DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[PhillyFlyers]

Has anyone tried getting into UBOOT on their 3kT, 4k, or 6k series scopes recently, and had success?
(I can still get into mine, but it's a 3024A)

Some here have been have no success trying to break into UBOOT with DSOX6000x and 3000T, just curious if anyone else has experienced this? 
(I don't know if there were any changes made to uboot over the last few years... )

[Phoenix6478]

Hi Everyone

Thank you for this great thread and the efforts put into the modified firmware!

I will soon get an Agilent MSO-X 3014A and I would like to enable all options. I read a lot on this thread already and I think i know how to do it, but i would be thankful if you could check my approach again.

1.) Download the modified Firmware for the 3000A from this Post and put it on the root of the USB flash drive: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3926996/#msg3926996

2.) Create the "infiniivision.lnk" file on the root directory of the USB drive with the following contents:

Code: [Select]

50#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS
3.) Run the firmware update in the scope settings

I know that I can only upgrade my 100Mhz scope to 200Mhz because thats the maximum that the frontend can do without hardware modifications.

One more thing, should I upgrade to the lastest Keysight Firmware before the hack, or should I leave the older Firmware on it? I read that I would have to change the ending of the Firmware file from .ksx to .cab if the current version is older than 2.41?

Thank you for your help!

Best
Phoenix

[Roland_W]

Hi Everyone,

I unfortunately brick by scope by change the patch to the used the proper software :
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3926996/#msg3926996

I do not double check that I have wrong path to the file .....

255#\usb\infiniiVision\infiniivisionLauncher.exe  -l all -l BW20 -l SCPIPS

instead of proper one 0#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS

Could anyone have a proper software on it pendrive, that I can run the original software ones again, and update the file to proper one.

PS: I do not have a ethernet connection to the scope, That the USB method show me that is the proper way to unbrick it.

Regards
Roland

[switchabl]

It is not possible to boot from USB any more on any recent firmware version, so you really need an ethernet interface. There are a number of designs around that you can use to make a cheap one yourself (maybe somebody here has some PCBs left over). You should be able to connect using telnet (port 23) and remove/replace the broken .lnk file.

instead of proper one 0#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS

This is also wrong, it should be 50#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS. The number at the start is the number of characters following (and not including) the #.

[Jay_Diddy_B]

Hi,

I recently shared the KiCAD files for the Ethernet Interface, DSOXLAN, in this thread:

https://www.eevblog.com/forum/projects/diy-dsoxlan-interface-for-keysight-oscilloscopes/

The file DSOXLAN.zip contains the gerber files ready to be sent.

You can order the PCB from the usual places.

There are more details in the thread.

Good luck,

Jay_Diddy_B

[analogRF]

Is there a guide for receovring from NAND corruption (3000A) through LAN connection?
I did this once through UART and YMODEM using the excellent guide by titiris (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181) but I now have a home made LAN board and a new 3024A with NAND corruption. I would like to try it with the LAN method which must be a lot faster than YMODEM

If someone can point me to a guide/post it's highly appreciated. I am confused as to whether I need to telnet or I need to have a tftp server? what files do I need to transfer to the scope? 

[Roland_W]

Thanks guys for the fast support.

I think about to add some file nawigator from Windows CE, and rename it, to run it from the USB driver. Perhaps could solve issue. I going to order the Ethernet board.

Thanks
Roland

[switchabl]

I think about to add some file nawigator from Windows CE, and rename it, to run it from the USB driver. Perhaps could solve issue.

You don't need a file navigator. When you connect with telnet, you should have a normal Windows command prompt (with "cd", "dir", "copy", "ren", "del" commands and so on). If you are not comfortable with that, I think you could probably just enter "infiniivisionLauncher.exe" to start the oscilloscope app and re-do the firmware upgrade procedure with the correct .lnk file. But I have not tried.

Is there a guide for receovring from NAND corruption (3000A) through LAN connection?

I have also used the YMODEM method myself (didn't have the LAN board yet) but I found this post: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/125/

Almost everything else should be the same as the titiris guide. You prepare the same files, connect using the serial console (not telnet). Just instead of "loady", you put nk.nb0 in the root of your TFTP server and use "set serverip" and "dhcp" to load it into RAM.

[analogRF]

so the "only" use of the LAN card is to load the nk.nb0 through TFTP?

The infiniivision setup on the USB drive and the rest of the process is the same?

[wp_wp]

so the "only" use of the LAN card is to load the nk.nb0 through TFTP?

The infiniivision setup on the USB drive and the rest of the process is the same?

Yes.
You just upload nk.nb0 to RAM through TFTP.And then,use USB drive boot infiniivision app.
And it is faster than upload nk.nb0 to RAM by YMODEM.
After all,the data rate of ethernet is more than serial port.
And you also can upload nk.nb0 to RAM through NFS.

[EE-digger]

Firmware version 7.55 is out.  Supports some new diff probes, Bug fixes to retain labels in setup recall, phase measurement error, changes in measured values for certain probes when measurement is stopped and increased size of CAN symbolic files.

[analogRF]

so the "only" use of the LAN card is to load the nk.nb0 through TFTP?

The infiniivision setup on the USB drive and the rest of the process is the same?

Yes.
You just upload nk.nb0 to RAM through TFTP.And then,use USB drive boot infiniivision app.
And it is faster than upload nk.nb0 to RAM by YMODEM.
After all,the data rate of ethernet is more than serial port.
And you also can upload nk.nb0 to RAM through NFS.
(Attachment Link) " alt="" class="bbc_img" />

this was much easier than using YMODEM 

[PhillyFlyers]

Hi All,


I just wanted to chime in here, and let everyone know I've removed all of my patched FWs....

....it was fun to prove out we could do it, but prob. not something I should continue doing forever.... not a good position to put myself in....

[pepperoni7]

Hi PhillyFlyers,

oh that is bad news. I always was looking forward for your patches evertime a new FW was out there.
But for sure I absolutely can understand you!

Also, it has come to my attention that a member on here sells 'services' for hacking scopes, etc... I'm not sure if it's with my patched FWs or not, but either way, that's not cool.. I have zero interest in contributing anything to that nonsense...

FullACK

...but I really dont think it's a good idea for me to keep doing this.... I really doubt keysight is happy with these easy-to-do patched FWs that anyone can do...

Well, I'm not sure if Keysight really depends on some hobbyist like us. Most of us probably buy second-hand Keysight gear because the "optimized" FW exists. Otherwise there might be more Rigol, Siglent or what else enthusiasts. And I also think only very few would really buy the optionpacks for thousands of dollars! And I don't think that many companies will use hacked FW (maybe a few?!). They have to rely on their equipment, they need service, support and calibration and cannot/will not risk to void all that. Therefore I cannot see any monetary loss for Keysight.

But on the other hand they gain a lot of prestige and reputation in the measurement and test gear community, if we -the users- are satisfied with the product.
So the next time your company is willing to spend their budget on new test equipment, probably it will be spent on Keysight gear, because you are used to it, you like it, you want it... 

And I'm also quite sure that Daniel Bogdanoff is smiling while reading this... because he knows it's true 

[Roland_W]

Hi All,

Thanks for support myself, and give me the right answer.
I unbrick scope using the RS232 interface.

1. I plug the RS232 interface as describe in Post 123 :
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895

Connect to the computer with PuTTy @115200,8,N,1, but I recommend to download TeraTerm for later use of YMODEM.

I press and hold SpaceBar before run the scope :

The terminal show that :

U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 256 MiB

Debug serial initialized ........OK
RTC: 2022-8-8   9:50:27.66 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Oct 29 2015 01:39:04
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008



P500 Boot Loader Configuration :

Mac address .......... (00:30:D3:29:8D:E3)
Ip address ........... (192.168.1.199)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0400000)
        2 (0xd4400000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images


I chose the 2 as load image 2, on a scope screen I found a note not proper image, please connect the keyboard, mouse, and put the USB pendrive to the scope with firmware.

Boot error

I connect the USB mouse, and keyboard to the back USB, and the USB pendrive to the front, and follow the instruction.

After that my scope will work proper now.

Terminal :

U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 256 MiB

Debug serial initialized ........OK
RTC: 2022-8-8   10:0:24.78 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Oct 29 2015 01:39:04
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008



P500 Boot Loader Configuration :

Mac address .......... (00:30:D3:29:8D:E3)
Ip address ........... (192.168.1.199)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0400000)
        2 (0xd4400000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>System ready!
Preparing for download...
RTC: 2022-8-8   10:0:35.8 UTC
 Loading image 2 from memory at 0xD4400000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXXOOOOOOOOXOXXOOOOOOOOXOOXOXOOOOXXXOOOOOOOOOXOOOXOOXXOXXXOOXOXXXXOXXXXXXOOOXXXOOOOOXOXXOXOOOXXXOOOXXOXOOOXOOXOOXXOOXOOOOXOXOOOOOXOOOXOOOXOXOXXXXXXXXXOOOOXOOXOOXOOOOXOOOOXXOOOOXOOOXOOOOOXOOXXOOOOOOOOOXOX
OOOXOOOOOOXOXOOOXOOOXOOXOXXXOXOOOXOXXXXOXOXOOXXXOXOOOXXXXOOOXOOOXOXOXOOOOXOOOXXXOXOOOXXOOOOOXOOOXOOOOXOXOOOXOOXOOXXXXXXXXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x107008C, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------

• : Address=0x80361000  Length=0x107008C  Name="" Target=RAM

 Loading image 2 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2022-8-8   10:0:37.28 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Mar 26 2015)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
++SER_Init: context Drivers\Active\12
SER_Init, dwIndex:2
SER2 got sysintr:0x00000016
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:29:8D:E3
Phy found addr 31 (ticks=2964)
WaitForLink Start (ticks=2966)
No Link (ticks=3968)
<--EDeviceInitialize

GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Time for NANDFLASH to load: 0 ms.
Time for SNANDFLASH to load: 0 ms.
Time for USB Hard Disk Drive to load: 0 ms.

*** BEGIN **** ExtractFileFromCabFile : INSTALL.XML
*** END **** ExtractFileFromCabFile : INSTALL.XML : 4365 ms

*** BEGIN **** ExtractFileFromCabFile : INSTALL.XML
*** END **** ExtractFileFromCabFile : INSTALL.XML : 2235 ms

*** BEGIN **** ExtractFileFromCabFile : INSTALL.XML
*** END **** ExtractFileFromCabFile : INSTALL.XML : 2235 ms
*** BEGIN **** ExtractFileFromCabFile : updateSplashImage.wvga.bin
*** END **** ExtractFileFromCabFile : updateSplashImage.wvga.bin : 20802 ms
*** BEGIN **** ExtractFileFromCabFile : auxInstallStep.exe
*** END **** ExtractFileFromCabFile : auxInstallStep.exe : 44 ms
*** BEGIN **** ProcessRecipeStep : \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\auxInstallStep.exe -v -s
=== Aux Step: -v -s ===
Skipped.
Deleting existing symbols.tte.old file.
Successfully moved symbols.tte.
*** END **** ProcessRecipeStep : \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\auxInstallStep.exe -v -s : 50 ms
*** BEGIN **** ExtractFileFromCabFile : fpga3000T.bin
*** END **** ExtractFileFromCabFile : fpga3000T.bin : 274 ms
*** BEGIN **** ProcessRecipeStep : \windows\loadP500Flash -u fpga --target monarch \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\fpga3000T.bin
*** END **** ProcessRecipeStep : \windows\loadP500Flash -u fpga --target monarch \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\fpga3000T.bin : 889 ms
*** BEGIN **** ExtractFileFromCabFile : updateBootLoaders2.exe
*** END **** ExtractFileFromCabFile : updateBootLoaders2.exe : 20695 ms
*** BEGIN **** ExtractFileFromCabFile : pboot_rel.bin
*** END **** ExtractFileFromCabFile : pboot_rel.bin : 17887 ms
*** BEGIN **** ProcessRecipeStep : \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\updatebootloaders2.exe
*** END **** ProcessRecipeStep : \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\updatebootloaders2.exe : 346 ms
*** BEGIN **** ExtractFileFromCabFile : nk.bin.comp
*** END **** ExtractFileFromCabFile : nk.bin.comp : 19745 ms
*** BEGIN **** ProcessRecipeStep : \windows\loadP500Flash -u ceImage1 \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\nk.bin.comp
*** END **** ProcessRecipeStep : \windows\loadP500Flash -u ceImage1 \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\nk.bin.comp : 24981 ms
*** BEGIN **** ExtractFileFromCabFile : recover.nk.bin.comp
*** END **** ExtractFileFromCabFile : recover.nk.bin.comp : 21188 ms
*** BEGIN **** ProcessRecipeStep : \windows\loadP500Flash -u ceImage2 \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\recover.nk.bin.comp
FWUpdate: image 3 value not defined
*** END **** ProcessRecipeStep : \windows\loadP500Flash -u ceImage2 \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\recover.nk.bin.comp : 14748 ms
*** BEGIN **** ExtractFileFromCabFile : infiniivisionSetup.cab
*** END **** ExtractFileFromCabFile : infiniivisionSetup.cab : 2685 ms
*** BEGIN **** ProcessRecipeStep : \windows\wceldcmd.exe /delete 0 \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\infiniivisionSetup.cab
*** END **** ProcessRecipeStep : \windows\wceldcmd.exe /delete 0 \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\infiniivisionSetup.cab : 8388 ms
*** BEGIN **** ExtractFileFromCabFile : splashImage.wvga.png
*** END **** ExtractFileFromCabFile : splashImage.wvga.png : 20766 ms
*** BEGIN **** ProcessRecipeStep : \windows\compileImageForSplashScreen.exe \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\splashImage.wvga.png \Secure\InfiniiVision\splashImage.bin
*** END **** ProcessRecipeStep : \windows\compileImageForSplashScreen.exe \TEMP\{3CD3D373-5A82-00CF-6D2D-95DE164A2798}\splashImage.wvga.png \Secure\InfiniiVision\splashImage.bin : 3117 ms
*** BEGIN **** ProcessRecipeStep : \windows\cmd.exe /c ren \Secure\Startup\infiniivision.lnk infiniivision.lnk.original
*** END **** ProcessRecipeStep : \windows\cmd.exe /c ren \Secure\Startup\infiniivision.lnk infiniivision.lnk.original : 592 ms
*** BEGIN **** ProcessRecipeStep : \windows\cmd.exe /c copy \usb\infiniivision.lnk \Secure\Startup\infiniivision.lnk
*** END **** ProcessRecipeStep : \windows\cmd.exe /c copy \usb\infiniivision.lnk \Secure\Startup\infiniivision.lnk : 601 ms
*** BEGIN **** ProcessRecipeStep : \windows\rebootInfiniivision.exe


U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 256 MiB


It look like we do not have possibility to enter to the U-Boot command anymore.

Regards
Roland

[Phoenix6478]

Thank you for the modified firmware PhillyFlyers 

I succesfully unlocked all the options and the 200Mhz BW on my Agilent MSO-X 3014A. Here are the contents of the .lnk file that i used:

Code: [Select]

59#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS -l CABLE
Best
Phoenix

[Jodorowsky]

Hello everyone.

I have been trying to read this whole subject, but damn, it's very hard to follow.

I have been recently given a DSO-X 2004A running version 02.65.2021030741 and I'm looking for a way tro unlock some or all the different capabilities of my oscilloscope, but I don't really kow where to start.

Is it even possible given the latest firmware update?

Sorry for going the lazy way, but being a non-native english speaker and seeing 140 pages of techspeak is a bit overwhelming for me.

[J-R]

Yes, I think some posts have been removed, probably to keep Keysight happy.

The information is generally still around if you dig for it, although I couldn't find any active links for the patched downloads.  Do you already have the patched firmware file?

The latest firmware available for download from Keysight appears to be this: "2000XSeries.02.65.20210307001.ksx"

So I'm not sure what it means that you have "0741" at the end of your firmware version rather than "07001".

Do you have the LAN hardware installed?

[Jodorowsky]

Firstly, thanks for taking the time to answer.

Now, no, I do not have the download for any patched version.

I went through most of the topic, and only found dead links or edited posts.

Concerning the version, no idea. If it goes wrong, could it brick my oscilloscope?

Lastly, I do not have the LAN interface.

[J-R]

For sure there is a very good chance of having a non-functioning scope, but having the LAN option can help you from what I've read.  You can telnet in and fix the .lnk file.  Plan B could be to use the serial header on the PCB.

