Some info I acquired these years:
2000/3000/4000A/T/G shared the same input chip (code name llama, used in some late dso5000/6000 too), the same ADC (code name talon), and the ADC might be a slightly modified vesion from old dso5000/6000 series, and the waveform procseeor chip (Megazoom, code name baldwin, it also used in 6000X series too).
The 3000A can mod to 500Mhz, but can't go to 1GHz due to lack some pads.
The 3000T/G can mod to 1GHz, but need 4 expensive relays. I belive use some normal relays and external attenuation networks will also works.
The 4034A can software hack to 4054A. The hardware mod to 1/1.5GHz is basicly impossible. As the mod requires to install a fpga between the ADCs to do USB decode, and an agilent 1NE5-0001B is also need to finish the signal path. But if ignore the potential error message, only do the mod to input part, the mod will be very similar to 3000 series.
As for the calibration after those hardware mod, the factory cal is also possible by just add a command in the infiniivison.lnk. Then the user cal will magically turned into factory cal.
As for the serial number and model number hack, the agilent secure data tools (DTD,OPD) is also leaked. Be careful as there were already some modded machines on the market.
As for the Keygen, yes the Keygen, is also achieved by someone in China, but he won't release it of course. But hacked firmware is enough for us to use so no keygen is also not a big problem.
Hope these info will help someone in the future.
