DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[WVL_KsZeN]

I've always thought the 50,000 waveforms/s of the 2000 was an artificial limit vs the 3000 series. And now they raised it to 200,000 for new units to make them competitive again. I wonder how much they will ask for the dsox2plus option..

I also wonder about the memory, the 2000 now has 1mb vs the 4mb (?) of the 3000. Maybe they will raise this to 2mb in the future (that would be most welcome!)

[Andrew]

...I wonder how much they will ask for the dsox2plus option...

If it is still the case that 3000A owners who had already purchased the app bundle don't get the FRA option then I suspect 2000A owners who want 200,000 wfms/s will have to hand over more cash for DSOX2PLUS or keep a watch on this thread.

[gamalot]

Upgraded to 2.43 

[Andrew]

Upgraded to 2.43 

That was quick  Are you able to confirm the increased update rate?

From http://www.datatec.de/Keysight-Upgrade-2000X-Oszilloskop-2018.htm

[gamalot]

Upgraded to 2.43 

That was quick  Are you able to confirm the increased update rate?

From http://www.datatec.de/Keysight-Upgrade-2000X-Oszilloskop-2018.htm

Be honest, I don't know how. 

[gamalot]

Upgraded to 2.43 

That was quick  Are you able to confirm the increased update rate?

From http://www.datatec.de/Keysight-Upgrade-2000X-Oszilloskop-2018.htm

Be honest, I don't know how. 

OK, I've watched Daniel's video, according to his instructions:

"You take the trigger out from your scope and you plug it into a frequency counter"

[PhillyFlyers]

infiniivisioncore.dll [snip] ** note:  in 2.42, the dll is no longer on disk, so you have to patch this directly in the nk.bin, and write to flash **

Where does one find the the dll in question?

All the best

Hi,

so basically you need to unpack the firmware image, decompress the nk.bin, and then extract the files from it, so you can get to the DLL...then from there, you can disassemble the DLL  and find the patch point(s). 

I have't had a chance to look at 2.43 yet, so if no one else already knows the 2.43 patch points, I'll get to it this week...

but once you have the patch point (or points if you want to also disable that 'unfinalized software' nag message), you can just find that code by doing a hex search in the uncompressed 'nk.bin' file, and modify the code right in that file. **** note, you MUST fix the checksum for this .dll in the nk.bin uncompressed file after making this change ***

then re-compress it, and write/flash the compressed 'nk.bin' to 'ceimage1' & 'ceimage2'


ie follow these 2 posts by Safar, as he was the one that showed exactly how to do it, and I verified that what he did does indeed work perfect.

** you MUST follow his instructions and FIX that checksum after you patch the 'nk.bin', before you recompress it **


https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1262075/#msg1262075

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1266429/#msg1266429

[Andrew]

Test Equity is listing the new option "Keysight DSOX2PLUS Enhancement Suite" at USD 250.

"Increases waveform update rate to 200,000 wfm/s, includes DSOX2SGM (segmented memory) and DSOX2MEMUP (deep memory upgrade), math functions from DSOX3ADVMATH, and all the advanced triggers from the 3000A X-Series (not TX). Included on 2000 X-Series oscilloscopes shipped after March 5, 2018."

https://www.testequity.com/products/3763/

[pamphonica]

I'm trying to telnet into a new-ish MSOX4034A (f/w 7.11).  I'm having problems generating an acceptable telnet password.
(Web access works fine)
I tried multiple times (as per Read Me file in zip in previous thread) -  Post #1774 - but no good.
What format should the model number be in to get the correct password?
Anyone got any ideas?
And has anyone successfully liberated a DSOX/MSOX4000A?
thanks
Jeremy

[PhillyFlyers]

I know someone back in this thread did it on a 4k series.....


are you sure the login/password is not just the basic ones as in the 3000A series?  (ie the password+hash was ONLY for the newer 3000T series)

also remember, when launching telnet, the first user/login attempt will always fail, just type in garbage for user/pass, let it fail, then login again...


ie this combo:

Code: [Select]

infiniivision
skywalker1977



[klaus11]

FYI:

The patch locations for firmware 2.43:

But 4000 series never had a 2.43 firmware, it started from fw 3.00.

[georges80]

FYI:

The patch locations for firmware 2.43:

But 4000 series never had a 2.43 firmware, it started from fw 3.00.

This is a 2000/3000 thread and PhillyFlyers is providing patch details for 2.43 since he had just posted above that he had successfully installed it on his 2000 series. i.e. his patch info is not in the context of the 4000 question...

Thank PhillyFlyers for the details, I'll look to update/install on my 2000 this w/end.

cheers,
george.

[jasonbrent]

Those with a liberated 3000 series scope... to use the MSO portion, what cable are you using? Whats a reasonably priced alternative?

[PhillyFlyers]

I picked up one of these, for about $115.. I know people have been selling them from time to time on here as well, but this seems to be the cheapest route.. Agilent has a replacement model# for this part, basically same thing, but it's $600 from them I believe... good grief.
No active logic in them..


Hp/Agilent 54620-61601

https://www.ebay.com/itm/Agilent-54620-61601-Logic-Analyzer-Probe-Cable-54620-61801-54620-61601/152928938063?epid=1041904829&hash=item239b46684f:g:H7AAAOSwB09YEjxE


There was discussion somewhere back in this thread talking about these, and members verified they work fine, I haven't had a chance to actually use mine yet...

FYI, I actually have a DSOX-3024A for my scope...

[EE-digger]

No active logic but the original HP (etc.) part has a 90k series resistance.  This give a good measure of protection against over-voltage, over-current and to some degree, ESD.

You could plug in anything that fits, including individual female 0.025" square connectors such as the ones on Chinese ribbon cables with male or female, or both, ends at real low prices.

Just use caution with any direct cable as it would hurt to blow the ASIC IF the connection from the front panel is not buffered 

I couldn't afford a new cable but also bought a like new on ebay.  The Agilent or KS $600 or $800 is a fair price.  The cable is US made (still was 2 years ago), has the woven ribbon construction as well as custom cable ends with precision female sockets.  They last for years without excessive abuse.  Sure, it would cost $75 or so if made in China and sold by XYZ scopes but then you wouldn't have KS anymore 

[jasonbrent]

That price point isn't too far from the MSO option itself... It looks like the probes from my Tektronix TLA5202 might would work also... looks kind of like an IDE/40pin connector. I'm -> <- close to getting a DSOX3014T with their current "30% off" promotion trade in... they accepted something I didn't expect as a trade which makes it very very tempting. I figured it can be liberated and/or upgraded over time as the need arises.

[TheSteve]

Used MSO cables pop up for good deals all the time on ebay - it is totally worth buying the proper one.

Here are the various part numbers you're looking for for a 3000 series scope:

54620-68701 - original part #
N6450-60001 - newer part #
N2756A / N2756-60001 -  updated logic probe cable, newest version.

[jasonbrent]

Used MSO cables pop up for good deals all the time on ebay - it is totally worth buying the proper one.

Here are the various part numbers you're looking for for a 3000 series scope:

54620-68701 - original part #
N6450-60001 - newer part #
N2756A / N2756-60001 -  updated logic probe cable, newest version.

Awesome, thank you. I think I'm going to pick up the DSOX3014T+DSOXLAN then... and try to figure out how to explain it to my wife.

By the time I need >200Mhz analog, prices will magically have come down (ha) or I'll enjoy some SMD rework.

[MarkL]

No active logic but the original HP (etc.) part has a 90k series resistance.  This give a good measure of protection against over-voltage, over-current and to some degree, ESD.

You could plug in anything that fits, including individual female 0.025" square connectors such as the ones on Chinese ribbon cables with male or female, or both, ends at real low prices.

Just use caution with any direct cable as it would hurt to blow the ASIC IF the connection from the front panel is not buffered 
...

The 90k embedded in the logic probe tip makes a voltage divider with the 10k input impedance of the scope's logic inputs, so the combination makes a x10 probe.  And the woven ribbon is a lossy transmission line, similar to a regular analog probe cable, to maintain signal integrity.

A cheap straight-thru 40-pin ribbon connector will give you the wrong voltage levels, and also would degrade the signal integrity if you're dealing with high speed signals.  Not to mention expose the digital front end to more risk of damage, as you point out.

I would get the genuine cable and probes, even if it's somewhat pricey.  The 54620-61601 is what was supplied by Agilent/Keysight when I ordered a 3000X with the logic option several years ago.

[PhillyFlyers]

The 90k embedded in the logic probe tip makes a voltage divider with the 10k input impedance of the scope's logic inputs, so the combination makes a x10 probe.  And the woven ribbon is a lossy transmission line, similar to a regular analog probe cable, to maintain signal integrity.

A cheap straight-thru 40-pin ribbon connector will give you the wrong voltage levels, and also would degrade the signal integrity if you're dealing with high speed signals.  Not to mention expose the digital front end to more risk of damage, as you point out.

I would get the genuine cable and probes, even if it's somewhat pricey.  The 54620-61601 is what was supplied by Agilent/Keysight when I ordered a 3000X with the logic option several years ago.

Oh yeah, absolutely, I agree with you all 100%.  Definitely buy an official HP/Agilent probe set, don't buy some 3rd party knockoff.   For the cost of these scopes, it makes no sense to cheap out on the probe tips and wreck the input logic.

 But just shop around and find a used set or even new set on ebay or here, and pay 1/6 of the cost!  I just wanted to emphasize to NOT buy it direct from Agilent, and pay $600 or more.  No need for that nonsense.  You can buy an entire scope for $600!  (lol, NOT one of these scopes, but maybe a Rigol   )

I got the 54620-61601 MSO probe set for my 3024A from ebay, it was new still in package, for $120....


I'm just curious if anyone actually located where they have this probe resistance at, as someone already disassembled one of the pod modules, and there was nothing in it at all...maybe it's in the 40-pin IDE header, as I don't see any pics of anyone opening that up?

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg367778/#msg367778


Also, btw, the newer/replacement probe packages do not have that braided cable as the older ones did, it's just straight up wire...

[EE-digger]

You can also keep your eyes open for a dirt cheap, parts only, older HP scope (green CRT, 54622D, many others).  You might find a scope with the logic probe included !

MarkL - all true.  Thanks

[EE-digger]

I'm just curious if anyone actually located where they have this probe resistance at, as someone already disassembled one of the pod modules, and there was nothing in it at all...maybe it's in the 40-pin IDE header, as I don't see any pics of anyone opening that up?

You made me  do it ... measured the probe ends instead of going back to work.  The 90k is actually in each channel lead, measured from the female socket for the micro grabber clips, to the dual gold pin end which I unplugged from the body. 

[Neganur]

I believe the equivalent circuit of the probes is in their manual (at least for the woven ones)

[MarkL]

I got the 54620-61601 MSO probe set for my 3024A from ebay, it was new still in package, for $120....

That's a good find.  For some reason sellers of the later version of the cable are asking a lot more.  They're all the same electrically.

I'm just curious if anyone actually located where they have this probe resistance at, as someone already disassembled one of the pod modules, and there was nothing in it at all...maybe it's in the 40-pin IDE header, as I don't see any pics of anyone opening that up?

See below.  The 90k resistor is the one with the strange symbol and you can see it in parallel with a compensation cap.  There's also a 249R in series with the tip.

Also, btw, the newer/replacement probe packages do not have that braided cable as the older ones did, it's just straight up wire...

You'll find that those "straight up wires" are tiny lossy coax, except for the outermost ones.  This is the same logic probing system HP/Agilent/Keysight has been selling for 20+ years.

Below is a photo of a broken one where I decided to drill out the rivets to get the shell open.  This is actually from a logic analyzer and not a scope, but it uses the same probes.  You can see some of the tiny coax center conductors.  Apparently someone yanked this connector out by the ribbon and some of the center conductors snapped and were pulled back into the cable.  That's why some are missing.

Moral of the story: If you buy a used logic cable, test *all* the data and clock channels.

[pamphonica]

I know someone back in this thread did it on a 4k series.....


are you sure the login/password is not just the basic ones as in the 3000A series?  (ie the password+hash was ONLY for the newer 3000T series)

also remember, when launching telnet, the first user/login attempt will always fail, just type in garbage for user/pass, let it fail, then login again...


ie this combo:

Code: [Select]

infiniivision
skywalker1977



Yes, thank you very much.  This worked just fine and I can see everything I need.  I am checking with Pinkus as he's been this route before.
Don't want to brick a new/used scope!