DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[Howardlong]

user: "infiniivision"
pass: "skywalker1977"+hash(ModelName, SerialNumber, MACAddress)

Need to figure out how to hash that data exactly

Please don't, I don't need to buy any more scopes!

[memset]

Apart from that I don't think we know if it is possible to activate the options like that on a T model.

I think it's all the same.

[memset]

:memset  - Is strapping for 1Ghz the same as for 350/500Mhz ? I was under this impression..

:Memset  - Do you happen to have the values of your original parts in 3000A scope so I can compare it with mine's? I looked in the thread but I did see just values for upper bandwidth scopes.

Strapping description:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg980404/#msg980404

Some values for 100/200MHz and 350/500Mhz frontends:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg987126/#msg987126

For 3000-series there are 3 types for frontend:
- 100/200MHz - software upgradeable
- 350/500MHz - also software upgradeable
- 1GHz

You can jump from 100MHz to 200MHz (or from 350MHz to 500MHz) via the license, but you can't jump from 100/200 to 350 or 500 or 1GHz without board replacement or HW mod.
Note that for 3000X-series and up: 100MHz scope would be strapped to 200MHz and 350MHz scope would be strapped to 500MHz.

[memset]

Please don't, I don't need to buy any more scopes!

Why not? Buying scopes is fun!

I think I saw some code example there:
https://repl.it/FLUQ
http://pastebin.com/2NJjMTxQ

Not sure whether it works or not.

[cgroen]

Please don't, I don't need to buy any more scopes!

Why not? Buying scopes is fun!

I think I saw some code example there:
https://repl.it/FLUQ
http://pastebin.com/2NJjMTxQ

Not sure whether it works or not.

It does
Thanks !!!

[Howardlong]

I predict a rapid sales rise in the MSOX3014T.

[cgroen]

I predict a rapid sales rise in the MSOX3014T.

Oh yes, I could have saved a good amount of money going with a 100MHz and no APP2BNDL 
Anyway, no regrets, its a wonderful scope !!

EDIT: But boy it would be wonderful to get 500 MHz, I did not in the first place as that was a major price increase, but would be very very nice....

[TheSteve]

I predict a rapid sales rise in the MSOX3014T.

Oh yes, I could have saved a good amount of money going with a 100MHz and no APP2BNDL 
Anyway, no regrets, its a wonderful scope !!

EDIT: But boy it would be wonderful to get 500 MHz, I did not in the first place as that was a major price increase, but would be very very nice....

It is starting to look like this might be a possible reality. Can you give us details on the internal file structure of the "T" series.
The hardware mod to 500 MHz so far looks identical to the 3000A series.

[Dubbie]

So I have logged into my 3024T!

The python script worked great.

I used infiniivision for the username and the hash as the password

Now what?

[TopLoser]

So I have logged into my 3024T!

The python script worked great.

I used infiniivision for the username and the hash as the password

Now what?

Let the game commence!

[Howardlong]

So I have logged into my 3024T!

The python script worked great.

I used infiniivision for the username and the hash as the password

Now what?

Let the game commence!

How much for that scope you mentioned under your desk?

[Dubbie]

If I understand correctly I can get 350Mhz without any hardware modifications, is that correct?

If that is the case, what is the command for that? -bw35?

[TopLoser]

So I have logged into my 3024T!

The python script worked great.

I used infiniivision for the username and the hash as the password

Now what?

Let the game commence!

How much for that scope you mentioned under your desk?

A lot less than you can buy it anywhere else, but there's a sale pending so I won't be listing it for a couple of days.

[tautech]

If I understand correctly I can get 350Mhz without any hardware modifications, is that correct?

If that is the case, what is the command for that? -bw35?

Can I sense which of your instruments will get improved next ? 

[TopLoser]

If I understand correctly I can get 350Mhz without any hardware modifications, is that correct?

If that is the case, what is the command for that? -bw35?

No, you can get a maximum of 200MHz with a stock 3024 or 3014, you need a stock 3034 if you want to push it to 500MHz without hardware mods. That's my understanding anyway...

[Dubbie]

Ah ok, Well in that case, onto the Hardware mods.

Need to find those Teledyne relays!

[TheSteve]

I am thinking the MSO feature will not be lost if a T series 100/200/350/500 MHz scope is strapped for 1 GHz. The T series uses a single part number for the MSO upgrade. The A series used two numbers, one for the 100-500 MHz scopes and one for the 1 GHz. I expect the two versions use different licenses which could explain why the MSO feature was no longer enabled when memset tried it.

[TheSteve]

Ah ok, Well in that case, onto the Hardware mods.

Need to find those Teledyne relays!

The relays are only needed if you want to go to 1 GHz - if 500 MHz is enough then the existing mod for the 3000A series should be fine. Of course I think we'd all like to go to 1 GHz - assuming we can determine the proper capacitor values(and get the relays).

[TopLoser]

I am thinking the MSO feature will not be lost if a T series 100/200/350/500 MHz scope is strapped for 1 GHz. The T series uses a single part number for the MSO upgrade. The A series used two numbers, one for the 100-500 MHz scopes and one for the 1 GHz. I expect the two versions use different licenses which could explain why the MSO feature was no longer enabled when memset tried it.

I can test that theory if needed....

[cgroen]

I predict a rapid sales rise in the MSOX3014T.

Oh yes, I could have saved a good amount of money going with a 100MHz and no APP2BNDL 
Anyway, no regrets, its a wonderful scope !!

EDIT: But boy it would be wonderful to get 500 MHz, I did not in the first place as that was a major price increase, but would be very very nice....

It is starting to look like this might be a possible reality. Can you give us details on the internal file structure of the "T" series.
The hardware mod to 500 MHz so far looks identical to the 3000A series.

Attached is a dump of the file structure of my MSOX3024T (3 months old approx). Scope has all features enabled (APP2BNDL).
The folder \Secure\System\Licensing\Store has been changed by me, there was a list of hex keys (I guess) and I changed these to something else.

[PA0PBZ]

Attached is a dump of the file structure of my MSOX3024T (3 months old approx).

So, the infiniivisionlauncher.exe is missing from the \Secure\infiniiVision folder:

Code: [Select]

Directory of \Secure\infiniiVision

10/18/11  08:47p    <DIR>                    web
10/18/11  08:47p    <DIR>                    fpga
10/06/16  04:48p                     1152032 splashImage.bin
12/29/15  10:27a                      105160 symbols.tte
12/29/15  10:27a                        1891 usbDemoData.html
12/29/15  10:27a                      822702 usbDemoDataEye.png
12/29/15  10:27a                      822702 usbDemoDataPlot.png

Found 7 file(s). Total size 2904487 bytes.
But apart from the Program Files\infiniiVision folder there is another infiniivisionlauncher.exe in the \Windows folder... Interesting.
Can you show the content of the infiniivision.lnk in the \Secure\Startup folder? I bet it is pointing to the launcher in Program Files.

[cgroen]

Attached is a dump of the file structure of my MSOX3024T (3 months old approx).

So, the infiniivisionlauncher.exe is missing from the \Secure\infiniiVision folder:

Code: [Select]

Directory of \Secure\infiniiVision

10/18/11  08:47p    <DIR>                    web
10/18/11  08:47p    <DIR>                    fpga
10/06/16  04:48p                     1152032 splashImage.bin
12/29/15  10:27a                      105160 symbols.tte
12/29/15  10:27a                        1891 usbDemoData.html
12/29/15  10:27a                      822702 usbDemoDataEye.png
12/29/15  10:27a                      822702 usbDemoDataPlot.png

Found 7 file(s). Total size 2904487 bytes.
But apart from the Program Files\infiniiVision folder there is another infiniivisionlauncher.exe in the \Windows folder... Interesting.
Can you show the content of the infiniivision.lnk in the \Secure\Startup folder? I bet it is pointing to the launcher in Program Files.

Here you go Paul:


\> type secure\startup\infiniivision.lnk
56#"\Program Files\infiniiVision\infiniivisionLauncher.exe"
\>

[cgroen]

This is the "about" screen from my scope with firmware version number etc:

[PA0PBZ]

As I expected it starts the launcher in the Program Files folder.

If you feel like doing a little experiment you can try the following:

taskkill /im infiniivisionLauncher.exe

\windows\infiniivisionlauncher.exe -bw35

Your hardware is not 350MHz but I wonder if it will show the 350MHz on the info screen, and also it could warn about 'unfinished software' like it does on the non-T version.

After that reboot the scope or kill the launcher again and start the one in Program Files\infiniiVision.

[cgroen]

As I expected it starts the launcher in the Program Files folder.

If you feel like doing a little experiment you can try the following:

taskkill /im infiniivisionLauncher.exe

\windows\infiniivisionlauncher.exe -bw35

Your hardware is not 350MHz but I wonder if it will show the 350MHz on the info screen, and also it could warn about 'unfinished software' like it does on the non-T version.

After that reboot the scope or kill the launcher again and start the one in Program Files\infiniiVision.

I'm not able to execute "taskkill" ? If I search for taskkill as an exe it is not found, and it is also not listed as a builtin command in the telnet ??