Also, I would suggest buying a DSO7000 (ideally DSO7104) and then enabling the MSO option from the service menu. Then all you need to do is buy the MSO probe, either 54620-68701 (kit) or 54620-61601.
Here is how you enable the service menu:
telnet <ip> 5810
username panther
password pictures
-> cmd
[vxWorks]# mem modify -w 1 0x009A2187
0x009a2187: 0x00-0x01
0x009a2188: 0x00-.
utility -> options -> licenses -> options
enable 'service mode', 'all licenses', and 'mso'
reboot scope
I don't think service mode doesn't enable all licenses - I think it's just the ones that allow hardware to be tested like memory and MSO. See This thread for info on a hack that allows all licenses to be installed.
As far as I can tell, it does. The service menu on my 7104 lists the following options:
Verbose
Service mode
Diagnostics
Power-on default setup
Messag diagnostics
String database diagnostics
Control message diagnostics
All licenses
MSO
Factory MSO
Acq memory = 2M
Acq memory = 8M
Acq memory = MAX
Before enabling all options, my license string is:
MSO, mem8M, LSS, SEC, 232, SGM, LMT, MST, A00
After enabling all options, my license string becomes:
All*, MSO, MSO*, FPG*, memMax*, LSS, AMS*, CAN*, SEC, ALT*, PWR*, 232, SGM, LMT, FRC*, MST, E00, SND*, FLX*, 553*
I will check the MSO7104B later to see what its new license string is, and which options appear to be enabled (namely, SGM and 232, it has the LSS license already)
Now, I did see something about circular segmented memory, which this does not enable (as far as I can tell). However, the telnet method is basiclly zero risk. I was unable to get the patch method working, and bricked my scope in the procces (manually reset it after it did not reset itself after waiting 10 minutes or so, and it didn't boot up afterwards). Fortunately, it is now un-bricked, but I am not going to try that again anytime soon.
Edit: from looking at an ebay auction wih an 'all options enabled' screenshot, it looks like anything the 'all licenses' enables has a * after it, and anything that was previously enabled does not have a *. The options string on that MSO6014A is:
All, MSO, MSO*, FPG*, memMax*, LSS*, AMS*, CAN*, BAT, ALT*, PWR*, 232*, SGM*, LMT*, FRC*, MST, E00, SND*, FLX*, 553*
So it will enable all of the 'standard' options, without any risky patching. And it can be disabled from the scope interface directly if you need to send it in for servicing, just un-tick 'service mode'.