DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[Howardlong]

Has anyone had any luck doing USB HS triggers or decode on the 3104T?

I can get full- and low-speed to work no problem.

I'm using an 1130A calibrated 1.5GHz probe with E2675A differential browser with 01131-62102 91 ohm tips. Scope's calibrated and passes self test. The same happens with an 1131A 3.5GHz probe with differential browser.

An MDO4104C with P6330 3.5GHz differential probe & TPA-BNC adapter decodes just fine.

Screenshots attached...

[Howardlong]

Has anyone had any luck doing USB HS triggers or decode on the 3104T?

I can get full- and low-speed to work no problem.

I'm using an 1130A calibrated 1.5GHz probe with E2675A differential browser with 01131-62102 91 ohm tips. Scope's calibrated and passes self test. The same happens with an 1131A 3.5GHz probe with differential browser.

An MDO4104C with P6330 3.5GHz differential probe & TPA-BNC adapter decodes just fine.

Screenshots attached...

I installed the USB trial licence, and it turns out it's a bug, USB HS trigger/decode doesn't work yet on MSOX3104T, this from KeysightCare Technical and Application Support:

We could reproduce the issue and found out that the 4000A x-series scope is working fine, but the 3000T x-series scope, which you use, is not and we also got the red lines. Therefore we logged a defect report to our R&D and they will fix it in the next releases. To set the priority to our R&D correctly, could you please let me know if you have any deadline in your projects that prevents you from doing your work or are you able to work with the TEK scopes while we are fixing the issue?

Thank you very much for bringing this to our attention. We are always looking forward to customers feedback to improve our software and hardware.

[Howardlong]

Turns out it's a bit more than a bug...

Unfortunately I don't have good news to share.

R&D looked into the issue with the 3000T x-series scope and USB 2.0 HS and found out that 3000T x-series scopes can’t support USB High Speed due to HW limitations. SW support for USB HS was accidentally added in the 7.35 GUI along with the intended and working USB LS and FS support.

In summary, USB LS and FS all work in the following.  As far as USB HS…
•   The 3000T Series FPGA cannot handle USB HS.
•   The 4000X Series has a secondary FPGA that handles USB HS in 1GHz+ models
•   The 6000X Series can handle USB HS it in its main FPGA.
R&D is investigating the changes to remove USB HS support from the 3000T Series GUI (targeted for the 7.50 release) while Marketing is reviewing the changes needed to customer facing documents.

My apologies for the mistake which we did in our documentation and software. This will be corrected soon.

Do you also have a 4000X or 6000X series scope from us?

Let me know if I can assist you any further in getting a 4000X or 6000X scope from one of our partners in the UK or with any other question. I hope we didn't loose your trust and you are still interested in ditching the TEKs

[2N3055]

Turns out it's a bit more than a bug...

Unfortunately I don't have good news to share.

R&D looked into the issue with the 3000T x-series scope and USB 2.0 HS and found out that 3000T x-series scopes can’t support USB High Speed due to HW limitations. SW support for USB HS was accidentally added in the 7.35 GUI along with the intended and working USB LS and FS support.

In summary, USB LS and FS all work in the following.  As far as USB HS…
•   The 3000T Series FPGA cannot handle USB HS.
•   The 4000X Series has a secondary FPGA that handles USB HS in 1GHz+ models
•   The 6000X Series can handle USB HS it in its main FPGA.
R&D is investigating the changes to remove USB HS support from the 3000T Series GUI (targeted for the 7.50 release) while Marketing is reviewing the changes needed to customer facing documents.

My apologies for the mistake which we did in our documentation and software. This will be corrected soon.

Do you also have a 4000X or 6000X series scope from us?

Let me know if I can assist you any further in getting a 4000X or 6000X scope from one of our partners in the UK or with any other question. I hope we didn't loose your trust and you are still interested in ditching the TEKs

Well, I don't buy it..

They created D3000USBB USB 2.0 Trigger and Decode for 3000T X-Series license type, datasheets, and whole infrastructures...

You tell me they did all that and didn't test it just a bit.. You managed to find a problem, in what, 2 hours....

It's either political, or we have a bigger problem, that they don't test as they used to....

Anyways, I saved some money...

[tv84]

Sinisa,

It's just HS limitation, or I'm seeing it wrong?

[2N3055]

Sinisa,

It's just HS limitation, or I'm seeing it wrong?

No  I think you're right.. Only HS is problem. If it is technical, this is one place where hardware decode is a problem, not a solution..

[Howardlong]

You tell me they did all that and didn't test it just a bit.. You managed to find a problem, in what, 2 hours....

Probably in total. I went back to it about three or four times... sometimes it's, you know, operator error. Sleeping on these things or trying it a day or two later you sometimes get a light bulb switch on in your head.

I have to say when I put in the ticket originally, I was still pretty sure they were going to tell me it was operator error.

As previously mentioned in my note on 18th, yes, it does work in both LS & FS. It's just HS that's the problem. It'd be a bit of a pain if you'd shelled out for both the option and a diff probe...

[TheSteve]

Turns out it's a bit more than a bug...

