DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[Pinkus]

Not exactly what I wanted to hear.....
Now, I do not know how I got there (just trying to stop uboot with 'space' as before), another screen came up

Code: [Select]

U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 256 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-10-29   8:22:14 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37935 Bytes = 37 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
RTC: 2019-5-19   22:59:58.49 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Oct 29 2015 01:39:04
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

image2 value is out of range 0 so it will be ignored.
  It must be a hexadecimal integer between 0xd00000000 and 0xd7ffffff or between 0x800000000 and 0x87ffffff.


P500 Boot Loader Configuration :

Mac address .......... (00:30:D3:20:29:C0)
Ip address ........... (192.168.1.164)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0400000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
[b]>System ready![/b]
Preparing for download...
RTC: 2019-5-19   23:0:52.60 UTC
 All images failed

Press r to reset
 After the system ready I sent a '3' just getting the message 'all images failed'.
Maybe I should have used option "d".
Anybody with experience/advise on this?

Obviously these questions now came on my mind:
Can I write an image/file to the flash with the P500? This should help if it is just corrupted.
Or maybe the flash is somehow damaged. Thus:is this flash an external single memory chip or is it embedded?

[Sparky]

So @kilobyte mentioned problems with Telnet in v2.50 here:

A portscan and testing the other ports showed no other telnet port except the SCPI Telnet port.

With V2.50 the Telnet port is only available for a short time before the infiniiVisionLauncher kills the service and starts the scope app.
But it is possible to kill the launcher if the login and process kill command is handled by a python script running directly after the network connection has been established. (ping /t)

using the launcher from here still allows to start the App with different Options
\Secure\infiniiVision\infiniiVisionLauncher.exe

But I don't see anyone else mentioning a problem with Telnet access, and @PhillyFlyers explicitly says that it is working fine.

Is the issue with Telnet access in v2.50 firmware still a question?  Or enough people have used v2.50 with Telnet and say its all good?  Hope we can clear that up!

[TheSteve]

Obviously these questions now came on my mind:
Can I write an image/file to the flash with the P500? This should help if it is just corrupted.
Or maybe the flash is somehow damaged. Thus:is this flash an external single memory chip or is it embedded?

The firmware can be reflashed via network - as far as I know anyway, I've only done it on 2000a/3000a models. However firmware alone will not restore your scope. The nand also contains the serial #, cal data and license data - vital machine unique info you require. My gut still tells me it is a hardware issue and not nand corruption.

[PA0PBZ]

Maybe I should have used option "d".
Anybody with experience/advise on this?

I played with that, see https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022248/#msg1022248

The software: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022267/#msg1022267

[Pinkus]

Thanks for your informations. I can now give you some more input. After many many tries (at least 200-300 tries) my DSOX4024a started up correctly,  giving me this UART ouput:

Code: [Select]

U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 256 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-10-29   8:22:14 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37935 Bytes = 37 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
RTC: 2019-5-20   12:38:24.19 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Oct 29 2015 01:39:04
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

image2 value is out of range 0 so it will be ignored.
  It must be a hexadecimal integer between 0xd00000000 and 0xd7ffffff or between 0x800000000 and 0x87ffffff.

System ready!
Preparing for download...
RTC: 2019-5-20   12:38:24.24 UTC
 Loading image 1 from memory at 0xD0400000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXXOOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOXXOOXXXOOOXOOOXOXOXOOXXOOOOXOXOOOOOXOOOXOOOXXXXXXXXOXOXOXXOXOXXXXXXXX
XOOOXOOOXOOXOOOOXOOOOXXOXOOOOOOOXOOOXOXOOOOOXXOOOOOXOOXOOXOOOOOOOOOOXOXOOXOOOOOOOXXOOOOOXXOOOOOOOXOXOXXOOXOXOOOXOOOOXOOXXXXOXOOOXOXXXOXOXOXXXXXXXOOXXXOOOXOXXXXXOXXXXXXXXOXXXXOXOXOXXXXOOOXXXOX
XXXXXOOOXOOOXXOXOOOXOXXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXXOXOOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXXXXXXXXXXXXXXXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x53CEC54, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x53CEC54  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2019-5-20   12:38:33.84 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Oct 26 2017)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:20:29:C0
Phy found addr 31 (ticks=3979)
WaitForLink Start (ticks=3981)
No Link (ticks=4984)
<--EDeviceInitialize

GMAC DMA status register = 0x0
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
SHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]
SHIM [AgilentPalWin32.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
AgilentLxiWebStartUp successfully started LXI web service.
Device load time:
   NANDFLASH: 0 ms
   SNANDFLASH: 0 ms
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
System has been running 24.332512 seconds
Performing Startup
Initializing FPGA at base address 0x850000 or 8716288
****
FPGA Type: Oregon
Ver: 2.055 Released
Build Time: Mon Jul 31 17:34:24 2017
Build Machine: 12345678 (removed, might include show serial number)
****
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
Exception 'Raised Exception' (-1): Thread-Id=04ac005e(pth=8992e2ec), Proc-Id=04640066(pprc=898b6000) 'infiniivisionLauncher.exe', VM-active=04640066(pprc=898b6000) 'infiniivisionLauncher.exe'
PC=40068ae0(coredll.dll+0x00058ae0) RA=803782c8(kernel.dll+0x000062c8) SP=0002cb34, BVA=0002cb98
Keyboard firmware version 35... ok
Keyboard Info: Board id 0, Board rev 2
Cal Date Sat Jan 12 00:47:44 2013
Startup sequence is complete.
No registry path: Drivers\USB\FunctionDrivers\USB488, no workaround
no workaround for USB phy
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
Building initial GUI layout...complete.
System has been running 38.022915 seconds
Start Up Sequence 13.690000
Memory Load 58%
   System Physical Memory 66.188 / 115.957 MB
   Process Virtual Memory 71.250 / 1024.000 MB
-----> InfiniiVision is running <-----

There is still the message "image2 value is out of range 0 so it will be ignored." at the beginning. I assume, this is not normal.
It really looks like the flash is not OK.
The question is, would this fall under Keysights service note for non booting DSOX2000/3000/4000/6000 scopes?

[goldsun]

mark,thinks

[Sparky]

So @kilobyte mentioned problems with Telnet in v2.50 here:

A portscan and testing the other ports showed no other telnet port except the SCPI Telnet port.

With V2.50 the Telnet port is only available for a short time before the infiniiVisionLauncher kills the service and starts the scope app.
But it is possible to kill the launcher if the login and process kill command is handled by a python script running directly after the network connection has been established. (ping /t)

using the launcher from here still allows to start the App with different Options
\Secure\infiniiVision\infiniiVisionLauncher.exe

But I don't see anyone else mentioning a problem with Telnet access, and @PhillyFlyers explicitly says that it is working fine.

Is the issue with Telnet access in v2.50 firmware still a question?  Or enough people have used v2.50 with Telnet and say its all good?  Hope we can clear that up!

Following up: I did the update to v2.50 and Telnet worked perfectly --- no difference than previous firmware.  It seems @kilobyte is the only one who had a problem.

[kilobyte]

Today I did the update from 2.43 to v2.50 on my own DSOX-3024A.
But before that I did a port scan with the old 2.43 and after the update with the 2.50
This is the second scope where the telnet port isn't available after the infiniivision launcher has starter.
But telnet is still available for a short time.

[Sparky]

Today I did the update from 2.43 to v2.50 on my own DSOX-3024A.
But before that I did a port scan with the old 2.43 and after the update with the 2.50
This is the second scope where the telnet port isn't available after the infiniivision launcher has starter.
But telnet is still available for a short time.

Interesting kilobyte, and thanks for the screenshot result.  When you say "...telnet is still available for a short time...." what do you mean by "short time"?  Is that 1 sec, 1 min or 10 min after the scope has started?

I try the telnet login within 1 min or so of when it boots -- no problems for me.

[TheSteve]

New firmware was released for the 3000T and 4000A series.

Version 7.30.2019051434

New Features:
This software revision includes the following new capabilities:
- Added support for the following new models:
o D3000AUTA, D3000GENA, D3000AERA, D3000PWRA, D3000NFCA, D3000BDLA

Enhancements
This software revision includes the following new enhancements:
- Added Digitizer Mode where you specify the sample rate and memory depth instead of
having them automatically be determined by the time/division setting.
- Frequency Response Analysis (FRA):
o The sweep frequency range is no longer limited to decade values – it can now be
set to any frequency within the WaveGen’s limits.
o The “points per decade” setting has been changed to “total points” for ease of use.
o Chart:
 Minor gridlines for the horizontal axis are now shown to improve readability
of the plot.
 The chart’s horizontal display range is now independent of the Start/Stop
Frequency setting in the Setup Menu.
- The full waveform data can now be exported while in Roll Mode.
- The :WAV subsystem now includes commands to download all segmented memory data in
one shot.
- Measurement Trend Math can now be applied on Digital channels.
- The “:MEASure:YATX” and “:MEASure:TEDGe” measurements, previously a SCPI-only
operation, are now accessible from the Measurement Menu.
- Added Slew Rate measurement.
- The Delay and count-based measurement can now be applied on Digital channels.

Bug Fixes:
This software revision includes the following Bug fixes:
- Corrected the NRZ serial decode from having an extra bit than the frame size when the
Start-Bit is 0.
- Corrected “:MEASure:DELay:DEFine” for not accepting a definition that includes the
“FALLing” edge parameter.
- Corrected the Reference Waveform data (.h5) from incorrectly saving data with twice the
delay where is a delay on the displayed waveform.
- Corrected ":MEAS:SHOW?" always returning "1" regardless of the actual state.
- Fixed various LIN LDF file-parsing bugs.
- Fixed various issues related to the N7026A probe.

Changes:
- As of version 7.30, the VNC server software for the remote front panel functionality is no
longer bundled with the scope software by default. Upgrading to 7.30 will not delete the
VNC server software from the scope, but new scopes will no longer ship with the VNC
server software installed. For scopes without the software installed, the Browser Web
Control page will provide a link for installing the software.


The key takeaway of the update for me is that they are now allowing manual sample rate/memory depth adjustment - will need to have a play with this to see what advantage it might offer.

[The_PCB_Guy]

New firmware was released for the 3000T and 4000A series.

Version 7.30.2019051434

.....

Enhancements
This software revision includes the following new enhancements:
- Added Digitizer Mode where you specify the sample rate and memory depth instead of
having them automatically be determined by the time/division setting.
- Frequency Response Analysis (FRA):
o The sweep frequency range is no longer limited to decade values – it can now be
set to any frequency within the WaveGen’s limits.
o The “points per decade” setting has been changed to “total points” for ease of use.
o Chart:
 Minor gridlines for the horizontal axis are now shown to improve readability
of the plot.
 The chart’s horizontal display range is now independent of the Start/Stop
Frequency setting in the Setup Menu....

I'm intrigued about the part regarding the Frequency Response Analysis (FRA). Is it possible to add this feature to my DSOX3000 scope using existing hacks? I don't recall ever seeing this as an option in the past.

[2N3055]

Can't find explanation what are: D3000AUTA, D3000GENA, D3000AERA, D3000PWRA, D3000NFCA, D3000BDLA

Also I'm not sure if all is all right with my licenses after upgrade. It shows them all like this:

MSO   MSO   Yes   N/A   Expired

Meaning installed but status is expired.. What???
I don't remember well but I don't remember that before..

I don't know what new options are , but it is time to revisit old question to Keysight.
I bought scope with full bundle only 6 months ago. Will I be able to upgrade to new definition of full bundle, and how?


As for Digitizer mode, just took a quick peek, you can set maximum sampling rate an mem length. If you set it to max both, it seems to manage memory an sampling rate same as always, but it will show you mem length used.  I like that.
I was wrong. It will get samples exactly like you set. It will even stop you to set timebase to setting you can't get with digitizer settings.. Of course with 2ch sample rate am memory will halve. So it will with single/run

Regards,
Sinisa

[TheSteve]

I suspect (but don't know for sure) that the reason the license screen has changed is because in the future you'll see more options that are subscription based. This is not something I approve of, but seems to be the way forward for so many things.

[2N3055]

I suspect (but don't know for sure) that the reason the license screen has changed is because in the future you'll see more options that are subscription based. This is not something I approve of, but seems to be the way forward for so many things.

Unfortunately, that seems like a plausible theory.

And all those new options have A suffix end seem to be some kind of advanced version of existing options:

D3000AUTA   Automotive Software for 3000 X-Series
D3000GENA   Embedded Software for 3000 X-Series   
D3000AERA   Aerospace Software for 3000 X-Series   
D3000PWRA   Power Supply Test Software for 3000 X-Series
D3000NFCA   NFC Software for 3000 X-Series      
D3000BDLA   Ultimate Bundle Software for 3000 X-Series

[TheSteve]

Installed the new v7.30 3000T firmware.
The regular about screen hasn't changed. The web interface information is where it indicates all of the licenses are expired(even though they aren't and they still function). I would say this is a bug.
I did test telnet for those who might need it, after the scope has booted it is *not* available. It is there for a brief period during the boot process but is then terminated(along with any connection you might have).

[arlvaljr]

I also installed the v.7.30 on my 3000T yesterday and Telnet is not available anymore.
It seems ports 22 and 23 Telnet uses to connect, are now closed and any connection tentative is denied.
I could connect Telnet on port 5024 (SCPI Telnet Port) but this connection just gives a prompt and not accept any regular command.

[2N3055]

New options seem not to be new options but new bundles:

D3000AERA - DSOX3AERO, DSOX3VID, DSOX3MASK, DSOXT3FRA and DSOX3ADVMATH
D3000AUTA - DSOX3AUTO, DSOX3FLEX, DSOX3MASK, DSOXT3SENSOR, DSOXT3NRZ, DSOXT3CXP, DSOXT3FRA and DSOX3ADVMATH
D3000GENA - DSOX3EMBD, DSOX3COMP, DSOX3AUDIO, DSOX3VID, DSOX3MASK, DSOXT3UPD, DSOXT3FRA and DSOX3ADVMATH
D3000PWRA - DSOX3PWR, DSOXT3UPD, DSOX3MASK, DSOXT3FRA and DSOX3ADVMATH
D3000BDLA - Ultimate bundle (whatever that is)
D3000NFCA - NFC replacement

EDIT:
Also my scope is not responding to VNC anymore, only remote is one in Web browser

On a first boot after upgrade my scope didn't have VNC server active, so I couldn't connect with external RealVNC Viewer.  Today, it works, so I guess either i made some user error (not very likely, all other net comm with scope on same IP was working, internal web pages, SCPI, even built in HTML5 remote control), or maybe on a first boot it was still shuffling things around (it does say "Finishing installation") and VNC server didn't start for some reason.

But now after second reboot it works normally.

[gslick]

Also my scope is not responding to VNC anymore, only remote is one in Web browser

According to the Release Notes if the firmware previously had VNC server functionality, it should still have the VNC server functionality after the firmware upgrade. But maybe you need to reinstall the VNC software anyway?

https://www.keysight.com/upload/cmc_upload/All/Keysight_3000T_X_Series_Oscilloscope_Release_Notes_07_30.pdf

Changes
- As of version 7.30, the VNC server software for the remote front panel functionality is no
longer bundled with the scope software by default. Upgrading to 7.30 will not delete the
VNC server software from the scope, but new scopes will no longer ship with the VNC
server software installed. For scopes without the software installed, the Browser Web
Control page will provide a link for installing the software.

[2N3055]

Also my scope is not responding to VNC anymore, only remote is one in Web browser

According to the Release Notes if the firmware previously had VNC server functionality, it should still have the VNC server functionality after the firmware upgrade. But maybe you need to reinstall the VNC software anyway?

https://www.keysight.com/upload/cmc_upload/All/Keysight_3000T_X_Series_Oscilloscope_Release_Notes_07_30.pdf

Changes
- As of version 7.30, the VNC server software for the remote front panel functionality is no
longer bundled with the scope software by default. Upgrading to 7.30 will not delete the
VNC server software from the scope, but new scopes will no longer ship with the VNC
server software installed. For scopes without the software installed, the Browser Web
Control page will provide a link for installing the software.

I read release notes before upgrading. I saw that. But with previous firmware I was able to simply connect to the scope with RealVNC VNC viewer (that had performance than remote control from scope in browser) and after firmware update it didn't accept connections anymore.

UPDATE:  I just went to troubleshoot further (maybe they moved to another port or something) and now it DID CONNECT. I can connect with RealVNC like before. I guess maybe it didn't work on the first boot after update, or something was wrong with my net config (although that is not wera likely because I could browse internal pages and remote control it with internal HTML5 remote control).
I will update my previous post.

[wutieru]

Hi,
where can I download the file  "patched_nk.bin.comp",version 2.50?

[Sparky]

Totally off-topic, but any thoughts on when there might be a replacement to 4000X series? 

[Sparky]

Hi,
where can I download the file  "patched_nk.bin.comp",version 2.50?

Not sure the individual file, but you could extract it from the patched installer.

[wutieru]

Hi，
Thanks for reply.
After patched installer ,it's only need a replaced .link file?

[Sparky]

Hi，
Thanks for reply.
After patched installer ,it's only need a replaced .link file?

Yes.  The installer linked above already includes the patched nk.bin.comp.  Once it's installed replace the empty .lnk with your customized one.

[wutieru]

Thanks!
I got it.
Now my dsox is full functionly.