DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[TheSteve]

Absolutely install version 2.50 to prevent further corruption.

[BaG]

Hi my friends;

Today I will try new experience with another DSOX-2014A with boot problem and it's a nand corruption. I would like to try Steve Guide but before doing something wrong I have some questions and I need your advice :

1- The motherboard of the DSOX2014A it's not the same like FrankBuss demonstrated and I need a confirmation from expert about TX RX position (see image attached)
2- Important point : did the RS232 TX RX Male (2,3) can work in this situation? as I see there are some difference in voltage output in forums. and did Cisco RJ45 console cable can work in this situation? because I don't have the adapter with 3.3V.
3- If it's work, I need to start Putty serial connection first before starting DSOX and wait response?? because DSOX bug very quickly after 1-Ref  2-Math 3-digital and that all.

Thank you so much for your help.

[Pinkus]

1) I do not know about the position on the DSOX2000 board. Somebody else must help.
2) DON'T / NEVER connect real RS232 Rx and Tx to the scope! The level will usually be somewhere between +- 5V and +-12V.
You MUST use a RS232-UART adapter with 3.3V signal level. Otherwise you will damage the microcontroller.
I do not know about this Cisco cable but it does not look like as there would be any electronics in it.
3) Yes, you will see immediate output after starting.

Hint: If you have a spare scope around, you should be able to measure the voltage level of your Cisco cable and also to find/check the Rx pin at your scopes motherboard. I am adding a picture (not mine - credits unknown) of the 3000a series, 2000 will probably the same connection scheme (though different position on the board).

[BaG]

Thank you a Lot Pinkus,

1- Maybe I found a solution for the Serial communication : I have a Raspberry PI 3 with UART_TXD0 and UART_RXD0 Pins 3.3V, I think I will try Putty in Unix to test the connection with DSOX.
2- in my DSOX image do you think serial is in J2701 pins or in J2300 holes ??

Any help are welcome, Thank you !!

Regards.

[Pinkus]

I do not know, but the two barley visible wires in layer 2 (which I marked red in my picture) will be very probably the UART lines. Thus the connection as shown should be correct.
But this is just a guess: you should measure the lines first!

[BaG]

Thank you Pinkus a lot, I confirm it's correct TX/RX for model DSOX2014A.

Raspberry PI it's an alternative for serial cable because it's provide 3.3V UART voltage. now everything is correct and DSOX started an working again  with TheSteve Guide  .

Thank you ALL so much for this great work  . best regards.

[syw6616]

DSOX2012? Using  " 3000XSeries.02.50.2019022736_patched.ksx",Why?

[PA0PBZ]

DSOX2012? Using  " 3000XSeries.02.50.2019022736_patched.ksx",Why?

I'm not sure what your question is but the firmware for the 2000 and 3000 series is the same.

[stafil]

Ok,

So let's try this again... please try them and let me know....

I did NOT put any of the 7.30 patches up, as I assume just going with the latest 7.31 is fine?  (I can put up 7.30 if anyone still wants it)



These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things


*** Note:  ***

Upgrading the firmware ALWAYS replaces the .lnk file with the stock one, I didn't look into putting our custom .ink files into the .CAB/.KSX file (even though I'm sure we can), so REMEMBER to SAVE OFF your .lnk file somewhere before doing the upgrade.  This way after the upgrade is done, telnet in and copy/move your .lnk file back over..


DSOX 1000X Series:  FW:  01.20.2019061038_patched  https://mega.nz/#!mjB0FAQa!8wYfTlHPuc4hF3UFPLoq0FOgylfsSVur4B5YSdCTn2I
md5: <5A48A3492AD5BB23336236FDC6A12738>

DSOX 2000X Series:  FW:  02.50.2019022736_patched  https://mega.nz/#!HiBAEIrZ!gydBKQMpH93kKwPUog3e2dGR1eWTIglZbL2kwd6dRxk
md5: <22E2508172382996B9ACF2852DB011F8>

DSOX 3000A Series:  FW:  02.50.2019022736_patched https://mega.nz/#!zmBkHCba!TK5Vf0N0LCeR3vYwx1fa41OekFXqg1psCYN-eagnvdY
md5: <CB931D537544D51D4EFFF44633506780>

DSOX 3000T Series:  FW:  7.31.2020012842_patched https://mega.nz/#!37BkWaCQ!JFJtIdT1p4m1BtULjw503jLpQDMjIV_cyzHRglBET-0
md5: <63DDE0129A9516C81DCF380F228BB08A>

DSOX 4000X Series:  FW:  7.31.2020012900_patched  https://mega.nz/#!7nQC0YYA!LN8kMBfHrh_OHCrrLKaHmJl6zxRhSQanycLwwnTLidA
md5: <6F94C7500AF7D129B28F75DD0E35AE9D>

Please let me know if there are any issues with any of these!

Just installing this firmware didn't help much for me for a DSOX3014T. Are there more steps needed other than using this firmware?

[BaG]

Hi friends,

One of my DSO-X3014A seems to have Calibration problem !! when I go to Cal Status : Failure: Factory Cal Failed !!  I explore the \secure\cal folder it's missing factorycal.dat !! I found only :
sernum.dat
framecal.dat
callog.txt

I am sure it's was factory calibrated before Nand Corruption and after correction each time I reboot the Scope I got the message : "Instrument is uncalibreated" !! and the auto scale not working any more message :"The Instrument must be calibrated".

I make a "User Cal" with BNC cables and everything passed fine but the message is not removed !!

Please my friends any chance to copy a new factorycal.dat from other Scope or there are a solution for this situation.

Thank you experts

[skander36]

Ok,

So let's try this again... please try them and let me know....

I did NOT put any of the 7.30 patches up, as I assume just going with the latest 7.31 is fine?  (I can put up 7.30 if anyone still wants it)



These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things


*** Note:  ***

Upgrading the firmware ALWAYS replaces the .lnk file with the stock one, I didn't look into putting our custom .ink files into the .CAB/.KSX file (even though I'm sure we can), so REMEMBER to SAVE OFF your .lnk file somewhere before doing the upgrade.  This way after the upgrade is done, telnet in and copy/move your .lnk file back over..


DSOX 1000X Series:  FW:  01.20.2019061038_patched  https://mega.nz/#!mjB0FAQa!8wYfTlHPuc4hF3UFPLoq0FOgylfsSVur4B5YSdCTn2I
md5: <5A48A3492AD5BB23336236FDC6A12738>

DSOX 2000X Series:  FW:  02.50.2019022736_patched  https://mega.nz/#!HiBAEIrZ!gydBKQMpH93kKwPUog3e2dGR1eWTIglZbL2kwd6dRxk
md5: <22E2508172382996B9ACF2852DB011F8>

DSOX 3000A Series:  FW:  02.50.2019022736_patched https://mega.nz/#!zmBkHCba!TK5Vf0N0LCeR3vYwx1fa41OekFXqg1psCYN-eagnvdY
md5: <CB931D537544D51D4EFFF44633506780>

DSOX 3000T Series:  FW:  7.31.2020012842_patched https://mega.nz/#!37BkWaCQ!JFJtIdT1p4m1BtULjw503jLpQDMjIV_cyzHRglBET-0
md5: <63DDE0129A9516C81DCF380F228BB08A>

DSOX 4000X Series:  FW:  7.31.2020012900_patched  https://mega.nz/#!7nQC0YYA!LN8kMBfHrh_OHCrrLKaHmJl6zxRhSQanycLwwnTLidA
md5: <6F94C7500AF7D129B28F75DD0E35AE9D>

Please let me know if there are any issues with any of these!

Just installing this firmware didn't help much for me for a DSOX3014T. Are there more steps needed other than using this firmware?

Hi Stafil ,
I don't know for sure if the process for the 3000 series is the same as for 2000 series , but after installing patched firmware , is not necesary to install v241_link_install.cab file from usb along with infiniivision.lnk ?

I think the procedure must be like this in post 2433 on page 88  - https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2932770/#msg2932770

If you already did that please ignore this post ...
 

[stafil]

Ok,

So let's try this again... please try them and let me know....

I did NOT put any of the 7.30 patches up, as I assume just going with the latest 7.31 is fine?  (I can put up 7.30 if anyone still wants it)



These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things


*** Note:  ***

Upgrading the firmware ALWAYS replaces the .lnk file with the stock one, I didn't look into putting our custom .ink files into the .CAB/.KSX file (even though I'm sure we can), so REMEMBER to SAVE OFF your .lnk file somewhere before doing the upgrade.  This way after the upgrade is done, telnet in and copy/move your .lnk file back over..


DSOX 1000X Series:  FW:  01.20.2019061038_patched  https://mega.nz/#!mjB0FAQa!8wYfTlHPuc4hF3UFPLoq0FOgylfsSVur4B5YSdCTn2I
md5: <5A48A3492AD5BB23336236FDC6A12738>

DSOX 2000X Series:  FW:  02.50.2019022736_patched  https://mega.nz/#!HiBAEIrZ!gydBKQMpH93kKwPUog3e2dGR1eWTIglZbL2kwd6dRxk
md5: <22E2508172382996B9ACF2852DB011F8>

DSOX 3000A Series:  FW:  02.50.2019022736_patched https://mega.nz/#!zmBkHCba!TK5Vf0N0LCeR3vYwx1fa41OekFXqg1psCYN-eagnvdY
md5: <CB931D537544D51D4EFFF44633506780>

DSOX 3000T Series:  FW:  7.31.2020012842_patched https://mega.nz/#!37BkWaCQ!JFJtIdT1p4m1BtULjw503jLpQDMjIV_cyzHRglBET-0
md5: <63DDE0129A9516C81DCF380F228BB08A>

DSOX 4000X Series:  FW:  7.31.2020012900_patched  https://mega.nz/#!7nQC0YYA!LN8kMBfHrh_OHCrrLKaHmJl6zxRhSQanycLwwnTLidA
md5: <6F94C7500AF7D129B28F75DD0E35AE9D>

Please let me know if there are any issues with any of these!

Just installing this firmware didn't help much for me for a DSOX3014T. Are there more steps needed other than using this firmware?

Hi Stafil ,
I don't know for sure if the process for the 3000 series is the same as for 2000 series , but after installing patched firmware , is not necesary to install v241_link_install.cab file from usb along with infiniivision.lnk ?

I think the procedure must be like this in post 2433 on page 88  - https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2932770/#msg2932770

If you already did that please ignore this post ...

Hey, thanks! I ended up getting a network card and following the steps your described. Basically just get the password from the password generator, telnet, and change the .lnk.

Thanks!

[skander36]

Hey, thanks! I ended up getting a network card and following the steps your described. Basically just get the password from the password generator, telnet, and change the .lnk.

Thanks!

Actually I used just the USB stick method .
As someone here said previously , I am just a parrot here . People that make this possible deserve thousands of thanks !
 

[pepperoni7]

Hi all,

first I want to thank all the contributors here doing a great job!
I have been following this topic as a silent reader almost from the beginning, but losing track here and then...
Now it's overwhelming to read through 100 pages!   

I searched this topic a lot for answers to my questions, but unfortunately I could not find the solution that I was looking for.
So maybe someone can help me?!

I was wondering if it is already possible to add the licenses/options to a MSOX3104T (i.e 3000T series) only by FW update via USB?
It's suggested that it could be done in post#2448, page 98 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2945740/#msg2945740)
by including the modified .lnk file, but obviously was not done yet. How could one implement the options in the .lnk permanently?

In post #2201, page 89 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363)
such a process is described, but it seems this is only valid for a 2000A (maybe also 3000A), but not confirmed for 3000T series. Am I wrong?

And either way... what would be the options settings for 3000T series?
Regarding newest FW 7.31, I suspect D3000BDLA and WAVEGEN should enable all possible SW/HW features. Are there other (hidden/secret) switches to enable, to get everthing to work? How would the .lnk file would look like?

Any light into the dark would be highly appreciated!
Thanks!