I think the chance of a true "bricking" is pretty low, but non-zero.

The golden age of this hack is probably gone, since the links are dead and the "hacker" has been driven underground, so to speak.

But if you find someone in this thread that has successfully flashed the patched firmware, you could try messaging them for the patched file and .lnk file.

[Jodorowsky]

All right then, I’ll start digging.

Thank you for the guidance, J-R

[J-R]

Was talking to a buddy the other day and he sniped something on ebay recently and had no issues with this patch.   Also, the "0741" showing for the firmware version appears to be normal, for both unpatched and patched.

Most of the unlocked features are somewhat niche, but the MSO and wavegen were welcomed additions.  There are budget MSO cables available on ebay for about $50.

[dhl]

Ok,

Here are the latest patched firmwares, for the 1000X, 2000X, 3000A, 3000T, 4000X......



These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things


*** Note:  ***

I have made these installs even EASIER, after the upgrade completes the install process will also make a backup of the oem lnk file that it installs during the upgrade, and then attempt to copy 'infiniivision.lnk' from the same USB stick you are doing the upgrade with...

so in otherwords, have your 'infiniivision.lnk' file READY, and on the root of your USB drive along with the patched firmware upgrade!
(this replaces having to telnet into your scope after the upgrade and having to put the .lnk file back on)

The install script at the end does these two actions:

copy \Secure\Startup\infiniivision.lnk infiniivision.lnk.original  (backs up oem file being replaced)
copy \usb\infiniivision.lnk \Secure\Startup\infiniivision.lnk     (copies .lnk file from your USB to the startup folder)

So have these TWO files on your USB:

1) infiniivision.lnk
2) upgrade_file.ksx




*** NOTE:  FOR THE 1000X....  ************************************
      This is 'BUD's' patched firmware!!  All credit goes to him and the 1000x hacking folks!  there is NO .LNK file required for this patch, just install the FW!  I repeat, there is NO .lnk file required for the
      1000x hacking

DSOX 1000X Series:  FW:  01.20.2019061038_patched  https://mega.nz/file/nrpW3T4Z#gLnn__QchpYL5FuQXLawyso2_ReaXgn-jF4MzcRZSAA
md5: <8D128F5691BCB7D178CFB8E48F3784B9>

*************************************************************

DSOX 2000X Series:  FW:  02.65.20210307001_patched  https://mega.nz/file/mzgGjBpC#yLNWn8cGjJlsLeH_fVZ3tYyPZILYJ3EtGK8F84oEFw8
md5: <AF47DDB93F9CC88911ADC65F4E55F97D>

DSOX 3000A Series:  FW:  02.65.20210307001_patched  https://mega.nz/file/j3hEzbCa#4sYGoVawZt62XnoC3ZZvUAEyf575Q6o_-iYIr-whH4w
md5: <B5EBDEEA00BCBF4DCE77D173F212B8F6>

DSOX 3000T Series:  FW:  7.40.2021031200_patched  https://mega.nz/file/rz5UXbrL#FXRPSRjLlFN16amBWt_Si74-nS8OjW5xWZPLqmBeynU
md5: <C1AA8839085890FC058D27C501AF4F08>

DSOX 4000X Series:  FW:  7.40.2021031202_patched  https://mega.nz/file/nrxwAb6R#gNp4CCdwl_oyhAzxuJSI9OopUPjbmnu7fn8E8ejeGDg
md5: <7C30FD851FB6A4B461130D61FE9C0E0C>

Please let me know if there are any issues with any of these!

Hi your firmware download link is not available any more, could you update a new link?

[dhl]

Does anyone have the DSOX 2000X Series patched Firmware? I saw some posts but the link is not available. Please help, thanks!

[dhl]

I tested the patched FW 2.65 on a 2000X
It worked perfectly with this .INK file content:

128#infiniivisionLauncher.exe -l MSO -l COMP -l AUTO -l EMBD -l WAVEGEN -l MASK -l MEMUP -l SGM -l BW20 -l EDK -l DVM -l RML -l PLUS

A big Thanks to PhillyFlyers

Could you post a new download link for dso 2000 or 3000 series fw2.65? The original link is not available anymore.