Unfortunately I don't have good news to share.

R&D looked into the issue with the 3000T x-series scope and USB 2.0 HS and found out that 3000T x-series scopes can’t support USB High Speed due to HW limitations. SW support for USB HS was accidentally added in the 7.35 GUI along with the intended and working USB LS and FS support.

In summary, USB LS and FS all work in the following.  As far as USB HS…
•   The 3000T Series FPGA cannot handle USB HS.
•   The 4000X Series has a secondary FPGA that handles USB HS in 1GHz+ models
•   The 6000X Series can handle USB HS it in its main FPGA.
R&D is investigating the changes to remove USB HS support from the 3000T Series GUI (targeted for the 7.50 release) while Marketing is reviewing the changes needed to customer facing documents.

My apologies for the mistake which we did in our documentation and software. This will be corrected soon.

Do you also have a 4000X or 6000X series scope from us?

Let me know if I can assist you any further in getting a 4000X or 6000X scope from one of our partners in the UK or with any other question. I hope we didn't loose your trust and you are still interested in ditching the TEKs

Maybe they want to trade your MSOX3104T for a MSOX4104A

[TK]

USB HS is a complex protocol, very verbose and probably cumbersome to debug on a DSO screen, except for some specific bug chasing using triggers.  I use an old Lecroy CATC USB 2.0 protocol analyzer I got on eBay for around $150 and software is still available for download from Lecroy and it runs on Windows 10.  It can capture full USB HS and some units even comes with exerciser that allows you to generate USB signals.

[2N3055]

Turns out it's a bit more than a bug...

Unfortunately I don't have good news to share.

R&D looked into the issue with the 3000T x-series scope and USB 2.0 HS and found out that 3000T x-series scopes can’t support USB High Speed due to HW limitations. SW support for USB HS was accidentally added in the 7.35 GUI along with the intended and working USB LS and FS support.

In summary, USB LS and FS all work in the following.  As far as USB HS…
•   The 3000T Series FPGA cannot handle USB HS.
•   The 4000X Series has a secondary FPGA that handles USB HS in 1GHz+ models
•   The 6000X Series can handle USB HS it in its main FPGA.
R&D is investigating the changes to remove USB HS support from the 3000T Series GUI (targeted for the 7.50 release) while Marketing is reviewing the changes needed to customer facing documents.

My apologies for the mistake which we did in our documentation and software. This will be corrected soon.

Do you also have a 4000X or 6000X series scope from us?

Let me know if I can assist you any further in getting a 4000X or 6000X scope from one of our partners in the UK or with any other question. I hope we didn't loose your trust and you are still interested in ditching the TEKs

Maybe they want to trade your MSOX3104T for a MSOX4104A

Yeah, if they'll do it for the price of USB option.. I'll be interested too... 

[2N3055]

And a question to gurus here:

what is MSOX3104G ?

What kind of model is that?

[tsmith35]

what is MSOX3104G

Just Google for this: Keysight "G models"

Looks like it indicates the inclusion of "Frequency response analysis - Bode plot"

[2N3055]

what is MSOX3104G

Just Google for this: Keysight "G models"

Looks like it indicates the inclusion of "Frequency response analysis - Bode plot"

Read carefully. A MSOX3104G, a 1 GHz MSO device from 3000 series with a G suffix....not a 3000A or 3000T but 3000G device..
Of course I googled first...

[Howardlong]

USB HS is a complex protocol, very verbose and probably cumbersome to debug on a DSO screen, except for some specific bug chasing using triggers.  I use an old Lecroy CATC USB 2.0 protocol analyzer I got on eBay for around $150 and software is still available for download from Lecroy and it runs on Windows 10.  It can capture full USB HS and some units even comes with exerciser that allows you to generate USB signals.

They are two different tools, like a hammer and a screwdriver.

I have a Teledyne Lecroy Mercury T2C to trigger the scope to determine latencies in USB driver code. The Lecroy analyser software is useless for seeing timing trends and bandwidth utilisation on its own.

[ikutyrev]

Hi guys,

I'm trying to save a DSO-X 2012A with suspected NAND flash issue, before dealing with sending it to Keysight (already had a bit of back and forth with them and that RMA setup is ongoing...).

I'm trying to boot off a USB drive so that I can just boot in once and then update firmware to the latest one. So far I haven't had any luck booting off flash drive, wanted to check here to see if I'm missing any steps.

My process so far:
-Take a fresh flash drive, formatted FAT16
-Create file infiniivisionStartupOverride.txt with content "True" (excluding quotations)
-Extract contents of 2000XSeries.02.35.2013061800 to flash drive
-Plug in flash drive, power on scope

It seems to try something with the flash drive, I see some activity on the flash drive LED, and then the scope just cycles through the button LED's and does nothing. This is different from powering the scope without a USB, it will attempt to boot then power cycle. When I had the UART debug connected it would read the flash drive, but gave some error message that made it seem like I had missed something in the file structure. I have the UART cable removed for now, or I'd pull up the exact output. I've tried a few different flash drives, all with the same result.

The posts I've seen on booting from USB mentioned unpacking the CAB inside the firmware contents and editing some data, but that seemed oriented towards unlocking features, which I'm not trying to get into (yet), just get the scope working. Also, opening up that CAB shows a bunch of files ending in 3-digit numbers, no folder structure.

Anything I'm missing here?

[TK]

Hi guys,

I'm trying to save a DSO-X 2012A with suspected NAND flash issue, before dealing with sending it to Keysight (already had a bit of back and forth with them and that RMA setup is ongoing...).

I'm trying to boot off a USB drive so that I can just boot in once and then update firmware to the latest one. So far I haven't had any luck booting off flash drive, wanted to check here to see if I'm missing any steps.

My process so far:
-Take a fresh flash drive, formatted FAT16
-Create file infiniivisionStartupOverride.txt with content "True" (excluding quotations)
-Extract contents of 2000XSeries.02.35.2013061800 to flash drive
-Plug in flash drive, power on scope

It seems to try something with the flash drive, I see some activity on the flash drive LED, and then the scope just cycles through the button LED's and does nothing. This is different from powering the scope without a USB, it will attempt to boot then power cycle. When I had the UART debug connected it would read the flash drive, but gave some error message that made it seem like I had missed something in the file structure. I have the UART cable removed for now, or I'd pull up the exact output. I've tried a few different flash drives, all with the same result.

The posts I've seen on booting from USB mentioned unpacking the CAB inside the firmware contents and editing some data, but that seemed oriented towards unlocking features, which I'm not trying to get into (yet), just get the scope working. Also, opening up that CAB shows a bunch of files ending in 3-digit numbers, no folder structure.

Anything I'm missing here?

Follow instructions posted here: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181

[ikutyrev]

I tried to follow those instructions, but I'm only given a few options for actions, not allowed to enter any commands. I've attached a txt file of the output I get when holding down space on power on. Pressing "u" to enter U-boot just ends in a HW reset.

I've reconnected the TTL UART cable, the message given after it reads the USB (when I'm trying to boot off USB) is "Incorrect Parameters" then it just spins for a while, and eventually power cycles.

EDIT: empty file uploaded, see next post

[TheSteve]

The file you attached is empty with no contents.

I tried to follow those instructions, but I'm only given a few options for actions, not allowed to enter any commands. I've attached a txt file of the output I get when holding down space on power on. Pressing "u" to enter U-boot just ends in a HW reset.

I've reconnected the TTL UART cable, the message given after it reads the USB (when I'm trying to boot off USB) is "Incorrect Parameters" then it just spins for a while, and eventually power cycles.

[ikutyrev]

Sorry, fixed file attached to this post

[Bud]

infiniivisionStartupOverride.txt function changed time ago, it won't work with newer firmware in the way you expect.

[wp_wp]

Sorry, fixed file attached to this post

In this situation,you can not see P500 prompt.
You need upload kernel file by Ethernet to scope.

[Volchenok82]

Hello everyone!
 
I skimmed through this topic, but I still don't quite understand how I can unlock my device! 

There is an MSOX3024T oscilloscope with an installed DSOXLAN module and a set of the following options: MSO, MEMUP, SGM, BW20, EDK, ADVMATH, DVMCTR, RML.
The device is manufactured in 2016. I updated the factory firmware (I don't remember the revision) long ago to version 7.30.2019051434. And then I read your messages and got fired up with the idea of ​​how to completely unlock it ...

I have not tried Telnet access yet - this option is more difficult for me.
After reading PhillyFlyers' answer # 2746, I tried to install the original new firmware 7.40.2021031200 on it first, and then uploaded the patched version of the same firmware to it. I used the following set of parameters in the .lnk file:
90 # infiniiVisionLauncher.exe -l D3000BDLB -l BW20 -l SCPIPS -l SEC -l MSO -l MEMUP -l WAVEGEN

The firmware got up without any problems, but the set of options in the device remained the same!

I also tried to slip him an earlier patched firmware 7.35.2020120822 with a different set of parameters:
106 # "\ Program Files \ infiniiVision \ infiniiVisionLauncher.exe" -l D3000BDLA -l BW35 -l SCPIPS -l SEC С -l WAVEGEN

Music again failed! 

Maybe I'm doing something wrong? I put both files (firmware and shortcut) on an empty medium, and then feed them to him ... But after flashing and rebooting, the device returns to me with a set of the same options ...


Please help me figure out how to hack it!

[TK]

There should be no space before and after the # character in the .lnk file

[Volchenok82]

Thanks for the answer! Then the parameter string should look like this:

90#infiniiVisionLauncher.exe -l D3000BDLB -l BW20 -l SCPIPS -l SEC -l MSO -l MEMUP -l WAVEGEN

107#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW35 -l SCPIPS -l SEC С -l WAVEGEN


Tell me, do you need to specify only additional options in the parameter line, or should all existing ones also be prescribed?
Does it make a difference which form of writing the string to use - the first or the second?
...

[Volchenok82]

I did it, I did it !!!
Many thanks to everyone, especially PhillyFlyers and his team!
The most recent firmware they patched works as it should!