Hameg R&S HMO scope licenses not available anymore

[Xyphro]

Hi Guys,

Just heard, that I cannot buy anymore a license for my HMO2024 scope (i need Ho010 serial decoding).
Took me 6 month to get convinced, that the money is worth it and now they discontinued even the buying of licenses? Quite disappointing.

Is there still a way, how I can buy a licenses, that somebody is aware of?

Best regards,

Kai

[rvalente]

Typical support behavior from germany (as well Japanese) companies, they discontinue their product and do not give a fuck for their legacy. I've seen this with siemens industrial equipment so many times.

At list they should have been nice and released a last firmware with all add-ons enabled just like Tek (aint a fan boy) did.

Id try to sell this unit and get yourself a hackable siglent/rigol.

[YetAnotherTechie]

To do serial analysis get a cheap usb logic analyzer. To add licenses, open the scope and start investigating!

[Xyphro]

Well, I have 3 Rigol scopes (& 1 Tek 1GHz scope) and still prefer this nice, tiny very portable, pretty noise free guy.

I also have a logic analzyer, but sometimes it is just nice to see timing behaviour of analog towards a decoded serial. Yes, I have a saleae logic pro 8 analyzer, that one can do analog too, but with limited bandwidth and sensitivity.
Let's call my wish for serial decoding a luxury problen, not a definate need.

I go to h*cking mode indeed then. So disappointed about the company mentality here - I am willing to pay and they discontinued just very few weeks ago

[Messtechniker]

Hi Guys,

Just heard, that I cannot buy anymore a license for my HMO2024 scope (i need Ho010 serial decoding).

Did you ask R&S directly by email, for example at "CustomerSupport@rohde-schwarz.com"?
If no licences are available any more simply ask for a free licence. Maybe worth a try.

[darkstar49]

I go to h*cking mode indeed then. So disappointed about the company mentality here - I am willing to pay and they discontinued just very few weeks ago

Do you have any early FW files ?? Just checked 4.531, resource file is OK, but the actual firmware file seems encrypted... (could be compression only, but entropy looks pretty high and constant for compression only). Can't recall to have seen any threads discussing HMO hacking...
If you're willing to dig in 'the hard way', check maybe the RTB thread... https://www.eevblog.com/forum/testgear/rs-rtb2004-snooping/msg3241942/#msg3241942

[EEVblog]

Hi Guys,

Just heard, that I cannot buy anymore a license for my HMO2024 scope (i need Ho010 serial decoding).

Did you ask R&S directly by email, for example at "CustomerSupport@rohde-schwarz.com"?
If no licences are available any more simply ask for a free licence. Maybe worth a try.

Yes, they should just give it away if they no longer sell it. I think Keysight did this with their 5000 series scope?

[Xyphro]

They will likely be afraid of people buying cheap end of life equipment and then getting all nice goodies for free anf not buying limited new stuff again. If I put a matketing-hat on, I can even somehow understand it :-) as a techie, it is hard to understand those kind of politics. But why shutdown a simple license generation system, generating money from virtually no effort.

This Renesas Sh2a/sh7203 is pretty closed in terms of details about debugging protocol, so I can't go a nice openocd based approach, but will borrow a debugger from an friend + willing to desolder also the tsop48 housing flash for readout. Will take some time, but now I feel a challenge to solve.

[RBBVNL9]

You might want to consider a PicoScope.

Most PicoScopes, including their most affordable models, use the same software which supports a wide range of serial protocol decoding functions. While the actual supported protocols may depend on hardware (e.g. bandwidth of channels), even the cheapest PicoScopes models support 1-Wire, ARINC 429, CAN & CAN FD, DALI, DCC, DMX512, Ethernet,  FlexRay, I²C, I²S, LIN, Manchester, MODBUS, PS/2, SENT, SPI, UART (RS-232 / RS-422 / RS-485), and USB 1.1. You can decode multiple protocols at the same time, the only limitation is the number of input channels you have.

I have PicoScope models 3405D and 2204A and find they both work quite well for serial decoding. While they do not have advanced triggering on serial protocols (which my R&S RTB2004 does have), the PicoScope's memory, search and analysis functions are much more powerful than many oscilloscopes.

The 2204A has a list price os US$ 139, which is less than many software options for bench oscilloscopes!

GL

[uski]

But why shutdown a simple license generation system, generating money from virtually no effort.

They hope that people who were ready to pay for a license will pay for a new scope, PLUS the license for this new scope, instead. This is especially valid for business users.
The cash cow is companies paying for equipment, not hobbyists. It is not surprising that they are protecting the model so that it is the most efficient possible toward people who pay the most...

I guess it's time to start hacking 

[darkstar49]

I guess it's time to start hacking 

yes, once you'll have a (decrypted) firmware image to chew... 

[Xyphro]

Will work on this over weekend, hoping the image is unencrypted in the flash at least (e10a debugger I will also get). I even found a nice tssop48 socket, that I can solder on the hmo2024 tssop48 pad directly, after removing the flash for easy multiple read/write cycles.

Oh, I got official direct reply too. No licenses can be bought anymore.

[Noy]

Will follow this thread.
Have an old Hameg HMO3524 (pre R&S Type) here with not all options installed :-D

[tunk]

Oh, I got official direct reply too. No licenses can be bought anymore.

Politely tell them that you will not buy any R&S products,
and that you will advice other people to be cautious if they
consider buying R&S products.

[Xyphro]

I did, but honestly if I would get such an email, I'd also think: "yeaaaaah, suuure".

Although there is something behind it, but simply not in a measureable way, so nobody believes.

[Saskia]

thanks for the info, it seems that that finally convinces me to NOT buy one of their newer scopes.

[tv84]

Looking for a unique, cheap versatile USB to GPIB adapter with standard USBTMC interface?
Build it yourself :-) https://github.com/xyphro/UsbGpib

Very nice!   

[Xyphro]

Thanks, took quite some effort to make and I use it with all my GPIB devices so far. There are also some guys having it built with success.

On the HMO: Find an update attached.

jTag pins identified, could read out the correct ID of the SH7203 MPU (confirmed jedec Manufacturer ID).

The only issue is, I am stuck without the E10a debugger from Renesas. The jTag, which they call uHDI is not documented and I could not find any software supporting this interface in context with SH7203 MPU.

Any Japanese colleagues here, that are able to google on japanese pages for e.g. an FTDI based H-UDI interface Software enabling memory read/write for SH7203 and help me out? 

It not, I'll will pick up an e10a tomorrow from a friend.
Edit: The interface is called H-UDI not U-HDI

[Rich@RohdeScopesUSA]

Zyphro - I can't make any promises, but let me see what I can get to happen.

-Rich

[YetAnotherTechie]

Thanks, took quite some effort to make and I use it with all my GPIB devices so far. There are also some guys having it built with success.

On the HMO: Find an update attached.

jTag pins identified, could read out the correct ID of the SH7203 MPU (confirmed jedec Manufacturer ID).

The only issue is, I am stuck without the E10a debugger from Renesas. The jTag, which they call uHDI is not documented and I could not find any software supporting this interface in context with SH7203 MPU.

Any Japanese colleagues here, that are able to google on japanese pages for e.g. an FTDI based H-UDI interface Software enabling memory read/write for SH7203 and help me out? 

It not, I'll will pick up an e10a tomorrow from a friend.
Edit: The interface is called H-UDI not U-HDI

So i read a few pages here and there about your renesas cpu, what i figured is you can use jtag as boundary scan *and* as debugger, boundary scan "uses standard registers" and h-udi is proprietary (https://renesasrulz.com/the_vault/f/archive-forum/7208/sh7253-jtag-debug-through-e10a) (https://www.manualslib.com/manual/140503/Renesas-Sh7781.html?page=1517)
It should be possible to use jtag to bit-bang a sequence to read the flash, I would desolder the chip and read it on tl866...

[Xyphro]

The sh7203 does not have boundary scan as one of the few devices in the series. Some sh2a controllers have it, some not as I could see so far. I started with urJtag, because that can bitbang using boundary scan.

As I will get the e10a today (just a 30km drive) there is no need to desolder + I can dump ram (maybe flash just has a bootloader and decrypts flash to ram?) and even debug too.

@Rich/R&S: let me know if you can organize sth. to avoid this overhead. Thanks for checking.

Best regards,

Kai

[Xyphro]

Ps: my tsop30/40/48 adapter for tl866 will only arrive in a few weeks. Made a layout for a flash programmer using atmega16 + a few 74lv164/74lv165 as IO expanders, but my PCB etching setup has some issues, making this path slower.

[MichalZ]

Hi.
I have similar problem with Hameg HMO3524 but mine applies to firmware.
Not  so long ago i have idea to find a new firmware to my Hameg, but i cant find hameg home page, its redirect you to the R&S page, but on R&S page i cant find any f.. information about Hameg or firmware for Hameg.
Their help desk inform me that latest firmware that i can instal to my scope without problem is 2.502, there is newer version 4.206 but for install it in Hamegs HMO3522 and HMO3524 the hardware upgrade is necessarry.
For HMO3000 serie not. That is a different hardware and different firmware.
They dont want to tell me what about these "hardware upgrade", they send me to my local R&S distributor, but distributor don't answer to my emails.

So, if you have Hameg HMO3522 or HMO3524 and you have firmware 2.xx the 2.502 is max you can install, if you want ver 4.206 you have to send the scope to R&S for hardware upgrade and probably pay for these. Great!!

If somebody needs i have both version in my HDD.

[Noy]

Same issue with mine..

[Xyphro]

Nice (NOT! ), I know somebody, that killed his SMIQ frontpanel in a similar way, by installing accidentally a version for a newer one. Funny to see, that newer stuff still has no firmware compatibility check built in.

Fyi: Have dumped flash and the 2 RAMs, investigation ongoing.