DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[TheSteve]

Do you still have the flash drive in the machine? It doesn't look like nand corruption but is trying to boot from an external flash which only going to work if you have very specific firmware.

[pquadrat]

My MSO-X 2014A appears to have the NAND flash problem too, but the recovery procedure using U-boot over the serial port doesn't work for me.
...
Unfortunately, Keysight no longer seems to repair this for free. I got a quote for a board replacement for a whopping €3362! When I purchased this 2014 back in 2014(!), it cost me around €2230 new at Farnell. Must be the inflation.

So I think this is a farewell moment to Keysight for me...

For me, if Keysight does not want to solve this known issue with these scopes any more, I will not hesitate to crack/upgrade/modify these scopes in a more active way, just to bring the balance between customers and manufacturer back.
Seems that they are no longer "innovating the HP way".

[mhsprang]

Do you still have the flash drive in the machine? It doesn't look like nand corruption but is trying to boot from an external flash which only going to work if you have very specific firmware.

Ehh... yes. Because it is supposed to boot off the flash drive at that point.

[macevergreen]

So sad. It seems I missed the party. 

All this years, I saved so hard some money to finally buy an old Agilent DSOX2002A. And now when I have it, it seems I can no longer get the wonderful FW to do some magic.

Please, anyone able to help me out?

[odisseus]

Hello everybody,

I've been using hacked fw on my MSO-X 3022T since about 2 years and have been quite happy with it. Looking at product support page, they have 7.56 as the latest patch release.
Can any of you please PM me and share a recent version of the patched firmware (doesn't have to be latest patch)?

Thank you very much!

[macevergreen]

Hi All,

My MSO-X 2014A appears to have the NAND flash problem too, but the recovery procedure using U-boot over the serial port doesn't work for me.

The last output of U-boot is:

ProcessStartupFolder: \usb\Startup\
                                   running \usb\Startup\infiniivision.lnk...
Ending ProcessStartupFolder

and then "the line went dead". Complete lockup of the console and the splash screen is visible.

So it looks like my NAND flash is too corrupted to recover.
Unfortunately, Keysight no longer seems to repair this for free. I got a quote for a board replacement for a whopping €3362! When I purchased this 2014 back in 2014(!), it cost me around €2230 new at Farnell. Must be the inflation.

So I think this is a farewell moment to Keysight for me...

Best,
Meindert

€3362? Isn't that almost as much as for a brand new oscilloscope? If they replace the board, will all licenses be transferred to the new one? Or do you have start buying all the licenses which you had beforehand again?

As far as I understood, the Agilent/Keysight 2000X-series seem to have two big issues. One seem to be the power supply and the other this NAND flash problem. Is that correct? What is the main cause of this NAND flash problem? Too much updating the software? Age? Too long run-time?

[Bud]

Do you still have the flash drive in the machine? It doesn't look like nand corruption but is trying to boot from an external flash which only going to work if you have very specific firmware.

Ehh... yes. Because it is supposed to boot off the flash drive at that point.

The firmware version you uploaded via Ymodem has to match the version on the scope, or be close to it.
Secondly, if i am not mistaken, ability to boot from USB was removed at some point. I believe this is what TheSteve referred to.

[mhsprang]

A brand new 2014A without all options is already over €4700 right now at Farnell.

For the price of the board replacement, I can buy a R&S RTB2004 will all options and upgrades (300 MHz BW) and digital probes right now. For €1114 I can buy a Siglent SDS2104X-plus and the SPL2016 logic probe that does all the MSOX2014A with options does.

So I told them that I either expect the 2014 repaired under warranty, as they have done before according to this thread, or I will shop elsewhere.

[PlainName]

So I told them that I either expect the 2014 repaired under warranty, as they have done before according to this thread, or I will shop elsewhere.

Sadly, that just tells them that whatever they do they won't see any of your money, so why would they pay to fix it?

[switchabl]

The firmware version you uploaded via Ymodem has to match the version on the scope, or be close to it.
Secondly, if i am not mistaken, ability to boot from USB was removed at some point. I believe this is what TheSteve referred to.

I know that some people have had to try several (older) versions to find a matching one. I suspect that this was just due to an error in the original guide (wrong .lnk startup file) that meant the application software was loaded from NAND and not USB as intended. But I cannot be sure.

IIRC version 2.35 was indeed the last one that supported running from USB. Later versions will instead halt the boot process and print the IP address (if the network module is connected). But this is baked into the system image, so if you load 2.35 (or older) through YMODEM, it should work not matter what version is installed.

In any case, the log clearly shows that the oscilloscope is in fact trying to load from USB, it just doesn't work for some reason. If you have double-checked that the contents of the startup .lnk file and the Secure folder are correct, trying different versions and maybe a different USB stick might still be worth a try.

[Bud]

IIRC version 2.35 was indeed the last one that supported running from USB. Later versions will instead halt the boot process and print the IP address (if the network module is connected). But this is baked into the system image, so if you load 2.35 (or older) through YMODEM, it should work not matter what version is installed.

That is the thing that it may not work. While the firmware may be bake into the system, the secret sauce is in the environment variables and user or system settings. There may be some that are version-specific and only work in a particular range of the firmware that was installed before NAND corruption happened.

[tv84]

There may be some that are version-specific and only work in a particular range of the firmware that was installed before NAND corruption happened.

Indeed, Bud. But with a $3k brick I would try everything...

[rolkinas]

Just in case:
I have earlier original firmware updates for dsox2000A in my archive:
link: https://files.fm/u/8my7exut5

2.35
2.37
2.39
2.41
2.42
2.43
2.60

and "fixed" ones:

2.43 for 2000X  (through telnet and needs dsox-LAN card)
2.60 for 2000X
1.20 for 1000X
2.60 for 3000X
7.35 for 3000T
7.35 for 4000X
2.65 for 3000X

drop me PM if you need any

[switchabl]

IIRC version 2.35 was indeed the last one that supported running from USB. Later versions will instead halt the boot process and print the IP address (if the network module is connected). But this is baked into the system image, so if you load 2.35 (or older) through YMODEM, it should work not matter what version is installed.

That is the thing that it may not work. While the firmware may be bake into the system, the secret sauce is in the environment variables and user or system settings. There may be some that are version-specific and only work in a particular range of the firmware that was installed before NAND corruption happened.

Yes, that is definitely a possibility. Ideally, we don't want to load anything from NAND at all but I am not sure if the current method achieves that. The system image is uploaded via YMODEM, the application software is running from USB but it is hard to verify that nothing else is loaded. Some environment variables are stored in a separate NOR flash, hopefully they are compatible between firmware versions but of course there is no guarantee.

So some corruption issues may not be fixable (if the "wrong" region is affected) and some versions may still be incompatible.

However I think there was at least one person who managed to recover a 2.65 device (that was bricked in a botched hacking attempt) by loading a 2.35 image through YMODEM and running 2.35 from USB. So this is not impossible per se on later versions.

It might also be possible to re-flash the NAND directly from the bootloader but that would be a high-risk operation and very hard to pull off without a full flash dump from a good unit. So this is really a last resort (if at all).

[mhsprang]

Keysight came back to me. They said the service department is not allowed to confirm service note repairs before the unit has been inspected and confirmed by tech team that it's a service note problem. That is why their standard response is to quote a "core replacement". So we agreed to have the scope picked up so Keysight can asses the problem and decide then if this is going to be a service note repair.

In the mean time I ordered an R&S RTB2004 with full options. Currently on discount at several distributors for around €3000-3300 (RTB2K-COM4).
For that money I get:

• RTB2004 Oscilloscope
• R&S®RT-ZP03 passive probe per channel, power cord, getting started manual and safety instructions
• RTB-B243 300 MHz Option
• RTH-B1 Mixed Signal Option (16 digital channels plus probe)
• RTB-B6 Arbitrary Function Generator Option
• RTB-K1 I2C/SPI Serial Trigger and Decode Option
• RTB-K2 UART/RS-232/RS-422/RS-485 Serial Trigger and Decode Option
• RTB-K3 CAN/LIN Serial Trigger and Decode Option
• RTB-K15 History & Segmented Memory Option
• RTB-K36 Frequency Response Analysis (Bode Plot) Option

I'm sure the MSOX2014 will find a new home if it gets repaired according to service note 

[Gajets]

Just in case:
I have earlier original firmware updates for dsox2000 in my archive:
2.35
2.37
2.39
2.41
2.42
2.43
2.60

and "fixed" ones:
2.43
2.60

drop me PM if you need any

it would be nice to get "fixed" 2.65

Any luck getting fixed 2.65? I really want that also.

[TheSteve]

Keysight came back to me. They said the service department is not allowed to confirm service note repairs before the unit has been inspected and confirmed by tech team that it's a service note problem. That is why their standard response is to quote a "core replacement". So we agreed to have the scope picked up so Keysight can asses the problem and decide then if this is going to be a service note repair.

In the mean time I ordered an R&S RTB2004 with full options. Currently on discount at several distributors for around €3000-3300 (RTB2K-COM4).
For that money I get:

• RTB2004 Oscilloscope
• R&S®RT-ZP03 passive probe per channel, power cord, getting started manual and safety instructions
• RTB-B243 300 MHz Option
• RTH-B1 Mixed Signal Option (16 digital channels plus probe)
• RTB-B6 Arbitrary Function Generator Option
• RTB-K1 I2C/SPI Serial Trigger and Decode Option
• RTB-K2 UART/RS-232/RS-422/RS-485 Serial Trigger and Decode Option
• RTB-K3 CAN/LIN Serial Trigger and Decode Option
• RTB-K15 History & Segmented Memory Option
• RTB-K36 Frequency Response Analysis (Bode Plot) Option

I'm sure the MSOX2014 will find a new home if it gets repaired according to service note 

The NAND corruption issue was taken care of in 2015, any firmware update since then would have resolved it. The service note for a "no charge" repair expired in 2019.
Hopefully they still take care of it for you.

For everyone else - keep your firmware up to date!

[Gajets]

Got it , should check my PM haha

[mhsprang]

The NAND corruption issue was taken care of in 2015, any firmware update since then would have resolved it. The service note for a "no charge" repair expired in 2019.
Hopefully they still take care of it for you.

For everyone else - keep your firmware up to date!

I just got word from Keysight, and I quote: "inform the customer that repair + calibration will be done under Service note – Factory warranty”

Yesss!!! 

[HighVoltage]

Congratulations !

Keysight has always been very generous with the NAND corruption issue.

I just had a broken and out of warranty scope with NAND corruption and it was taken care of perfectly at Keysight Germany.

[macevergreen]

I just wanted to take a moment to thank you all for the amazing help with my oscilloscope the past weeks. I learned a lot You all are awesome!

[mhsprang]

Today I received my MSOX 2014 back from Keysight. They repaired the scope. Well, they basically replaced the entire unit. The only original part is the backside with the serial number sticker, with Agilent molded into the plastic. The entire front is a new Keysight part, including the screen :-) Me happy!

[PlainName]

I think that's where companies like Keysight score over your average Asian cheapy. Similar experience with a BMW-badged Garmin GPS the other day - got its touchscreen in a mess, chatted to Garmim online and a new replacement was with me two days later, gratis, and express shipping both ways paid. That kind of service is what part of the high up-front cost pays for.

[w1k]

i saw you posted here that your nand flash seems to be corrupted to.
No, it doesn't.
I repaired approx 100pcs dsox2000/3000 with the programmer and no one replacement of nand flash was needed
congrats with the free repair covered by service note))

[Bud]

i saw you posted here that your nand flash seems to be corrupted to.
No, it doesn't.
I repaired approx 100pcs dsox2000/3000 with the programmer and no one replacement of nand flash was needed
congrats with the free repair covered by service note))

NAND corruption discussed here refers to corruption of data stored in NAND, not physical chip failure. Reprogramming the scope (seems this is exactly what you have done) with later firmware rectifies the problem. No chip replacement is needed.