Author Topic: EEVblog #978 - Keysight 1000X Hacking  (Read 423089 times)

0 Members and 3 Guests are viewing this topic.

Offline mtdoc

  • Super Contributor
  • ***
  • Posts: 3575
  • Country: us
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #125 on: March 11, 2017, 08:49:48 pm »
This scope, it's distribution to various video bloggers and it's quickly uncovered hackability is clearly a direct response to the success of the Rigol DS series.

It looks like a consumer grade hackable scope race is on!

My guess is the next generation of Chinese branded scopes offers better specs, is also widely distributed to bloggers and wink, wink, nod - is easily hacked.
 
The following users thanked this post: Koen

Offline Jay_Diddy_B

  • Super Contributor
  • ***
  • Posts: 2731
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #126 on: March 11, 2017, 08:56:38 pm »
This scope, it's distribution to various video bloggers and it's quickly uncovered hackability is clearly a direct response to the success of the Rigol DS series.

It looks like a consumer grade hackable scope race is on!

My guess is the next generation of Chinese branded scopes offers better specs, is also widely distributed to bloggers and wink, wink, nod - is easily hacked.

It is a great success in terms of how much interest it has generated. In some ways I think Keysight has won.
You can do some upgrades by hacking such as bandwidth and memory depth, but the really useful stuff like the Wavegen is still locked by the absent hardware. The serial decode SPI, CAN, I2C would be useful, but this has not been hacked (yet).

Regards,

Jay_Diddy_B
 

Offline RossS

  • Contributor
  • Posts: 25
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #127 on: March 11, 2017, 09:21:01 pm »
It is really academic, because such a large part of the hardware is missing, but can you access the FRA or the Bode function?

Yup, FRA "works". (It gives an error about voltage overload on the gen out bnc.)

You can plug in a USB keyboard for text entry. I wonder if there are key aliases for the front-panel buttons.

Looks like there are some key combinations (control-a for analyze, control-l for label, etc.), though I didn't find anything mapped to the wavegen function.
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #128 on: March 11, 2017, 09:23:51 pm »
You can plug in a USB keyboard for text entry. I wonder if there are key aliases for the front-panel buttons.

Any luck with a USB to network adapter? I've been pondering if they happened to support one since it first came out. If it does support one I imagine it may be one specific model though.
Not the one I tried.  As AFAIK there is no "generic" USB-ethernet adapter, it would have to be something that is explicitly supported by the build of WinCE, and would also need to be supported by the Keysight application.
Seems unlikely, and not hugely useful. The only thing I've ever used network connectivity for on any scope is pulling screen images without having to plug in a USB stick

It does have SCPI support over USB, so that would cover a lot of use cases.

Network could mean telnet access like the X2000/X3000 series - which to this point has been the key to "enabling" software licenses.
VE7FM
 

Online mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 13695
  • Country: gb
    • Mike's Electric Stuff
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #129 on: March 11, 2017, 09:46:13 pm »
You can plug in a USB keyboard for text entry. I wonder if there are key aliases for the front-panel buttons.

Any luck with a USB to network adapter? I've been pondering if they happened to support one since it first came out. If it does support one I imagine it may be one specific model though.
Not the one I tried.  As AFAIK there is no "generic" USB-ethernet adapter, it would have to be something that is explicitly supported by the build of WinCE, and would also need to be supported by the Keysight application.
Seems unlikely, and not hugely useful. The only thing I've ever used network connectivity for on any scope is pulling screen images without having to plug in a USB stick

It does have SCPI support over USB, so that would cover a lot of use cases.

Network could mean telnet access like the X2000/X3000 series - which to this point has been the key to "enabling" software licenses.
I wonder if the WinCE build includes RNDIS support.  ;)
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Online mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 13695
  • Country: gb
    • Mike's Electric Stuff
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #130 on: March 11, 2017, 09:50:10 pm »
My guess is the next generation of Chinese branded scopes offers better specs, is also widely distributed to bloggers and wink, wink, nod - is easily hacked.
I doubt the Chinese are that smart. They're still rubbing numbers off chips FFS  :-DD
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #131 on: March 11, 2017, 10:24:31 pm »
Well, even so, "just" with the already-confirmed(?) hacks, you can turn a 600$-ish 50MHz educational-wavegen one into a 1000$-ish >200MHz fully-fledged one... Which isn't too shabby in itself, imho.

Well, that is, assuming the issue Mike pointed out in his video from today, gets taken care of in the near future, of course  :-+

I'm getting very tempted  :scared:

PS: What're the odds this has the same front-end as the DSOX2000 series? That might sort of explain the >200MHz capability, methinks...

The DSOX1000 series has a much "lower buck" front end then the X2000/X3000 series. Both the X2000/X3000 series have a front end processor capable of 1 GHz(actually should be 1.5 GHz).
VE7FM
 

Offline KhronX

  • Frequent Contributor
  • **
  • Posts: 341
  • Country: fi
    • Khron's Cave - Electronics Blog
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #132 on: March 11, 2017, 10:38:12 pm »
I meant the analog front-end, not the ADC :)

At least Farnell "only" have 70 / 100 / 200MHz 2000X-series scopes, hence my hunch.

