Author Topic: EEVblog #978 - Keysight 1000X Hacking  (Read 151618 times)

0 Members and 1 Guest are viewing this topic.

Offline Bud

  • Super Contributor
  • ***
  • Posts: 3529
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #575 on: February 06, 2019, 09:37:30 pm »
External trigger area, mysterious(no one measured it) cap under LMV7219

Is it on the other side of the PCB ?
Facebook-free life and Rigol-free shack.
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 3529
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #576 on: February 06, 2019, 10:02:40 pm »
I looks like it is possible to add LAN option.  :popcorn:
Code: [Select]

LaunchInfiniiVision:
BLT Module Config 03 - UNKNOWN
=========================================
BLT Product Config 24
   Bandwidth   : 200MHz
   #Channel    : 2
   Board Rev   : FPR
   Clk Gating  : Baldwin
   Sample Rate : 4GSa
   LAN PHY     : Yes
Can you share details of this mod?
Facebook-free life and Rigol-free shack.
 
The following users thanked this post: rhythmp

Offline FERCSA

  • Contributor
  • Posts: 36
  • Country: hu
    • www.fercsa.com
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #577 on: February 06, 2019, 11:17:33 pm »
External trigger area, mysterious(no one measured it) cap under LMV7219

Is it on the other side of the PCB ?

Nope. Same side as most of the mods. Just look for U9 on this picture:
https://www.fercsa.com/keysight/trigger_mod_before.jpg
Then top-right, there is a 10nF cap. I used 10nF, because I already had one. Others used a 33nF cap, so that could be good too.

I looks like it is possible to add LAN option.  :popcorn:
Code: [Select]

LaunchInfiniiVision:
BLT Module Config 03 - UNKNOWN
=========================================
BLT Product Config 24
   Bandwidth   : 200MHz
   #Channel    : 2
   Board Rev   : FPR
   Clk Gating  : Baldwin
   Sample Rate : 4GSa
   LAN PHY     : Yes
Can you share details of this mod?

I didn't make this mod, but you'll need a LAN8700C chip and just connect it to the unpopulated connector on the BLT module.
U-boot supports other chips like Microsemi (ex-Vitesse) VSC8641 and one from National, but I don't remember the exact part number.

I tried a cheap usb-lan adapter too, it had WinCE driver, but when I loaded this driver nothing happened. Probably there is a missing network related component or registry entry. It would be fun to solve this, because I successfully run a gdb server on this scope before, but I was not able to make a connection through serial.
Don't ask. I'm the same guy who gave you ultra fast internet in the '00s..
 #FERCSA
 
The following users thanked this post: Bud

Offline hv222

  • Regular Contributor
  • *
  • Posts: 63
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #578 on: February 07, 2019, 09:38:53 am »
I looks like it is possible to add LAN option.  :popcorn:
Code: [Select]

LaunchInfiniiVision:
BLT Module Config 03 - UNKNOWN
=========================================
BLT Product Config 24
   Bandwidth   : 200MHz
   #Channel    : 2
   Board Rev   : FPR
   Clk Gating  : Baldwin
   Sample Rate : 4GSa
   LAN PHY     : Yes
Can you share details of this mod?


It needs some PCB with LAN8700C. Schematic is same like this: http://ww1.microchip.com/downloads/en/DeviceDoc/evb8700_mii_sch.pdf to configure LAN8700C pins RXD0, RXD1, RXD2 and RXD3 require 10kOhm pull down resistor to GND.PHY is connected with processor board on unsoldered connector I don't used 100om resistors. I'm not sure if I mark pin 1 correctly. Check ground pins location.
You also need to modify memory U701. MAC is located in this flash at address 0x070000 to 0x070005 (6 bajts).Mac is not programmed by default - it value is 0xff 0xff 0xff 0xff 0xff 0xff.  I got access to flash via FT2232 chip and software SPI FTDI programmer (flash was extracted from board). However this hack not give me too much. It was possible to connect with scope via telnet, but hacks knowed from 2000x and 3000x was not working.
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 3529
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #579 on: February 07, 2019, 04:24:25 pm »
Thank you hv222. Did you try if Keysight software works with the added LAN?
Facebook-free life and Rigol-free shack.
 

Offline hv222

  • Regular Contributor
  • *
  • Posts: 63
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #580 on: February 07, 2019, 04:36:42 pm »
It detects scope, but I don't play with it.
 
The following users thanked this post: Bud

Offline Bud

  • Super Contributor
  • ***
  • Posts: 3529
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #581 on: February 07, 2019, 06:26:43 pm »
The two things that immediately bothered me with the EDUX were too bright button lights (annoyingly distracting) and loud fan. Will be looking to reduce the LED brightness first thing when disassemble the scope. Has anyone found a nicer replacement fan model ?
Facebook-free life and Rigol-free shack.
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 3529
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #582 on: February 11, 2019, 03:12:00 am »
...
And here is some picture:



Are the resistors 0805 or 0603 ?
Facebook-free life and Rigol-free shack.
 

Offline hv222

  • Regular Contributor
  • *
  • Posts: 63
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #583 on: February 11, 2019, 08:40:29 am »
0603. It's just for USB signal conditioning. Only option to make it useful is put uart to USB bridge and connect it to scope uart for debugging purpose.
 

Offline FERCSA

  • Contributor
  • Posts: 36
  • Country: hu
    • www.fercsa.com
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #584 on: February 11, 2019, 06:54:55 pm »
The two things that immediately bothered me with the EDUX were too bright button lights (annoyingly distracting) and loud fan. Will be looking to reduce the LED brightness first thing when disassemble the scope. Has anyone found a nicer replacement fan model ?

You can try those rubber fan mounts. It helps a little. I found a few in my old PC.
As hv222 said they're 0603 components. I used an USB2514 chip, which has 4 ports, so my usb-serial and jtag is always connected if I need them.

Btw you got the G version or the none G?
Don't ask. I'm the same guy who gave you ultra fast internet in the '00s..
 #FERCSA
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 3529
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #585 on: February 11, 2019, 07:05:56 pm »
It is an A, non-G one
Facebook-free life and Rigol-free shack.
 

Offline luiz_aug

  • Contributor
  • Posts: 6
  • Country: br
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #586 on: February 27, 2019, 07:03:12 pm »
So guys, I found some valuable information here but also got a little confused by the so many model variants of oscilloscopes.

To summarize, If one got a EDUX1002G (brand-new with the  01.01.1016092800 firmware version), besides the "time-machine" hack to evaluate the EMBD tool for lifetime, which are the other verified hacks it can be applied for ?

Thank You!
 

Online TK

  • Super Contributor
  • ***
  • Posts: 1141
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #587 on: February 27, 2019, 08:20:43 pm »
With the latest software hack from FERCSA, it is fully enabled as DSOX1102G with the serial decode options and it is supposed to be good up to 200MHz.  You will need the hardware external trigger and front-end mods done on the EDUX.
 

Offline luiz_aug

  • Contributor
  • Posts: 6
  • Country: br
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #588 on: February 28, 2019, 04:01:45 am »
With the latest software hack from FERCSA, it is fully enabled as DSOX1102G with the serial decode options and it is supposed to be good up to 200MHz.  You will need the hardware external trigger and front-end mods done on the EDUX.

Ok, so all I got to mod is the described components at Reply #529 from @FERCSA ? No need for the resistor hack to convert EDUX -> DSOX ?
 

Online TK

  • Super Contributor
  • ***
  • Posts: 1141
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #589 on: February 28, 2019, 01:18:57 pm »
With the latest software hack from FERCSA, it is fully enabled as DSOX1102G with the serial decode options and it is supposed to be good up to 200MHz.  You will need the hardware external trigger and front-end mods done on the EDUX.

Ok, so all I got to mod is the described components at Reply #529 from @FERCSA ? No need for the resistor hack to convert EDUX -> DSOX ?
You need the resistor hack as well
 
The following users thanked this post: luiz_aug

Offline vladsol

  • Contributor
  • Posts: 11
  • Country: 00
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #590 on: February 28, 2019, 02:21:22 pm »
Successfully replaced the stock FAN.
Before:

After:


New FAN: Sunon HA60251V4-000U-999

Now my oscilloscope is almost fully silent :)
« Last Edit: February 28, 2019, 02:25:06 pm by vladsol »
 

Offline bleckers

  • Contributor
  • Posts: 35
  • Country: au
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #591 on: March 03, 2019, 11:33:20 am »
FW v1.1: https://bit.ly/dsox1102hack
MD5: ad84976ff2f5b044a21020436751c5c3

You sir are a legend. The update process worked flawlessly and all options are working on the DSOX1102G.
 

Online TK

  • Super Contributor
  • ***
  • Posts: 1141
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #592 on: March 03, 2019, 11:45:41 pm »
Successfully replaced the stock FAN.
Before:

After:


New FAN: Sunon HA60251V4-000U-999

Now my oscilloscope is almost fully silent :)
Photo shows HD6020B12M
 

Offline vladsol

  • Contributor
  • Posts: 11
  • Country: 00
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #593 on: March 04, 2019, 05:09:23 am »
Quote from: TK
Photo shows HD6020B12M
Take a look at the second photo.
SuperFan HD6020B12M was replaced by Sunon HA60251V4
 

Online TK

  • Super Contributor
  • ***
  • Posts: 1141
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #594 on: March 04, 2019, 12:01:49 pm »
Quote from: TK
Photo shows HD6020B12M
Take a look at the second photo.
SuperFan HD6020B12M was replaced by Sunon HA60251V4
My mistake, I assumed both photos were from the same new fan.  Thanks for the info.
 

Offline Cesarsound

  • Newbie
  • Posts: 4
  • Country: br
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #595 on: March 19, 2019, 04:58:10 pm »
FERCSA HACKING firmware.

I have a 70MHz DSOX1102G I bought in 2018. I was interested in increasing the bandwidth to 100MHz, but I found the KS upgrade a bit expensive. Searching in this forum, I found the FERCSA HACKING firmware. At first I was a bit afraid that something went wrong, but I decided to install the FERCSA HACKING firmware on my DSOX.

The installation was done successfully, it took 3 minutes and in the end even the soft reset worked perfectly. Now I am very happy because I got a bandwidth of 200MHz and the time base now reaches 2nS (before the minium was 5nS) WOW :)

-I've attached some photos comparing the before and after and the installation process.
-I measured a signal from a 125MHz TCXO oscillator (before and after photo).
-I measured the SPI protocol of an Arduino (pictured below).

FERCSA, thank you for sharing this brilliant work and continue the development!

Good luck to everyone.
« Last Edit: March 21, 2019, 12:17:10 am by Cesarsound »
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 3529
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #596 on: March 21, 2019, 02:43:52 pm »
Can someone with a 1000G post a screenshot of the function gen output with 10 MHz square wave please?
Facebook-free life and Rigol-free shack.
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 3529
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #597 on: March 21, 2019, 03:04:14 pm »
Successfully replaced the stock FAN.
Before:

After:

New FAN: Sunon HA60251V4-000U-999

Now my oscilloscope is almost fully silent :)
I've done this with the same new fan and i would not say the scope is almost silent, however the annoying mid- frequency pitch whining noise has now gone. It was what bothered me the most. If anyone is considering the mod, go buy the fan now as Digikey just sent an obscolescence notification for this fan.
Facebook-free life and Rigol-free shack.
 

Online TK

  • Super Contributor
  • ***
  • Posts: 1141
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #598 on: March 21, 2019, 03:45:01 pm »
Can someone with a 1000G post a screenshot of the function gen output with 10 MHz square wave please?

Square Wave, 10MHz, 500mVpp, Offset=0V

With 50ohm passthrough


Without 50ohm passthrough
« Last Edit: March 21, 2019, 03:48:36 pm by TK »
 
The following users thanked this post: Bud

Online TK

  • Super Contributor
  • ***
  • Posts: 1141
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #599 on: March 21, 2019, 09:34:51 pm »
Tried the SunOn and the GDSTIME... both are worse than the original fan.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf