DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[plesa]

The warning message about firmware issue remains on screen all the time, or only seen after boot?

Georg

P.S. I waiting for my DSOX3032.

Only after boot up, you need to press button to accept it. And the self test did not passed. But we did not encountered any issue with hacked software.

[troth]

Any news/comments about the 2.36 FW shipping on newer scopes (as per https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097)?

No, but the user who reported this firmware has only three post and seems to be no longer online. He did not tried the downgrade to 2.35.

I'm still following this thread, but haven't had anything to contribute to the discussion, so have been lurking.

I'm reluctant to downgrade the FW without a path back to the factory FW or a newer FW. I've been watching the agilent website for newer firmware (since 2.35 was released in june, I was hoping there'd be some update soon-ish).

A few weeks ago I wrote a python script that takes the 2.35 cab and explodes it and explodes the cab file within then uses the setup.xml file to populate the Secure directory with the right names and structure. Then the script modifies and creates all the files needed for the hack. Would not be hard to extend it to automate the population of a USB flash drive.

The script is currently in a private git repo on bitbucket.org. I haven't made it public since I have no way of verifying it's correctness and thus didn't want to inflict it on anyone. I can easily make it public if anyone is interested. It currently only works on Linux, put I don't think it would be difficult to port to Windows. I wrote it to avoid having to use the non-free cab program on windows since I'm much more of a Linux geek.

[GregerG]

Only after boot up, you need to press button to accept it. And the self test did not passed. But we did not encountered any issue with hacked software.

It should pass all self tests and calibrations... at least they do pass fine for me...

[travisc]

My new DSO-X-3034A arrived today.  It had firmware 2.35 installed.  It's now 500MHz and fully optioned up thanks to this thread.

Thank you everyone that worked on this!!!

A few notes that might be helpful to others...

I had to add BW50 to the startup shortcut to upgrade from 350MHz to 500MHz.  I thought the -l All would cover that but apparently not.  So my infiniivision.lnk file is now ...

Code: [Select]

62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS -l BW50
The file structure of my startup drive is slightly different than a post I was comparing to in this thread.  It was missing a few indents which threw me for a bit.  The correct structure is ...

Code: [Select]

\
+-infiniiVision
  +-fpga
  +-upgrade
  +-web
     +-css
     +-help
     +-image
     +-include
     +-web-socket-js
     +-lib
     +-Lxi
        +-Identification
     +-navbar
+-Startup
infiniivisionStartupOverride.txt

I had to use a 4GB flash drive, an 8GB I tried at first didn't work.

When using WinCE CAB Manager I also had to turn on "Simulate Folder Names" when extracting the files to get the correct structure.

Thanks again!

[plesa]

This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

[taemun]

I'm still following this thread, but haven't had anything to contribute to the discussion, so have been lurking.

I'm reluctant to downgrade the FW without a path back to the factory FW or a newer FW. I've been watching the agilent website for newer firmware (since 2.35 was released in june, I was hoping there'd be some update soon-ish).

Do you have the Ethernet option? Can you poke around in Telnet?

[troth]

Do you have the Ethernet option? Can you poke around in Telnet?

Unfortunately, I do not have the Ethernet module and it's not in the budget to buy any upgrades until later in the year.

[RF-Engineer]

This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

I've seen references to 255#, 256#, 62#.  What do these prefix numbers mean?

[RF-Engineer]

Only after boot up, you need to press button to accept it. And the self test did not passed. But we did not encountered any issue with hacked software.

It should pass all self tests and calibrations... at least they do pass fine for me...

Interesting.  After boot-up, you don't see a red-colored firmware error message?  How did you do that?

[plesa]

Do you have the Ethernet option? Can you poke around in Telnet?

Unfortunately, I do not have the Ethernet module and it's not in the budget to buy any upgrades until later in the year.

Please do not use hacked scope for business, it is for home/ non commercial use only!!

[plesa]

This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

I've seen references to 255#, 256#, 62#.  What do these prefix numbers mean?

Read the whole thread. Briefly it is ammount of characters in link.

[ZeroAviation]

Hi guys,

So I have read the whole thread. I want to make sure I understand something correctly though.

You can use the shortcut's without modifying the dll? Is that correct?

Thanks all for your work on this.

-Matt

[plesa]

Hi guys,

So I have read the whole thread. I want to make sure I understand something correctly though.

You can use the shortcut's without modifying the dll? Is that correct?

Thanks all for your work on this.

-Matt

No, you need to modify InfiniivisionCore.dll, this will unlok the options which needs to be selected in the link file.

[RF-Engineer]

This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

I've seen references to 255#, 256#, 62#.  What do these prefix numbers mean?

Read the whole thread. Briefly it is ammount of characters in link.

I see that now in your message #282.  However "wersi" used #62 with many switches after, totalling much more than 62 characters.  I've been making changes without changing that parameters and the functions still seem to work.  Perhaps the firmware error message goes away with the correct character count?

To deal with the firmware error message, I used the hex editor that now shows "all options intialized and enabled..."  Same when the scope finishes booting.  This sure does look like a factory issue that way!



 

[plesa]

There were several request for the digital probe schematic.The original probe cannot be dissassembled without damage.
So I just found schematic in the Agilent documents
http://cp.literature.agilent.com/litweb/pdf/5968-4632E.pdf
I saw lot of the probes on ebay and grabbers as well, pretty cheap.
The type is N6459 (8 channels) and N6450 (16 channels)

[RF-Engineer]

There were several request for the digital probe schematic.The original probe cannot be dissassembled without damage.
So I just found schematic in the Agilent documents
http://cp.literature.agilent.com/litweb/pdf/5968-4632E.pdf
I saw lot of the probes on ebay and grabbers as well, pretty cheap.
The type is N6459 (8 channels) and N6450 (16 channels)

I see many used Agilent "E" series logic probes available.  Anyone know if these are pin-for-pin compatible with the Agilent "N" series for the DSOX/MSOX?

[nowlan]

Did anyone look inside the lan/vga adapter?
Not just simple resistors?

[RF-Engineer]

This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

I noticed that when the three relevant files are uploaded direct to the DSOX from the USB stick, the "*" in front of each option in in "About Oscilloscope" is removed as well when using prior characters strings as described in earlier posts.     

[Sbampato12]

I've dissembled a logic probe, but I didn't take a good camera yet.
ASAP, I will put the photos from it.

[kilobyte]

I also found this documentation some times ago.

the Probes with grabbers are not so expensive on ebay.
In the company where i work we have an old E9340A with that 16 channel probes and i mean that i have measured something between the grabbers and the input pins for the flat cable.
But this was some month ago and i can't remember me for the exact value, i think i have measured round about 90kohms.

But now something other:
while i was analysing the dll for the DSOX4000 series i found a different word CAKE in the source.
Is there someone with a DSOX4000 that can try this word in the Screensaver Usertext?

[Isamun]

Did anyone look inside the lan/vga adapter?
Not just simple resistors?

Dave did a teardown:


LAN goes straight to a MagJack. The VGA part has a bit more to it (screen buffer, driver and fpga for timing)

[RF-Engineer]

Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600.  I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit.  Impeccable timing, isn't it?   Can anyone else spot its availability?   

[grego]

I've been trying to get this to work for a while now - I've tried 3 different USB sticks (1G, 2G and 32G), I've got everything extracted:

infiniiVision/
Startup/
infiniivisionStartupOverride.txt

At the root of my stick.  The Override.txt file just contains "True" on a single line.  The .dll has been modified.  The .lnk file has been altered per instructions.

With the stick in I can see it being accessed when the scope is starting up, after a second or two from reading from it though it moves immediately into it's normal boot cycle and then comes up clean on the internally installed firmware.  Any suggestions?

I'm messing with this just to see how it all works - I actually have licenses installed for the things I really use but this is more intellectual curiousity now and it's frustrating when things don't work. ;-)

Thanks.

[taemun]

With the stick in I can see it being accessed when the scope is starting up, after a second or two from reading from it though it moves immediately into it's normal boot cycle and then comes up clean on the internally installed firmware.  Any suggestions?

Which FW are you on?

[plesa]

In attachment is the USB folder structure including the .lnk files for fully enabled licenses and also for automatic copy to flash. Which will not require the presence of USB flash plugged.
You just need to unpack the InfiniiVisionSetup.CAB with the WinCE CAB MAnager ( just press right mouse button on files and select Extract and choose Simulate Folder Names)
Copy the files intoprepared folder structure inside Infiniivision folder.
And choose and rename if necessary the file in the Startup folder ( by default is set the full licence set for 3k series).
The scope should contains firmware 2.35.
Turn scope with this USB flash on.