Author Topic: EEVblog #978 - Keysight 1000X Hacking  (Read 423052 times)

0 Members and 4 Guests are viewing this topic.

Offline CJay

  • Super Contributor
  • ***
  • Posts: 4136
  • Country: gb
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #50 on: March 09, 2017, 12:29:03 pm »
Electronics hobbyists are a right bunch of cheapskates, complaining about spending £500 on a new oscilloscope! One of my (amateur) musician friends has just spent £4,500 on a second-hand concertina, which will need a ~£350 overhaul to make it properly playable.

Some are definitely cheapskates,by choice or necessity, it's going to take me two years to save for one of these, having kids and an ex partner isn't cheap so I have to be very cheap when it comes to my hobby.
 

Offline Windfall

  • Contributor
  • Posts: 30
  • Country: nl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #51 on: March 09, 2017, 12:59:20 pm »
Interesting, especially to get that boot log out of it.

But it never ceases to amaze me seeing Dave use this huge soldering iron tip on small board items (me, I prefer the small tips for that ! I guess it's an Australian thing, like the butcher knife ...  :)).
 

Offline S13

  • Contributor
  • Posts: 45
  • Country: nl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #52 on: March 09, 2017, 01:05:09 pm »
I can set it to 50MHz, 100MHz, and 200MHz analog bandwidth and either 1GS or 2GS by twiddling resistor values. Haven't found 70MHz yet, although I found the boot option that displays that value. Video rendering tonight.

That is very impressive, in such short amount of time!  :-+

Also you might want to fiddle more with UART2 if you run out of other options to try. It seems very easy to trace the signals, since they use a very straightforward BGA fanout pattern (straight outwards from each quadrant). From those vias you can access the signals directly or trace them to the side connector and probe them over there. Maybe the UART2 doesnt output anything by default, but it might be capable of accepting input? Like a standard console with help functionality perhaps?

UART2 seems to operate at 115k2, as indicated by the initialization string:
Code: [Select]
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)0x1c200 = 115200
It must be initialized for a reason i suspect...
 

Offline mikerj

  • Super Contributor
  • ***
  • Posts: 3233
  • Country: gb
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #53 on: March 09, 2017, 01:10:19 pm »
Electronics hobbyists are a right bunch of cheapskates, complaining about spending £500 on a new oscilloscope! One of my (amateur) musician friends has just spent £4,500 on a second-hand concertina, which will need a ~£350 overhaul to make it properly playable.

Sounds like your friend has a lot more cash to burn than most electronics hobbyists.
 

Offline EEVblogTopic starter

  • Administrator
  • *****
  • Posts: 37661
  • Country: au
    • EEVblog
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #54 on: March 09, 2017, 01:11:54 pm »
Also you might want to fiddle more with UART2 if you run out of other options to try. It seems very easy to trace the signals, since they use a very straightforward BGA fanout pattern (straight outwards from each quadrant). From those vias you can access the signals directly or trace them to the side connector and probe them over there. Maybe the UART2 doesnt output anything by default, but it might be capable of accepting input? Like a standard console with help functionality perhaps?

I think Mike said he xrayed the board and didn't find anything?
 

Offline S13

  • Contributor
  • Posts: 45
  • Country: nl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #55 on: March 09, 2017, 01:20:09 pm »
I can only assume the UART2 pins are part of the BGA fanout, right? And if so it must be accessible, if only from those vias alone.

So we have an actual xray of the board as well? Would be interesting to see  8)
 

Offline Inflex

  • Regular Contributor
  • *
  • Posts: 166
  • Country: au
    • Charters Towers Phone & Computer Repairs
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #56 on: March 09, 2017, 01:26:59 pm »
I think Mike said he xrayed the board and didn't find anything?

Will those images be posted any time? What are people using to do xrays on boards; I'm guessing part of a BGA rework setup?
Magicsmoke abuser | What I repair daily on YouTube | FlexBV
- BoardView
| Paul Daniels
 

Offline NivagSwerdna

  • Super Contributor
  • ***
  • Posts: 2495
  • Country: gb
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #57 on: March 09, 2017, 01:28:10 pm »
I can set it to 50MHz, 100MHz, and 200MHz analog bandwidth and either 1GS or 2GS by twiddling resistor values. Haven't found 70MHz yet, although I found the boot option that displays that value. Video rendering tonight.

All that's needed for confirmation is to repeat the hack using the EDUX1102G
If you can get a US$650 2CH 200MHz bandwidth 2GS 1M scope with function gen for that price then it's going to be very popular.

Wow!   Just wow!

If a resistor twiddle made a EDUX1002A into 200MHz then that would be a very interesting proposition!
 

Offline bktemp

  • Super Contributor
  • ***
  • Posts: 1616
  • Country: de
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #58 on: March 09, 2017, 01:35:16 pm »
I think Mike said he xrayed the board and didn't find anything?

Will those images be posted any time? What are people using to do xrays on boards; I'm guessing part of a BGA rework setup?
Mike uses a Faxitron MX-20:
 
The following users thanked this post: Inflex

Offline JPortici

  • Super Contributor
  • ***
  • Posts: 3452
  • Country: it
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #59 on: March 09, 2017, 01:39:04 pm »
I can set it to 50MHz, 100MHz, and 200MHz analog bandwidth and either 1GS or 2GS by twiddling resistor values. Haven't found 70MHz yet, although I found the boot option that displays that value. Video rendering tonight.

All that's needed for confirmation is to repeat the hack using the EDUX1102G
If you can get a US$650 2CH 200MHz bandwidth 2GS 1M scope with function gen for that price then it's going to be very popular.

Wow!   Just wow!

If a resistor twiddle made a EDUX1002A into 200MHz then that would be a very interesting proposition!
unlocking memory is more important imho
 

Online Monkeh

  • Super Contributor
  • ***
  • Posts: 7990
  • Country: gb
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #60 on: March 09, 2017, 01:47:45 pm »
At a guess I'd say the software will be broken at some point but Windows CE is closed source so Keysight have made it that bit more difficult over a Linux based product where they have to make at least some of their source available.

On that note, where's the u-boot source?
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 6877
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #61 on: March 09, 2017, 02:02:15 pm »
Ethics police were already headed off at the pass. Daniel from Keysight basically have the green light earlier in the thread.

It was not about Daniel, it was about the forum's resident voluntary ethics police task force.
Facebook-free life and Rigol-free shack.
 

Offline MrBungle

  • Supporter
  • ****
  • Posts: 75
  • Country: au
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #62 on: March 09, 2017, 02:09:48 pm »
Nice point missage  :palm:
 

Online tautech

  • Super Contributor
  • ***
  • Posts: 28136
  • Country: nz
  • Taupaki Technologies Ltd. Siglent Distributor NZ.
    • Taupaki Technologies Ltd.
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #63 on: March 09, 2017, 06:44:59 pm »
If you can get a US$650 2CH 200MHz bandwidth 2GS 1M scope with function gen for that price then it's going to be very popular.
Quite possibly but you don't have to hack a SDS1202X+ @ $ 765 on promo with Decoders thrown in.
13M more memory depth too.

Damn, ok, that's really great value.
Yep.
Forgot to mention it's got AWG too and it's the MSO version but you have to buy the 16ch probe set and activation.
Avid Rabid Hobbyist
Siglent Youtube channel: https://www.youtube.com/@SiglentVideo/videos
 

Offline 3db

  • Frequent Contributor
  • **
  • Posts: 331
  • Country: gb
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #64 on: March 09, 2017, 06:54:55 pm »
I think Mike said he xrayed the board and didn't find anything?

Will those images be posted any time? What are people using to do xrays on boards; I'm guessing part of a BGA rework setup?

Mike bought an XRAY machine years ago.
3DB
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 13694
  • Country: gb
    • Mike's Electric Stuff
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #65 on: March 09, 2017, 08:26:52 pm »
I can set it to 50MHz, 100MHz, and 200MHz analog bandwidth and either 1GS or 2GS by twiddling resistor values. Haven't found 70MHz yet, although I found the boot option that displays that value. Video rendering tonight.

That is very impressive, in such short amount of time!  :-+

Also you might want to fiddle more with UART2 if you run out of other options to try. It seems very easy to trace the signals, since they use a very straightforward BGA fanout pattern (straight outwards from each quadrant). From those vias you can access the signals directly or trace them to the side connector and probe them over there. Maybe the UART2 doesnt output anything by default, but it might be capable of accepting input? Like a standard console with help functionality perhaps?

UART2 seems to operate at 115k2, as indicated by the initialization string:
Code: [Select]
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)0x1c200 = 115200
It must be initialized for a reason i suspect...
I tried sending <CR> and other characters during boot with no obvious effect
I suspect the initialisation thing is simply that part of the boot process setting up the UART, despite it previously having been initialised by the earlier boot process. UART2 is the one connected to the connector pads.
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #66 on: March 09, 2017, 08:50:44 pm »
uboot can likely be interrupted with the space bar.
VE7FM
 

Offline Dan Moos

  • Frequent Contributor
  • **
  • Posts: 357
  • Country: us
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #67 on: March 09, 2017, 08:56:47 pm »
Ethics police were already headed off at the pass. Daniel from Keysight basically have the green light earlier in the thread.

It was not about Daniel, it was about the forum's resident voluntary ethics police task force.
Yes, and those ethics police have nothing to get in a knot about, for the reasons I said.



Sent from my E6830 using Tapatalk

 

Offline EEVblogTopic starter

  • Administrator
  • *****
  • Posts: 37661
  • Country: au
    • EEVblog
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #68 on: March 09, 2017, 10:58:39 pm »
 
The following users thanked this post: bitseeker, S13, skander36

Offline mike1305

  • Contributor
  • Posts: 29
  • Country: us
  • Engineer by day, whisky by night
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #69 on: March 09, 2017, 11:04:11 pm »
This is hilarious!  :-DD only 9 days after launch...
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 13694
  • Country: gb
    • Mike's Electric Stuff
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #70 on: March 09, 2017, 11:04:18 pm »
Might have been useful to list the resistor values for the 200MHz "working" configuration...

There seemed to be some other fairly obvious config/build version resistors, two sets where only one of two R's was populated.

It would be interesting to see what, if any, differences you see in the outputs of the 74HC595 near the front-end.
I had a brief look, and there is a mux in there so it could be it's selecting between full and limited-bandwidth paths.
Didn't see anything that looked like a Rigol style varicap,   
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline suenrod

  • Supporter
  • ****
  • Posts: 5
  • Country: us
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #71 on: March 09, 2017, 11:17:44 pm »
Thanks for the work Dave! Now I just need the money to buy one. :-)
Before you criticize someone, you should walk a mile in their shoes. That way when you criticize them, you are a mile away from them and you have their shoes.
 

Offline Wonderbar

  • Newbie
  • Posts: 3
  • Country: af
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #72 on: March 09, 2017, 11:18:20 pm »
Regarding the "Revisions"

LP1 = Lab Prototype 1 (normal first prototype build with final design)
LP2 = Lab Prototype 2 (second interation)
PP = Production Prototype (Final production design to do tests with, dropping, climate chamber, EMC and such)

put those bad emissions on frequencies of the nearby radio station next to the testlab! So no one will know ;)
 

Offline HighVoltage

  • Super Contributor
  • ***
  • Posts: 5453
  • Country: de
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #73 on: March 10, 2017, 12:34:41 am »
Great videos, Dave.
Thanks
There are 3 kinds of people in this world, those who can count and those who can not.
 

Offline JPortici

  • Super Contributor
  • ***
  • Posts: 3452
  • Country: it
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #74 on: March 10, 2017, 06:15:24 am »
This is hilarious!  :-DD only 9 days after launch...
you are pretending this wasn't the plan all along
 
The following users thanked this post: GlowingGhoul


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf