Author Topic: EEVblog #978 - Keysight 1000X Hacking  (Read 152653 times)

0 Members and 1 Guest are viewing this topic.

Offline hv222

  • Regular Contributor
  • *
  • Posts: 63
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #475 on: November 18, 2017, 12:11:44 am »
I add PHY LAN8700C, but it looks like it not have MAC address assigned  - FF-FF-FF-FF-FF-FF. I'm not sure about pull up/down configuration of PHY. I made some reverse engineering of 2000x, 3000x and 4000x teardown photos, but it's not enough clear where pull resistors are going - probably GND. Now are 10k pull down resistors to RXD0, RXD1, RXD2, RXD3 lines. LED's are connected like in recommended schematic for MII mode - PHY application. I try to read M25P40 memory and also play with wire shark to check out communication.

Code: [Select]

LAN PHY detected.
 EDeviceLoadEeprom, MAC address not programmed.
-EDeviceLoadEeprom 03:04:05:06:07:08
Phy found addr 31 (ticks=3327)
WaitForLink Start (ticks=3329)
No Link (ticks=4331)
<--EDeviceInitialize

GMAC DMA status register = 0x0
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
WaitForLink Start (ticks=6338)
Link Detected (ticks=6339)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
phyCfg->bFullDuplex 0x1
<--EDeviceInitialize

GMAC DMA status register = 0x600004
DriverStart
GMAC Device enable interrupt
cable attached
Device load time:
   NANDFLASH: 0 ms
   SNANDFLASH: 0 ms
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
LaunchInfiniiVision:
BLT Module Config 03 - UNKNOWN
 
The following users thanked this post: skander36

Offline skander36

  • Regular Contributor
  • *
  • Posts: 87
  • Country: ro
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #476 on: November 23, 2017, 02:50:53 pm »
Hi , any news / progress about 1000X hack ?
THX !!!
 

Offline hv222

  • Regular Contributor
  • *
  • Posts: 63
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #477 on: November 23, 2017, 02:54:36 pm »
I add MAC address and it is possible to connect with scope by telnet. But hacking like in 2000x/3000x series is not working  :(
 
The following users thanked this post: skander36

Offline skander36

  • Regular Contributor
  • *
  • Posts: 87
  • Country: ro
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #478 on: November 26, 2017, 01:46:20 pm »
So , if I am not interested in wavegen , FRA and stuff , what can I do to make a EDUX 1002A to get a 2Gs/s and 1Mpt memory ?
It is possible only by software or I still need to change resistors for Prod. ID ?

THX !
 

Online TK

  • Super Contributor
  • ***
  • Posts: 1147
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #479 on: November 26, 2017, 01:51:21 pm »
So , if I am not interested in wavegen , FRA and stuff , what can I do to make a EDUX 1002A to get a 2Gs/s and 1Mpt memory ?
It is possible only by software or I still need to change resistors for Prod. ID ?

THX !
Just change the Product ID resistors to 24 (DSOX).  Software hack does not work.
 
The following users thanked this post: skander36

Offline skander36

  • Regular Contributor
  • *
  • Posts: 87
  • Country: ro
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #480 on: November 28, 2017, 10:50:37 am »
Which resistors ?
What values ?
I've read this thread 3 times from beginning and more times searching through it but I cannot figure out what values and which resistors to change just for Id 24 on EDUX1002A .

Thank you !
« Last Edit: November 28, 2017, 12:19:38 pm by skander36 »
 

Online TK

  • Super Contributor
  • ***
  • Posts: 1147
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #481 on: December 03, 2017, 04:54:38 pm »
My EDUX1002G is showing some strange traces while doing user calibration, at the very beginning of the process and after about 30 seconds into the process.  Does anyone with the EDUX1002 or DSOX1000 see the same during user calibration? And of course it fails after running for about 4 minutes.


« Last Edit: December 03, 2017, 04:56:55 pm by TK »
 

Offline skander36

  • Regular Contributor
  • *
  • Posts: 87
  • Country: ro
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #482 on: December 05, 2017, 01:03:52 pm »
EDUX1002A does not show this on calibration time .
 
 
The following users thanked this post: TK

Online TK

  • Super Contributor
  • ***
  • Posts: 1147
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #483 on: December 05, 2017, 03:35:07 pm »
Which resistors ?
What values ?
I've read this thread 3 times from beginning and more times searching through it but I cannot figure out what values and which resistors to change just for Id 24 on EDUX1002A .

Thank you !
It is described on this thread: https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg1162790/#msg1162790

It activates all DSOX1000 features, which includes 1Mpts, 2GSa/s, 70MHz BW, etc
 
The following users thanked this post: skander36

Offline skander36

  • Regular Contributor
  • *
  • Posts: 87
  • Country: ro
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #484 on: December 05, 2017, 05:47:49 pm »
Thanks !
In the mean time thanks to a forum member (thuttu77) I have done the mod but still I am not sure about 1Mpts .
It show the same EDUX1002A but with 70 MHz , 2GSa , Segmented and Mask .
On EDUX 1002A resistors from left (green) was 1K & 10K (the picture is not from EDUX1002A) . I change it with 68k & 100K to obtain 0,95V corresponding to ID 023 .
« Last Edit: December 05, 2017, 06:34:00 pm by skander36 »
 

Online TK

  • Super Contributor
  • ***
  • Posts: 1147
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #485 on: December 05, 2017, 08:31:58 pm »
Thanks !
In the mean time thanks to a forum member (thuttu77) I have done the mod but still I am not sure about 1Mpts .
It show the same EDUX1002A but with 70 MHz , 2GSa , Segmented and Mask .
On EDUX 1002A resistors from left (green) was 1K & 10K (the picture is not from EDUX1002A) . I change it with 68k & 100K to obtain 0,95V corresponding to ID 023 .
ID for DSOX1102G is 24, not 23.  Do you know if 23 is the ID for DSOX1102A?  If you see 70MHz, 2GSa/s and segmented memory, then you have the DSOX which by default has 1Mpts.
 

Offline skander36

  • Regular Contributor
  • *
  • Posts: 87
  • Country: ro
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #486 on: December 05, 2017, 09:27:05 pm »
Yes , I know . As I mentioned I have EDUX1002A , not G, so I will not need Generator, FRA and stuff  .
That way I need to choose ID023 for DSOX1002A .
I believe you about 1Mpts but there is a method to verify this ?

Thanx ! 
« Last Edit: October 17, 2018, 12:55:32 pm by skander36 »
 

Offline hv222

  • Regular Contributor
  • *
  • Posts: 63
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #487 on: December 05, 2017, 09:57:37 pm »
TK, photos from user calibration are very strange. I'm wonder, why it's not return fail immediately. Did you resolder connectors? If scope is working well, problem probably is in signal generator used for calibration. Check U33, U47 and stuff around it including PWM5V supply rail from U30. It's wired that it is in both channels... So check also 2 components on top side of main PCB, on the right from CH1 front end (capacitor and inductor). They are connecting both channels with BLT PCB. entry point of this connection in analog frontend it's via 390ohm resistor, A7 (sot23) double diode, 47X resistor to pin 1 of U34/U39. Maybe some capacitor on the way fail to open, and PWM signal is visible instead of DC. If here is everything okej I think that problem is in BLT board - bad solder points under BGA or damage inside IC's. Unfortunately my logic analyzer is too slow to capture digital communication while user calibration. I don't have more ideas to solve it.
 
The following users thanked this post: TK

Online TK

  • Super Contributor
  • ***
  • Posts: 1147
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #488 on: December 06, 2017, 02:09:31 am »
TK, photos from user calibration are very strange. I'm wonder, why it's not return fail immediately. Did you resolder connectors? If scope is working well, problem probably is in signal generator used for calibration. Check U33, U47 and stuff around it including PWM5V supply rail from U30. It's wired that it is in both channels... So check also 2 components on top side of main PCB, on the right from CH1 front end (capacitor and inductor). They are connecting both channels with BLT PCB. entry point of this connection in analog frontend it's via 390ohm resistor, A7 (sot23) double diode, 47X resistor to pin 1 of U34/U39. Maybe some capacitor on the way fail to open, and PWM signal is visible instead of DC. If here is everything okej I think that problem is in BLT board - bad solder points under BGA or damage inside IC's. Unfortunately my logic analyzer is too slow to capture digital communication while user calibration. I don't have more ideas to solve it.
I resoldered all the connector pins (main PCB to BLT).  I suspect my problem is with U34/U39.  I will remove them and resolder.  Have you soldered the center thermal pad?  Any hints on how to solder them?
 

Offline hv222

  • Regular Contributor
  • *
  • Posts: 63
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #489 on: December 06, 2017, 08:42:24 am »
Thermal pad can be soldered only by hot air or IR station. U34/U39 is only differential amplifier. Thermal pad in LMH6552 is only for thermal purpose. If scope is working correctly on some test signal from generator I will search problem in other place.
 

Online TK

  • Super Contributor
  • ***
  • Posts: 1147
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #490 on: December 06, 2017, 05:57:21 pm »
TK, photos from user calibration are very strange. I'm wonder, why it's not return fail immediately. Did you resolder connectors? If scope is working well, problem probably is in signal generator used for calibration. Check U33, U47 and stuff around it including PWM5V supply rail from U30. It's wired that it is in both channels... So check also 2 components on top side of main PCB, on the right from CH1 front end (capacitor and inductor). They are connecting both channels with BLT PCB. entry point of this connection in analog frontend it's via 390ohm resistor, A7 (sot23) double diode, 47X resistor to pin 1 of U34/U39. Maybe some capacitor on the way fail to open, and PWM signal is visible instead of DC. If here is everything okej I think that problem is in BLT board - bad solder points under BGA or damage inside IC's. Unfortunately my logic analyzer is too slow to capture digital communication while user calibration. I don't have more ideas to solve it.
@hv222 Thanks to your hints, I resolved the user calibration error.  It was the 390ohm resistor near U34 on CH1 frontend.  The value was 3Mohms, even when it was marked 391.  Replaced with a good one, and now it is a DSOX1102G that passes user calibration.
 

Offline hv222

  • Regular Contributor
  • *
  • Posts: 63
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #491 on: December 06, 2017, 06:23:57 pm »
That's great. I'm preparing to new analog frontend design for this scope with 800MHz bandwidth and all main board on future. 800MHz sound's reasonable with 2GSPS ADC. I want to base on http://www.ti.com/lit/ug/tiduba4/tiduba4.pdf and https://www.flickr.com/photos/eevblog/21053475596/in/album-72157657671196148/ Maybe someone have more helpful resources like schematics, literature, application notes etc.?
 

Offline thuttu77

  • Contributor
  • Posts: 8
  • Country: fi
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #492 on: March 16, 2018, 11:04:30 am »
Since Keysight released new firmware to DSO X 1000 series some time a go does enyone have tested / tried to hack it?
 

Online TK

  • Super Contributor
  • ***
  • Posts: 1147
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #493 on: March 16, 2018, 03:10:59 pm »
The new firmware will not allow you to set the date before year 2018.  If you are using the trial serial decode option and setting back the time to use it "permanently", do not upgrade your scope to the latest firmware.  Firmware cannot be downgraded.
 

Offline skander36

  • Regular Contributor
  • *
  • Posts: 87
  • Country: ro
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #494 on: March 16, 2018, 08:06:01 pm »
The new version comes with a one month trial license for ALL ( DIS / EMB SERIAL Decode SPI/I2C plus AUTO which was not available before for EDUX Series) .
 I don't know if this is possible because is a mod hardware (I have ID 23 ) or is a way to show that AUTO Decoding capabilities can be use even with EDUX Series . Auto was not marketed for sale with the EDUX series .
 

Online TK

  • Super Contributor
  • ***
  • Posts: 1147
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #495 on: March 16, 2018, 08:14:41 pm »
The new version comes with a one month trial license for ALL ( DIS / EMB SERIAL Decode SPI/I2C plus AUTO which was not available before for EDUX Series) .
 I don't know if this is possible because is a mod hardware (I have ID 23 ) or is a way to show that AUTO Decoding capabilities can be use even with EDUX Series . Auto was not marketed for sale with the EDUX series .
I think it is because it was modded.  SPI is not available on unmodded EDUX scopes, but it gets activated when modded.
 
The following users thanked this post: skander36

Offline thuttu77

  • Contributor
  • Posts: 8
  • Country: fi
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #496 on: March 28, 2018, 06:51:40 am »
The new firmware will not allow you to set the date before year 2018.  If you are using the trial serial decode option and setting back the time to use it "permanently", do not upgrade your scope to the latest firmware.  Firmware cannot be downgraded.

Its not problem to me I have serial debug license waiting activation, It would be interesting to see if AUTO is possible to add modded EDUX since info screen still says its EDUX but 70MHz
 

Online TK

  • Super Contributor
  • ***
  • Posts: 1147
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #497 on: March 28, 2018, 11:56:49 am »
The new firmware will not allow you to set the date before year 2018.  If you are using the trial serial decode option and setting back the time to use it "permanently", do not upgrade your scope to the latest firmware.  Firmware cannot be downgraded.

Its not problem to me I have serial debug license waiting activation, It would be interesting to see if AUTO is possible to add modded EDUX since info screen still says its EDUX but 70MHz
If you activate the 30 day trial, it will activate all protocols including AUTO for a limited time.  You cannot purchase AUTO on a modded EDUX scope because it is still an EDUX model for Keysight and they also verify the serial number.
 

Offline ePoxi

  • Newbie
  • Posts: 1
  • Country: ar
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #498 on: April 03, 2018, 02:33:51 am »
I'm going to buy an EDUX1002A in the next few days. I'll let you know what firmware and hardware revision comes with.

Thanks for all the hard working you've been doing hacking this device!
 

Offline bitseeker

  • Super Contributor
  • ***
  • Posts: 7906
  • Country: us
  • Lots of engineer-tweakable parts inside!
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #499 on: April 03, 2018, 05:56:44 pm »
Welcome to the forum, ePoxi. Enjoy your scope!
I TEA.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf