DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[laserK]

Hi,

after some further digging I found a way into the 4000 series scopes. I can only speculate,but from the similarities of the firmware I assume that this way works also with the 3000T series. I have no hardware to test this.
The command line switch has moved, but it is still present. Since usb booting is not enabled you need a telnet login.
I patched the dll inside the nk.bin file. This is rather simple as the nk.bin is not compressed and you can just search for the binary values from the infiniivisioncore.dll rather than unpacking, paching, and repacking a new nk.bin. CRC32 values need to be computed correctly for each block in the nk.bin. viewbin.exe from the nkbintools was helping here (at least displaying block offsets and checksums).
The patched nk.bin can be booted from the WinCE bootloader with the help of CELoader. Therefore a serial adapter is necessary to stop the bootloader with "space". The pinout for the 115200 8N1 serial debug connection is the same as for the 2000/3000 series.
Once booted, the scope app can be killed and restarted with the command line options.
Alternatively to the CELoader one can also flash the patched nk.bin.comp (compressed with bincompress after patching) from usb via telnet:

Code: [Select]

\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
To undo, one just needs to do a firmware update (with same version number).

The above method works for v4.07. Not sure about v7.06 and v7.10.

[adranp]

Hi :laserK,

As it seems for 7.10 there is no need to patch the .dll. Just swap the infinivisionLoader.exe and everything is working.

I'll try hopefully at the end of this week the usb method to see if there's any chance it was re-enabled in 7.10.

Thanks.

[adranp]

One thing I encountered in 7.10 and someone kind of confirmed it, is telnet login failing with "Logon Incorrect".

Let me know if anyone else encountered this and I can provide my take on it.

[ELIK]

Answer is already presented in this thread.

[HardDrive]

One thing I encountered in 7.10 and someone kind of confirmed it, is telnet login failing with "Logon Incorrect".

The first login always return "Logon Incorrect". Just perform the login again, it should work the second time.

[Bud]

I recall this is has to do with telnet having an extra character in the buffer at start. Just hit Enter to clear the buffer, then login. No need to type login information twice.

[adranp]

Hi :Bud and :HardDrive,

I know what you are talking about, but this is not the case I have encountered.. "Login Incorrect" goes on until you need to restart the scope multiple times until it works..
I use a Mac terminal so there is no extra character at start.. 

Is any of you using the scope with a valid internet access gateway? It seems to me that after I disabled the valid gateway on the scope the issue vanished.

[Bud]

I do not have a 3K yet, can't comment at this time.

[ELIK]

One thing I encountered in 7.10 and someone kind of confirmed it, is telnet login failing with "Logon Incorrect".

Let me know if anyone else encountered this and I can provide my take on it.

Too less info by you, there is no any source data for your case, just a result only. What you want by the people with such question??? 
Why do we need your "take on it"?
If you have a problem with that - please give a bit more information then someone can help you. There are no magicans, guess what you do there, what you use as "login/password" in your telnet as example.

[adranp]

:ELIK

Read all my posts and you'll have all the info needed. No need to get upset in any way 

I had a problem and I solved it.. Just wanted to let ppl know that if someone else has this issue I can provide my "take" (read solution) for it..

[ELIK]

Okey, sorry for my misinterpretation of your messages.

[TheSteve]

Has anyone accurately measured the -3dB point of a 3104A or 3104T?
If not, is anyone up for checking it for me?

[Neganur]

I did the A some years ago, it drops off brick wall like after 1.1 GHz. At 1GHz it was less than 0.8 dB down.

Will see if I have the screenshot

[Someone]

I did the A some years ago, it drops off brick wall like after 1.1 GHz. At 1GHz it was less than 0.8 dB down.

Will see if I have the screenshot

You posted it up and came to a very similar result to the unit I measured:
https://www.eevblog.com/forum/testgear/frequency-response-of-your-dso/msg192576/#msg192576
https://www.eevblog.com/forum/testgear/frequency-response-of-your-dso/msg427701/#msg427701

[ELIK]

Hello all
I see the trouble: MSO-X3024A version of firmware 2.42, the try to adding anything to the empty "infiniivision.lnk" (INFINI~1.018) file in the infiniiVisionSetup.cab, causes after restart always the message on the screen "System concerns detected: OS version is not correct. Please reload system firmware". MD5 sum is correct, the content of .lnk is correct too ( lnk was checked on the previous versions - work well).

If I do the stop and restart infiniivisionlauncher.exe with options manually, via Telnet - all works fine.
The trouble come is only if I try to change this lnk file right in the filesystem (use permanent way without usb)...

