The fort is falling. Liberating Keysight DSOX 1200 (Linux, black) series scopes. - Page 1
Forum section: electronics / testgear

author: Bud
author_rank: Super Contributor
timestamp: February 11, 2024, 08:28:23 pm
content: A major breakthrough in liberation of the black Linux-based EDUX 1052a scope. The wall has been breached, I am in and exploring the filesystem.The intent is to not do anything before understanding the filesystem, taking a full backup and have a restore plan.This should also apply to the 2- and 4-channel DSOX 1200 series Linux-based scopes, since they they all have same firmware. The Subject of this topic was selected to reflect that.

author: Bud
author_rank: Super Contributor
timestamp: February 11, 2024, 08:29:47 pm
content: Full boot log:Code:U-Boot SPL 2019.01+tlo+b14f82da857 (Jul 16 2021 - 22:16:28 +0000)Configure DDRTrying to boot from NORU-Boot 2019.01+tlo+b14f82da857 (Jul 16 2021 - 22:16:28 +0000)-SPEArCPU: SPEAr600DRAM: 128 MiBFlash: 512 KiBNAND: (ECC 4-bits BCH) 256 MiBLoading Environment from Flash... OKPower-on resetHit SPACE in 5 seconds to stop autoboot.ubi0: attaching mtd2ubi0: scanning is finishedubi0: attached mtd2 (name "rootfs", size 144 MiB)ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 129024 bytesubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 512ubi0: VID header offset: 512 (aligned 512), data offset: 2048ubi0: good PEBs: 1152, bad PEBs: 0, corrupted PEBs: 0ubi0: user volume: 4, internal volumes: 1, max. volumes count: 128ubi0: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 1033334404ubi0: available PEBs: 0, total reserved PEBs: 1152, PEBs reserved for bad PEB handling: 40Loading file 'fpga1.binx' to addr 0x04000000...Done## Checking Image at 04000000 ...Legacy image foundImage Name:Image Type: ARM Linux Firmware (gzip compressed)Data Size: 283776 Bytes = 277.1 KiBLoad Address: 00000000Entry Point: 00000000Verifying Checksum ... OKLoading FPGA Device 0...........................................Done.Loading file '1000X.dtb' to addr 0x01800000...DoneLoading file 'uImage' to addr 0x02000000...Done## Checking Image at 02000000 ...Legacy image foundImage Name: Linux-4.14.102-keysight-productiImage Type: ARM Linux Kernel Image (uncompressed)Data Size: 3611384 Bytes = 3.4 MiBLoad Address: 02000000Entry Point: 02000000Verifying Checksum ... OK## Booting kernel from Legacy Image at 02000000 ...Image Name: Linux-4.14.102-keysight-productiImage Type: ARM Linux Kernel Image (uncompressed)Data Size: 3611384 Bytes = 3.4 MiBLoad Address: 02000000Entry Point: 02000000## Flattened Device Tree blob at 01800000Booting using the fdt blob at 0x1800000Loading Kernel Image ... OKLoading Device Tree to 07788000, end 0778d4f4 ... OKStarting kernel ...Uncompressing Linux... done, booting the kernel.Booting Linux on physical CPU 0x0Linux version 4.14.102-keysight-production (oe-user@oe-host) (gcc version 8.2.0 (GCC)) #1 PREEMPT Fri Jul 16 21:32:14 UTC 2021CPU: ARM926EJ-S  revision 5 (ARMv5TEJ), cr=0005317fCPU: VIVT data cache, VIVT instruction cacheOF: fdt: Machine model: Keysight,DSO-X1102AMemory policy: Data cache writebackBuilt 1 zonelists, mobility grouping on. Total pages: 32512Kernel command line: console=ttyAMA0,115200 instrumentguid=236ADCE1-3D7C-6820-BD59-A638093DC90E mtdparts=nand:16m(system-storage),144m(rootfs),-(user-storage) ubi.mtd=user-storage,0,0,2 ubi.mtd=system-storage,0,0,1 ubi.mtd=rootfs,0,0,0 ecc_mode=1 ubi.block=0,rootfs root=/dev/ubiblock0_0 rootfstype=squashfs init=/sbin/preinitPID hash table entries: 512 (order: -1, 2048 bytes)Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)Memory: 122668K/131072K available (5126K kernel code, 211K rwdata, 1256K rodata, 180K init, 219K bss, 8404K reserved, 0K cma-reserved)Virtual kernel memory layout:vector : 0xffff0000 - 0xffff1000 ( 4 kB)fixmap : 0xffc00000 - 0xfff00000 (3072 kB)vmalloc : 0xc8800000 - 0xff800000 ( 880 MB)lowmem : 0xc0000000 - 0xc8000000 ( 128 MB)modules : 0xbf000000 - 0xc0000000 ( 16 MB).text : 0xc0008000 - 0xc0509c58 (5128 kB).init : 0xc0669000 - 0xc0696000 ( 180 kB).data : 0xc0696000 - 0xc06cad40 ( 212 kB).bss : 0xc06d00a4 - 0xc0706d04 ( 220 kB)SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1Preemptible hierarchical RCU implementation.Tasks RCU enabled.NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16VIC @f1100000: id 0x00041190, vendor 0x41VIC @f1000000: id 0x00041190, vendor 0x41clocksource: tmr1: mask: 0xffff max_cycles: 0xffff, max_idle_ns: 155536400 nssched_clock: 32 bits at 100 Hz, resolution 10000000ns, wraps every 21474836475000000nsConsole: colour dummy device 80x30Calibrating delay loop... 165.27 BogoMIPS (lpj=826368)pid_max: default: 32768 minimum: 301Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)CPU: Testing write buffer coherency: okSetting up static identity map for 0x8400 - 0x8458Hierarchical SRCU implementation.devtmpfs: initializedrandom: get_random_u32 called from bucket_table_alloc+0xe0/0x274 with crng_init=0clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 nsfutex hash table entries: 256 (order: 0, 7168 bytes)NET: Registered protocol family 16DMA: preallocated 256 KiB pool for atomic coherent allocationsSerial: AMBA PL011 UART driverd0000000.serial: ttyAMA0 at MMIO 0xd0000000 (irq = 40, base_baud = 0) is a PL011 rev2console  enabledd0080000.serial: ttyAMA1 at MMIO 0xd0080000 (irq = 41, base_baud = 0) is a PL011 rev2SCSI subsystem initializedusbcore: registered new interface driver usbfsusbcore: registered new interface driver hubusbcore: registered new device driver usbpps_core: LinuxPPS API ver. 1 registeredpps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>PTP clock support registeredclocksource: Switched to clocksource tmr1NET: Registered protocol family 2TCP established hash table entries: 1024 (order: 0, 4096 bytes)TCP bind hash table entries: 1024 (order: 2, 20480 bytes)TCP: Hash tables configured (established 1024 bind 1024)UDP hash table entries: 256 (order: 1, 12288 bytes)UDP-Lite hash table entries: 256 (order: 1, 12288 bytes)NET: Registered protocol family 1RPC: Registered named UNIX socket transport module.RPC: Registered udp transport module.RPC: Registered tcp transport module.RPC: Registered tcp NFSv4.1 backchannel transport module.workingset: timestamp_bits=30 max_order=15 bucket_order=0squashfs: version 4.0 (2009/01/31) Phillip LougherNFS: Registering the id_resolver key typeKey type id_resolver registeredKey type id_legacy registeredNET: Registered protocol family 38Block layer SCSI generic (bsg) driver version 0.4 loaded (major 247)io scheduler noop registeredio scheduler deadline registeredio scheduler cfq registered (default)io scheduler mq-deadline registeredio scheduler kyber registeredpl061_gpio f0100000.gpio: PL061 GPIO chip @0xf0100000 registeredpl061_gpio fc980000.gpio: PL061 GPIO chip @0xfc980000 registeredpl061_gpio d8100000.gpio: PL061 GPIO chip @0xd8100000 registeredbrd: module loadedflash_id 3459839 0x34CAFFsmi fc000000.flash: mtd .name=nor-flash .size=800000(8M)smi fc000000.flash: .erasesize = 0x10000(64K)3 ofpart partitions found on MTD device nor-flashCreating 3 MTD partitions on "nor-flash":0x000000000000-0x000000060000 : "uboot"0x000000060000-0x000000070000 : "env0"0x000000070000-0x000000080000 : "mfgdata"fsmc-nand d1800000.flash: FSMC device partno 090, manufacturer 80, revision 00, config 00nand: device found, Manufacturer ID: 0x2c, Chip ID: 0xdanand: Micron MT29F2G08ABAEAH4nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64fsmc-nand d1800000.flash: Using 4-bit SW BCH ECC schemenand: chip has unique ID: 6f-f5290fa39045d345ad45ae12cc12fd61Scanning device for bad blocks3 cmdlinepart partitions found on MTD device nandCreating 3 MTD partitions on "nand":0x000000000000-0x000001000000 : "system-storage"0x000001000000-0x00000a000000 : "rootfs"0x00000a000000-0x000010000000 : "user-storage"fsmc-nand d1800000.flash: FSMC NAND driver registration successfullibphy: Fixed MDIO Bus: probedstmmaceth e0800000.ethernet: no reset control foundstmmac - user ID: 0x10, Synopsys ID: 0x32stmmaceth e0800000.ethernet: Ring mode enabledstmmaceth e0800000.ethernet: DMA HW capability register supportedstmmaceth e0800000.ethernet: Normal descriptorslibphy: stmmac: probedSMSC LAN8710/LAN8720 stmmac-0:07: attached PHY driver [SMSC LAN8710/LAN8720] (mii_bus:phy_addr=stmmac-0:07, irq=POLL)usbcore: registered new interface driver rtl8150usbcore: registered new interface driver r8152usbcore: registered new interface driver asixusbcore: registered new interface driver ax88179_178ausbcore: registered new interface driver cdc_etherusbcore: registered new interface driver net1080usbcore: registered new interface driver cdc_subsetusbcore: registered new interface driver zaurususbcore: registered new interface driver cdc_ncmehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) DriverSPEAr-ehci: EHCI SPEAr driverspear-ehci e1800000.ehci: EHCI Host Controllerspear-ehci e1800000.ehci: new USB bus registered, assigned bus number 1spear-ehci e1800000.ehci: irq 75, io mem 0xe1800000spear-ehci e1800000.ehci: USB 2.0 started, EHCI 1.00hub 1-0:1.0: USB hub foundhub 1-0:1.0: 1 port detectedspear-ehci e2000000.ehci: EHCI Host Controllerspear-ehci e2000000.ehci: new USB bus registered, assigned bus number 2spear-ehci e2000000.ehci: irq 77, io mem 0xe2000000spear-ehci e2000000.ehci: USB 2.0 started, EHCI 1.00hub 2-0:1.0: USB hub foundhub 2-0:1.0: 1 port detectedohci_hcd: USB 1.1 'Open' Host Controller (OHCI) DriverSPEAr-ohci: OHCI SPEAr driverspear-ohci e1900000.ohci: USB Host Controllerspear-ohci e1900000.ohci: new USB bus registered, assigned bus number 3spear-ohci e1900000.ohci: irq 74, io mem 0xe1900000hub 3-0:1.0: USB hub foundhub 3-0:1.0: 1 port detectedspear-ohci e2100000.ohci: USB Host Controllerspear-ohci e2100000.ohci: new USB bus registered, assigned bus number 4spear-ohci e2100000.ohci: irq 76, io mem 0xe2100000hub 4-0:1.0: USB hub foundhub 4-0:1.0: 1 port detectedusbcore: registered new interface driver usb-storagerandom: fast init donebq32k 0-0068: rtc core: registered bq32k as rtc0i2c /dev entries driversp805-wdt fc880000.wdt: registration successfuldevice-mapper: ioctl: 4.37.0-ioctl (2017-09-20) initialised: dm-devel@redhat.comusbcore: registered new interface driver usbhidusbhid: USB HID core driverspear-adc f465c354.adc: SPEAR ADC driver loaded, IRQ 54NET: Registered protocol family 10Segment Routing with IPv6sit: IPv6, IPv4 and MPLS over IPv4 tunneling driverNET: Registered protocol family 17Key type dns_resolver registeredubi2: attaching mtd7ubi2: scanning is finishedubi2: attached mtd7 (name "user-storage", size 96 MiB)ubi2: PEB size: 131072 bytes (128 KiB), LEB size: 129024 bytesubi2: min./max. I/O unit sizes: 2048/2048, sub-page size 512ubi2: VID header offset: 512 (aligned 512), data offset: 2048ubi2: good PEBs: 768, bad PEBs: 0, corrupted PEBs: 0ubi2: user volume: 1, internal volumes: 1, max. volumes count: 128ubi2: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 942022490ubi2: available PEBs: 0, total reserved PEBs: 768, PEBs reserved for bad PEB handling: 40ubi2: background thread "ubi_bgt2d" started, PID 629ubi1: attaching mtd5ubi1: scanning is finishedubi1: attached mtd5 (name "system-storage", size 16 MiB)ubi1: PEB size: 131072 bytes (128 KiB), LEB size: 129024 bytesubi1: min./max. I/O unit sizes: 2048/2048, sub-page size 512ubi1: VID header offset: 512 (aligned 512), data offset: 2048ubi1: good PEBs: 128, bad PEBs: 0, corrupted PEBs: 0ubi1: user volume: 1, internal volumes: 1, max. volumes count: 128ubi1: max/mean erase counter: 3/0, WL threshold: 4096, image sequence number: 1442190306ubi1: available PEBs: 0, total reserved PEBs: 128, PEBs reserved for bad PEB handling: 40ubi1: background thread "ubi_bgt1d" started, PID 634ubi0: attaching mtd6ubi0: scanning is finishedubi0: attached mtd6 (name "rootfs", size 144 MiB)ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 129024 bytesubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 512ubi0: VID header offset: 512 (aligned 512), data offset: 2048ubi0: good PEBs: 1152, bad PEBs: 0, corrupted PEBs: 0ubi0: user volume: 4, internal volumes: 1, max. volumes count: 128ubi0: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 1033334404ubi0: available PEBs: 0, total reserved PEBs: 1152, PEBs reserved for bad PEB handling: 40ubi0: background thread "ubi_bgt0d" started, PID 642block ubiblock0_0: created from ubi0:0(rootfs)bq32k 0-0068: setting system clock to 2024-01-10 01:00:01 UTC (1704848401)uart-pl011 d0000000.serial: no DMA platform dataVFS: Mounted root (squashfs filesystem) readonly on device 253:0.devtmpfs: mountedFreeing unused kernel memory: 180KThis architecture does not have kernel memory protection.in /sbin/preinitpreinit - looking in /sbin/preinit.dpreinit - /sbin/preinit.d/90-overlay-etcpreinit - prepare and boot overlay /etcUBIFS (ubi2:0): background thread "ubifs_bgt2_0" started, PID 650UBIFS (ubi2:0): recovery neededUBIFS (ubi2:0): recovery completedUBIFS (ubi2:0): UBIFS: mounted UBI device 2, volume 0, name "user-storage"UBIFS (ubi2:0): LEB size: 129024 bytes (126 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytesUBIFS (ubi2:0): FS size: 91994112 bytes (87 MiB, 713 LEBs), journal size 4644864 bytes (4 MiB, 36 LEBs)UBIFS (ubi2:0): reserved for root: 4345108 bytes (4243 KiB)UBIFS (ubi2:0): media format: w5/r0 (latest is w5/r0), UUID D1C436AD7-DC43-2FAC-5FDE-8609529CEA34, small LPT modelpreinit - mount -t ubifs -o sync ubi2:user-storage /firmware/userpreinit - Success mounting overlay-etc for /etc on /firmware/user/etc-rwpreinit - /sbin/preinit.d/91-overlay-var-libpreinit - prepare and boot overlay /var/libUBIFS (ubi1:0): background thread "ubifs_bgt1_0" started, PID 654UBIFS (ubi1:0): recovery neededUBIFS (ubi1:0): recovery completedUBIFS (ubi1:0): UBIFS: mounted UBI device 1, volume 0, name "system-storage"UBIFS (ubi1:0): LEB size: 129024 bytes (126 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytesUBIFS (ubi1:0): FS size: 9547776 bytes (9 MiB, 74 LEBs), journal size 1032193 bytes (0 MiB, 6 LEBs)UBIFS (ubi1:0): reserved for root: 450964 bytes (440 KiB)UBIFS (ubi1:0): media format: w5/r0 (latest is w5/r0), UUID A56ADC46-9AD2-8734-09D3-D3DFD7D18420, small LPT modelpreinit - mount -t ubifs -o sync ubi1:system-storage /usr/localpreinit - Success mounting overlay-/var/lib for /var/lib on /usr/local/var/lib-rwpreinit - /sbin/preinit.d/98-check-mounts-panicpreinit - checks mounts and panic if not all thereUBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 658UBIFS (ubi0:1): recovery neededUBIFS (ubi0:1): recovery completedUBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "firmware-bin"UBIFS (ubi0:1): LEB size: 129024 bytes (126 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytesUBIFS (ubi0:1): FS size: 32385024 bytes (30 MiB, 251 LEBs), journal size 1677312 bytes (1 MiB, 13 LEBs)UBIFS (ubi0:1): reserved for root: 1529624 bytes (1493 KiB)UBIFS (ubi0:1): media format: w5/r0 (latest is w5/r0), UUID 36D39C56-0956-537A-9A80-384D350936528, small LPT modelpreinit - mount -t ubifs -o sync ubi0:firmware-bin /firmware/binUBIFS (ubi0:2): background thread "ubifs_bgt0_2" started, PID 661UBIFS (ubi0:2): recovery neededUBIFS (ubi0:2): recovery completedUBIFS (ubi0:2): UBIFS: mounted UBI device 0, volume 2, name "firmware-data"UBIFS (ubi0:2): LEB size: 129024 bytes (126 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytesUBIFS (ubi0:2): FS size: 7225344 bytes (6 MiB, 56 LEBs), journal size 1032193 bytes (0 MiB, 6 LEBs)UBIFS (ubi0:2): reserved for root: 341270 bytes (333 KiB)UBIFS (ubi0:2): media format: w5/r0 (latest is w5/r0), UUID DFA5DE68-4A4D-29F3-67CA-5A6D7CA1FD09, small LPT modelpreinit - mount -t ubifs -o sync ubi0:firmware-data /firmware/datasystemd: systemd 239 running in system mode. (+PAM -AUDIT -SELINUX -IMA -APPARMOR +SMACK +SYSVINIT +UTMP -LIBCRYPTSETUP -GCRYPT -GNUTLS +ACL -XZ -LZ4 -SECCOMP +BLKID -ELFUTILS +KMOD -IDN2 -IDN -PCRE2 default-hierarchy=hybrid)systemd: Detected architecture arm.Welcome to The Keysight tlo 2.6-1.40.0!systemd: Set hostname to <k-ex1052a-31549>.systemd: File /lib/systemd/system/systemd-journald.service:36 configures an IP firewall (IPAddressDeny=any), but the local system does not support BPF/cgroup based firewalling.systemd: Proceeding WITHOUT firewalling in effect! (This warning is only shown for the first loaded unit using IP firewalling.)random: systemd: uninitialized urandom read (16 bytes read)systemd: Listening on udev Kernel Socket.[ OK ] Listening on udev Kernel Socket.random: systemd: uninitialized urandom read (16 bytes read)systemd: Listening on Journal Socket.[ OK ] Listening on Journal Socket.random: systemd: uninitialized urandom read (16 bytes read)systemd: Mounting POSIX Message Queue File System...Mounting POSIX Message Queue File System...systemd: Listening on Network Service Netlink Socket.[ OK ] Listening on Network Service Netlink Socket.systemd: Starting Remount Root and Kernel File Systems...Starting Remount Root and Kernel File Systems...Starting Create list of required st…ce nodes for the current kernel...[ OK ] Created slice system-serial\x2dgetty.slice.[ OK ] Listening on Journal Socket (/dev/log).[ OK ] Reached target Swap.[ OK ] Created slice User and Session Slice.[ OK ] Reached target Slices.[ OK ] Listening on udev Control Socket.Mounting Kernel Debug File System...[ OK ] Listening on Syslog Socket.[ OK ] Started Dispatch Password Requests to Console Directory Watch.[ OK ] Started baldwin-splash startup service , start ASAP.Starting udev Coldplug all Devices...Starting Journal Service...[ OK ] Started Forward Password Requests to Wall Directory Watch.Starting Load Kernel Modules...[ OK ] Listening on initctl Compatibility Named Pipe.[ OK ] Created slice system-getty.slice.[ OK ] Reached target Remote File Systems.[ OK ] Mounted POSIX Message Queue File System.[ OK ] Started Remount Root and Kernel File Systems.[ OK ] Started Create list of required sta…vice nodes for the current kernel.[ OK ] Mounted Kernel Debug File System.Starting Create Static Device Nodes in /dev...fuse init (API version 7.26)[ OK ] Started Load Kernel Modules.Mounting Kernel Configuration File System...Starting Apply Kernel Variables...Mounting FUSE Control File System...[ OK ] Mounted Kernel Configuration File System.[ OK ] Mounted FUSE Control File System.[ OK ] Started Create Static Device Nodes in /dev.[ OK ] Reached target Local File Systems (Pre).Mounting /var/volatile...systemd: Starting udev Kernel Device Manager...Starting udev Kernel Device Manager...systemd: Mounted /var/volatile.[ OK ] Mounted /var/volatile.systemd: Starting Bind mount volatile /var/cache...Starting Bind mount volatile /var/cache...systemd: Starting Load/Save Random Seed...Starting Load/Save Random Seed...systemd: Starting Bind mount volatile /var/spool...Starting Bind mount volatile /var/spool...systemd: Started Journal Service.[ OK ] Started Journal Service.[ OK ] Started Apply Kernel Variables.[ OK ] Started Load/Save Random Seed.Starting Flush Journal to Persistent Storage...systemd-journald: Received request to flush runtime journal from PID 1[ OK ] Started Flush Journal to Persistent Storage.overlayfs: upper fs does not support xattr.overlayfs: upper fs does not support xattr.[ OK ] Started udev Kernel Device Manager.[ OK ] Started Bind mount volatile /var/cache.[ OK ] Started Bind mount volatile /var/spool.[ OK ] Reached target Local File Systems.Starting Create Volatile Files and Directories...[ OK ] Started Create Volatile Files and Directories.Starting Update UTMP about System Boot/Shutdown...[ OK ] Started udev Coldplug all Devices.designware-udc e1100000.usbd: Device Synopsys UDC probed csr c8d74000: plug c8d76000[ OK ] Found device /dev/ttyAMA0.[ OK ] Started Update UTMP about System Boot/Shutdown.[ OK ] Reached target System Initialization.[ OK ] Listening on RPCbind Server Activation Socket.[ OK ] Listening on CUPS LPD Server Socket.[ OK ] Started CUPS Scheduler.[ OK ] Reached target Paths.[ OK ] Listening on CUPS Scheduler.[ OK ] Listening on D-Bus System Message Bus Socket.[ OK ] Reached target Sockets.[ OK ] Reached target Basic System.[ OK ] Started D-Bus System Message Bus.[ OK ] Started Kernel Logging Service.[ OK ] Started System Logging Service.Starting InfiniiVision bootapp service...Starting Login Service...Starting RPC Bind Service...--- : start ---------------------Starting palio initial usb488 as root... LaunchInfiniiVisionfile system registered[ OK ] Started RPC Bind Service.[ OK ] Started Login Service.[ OK ] Started palio initial usb488 as root.LaunchInfiniiVision: 02.12.2021071625 ()System has been running 33.24 secondsTODO: AddDebugThreadDataTODO: InitClockReleased build, Jul 16 2021, 20:56:43Initializing FPGA...************************************Ver: 1.067 Released************************************Calibration mode UserCal Date Thu Aug 12 15:38:53 2021TODO: SuspendThreadTODO: ResumeThreadStartup sequence is complete.TODO: DecryptStringFromFileSystem has been running 9.528608 secondsSystem has been running 42.75 seconds (monontonic version)Start Up Sequence 9.511000MEMORY USAGE: 25484 kBMinor Faults: 2323Major Faults: 1125Block Input Operations: 0Block Output Operations: 0Voluntary context switches: 4548Involuntary context switches: 1041-----> InfiniiVision is running <-----read descriptorsread strings[ OK ] Started InfiniiVision bootapp service.Starting Network Manager...[ OK ] Started Daily Cleanup of Temporary Directories.Starting Network Service...[ OK ] Started Run ubirepair script early Sunday morning.[ OK ] Reached target Timers.usb-device code, fix USB-device PHY glitcdesignware-udc e1100000.usbd: reg gadget driver 'configfs-gadget'h with software:1[ OK ] Started Network Service.Starting Network Name Resolution...[ OK ] Started Network Name Resolution.[ OK ] Reached target Host and Network Name Lookups.[ OK ] Started Network Manager.[ OK ] Reached target Network.Starting mdns Server...Starting Permit User Sessions...Starting php-fpm Server...[ OK ] Started Permit User Sessions.[ OK ] Started Serial Getty on ttyAMA0.[ OK ] Started Getty on tty1.[ OK ] Reached target Login Prompts.[ OK ] Started mdns Server.Starting Hostname Service...[ OK ] Started Hostname Service.Starting Network Manager Script Dispatcher Service...[ OK ] Started Network Manager Script Dispatcher Service.IPv6: ADDRCONF(NETDEV_UP): eth0: link is not readySMSC LAN8710/LAN8720 stmmac-0:07: attached PHY driver [SMSC LAN8710/LAN8720] (mii_bus:phy_addr=stmmac-0:07, irq=POLL)stmmaceth e0800000.ethernet eth0: RX IPC Checksum Offload disabledstmmaceth e0800000.ethernet eth0: No MAC Management Counters availablestmmaceth e0800000.ethernet eth0: PTP not supported by HWIPv6: ADDRCONF(NETDEV_UP): eth0: link is not readyStarting Authorization Manager...stmmaceth e0800000.ethernet eth0: Link is Up - 100Mbps/Full - flow control rx/txIPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes readyrandom: crng init donerandom: 7 urandom warning(s) missed due to ratelimitingtlo 2.6-1.40.0 k-ex1052a-31549 ttyAMA0k-ex1052a-31549 login:Interesting that EDUX is identified as a higher model DSOX1102A:QuoteAlso attached are the NOR map, Uboot environment variables, Kernel config, and a dump of the filesystem structure.

author: Bud
author_rank: Super Contributor
timestamp: February 12, 2024, 05:58:02 am
content: The 1200X scope filesystem is ridiculously convoluted. It has 3 layers as represented in the image. The base layer is the raw NAND which provide ECC error correction. The 256MiB NAND is divided to 3 partitions in U-boot with names MTD1, MTD2, MTD3. On top of each of MTD partitions is mounted UBI system which provides wear-leveling control over the NAND physical blocks marking them bad as they wear out and relocating data to reserved good blocks. UBI also provides data volume management to UBIFS file system which is the top layer in the hierarchy. UBIFS manages files and folders and relies on UBI layer for error correction and bad blocks management. Individual files can only be read/written at UBIFS level. UBI can only read/write entire Volumes, not individual files.When Linux is booted, several UBIFS volumes are mounted. The rootfs filesystem which contains the Linux OS is mounted separately not as a UBIFS volume but as a UBI block, because it is squashfs type of image which is read-only. Being read-only it is never gets re-written except during firmware updates. From liberation perspective that means a part of it can't be changed in-place, only as a whole image which then will require erasing and re-writing the entire 76MiB rootfs volume. So perhaps that may not be a good approach.The other volumes seem to be writable and are divided to store different types of system, application and user data. The Linux kernel is stored on its own volume named "boot" together with the kernel device tree. User data such as screen captures and acquisition data is stored in "user-storage" volume. "Firmware-bin" volume stores the InfiniiVision application executable and other files. Additionally, several overlays are mounted which map some of the volumes into the rootfs volume, thus making part of rootfs writable, kinda.I took a backup of the entire NAND, uploaded it to a Linux VM and mounted in a NAND simulator. The filesystem structure that resulted from that is shown in the below images. The 3 layers of the hierarchy can clearly be seen. Analysis of the filesystem structure is needed to understand the backup/restore strategy and liberation options.

author: Bud
author_rank: Super Contributor
timestamp: February 12, 2024, 06:29:05 am
content: Reserved for updates.

author: xlslope
author_rank: Newbie
timestamp: February 20, 2024, 04:36:21 pm
content: Nice work, wish you could find a way to 'update' the BW soon.

author: nctnico
author_rank: Super Contributor
timestamp: February 20, 2024, 05:05:01 pm
content: Quote from: Bud on February 12, 2024, 05:58:02 amAFAIK this image is incorrect. UBI doesn't divide the flash in seperate sections for each partition but uses the entire flash for wear levelling. The partitions are just a way to slice the flash into fixed size pieces which can be accessed as a block device.

author: Bud
author_rank: Super Contributor
timestamp: February 20, 2024, 05:45:17 pm
content: I do not think so. UBI has to attach each MTD partition (from NAND layer) individually using ubi attach command. Therefore UBI can only use NAND space available within an attached partition. And I understand you do not have to give the entire NAND to UBI, you can give some space to UBI and use rest of space for something else.

author: nctnico
author_rank: Super Contributor
timestamp: February 20, 2024, 06:05:17 pm
content: Wikipedia claims I'm right; the entire flash is used (unless you tell UBI to use a smaller part of the flash but this isn't at the partition size level). IIRC in a past project I told UBI that the flash was larger but had the partitions sized so it would fit in the smaller flash. But lo & behold, at some point the UBI wear levelling algorithm tried to access a flash sector which wasn't physically there.

author: Bud
author_rank: Super Contributor
timestamp: February 21, 2024, 04:34:16 am
content: Wiki is written by people and people tend to make errors. I never take Wiki for granted. My entire looking into UBI was a discovery that things were not documented well. For some things I had to go as deep as examine UBI source code. I will stick to my findings because of a couple things: 1- I still believe you can allocate one partition to UBI and a second partition to a different filesystem such as jffs2, which means UBI can't use the entire NAND, otherwise it will corrupt the jffs2 partition. And 2 - I have looked at the NAND dump that I downloaded and I found no data being spread out all over the NAND space, the data was perfectly sequentially written, with each partition having its respective data within the address space allocated to each individual partition. It is possible that UBI will start reallocating blocks as they become bad later, but on a brand new NAND the data blocks are sequential and is within its respective partition (just interleaved with UBI headers).It should be easy to prove one way or the other by using NAND simulator in Linux by instantiating a NAND device and creating two partitions, one allocate to UBI and second one to , say, JFFS2. Fill JFFS one with data, then UBIFS one with data, and see if UBIFS corrupted data on JFFS2 partition, which what should happen if UBI uses the entire NAND. I do not anticipate that to happen.Anyway, this is not my focus at the moment. It seems that liberating 1200X is not a question anymore, the question is how to do it in a way with minimum writes to NAND, as NAND corruption appears to be Keysight scope's specialty. This is why I wanted to understand organization of data storage, how UBI works, etc. In general, after gaining access there are so many ways that I am not even sure yet which one to use. In this regard 1200X with its Linux appears to be easier to work with than 1000X with its Windows Embedded OS. I'll post details later, just being busy at work.

author: tv84
author_rank: Super Contributor
timestamp: February 21, 2024, 10:01:22 am
content: Please share a list ofallthe files in the system.

author: Bud
author_rank: Super Contributor
timestamp: February 21, 2024, 05:30:50 pm
content: Is a Linux command that can dump file tree in a file?BTW: for rootfs just see the squashfs file in the official update package, rootfs is read only, so it is 1:1 match.

author: Veteran68
author_rank: Frequent Contributor
timestamp: February 21, 2024, 06:22:23 pm
content: Quote from: Bud on February 21, 2024, 05:30:50 pmThetreecommand is commonly used, but typically isn't installed be default especially on an embedded OS.You can always fall back onls -R >output.txt

author: tv84
author_rank: Super Contributor
timestamp: February 21, 2024, 06:35:45 pm
content: Quote from: Bud on February 21, 2024, 05:30:50 pmUse:ls -aR / > output.txt

author: nctnico
author_rank: Super Contributor
timestamp: February 21, 2024, 06:36:00 pm
content: Quote from: Bud on February 21, 2024, 04:34:16 amYou are mis-understanding what I wrote. What I wrote is that UBI takes the entire piece of NAND flash you assign to it and UBI creates virtual partitions on it if you like. Under the hood it will use the entire piece of NAND flash you assigned to it to place the data randomly into flash. So your partitions end up anywhere on the piece of NAND flash you assigned to it as wear levelling progresses. Doing this makes a lot of sense because you only need 1 pool of spare sectors for all the partitions instead of seperate pools AND you don't run the risk of running out of spare sectors for very small partitions. Ofcourse when writing data initially, it will be sequential. But try writing files repeatedly for a while and things will start to mix.

author: Bud
author_rank: Super Contributor
timestamp: February 22, 2024, 08:36:43 pm
content: Quote from: xlslope on February 20, 2024, 04:36:21 pmEDUX would require input circuit hardware update for BW. Otherwise it will only be extended time/ setting added.

author: Bud
author_rank: Super Contributor
timestamp: February 23, 2024, 05:00:17 am
content: Reply #1updated, see filesystem dump there.

author: xlslope
author_rank: Newbie
timestamp: February 23, 2024, 03:48:56 pm
content: I just checked the DSOX1200A/G BW upgrade option on Keysight site, it seems D1200BW1A/2A/3A all not required to send the scope back.I bought my DSOX1204G last year with all functions available already.(like 20MHzAWG, Blod plot, I2C/SPI/CAN Analyse....), only the BW is 70MHz upgradable.Btw, thanks to your (and the others‘) work on DSOX2000/3000X again, I just repaired and 'upgrade' 2 broken 3014A in our lab.

author: Bud
author_rank: Super Contributor
timestamp: February 23, 2024, 04:27:27 pm
content: Do you have "all" licenses though? The device datasheet only tells you what is marketed with the device. In the 1000X model other licenses were liberated, going from my memory - Advanced Math, enhanced video triggering, circular segmented memory (not just segmented memory), more serial bus types, firmware downgrade, and a few for which their purpose was not clear

author: xlslope
author_rank: Newbie
timestamp: February 25, 2024, 12:14:04 pm
content: I just check the Licences I have in DSOX1204G, EMBD/AUTO/SGM/MASK/EDK/WAVEGEN/DVM/RML,Analyze functions seems less than 3014A (like PowerSupply functions(Noise/Ripple/Efficiency/PSRR.....), but I never use them, FRA and AWG is enough for me to test the PSRR and loop)I'm not sure if its all 1204G can provide, just like you said, there may be some useful functions unpublished.

author: bestel
author_rank: Contributor
timestamp: June 21, 2024, 09:16:20 am
content: Thank you for your work!Did you manage a way to unlock the bandwidth?

author: sprit
author_rank: Regular Contributor
timestamp: October 27, 2024, 02:24:56 am
content: Hello everyone, have a nice day.I have a DSOX1204A, after tearing it down to find the UART port I found that the motherboard has some changes compared to the old version. The debug port has been removed from the new board. I have been struggling since yesterday and still can't find the location of the RX and TX ports, can anyone tell me?It seems that Keysight's move from Windows to Linux makes it harder to hack, has anyone had success with it?

author: Bud
author_rank: Super Contributor
timestamp: October 29, 2024, 12:26:22 am
content: The serial port connector (or rather pads/vias for it) is on the main board now, on the righthand side. But you won't get much out if it because of how Uboot is configured. Getting access to Uboot requires some heck of a work to be performed.No i do not have a "step by step procedure", never documented it, just letting you know.

author: ShQ
author_rank: Contributor
timestamp: October 29, 2024, 10:48:27 am
content: Out of curiosity for Keysight's Linux-based offerings, can you elaborate on the basic exploit you found?

author: Bud
author_rank: Super Contributor
timestamp: November 01, 2024, 03:32:44 am
content: No exploit. It is a feature, not a bug.It is hiding in plain view on DSOX1200. The BOOT_SEL pin K18 of Spear600 is controlled via a transistor switch from the front panel keypad. Finding the right key was a matter of disconnecting the keypad and pressing each key to find which one controls the transistor's Base line. Turned out it is the "Cursors" key.No need to disassemble the scope to get access to the UART port on the main board. Everything can be done via the USB port at the back of the scope.Connect the USB port to the computer. Hold the "Cursors" key while turning power on. The CPU will boot in USB mode (the screen will be blank) and a new serial device will pop up on the PC. From there the STM's own Flasher Utility can be used much in a same way as you did in the 2000/3000 thread.

author: candrian
author_rank: Regular Contributor
timestamp: November 01, 2024, 06:59:36 pm
content: I just tried your method on a DSOX1202 but no serial port is popping up. Nevertheless all LEDs in the front panel are lit and the screen is off which looks like to be special mode as you described.

author: Bud
author_rank: Super Contributor
timestamp: November 02, 2024, 04:29:54 am
content: You have to download the Spear600 Flashing Utility and follow instructions in the doc folder to install Spear600 driver.https://www.st.com/en/development-tools/stsw-spear009.htmlCheck the Device Manager as you go. In the end you should get a new COM port appeared there.And select that COM port in the Flashing Utility to get Uboot prompt.Be careful and do not fool around with the Flasher if you do not know what you are doing, you can brick the scope.This is only a starting point. There is more involved in backing up the NOR and changing it to get the full boot log and everything else.

author: candrian
author_rank: Regular Contributor
timestamp: November 02, 2024, 09:29:03 am
content: Ah ok I understand. I now have the USB device mounted but not the com port yet installed. In the documentation it says ". During the connect operation Flashing tool sends the DDR driver and firmware (using lib-usb) interface. These binaries are present in binaries/ folder of the package. " Will this step affect the scope? It's not clear if its going to overwrite something already working on the scope or it will write it on non persistent memory and will then be reset.

author: Bud
author_rank: Super Contributor
timestamp: November 02, 2024, 12:50:53 pm
content: Connect step does not affect the scope, it only loads the DDR driver and basic Uboot.

author: candrian
author_rank: Regular Contributor
timestamp: November 03, 2024, 08:58:06 pm
content: Thank for your information.I followed the documentation line by line. The device is recognized as I previously mentioned, I downloaded "USB flasher for SPEAR" 2.4 as the latest 3.2.5 package includes only a file system rootfs_nand_smallpage.jffs2 and not the application itself but when I click the connect button I instantly get an error message "Firmware could not be uploaded. Please restart the board and try again". The message pups up so instantly that it doesn't look to make any tries before. Is this something you came across?

author: Bud
author_rank: Super Contributor
timestamp: November 04, 2024, 02:15:53 am
content: Check the VID/PID in Device Manager and see if it matches the ones in usb_send source code main.cYou can also search the source code .C files and .TCL scripts for the error message and track what conditions causes it.P.S.: I just noticed your screenshot's Device Manager shows "libusb (WinUSB)". Mine is "libusb-Win32". Did you select the correct library in Zadig ?

author: candrian
author_rank: Regular Contributor
timestamp: November 04, 2024, 01:20:53 pm
content: Nice catch. For some reason it winusb was installed instead of lib-usb from Zadig. Now I have the com port mounted.Next step is to manage and have the full boot log and get the nand content.

author: Anthocyanina
author_rank: Frequent Contributor
timestamp: November 21, 2024, 08:30:36 pm
content: today i got curious about the 1204's insides. I haven't been able to find teardown photos of these scopes anywhere. only the 2 channel edu one. I'm curious about how they do the function generator in the 4 channel ones. could anyone share pictures of the inside of those please? thank you!

author: samsh
author_rank: Newbie
timestamp: November 22, 2024, 10:14:35 am
content: I would also be curious to see a teardown, and came up short looking for videos too, although there are some videos on here about replacing the fan in the DSOX1204g and thats as much of the inside as I have seen. I'm pretty sure the Megazoom IV can take four ADC inputs so it will probably be extremely similar (possibly the exact same seperate processor board as in the EDU models) but with more front ends. I would assume the FPGA runs the sig gen.Sorry for derailing the thread a bit, but I am looking to buy either one of these (70 MHz + upgrade to either 100 MHz or 200 MHz, new with warranty and included 1x/10x probes), or a 3000A series (200 MHz, used but in good condition, no warranty, would be using my own 10x 150 MHz probes). Not quite sure which way to go tbh. The 1204g looks cute and has a nice form factor (included probes like nice as well), but yeah, the 3000A is a lot more scope for the same price. You guys seem quite fond of the little black scope, and Dave seems to use it quite a lot, so I felt this might be a good place to ask for anyones opinion. Is the DSOX1204gsubstantiallymore portable?

author: Bud
author_rank: Super Contributor
timestamp: November 22, 2024, 01:41:39 pm
content: Quote from: Anthocyanina on November 21, 2024, 08:30:36 pmI believe i saw a photo, they crammed the FG into the space on the right hand side of the board below the LAN connector.

author: samsh
author_rank: Newbie
timestamp: December 21, 2024, 03:03:45 am
content: Ended up picking up one a DSOX1204g used for a very good price (with probes). It is nice and compact and a little bit adorable in person, but the fan is pretty horrific (if you are at all sensitive to fan noise you have been warned) so I have ordered a Noctua replacement. It was either this or a 3000A for a lot more money (4x cost!), and the compactness and more recent design (no PSU issues or Flash rot) were the deciding factor (I am upgrading from an analogue Tek). It works just as well as any other Keysight unit and is as responsive and intuitive as expected; the encoders feel very nice and all click in exe.Naturally I have taken it apart, and I will note that the main processor board is the same as the other 1000x units but with a later revision number. The PSU/Fan is the exact same as is most of the metalwork, the only difference to the disassembly process from Dave's video is additional nut/fasteners on the external trigger BNC on the back of the unit, and the metalwork differs around the (mechanical) power switch. I have annotated some photos to highlight some stuff, including the function generator. Overall, the PCB is significantly denser than other units, and I have not seen anything unpopulated apart from those debug headers (but I have only looked at one side). The main PCB is marked as X1004AG, so I assume that just means 1000 series, 4 channels with a generator, and what is 'unique' about the 1200x series is just the software/black colour scheme as opposed to anything about the hardware which is evidently completely common to the 1100x models (but there was no 1104x released).In terms of hacking, obviously the 200 MHz would be nice but I think ADVMATH and to a lesser extent ARINC429 are also worthy unlock goals. I want to speculate that possibly the AFG can be unlocked. I assume the single MegaZoom is using its AFG to power the demo signals as well as the function generator - so maybe there is a path there (also the BNC is marked AWG on the PCB)? It appears that (from the hardware and interacting with the unit) the linux operating system features a complete reimplementation of the Megazoom IV capabilities. I don't think the engineers just decided not to implement the 2000x features and I would speculate that perhaps this product might have been a testbed for plans to maybe switch the G-series scopes away from windows embedded due to licensing or longevity reasons, but that plan simply never eventuated. Perhaps some tinkering with the OS will reveal some commonality with the HD3 but I doubt it, and all the newer scopes (i.e., Tek 2 series) seem to implement cryptographic keys stored in secure enclaves inside the SOCs.Let me know if there is anything you want to see from this unit specifically. I don't think I am yet brae enough to pull up the spear flashing utility but who knows. All screws are T9 except the frontend which is T6 (no solder, also the trim cap is accessible without removing the shield). No calibration or warranty void stickers are present, but you do anything at your own risk exe.

author: samsh
author_rank: Newbie
timestamp: December 21, 2024, 03:30:59 am
content: More photos

author: Bud
author_rank: Super Contributor
timestamp: December 21, 2024, 06:07:33 am
content: Quote from: samsh on December 21, 2024, 03:03:45 amI do not think ARINC429 exists in 1000X series.

author: tv84
author_rank: Super Contributor
timestamp: December 21, 2024, 12:43:43 pm
content: Quote from: samsh on December 21, 2024, 03:03:45 amI think those are only possible with patched FW, from my recollections.https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3823583/#msg3823583

author: samsh
author_rank: Newbie
timestamp: December 21, 2024, 02:16:04 pm
content: ARINC429 decoding is done within the ASIC I think (it could be on the FPGA), and it was unlocked on the 1100 series with the modified firmware perhttps://www.fercsa.com/keysight/hack_2.png,although I didn't see an explicit demonstration of it in action and I know some functions that were 'unlockable' didn't actually function correctly (power analysis stuff iirc), so perhaps it falls into that category? Interestingly I am looking at buying another scope (professionally) and some Siglent models support ARINC429 decoding but not triggering.I don't understand Fercsa's method and I am probably not technically skilled enough to crack this one myself, but as Bud said I think its when not if.

author: Bud
author_rank: Super Contributor
timestamp: December 21, 2024, 02:47:48 pm
content: Ah, it is a serial method. Then yes it should be unlocked in a liberated FW. As to being functional, the scope has training signals generation feature, which may has it.

author: analogRF
author_rank: Super Contributor
timestamp: January 16, 2025, 03:50:50 pm
content: Quote from: candrian on November 04, 2024, 01:20:53 pmwere you able to get the boot log and nand content? could you get to the linux prompt?

author: analogRF
author_rank: Super Contributor
timestamp: January 17, 2025, 09:44:43 pm
content: after a lot of work finally here is my boot log for DSOX1204Gi can get to uboot as well (the prompt is dsoP2>)but nothing else so farcan anybody guess what that login/passwd at the end of the boot could be??that will take me into linux system

author: samsh
author_rank: Newbie
timestamp: January 18, 2025, 10:46:42 am
content: Saw some activity so I thought I may as well share this.I did the fan swap on the DSOX1204g. I swapped in a Noctua NF-A6x25 FLX, and I took the included 3-pin fan to MOLEX connector (as in PC ATX power supply molex connector) and cannibalised it to turn it into a 3-pin fan to 2-pin JST 2.54mm pitch fan connector. The included Noctua isolated mounts are not compatible with the sheet metal casing (I couldn't fit them by hand, so I pulled them through with pliers and they broke) which is relatively thick when compared to a PC case.The result is an elimination of any mechanical whirring or grating noises, but there is still a lot of aerodynamic noise. The scope is the loudest instrument on my bench (including a beefy PC with lie 5 'be quiet!' branded fans and a massive air tower cooler), but its no longer actively grating or unpleasant. I had thought about trying to make some kind of standoff mod like this () but it appears that the separation of the sheet metal and the plastic case gives about 5mm of stand-off already so this is probably as good as it gets.I got this scope for an absolute bargain, but I would be very disappointed if I payed RRP and got this new from Keysight. The silence of, say, the Tek MSO24, Siglent SDS2000X HD and RTB2004 are genuine perks, and I would expect better from an 'A' brand. I suspect this is somewhat because the now 13 (or is it 15?) year old tech in the Megazoom IV is pretty inefficient and the scope exhaust actually gets quite hot. The fan also doesn't really appear to be temperature controlled but I am not sure, it looks capable of it but I have only heard one level of fan speed (before and after the mods). Perhaps I will have a better go of isolation mounting the fan and see if it improves further, although I doubt it.

author: analogRF
author_rank: Super Contributor
timestamp: January 29, 2025, 06:16:25 pm
content: has anyone ever tried to JTAG the BLT module in 1204A/G or in 1000X models?I have done the mod by cutting the ground trace and connecting the 10k resistors on TEST_0 and TEST_1 pins to 3.3V (pulled up) to enable the jtaginterface as per instruction in 1000X thread and soldered all the JTAG pins to a connector and on to Segger J-LINK.however I cannot connect to the cores. The software keeps saying cannot halt the CPU. I cannot even hard reset the CPU in the J-LINK commander. At least hard reset should work, no? There is a SRST pin among the debug pins which I assumed it was system reset so I connnected that to the nRESET pin of J-LINK.or maybe 10k pull up is too weak?one thing I notice is that the scope boots normally and works normally. I think someone had said the scope should not boot from NOR after doing the JTG mod.am I right?