EEVblog #978 - Keysight 1000X Hacking

[raphaelCoelho]

That's right!
I bought the edux1052g.
Thank you very much Bud for your help and patience.
Best regards, Raphael

[miket6000]

Hi Everyone,

Thank you to all who have put time effort and money into figuring out these upgrades, I really appreciate it. I'm having an issue with the external trigger view for an EDUX1002A which has had its ID set to 23 (DSOX1202A) had the trigger mod done and had the 1.20 license enabled firmware (including the 2Mpt memory hack) installed. I've checked and double checked all the modifications required and the quality of the work and can't figure out what's causing this.

Everything works perfectly until I enable external trigger view (pressing the "External" button). When I do that and the time base is set to greater than 50us/ then a weird artifact occurs where the data to the left and right of the trigger point no longer match. Below is the capture with channel 1 monitoring the probe compensation signal and externally triggering off the probe compensation signal using a second 10:1 probe, everything is fine.


I turn on external view, with no other changes and you can see the strange artifact as shown below.


If I set the timebase to less than 100uS/ the artifact goes away. Maybe interestingly, the artifact always occurs a fixed number of divisions to the left of the trigger point.


Part of me definitely wonders if it's part of the memory hack, just because it looks so much like a circular buffer overflow, but I can't find any information about anyone else having the issue (though it's maybe an edge use case?). I would uninstall the hacked software to see if that's the cause, but frankly I'm not sure how to do that.

Any help or pointers as to what I should be looking at would be greatly appreciated.

Mike

[JDubU]

Confirmed.

[Bud]

You can downgrade to an official firmware but i'd think you will also have to change the ID back.

[miket6000]

Thanks JDubU and Bud, I was mainly interested in understanding if the issue was specific to my machine, or due to the hack. Obviously backing out the firmware hack causes a bigger loss of functionality than dealing with the issue by avoiding the condition that manifest it, this sort of thing is always a risk when you take a "working" machine and try to "improve" it.

Bud, I'm not sure if you performed the hack or were just the gateway for it to this community, but you definitely seem close to the source. Is there any chance of a version without the memory hack? Of course I don't know this is the issue, I'm just latching on to how similar it looks to other issues when buffer indexes have wrapped around. I know this isn't the latest hotness anymore, but some of us are still keen on our little scopes.

Thanks again,
Mike.

[Bud]

There was no memory wraparound problem at the time when extended memory was enabled, i tested that with a linear voltage ramp over the entire screen. I tested both channels but i did not test the external trigger view. Try to turn on Ch1 Ch2 in addition to external view and see if you observe similar issues on Ch1 Ch2 traces.

Edit: Found the screenshot of a linear ramp. 2MSa/s over 1s horizontal (10 divisions 100mS/) gives 2 MPoints of memory.

[miket6000]

I'll try channel 2 and the linear sweep with the external trigger view tonight.

Edit: issue affects both channels. Everything still works fine with the external view off. Below the ramp is triggering off the external probe on the same signal as channel 2. Scope_9 is both channels showing the probe compensation with ext view on.
Scope_10 is the ramp on channel 2
scope_11 is the same ramp but with ext view on.

[Ungolian]

So I've been following this thread and am considering getting one of these.  I'm messing around on Mouser looking at parts costs, and is it really necessary to use the LMH6552SD?  According to the datasheet, the LMH6552MA has the same lead spacing, and actually has leads!  Plus it looks like it's replacing an SOIC already, so why replace it with a WSON?  The MA is $1.50 more, but easier to solder.

[Bud]

Do it and let us know if that worked ! 

[Ungolian]

Well, if I order from Mouser, some things are back ordered.  It won't be until May or June until I'd get them.  Was just curious if there was a specific reason you chose that one or if it is just what was in the parts bin.  Thanks for the work you put into this, it's a great value.  Getting the parts could be an issue though.  Just wanted to get it right. 

[Bud]

I am not a right person to ask, several people did it long before me.

[Ungolian]

It looks like Keysight has released v2.12 for this.  I'm not a code expert, but it looks like it's still Win CE.  Does anyone know if there are any added security measures that would prevent the software hack from working?

[Bud]

If it is for DSOX1200 series scope, it is Linux.

[Ungolian]

Indeed it is.  *Sigh*  Briefly looking through the code, there are references to the 1000x series though.  I'll assume they switched to Linux on version 2.0, and it's now impossible to do the software mods.  Thanks for the help! 

[Bud]

Keysight refers to both DSOX1100 (WinCE) and DSOX1200 (Linux) series as 1000 series scopes. Go figure.

[Ungolian]

Ok, so I answered my own question regarding the LMH6552, but raised another one.  As per the data sheet:

8.2.1.2.1 WSON Package
Due to its size and lower parasitics, the WSON requires the lower optimum value of 275 Ω for RF. This gives a
flat frequency response with minimal peaking. With a lower RF value the WSON package has a reduction in
noise compared to the SOIC with its optimum RF = 360 Ω.

The stock value in the scope is 390 Ω.  With the proper Rf (275 Ω), the noise floor would be lower.  There's about a 30% difference between those resistor values, not sure if that translates into a 30% reduction in noise. 

Even though the 1000x series is discontinued, owners may want to look into this.  Plus, the work in this thread is still relevant to the new EDUX1052 models (the hardware mods anyways).  I think I'm going to bite the bullet and get an EDUX and see if I can do a full hardware mod.  I still have some questions about the three missing components on the front end of the 1052 vs. the 1000x, and how to do the button for the wave generator since the software can't be hacked.  Wxqhigh seems to be the only one that has successfully done the 1052A to 1072G.  I'll most likely reach out to him, order the scope and parts, and start a new thread.  Stay tuned!

[tsirvoulis]

Hi to everyone
I have also notice the issue that miket6000 has!!!
My osciloscope is a EDUX1002G with the hacked firmware and ID as DSOX1102G, also i have made the ext trigger mod on it!
The Hardware test is passed, but the only strange thing is this "bug" when you select the ext triger!!!!

If anyone has any idea what is the cause of this it will be very helpfull !

Greetings from Greece

Petros

[felixsys]

1000X crashed..
I have two 1000X EDUX1002A one of them has NAND problem the other works perfectly on FERCSA firmware.
I have already hooked up the serial port and here is the output.

Code: [Select]

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1A80C40  Name="" Target=RAM
 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1E00000

BL_IMAGE_TYPE_UNKNOWN

 Loading image 2 failed, trying next one
 All images failed

Press r to reset

Can't burn the original or the FERCSA firmware, even tried upload it via dummy modem, but UBoot commands don't respond.

I swapped the U701 serial flash IC from the working BLT board, but that didn't help.

any way to load firmware without LAN?

[Bud]

What do you mean by Uboot commands do not respond?
Maybe try a different terminal software. I recall not all of it works, TerraTerm I believe worked and was what people used.

If not that, then what you can try (beside my StupidBear LAN board) is solder a blank U701. The CPU behavior is such that if it can't find the NOR it will go into USB boot mode. You then will need the ST USB Downloader utility and flash the firmware over USB. Try scanning this thread in reverse direction, I recall someone did it some time back, details should be clear. And it has the exact ST utility name, i am not sure i named it correct.

[felixsys]

I will try to solder a blank U701 and see if the device will boot on usb mode.

Thank you !

[Anthocyanina]

That is what I am trying to say - you can't measure it and therefore it is unknown if it changed or not.

Recently got the 1102g, and while exploring the menus i found that in utility >options>auxiliary there is an option under Gen Out that allows you to select trigger out on the generator connector. I measured that with the owon, and it's a bit over the 50k rate they specify, at least at the faster timebase settings.

[Anthocyanina]

Has there been any instability issues with Bud's modded firmware? I want to try it, if anything, just for the serial decodes, but i don't want to risk any instability or damage to my oscilloscope, beyond the risk of a regular firmware upgrade. Also I see the only source for Bud's firmware now is from Mega. Does anyone have the checksum for Bud's firmware? also want to be sure it's not been changed.

I'll try channel 2 and the linear sweep with the external trigger view tonight.

Edit: issue affects both channels. Everything still works fine with the external view off. Below the ramp is triggering off the external probe on the same signal as channel 2. Scope_9 is both channels showing the probe compensation with ext view on.
Scope_10 is the ramp on channel 2
scope_11 is the same ramp but with ext view on.

Is this a common issue with Bud's firmware?

Thank you! 

[Anthocyanina]

Having given a try to Bud's firmware and finding it also has the weird bug when ext trigger is on at certain timebases, as seen in the attached screenshot, I wanted to adventure into modding the firmware without a clue of where to start. Anyway, opening some files with hex editors, i found this. So it seems at least bits of this firmware go back to the DSO1000A series, the even older low end scopes(which i found to be a curiosity), as well as some mentions of Symantec time stamping services. This from the INFINI~1.025 executable file. Maybe the Symantec time stuff is what's keeping track of the trial period? I'm mostly interested in just the serial decodes, for some of which i would need the ext trigger channel to be active. So maybe change something about the timing of the trial period would work for that purpose?

If anyone has any ideas/tips on how to move forward, as this is my first time trying to do something like this, they would be very welcome.

Thank you!

[Bud]

This is only an issue when External View is enabled.  Normal 2-channel working mode is not affected.
I found the older 1M memory version nk.bin.comp file. If you can provide a link to storage I can upload it. But it will be up to you to put it in the firmware update package.

[Anthocyanina]

This is only an issue when External View is enabled.  Normal 2-channel working mode is not affected.
I found the older 1M memory version nk.bin.comp file. If you can provide a link to storage I can upload it. But it will be up to you to put it in the firmware update package.

Hi! Would it be ok for you to upload it to gofile.io or send it to me by email and i can upload it publicly on mega in case anyone else wants to download it? Thank you!