About to throw DSO-X 3000 OUT OF WINDOW! - Page 1
Forum section: electronics / testgear

author: Hugoneus
author_rank: Frequent Contributor
timestamp: October 06, 2017, 08:15:49 pm
content: Hi everyone,I have a DSO-X 3034A which no longer boots. It has corrupt flash memory. I hooked up a USB-to-RS232 to the internal serial port and I can see it booting partially but then it stops because it detects corrupted firmware.I know that there are ways to make it boot from USB. There is a long thread about how to hack them. Sadly I can't download WinCE CAB Manager anymore because I can't find it online.Can anyone help me boot this damn instrument from USB or tell me how I can correct the boot issue? I know many of you know details of this because you have successfully hacked them.Thank you,

author: trevwhite
author_rank: Frequent Contributor
timestamp: October 06, 2017, 08:21:02 pm
content: When my stock DSO-X3024a stopped booting it was corrupted NAND memory. Had to send it back for repair.I think they replaced the main board

author: Hugoneus
author_rank: Frequent Contributor
timestamp: October 06, 2017, 08:28:31 pm
content: Quote from: trevwhite on October 06, 2017, 08:21:02 pmYes, but I am sure it can be booted from USB. Because the UBoot portion is still working.If someone can post a USB image of what works, it should work on this scope.

author: TK
author_rank: Super Contributor
timestamp: October 06, 2017, 08:38:09 pm
content: You can throw it all the way to Western Pennsylvania...I sent mine (out of warranty) too to Keysight last week, it was repaired for free (replaced acquisition board... I think it is the whole board), recalibrated for free and "upgraded" to Keysight (it was an Agilent unit before, they replaced the front label). I will post the full process if you need...It was repaired for free covered under: Factory Warranty per Service Note: MSOX3024A-05A

author: trevwhite
author_rank: Frequent Contributor
timestamp: October 06, 2017, 08:39:34 pm
content: Pm me email address.Sent from my SM-G950F using Tapatalk

author: TK
author_rank: Super Contributor
timestamp: October 06, 2017, 08:41:00 pm
content: Quote from: Hugoneus on October 06, 2017, 08:15:49 pmI used makecab to make an install image for my DSOX1000. I think it is standard on Windows 7, 10, etc.

author: TK
author_rank: Super Contributor
timestamp: October 06, 2017, 09:02:20 pm
content: Quote from: Hugoneus on October 06, 2017, 08:28:31 pmThe scope serial number and factory calibration information is stored on the NAND flash, so I think only Keysight can repair and reprogram a bricked scope due to NAND flash corruption.

author: Hugoneus
author_rank: Frequent Contributor
timestamp: October 06, 2017, 09:04:58 pm
content: Thank you all,But the problem is also with timing. I need to get this working right away...If anyone has the USB image which can be used to boot directly from USB, please share it with me. And if you know a way to restore the flash memory that would be great. I have access to the internal serial port and can see the boot sequence. I can even halt it and enter manual commands.

author: edpalmer42
author_rank: Super Contributor
timestamp: October 06, 2017, 09:28:56 pm
content: Are you talking about the shareware WinCE Cab Manager from OCPSoftware? If so, that's available from the Wayback Machine.Ed

author: marshallh
author_rank: Unknown
timestamp: October 07, 2017, 02:00:00 am
content: Here is WinCE cab manager: (shareware)http://www.filedropper.com/cecabmgrsetup

author: TheSteve
author_rank: Unknown
timestamp: October 07, 2017, 02:11:06 am
content: Quote from: TK on October 06, 2017, 09:02:20 pmSerial # etc are stored on a separate partition, they should be fine.I think to bring it back to life you'll need a network card to grab a boot file via ftp.

author: TK
author_rank: Super Contributor
timestamp: October 07, 2017, 03:02:10 am
content: I have not tried booting from USB, but this is the information I gathered:The tools needed to unzip the cab file correctly without using WINCECAB:https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1035636/#msg1035636To create the package again, use makecab.exe in windows.I think you need firmware 2.35 to boot from USB. Later versions disabled this option:https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg642279/#msg642279Firmware 2.35 image: EDITED: read next post

author: TK
author_rank: Super Contributor
timestamp: October 07, 2017, 03:06:18 am
content: Post with links to download old firmware:https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1184098/#msg1184098

author: TK
author_rank: Super Contributor
timestamp: October 07, 2017, 03:21:46 am
content: If you have a LAN card, maybe you can try this network firmware loading method by PA0PBZ:https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022267/#msg1022267

author: TheSteve
author_rank: Unknown
timestamp: October 07, 2017, 03:32:20 am
content: With the version 2.35 images that boot from USB they weren't booted directly from UBOOT. The image on the internal flash is booted from UBOOT. If that image saw the image on the USB drive it would then execute the files from USB. So any images that were made in the past to boot from USB seem very unlikely to boot directly from UBOOT.The only solution I can see having a chance at working is the network loading method described by PA0PBZ.edit - I assume you're not getting rid of the scope but should it get to that point please consider sending it to me to try to recovery. I've been trying to buy a scope with a corrupted flash so I can write a recovery howto but I always get outbid on them. We can always sell it afterwards or I"ll return it etc.

author: alanambrose
author_rank: Frequent Contributor
timestamp: October 07, 2017, 03:55:28 pm
content: Yeah, my experience (in the UK) is that Keysight will fix this problem for free, it'll take about a week, and the scope will come back with a new cal cert.Can't argue with that, thanks Keysight, but I have not been able to find out yet whether this is 'fixed for good' or 'fixed for a while'.A.

author: Jwalling
author_rank: Unknown
timestamp: October 07, 2017, 04:44:52 pm
content: Quote from: TK on October 06, 2017, 08:38:09 pmMSOX3024A-05A? I can't seem to find that.It used to be easy to find service notes / service bulletins on Keysight's website when it was Agilent, yet not anymore. Where are they located these days? I think the DSOX2000 series has the same damn problem with corrupt firmware. It would be nice if they could post a USB image and information that would help end users recover their corrupted scopes.

author: Neganur
author_rank: Unknown
timestamp: October 07, 2017, 06:35:32 pm
content: http://literature.cdn.keysight.com/litweb/pdf/DSOX2002A-05.pdfhad to google it....couldn't find it in the infoline nor their websiteEdit: actually no, this is about firmware updating after corruption. heh.

author: Jwalling
author_rank: Unknown
timestamp: October 07, 2017, 07:21:00 pm
content: Quote from: Neganur on October 07, 2017, 06:35:32 pmMaybe Daniel can release MSOX3024A-05A for public consumption?

author: Hugoneus
author_rank: Frequent Contributor
timestamp: October 07, 2017, 08:27:37 pm
content: Thank you all.As some of you have correctly pointed out, whether I can repair the instrument through USB depends a lot on when the corrupted issue happens. It turns out that the unit does not get into a situation where I am able to boot from USB.Unfortunately I do not have the Ethernet option to attempt a load from FTP.Any ideas?

author: Dubbie
author_rank: Unknown
timestamp: October 07, 2017, 09:28:00 pm
content: Can you borrow an Ethernet module from another scope?

author: Hugoneus
author_rank: Frequent Contributor
timestamp: October 07, 2017, 09:30:33 pm
content: Quote from: Dubbie on October 07, 2017, 09:28:00 pmThere were two scopes, neither have Ethernet. I fixed one with USB boot, because it still reached a point to check USB image. The other one fails earlier in the boot sequence.

author: TheSteve
author_rank: Unknown
timestamp: October 07, 2017, 09:54:57 pm
content: The network interface is really nothing more then a magjack - wire one in.

author: TK
author_rank: Super Contributor
timestamp: October 07, 2017, 09:59:30 pm
content: Here is one design with schematics that you can use to wire the magjack.https://github.com/aewallin/DSOXLAN

author: Hugoneus
author_rank: Frequent Contributor
timestamp: October 08, 2017, 01:59:23 am
content: Quote from: TK on October 07, 2017, 03:06:18 amThese seem to be for the 2000 series...

author: TheSteve
author_rank: Unknown
timestamp: October 08, 2017, 02:53:25 am
content: Quote from: Hugoneus on October 08, 2017, 01:59:23 am2000a and 3000a series use the same firmware - so you can safely use it.

author: Hugoneus
author_rank: Frequent Contributor
timestamp: October 08, 2017, 04:57:34 am
content: Quote from: TheSteve on October 08, 2017, 02:53:25 amInteresting. My DSO doesn't allow me to downgrade to an earlier version. Is there a trick to it?

author: TheSteve
author_rank: Unknown
timestamp: October 08, 2017, 05:29:34 am
content: Quote from: Hugoneus on October 08, 2017, 04:57:34 amDepends what version you're on. They blocked downgrades to version 2.35 but there are some limited downgrade tricks. I generally recommend the newest firmware as it seems to mostly solve the flash corruption issue.

author: Hugoneus
author_rank: Frequent Contributor
timestamp: October 08, 2017, 04:01:27 pm
content: This is all very interesting. Thank you everyone.If anyone knows a trick to down-grade to 2.35 please let me know.Thank you.

author: TK
author_rank: Super Contributor
timestamp: October 08, 2017, 04:02:49 pm
content: Quote from: Hugoneus on October 08, 2017, 04:01:27 pmWhy do you need to downgrade to 2.35? You don't need USB boot to hack the scope.

author: Hugoneus
author_rank: Frequent Contributor
timestamp: October 08, 2017, 04:06:42 pm
content: Quote from: TK on October 08, 2017, 04:02:49 pmSomeone was nice enough to send me a USB boot which enables all the options. Unfortunately after I updated the instrument to 2.42 (to fix all the FLASH problems), it no longer will boot from USB with the hacked firmware. The USB boot is version 2.35.

author: TiN
author_rank: Super Contributor
timestamp: October 08, 2017, 04:28:31 pm
content: HugoneusSomebody uploaded 3000X cab's including 2.37 toFTPif that have any help. I have no KS scopes to try anything.

author: Hugoneus
author_rank: Frequent Contributor
timestamp: October 08, 2017, 04:34:10 pm
content: Quote from: TiN on October 08, 2017, 04:28:31 pmI don't think that would help. Because the scope won't allow down-grading from 2.4x to below anymore. Looks like hacking is only possible through the LAN...

author: TK
author_rank: Super Contributor
timestamp: October 08, 2017, 04:38:55 pm
content: It is still possible to hack with 2.42 without LAN... I will find the information and update this postEDIT: here is the post. It works with 2.42.https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg989285/?topicseen#msg989285

author: Hugoneus
author_rank: Frequent Contributor
timestamp: October 08, 2017, 04:40:37 pm
content: Quote from: TK on October 08, 2017, 04:38:55 pmThank you. At the moment the OS gives an error when I try. If you know a solid way which works that would be very interesting.

author: G33KatWork
author_rank: Contributor
timestamp: October 08, 2017, 09:00:48 pm
content: Just some tips to maybe fix the one that's still broken:If you have access to the u-boot shell, you can try to find out how it loads stuff from the flash and then load it from USB instead by entering the commands directly on the prompt.That of course only works if the u-boot has enabled the USB support and you manage to get a working kernel, rootfs etc. on the USB stickEnter printenv and look at the bootcmd. That's what's executed by default. From there try to figure out how stuff is loaded.To boot from USB you need to load the kernel from USB and somehow tell it to use the USB stick as the root filesystem. I don't know how to do that with Windows CE unfortunately and how that boots at all.You can also write the flash from the u-boot shell. You load something from an external storage device like USB into RAM and then use the appropriate commands to write that stuff to the flash.If you manage to get the right partitions from a working scope by fixing the other one, that could work. Just make sure you have a backup of the flash and don't touch the u-boot and caldata.It's a lot of tinkering and it very much depends on what is available in the u-boot, what condition the flash itself is in. Is only the filesystem damaged, or maybe the flash chip itself etc.I also only have experience booting Linux with u-boot. I never touched Windows CE

author: Safar
author_rank: Regular Contributor
timestamp: October 20, 2017, 08:16:30 pm
content: When I tried to flash DSOX3000 via U-Boot I was able did it only via TFTP flash utility, and USB did not success for meAnd if I remember when I tried stop loading by space key in term it was two different menus U-Boot and something else. It depends of moment of stop.

author: Hugoneus
author_rank: Frequent Contributor
timestamp: October 20, 2017, 08:23:45 pm
content: Thanks, I will try.

author: bfsy
author_rank: Newbie
timestamp: February 09, 2018, 08:28:05 am
content: Quote from: Hugoneus on October 06, 2017, 08:15:49 pmI use a RS232 to TTL module.Only 3 lines : RX TX GND ?How to set the RS232 on PC ?Baud rate 9600Data bits 8Parity NoneStop bits 1XON/XOFF