EEVblog #978 - Keysight 1000X Hacking

[Bud]

Have you done the trigger mod ?

https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg3217012/#msg3217012

[Bud]

Adding LAN interface:

None of the 1000X series scopes has Ethernet LAN interface. They are however capable of supporting one, which was reported on EEVBlog here:

https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg1347094/#msg1347094

The BLT module on the scope, the Uboot bootloader and the device’s Windows CE operating system support LAN if one is built (a physical layer PHY chip is required) and connected to the unpopulated connector J104 on the BLT module. User hv222 of EEVBlog kindly shared reversed engineered information on the connector here:

https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg2183900/#msg2183900

There was a trick however, that caused me a few days of headache and heavy troubleshooting trying to get going the LAN module that I built using the Microchip LAN8700 Ethernet PHY chip. I finally figured out that it was required to pull pin 39 of U104 to Ground in order to signal "LAN present" condition. Which I did and with the next reboot:

Code: [Select]

…
LAN PHY detected.
-EDeviceLoadEeprom 00:30:D3:20:D7:70
Phy found addr 31 (ticks=3225)
WaitForLink Start (ticks=3227)
No Link (ticks=4229)
<--EDeviceInitialize
GMAC DMA status register = 0x0
LIN: Data Valid
…
WaitForLink Start (ticks=6219)
Link Detected (ticks=6220)

GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
phyCfg->bFullDuplex 0x1
<--EDeviceInitialize

GMAC DMA status register = 0x600004
DriverStart
GMAC Device enable interrupt
cable attached

The System screen now showed a LAN interface:



To scan open ports on the EDUX I used the software called Angry IP Scanner (https://angryip.org/). This resulted in discovering a few open ports as shown in the following screenshot:



It can be seen that the scope has the following ports/services available:

• port 21: FTP
• port 23:  Telnet
• port 80: WEB HTTP interface
• port 443: not sure how it may be used, refuses connections from the browser using HTTPS
• port 111: unknown use
• ports 5024, 5025:  SCPI interface that provides access from Keysight IO Libraries and software like BenchVue over the network LAN interface.

With the LAN interface built and configured, you can use Telnet to remotely connect to the oscilloscope’s IP address using the following credentials:

Code: [Select]

User: infiniivision
Password: skywalker1977

Once logged in, you are in the Telnet Home folder and can run a DIR command to look around.


From here you can explore the file system and run commands supported by the Pocket CMD command line interpreter. You can copy, delete, rename files, run the executables located in \Windows and other folders, list processes, kill processes, reboot the scope, etc. There is a hidden folder \Secure which is not listed by the DIR command, but it is possible to get in by typing cd \Secure in the Telnet window. There are several subfolders inside there including the \Secure\Infiniivision\web folder.

[Bud]

The StupidBear LAN board for the EDUX provides 100Mbit/s full duplex network Ethernet connectivity. It also has a USB-to-UART bridge and a second USB Host port, which  were used for debugging and to connect a keyboard or mouse. They are not needed if only LAN is required. The board gets power from the main board. Refer to the PDF attachment for the schematic.





The board was designed to plug in to the installed mezzanine connector J104 on the  BLT board and then is secured to the main board's existing mounting poles via 2.5mm spacers. Raising the StupidBear LAN board above the main board by 2.5mm was required in order to maintain proper mating to the mezzanine connector J104 on the  BLT board. The  BLT board has to be unscrewed and lifted off, the LAN board is connected to it, then the entire assembly is carefully placed on the main board, and is secured with 4 BLT board screws and two new screws by the LAN connector (again, two 2.5mm spacers are needed under the LAN board to maintain proper height above the main board).



The stock scope does not have J104 soldered. The connector must be purchased and soldered onto the BLT board. The connector data:
Amphenol 61083-041402LF
Digikey part number: 609-1667-1-ND



Also attached is the BOM that has DigiKey part numbers for the critical components, and the Gerber files to order a PCB if you want to build a StupidBear LAN board for your Keysight 1000X including the EDUX model and have some fun.
Important: The LAN PCB thickness must be 1mm in order to have some clearance above the components under it on the scope's main PCB.

[Bud]

Using Keysight LXI (LAN eXtensions for Instrumentation) interface using Keysight BenchVue:

Keysight BenchVue is a software that provides virtual instrument panels for accessing and controlling  network devices supporting LXI interface over Ethernet. With the LAN interface added to the scope, BenchVue worked just fine (a trial version of BenchVue can be downloaded from Keysight web site). The following screenshot shows a session with the modified EDUX1002A scope on which the Wavegen was  unlocked too:



Custom software can be created in a number of usual ways in C, VB, VBA and other programming languages using Keysight I/O libraries.

Talking to LXI interface using telnet (port 5024):
With the LAN interface added it is possible to exchange SCPI commands and data with the scope just over Telnet using port 5024. Telnet credentials to log in to the scope are the same as for the regular Telnet connection provided earlier above. The following screenshot captured a few commands/responses exchanged that way:



Using WEB interface and FTP:
WEB server and  \Secure\Infiniivision\web folder is the home folder of the scope’s WEB server, the one you get connected to from outside using your favorite Internet browser to the scope’s IP address. On the 1000X the web folder is empty but you can put WEB pages and applications in it and use it just like a regular WEB server, within the limitations of web technologies supported by Windows CE 6.0. Regular WEB sites, ASP and JAVA pages seem to work fine, as long as the WEB pages do not attempt to interact with the operating system by calling or creating COM objects that may not exist or unsupported.