Could anyone fix this problem in the installer pack?
Sorry, let me asking another: This trouble is only in my tool, or someone have it too?

[bg8up]

The MSOX3000T's Nk include infiniiviaionlauncher.exe which decompress into folders /Windows and /program files/infiniivision everyboot,excep Version 3.xx.
In Version 4.xx or 7.xx, the infiniivisionlaunch is different as infiniivision.cab,it doesn't accept -l parameter.

Version3.xx is defined by /secure/startup/infxxx.lnk.
Version 4.xx and 7.xx,which define the startup parameter is not clear
The way to permanent options,should find out startup process and parameter in Nk.

[ELIK]

Question is closed, trouble was fixed.  My mistake was next: I am used the TotalCommander for packing back the content of "infiniiVisionSetup.cab".

[Howardlong]

Regarding the timebase quadrature encoder on the MSOX3000A, is it just mine/me, or does this very frequently miss clicks? It's my only irritation in an otherwise slick UI. Other knobs work fine.

In comparison, the MSO7000B and 54642D are perfect in this respect. Even the Tek MDO3000, renowned for its sedentary nature, doesn't actually miss QE inputs, although it might take a while to respond.

[PA0PBZ]

Regarding the timebase quadrature encoder on the MSOX3000A, is it just mine/me, or does this very frequently miss clicks?

I never noticed this, but let's see what others think.

[Howardlong]

Regarding the timebase quadrature encoder on the MSOX3000A, is it just mine/me, or does this very frequently miss clicks?

I never noticed this, but let's see what others think.

I am wondering if it's the encoder itself, the behaviour is sporadic but frequent and easy to reproduce, apparently aggravated by recent use, and doesn't seem to be affected by how much activity is actually going on on the scope.

[Safar]

I never noticed this, but let's see what others think.

Work well in my DSOX3034A

[Howardlong]

I never noticed this, but let's see what others think.

Work well in my DSOX3034A

It seems to be much worse very recently, I am thinking now it may be a physical fault, hopefully a bit of switch cleaner will resolve.

[mikeselectricstuff]

I never noticed this, but let's see what others think.

Work well in my DSOX3034A

It seems to be much worse very recently, I am thinking now it may be a physical fault, hopefully a bit of switch cleaner will resolve.

Could also be a cracked solder joint or PCB track near the encoder. One way to diagnose this is to see if it gets better or worse if you apply a slight sideways force in various directions while turning

[Howardlong]

I never noticed this, but let's see what others think.

Work well in my DSOX3034A

It seems to be much worse very recently, I am thinking now it may be a physical fault, hopefully a bit of switch cleaner will resolve.

Could also be a cracked solder joint or PCB track near the encoder. One way to diagnose this is to see if it gets better or worse if you apply a slight sideways force in various directions while turning

The symptoms you mention were indeed there, however when I disassembled the unit there was no evidence of any bad joints. Rather than just re-touch them and re-assemble, I had a look in the parts drawers and found I had almost identical device in stock that fits perfectly and functions identically electrically with the right number of detents (24) and a push switch. Even the shaft is the right length and type. So I replaced the knob. It works perfectly.

The part is RS part number 6234237, and the manufacturer's details are Alps EC12E2424407.

The problem has been there since I bought the scope 18 months ago, but it wasn't that bad, I just put it down to Windows CE. It seems like it's been getting worse over time, but only now I've done anything about it as it became bad enough.

Edit: the job took about an hour and a half in total. Getting the old switch out is a chore, I snipped the leads in the end rather than risk ruining the PCB by trying to reflow it.

Edit 2: Coincidentally, this is the same encoder I used on a Rigol MSO1074z for the multi-finction knob mod.

[MarkL]

Regarding the timebase quadrature encoder on the MSOX3000A, is it just mine/me, or does this very frequently miss clicks? It's my only irritation in an otherwise slick UI. Other knobs work fine.

In comparison, the MSO7000B and 54642D are perfect in this respect. Even the Tek MDO3000, renowned for its sedentary nature, doesn't actually miss QE inputs, although it might take a while to respond.

I have an MSOX3104A and the timebase encoder gradually got worse over time with missing clicks.  At about 2.5 years old it was so bad I sent it back to Agilent for repair.  They confirmed the problem and replaced the encoder.  Plus refreshed the cal (that was nice since I wasn't expecting it.)

The encoder replacement was almost 3 years ago and now it's getting bad again.  Fortunately I have a service agreement, but I think it will be going back again within the next couple of months.