DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[Xavier64]

Good day,

does anyone have the old 7.10 Firmware for the 3000T Series!? I only can download the NEW 7.20 on the Keysight Website.


Many thanks.

[JeffreyLatter]

As to older version of firmware for the 3000T

https://drive.google.com/drive/folders/0B1zyLRNonVMFY3V1Z3hXUDNtRnc?usp=sharing

[Sparky]

I do 
I sold my DSOX3024a and purchased a DSOX4024a instead.
The larger screen (though unfortunately not higher resolution) and the touch (not always, but perfect for dragging or entering numbers/characters) are a really nice improvement over the 3000 series. And I compared it to an R&S RTB2004: the Keysight is way better suited for daily work (easier and quicker to use, more and better functionality, not artificially crippled as the RTB).

If you read the posts above: transforming it into a MSOX4024a with all options enabled is not too difficult.
I will do the 500Mhz modification in a month or maybe two and will make photos of all needed steps then and post them here.

Hi Pinkus, I was wondering if you went ahead with the 500MHz to 1GHz mod for your 4k X-series scope?  I currently have DSO-X3034A (non-touch screen).  I bought the application bundle for it and use MSO and 500MHz bandwidth options from this thread.  I like it a lot but sometimes wonder about a step up for higher sample rate, more bandwidth, and better support for some probes.  A 4k series at a good price...and up-cycled to higher bandwidth, seems like an option I would consider....so I'm curious if you (or anyone) made progress in this regard.

I also wonder when Keysight would refresh the 4000 X series.  The big screen is great but its low resolution and the 5GSa/s is starting to look a bit long in the tooth...

Sparky

[mlan]

The 'FWD' license allows you to downgrade the firmware, which is otherwise locked to a minimum version number.

[Pinkus]

Hi Pinkus, I was wondering if you went ahead with the 500MHz to 1GHz mod for your 4k X-series scope?

Hi Sparky,
I would like to, however my DSOX4000, running with the latest firmware version, sometimes needs 2-3 attempts to boot up. I suspect an starting NAND corruption. Right now I am not sure what to do with this scope and how to fix it. This is right now more important than getting 500 Mhz or 1 GHz. Next will be to log the UART output and see it this helps to nail down the problem. Maybe mlans post might help to allow another firmware update with the latest version, even if I already have it installed. My hope is to rewrite NAND.
I will definitively post here if I did the upgrade (also the outcome of a firmware rewrite will be posted).

[TheSteve]

Please log the serial data so we can determine the cause of the problem. I'd suggest reinstalling the newest firmware but logging data should be done first.
Btw, I've never seen a scope with the NAND corruption issue that would boot on occasion, they never booted. It is possible of course.

[trevwhite]

My scope would intermittently boot. Then one day stopped booting completely. Thankfully it was under warranty but that was nand memory issue.

Sent from my SM-G950F using Tapatalk

[GregerG]

Which is the latest 2000X firmware you can usb boot? I don't feel like permanently modifying it and I don't have the lan module anyways....
Cheers!
//Greg

[Sparky]

Hi Pinkus, I was wondering if you went ahead with the 500MHz to 1GHz mod for your 4k X-series scope?

Hi Sparky,
I would like to, however my DSOX4000, running with the latest firmware version, sometimes needs 2-3 attempts to boot up. I suspect an starting NAND corruption. Right now I am not sure what to do with this scope and how to fix it. This is right now more important than getting 500 Mhz or 1 GHz. Next will be to log the UART output and see it this helps to nail down the problem. Maybe mlans post might help to allow another firmware update with the latest version, even if I already have it installed. My hope is to rewrite NAND.
I will definitively post here if I did the upgrade (also the outcome of a firmware rewrite will be posted).

Hi Pinkus, sorry to hear you have a problem with booting your DSOX4k scope.  That's really unfortunate news and I definitely understand it's a more urgent and important problem to fix than the bandwidth mod.  I hope you are able post the u-boot messages here and hopefully someone can help identify the problem and fix it.

Sparky

[lzqing]

Thank you all ! Thank you Safar , https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1453247/#msg1453247
The 2.43 after hack is perfect, it is working well with my DSOX2022A , I like "PLUS"  option ,let me use more enhanced trigger function  .


Best Regards
Andy Lu

[Dwaine]

I just bought a DSOX2004A 70mhz scope.  Can this scope be hacked up to 200mhz bandwidth.   I can't seem to find anything relating to the bandwidth upgrade for the 2004a.

Maybe the resister config on the board?

[gamalot]

I just bought a DSOX2004A 70mhz scope.  Can this scope be hacked up to 200mhz bandwidth.   I can't seem to find anything relating to the bandwidth upgrade for the 2004a.

Maybe the resister config on the board?

There is the option "BW20".

[rramirez]

I have a DSOX2000 with 2.43.2018020635 FW. I followed the steps in post #1876 to the letter, except my selected options string was:

"88#infiniivisionLauncher.exe -l ALL -l BW20 -l DVM -l PLUS -l SCPIPS -l CABLE --perf"

and everything went smoothly. Are the quotes supposed to be there? What is the significance of the 88# before the launcher program?

UPDATE: it dawned on me that the 88# was referencing the byte count of the string, so once I used the correct number in the infiniivision.lnk file, (81#, no quotes) it all worked fine.

Russ

[kennyhan]

Thank you all,Today I was hacked my scope dsox3014t,but the scope "User Cal Status" is always shown as "unprotected",What should I do？Very thank you all again.

[TheSteve]

Thank you all,Today I was hacked my scope dsox3014t,but the scope "User Cal Status" is always shown as "unprotected",What should I do？Very thank you all again.

That is a byproduct of the hack. It is actually a good thing as it makes for an easy way to verify externally if licenses are valid/real or have been hacked.

[kennyhan]

Thank you all,Today I was hacked my scope dsox3014t,but the scope "User Cal Status" is always shown as "unprotected",What should I do？Very thank you all again.

That is a byproduct of the hack. It is actually a good thing as it makes for an easy way to verify externally if licenses are valid/real or have been hacked.

Thank you Steve. I think I don't should always look at the calibration menu.

[wutieru]

I try to crack a DSOX 2002 with the tutorial step by step. It seems that everything is correct, but when I restart Oscilloscope, the message is displayed on the screen: "Firmware checksum error, need to be fixed." and the machine has no reaction, only restore firmware. The Oscilloscope's firmware is newest，and before I hack this，I have successfully hacked 2 sets（one is DSOX 2004 and the other is DSOX 2012).

[schmike]

Dear Safar

I just recviced the 3014A with firmware 01.10
Updated the firmware to 2.43
And download the patch from you and push on the usb flash.
I telnet to 3014A with port 5024
After I type the code
\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
[/code]
No following action on screen or on the scope
Any suggestion for me to do for update for all option?
Thanks alot.

I make patched.bin.comp with PhillyFlyers info and with corrected checksum:

Patched2.43

MD5 of file for check: 1CA34A1B837B075133BE53B379749BBB

You can flash it as usual by loadP500Flash via telnet in scope

Code: [Select]

\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp

Checked on my DSOX3034A

FYI:

The patch locations for firmware 2.43:

Code: [Select]

1) options patch:  0x280940:  change "04 00 A0 E1" -> "00 00 A0 E3"
2) nag patch:       0x2a9f38:   change "66 5A FF EB" -> "01 00 A0 E3"


[schmike]

Screen CAP

Dear Safar

I just recviced the 3014A with firmware 01.10
Updated the firmware to 2.43
And download the patch from you and push on the usb flash.
I telnet to 3014A with port 5024
After I type the code
\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
[/code]
No following action on screen or on the scope
Any suggestion for me to do for update for all option?
Thanks alot.

I make patched.bin.comp with PhillyFlyers info and with corrected checksum:

Patched2.43

MD5 of file for check: 1CA34A1B837B075133BE53B379749BBB

You can flash it as usual by loadP500Flash via telnet in scope

Code: [Select]

\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp

Checked on my DSOX3034A

FYI:

The patch locations for firmware 2.43:

Code: [Select]

1) options patch:  0x280940:  change "04 00 A0 E1" -> "00 00 A0 E3"
2) nag patch:       0x2a9f38:   change "66 5A FF EB" -> "01 00 A0 E3"


[januszb]

Schmike,
You're telnetting to the wrong port.  5024 is for SCPI (which is why *idn? works).  For the patch you need to telnet to the normal port (23), login, then do the necessary commands.
Janusz

[Dwaine]

Stupid question....  I see the DSOX3000 series you can upgrade the front-end to 500mhz.   Can the DSOX2000 series front-end be upgrade to 500mhz too?    I would love to complete a front-end upgrade to my DSOX2014a to 500mhz.   I have not seen a complete parts list.

Has anyone figured out how to get the DSOX2000 series to display 1 million waves?

I just got my first Keysight scope.   Upgraded from the Rigol DS1054Z.

[TheSteve]

Stupid question....  I see the DSOX3000 series you can upgrade the front-end to 500mhz.   Can the DSOX2000 series front-end be upgrade to 500mhz too?    I would love to complete a front-end upgrade to my DSOX2014a to 500mhz.   I have not seen a complete parts list.

Has anyone figured out how to get the DSOX2000 series to display 1 million waves?

I just got my first Keysight scope.   Upgraded from the Rigol DS1054Z.

I know someone posted about performing the 500 MHz upgrade on a 2000 series in the past, not sure if he did it or not. It should be possible from what I have seen but you won't find an easy howto. It also has no builtin 50 ohm termination but you can use an external one. Using pics of the PCB's we can probably determine what needs to be changed.
I don't think the 2000 can process 1 million waveforms per second as it only has one Megazoom IV ASIC instead of the 2 used in the 3000 series. I believe Keysight has updated the 2000 from 50k to 200k waveforms/sec though.

[PA0PBZ]

Since the 2000 series only goes up to 200 MHz officially how are you going to tell the scope it is capable of 500MHz? I mean in terms of vertical speed, anti-aliasing and such?

[TheSteve]

The 2000 series still respects the hardware jumpers that select the base speed and configure the firmware. So that part is no problem.

[Dwaine]

So you would configure the hardware jumpers to bump it up to 500mhz for the frontend and then install the necessary parts into the 4 front-ends.   Is it the same parts list as the DSOX3000A?