EEVblog #978 - Keysight 1000X Hacking

[CJay]

Electronics hobbyists are a right bunch of cheapskates, complaining about spending £500 on a new oscilloscope! One of my (amateur) musician friends has just spent £4,500 on a second-hand concertina, which will need a ~£350 overhaul to make it properly playable.

Some are definitely cheapskates,by choice or necessity, it's going to take me two years to save for one of these, having kids and an ex partner isn't cheap so I have to be very cheap when it comes to my hobby.

[Windfall]

Interesting, especially to get that boot log out of it.

But it never ceases to amaze me seeing Dave use this huge soldering iron tip on small board items (me, I prefer the small tips for that ! I guess it's an Australian thing, like the butcher knife ...  ).

[S13]

I can set it to 50MHz, 100MHz, and 200MHz analog bandwidth and either 1GS or 2GS by twiddling resistor values. Haven't found 70MHz yet, although I found the boot option that displays that value. Video rendering tonight.

That is very impressive, in such short amount of time! 

Also you might want to fiddle more with UART2 if you run out of other options to try. It seems very easy to trace the signals, since they use a very straightforward BGA fanout pattern (straight outwards from each quadrant). From those vias you can access the signals directly or trace them to the side connector and probe them over there. Maybe the UART2 doesnt output anything by default, but it might be capable of accepting input? Like a standard console with help functionality perhaps?

UART2 seems to operate at 115k2, as indicated by the initialization string:

Code: [Select]

SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)

0x1c200 = 115200
It must be initialized for a reason i suspect...

[mikerj]

Electronics hobbyists are a right bunch of cheapskates, complaining about spending £500 on a new oscilloscope! One of my (amateur) musician friends has just spent £4,500 on a second-hand concertina, which will need a ~£350 overhaul to make it properly playable.

Sounds like your friend has a lot more cash to burn than most electronics hobbyists.

[EEVblog]

Also you might want to fiddle more with UART2 if you run out of other options to try. It seems very easy to trace the signals, since they use a very straightforward BGA fanout pattern (straight outwards from each quadrant). From those vias you can access the signals directly or trace them to the side connector and probe them over there. Maybe the UART2 doesnt output anything by default, but it might be capable of accepting input? Like a standard console with help functionality perhaps?

I think Mike said he xrayed the board and didn't find anything?

[S13]

I can only assume the UART2 pins are part of the BGA fanout, right? And if so it must be accessible, if only from those vias alone.

So we have an actual xray of the board as well? Would be interesting to see 

[Inflex]

I think Mike said he xrayed the board and didn't find anything?

Will those images be posted any time? What are people using to do xrays on boards; I'm guessing part of a BGA rework setup?

[NivagSwerdna]

I can set it to 50MHz, 100MHz, and 200MHz analog bandwidth and either 1GS or 2GS by twiddling resistor values. Haven't found 70MHz yet, although I found the boot option that displays that value. Video rendering tonight.

All that's needed for confirmation is to repeat the hack using the EDUX1102G
If you can get a US$650 2CH 200MHz bandwidth 2GS 1M scope with function gen for that price then it's going to be very popular.

Wow!   Just wow!

If a resistor twiddle made a EDUX1002A into 200MHz then that would be a very interesting proposition!

[bktemp]

I think Mike said he xrayed the board and didn't find anything?

Will those images be posted any time? What are people using to do xrays on boards; I'm guessing part of a BGA rework setup?

Mike uses a Faxitron MX-20:

[JPortici]

I can set it to 50MHz, 100MHz, and 200MHz analog bandwidth and either 1GS or 2GS by twiddling resistor values. Haven't found 70MHz yet, although I found the boot option that displays that value. Video rendering tonight.

All that's needed for confirmation is to repeat the hack using the EDUX1102G
If you can get a US$650 2CH 200MHz bandwidth 2GS 1M scope with function gen for that price then it's going to be very popular.

Wow!   Just wow!

If a resistor twiddle made a EDUX1002A into 200MHz then that would be a very interesting proposition!

unlocking memory is more important imho

[Monkeh]

At a guess I'd say the software will be broken at some point but Windows CE is closed source so Keysight have made it that bit more difficult over a Linux based product where they have to make at least some of their source available.

On that note, where's the u-boot source?

[Bud]

Ethics police were already headed off at the pass. Daniel from Keysight basically have the green light earlier in the thread.

It was not about Daniel, it was about the forum's resident voluntary ethics police task force.

[MrBungle]

Nice point missage 

[tautech]

If you can get a US$650 2CH 200MHz bandwidth 2GS 1M scope with function gen for that price then it's going to be very popular.

Quite possibly but you don't have to hack a SDS1202X+ @ $ 765 on promo with Decoders thrown in.
13M more memory depth too.

Damn, ok, that's really great value.

Yep.
Forgot to mention it's got AWG too and it's the MSO version but you have to buy the 16ch probe set and activation.

[3db]

I think Mike said he xrayed the board and didn't find anything?

Will those images be posted any time? What are people using to do xrays on boards; I'm guessing part of a BGA rework setup?

Mike bought an XRAY machine years ago.
3DB

[mikeselectricstuff]

I can set it to 50MHz, 100MHz, and 200MHz analog bandwidth and either 1GS or 2GS by twiddling resistor values. Haven't found 70MHz yet, although I found the boot option that displays that value. Video rendering tonight.

That is very impressive, in such short amount of time! 

Also you might want to fiddle more with UART2 if you run out of other options to try. It seems very easy to trace the signals, since they use a very straightforward BGA fanout pattern (straight outwards from each quadrant). From those vias you can access the signals directly or trace them to the side connector and probe them over there. Maybe the UART2 doesnt output anything by default, but it might be capable of accepting input? Like a standard console with help functionality perhaps?

UART2 seems to operate at 115k2, as indicated by the initialization string:

Code: [Select]

SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)

0x1c200 = 115200
It must be initialized for a reason i suspect...

I tried sending <CR> and other characters during boot with no obvious effect
I suspect the initialisation thing is simply that part of the boot process setting up the UART, despite it previously having been initialised by the earlier boot process. UART2 is the one connected to the connector pads.

[TheSteve]

uboot can likely be interrupted with the space bar.

[Dan Moos]

Ethics police were already headed off at the pass. Daniel from Keysight basically have the green light earlier in the thread.

It was not about Daniel, it was about the forum's resident voluntary ethics police task force.

Yes, and those ethics police have nothing to get in a knot about, for the reasons I said.



Sent from my E6830 using Tapatalk

[EEVblog]

[mike1305]

This is hilarious!  only 9 days after launch...

[mikeselectricstuff]

Might have been useful to list the resistor values for the 200MHz "working" configuration...

There seemed to be some other fairly obvious config/build version resistors, two sets where only one of two R's was populated.

It would be interesting to see what, if any, differences you see in the outputs of the 74HC595 near the front-end.
I had a brief look, and there is a mux in there so it could be it's selecting between full and limited-bandwidth paths.
Didn't see anything that looked like a Rigol style varicap,   

[suenrod]

Thanks for the work Dave! Now I just need the money to buy one. :-)

[Wonderbar]

Regarding the "Revisions"

LP1 = Lab Prototype 1 (normal first prototype build with final design)
LP2 = Lab Prototype 2 (second interation)
PP = Production Prototype (Final production design to do tests with, dropping, climate chamber, EMC and such)

put those bad emissions on frequencies of the nearby radio station next to the testlab! So no one will know

[HighVoltage]

Great videos, Dave.
Thanks

[JPortici]

This is hilarious!  only 9 days after launch...

you are pretending this wasn't the plan all along