DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[wp_wp]

If anyone could please check my steps/understanding on my Jan 7 post -- a couple of questions I'd appreciate it much

Should I image the 3024A with 2.50 instead of 2.43?

Spring is here, I'll be out hiking...

Thank you,
NN


Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2084 on: January 07, 2019, 01:23:31 am »
ReplyQuoteModifyRemove
Hello again, and thanks for your help.

Acquiring a DSOXLAN, I'm finally ready to do the upgrade to my 3024A running "factory" 2.43, applying the latest patched 2.43 (and it is a rainy weekend) -- I have a couple of questions please.

1/ Can anyone clarify the contents of the link file to enable all features available in the patched firmware -- for the 3024A?

From previous responses, I am not clear on if my modified link contents (cmd line) is correct -- specifically, the preceding "211#..." which I  think would have been OK if I had the 350MHz model, and appears to represent the length of the infiniivisionLauncher.exe cmd line not including the preceding "211#".

"211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

The above (not for my scope) is indeed 211 characters in length so it makes sense (to me) I need to change that number.

Is the below correct (I removed "-l BW50" alone) -- with the # of characters now being 203? :

"203#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

As I am now clear I can revert back to the factory v2.43 if I am to sell the scope or send it in for cal, there's just one more thing:

2/ Should I expect the "unsealed instrument" warning to appear after in the liberated 2.43 -- and if so, can I ignore it (will it impact anything) or is there another patch to make that warning disappear?

Thank you kindly for verifying this and your help, best to all in 2019!

NorcalNerd

Does the new firmware 2.50 work with the hack?

I use the new firmware 2.50 to hack the 3024A,but I cannot open BW50

[2N3055]

If anyone could please check my steps/understanding on my Jan 7 post -- a couple of questions I'd appreciate it much

Should I image the 3024A with 2.50 instead of 2.43?

Spring is here, I'll be out hiking...

Thank you,
NN


Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2084 on: January 07, 2019, 01:23:31 am »
ReplyQuoteModifyRemove
Hello again, and thanks for your help.

Acquiring a DSOXLAN, I'm finally ready to do the upgrade to my 3024A running "factory" 2.43, applying the latest patched 2.43 (and it is a rainy weekend) -- I have a couple of questions please.

1/ Can anyone clarify the contents of the link file to enable all features available in the patched firmware -- for the 3024A?

From previous responses, I am not clear on if my modified link contents (cmd line) is correct -- specifically, the preceding "211#..." which I  think would have been OK if I had the 350MHz model, and appears to represent the length of the infiniivisionLauncher.exe cmd line not including the preceding "211#".

"211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

The above (not for my scope) is indeed 211 characters in length so it makes sense (to me) I need to change that number.

Is the below correct (I removed "-l BW50" alone) -- with the # of characters now being 203? :

"203#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

As I am now clear I can revert back to the factory v2.43 if I am to sell the scope or send it in for cal, there's just one more thing:

2/ Should I expect the "unsealed instrument" warning to appear after in the liberated 2.43 -- and if so, can I ignore it (will it impact anything) or is there another patch to make that warning disappear?

Thank you kindly for verifying this and your help, best to all in 2019!

NorcalNerd

Does the new firmware 2.50 work with the hack?

I use the new firmware 2.50 to hack the 3024A,but I cannot open BW50

You cannot and you never will this way. It has been said many times here before.
100 and 200 MHz is one mainboard,  350 and 500Mhz is different board.  Only way to go to 500 MHz is to make changes to mainboard (with soldering iron, changing components) and then, with software set it to 500 MHz.

[wp_wp]

If anyone could please check my steps/understanding on my Jan 7 post -- a couple of questions I'd appreciate it much

Should I image the 3024A with 2.50 instead of 2.43?

Spring is here, I'll be out hiking...

Thank you,
NN


Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2084 on: January 07, 2019, 01:23:31 am »
ReplyQuoteModifyRemove
Hello again, and thanks for your help.

Acquiring a DSOXLAN, I'm finally ready to do the upgrade to my 3024A running "factory" 2.43, applying the latest patched 2.43 (and it is a rainy weekend) -- I have a couple of questions please.

1/ Can anyone clarify the contents of the link file to enable all features available in the patched firmware -- for the 3024A?

From previous responses, I am not clear on if my modified link contents (cmd line) is correct -- specifically, the preceding "211#..." which I  think would have been OK if I had the 350MHz model, and appears to represent the length of the infiniivisionLauncher.exe cmd line not including the preceding "211#".

"211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

The above (not for my scope) is indeed 211 characters in length so it makes sense (to me) I need to change that number.

Is the below correct (I removed "-l BW50" alone) -- with the # of characters now being 203? :

"203#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

As I am now clear I can revert back to the factory v2.43 if I am to sell the scope or send it in for cal, there's just one more thing:

2/ Should I expect the "unsealed instrument" warning to appear after in the liberated 2.43 -- and if so, can I ignore it (will it impact anything) or is there another patch to make that warning disappear?

Thank you kindly for verifying this and your help, best to all in 2019!

NorcalNerd

Does the new firmware 2.50 work with the hack?

I use the new firmware 2.50 to hack the 3024A,but I cannot open BW50

You cannot and you never will this way. It has been said many times here before.
100 and 200 MHz is one mainboard,  350 and 500Mhz is different board.  Only way to go to 500 MHz is to make changes to mainboard (with soldering iron, changing components) and then, with software set it to 500 MHz.

Thank you.
I hacked a DSOX3034A,and its bandwidth reaches 500MHz.
But I see Keysight's web,200MHz to 350MHz for 3024A,does not need change board.

[2N3055]

..............
Thank you.
I hacked a DSOX3034A,and its bandwidth reaches 500MHz.
But I see Keysight's web,200MHz to 350MHz for 3024A,does not need change board.

Not correct.

DSOX3BW34 3000A X-Series 4-Channel Oscilloscope Bandwidth Upgrade: 200 MHz to 350 MHz:
 Return to service center required

DSOX3BW54 3000A X-Series 4-Channel Oscilloscope Bandwidth Upgrade: 350 MHz to 500 MHz:
 Upgrade instantly with the license-only upgrade. No return to service center required

From Keysight site.

[wp_wp]

..............
Thank you.
I hacked a DSOX3034A,and its bandwidth reaches 500MHz.
But I see Keysight's web,200MHz to 350MHz for 3024A,does not need change board.

Not correct.

DSOX3BW34 3000A X-Series 4-Channel Oscilloscope Bandwidth Upgrade: 200 MHz to 350 MHz:
 Return to service center required

DSOX3BW54 3000A X-Series 4-Channel Oscilloscope Bandwidth Upgrade: 350 MHz to 500 MHz:
 Upgrade instantly with the license-only upgrade. No return to service center required

From Keysight site.

OK!
Thank you.
I see.
I know what is wrong.
I see the message in Keysight Chinese site,it said:
3000A X 系列 4 通道示波器带宽升级：200 MHz 至 350 MHz
通过在您的需求变化时将示波器带宽增加到 350 MHz，为您提供充分的投资保护
仅需许可证便可立即进行升级 无需送回服务中心
带宽升级适用于 DSO 和 MSO 型号

[wp_wp]

Help!
I have known how to convert nk.bin.comp to nk.bin,and how to convert nk.bin to  nk.nb0,and how to extract files from nk.nb0,and how to modify the infiniivisioncore.dll,but how to do the reverse process?

[yingziwin]

I've done extracting through serial on the board And I meet the same problem with you.All the LEDs don't light on.It show the same error and stops at BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.Do you solve it with the DSOXLAN module?Can you share the procedure?

[TK]

I've done extracting through serial on the board And I meet the same problem with you.All the LEDs don't light on.It show the same error and stops at BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.Do you solve it with the DSOXLAN module?Can you share the procedure?

If it is a NAND corruption problem, you can solve it following this guide: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181

[wp_wp]

I made a file,and that file let MSOX2024A jump into WinCE UI.

[wp_wp]

让是德Infiniivision DSOX/MSOX2000A示波器从正常界面跳到winCE界面的文件，感兴趣的朋友可以下载玩玩。
已在MSOX2024A（固件版本2.50）上测试有效。

[ElectronMan]

It appears I've managed to FUBAR the front panel on my 3034T by attempting installation of the "fixed" 7.31 firmware (from this post https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2945740/#msg2945740). I can re-load different firmwares, but no more lights on the front-panel, and when I can get it to boot at all, it complains that there is no front-panel.

The touchscreen works fine.

UART console shows this:

WaitForKeyboardEvent FAILED
WaitForKeyboardEvent FAILED
Keyboard firmware version mismatch, 35 (binary) vs 255 (keyboard)
Programming keyboard firmware...
  Initializing UART...Exception 'Raised Exception' (-1): Thread-Id=0439001e(pth=89633780), Proc-Id=0436001e(pprc=8973daec) 'infiniivisionLauncher.exe', VM-active=0436001e(pprc=8973daec) 'infiniivisionLauncher.exe'
PC=40068ae0(coredll.dll+0x00058ae0) RA=803782c8(kernel.dll+0x000062c8) SP=0002cb34, BVA=0002cb98
SER2 Serial Port, new baud rate:0x2580  (UARTCLK:48000000 IBRD:0x138 FBRD:0x20)
SER2 Serial Port, new baud rate:0xe100  (UARTCLK:48000000 IBRD:0x34 FBRD:0x5)
 ok
  Unlocking flash memory... failed
Unsucessful programming of the keyboard (MicroCIdCheck failed)
Retry 1 keyboard firmware updating
Programming keyboard firmware...
  Initializing UART...SER2 Serial Port, new baud rate:0x2580  (UARTCLK:48000000 IBRD:0x138 FBRD:0x20)
Programming LAN option module...
Option module FPGA programing DONE...
SER2 Serial Port, new baud rate:0xe100  (UARTCLK:48000000 IBRD:0x34 FBRD:0x5)
SHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]
SHIM [AgilentPalWin32.dll] Get Process Addresses
 ok
  Unlocking flash memory... failed
Unsucessful programming of the keyboard (MicroCIdCheck failed)
Retry 2 keyboard firmware updating
Programming keyboard firmware...
  Initializing UART...SER2 Serial Port, new baud rate:0x2580  (UARTCLK:48000000 IBRD:0x138 FBRD:0x20)
SER2 Serial Port, new baud rate:0xe100  (UARTCLK:48000000 IBRD:0x34 FBRD:0x5)
 ok
  Unlocking flash memory... failed
Unsucessful programming of the keyboard (MicroCIdCheck failed)
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
Front Panel UART driver reset -- Contact ChrisG
ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\sh600_serial\.\sh600_serial_drv.cpp line 661: SER2 SER Driver: does not support multiple Open()'s
Error opening UART Driver.
Front Panel UART driver reset -- Contact ChrisG
ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\sh600_serial\.\sh600_serial_drv.cpp line 661: SER2 SER Driver: does not support multiple Open()'s
Error opening UART Driver.

My best guess here is that the firmware for the front panel is corrupted, and no longer responding to attempts to re-flash it. I'm currently trying to find the firmware in the installer, in case I need to try manually flashing it onto the chip (last resort).

Anyone have any other ideas?

I started from version 7.30, which unfortunately I don't seem to have archive anywhere. I've tried firmware 7.10, and the official 7.31 firmware, they all fail when attempting to reflash the front panel firmware.

[TheSteve]

Sounds like the processor on the front panel packed it in during the update process.
You should be able to remove the front panel, replace the processor, then boot up the scope and it will auto-program the processor for you. The part # I've seen previously is R5F212A7SNFP or R5F212A7SNFP#V2.

[ElectronMan]

Oddly enough, I just took it apart and could not find a processor on the front panel... It is definitely talking to something over the SPEAR's 2nd UART, but I am having trouble finding the bugger so far.

[ElectronMan]

Found it, apparently a Renesas R5F212A7 microcontroller. The NAND flash endurance in these chips is only 100 erasures. I wonder if it attempted to erase and reflash it one-too-many times while it was having the UART issues.

[TheSteve]

Told ya

Swap it out and it will magically come back to life on the next boot, no need to worry about programming it manually.

[ElectronMan]

Sounds like the processor on the front panel packed it in during the update process.
You should be able to remove the front panel, replace the processor, then boot up the scope and it will auto-program the processor for you. The part # I've seen previously is R5F212A7SNFP or R5F212A7SNFP#V2.

How did I completely miss that when I read your post the first time?  Thanks for the info. Sounds a lot simpler than trying to get a front panel replacement.

[wp_wp]

I see something in a DLL file:
   infiniiVisionWebCom.ScopeInfo.1 = s 'ScopeInfo Class'
   {
      CLSID = s '{DED1059F-0BB5-46D1-BDED-9A72968FD7AE}'
   }
   infiniiVisionWebCom.ScopeInfo = s 'ScopeInfo Class'
   {
      CLSID = s '{DED1059F-0BB5-46D1-BDED-9A72968FD7AE}'
      CurVer = s 'infiniiVisionWebCom.ScopeInfo.1'
   }
what does CLSID = s '{DED1059F-0BB5-46D1-BDED-9A72968FD7AE}' mean?
I believe that this information is very important,it is related to the change of scope model number.
And when I go into WinCE of DSOX2002A,I found a HostIDChangedHandler.exe file.when I run this exe file,it refers SecureDataTool!

[ElectronMan]

I see something in a DLL file:
   infiniiVisionWebCom.ScopeInfo.1 = s 'ScopeInfo Class'
   {
      CLSID = s '{DED1059F-0BB5-46D1-BDED-9A72968FD7AE}'
   }
   infiniiVisionWebCom.ScopeInfo = s 'ScopeInfo Class'
   {
      CLSID = s '{DED1059F-0BB5-46D1-BDED-9A72968FD7AE}'
      CurVer = s 'infiniiVisionWebCom.ScopeInfo.1'
   }
what does CLSID = s '{DED1059F-0BB5-46D1-BDED-9A72968FD7AE}' mean?
I believe that this information is very important,it is related to the change of scope model number.
And when I go into WinCE of DSOX2002A,I found a HostIDChangedHandler.exe file.when I run this exe file,it refers SecureDataTool!

The CLSID stuff is just a Windows COM object ID. These get registered in Windows on installation of the DLL (regsvr32, etc) and allow applications to load the COM object API interface by the class name (infiniiVisionWebCom.ScopeInfo). The CLSID is then looked up in the registry to find the appropriate DLL file. Nothing too interesting there.

Not sure about the HostIDChanged tool.

[ElectronMan]

Has anyone with a 3000 or 4000 series ever tried "CAKE" or "AFTER DUSK" as the screensaver text?

I saw CAKE mentioned previously but never saw a response. These don't work on my 1102G, but are in the DLL alongside TREK. Hopefully I can try them on my 3034T once I get it repaired.

[TK]

Jumped to this thread late, but can anyone point me a path to unlock some of the features of my DSOX3054T?

I ordered it with APPBNDL, but my distributor f*ed up and gave me the newer BDLA, which has all APPBNDL has but rest of WAVEGEN.

My distributor is not able to order a new license without hardware (some Keysight distro weirdness in China), and we don't have a plan for new hardware purchase.

The only he can do is to give me a credit of the same license in my next order, but that would be months if not years ahead.

I paid for WAVEGEN, and I want it enabled. How can I generate this option without risking bricking my scope?

Never mind. My distributor offered me one Rigol DG2052 per lost Keysight license to make up. Free 8-bit to 16-bit upgrade and 25MHz o 50MHz upgrades at the cost of some additional bench space is okay to me.

I think you cannot run Bode plot with external awg. Ask for the wavegen license or your scope will miss a valuable tool

[2N3055]

Jumped to this thread late, but can anyone point me a path to unlock some of the features of my DSOX3054T?

I ordered it with APPBNDL, but my distributor f*ed up and gave me the newer BDLA, which has all APPBNDL has but rest of WAVEGEN.

My distributor is not able to order a new license without hardware (some Keysight distro weirdness in China), and we don't have a plan for new hardware purchase.

The only he can do is to give me a credit of the same license in my next order, but that would be months if not years ahead.

I paid for WAVEGEN, and I want it enabled. How can I generate this option without risking bricking my scope?

Never mind. My distributor offered me one Rigol DG2052 per lost Keysight license to make up. Free 8-bit to 16-bit upgrade and 25MHz o 50MHz upgrades at the cost of some additional bench space is okay to me.

I think you cannot run Bode plot with external awg. Ask for the wavegen license or your scope will miss a valuable tool

That is correct, you cannot.. FRA is pretty  much most important use of that AWG..
Other is realy easy way to clone channel capture into AWG and use variable noise addition...

[TK]

I think you cannot run Bode plot with external awg. Ask for the wavegen license or your scope will miss a valuable tool

Nah, I've never used it, and if I ever needed, there's the Analog Discovery for me.

At 20MHz, despite the beefy size and cost, the 8-bit Keysight doesn't stand a chance against 14-bit ADC and DAC.

I know there are other options, but OP paid for a feature and was given an alternative that is not the same value, that was my point

EDIT: @blueskull, you were the OP, sorry.  If the alternative works for you, then everything is OK

[TheSteve]

Has anyone with a 3000 or 4000 series ever tried "CAKE" or "AFTER DUSK" as the screensaver text?

I saw CAKE mentioned previously but never saw a response. These don't work on my 1102G, but are in the DLL alongside TREK. Hopefully I can try them on my 3034T once I get it repaired.

CAKE = Text with the developer names and other text which changes.

AFTER DUSK = Flying scopes with wing and scope probes.

[ElectronMan]

Thanks, I saw a lot of that text from CAKE in the binary, and the AFTER DUSK is obviously a reference to the windows After Dark screen saver.

I've been digging into the R&S RTB2004 firmware and one thing I've noticed immediately is the complete lack of "Easter Eggs." They are all business.

[TheSteve]

Thanks, I saw a lot of that text from CAKE in the binary, and the AFTER DUSK is obviously a reference to the windows After Dark screen saver.

I've been digging into the R&S RTB2004 firmware and one thing I've noticed immediately is the complete lack of "Easter Eggs." They are all business.

Shame, it is always good to have a little fun.