[stafil]

Hi all,

first I want to thank all the contributors here doing a great job!
I have been following this topic as a silent reader almost from the beginning, but losing track here and then...
Now it's overwhelming to read through 100 pages!   

I searched this topic a lot for answers to my questions, but unfortunately I could not find the solution that I was looking for.
So maybe someone can help me?!

I was wondering if it is already possible to add the licenses/options to a MSOX3104T (i.e 3000T series) only by FW update via USB?
It's suggested that it could be done in post#2448, page 98 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2945740/#msg2945740)
by including the modified .lnk file, but obviously was not done yet. How could one implement the options in the .lnk permanently?

In post #2201, page 89 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363)
such a process is described, but it seems this is only valid for a 2000A (maybe also 3000A), but not confirmed for 3000T series. Am I wrong?

And either way... what would be the options settings for 3000T series?
Regarding newest FW 7.31, I suspect D3000BDLA and WAVEGEN should enable all possible SW/HW features. Are there other (hidden/secret) switches to enable, to get everthing to work? How would the .lnk file would look like?

Any light into the dark would be highly appreciated!
Thanks!

You will have to mess about with the .CAB files.

The rough steps would be:

1. Download the patched version.

2. Rename it to .CAB and extract it

3. Go in the folder and extract infiniiVisionSetup.CAB

4. Go in that folder and open the "INFINI~1.064" file and add the options you need.

5. Save it and do the opposite of steps 3 & 2. I.e. re-create the CAB files.


Or just buy a LAN card and do it over telnet. That's what I did.

[pepperoni7]

You will have to mess about with the .CAB files.

The rough steps would be:

1. Download the patched version.

2. Rename it to .CAB and extract it

3. Go in the folder and extract infiniiVisionSetup.CAB

4. Go in that folder and open the "INFINI~1.064" file and add the options you need.

5. Save it and do the opposite of steps 3 & 2. I.e. re-create the CAB files.


Or just buy a LAN card and do it over telnet. That's what I did.

Thanx stafil,

the steps 1 -4 I could also find out in the meantime by myself.
But the Options in INFINI~1.064 are empty, although my scope tells me I have MSO, MEMUP, SGM, EDK, ADVMATH, DVMCTR and RML.
If I would miss these options in the -lnk file, would they get lost then or are they fixed in FW?

BTW, one of the main questions still is: What are the valid options to include in .lnk for a 3000T?
I found some hints here in this topic, but only saying "... 3000T uses same as 4000A" or vice versa, but no details 

Or can the .lnk file on a 3000T also be applied (using v241_link_install.cab) like described here?
Post #2201, (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363)

Thanx

[EE-digger]

Pepperoni7

With regards to our PM, here are the resulting options ...

[pepperoni7]

EE-digger,

thank you!

[stafil]

You will have to mess about with the .CAB files.

The rough steps would be:

1. Download the patched version.

2. Rename it to .CAB and extract it

3. Go in the folder and extract infiniiVisionSetup.CAB

4. Go in that folder and open the "INFINI~1.064" file and add the options you need.

5. Save it and do the opposite of steps 3 & 2. I.e. re-create the CAB files.


Or just buy a LAN card and do it over telnet. That's what I did.

Thanx stafil,

the steps 1 -4 I could also find out in the meantime by myself.
But the Options in INFINI~1.064 are empty, although my scope tells me I have MSO, MEMUP, SGM, EDK, ADVMATH, DVMCTR and RML.
If I would miss these options in the -lnk file, would they get lost then or are they fixed in FW?

BTW, one of the main questions still is: What are the valid options to include in .lnk for a 3000T?
I found some hints here in this topic, but only saying "... 3000T uses same as 4000A" or vice versa, but no details 

Or can the .lnk file on a 3000T also be applied (using v241_link_install.cab) like described here?
Post #2201, (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363)

Thanx

It's normal for the .lnk to not have an arguments in the original FW. The options are installed by the licenses.

Not sure about all the valid options. But when I would put a non valid options, it would just ignore it. So don't worry about it. The options I put for my case were:

MSO, MEMUP, SGM, BW20, EMBD and WAVEGEN as those were the ones I cared about.

