Author Topic: EEVblog #978 - Keysight 1000X Hacking  (Read 422921 times)

0 Members and 3 Guests are viewing this topic.

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #375 on: June 14, 2017, 07:21:34 pm »
Thank you Bud.

More tests results: CH1 (yellow) is unmodded, CH2 (green) is modded, now with bypassed low pass filter outside LMH6552.

Tested 1MHz, 50MHz, 100MHz, 200MHz and 250MHz.  Then 1MHz -40dBm signal using 2mV/div setting on the scope.
I think the delay between CH1 and CH2 is because of the elimination of the extra opamp before the differential path.








I was not able to measure the values of the caps and inductors... I don't have the appropriate instrument.
« Last Edit: June 14, 2017, 10:13:55 pm by TK »
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 6877
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #376 on: June 14, 2017, 09:36:18 pm »
So this is the best result so far, isn't it. After removing the LPF you are getting what, maybe 170MHZ 3dB bandwidth or something. Can you find someone to help you measure the LPF components?

Also try 200MHz 16mV p-p at 2mV/ to exlude the attenuator from the path, to see if some of the roll-off is because of the attenuator.

Looks this puppy may be a great buy, providing everything else works with this hack.
Facebook-free life and Rigol-free shack.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #377 on: June 14, 2017, 09:59:56 pm »
So this is the best result so far, isn't it. After removing the LPF you are getting what, maybe 170MHZ 3dB bandwidth or something. Can you find someone to help you measure the LPF components?

Also try 200MHz 16mV p-p at 2mV/ to exlude the attenuator from the path, to see if some of the roll-off is because of the attenuator.

Looks this puppy may be a great buy, providing everything else works with this hack.
I need to find the values and make the substitution, CH2 is noisy without the LPF, but the hack looks promising
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #378 on: June 14, 2017, 11:52:37 pm »
The DSOX3000 200MHz scope has C1,C2 = 4.7pF and L2,L3 = 47nH in the LPF outside the differential opamp.  If I use the same values in my 1000X, I should get a LPF with cutoff frequency above 200MHz, right?

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg987126/#msg987126

Ordered the parts from mouser... next week I will post the results.
« Last Edit: June 15, 2017, 12:54:23 am by TK »
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3742
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #379 on: June 15, 2017, 01:48:47 am »
I am not sure if the inductors in the 200 MHz version of the scope are really 47 nH, they might be 30 nH.
VE7FM
 
The following users thanked this post: TK

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #380 on: June 15, 2017, 02:25:39 am »
What can happen if I use the values of the 500MHz frontend LPF?

Ordered more parts from mouser to try, I will also test 30nH
« Last Edit: June 15, 2017, 02:37:44 am by TK »
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3742
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #381 on: June 15, 2017, 03:13:08 am »
I'll do my best to measure one of the inductors from a 200 MHz front end tomorrow. I have the gear but need to build a jig to connect the 0603 sized part to my VNA.
I doubt you'll get to 500 MHz with the 1000 - aiming for 200 MHz is a good target.

So nobody with a stock DSOX1102 has wanted to try enabling the 200 MHz license to see what happens?
VE7FM
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 6877
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #382 on: June 15, 2017, 03:51:20 am »
I am not sure if the inductors in the 200 MHz version of the scope are really 47 nH, they might be 30 nH.

30nH seems to be too small, a sim shows the filter 3dB BW almost at 400MHz.  47nH looks OK.
Facebook-free life and Rigol-free shack.
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 6877
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #383 on: June 15, 2017, 03:57:52 am »
I doubt you'll get to 500 MHz with the 1000 - aiming for 200 MHz is a good target.

It already rolls off too much at 200, perhaps being limited by what is in front of the buffer amplifier, or by non optimal PCB tracks layout for that frequency range.
Even with 200 it looks a good value for the money.
Facebook-free life and Rigol-free shack.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #384 on: June 15, 2017, 11:19:27 am »
Sorry for the confusion, I just wanted to ask what the side effects could be by using the LPF components of the 500MHz front end, as they are the only known and confirmed values.
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 6877
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #385 on: June 15, 2017, 12:23:17 pm »
A noisier trace, because of the wider noise bandwidth.
Facebook-free life and Rigol-free shack.
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3742
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #386 on: June 17, 2017, 05:40:55 am »
Just wanted to confirm the 200 MHz low pass filter in the DSOX3000 series of scopes uses a 47nH inductor. I tried like heck to get a better focus on the jig itself without success. It is an SMA jack with a tiny pogo pin that will hold 0603 sized parts.
edit - added the capacitor as well which does appear to be 4.7 pF.
« Last Edit: June 17, 2017, 05:45:25 am by TheSteve »
VE7FM
 
The following users thanked this post: Bud, tek2232, TK, skander36

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #387 on: June 17, 2017, 01:21:15 pm »
Just wanted to confirm the 200 MHz low pass filter in the DSOX3000 series of scopes uses a 47nH inductor. I tried like heck to get a better focus on the jig itself without success. It is an SMA jack with a tiny pogo pin that will hold 0603 sized parts.
edit - added the capacitor as well which does appear to be 4.7 pF.
Thank you for measuring the components.  Nice fixture for the Network Analyzer!!!
 

Offline nickdepinet

  • Supporter
  • ****
  • Posts: 14
  • Country: us
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #388 on: June 17, 2017, 02:50:56 pm »
I've been working with TK on the software unlocks side of things, and it looks like the 1000x series is in the same spot as the 3000T. However, we don't yet have an unlocked infiniivisionlauncher.exe (maybe in the first firmware update?) to look through. I'm going to investigate the new 3000T one and see what differences we can find there. We've been proceeding carefully because without a Lan port unbricking the scope looks to be difficult to impossible. Additionally, we can't fake the installed licenses on the scope without finding the key and algorithm used to generate the signatures, each stored license is signed.

I can't test the 200Mhz performance from the software unlock we have currently on my DSOX, so if someone with a 100Mhz DSOX and the ability to test the 200Mhz performance wants to try it out and help us see what the hardware limitations are on the DSOX line please PM me.

 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #389 on: June 17, 2017, 03:01:24 pm »
I tested rise time on the unmodded (CH1 yellow) and modded (CH2 green no LPF after differential opamp) channels.  Signal is eMMC clock signal from BeagleBone Green board.




As a comparison, I only get 6.5ns rise time on the micsic TO1104 (1GSa/s 4 channel table scope).  Actually, to be fair to the micsig, I would like to comment that the EDUX I have has the personality set to DSOX and it has the software hack that enabled 200MHz.  I am using the same 200MHz probes on both tests.



« Last Edit: June 17, 2017, 03:14:07 pm by TK »
 

Offline nickdepinet

  • Supporter
  • ****
  • Posts: 14
  • Country: us
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #390 on: June 17, 2017, 11:04:13 pm »
So with some raspberry pi jankiness I can generate a 200Mhz signalTM. This is really the limit of what you can get out of the GPIO pins on a raspberry pi, so things are a lot wonky...

However, if we only look at the voltage measurements on my DSOX1102G - 200Hz signal gives us 4.5 volts.

Things get really wonky at high frequencies - the raspberry pi really doesn't like generating this signal... But, we can see some interesting voltages:

Stock Firmware: 2.38V -- That's a loss of ~5.5dB
Unlocked Firmware: 3.43V -- That's a loss of ~2.4dB

So it looks like the DSOX line can natively do over 200Mhz with only software tweaks - no hardware mods needed... We just need to figure out unlocking 200Mhz while retaining access to licenses - modded software removes all licensed options and can't install any new ones (reverting to stock software re-enables these). Additionally - the modded software removes the limits on the wave gen (Can set crazy values like 200Mhz pulse) - but doesn't actually output any signal  :(

 
The following users thanked this post: TK

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #391 on: June 23, 2017, 09:29:18 pm »
Hardware mod for CH2 is done.  200MHz using the software hack infiniivisionLauncher.exe from Secure.  It can get comfortably up to 200MHz and 215MHz is kind of the absolute max regarding frequency measurement.

I got an MSOX2004A the other day and I compared the modded EDUX to the MSOX2004A (software hacked to 200MHz).  The MSOX2004A can get up to around 350MHz.

In the pictures CH1 (yellow) is the unmodded channel, CH2 (green) is the modded channel.













« Last Edit: June 23, 2017, 09:33:33 pm by TK »
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3742
  • Country: ca
  • Living the Dream
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #392 on: June 23, 2017, 09:40:08 pm »
Hardware mod for CH2 is done.  200MHz using the software hack infiniivisionLauncher.exe from Secure.  It can get comfortably up to 200MHz and 215MHz is kind of the absolute max regarding frequency measurement.

I got an MSOX2004A the other day and I compared the modded EDUX to the MSOX2004A (software hacked to 200MHz).  The MSOX2004A can get up to around 350MHz.


What is is most important is the -3 dB point or the scopes rise time. The MSOX2004A should have a -3 dB point around 230 MHz.
Can you measure that on both? Feed in 1 Vpp with a 50 ohm termination and increase the frequency until you you get to .707 Vpp. The amplitude should also remain quite flat as the frequency is increased with no sudden peaks or drops.

edit - I should add that I believe it may be possible to get the MSOX2004A up to 500 MHz bw with some part swaps, this isn't confirmed though.
« Last Edit: June 23, 2017, 09:49:30 pm by TheSteve »
VE7FM
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 6877
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #393 on: June 24, 2017, 04:07:11 am »
200MHz using the software hack infiniivisionLauncher.exe from Secure. 

While you are fresh at it, can you post a link to the software hack procedure ?
Facebook-free life and Rigol-free shack.
 

Offline JiriB

  • Contributor
  • Posts: 13
  • Country: cz
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #394 on: June 24, 2017, 08:13:34 am »
Yes, BenchVue with EDUX works great. Test Flow will allow you to program, for example, sweep (https://community.keysight.com/thread/25100). You need a license or 30-day trial.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #395 on: June 24, 2017, 01:03:53 pm »
200MHz using the software hack infiniivisionLauncher.exe from Secure. 

While you are fresh at it, can you post a link to the software hack procedure ?
I detailed the procedure here: https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg1224021/#msg1224021

This is the makecab configuration file I used:

Code: [Select]
.OPTION EXPLICIT

;    CabinetNameTemplate is the name of the output CAB file:

.Set CabinetNameTemplate=1000X.link.install.ksx

.Set DiskDirectory1=.
.Set CompressionType=MSZIP
.Set Cabinet=on
.Set Compress=on
.Set CabinetFileCountThreshold=0
.Set FolderFileCountThreshold=0
.Set FolderSizeThreshold=0
.Set MaxCabinetSize=0
.Set MaxDiskFileCount=0
.Set MaxDiskSize=0

1000X.link.install\infiniiVisionSetup.cab

1000X.link.install\install.xml

I started with the V421_link_install method, renaming and modifying recipe.xml to install.xml

The infiniivision.lnk file content I used:

Code: [Select]
62#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l BW10
But it is not taking the options.  Even with BW10 it activates 200MHz but no other software option and you lose the official licenses while you are in hacked mode.

 

Offline JiriB

  • Contributor
  • Posts: 13
  • Country: cz
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #396 on: June 26, 2017, 07:35:07 am »
Why 62 # and not 63 #?
LEN("#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l BW10") = 63
Opinions counting # differ... :(
Thanks
« Last Edit: June 26, 2017, 08:41:54 am by JiriB »
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #397 on: June 26, 2017, 12:07:56 pm »
You must count the characters AFTER #
 

Offline Keysight DanielBogdanoff

  • Supporter
  • ****
  • Posts: 777
  • Country: us
  • ALL THE SCOPES!
    • Keysight Scopes YouTube channel
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #398 on: June 26, 2017, 06:10:20 pm »
Additionally - the modded software removes the limits on the wave gen (Can set crazy values like 200Mhz pulse) - but doesn't actually output any signal  :(

It's not unreasonable to get extra capabilities out of the WaveGen, we limit it now to match specs. But, you theoretically could get a "souped-up" WaveGen that has questionable specs. For example, it's probably trying to do the pulse you described but can't get there. But, you could likely push it beyond current as-shipped limits.
 
The following users thanked this post: Sigurd

Offline bitseeker

  • Super Contributor
  • ***
  • Posts: 9057
  • Country: us
  • Lots of engineer-tweakable parts inside!
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #399 on: June 26, 2017, 09:44:30 pm »
That sounds like classic HP gear. You can push them beyond the specified limits, but there's no guarantee they'll deliver the stated accuracy when doing so.
TEA is the way. | TEA Time channel
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf