8AEAE82 ??
...
This license allows the scope to load earlier firmware versions.  Tech support once generated this license for me which allowed me to back out a firmware upgrade that introduced a nasty bug.  "FWD" probably means "firmware downgrade".

Maybe they were trying to be non-obvious by calling it F8AEAE82.

FYI, for your list.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: lastguy on October 06, 2021, 08:37:39 pm
I don't want to over write scope firmware in NVM, thus I want USB boot.
I have Eth card but no RS232, I can telnet (windows telnet or teraterm) get welcome msg and >>, but cannot run any cmd - no effect, cannot show any fold or file.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on October 06, 2021, 10:52:31 pm
Seems you are telneting to port 5024 which is SCPI interface ( try entering *IDN? ). You should telnet to port 23.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: lastguy on October 07, 2021, 11:04:05 pm
Seems you are telneting to port 5024 which is SCPI interface ( try entering *IDN? ). You should telnet to port 23.
Thanks! 5024 is SCPI! I used SCPI but always through keysight I/O, never used windows telnet with a/c login. I thought telnet to port 23 shall ask me a/c and passwd but it just failed.
Anybody can share 3000T a/c name and passwd? Does the USB need to be formatted as "bootable"?
I'v been climbing now at 3x floors or 1/4.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on October 07, 2021, 11:46:43 pm
Each 3000T calculates a unique password(most of the time anyway).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: lastguy on October 12, 2021, 05:05:53 pm
Each 3000T calculates a unique password(most of the time anyway).
thx then how to get to the status where telnet asks for ac name and passwd? I got this:
C:\>telnet 10.76.171.133 23
Connecting To 10.76.171.133...Could not open connection to the host, on port 23: Connect failed
C:\>
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on October 14, 2021, 04:37:14 am
[attachimg=2][attach=1]
Each 3000T calculates a unique password(most of the time anyway).
thx then how to get to the status where telnet asks for ac name and passwd? I got this:
C:\>telnet 10.76.171.133 23
Connecting To 10.76.171.133...Could not open connection to the host, on port 23: Connect failed
C:\>
With port 23, I didn’t telnet DSOX3014T either.
So I made a file to let 3000T jump to WinCE desktop.
[attach=1]
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: maurit on October 14, 2021, 05:16:33 pm
Hi all,
thank you for all posts that have allowed me, three years ago, to restore my DSOX3034A.
Now I also have a DSOX2012A with corrupted NAND but i ran into a problem that i can't solve.
The DHCP works and change the address in the Oscilloscope.
I can see the address assigned with "IP Scanner" or in my router.

Although I assume that the firmware installed is 2.30 (Length=0x12F9870)
I have tried to load the nk.bin of 1.10, 2.10, 2.20, 2.30, 2.35, 2.42 without success.

The file celoader and nk.bin are in C:\DSOX\
Below I report the screen-shots of the RS232 traffic (Oscilloscope)  |Oand the Win7 DOS window (PC).

I have read and reread the 116 pages of the blog but I cannot understand the problem. |O
Thanks for your help and sorry for my english !!!


U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500
CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2011-01-27  11:38:14 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    36703 Bytes = 35.8 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...

Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Jan 27 2011 02:
04:15
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXOOOOOOOOXOXXOOOOOOOOXOOXOXOOOÿOXXXOOOOOOOOOXOOOOXOXXOXXOXOOOXOXXXXXXOOX
XOOOOOOXOOXXOXXOOOXOXXOOXXOXOOOERROR: Checksum failure (expected=0x11DCE9E  comp
uted=0x11DC098)
****** Checksum failure on record 42, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------

 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1600000

BL_IMAGE_TYPE_UNKNOWN

 Loading image 2 failed, trying next one
 All images failed

Press r to reset

Now I leave and press space to stop autoboot

P500 Boot Loader Configuration :

Mac address .......... (00:30:D3:20:8B:C5)
Ip address ........... (192.168.1.169)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0600000)
        2 (0xd1600000)

l) Load flash resident image now
d) Download from ethernet now
u) Start u-boot by resetting
v) Verify Images

I press "D" option

>Ready!
Preparing for download...
 Downloading image from platform builder
Setting MAC address GMAC_MAC_ADDR_HI_LO[0] = 0x8000C58B, GMAC_MAC_ADDR_HI_LO[1]
= 0x20D33000
Auto Negotiation complete in 133943 iterations
Link up
AutoNegotiate Full Duplex
AutoNegotiate 100 Base T
Reading MAC address 0x30 0xD320 0x8BC5
Setting MAC address GMAC_MAC_ADDR_HI_LO[0] = 0x8000C58B, GMAC_MAC_ADDR_HI_LO[1]
= 0x20D33000
INFO: GMAC Ethernet controller initialized.
InitDHCP():: Calling ProcessDHCP()
ProcessDHCP()::DHCP_INIT
!CheckUDP: Not UDP (proto = 0x00000002)
Got Response from DHCP server, IP address: 192.168.1.207

ProcessDHCP()::DHCP IP Address Resolved as 192.168.1.207, netmask: 255.255.255.0

Lease time: -1 seconds
Got Response from DHCP server, IP address: 192.168.1.207
No ARP response in 2 seconds, assuming ownership of 192.168.1.207
+EbootSendBootmeAndWaitForTftp
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
!CheckUDP: Not UDP (proto = 0x00000001)
!CheckUDP: Not UDP (proto = 0x00000001)
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
................................................




This is what it tells me from PC Command Prompt The "C:\DSOX" directory contain "celoader" and "nk.bin"



Microsoft Windows [Versione 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. Tutti i diritti riservati.

C:\Users\Utente>cd \

C:\>cd dsox

C:\dsox>celoader nk.bin 192.168.1.207
syntax: celoader [binfile-name] [target-id]

CELOADER 1.3.0 - Waiting for BOOTME from nk.bin...
Packet from: 192.168.1.207
64 BYTES: EDBG-------0- ------SH600_-----------SH600_35781------A---------
Error: Received EBOOT from another target
** EXITING **

C:\dsox>
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on October 14, 2021, 05:53:09 pm
Try the recovery using YMODEM over UART technique. No need to use lan card and setup bootp server
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on October 14, 2021, 05:59:06 pm
Quote
C:\dsox>celoader nk.bin 192.168.1.207

Try with no IP address.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: maurit on October 15, 2021, 01:04:58 pm
Hi Bud,
without IP address same result.
I am trying with YMODEM serial transfer proposed by TK but the first results are not positive,
only a few data transferred !!!   :-//
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: maurit on October 15, 2021, 02:30:44 pm
 |O I have tried many times with YMODEM but it fails, only 7168 Bytes transferred each time.
The data sent and received is also unreadable.
The RS232 setting seems correct to me.

=========== This is what TeraTerm tells me =========================================

 0ðÀÀx`ÿÀ{`àÿÀððÀþààÀÀÿÀÀÀÀ{`àÿÀpoà€öÀþ€°€ø€üÀ€ø€ü€üÀÿ€°€ø€üÀ€ø€ü€üÀàö

                                                                             00``ÀÀÀÀx`ÿÀüàÿÀðàÀÿÀÀüàÀÀÀÿàÀüÀÿÀ`oàð?06àÀ°€€öÀàö

        00`àØÀðÀpÀ°€Àx`ÿÀìàÿÀððÀþÀÀüàÀÀÀÀÀ{`àÿÀðÀ°€üÀàü`ÿàÀûÀ°€ÀÀÀ{`àÿÀplààü`ÿÀààØÀ€öÀö

                                                                                       0ðÀÀà
CCCCCCCCCCCCCCCCCCCCxyzModem - CRC mode, 4(SOH)/7(STX)/0(CAN) packets, 25 retries
## Total Size      = 0x00001c00 = 7168 Bytes
p500>

============================================================================
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on October 15, 2021, 03:20:04 pm
Hi Bud,
without IP address same result.

I have in my records nk.bin should be renamed to boot.bin (for 1000x scope) for tftp. Try with a renamed file.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: maurit on October 15, 2021, 04:50:08 pm
Thanks TK
for the tip but no progress.
I have tried all the nk0 files, of the Old Firmware in my possession: 1.10, 2.10, 2.20, 2.30, 2.35, 2.42.
I tried to replace the address "loady 0x0361000 115200" with "loady 0x80361000 115200"......Nothing !!

Why I don't  receive, in Teraterm, sensible things but incomprehensible graphic signs?
Is this normal?

Thanks for your patience ....... I'm just a hobbyist.  :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: maurit on October 15, 2021, 04:59:29 pm
I renamed the nk.bin to boot.bin but it doesn't work.

Thanks a lot.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on October 15, 2021, 05:27:09 pm
Why I don't  receive, in Teraterm, sensible things but incomprehensible graphic signs?
Is this normal?

Thanks for your patience ....... I'm just a hobbyist.  :)
Do you use a voltage level converter RS232->5V (or 3.3V) ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TK on October 15, 2021, 05:56:18 pm
Thanks TK
for the tip but no progress.
I have tried all the nk0 files, of the Old Firmware in my possession: 1.10, 2.10, 2.20, 2.30, 2.35, 2.42.
I tried to replace the address "loady 0x0361000 115200" with "loady 0x80361000 115200"......Nothing !!

Why I don't  receive, in Teraterm, sensible things but incomprehensible graphic signs?
Is this normal?

Thanks for your patience ....... I'm just a hobbyist.  :)
It is not normal, serial signals on the DSO are 3.3V 

Also, as you were able to "communicate"  with the scope and typed the loady command, I assume you are using 115200 baud setting in teraterm.  I also assume that you are using the modified nk.bin file?

Are you following up the instructions on this link? https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: maurit on October 15, 2021, 10:04:06 pm
Yes,
I use a voltage level converter RS232->3,3V. Powered from Oscilloscope.
I used the nk.nb0 file as in the Titiris guide.
[attach=1]

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: maurit on October 15, 2021, 10:27:50 pm
Chinese TTL <> RS232  (3,3 V.) with MAX3232.

[attach=1]
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: maurit on October 16, 2021, 02:18:50 pm
 :-+   :-+   :-+
Problem solved !!!!!!!
It was the underperforming TTL <> RS232 Chinese interface.
I shortened the rs232 cable to the PC and the transfer started immediately.

Now I will update the Firmware and Options.

Thanks to all.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: maurit on October 16, 2021, 02:23:50 pm
[attach=1]
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on October 17, 2021, 12:04:28 pm
Thread closed (https://www.eevblog.com/forum/testgear/the-internet-archive-has-a-2015-snapshot-of-the-keysight-ftp-site/msg3752840/#msg3752840).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: maurit on October 20, 2021, 12:28:21 pm
Dear tv84,
I didn't understand the statement: Thread closed
Thanks for any clarification.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on October 20, 2021, 12:39:41 pm
Dear tv84,
I didn't understand the statement: Thread closed
Thanks for any clarification.

when the link was not removed yet, I think it was clear why  ;) :-DD
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: lastguy on October 21, 2021, 05:05:09 am
when the link was not removed yet, I think it was clear why  ;) :-DD
illogical
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on October 21, 2021, 08:54:47 am
(Attachment Link) (Attachment Link)
Each 3000T calculates a unique password(most of the time anyway).
thx then how to get to the status where telnet asks for ac name and passwd? I got this:
C:\>telnet 10.76.171.133 23
Connecting To 10.76.171.133...Could not open connection to the host, on port 23: Connect failed
C:\>

(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=1297528;image)
With port 23, I didn’t telnet DSOX3014T either.
So I made a file to let 3000T jump to WinCE desktop.
(Attachment Link)

Just before lockdown, I travelled to Hong Kong on Emirates, and the in flight entertainment remote crashed.

Unfortunately I didn't have a USB keyboard or serial adapter with me, or I'd have unlocked some additional options.



Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on October 21, 2021, 09:29:28 am
Unfortunately I didn't have a USB keyboard or serial adapter with me, or I'd have unlocked some additional options.

:) Nonetheless, it was good that it wasn't linked to the flight management system.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on October 21, 2021, 06:56:42 pm
Or maybe it is connected to the flight system - you just never know :)

For those wondering the 3000t series appears to enable telnet and then disable it a few seconds later. So the only way to telnet in is to connect at just the right time and then kill the infiniivision task so it doesn't kill the session. Generally you also need to calculate a custom password for each scope. Normally a script would be used to login and kill the task. Details are many pages back in this thread.

And lastly if anyone is looking for an MSO cable these two are a crazy good deal and won't last long(not mine, no affiliation with the seller):

https://www.ebay.com/itm/363589547314 (https://www.ebay.com/itm/363589547314)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on October 22, 2021, 04:37:21 am
I also write a file to let 4000A scope jump to WinCE desktop.
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=1305218;image)
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=1305224;image)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on October 24, 2021, 09:43:33 pm
I also write a file to let 4000A scope jump to WinCE desktop.

Very nice, will you be posting the files?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: maurit on October 26, 2021, 09:59:43 am
Good morning,
if you are interested I have some DSOX-Lan cards left with 3D printed frames.
As in the pictures.
I sell for 40 Euros + shipping.
I ship from Italy.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: lastguy on October 27, 2021, 10:20:57 pm
I also write a file to let 4000A scope jump to WinCE desktop.
WP_WP: would you mind to share these file?
anybody can confirm a bootable currently (AMAZON/EBAY) available USB stick?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: lastguy on October 27, 2021, 10:32:27 pm
I also write a file to let 4000A scope jump to WinCE desktop.

Very nice, will you be posting the files?
I found a paper with downloadable file to do similar things: https://ripitapart.com/2018/10/15/gaining-access-to-the-windows-ce-desktop-and-doom-on-the-keysight-dsox1102g-oscilloscope/ (https://ripitapart.com/2018/10/15/gaining-access-to-the-windows-ce-desktop-and-doom-on-the-keysight-dsox1102g-oscilloscope/)
or just download this and follow readme: https://www.dropbox.com/s/1xq7g7he942ynr5/ScopeLiberator-Release-2.0.zip?dl=0 (https://www.dropbox.com/s/1xq7g7he942ynr5/ScopeLiberator-Release-2.0.zip?dl=0)
Tried on 3000T, once Run lighted typed two times [Wkey] R \usb\a.bat, 2nd type is near by Keysight read logo, get to wince but no mouse icon.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on October 28, 2021, 03:50:24 am
Just have to get the timing perfect.  >:D >:D >:D

Logging in via telnet is probably easier though.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on October 28, 2021, 04:47:45 am
Try my package for the 1000x, maybe it will work.
https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg3702367/#msg3702367 (https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg3702367/#msg3702367)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HardDrive on October 30, 2021, 05:53:58 am
Does anyone by any chance have a copy of this file lying around? (the original link is no longer working)
Quote
DSOX 3000T Series:  FW:  7.31.2020012842_patched
md5: <63DDE0129A9516C81DCF380F228BB08A>

After updating to the latest 7.40.2021031200, I can no longer access the Web interface without the scope crashing.
This used to work with the older 7.31 FW.

My scope is an MSOX3104T with a "DSOXLAN" installed.
Normally, I would get a "LAN VGA option module fault" even with the older FW when it boots, but this has not caused it to crash.
However, with the newer 7.40 and 7.35 FW, as long as there is an attempt to load the web interface, the scope would crash immediately.

Wondering whether anyone else has encountered this issue? Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pepperoni7 on October 30, 2021, 08:10:50 am
...
My scope is an MSOX3104T with a "DSOXLAN" installed.
Normally, I would get a "LAN VGA option module fault" even with the older FW when it boots, but this has not caused it to crash.
However, with the newer 7.40 and 7.35 FW, as long as there is an attempt to load the web interface, the scope would crash immediately.

Wondering whether anyone else has encountered this issue? Thanks!

My DSOXLAN board has a jumper to short pin 78 and 80 (I guess) to "enable" the LAN module.
But then the scope assumes an orginal LAN/VGA board installed. But yours is missing the VGA option, therefore the error message!
The error is not harmful AFAIK but annoying...
If NOT shorting pin 78 to 80 the module seems not to be recognized by the scope (it's not visible in the utility menue), but it still gets an IP adress assigned from DHCP and works perfectly for me, even with FW7.35.
Of course you once must get to know this IP adress and make sure it doesnt get changed by DHCP.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HardDrive on October 30, 2021, 10:55:06 am
Thanks, pepperoni7 & tv84,

Unfortunately, reverting back to 7.31 did not resolve the issue.

Poking around in the telnet console, I discovered the crash address 0x4027236C belongs to a module called 'nspm.dll' (related to DNS/WINS namespace provider?)
Inspecting the DLL, it seems to crash after reading the registry 'Ident\Name', hinting something to do with the system name (not exactly sure what is really doing, it was a wild guess).
So I changed the system name from 'msox3104t' to 'mso' and the Web Interface now works (no idea why that worked but it did).

In hindsight, I recently configured DHCP to issue that system name and also updated the FW 7.40 at the same time but did not correlate the new name to the issue.

Everything works now even on the latest 7.40 FW :phew:

Thanks again for the help!  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on October 30, 2021, 11:58:05 am
Does anyone by any chance have a copy of this file lying around? (the original link is no longer working)
Quote
DSOX 3000T Series:  FW:  7.31.2020012842_patched
md5: <63DDE0129A9516C81DCF380F228BB08A>

After updating to the latest 7.40.2021031200, I can no longer access the Web interface without the scope crashing.
This used to work with the older 7.31 FW.

My scope is an MSOX3104T with a "DSOXLAN" installed.
Normally, I would get a "LAN VGA option module fault" even with the older FW when it boots, but this has not caused it to crash.
However, with the newer 7.40 and 7.35 FW, as long as there is an attempt to load the web interface, the scope would crash immediately.

Wondering whether anyone else has encountered this issue? Thanks!

Try scope with static address.
Disconnect scope from the router and try connecting to a PC with crossover cable or just switch with static addressing...
Also try to disable any IPV6 on router.

There is a IPv6 related bug that crashes the scope like that and is connected to router implementation of IPv6. It was happening with Speedport Plus internet router during DHCP 1pv$ and 6 address handout. It didn't matter if you disabled IPv6 on scope and router...
It didn't happen with static address and different router..

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: albertr on November 01, 2021, 02:17:32 pm
A quick question for the experts - what is the difference between MEMUP and memMax options (on a 3000T series if it makes a difference)?
Thanks!
-albertr
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Venturi962 on November 01, 2021, 02:47:14 pm
No functional difference, description available here:

https://www.eevblog.com/forum/testgear/agilent-dso-2000x-what-are-these-additional-software-packages/msg314783/#msg314783 (https://www.eevblog.com/forum/testgear/agilent-dso-2000x-what-are-these-additional-software-packages/msg314783/#msg314783)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: albertr on November 01, 2021, 05:04:33 pm
Also, did anyone already try the DSOX3U2H option that was mentioned in ver. 7.40 F/W pictured below?

-albertr

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on November 02, 2021, 11:47:08 pm
USB high speed decode and trigger doesn't work on 3000T. See up thread starting at post 2786 on page 112. Turns out there was a marketing/technical miscommunication.

LS and FS works.

Edit: even if HS did work, you'd need a 1GHz+ bandwidth scope. It does work on the 4000A and 6000X but they have hardware to support HS that the 3000T doesn't.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on November 03, 2021, 06:50:42 am
USB high speed decode and trigger doesn't work on 3000T. See up thread starting at post 2786 on page 112. Turns out there was a marketing/technical miscommunication.

LS and FS works.

Edit: even if HS did work, you'd need a 1GHz+ bandwidth scope. It does work on the 4000A and 6000X but they have hardware to support HS that the 3000T doesn't.

Looks like only the 1 GHz and 1.5 GHz 4000 series have the extra FPGA (U2303) and a few other IC's. Good thing I never had the chance to try modding a 4000 series to 1 or 1.5 GHz. It would probably be unhappy without the extra parts.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on November 03, 2021, 05:55:49 pm
USB high speed decode and trigger doesn't work on 3000T. See up thread starting at post 2786 on page 112. Turns out there was a marketing/technical miscommunication.

LS and FS works.

Edit: even if HS did work, you'd need a 1GHz+ bandwidth scope. It does work on the 4000A and 6000X but they have hardware to support HS that the 3000T doesn't.

Looks like only the 1 GHz and 1.5 GHz 4000 series have the extra FPGA (U2303) and a few other IC's. Good thing I never had the chance to try modding a 4000 series to 1 or 1.5 GHz. It would probably be unhappy without the extra parts.

Presumably that means that certain 4000A bandwidth upgrades are RTB?

Edit: I guess so.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on November 03, 2021, 06:45:07 pm
USB high speed decode and trigger doesn't work on 3000T. See up thread starting at post 2786 on page 112. Turns out there was a marketing/technical miscommunication.

LS and FS works.

Edit: even if HS did work, you'd need a 1GHz+ bandwidth scope. It does work on the 4000A and 6000X but they have hardware to support HS that the 3000T doesn't.

Looks like only the 1 GHz and 1.5 GHz 4000 series have the extra FPGA (U2303) and a few other IC's. Good thing I never had the chance to try modding a 4000 series to 1 or 1.5 GHz. It would probably be unhappy without the extra parts.

Presumably that means that certain 4000A bandwidth upgrades are RTB?

Edit: I guess so.

Yes, it should be the same as the 3000a/3000t series more or less.
-100/200 MHz
-350/500 MHz
-1 GHz
-1.5 GHz

If you look on the Keysight parts site you can just see the added chips in the tiny pics on the 1 and 1.5 GHz models.

Like the 3000t series I believe all 4000 series use the same base PCB. The 3000A used an updated PCB for the 1 GHz model.

A lower model 4000 should still be possible to upgrade to 1.5 GHz as a crazy DIY project but adding BGA into the mix lowers my "excitement" level. If I was to take on such a project I'd want to be extremely confident it was going to work when done.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Venturi962 on November 03, 2021, 08:15:38 pm
EEVBlog Flickr has a good photo of 200MHZ 4000X Series board with U2303 (bottom left between heatsinks) unpopulated:

https://www.flickr.com/photos/eevblog/8181558404/in/album-72157631997535516/ (https://www.flickr.com/photos/eevblog/8181558404/in/album-72157631997535516/)

Closeup: https://www.flickr.com/photos/eevblog/8181518941/in/album-72157631997535516/ (https://www.flickr.com/photos/eevblog/8181518941/in/album-72157631997535516/)  U2300, U2402 also unpopulated.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on November 03, 2021, 11:38:52 pm
EEVBlog Flickr has a good photo of 200MHZ 4000X Series board with U2303 (bottom left between heatsinks) unpopulated:

https://www.flickr.com/photos/eevblog/8181558404/in/album-72157631997535516/ (https://www.flickr.com/photos/eevblog/8181558404/in/album-72157631997535516/)

Closeup: https://www.flickr.com/photos/eevblog/8181518941/in/album-72157631997535516/ (https://www.flickr.com/photos/eevblog/8181518941/in/album-72157631997535516/)  U2300, U2402 also unpopulated.

Yes, he did a great job with those pics. I used them to confirm the lower frequency models didn't have the parts populated. Added parts are likely trigger related if I had to guess.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dr3hl3rt on November 07, 2021, 04:22:01 pm
I am having a wierd issue...

I have a DSO-X 3024A which is now a MSO-X - and I got the official 16-channel cabelharness from keysight

but... D00 on the cable is routed to D01 on the scope - and none of the channels can bring anything to D00 on the scope.

I am very confused...

best regards,

Henrik
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sbvr4 on November 07, 2021, 04:32:50 pm
Hi,
Last I checked the link to generate the unique password to telnet in was down. Is that still needed to gain access via telnet? I have a 3000T.

Thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Venturi962 on November 07, 2021, 05:09:52 pm
If on PhillyFlyers FW:

User: infiniivision
Pass: skywalker1977
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on November 07, 2021, 06:38:35 pm
If on PhillyFlyers FW:

User: infiniivision
Pass: skywalker1977

Did he patch out the unique password requirement for the t series?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Venturi962 on November 07, 2021, 09:14:19 pm
Works for me on 4000X, so I would guess it's the same for 3000T as they share codebase.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on November 08, 2021, 01:13:42 am
Works for me on 4000X, so I would guess it's the same for 3000T as they share codebase.

I guess someone will have to try it, I can't as I don't run patched firmware.
I do know that telnet is disabled during the boot process on the 3000t series so you need to login quickly(with a script ideally) and kill the infiniivision process to stay connected.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 08, 2021, 11:21:53 am
Hello everyone, I have an Agilent DSO-X-3024A that didn't want to boot, so I followed the instructions from page 84 and successfully brought the oscilloscope back to life via the UART interface. after that I played a bit in U-Boot and (don't ask how) typed the erase flash command |O. Now when you turn it on, only one light comes on and nothing happens. Even on UART lines there is nothing ....
Is this the end for DSOX or is there a flash option to reload the U-Boot?   
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on November 08, 2021, 12:11:13 pm
If there is no uboot, there are no options via software.

You must reprogram the SPI memory with the bootloader. I'm not sure that you must take it out. Others may confirm that.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 08, 2021, 02:26:20 pm
How to load SPI memory at all and with which files?
In 3000XSeries.cab there are bin files that are related to uboot ....
I see that SPEAr 600 is based on dual ARM926, is there a possibility to load a new uboot via JTAG interface or some other pins? I tried with debug pins from SPEAr 600 datasheet and some ARM programmers, but I don't have a connection ...
I don't know where to start ... :-//
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on November 08, 2021, 04:12:17 pm
This sounds like a pretty good challenge - to use the jtag interface two resistors need to be moved to enable it. I am guessing you already did that but if not see the details here:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg274963/#msg274963 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg274963/#msg274963)

Assuming the firmware updates have all of the required information you will still need to figure out the memory map and where to locate things.
I guess see if you can get u-boot installed and working and go from there.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 08, 2021, 04:44:28 pm
If there is no uboot, there are no options via software.

You must reprogram the SPI memory with the bootloader. I'm not sure that you must take it out. Others may confirm that.
It was a simple task on my 1000x , the SPI memory is a SOIC-8 chip on the back of the BLT module. Not sure what chip is used on the 3000 model.

Edit: this is astounding that it is possible to erase Uboot from Uboot, lol.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 08, 2021, 04:54:39 pm
How to load SPI memory at all and with which files?
In 3000XSeries.cab there are bin files that are related to uboot ....
I see that SPEAr 600 is based on dual ARM926, is there a possibility to load a new uboot via JTAG interface or some other pins? I tried with debug pins from SPEAr 600 datasheet and some ARM programmers, but I don't have a connection ...
I don't know where to start ... :-//

It was posted in the 1000x hacking thread how to connect JTAG to SPEAR600. You can look at that for reference but some details like pull up/down resistors may differ. I've done that on my 1000x.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 08, 2021, 05:30:17 pm
Thanks for the answers, I missed that post about removing the resistor. I will try to remove them to see if I can communicate with SPEAR 600.
I know it’s impossible to erase, but is there a first time for everything  :palm:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 08, 2021, 05:42:54 pm
Did you see this post?
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1458452/#msg1458452 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1458452/#msg1458452)

It appears it may be possible to reflash the NOR (SPI) via USB. The USB Flasher utility seems to be still available from ST web site.
A bit of a challenge maybe in specifying a proper address in the scope memory map. You could try sending the OP a personal message.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on November 08, 2021, 07:07:50 pm
Did you see this post?
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1458452/#msg1458452 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1458452/#msg1458452)

It appears it may be possible to reflash the NOR (SPI) via USB. The USB Flasher utility seems to be still available from ST web site.
A bit of a challenge maybe in specifying a proper address in the scope memory map. You could try sending the OP a personal message.

That post is the easiest way to do it, definitely. BTW, what address are you referring to?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 09, 2021, 03:44:13 am
I mean the start and stop addresses for XBoot, UBoot and PBoot in the NOR memory space. But it should be possible to figure them out from the firmware UBoot binary image. The below is from my records for the 1000x NOR:

Code: [Select]
end of SPI Flash F807FFFF NOR
PBoot F8050000 0x946F NOR
Uboot F8010000 0x2FDD4 NOR
XLOADER F8000000 0x153A NOR
start of SPI Flash F8000000 0x80000 NOR

The third column is the length of the data blobs.
I am pretty sure the leading "F8" should be removed if the USB Flasher utility is used.
Again , this is for the 1000x. I do not know the setup for the 3000 scope.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 09, 2021, 12:05:24 pm
I connected the oscilloscope to the PC, download the USB Flasher utility from https://www.st.com/en/development-tools/stsw-spear008.html (https://www.st.com/en/development-tools/stsw-spear008.html)
and ActiveTCL 8.16.11. I tried to follow the instructions in the USB Flasher to establish a connection with the SPEAR 600, but it didn't work on Win10 and Win7, at least it didn't work for me.
Then I tried on an old computer with WinXp and successfully connected to the SPEAR 600 SoC, only I had to find an older version of AcitveTCL 8.15.14 (http://www.softoware.org/apps/get-activetcl-for-windows- (http://www.softoware.org/apps/get-activetcl-for-windows-) 32-bit-for-windows.html).
Now it remains to try to load XBoot, UBoot and PBoot ...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 09, 2021, 12:10:32 pm
I mean the start and stop addresses for XBoot, UBoot and PBoot in the NOR memory space. But it should be possible to figure them out from the firmware UBoot binary image. The below is from my records for the 1000x NOR:

Code: [Select]
end of SPI Flash F807FFFF NOR
PBoot F8050000 0x946F NOR
Uboot F8010000 0x2FDD4 NOR
XLOADER F8000000 0x153A NOR
start of SPI Flash F8000000 0x80000 NOR

The third column is the length of the data blobs.
I am pretty sure the leading "F8" should be removed if the USB Flasher utility is used.
Again , this is for the 1000x. I do not know the setup for the 3000 scope.

Thanks! I'll try with the specified layout in memory, I guess I can't destroy flash memory anymore
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 09, 2021, 01:38:32 pm
But configuring 3 partitions separately (Xboot,Uboot,Pboot) would require 3 separate bin source files. If the 3000 SPI firmware comes as a single file than it would need to be split using  respective  offsets for each partition. I guess alternatively only one partition can be configured for the size of the firmware and the entire firmware bin file loaded at once.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on November 09, 2021, 02:01:57 pm
There is extra info besides the 3 blocks that goes into that mem. Namely, the MAC, GUID and S/N.

But I don't see why can't be flashed in one time only. Seems easier than it sounds to create the macro block.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 09, 2021, 03:00:08 pm
Agreed.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on November 09, 2021, 05:46:27 pm
Here is the mapping:

Code: [Select]
00000000 - XLOADER  (contents up to aprox. offset 0x1540)
00010000 - UBOOT (contents up to aprox. offset 0x3F90C)
00040000 - Environment variables  (contents up to aprox. offset 0x40520)
00050000 - PBOOT (contents up to aprox. offset 0x593B8)
00060000 - Environment variables  (contents up to aprox. offset 0x60520)  2ND COPY
00070000 - MAC address
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 09, 2021, 06:48:55 pm
I tried to flash with the existing settings in SPEAr flashing Utilities. As you can see in the attached screenshots, the size of one sector is 0x10000, and I can only change the number of sectors. The files I loaded are from 3000KSSeries.02.65.20210307001.cab are (kloader_image.bin, u-boot_image.bin, pboot_rel.bin).
After flashing in SPEAr 600, Uboot appeared on UART lines, but with the error FPGA programming failed! (picture Uboot attached)
However I tried to load nk.nb0 and run it from address 0x00362000 from the USB drive but it stopped (picture Uboot2 attached). Only the Agilent logo appeared on the screen.
What to do now? Should I delete the flash again and load it with new offsets or can something be done with p500>?
Are these .bin files really appropriate?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 09, 2021, 09:25:56 pm
@sajsoni you are moving too fast....please hold on.

First, Pboot was only one sector long, not 44 , not sure how and if that might have caused  anything you are experiencing now.
What it tells you is your fpga image is corrupted in NAND. Do not attempt to boot until you fix this issue. The good news is you can upload the fpga image the same way using y modem. It is a separate bin file in the firmware package. I have done that once and i recall i uploaded to RAM and from there wrote into NAND - i need to check my records if i have any notes left.
What you can do in the meanwhile is to run printenv from Uboot and compare the output against tv84's post right above this one.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 09, 2021, 11:24:04 pm
I found what I did was I loaded FPGA bin file to RAM using ymodem, but did not write into NAND then. Instead I just sent the uploaded blob from RAM directly to FPGA and started the kernel image. Once the scope booted successfully,  I ran firmware update and it updated the FPGA image in NAND.

This is an excerpt from the log:

First, load the existing fpga image from NAND to RAM address 0x800000 (to compare later with the good image)
Code: [Select]
p500> nand read 800000 60000 45480

NAND read: device 0 offset 0x60000, size 0x45480
 283776 bytes read: OK

Load a copy of the good fpga image using Ymodem to RAM address 0x900000

Code: [Select]
p500> loady 900000 115200
## Ready for binary (ymodem) download to 0x00900000 at 115200 bps...
CCxyzModem - CRC mode, 1(SOH)/278(STX)/0(CAN) packets, 7 retries
## Total Size      = 0x00045480 = 283776 Bytes

Check the loaded image's CRC
Code: [Select]
p500> crc 900000 45480
CRC32 for 00900000 ... 0094547f ==> 5f15252c

Compare the two fpga  images
Code: [Select]
p500> cmp 800000 900000 45480
word at 0x00801070 (0x00008000) != word at 0x00901070 (0x00000000)
Total of 1052 words were the same
As can be seen, one byte (actually one bit!) in the existing fpga image was corrupted.

Program the FPGA using the uploaded good image in RAM
Code: [Select]
p500> fpga 900000 45480
Start the scope
Code: [Select]
p500> run bootcmd
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-05-07   8:18:27 UTC
.....

...And run firmware update as usual from the scope application.
Note that the length of the fpga image will be different in your case - look in the environment variables tv84 posted above , so you have to replace it in the Uboot commands:

fpgasize=0x75394

Alternatively, I guess you could try loading the FPGA binary using the USB Flasher program, my guess the load offset in NAND would be 0x60000, and the length woudl be 0x75394 converted to number of sectors. Or use nand write command in Uboot to overwrite the image in NAND with the uploaded image at RAM address 0x900000. I have not tried that. The method I used seems to be a lower risk though as it does not modify the NAND by itself.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 10, 2021, 01:12:47 am
Quote
What you can do in the meanwhile is to run printenv from Uboot and compare the output against tv84's post right above this one.

Make sure you check the environment variables , do not try to boot until they are in place.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 10, 2021, 11:57:56 am
@Bud @ tv84 Thanks for the answers!

Now it's not all clear to me about environment variables ... this is a printout of the printenv command:

Code: [Select]
U-Boot 2010.03 (May 18 2017 - 11:28:22) Agilent P500

CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: fsmc-ecc1 128 MiB
In: serial
Out: serial
Err: serial
SerNum: serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
BMP data is not valid. Use splash bmp
Press space to stop autoboot: 2
p500> printenv
bootcmd = tftp 0x4000000 nk.bin; bootm 0xf8050000
ramboot = dhcp 0x4000000 nk.bin; bootm 0xf8050000
bootdelay = 3
baudrate = 115200
serverip = 192.168.1.10
preboot = splash load; fpga; expi
gatewayip = 192.168.1.10
netmask = 255.255.255.0
usbtty = cdc_acm
fpgadata = 0xd0060000
fpgasize = 0x75394
splashdata = 0xd0000000
dispParm1 = 0x300 0x400 0x2625A00 0x1 0x3
dispParm2 = 0x20 0x4c 0x1 0x2 0x3
boardversion = 4
ps = 0
rtc = 0
erase_env = protect off 1: 4, erase 1: 4
store_uboot = protect off 1: 1-3; erase 1: 1-3; cp.b 0x800000 0xF8010000 $ {filesize}; protect on 1: 1-3; imi 0xF8010000
get_uboot_eth = dhcp 0x800000 u-boot_image.bin; run store_uboot
get_uboot_uart = loadb 0x800000 115200; run store_uboot
ethaddr = 00: 03: d3: 04: 10: 00
serialnum = serial number not programmed
chipversion = BD
nimages = 1
image1 = 0xd0400000
fsstart = 0x2c00000
numfilesystems = 1
lengthfilesystem1 = 0x5400000
lengthfilesystem2 = 0x0
ecc = 1
verify = n
ipaddr = 192.168.1.100
ethact = smsc

Environment size: 893/16380 bytes
p500>


I compared the FPGA images, but I didn't try to boot. I loaded FPGA3000A.bin (469kB), is that the appropriate bin file? The result is as follows:

Code: [Select]
p500> nand read 800000 60000 45480
NAND read: device 0 offset 0x60000, size 0x45480
 283776 bytes read: OK
p500> loady 900000 115200
## Ready for binary (ymodem) download to 0x00900000 at 115200 bps ...
CCxyzModem - CRC mode, 2 (SOH) / 469 (STX) / 0 (CAN) packets, 4 retries
## Total Size = 0x00075394 = 480148 Bytes
p500> crc 900000 45480
CRC32 for 00900000 ... 0094547f ==> 3733a6e1
p500> cmp 800000 900000 45480
word at 0x00800144 (0x0000a000)! = word at 0x00900144 (0x0000a402)
Total of 81 words were the same
p500>
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 10, 2021, 01:49:40 pm
I believe there is only one fpga bin file in the firmware package.

You should be using Your fpga bin file's length when doing Uboot cpmmands, 45480 was for my EDUX1000x scope. Look at fpgasize variable in your printenv and it also must match the fpga bin file length in Hex.

@t84 what scope model your printenv was from? Seems there are differences with sajsoni's one.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on November 10, 2021, 05:04:47 pm
Mine was a pure 3000A.

But without any previous erasures...  :)

Since sajsoni provided his MAC address, here is a FULL dump of the NOR mem for sajsoni to flash.

This includes all the bootloaders and the env. vars and the correct MAC address, as taken from a 3000A dump.

I think it can't get any simpler. Use the SPEAR600 app to flash only this file from offset 0.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 10, 2021, 05:22:35 pm
The problem is that I don't have a connection between the PC and the oscilloscope now. I can't run SPEar 600 flash utilites. Maybe because Uboot loaded? Should I do erase flash again?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 10, 2021, 05:55:32 pm
Do not do it. There are differences in image offsets and filesystem size between your environment and tv84's. Also you are going to lose access to Uboot. And the scary thing that ecc environment variable is missing in tv84's SPI printenv list - that may totally screw up your scope including the filesystem and calibration.

I recommend you run through my procedure again but with proper fpga size parameter and see if your resident fpga image and the original one produce a match or mismatch.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on November 10, 2021, 06:36:59 pm
Bud, I have no way to certify my statements but the env vars are in the NOR flash (that is guaranteed).

So, all the contents of his printenv were taken from his NOR flash after a reconstruction by the SPEAR tool (using defaults values).

I think those default values are not better than my dump taken from a working machine.

BUT, I'm in no position to guarantee all of this since I don't have your experience in this scope.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 10, 2021, 06:54:40 pm
I am not saying they are incorrect. The difference is likely because of the scopes' model variation.

Edit: what I am trying to understand is if sajsoni's env variables are default ones or specific to his scope.

@sajsoni - do you know the firmware version your scope had before the incident ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 11, 2021, 02:18:31 pm
I hurried again and loaded the .bin file uploaded by tv84. First I deleted the flash and loaded only one file starting from 0 to 8 sectors (one size 0x10000). After a successful flash when I turn on the oscliscope sometimes it boots successfully and sometimes not. I tracked across the UART where the boot fits

One example of a boot. Interrupts on kernel loading ...

Code: [Select]
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-05-07   8:18:27 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37749 Bytes = 36.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


An example of another boot. unsuccessful loading of all images .....

Code: [Select]
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-05-07   8:18:27 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37749 Bytes = 36.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
RTC: 2021-3-7   23:26:40.8 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
RTC: 2021-3-7   23:26:40.11 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOERROR: Checksum failure (expected=0x31D2860  computed=0x31BA795)
****** Checksum failure on record 7, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1ACB780  Name="" Target=RAM
 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOERROR: Checksum failure (expected=0x31D2860  computed=0x31BBD0F)
****** Checksum failure on record 7, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1ACB780  Name="" Target=RAM
 Loading image 2 failed, trying next one
 All images failed

Press r to reset



An example of a successful (at least I think it is) boot. All channels appear and everything looks good.

Code: [Select]
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-05-07   8:18:27 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37749 Bytes = 36.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
RTC: 2017-5-19   23:17:58.87 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
RTC: 2017-5-19   23:17:58.91 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOOOXOOXOOXXOOXOXOOOOXOXOOOOOXOOOXOOOXXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOX
OOOXOOXOOOOXXXOOOOXOOXXOOXOOOOOOOOOXOXOOOXOOOOOOXOXOOOOXOXOOOOOOOXOXOXOOXOXOOOXOOOXOOXOXXOXOOOXOXXXXXOXOXXOXXXXOXOXXOOOXXOXXXXXXXOXXXXXXXOXXXXOXOXXOXOOOXXXXOXXXXXOOOXXOXX
OOXXOXXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOOXOXOOXOOXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1ACB780, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1ACB780  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2017-5-19   23:18:2.34 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Mar  7 2021)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:03:D3:04:10:00
Phy found addr 31 (ticks=3044)
WaitForLink Start (ticks=3045)
No Link (ticks=4048)
<--EDeviceInitialize

GMAC DMA status register = 0x0
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Device load time:
   NANDFLASH: 0 ms
   SNANDFLASH: 0 ms
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
Our command line is
Performing Startup
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses

      creating \Agilent Flash\selftest\
      creating \Agilent Flash\wfmMem\
      creating \Agilent Flash\LxiMdns\Released build, Mar  7 2021, 23:23:02
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
No option module detected
Keyboard firmware version 32... ok
Keyboard Info: Board id 1, Board rev 3
Startup sequence is complete.
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
System has been running 23.916475 seconds
Start Up Sequence 13.584780
Memory Load 55%
   System Physical Memory 39.672 / 73.277 MB
   Process Virtual Memory 49.500 / 1024.000 MB
-----> InfiniiVision is running <-----
failed open \Secure\InfiniiVision\LudicrousSpeed.usb
                                                    no workaround for USB phy



What to do next? Now the oscilloscope sometimes boots from the first attempt and sometimes from the 20th ...
Before deleting the flash via UART I was able to load version 3000XSeries.02.35.2013061800. Later, I upgraded to 3000XSeries.02.65.20210307001 via USB according to the procedure on Keysight




Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 11, 2021, 02:45:12 pm
As I warned you, you now can't access  Uboot...
Regarding inconsistent boot I can't recall people having this problem. Maybe the memory is indeed faulty, but i would check the power supply voltages quality and  power supply connectors for oxidation. Also if the PS electrolytics are of a junk brand i would look at replacing them.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 11, 2021, 03:38:20 pm
I can with space break boot and get p500 ...
The only thing is that now I can't read the data from USB ...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 11, 2021, 04:14:34 pm
From p500 prompt what is your printenv output now ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 11, 2021, 04:20:55 pm

Code: [Select]
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
p500> printenv
ramboot=dhcp 0x4000000 nk.bin;bootm 0xf8050000
baudrate=115200
usbtty=cdc_acm
fpgasize=0x75394
splashdata=0xd0000000
dispParm1=0x300 0x400 0x2625A00 0x1 0x3
dispParm2=0x20 0x4c 0x1 0x2 0x3
boardversion=4
ps=0
rtc=0
erase_env=protect off 1:4;erase 1:4
store_uboot=protect off 1:1-3;erase 1:1-3;cp.b 0x800000 0xF8010000 ${filesize};protect on 1:1-3;imi 0xF8010000
get_uboot_eth=dhcp 0x800000 u-boot_image.bin;run store_uboot
get_uboot_uart=loadb 0x800000 115200;run store_uboot
serialnum=serial number not programmed
ethact=smsc
bootdelay=0
bootaddr=0x700
loadaddr=0x00800000
chipversion=BD
nimages=2
image1=0xd0600000
image2=0xd1600000
fpgadata=0xd0060000
fimage=1
pbootdelay=0
numfilesystems=2
lengthfilesystem1=0x2800000
lengthfilesystem2=0x2800000
fsstart=0x2c00000
bootCeFlash=bootm 0xf8050000
uart2=115200
bootcmd=run keyrst;run bootCeFlash
preboot=fpga; expi 62500
keyrst=mw d8100400 6 1;mw d8100008 0 1;mw d8100008 2 1
bootfile=nk.bin.comp
filesize=C72BF2
blocksize=0xc80000
fileaddr=800000
gatewayip=146.223.241.1
netmask=255.255.255.0
serverip=146.223.241.68
stdout=serial
stdin=serial
stderr=serial
infiniiVisionCabFile=
infiniiVisionHostname=
infiniiVisionNetworkAdapter=
infiniiVisionInstallStatus=installing cab file
ethaddr=00:03:d3:04:10:00
manufacturer=
verify=n
ipaddr=192.168.1.100

Environment size: 1299/16380 bytes
p500>
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 11, 2021, 04:48:31 pm
It looks ok. I am puzzled how it still gives access to Uboot with bootdelay=0.
Try bootcmd command  and hit space right away. You should see Pboot menu from which you can verify images. Try verifying a few times and see if results are good or inconsistent.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 11, 2021, 04:58:15 pm
I tried three times and the result is always like this:

Code: [Select]
l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>
********* Image 1  *******************O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOOOXOOXOOXXOOXOXOOOOXOXOOOOOXOOOXOOOXXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOX
OOOXOOXOOOOXXXOOOOXOOXXOOXOOOOOOOOOXOXOOOXOOOOOOXOXOOOOXOXOOOOOOOXOXOXOOXOXOOOXOOOXOOXOXXOXOOOXOXXXXXOXOXXOXXXXOXOXXOOOXXOXXXXXXXOXXXXXXXOXXXXOXOXXOXOOOXXXXOXXXXXOOOXXOXX
OOXXOXXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOOXOXOOXOOXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1ACB780, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1ACB780  Name="" Target=RAM
******************************************************
Valid Image at 0xd0600000
*******************************************************

********* Image 2  *******************O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXRewrite recommended, internal ECC corrected data at 0x2ff1
OXXOXXXXXXOOOXXXOXXOOOXXXOOOXOOXOOXXOOXOXOOOOXOXOOOOOXOOOXOOOXXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOX
OOOXOOXOOOOXXXOOOOXOOXXOOXOOOOOOOOOXOXOOOXOOOOOOXOXOOOOXOXOOOOOOOXOXOXOOXOXOOOXOOOXOOXOXXOXOOOXOXXXXXOXOXXOXXXXOXOXXOOOXXOXXXXXXXOXXXXXXXOXXXXOXOXXOXOOOXXXXOXXXXXOOOXXOXX
OOXXOXXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOOXOXOOXOOXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1ACB780, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1ACB780  Name="" Target=RAM
******************************************************
Valid Image at 0xd1600000
*******************************************************

P500 Boot Loader Configuration :

Mac address .......... (00:03:D3:04:10:00)
Ip address ........... (192.168.1.176)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0600000)
        2 (0xd1600000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>



What should the partition name be when doing flash SPEar 600? I put the offered name "Partition 1" ...
Does it matter?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on November 11, 2021, 07:07:52 pm
If the scope boots then perform a firmware update while watching the UART data. You should see it re-locate bad sectors. When you've done an update do it again and see if it relocates further bad sectors. Make sure when booting it no longer shows any issues.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 12, 2021, 09:10:12 am
I tried to do an update but I can't read the USB flash ... there is some problem with USB, this is the log when the boot is complete:

Code: [Select]
   System Physical Memory 39.680 / 73.277 MB
   Process Virtual Memory 49.500 / 1024.000 MB
-----> InfiniiVision is running <-----
will do USB phy workaround: CheckCRC

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on November 12, 2021, 09:29:29 am
Didn't you already had problems in USB?

Look at your previous "successfull log":
Code: [Select]
   System Physical Memory 39.672 / 73.277 MB
   Process Virtual Memory 49.500 / 1024.000 MB
-----> InfiniiVision is running <-----
failed open \Secure\InfiniiVision\LudicrousSpeed.usb
                                                    no workaround for USB phy

After restoring the machine didn't you say that you were able to upgrade the FW?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 12, 2021, 09:38:48 am
I was able to do an update but before the incident with erasing the flash memory. Now after the flash with the complete dump a USB error occurs
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 12, 2021, 01:36:12 pm
Your photo shows the USB port is fine. Uncheck the Compatibility Mode. And use a smaller capacity USB drive or different USB drive. I've seen both messages in serial output and they were not indicative of USB access problems.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on November 12, 2021, 03:40:04 pm
Also try the rear port instead of the front port if you haven't(or vice versa).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 12, 2021, 04:33:53 pm
Tried with another USB flash and it works, tried to load version 3000XSeries.02.65.20210307001 and this is the log on UART:

Code: [Select]
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses

** BEGIN ** ExtractFileFromCabFile: RECIPE.XML
** END   ** ExtractFileFromCabFile: RECIPE.XML: 80 ms
PRE: "" -> ""
** BEGIN ** ExtractFileFromCabFile: infiniiVisionSetup.cab
** END   ** ExtractFileFromCabFile: infiniiVisionSetup.cab: 17061 ms
** BEGIN ** ExtractFileFromCabFile: _setup.xml
** END   ** ExtractFileFromCabFile: _setup.xml: 45 ms
** BEGIN ** ExtractFileFromCabFile: INFINI~1.176
** END   ** ExtractFileFromCabFile: INFINI~1.176: 44 ms
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses

** BEGIN ** ExtractFileFromCabFile: RECIPE.XML
** END   ** ExtractFileFromCabFile: RECIPE.XML: 25 ms
PRE: "" -> ""
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses

** BEGIN ** ExtractFileFromCabFile: RECIPE.XML
** END   ** ExtractFileFromCabFile: RECIPE.XML: 17 ms
PRE: "" -> ""
** BEGIN ** ExtractFileFromCabFile: updateSplashImage.wvga.bin
** END   ** ExtractFileFromCabFile: updateSplashImage.wvga.bin: 8 ms
GetNextUsbEvent, bOpenContextClosing
EventThread, ERROR ABORTED or INVALID HANDLE, exiting
GetSetupPacket, tmcDriverClosing 2
** BEGIN ** ExtractFileFromCabFile: auxInstallStep.exe
** END   ** ExtractFileFromCabFile: auxInstallStep.exe: 406 ms
** BEGIN ** ProcessRecipeStep: \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\auxInstallStep.exe -v
=== Aux Step: -v ===
Skipped.
** END   ** ProcessRecipeStep: \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\auxInstallStep.exe -v: 23 ms
** BEGIN ** ExtractFileFromCabFile: nk.bin.comp
** END   ** ExtractFileFromCabFile: nk.bin.comp: 7175 ms
** BEGIN ** ProcessRecipeStep: \windows\loadP500Flash -u ceImage2 \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\nk.bin.comp
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
FWUpdate: image 3 value not defined
                                   0.000000 complete (Erasing)
100.000000 complete (Erasing)
0.000000 complete (Writing)
2.546880 complete (Writing)
5.093760 complete (Writing)
7.640639 complete (Writing)
10.187519 complete (Writing)
12.734399 complete (Writing)
15.281279 complete (Writing)
17.828158 complete (Writing)
20.375038 complete (Writing)
22.921918 complete (Writing)
25.468798 complete (Writing)
28.015677 complete (Writing)
30.562557 complete (Writing)
33.109437 complete (Writing)
35.656317 complete (Writing)
38.203196 complete (Writing)
40.750076 complete (Writing)
43.296956 complete (Writing)
45.843836 complete (Writing)
48.390715 complete (Writing)
50.937595 complete (Writing)
53.484475 complete (Writing)
56.031355 complete (Writing)
58.578234 complete (Writing)
61.125114 complete (Writing)
63.671994 complete (Writing)
66.218874 complete (Writing)
68.765753 complete (Writing)
71.312633 complete (Writing)
73.859513 complete (Writing)
76.406393 complete (Writing)
78.953272 complete (Writing)
81.500152 complete (Writing)
84.047032 complete (Writing)
86.593912 complete (Writing)
89.140791 complete (Writing)
91.687671 complete (Writing)
94.234551 complete (Writing)
96.781431 complete (Writing)
99.328310 complete (Writing)
100.000000 complete (Writing)
0.000000 complete (Verifying)
2.546880 complete (Verifying)
5.093760 complete (Verifying)
7.640639 complete (Verifying)
10.187519 complete (Verifying)
12.734399 complete (Verifying)
15.281279 complete (Verifying)
17.828158 complete (Verifying)
20.375038 complete (Verifying)
22.921918 complete (Verifying)
25.468798 complete (Verifying)
28.015677 complete (Verifying)
30.562557 complete (Verifying)
33.109437 complete (Verifying)
35.656317 complete (Verifying)
38.203196 complete (Verifying)
40.750076 complete (Verifying)
43.296956 complete (Verifying)
45.843836 complete (Verifying)
48.390715 complete (Verifying)
50.937595 complete (Verifying)
53.484475 complete (Verifying)
56.031355 complete (Verifying)
58.578234 complete (Verifying)
61.125114 complete (Verifying)
63.671994 complete (Verifying)
66.218874 complete (Verifying)
68.765753 complete (Verifying)
71.312633 complete (Verifying)
73.859513 complete (Verifying)
76.406393 complete (Verifying)
78.953272 complete (Verifying)
81.500152 complete (Verifying)
84.047032 complete (Verifying)
86.593912 complete (Verifying)
89.140791 complete (Verifying)
91.687671 complete (Verifying)
94.234551 complete (Verifying)
96.781431 complete (Verifying)
99.328310 complete (Verifying)
100.000000 complete (Verifying)
** END   ** ProcessRecipeStep: \windows\loadP500Flash -u ceImage2 \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\nk.bin.comp: 8151 ms
** BEGIN ** ExtractFileFromCabFile: updateBootLoaders2.exe
** END   ** ExtractFileFromCabFile: updateBootLoaders2.exe: 318 ms
** BEGIN ** ExtractFileFromCabFile: pboot_rel.bin
** END   ** ExtractFileFromCabFile: pboot_rel.bin: 355 ms
** BEGIN ** ProcessRecipeStep: \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\updatebootloaders2.exe
Update XLOADER at address f8000000.
XLOADER is up to date. Skipping
Update UBOOT at address f8010000.
UBOOT is up to date. Skipping
Update PBOOT at address f8050000.
PBOOT is up to date. Skipping
** END   ** ProcessRecipeStep: \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\updatebootloaders2.exe: 96 ms
** BEGIN ** ExtractFileFromCabFile: nk.bin.comp
** END   ** ExtractFileFromCabFile: nk.bin.comp: 7169 ms
** BEGIN ** ProcessRecipeStep: \windows\loadP500Flash -u ceImage1 \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\nk.bin.comp
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
0.000000 complete (Erasing)
100.000000 complete (Erasing)
0.000000 complete (Writing)
2.546880 complete (Writing)
5.093760 complete (Writing)
7.640639 complete (Writing)
10.187519 complete (Writing)
12.734399 complete (Writing)
15.281279 complete (Writing)
17.828158 complete (Writing)
20.375038 complete (Writing)
22.921918 complete (Writing)
25.468798 complete (Writing)
28.015677 complete (Writing)
30.562557 complete (Writing)
33.109437 complete (Writing)
35.656317 complete (Writing)
38.203196 complete (Writing)
40.750076 complete (Writing)
43.296956 complete (Writing)
45.843836 complete (Writing)
48.390715 complete (Writing)
50.937595 complete (Writing)
53.484475 complete (Writing)
56.031355 complete (Writing)
58.578234 complete (Writing)
61.125114 complete (Writing)
63.671994 complete (Writing)
66.218874 complete (Writing)
68.765753 complete (Writing)
71.312633 complete (Writing)
73.859513 complete (Writing)
76.406393 complete (Writing)
78.953272 complete (Writing)
81.500152 complete (Writing)
84.047032 complete (Writing)
86.593912 complete (Writing)
89.140791 complete (Writing)
91.687671 complete (Writing)
94.234551 complete (Writing)
96.781431 complete (Writing)
99.328310 complete (Writing)
100.000000 complete (Writing)
0.000000 complete (Verifying)
2.546880 complete (Verifying)
5.093760 complete (Verifying)
7.640639 complete (Verifying)
10.187519 complete (Verifying)
12.734399 complete (Verifying)
15.281279 complete (Verifying)
17.828158 complete (Verifying)
20.375038 complete (Verifying)
22.921918 complete (Verifying)
25.468798 complete (Verifying)
28.015677 complete (Verifying)
30.562557 complete (Verifying)
33.109437 complete (Verifying)
35.656317 complete (Verifying)
38.203196 complete (Verifying)
40.750076 complete (Verifying)
43.296956 complete (Verifying)
45.843836 complete (Verifying)
48.390715 complete (Verifying)
50.937595 complete (Verifying)
53.484475 complete (Verifying)
56.031355 complete (Verifying)
58.578234 complete (Verifying)
61.125114 complete (Verifying)
63.671994 complete (Verifying)
66.218874 complete (Verifying)
68.765753 complete (Verifying)
71.312633 complete (Verifying)
73.859513 complete (Verifying)
76.406393 complete (Verifying)
78.953272 complete (Verifying)
81.500152 complete (Verifying)
84.047032 complete (Verifying)
86.593912 complete (Verifying)
89.140791 complete (Verifying)
91.687671 complete (Verifying)
94.234551 complete (Verifying)
96.781431 complete (Verifying)
99.328310 complete (Verifying)
100.000000 complete (Verifying)
** END   ** ProcessRecipeStep: \windows\loadP500Flash -u ceImage1 \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\nk.bin.comp: 8143 ms
** BEGIN ** ExtractFileFromCabFile: fpga2000a.bin
** END   ** ExtractFileFromCabFile: fpga2000a.bin: 102 ms
** BEGIN ** ProcessRecipeStep: \windows\loadP500Flash -u fpga --target economy \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\fpga2000a.bin
Hardware does not match the specified target (-t).
FPGA update failed!
** END   ** ProcessRecipeStep: \windows\loadP500Flash -u fpga --target economy \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\fpga2000a.bin: 398 ms
** BEGIN ** ExtractFileFromCabFile: fpga3000a.bin
** END   ** ExtractFileFromCabFile: fpga3000a.bin: 234 ms
** BEGIN ** ProcessRecipeStep: \windows\loadP500Flash -u fpga --target performance \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\fpga3000a.bin
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
** END   ** ProcessRecipeStep: \windows\loadP500Flash -u fpga --target performance \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\fpga3000a.bin: 688 ms
** BEGIN ** ExtractFileFromCabFile: cleanupFileSystem.exe
** END   ** ExtractFileFromCabFile: cleanupFileSystem.exe: 287 ms
** BEGIN ** ProcessRecipeStep: \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\cleanupFileSystem.exe
**** CleanupInfiniiVisionFolder ****
**** CleanupInfiniiVisionFolder ****
**** CleanupInfiniiVisionFolder ****
**** CleanupInfiniiVisionFolder ****
**** CleanupInfiniiVisionFolder ****
   DELETED: \secure\infiniiVision\web\Lxi\Identification\Default.asp
   DELETED: \secure\infiniiVision\web\Lxi\Identification\LXIIdentification.xsd
   DELETED: \secure\infiniiVision\web\Lxi\Identification\
   DELETED: \secure\infiniiVision\web\Lxi\
**** CleanupInfiniiVisionFolder ****
**** CleanupInfiniiVisionFolder ****
   DELETED: \secure\infiniiVision\web\include\web-socket-js\WebSocketMain.swf
   DELETED: \secure\infiniiVision\web\include\web-socket-js\swfobject.js
   DELETED: \secure\infiniiVision\web\include\web-socket-js\web_socket.min.js
   DELETED: \secure\infiniiVision\web\include\web-socket-js\
   DELETED: \secure\infiniiVision\web\include\vnc.min.js
   DELETED: \secure\infiniiVision\web\include\
**** CleanupInfiniiVisionFolder ****
   DELETED: \secure\infiniiVision\web\css\AGBD____.TTF
   DELETED: \secure\infiniiVision\web\css\KeysightSansBold.ttf
   DELETED: \secure\infiniiVision\web\css\default.min.css
   DELETED: \secure\infiniiVision\web\css\
**** CleanupInfiniiVisionFolder ****
   DELETED: \secure\infiniiVision\web\help\helpBrowserWebControl.asp
   DELETED: \secure\infiniiVision\web\help\helpGetImage.asp
   DELETED: \secure\infiniiVision\web\help\helpHome.asp
   DELETED: \secure\infiniiVision\web\help\helpHomeAdv.asp
   DELETED: \secure\infiniiVision\web\help\helpInfoCal.html
   DELETED: \secure\infiniiVision\web\help\helpInfoOptions.html
   DELETED: \secure\infiniiVision\web\help\helpInfoVersion.asp
   DELETED: \secure\infiniiVision\web\help\helpModifyConfig.asp
   DELETED: \secure\infiniiVision\web\help\helpNav.asp
   DELETED: \secure\infiniiVision\web\help\helpRecall.asp
   DELETED: \secure\infiniiVision\web\help\helpRemoteFrontPanel.asp
   DELETED: \secure\infiniiVision\web\help\helpRemoteSCPICommands.asp
   DELETED: \secure\infiniiVision\web\help\helpSave.asp
   DELETED: \secure\infiniiVision\web\help\helpSaveRecall.asp
   DELETED: \secure\infiniiVision\web\help\helpStyle.css
   DELETED: \secure\infiniiVision\web\help\helpVar.asp
   DELETED: \secure\infiniiVision\web\help\helpViewConfig.asp
   DELETED: \secure\infiniiVision\web\help\
**** CleanupInfiniiVisionFolder ****
   DELETED: \secure\infiniiVision\web\image\IEstep1.png
   DELETED: \secure\infiniiVision\web\image\IEstep2.png
   DELETED: \secure\infiniiVision\web\image\IEstep3.png
   DELETED: \secure\infiniiVision\web\image\IEstep4.png
   DELETED: \secure\infiniiVision\web\image\bottomKbLabelWeb.png
   DELETED: \secure\infiniiVision\web\image\brand.png
   DELETED: \secure\infiniiVision\web\image\down-over.gif
   DELETED: \secure\infiniiVision\web\image\down.gif
   DELETED: \secure\infiniiVision\web\image\entryLed.png
   DELETED: \secure\infiniiVision\web\image\filltrans.gif
   DELETED: \secure\infiniiVision\web\image\instrumentBanner.gif
   DELETED: \secure\infiniiVision\web\image\instrumentImage.jpg
   DELETED: \secure\infiniiVision\web\image\kbLabel2ChanWeb.png
   DELETED: \secure\infiniiVision\web\image\kbLabel4ChanWeb.png
   DELETED: \secure\infiniiVision\web\image\keyboard.gif
   DELETED: \secure\infiniiVision\web\image\labelPanelWeb.png
   DELETED: \secure\infiniiVision\web\image\line-heading.gif
   DELETED: \secure\infiniiVision\web\image\lxi.jpg
   DELETED: \secure\infiniiVision\web\image\m2XX2A.jpg
   DELETED: \secure\infiniiVision\web\image\m2XX4A.jpg
   DELETED: \secure\infiniiVision\web\image\m3XX2A.jpg
   DELETED: \secure\infiniiVision\web\image\m3XX4A.jpg
   DELETED: \secure\infiniiVision\web\image\popupMenu.jpg
   DELETED: \secure\infiniiVision\web\image\popupMenu_wvga.jpg
   DELETED: \secure\infiniiVision\web\image\rightKbLabelWeb.png
   DELETED: \secure\infiniiVision\web\image\runStop.png
   DELETED: \secure\infiniiVision\web\image\single.png
   DELETED: \secure\infiniiVision\web\image\softkey.jpg
   DELETED: \secure\infiniiVision\web\image\softkey_wvga.jpg
   DELETED: \secure\infiniiVision\web\image\splash.png
   DELETED: \secure\infiniiVision\web\image\splashLoad.png
   DELETED: \secure\infiniiVision\web\image\splashSorry.png
   DELETED: \secure\infiniiVision\web\image\touchIcon.png
   DELETED: \secure\infiniiVision\web\image\up-over.gif
   DELETED: \secure\infiniiVision\web\image\up.gif
   DELETED: \secure\infiniiVision\web\image\waveNarrow.png
   DELETED: \secure\infiniiVision\web\image\waveShort.png
   DELETED: \secure\infiniiVision\web\image\waveTall.png
   DELETED: \secure\infiniiVision\web\image\waveWide.png
   DELETED: \secure\infiniiVision\web\image\web-enable.png
   DELETED: \secure\infiniiVision\web\image\zoom.png
   DELETED: \secure\infiniiVision\web\image\
**** CleanupInfiniiVisionFolder ****
   DELETED: \secure\infiniiVision\web\lib\edtftpj.jar
   DELETED: \secure\infiniiVision\web\lib\plugin.jar
   DELETED: \secure\infiniiVision\web\lib\
**** CleanupInfiniiVisionFolder ****
   DELETED: \secure\infiniiVision\web\navbar\PantherTabs.psd
   DELETED: \secure\infiniiVision\web\navbar\bluebar.gif
   DELETED: \secure\infiniiVision\web\navbar\config-down.gif
   DELETED: \secure\infiniiVision\web\navbar\config-over.gif
   DELETED: \secure\infiniiVision\web\navbar\config.gif
   DELETED: \secure\infiniiVision\web\navbar\help-down.gif
   DELETED: \secure\infiniiVision\web\navbar\help-over.gif
   DELETED: \secure\infiniiVision\web\navbar\help.gif
   DELETED: \secure\infiniiVision\web\navbar\image-down.gif
   DELETED: \secure\infiniiVision\web\navbar\image-over.gif
   DELETED: \secure\infiniiVision\web\navbar\image.gif
   DELETED: \secure\infiniiVision\web\navbar\printpage-down.gif
   DELETED: \secure\infiniiVision\web\navbar\printpage-over.gif
   DELETED: \secure\infiniiVision\web\navbar\printpage.gif
   DELETED: \secure\infiniiVision\web\navbar\remote-down.gif
   DELETED: \secure\infiniiVision\web\navbar\remote-only.gif
   DELETED: \secure\infiniiVision\web\navbar\remote-over.gif
   DELETED: \secure\infiniiVision\web\navbar\saverecall-down.gif
   DELETED: \secure\infiniiVision\web\navbar\saverecall-over.gif
   DELETED: \secure\infiniiVision\web\navbar\saverecall.gif
   DELETED: \secure\infiniiVision\web\navbar\status-down.gif
   DELETED: \secure\infiniiVision\web\navbar\status-over.gif
   DELETED: \secure\infiniiVision\web\navbar\status.gif
   DELETED: \secure\infiniiVision\web\navbar\utilities-down.gif
   DELETED: \secure\infiniiVision\web\navbar\utilities-over.gif
   DELETED: \secure\infiniiVision\web\navbar\utilities.gif
   DELETED: \secure\infiniiVision\web\navbar\welcome-down.gif
   DELETED: \secure\infiniiVision\web\navbar\welcome-over.gif
   DELETED: \secure\infiniiVision\web\navbar\welcome.gif
   DELETED: \secure\infiniiVision\web\navbar\
   DELETED: \secure\infiniiVision\web\ClickFix.js
   DELETED: \secure\infiniiVision\web\CookieUtils.js
   DELETED: \secure\infiniiVision\web\InfiniiVision_Quick_Reference.html
   DELETED: \secure\infiniiVision\web\appletInstall.jar
   DELETED: \secure\infiniiVision\web\appletScpi.jar
   DELETED: \secure\infiniiVision\web\appletsVersion.asp
   DELETED: \secure\infiniiVision\web\constant.asp
   DELETED: \secure\infiniiVision\web\doModifyConfig.asp
   DELETED: \secure\infiniiVision\web\doSave.asp
   DELETED: \secure\infiniiVision\web\download.asp
   DELETED: \secure\infiniiVision\web\enumConst.asp
   DELETED: \secure\infiniiVision\web\frontpanel.min.js
   DELETED: \secure\infiniiVision\web\getImage.asp
   DELETED: \secure\infiniiVision\web\home.html
   DELETED: \secure\infiniiVision\web\homeBottom.asp
   DELETED: \secure\infiniiVision\web\homeMiddle.asp
   DELETED: \secure\infiniiVision\web\homeTop.asp
   DELETED: \secure\infiniiVision\web\ieCompat.html
   DELETED: \secure\infiniiVision\web\index.asp
   DELETED: \secure\infiniiVision\web\infoCal.asp
   DELETED: \secure\infiniiVision\web\infoLicense.asp
   DELETED: \secure\infiniiVision\web\infoNav.asp
   DELETED: \secure\infiniiVision\web\infoVersion.asp
   DELETED: \secure\infiniiVision\web\information.html
   DELETED: \secure\infiniiVision\web\lanInfo.asp
   DELETED: \secure\infiniiVision\web\modifyConfig.asp
   DELETED: \secure\infiniiVision\web\navigation.asp
   DELETED: \secure\infiniiVision\web\networkStatus.asp
   DELETED: \secure\infiniiVision\web\pwdEnum.asp
   DELETED: \secure\infiniiVision\web\pwdPrompt.asp
   DELETED: \secure\infiniiVision\web\pwdVerify.asp
   DELETED: \secure\infiniiVision\web\recall.asp
   DELETED: \secure\infiniiVision\web\remoteApplet.asp
   DELETED: \secure\infiniiVision\web\remoteSCPICommands.asp
   DELETED: \secure\infiniiVision\web\rfp.html
   DELETED: \secure\infiniiVision\web\rfp.mf
   DELETED: \secure\infiniiVision\web\save.asp
   DELETED: \secure\infiniiVision\web\saveFrame.asp
   DELETED: \secure\infiniiVision\web\saveRecall.asp
   DELETED: \secure\infiniiVision\web\scopeInfo.asp
   DELETED: \secure\infiniiVision\web\style.css
   DELETED: \secure\infiniiVision\web\toolbarHelp.asp
   DELETED: \secure\infiniiVision\web\top.asp
   DELETED: \secure\infiniiVision\web\utils.js
   DELETED: \secure\infiniiVision\web\viewConfig.asp
   DELETED: \secure\infiniiVision\web\
**** CleanupInfiniiVisionFolder ****
   DELETED: \secure\infiniiVision\fpga\FPGA2000A.bin
   DELETED: \secure\infiniiVision\fpga\FPGA3000A.bin
   DELETED: \secure\infiniiVision\fpga\N2750A.bin
   DELETED: \secure\infiniiVision\fpga\N2820A.bin
   DELETED: \secure\infiniiVision\fpga\gpibFPGA.bin
   DELETED: \secure\infiniiVision\fpga\lanFPGA.bin
   DELETED: \secure\infiniiVision\fpga\
   DELETED: \secure\infiniiVision\SetupConverter.exe
   DELETED: \secure\infiniiVision\splashImage.bin
   DELETED: \secure\infiniiVision\dnssd_CE.dll
   DELETED: \secure\infiniiVision\libcups2.dll
   DELETED: \secure\infiniiVision\libcups2backend.dll
   DELETED: \secure\infiniiVision\networkPrintFile.exe
   DELETED: \secure\infiniiVision\websockify.exe
   DELETED: \secure\infiniiVision\infiniiVisionLauncher.exe
   DELETED: \secure\infiniiVision\infiniiVisionWebCom.dll
   DELETED: \secure\infiniiVision\
**** CleanupInfiniiVisionFolder ****
   DELETED: \secure\Startup\infiniivision.lnk
   DELETED: \secure\Startup\
**** CleanupInfiniiVisionFolder ****
   DELETED: \secure\help\lpkChineseS.lpk
   DELETED: \secure\help\lpkChineseT.lpk
   DELETED: \secure\help\lpkCzech.lpk
   DELETED: \secure\help\lpkFrench.lpk
   DELETED: \secure\help\lpkGerman.lpk
   DELETED: \secure\help\lpkItalian.lpk
   DELETED: \secure\help\lpkJapanese.lpk
   DELETED: \secure\help\lpkKorean.lpk
   DELETED: \secure\help\lpkPolish.lpk
   DELETED: \secure\help\lpkPortuguese.lpk
   DELETED: \secure\help\lpkRussian.lpk
   DELETED: \secure\help\lpkSpanish.lpk
   DELETED: \secure\help\lpkThai.lpk
   DELETED: \secure\help\lpkTurkish.lpk
   DELETED: \secure\help\
**** CleanupInfiniiVisionFolder ****
   DELETED: \secure\bin\
** END   ** ProcessRecipeStep: \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\cleanupFileSystem.exe: 3033 ms
** BEGIN ** ExtractFileFromCabFile: infiniivisionSetup.cab
** END   ** ExtractFileFromCabFile: infiniivisionSetup.cab: 9835 ms
** BEGIN ** ProcessRecipeStep: \windows\wceldcmd.exe /delete 0 \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\infiniivisionSetup.cab
** END   ** ProcessRecipeStep: \windows\wceldcmd.exe /delete 0 \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\infiniivisionSetup.cab: 8149 ms
** BEGIN ** ExtractFileFromCabFile: splashImage.png
** END   ** ExtractFileFromCabFile: splashImage.png: 438 ms
** BEGIN ** ProcessRecipeStep: \windows\compileImageForSplashScreen.exe \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\SplashImage.png \Secure\InfiniiVision\splashImage.bin
** END   ** ProcessRecipeStep: \windows\compileImageForSplashScreen.exe \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\SplashImage.png \Secure\InfiniiVision\splashImage.bin: 3021 ms
WMT: "", ""
** BEGIN ** ProcessRecipeStep: \windows\rebootInfiniivision.exe

Debug serial initialized ........OK
RTC: 2003-9-0   39:47:50.39 UTC

 icrosoft Windows CE Bootloader Common Library Versio
U-Bool 2010 03 (Oct 11 20:13- Micro:06) gindots C006.
EtU:   SPEoo600a
                er for the AgilRnM P512  oar

Adaptation performed by Agilent Technologies (c) 2008

Flash: 512 KiB
NAND:
System ready!
Preparing foredcw l28dM.B
RTC: 2021-3-9   3:39:47.54 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOIn:    serial
Out:   serial
Err:   serial
OOSerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
XIncorrect Data 0 EccResult: ff30cc EccError: ff30cc EccRead: 0
 EBOOT_ReadFlash failed offset 66e651
 EBOOT_ReadFlash failed location d0670000
ODeCompressFlash: CeCompressDecode() failed
 CeDecompressFlashBlock failed
****** Data record 8 corrupted, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1ACB780  Name="" Target=RAM
 Loading image 1 failed, trying next one
 Loading image 2 from meaoly a   0D
                                   6000d0
t copy from NAND offset 0x60000. Error -74 With ECC
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-05-07   8:18:27 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37749 Bytes = 36.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
RTC: 2021-3-9   3:39:47.96 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
RTC: 2021-3-9   3:39:48.0 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOOOXOOXOOXXOOXOXOOOOXOXOOOOOXOOOXOOOXXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOX
OOOXOOXOOOOXXXOOOOXOOXXOOXOOOOOOOOOXOXOOOXOOOOOOXOXOOOOXOXOOOOOOOXOXOXOOXOXOOOXOOOXOOXOXXOXOOOXOXXXXXOXOXXOXXXXOXOXXOOOXXOXXXXXXXOXXXXXXXOXXXXOXOXXOXOOOXXXXOXXXXXOOOXXOXX
OOXXOXXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOOXOXOOXOOXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1ACB780, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1ACB780  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2021-3-9   3:39:51.39 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Mar  7 2021)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:03:D3:04:10:00
Phy found addr 31 (ticks=3360)
WaitForLink Start (ticks=3361)
No Link (ticks=4364)
<--EDeviceInitialize

GMAC DMA status register = 0x0
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Device load time:
   NANDFLASH: 299 ms
   SNANDFLASH: 299 ms
   USB Hard Disk Drive: 299 ms
Summary of scan:

All FATs on volume agree

Percent Fragmentation: 0
Invalid Directories: 0
Invalid Files: 0
Invalid Clusters: 0
Lost Cluster Chains: 0

ScanVolume \Agilent Flash (NANDFLASH) 0.293000
Summary of scan:

All FATs on volume agree

Percent Fragmentation: 0
Invalid Directories: 0
Invalid Files: 0
Invalid Clusters: 0
Lost Cluster Chains: 0

ScanVolume \Secure (SNANDFLASH) 0.340000

Debug serial initialized ........OK
RTC: 2103-9-0   1:0:14.41 UTC

.4 B-iot  a010702 (5c01:88203er Common Library Version
Mic4o28:t )indoest P5000 EtCPU:   Bootro0d
 for the AgileDR M5  1b8aMdB
Adaptation performed by Agilent Technologies (c) 2008

Flash: 512 KiB
NAND:
System ready!
Preparing fom -eccl 128 MiB
RTC: 2021-3-9   3:41:0.17 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOIn:    serial
Out:   serial
Err:   serial
OSerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smscX
Incorrect Data 0 EccResult: ffffff EccError: ffffff EccRead: 0
 EBOOT_ReadFlash failed offset 66e651
 EBOOT_ReadFlash failed location d0672000
ODeCompressFlash: CeCompressDecode() failed
 CeDecompressFlashBlock failed
****** Data record 8 corrupted, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1ACB780  Name="" Target=RAM
 Loading image 1 failed, trying next one
 Loading image 2 from memoaylad: xD1
00u0
not copy from NAND offset 0x60000. Error -74 With ECC
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-05-07   8:18:27 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37749 Bytes = 36.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
RTC: 2021-3-9   3:41:0.59 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
RTC: 2021-3-9   3:41:0.63 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOOOXOOXOOXXOOXOXOOOOXOXOOOOOXOOOXOOOXXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOX
OOOXOOXOOOOXXXOOOOXOOXXOOXOOOOOOOOOXOXOOOXOOOOOOXOXOOOOXOXOOOOOOOXOXOXOOXOXOOOXOOOXOOXOXXOXOOOXOXXXXXOXOXXOXXXXOXOXXOOOXXOXXXXXXXOXXXXXXXOXXXXOXOXXOXOOOXXXXOXXXXXOOOXXOXX
OOXXOXXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOOXOXOOXOOXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1ACB780, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1ACB780  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2021-3-9   3:41:4.1 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Mar  7 2021)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:03:D3:04:10:00
Phy found addr 31 (ticks=3354)
WaitForLink Start (ticks=3356)
No Link (ticks=4358)
<--EDeviceInitialize

GMAC DMA status register = 0x0
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Device load time:
   NANDFLASH: 0 ms
   SNANDFLASH: 0 ms
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
Our command line is
Performing Startup
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses

      creating \Secure\bin\Released build, Mar  7 2021, 23:23:02
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
No option module detected
Keyboard firmware version 32... ok
Keyboard Info: Board id 1, Board rev 3
Startup sequence is complete.
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
System has been running 25.903025 seconds
Start Up Sequence 15.202900
Memory Load 55%
   System Physical Memory 39.730 / 73.277 MB
   Process Virtual Memory 49.500 / 1024.000 MB
-----> InfiniiVision is running <-----
failed open \Secure\InfiniiVision\LudicrousSpeed.usb
                                                    no workaround for USB phy




Again, sometimes the startup is successful and in most cases it fits here:

Code: [Select]
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-05-07   8:18:27 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37749 Bytes = 36.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Maybe try to downgrade to a lower version for example 2.35? Although there is no logic ...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 12, 2021, 05:58:01 pm
@sajsoni do you read the log at all? There are NAND/ECC errors. Do what TheSteve advised- run another update and see if errors persist.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on November 12, 2021, 07:22:21 pm
Bud, BTW, please explain what the "verify images" of the pboot does. Which images does it verify and how?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 12, 2021, 07:33:00 pm
I don't have a LAN card ...


I tried to run the flash a few more times and they always have the same errors, if we think of the same part of the log:

Code: [Select]
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1ACB780  Name="" Target=RAM
 Loading image 1 failed, trying next one
 Loading image 2 from memora lt 0 D 000Could not copy from NAND offset 0x60000. Error -74 With ECC
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-05-07   8:18:27 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37749 Bytes = 36.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 12, 2021, 07:58:38 pm
Bud, BTW, please explain what the "verify images" of the pboot does. Which images does it verify and how?
There are two same copies of nk.bin image in NAND. I do not know the exact method how Pboot validates them but think it calculates a checksum and compares against the original value. Now - the original checksum value may be stored either in the header in the nk.bin itself or somewhere else in NAND written by the last successfull firmware update, i do not know.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 12, 2021, 09:30:00 pm
I don't have a LAN card ...


I tried to run the flash a few more times and they always have the same errors, if we think of the same part of the log:

Code: [Select]
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1ACB780  Name="" Target=RAM
 Loading image 1 failed, trying next one
 [b]Loading image 2 from memora lt 0 D 000[/b]Could not copy from NAND offset 0x60000. Error -74 With ECC
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-05-07   8:18:27 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37749 Bytes = 36.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

The output is garbled (5th row from top)... Do you have a reliable serial connection ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: albertr on November 13, 2021, 03:57:58 am
F/W ver.7.50 was released today for 3000T-series scopes.

2021-11-12    7.50.20211028

Here's the change log (according to Keysight):

Version 7.50.2021102830
Released Date: 12 November 2021
Instrument software version: Revision 7.50.2021102830
File Name: 3000XSeriesT.7.50.2021102830.ksx
Bug Fixes
This software revision includes the following Bug fixes:
- Corrected issue where WaveGen inversion disappears at 50% duty cycle.
- Removed references to unsupported USB 2.0 hi-speed. USB 2.0 hi-speed is not supported
by 3000T X-Series oscilloscopes.
- Corrected issue where remote command :WMEM1:SAVE MATH1 does not behave the
same as the front panel operation.
- Fixed incorrect scaling issue with N282xA probes
- Corrected firmware update failure (AUX-V)

-albertr

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 13, 2021, 11:14:25 am
I think the serial connection is fine. Here is part of the same log with another UART converter.
Now he failed to load any images ....

Code: [Select]
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1ACB780  Name="" Target=RAM
aCludd nryicgpn xr onN
 Loadint 0mag0 2  rrmom mor  ith0EDC
0000
Incorrect Data 0 EccResult: cc0f00 EccError: 33f0ff EccRead: ffffff
 IsCompressed: ReadFlash failed

BL_IMAGE_TYPE_UNKNOWN

 Loading image 2 failed, trying next one
 All images failed

Press r to reset
failed: 13 5
Could not copy from NAND offset 0x60000. Error -74 NO ECC
FPGA programming FAILED!
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-05-07   8:18:27 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37749 Bytes = 36.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 13, 2021, 02:12:20 pm
Is it a 3.3V uart converter?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 13, 2021, 02:56:27 pm
Yes, 3.3V converter
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 13, 2021, 03:01:26 pm
If the CPU is not even able to drive serial output, it is time to check voltages.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on November 14, 2021, 12:32:53 am
F/W ver.7.50 was released today for 3000T-series scopes.

2021-11-12    7.50.20211028

Here's the change log (according to Keysight):

Version 7.50.2021102830
Released Date: 12 November 2021
Instrument software version: Revision 7.50.2021102830
File Name: 3000XSeriesT.7.50.2021102830.ksx
Bug Fixes
This software revision includes the following Bug fixes:
- Corrected issue where WaveGen inversion disappears at 50% duty cycle.
- Removed references to unsupported USB 2.0 hi-speed. USB 2.0 hi-speed is not supported
by 3000T X-Series oscilloscopes.
- Corrected issue where remote command :WMEM1:SAVE MATH1 does not behave the
same as the front panel operation.
- Fixed incorrect scaling issue with N282xA probes
- Corrected firmware update failure (AUX-V)

-albertr

Installed without any issue.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 14, 2021, 02:54:36 pm
Voltages are OK ...

since I have access to another identical oscilloscope with software version 2.65, is there a possibility to read and save the complete dump on the PC and then try the flash again?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 14, 2021, 03:26:10 pm
The resistors are not in their original form, I removed two resistors to enable JTAG as someone mentioned ....
Can they have an impact? I can return them as they were, they are 1K resistors ...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 14, 2021, 03:59:38 pm
Finally! Now they are constantly booting from the first!  :scared:

Thank you all for your help
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sajsoni on November 14, 2021, 04:12:02 pm
Maybe I'm a little boring now. Is it complicated to add licenses for digital channel and serial decoding functions?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 14, 2021, 09:58:06 pm
Thanks for wasting our time. Cant offer my advice anymore.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on November 19, 2021, 07:36:02 pm
FOR REFERENCE

Decided to gather all the DSOX1000, 2000A, 3000A, 3000T, 4000A and 6000A options information in a single table. It's the best info I've collected so far but it may contain some errors.

If you see any omission/error please say so (or pm me to reduce clutter).

(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=1616008;image)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on November 19, 2021, 10:31:44 pm
FCDCFCE29--DSOX6B10T254BW
for 4000A,it also has F9EA328C .
F9EA328C--TELN
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ita4ever on November 24, 2021, 07:48:22 pm
Does the hacked firmware void the warranty??
More than likely, however like Jailbreaking or something, if you can get the original firmware back on there before you send it in for servicing theyll probably never know you were ever running a customer firmware.

Anyone here had really reverted to original firmware, sent the oscilloscope for a warranty repair and got the repair?

I'm slightly undecided between DSOX2004A and DSOX3014A. The budget allows me to get to the DSOX3014A even if my actual needs can be covered with the DSOX2004A. In both cases the decoding of the serial protocols is mandatory.
The doubt arises from the fact that if the oscilloscope fails under warranty .. I can't risk throwing away a DSOX3014A, too expensive!

Thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on November 24, 2021, 08:30:26 pm
Quote
decoding of the serial protocols is mandatory

Wouldn't something PC-based be more appropriate for that? The scope is great for sorting logic levels used by serial protocols, but if you're debugging the actual data I find something like the Logic preferable.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ita4ever on November 24, 2021, 08:43:55 pm
Quote
decoding of the serial protocols is mandatory

Wouldn't something PC-based be more appropriate for that?

Yes, of course.
If one have to decode serial protocols only, there is no need to use an oscilloscope. A PC-based solution could be more appropriate.
In my case I'm going to buy a new oscilloscope and I'd like to use it for serial protocols decoding too.
I specified that because both DSOX2000 and DSOX3000A has no standard serial protocols decoding so I'll go with the hack.
Then my question about the warranty.

Thanks for your opinion.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Keysight DanielBogdanoff on November 24, 2021, 11:12:14 pm
Does the hacked firmware void the warranty??
More than likely, however like Jailbreaking or something, if you can get the original firmware back on there before you send it in for servicing theyll probably never know you were ever running a customer firmware.

I'm slightly undecided between DSOX2004A and DSOX3014A. The budget allows me to get to the DSOX3014A even if my actual needs can be covered with the DSOX2004A. In both cases the decoding of the serial protocols is mandatory.
The doubt arises from the fact that if the oscilloscope fails under warranty .. I can't risk throwing away a DSOX3014A, too expensive!


The official stance is that if something comes in modified the warranty doesn't hold. You also might think about a DSOX1204A/G over the DSOX2004A?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ita4ever on November 25, 2021, 09:55:50 am
The official stance is that if something comes in modified the warranty doesn't hold. You also might think about a DSOX1204A/G over the DSOX2004A?

I briefly read about DSOX1204A days ago when comparing many scopes in order to narrowing the selection.
My conclusion was that Keysight is trying to be part of the low-price scopes segment.
I have used many scopes brand in my job and I my preference is for Keysight even if there are many cheaper brands around.
I would not want DSOX1204A to be too cheap a product for a brand like Keysight and then you would pay for the name but not for the quality.
If I wanted to spend less I probably would choose Rigol. This is my opinion.
Have you had a chance to work with any DSO1200? What was your impression?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on November 25, 2021, 10:03:33 am
The official stance is that if something comes in modified the warranty doesn't hold. You also might think about a DSOX1204A/G over the DSOX2004A?

I briefly read about DSOX1204A days ago when comparing many scopes in order to narrowing the selection.
My conclusion was that Keysight is trying to be part of the low-price scopes segment.
I have used many scopes brand in my job and I my preference is for Keysight even if there are many cheaper brands around.
I would not want DSOX1204A to be too cheap a product for a brand like Keysight and then you would pay for the name but not for the quality.
If I wanted to spend less I probably would choose Rigol. This is my opinion.
Have you had a chance to work with any DSO1200? What was your impression?

 |O :-DD
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on November 26, 2021, 05:12:52 pm
I'm slightly undecided between DSOX2004A and DSOX3014A. The budget allows me to get to the DSOX3014A even if my actual needs can be covered with the DSOX2004A.
...

In regards to the DSOX3014A... In your talking about the warranty, it sounds like you're considering purchasing new.

The "A" version has been out for quite a long time, and hasn't received any significant functionality software upgrades in years.  In fact, although you can still buy it, it's not even listed anymore on Keysight's oscilloscope page.

If you want to purchase a scope in the 3000 series, you should look more closely at the "T" version, namely the DSO3014T.  It's even slightly cheaper; DSOX3014A @ US$4,980 vs. DSOX3014T @ US$4,838, and has more features (like FRA).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ita4ever on November 26, 2021, 10:05:50 pm
In regards to the DSOX3014A... In your talking about the warranty, it sounds like you're considering purchasing new.
Yes, I'm mainly focused on a new one.
I also consider the used ones but at the moment I have no trusty enough sources where to buy this model.

The "A" version has been out for quite a long time, and hasn't received any significant functionality software upgrades in years.  In fact, although you can still buy it, it's not even listed anymore on Keysight's oscilloscope page.
Good observation, thanks

If you want to purchase a scope in the 3000 series, you should look more closely at the "T" version, namely the DSO3014T.  It's even slightly cheaper; DSOX3014A @ US$4,980 vs. DSOX3014T @ US$4,838, and has more features (like FRA).
I had considered the "T" version and read the dedicate thread here on eevblog. There are different points of view about it.
Some of them match with mine: touchsceen added just to bring some modern look to an old model scope but not as essential as for a scope born with the touchscreen.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Amphion on November 28, 2021, 10:37:03 am
Hi all. I was about to buy a Siglent SDS2000x plus series, but then I found this thread. I used to use one of these scopes (an MSOX3054) at work and love it. I just didn't think I could afford an MSOX AND the options I need. But now I'm considering buying an MSOX/DSOX 30x4 for as cheap as I can, and then doing the "upgrades." Before I spend those $$$k, I'd just like to confirm here...

1)My understanding from what I've read is that upgrading is as simple as doing a standard firmware update via USB stick, but using PhillyFlyers patched firmware. And maybe some command line stuff to enable options, but it looks pretty easy and straightforward correct? i.e.:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3562918/#msg3562918 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3562918/#msg3562918)

2)Before I make a purchase, are there any major gotchas I should know about that I might have missed by not reading all of this massive amount of posts (models that don't work to upgrade etc.)?


Glad I found this thread, good work, and Thanks!

EDIT: I just found this regarding hardware based bandwidth upgrade limitations:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3434410/#msg3434410 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3434410/#msg3434410)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Amphion on December 01, 2021, 06:21:12 am
Are there other limitations besides bandwidth to be aware of when "upgrading"?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 240RS on December 02, 2021, 11:31:36 am
I just bought my first Keysight and it is being shipped (snail post). But it is an old Agilent MSOX3104A, thinking that the main difference is the touch screen functionality that I certainly could do without.

Have follwed this complete thread and love it. But only saw this recent post now and I am afraid I have bought an old 'A' that will limit me given that the most recent firmware for it is years old. Is PhillyFlyers fw only working on the 'T' version?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pepperoni7 on December 03, 2021, 07:31:52 am
Is PhillyFlyers fw only working on the 'T' version?
Other versions too, including 3000A:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3562918/#msg3562918 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3562918/#msg3562918)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 240RS on December 03, 2021, 12:21:37 pm
Super helpful!! Thanks. I had seen that part of the thread, but never paid attention to 7.40 vs 2.65

Turns out I 'won' two auctions. So will have two 3014A's. One is airfreight, so shouldn't be too long. Can't wait.

Any risk for NAND errors after the upgrade to 2.65?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ita4ever on December 03, 2021, 01:27:02 pm
Turns out I 'won' two auctions. So will have two 3014A's.

How much did you spent for one of them?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on December 03, 2021, 03:44:41 pm
Super helpful!! Thanks. I had seen that part of the thread, but never paid attention to 7.40 vs 2.65

Turns out I 'won' two auctions. So will have two 3014A's. One is airfreight, so shouldn't be too long. Can't wait.

Any risk for NAND errors after the upgrade to 2.65?

Very very minimal, not enough to be concerned about.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 240RS on December 03, 2021, 10:09:58 pm
Thanks!!

As for prices:
2015 Agilent MSO 3014A, with logic probe: $2k
2018 MSO 3104A, unused (!), logic and 4 probes is sealed bags still: $3k

Correction: 3014 models (100MHz)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on December 03, 2021, 11:28:28 pm
I saw the first one at Ebay too. I don't think the $2,000 figure should be left alone. You need to add $178 shipping and $564 non refundable/reclaimable import charges (the well known Ebay/Pitney Bowes scam) and you still have no probes. Four Agilents/Keysight N2863a probes will add another $300 (if you are lucky), probably more like $400 including shipping, thus the final price is >$3000.
The second one (also a DSOX3014a) sounds like a better deal as almost unused, but here probably also shipping adds and -if from Ebay- the usual import fee scam.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 240RS on December 04, 2021, 04:09:36 pm
Not sure what you are trying to say.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on December 04, 2021, 05:08:45 pm
Not sure what you are trying to say.

That you overpaid, but trying not to sound like a hypocrite  8)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 240RS on December 04, 2021, 09:56:01 pm
Ahh, making it personal…
Calculation dor first is incorrect. Shipping and duties on second zero.

Of course many do not like the price. Otherwise I could not have bought it.

I am just an (import duty exempt) enthusiast. Answering the question.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: killingtime on December 18, 2021, 09:49:21 pm
Just managed to get to the end of this interesting thread. Some questions if I may, and to recap..

In the beginning, people downloaded the official firmware from Keysight that matched what was already loaded onto their scopes and manually hacked it with a hex editor. Modified files were placed on a FAT16 USB flash drive and the scope was booted from this drive. A warning message was displayed on screen about tampered files, but after clearing this the scope booted and loaded the options you hacked into the firmware. This hack had the advantage that files on the scope itself were not modified, and if you wanted to revert to the stock scope, you just unplugged the USB drive and rebooted. A big plus for those running new scopes, given Keysight have said they'll invalidate the warranty of any scope that's been tampered with.

Then Keysight started releasing firmware updates that would no longer boot from a flash drive (they read these forums too). Forum member PhillyFliers then very kindly released official Keysight firmware that was pre-hacked and could be used to modify the scope. Download links and instructions can be found below post 2603 and onwards. If you read the instructions, they seem to modify software on the scope itself. Keysight have also changed the telnet login, but there's a python script that runs over Ethernet to overcome this obstacle.

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/2600/ (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/2600/)

My questions are:
1. Is it possible to get the firmware from PhillyFliers to run from a USB flash drive (avoiding mods to the scope itself), or is this window now closed?
2. Does the firmware from PhillyFliers give the error message at start-up that has to be cleared, or does the scope boot without warnings?

Thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlloyd1 on December 20, 2021, 10:59:32 pm
I can't answer your question.
But I did want to publicly say how helpful your recap was for those of us that are software challenged. :)
Thanks for doing that.
 :-+

mlloyd1
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on December 20, 2021, 11:38:24 pm
Jusf run an official firmware update and all your "firmware modification on the scope" will be overwritten. I am not sure what your concern is....
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on December 21, 2021, 01:14:40 am

My questions are:
1. Is it possible to get the firmware from PhillyFliers to run from a USB flash drive (avoiding mods to the scope itself), or is this window now closed?
2. Does the firmware from PhillyFliers give the error message at start-up that has to be cleared, or does the scope boot without warnings?

Thanks.
1.It is possible to get the firmware from PhillyFliers to run from a USB flash drive.
2.PhillyFliers firmware do not give the error message.He patched firmwares perfect.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on December 21, 2021, 05:41:00 am
So why dont you share with us the new technology. Make your contribution to the thread.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 240RS on December 29, 2021, 10:15:08 am
I've been using a DSOX2014A I upgraded around version 2.41.  Yesterday upgraded using the Safar method to 2.43 to get the PLUS+ stuff.

Now it seems like I'm missing an info screen that overlaid statistics I regularly used.
This is what it used to look like:
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=639922;image)

The Statistics button is missing from the bottom right so no overlay.  Is this maybe the problem with to long a script?  I used;
211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW20 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

Screenshot from this thread way earlier. In relation to the --perf option that I like. But apart from that, how could I have a white background for scope screenshots? I only managed to get the black background (via usb-stick).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on December 29, 2021, 10:37:09 am
Quote
how could I have a white background for scope screenshots?

There's an option to switch to negative video when you connect via a browser (over the network).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 240RS on December 29, 2021, 10:43:07 am
That explains!! Will try to upgrade with a LAN card then. Really do not like the black screenshots and also started to hate using an usb stick for it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on December 29, 2021, 11:26:55 am
That explains!! Will try to upgrade with a LAN card then. Really do not like the black screenshots and also started to hate using an usb stick for it.

In file save menu when setting file format there is setting submenu where you can set palette when saving to USB..

It is a shame Keysight never made possible to map network drive from a scope. It has stupid print to network printer that is something I never used (usually you paste image into some document first) but no mapping to network drive so we don't have to use stupid USB for everything
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 240RS on December 29, 2021, 03:21:11 pm
Tx. It was the “Invert Grat” option and then save to USB under the menu as you said. Solved that issue.

Fully agree on the latter point. Makes me even think of creating a network printer that saves to file.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on January 02, 2022, 05:04:57 pm
Hi Lads.
I have tried to connect with telnet. DSOX4024A
But I am getting an error message "Could not open connection to the  host on port 23: Connect failed."
I had ping response on the address.
I wouldlike to download the Secure\startup\infiniivision.lnk   
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on January 02, 2022, 07:42:17 pm
Figured.
I can connect with telnet during the boot of the scope. :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on January 02, 2022, 08:34:45 pm
But still have a question.
Installed the patched firmware with the infiniivision.lnk file.
But still not geting extra upgrades.
this is in the lnk file
84#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l D4000BDLA -l WAVEGEN

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hexley on January 02, 2022, 11:00:47 pm

But still not geting extra upgrades.
this is in the lnk file
84#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l D4000BDLA -l WAVEGEN

Wrong character count. Try 80#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l D4000BDLA -l WAVEGEN
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on January 03, 2022, 05:53:18 pm

But still not geting extra upgrades.
this is in the lnk file
84#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l D4000BDLA -l WAVEGEN

Wrong character count. Try 80#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l D4000BDLA -l WAVEGEN
I will try try it so. I did not know that is the character count. Thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on January 03, 2022, 06:08:25 pm
Thanks. That was it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on January 03, 2022, 08:44:47 pm
Hi Lads again.
I was using BW50. But still I have 200Mhz. The rest of the options are working.
And I do not see that listed.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on January 03, 2022, 08:48:53 pm
Hi Lads again.
I was using BW50. But still I have 200Mhz. The rest of the options are working.
And I do not see that listed.

You didn't read enough.

100 and 200 MHz are first variation of hardware. 350 and 500 MHz are second one, and 1GHz is a third variation.
You cannot go to 350/500 Mhz without hardware changes on the mainboard.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oaba on January 04, 2022, 05:24:29 am
How the software will know you have a 1GHZ hardware?
Even if you replaced the relays, caps, resistors.
Is there a jumper?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on January 04, 2022, 08:23:11 am
How the software will know you have a 1GHZ hardware?
Even if you replaced the relays, caps, resistors.
Is there a jumper?
Yes.
There is a whole separate topic on it. I'm not going to answer sentence by sentence what is a 20 pages book somenone else wrote. Just go there and read.
And I will disappoint you: going to 1 GHz is very hard to do...
going to 500 Mhz is easier but still risky business.
You need to be experienced and know what you doing.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Venturi962 on January 08, 2022, 02:43:35 pm
The release notes for 7.50 state that the Aux -V / Symbols issue was addressed in the firmware:

"- Corrected firmware update failure (AUX-V) "

Attached the Release Notes as well.  This seems to be a 3000T / 4000X Firmware only.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hexley on January 08, 2022, 10:06:59 pm
7.50 upgrade on a 4000X went smoothly. Thanks, PhllyFlyers.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sievil on January 11, 2022, 09:02:36 am
4054A works,  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: molin on January 20, 2022, 12:37:23 pm
The link to the 2.35 version FW in this post (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181)) is broken. It reports only "403 Forbidden".
Would someone please share the 2.35 FW?
Or does the guide work with other FW versions as well (even though the guide indicates that newer versions do not boot from USB)

Thanks for a great guide!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: felixsys on January 20, 2022, 06:00:17 pm
Just bought a 3024T .. Has anyone updated this oscilloscope to 500 mhz? Soft upgrade is not possible. I think there's some components to modify/add on the frontend board.
all feedbacks will be appreciated!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: hugos31 on January 22, 2022, 02:57:28 am
thanks  PhillyFlyers  ...worked on my DSOX1102G
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wutieru on January 22, 2022, 09:36:40 am
Does anyone have a schematic for the DSX3000?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: moloko on January 22, 2022, 04:06:59 pm
I have been thinking recently about selling my DSOX 2002 (which is patched to max specs). Is there any way to restore the original configuration (bandwidth, etc.) before selling it?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mr. Scram on January 25, 2022, 05:41:32 am
The official stance is that if something comes in modified the warranty doesn't hold. You also might think about a DSOX1204A/G over the DSOX2004A?
Please note that this doesn't hold in the EU. Warranty can only be denied if the defect was a result of the modifications of the owner, and this can be reasonably demonstrated. General handwaving and assumptions that any change would lead to the defect are not acceptable under EU warranty laws.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: knotlogic on January 25, 2022, 02:43:36 pm
Apologies for going somewhat off topic on this, but I figured this would be the best place to ask for advice.

I'm looking to buy a scope.  Had my eye on a fully loaded used MSOX2024A from the Keysight eBay store, but have had a busy time the past 1.5 years.  Now that I'm finally getting around to it, I see the prices have shot up about 50%.

Plan B, and where this thread becomes relevant, is that I hunt for a DSOX20x4A and used a patched firmware.  But on that I have questions, and I was really hoping to benefit from the experience of people who have actually done this or something like it:

Realistically, how much risk is there in doing the hack?  From what I've been reading it's now dead simple.  And if I understand correctly, we don't even need to telnet into the scope anymore?  Just install the firmware from USB?

Is flash corruption still an issue with some units?  I remember there was a thing a few years back about scopes suddenly not being able to boot anymore.  I think that was flash related, and I know that at the time there was some sort of support from Keysight, but I figure that's long past.  Was the cause ever identified?

At the end of the day, do you think I might be better off taking the hit on Keysight's new prices and buying from their eBay store.  I realise that's hard to qualify given it's impossible to predict what the alternatives are.  (And yes, I've read about their new B2B only policy).  The plus points that I can see are there are less likely to be any issues with the scope, they come with full options enabled,  and they come with at least a 30 day warranty.  The minus is they don't come with accessories, so that would be an additional cost.  Though the lack of accessories would probably be the case with other sellers as well.

On a related note, are the logic probes easy to find?

My biggest worry is ending up with a dead unit that's beyond my ability to fix.  So I could really use the advice on what I should look out for or avoid.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mike112 on January 27, 2022, 04:21:25 pm
Hey guys I have a 3000 series scope with a typical nand flash issue and I've been trying to get it to boot with no luck so far. I was hoping someone may be able to shed some light on whether I can get it back or not. I have been trying to use the method that titirus put together. So far I have made the nk.nb0 file and uploaded it to the scope as well as prepared a boot USB that is attached to the scope. Im pretty sure the problem is that the scope is is looking for the startup file on the scope rather than from the usb drive.

Code: [Select]
U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
p500> loady 0x0361000 115200
## Ready for binary (ymodem) download to 0x00361000 at 115200 bps...
CCxyzModem - CRC mode, 1(SOH)/19482(STX)/0(CAN) packets, 5 retries
## Total Size      = 0x013064d4 = 19948756 Bytes
p500> go 0x00362000
## Starting application at 0x00362000 ...
Windows CE Kernel for ARM (Thumb Enabled) Built on Jan 24 2013 at 14:52:37
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jun 18 2013)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:1D:28:B4
Phy found addr 31 (ticks=2582)
WaitForLink Start (ticks=2583)
No Link (ticks=3586)
<--EDeviceInitialize

GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
ERROR: OALIoCtlHalGetDeviceInfo: Device doesn't support IOCTL_HAL_GET_DEVICE_INFO::SPI_GETBOOTMENAME
Failed to start/configure network.
Time for NANDFLASH to load: 0 ms.
Time for SNANDFLASH to load: 0 ms.
Starting ProcessStartupFolder
running \Secure\Startup\infiniivision.lnk...
System.MissingMethodException: Can't find an Entry Point 'RegisterNativeCompactLicensingCallbacks' in a PInvoke DLL 'Agilent.Cdf.Api.Unmanaged.dll'.
   at Agilent.Cdf.Api.Licensing.Compact.LicenseSupervisor.g.a.c()
   at Agilent.Cdf.Api.NativeInterop.RegisterNativeCallbacks()
   at Agilent.InfiniiVision.infiniiVisionLauncher.Main(String[] args)

Ending ProcessStartupFolder

The part that im looking at is:

Starting ProcessStartupFolder
running \Secure\Startup\infiniivision.lnk

shouldn't it be trying to find it on the usb?  :-// If anyone has some ideas of where Im going wrong that would be greatly appreciated. Ive tried 2 different usb sticks formatted to FAT but maybe I did something wrong with the code?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on January 27, 2022, 04:45:12 pm
I do not think booting from usb works anymore. At some firmware release version that was taken off.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mike112 on January 27, 2022, 04:55:56 pm
Hmm I don't know if this scope ever had its firmware updated, ill have to check. Is the only other way to try and source a lan card?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on January 27, 2022, 05:19:56 pm
But you are booting from the memory using image you uploaded via Ymodem. Perhaps you need to upload one of the older images that can read startup folder from USB.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 27, 2022, 08:40:33 pm
Could be a firmware version mismatch - try images from older firmware versions.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: btr on January 29, 2022, 02:05:26 pm
Please accept my heartfelt Thank You to all who shared their knowledge and made this thread what it is!

I had a non booting DSO-X3012A with the (as I now know not uncommon) NAND problem, the instrument is now in working condition thanks to the info presented here, the support from fellow user maurit as well as the LAN card he provided me with.

Cheers!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mike112 on January 31, 2022, 05:07:16 pm
Thank you everyone for the help! My scope was not booting due to a corrupt NAND issue and is now back up and running great. Just want to mention a few issues I had in case anyone hits them in the future. I was using the method titirus put together in this post.

1 - I was having an issue with the USB not being read in uboot. As TheSteve and Bud mentioned above it did turn out to be related to not using an old enough/or mismatched firm where. I was trying to use 2.35, but when I used th nk file from 2.10 it worked flawlessly to get the scope to boot.

2 - Once I had the scope up I needed to get the firmware installed on to the scope. The scope had no issue reading the USB drive but every time I tried to install the firmware from the drive it would display "Error: The file did not load correctly.". This turned out to be just an issue with the USB drive. I tried it with another USB I keep on my key chain I had with me and it worked! I installed 2.10 and then updated to 2.35.

Incase anyone wonders about the brand of the USB drives, the one that did not work is branded 'Gigastone' and is new, the one that worked is PNY and at least 10+years old haha. Thanks again everyone!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 31, 2022, 05:57:35 pm
I hope you upgrade beyond 2.35 to current firmware so nand corruption is much less likely to reoccur.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: arlvaljr on January 31, 2022, 08:29:42 pm
I installed the 7.50 upgrade on my MSOX 3022T and is working perfect.
Installation took a bit longer than previous ones but it was very smooth with all files placed in the same pen drive.

Thanks, PhllyFlyers by your perfect work!

 :-+ :-+ :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sievil on February 18, 2022, 01:36:21 am
MSOX3024T works great !
Quote
50#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PioB on February 18, 2022, 01:51:07 pm
I am not clear on the following, I tried finding it on the last several pages but well...:

Assume one has a 100 MHz scope  with a officially licensed 200 MHz Bandwidth upgrade (thus 3024T) and a bundle of officially licensed decoders activated.

If one were to run the PhillyFlyers Hack in order to obtain the MSO-functionality

What would happen in case of the next firmware upgrade?

Would one revert to the official 200/decoders
Would one lose all the licenses and would have to hack everything
Would one keep 200/decoders/MSO
...
?

Thanks for any inputs on this
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pquadrat on February 21, 2022, 07:42:00 pm
3000A-series 200MHz board to 500MHz board upgrade how-to.
Similar procedure can be applied to 3000T and 4000A series.

To extend 100/200MHz board to 350/500MHz you'll need to perform serious hardware modification of the main board.
Decent SMD soldering skill and soldering equipment are required to perform this modification.
Thus, it's not recommended to try this mod unless you're really desperate to get extra bandwidth.
...

I successfully did this modification. Thanks to memset! It really needs some SMD skills, the next one will look better.
I tested the bandwith, and is is more than 500MHz, and triggers to above 1GHz. Before the self calibration, bandwith was even better, seems to be software-limited.
Now I need another one to do the 1Ghz mod  ;D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on February 22, 2022, 03:38:13 am
Congrats on your mod!  Now for the 1GHz, you also need around 142 little cups, bags, ice cube trays, or pill bottles to put your old parts in for safe backup, by channel   :)

Fortunately, the shields come off easy (hot iron, good rosin solder wik) and the parts are mostly 0603 which by today's standards are large.

You also have a chance to leave those boards a lot cleaner than the manufacturer did.  You need a good flux remover to remove the baked on, no clean flux on these scope boards.  The parts you replaced, however, are the easiest to clean due to the heat and flux from your new solder / paste.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Oddball_85 on February 24, 2022, 05:21:22 am
Quote
1 - I was having an issue with the USB not being read in uboot. As TheSteve and Bud mentioned above it did turn out to be related to not using an old enough/or mismatched firm where. I was trying to use 2.35, but when I used th nk file from 2.10 it worked flawlessly to get the scope to boot
Where were you able to find 2.1? Is there anywhere that old firmware versions can be downloaded?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: John1996 on March 17, 2022, 10:29:10 am
Hi
I have DSO-X4024A with corrupted NAND. I reflashed device and SDO boots now but Secure folder is empty. Could somebody copy Secure folder (with changed serial number or without it).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adbjn on March 20, 2022, 10:29:23 pm
I bought a used DSO-X 2022A today and I just spent endless hours reading through this forum thread trying to understand how to hack it to enable all options. I thought I would never understand how to do it and it seemed super complicated. There were only bits of information and hints here and there and references to other posts all over the place. I was almost about to order a LAN expansion card because at one point I thought I needed it to hack the scope. After a few hours of reading and reading and then some more reading I was just about to give up.

But then, I tried this 1-minute hack which seemed far far too easy to possibly have any chance of working:
- Copied the firmware file for my scope from post #3033 into the root folder of a USB memory stick.
- Created a file called "infiniivision.lnk" (described in post #1529) with just this one line of text inside the root folder of the same USB memory stick:
160#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO --perf -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l TOM -l BW20 -l ADVMATH -l EMBD -l EDK -l VID

I then installed the updated (hacked) firmware from the USB memory stick. To my complete surprise, it seems to have actually worked. Functions I did not have before are now enabled.

However, when I start my scope I get this error message: "System concerns detected. OS version is not correct. Please reload system firmware."

Is this normal? Should I be concerned?

Btw, is there a better LNK-file that you should use today? The one I used is from a few years back.

Anyway, big thanks to everyone who have contributed to this incredible thread.

Johan
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on March 20, 2022, 11:57:09 pm
Consider youself lucky, as it seems your scope had an older firmware version that allowed that USB trick. The post #1529 was frok 5 years ago. With many last versions you cant do it anymore.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: msuthar on March 21, 2022, 02:24:54 am
The link file you used is for 3000 series.
for 2000 use this one

Use the latest firmware 2.65 and put these lines.
146#infiniivisionLauncher.exe -l MSO -l WAVEGEN --perf -l D2000AUTB -l D2000GENB -l D2000BDLB -l BW10 -l BW20 -l SCPIPS -l PLUS -l VID -l CABLE -l ASV

-SGMC    ?   correct is -SGM   is for segmented memory.
and
-TOM
-FLEX
Are not supported in your model.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adbjn on March 21, 2022, 06:39:34 am
Consider youself lucky, as it seems your scope had an older firmware version that allowed that USB trick. The post #1529 was frok 5 years ago. With many last versions you cant do it anymore.

OK. I initially had a firmware version from 2013. Before I knew that the scope could be hacked I upgraded it to the latest 2.65 version and then later I found this thread and did the hack. But my scope is probably old. It even says Agilent on the front.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adbjn on March 21, 2022, 06:54:15 am
Use the latest firmware 2.65 and put these lines.
146#infiniivisionLauncher.exe -l MSO -l WAVEGEN --perf -l D2000AUTB -l D2000GENB -l D2000BDLB -l BW10 -l BW20 -l SCPIPS -l PLUS -l VID -l CABLE -l ASV

Thanks! The error message is gone now. Will this unlock all functions of the 2000-series?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: msuthar on March 21, 2022, 04:13:31 pm

for unlocking all function there is one switch  -l All

Following will unlock all including the dealer mode for demo.

145#infiniivisionLauncher.exe -l MSO -l WAVEGEN --perf -l D2000BDLB -l D2000AUTB -l D2000GENB -l BW20 -l SCPIPS -l PLUS -l VID -l CABLE -l ASV -l DIS

Brgds.
73.
Manoj Suhar VU2EHY
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adbjn on March 21, 2022, 09:30:07 pm

for unlocking all function there is one switch  -l All

Following will unlock all including the dealer mode for demo.

145#infiniivisionLauncher.exe -l MSO -l WAVEGEN --perf -l D2000BDLB -l D2000AUTB -l D2000GENB -l BW20 -l SCPIPS -l PLUS -l VID -l CABLE -l ASV -l DIS

Brgds.
73.
Manoj Suhar VU2EHY

Ok. Thanks for the info. But if "-l All" unlocks everything then why not just use that instead of the 145 character long lnk-file text?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: adbjn on March 21, 2022, 09:32:40 pm
What would be the cheapest type of digital probe that can be used with the 2000A series scopes? Is there anything cheaper or better than the Agilent N6459-61601?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 240RS on March 23, 2022, 08:56:29 am

for unlocking all function there is one switch  -l All

Following will unlock all including the dealer mode for demo.

145#infiniivisionLauncher.exe -l MSO -l WAVEGEN --perf -l D2000BDLB -l D2000AUTB -l D2000GENB -l BW20 -l SCPIPS -l PLUS -l VID -l CABLE -l ASV -l DIS

Brgds.
73.
Manoj Suhar VU2EHY

Ok. Thanks for the info. But if "-l All" unlocks everything then why not just use that instead of the 145 character long lnk-file text?

Always wondered this myself! Is there something that is missed in the All key?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: msuthar on March 23, 2022, 01:51:25 pm
39#infiniivisionLauncher.exe --perf -l All
see the attached image
* means no expiration . you can see in the Utility>Service>Licensing>My Support Subscriptions   menu

It does not give following

BW10            100MHz Bandwidth"
BW20            200MHz Bandwidth"
CABLE           Ratio and Phase measure in Analyse Menu
SCPIPS        Infiniium Mode scipip infiniion SCPI PS  commands

[attach=1]
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: John1996 on April 01, 2022, 10:58:39 am
I have DSO-X4024A with corrupted NAND. I reflashed device and SDO boots now but Secure folder is empty.

I think you should use the SecureDataTool_DTD2.exe to rebuild it correctly.

Thnks. Could you tell me where I can find it?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: maomi84 on April 18, 2022, 09:37:35 am
Thanks all for the great work, I have installed the latest patched firmware on my DSOX3014T, my firmware is 07.50
But I have a  few question
1.
39#infiniivisionLauncher.exe --perf -l All
Why the licenses with the  *   displayed.  How to eliminate this.
2.
39#infiniivisionLauncher.exe --perf -l DIS
The following dialog box appears each time when power on,How to eliminate this.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: msuthar on April 18, 2022, 01:22:09 pm
* means no expiration . you can see in the Utility>Service>Licensing>My Support Subscriptions   menu
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: SpacedCowboy on April 18, 2022, 07:58:17 pm
Does anyone have a key to what these 'enablements' are, or can point me to a post where they're laid out ? Interested to know if the eye-diagram functionality is one of the -l xxxx options :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on April 18, 2022, 08:01:34 pm
Does anyone have a key to what these 'enablements' are, or can point me to a post where they're laid out ? Interested to know if the eye-diagram functionality is one of the -l xxxx options :)

Unless you have a DSOX6000  eye-diagram functionality is  not..

edit:clarification
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on April 18, 2022, 08:14:52 pm
Does anyone have a key to what these 'enablements' are, or can point me to a post where they're laid out ?

Here (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3823583/#msg3823583).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: SpacedCowboy on April 18, 2022, 10:06:27 pm
Looks like I'd need the 6000, so I guess ... not happening :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: maomi84 on April 19, 2022, 02:41:31 am
THANKS!
My Support Subscriptions   menu shows this ,what does the N/A mean.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on April 23, 2022, 03:22:41 pm
https://dictionary.cambridge.org/dictionary/english/n-a
not applicable
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on May 03, 2022, 05:23:46 pm
SpacedCowboy

I bit late to the party here but check out the new 3000G data sheet, page 24.  The G can measure X and Y jitter distribution and also does a variety of measurements on it.  Also has bin width and other controls and can show S.D. of the jitter.

"Real" jitter analysis needs proper clock recovery but (I suspect) you're on your own as far as setting up triggers, record length, etc. so that you are analyzing NN clocks out from the trigger point.  I believe the 6000 has a means of deriving a "recovered clock" for its jitter analysis in software.

Actually, the 3000T and 4000A do some of this but it's internal and intended for USB analysis and reporting.


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: SpacedCowboy on May 03, 2022, 06:14:34 pm
SpacedCowboy

I bit late to the party here but check out the new 3000G data sheet, page 24.  The G can measure X and Y jitter distribution and also does a variety of measurements on it.  Also has bin width and other controls and can show S.D. of the jitter.

"Real" jitter analysis needs proper clock recovery but (I suspect) you're on your own as far as setting up triggers, record length, etc. so that you are analyzing NN clocks out from the trigger point.  I believe the 6000 has a means of deriving a "recovered clock" for its jitter analysis in software.

Actually, the 3000T and 4000A do some of this but it's internal and intended for USB analysis and reporting.

Thanks, I appreciate the thought :)

In fact, I ordered the MSO-8000 from Saelig (with their 6% discount) last week instead. Saelig were expecting it in today and just charged my card this morning, so I guess it's on it's way towards me now - probably another few days till it gets here since I'm on the West coast.

The '8000' I'd looked at the price of (and dismissed as too expensive) was in fact my mistake - whatever I typed in must have been wrong, because the prices I was looking at were in the $25k+ range. There's not a lot of price difference between the Rigol MSO8k and the Siglent 6000A at that level, but Rigol have far cheaper add-on options. Since I'm stretching my budget already (my current scope is a DS1102D :)) that's reasonably important. In any event, this will be quite the upgrade!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on May 03, 2022, 06:54:41 pm
Nice looking, capable rig.

I've hated the Rigol UI on their low end scopes.  This front panel looks a bit more like an Agilent/Keysight configuration.  I'm invested in Tek/Keysight probes, etc. and the USA, otherwise I'd consider them in the future.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on May 20, 2022, 08:07:24 pm
Coyote is 4000. InfiniiVision is common sw for 2k, 3k, 4k.

Code: [Select]
economy         DSOX2000A
performance     DSOX3000A
coyote          DSOX4000A
wolfhound       DSOX6000A
monarch         DSOX3000T
marsupial       DSOX1000A

And what are those missing?

Edit: added the new info.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on May 20, 2022, 10:09:12 pm
Coyote is 4000. InfiniiVision is common sw for 2k, 3k, 4k.

Code: [Select]
economy         DSOX2000A
performance     DSOX3000A
coyote          DSOX4000
wolfhound
monarch
marsupial       DSOX1000G (?)

And what are those missing?

3000T and 6000 ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on May 20, 2022, 10:29:22 pm
wolfhound 6000A
monarch   3000T
marsupial  1000A
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tautech on May 20, 2022, 10:38:48 pm
wolfhound 6000A
:-//
https://int.siglent.com/products-overview/sds6000a/
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on May 20, 2022, 10:49:17 pm
wolfhound 6000A
6000A is KeySight infiniivision 6000X
Not Siglent 6000A
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: LaurentR on June 21, 2022, 12:20:44 am
I am not normally clumsy, but I tried to hack my 3104T (with the old bundle) from 7.50 official to PhillyFlyers' hacked 7.50 and while the update seems to have happened fine, I see no difference, in particular:
* No .lnk file (tried a bunch of different ones) has changed the options. I also tried no .lnk file. This is using PhillyFlyers' latest instructions to keep the .lnk file on the USB drive (in post 3033).
* I can telnet to the scope after boot, but the infiniivision/skywalker1977 password doesn't seem to work.

I have read a lot of the thread including several recent successes with 7.50, so I am confused about what I could have missed. For people who have successfully updated to 7.50, do the standard telnet user/password work?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pepperoni7 on June 21, 2022, 04:13:33 pm
I think there is no standard PW anymore. You have to generate a PW that matches the S/N... but anyways... Telnet is no longer required since PhillyFlyer invented his new method.
What is your .lnk File (show an example)?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: LaurentR on June 21, 2022, 11:09:17 pm
I think there is no standard PW anymore. You have to generate a PW that matches the S/N... but anyways... Telnet is no longer required since PhillyFlyer invented his new method.
What is your .lnk File (show an example)?

Thanks!

I know I tried at least these and saw no difference (less or more options enabled):
39#infiniivisionLauncher.exe --perf -l All
39#infiniivisionLauncher.exe --perf -l DIS
62#infiniivisionLauncher.exe --perf -l all -l SCPIPS -l D3000USBB

For the password, I saw the mention of new firmware requiring a per-SN password, but then this (somewhat recent) post seemed to claim that hacked firmware could still use the standard password:

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/2920/ (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/2920/)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pepperoni7 on June 22, 2022, 04:55:40 am
Try this
98#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l WAVEGEN -l D3000BDLB -l SCPIPS -l SECA
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on June 22, 2022, 05:40:35 am
Be sure that your .lnk file is named properly and that you haven't ended up with .lnk.lnk thanks to windows.  It should be in your usb root folder.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: LaurentR on June 22, 2022, 07:11:39 am
Try this
98#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l WAVEGEN -l D3000BDLB -l SCPIPS -l SECA

Awesome, it worked! Thanks a lot. Hopefully, that's useful to others. I can finally decode USB (the main feature missing in the older BDLA I got).

Note that I investigated on the password side and it still doesn't work BUT...
I used the Pastebin code: http://pastebin.com/2NJjMTxQ (http://pastebin.com/2NJjMTxQ) mentioned earlier here: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/1328/ (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/1328/)
And it worked! Just have to run Python2 (not 3) and use the resulting password as is (not concatenated with skywalker1977).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Venturi962 on June 23, 2022, 01:15:26 am
Has anyone tried the PhillyFlyers' hacked firmware on a 4000X scope?

Yes - works fine.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on June 23, 2022, 06:20:12 am
Has anyone tried the PhillyFlyers' hacked firmware on a 4000X scope?

Yes - works fine.
Thanks for the feedback
Do you have a correct text line for the .lnk File?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jay_Diddy_B on June 23, 2022, 12:49:53 pm
Hi,

A big thank you to PhillyFlyers for the hacked firmware!!

Link:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3926996/#msg3926996 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3926996/#msg3926996)

I just installed on a DSOX-3034A which had 2.35 FW

I had to change the extension from .ksx to .cab because my FW was older than 2.41. This is following the guidance on the Keysight website.

I used:
Code: [Select]
50#infiniivisionLauncher.exe -l all -l BW50 -l SCPIPS
as my infiniivision.lnk file

Regards,
Jay_Diddy_B
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: switchabl on June 23, 2022, 02:06:46 pm
I also want to thank everyone for all the great information in this thread. I got my hands on a non-booting DSOX2012A recently and was able to fix it easily over the serial console.

I mostly followed https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181, (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181,) but I put this in the infiniivision.lnk
Code: [Select]
44#\usb\infiniiVision\infiniiVisionLauncher.exeinstead of
Code: [Select]
48#\Secure\infiniiVision\infiniivisionLauncher.exe
From what I gather, this is the correct way, because it actually launches the app from USB. This should increase the chance of booting successfully even if the boot image does not match the installed version. Or at least it worked fine for me with 2.35. I am not sure which version the scope had before, but clearly an older one because it updated the keypad firmware on boot.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Venturi962 on June 24, 2022, 01:23:03 pm
Has anyone tried the PhillyFlyers' hacked firmware on a 4000X scope?

Yes - works fine.
Thanks for the feedback
Do you have a correct text line for the .lnk File?

You can use this (doesn't include bandwidth upgrades):

81#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l D4000BDLA -l WAVEGEN
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on June 26, 2022, 11:50:10 am
I tested the patched FW 2.65 on a 2000X
It worked perfectly with this .INK file content:

128#infiniivisionLauncher.exe -l MSO -l COMP -l AUTO -l EMBD -l WAVEGEN -l MASK -l MEMUP -l SGM -l BW20 -l EDK -l DVM -l RML -l PLUS


A big Thanks to PhillyFlyers

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on July 02, 2022, 10:43:34 am
Does anyone know, if the Bandwidth of a 200 MHz 4000X scope can be upgraded trough software?
If so, what is the code for the .INK file?

Thanks
For 200Mhz 4000A scopes,you can not upgrade bandwidth with options.
You must modify the hardware.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on July 16, 2022, 07:55:29 pm
Has anyone tried getting into UBOOT on their 3kT, 4k, or 6k series scopes recently, and had success?
(I can still get into mine, but it's a 3024A)

Some here have been have no success trying to break into UBOOT with DSOX6000x and 3000T, just curious if anyone else has experienced this? 
(I don't know if there were any changes made to uboot over the last few years... )
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Phoenix6478 on July 28, 2022, 04:29:19 pm
Hi Everyone

Thank you for this great thread and the efforts put into the modified firmware!

I will soon get an Agilent MSO-X 3014A and I would like to enable all options. I read a lot on this thread already and I think i know how to do it, but i would be thankful if you could check my approach again.

1.) Download the modified Firmware for the 3000A from this Post and put it on the root of the USB flash drive: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3926996/#msg3926996 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3926996/#msg3926996)

2.) Create the "infiniivision.lnk" file on the root directory of the USB drive with the following contents:
Code: [Select]
50#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS
3.) Run the firmware update in the scope settings

I know that I can only upgrade my 100Mhz scope to 200Mhz because thats the maximum that the frontend can do without hardware modifications.

One more thing, should I upgrade to the lastest Keysight Firmware before the hack, or should I leave the older Firmware on it? I read that I would have to change the ending of the Firmware file from .ksx to .cab if the current version is older than 2.41?

Thank you for your help!

Best
Phoenix
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Roland_W on July 29, 2022, 10:44:25 am
Hi Everyone,

I unfortunately brick by scope by change the patch to the used the proper software :
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3926996/#msg3926996 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3926996/#msg3926996)

I do not double check that I have wrong path to the file .....

255#\usb\infiniiVision\infiniivisionLauncher.exe  -l all -l BW20 -l SCPIPS

instead of proper one 0#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS

Could anyone have a proper software on it pendrive, that I can run the original software ones again, and update the file to proper one.

PS: I do not have a ethernet connection to the scope, That the USB method show me that is the proper way to unbrick it.

Regards
Roland

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: switchabl on July 29, 2022, 11:51:57 am
It is not possible to boot from USB any more on any recent firmware version, so you really need an ethernet interface. There are a number of designs around that you can use to make a cheap one yourself (maybe somebody here has some PCBs left over). You should be able to connect using telnet (port 23) and remove/replace the broken .lnk file.

instead of proper one 0#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS

This is also wrong, it should be 50#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS. The number at the start is the number of characters following (and not including) the #.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jay_Diddy_B on July 29, 2022, 04:06:52 pm
Hi,

I recently shared the KiCAD files for the Ethernet Interface, DSOXLAN, in this thread:

https://www.eevblog.com/forum/projects/diy-dsoxlan-interface-for-keysight-oscilloscopes/ (https://www.eevblog.com/forum/projects/diy-dsoxlan-interface-for-keysight-oscilloscopes/)

The file DSOXLAN.zip contains the gerber files ready to be sent.

You can order the PCB from the usual places.

There are more details in the thread.

Good luck,

Jay_Diddy_B

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on July 29, 2022, 06:06:27 pm
Is there a guide for receovring from NAND corruption (3000A) through LAN connection?
I did this once through UART and YMODEM using the excellent guide by titiris (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181)) but I now have a home made LAN board and a new 3024A with NAND corruption. I would like to try it with the LAN method which must be a lot faster than YMODEM

If someone can point me to a guide/post it's highly appreciated. I am confused as to whether I need to telnet or I need to have a tftp server? what files do I need to transfer to the scope? 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Roland_W on July 29, 2022, 07:20:44 pm
Thanks guys for the fast support.

I think about to add some file nawigator from Windows CE, and rename it, to run it from the USB driver. Perhaps could solve issue. I going to order the Ethernet board.

Thanks
Roland
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: switchabl on July 29, 2022, 08:45:54 pm
I think about to add some file nawigator from Windows CE, and rename it, to run it from the USB driver. Perhaps could solve issue.

You don't need a file navigator. When you connect with telnet, you should have a normal Windows command prompt (with "cd", "dir", "copy", "ren", "del" commands and so on). If you are not comfortable with that, I think you could probably just enter "infiniivisionLauncher.exe" to start the oscilloscope app and re-do the firmware upgrade procedure with the correct .lnk file. But I have not tried.

Is there a guide for receovring from NAND corruption (3000A) through LAN connection?

I have also used the YMODEM method myself (didn't have the LAN board yet) but I found this post: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/125/ (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/125/)

Almost everything else should be the same as the titiris guide. You prepare the same files, connect using the serial console (not telnet). Just instead of "loady", you put nk.nb0 in the root of your TFTP server and use "set serverip" and "dhcp" to load it into RAM.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on July 30, 2022, 01:33:44 pm
so the "only" use of the LAN card is to load the nk.nb0 through TFTP?

The infiniivision setup on the USB drive and the rest of the process is the same?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on July 30, 2022, 01:48:49 pm
so the "only" use of the LAN card is to load the nk.nb0 through TFTP?

The infiniivision setup on the USB drive and the rest of the process is the same?
Yes.
You just upload nk.nb0 to RAM through TFTP.And then,use USB drive boot infiniivision app.
And it is faster than upload nk.nb0 to RAM by YMODEM.
After all,the data rate of ethernet is more than serial port.
And you also can upload nk.nb0 to RAM through NFS.
(http://[attachimg=2])
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on August 03, 2022, 03:22:38 am
Firmware version 7.55 is out.  Supports some new diff probes, Bug fixes to retain labels in setup recall, phase measurement error, changes in measured values for certain probes when measurement is stopped and increased size of CAN symbolic files.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on August 03, 2022, 03:25:55 am
so the "only" use of the LAN card is to load the nk.nb0 through TFTP?

The infiniivision setup on the USB drive and the rest of the process is the same?
Yes.
You just upload nk.nb0 to RAM through TFTP.And then,use USB drive boot infiniivision app.
And it is faster than upload nk.nb0 to RAM by YMODEM.
After all,the data rate of ethernet is more than serial port.
And you also can upload nk.nb0 to RAM through NFS.
(http:// (Attachment Link) )

this was much easier than using YMODEM  :-+ :-+ :) :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PhillyFlyers on August 06, 2022, 06:44:27 pm
Hi All,


I just wanted to chime in here, and let everyone know I've removed all of my patched FWs....

....it was fun to prove out we could do it, but prob. not something I should continue doing forever.... not a good position to put myself in....





Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pepperoni7 on August 07, 2022, 11:17:19 am
Hi PhillyFlyers,

oh that is bad news. I always was looking forward for your patches evertime a new FW was out there.
But for sure I absolutely can understand you!

Also, it has come to my attention that a member on here sells 'services' for hacking scopes, etc... I'm not sure if it's with my patched FWs or not, but either way, that's not cool.. I have zero interest in contributing anything to that nonsense...
FullACK

Quote
...but I really dont think it's a good idea for me to keep doing this.... I really doubt keysight is happy with these easy-to-do patched FWs that anyone can do...
Well, I'm not sure if Keysight really depends on some hobbyist like us. Most of us probably buy second-hand Keysight gear because the "optimized" FW exists. Otherwise there might be more Rigol, Siglent or what else enthusiasts. And I also think only very few would really buy the optionpacks for thousands of dollars! And I don't think that many companies will use hacked FW (maybe a few?!). They have to rely on their equipment, they need service, support and calibration and cannot/will not risk to void all that. Therefore I cannot see any monetary loss for Keysight.

But on the other hand they gain a lot of prestige and reputation in the measurement and test gear community, if we -the users- are satisfied with the product.
So the next time your company is willing to spend their budget on new test equipment, probably it will be spent on Keysight gear, because you are used to it, you like it, you want it...  :D

And I'm also quite sure that Daniel Bogdanoff is smiling while reading this... because he knows it's true  ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Roland_W on August 08, 2022, 08:14:45 am
Hi All,

Thanks for support myself, and give me the right answer.
I unbrick scope using the RS232 interface.

1. I plug the RS232 interface as describe in Post 123 :
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895)

Connect to the computer with PuTTy @115200,8,N,1, but I recommend to download TeraTerm for later use of YMODEM.

I press and hold SpaceBar before run the scope :

The terminal show that :

U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 256 MiB

Debug serial initialized ........OK
RTC: 2022-8-8   9:50:27.66 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Oct 29 2015 01:39:04
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008



P500 Boot Loader Configuration :

Mac address .......... (00:30:D3:29:8D:E3)
Ip address ........... (192.168.1.199)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0400000)
        2 (0xd4400000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images



I chose the 2 as load image 2, on a scope screen I found a note not proper image, please connect the keyboard, mouse, and put the USB pendrive to the scope with firmware.

Boot error [attach=1]

I connect the USB mouse, and keyboard to the back USB, and the USB pendrive to the front, and follow the instruction.

After that my scope will work proper now.

Terminal :

U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 256 MiB

Debug serial initialized ........OK
RTC: 2022-8-8   10:0:24.78 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Oct 29 2015 01:39:04
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008



P500 Boot Loader Configuration :

Mac address .......... (00:30:D3:29:8D:E3)
Ip address ........... (192.168.1.199)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0400000)
        2 (0xd4400000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>System ready!
Preparing for download...
RTC: 2022-8-8   10:0:35.8 UTC
 Loading image 2 from memory at 0xD4400000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXXOOOOOOOOXOXXOOOOOOOOXOOXOXOOOOXXXOOOOOOOOOXOOOXOOXXOXXXOOXOXXXXOXXXXXXOOOXXXOOOOOXOXXOXOOOXXXOOOXXOXOOOXOOXOOXXOOXOOOOXOXOOOOOXOOOXOOOXOXOXXXXXXXXXOOOOXOOXOOXOOOOXOOOOXXOOOOXOOOXOOOOOXOOXXOOOOOOOOOXOX
OOOXOOOOOOXOXOOOXOOOXOOXOXXXOXOOOXOXXXXOXOXOOXXXOXOOOXXXXOOOXOOOXOXOXOOOOXOOOXXXOXOOOXXOOOOOXOOOXOOOOXOXOOOXOOXOOXXXXXXXXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x107008C, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
  • : Address=0x80361000  Length=0x107008C  Name="" Target=RAM

 Loading image 2 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2022-8-8   10:0:37.28 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Mar 26 2015)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
++SER_Init: context Drivers\Active\12
SER_Init, dwIndex:2
SER2 got sysintr:0x00000016
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:29:8D:E3
Phy found addr 31 (ticks=2964)
WaitForLink Start (ticks=2966)
No Link (ticks=3968)
<--EDeviceInitialize

GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Time for NANDFLASH to load: 0 ms.
Time for SNANDFLASH to load: 0 ms.
Time for USB Hard Disk Drive to load: 0 ms.

*** BEGIN **** ExtractFileFromCabFile : INSTALL.XML
*** END **** ExtractFileFromCabFile : INSTALL.XML : 4365 ms

*** BEGIN **** ExtractFileFromCabFile : INSTALL.XML
*** END **** ExtractFileFromCabFile : INSTALL.XML : 2235 ms

*** BEGIN **** ExtractFileFromCabFile : INSTALL.XML
*** END **** ExtractFileFromCabFile : INSTALL.XML : 2235 ms
*** BEGIN **** ExtractFileFromCabFile : updateSplashImage.wvga.bin
*** END **** ExtractFileFromCabFile : updateSplashImage.wvga.bin : 20802 ms
*** BEGIN **** ExtractFileFromCabFile : auxInstallStep.exe
*** END **** ExtractFileFromCabFile : auxInstallStep.exe : 44 ms
*** BEGIN **** ProcessRecipeStep : \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\auxInstallStep.exe -v -s
=== Aux Step: -v -s ===
Skipped.
Deleting existing symbols.tte.old file.
Successfully moved symbols.tte.
*** END **** ProcessRecipeStep : \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\auxInstallStep.exe -v -s : 50 ms
*** BEGIN **** ExtractFileFromCabFile : fpga3000T.bin
*** END **** ExtractFileFromCabFile : fpga3000T.bin : 274 ms
*** BEGIN **** ProcessRecipeStep : \windows\loadP500Flash -u fpga --target monarch \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\fpga3000T.bin
*** END **** ProcessRecipeStep : \windows\loadP500Flash -u fpga --target monarch \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\fpga3000T.bin : 889 ms
*** BEGIN **** ExtractFileFromCabFile : updateBootLoaders2.exe
*** END **** ExtractFileFromCabFile : updateBootLoaders2.exe : 20695 ms
*** BEGIN **** ExtractFileFromCabFile : pboot_rel.bin
*** END **** ExtractFileFromCabFile : pboot_rel.bin : 17887 ms
*** BEGIN **** ProcessRecipeStep : \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\updatebootloaders2.exe
*** END **** ProcessRecipeStep : \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\updatebootloaders2.exe : 346 ms
*** BEGIN **** ExtractFileFromCabFile : nk.bin.comp
*** END **** ExtractFileFromCabFile : nk.bin.comp : 19745 ms
*** BEGIN **** ProcessRecipeStep : \windows\loadP500Flash -u ceImage1 \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\nk.bin.comp
*** END **** ProcessRecipeStep : \windows\loadP500Flash -u ceImage1 \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\nk.bin.comp : 24981 ms
*** BEGIN **** ExtractFileFromCabFile : recover.nk.bin.comp
*** END **** ExtractFileFromCabFile : recover.nk.bin.comp : 21188 ms
*** BEGIN **** ProcessRecipeStep : \windows\loadP500Flash -u ceImage2 \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\recover.nk.bin.comp
FWUpdate: image 3 value not defined
*** END **** ProcessRecipeStep : \windows\loadP500Flash -u ceImage2 \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\recover.nk.bin.comp : 14748 ms
*** BEGIN **** ExtractFileFromCabFile : infiniivisionSetup.cab
*** END **** ExtractFileFromCabFile : infiniivisionSetup.cab : 2685 ms
*** BEGIN **** ProcessRecipeStep : \windows\wceldcmd.exe /delete 0 \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\infiniivisionSetup.cab
*** END **** ProcessRecipeStep : \windows\wceldcmd.exe /delete 0 \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\infiniivisionSetup.cab : 8388 ms
*** BEGIN **** ExtractFileFromCabFile : splashImage.wvga.png
*** END **** ExtractFileFromCabFile : splashImage.wvga.png : 20766 ms
*** BEGIN **** ProcessRecipeStep : \windows\compileImageForSplashScreen.exe \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\splashImage.wvga.png \Secure\InfiniiVision\splashImage.bin
*** END **** ProcessRecipeStep : \windows\compileImageForSplashScreen.exe \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\splashImage.wvga.png \Secure\InfiniiVision\splashImage.bin : 3117 ms
*** BEGIN **** ProcessRecipeStep : \windows\cmd.exe /c ren \Secure\Startup\infiniivision.lnk infiniivision.lnk.original
*** END **** ProcessRecipeStep : \windows\cmd.exe /c ren \Secure\Startup\infiniivision.lnk infiniivision.lnk.original : 592 ms
*** BEGIN **** ProcessRecipeStep : \windows\cmd.exe /c copy \usb\infiniivision.lnk \Secure\Startup\infiniivision.lnk
*** END **** ProcessRecipeStep : \windows\cmd.exe /c copy \usb\infiniivision.lnk \Secure\Startup\infiniivision.lnk : 601 ms
*** BEGIN **** ProcessRecipeStep : \windows\rebootInfiniivision.exe


U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 256 MiB


It look like we do not have possibility to enter to the U-Boot command anymore.

Regards
Roland
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Phoenix6478 on August 08, 2022, 04:47:54 pm
Thank you for the modified firmware PhillyFlyers  :-+

I succesfully unlocked all the options and the 200Mhz BW on my Agilent MSO-X 3014A. Here are the contents of the .lnk file that i used:
Code: [Select]
59#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS -l CABLE
Best
Phoenix
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jodorowsky on August 13, 2022, 08:59:11 pm
Hello everyone.

I have been trying to read this whole subject, but damn, it's very hard to follow.

I have been recently given a DSO-X 2004A running version 02.65.2021030741 and I'm looking for a way tro unlock some or all the different capabilities of my oscilloscope, but I don't really kow where to start.

Is it even possible given the latest firmware update?

Sorry for going the lazy way, but being a non-native english speaker and seeing 140 pages of techspeak is a bit overwhelming for me.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: J-R on September 19, 2022, 02:02:13 am
Yes, I think some posts have been removed, probably to keep Keysight happy.

The information is generally still around if you dig for it, although I couldn't find any active links for the patched downloads.  Do you already have the patched firmware file?

The latest firmware available for download from Keysight appears to be this: "2000XSeries.02.65.20210307001.ksx"

So I'm not sure what it means that you have "0741" at the end of your firmware version rather than "07001".

Do you have the LAN hardware installed?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jodorowsky on September 19, 2022, 06:05:16 am
Firstly, thanks for taking the time to answer.

Now, no, I do not have the download for any patched version.

I went through most of the topic, and only found dead links or edited posts.

Concerning the version, no idea. If it goes wrong, could it brick my oscilloscope?

Lastly, I do not have the LAN interface.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: J-R on September 20, 2022, 06:56:33 am
For sure there is a very good chance of having a non-functioning scope, but having the LAN option can help you from what I've read.  You can telnet in and fix the .lnk file.  Plan B could be to use the serial header on the PCB.

I think the chance of a true "bricking" is pretty low, but non-zero.

The golden age of this hack is probably gone, since the links are dead and the "hacker" has been driven underground, so to speak.

But if you find someone in this thread that has successfully flashed the patched firmware, you could try messaging them for the patched file and .lnk file.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jodorowsky on September 20, 2022, 07:32:10 am
All right then, I’ll start digging.

Thank you for the guidance, J-R
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: J-R on October 08, 2022, 01:57:55 am
Was talking to a buddy the other day and he sniped something on ebay recently and had no issues with this patch.   Also, the "0741" showing for the firmware version appears to be normal, for both unpatched and patched.

Most of the unlocked features are somewhat niche, but the MSO and wavegen were welcomed additions.  There are budget MSO cables available on ebay for about $50.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dhl on October 19, 2022, 10:15:05 pm
Ok,

Here are the latest patched firmwares, for the 1000X, 2000X, 3000A, 3000T, 4000X......



These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things


*** Note:  ***

I have made these installs even EASIER, after the upgrade completes the install process will also make a backup of the oem lnk file that it installs during the upgrade, and then attempt to copy 'infiniivision.lnk' from the same USB stick you are doing the upgrade with...

so in otherwords, have your 'infiniivision.lnk' file READY, and on the root of your USB drive along with the patched firmware upgrade!
(this replaces having to telnet into your scope after the upgrade and having to put the .lnk file back on)

The install script at the end does these two actions:

copy \Secure\Startup\infiniivision.lnk infiniivision.lnk.original  (backs up oem file being replaced)
copy \usb\infiniivision.lnk \Secure\Startup\infiniivision.lnk     (copies .lnk file from your USB to the startup folder)

So have these TWO files on your USB:

1) infiniivision.lnk
2) upgrade_file.ksx




*** NOTE:  FOR THE 1000X....  ************************************
      This is 'BUD's' patched firmware!!  All credit goes to him and the 1000x hacking folks!  there is NO .LNK file required for this patch, just install the FW!  I repeat, there is NO .lnk file required for the
      1000x hacking

DSOX 1000X Series:  FW:  01.20.2019061038_patched  https://mega.nz/file/nrpW3T4Z#gLnn__QchpYL5FuQXLawyso2_ReaXgn-jF4MzcRZSAA
md5: <8D128F5691BCB7D178CFB8E48F3784B9>

*************************************************************

DSOX 2000X Series:  FW:  02.65.20210307001_patched  https://mega.nz/file/mzgGjBpC#yLNWn8cGjJlsLeH_fVZ3tYyPZILYJ3EtGK8F84oEFw8
md5: <AF47DDB93F9CC88911ADC65F4E55F97D>

DSOX 3000A Series:  FW:  02.65.20210307001_patched  https://mega.nz/file/j3hEzbCa#4sYGoVawZt62XnoC3ZZvUAEyf575Q6o_-iYIr-whH4w
md5: <B5EBDEEA00BCBF4DCE77D173F212B8F6>

DSOX 3000T Series:  FW:  7.40.2021031200_patched  https://mega.nz/file/rz5UXbrL#FXRPSRjLlFN16amBWt_Si74-nS8OjW5xWZPLqmBeynU
md5: <C1AA8839085890FC058D27C501AF4F08>

DSOX 4000X Series:  FW:  7.40.2021031202_patched  https://mega.nz/file/nrxwAb6R#gNp4CCdwl_oyhAzxuJSI9OopUPjbmnu7fn8E8ejeGDg
md5: <7C30FD851FB6A4B461130D61FE9C0E0C>

Please let me know if there are any issues with any of these!

Hi your firmware download link is not available any more, could you update a new link?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dhl on October 19, 2022, 10:38:41 pm
Does anyone have the DSOX 2000X Series patched Firmware? I saw some posts but the link is not available. Please help, thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dhl on October 19, 2022, 10:49:31 pm
I tested the patched FW 2.65 on a 2000X
It worked perfectly with this .INK file content:

128#infiniivisionLauncher.exe -l MSO -l COMP -l AUTO -l EMBD -l WAVEGEN -l MASK -l MEMUP -l SGM -l BW20 -l EDK -l DVM -l RML -l PLUS


A big Thanks to PhillyFlyers

Could you post a new download link for dso 2000 or 3000 series fw2.65? The original link is not available anymore.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: scarysparks on October 23, 2022, 07:56:02 pm
+1 for the patched firmware
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: msuthar on October 24, 2022, 02:17:36 am
found this very long Youtube video on following url.  useful for Corrupted NAND.

https://www.youtube.com/watch?v=eO1Mttm2V9Y (https://www.youtube.com/watch?v=eO1Mttm2V9Y)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: orbital on November 16, 2022, 02:48:27 pm
Please excuse my ignorance, but I have a DSO X 3024A that won't boot (lights turn on REF and MATH without progressing into the OS), and was wondering if i can boot the official firmware off a usb drive with the intention of then reflashing the entire system? The firmware is very likely not updated on the scope from 2017 at the latest, and I'm pretty sure this is NAND corruption.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: switchabl on November 16, 2022, 03:47:32 pm
Yes, that definitely sounds like NAND corruption. I don't think booting directly from USB will work because the boot process likely fails before that. However, there is a good chance that you can fix the problem using the serial console.

For more details, see this guide by titiris: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181)

Some notes:
- The firmware link in the guide is dead, look here instead: https://xdevs.com/doc/HP_Agilent_Keysight/DSOX/ (https://xdevs.com/doc/HP_Agilent_Keysight/DSOX/)
- dosetup.py needs (old) Python 2
- IMHO the content of the infiniivision.lnk should be
Code: [Select]
44#\usb\infiniiVision\infiniiVisionLauncher.exe- You need to use firmware 2.35 (or older) to prepare nk.nb0 and the Secure folder, but you could upgrade directly to 2.65 instead of 2.35 if you want to (rename .ksx to .cab and put it on USB stick).
- After you are done, don't forget to unplug USB stick (turn off first). It still has the startup override on it, so it may prevent booting.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: orbital on November 18, 2022, 03:41:47 pm
Thank you so much, that was tremendously helpful as I was succesfuly able to get into firmware 2.35, from there I immediately tried to write the latest firmware  2.65 after changing the extension to .cab and writing it to the same USB drive. It seemed to write properly as I could see the correct splash screen, however I think I'm caught in a boot loop. I was able to grab the log from teraterm if it's at all useful and have linked a video showing the behaviour, please let me know what you think.

I did use:
Code: [Select]
44#\usb\infiniiVision\infiniiVisionLauncher.exe
https://www.youtube.com/watch?v=YEj5JKevwJQ (https://www.youtube.com/watch?v=YEj5JKevwJQ)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: switchabl on November 18, 2022, 04:08:44 pm
Yes, looks like the NAND is fixed and at least the Windows image is booting cleanly but the oscilloscope application is not running. Just to be sure, did you remove the USB drive? This behaviour looks like the startup override could still be active.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on November 18, 2022, 04:14:43 pm
I'd guess there is an invalid .lnk file sitting in there from a previous hack, or maybe placed there in error during repair.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: orbital on November 18, 2022, 04:24:01 pm
Yes, looks like the NAND is fixed and at least the Windows image is booting cleanly but the oscilloscope application is not running. Just to be sure, did you remove the USB drive? This behaviour looks like the startup override could still be active.
I did put both cab files (2.35 and 2.65) on the same flash drive, and i just tried "48#\Secure\infiniiVision\infiniivisionLauncher.exe", however the 'go' command takes me to the 2.65 spasl screen where with nothing else happening, so I'm not sure what is happening there.

The first time round (as shown in the youtube link + previously attached log) was transfer made, go command executed, then inside oscilloscope OS, called utility to update to 2.65, then the rest is logged as I showed you. I didn't remove the USB stick, should I have? Now I come to think of it, that override with 'true' is still in the stick, let me try removing it.. aaaand it's fixed.

I could kiss you.. (and titiris and all the others who made really helpful documentation). There's no way I could have caught this all myself. Thank you SO much. 

Now to figure out how to retrieve the licence that was purchased years ago for the wave generator. Was it quite easy to hack/unlock this scope ? Edit: wave generator still works. Hooray
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: switchabl on November 18, 2022, 07:23:27 pm
Happy to hear everything worked out!  :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on December 07, 2022, 09:31:54 pm
I'm seeing some noise about the MSOX3000G online (Youtube recommendation, and distributor websites).

ISTBC, but as far as I can tell the main difference between the G and the T is.... drum roll... a dark grey enclosure as opposed to a beige one. Looks like some of the serial triggers/decoders are thrown in as standard, but with a price hike over the T to reflect that.

Is there any functional benefit of this new scope?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2N3055 on December 07, 2022, 10:19:43 pm
I'm seeing some noise about the MSOX3000G online (Youtube recommendation, and distributor websites).

ISTBC, but as far as I can tell the main difference between the G and the T is.... drum roll... a dark grey enclosure as opposed to a beige one. Looks like some of the serial triggers/decoders are thrown in as standard, but with a price hike over the T to reflect that.

Is there any functional benefit of this new scope?

All I could see is that it has some kind of histogram mode.. That is only capability difference...
Rest is only some free options.. Which is nice, but no new capability.
So no need for me to consider upgrade.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on December 08, 2022, 06:32:10 pm
I'm seeing some noise about the MSOX3000G online (Youtube recommendation, and distributor websites).

ISTBC, but as far as I can tell the main difference between the G and the T is.... drum roll... a dark grey enclosure as opposed to a beige one. Looks like some of the serial triggers/decoders are thrown in as standard, but with a price hike over the T to reflect that.

Is there any functional benefit of this new scope?

All I could see is that it has some kind of histogram mode.. That is only capability difference...
Rest is only some free options.. Which is nice, but no new capability.
So no need for me to consider upgrade.

Yes, I noticed that, I wasn't sure if this was part of a more recent firmware upgrade or not on the 3000T.

It's a feature that'd been on the Tek MDO3000 for some time. The MDO3000 has always had more features than the MSOX3000, but the Tek's UI is just so painful! Thus, Keysight Infiniivisions remain my goto scopes and the Teks fill in about 20% of the time when I need a feature lacking on the Keysights like histograms or triple bus decodes for example.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tru3533 on December 10, 2022, 02:32:42 am
Anyone who can help with patched firmware and .lnk file for the 2000X?

I bought an DSOX2002A with corrupted NAND and got it working with titris/switchabl instructions, v2.35 and serial cable
Don't have lan cable yet.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Andrew Seltzman on December 11, 2022, 05:13:20 am
I'm looking for a copy of PhillyFlyers patched 2.65 firmware for the DSOX2004A, if anyone could PM me the link I'd appreciate it :-+

Edit: thanks all, scope upgraded :) Interestingly, I didn't have to update the Infiniivision.lnk file, just loading the patched 2.65 firmware enabled all licenses
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: J-R on December 12, 2022, 03:20:52 am
I couldn't find anyone that had proven you could hack the DSOX3012A from 100MHz to 200MHz, and Keysight specifically doesn't offer that option on the 2 channel version, but I can confirm it does work.  Rise time was measured right at 1.7ns and -3dB was very roughly measured to be approximately 225MHz.  Side note, it was able to count frequencies well past that, for example 800MHz.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Gajets on December 16, 2022, 04:00:59 pm
I'm looking for a copy of PhillyFlyers patched 2.65 firmware for the DSOX2004A, if anyone could PM me the link I'd appreciate it :-+

Edit: thanks all, scope upgraded :) Interestingly, I didn't have to update the Infiniivision.lnk file, just loading the patched 2.65 firmware enabled all licenses

i would also greatly appreciated a Patched  2.65 firmware  for the dsox3024a,  if anyone could PM me the link.

Really, guys I salvaged a dsox3024a a former employer gave me.  and would love to enable all options. I also have a msox2024a that was purchased with all options enabled and i would like the 3024a the same way..
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mc_engineering on December 18, 2022, 05:51:03 pm
Hi, I am also highly interested in the latest patched 2.65 firmware.

My DSO-X2012A is currently running 2.35 directly of an USB-stick. Setup back in 2014

i just recoverd form a shock, after realizing that the usb drive went missing during mooving and the scope wouldn boot without it. fortunatly i was able to find the backup on an old PC and got the scope to boot again.

So if any one still needs 2.35 for some reason, let me know.

By the way, can the newer firmwares use the digital MSO chanals for serial decoding? couldnt finde anything in the changelog about it.
Or is it a license Option? I Got used to that feature on a Tektronix mso.


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: switchabl on December 18, 2022, 07:00:55 pm
By the way, can the newer firmwares use the digital MSO chanals for serial decoding? couldnt finde anything in the changelog about it.
Or is it a license Option? I Got used to that feature on a Tektronix mso.

Sadly, no. In fact, you can't even use serial decode (on the analog inputs) and the digital channels at the same time. This is supposedly a hardware limitation on the 2000 series which had no serial decoding at all when it was first released (unlike the 3000 series).

There are some 3000 series features that you can enable (using the --perf option), like measurement statistics and event search, even though they were never officially available even as a licensed option. But serial decode on digital channels is not one of them.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Feuerbard on December 26, 2022, 10:02:32 pm
Plz anyone send me in PM link for PhillyFlyers patched 2.65 firmware for 3000a series  , I have 3012 with 2.35 firmware
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on December 26, 2022, 11:32:08 pm
Will there be a new scope released? The DSOX2000A series will be 12 years old soon. https://www.keysight.com/us/en/products/oscilloscopes/infiniivision-2-4-channel-digital-oscilloscopes/infiniivision-2000-x-series-oscilloscopes.html (https://www.keysight.com/us/en/products/oscilloscopes/infiniivision-2-4-channel-digital-oscilloscopes/infiniivision-2000-x-series-oscilloscopes.html)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: marektux on January 01, 2023, 01:47:09 pm
Can anyone please share patched firmware for DSOX3000T Series.

If anyone has official firmware for DSOX3000T different than 7.56.20221202 please share it too.

Thank you.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: bermshot on January 07, 2023, 06:52:01 pm
Does anyone have a copy of 3000XSeries.02.12.2012041800.cab?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kada on January 15, 2023, 10:27:04 pm
Does anybody have the patched PhillyFlyers 2.65 firmware for 3000A ? I would appreciate it if anybody can PM it to me. Thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tautech on January 15, 2023, 11:34:21 pm
Does anybody have the patched PhillyFlyers 2.65 firmware for 3000A ? I would appreciate it if anybody can PM it to me. Thanks.
It may have escaped your observations but we can't attach files to PM's......and fair enough too.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mhsprang on January 21, 2023, 01:15:10 pm
Hi All,

My MSO-X 2014A appears to have the NAND flash problem too, but the recovery procedure using U-boot over the serial port doesn't work for me.

The last output of U-boot is:

ProcessStartupFolder: \usb\Startup\
                                   running \usb\Startup\infiniivision.lnk...
Ending ProcessStartupFolder

and then "the line went dead". Complete lockup of the console and the splash screen is visible.

So it looks like my NAND flash is too corrupted to recover.
Unfortunately, Keysight no longer seems to repair this for free. I got a quote for a board replacement for a whopping €3362! When I purchased this 2014 back in 2014(!), it cost me around €2230 new at Farnell. Must be the inflation.

So I think this is a farewell moment to Keysight for me...

Best,
Meindert
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 21, 2023, 05:04:56 pm
Do you still have the flash drive in the machine? It doesn't look like nand corruption but is trying to boot from an external flash which only going to work if you have very specific firmware.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pquadrat on January 21, 2023, 05:19:29 pm
My MSO-X 2014A appears to have the NAND flash problem too, but the recovery procedure using U-boot over the serial port doesn't work for me.
...
Unfortunately, Keysight no longer seems to repair this for free. I got a quote for a board replacement for a whopping €3362! When I purchased this 2014 back in 2014(!), it cost me around €2230 new at Farnell. Must be the inflation.

So I think this is a farewell moment to Keysight for me...
For me, if Keysight does not want to solve this known issue with these scopes any more, I will not hesitate to crack/upgrade/modify these scopes in a more active way, just to bring the balance between customers and manufacturer back.
Seems that they are no longer "innovating the HP way".
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mhsprang on January 22, 2023, 12:39:50 pm
Do you still have the flash drive in the machine? It doesn't look like nand corruption but is trying to boot from an external flash which only going to work if you have very specific firmware.
Ehh... yes. Because it is supposed to boot off the flash drive at that point.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: macevergreen on January 22, 2023, 01:08:30 pm
So sad. It seems I missed the party.  :'(

All this years, I saved so hard some money to finally buy an old Agilent DSOX2002A. And now when I have it, it seems I can no longer get the wonderful FW to do some magic.

Please, anyone able to help me out?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: odisseus on January 22, 2023, 02:58:28 pm
Hello everybody,

I've been using hacked fw on my MSO-X 3022T since about 2 years and have been quite happy with it. Looking at product support page, they have 7.56 as the latest patch release.
Can any of you please PM me and share a recent version of the patched firmware (doesn't have to be latest patch)?

Thank you very much!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: macevergreen on January 22, 2023, 04:17:00 pm
Hi All,

My MSO-X 2014A appears to have the NAND flash problem too, but the recovery procedure using U-boot over the serial port doesn't work for me.

The last output of U-boot is:

ProcessStartupFolder: \usb\Startup\
                                   running \usb\Startup\infiniivision.lnk...
Ending ProcessStartupFolder

and then "the line went dead". Complete lockup of the console and the splash screen is visible.

So it looks like my NAND flash is too corrupted to recover.
Unfortunately, Keysight no longer seems to repair this for free. I got a quote for a board replacement for a whopping €3362! When I purchased this 2014 back in 2014(!), it cost me around €2230 new at Farnell. Must be the inflation.

So I think this is a farewell moment to Keysight for me...

Best,
Meindert

€3362? Isn't that almost as much as for a brand new oscilloscope? If they replace the board, will all licenses be transferred to the new one? Or do you have start buying all the licenses which you had beforehand again?

As far as I understood, the Agilent/Keysight 2000X-series seem to have two big issues. One seem to be the power supply and the other this NAND flash problem. Is that correct? What is the main cause of this NAND flash problem? Too much updating the software? Age? Too long run-time?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on January 22, 2023, 04:49:25 pm
Do you still have the flash drive in the machine? It doesn't look like nand corruption but is trying to boot from an external flash which only going to work if you have very specific firmware.
Ehh... yes. Because it is supposed to boot off the flash drive at that point.
The firmware version you uploaded via Ymodem has to match the version on the scope, or be close to it.
Secondly, if i am not mistaken, ability to boot from USB was removed at some point. I believe this is what TheSteve referred to.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mhsprang on January 22, 2023, 06:16:03 pm
A brand new 2014A without all options is already over €4700 right now at Farnell.

For the price of the board replacement, I can buy a R&S RTB2004 will all options and upgrades (300 MHz BW) and digital probes right now. For €1114 I can buy a Siglent SDS2104X-plus and the SPL2016 logic probe that does all the MSOX2014A with options does.

So I told them that I either expect the 2014 repaired under warranty, as they have done before according to this thread, or I will shop elsewhere.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on January 22, 2023, 06:44:27 pm
Quote
So I told them that I either expect the 2014 repaired under warranty, as they have done before according to this thread, or I will shop elsewhere.

Sadly, that just tells them that whatever they do they won't see any of your money, so why would they pay to fix it?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: switchabl on January 22, 2023, 06:46:16 pm
The firmware version you uploaded via Ymodem has to match the version on the scope, or be close to it.
Secondly, if i am not mistaken, ability to boot from USB was removed at some point. I believe this is what TheSteve referred to.

I know that some people have had to try several (older) versions to find a matching one. I suspect that this was just due to an error in the original guide (wrong .lnk startup file) that meant the application software was loaded from NAND and not USB as intended. But I cannot be sure.

IIRC version 2.35 was indeed the last one that supported running from USB. Later versions will instead halt the boot process and print the IP address (if the network module is connected). But this is baked into the system image, so if you load 2.35 (or older) through YMODEM, it should work not matter what version is installed.

In any case, the log clearly shows that the oscilloscope is in fact trying to load from USB, it just doesn't work for some reason. If you have double-checked that the contents of the startup .lnk file and the Secure folder are correct, trying different versions and maybe a different USB stick might still be worth a try.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on January 22, 2023, 07:35:14 pm
IIRC version 2.35 was indeed the last one that supported running from USB. Later versions will instead halt the boot process and print the IP address (if the network module is connected). But this is baked into the system image, so if you load 2.35 (or older) through YMODEM, it should work not matter what version is installed.

That is the thing that it may not work. While the firmware may be bake into the system, the secret sauce is in the environment variables and user or system settings. There may be some that are version-specific and only work in a particular range of the firmware that was installed before NAND corruption happened.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on January 22, 2023, 08:13:06 pm
There may be some that are version-specific and only work in a particular range of the firmware that was installed before NAND corruption happened.
Indeed, Bud. But with a $3k brick I would try everything...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rolkinas on January 22, 2023, 08:53:29 pm
Just in case:
I have earlier original firmware updates for dsox2000A in my archive:
link: https://files.fm/u/8my7exut5

2.35
2.37
2.39
2.41
2.42
2.43
2.60

and "fixed" ones:

2.43 for 2000X  (through telnet and needs dsox-LAN card)
2.60 for 2000X
1.20 for 1000X
2.60 for 3000X
7.35 for 3000T
7.35 for 4000X
2.65 for 3000X

drop me PM if you need any
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: switchabl on January 22, 2023, 09:21:22 pm
IIRC version 2.35 was indeed the last one that supported running from USB. Later versions will instead halt the boot process and print the IP address (if the network module is connected). But this is baked into the system image, so if you load 2.35 (or older) through YMODEM, it should work not matter what version is installed.

That is the thing that it may not work. While the firmware may be bake into the system, the secret sauce is in the environment variables and user or system settings. There may be some that are version-specific and only work in a particular range of the firmware that was installed before NAND corruption happened.

Yes, that is definitely a possibility. Ideally, we don't want to load anything from NAND at all but I am not sure if the current method achieves that. The system image is uploaded via YMODEM, the application software is running from USB but it is hard to verify that nothing else is loaded. Some environment variables are stored in a separate NOR flash, hopefully they are compatible between firmware versions but of course there is no guarantee.

So some corruption issues may not be fixable (if the "wrong" region is affected) and some versions may still be incompatible.

However I think there was at least one person who managed to recover a 2.65 device (that was bricked in a botched hacking attempt) by loading a 2.35 image through YMODEM and running 2.35 from USB. So this is not impossible per se on later versions.

It might also be possible to re-flash the NAND directly from the bootloader but that would be a high-risk operation and very hard to pull off without a full flash dump from a good unit. So this is really a last resort (if at all).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mhsprang on January 24, 2023, 09:31:17 am
Keysight came back to me. They said the service department is not allowed to confirm service note repairs before the unit has been inspected and confirmed by tech team that it's a service note problem. That is why their standard response is to quote a "core replacement". So we agreed to have the scope picked up so Keysight can asses the problem and decide then if this is going to be a service note repair.

In the mean time I ordered an R&S RTB2004 with full options. Currently on discount at several distributors for around €3000-3300 (RTB2K-COM4).
For that money I get:
I'm sure the MSOX2014 will find a new home if it gets repaired according to service note  :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Gajets on January 25, 2023, 02:38:34 pm
Just in case:
I have earlier original firmware updates for dsox2000 in my archive:
2.35
2.37
2.39
2.41
2.42
2.43
2.60

and "fixed" ones:
2.43
2.60

drop me PM if you need any

it would be nice to get "fixed" 2.65 :)

Any luck getting fixed 2.65? I really want that also.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on January 25, 2023, 04:18:18 pm
Keysight came back to me. They said the service department is not allowed to confirm service note repairs before the unit has been inspected and confirmed by tech team that it's a service note problem. That is why their standard response is to quote a "core replacement". So we agreed to have the scope picked up so Keysight can asses the problem and decide then if this is going to be a service note repair.

In the mean time I ordered an R&S RTB2004 with full options. Currently on discount at several distributors for around €3000-3300 (RTB2K-COM4).
For that money I get:
  • RTB2004 Oscilloscope
  • R&S®RT-ZP03 passive probe per channel, power cord, getting started manual and safety instructions
  • RTB-B243 300 MHz Option
  • RTH-B1 Mixed Signal Option (16 digital channels plus probe)
  • RTB-B6 Arbitrary Function Generator Option
  • RTB-K1 I2C/SPI Serial Trigger and Decode Option
  • RTB-K2 UART/RS-232/RS-422/RS-485 Serial Trigger and Decode Option
  • RTB-K3 CAN/LIN Serial Trigger and Decode Option
  • RTB-K15 History & Segmented Memory Option
  • RTB-K36 Frequency Response Analysis (Bode Plot) Option
I'm sure the MSOX2014 will find a new home if it gets repaired according to service note  :)

The NAND corruption issue was taken care of in 2015, any firmware update since then would have resolved it. The service note for a "no charge" repair expired in 2019.
Hopefully they still take care of it for you.

For everyone else - keep your firmware up to date!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Gajets on January 26, 2023, 06:52:16 pm
Got it , should check my PM haha
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mhsprang on February 02, 2023, 08:44:35 am

The NAND corruption issue was taken care of in 2015, any firmware update since then would have resolved it. The service note for a "no charge" repair expired in 2019.
Hopefully they still take care of it for you.

For everyone else - keep your firmware up to date!
I just got word from Keysight, and I quote: "inform the customer that repair + calibration will be done under Service note – Factory warranty”

Yesss!!!  ;D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on February 02, 2023, 11:28:24 am
Congratulations !

Keysight has always been very generous with the NAND corruption issue.

I just had a broken and out of warranty scope with NAND corruption and it was taken care of perfectly at Keysight Germany.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: macevergreen on February 07, 2023, 07:21:38 pm
I just wanted to take a moment to thank you all for the amazing help with my oscilloscope the past weeks. I learned a lot :) You all are awesome! :clap:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mhsprang on February 13, 2023, 04:53:06 pm
Today I received my MSOX 2014 back from Keysight. They repaired the scope. Well, they basically replaced the entire unit. The only original part is the backside with the serial number sticker, with Agilent molded into the plastic. The entire front is a new Keysight part, including the screen :-) Me happy!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PlainName on February 13, 2023, 05:19:03 pm
I think that's where companies like Keysight score over your average Asian cheapy. Similar experience with a BMW-badged Garmin GPS the other day - got its touchscreen in a mess, chatted to Garmim online and a new replacement was with me two days later, gratis, and express shipping both ways paid. That kind of service is what part of the high up-front cost pays for.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: w1k on February 13, 2023, 07:04:41 pm
i saw you posted here that your nand flash seems to be corrupted to.
No, it doesn't.
I repaired approx 100pcs dsox2000/3000 with the programmer and no one replacement of nand flash was needed
congrats with the free repair covered by service note))
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on February 13, 2023, 10:07:15 pm
i saw you posted here that your nand flash seems to be corrupted to.
No, it doesn't.
I repaired approx 100pcs dsox2000/3000 with the programmer and no one replacement of nand flash was needed
congrats with the free repair covered by service note))
NAND corruption discussed here refers to corruption of data stored in NAND, not physical chip failure. Reprogramming the scope (seems this is exactly what you have done) with later firmware rectifies the problem. No chip replacement is needed.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mhsprang on February 14, 2023, 11:56:56 am
i saw you posted here that your nand flash seems to be corrupted to.
No, it doesn't.
I repaired approx 100pcs dsox2000/3000 with the programmer and no one replacement of nand flash was needed
congrats with the free repair covered by service note))
NAND corruption discussed here refers to corruption of data stored in NAND, not physical chip failure. Reprogramming the scope (seems this is exactly what you have done) with later firmware rectifies the problem. No chip replacement is needed.
I will probably never know what the problem was exactly.

All the symptoms pointed to a NAND flash corruption but I am pretty sure that the firmware was already at 2.65.
I tried all the listed methods in this thread to revive the unit, using V2.35 and V2.65 firmware, to no avail.
I reported this to Keysight, they accepted the unit and offered repair under service note but they did replace the entire front of the unit. So essentially I have a new 2014A. Customer Service Report states:

"Your instrument was repaired by core exchange. Firmware updated and device adjusted and checked". Serial number and rear housing remain unchanged."

Whether the NAND flash was just corrupted or damaged, I don't know. The repair report didn't mention that.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Reprobyte on February 16, 2023, 12:19:52 am
I am happy to say that I now have a DSOX2002A fully kitted out, thanks to everyone here who has contributed over the years, it's been a good read. And thanks very much to the forum user who helped me out getting it sorted and the advice, much appreciation!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grafmar78 on February 21, 2023, 10:23:33 am
Hi, i've some news about unbrick the 4000A series..(maybe someone know that  :-+)
Inside the cab 7.31.2020012900 there is a special bin , named "recover.nk.bin.comp" you can decompress and than convert into  "recover.nb0". With that you can use teraterm and load with YMODEM and command "loady 0x0361000 115200"

Thanks for the hint.
I unbricked a 4024A using the recover.nk.bin.comp from the 4000X.7.56.2022120229.ksx file (renamed to .cab). I used TFTP to upload the file. Now it boots again  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mlloyd1 on February 23, 2023, 03:32:34 am
thanks for sharing!
does anyone know if this approach works for 3000T series models also?

mlloyd1
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on February 23, 2023, 04:02:06 am
The 3000T series .ksx file is packed(or perhaps encrypted) in some manor. I'm not aware of anyone who has successfully unpacked it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: switchabl on February 23, 2023, 10:00:35 am
The 3000T .ksx is still just a renamed CAB archive, expand.exe that comes with Windows seems to handle it just fine. I can see there is a recover.nk.bin.comp, so I guess it might be worth a try.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wp_wp on February 23, 2023, 12:44:53 pm
Hi
I have a DSOX3034A,and I got the following info by serial port:

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-05-07   8:18:27 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37749 Bytes = 36.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
RTC: 2023-2-23   20:36:4.55 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
RTC: 2023-2-23   20:36:4.59 UTC
 Loading image 1 from memory at 0xD0600000
LLD_GetInfo::Device parameter page is not ONFI compatible!

So,what does "Device parameter page is not ONFI compatible!" mean?
How can I solve it?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grizlikoff on March 01, 2023, 11:08:11 am
MSOX-3034A fixed need
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grizlikoff on March 01, 2023, 11:15:20 am
Hi guys! I have MSO-X 3034A ( 4 Chanel , w/o LAN and VGA)
FW 02.50.2019022736
Installed License MSO, SGM, EDK, WAVEGEN, DVM, RML
How to unlock other tools?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grizlikoff on March 03, 2023, 11:22:23 am
Ok. Thx for my freind allredy done. PM if you need some one.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grizlikoff on March 03, 2023, 11:24:25 am
Another question - can any one explain ho to decod SMBUS? i2C - workin but SMBUS not
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: maurit on March 03, 2023, 03:23:51 pm
I have some cards available if you are interested,
I sell, DSOX-Lan card for Agilent Keysight MSOX DSOX 2000 3000 InfiniiVision Series oscilloscope,
 for Debugging and add Options.
This interface is HOMEMADE, new and professionally built on gold plated printed circuit boards and 3D printing plastic frame.

45,00 Euros plus shipping costs.
I ship worldwide from Italy.

Thanks for watching.
maurizio - Italy

Ebay Title: "Agilent Keysight DSOXLAN Card MSOX DSOX 2000 3000 InfiniiVision Oscilloscope"

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Gribo on March 04, 2023, 10:09:50 pm
I'm getting a 'LAN/VGA module concern' on boot up with 2.65. Obviously, Telnet is not working, however standard LXI and web panel do work
Did anyone encounter this issue before?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on March 04, 2023, 10:24:26 pm
I assume you have a fake/clone LAN card?

If so this will always happen if the LAN card enable line is connected on the clone PCB as the scope is trying to load the VGA output FPGA and failing. You can open the LAN card detect lines on your card and the error will go away but you will also lose the network config options in the scope menu, and perhaps some other stuff. It has been well documented in this thread previously. A search would provide full details.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Gribo on March 05, 2023, 12:30:23 am
Ok, so nothing to worry about. Thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Yetisnail on March 08, 2023, 06:34:24 am
Thank you all for your contributions over the years. On the off-chance that somebody might read this, I'd like to ask where I can find or get a patched version of the 2.65 firmware for the 2000x series. All the links I found so far have been taken down. If you know or have something the like I'd very much appreciate a pm or a response. It is maybe a bit blunt to just ask for something, if you are new. But I sadly have nothing to contribute to this amazing thread. Wish ya all a pleasant week.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: nb_haha on March 16, 2023, 08:22:15 am
Hello everyone, can anyone help me connect to the Telnet of DSOX4000A (software version 7.56),
or send me a copy of the newer special firmware,
or help me modify the model number of DSOX4000A,
can send me a private message.
I am willing to exchange a genuine 2000/3000 BDL license.
Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wirelessnet2 on March 16, 2023, 03:43:19 pm
Was there ever a 7.50 FW released for DSOX4000 Series scopes? If anyone has it and would be willing to send it to me, that would be awesome, thanks!

(Also, was there ever a patched FW newer than 7.50 released for 3000T or 4000X scopes?)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Boppeldibop on March 27, 2023, 05:06:52 pm
Can some kind member here maybe help me out with a working link to PhillyFlyers FW: DSOX 3000T Series:  FW:  7.40.2021031200_patched   edit: or newer, I think 7.50 was the last version(?)
Would be very much appreciated  :).


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ArtemSR on March 28, 2023, 12:18:39 pm
Hi friends.! I have DSOX3012t ( 2 Chanel , w/o LAN and VGA)
FW 07.25.2018101442
and
MSOX3024t ( 4 Chanel , w/o LAN and VGA)
FW 07.40.2021031200
Installed License MSO, SGM, EDK, WAVEGEN, DVM, RML
How to unlock other tools?
Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Boppeldibop on March 28, 2023, 04:03:32 pm
Was there ever a 7.50 FW released for DSOX4000 Series scopes? If anyone has it and would be willing to send it to me, that would be awesome, thanks!
Do you mean an official version or a patched one?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on March 31, 2023, 10:12:32 pm
Just upgraded my DSO-X 2002A to a DSO-X 3104, the video has all the necessary info.   :popcorn:


https://www.youtube.com/watch?v=cmAHrhOMPHY (https://www.youtube.com/watch?v=cmAHrhOMPHY)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on April 01, 2023, 12:36:42 am
Just upgraded my DSO-X 2002A to a DSO-X 3104, the video has all the necessary info.   :popcorn:

Not April 1st here yet.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: obsoletepower on April 01, 2023, 04:34:17 am
Would anybody be so kind as to send me a working link to the PhillyFlyers patched FW 2.65 for the 2000-X series scopes? It would be greatly appreciated. Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on April 01, 2023, 08:09:36 am
Just upgraded my DSO-X 2002A to a DSO-X 3104, the video has all the necessary info.   :popcorn:


Finally a video that everyone understands, Thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: girardi on April 04, 2023, 07:46:01 pm
Also need a FW 2.35 for the 2000-X series scopes....
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 77Ribetts on April 24, 2023, 10:11:04 am
Well i would like to say a massive thanks to everyone who filled this thread in particular titiris for his unbricking howto. ive done hardly anything but read this thread for 10 days 8 hrs a day it was mostly giberish to me at first
 All i wanted was a nice  A---B howto i could blindly follow.
 But slowly things began to click the mist began to clear and at last today 
 I UNBRICKED my teabay dsox2002a  :phew: so yeh thanks again to all you gods and demigods of the great repar
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: maxIT on April 26, 2023, 04:48:05 pm
Hi,
I have a DSOX3034A oscilloscope. Has anyone tried to hack?
Thanks in advance
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 77Ribetts on April 29, 2023, 01:25:20 am
Also need a FW 2.35 for the 2000-X series scopes....

Hi what you seek is in the thread somewere
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on May 13, 2023, 01:24:48 pm
New Firmware for the 4000X scopes has been released (maybe for other scopes as well)

Release date: 2023-04-17    
Version: 7.57.20230401


Quote
Bug Fixes
This software revision includes the following Bug fixes:
- Corrected change in measurement value and probe attenuation for auto-attenuation
probes when an acquisition is stopped. Applies to:
o N7026A
o DP0010A, DP0011A, DP0012A, DP0013A
o PP0004A with PP0001A, PP0002A, PP0003A
- For analog channels, a 50Ω impedance setting is no longer persisted when the scope
power is cycled.
- Fixed FFT Analysis power measurements failing to start when installed using SCPI
commands. Applies to:
o :MEASure:FFT:ACPR
o :MEASure:FFT:CPOWer
o :MEASure:FFT:OBW
o :MEASure:FFT:THD

The install went smooth on my 4000X scope.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on May 14, 2023, 12:46:25 am
New Firmware for the 4000X scopes has been released (maybe for other scopes as well)

Release date: 2023-04-17    
Version: 7.57.20230401


Quote
Bug Fixes
This software revision includes the following Bug fixes:
- Corrected change in measurement value and probe attenuation for auto-attenuation
probes when an acquisition is stopped. Applies to:
o N7026A
o DP0010A, DP0011A, DP0012A, DP0013A
o PP0004A with PP0001A, PP0002A, PP0003A
- For analog channels, a 50Ω impedance setting is no longer persisted when the scope
power is cycled.
- Fixed FFT Analysis power measurements failing to start when installed using SCPI
commands. Applies to:
o :MEASure:FFT:ACPR
o :MEASure:FFT:CPOWer
o :MEASure:FFT:OBW
o :MEASure:FFT:THD

The install went smooth on my 4000X scope.

Was all good when I installed it on my 3000t last month.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hexley on May 14, 2023, 12:59:15 am
New Firmware for the 4000X scopes has been released (maybe for other scopes as well)

Release date: 2023-04-17    
Version: 7.57.20230401


Quote
Bug Fixes
This software revision includes the following Bug fixes:
- Corrected change in measurement value and probe attenuation for auto-attenuation
probes when an acquisition is stopped. Applies to:
o N7026A
o DP0010A, DP0011A, DP0012A, DP0013A
o PP0004A with PP0001A, PP0002A, PP0003A
- For analog channels, a 50Ω impedance setting is no longer persisted when the scope
power is cycled.
- Fixed FFT Analysis power measurements failing to start when installed using SCPI
commands. Applies to:
o :MEASure:FFT:ACPR
o :MEASure:FFT:CPOWer
o :MEASure:FFT:OBW
o :MEASure:FFT:THD

The install went smooth on my 4000X scope.

Sending the Bat Signal to @PhillyFlyers...just in case retirement is boring for him.  >:D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: paw944 on May 24, 2023, 08:50:42 am
Hi all! I have this boy: DSO-X 3034T
FW 04.08.2016071801
Installed License MEMUP, SGM, ADVMATH, RML
Can someone explane, how to unlock other tools?
Thx alot!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: offrds2 on June 08, 2023, 06:32:02 pm
Would anybody be so kind as to send me a working link to the PhillyFlyers patched FW 2.65 for the 2000-X series scopes? It would be greatly appreciated. Thanks! Finally got my scope back DSOX3014A it had the dreaded NAND flash corruption. Keysight replaced the core under an extended warranty, what a relief.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Thuyvv on June 09, 2023, 07:55:16 am
Hi Tirris, I can not get nk.bin file as your instructions, I try many methods but not success (the first method: I doubled click mouse to run file bincompress. The second method: I opened CMD and ran MyLocalDisk:\yourfolder>bincompress /d nk.bin.comp nk.bin)
please give me more detail step or give me the final file nk.nb0, many thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: offrds2 on June 09, 2023, 11:07:19 am
Would anybody be so kind as to send me a working link to the PhillyFlyers patched FW 2.65 for the dsox3014A 3000-X series scopes? It would be greatly appreciated. Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grizlikoff on June 10, 2023, 02:52:21 pm
https://disk.yandex.ru/d/7wkTHJFKRjsKuQ
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: offrds2 on June 11, 2023, 11:40:50 pm
I got my scope back from Keysight, had the dreaded NAND corruption. They repaired it under a some extended service warranty. When it came back I saw I still could activate the 30 Trial for all the software. I thought I could try the software some time in the future when I had more time, then it hit me "I have a time machine". I  don't know how or when the scopes time got changed and I should have checked it before I activated the trial but it was set to 6/7/2050. The trials are for 30 days from the date activated so mine expires 7/6/2050 . I am trying out the Serial decode functions now, and in 30 days I will set the time to the correct date . Only time will tell if when I set the clock to the correct date what will happen.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: k176la7 on June 17, 2023, 09:42:24 pm
yes firmware the same. in link working firmware with infinivision.nk 149 bytes long
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mindThomas on June 28, 2023, 08:40:33 am
Today after unpacking my MSO-X 3034A, which has been stored away for a few years due, the scope is not turning on. It gave a little bleep the first time but independent of how many times I turn it on, only the REF and MATH LEDs will come on.
I found this post after searching for help online and have been trying to do some troubleshooting myself including disassembling the unit to check voltages and connect to the debug serial port.

This is the full U-boot log:
Code: [Select]
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2011-08-24  22:35:34 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    36045 Bytes = 35.2 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Aug 24 2011 15:15:48
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOXOXOOOOXXOOOOOOOOOXOOOOXOXXOXOXXOOOXOXXXXXOOXXXOOOOOOXOOXXXOXXOOOXIncorrect Data 3 EccResult: 3f3fc EccError: 3cc303 EccRead: 3f30ff
 EBOOT_ReadFlash failed offset 82fea9
 EBOOT_ReadFlash failed location d0834000
ODeCompressFlash: CeCompressDecode() failed
 CeDecompressFlashBlock failed
****** Data record 38 corrupted, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x13064D4  Name="" Target=RAM
 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1600000

BL_IMAGE_TYPE_UNKNOWN

 Loading image 2 failed, trying next one
 All images failed

Press r to reset

I do not have the DSOXLAN module.
What are my options to recover this scope? And why did it happen in the first place out of nowhere?
I have never updated the scope so I would believe that the scope is on 2.35 or earlier.

Is it possible to recover this scope without the DSOXLAN module?
Or should I send it in for repair at Keysight?

Best regards
Thomas Jespersen
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: analogRF on June 28, 2023, 12:29:00 pm
yes you can recover it via the serial port on the board. explained here
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181
 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181)
and here
https://www.eevblog.com/forum/testgear/agilent-dsox3054a-not-booting-possible-nand-corruption-help!/msg3451418/#msg3451418 (https://www.eevblog.com/forum/testgear/agilent-dsox3054a-not-booting-possible-nand-corruption-help!/msg3451418/#msg3451418)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mindThomas on June 29, 2023, 09:02:18 am
yes you can recover it via the serial port on the board. explained here
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181
 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181)
and here
https://www.eevblog.com/forum/testgear/agilent-dsox3054a-not-booting-possible-nand-corruption-help!/msg3451418/#msg3451418 (https://www.eevblog.com/forum/testgear/agilent-dsox3054a-not-booting-possible-nand-corruption-help!/msg3451418/#msg3451418)

You are completely right. After writing my post I also kept digging through this lengthy topic and I did indeed find @titiris great writeup (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181)
By following his steps I managed to recover the scope to working conditions on V2.35, although I have yet to update it to the patched firmware.

Should I go for 2.60 or 2.65? And now with a working unit, would I need the Serial port or the LAN option to upgrade? Or should I just proceed with the patched update as if it was a regular firmware update?
Is it possible to downgrade the firmware the same way? Have anyone tried this, e.g. going from 2.60 to 2.35?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: arlvaljr on July 06, 2023, 06:59:08 pm
Do you still have a copy of firmware for MSOX 3000T or DSOX 3000T Version 7.56.2022120226?
Would you mind to provide me a copy of this firmware if you still have it?
I keep all firmware revision copies in my computer and I lost this version before the Version 7.57 release was done.
Thanks in advance!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: albertr on July 13, 2023, 10:20:12 pm
New Firmware for the 4000X scopes has been released (maybe for other scopes as well)

Release date: 2023-04-17    
Version: 7.57.20230401


Quote
Bug Fixes
This software revision includes the following Bug fixes:
- Corrected change in measurement value and probe attenuation for auto-attenuation
probes when an acquisition is stopped. Applies to:
o N7026A
o DP0010A, DP0011A, DP0012A, DP0013A
o PP0004A with PP0001A, PP0002A, PP0003A
- For analog channels, a 50Ω impedance setting is no longer persisted when the scope
power is cycled.
- Fixed FFT Analysis power measurements failing to start when installed using SCPI
commands. Applies to:
o :MEASure:FFT:ACPR
o :MEASure:FFT:CPOWer
o :MEASure:FFT:OBW
o :MEASure:FFT:THD

The install went smooth on my 4000X scope.

Sending the Bat Signal to @PhillyFlyers...just in case retirement is boring for him.  >:D

I think someone knowledgable in these firmwares (unfortunately I am not good in it, unless someone can explain it to me) needs to pick up the baton dropped by the fallen camrade @PhillyFlyers and continue the great service to this community.

-albertr
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Boppeldibop on July 16, 2023, 05:24:37 pm
Do you still have a copy of firmware for MSOX 3000T or DSOX 3000T Version 7.56.2022120226?
Would you mind to provide me a copy of this firmware if you still have it?
I keep all firmware revision copies in my computer and I lost this version before the Version 7.57 release was done.
Thanks in advance!
=> PM
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MNSerg on July 28, 2023, 02:57:42 pm
Good day! I wanted to ask if you have a patched firmware of any version for the Keysight 4000X oscilloscope? I've read the whole topic, but the firmware files are no longer available there and I can't find them. I really ask for help. :-// |O
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on July 29, 2023, 04:18:55 pm
I am wondering if Keysight will come up with a new scope when DSOX2000 and DSOX3000 was released back in 2011.
https://www.youtube.com/watch?v=zdbuSZVYewg&ab_channel=EEVblog (https://www.youtube.com/watch?v=zdbuSZVYewg&ab_channel=EEVblog)
24. 2. 2011
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 晓看风云 on August 09, 2023, 05:29:34 pm
Hello, I'm looking for a copy of PhillyFlyers patched 2.65 firmware for the DSOX2002A. Could you please send a copy to my email 328131661@qq.com Or PM. if anyone could PM me the link I'd appreciate it :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on August 13, 2023, 05:18:48 pm
A search turned up nothing on this.

Has anyone determined if the 3000G firmware is that same as the 3000T, albeit for naming?  As anyone imperiled their G yet to try "upgrading"
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: J-R on August 14, 2023, 01:10:47 am
A search turned up nothing on this.

Has anyone determined if the 3000G firmware is that same as the 3000T, albeit for naming?  As anyone imperiled their G yet to try "upgrading"
Well, the official firmware from Keysight has the same version number for both and the files appear identical, so it seems likely.  However, the last liberated 3000T firmware was version 7.40 and the current Keysight release is 7.57, so you might be missing out on some things.  It's also possible they silently blocked the patch in one of the updates.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ktsee on August 17, 2023, 07:14:42 am
can this step do for DSOX2012A too? Or it will need another script?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: andreas_jka on August 23, 2023, 05:50:55 pm
Hi,

I just managed to repair a broken and scraped DSOX 3012A (screen did not work and turned out that the 23VDC was short circuit due to a faulty capacitor). Since the scope is old I searched for FW upgrades and found this amazing thread!

I have now read most parts and are wondering if anyone could provide me with a PhillyFlyers patched FW 2.65 for the 3000-X series scopes? I would be most grateful.

Please send me a PM and I will get back with my email (I enabled the option to send me a email directly when I registered so maybe that will work as well).

The current FW is 2.37 so I hope it will be possible to upgrade completely through USB since the scope does not have any ethernet port.

Thank you in advance!

Andreas
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on August 28, 2023, 07:55:13 am
Hello
6 years of successful working of my MSOX3034T after crash, now few days ago a bad things come.  :palm:
The NAND was corrupted after long non-stop working of scope at hot weather +35 degrees. The command "nand bad" shows 5 bad sectors in NAND.
Now I restored the scope via LAN and serial port. Currently, the software version is 7.30 on scope.
But I see the two main problems.

1: Any update of scope via USB stick with original or patched .KSX firmware is unsuccessful. Every time I see via serial terminal the stuck when unpacking and reading of files by USB stick.
After minute-two of update the scope shows me the warning "Error, file loaded incorrectly". Another usb stick, with that was successful updates in past, does not helps, all was same.
When restoring of scope, was no trys by me to factory erase of NAND because I'm afraid to erase some hidden data like calibration data or serial number stored in NAND.
Maybe anyone have a way of fixing this problem with failed update via usb?

2: When the scope was restored, the message shown always "Instrument is uncalibrated. Please refer to User Cal status for details".
 The window of cal.status shows the "Results: FAILED, cal. date: zeroes, fault: Factory Cal failed" with no comments.
 The User Calibration with 5-ends cable, always stops with fault "Can't calibrate, bla-bla-bla refer to Keysight staff".
 Now all lines of scope inputs on screen are very noised, show about 8mm thickness of noise on screen.
 That means the factory calibration data is lost in my scope, is this possible at all?

In what place/folder the calibration data stored in this MSOX3034T? I think, in another place not same as in DSO3000A or other scopes.
I tried to read via terminal the content of filesystem, the folder /Secure have just 2 folders inside "Infiniivision" and "Startup", nothing else.
In past, I readed via MCU and Segger JTAG the full raw dump of NAND (256MB). Not sure that my reading was fully correct, but in dump I see some adequate data like labels, warnings and other readable data.
Is it possible to program the NAND with this binary raw dump readed by this NAND few years ago? Did someone such flashing successfully or something similar?

I read out the datasheet on this NAND, it have a few OTP pages for store of some static data like Serial Numbers. But can't find the way of dump these pages via terminal or via MCU JTAG. Is it possible to read these OTP pages with some simle ways?

Need your help,
Thanks before for the answers..


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: albertr on August 28, 2023, 02:54:32 pm
I would try to restore the nand dump to a brand new nand chip and then try to replace the old nand chip with a new one on the board.

-albertr
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ElectronMan on August 28, 2023, 04:23:24 pm
Hello
6 years of successful working of my MSOX3034T after crash, now few days ago a bad things come.  :palm:
The NAND was corrupted after long non-stop working of scope at hot weather +35 degrees. The command "nand bad" shows 5 bad sectors in NAND.
Now I restored the scope via LAN and serial port. Currently, the software version is 7.30 on scope.
But I see the two main problems.

1: Any update of scope via USB stick with original or patched .KSX firmware is unsuccessful. Every time I see via serial terminal the stuck when unpacking and reading of files by USB stick.
After minute-two of update the scope shows me the warning "Error, file loaded incorrectly". Another usb stick, with that was successful updates in past, does not helps, all was same.
When restoring of scope, was no trys by me to factory erase of NAND because I'm afraid to erase some hidden data like calibration data or serial number stored in NAND.
Maybe anyone have a way of fixing this problem with failed update via usb?

2: When the scope was restored, the message shown always "Instrument is uncalibrated. Please refer to User Cal status for details".
 The window of cal.status shows the "Results: FAILED, cal. date: zeroes, fault: Factory Cal failed" with no comments.
 The User Calibration with 5-ends cable, always stops with fault "Can't calibrate, bla-bla-bla refer to Keysight staff".
 Now all lines of scope inputs on screen are very noised, show about 8mm thickness of noise on screen.
 That means the factory calibration data is lost in my scope, is this possible at all?

In what place/folder the calibration data stored in this MSOX3034T? I think, in another place not same as in DSO3000A or other scopes.
I tried to read via terminal the content of filesystem, the folder /Secure have just 2 folders inside "Infiniivision" and "Startup", nothing else.
In past, I readed via MCU and Segger JTAG the full raw dump of NAND (256MB). Not sure that my reading was fully correct, but in dump I see some adequate data like labels, warnings and other readable data.
Is it possible to program the NAND with this binary raw dump readed by this NAND few years ago? Did someone such flashing successfully or something similar?

I read out the datasheet on this NAND, it have a few OTP pages for store of some static data like Serial Numbers. But can't find the way of dump these pages via terminal or via MCU JTAG. Is it possible to read these OTP pages with some simle ways?

Need your help,
Thanks before for the answers..

I had to do this recently with my 3034T. I can recover the files from your dump if you would like.

They get stored under \Secure\cal.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ELIK on August 28, 2023, 10:29:33 pm
Yes sorry, the folder "cal" is invisible but present, it have a 4 files. I copied these files to usb flash and observed. they are all empty, looks just as dummy files with mostly zeroes inside.
sernum.dat (length 76 bytes) have no sernum, zeroes inside.
FactoryCal0.dat (708 bytes), have in dump a date "00.00.YYYYMMDDXX" s and filled with "03 00 00 00" repeated words
ServiceCal0.dat (704 bytes), same, have a date "00.00.YYYYMMDDXX" and filled with "03 00 00 00"
UserCal16.dat (27kb) have a date "00.00.YYYYMMDDXX" and filled with some bytes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: xiaofengya8975 on August 30, 2023, 05:26:53 am
Who can provide MSOX 3000T or DSOX 3000T version 7.3 firmware? My DSOX3054T won't start! The links on the forums are all broken. Unable to download
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: msuthar on September 01, 2023, 02:50:00 am
A search turned up nothing on this.

Has anyone determined if the 3000G firmware is that same as the 3000T, albeit for naming?  As anyone imperiled their G yet to try "upgrading"

Yes, it worked on new MSO-X3054G which came with factory installed 7.57 firmware which was downgraded to 7.30 patched.
Looking for patched 7.50 for 3000T firmware can anyone PM please.
73
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Electrojunky on September 08, 2023, 01:29:43 pm
Hello!

Would anyone be so kind as to provide a copy of PhillyFlyers patched FW 2.65 for the 2000-X series scope?

Thank you!!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rev3rse on September 08, 2023, 03:58:56 pm
 Hello everyone,

   Massive thanks  for the work.
 
 Long story short ...

   I've upgraded a DSOX2002A scope a few months back ... and screwed the .lnk files ... attached a ttl serial - I think it started several times. Putty flooded with errors.
   A few months passed - bought a dsoxlan card, attached serial and dsoxlan - used CELoader - managed to start the scope. RE-flashed the firmware.

   I can logon with telnet  - but I DON'T HAVE \Secure folder. Even if I create the folder with mkdir - on next reboot it's gone.
   I always get the error "System concerns detected" - OS versio is not correct.

  I tried everything. Creting the folder. Re-flashing multiple times with original / patched firmware (2.65). Cannot find "Secure folder". In serial teminal I see the message: Creating \Secure\cal" ... but the folder does not exist.
 I tried attrib -H -R -S ... nope ...

   What's the deal ? Why I lost "Secure" folder ? What can I do to "factory reset" the scope.

Apreciated !
Popte.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rdebets on September 08, 2023, 08:59:11 pm
Just in case somebody runs into this problem: my DSOX3034T just lost it's T......the touch screen no longer worked.
I took the unit apart and reseated the 2 touch screen flex cables, reassembled and it works again.


The touchscreen is separate from the display and is a Dawar DW00398D quite solidly built using two glass plates.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rev3rse on September 08, 2023, 10:56:41 pm
 ... I tried a few things in the last few hours.
  Like I mentioned ... I have serial and dsoxlan (clone) card.

 Telneting into the scope works with modified firmware. no \secure folder. But -
   - I have a serial number, (in about) and a valid MAC address.
   - I have NO calibration data. Last calibration date 1970 ...

  I have no options installed. If I kill the app (processmgr kill infiniivisionlauncher.exe) and start it again like this: infiniivisionLauncher.exe -l MSO -l WAVEGEN --perf -l D2000AUTB -l D2000GENB -l D2000BDLB -l BW10 -l BW20 -l SCPIPS -l PLUS -l VID -l CABLE -l ASV
  Options appear in "about" but - I still have the message with System concerns detected" - OS version is not correct.

 I am posting this because I defenitely have another question  -
  about 10 pages back when the last firmware was posted - I notice a difference in MD5 checksums for the file between 3000 and 2000 series. Well I used 3000XSeries.02.65.20210307001_patched.ksx ...  NOT 2000 ... because somewhere back in the thread someone said they are identical. Could that be a problem ?
 
  I tried to reflash the original 2.65 firmware using an usb stick - and I have the same error "System concerns detected" - OS version is not correct. "   - and now I cannot telnet (I know there's a python script to login at the precise right time ... but ... I don't think it's helpful).

  I don't really see any ECC errors in serial console (I might be wrong).

 Can someone point me please to a legit 2000 series 2.65 firmware ? Maybe I screwed things up using that 3000X one ?? (since the md5 is different) ?

 What do you  guys think ?

  Thankyou readers !
   Popte.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: J-R on September 09, 2023, 02:08:19 am
You can download all of the official firmware files directly from Keysight.

The official 2000X and 3000X firmware files are 100% identical, but the patched ones are not, as you have found.  Personally I would play it safe and use the correct patch file.

Another note, your command line looks a bit suspect.  For example, you are telling it the bandwidth is both 100MHz and 200MHz?

What are you using for your .lnk file?  This is a simple one that will work for both 2000X and 3000X: 59#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS -l CABLE
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rev3rse on September 09, 2023, 12:21:35 pm
You can download all of the official firmware files directly from Keysight.

I would apreciate if someone could help me with a patched 2000 series firmware. I have all the official (most of them) since version 1.10.


The official 2000X and 3000X firmware files are 100% identical, but the patched ones are not, as you have found.  Personally I would play it safe and use the correct patch file.

It was a mistake. Wasn't intended - I really tought then that they are identical. ...
Do you think this is the cause for the filesystem  problem ? The reason I don't have a /Secure/ ffolder ?

Another note, your command line looks a bit suspect.  For example, you are telling it the bandwidth is both 100MHz and 200MHz?

Yes ... I noticed last evening. Tried my command line with  -l BW20 only - and works. But with both ... still works.
I copy/pasted the command from someone on this thread that had success with it on a 2002A. So ... if for someone else worked ....

What are you using for your .lnk file?  This is a simple one that will work for both 2000X and 3000X: 59#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS -l CABLE

Well this is the big problem. I DON'T HAVE a .lnk file (or I cannot see it). Since I don't have a /secure folder .... I don't have a lnk file. The application (infiniivisionLauncher.exe) starts at boot-up - but I DON'T know who invokes the executable ... and from where.
I can kill it like I mentioned in my last post - and I can start it with parameters ... works but still with an error.

Now that you cleared up the thing that the patched files have diffs .... I am really starting to think this is the root of my problem.
What should I do ? Can someone please help me with a patched 2.65 firmware for 2002A ?
Also .. Should I "recover" the scope using teraterm - and serial ? Is it worth it ? Since it's booting and I have network - isn't there an easier way to do that ?
I tried (currently) an official 2.65 firmware for 2002A - same error ...

Thankyou.
Popte.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rev3rse on September 13, 2023, 09:50:30 am

Hello everyone,

  I still have no ideea how to "factory" reset this scope.
  The error "System Concerns Detected: OS versio is not correct. Please reload system firmware"  - remains, no matter what. Official firmware, patched one ...


I tried 2002A firmware.
 Please take a look at my screenshow - with 2xPutty open.


  Any ideeas ?

Thankyou,

Popte.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ElectronMan on September 13, 2023, 07:32:43 pm

Hello everyone,

  I still have no ideea how to "factory" reset this scope.
  The error "System Concerns Detected: OS versio is not correct. Please reload system firmware"  - remains, no matter what. Official firmware, patched one ...


I tried 2002A firmware.
 Please take a look at my screenshow - with 2xPutty open.


  Any ideeas ?

Thankyou,

Popte.

On the 3000 \Secure is often hidden. You can try to cd into it (without it listed).

But if it is being recreated on boot every time, you have bigger problems. I had that issue and needed to erase the bad block via JTAG to get \Secure to stay. Otherwise it would be recreated empty on every bootup.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ThomasDK on September 29, 2023, 11:25:33 am
Can someone send me the patched firmware for DSOX2000?

Thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: diegodgo on September 30, 2023, 01:09:58 am
Hello.
Could someone please send me a copy of the PhillyFlyers corrected firmware 2.65 for the DSOX2002A? By PM or email diegodgo@gmail.com

Thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: marekx on October 10, 2023, 07:27:37 am
I will also step into this queue. Please could anyone share link or a copy of the PhillyFlyers 2.65 patched firmware for DSOX2000 :) t991731@protonmail.com

With best wishes,
Marek
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cmilak34 on October 14, 2023, 02:55:06 pm
Hello everyone!

I have a problem with oscilloscope.

Patient: MSO-X 3102A
Symptoms: standard NAND corruption

I based on the famous manual of titiris. I used 3000XSeries.02.35.2013061800 firmware.

Everything works up until running the "go 0x00362000" command. A logo appeared on the display, but the whole boot procedure in Tera Term stopped at some point:

Code: [Select]
ime for NANDFLASH to load: 0 ms.
Time for SNANDFLASH to load: 0 ms.
Starting ProcessStartupFolder
running \Secure\Startup\infiniivision.lnk...
Ending ProcessStartupFolder
                           System.TypeLoadException: TypeLoadException
   at Agilent.InfiniiVision.infiniiVisionLauncher.Main(String[] args)

It looks like instead of loading the image from the memory stick, the corrupted image from the oscilloscope is loaded further.

I have tried different paths in the infiniivision.lnk file:
Code: [Select]
48#\Secure\infiniiVision\infiniivisionLauncher.exeor
Code: [Select]
44#\usb\infiniiVision\infiniiVisionLauncher.exeor
Code: [Select]
51#\usb\Secure\infiniiVision\infiniivisionLauncher.exe Doesn't work.
Any ideas?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ha110ween on October 20, 2023, 01:13:36 pm
Could anyone send me the PhillyFlyers patched firmware for DSOX 4000X Series?

bh3nvn@hotmail.com

Thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ha110ween on October 21, 2023, 02:05:02 am
Could anyone send me the PhillyFlyers patched firmware for DSOX 4000X Series?

bh3nvn@hotmail.com

Thanks

Thanks to all friends!
Worked on my MSO-X 4034A.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pausmth32 on October 21, 2023, 08:43:23 pm
Hi,
If I could get a copy or link to PhillyFlyers patched firmware for the dsox2002a that would be great! pausmth@gmail.com or PM
Thanks in advance!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jirikv on October 25, 2023, 12:12:09 pm
Hi,
can I also ask someone to send me PhillyFlyers patched firmware for the DSOX2000X
jirikva528@gmail.com or PM
Thanks a lot!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cmilak34 on October 28, 2023, 05:42:11 pm
As I mentioned earlier my oscilloscope (MSO-X 3102A) has the typical NAND corruption.  I have already tried the tetris method with firmware versions 2.1, 2.3, 2.35 - no succes. I've tried different USB drives, different paths in the infiniivision.lnk file, but it still won't start booting from the USB drive.

I finally started comparing the lengths of the different firmwares. It looks like the firmware on my oscilloscope is  2.36.

Has anyone managed to fix their oscilloscope in this situation?

Can anyone tell me what the numbers in the paths mean?
For example:
Code: [Select]
44#\usb\infiniiVision\infiniiVisionLauncher.exeWhat
Code: [Select]
44# mean?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gamalot on October 28, 2023, 06:44:06 pm
As I mentioned earlier my oscilloscope (MSO-X 3102A) has the typical NAND corruption.  I have already tried the tetris method with firmware versions 2.1, 2.3, 2.35 - no succes. I've tried different USB drives, different paths in the infiniivision.lnk file, but it still won't start booting from the USB drive.

I finally started comparing the lengths of the different firmwares. It looks like the firmware on my oscilloscope is  2.36.

Has anyone managed to fix their oscilloscope in this situation?

Can anyone tell me what the numbers in the paths mean?
For example:
Code: [Select]
44#\usb\infiniiVision\infiniiVisionLauncher.exeWhat
Code: [Select]
44# mean?

The length of the path string "\usb\infiniiVision\infiniiVisionLauncher.exe".
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cmilak34 on October 29, 2023, 08:26:04 pm
Quote
The length of the path string "\usb\infiniiVision\infiniiVisionLauncher.exe".
Finally I understood. Thank you!

I still fight with my NAND corruption. I compare length couple FW:

1.10 - 0x01238818 - 19105816
2.10 - 0x0124867C - 19170940
2.20 - 0x01248680 - 19170944
2.35 - 0x013064D4 - 19948756
x.xx  - 0x013064E8 - 19948776
2.37 - 0x0130656C - 19948908
2.41 - 0x015264A8 - 22176936

x.xx is my version of firmware. I know this is not definitive proof, but based on the sizes 2.35 and 2.37 I would guess that my version is 2.36.

Could some good soul send me this firmware please? Unfortunately I can't find this version.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cmilak34 on October 31, 2023, 07:03:19 pm
Thank you very much, good man, for v2.36 (sorry, I don't remember your nickname).

I compared the length of the versions and, as I suspected, I had v.2.36 installed. Obviously the tetris method did not work on this version FW.

After discussion with analogRF, I decided to keep trying with version 2.35.

Finally it worked! The directory structure on the USB stick was wrong.

Here is a working structure:
Code: [Select]
USB flash
root


├───3000XSeries.02.35.2013061800.cab
├───infiniivisionStartupOverride.txt

├───Secure
│   ├───infiniiVision
│   │   │   Agilent.Cdf.Api.dll
│   │   │   ...
│   │   │
│   │   ├───fpga
│   │   │       FPGA2000A.bin
│   │   │       ...
│   │   │
│   │   ├───upgrade
│   │   │       infiniiVisionWebCom.dll
│   │   │
│   │   └───web
│   │       │   appletInstall.jar
│   │       │   ...
│   │       │
│   │       ├───css
│   │       │       AGBD____.TTF
│   │       │       default.min.css
│   │       │
│   │       ├───help
│   │       │       helpBrowserWebControl.asp
│   │       │       ...
│   │       │
│   │       ├───image
│   │       │       agilent.gif
│   │       │       ...
│   │       │
│   │       ├───include
│   │       │   │   vnc.min.js
│   │       │   │
│   │       │   └───web-socket-js
│   │       │           swfobject.js
│   │       │
│   │       ├───lib
│   │       │       edtftpj.jar
│   │       │       plugin.jar
│   │       │
│   │       ├───Lxi
│   │       │   └───Identification
│   │       │           Default.asp
│   │       │
│   │       └───navbar
│   │               bluebar.gif
│   │               ...
│   │
│   └───Startup
│           infiniivision.lnk

├───Startup
│       infiniivision.lnk

└───Temp
        EnvVars.txt

I don't think this is quite the structure tetris describes in his tutorial, but English isn't my first language, so I may have misunderstood something. Anyway, with this structure, version 2.35 ran without a problem.

One more thing - the same path was set in both infiniivision.lnk files - not only in \Startup\ but also in \Secure\Startup\.

In the infiniivision.lnk files was used the path sugested by analogRF (https://www.eevblog.com/forum/testgear/agilent-dsox3054a-not-booting-possible-nand-corruption-help (https://www.eevblog.com/forum/testgear/agilent-dsox3054a-not-booting-possible-nand-corruption-help)!/msg3451418/#msg3451418)
Code: [Select]
51#\usb\Secure\infiniiVision\infiniivisionLauncher.exe
USB Flash drive used:
- Kingston
- 4GB
- FAT (not FAT32)

As you can see the installed version 2.36 was not the problem.

I would like to thank users Mike112 and analogRF. Especially without the help of analogRF I probably would not have been able to repair the oscilloscope.

I wish you all good luck for your next repairs.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: xo01xoxo on November 02, 2023, 09:15:04 am
https://drive.google.com/file/d/1ryl1kb-962e0BtlbxDqIQ-d35yqo_ji5/view
[attachimg=1]
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jtw on November 03, 2023, 04:49:56 am
Hi,

Could someone please send me the PhillyFlyers patched firmware for DSOX3000T Series (I believe the most recent is 7.40.2021031200_patched).

PM or email: flashinglasers@duck.com.

Thank you in advance!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: albertr on November 03, 2023, 04:10:26 pm
https://drive.google.com/file/d/1ryl1kb-962e0BtlbxDqIQ-d35yqo_ji5/view
(Attachment Link)

xo01xoxo,

It's nice to see the movement, but it could help if you provided more details...

-albertr
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: SethiUllman on November 04, 2023, 04:41:38 pm
Hello, I am been going through these posts and am in need of this specific .cab file;

2000XSeries.02.00.2011101301.cab

Does anyone have this file? 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: diegodgo on November 10, 2023, 03:43:18 pm
Hello, I have an MSO-X 2014A with a problem, but I can't do the recovery processes. It gives me this screen when booting in TeraTerm. Has anyone had this problem and managed to fix it?

Since now. Thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ShQ on November 10, 2023, 09:19:00 pm
Interesting thread! Judging from the devicetrees in the DSOX1204 firmware, it seems the DSOX1204 and DSOX2xxx are very similar -- they use the same (pretty ancient) ARM SoC, the ST SPEAr600. Makes me wonder if you could with some effort run Linux firmware on the older DSO2xxx, as the application is very obviously a derived codebase.

I just acquired a DSOX2004 for testing, does anyone have a link to the option-patched firmware on hand? All the links posted before are down.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: amindavid11 on November 12, 2023, 09:39:35 pm
Hello,

Could someone please send me the PhillyFlyers patched firmware for DSOX3000T Series.


Thank you in advance!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ShQ on November 18, 2023, 03:28:26 am
Seems like my scope has been bricked, does anyone happen to have spare DSOXLAN modules lying around they'd like to sell?  :P
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jay_Diddy_B on November 19, 2023, 03:45:24 am
Seems like my scope has been bricked, does anyone happen to have spare DSOXLAN modules lying around they'd like to sell?  :P

If you want to build one, the files are in this thread:

https://www.eevblog.com/forum/projects/diy-dsoxlan-interface-for-keysight-oscilloscopes/msg4323214/#msg4323214 (https://www.eevblog.com/forum/projects/diy-dsoxlan-interface-for-keysight-oscilloscopes/msg4323214/#msg4323214)

You can order the boards from JLCPCB cheaper than I can send you a board.

There are two designs for different magjacks.


Regards,

Jay_Diddy_B
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on November 19, 2023, 03:09:21 pm
Seems like my scope has been bricked, does anyone happen to have spare DSOXLAN modules lying around they'd like to sell?  :P
Someone recently announced they are selling pre-built homebrew DSOXLAN modules for 50 Euros, ships anywhere:

  https://test-equipment-for-sale-wanted-or-exchange.groups.io/g/main/message/5144

No affiliation or experience with the seller.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: PA0PBZ on November 19, 2023, 03:42:44 pm
Here's the listing: https://www.ebay.com/itm/325830591919 (https://www.ebay.com/itm/325830591919)

@ShQ: Have not found my card yet so this may be a good option, at least this one you can keep  ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: J-R on November 19, 2023, 10:59:13 pm
In what way is your scope bricked?  Won't boot or just the wrong .lnk file?  Unless I'm mistaken, my understanding is the LAN module only works if the OS can start up.  Furthermore, the factory Keysight firmware disabled telnet some time ago, so you would need the hacked firmware to have already been flashed so that telnet is enabled.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ShQ on November 19, 2023, 11:40:22 pm
If you want to build one, the files are in this thread:

https://www.eevblog.com/forum/projects/diy-dsoxlan-interface-for-keysight-oscilloscopes/msg4323214/#msg4323214 (https://www.eevblog.com/forum/projects/diy-dsoxlan-interface-for-keysight-oscilloscopes/msg4323214/#msg4323214)

You can order the boards from JLCPCB cheaper than I can send you a board.

There are two designs for different magjacks.


Regards,

Jay_Diddy_B

Ah yes, I did find these (thanks for the design by the way!), but I was hoping to find a way that's quicker than waiting a few weeks for the PCBs to come in.  :P

Someone recently announced they are selling pre-built homebrew DSOXLAN modules for 50 Euros, ships anywhere:

  https://test-equipment-for-sale-wanted-or-exchange.groups.io/g/main/message/5144 (https://test-equipment-for-sale-wanted-or-exchange.groups.io/g/main/message/5144)

No affiliation or experience with the seller.
Here's the listing: https://www.ebay.com/itm/325830591919 (https://www.ebay.com/itm/325830591919)

@ShQ: Have not found my card yet so this may be a good option, at least this one you can keep  ;)

Thanks, I'll have a look at that one -- and thanks a bunch for looking anyway. :)

In what way is your scope bricked?  Won't boot or just the wrong .lnk file?  Unless I'm mistaken, my understanding is the LAN module only works if the OS can start up.  Furthermore, the factory Keysight firmware disabled telnet some time ago, so you would need the hacked firmware to have already been flashed so that telnet is enabled.

It fails to boot, checksum error in NK.BIN (my own fault, not NAND corruption). The Windows CE bootloader actually has a way to load a recovery image over LAN, as PA0PBZ described a few years ago (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022248/#msg1022248).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: John1996 on November 21, 2023, 06:09:06 pm
Could someone please send me the last patched firmware for MSOX3000T Series. Thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: amindavid11 on November 21, 2023, 06:57:44 pm
https://drive.google.com/file/d/1ryl1kb-962e0BtlbxDqIQ-d35yqo_ji5/view
(Attachment Link)

Is this a new FW hack? Can this be used with the 3000T?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on November 21, 2023, 08:58:41 pm
Can this be used with the 3000T?

If it's a 4000X FW, then no.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ShQ on November 25, 2023, 10:35:13 pm
Made some progress while waiting for a LAN adapter, which ended up making getting one redundant. ::)

First on the agenda was trying if I could simply "borrow" an 8P8C jack and some magnetics from an old network switch,
attach some probes to the expansion connector, and solder the wires attached to the probes directly to the magnetics.
It made for a wonderfully cursed setup:

[attachimg=1]

Sadly, after a lot of fiddling around and re-soldering I wasn't able to fully get it to work; running ethernet signals was possibly not what dupont wires were invented for. ;)

However, when closing up the probe setup and taking another look at the mainboard, I couldn't help but wonder why the user cal button was so auspiciously located on the back,
directly on the mainboard. What would happen if it was pushed while in the bootloader?

...

Well, nothing. What about while the scope is powering up?
Huh. No UART output. Is it just a weird reset line?
Maybe the SoC is doing something odd, let's hook up the USB and see if it enumerates at all.

[attachimg=5]

... what's this? The SPEAr300 reference manual (https://www.st.com/resource/en/reference_manual/dm00025692-spear300-stmicroelectronics.pdf) has some hints:

Quote
38.5.3    USB boot

USB Boot refers upgrading of Flash memories (NAND and NOR) via USB.
[...]

After receiving 12 bytes BootROM decodes 12 byte command, changes the USB state machine to GET_DATA phase and then waits for expected number of bytes from Host.
BootROM receives the data and stores it into load address specified in the command, once all the data is received, BootROM changes the USB state machine to EXEC phase and decodes the type of data, if the received data is DDR Driver, then BootROM jumps to loadaddress, executes the DDR driver and jumps back to BootROM.

Now that the DDR is initialized, BootROM changes the USB state machine again to GET_CMD phase.
Now same process is repeated again, but this time type of data received is FIRMWARE, the FIRMWARE is capable of receiving data from Host, Flash upgrade capable etc.
After receiving the FIRMWARE, BootROM jumps to it in DDR.

That sounds great! Something is off though, even disregarding it containing one of the longest run-on sentences I've ever seen: the USB descriptors don't quite match.
Now, this is a reference manual for the SPEAr300, not SPEAr600, so maybe that's the sole difference? The SPEAr1340 seems to have a significantly more involved protocol.
Luckily (found in this very thread (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg264473/#msg264473) even, thanks @abyrvalg!), ST has released a "flasher" (https://www.st.com/en/development-tools/stsw-spear008.html), and it comes with source code!
And, the source code mentions the main descriptor difference!

Code: [Select]
#define MY_VID 0x0483
#define SPR600_PID 0x7261
#define SPR300_PID 0x3801

It's a Windows-based tool however, based on old libusb 0.1.  :(
I took the liberty of rewriting it into slightly more portable C taking advantage of the more modern libusb 1.0 (sources attached to this post).
Time to try it out! It needs a DDR driver and a U-boot image, both we can take from any Keysight firmware update:

Code: [Select]
$ spearload -t spear600 p500_ddrdriver.bin u-boot_image.bin
spearload: opening device...
spearload: sending DDR driver p500_ddrdriver.bin...
.
......
spearload: sending firmware u-boot_image.bin...
.
...

Back at the UART, we are greeted with success! ;D

Code: [Select]
U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

However, this just brings us back where we started: if you've been following along the thread, you may have noted that not everyone is lucky with getting a functional U-boot that can be interrupted.
Sadly, mine is no exception: after above output, any serial output simply dies. :(

I decided to finally take some time and dive into the U-Boot image to figure out why exactly this is happening.
It seems to happen right after the early serial I/O is replaced by the more featured serial drivers, but they seem to poke the same registers. Odd.
There's a little function call tucked away there, what does it do?

[attachimg=2]

 :o USB serial! But it would boot way too fast to allow us to enumerate the device, connect and interrupt! ... Right?
Well, Keysight seems to have thought of that as well: there's a sneaky little conditional waay later in the initialisation process:

[attachimg=3]

This basically checks for pre-production silicon, or the DDR driver being present at a specific address (the string is it is comparing to being present in p500_ddrdriver.bin).

I first tried loading the driver to appear at that expected address, but that didn't seem to work. Bummer, possibly the driver code is not relocatable.

Still, there's no reason we can't simply patch this conditional! Making the following changes in u-boot_image.bin from firmware 2.65:


Code: [Select]
Offset 0x16100:  0c 00 00 1a -> 0c 00 00 ea   ; bne -> b
Offset 0x18:     57 11 83 33 -> 4f 18 d7 f0   ; data checksum
Offset 0x4:      6c 2f de de -> 4e 52 6b 13   ; header checksum

Update: disregard the above! It seems that the DDR driver itself moves the string into that location (and presumably XLOADER, the normal loader after the DDR training sequence clears it),
so no modifications are necessary!

Guess what suddenly appears on the USB side?

[attachimg=4]

;D

Code: [Select]
Welcome to minicom 2.8

OPTIONS:
Compiled on Oct 25 2021, 06:07:01.
Port /dev/tty.usbmodem00000001, 22:22:23

Press Meta-Z for help on special keys


p500>

Finally! So in summary, you can get a working U-Boot serial on these bad boys without even opening the scope! ;)

The short version:
1) Extract a Keysight 2.65 firmware update
2) Modify u-boot_image.img as per the instructions above
3) Power up the scope while using a tool to hold down the button labeled "CAL" on the back
4) Connect to the scope USB port
5) Use the attached spearload program or ST's own flasher (linked above) to load p500_ddrdriver.bin and the modified u-boot_image.img
6) Enjoy your fresh USB serial, no functioning NAND required!

And since it's bootROM functionality, they can't patch this one out from existing products. :P
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on November 26, 2023, 06:24:20 pm
Nice investigation!  :clap: :clap:

So, you are forcing the setting of env vars:
preboot=set stdin usbtty;set stdout usbtty;set stderr usbtty
bootdelay=-1

I think you could make it even "simpler/cleaner" and not require the U-Boot patch:   :popcorn:

- Just extend the size of p500_ddrdriver.bin in order to accommodate the "DDR_DRIVER" string at the verification address 0xD2B01F00.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ShQ on November 26, 2023, 07:16:20 pm
Interesting idea! I don't think that'll be possible: the difference between the native load address 0xD2800B00 and expected address 0xD2B01F00 is about 3 megabytes, which you'd have to upload to the chip before DRAM is functional (that's the point of the driver, after all :P) -- it simply doesn't have that much SRAM, I think. ;)

Plus: you'd have to make similar modifications to the DDR driver header to adjust the size and both checksums, so the difference being changing one byte versus adding 3 megabytes, I think the one byte wins in cleanliness here. :P
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on November 26, 2023, 07:21:06 pm
Plus: you'd have to make similar modifications to the DDR driver header to adjust the size and both checksums, so the difference being changing one byte versus adding 3 megabytes, I think the one byte wins in cleanliness here. :P

 :) I knew you would say that.  :-+

As you reminded me, the SRAM is not sufficient for such a file...  |O

I've just opened p500_ddrdriver.bin and one of the first operations it does is precisely:

strcpy((BYTE *)0xD2B01F00, "DDR_DRIVER");

This must be a flag saying that the driver is loaded.

Your method wins! :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ShQ on November 26, 2023, 07:55:07 pm
Hum, interesting! It indeed seems to do that, but then the question is: why doesn't this trigger that condition every boot?

It doesn't seem like it gets cleared before that condition runs:

Code: [Select]
p500> md.b 0xD2B01F00 10
d2b01f00: 44 44 52 5f 44 52 49 56 45 52 00 00 00 00 00 00    DDR_DRIVER......

... WOW, I am stupid. The U-Boot mod isn't even needed! :o

Just verified that it works perfectly fine on an untouched p500_ddrdriver.bin and u-boot_image.img -- was so caught up in that discovery that I hadn't even bothered testing without.  |O
It must be that this indicates that there was no XLOADER in-between, which would presumably clear that part of memory. Thanks for checking me on that!

That makes our summary easier!
1) Extract a Keysight 2.65 firmware update
2) Power up the scope while using a tool to hold down the button labeled "CAL" on the back
3) Connect to the scope USB port
4) Use the attached spearload program or ST's own flasher (linked above) to load p500_ddrdriver.bin and u-boot_image.img from the update
5) Enjoy your fresh USB serial, no functioning NAND required!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on November 27, 2023, 09:38:00 am
Just verified that it works perfectly fine on an untouched p500_ddrdriver.bin and u-boot_image.img -- was so caught up in that discovery that I hadn't even bothered testing without.  |O
It must be that this indicates that there was no XLOADER in-between, which would presumably clear that part of memory. Thanks for checking me on that!

I also was baffled when I saw it loading first. But I assumed you had that covered...  :) I then went to think: damn, I really don't know sh.. about this uboot stuff.

Glad it helped perfect your discovery.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 28, 2023, 05:38:36 am
@ShQ would you be able to compile your utility into a Windows executable ?  ::)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ShQ on November 29, 2023, 12:51:27 pm
No problem! Attached it to this post, along with a slightly newer version of the source code to address some portability issues and a minor bug.
It requires WinUSB or libusbK (https://github.com/libusb/libusb/wiki/Windows#how-to-use-libusb-on-windows).

I don't have a Windows install to test on though, so hopefully it works. Please let me know if it doesn't! ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on November 29, 2023, 03:40:51 pm
Awsome, thank you. Is it requiring WinUSB to compile or to run, or for both?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ShQ on November 29, 2023, 07:19:09 pm
To run. The libusb wiki page recommends Zadig (http://zadig.akeo.ie/) to manage libusb drivers, that may make it easier.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrancescoChino on December 07, 2023, 05:35:17 pm
Dear All,
I have the sam booting problem with the DSO-X 2000 oscilloscope, but I'm not able to download anymore the FW 2.35.
Could someone of you tell me wher is possible to obtain this older FW version ?

Thank you

Francesco
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: albertr on December 08, 2023, 10:12:43 pm
Hum, interesting! It indeed seems to do that, but then the question is: why doesn't this trigger that condition every boot?

It doesn't seem like it gets cleared before that condition runs:

Code: [Select]
p500> md.b 0xD2B01F00 10
d2b01f00: 44 44 52 5f 44 52 49 56 45 52 00 00 00 00 00 00    DDR_DRIVER......

... WOW, I am stupid. The U-Boot mod isn't even needed! :o

Just verified that it works perfectly fine on an untouched p500_ddrdriver.bin and u-boot_image.img -- was so caught up in that discovery that I hadn't even bothered testing without.  |O
It must be that this indicates that there was no XLOADER in-between, which would presumably clear that part of memory. Thanks for checking me on that!

That makes our summary easier!
1) Extract a Keysight 2.65 firmware update
2) Power up the scope while using a tool to hold down the button labeled "CAL" on the back
3) Connect to the scope USB port
4) Use the attached spearload program or ST's own flasher (linked above) to load p500_ddrdriver.bin and u-boot_image.img from the update
5) Enjoy your fresh USB serial, no functioning NAND required!

Can you share the p500_ddrdriver.bin and u-boot_image.img files? I'm not sure how to extract them from the F/W update... or maybe you can share the instructions on how to extract these files from ksx F/W update?

-albertr
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tv84 on December 08, 2023, 10:41:56 pm
Can you share the p500_ddrdriver.bin and u-boot_image.img files? I'm not sure how to extract them from the F/W update... or maybe you can share the instructions on how to extract these files from ksx F/W update?

7-Zip is enough.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: albertr on December 09, 2023, 12:07:05 am
Can you share the p500_ddrdriver.bin and u-boot_image.img files? I'm not sure how to extract them from the F/W update... or maybe you can share the instructions on how to extract these files from ksx F/W update?

7-Zip is enough.

Ok, thanks! I extracted the files with 7z, and I assume that pboot_rel.bin is u-boot_image.img? But where can I find p500_ddrdriver.bin?

Code: [Select]
bash-3.2$ file pboot_rel.bin
pboot_rel.bin: u-boot legacy uImage, PBOOT, Linux/ARM, OS Kernel Image (gzip), 37935 bytes, Thu Oct 29 08:22:14 2015, Load Address: 00000000, Entry Point: 00000000, Header CRC: 0X2D999100, Data CRC: 0X84FF067B
-albertr
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: diegodgo on December 09, 2023, 02:31:00 am
Hello.

I have the original file in this version, please give me your email and I will send it to you.
Dear All,
I have the sam booting problem with the DSO-X 2000 oscilloscope, but I'm not able to download anymore the FW 2.35.
Could someone of you tell me wher is possible to obtain this older FW version ?

Thank you

Francesco
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ahakman on December 09, 2023, 09:11:58 am
That makes our summary easier!
1) Extract a Keysight 2.65 firmware update
2) Power up the scope while using a tool to hold down the button labeled "CAL" on the back
3) Connect to the scope USB port
4) Use the attached spearload program or ST's own flasher (linked above) to load p500_ddrdriver.bin and u-boot_image.img from the update
5) Enjoy your fresh USB serial, no functioning NAND required!

I just spent way too long trying to compile your spearload in current Debian (really rusty at c / build stuff - I've become a python softy now apparently).
I had to make 2 changes to the Makefile to make it compile and link successfully:

remove "-std=c2x" from the CFLAGS variable (sounds like -std=c2x forces it to be pure c std 2000, which doesn't support macros, hence it complains about all of the byte order swapping functions from endian.h  - leaving it undefined means use "gnu c standard" that does support macros)
and
in the binary build target, move "$(CFLAGS) $(LDFLAGS)" to the end of the line - if the flags are specified before the object file / binary, it can't find libusb-1.0. Simply moving the flags after the source/target fixes that issue (found a reference to that on stackexchange).

So
CFLAGS += -std=c2x -Wall -Wextra -pedantic -Wno-zero-length-array        ==>       CFLAGS += -Wall -Wextra -pedantic -Wno-zero-length-array
and
(CROSS_COMPILE)$(CC) $(CFLAGS) $(LDFLAGS) $^ -o $@        ==>      $(CROSS_COMPILE)$(CC) $^ -o $@ $(CFLAGS) $(LDFLAGS)   

But it's compiled now!
On with the show...

Edited to add:
There's also a bug in read_file()
the 3rd argument to fread should be "size - total", not "total - size" - what you had originally gives negative values, and the libc I'm using complains about that and throws a "spearload: read_file: ./p500_ddrdriver.bin: could not read: Bad address" error - you can't tell it to read a negative number of records!

But now after changing those things, it must be working - it's showing up as a serial device now!

Bus 001 Device 014: ID 0957:7a18 Agilent Technologies, Inc. P500
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ahakman on December 09, 2023, 12:26:34 pm
So I must be doing something wrong.

I boot with the cal switch pushed in, it shows up as the STMicroelectronics ST SPEAr SoC Family Device
I use spearload to push p500_ddrdriver.bin and u-boot_image.bin (from 3000XSeries.02.65.20210307001_patched.ksk available a few pages back in this thread)
It then turns into a USB serial device (shows up at /dev/ttyACM0)
I can connect to it by minicom and I get the p500> prompt and can see and run all the u-boot commands.
I use ymodem to upload nk.nb0 (from the same firmware above) and have prepared the USB stick (also from the same frimware as above)
when I "go 0x00362000", I see "## Starting application at 0x00362000 ...", but at that point the USB serial device disappears, and minicom disconnects.

I do see a little bit of activity on the USB stick, but it never actually boots the application, and just sits there with the screen dark. About every minute or so the light on the usb stick flashes a little

Also for creating the .lnk file on the USB stick, I'm using "51#\usb\Secure\infiniiVision\infiniivisionLauncher.exe" so it should be running the application from the USB stick, not from the flash

Any hints or guesses what I'm doing wrong? Do I need to be using the firmware version that's already on the scope, even if the startup link points to the USB stick?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on December 09, 2023, 01:12:20 pm
Connect a second terminal to the UART output on the board to see boot process output.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on December 09, 2023, 07:51:08 pm
Maybe try the process with 2.35 version firmware - it allows \usb
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ahakman on December 10, 2023, 12:03:43 am
Yeah, both of those suggestions (using the dedicated uart instead of the usb-serial uart, and trying with 2.35) were going to be my next steps, but when it's 5am and you've been up all night, you have to call it and go to bed at some point!

I did manage to find a working link for 2.35 somewhere way back in this thread, I just have to go through the process to prepare the usb stick and get nk.nb0 from it again...

So after finally finding a USB-TTL rs232 adapter, when booting from uboot over usb-serial console and monitoring the other console, this is where it gets stuck after I issue the go 0x00362000

Code: [Select]
Windows CE Kernel for ARM (Thumb Enabled) Built on Jan 24 2013 at 14:52:37
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jun 18 2013)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:20:AE:A7
Phy found addr 31 (ticks=2722)
WaitForLink Start (ticks=2724)
No Link (ticks=3726)
<--EDeviceInitialize

GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.

And it just sits there for forever not doing anything.

I don't know if that means the USB stick isn't setup right? I tried both literally what's written in post #2085 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181) "Copy the CONTENTS of secure to the root of the USB stick", and also what's in post #3204 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg5144925/#msg5144925) which is copy the FOLDER secure to the root of the USB stick - same thing.

I'm trying again re-formatting the stick as FAT16 - No difference.

I see @rizal5478 showed the exact same boot log stopping in the same place at

BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
and never getting to
BALDWIN_DDI: cBaldwinHwIf::Init: Success!

in message #2114 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2193438/#msg2193438) - doesn't seem like there was any resolution to that.

Pretty sure the easy solution here is to get Keysight to replace it rather than spending so much time trying to recover it. I have boot logs that proves it's nand corruption, though my last interaction with keysight support was less than stellar...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on December 10, 2023, 07:05:22 am
I think your FPGA is not getting loaded.
Is a reason you go to USB first? Have you tried to boot normally?
The thing is that the Uboot you send over USB may not have the environment variables, which are stored in NOR.

Edit: That is exactly what the boot log in the post you referenced said:

Code: [Select]
FPGA programming FAILED!
And also:
Code: [Select]
Could not copy from NAND offset 0x60000. Error -74 With ECC
Address 0x60000 is where the FPGA image is stored in NAND
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ahakman on December 10, 2023, 08:37:45 am
Booting normally, and interrupting u-boot and uploading nk.nb0 over serial took 10x longer than it did over usb, but it got slightly further.

I got a splash screen, but abruptly stopped.

From the log:
Code: [Select]
GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
ERROR: OALIoCtlHalGetDeviceInfo: Device doesn't support IOCTL_HAL_GET_DEVICE_INFO::SPI_GETBOOTMENAME
Failed to start/configure network.
Time for NANDFLASH to load: 0 ms.
Time for SNANDFLASH to load: 0 ms.
Time for USB Hard Disk Drive to load: 0 ms.
Starting ProcessStartupFolder
ProcessStartupFolder: \usb\Startup\
                                   running \usb\Startup\infiniivision.lnk...

The Startup\infiniivision.link file contains:
Code: [Select]
51#\usb\Secure\infiniiVision\infiniivisionLauncher.exe

the folder structure on the usb key indeed has
\Secure\infiniiVision\infiniivisionLauncher.exe

but it doesn't seem to run
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ahakman on December 10, 2023, 02:43:10 pm
I got it working

From the size of the image on the scope, I could tell it had 2.37 on it to start with (the version that was corrupt).

Booting 2.35 from ymodem / the usb stick didn't work

Booting 2.37 from ymodem / the usb stick did work, but the application has to be in \usb\Secure in 2.37 - the first time I tried it, it was in \usb\infiniivision - it didn't like that - it said "invalid parameters" when booting and then rebooted from the flash and threw the error about the image being corrupt.

So if your scope initially has 2.35 or 2.36 on it, you can boot 2.35 from ymodem / USB, with the application in \usb\infiniivision\
If your scope initially has 2.37 on it, you can NOT boot 2.35 from ymodem / USB, but you CAN boot 2.37 from ymodem / USB with the application in \usb\Secure\infiniivision\

I installed 2.65 from the USB stick once it booted, and now it boots itself fine from the flash!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on December 10, 2023, 04:03:56 pm
Great! One more restored  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ahakman on December 10, 2023, 10:54:29 pm
I do notice a difference in the startup sequence of lights compared to my DSOX2012A, which Agilent Keysight replaced a few years ago for corrupt NAND (and is running 2.50 firmware) so is practically brand new.

On the DSOX2012A, the light sequence is
ref -> +math -> +digital -> +serial -> +run/stop +single
all lights off
channel buttons -> wavegen + intensity -> all 4 triangle lights -> run/stop + single -> only single
application is running, lights as they are for operation

On this one (DSOX2024A) the light sequence is different
ref -> +math -> +digital -> +serial -> +run/stop +single
all lights off
channel buttons -> wavegen + intensity -> all 4 triangle lights -> run/stop + single -> only single for noticeably longer
all lights off
channel buttons -> wavegen + intensity -> all 4 triangle lights -> run/stop + single
all lights off
channel buttons -> wavegen + intensity -> all 4 triangle lights -> run/stop + single
all lights off

Is it normal for the 4 channel scope to take longer to boot / have the extra 2 cycles of lights during booting? Or is this a sign of worn out NAND that takes longer (and hence the better solution would've been replacement rather than recovery)? Or does 2.65 just take longer to boot than 2.50?

Now I'd like to find a DSOX 3034 or a 4000 series that's corrupt for a decent price and get that fixed... eventually - they seem to pop up occasionally.
I haven't been looking a lot since I got the 2012A a few years ago, but having 4 channels really would be nice for some stuff I'm working on now!

Also, does anyone have suggestions for probes? Even with the DSOX2012A, I've been using the probes that came with my 54645D, but that's only 2 channel too, and now I have a 4 channel DSOX2024A
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on January 05, 2024, 03:15:10 pm
Just an FYI to all regarding NAND corruption repair.  Spoke to Keysight this morning and it is no longer free, the system shows as billable.  The good news, if this is to some, is that in this location (US), the repair is $1900 which includes full calibration.  That's not bad, considering.

Also, the freebies ended in December 2022 (2019 in the original service note).  For our European friends, perhaps the end date was different.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jedi on January 06, 2024, 06:37:05 am
Hello, I am a user of the 4000 series.
A few days ago, I confirmed that my device no longer boots due to a NAND error.
I am attaching the u-boot log via serial.
Is there a way to reflash the 4000 series? Thank you

Code: [Select]
U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  256 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2011-08-12  17:16:04 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37297 Bytes = 36.4 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Aug 12 2011 11:03:19
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

image2 value is out of range 0 so it will be ignored.
  It must be a hexadecimal integer between 0xd00000000 and 0xd7ffffff or between 0x800000000 and 0x87ffffff.

System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0400000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXOOOOOOOOXOXXOIncorrect Data 1 EccResult: ff0fff EccError: ff3cfc EccRead: 3303
 EBOOT_ReadFlash failed offset 47cdc3
 EBOOT_ReadFlash failed location d0480000
ODeCompressFlash: CeCompressDecode() failed
 CeDecompressFlashBlock failed
****** Data record 9 corrupted, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x29B0048  Name="" Target=RAM
 Loading image 1 failed, trying next one
 All images failed

Press r to reset
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jwalling on January 06, 2024, 09:56:30 am
Just an FYI to all regarding NAND corruption repair.  Spoke to Keysight this morning and it is no longer free, the system shows as billable.  The good news, if this is to some, is that in this location (US), the repair is $1900 which includes full calibration.  That's not bad, considering.

Also, the freebies ended in December 2022 (2019 in the original service note).  For our European friends, perhaps the end date was different.

That's interesting - which model # were you inquiring about?
I ask because I just exchanged emails this week with a guy with an MSOX2014A in the USA, and Keysight is going to repair for free under service note MSOX2024A-06B.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Svitchy on January 08, 2024, 04:53:15 pm
Hey guys!! Can some one share files with me, i need PhillyFlyers patched FW 2.65 for the 2000-X series scopes?!
Will apreciate for help!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EE-digger on January 11, 2024, 08:01:39 pm
Just an FYI to all regarding NAND corruption repair.  Spoke to Keysight this morning and it is no longer free, the system shows as billable.  The good news, if this is to some, is that in this location (US), the repair is $1900 which includes full calibration.  That's not bad, considering.

Also, the freebies ended in December 2022 (2019 in the original service note).  For our European friends, perhaps the end date was different.

That's interesting - which model # were you inquiring about?
I ask because I just exchanged emails this week with a guy with an MSOX2014A in the USA, and Keysight is going to repair for free under service note MSOX2024A-06B.

DSOX3034A and this was the official word ... but ... you have to talk with them as the end result can be different.  Nice people, still a great company.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on January 11, 2024, 08:33:56 pm
My DSOX4024a with a NAND problem was also repaired without any discussion (Germany).
Since then, Keysight has been a favourite of mine.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: polizz7442 on January 21, 2024, 03:28:00 am
Sorry to post the same message as others, but I also cannot seem to find an active 2.65 FW link in the thread and I've been reading for a couple of hours. Would anyone happen to have it handy? I have a DSOx2K scope that was previously loaded with 2.5. Is the procedure just as simple as loading it onto the root of a USB still along with the lnk file? Thanks all.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: msuthar on February 02, 2024, 05:10:05 am
After a very long time there is update on DSO X-2000 series oscilloscope firmware  2.66 is posted today

https://www.keysight.com/in/en/support/DSOX2004A/oscilloscope-70-mhz-4-analog-channels.html#drivers (https://www.keysight.com/in/en/support/DSOX2004A/oscilloscope-70-mhz-4-analog-channels.html#drivers)


brgds.

73
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: J-R on February 02, 2024, 06:24:29 am
Almost 3 years since the last update.  I wonder if we'll get an updated hack or if everyone has gone underground.

Release notes for 2.66:
"Enhancements for both 2000A and 3000A
- Added a new Trig Out mode – Trigger Source. The raw trigger signal from the
oscilloscope’s trigger circuit is output to Trig Out when Trigger Source is selected.
Bug Fixes for both 2000A and 3000A
- Fixed issue in which saving a PNG 24-bit image does not work after recalling a setup file.
- Fixed issue where the phase measurement is incorrect after recalling a setup file with
different source settings."

According to the manual, Trig Out is delayed by 30ns, so I wonder if this "enhancement" removes that delay or if they are referring to some other change.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: switchabl on February 04, 2024, 10:11:29 pm
The delay seems to be slightly reduced (~5ns). Apart from that it doesn't output auto trigger events. This is a weirdly specific feature to add to a 12 year old DSO. Maybe a big customer (or someone inside Keysight) thought they really, really needed that for some reason.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: J-R on February 04, 2024, 10:39:33 pm
The delay seems to be slightly reduced (~5ns). Apart from that it doesn't output auto trigger events. This is a weirdly specific feature to add to a 12 year old DSO. Maybe a big customer (or someone inside Keysight) thought they really, really needed that for some reason.
Good to know.  Seems that having a hacked scope is the better path for most folks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: switchabl on February 04, 2024, 10:56:11 pm
I played around with it some more. It does output every potential trigger event, even if the acquisition engine is not ready/not running. That's actually pretty interesting (but still very niche).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: doombot1 on February 08, 2024, 10:46:28 pm
A while since I've made an EEVBlog post, but delved enough into what I'm about to describe that I figured anyone else with the same issue as me would really appreciate the documentation (I know I would've myself). Anyways... here goes.

I got an MSO-X 2012A scope from my uni 2 years ago that had the dreaded NAND corruption problem. Lights flash, screen stays blank, etc. Knowing my uni, the scope's FW had never been upgraded - and checking the working scopes in the labs, it was running the _original_ 1.10 firmware from Agilent.

So, on a whim, I figured I would give this thread a read-through, and ended up finding the famed titiris method. Took apart the scope, attached UART, et cetera. And to my absolute surprise, it worked! I loaded on 2.35 firmware directly, nothing in between and everything worked just fine. Loaded the cab file on at the end, and bingo! Working scope. Even though it's the 3000X firmware DSO firmware, it loaded onto my 2000X MSO. Still maintained the MSO license, too.  ;D And a quick FYI - for anyone who is looking to find SOME of the old firmwares - anything >= 2.37 (non-hacked), you can go to the link elsewhere in this thread - https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/ - it will show you a 403 error - but if you put the same link into the Internet Archive/Wayback machine, you can still get to the firmwares! Haven't found anything newer than 2.37 though, unfortunately... if anyone's got a patched 2.65, send me a PM - that would be awesome ;)

...anyways. Here's where I got cocky. "Oh," I thought, "I've gotten this far - may as well try to hack the scope." So, I read a few more pages and saw someone had created a 2.41 cab file - and without _any_ thinking, I downloaded that and loaded it onto my scope. :palm: TERRIBLE idea. It bricked the scope - sent it into a boot loop. :-BROKE It would get to the point where it loaded the splash screen for 2.35 and then it would reboot. After reading a few more pages (like my impatient *** should've done beforehand), I realized that A. you need patched DLLs, and B. you can't just ...load 2.41 on top of 2.35. DUH! |O So I just figured "oh, well I'll just redo the titiris method." That didn't work. It'd send the file over YMODEM and then just... not boot off of the USB. I tried no less than 5 times. Waiting 45 minutes each time.

I gave up on it for a few days and was pretty frustrated - I'd gotten SO close, and yet, for nothing. But after a bit of stewing, I came back to it - I realized that I might've been able to use telnet to recover the scope. Not wanting to shell out for a LAN board, just in case it didn't work (and again... did I mention that I'm impatient?), I stuck wires into the pins of the header on the mainboard (using the schematics/pinout from the DSOXLAN schematics found from elsewhere in this thread). I tried once with standard breadboarding wires but those were too large, and although they fit, they didn't fit well and kinda goofed the connector up a bit. I tried again with logic probe tips, but again, too cramped. Came back to it the next day and realized ethernet cable wire is pretty thin, right? Well - turns out that 24 gauge solid-core ethernet wire works _perfect_ for this - stuck a bunch of those into the connector wires and BINGO! LAN!

(this is getting long, sorry in advance... it's just how I am)

LAN worked now - but the biggest issue now was, how the **** could I connect to it? Because the scope was stuck in a boot loop, I (connected to the UART in one window) could see that it initialized the LAN immediately before trying to load the infiniivision_ext.lnk file, and then would die very quickly. Enough time to get the telnet to connect but not to actually log in, let alone to kill infiniivisionLauncher.exe.
A stroke of genius had me write a quick AutoHotKey script to auto-type the entire username/password combo with just 2 key presses - and with that, I could just barely get logged onto the telnet before the scope looped again - but, even with a 3rd AHK macro for "processMgr.exe kill infiniivisionSetup.exe", the scope didn't have enough time to actually kill the process before hitting the fault and looping. After a LOT of toying around, I figured that maybe the .lnk file was bad? Or that if I renamed it, it wouldn't be able to call it, and therefore wouldn't try to run the faulted Launcher. So, doing one command at a time, with an incredible amount of patience (you have to open the telnet at just the right time for it to connect), I:
   1. Listed the files in \Secure\Startup
   2. Ran a `type` (MS equivalent of cat) on \Secure\Startup\infiniivision_ext.lnk - this showed me that it had the "hacked" commandline from the 2.41 I tried to load; the one with all of the options.
   3. Created a file `test.txt` in \Secure\Startup
   4. Filled `test.txt` with a new .lnk command - XX#\usb\Secure\Startup\infiniivision.lnk (can't recall what the number before the # was, unfortunately - I had to try a few) - note the \usb at the start, too.
   5. Renamed test.txt to `infiniivision.lnk`
After the rename, the scope used infiniivision.lnk instead of the _ext version - and would boot, load telnet, and presumably because the usb wasn't even plugged in, would try to execute a nonexistent program - which meant that instead of looping because of a fault, the scope would just hang. Which is fine - because now I could get into Telnet! And stay there!

From there, it was pretty simple. Kill the infiniivision launcher first - `processMgr.exe kill infiniivisionLauncher.exe` I loaded the firmware onto a thumb drive in the same folder structure described in titiris's post (2.35 - NOT 2.41 - mostly because I couldn't find 2.41) and then just put in the flash drive and manually executed `\usb\Secure\infiniiVision\infiniivisionlauncher.exe` in Telnet - and it worked!! The scope booted. Which was incredible! From there, it was as simple as changing the infiniivision.lnk file on the scope (\Secure\Startup\infiniivision.lnk) to include the proper link to boot from the scope's exe as normal, and then I just used the scope's GUI to flash the 2.35 firmware. Note that if `infiniivisionStartupOverride.txt` is present on the USB, the FW flash will fail - you need to remove that. And from there, all was well - scope works just fine, and I avoided having to send it to Keysight to get it fixed!

This isn't so much of a guide as it is an explanation of what I did wrong... but that said - I wrote this all out in the slim chance that someone else did an oopsie like I did and thinks they ruined their scope - and if so, hopefully this helps you fix it!! Good luck, and cheers!
P.S. Again... if anyone's got patched FW of any version >= 2.35, that would be awesome... PM me! I'm suddenly not overly afraid to try again - but I also will probably need more thorough instructions this time ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: doombot1 on February 08, 2024, 10:47:31 pm
Sorry to post the same message as others, but I also cannot seem to find an active 2.65 FW link in the thread and I've been reading for a couple of hours. Would anyone happen to have it handy? I have a DSOx2K scope that was previously loaded with 2.5. Is the procedure just as simple as loading it onto the root of a USB still along with the lnk file? Thanks all.
I've got the same question... is that all? Just load it on via USB as normal? Or is there _anything_ else that needs to be done? Can I load it right on top of 2.35 firmware?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: xlslope on February 21, 2024, 10:41:14 am
If anyone could send me a PhillyFlyers's 3000T and 3000A's patched firmware and lnk,thanks a lot.
my e-mail addr is 502383998@qq.com.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: LA7SJA on February 21, 2024, 02:46:18 pm
For the unpatched firmware you only need the  *.ksx file.
for the patched firmware you need a infiniivision.lnk file in usb root containing the "patch parameters" like this:
146#infiniivisionLauncher.exe -l MSO -l WAVEGEN --perf -l D2000AUTB -l D2000GENB -l D2000BDLB -l BW10 -l BW20 -l SCPIPS -l PLUS -l VID -l CABLE -l ASV
or a shorter version that should do more or less the same.
50#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS

The latest (last) patched firmware is '2000XSeries.02.65.20210307001_patched.ksx'

"If your oscilloscope’s software version is prior to 2.41, you will need to change the suffix of the upgrade file from .ksx to .cab."
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: skander36 on February 28, 2024, 12:42:53 pm
Fw. ver. 2.66 is out.
https://www.keysight.com/us/en/lib/software-detail/instrument-firmware-software/installing-infiniivision-2000-xseries-oscilloscope-firmware-2014479.html (https://www.keysight.com/us/en/lib/software-detail/instrument-firmware-software/installing-infiniivision-2000-xseries-oscilloscope-firmware-2014479.html)
 Bug Fixes for both 2000A and 3000A
- Fixed issue in which saving a PNG 24-bit image does not work after recalling a setup file.
- Fixed issue where the phase measurement is incorrect after recalling a setup file with
different source settings.
Release Date: 1 February 2024
Instrument software version: Revision 2.66
File Names: 2000XSeries.02.66.20240123001.ksx,3000XSeries.02.66.20240123001.ksx

Later edit - Sorry I did not see that the info was reported few posts above.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on February 28, 2024, 03:05:40 pm

 Bug Fixes for both 2000A and 3000A
- Fixed issue in which saving a PNG 24-bit image does not work after recalling a setup file.
- Fixed issue where the phase measurement is incorrect after recalling a setup file with different source settings.

Thanks for the info..
Those were annoying problems, I am glad they got resolved.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: msuthar on March 02, 2024, 07:55:33 pm
DSO-X2004 with new firmware 2.66 with all features! it is still possible.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: J-R on March 02, 2024, 10:12:28 pm
DSO-X2004 with new firmware 2.66 with all features! it is still possible.
What is the method?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on March 03, 2024, 12:11:30 am
DSOX2000 and 3000 series are 13 years old now. They are like Fluke 89 now, LOL. Fluke 89IV was probably introduced in 2004, some 20 years ago.
I still do like my DSOX2002A, though. I bought it back in 2013. Nowadays I would probably buy a newer GW Instek, but I am not sure.

https://www.youtube.com/watch?v=S62G0F4B1q0&ab_channel=EEVblog (https://www.youtube.com/watch?v=S62G0F4B1q0&ab_channel=EEVblog)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: msuthar on March 03, 2024, 04:47:06 am
DSO-X2004 with new firmware 2.66 with all features! it is still possible.
What is the method?

Old methods found in this forum
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: J-R on March 03, 2024, 05:29:35 am
DSO-X2004 with new firmware 2.66 with all features! it is still possible.
What is the method?

Old methods found in this forum
Multiple methods have been discussed going back over 10 years and 130+ forum pages.  Which one specifically did you use?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: switchabl on March 03, 2024, 11:31:28 am
Presumably they patched infiniiVisionCore.dll in the WinCE image (manually). It is not exactly a secret that this is what all the more recent hacks do. You'd still need to find the correct offsets to patch for 2.66. There's probably not a step-by-step guide but I'm pretty sure there is enough information in this thread for someone with at least minimal reverse engineering experience to figure it out.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dfw_ee on March 11, 2024, 05:20:16 am
Hi, i've some news about unbrick the 4000A series..(maybe someone know that  :-+)
Inside the cab 7.31.2020012900 there is a special bin , named "recover.nk.bin.comp" you can decompress and than convert into  "recover.nb0". With that you can use teraterm and load with YMODEM and command "loady 0x0361000 115200"

With "go 0x00362000" starts one application that permit upolad a standard firmware and so on..

Now my request, I need an old firmware for the 4000A, can someone help me?
Online there is only 7.31.2020012900  :-\

Thanks for posting this info. My MSO-X 4054A would not boot up, It was hanging with only the "REF" button lit. I hooked up to the internal UART and saw the following:

 CeDecompressFlashBlock failed
****** Data record 91 corrupted, ABORT!!! ******

So as expected it confirmed the corrupted flash. I utilized "recover.nb0" as you have above and was able to unbrick the scope. Happy to have it working again! Thanks!!