Thanks,
Stavros

[tv84]

sorry, I am late to this party and I am still reading the thread from the start, but I cannot figure out what FERCSA hack is. I did a search in the thread but FERCSA doesn't show up. Could you please explain which hack you are referring to?

FERCSA's hack was done for the 1000X series. 

If I'm not mistaken, it's basically the same hack that is currently implemented in Rigol's MSO5000/7000 scopes: all the options available are enabled by default.

The difference between that hack and the current one that PhillyFliers applied to all KS models (that you all seem to be using in this thread) is that you don't need to mess with the .lnk file. Nonetheless I also like the simplicity of this hack.

[tv84]

The options that people usually activate in 3000/4000 are: DIS, MSO, BW20/BW50, VID, SCPIPS

Looking at this table, there are some options that none of you enable:

FPGAX, TEL, FRC and RAST

Has anyone experimented with them?

[arlvaljr]

I just want to report a tip I used to hack my MSOX 3022T.

After install the PhillyFliers modified update 7.31 (Thanks a lot to him) , I tried to place the new infiniivision.lnk to work on the "Secure\Startup" folder but it fails all the time, no matter the script I used. On every boot the scope just returned its original licenses.

In the other hand, after kill the running infiniivisionLauncher.exe on the scope and put a command to run the infiniivisionLauncher.exe with options directly from the Telnet , it worked perfectly opening every license requested.

Researching the internet about WinCE lnk files structure, I found a note about fail to transfer or copy WinCE 6.0 lnk files from a Windows 10 system, that was my case. In this note, there was a recommendation to transfer or copy the lnk files named as .txt file to the WINCE system and then, rename the txt file to lnk file from inside the WinCE system.

Also I noticed that the recommended structure for the WinCE lnk file was like the example bellow:

81#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l D3000BDLA - l WAVEGEN

Note the quotes around “\Program Files\infiniiVision\infiniivisionLauncher.exe".

The number in the beginning is just the total number of characters after the "#" sign ("\Program Files\infiniiVision\infiniivisionLauncher.exe" –l D3000BDLA - l WAVEGEN).

So, I placed my modified  .lnk file named as .txt on a USB drive, and via Telnet renamed the original Secure\Startup\infiniivision.lnk file to Secure\Startup\infiniivision.bak, copied from the USB drive plugged on the scope the new infiniivision.txt file to the Secure\Startup folder and then, also via Telnet, renamed the infiniivision.txt to infiniivision.lnk. “BINGO”, all options were enabled together with the already installed licenses at the scope boot up.

Regarding the options, the D3000BDLA is the new bundle name to enable all possible options. Only need to add the WAVEGEN, that is not part of the new bundle. For reference download the May 2019 revised User Manual from Keysight, and check on “License Options Available” (stays around page 399 of User Manual), for the old license names and the replacement new licenses available. Of course, the old names still works but, use just one option name is easier  .

Sorry for the long text, but may be usefull.

[pepperoni7]

Think it rather should be
80#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l D3000BDLA -l WAVEGEN
instead of
81#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l D3000BDLA - l WAVEGEN

[arlvaljr]

Correct Pepperoni7 I wrote an extra space after the minus simbol on this post by mistake. Should't have this space and the count goes to 80 not 81.

The file I installed on my Scope is correct and working.

I used the "010 Editor" to easy count the number of characters when I was preparing the post example, I didn't realize about the extra space.

Sorry for the mistake  .

[arlvaljr]

Regarding the list of options I downloaded the "User Manual" in English and took pictures from the list of options to show which replaces which one.

The post of tv84 have more options but several of them do not work on my model and there are some that becomes annoying like the DIS (Distribution). When I tried the DIS, as the license is installed every boot, it brings a demonstration screen that need to be switched off every boot.

Most of the licenses on the tv84 post, which works on my model (MSOX 3022T), seems to be inside of one of the new options given in the User Manual.

Sincerely, I am very happy with the D3000BDLA and WAVEGEN options, there is a lot o functionalities to be searched on them for a while.

PS: The -l ALL still works if wanted.