Author Topic: EEVblog #978 - Keysight 1000X Hacking  (Read 212272 times)

0 Members and 2 Guests are viewing this topic.

Offline Brumby

  • Supporter
  • ****
  • Posts: 10520
  • Country: au
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #300 on: March 24, 2017, 01:59:04 am »
I wonder if the Keysight designers are following this and having a chuckle every now and then - or maybe wondering how much will be unveiled....?
 

Online mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 12391
  • Country: gb
    • Mike's Electric Stuff
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #301 on: March 24, 2017, 10:40:49 am »
Bear in mind that the EDU and DSO will have different factory cal procedures, so if you upgrade it, there may be factory cal data missing for "enhanced" hardware features.
 
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1615
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #302 on: March 24, 2017, 10:54:45 am »
maybe trig 2 is with other range?
According the datasheet, EDUX model has only +/- 8V range, DSOX has additionally +/- 1.6V.
This is ratio 5.
"/1" or "/5" probably means 1.6V and 8V range respectively (More logical to be opposite, but log data shows only /5 for EDUX, which have 8V range only).
In the DSOX log, there are two lines for Trig2 which contain both ranges (/1 and /5), so Trig2 is not related to the second range.

B1 and B0 are gain/offset coefficients (but I have no idea, which one is the gain or the offset).

I spotted one additional hardware difference between EDUX and DSOX regarding the External Input.

There are 2 resistors to the right of the LEFT CPU board socket.  The DSOX has only the lower resistor populated with value 30.1 ohms (marking 47X) and the EDUX has only the upper resistor populated with a 0 ohm jumper (marking 000).  When I switched the resistors to the correct DSOX configuration, I was able to get a very consistent digital trace for the External Input.  The resistor seems to be related to the EXT_VIEW signal that comes from the Analog comparator on the EXT INPUT section.  Before switching this resistor, the trace was fluctuating rapidly between logic 0 and 1 unless triggering from External Input.  Now I see a nice digital trace when triggering on CH1 or CH2 and I can even use EXT INPUT to create an Analog Bus and get bus values in HEX (only 1-3 bit bus).

But still User Calibration FAILS... |O

There must be more hidden hardware switches around... When I switched these 2 resistors and went back to Product ID 22 (EDUX1002G) to reset the User Calibration status to PASS, the external switch is offering additional functions similar to DSOX without the dual range (1.6V and 8V), but now I can add EXTERNAL to the analog bus when before it was not possible or my EDUX is having double personality issues after switching from EDUX to DSOX and back so many times...

Can any EDUX user try if EXTERNAL INPUT can be added to the Analog Bus?
 

Offline brumster

  • Contributor
  • Posts: 10
  • Country: gb
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #303 on: March 24, 2017, 03:36:02 pm »
Can any EDUX user try if EXTERNAL INPUT can be added to the Analog Bus?

Yep. I select external as the trigger, then in the Bus menu I can choose Analog and select the EXT input fine. edit: that's "factory"; no hack in place whatsoever
 

Offline bitseeker

  • Super Contributor
  • ***
  • Posts: 8698
  • Country: us
  • Lots of engineer-tweakable parts inside!
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #304 on: March 24, 2017, 05:48:01 pm »
I wonder if the Keysight designers are following this and having a chuckle every now and then - or maybe wondering how much will be unveiled....?

If it was my product being hacked here, I'd certainly be following with interest. It would be fun to be a fly on the wall at Keysight.
I TEA.
 

Offline Windfall

  • Contributor
  • Posts: 30
  • Country: nl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #305 on: March 24, 2017, 09:03:43 pm »
I wonder if the Keysight designers are following this and having a chuckle every now and then - or maybe wondering how much will be unveiled....?
Either they made it easy (basically just looking at the hardware and matching differences, as is attempted in this thread as far as I can see), and hence they don't really care, or they made it deceptively easy or hard (i.e. requiring deep software hacks as well), and they most certainly will have a chuckle now and then.  :-DD
 

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2831
  • Country: nz
  • D Size Cell
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #306 on: March 24, 2017, 09:32:17 pm »
They could become heros and just publish the hack.
On a quest to find increasingly complicated ways to blink things
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3220
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #307 on: March 24, 2017, 10:05:59 pm »
They could become heros and just publish the hack.

They could also give me the capacitor values needed to mod a 3000t scope to 1 GHz, but that seems unlikely.
VE7FM
 
The following users thanked this post: mrpackethead

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2831
  • Country: nz
  • D Size Cell
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #308 on: March 25, 2017, 02:04:39 am »
They could become heros and just publish the hack.

They could also give me the capacitor values needed to mod a 3000t scope to 1 GHz, but that seems unlikely.


How are you going with that hack?   This is somethign i'd love to do.
On a quest to find increasingly complicated ways to blink things
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3220
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #309 on: March 25, 2017, 02:49:28 am »
They could become heros and just publish the hack.

They could also give me the capacitor values needed to mod a 3000t scope to 1 GHz, but that seems unlikely.


How are you going with that hack?   This is somethign i'd love to do.

Sadly it is at a stand still. Ran into a road block getting the needed capacitor values, we have everything else.
VE7FM
 

Offline amitchell

  • Regular Contributor
  • *
  • Posts: 140
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #310 on: March 25, 2017, 02:03:52 pm »
Are the smart tweezers any good? If someone could get them off a 1Ghz...

http://www.smarttweezers.ca/


Quote

Sadly it is at a stand still. Ran into a road block getting the needed capacitor values, we have everything else.
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3220
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #311 on: March 25, 2017, 06:27:46 pm »
Are the smart tweezers any good? If someone could get them off a 1Ghz...

http://www.smarttweezers.ca/


Quote

Sadly it is at a stand still. Ran into a road block getting the needed capacitor values, we have everything else.

Those might give us accurate enough readings but the parts would still need to be removed to measure them - and that is the biggest challenge. We need to find someone who not only has a 1 GHz scope but has the skill and tools to remove, measure and reinstall the parts successfully.
VE7FM
 

Offline markb82

  • Regular Contributor
  • *
  • Posts: 59
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #312 on: March 25, 2017, 06:55:26 pm »
How about measure the caps on the 500mhz variant, and cut them in half?  t=RC
 

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2831
  • Country: nz
  • D Size Cell
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #313 on: March 25, 2017, 07:53:22 pm »
what part of the system are caps being used?  I'm assuming that these are not for selection of 'personality'.. 
On a quest to find increasingly complicated ways to blink things
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3220
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #314 on: March 25, 2017, 09:18:49 pm »
Anyone interested in the possible upgrade of the 3000T series to 1 GHz should look at this post here:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1147361/#msg1147361
As you can see the parts that need to be changed are critical (balanced front end filter etc) and shouldn't be guessed.

We do know most of the values used in the 100/200 MHz model and the 350/500 MHz model - it may be possible to extrapolate possible values for the 1 GHz mod for most parts but the 1 GHz model has additional components and a different 50 ohm input path.

Anyway, further discussion should probably be moved over to the 2000/3000 hacking thread as it is totally different then the 1000x.
VE7FM
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1615
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #315 on: March 29, 2017, 12:44:06 pm »
Does anyone have the download link for the 1000X series scope firmware?
 

Offline brumster

  • Contributor
  • Posts: 10
  • Country: gb
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #316 on: March 30, 2017, 09:12:16 am »
Does anyone have the download link for the 1000X series scope firmware?

I don't think it exists, or is available (yet). I had a scour for it when I received my scope, and I've also looked back at Keysight's website just now, and there's only "purchase" links for the upgraded features like serial decode and 70->100 bandwidth upgrades. I am guessing we'd have to wait until there's some patch or update issued, but at the moment products are shipping with the first firmware release and until there's a new issue, nothing will be forthcoming?
 

Offline fishandchips

  • Regular Contributor
  • *
  • Posts: 188
  • Country: us
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #317 on: May 10, 2017, 04:29:41 am »
Does anyone have the download link for the 1000X series scope firmware?

I don't think it exists, or is available (yet). I had a scour for it when I received my scope, and I've also looked back at Keysight's website just now, and there's only "purchase" links for the upgraded features like serial decode and 70->100 bandwidth upgrades. I am guessing we'd have to wait until there's some patch or update issued, but at the moment products are shipping with the first firmware release and until there's a new issue, nothing will be forthcoming?

How do you like your scope?
 

Offline brumster

  • Contributor
  • Posts: 10
  • Country: gb
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #318 on: May 10, 2017, 08:26:50 am »
Yeah, it's OK, I'm happy with it. To be totally honest, I loved (and still have) my Picoscope USB scope but needed something with more bandwidth at a cost-effective price, and this ticked the boxes. The only thing that disappoints me is the lack of decode functions (i2c, CAN, etc) without spending more $$$, but I kept the Picoscope for that anyway.

I think anyone jumping out and buying one of these thinking they are going to hack their way to a higher-end scope, though, is going to be disappointed. As can be seen from the conversation here, it's not really as simple or effective as it has maybe been made out. Keysight achieved what they wanted though, got some sales out of it I bet! Maybe with time it'll open up some more.

It also annoyed me that the USB connectivity, touted as part of the product, is actually a pay-to-use feature and the software installation needed on your PC is very heavyweight and convoluted, as it's generic for all Keysight products. So my hope of logging out to a PC is dead in the water, and that bugs me as I had high hopes of using that feature.

Build quality, useability, features - they are all great. No issues there.

Overall, a thumbs up, great little scope.
 

Offline Fred27

  • Supporter
  • ****
  • Posts: 656
  • Country: gb
    • Fred's blog
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #319 on: May 10, 2017, 08:39:23 am »
Sales will definitely go up again if the decode options are "liberated". What would really steal sales from the DS1054Z in my opinion would be if Keysight decided to open up the API for writing third party decoder plugins. How easy or practical this would be given their software architecture, I have no idea.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1615
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #320 on: June 02, 2017, 10:02:58 pm »
Some interesting update.  It looks like on 1000X the recipe.xml file was renamed install.xml (Thanks Daniel for posting the FRA patch).  Regenerated the .ksx file using makecab on windows and I was able to install the infiniiVision.lnk file from USB (Using v241_link_install.cab hack method).  The only problem is that it activates 200MHz but does not take any other option like the 2000X / 3000X. I tried -l DIS, -l ALL, -l EMBD, -l COMP, -l AUTO... and I cannot enable serial decode.  I even removed -l BW10 and still get 200MHz activated (but I think it is limited by hardware to 70-100MHz... I have a modded EDUX1002G).

It adds an interesting Attenuation Compensation Test to the Service Menu (picture attached)

Note: I posted the same information on the DSOX2000 / DSOX3000 hack thread
« Last Edit: June 02, 2017, 10:41:10 pm by TK »
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1615
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #321 on: June 02, 2017, 10:54:15 pm »
More tests... Hardware self test fails, but it is not an issue because the hack can be uninstalled very easily using modified v421_link_uninstall.cab (for the 1000X) if you need to run this test.

NOTE: hardware self test fails because of the EDUX to DSOX hardware mod, not the software hack.

Edited 10/19/17: Self test passes on hacked EDUX with the 10K resistor soldered on the back of the PCB, as found by this post: https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg1327551/#msg1327551
« Last Edit: October 19, 2017, 09:51:02 pm by TK »
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3220
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #322 on: June 03, 2017, 03:18:35 am »
Thanks for posting the info, have you tried using a custom cab to dump the entire filesystem to a flash drive?
VE7FM
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1615
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #323 on: June 03, 2017, 01:19:03 pm »
Thanks for posting the info, have you tried using a custom cab to dump the entire filesystem to a flash drive?
I tried copying some files from the internal flash to a USB drive... text files are OK to copy, but DLL files do not get copied to USB drive.  Maybe they added some sort of protection to avoid this operation.

Does anyone know where the valid options for infiniiVisionLauncher.exe are stored?
 

Offline Keysight DanielBogdanoff

  • Frequent Contributor
  • **
  • Posts: 748
  • Country: us
  • ALL THE SCOPES!
    • Keysight Scopes YouTube channel
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #324 on: June 05, 2017, 06:43:10 am »
What would really steal sales from the DS1054Z in my opinion would be if Keysight decided to open up the API for writing third party decoder plugins. How easy or practical this would be given their software architecture, I have no idea.

I agree this would be super-useful. It's something I have (and will continue to) pitch, but it's a tricky thing to do without giving away our secret sauce.
 
The following users thanked this post: thm_w, Sigurd


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf