DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[tabajaralabs]

Where is the start part before it gets to p500 prompt. Do you still interrupt the boot to get to the prompt or does the scope stops by itself, which it should not if you changed the bootdelay variable. I want to see everything from the moment you turn the scope on, no pressing Cal buttons, no hitting space bar, no pen drive. Just let it roll.

Ok, from the start, pressing power button and reading UART:

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2010-10-19  12:09:59 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    36687 Bytes = 35.8 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Oct 19 2010 03:38:36
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOXOOXOXXXOOXOXOXXXXXXOOOXXXOOOOOXOXOXXXXXXOOOOXXXOOOXXOOOOXOOXOOXXOOOXOOOOOXOOXOOOOXXXXXXOXXOXOXXXXXXXOXXXXOOOXOOOOXXOOOOXOOOOXOXOXOOOOOOXOOOXOOXOOOOX
OXOOOOOXOOOOXXOOOOOOOOOXXOOOOXOOOOOOXXOXOOOOXOXOOOOXXOOXOOXXOXOOOXOOOXOOXXOXOXOOOXXXXOXXOOOXXOXXXOXXOOXXOOXXOXXXXXXOOOXXXOXOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOOXXXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1237530, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------

• : Address=0x80361000  Length=0x1237530  Name="" Target=RAM

 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Jun 16 2009 at 10:08:15
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jan 13 2011)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
-EDeviceLoadEeprom 00:30:D3:14:9C:AE
Phy found addr 31 (ticks=3054)
WaitForLink Start (ticks=3056)
Link Detected (ticks=3058)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.

After the last line, the lights on the front of the scope keep cycling (channel 1/2, wavegen, 4 green triangles, run stop/single)

[tabajaralabs]

no it cannot be like that. the normal UART boot log does not look like the last post.
you should not have played with the env vars. you have to go back to exactly the stock env vars before any change whatsoever and let the UART
do its thing without ANY interruption, no USB memory, no USB connection, no key press nothing at all.
but the env vars need to be restored to their original stock content.

Is there a list of standard env variables so I can restore mine?

[Bud]

What was in that 241 link cab file that you installed, which caused you the trouble?

[tabajaralabs]

What was in that 241 link cab file that you installed, which caused you the trouble?

Good question. I remember I had to load 3 files on the update and I loaded the second instead of first. If I open the cab, there is an infiniivisionsetup.cab and inside it, a 0fakever.001 file.
Unfortunately, I created these files long time ago, I don't remember why these files

[Bud]

A file named 0fakever would not inspire much confidence in me. What is the purpose of that 241 link package, why did you make it?

[tabajaralabs]

A file named 0fakever would not inspire much confidence in me. What is the purpose of that 241 link package, why did you make it?

A long time ago, when was published here on the forum the files for unlocking the DSO-2000x scopes, I had lots of trouble finding all the files to do the entire procedure. I remember I have to read tens and tens of pages to find all the files. So I packaged the 3 files needed and numbered them 1 - 2 - 3. And all my friends who had the same scope had used this pack to unlock their scopes. The files weren't created by me. I just collected the files, made a package with some instructions and saved them in case anyone would need it. Lots of people I know used my pack to unlock their scopes.
Since it was 5 years ago, I don't remember many details. I hadn't used this package I made since them

[tabajaralabs]

Ok, got it "working"
The secret?

p500> fpga                                                                     
p500> expi 62500                                                               
p500> run keyrst                                                               
p500> boot 

I was able to boot the internal WinCE kernal (which DOES NOT BOOT without these commands) and load 01.10.2011031600 firmware from pen drive. The scope seems to be running although complaining of no cal data and unfinalized software. Thanks to everyone who helped

But now I have a problem: Everytime I try to load ANY complete firmware package from Pen Drive, scope gives an error and reboots. I tried many firmwares avaiable on https://salvagedcircuitry.com/docs/2000a-nand-recovery/2000a-3000a-firmware.zip

Is there something am I missing?

When I try to update, this is the error I get via UART:

Exception 'Prefetch Abort' (3): Thread-Id=05b7000e(pth=87ec9518), Proc-Id=049300
02(pprc=83845cd8) 'infiniivisionLauncher.exe', VM-active=04930002(pprc=83845cd8)
 'infiniivisionLauncher.exe'                                                   
PC=41003a40(infiniivisioncore.dll+0x00273a40) RA=40ffba8c(infiniivisioncore.dll+
0x0026ba8c) SP=02a7fe64, BVA=41003a40                                           
Exception 'Data Abort' (4): Thread-Id=05b7000e(pth=87ec9518), Proc-Id=04930002(p
prc=83845cd8) 'infiniivisionLauncher.exe', VM-active=04930002(pprc=83845cd8) 'in
finiivisionLauncher.exe'                                                       
PC=40029754(coredll.dll+0x00019754) RA=02a7fbf4(+0x02a7fbf4) SP=02a7fa48, BVA
=41b17518                                                                       
Exception 'Data Abort' (4): Thread-Id=05b7000e(pth=87ec9518), Proc-Id=04930002(p
prc=83845cd8) 'infiniivisionLauncher.exe', VM-active=04930002(pprc=83845cd8) 'in
finiivisionLauncher.exe'                                                       
PC=40029754(coredll.dll+0x00019754) RA=02a7fbf4(+0x02a7fbf4) SP=02a7fa48, BVA
=41b17518                                                                       
The exception 0xC0000005 occurred at address 0x41003A40. 

Thanks! =)

[Bud]

The 1000x scope environment variable has this line:
preboot=fpga; expi 62500

Maybe you can try adding to your uboot env .

[analogRF]

The 1000x scope environment variable has this line:
preboot=fpga; expi 62500

Maybe you can try adding to your uboot env .

that variable also exists in 3000A. In fact those steps that he said in the previous post they all execute during the normal boot process and they are using other env vars.
so technically if the normal boot process would have executed it would have gone through those steps but the reason it doesn't in my opinion is that he has messed with the env vars so much. maybe deleted something that is critical ....

[tabajaralabs]

After days of crying and sweating...The scope is "working"
The "working" between commas because there are some questions I'm still unable to find a solution.
- Boot is slow, looks like it is running a kind of "checkdisk" every boot.
- I cannot, in the name of the spaghetti monster, load another firmware than 2.50. It says the file has an error and does not load the upgrade. Nor the hack.
- The web server returns "File not found"
- On boot appears "System concerns detected, os version is not correct, please reload system firmware"
- VNC server does not work

Firstly I loaded V1.10, then 2.50.

Any tips?
Thanks!

[onesystem]

Did you load stock firmware of a liberated one? If it was liberated, try loading stock firmware and see if the error persists

[tabajaralabs]

Firstly I loaded stock firmware. Same error. So I loaded the modded firmware and the error is the same. Interesting that since I loaded 2.50 firmware, I cannot load ANY firmware different from 2.50. It is like a "write protection" is enabled on flash and cannot be disabled. Also, in both firmwares, the scope takes the best part of 5 minutes (!!!) to initialize.

Well, at least I saved the scope, but I am still intrigued I cannot change the firmware, the modded firmware does not open the optional functions and the time it takes to boot. I'll log the boot thru UART and paste here.

[tabajaralabs]

DSO-X2002A, firmware 2.50.* hacked, takes almost 5 min to boot

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  3  2  1  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-05-07   8:18:27 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37749 Bytes = 36.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
RTC: 2025-4-13   22:30:16.78 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
RTC: 2025-4-13   22:30:16.82 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOOOXOOXOOXXOOXOXOOOOXOXOOOOOXOOOXOOXOXOXOXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXOOOXOOX
OOOOXXXOOOOXOOXOOXOOOOOOOOOXOXOOOXOOOOOOXOXOOOOOXXOOOOOOOXOXOXXOOXOXOOOXOOOXOOXOXXXOXOOOXOXXXXOXOXXOXXXXXOXOXXOOOXXXOXXXXXXOXXXXXXOXXXXOXOXOXOOOXXXXOXXXXXOOOXXOXXOOXXOX
XXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOOXOXOOXOOXXXXXXXXXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1ACA724, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------

• : Address=0x80361000  Length=0x1ACA724  Name="" Target=RAM

 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2025-4-13   22:30:20.17 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Feb 27 2019)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:14:9C:AE
Phy found addr 31 (ticks=3406)
WaitForLink Start (ticks=3408)
Link Detected (ticks=3410)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
phyCfg->bFullDuplex 0x1
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Autonegociation Start (ticks=5436)
Running infiniiVisionInstallHelper
Running launchNetworkServices
Starting Agilent LXI Services.
Device load time:
Autonegociation End (ticks=7941)
WaitForLink Start (ticks=7942)
Link Detected (ticks=7945)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
cable attached
SHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]
SHIM [AgilentPalWin32.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
AgilentLxiWebStartUp successfully started LXI web service.
   NANDFLASH: 0 ms
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
Our command line is
Performing Startup
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses

      creating \Secure\cal\
      creating \Secure\help\
      creating \Secure\bin\Released build, Feb 27 2019, 20:34:05
Initializing FPGA...
****
FPGA Type: Idaho
Ver: 2.027 Released
Build Time: Tue Oct 13 16:48:05 2015
Build Machine: TS2404M
****
SHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]
SHIM [AgilentPalWin32.dll] Get Process Addresses
Programming LAN option module...
Failed to open \Secure\infiniivision\fpga\lanFpga.bin FPGA binary file
Keyboard firmware version 32... ok
Keyboard Info: Board id 7, Board rev 2
Serial Number file isn't loaded, defaulting to 0
Could not load valid cal factors
Startup sequence is complete.
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
System has been running 138.218582 seconds
Start Up Sequence 9.251840
Memory Load 56%
   System Physical Memory 40.750 / 73.277 MB
   Process Virtual Memory 43.188 / 1024.000 MB
-----> InfiniiVision is running <-----
failed open \Secure\InfiniiVision\LudicrousSpeed.usb
no workaround for USB phy

[analogRF]

it has taken 2min and 18sec to boot not close to 5 min but still is 6 times the normal boot. it is partly due to the lan cable and lan module
remove the lan module post the log again

i dont see the scan of file system and it is trying to create the cal directory each time!? obviously all cal files are gone or they are not accessible due to nand problem?
same goes for the serial number of the scope and that might be the reason u cannot upgrade. What S/N shows up in the scope now?

does it even work? I mean does it show any signal correctly at all?

[Bud]

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
...
Could not load valid cal factors
...

Not good. Don't you have an overly thick trace now? Any DC offset?  Get a sinewave to the scope input and check how it looks. Also check what Calibration status says.

[tabajaralabs]

it has taken 2min and 18sec to boot not close to 5 min but still is 6 times the normal boot. it is partly due to the lan cable and lan module
remove the lan module post the log again

i dont see the scan of file system and it is trying to create the cal directory each time!? obviously all cal files are gone or they are not accessible due to nand problem?
same goes for the serial number of the scope and that might be the reason u cannot upgrade. What S/N shows up in the scope now?

does it even work? I mean does it show any signal correctly at all?

Removed the LAN module, the boot time is more or less the same. I'll paste it here
I don't know about the cal files. Where are they located?
The serial number of the scope appears on the "about osciloscope page", same number as the sticker behind it
SEEMS to be working OK. I connected the signal generator and, up to 10MHz, seems to be working mostly ok. Didn't do the user cal yet because I'm organizing the lab and the BNC cables are stashed somewhere I don't know

þ

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  3  2  1  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-05-07   8:18:27 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37749 Bytes = 36.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
RTC: 2025-4-14   1:46:40.50 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
RTC: 2025-4-14   1:46:40.54 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOOOXOOXOOXXOOXOXOOOOXOXOOOOOXOOOXOOXOXOXOXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXOOOXOOX
OOOOXXXOOOOXOOXOOXOOOOOOOOOXOXOOOXOOOOOOXOXOOOOOXXOOOOOOOXOXOXXOOXOXOOOXOOOXOOXOXXXOXOOOXOXXXXOXOXXOXXXXXOXOXXOOOXXXOXXXXXXOXXXXXXOXXXXOXOXOXOOOXXXXOXXXXXOOOXXOXXOOXXOX
XXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOOXOXOOXOOXXXXXXXXXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1ACA724, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------

• : Address=0x80361000  Length=0x1ACA724  Name="" Target=RAM

 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2025-4-14   1:46:43.89 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Feb 27 2019)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:14:9C:AE
Phy found addr 31 (ticks=3409)
WaitForLink Start (ticks=3411)
No Link (ticks=4413)
<--EDeviceInitialize

GMAC DMA status register = 0x0
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Device load time:
   NANDFLASH: 0 ms
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
Our command line is
Performing Startup
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses

      creating \Secure\cal\
      creating \Secure\help\
      creating \Secure\bin\Released build, Feb 27 2019, 20:34:05
Initializing FPGA...
****
FPGA Type: Idaho
Ver: 2.027 Released
Build Time: Tue Oct 13 16:48:05 2015
Build Machine: TS2404M
****
SHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]
SHIM [AgilentPalWin32.dll] Get Process Addresses
No option module detected
Keyboard firmware version 32... ok
Keyboard Info: Board id 7, Board rev 2
Serial Number file isn't loaded, defaulting to 0
Could not load valid cal factors
Startup sequence is complete.
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
System has been running 139.276337 seconds
Start Up Sequence 9.020849
Memory Load 51%
   System Physical Memory 36.645 / 73.277 MB
   Process Virtual Memory 42.563 / 1024.000 MB
-----> InfiniiVision is running <-----
failed open \Secure\InfiniiVision\LudicrousSpeed.usb
no workaround for USB phy
8

[Bud]

I don't know about the cal files. Where are they located?

...
      creating \Secure\cal\
...

This is the location. But it was overridden with an empty one.

[Lydia]

Hi guys! I've met a strange problem, there's a DSOX-2014A can't boot due to traditional NAND failure, but unfortunately, it's u-boot cannot be interrupt by using space.

I've tried using USBboot and USB-Serial, but obviously, u-boot on the USB-Serial can't boot the scope, it will stuck and stop, no light turned on

To verify, I teared down a functional DSOX-2012A and using the same nk.nb0 file and U-Disk, it boots perfectly no matter I use Serial or TFTP through On-board Serial port
And if I use the USB way trying to boot, then it will just stuck like the dead one.

now I'm trying to flash the NOR chip to get a interruptable U-boot.

Is that possible or a right way to deal with this problem?
Any other things or steps I missed? Other way can be taken?

Anyway, thanks you guys so much that offering plenty information in this post.

[analogRF]

Hi guys! I've met a strange problem, there's a DSOX-2014A can't boot due to traditional NAND failure, but unfortunately, it's u-boot cannot be interrupt by using space.

I've tried using USBboot and USB-Serial, but obviously, u-boot on the USB-Serial can't boot the scope, it will stuck and stop, no light turned on

To verify, I teared down a functional DSOX-2012A and using the same nk.nb0 file and U-Disk, it boots perfectly no matter I use Serial or TFTP through On-board Serial port
And if I use the USB way trying to boot, then it will just stuck like the dead one.

now I'm trying to flash the NOR chip to get a interruptable U-boot.

Is that possible or a right way to deal with this problem?
Any other things or steps I missed? Other way can be taken?

Anyway, thanks you guys so much that offering plenty information in this post.

first try to press the space bar before powering the scope and keep it pressed. it should stop.
also make sure your RX connection is good and you do actually send correct letters to the scope.

as one had suggested if you can stop the boot with USB method and get to p500> then just change the bootdelay variable from 0 (sec) to something like 3 or 5 (sec) and make sure you issue saveenv before quitting. then go back to UART and do the recovery

[Lydia]

Hi guys! I've met a strange problem, there's a DSOX-2014A can't boot due to traditional NAND failure, but unfortunately, it's u-boot cannot be interrupt by using space.

I've tried using USBboot and USB-Serial, but obviously, u-boot on the USB-Serial can't boot the scope, it will stuck and stop, no light turned on

To verify, I teared down a functional DSOX-2012A and using the same nk.nb0 file and U-Disk, it boots perfectly no matter I use Serial or TFTP through On-board Serial port
And if I use the USB way trying to boot, then it will just stuck like the dead one.

now I'm trying to flash the NOR chip to get a interruptable U-boot.

Is that possible or a right way to deal with this problem?
Any other things or steps I missed? Other way can be taken?

Anyway, thanks you guys so much that offering plenty information in this post.

first try to press the space bar before powering the scope and keep it pressed. it should stop.
also make sure your RX connection is good and you do actually send correct letters to the scope.

as one had suggested if you can stop the boot with USB method and get to p500> then just change the bootdelay variable from 0 (sec) to something like 3 or 5 (sec) and make sure you issue saveenv before quitting. then go back to UART and do the recovery

Thank you for reply so much!

After reading this message, I use printenv both on USB-Serial and serial-onboard by using the functional one, alomst of them are same, but some vars like pbootdelay, stdin, stdout, stderr are totally different
Using On-board serial, it shows stdout=serial, stdin=serial, stderr=serial, pbootdelay=0
Using USB-serial, it shows stdout=usbtty, stdin=usbtty, stderr=usbtty, pbootdelay=-1
So I dont really sure I can directly save the envs under USB's u-boot

also, in the interruptable u-boot, even pbootdelay=0, it still indicate that press space to pause, but another one totally without this message.

So I'm trying to get a copy of my NOR first,  try both edit env and flash NOR independently.
Once I get success, I will post some conclusion here... good luck to me

[analogRF]

I was talking about bootdelay not pbootdelay.
still if you keep pressing space bar when you switch on most likely it will stop.
unless your setup is not sending the correct character to RX line

[TSOL]

Has anyone done any work on the T-series version of these scopes? I am looking at getting a 3XXX-T series scope for the power analysis functions and Keysight's S-tier hardware, but it has stiff competition if it cannot yet be upgraded.

[BillCRM]

Has anyone done any work on the T-series version of these scopes? I am looking at getting a 3XXX-T series scope for the power analysis functions and Keysight's S-tier hardware, but it has stiff competition if it cannot yet be upgraded.

Already hacked by forum members, but bandwidth hack requires hardware modification.

[BillCRM]

Some progress on dsox4000 hardware mod: the USB decode part requires a custom chip made by agilent, so hack might be not possible, but BW hack basicly same as dsox3000T series.

[Hirschinger]

*** Edit ***
This is solved, had to remove the USB Stick and the Serial connection, now it is working again
Thanks all for writing the infos here.


Hello to all the Brave Guys still here on Page 143 and Thanks a lot for the help.
I Have a DSOX4024A here with NAND Issue and tried the USB-Serial-Version described in here with Version 4.08 and 7.65 as they were the only versions i was able to find online.
The Transfer always stopped around 75% afterwards i tried it with the recover.nk.bin.comp File as described by imett in Post 2435.
That worked at least so far that it booted again and wanted to get a new firmware via USB-Stick.
There i also tried 4.08 and 7.65 with same Result: The Scope is hanging in a Bootloop.
I will attach the Teraterm Log down and hope that someone can help me.

Update: the attached .txt contains the log including the SW Flash


Thanks a lot
Hirschinger


U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 256 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-10-29   8:22:14 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37935 Bytes = 37 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
RTC: 2025-5-18   19:11:14.30 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Oct 29 2015 01:39:04
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

image2 value is out of range 0 so it will be ignored.
  It must be a hexadecimal integer between 0xd00000000 and 0xd7ffffff or between 0x800000000 and 0x87ffffff.

System ready!
Preparing for download...
RTC: 2025-5-18   19:11:14.35 UTC
 Loading image 1 from memory at 0xD0400000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOOXOOOOOOOXOOXOXOOOOXXXOOOOOOOOOXOOOOXOXXOOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXOOOXXXOXXOXXOOXXXOOOXOOXOOOXXOOXXOOOOXOXOOOOOXOOOXOOOXXXXOXXXOXOXOXXOXXXXXXXXXOOOX
OOOXOOXOOOXOOOOXOXOXOOOOOOXOOOOXOXOOOOOXXOOOOOXOOXOOXXOOOOOOOOOOXXOOOXOOOOOOOXXOOOOOXXOOOOOOOXOXOXOOXOXOOOXOOOXOOOXXXXOXOOOXOXXXXXOXOXOXXXXXXOXOXXOXOOXXOXXXXOXXXXXXXXOXXXXXXXXOOXXOXXOOOXX
XXOXXXXXOOOXXOOOXXOXOOOXOXXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXXXOXOOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXXXXXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x5437B34, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------

• : Address=0x80361000  Length=0x5437B34  Name="" Target=RAM

 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2025-5-18   19:11:24.3 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Dec  5 2024)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:21:B2:00
Phy found addr 31 (ticks=4770)
WaitForLink Start (ticks=4771)
No Link (ticks=5774)
<--EDeviceInitialize

GMAC DMA status register = 0x0
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
SHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]
SHIM [AgilentPalWin32.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
AgilentLxiWebStartUp successfully started LXI web service.
Device load time:
   NANDFLASH: 1 ms
   SNANDFLASH: 1 ms
   USB Hard Disk Drive: 1 ms
Incorrect Parameters