DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[kilobyte]

Hi pinkman,

my usb stick is formatted with FAT32 and works without a problem.
It needs a little bit more time to start the application and the splash screen is not shown on my scope.
The folder structure on the flash drive should be

\
+-infiniiVision
  +-fpga
  +-upgrade
  +-web
  +-css
  +-help
  +-image
  +-include
  +-web-socket-js
  +-lib
  +-Lxi
     +-Identification
  +-navbar
+-Startup


So its possible that you do something wrong.
My first test also didn't work because I mistyped something.

Maybe i can try my USB stick on a newer DSOX2000 series scope at work.

[pinkman]

kilobyte,

Thanks for the reply.  My understanding is that I should extract the contents of infiniivisionSetup.cab, then take contents of the "Secure" folder and copy *only* Secure folder contents to Flash root drive.  I have done this, but my folder structure looks a little bit different than what you have listed.

Are there any files, other than contents of "Secure" folder(including modified infiniivisionCore.dll)  + startupoverride text file that should be on the flash disk?

[plesa]

kilobyte,

Thanks for the reply.  My understanding is that I should extract the contents of infiniivisionSetup.cab, then take contents of the "Secure" folder and copy *only* Secure folder contents to Flash root drive.  I have done this, but my folder structure looks a little bit different than what you have listed.

Are there any files, other than contents of "Secure" folder(including modified infiniivisionCore.dll)  + startupoverride text file that should be on the flash disk?

Did you copy whole structure from extracted  \3000XSeries.02.35.2013061800.cab\infiniiVisionSetup.cab ? The whole content of \Secure\ folder must be copied to USB flash.
Also check presence of the Startup folder with modified   infiniivision.lnk which contains sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"

[plesa]

Muahahaha!

Here is it the Enterprise Screensaver.

I did take a look in the dsox4000 dll and there are a lot more debug information and resources.
I opened the 4000 infiniivision with a resource hacker and I was able to extract bitmaps and Winform dialogs.
After disassembling the dll I searched for the text TREK and found the reference to this in a subfunction with other references to ...Screensaver...
So i tried it on my scope and bingo.

Regards
Kai

NICE!!!

[pinkman]

kilobyte,

Thanks for the reply.  My understanding is that I should extract the contents of infiniivisionSetup.cab, then take contents of the "Secure" folder and copy *only* Secure folder contents to Flash root drive.  I have done this, but my folder structure looks a little bit different than what you have listed.

Are there any files, other than contents of "Secure" folder(including modified infiniivisionCore.dll)  + startupoverride text file that should be on the flash disk?

Did you copy whole structure from extracted  \3000XSeries.02.35.2013061800.cab\infiniiVisionSetup.cab ? The whole content of \Secure\ folder must be copied to USB flash.
Also check presence of the Startup folder with modified   infiniivision.lnk which contains sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"

I did copy the entire contents of the \Secure folder.  There were files in the "root" directory of the .CAB file (such as FPGA2000.bin, FPGA3000.bin, etc) which I did not copy - So the entire contents of the \Secure folder are duplicated on the root directory of my flash disk.

Then, I modified the infiniivisionCore.dll file as you described, I modified the \Startup\infiniivision.lnk file as you described, and created a file in in the root directory of my flash disk called "infiniivisionStartupOverride.txt" and put the text "True" inside that file.

It appears that I am following the correct procedure... I have tested quite a few different flash disks, old and new - I will see if I can get some different ones and test, but maybe I am unlucky and the newer scopes will require more work.

My next step will be to gain access to the console via the serial port.  I assume that doing this will allow me to see startup error messages as a result of my flash disk?

[jrgandara]

This Startrek easteregg screen saver worked fine in my 2002! I love it!

[abyrvalg]

Go further! Somebody take a WinCE toolchain and make an S/N changer, change the last digit to use leaked key.

[kilobyte]

I test my usb stick on a dsox2024a at work today.
The DSO is only some month old (July 2013).

It's a pity but it didn't load the firmware from usb stick.
The LED on the flash drive has flashed at startup but after that there was no reaction compared to my DSOX.
Maybe they have changed something in the bootloader or something else.

I think i will buy the LAN Module(as a Christmas gift  ), maybe with this its possible to do more research on the scope.

[ben_r_]

Huh, now Im more glad I bought a Premium Used from Agilent. Hopefully mine will be an older one and this hack will work on it. Still havent had a change to play with it though as I havent needed anything more than the features Ive already purchased.

[DavidDLC]

But... the low capacity USB thumdrive is a FAT32 and it works. 

David.

I made my scope work with the 8GB USB drive.

I had to create a primary partition of 7.65 GB (it won't work with 7.7 or higher), and format it to FAT32.

 

David.

[pinkman]

I test my usb stick on a dsox2024a at work today.
The DSO is only some month old (July 2013).

It's a pity but it didn't load the firmware from usb stick.
The LED on the flash drive has flashed at startup but after that there was no reaction compared to my DSOX.
Maybe they have changed something in the bootloader or something else.

I think i will buy the LAN Module(as a Christmas gift  ), maybe with this its possible to do more research on the scope.

As I suspected... Agilent probably planned this all along... Release a hackable 1st version of a scope, knowing that newer models will not be hackabe and there will still be a few hackable versions always floating around on the market to generate buzz about hacking... Sales skyrocket with hopeful buyers...  Kill product line after 5 years of better than average sales and provide little or no legacy support.  Lol.

[ben_r_]

Yea I doubt sales are going to sky rocket on $2000+ oscilloscopes just because there is a hack out there that most will never even hear about.

[vl400]

Tried on two July build 3000x scopes and the USB boot method works. Everything except bandwidth upgrade (100MHz still 100MHz and 350MHz still 350MHz) being available.

One is v2.35 and the other v2.30 firmware.

[Rufus]

Tried on two July build 3000x scopes and the USB boot method works. Everything except bandwidth upgrade (100MHz still 100MHz and 350MHz still 350MHz) being available.

One is v2.35 and the other v2.30 firmware.

I think the USB port is a bit flaky. There were problems with scopes endlessly cycling the LEDs on boot when a USB stick is inserted. Until a couple of firmware updates ago mine would never show the splash screen if a USB stick was inserted. Comments here about needing FAT16 or FAT32 and not more than 7.9GB etc might just be down to the scope liking some sticks more than others.

The scope isn't going to spend a lot of time checking or waiting for a USB stick during boot.

[willemite]

Sounds just like trying to boot other operating systems from USB flash drives. It is always hit or miss for me, some just are not accepted on any given computer at boot time, even though they might work fine once the full O/S is loaded

[pinkman]

Tried on two July build 3000x scopes and the USB boot method works. Everything except bandwidth upgrade (100MHz still 100MHz and 350MHz still 350MHz) being available.

One is v2.35 and the other v2.30 firmware.

I think the USB port is a bit flaky. There were problems with scopes endlessly cycling the LEDs on boot when a USB stick is inserted. Until a couple of firmware updates ago mine would never show the splash screen if a USB stick was inserted. Comments here about needing FAT16 or FAT32 and not more than 7.9GB etc might just be down to the scope liking some sticks more than others.

The scope isn't going to spend a lot of time checking or waiting for a USB stick during boot.

That is exactly what mine does.  It boots to the splash screen, and then the LED's cycle... Forever.  Maybe I need to try a few more flash drives.  Have already been through a dozen of them!

[wersi]

I've noticed that scope hangs if there is missig full path to launcher in .lnk file (in startup folder).

For example if you forgot to add "\usb" to launcher path in the .lnk file on USB stick or if you replaced .lnk file in flash memory with one from usb stick; containing "\usb" path, scope will hang. (I did this by mistake)

If you have used "-All" switch, You probably lost 30 trial option.
In case You don't like a little star you can add separate license switches (-l AUTO, -l MSO,.....).
There are two hidden options -l VID and -l CABLE. You can find them by pressing analyse button
Enjoy!

[wersi]

I test my usb stick on a dsox2024a at work today.
The DSO is only some month old (July 2013).

It's a pity but it didn't load the firmware from usb stick.
The LED on the flash drive has flashed at startup but after that there was no reaction compared to my DSOX.
Maybe they have changed something in the bootloader or something else.

I think i will buy the LAN Module(as a Christmas gift  ), maybe with this its possible to do more research on the scope.

Try to format usb stick, copy override.txt and than other system files.

[wersi]

Tried on two July build 3000x scopes and the USB boot method works. Everything except bandwidth upgrade (100MHz still 100MHz and 350MHz still 350MHz) being available.

One is v2.35 and the other v2.30 firmware.

You can upgrade 100MHz version only to 200MHz, and 350MHz can go up to 500MHz. (it should..)

[vl400]

You can upgrade 100MHz version only to 200MHz, and 350MHz can go up to 500MHz. (it should..)

Yeah I have, but it is using a different method. Was just pointing out that the USB boot method does not appear to enable the bandwidth upgrade 

[Rigby]

I DO NOT INTEND FOR THIS TO BE TAKEN NEGATIVELY!

I find it... interesting how so many people SEEM TO BE genuinely upset that they are unable to get more scope than they paid for.

I'm not attacking, I'm not criticizing, nothing like it; it is just very interesting to me that people genuinely believe that they should be able to upgrade their scope for free.  Reading that sentence after I typed it out, you may (incorrectly) infer that I am against this point of view; you are wrong.

I guess my interest here comes from the dichotomy between a market that is quickly moving towards software upgrades like this one, and that the market is full of people who believe that once they've purchased something, they own it.

I know in the EU that the "you bought it, you own it" rule applies, but here in the US, that isn't the case.  It should be, but it isn't.

I am just wondering where the split started.

[wersi]

Dear Rigby,

I guess these guys (me included) can't help You with that problem, since most of us are in to electronic design, hardware and software, and have very little knowledge about sociology and psychology matters.   O0

[plesa]

I've noticed that scope hangs if there is missig full path to launcher in .lnk file (in startup folder).

For example if you forgot to add "\usb" to launcher path in the .lnk file on USB stick or if you replaced .lnk file in flash memory with one from usb stick; containing "\usb" path, scope will hang. (I did this by mistake)

If you have used "-All" switch, You probably lost 30 trial option.
In case You don't like a little star you can add separate license switches (-l AUTO, -l MSO,.....).
There are two hidden options -l VID and -l CABLE. You can find them by pressing analyse button
Enjoy!

I did not fnd anything which is related to -l CABLE.
I can confirm - adding -l BW50 upgraded the 350MHz version to 500MHz, tested with Vincent pulse generator (see attachment).

Fo someone who is going to buy a new scope can be interested current PROMO
https://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2384797&nid=-33573.0.08&id=2384797

[wersi]

It's working on 2000 series, You can find it when you press Analyse button. When you add that switch launcher returns: *** Installing License: Cable Calibration.
-l VID adds HD video trigger and -l CABLE adds that cable calibration option which i'm not shure what's it for, didn't try that option yet.

[ben_r_]

Has anyone tested going back to stock after modding the firmware? Any issues there? What about with re-enabling previously purchased upgrades?