DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[TK]

I did it, I did it !!!
Many thanks to everyone, especially PhillyFlyers and his team!
The most recent firmware they patched works as it should!

which .lnk configuration did you end up using?  You can add BW35 to enable 350MHz option

EDIT: 350MHz option requires the HW mod in addition to the SW hack

[TheSteve]

I did it, I did it !!!
Many thanks to everyone, especially PhillyFlyers and his team!
The most recent firmware they patched works as it should!

which .lnk configuration did you end up using?  You can add BW35 to enable 350MHz option

He was adding it before but it will never work as his scope is limited to 200 MHz without a hardware mod.

[TK]

I did it, I did it !!!
Many thanks to everyone, especially PhillyFlyers and his team!
The most recent firmware they patched works as it should!

which .lnk configuration did you end up using?  You can add BW35 to enable 350MHz option

He was adding it before but it will never work as his scope is limited to 200 MHz without a hardware mod.

Yes, you are right...  350MHz needs the hw mod

[Volchenok82]

I used this set of parameters:

90#infiniiVisionLauncher.exe -l D3000BDLB -l BW35 -l SCPIPS -l SEC -l MSO -l MEMUP -l WAVEGEN

But as you correctly noted, it did not work, because there is a hardware limitation in the bandwidth of this model!  If someone wrote here that he managed to programmatically increase the bandwidth from 200 to 350 or even up to 500 MHz - do not believe ...
 

[wp_wp]

With HW mod,you can hack MSOX3024T to 500MHz。

[TheSteve]

With HW mod,you can hack MSOX3024T to 500MHz。

Or 1 GHz, or even 1.5 GHz

https://www.eevblog.com/forum/testgear/keysight-3000t-scope-1-ghz-hardware-upgrade-mod/

500 MHz is much less work though.

[Volchenok82]

With HW mod,you can hack MSOX3024T to 500MHz。

Thanks for the offer!   

I saw post  #1013 how this can be done, I will think about it in the future - I am not yet mature enough to open it and re-solder something there!   

[Volchenok82]

With HW mod,you can hack MSOX3024T to 500MHz。

Or 1 GHz, or even 1.5 GHz

https://www.eevblog.com/forum/testgear/keysight-3000t-scope-1-ghz-hardware-upgrade-mod/

500 MHz is much less work though.

 

[lzqing]

I am try to write serial number to my DSOX2022A, when i fix it from corrupted NAND flash ,but now the serial number is Unset status;
I plan to try leaked SecureDataTool , get error below , anybody has old files backup and could you share me 'Agilent.Cdf.Core.Kernel.dll'. I think FW2.0 or 1.10 include this file.


\usb> \usb\AgilentConfidential_SecureDataTool_Client.exe Get-SerialNumber -ResultFile "\usb\GetSerialNumberResult.txt" -ErrorFile "\usb\GetSerialNumberErrorFile.txt"
Caption: AgilentConfidential_SecureDataTool_Client.exe
Title  : Error
Text   : An unexpected error has occurred in AgilentConfidential_SecureDataTool_Client.exe.
Select Quit and then restart this program, or select Details for more information.

Can't find PInvoke DLL 'Agilent.Cdf.Core.Kernel.dll'.

Details: AgilentConfidential_SecureDataTool_Client.exe
MissingMethodException
Can't find PInvoke DLL 'Agilent.Cdf.Core.Kernel.dll'.

   at Agilent.Cdf.Api.Security.P500SecureStream.get_Length()
   at eh.aa(SecureStreamId A_0, ci A_1)
   at eh.p()
   at Agilent.Cdf.Api.Security.SecureStorage.ReadCommonArea()
   at Agilent.Cdf.Tools.SecureDataTool.GetSerialNumberCommand.BeginProcessing()
   at b2.a.p(b2 A_0)
   at b2.a.n(IEnumerable`1 A_0, b A_1)
   at b2.b.e(a A_0, IEnumerable`1 A_1)
   at b2.h(IEnumerable`1 A_0)
   at g2.a(String[] A_0)

[lzqing]

No，should be Agilent.Cdf.Core.Kernel.dll 。

[wp_wp]

Have you tested?

I tested.
With Agilent.Cdf.Api.dll,you can not modify serial number and model number.
You must have Agilent.Cdf.Core.Kernel.dll also.

[dagolard]

Hi all.

I´m not the big hacker, so I hope you forgive me my dumb question.

I have a MSO-X 2014A with blackscreen and want to find out, it´s the NAND Error or something else. If NAND, I want to send it in for free repair.

- installed TERA TERM
- Connected serial PC port to the PCB with settings 115200/8/0/1
- switched on the scope.

Result - see picture

What I´m doing wrong?

[PlainName]

- Connected serial PC port to the PCB with settings 115200/8/0/1

Should that be 115200/8/N/1 ?

[dagolard]

You are right. It is 8/N/1. Sorry.

[PlainName]

No problem. That kind of thing is easy (for others) to spot since we've all done it enough to recognise it quickly

[dagolard]

So - except of the wrong term any ideas?

[Bud]

Try a different terminal software.

[Hexley]

- Connected serial PC port to the PCB with settings 115200/8/0/1

Did you use a logic-level serial adapter? The scope has 3V3 signals, so a standard serial port is not compatible.

[dagolard]

No, I didn´t.
So I have to get one...

[dagolard]

I think that should work...

https://homediyelectronics.com/projects/arduino/seriallevelconverter/

[Hexley]

Or this https://www.amazon.com/DSD-TECH-SH-U09C5-Converter-Support/dp/B07WX2DSVB/ if you set the jumper to 3.3V you should be OK.

[TheSteve]

If you also connected the TX line from the PC to the scope then you tortured the processor UART a little - but it likely survived just fine.

[dagolard]

I hope I didn't destroy anything...

[dagolard]

Ready for weekend...

[dagolard]

Okay, that´s the result I get....

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2011-08-24  22:35:34 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    36045 Bytes = 35.2 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Aug 24 2011 15:15:48
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOXOXOOOOERROR: Checksum failure (expected=0x167CF58  computed=0x167D64E)
****** Checksum failure on record 13, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------

• : Address=0x80361000  Length=0x13064E8  Name="" Target=RAM

 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1600000

BL_IMAGE_TYPE_UNKNOWN

 Loading image 2 failed, trying next one
 All images failed

Press r to reset

NAND or no NAND Failure?