Well, even so, "just" with the already-confirmed(?) hacks, you can turn a 600$-ish 50MHz educational-wavegen one into a 1000$-ish >200MHz fully-fledged one... Which isn't too shabby in itself, imho.

Well, that is, assuming the issue Mike pointed out in his video from today, gets taken care of in the near future, of course  :-+

I'm getting very tempted  :scared:

PS: What're the odds this has the same front-end as the DSOX2000 series? That might sort of explain the >200MHz capability, methinks...

The DSOX1000 series has a much "lower buck" front end then the X2000/X3000 series. Both the X2000/X3000 series have a front end processor capable of 1 GHz(actually should be 1.5 GHz).
Khron's Cave - Electronics - Audio - Teardowns - Mods - Repairs - Projects - Music - Rants - Shenanigans
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #133 on: March 11, 2017, 10:56:44 pm »
I am talking about the analog front end and not the ADC. The 2000/3000 series use a custom ASIC in the analog front end that is not present in the 1000X series. The 2000X series is limited to 200 MHz but that simply a choice Keysight has made.

I meant the analog front-end, not the ADC :)

At least Farnell "only" have 70 / 100 / 200MHz 2000X-series scopes, hence my hunch.

Well, even so, "just" with the already-confirmed(?) hacks, you can turn a 600$-ish 50MHz educational-wavegen one into a 1000$-ish >200MHz fully-fledged one... Which isn't too shabby in itself, imho.

Well, that is, assuming the issue Mike pointed out in his video from today, gets taken care of in the near future, of course  :-+

I'm getting very tempted  :scared:

PS: What're the odds this has the same front-end as the DSOX2000 series? That might sort of explain the >200MHz capability, methinks...

The DSOX1000 series has a much "lower buck" front end then the X2000/X3000 series. Both the X2000/X3000 series have a front end processor capable of 1 GHz(actually should be 1.5 GHz).
VE7FM
 

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2845
  • Country: nz
  • D Size Cell
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #134 on: March 11, 2017, 11:06:40 pm »
So given where this is going would you even bother going and buying a Rigol now?
On a quest to find increasingly complicated ways to blink things
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #135 on: March 11, 2017, 11:13:30 pm »
So given where this is going would you even bother going and buying a Rigol now?

There are several other new scopes coming it seems, so waiting a little might make sense. Also the 1000X series doesn't have the software licenses hacked and I doubt that will happen anytime soon. For many people the DS1054Z may still be tough to beat - unless they prefer to see a higher end brand name on the bench(and who doesn't?).
VE7FM
 

Online mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 13695
  • Country: gb
    • Mike's Electric Stuff
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #136 on: March 11, 2017, 11:20:35 pm »
- unless they prefer to see a higher end brand name on the bench(and who doesn't?).
..and a nice, responsive UI, proven firmware, support etc. etc....
Price isn't everything - some people just like to have nice things
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline comeau

  • Contributor
  • Posts: 13
  • Country: us
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #137 on: March 11, 2017, 11:25:36 pm »
For the record, I love how they were nice enough to give Dave a bunch of free scopes and he repaid them by hacking the crap out of it on YouTube like a week later.
 

Offline mtdoc

  • Super Contributor
  • ***
  • Posts: 3575
  • Country: us
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #138 on: March 11, 2017, 11:41:55 pm »
For the record, I love how they were nice enough to give Dave a bunch of free scopes and he repaid them by hacking the crap out of it on YouTube like a week later.

I've no doubt that Dave had tacit permission from Keysight to do this. In fact I wouldn't be surprised if they encouraged it.
 
The following users thanked this post: Someone

Offline Villain

  • Regular Contributor
  • *
  • Posts: 71
  • Country: de
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #139 on: March 11, 2017, 11:45:51 pm »
Dave stated under the youtube video that keysight did not give him permission to hack the scope, neither did they know he would do it.
 

Offline mtdoc

  • Super Contributor
  • ***
  • Posts: 3575
  • Country: us
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #140 on: March 11, 2017, 11:54:27 pm »
Dave stated under the youtube video that keysight did not give him permission to hack the scope, neither did they know he would do it.

Of course he did.  He's no fool and I'm sure the lawyers wouldn't have it any other way. That is why I said TACIT approval.

See post #6 in this thread from Daniel from Keysight and read between the lines...
 
The following users thanked this post: Someone

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2845
  • Country: nz
  • D Size Cell
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #141 on: March 12, 2017, 01:46:07 am »
For the record, I love how they were nice enough to give Dave a bunch of free scopes and he repaid them by hacking the crap out of it on YouTube like a week later.

I've no doubt that Dave had tacit permission from Keysight to do this. In fact I wouldn't be surprised if they encouraged it.

Or even provided some hints on how to get started.  Dave?  Care to comment
On a quest to find increasingly complicated ways to blink things
 

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2845
  • Country: nz
  • D Size Cell
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #142 on: March 12, 2017, 01:47:23 am »
So given where this is going would you even bother going and buying a Rigol now?

There are several other new scopes coming it seems, so waiting a little might make sense. Also the 1000X series doesn't have the software licenses hacked and I doubt that will happen anytime soon. For many people the DS1054Z may still be tough to beat - unless they prefer to see a higher end brand name on the bench(and who doesn't?).

What 'software' licences are you talking about specifically?
On a quest to find increasingly complicated ways to blink things
 

Offline KhronX

  • Frequent Contributor
  • **
  • Posts: 341
  • Country: fi
    • Khron's Cave - Electronics Blog
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #143 on: March 12, 2017, 02:01:40 am »
The serial decode options - that's pretty much all that's left.
Khron's Cave - Electronics - Audio - Teardowns - Mods - Repairs - Projects - Music - Rants - Shenanigans
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #144 on: March 12, 2017, 02:51:46 am »
So given where this is going would you even bother going and buying a Rigol now?

There are several other new scopes coming it seems, so waiting a little might make sense. Also the 1000X series doesn't have the software licenses hacked and I doubt that will happen anytime soon. For many people the DS1054Z may still be tough to beat - unless they prefer to see a higher end brand name on the bench(and who doesn't?).

What 'software' licences are you talking about specifically?

DSOX1EMBD which is I2C, SPI, UART
DSOX1AUTO which is CAN/LIN

EDUX1EMBD which is I2C, UART for EDU models.

There are also software bandwidth upgrades(so far only to 100 MHz that we know of) which could mean easier upgrades without having to open the case of the scope.

Keysight can also easily disable any/all 200 MHz performance in firmware in the future if they want no matter the jumper settings.
VE7FM
 

Offline Brumby

  • Supporter
  • ****
  • Posts: 12288
  • Country: au
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #145 on: March 12, 2017, 03:52:22 am »
For the record, I love how they were nice enough to give Dave a bunch of free scopes and he repaid them by hacking the crap out of it on YouTube like a week later.

I've no doubt that Dave had tacit permission from Keysight to do this. In fact I wouldn't be surprised if they encouraged it.

Or even provided some hints on how to get started.  Dave?  Care to comment

IF this were even remotely true, I would not expect Dave to make any comment - and if he did, I can't see him offering anything other than denial.


As for Daniel's comment, he simply indicated that whatever a person does with their own scope is up to them.  After all, what they do in their own lab would be impossible to police.

Their legal department would start taking an active interest if someone was trying to sell hacked scopes.  I would think that is pretty obvious - as this would directly impact Keysight's sales.
« Last Edit: March 12, 2017, 03:54:35 am by Brumby »
 

Offline hauptbr09

  • Contributor
  • Posts: 12
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #146 on: March 12, 2017, 04:05:33 am »
For the record, I love how they were nice enough to give Dave a bunch of free scopes and he repaid them by hacking the crap out of it on YouTube like a week later.

I've no doubt that Dave had tacit permission from Keysight to do this. In fact I wouldn't be surprised if they encouraged it.

Or even provided some hints on how to get started.  Dave?  Care to comment

IF this were even remotely true, I would not expect Dave to make any comment - and if he did, I can't see him offering anything other than denial.


As for Daniel's comment, he simply indicated that whatever a person does with their own scope is up to them.  After all, what they do in their own lab would be impossible to police.

Their legal department would start taking an active interest if someone was trying to sell hacked scopes.  I would think that is pretty obvious - as this would directly impact Keysight's sales.
Yes, this would be the case. Legally speaking, it is your property. Legal from Keysight would nail anyone redistributing scopes that were hacked, the same as they would nail anyone selling knockoffs rebranded as Keysight.

Sent from my SM-G935V using Tapatalk

 
The following users thanked this post: mrpackethead

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2845
  • Country: nz
  • D Size Cell
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #147 on: March 12, 2017, 05:16:16 am »
The serial decode options - that's pretty much all that's left.

Which is of not a lot of interest to me. Thats so easy to do with a Logic Analyser and a PC.. 
On a quest to find increasingly complicated ways to blink things
 

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2845
  • Country: nz
  • D Size Cell
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #148 on: March 12, 2017, 05:48:12 am »

Their legal department would start taking an active interest if someone was trying to sell hacked scopes.  I would think that is pretty obvious - as this would directly impact Keysight's sales.
[/quote]
Yes, this would be the case. Legally speaking, it is your property. Legal from Keysight would nail anyone redistributing scopes that were hacked, the same as they would nail anyone selling knockoffs rebranded as Keysight.

Sent from my SM-G935V using Tapatalk
[/quote]

If i took a 'red led flasher' and replaced the led with a green led and then resold it. ( it was my property, i am allowed to sell it ), would i be breaking any law?     Is the situation not the same with this scope? Its your property, you can do what you want with it,  change it, paint it, etc etc.

What law would you be breaching..  Your not hacking any code. Your just using the scope in a way it was'tn possibly intended to be done.


Note: I'm not even contemplaing becoming a scope mod resale shp.. but thats not the point.
On a quest to find increasingly complicated ways to blink things
 

Offline Brumby

  • Supporter
  • ****
  • Posts: 12288
  • Country: au
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #149 on: March 12, 2017, 07:33:13 am »
IANAL.  The Keysight legal department would be the people to ask.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf