Author Topic: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ? (Read 1249303 times)

maurit · « **Reply #2850 on:** October 15, 2021, 10:27:50 pm »

Chinese TTL <> RS232 (3,3 V.) with MAX3232.

maurit · « **Reply #2851 on:** October 16, 2021, 02:18:50 pm »

Problem solved !!!!!!!
It was the underperforming TTL <> RS232 Chinese interface.
I shortened the rs232 cable to the PC and the transfer started immediately.

Now I will update the Firmware and Options.

Thanks to all.

maurit · « **Reply #2852 on:** October 16, 2021, 02:23:50 pm »

tv84 · « **Reply #2853 on:** October 17, 2021, 12:04:28 pm »

Thread closed.

maurit · « **Reply #2854 on:** October 20, 2021, 12:28:21 pm »

Dear tv84,
I didn't understand the statement: Thread closed
Thanks for any clarification.

analogRF · « **Reply #2855 on:** October 20, 2021, 12:39:41 pm »

Quote from: maurit on October 20, 2021, 12:28:21 pm

Dear tv84,
I didn't understand the statement: Thread closed
Thanks for any clarification.

when the link was not removed yet, I think it was clear why

lastguy · « **Reply #2856 on:** October 21, 2021, 05:05:09 am »

Quote from: analogRF on October 20, 2021, 12:39:41 pm

when the link was not removed yet, I think it was clear why

illogical

Howardlong · « **Reply #2857 on:** October 21, 2021, 08:54:47 am »

Quote from: wp_wp on October 14, 2021, 04:37:14 am

(Attachment Link) (Attachment Link)
Quote from: lastguy on October 12, 2021, 05:05:53 pm
Quote from: TheSteve on October 07, 2021, 11:46:43 pm
Each 3000T calculates a unique password(most of the time anyway).
thx then how to get to the status where telnet asks for ac name and passwd? I got this:
C:\>telnet 10.76.171.133 23
Connecting To 10.76.171.133...Could not open connection to the host, on port 23: Connect failed
C:\>

With port 23, I didn’t telnet DSOX3014T either.
So I made a file to let 3000T jump to WinCE desktop.
(Attachment Link)

Just before lockdown, I travelled to Hong Kong on Emirates, and the in flight entertainment remote crashed.

Unfortunately I didn't have a USB keyboard or serial adapter with me, or I'd have unlocked some additional options.

tv84 · « **Reply #2858 on:** October 21, 2021, 09:29:28 am »

Quote from: Howardlong on October 21, 2021, 08:54:47 am

Unfortunately I didn't have a USB keyboard or serial adapter with me, or I'd have unlocked some additional options.

Nonetheless, it was good that it wasn't linked to the flight management system.

TheSteve · « **Reply #2859 on:** October 21, 2021, 06:56:42 pm »

Or maybe it is connected to the flight system - you just never know

For those wondering the 3000t series appears to enable telnet and then disable it a few seconds later. So the only way to telnet in is to connect at just the right time and then kill the infiniivision task so it doesn't kill the session. Generally you also need to calculate a custom password for each scope. Normally a script would be used to login and kill the task. Details are many pages back in this thread.

And lastly if anyone is looking for an MSO cable these two are a crazy good deal and won't last long(not mine, no affiliation with the seller):

https://www.ebay.com/itm/363589547314

wp_wp · « **Reply #2860 on:** October 22, 2021, 04:37:21 am »

I also write a file to let 4000A scope jump to WinCE desktop.

TheSteve · « **Reply #2861 on:** October 24, 2021, 09:43:33 pm »

Quote from: wp_wp on October 22, 2021, 04:37:21 am

I also write a file to let 4000A scope jump to WinCE desktop.

Very nice, will you be posting the files?

maurit · « **Reply #2862 on:** October 26, 2021, 09:59:43 am »

Good morning,
if you are interested I have some DSOX-Lan cards left with 3D printed frames.
As in the pictures.
I sell for 40 Euros + shipping.
I ship from Italy.

lastguy · « **Reply #2863 on:** October 27, 2021, 10:20:57 pm »

Quote from: wp_wp on October 22, 2021, 04:37:21 am

I also write a file to let 4000A scope jump to WinCE desktop.

WP_WP: would you mind to share these file?
anybody can confirm a bootable currently (AMAZON/EBAY) available USB stick?

lastguy · « **Reply #2864 on:** October 27, 2021, 10:32:27 pm »

Quote from: TheSteve on October 24, 2021, 09:43:33 pm

Quote from: wp_wp on October 22, 2021, 04:37:21 am
I also write a file to let 4000A scope jump to WinCE desktop.

Very nice, will you be posting the files?

I found a paper with downloadable file to do similar things: https://ripitapart.com/2018/10/15/gaining-access-to-the-windows-ce-desktop-and-doom-on-the-keysight-dsox1102g-oscilloscope/
or just download this and follow readme: https://www.dropbox.com/s/1xq7g7he942ynr5/ScopeLiberator-Release-2.0.zip?dl=0
Tried on 3000T, once Run lighted typed two times [Wkey] R \usb\a.bat, 2nd type is near by Keysight read logo, get to wince but no mouse icon.

TheSteve · « **Reply #2865 on:** October 28, 2021, 03:50:24 am »

Just have to get the timing perfect.

Logging in via telnet is probably easier though.

Bud · « **Reply #2866 on:** October 28, 2021, 04:47:45 am »

Try my package for the 1000x, maybe it will work.
https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg3702367/#msg3702367

HardDrive · « **Reply #2867 on:** October 30, 2021, 05:53:58 am »

Does anyone by any chance have a copy of this file lying around? (the original link is no longer working)

Quote

DSOX 3000T Series: FW: 7.31.2020012842_patched
md5: <63DDE0129A9516C81DCF380F228BB08A>

After updating to the latest 7.40.2021031200, I can no longer access the Web interface without the scope crashing.
This used to work with the older 7.31 FW.

My scope is an MSOX3104T with a "DSOXLAN" installed.
Normally, I would get a "LAN VGA option module fault" even with the older FW when it boots, but this has not caused it to crash.
However, with the newer 7.40 and 7.35 FW, as long as there is an attempt to load the web interface, the scope would crash immediately.

Wondering whether anyone else has encountered this issue? Thanks!

pepperoni7 · « **Reply #2868 on:** October 30, 2021, 08:10:50 am »

Quote from: HardDrive on October 30, 2021, 05:53:58 am

...
My scope is an MSOX3104T with a "DSOXLAN" installed.
Normally, I would get a "LAN VGA option module fault" even with the older FW when it boots, but this has not caused it to crash.
However, with the newer 7.40 and 7.35 FW, as long as there is an attempt to load the web interface, the scope would crash immediately.

Wondering whether anyone else has encountered this issue? Thanks!

My DSOXLAN board has a jumper to short pin 78 and 80 (I guess) to "enable" the LAN module.
But then the scope assumes an orginal LAN/VGA board installed. But yours is missing the VGA option, therefore the error message!
The error is not harmful AFAIK but annoying...
If NOT shorting pin 78 to 80 the module seems not to be recognized by the scope (it's not visible in the utility menue), but it still gets an IP adress assigned from DHCP and works perfectly for me, even with FW7.35.
Of course you once must get to know this IP adress and make sure it doesnt get changed by DHCP.

HardDrive · « **Reply #2869 on:** October 30, 2021, 10:55:06 am »

Thanks, pepperoni7 & tv84,

Unfortunately, reverting back to 7.31 did not resolve the issue.

Poking around in the telnet console, I discovered the crash address 0x4027236C belongs to a module called 'nspm.dll' (related to DNS/WINS namespace provider?)
Inspecting the DLL, it seems to crash after reading the registry 'Ident\Name', hinting something to do with the system name (not exactly sure what is really doing, it was a wild guess).
So I changed the system name from 'msox3104t' to 'mso' and the Web Interface now works (no idea why that worked but it did).

In hindsight, I recently configured DHCP to issue that system name and also updated the FW 7.40 at the same time but did not correlate the new name to the issue.

Everything works now even on the latest 7.40 FW

Thanks again for the help!

2N3055 · « **Reply #2870 on:** October 30, 2021, 11:58:05 am »

Quote from: HardDrive on October 30, 2021, 05:53:58 am

Does anyone by any chance have a copy of this file lying around? (the original link is no longer working)
Quote
DSOX 3000T Series: FW: 7.31.2020012842_patched
md5: <63DDE0129A9516C81DCF380F228BB08A>

After updating to the latest 7.40.2021031200, I can no longer access the Web interface without the scope crashing.
This used to work with the older 7.31 FW.

My scope is an MSOX3104T with a "DSOXLAN" installed.
Normally, I would get a "LAN VGA option module fault" even with the older FW when it boots, but this has not caused it to crash.
However, with the newer 7.40 and 7.35 FW, as long as there is an attempt to load the web interface, the scope would crash immediately.

Wondering whether anyone else has encountered this issue? Thanks!

Try scope with static address.
Disconnect scope from the router and try connecting to a PC with crossover cable or just switch with static addressing...
Also try to disable any IPV6 on router.

There is a IPv6 related bug that crashes the scope like that and is connected to router implementation of IPv6. It was happening with Speedport Plus internet router during DHCP 1pv$ and 6 address handout. It didn't matter if you disabled IPv6 on scope and router...
It didn't happen with static address and different router..

albertr · « **Reply #2871 on:** November 01, 2021, 02:17:32 pm »

A quick question for the experts - what is the difference between MEMUP and memMax options (on a 3000T series if it makes a difference)?
Thanks!
-albertr

Venturi962 · « **Reply #2872 on:** November 01, 2021, 02:47:14 pm »

No functional difference, description available here:

https://www.eevblog.com/forum/testgear/agilent-dso-2000x-what-are-these-additional-software-packages/msg314783/#msg314783

albertr · « **Reply #2873 on:** November 01, 2021, 05:04:33 pm »

Also, did anyone already try the DSOX3U2H option that was mentioned in ver. 7.40 F/W pictured below?

-albertr

Howardlong · « **Reply #2874 on:** November 02, 2021, 11:47:08 pm »

USB high speed decode and trigger doesn't work on 3000T. See up thread starting at post 2786 on page 112. Turns out there was a marketing/technical miscommunication.

LS and FS works.

Edit: even if HS did work, you'd need a 1GHz+ bandwidth scope. It does work on the 4000A and 6000X but they have hardware to support HS that the 3000T doesn't.


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ? (Read 1249303 times)

Share me