Agilent MSO 5000/6000/7000 - anyone hacked these scopes?

[KE5FX]

The responsiveness of a 6000 or 7000 series scope is only appreciated, when you use a fancy 3000x or 4000x or 6000x for a while and go back to the older scope.

Especially the FFT function is far too slow in the modern scopes.

Sure about that? I tried to use FFT on my 7104A but that was horribly slow when set to 128k points. Like one update every 10 seconds IIRC.

At what sample rate?

[cos]

Hello Howardlong, thank you very much it works flawlessly!

If you are interested, please find the issue I had below.
As it appears to have affected other DSO5012A users I will make a new posting referring to this posting hoping to help them out.

Recently I obtained an Agilent DSO5012A. Installed options were mem8M, PWR, SGM, LMT, MST and E00.
The seller warned me not to update the SW as I might lose options as others had experienced.
The SW versions were: Boot 03.05, System 06.16.0001, Language 04.10, Library 02.25 and Graphics 02.19.
According to the Keysight site, System and Language were not up to date. Language updated without a problem to 06.16.
Then I took the gamble, updated System to 06.20.0000 and sure enough lost my options: only MST and E00 remained.
Reverting back to System 06.16.0000 did not bring the options back.

The topic "Agilent MSO 5000/6000/7000 - anyone hacked these scopes?" by dfnr2 also discussed the possibility of enabling options (licenses).
Reply #224 from mikeselectricstuff was my first clue for System version 06.16.0001 by unpacking, modifying and packing it again.
Reply #467 from berk98 addressed System version 06.20.0000.
This was all for the MSO series but as MSO was an option in the DSO series, I figured it would also work for the DSO variant.
The link for the unjzp and packjzp tools was not valid anymore: finally found them (aglt-master.zip) on github but not being very proficient in manipulating SW, could not make them work.
In a more recent reply (#606) by Orange I found jzp_0.2 which is apparently based on earlier work from flowswitch and miek but could not make it work either.
So I finally asked if and how that would work using Windows 10.
There was a promt reply #674 from Howardlong and that worked without a flaw.

I may not have done it the most efficient way but for those who ran into the same issue, here's how I dit it.
1) Created a similar folder structure (G:\source\hp\5012A\jzp_0.2) on a bootable USB drive, placing the latest (version 06.20.0000) sys6000.jzp file in the jzp_0.2 folder.
2) unpacked it using unjzp.exe to sys6000.bin file.
3) Selected sys6000.bin in a trial version of a hex editor and opened it.
4) Moved to line 002e80f0, clicked column 08 and entered the new value per reply #467. Note: the editor moves automatically to the next column, enter the new value and so on.
5) Saved the modified file.
6) Packed the modified file using packjzp which yielded sys6000.new.jzp.
7) Copied sys6000.new.jzp to another USB stick, deleted ".new" from the filename, connected it to the oscilloscope and installed the file.
After the automatic restart all original options had been restored!
Kudo's to all people who have made this possible!

[Howardlong]

Hello Howardlong, thank you very much it works flawlessly!

If you are interested, please find the issue I had below.
As it appears to have affected other DSO5012A users I will make a new posting referring to this posting hoping to help them out.

Recently I obtained an Agilent DSO5012A. Installed options were mem8M, PWR, SGM, LMT, MST and E00.
The seller warned me not to update the SW as I might lose options as others had experienced.
The SW versions were: Boot 03.05, System 06.16.0001, Language 04.10, Library 02.25 and Graphics 02.19.
According to the Keysight site, System and Language were not up to date. Language updated without a problem to 06.16.
Then I took the gamble, updated System to 06.20.0000 and sure enough lost my options: only MST and E00 remained.
Reverting back to System 06.16.0000 did not bring the options back.

The topic "Agilent MSO 5000/6000/7000 - anyone hacked these scopes?" by dfnr2 also discussed the possibility of enabling options (licenses).
Reply #224 from mikeselectricstuff was my first clue for System version 06.16.0001 by unpacking, modifying and packing it again.
Reply #467 from berk98 addressed System version 06.20.0000.
This was all for the MSO series but as MSO was an option in the DSO series, I figured it would also work for the DSO variant.
The link for the unjzp and packjzp tools was not valid anymore: finally found them (aglt-master.zip) on github but not being very proficient in manipulating SW, could not make them work.
In a more recent reply (#606) by Orange I found jzp_0.2 which is apparently based on earlier work from flowswitch and miek but could not make it work either.
So I finally asked if and how that would work using Windows 10.
There was a promt reply #674 from Howardlong and that worked without a flaw.

I may not have done it the most efficient way but for those who ran into the same issue, here's how I dit it.
1) Created a similar folder structure (G:\source\hp\5012A\jzp_0.2) on a bootable USB drive, placing the latest (version 06.20.0000) sys6000.jzp file in the jzp_0.2 folder.
2) unpacked it using unjzp.exe to sys6000.bin file.
3) Selected sys6000.bin in a trial version of a hex editor and opened it.
4) Moved to line 002e80f0, clicked column 08 and entered the new value per reply #467. Note: the editor moves automatically to the next column, enter the new value and so on.
5) Saved the modified file.
6) Packed the modified file using packjzp which yielded sys6000.new.jzp.
7) Copied sys6000.new.jzp to another USB stick, deleted ".new" from the filename, connected it to the oscilloscope and installed the file.
After the automatic restart all original options had been restored!
Kudo's to all people who have made this possible!

Rather than hacking the binary, the other option is to telnet into the scope on port 5810 and enable the options through the service menu.

Login/password credentials are panther/pictures.

The command is "setServiceMode(1)"

You can then enable All Licenses, MSO (6000/7000 only) and Acq memory = MAX from the Utility => Options => Licences => Options menu, and then restart the scope.

For those with a 6000/7000, my notes indicate that you may need to do two restarts to enable the MSO option.

There are a few esoteric options this method doesn't enable, notably FMS, BAT, FRS, TEL, 1MV, TOM and CIR,see post #661 for what these are.

Also see posts #225 & #227 in this thread.

6.16.0001 sys6000.jzp is in message #642. I recommend 6.16 over 6.20, as 6.20 has a nasty and obvious bug when using the horizontal zoom in both 6000 & 7000 scopes (and presumably 5000 too) identified in post #666.

[HighVoltage]

Rather than hacking the binary, the other option is to telnet into the scope on port 5810 and enable the options through the service menu.

That is what I did many years ago on my 7000B series scopes and the service menu is still active and works like a charm.

[cos]

Rather than hacking the binary, the other option is to telnet into the scope on port 5810 and enable the options through the service menu.

Login/password credentials are panther/pictures.

The command is "setServiceMode(1)"

You can then enable All Licenses, MSO (6000/7000 only) and Acq memory = MAX from the Utility => Options => Licences => Options menu, and then restart the scope.

For those with a 6000/7000, my notes indicate that you may need to do two restarts to enable the MSO option.

There are a few esoteric options this method doesn't enable, notably FMS, BAT, FRS, TEL, 1MV, TOM and CIR,see post #661 for what these are.

Also see posts #225 & #227 in this thread.

6.16.0001 sys6000.jzp is in message #642. I recommend 6.16 over 6.20, as 6.20 has a nasty and obvious bug when using the horizontal zoom in both 6000 & 7000 scopes (and presumably 5000 too) identified in post #666.

Thank you for the alternative method. For now I will stick to modifying the binary.

I can confirm that the horizontal zoom issue is also present in my 5000 series scope using the 6.20 sys file.

Unzipped 6.16.0001 sys6000.jzp from message #642. Unpacked the jzp file, modified the bin file, packed it again to jzp and loaded it into the scope.
That solved the zoom problem.
Note 1: In the sys6000.bin 06.16.0001 file the data from address 002E7B80 needs to be changed per reply #224 (sys6000.bin 06.20.0000 has a different start address).

Note 2: The scope remembers the last horizontal zoom timebase setting so returns to that value when zoom is reselected after it has been used previously.

Note 3: Selected all options via Utility => Options => Licences => write "ALL" in the input field => Apply => restart scope.
The list of available options and the resulting scope data are shown in the attachments.

[tv84]

Since some guys continue to ask for my help on this, I'll write this again about how to activate the options in these machines:

1 - EASIEST WAY: telnet to the scope, activate service mode and go to the menu and enable the options at will. As long as you can telnet, this will work. It may exist some conditions (not sure) where you can loose the activations and have to reenable them.
2 - BEST WAY: create the official licenses and insert them via the string menu (see here and here). This will officialy license the scope forever, no matter what happens to the FW versions.
3 - RISKIER WAY: create and install a patched FW version that overrides the license verification. If you change FW, you'll loose the added options and you'll have to reload a new patched version.

All these methods are detailed previously in this thread.

[Alex Nikitin]

So here is my new old scope - the Agilent MSO6014A, came from eBay, bought for an offer of £350, in an unknown condition (OK, it was shown powered up on the photos), apparently without any accessories (as I've been told by the seller only to discover on arrival a full set of somewhat mangled probes and a digital pod in the storage compartment of the scope) and in some places very dirty for a decent scope (just to give you a taste of it, below is a photo of one of the knobs before I've cleaned it). After a reasonably thorough cleaning I've powered it up and found that the scope generally works OK, has MSO (obviously), LSS (a good thing for me) and standard MST and E00. No memory unlock. After spending some time with the scope I've found a fried attenuator on  CH4, it doesn't work properly above 200mV/div and has some weird DC offsets at all positions, I will attempt to repair it if I have time.

So, the question: is it possible to unlock the full memory permanently? I don't care much about other licenses, would probably just buy one if possible but I guess it is not sold by Keysight now.

Cheers

Alex

P.S. - and if someone had a similar attenuator fault, all pointers in this respect are very welcome.

[Alex Nikitin]

Update: I can telnet to the scope, I can get the service menu, I can mark the options however it does exactly nothing, no memory increase etc. The firmware is v6.16 and I’m not adventurous enough to modify the code…  . Probably I’m missing something simple.

Cheers

Alex

[HighVoltage]

Update: I can telnet to the scope, I can get the service menu, I can mark the options however it does exactly nothing, no memory increase etc. The firmware is v6.16 and I’m not adventurous enough to modify the code…  . Probably I’m missing something simple.

Cheers

Alex

Hi Alex
Did you really turn on the Service Menu?
Does it stay on after a reboot?
Usually with the service menu turned ON, all options are activated and indicate by a start (*) next to the option.
At least on the 7000 series scope and the 6000 series should be the same.

[Howardlong]

Did you really turn on the Service Menu?
Does it stay on after a reboot?
Usually with the service menu turned ON, all options are activated and indicate by a start (*) next to the option.
At least on the 7000 series scope and the 6000 series should be the same.

I have both a 7104B and a 6104A, and, in this respect I confirm that they are the same, although they do use different firmware files.

6.16 is my recommended firmware version for both 6000 and 7000: the latest 6.20 has a nasty and obvious bug on the timebase setting when using the zoom window.

[Alex Nikitin]

Hi Alex
Did you really turn on the Service Menu?
Does it stay on after a reboot?
Usually with the service menu turned ON, all options are activated and indicate by a start (*) next to the option.
At least on the 7000 series scope and the 6000 series should be the same.

I can turn on the service menu by Telnet command and see the list of options with check boxes however the service mode doesn't stay on after a power cycle and if I check boxes the options checked do not appear in the licenses list with or without (*) and appear to do nothing (at least the memory does not increase from the sample rate values) .

Cheers

Alex

[HighVoltage]

I can turn on the service menu by Telnet command and see the list of options with check boxes however the service mode doesn't stay on after a power cycle and if I check boxes the options checked do not appear in the licenses list with or without (*) and appear to do nothing (at least the memory does not increase from the sample rate values) .

Cheers

Alex

You need to turn service mode ON
That allows you to turn on:
-  "ALL licenses"
-  "MSO"
-  "Acq memory = MAX"

If you go to "Options Acq memo ..." you should see the enclosed screen and under "About Oscilloscope" you should see the new options with a (*)

Here are my pictures from a 7000B series.

[Alex Nikitin]

It works now, 8MSa/s at 100ms/div  ! Many thanks, your screen shots did help, I did not check the Service Mode mark before! Now I need to find time and fix the attenuator fault in CH4. It certainly looks like a lower resistor fried or just o/c. Below are the screen shots - the one at 2V/div (including 1/10 probe) looks normal (though there is a problem with the line movement, it is not right) but at higher attenuations (5V, 10V, 20V, 50V) the signal looks wrong and has a wrong amplitude... . I very much hope it is a simple component failure.

Cheers

Alex

[HighVoltage]

Great!
Now, that you checked the Service Mode mark, it should stay activated after a reboot.

Yes, I would check the resistors first for the attenuator problem.
You can easily compare values with the other working channels.

These are great scopes, even if they are a little dated.

[Alex Nikitin]

Yes, it is a nice scope (especially for £350, even with a broken channel). I actually prefer it to later scopes as it starts in 12s flat, faster than my main Tek 2465BST. Is there a scope nowadays able to start faster (or even close to this time)?

Cheers

Alex

[2N3055]

Yes, it is a nice scope (especially for £350, even with a broken channel). I actually prefer it to later scopes as it starts in 12s flat, faster than my main Tek 2465BST. Is there a scope nowadays able to start faster (or even close to this time)?

Cheers

Alex

R&S RTB2000 starts very fast, around 10 sec. At least it did last time I tried it, a year or so ago.

[Howardlong]

Yes, it is a nice scope (especially for £350, even with a broken channel). I actually prefer it to later scopes as it starts in 12s flat, faster than my main Tek 2465BST. Is there a scope nowadays able to start faster (or even close to this time)?

Cheers

Alex

Here's my 54642D, under 5s.

[IXIS42]

Hello! I also bought such an oscilloscope. But it cost me 1600 dollars with customs clearance)

[IXIS42]

Hello! I have an Agilent 7034B oscilloscope. And I want to open all the options, please advise how to do it through the menu using Keygen. Thank you!

[HighVoltage]

Hello! I have an Agilent 7034B oscilloscope. And I want to open all the options, please advise how to do it through the menu using Keygen. Thank you!

Just read through the last few pages, it is all said and works well.