EEVblog #978 - Keysight 1000X Hacking

[peekpt]

Maybe the resistors sets up the default configuration and it can still be modified via software. 

[tlc531]

Oh my. History repeating itself!Keysight know about this, its an early sales ploy. The hardware hack and eventual software hack will eventually be blocked. Meanwhile people will buy the scopes and give early great sales figures.  People like thinking they are getting something for nothing. Otherwise why would Keysight send out new scopes to the likes of Dave(EEVBLOG) and Julian Illett and others for free. Vloggers in Electronics are awash with new Keysight kit.

[tlc531]

Ben Heck has got a new Keysight Scope too Imagine

[bitseeker]

No need to imagine. Brand marketing via giving vloggers free products has worked before and will work again and again.

[hauptbr09]

Keygen will take a while unless you can pull the image through the debug. It's an arm architecture, so I'm sure it could be decoded

Sent from my SM-G935V using Tapatalk

[Dan Moos]

I just want to say this was one of your best videos in awhile. My only hope of getting this scope is the contest. My recent 1054z is was barely gotten past my wife! But watching this kind of hands on stuff is you at your best.

Sent from my E6830 using Tapatalk

[EEVblog]

Not if you have to solder tiny resistors to do it. 
Sales will shoot up after the keygen appears.

I suspect that a Keygen won't be enough.
There is likely some way to override the config resistor in the boot code but that's a different software hack. If no one does that then modding resistors might be the only way. Especially if you want the 200MHz.

[TheSteve]

I don't see there ever being a keygen for this scope, and I hope there isn't. If there is a keygen for the 1000 scope it would likely be usable with the 2000/3000 series as well. The dollar value of the options is just too high for there to be a permanent way to enable all software options - Keysight would have to respond. Right now there are software hacks for the 2000/3000 series but you can always tell at boot or on the system info screen, the hacking can't be hidden.

Changing some jumpers to get more bandwidth is all good in my book though!

[Bud]

The ethics police will be here soon with their stock moral bankruptcy thing.

[Dan Moos]

Ethics police were already headed off at the pass. Daniel from Keysight basically have the green light earlier in the thread.

Sent from my E6830 using Tapatalk

[MrBungle]

I now have a 220MHz bandwidth scope 

Would it now be fairer to compare the feature/price of the 1000X vs Rigol's DS2000 series instead of the 1054Z?

[CJay]

Maybe the resistors sets up the default configuration and it can still be modified via software. 

My thoughts exactly, a user buys, say, the 70MHz version but upgrades it with keys to 100MHz (if that's an upgrade path that Keysight offer), somehwere down the line the 'EEPROM' goes corrupt or the user does a factory reset, the resistors set the 'scope back to 70MHz so the keys have to be input again.

At a guess I'd say the software will be broken at some point but Windows CE is closed source so Keysight have made it that bit more difficult over a Linux based product where they have to make at least some of their source available.

All in, I think it's a pretty damn impressive 'scope, I'd like one for my first digital 'scope so I'm hoping I am incredibly lucky and win one.
If not, I've got to find some (very rare) overtime and some serious saving to do.

Maybe a paper round...

[Pampalini]

Hello everybody

Here is TME.EU price comparison (excluding VAT):

DSOX1102A:   70 MHz   2 Analog Channels     1 Mpts   2 GSa/s   50,000 wfms/s   630 USD
DSOX1102G:   70 MHz   2 Analog Channels     1 Mpts   2 GSa/s   50,000 wfms/s   823 USD
EDUX1002A:   50 MHz   2 Analog Channels   100 kpts   1 GSa/s   50,000 wfms/s   436 USD
EDUX1002G:   50 MHz   2 Analog Channels   100 kpts   1 GSa/s   50,000 wfms/s   630 USD

Available upgrades:
   DSOX1B7T102   70 Mhz > 100 MHz (for DSOX only)                  224 USD
   EDUX1EMBD    I2C, UART/RS-232   (for EDUX only)                  147 USD
   DSOX1EMBD   I2C, UART/RS-232   (for DSOX only)                  147 USD
   DSOX1AUTO   CAN, LIN                  (for DSOX only)                  147 USD

DSOX2022A:   200 MHz   2 Analog Channels   1 Mpts   2 GSa/s   50,000 wfms/s   2227 USD

[EEVblog]

Maybe the resistors sets up the default configuration and it can still be modified via software. 

My thoughts exactly, a user buys, say, the 70MHz version but upgrades it with keys to 100MHz (if that's an upgrade path that Keysight offer), somehwere down the line the 'EEPROM' goes corrupt or the user does a factory reset, the resistors set the 'scope back to 70MHz so the keys have to be input again.

The software will always be able to override the resistors, because it's the same software that reads the resistor voltage.
But as it stands I have a 200MHz 1000X on my bench now. I can even get it to 2.5GS/s with some issues that I'm reasonably confident are solvable.
Keysight don't sell a 200MHz 1000X series, so I've got extra performance thanks to a soldering iron 
Warranty definitely void!

I can set it to 50MHz, 100MHz, and 200MHz analog bandwidth and either 1GS or 2GS by twiddling resistor values. Haven't found 70MHz yet, although I found the boot option that displays that value. Video rendering tonight.

All that's needed for confirmation is to repeat the hack using the EDUX1102G
If you can get a US$650 2CH 200MHz bandwidth 2GS 1M scope with function gen for that price then it's going to be very popular.

[tautech]

If you can get a US$650 2CH 200MHz bandwidth 2GS 1M scope with function gen for that price then it's going to be very popular.

Quite possibly but you don't have to hack a SDS1202X+ @ $ 765 on promo with Decoders thrown in.
13M more memory depth too.

[3db]

Oh my. History repeating itself!Keysight know about this, its an early sales ploy. The hardware hack and eventual software hack will eventually be blocked. Meanwhile people will buy the scopes and give early great sales figures.  People like thinking they are getting something for nothing. Otherwise why would Keysight send out new scopes to the likes of Dave(EEVBLOG) and Julian Illett and others for free. Vloggers in Electronics are awash with new Keysight kit.

Because it's CHEAP advertising !!
3DB

[EEVblog]

If you can get a US$650 2CH 200MHz bandwidth 2GS 1M scope with function gen for that price then it's going to be very popular.

Quite possibly but you don't have to hack a SDS1202X+ @ $ 765 on promo with Decoders thrown in.
13M more memory depth too.

Damn, ok, that's really great value.

[Pampalini]

All that's needed for confirmation is to repeat the hack using the EDUX1102G

Also is it possible to switch on wave generator in EDUX1002A.

[EEVblog]

All that's needed for confirmation is to repeat the hack using the EDUX1102G

Also is it possible to switch on wave generator in EDUX1102A.

No, it does not physically have the BNC

[Pampalini]

Yah... but I got drill and soldering iron

[EEVblog]

Yah... but I got drill and soldering iron

I greatly doubt they include the components on the PCB. There is a lot of stuff there to add if the footprints are there.

[NivagSwerdna]

Vloggers in Electronics are awash with new Keysight kit.

If the consider the manufacturing cost of these devices and then compare it to the cost of advertising then it is an absolute no brainer to try and get these as visible as possible.  I've seen them all over youtube so I feel targeted!  However, I'm not sure how worthwhile the exercise actually is since as a hobbyist my budget is below these for a 2-channel scope, my Rigol works fine.  (My next upgrade, if I ever do, will be to 4 channels).  The result of the viewer survey will be interesting... I imagine the vast majority of the audience of the EEVBlog channel aren't in the market for this device, either being non-scope users, cheap scope users or at the other end of the spectrum being professionals (who would look for something with more channels/functions etc).  I have seen these also on less technical channels where they seem ridiculously out of place but the economics of giving them away to get exposure can't be faulted... they probably only have to sell a handful more to get their money back and there will be some pro-sumer types out there with the necessary $$$. 

It would be nice to see the features on this scope that I don't get in my cheapo Rigol just for comparison.  I don't own a Ferrari but it doesn't mean I don't admire them when I see one. 

On the hacking front... The serial debug is interesting... suggests that the structure is very like the 2000/3000 series discussed elsewhere... looks like a firmware mod via USB or a direct approach to the internal FAT file system in the NAND might be more the way to go.  I think Keysight use FlexLM type licencing so the .dll that validates those licences might be the way to go.... but it hasn't got 4-CH so not interesting to me.

[nfmax]

Electronics hobbyists are a right bunch of cheapskates, complaining about spending £500 on a new oscilloscope! One of my (amateur) musician friends has just spent £4,500 on a second-hand concertina, which will need a ~£350 overhaul to make it properly playable.

[NivagSwerdna]

Electronics hobbyists are a right bunch of cheapskates, complaining about spending £500 on a new oscilloscope! One of my (amateur) musician friends has just spent £4,500 on a second-hand concertina, which will need a ~£350 overhaul to make it properly playable.

I can only talk from personal experience... but yes there are moths in my wallet.  However... if your requirement is to see some waveforms once in a blue moon to either diagnose some development or fix something and for the majority of the time the equipment ends up turned off it is difficult to justify £££££ when £££ meets the requirement.  If their new musical instrument actually sounds better then maybe they can justify the extra cost but in the case of a scope then I can't imagine the trace on a £££ scope looks much different from a £££££ scope within certain criteria... i.e. when you go to higher frequencies etc then you end up having to spend the £££££ or deciding not to do the project.  I would like SPI decoding... just not sure how ££ much...  If I used my scope everyday then I would definitely spend more.

[Pampalini]

Yah... but I got drill and soldering iron

I greatly doubt they include the components on the PCB. There is a lot of stuff there to add if the footprints are there.

Of course you are right. I watched your teardown video, there must be two deferent MB version for G and A. Even if it is possible to populate all that stuff in wave gene circuit ... it could be more fun to build own generator.