DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[lastguy]

I read original 7.40 or PhillyFlyers packed, both .lnk shows: 56#"\Program Files\infiniiVision\infiniivisionLauncher.exe"
and now infiniiVisionLauncher.exe is in folder named [INSTALLDIR], which seems, during boot the [INSTALLDIR] content will be copied to \Program Files\infiniiVision\ before .lnk cmd be called.
Thus previous USB boot won't work, any work around? I'm not familiar with WINCE.

Does PhillyFlyers' pkg unlocked all features or need user to repack the pkg? what is the BW? which USB format tool shall be used? is Rufus (FreeDOS style boot) ok?

[lastguy]

No body want to help me?
I got non-English version cab manager installation pkg, if someone sent me a link to download English one - just zip the installed folder, I'd be able to release a pkg to be installed on windows 10.
Original pkg cannot be installed on windows 10, and no pkg can be downloaded from US web, all are links to original company web which is non existed.

[TK]

In my case, I don't know how to help because I don't understand what you are trying to accomplish.  There is a hack already that enables all the options you like and I included the link for you to download the files.  It is as simple as downloading the installation file, then copy it to the USB stick and copy also the infiniivision.lnk file with the options you want to enable.

[TK]

I read original 7.40 or PhillyFlyers packed, both .lnk shows: 56#"\Program Files\infiniiVision\infiniivisionLauncher.exe"
and now infiniiVisionLauncher.exe is in folder named [INSTALLDIR], which seems, during boot the [INSTALLDIR] content will be copied to \Program Files\infiniiVision\ before .lnk cmd be called.
Thus previous USB boot won't work, any work around? I'm not familiar with WINCE.

Does PhillyFlyers' pkg unlocked all features or need user to repack the pkg? what is the BW? which USB format tool shall be used? is Rufus (FreeDOS style boot) ok?

You don't need to boot from the USB.  Just copy the patched firmware and the desired infiniivision.lnk file (where you indicate which options you want to enable), power on the scope, when boot is finished, insert the USB drive, then go to utility -> file browser, select the patched firmware and voila, options enabled after scope reboots.

[2lostkiwis]

I have been following this thread for a long time. And have the latest firmware patched on my DSO-X 3034A. I got the 500MHz upgrade which I tested with fast rise time pulse generator from Leo Bodnar. Really appreciate eveyones work on getting this working. One thing that is not clear to me, is exactly what options I should have in the link file. I currently have:

Code: [Select]

50#infiniivisionLauncher.exe -l all -l BW50 -l SCPIPS
Can anyone give me the correct list of what I should have? Just in case I am missing anything...

[msuthar]

Hi,
You can try this :

32#infiniivisionLauncher.exe -l ALL

-l ALL   enables all "trial" licences but without time limit, that's why there are "*" following each license.
or
-l DIS    Distributor license (memMax,EMBD,AUTO,COMP,SGM,MASK,WAVEGEN,ASV,PLUS) 

[msuthar]

Add more if any item  is missing :

-l D2000AUTA   Automotive Software for 2000 X-Series      (Automotive Software Package CAN LIN  ,serial trigger,Mask limit testing )
-l D2000GENA   General purpose Software for 2000 X-Series           (Embeded Software Package I2C,SPI,UART-RS232/422/485 serial trigger Mask limit testing )
-l D2000BDLA   Software Bundle for 2000 X-Series              (Ultimate Bundle Software Package I2C,SPI,UART(RS232/422/485) CAN LIN serial trigger Mask limit testing )
-l D2000AUTB   Automotive Software for 2000 X-Series      (Automotive Software Package CAN LIN  ,serial trigger,Mask limit testing )
-l D2000GENB   General purpose Software for 2000 X-Series           (Embeded Software Package I2C,SPI,UART-RS232/422/485 serial trigger Mask limit testing )
-l D2000BDLB   Software Bundle for 2000 X-Series              (Ultimate Bundle Software Package I2C,SPI,UART(RS232/422/485) CAN LIN serial trigger Mask limit testing

-l All              All Licenses
-l rmAll           No Licenses
-l DIS      Distributor license
-l MSO      MSO
-l FPG      FPGA Probe ??
-l ALT      FPGA Altera ??
-l memNo           Acq Memory Dflt
-l MEMUP           Acq Memory Max
-l memMax   Acq Memory Max
-l EMBD      Embedded serial decode and trigger
-l AUTO      Automotive serial decode and trigger
-l AUDIO           Audio serial decode and trigger
-l AERO      1553 & 429 serial decodes
-l FLEX      Flex Ray serial decode
-l FRC      Flex Ray Compliance
-l FLEXC           Flex Ray Plus
-l PWR      Power application
-l COMP      UART/RS232 serial decode and trigger
-l SGM      Segmented Memory
-l SGMC      Circular Segmented Memory
-l MASK      Mask limit testing
-l TEL      Telecom Mask Test
-l BW50      500MHz Bandwidth
-l BW20      200MHz Bandwidth
-l BW10      100MHz Bandwidth
-l WAVEGEN   WaveGen license
-l ADVMATH   Advance Math
-l VID      Enhanced Video Triggering
-l ASV      Agilent  Spectrum Visuliser  license for OSV -Oscilloscope Spectrum Visualizer PC Software
-l TOM      Tomotherapy
-l FWD      F8AEAE82 ??
-l PLUS      Enhancements - math, memory, update rate For DSOX2000 PLUS
-l CABLE           Cable Calibration, Ratio and Phase measure in Analyse Menu
-l SCPIPS           Infiniium Mode SCPI Commands supports
-l RML      Remote Log
-l DVM      Digital Voltmeter
-l EDK      Education kit license
--perf               adds more items  in measure display

[MarkL]

...
-l FWD      F8AEAE82 ??
...

This license allows the scope to load earlier firmware versions.  Tech support once generated this license for me which allowed me to back out a firmware upgrade that introduced a nasty bug.  "FWD" probably means "firmware downgrade".

Maybe they were trying to be non-obvious by calling it F8AEAE82.

FYI, for your list.

[lastguy]

I don't want to over write scope firmware in NVM, thus I want USB boot.
I have Eth card but no RS232, I can telnet (windows telnet or teraterm) get welcome msg and >>, but cannot run any cmd - no effect, cannot show any fold or file.

[Bud]

Seems you are telneting to port 5024 which is SCPI interface ( try entering *IDN? ). You should telnet to port 23.

[lastguy]

Seems you are telneting to port 5024 which is SCPI interface ( try entering *IDN? ). You should telnet to port 23.

Thanks! 5024 is SCPI! I used SCPI but always through keysight I/O, never used windows telnet with a/c login. I thought telnet to port 23 shall ask me a/c and passwd but it just failed.
Anybody can share 3000T a/c name and passwd? Does the USB need to be formatted as "bootable"?
I'v been climbing now at 3x floors or 1/4.

[TheSteve]

Each 3000T calculates a unique password(most of the time anyway).

[lastguy]

Each 3000T calculates a unique password(most of the time anyway).

thx then how to get to the status where telnet asks for ac name and passwd? I got this:
C:\>telnet 10.76.171.133 23
Connecting To 10.76.171.133...Could not open connection to the host, on port 23: Connect failed
C:\>

[wp_wp]

[ Specified attachment is not available ]

Each 3000T calculates a unique password(most of the time anyway).

thx then how to get to the status where telnet asks for ac name and passwd? I got this:
C:\>telnet 10.76.171.133 23
Connecting To 10.76.171.133...Could not open connection to the host, on port 23: Connect failed
C:\>

With port 23, I didn’t telnet DSOX3014T either.
So I made a file to let 3000T jump to WinCE desktop.

[maurit]

Hi all,
thank you for all posts that have allowed me, three years ago, to restore my DSOX3034A.
Now I also have a DSOX2012A with corrupted NAND but i ran into a problem that i can't solve.
The DHCP works and change the address in the Oscilloscope.
I can see the address assigned with "IP Scanner" or in my router.

Although I assume that the firmware installed is 2.30 (Length=0x12F9870)
I have tried to load the nk.bin of 1.10, 2.10, 2.20, 2.30, 2.35, 2.42 without success.

The file celoader and nk.bin are in C:\DSOX\
Below I report the screen-shots of the RS232 traffic (Oscilloscope)  |Oand the Win7 DOS window (PC).

I have read and reread the 116 pages of the blog but I cannot understand the problem.
Thanks for your help and sorry for my english !!!


U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500
CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2011-01-27  11:38:14 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    36703 Bytes = 35.8 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...

Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Jan 27 2011 02:
04:15
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXOOOOOOOOXOXXOOOOOOOOXOOXOXOOOÿOXXXOOOOOOOOOXOOOOXOXXOXXOXOOOXOXXXXXXOOX
XOOOOOOXOOXXOXXOOOXOXXOOXXOXOOOERROR: Checksum failure (expected=0x11DCE9E  comp
uted=0x11DC098)
****** Checksum failure on record 42, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------

• : Address=0x80361000  Length=0x12F9870  Name="" Target=RAM

 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1600000

BL_IMAGE_TYPE_UNKNOWN

 Loading image 2 failed, trying next one
 All images failed

Press r to reset

Now I leave and press space to stop autoboot

P500 Boot Loader Configuration :

Mac address .......... (00:30:D3:20:8B:C5)
Ip address ........... (192.168.1.169)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0600000)
        2 (0xd1600000)

l) Load flash resident image now
d) Download from ethernet now
u) Start u-boot by resetting
v) Verify Images

I press "D" option

>Ready!
Preparing for download...
 Downloading image from platform builder
Setting MAC address GMAC_MAC_ADDR_HI_LO[0] = 0x8000C58B, GMAC_MAC_ADDR_HI_LO[1]
= 0x20D33000
Auto Negotiation complete in 133943 iterations
Link up
AutoNegotiate Full Duplex
AutoNegotiate 100 Base T
Reading MAC address 0x30 0xD320 0x8BC5
Setting MAC address GMAC_MAC_ADDR_HI_LO[0] = 0x8000C58B, GMAC_MAC_ADDR_HI_LO[1]
= 0x20D33000
INFO: GMAC Ethernet controller initialized.
InitDHCP():: Calling ProcessDHCP()
ProcessDHCP()::DHCP_INIT
!CheckUDP: Not UDP (proto = 0x00000002)
Got Response from DHCP server, IP address: 192.168.1.207

ProcessDHCP()::DHCP IP Address Resolved as 192.168.1.207, netmask: 255.255.255.0

Lease time: -1 seconds
Got Response from DHCP server, IP address: 192.168.1.207
No ARP response in 2 seconds, assuming ownership of 192.168.1.207
+EbootSendBootmeAndWaitForTftp
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
!CheckUDP: Not UDP (proto = 0x00000001)
!CheckUDP: Not UDP (proto = 0x00000001)
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
Sent BOOTME to 255.255.255.255
................................................




This is what it tells me from PC Command Prompt The "C:\DSOX" directory contain "celoader" and "nk.bin"



Microsoft Windows [Versione 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. Tutti i diritti riservati.

C:\Users\Utente>cd \

C:\>cd dsox

C:\dsox>celoader nk.bin 192.168.1.207
syntax: celoader [binfile-name] [target-id]

CELOADER 1.3.0 - Waiting for BOOTME from nk.bin...
Packet from: 192.168.1.207
64 BYTES: EDBG-------0- ------SH600_-----------SH600_35781------A---------
Error: Received EBOOT from another target
** EXITING **

C:\dsox>

[TK]

Try the recovery using YMODEM over UART technique. No need to use lan card and setup bootp server

[Bud]

C:\dsox>celoader nk.bin 192.168.1.207

Try with no IP address.

[maurit]

Hi Bud,
without IP address same result.
I am trying with YMODEM serial transfer proposed by TK but the first results are not positive,
only a few data transferred !!!   

[maurit]

  I have tried many times with YMODEM but it fails, only 7168 Bytes transferred each time.
The data sent and received is also unreadable.
The RS232 setting seems correct to me.

=========== This is what TeraTerm tells me =========================================

 0ðÀÀx`ÿÀ{`àÿÀððÀþààÀÀÿÀÀÀÀ{`àÿÀpoà€öÀþ€°€ø€üÀ€ø€ü€üÀÿ€°€ø€üÀ€ø€ü€üÀàö

                                                                             00``ÀÀÀÀx`ÿÀüàÿÀðàÀÿÀÀüàÀÀÀÿàÀüÀÿÀ`oàð?06àÀ°€€öÀàö

        00`àØÀðÀpÀ°€Àx`ÿÀìàÿÀððÀþÀÀüàÀÀÀÀÀ{`àÿÀðÀ°€üÀàü`ÿàÀûÀ°€ÀÀÀ{`àÿÀplààü`ÿÀààØÀ€öÀö

                                                                                       0ðÀÀà
CCCCCCCCCCCCCCCCCCCCxyzModem - CRC mode, 4(SOH)/7(STX)/0(CAN) packets, 25 retries
## Total Size      = 0x00001c00 = 7168 Bytes
p500>

============================================================================

[Bud]

Hi Bud,
without IP address same result.

I have in my records nk.bin should be renamed to boot.bin (for 1000x scope) for tftp. Try with a renamed file.

[maurit]

Thanks TK
for the tip but no progress.
I have tried all the nk0 files, of the Old Firmware in my possession: 1.10, 2.10, 2.20, 2.30, 2.35, 2.42.
I tried to replace the address "loady 0x0361000 115200" with "loady 0x80361000 115200"......Nothing !!

Why I don't  receive, in Teraterm, sensible things but incomprehensible graphic signs?
Is this normal?

Thanks for your patience ....... I'm just a hobbyist. 

[maurit]

I renamed the nk.bin to boot.bin but it doesn't work.

Thanks a lot.

[Bud]

Why I don't  receive, in Teraterm, sensible things but incomprehensible graphic signs?
Is this normal?

Thanks for your patience ....... I'm just a hobbyist. 

Do you use a voltage level converter RS232->5V (or 3.3V) ?

[TK]

Thanks TK
for the tip but no progress.
I have tried all the nk0 files, of the Old Firmware in my possession: 1.10, 2.10, 2.20, 2.30, 2.35, 2.42.
I tried to replace the address "loady 0x0361000 115200" with "loady 0x80361000 115200"......Nothing !!

Why I don't  receive, in Teraterm, sensible things but incomprehensible graphic signs?
Is this normal?

Thanks for your patience ....... I'm just a hobbyist. 

It is not normal, serial signals on the DSO are 3.3V 

Also, as you were able to "communicate"  with the scope and typed the loady command, I assume you are using 115200 baud setting in teraterm.  I also assume that you are using the modified nk.bin file?

Are you following up the instructions on this link? https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181

[maurit]

Yes,
I use a voltage level converter RS232->3,3V. Powered from Oscilloscope.
I used the nk.nb0 file as in the Titiris guide.