Author Topic: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ? (Read 1376782 times)

dimmog · « **Reply #3475 on:** February 18, 2025, 06:27:51 pm »

Quote from: analogRF on February 18, 2025, 06:16:38 pm

Quote from: dimmog on February 18, 2025, 03:48:31 pm
Quote from: analogRF on February 18, 2025, 11:59:02 am
Quote from: dimmog on February 18, 2025, 05:27:01 am
Has anyone managed to fix NAND corruption on the DSOX3000 with "FPGA programming FAILED!" error in U-Boot?

is that the whole boot log? it doesnt go any further?

Thank you for your response. It does go further and sometimes even attempts to boot, about once in every ten attempts. I've attached the full log.

yes this is the log I was expecting to see.

it is interesting that the FW image does not exactly match 2.35 although it seems very close (like a few bytes off)

The original firmware version was likely 2.36, based on the production date on the back sticker.

jjcyril · « **Reply #3476 on:** February 20, 2025, 10:22:34 am »

Hi
sorry to bother you could you send me the firmware 2.35 for the oscilloscope keysight or agilent
please

dimmog · « **Reply #3477 on:** February 20, 2025, 11:56:07 am »

Quote from: jjcyril on February 20, 2025, 10:22:34 am

Hi
sorry to bother you could you send me the firmware 2.35 for the oscilloscope keysight or agilent
please

The link can be found on the previous page of this thread

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg5797997/#msg5797997

Lydia · « **Reply #3478 on:** March 31, 2025, 06:11:34 pm »

It seems that oscilloscope will indicate this err every time you do SelfTest until you passed UserCal first.

I have a EDUX-1000A model and modified it to DSOX-1000G, so at some stage during work, this oscilloscope will stay in UserCal failed status.
During that time, I occasionally find that if system report it's uncaled, then it will never pass SelfTest and report "TrigComp".
But when I passed UserCal, SelfTest passed immediately even without a reboot.

So it seems that if your machine is reporting Uncal, then ignore SelfTest and finish UserCal, This message maybe not due to a hardware damage.

tabajaralabs · « **Reply #3479 on:** April 09, 2025, 06:45:01 am »

This is the SECOND scope I am trying to recover using the https://salvagedcircuitry.com/2000a-nand-recovery.html method and I fail miserably AGAIN :\ I must be doing something very stupid.
I'll enumerate my steps, please, someone help!

And this one was working! When I tried to install the upgrade file, I installed a wrong file and it stopped working, with memory corruption (leds flashing)

BTW: The firmwre was VERY old. 01.00.2011011301 when it was working.

1 - Connect the scope with CAL pressed. Run spearload.exe -t spear600 p500_ddrdriver.bin u-boot_image.bin and opens a serial port on pc. I'm using the USB port instead of the serial port since it is SO much faster.
2 - Open TeraTerm, I enter the P500> prompt. Set environment variables (server, gateway, ipaddr). Save it with "saves". Don't know why, ipaddr variable does not get saved, I have to SETENV IPADDR every time I boot the scope
3 - Prepared the NK.BIN/NK.NB0 files, the pendrive as usual. Yes, 1GB pen drive, fat32. Everything as said in the site.
4 - TFTPBOOT 0x00361000 NK.NB0 (or NK.BIN), the correct number of bytes is transfered
5 - GO 0x00362000 and the scope locks up, with just a pair of ## instead of ## Starting...

Tried TFTPBOOT, BOOTP, nothing.

And when it happened, I could see agilent image on boot and panel leds flashed. Now when I turn it on, it does nothing. If I issue the BOOT command I get

p500> boot
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2010-10-19 12:09:59 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 36687 Bytes = 35.8 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK

Starting kernel ...

Unfortuntely I have not even the minimal idea of what is happening.
please, help!

Update: Connected a ttl to usb serial on the comm port. This is what happens when I type go 0x0362000:

Windows CE Kernel for ARM (Thumb Enabled) Built on Jun 16 2009 at 10:08:15
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Mar 16 2011)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
-EDeviceLoadEeprom 00:30:D3:14:9C:AE
Phy found addr 31 (ticks=2674)
WaitForLink Start (ticks=2676)
Link Detected (ticks=2678)

GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.

onesystem · « **Reply #3480 on:** April 09, 2025, 01:49:04 pm »

Try using this method. It is quite easy and judging by your description scope boots far enough to load "windows". NOTE: you might have no such file as "infiniiVisionUpdateService.exe", in that case start the infiniiVision service file (I do not remember it's name, but it will be obvious), and there will be a weird looking scope interface with windows overlay mixed together - but it will let you use the scope's internal firmare update option!

Quote from: onesystem on February 02, 2025, 07:08:04 pm

I followed the instructions on this blog:

https://ripitapart.com/2018/10/15/gaining-access-to-the-windows-ce-desktop-and-doom-on-the-keysight-dsox1102g-oscilloscope/

Gained access to windows of the scope. Then in using command prompt navigated to Windows directory, found program called infiniiVisionUpdateService.exe, in command prompt typed infiniiVisionUpdateService.exe \usb\2000XSeries.02.66.20240123001.ksx, and scope updated to the 2.66 firmware and is runnig well now - no errors - serial output shows normal running.

So in summary:
1. FAT formatted USB
2. placed infiniivisionStartupOverride.txt in the root of usb (knowing it will stump scope from booting but looking at usb for some time before rebooting)
3. placed extracted content of ScopeLiberator-Release-2.0.zip into the usb flash drive root (without any folder structure)
4. placed 2000XSeries.02.66.20240123001.ksx file into usb root
5. connected keyboard to the back of the scope, plugged usb in front.
6. Turned on the scope and waited until lights started circling on buttons, then pressed Windows button + R, then typed \usb\a.bat and pressed Enter
7. Windows 98-like desktop showed up. Navigated to usb drive, started command prompt, in there switched to Windows directory, typed infiniiVisionUpdateService.exe \usb\2000XSeries.02.66.20240123001.ksx and update went through.
8. When scope was rebooting, I unplugged the flash drive and got a working scope.

tabajaralabs · « **Reply #3481 on:** April 09, 2025, 10:28:22 pm »

Strange method, but interesting, I'll give a try. Thanks!
But...where do I find this scope liberator? And are you aware my scope is a DSO-X2000 series, not 1000 eh?

onesystem · « **Reply #3482 on:** April 09, 2025, 11:05:37 pm »

At the end of Reply #3460 you will find attachment. Yes I am aware yours is DSOX2000, mine was too. It will work with 2000 and 3000 for sure.

tabajaralabs · « **Reply #3483 on:** April 10, 2025, 01:03:35 am »

Quote from: tabajaralabs on April 09, 2025, 10:28:22 pm

Strange method, but interesting, I'll give a try. Thanks!
But...where do I find this scope liberator? And are you aware my scope is a DSO-X2000 series, not 1000 eh?

Unfortunately, it didn't work.
Scope came to a point lights does not flash if via USB/Serial channel (back USB B connector) I do not issue a "boot" command.
After the BOOT command the internal serial shows lots of things happening, but stops on the BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.

I did just as you said, prepared the pen drive, connected to the front of the scope. Issued the BOOT command. Connected the USB keyboard on the back A port (and ok, I tested the keyboard before connecting and disconnected the B port after boot). Keyboard does not flash lights. As I issued the BOOT command the lights started to flash in sequence and I typed the (windows)-R \usb\a.bat command lots of times. No response whatsoever.

I have a theory that may or may not be connected to reality - please disregard my words after this point:
SEEMS that you have 2 partitions on boot. One is the PBOOT partition. This partition boots up the scope circuit and prepares to load the windows CE which sits on other partition. Most or all of these methods works, if somehow you have the windows CE installed on second partition. On my scope, SEEMS I have a problem on the second partition which is deep enough not to let the system boot with the methods described here

At least, this is what it SEEMS to be.

Actual state:
When I turn it on, nothing happens. No flash lights, no signal it is turned on beyond fan rotating.

If I type BOOT on the p500> prompt via serial USB B port, it boots up to the "baldin" line. No display, lights flashes.

Heeelp! =(

tabajaralabs · « **Reply #3484 on:** April 10, 2025, 01:40:33 am »

Just out of curiosity...I have a DSO2002x working...
Can I copy the entire NAND of it thru usb/serial/whatever and restore this backup on the working scope?\

tabajaralabs · « **Reply #3485 on:** April 10, 2025, 02:16:44 am »

I think I have a better question, lets see if it is doable...
I have the image of the Flash rom extracted from a dsx2000 working scope running V2.64. The NAND image looks correct comparing with some info I can get on uboot. I believe the flash image is OK, and - according to the uboot - it should be an entire jffs2 filesystem. I have no ways to browse this filesystem but it seems complete. Is there a way I can upload this entire 128K image to the Flash on the scope trying to revive it? I have the start address of the flash, maybe loading it on ram and CPing it to flash?

Bud · « **Reply #3486 on:** April 10, 2025, 02:34:40 am »

Connect a terminal to the UART port, boot normally (not with the Cal button trick) and post the log here.

Bud · « **Reply #3487 on:** April 10, 2025, 02:48:05 am »

Forget abput transplanting NAND image, you will lose factory cal.

tabajaralabs · « **Reply #3488 on:** April 10, 2025, 12:57:39 pm »

Quote from: Bud on April 10, 2025, 02:34:40 am

Connect a terminal to the UART port, boot normally (not with the Cal button trick) and post the log here.

If I just keep the UART connected, this is what happens:

Quote

U-Boot 2010.03 (Sep 09 2010 - 14:47:56)Agilent P500

CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: 128 MiB

If I connect the USB B connector on the back, and type BOOT at the P500> prompt, that is what happens in the UART

Quote

Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Oct 19 2010 03:
38:36
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

System ready!
Preparing for download...
Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOXOOXOXXXOOXOXOXXXXXXOOOXXXO
OOOOXOXOXXXXXXOOOOXXXOOOXXOOOOXOOXOOXXOOOXOOOOOXOOXOOOOXXXXXXOXXOXOXXXXXXXOXXXXO
OOXOOOOXXOOOOXOOOOXOXOXOOOOOOXOOOXOOXOOOOX
OXOOOOOXOOOOXXOOOOOOOOOXXOOOOXOOOOOOXXOXOOOOXOXOOOOXXOOXOOXXOXOOOXOOOXOOXXOXOXOO
OXXXXOXXOOOXXOXXXOXXOOXXOOXXOXXXXXXOOOXXXOXOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOOXXXXXX
XXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1237530, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
: Address=0x80361000 Length=0x1237530 Name="" Target=RAM

Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
Launching windows CE image by jumping at address 0x 362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Jun 16 2009 at 10:08:15
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jan 13 2011)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
-EDeviceLoadEeprom 00:30:D3:14:9C:AE
Phy found addr 31 (ticks=2653)
WaitForLink Start (ticks=2654)
Link Detected (ticks=2657)

GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.

Anything else I can help? Maybe this other info is important:

If I press space when booting (of course, sending BOOT in the USB UART) and ask for testing the two avaiable images, it says image 2 is not valid, here you are the log

Quote

Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Oct 19 2010 03:
38:36
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

P500 Boot Loader Configuration :

Mac address .......... (00:30:D3:14:9C:AE)
Ip address ........... (192.168.0.204)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
1 (0xd0600000)
2 (0xd1600000)

l) Load flash resident image now
d) Download from ethernet now
u) Start u-boot by resetting
v) Verify Images
>
********* Image 1 *******************O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOXOOXOXXXOOXOXOXXXXXXOOOXXXO
OOOOXOXOXXXXXXOOOOXXXOOOXXOOOOXOOXOOXXOOOXOOOOOXOOXOOOOXXXXXXOXXOXOXXXXXXXOXXXXO
OOXOOOOXXOOOOXOOOOXOXOXOOOOOOXOOOXOOXOOOOX
OXOOOOOXOOOOXXOOOOOOOOOXXOOOOXOOOOOOXXOXOOOOXOXOOOOXXOOXOOXXOXOOOXOOOXOOXXOXOXOO
OXXXXOXXOOOXXOXXXOXXOOXXOOXXOXXXXXXOOOXXXOXOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOOXXXXXX
XXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1237530, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
: Address=0x80361000 Length=0x1237530 Name="" Target=RAM

******************************************************
Valid Image at 0xd0600000
*******************************************************

********* Image 2 *******************
BL_IMAGE_TYPE_UNKNOWN

******************************************************
Image at 0xd1600000 is not valid
*******************************************************

P500 Boot Loader Configuration :

Mac address .......... (00:30:D3:14:9C:AE)
Ip address ........... (192.168.0.204)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
1 (0xd0600000)
2 (0xd1600000)

l) Load flash resident image now
d) Download from ethernet now
u) Start u-boot by resetting
v) Verify Images

Thanks for all the help!

onesystem · « **Reply #3489 on:** April 10, 2025, 01:14:06 pm »

Did you also prepare a flash drive with bootable structure on it and plugged it in before starting with step #5?

Quote from: tabajaralabs on April 09, 2025, 06:45:01 am

1 - Connect the scope with CAL pressed. Run spearload.exe -t spear600 p500_ddrdriver.bin u-boot_image.bin and opens a serial port on pc. I'm using the USB port instead of the serial port since it is SO much faster.
2 - Open TeraTerm, I enter the P500> prompt. Set environment variables (server, gateway, ipaddr). Save it with "saves". Don't know why, ipaddr variable does not get saved, I have to SETENV IPADDR every time I boot the scope
3 - Prepared the NK.BIN/NK.NB0 files, the pendrive as usual. Yes, 1GB pen drive, fat32. Everything as said in the site.
4 - TFTPBOOT 0x00361000 NK.NB0 (or NK.BIN), the correct number of bytes is transfered
5 - GO 0x00362000 and the scope locks up, with just a pair of ## instead of ## Starting...

tabajaralabs · « **Reply #3490 on:** April 10, 2025, 02:05:39 pm »

Quote from: onesystem on April 10, 2025, 01:14:06 pm

Did you also prepare a flash drive with bootable structure on it and plugged it in before starting with step #5?

Quote from: tabajaralabs on April 09, 2025, 06:45:01 am
1 - Connect the scope with CAL pressed. Run spearload.exe -t spear600 p500_ddrdriver.bin u-boot_image.bin and opens a serial port on pc. I'm using the USB port instead of the serial port since it is SO much faster.
2 - Open TeraTerm, I enter the P500> prompt. Set environment variables (server, gateway, ipaddr). Save it with "saves". Don't know why, ipaddr variable does not get saved, I have to SETENV IPADDR every time I boot the scope
3 - Prepared the NK.BIN/NK.NB0 files, the pendrive as usual. Yes, 1GB pen drive, fat32. Everything as said in the site.
4 - TFTPBOOT 0x00361000 NK.NB0 (or NK.BIN), the correct number of bytes is transfered
5 - GO 0x00362000 and the scope locks up, with just a pair of ## instead of ## Starting...

Yep, that was step 3.
The pen drive preparation process has a lot of question marks, but I did my best. I don't know if capital letters are different (I assume not), if I gotta put a CR/LF on the end of the two created files etc. I assume not because of windows CE. anyways, I see the pen drive flash, but doesn't work. Of course, I tried 4 different pendrives. All of them below 8GB.

onesystem · « **Reply #3491 on:** April 10, 2025, 04:53:41 pm »

Okay. Regarding the version of the firmware - you mentioned that it was version 01.00.2011011301. is nk.bin file also from that version?
Maybe you can try several different nk.bin from not only the version 01.00.2011011301, but also maybe from the version that you tried to load...

tabajaralabs · « **Reply #3492 on:** April 10, 2025, 07:37:37 pm »

Quote from: onesystem on April 10, 2025, 04:53:41 pm

Okay. Regarding the version of the firmware - you mentioned that it was version 01.00.2011011301. is nk.bin file also from that version?
Maybe you can try several different nk.bin from not only the version 01.00.2011011301, but also maybe from the version that you tried to load...

tried 8 versions, from 2000XSeries.01.10.2011031600.cab to 2000XSeries.02.65.20210307001.ksx. Unfortunately it didn't work. The version 01.00.2011011301 as far as I could find is unavaiable on the net...

onesystem · « **Reply #3493 on:** April 10, 2025, 08:01:34 pm »

Wait. You said you are using USB in the back of the scope. I did those procedures using the UART header on the circuit board of the scope (you would have to open it up to get to it). And I know it takes a long time - but could you try it? This way we know that procedure when done exactly as on that website, still fails.

This parts gets me a little confused:

Quote from: tabajaralabs on April 09, 2025, 06:45:01 am

2 - Open TeraTerm, I enter the P500> prompt. Set environment variables (server, gateway, ipaddr). Save it with "saves". Don't know why, ipaddr variable does not get saved, I have to SETENV IPADDR every time I boot the scope

There is no server, gateway, ipaddr on that UART port - so I guess you are using network card? I never used that, only used UART to load the files.

analogRF · « **Reply #3494 on:** April 10, 2025, 08:10:39 pm »

just connect the UART and DO NOT connect ANYTHING else to any other place
and post what exactly shows up on the UART header on the board.

you did not have to use USB connection to PC at all. if it is indeed a nand corruption
only the UART connection is enough and a LAN card can be helpful but not mandatory
I have repaired at least 14-15 of these scopes from NAND corruption so far and never connected USB-B to PC.
but there are issues other than nand corruption that can occur. the exact UART log is important

tabajaralabs · « **Reply #3495 on:** April 10, 2025, 08:21:40 pm »

Quote from: analogRF on April 10, 2025, 08:10:39 pm

just connect the UART and DO NOT connect ANYTHING else to any other place
and post what exactly shows up on the UART header on the board.

you did not have to use USB connection to PC at all. if it is indeed a nand corruption
only the UART connection is enough and a LAN card can be helpful but not mandatory
I have repaired at least 14-15 of these scopes from NAND corruption so far and never connected USB-B to PC.
but there are issues other than nand corruption that can occur. the exact UART log is important

That is exactely what I did:
(just the uart, no USB connection:)

Quote

U-Boot 2010.03 (Sep 09 2010 - 14:47:56)Agilent P500

CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: 128 MiB

Only that text, nothing else.
And yes, I have the vga/network adapter connected. And yes, the boot without the network adapter is the same

Thanks for the help!

tabajaralabs · « **Reply #3496 on:** April 10, 2025, 08:24:20 pm »

Quote from: onesystem on April 10, 2025, 08:01:34 pm

Wait. You said you are using USB in the back of the scope. I did those procedures using the UART header on the circuit board of the scope (you would have to open it up to get to it). And I know it takes a long time - but could you try it? This way we know that procedure when done exactly as on that website, still fails.

This parts gets me a little confused:
Quote from: tabajaralabs on April 09, 2025, 06:45:01 am
2 - Open TeraTerm, I enter the P500> prompt. Set environment variables (server, gateway, ipaddr). Save it with "saves". Don't know why, ipaddr variable does not get saved, I have to SETENV IPADDR every time I boot the scope
There is no server, gateway, ipaddr on that UART port - so I guess you are using network card? I never used that, only used UART to load the files.

I did it both ways:
- Just the UART and the network adapter
- Uart + USB and the network adapter

I cannot believe I cannot use the networking card to load the NK.NB0 file (after all it is just a difference on the media to transfer the files to memory) but of course, I know nothing. If you want I can try transfering thru the UART.

analogRF · « **Reply #3497 on:** April 10, 2025, 08:29:01 pm »

Quote from: tabajaralabs on April 10, 2025, 08:21:40 pm

Quote from: analogRF on April 10, 2025, 08:10:39 pm
just connect the UART and DO NOT connect ANYTHING else to any other place
and post what exactly shows up on the UART header on the board.

you did not have to use USB connection to PC at all. if it is indeed a nand corruption
only the UART connection is enough and a LAN card can be helpful but not mandatory
I have repaired at least 14-15 of these scopes from NAND corruption so far and never connected USB-B to PC.
but there are issues other than nand corruption that can occur. the exact UART log is important

That is exactely what I did:
(just the uart, no USB connection:)
Quote
U-Boot 2010.03 (Sep 09 2010 - 14:47:56)Agilent P500

CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: 128 MiB

Only that text, nothing else.
And yes, I have the vga/network adapter connected. And yes, the boot without the network adapter is the same

Thanks for the help!

I dont get it. If that is all you get on the UART port how did you get into the p500> prompt and changed variables and such!?

if that's all you get on the uart and nothing else, the problem may not be nand corruption at all. It is stopping way too early
before any attempt at loading kernel or anything. Looks more like a RAM issue or even some power supply on board is bad etc...

tabajaralabs · « **Reply #3498 on:** April 10, 2025, 08:38:14 pm »

Quote from: onesystem on April 10, 2025, 08:01:34 pm

Wait. You said you are using USB in the back of the scope. I did those procedures using the UART header on the circuit board of the scope (you would have to open it up to get to it). And I know it takes a long time - but could you try it? This way we know that procedure when done exactly as on that website, still fails.

This parts gets me a little confused:
Quote from: tabajaralabs on April 09, 2025, 06:45:01 am
2 - Open TeraTerm, I enter the P500> prompt. Set environment variables (server, gateway, ipaddr). Save it with "saves". Don't know why, ipaddr variable does not get saved, I have to SETENV IPADDR every time I boot the scope
There is no server, gateway, ipaddr on that UART port - so I guess you are using network card? I never used that, only used UART to load the files.

Ok, now I am using internal UART
Firstly, I moved all stdin/out/err to serial

Quote

setenv stdin serial
setenv stdout serial
seterr stdout serial
saveenv

and rebooted. Disconnected the network adapter and the back usb port. Now I am using ONLY the internal UART

Turn scope off, then on. This is what I get:

Quote

U-Boot 2010.03 (Sep 09 2010 - 14:47:56)Agilent P500

CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc

And the scope locks up. Does not accept any input from anything. If I boot the scope with spacebar pressed, does nothing. Same thing as above
Anything else I should try?

analogRF · « **Reply #3499 on:** April 10, 2025, 08:46:46 pm »

this is way too early in the boot process. even pboot has not started, forget about WinCE and nk.nb0 and all of that.
To me looks like either a RAM issue or NOR flash.
i think there was a dump of NOR flash somewhere in the forum but I dont have it

does it stop there every time you power on? or does it go further randomly sometimes?


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ? (Read 1376782 times)

Share me