DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[TheSteve]

Yes, that is typical NAND corruption.

[NEDM64]

Okay, that´s the result I get....

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2011-08-24  22:35:34 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    36045 Bytes = 35.2 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Aug 24 2011 15:15:48
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOXOXOOOOERROR: Checksum failure (expected=0x167CF58  computed=0x167D64E)
****** Checksum failure on record 13, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------

• : Address=0x80361000  Length=0x13064E8  Name="" Target=RAM

 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1600000

BL_IMAGE_TYPE_UNKNOWN

 Loading image 2 failed, trying next one
 All images failed

Press r to reset

NAND or no NAND Failure?

Hi! Where did you connect the TX/RX lines?

I also have a scope (DSOX2002A) with apparently NAND corruption...

[dagolard]

Read this...

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895

[analogRF]

I have a quick question
Can 350MHz 4000A series be upgraded to 500MHz with only a license? The last page of the 4000A datasheet
does not have this particular upgrade in the table and all the others require sending to service center so I got confused...
just to be sure, the methods discussed in this thread can upgrade BW on 4034A to 500MHz, am I correct?

[Venturi962]

"Can 350MHz 4000A series be upgraded to 500MHz with only a license?"  Yes.  I did the HW mod on a 4024A and used the BW50 License to enable 500MHz bandwidth:

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3497278/#msg3497278

memset describes the strapping here:

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1115301/#msg1115301

[analogRF]

oh and one more question about 4000A. Can 350/500MHz model trigger and decoce on USB (LS/FS/HS?)
it is a bit confusing because I saw a video that the guy used 4024A to decode USB but then the datasheet says only >1GHz models can do that
so if someone can clarify it would be great.

[analogRF]

is there any ftp access to the WinCE file system on 2000A/3000A/4000A?
I know there is a telnet that people use for upgrading or unbricking (I did that via UART) but is there a ftp access
that allows to transfer files from/to the scope?

[Venturi962]

I have access to LS / FS USB decoding on mine.  Perhaps HS is tied to Scope Bandwidth. 

Easiest way to transfer files is with USB, will appear as a directory over Telnet.

[analogRF]

I have access to LS / FS USB decoding on mine.  Perhaps HS is tied to Scope Bandwidth. 

Easiest way to transfer files is with USB, will appear as a directory over Telnet.

thanks. yes it seems LS/FS are ok on all models but HS needs an extra FPGA to be on the board and is only available in 1G/1.5G models

so when you telnet you can copy any system file on USB?

[Venturi962]

Yes, can copy files using 'copy' command

[wheedal]

Re: MSO logic analyzer function cables
Nice! --someone on Ebay has new old stock 54620-61601 kits for $80.
------------------------------
and Gone.
wow, that was fast --they had quite a few --someone bought them all.  Guess I'm glad I got mine

[Howardlong]

I have access to LS / FS USB decoding on mine.  Perhaps HS is tied to Scope Bandwidth. 

Easiest way to transfer files is with USB, will appear as a directory over Telnet.

Yes, you need (a) 1GHz sample rate or greater and (b) at least a 4000A. HS doesn't work on a 3000T. There's no USB trigger/decode at all on 3000A or 2000.

There is some marketing material out there that suggested the 3104T would support it. When I evaluated it, I couldn't get HS to work, although the DUT decoded fine on a Tek MDO4000.

In the end it turned out to be an error in the marketing material.

Even with HS, you're still going to need expensive diff probes.

[lastguy]

Where can I found instructions on how to use PhillyFlyers' patches? which eth card or telnet etc s/w tool shall I use? do I need to hard wire the serial port on PCB? Do I still need USB boot when power cycle?

Highest affordable one for me might be 2000x, I'm a slave of Fannie&Freddie.  SynGen h/w is built in but no AWG capability? Can 2CH be upgraded to 4CH? DSO2002a (not MSO) can also unlock logic channel?
I looked h/w modification, photos seems to be 3000x, are they same for 2000x? Digikey 0603 resistors needs 5K pcs, aliexpress kit are E24. Where did you get parts from ? I'm in California.

More important, acc name and passwd for telnet?

thanks the building is too high to climb might take me months。

 

[dagolard]

My scope is back. Repaired and calibrated.

Now a question: is there a "easy way" to activate missing licenses? Actually I have only MSO, BW10, EDK, DVM and RML.
I.e. OSV and the Generator I would like to have...

[CebroEtec]

hello!


I have a DSO-X-2002A oscilloscope with problably a NAND problem, but i am not sure, could you guys help me? It stays like in the picture below...

I have some USB to TTL boards, could i connect it to the points in the pcb of the oscilloscope and conect via usb port in my pc to check the boot problem or i am missing something?

[TK]

hello!


I have a DSO-X-2002A oscilloscope with problably a NAND problem, but i am not sure, could you guys help me? It stays like in the picture below...

I have some USB to TTL boards, could i connect it to the points in the pcb of the oscilloscope and conect via usb port in my pc to check the boot problem or i am missing something?

Get the 3.3V version of the USB to TTL adapter or board.  USB voltage still 5V, but RX and TX levels must be 3.3V

[YetAnotherTechie]

start here https://www.eevblog.com/forum/testgear/agilent-dsox3054a-not-booting-possible-nand-corruption-help!/msg3449794/#msg3449794
and go here too
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181

Search "eevblog nand" on google and "keysight nand" here on the top right.
Your very first action should be make a full backup of the nand, before you start issuing commands that change the flash system.  It's a filesystem, and it's corrupted, every write is unpredictable, even reading is dangerous if the system does on the fly ECC writes. If you don't have a backup and discover that your factory calibration or identity files are corrupted or missing no one will be able to help you.

[CebroEtec]

Thank for the advices!

So, I will connect my USB to TTL board using 3.3v for the oscilloscope pcb.

@YetAnotherTechie, thanks for the help. I am reading all the posts in this sub since a week ago, and i am learning a lot! But I do not remember anyone saying how can we backup the NAND, or am i missing something? What i understood was that by the serial connection we can read the system doing the boot up, and uploading new firware files, am i wrong?

[YetAnotherTechie]

its in the code section of the first message of the first link i gave you......
also see
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1021864/?topicseen#msg1021864
stop uboot enter "help"
use commands bdinfo, coninfo, flinfo,fsinfo,iminfo,imls,printenv to get information.

use nand info
from there nand read to the offset of free ram mentioned in the posts, and transfer to the pc, using "saves"

Unless you've used putty before i recommend you practice using it somewhere else, or use another program, it's very easy to let muscle memory make a right click, and in putty that pastes everything on the clipboard to the command line followed by enter. It's a Murphy incarnated.

[dagolard]

Nobody? 

[TK]

Nobody? 

Nobody?  There is plenty of information on this exact same thread on how to achieve what you are looking for. If by “easy way” you mean not even looking back posts, then you will not get any help here..,

[dagolard]

These are 115 pages, and english isn´t my native language. That´s why a hint to the page would be helpful. But if you don´t want to help simply ignore my request.

By the way: even I helped others with a link, see page 114... 🙄
 

[TK]

These are 115 pages, and english isn´t my native language. That´s why a hint to the page would be helpful. But if you don´t want to help simply ignore my request.

By the way: even I helped others with a link, see page 114... 🙄

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3562918/#msg3562918

[lastguy]

These are 115 pages, and english isn´t my native language. That´s why a hint to the page would be helpful. But if you don´t want to help simply ignore my request.

By the way: even I helped others with a link, see page 114... 🙄

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3562918/#msg3562918

TK,
thanks I did see this while I'm still climbing the floor.
I tried to telnet using Eth card, holding down space while boot scope, yet whenever the remote session got activated on my laptop, the scope boot already done, so I see ">" then no cmd can be used. (1st msg is "Welcome to Keysight...")

Anybody can package installed folder of cab mgr and upload here? the company is not more thus no download - all US web just link to this co.
Another question is, what is the last version can boot from USB?

thx for any help

[lastguy]

These are 115 pages, and english isn´t my native language. That´s why a hint to the page would be helpful. But if you don´t want to help simply ignore my request.

below is initial steps, then read the link TK given above for latest s/w.
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg322242/#msg322242

do you have the cab mgr s/w? if yes then you can export the .cab (use 7zip for release file first) and modify the .lnk file by adding at the end:-l All -l BW20 -l SCPIPS
a safe way is to boot from USB, I've not able to try whether it is ok for latest version. what's your s/w version?

simplest way as you asked is on floor #301: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/300/