DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[lampask]

When checking the past attempts at modifying the X3000A frontend by people in the thread I wanted to revisit the possibility of upgrading the bandwidth to 1Ghz by adding a daughter board to the frontend of 100/200mhz or 350/500mhz versions. After inspecting the frontend part of the board from photos sent in this thread it seems nearly identical, the daughter board would need to add the Teledyne attenuator relay, the low R_on n-channel mosfet, BAV99 diode and a few additional components. (I would also need to change the strapping resistors and possibly switch the hex inverter ic)

As I do not own a 3104A series scope and cannot measure stuff myself I wanted to ask someone with more experience with this scope how is the relay switching implemented. There are vias around the extra diode and mosfet that I cannot identify from photos, but thats about everything that can be seen from the top and bottom layers. I had a suspicion that the gate of the mosfet might be connected to the U202 register IC, and the drain to the relay switching vias through the diode, but I can't be sure about this and it would be nice to hear form someone who possibly tried to reverse engineer this before with an access to the hardware.

I have attached one side photo of the frontend section of the 3104A sent before https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=287307;image, where I have marked the interesting connections that I mentioned.
 

[BillCRM]

V2.66 patched successfully with info on the forum, mod at record 168, patch as usual. Patch to 00 00 a0 e3 & 01 00 a0 e3! If you don't understand, go back and watch PhillyFlyers' and safar's posts.

[BillCRM]

Hack of 3000T and 4000A of V7.60 also achieved, at record 172&174, patch as usual!

[Gregdavill]

Thanks for confirming. As a fun weekend project I just upgraded to v2.66.
Followed the nk.bin patching steps for 2.43, used ghidra to trace original patches, and find their new addresses in v2.66.

Everything working pretty well. But I have noticed the LAN info screen in the UI/web doesn't seem to update, even though the scope does appear correctly on my LAN. 

[BillCRM]

Some old splash images in case you don’t like the boring Keysight one.

[HighVoltage]

Some old splash images in case you don’t like the boring Keysight one.

I have good memories associated with these old splash screens, especially, when I saw them for the first time.
In comparison the new Keysight screens are boring !

[Howardlong]

What process does

"mod at record xxx, patch as usual. Patch to yy yy yy yy yy yy yy yy"

refer to?

I understand about extracting the .kgx cab files, but then what?

[BillCRM]

Look around page 75, some detailed guide lines was there. All the essential tools was the same as used for firmware recovery.

[BillCRM]

I also created a joking one The tektronix MDO3000 share the same resolution as the DSOX series.

[BillCRM]

More detailed, ksx to cab, then get nk.bin.comp, then decompress, the check record, then put nk.bin to any hex editor and mod. then recalculate the checksum. Recompress the nk.bin to nk.bin.comp, get the new md5 for the file. Modify the recipe.xml. and pack everything together back to the cab. and last cab to ksx. Then it's ready to go

[tabajaralabs]

Dear ALL
First of all thanks for all the fishes, I learn a lot on this forum and way more in this thread.
I am having a problem that I wasn't able to figure alone the direction to go. Any help would be great
I'm recovering a 4 chan DSO-x 2024A, it was on rev. 02.39.20151022602. I downloaded the corresponding CAB file, loaded on the scope but I'm getting the following error:

I tried to look for it, tried to understand it but unfortunately there is nothing I can infer to direct me
Thanks a lot
73 de PU2SEX Alexandre

[tabajaralabs]

Screen changed, one step ahead. I connected the vga/network adapter, it passed thru the network test stage but locks up here. Using 2.35 firmware, which "seems" to be the last bootable firmware

I feel ashamed, but I just don't know in which direction to go. Any helpers, please?

[tabajaralabs]

Is there anything that can be done if you erase the u-boot code?
I just did that to mine, in a lapse of reason

[Bud]

Does DSOX2000 have a separate NOR chip? You can unsolder and reprogram it.
The other way is to reprogram it via USB port. If Uboot not loading, the CPU will switch to USB boot mode. You need to download STM32 Flashing Utility, follow instructions in it to install it on a computer, get access to the scope's memory and reflash the NOR image to the respective memory address.

[BillCRM]

Is there anything that can be done if you erase the u-boot code?
I just did that to mine, in a lapse of reason

No worry, theres the uboot dump.
Change txt to bin as Dave not allowed to upload a bin file there.

[BillCRM]

If you need,  I could also provide a dump of the whole nand,  but this might be the last solution as using other's nand dump will cause a serial number change and wrong cal data.
However, I believe your condition is due to wrong usb file structure.

[BillCRM]

Keysight released new firmware for 3000T/G & 4000X series, version 7.65.
Hack is still the old fashion way, 3000 at record 175, 4000 at record 178. The data sequences are still the same as old versions.
The new version fixed bugs and added support for new probes.

[lampask]

Would there be someone willing to provide an uboot dump from 3000T/3000G? The xloader partition there is different, because of a diferent ram chip (MT47H128M16RT-25E:C / D9MTD) and the scope cannot perform memory training otherwise.

Or alternatively does someone have the xloader source for arm spear600 laying around? The only thing I found in regards to this was a chinese site https://www.codebus.net/2159210.html. And that also doesn't seem to have this chip between the files. The original ST Linux project (with the xloader source) in which ST provided tools for the SPEAr series seems to be gone from the internet unfortunately

[tabajaralabs]

If you need,  I could also provide a dump of the whole nand,  but this might be the last solution as using other's nand dump will cause a serial number change and wrong cal data.
However, I believe your condition is due to wrong usb file structure.

Bill, are you talking about the entire program memory area or just the uboot? Unfortunately, my knowledge about this scope is VERY limited. It would be nice if I could get an entire dump from a good osciloscope and install on mine. I tried 6 different firmware versions (all old versions and the 2.50 cracked one) and wasn't able to make it boot.  It tries to boot, load the (ugly) keysight boot screen and returns a segfault in many appls.

Tried to run MTEST but it locks up. Got a good, working (2 channel) dso-x2002A and it locks up on the MTEST too. So I don't believe the problem is RAM bound.

I confess I am completely lost, and I cannot find a line of logic. Begging for help, I cannot let this scope let go. It looks like to be SO near!

BTW, I have the LAN interface, so I can load and boot way faster than serial.

Maybe if someone created a correct USB boot drive image + NK.NB0 file for me to try to load...If you can do that feel free to send me a private message

Thanks and sorry for being so noob

[Bud]

Post your USB file structure and the launching command line. Let people take a  look at it.

[tabajaralabs]

Post your USB file structure and the launching command line. Let people take a  look at it.

Got a 1GB (gift from keysight! =D) pen drive, formatted in FAT, did the same as here:

USB folder procedure:
    copy the contents of the Secure folder in your USB root.
    copy the Temp folder in your USB root.
    make a folder name Startup in your USB root.
    create a file inside the folder Startup, named infiniivision.lnk, containing 51#\usb\Secure\infiniiVision\infiniivisionLauncher.exe
    create a file in your USB root, named infiniivisionStartupOverride.txt, containing "True"
    copy the stock firmware .cab file form keysight to your USB root. Use 02.40 or above. 2.41.cab is in the above archive.

Command line: After booting the scope and running...
spearload -t spear600 p500_ddrdriver.bin u-boot_image.bin

this opens a serial port on the computer, I go to the terminal program and type:
TFTP 0x00361000

It loads the nk.nb0 binary I generated as described in
https://salvagedcircuitry.com/2000a-nand-recovery.html

When the load finishes, i type
GO 0x00362000

And it boots some of the code or, what is happening now, locks up.

I am regenerating for the nth time the usb drive and trying again.

[Bud]

Which uboot image you are uploading?

[tabajaralabs]

Which uboot image you are uploading?

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

[Bud]

I do not know what that means. Are you using the uboot from a 2000x scope or some other variant?

[tabajaralabs]

I do not know what that means. Are you using the uboot from a 2000x scope or some other variant?

As far as I know, yes!