DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[bitbanger]

What's the status of 3000T series option mods? If potential for options I'll read back through the 90 pages but I haven't been in the loop since my 2000A. TIA.

[Sparky]

What's the status of 3000T series option mods? If potential for options I'll read back through the 90 pages but I haven't been in the loop since my 2000A. TIA.

Several people here have done it.

[ahakman]

Pinkus: If it doesn't start and it gets stuck with some of the front panel lights on, that sounds like the flash corruption problem. There's a few threads about it on the official keysight forums too that mention "try to start it 10 times - if you can start it, upgrade the firmware - it should be fine going forward. If you can't, send it in for replacement", so the intermittent starting issue that you're seeing is normal for the flash corruption issue. If you have to start it 200 or 300 times to get it to boot, I'd definitely get it replaced under the service note.

I just sent in a DSOX2012A with the non-booting flash corruption problem too a couple weeks ago, and got back essentially a brand new scope. Just opened up the box today and checked it out. I think the only thing that's original is the back cover with the original s/n sticker. Maybe the power supply too, but not sure, didn't take the cover off. The one I sent in had some scuffs on the front, and a little crack on the side where the front plastic meets the back cover. It's entirely replaced now.

When I sent it in, I told them, "If it's not covered by the service note for the flash, please let me know BEFORE you go ahead and repair under the fixed price repair", and they said they would do that. Wasn't contacted by them, other than an email confirming that it was indeed a flash problem and covered under the service note, and they were shipping it back to me.

Grabbed my probes from my 54645D, did the "upgrades" mentioned in this thread, and I'm a super happy camper now!

If I was you, I'd go ahead and send it on in! Was the best customer service I've gotten from any company in a very long time (though to be fair, I don't deal with many companies in a customer service type way - I either fix things myself, or if I can't, they go to "the parts pile")

[Gribo]

Is there any more interest in DSOXLAN boards? I just managed to sell my last one.

[jeccylx]

Has anyone cracked 3034T?I downloaded the upgrade firmware, referring to 3034A, I modified two places, but the LNK file can not open option.who can hlep me?

[JeffreyLatter]

Has anyone cracked 3034T?I downloaded the upgrade firmware, referring to 3034A, I modified two places, but the LNK file can not open option.who can hlep me?

Jeccylx The offsets should be those from PhillyFlyers Post on April 12, 2018, 06:13:47 am.

Code: [Select]

1) options patch: 0x486d00: change "04 00 A0 E1" -> "00 00 A0 E3"
2) nag patch: 0x4f24e0: change "A8 F1 93 E5" -> "01 00 A0 E3"

But check up on the thread, as I can't remember it precisely - But I can confirm the permanent mod via offsets works on the 3024T.
Otherwise, look at p71 at the end for quick 'n dirty workaround - But with a ng message.

[jeccylx]

Thanks very much!!! JeffreyLatter ，When I download firmware,The version is 3000XSeriesT.7.30.2019051434, my patch is:
option:00494E74 : 04 00 A0 E1 -> 00 00 A0 E3
nag   :00502350:  AC F1 93 E5 -> 01 00 A0 E3
i read P71,it must use "42.exe"?can not modify lnk file?

[gmaker]

Thank You!
Worked perfectly

For others wanting to do this, the Scopes for Dummies version as follows:

Download Phillyflier's patched firmware from post #2167 on page 87
Download Luminax's license patch from post #1529 on page 62
Extract license patch, open cmd window (if using MS Windows), navigate to license patch folder and rename infiniivision.lnk to .txt
Edit infiniivision.txt and replace text in the file with Odessa's modification from post#2197 on page 88
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID
Save and rename file back to .lnk
Copy firmware file (rename from .ksx to .cab if current scope fireware is older than v2.41) to FAT32 formatted USB drive
Copy licence files (2x .cab files and .lnk file) to same USB drive

Now go to your scope, turn on and plug in USB drive to front USB port
Press [Utility] > File Explorer, select the firmware file (3000XSeries.02.50.2019022736_patched.cab); then, press Load File, wait for scope to load and reboot.
Check firmware has updated to v2.5, if successful continue
Press [Utility] > File Explorer, select v241_link_install.cab file; then, press Load File, wait for scope to load and reboot.
Check licenses have all been added and if so...

Thank you to all those that made this possible 

It works! Thank you guys!

[ahakman]

Is there any more interest in DSOXLAN boards? I just managed to sell my last one.

Yes, I'd be interested in one. How much are they? Is this just bare PCB and I get the rest of the stuff, or is it a kit, or pre-assembled?

I was going to look into it, but I'm in the process of getting my office re-organized, so the scope isn't even on the bench yet

[The_PCB_Guy]

I also have several DIY LAN modules available now, either as a bare PCB, a kit, or fully assembled (price/lead times vary accordingly). PM me if you are interested.

- Matt

[Xavier64]

Thanks very much!!! JeffreyLatter ，When I download firmware,The version is 3000XSeriesT.7.30.2019051434, my patch is:
option:00494E74 : 04 00 A0 E1 -> 00 00 A0 E3
nag   :00502350:  AC F1 93 E5 -> 01 00 A0 E3
i read P71,it must use "42.exe"?can not modify lnk file?

Would someone be so kind and upload the patched nk.bin for firmware 3000XSeriesT.7.30.2019051434 ?!

Many thanks.

[Wade2019]

Hi,

I own a DSOX4024A , unfortunately my firmware version is “04.08.2016071800”。Because #1931 requires 7.20.2017102615 version to crack.

where can I download the firmware to"7.20.2017102615 "? 

Keysight can download firmware version 7.30.20190514, but can't download version 7.20.2017102615.

Thank you。

[mlloyd1]

I'm not sure what happened.
I tried installmodV2 posted earlier for a 3000T running 7.20.xxxx and got the "Unsealed Instrument" warning during booting and the "Systems concern detected: -Secure storage is unititialized. Please set instrument serial and licensing model numbers" error.
You can also see my BW and memory is chopped down as well.

Thanks for any ideas for recovery.

mlloyd1

[mlloyd1]

Sorry, I couldn't figure out how to attach 2 pictures to a posting.
This is the view during booting for my previous post.

mlloyd1

[JeffreyLatter]

Mlloyd1 - Thank you for the pictures. - Don't worry - I have had all of the above messages during my efforts.
I still got it recovered 

For everyone else - We're working in the PM's on this - my initial solution is to remove the mod and reestablish the original *.lnk - It should fix the serial etc. message.

I will be removing the mod-package for the 3000T series for a while, as I have had a couple of users with difficulties after installing since releasing it - So I will re-think the readme file and maybe update the package for safety.
I do state that using the installer is on your own risk, but I must admit, I do feel real bad, whenever there is a problem after trying it out.
 

[mlloyd1]

And I want to state that this tinkering is fun and educational (otherwise, why do it!) and I do not blame anybody for anything.
I read everything here (more than a few times) and decided to take the risk and learn something
This is MY scope and I decided what to do to it all on my own.
OK, is that enough disqualifiers?
 

To all the early adopters who sacrificed hardware and shared their knowledge, THANKS!!!!

mlloyd1

[mlloyd1]

Jeffrey:

After some playing around, I was able to get reconnected via telnet and also connected again to the device web pages.
So, I reran the installer and added the command.txt file to the USB drive this time.
After the reinstall and reboot, I still get the warning and error messages, but am very happy with the results in the "About Oscilloscope" screen.

[pquadrat]

Thanks very much!!! JeffreyLatter ，When I download firmware,The version is 3000XSeriesT.7.30.2019051434, my patch is:
option:00494E74 : 04 00 A0 E1 -> 00 00 A0 E3
nag   :00502350:  AC F1 93 E5 -> 01 00 A0 E3
i read P71,it must use "42.exe"?can not modify lnk file?

Would someone be so kind and upload the patched nk.bin for firmware 3000XSeriesT.7.30.2019051434 ?!

Many thanks.

I tried to do the patching on 7.30, but I do not understand the instructions about the checksum. Is this only to be done with IDA (freeware ok?) ?
All other steps are clear.

Thanks

[mlloyd1]

Jeffrey,

Yes, i still have the same error messages, including the one about "uninitialized secure storage" from message 2252: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2521839/#msg2521839

I also did a Hardware Self Test and got the "Self test failed: Firmware Status" error as shown in the image below.

mlloyd1

[Mr. Scram]

Probably a silly question, but I noticed the 2000X series having a signal generator instead of an AWG. Considering the signal generation appears to be done by the ASIC, is the lack of an AWG on the 2000X series a matter of software?

[pquadrat]

Jeffrey,

Yes, i still have the same error messages, including the one about "uninitialized secure storage" from message 2252: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2521839/#msg2521839

I also did a Hardware Self Test and got the "Self test failed: Firmware Status" error as shown in the image below.

mlloyd1

I think the method from Jeffrey is obsolete, I used it also, but removed it because of the error messages.

Then I used this method:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2166124/#msg2166124
with the correct nk.bin.comp file, and modify the inf file to your needs, it works without any issues.

Still looking for a nk.bin.com file for the newest firmware (7.30).

[mlloyd1]

pquadrat:

you were working on a "T" (touch) series, correct?

mlloyd1

[pquadrat]

pquadrat:

you were working on a "T" (touch) series, correct?

mlloyd1

Yes, it is a DSOX-3104T.

[Mr. Scram]

I've skimmed through the thread and have learned a lot. Can anyone please confirm the following?

*Any oscilloscope still on Agilent firmware should be upgraded to modern firmware to prevent NAND issues and possibly add extra features
*To enable features as described in this thread on recent firmware you need a DSOXLAN module or equivalent alternative. Enabling without a LAN module is no longer possible
*When enabled there is a feature which allows downgrading of the oscilloscope back to stock for the purposes of warranty or selling it.

Is this current and correct for a 2000X series?

[FrankBuss]

*To enable features as described in this thread on recent firmware you need a DSOXLAN module or equivalent alternative. Enabling without a LAN module is no longer possible

It might be possible to poke around with the UBOOT booloader over serial port, see here for the pins. I loaded a modified nk.bin over ethernet with the telnet password disabled this way (this was at a time when the Star Wars password was not known). But might be possible to do something over the serial port, only, as well, like patching some bytes in the flash, if you know the right locations and values.