FTP root folder:
FTP connectivity using the same credentials as for Telnet. In the scope file system the FTP root folder is set to \Temp. Once connected, two other folders can be seen:



Using FTP, files and data can be copied to the scope and back, which can be used in conjunction with Telnet to explore and experiment with the device. The FTP storage is however volatile, data is lost after a reboot.

Webdata folder is mapped to \temp\webdata.
Webupdate folder is mapped to \Agilent Flash\webupdate , which is a hidden folder and may somehow be used for firmware updates over FTP, not sure. It is not accessible from the browser using HTTP.

[JiriB]

Yes, of course...
Update: **** CAL PASSED ****
A little bad soldering U9 / pin2
I am happy ))
Thank you.

[Bud]

Attached.

[Bud]

My posts #827 and #828 are now updated.

[Bud]

External Trigger reverse engineered schematic (with the External Trigger hardware mod in place).

[TK]

The StupidBear LAN board for the EDUX provides 100Mbit/s full duplex network Ethernet connectivity. It also has a USB-to-UART bridge and a second USB Host port, which  were used for debugging and to connect a keyboard or mouse. They are not needed if only LAN is required. The board gets power from the main board. Refer to the PDF attachment for the schematic.





The board was designed to plug in to the installed mezzanine connector J104 on the  BLT board and then is secured to the main board's existing mounting poles via 2.5mm standoffs. Raising the StupidBear LAN board above the main board by 2.5mm was required in order to maintain proper mating to the mezzanine connector J104 on the  BLT board. The  BLT board has to be unscrewed and lifted off, the LAN board is connected to it, then the entire assembly is carefully placed on the main board, and is secured with 4 BLT board screws and two new screws by the LAN connector (again, two 2.5mm standoffs are needed under the LAN board to maintain proper height above the main board).



The stock scope does not have J104 soldered. The connector must be purchased and soldered onto the BLT board. The connector data:
Amphenol 61083-041402LF
Digikey part number: 609-1667-1-ND



Also attached is the BOM that has DigiKey part numbers for the critical components, and the Gerber files to order a PCB if you want to build a StupidBear LAN board for your Keysight 1000X including the EDUX model and have some fun.

Nice board!

[wxqhigh]

Hi everyone
I'm  considering about moddinng the WaveGEN recently , but i’m stucking on some problems
(Thank you for the schematic provided by hv122)
Yeah..we have the schematic..but how to confirm the capacitors and inductors even FB's value?

[Bud]

Here is the function generator schematic with the LPF filter values that I used. The LPF was designed for 40MHz cut-off frequency.
I did not use the output filter C29 L7 L8 C30. Jumpers were used instead of inductors L7/L8.

The generator requires populating the unused parts in the power supply section on the main PCB for +/-15V and +/-5V supply rails. Attached is a photo of the populated +/-15V section.
Digikey part numbers for the additional aluminum capacitors:
470uF 35V  P18963CT-ND      Qty 2
100uF 50V  493-2306-1-ND   Qty 2

The positive 15V voltage regulator Digikey P/N:
MC78M15CTTRKGOSCT-ND

I did not keep the bag from the negative 15V rail regulator but I suppose it was Digikey P/N:
MC79M15CDTRKGOSCT-ND

The +/-5V power supply section is on the bottom side of the main board next to the power supply connector. There are two ICs: U17 (LM79L05) and U18 (LM78L05) and a few capacitors around them that need to be populated.

Some Digikey part numbers I used for the function generator:
Resistor array 4x10K 1206   CRA6S810.0KACT-ND  Qty 2
Resistor array 4x100K 1206  Y9104CT-ND  Qty 2
Resistor 18 Ohm 2512 1W    541-18.0AFCT-ND  Qty 3
Relay DPDT 4.5VDC  255-5466-1-ND   Qty 2 (you need one more for External Trigger mod)
IC Quad Comparator  LM339AMX/NOPBCT-ND   Qty 1
IC NOR Gate MC74ACT02DGOS-ND  Qty 1
Diode array BAV99  1727-4311-1-ND  Qty 4

[wxqhigh]

WOw,thanks！

[Bud]

Have fun, as much or more as I had working on the mods. The EDUX1002A is a treasure, it was incredible fun working with it to update it from the lowest model in the series to the highest one and actually overpassing the highest DSOX1102G 2-channel model in the series because of addition of the LAN port and 2MPoints acquisition memory. The EDUX1002A is like Keysight version of Flir E4 which was I also had a lot of fun with upgrading. 

[wxqhigh]

Have fun, as much or more as I had working on the mods. The EDUX1002A is a treasure, it was incredible fun working with it to update it from the lowest model in the series to the highest one and actually overpassing the highest DSOX1102G 2-channel model in the series because of addition of the LAN port. The EDUX1002A is like Keysight version of Flir E4 which was I also had a lot of fun with upgrading. 

Exactly , by the way，I got a EDUX1052A few days ago and I'm going to take it apart
Waitting my photos

[JDubU]

Bud,

Do you recall what you used for L6 and L10? 
They are on your separate schematic for the VP15_FG and VM15_FG supplies.

[Bud]

Just some regular 1A-2A ferrite beads that i had in the parts bin, i did not buy anything special. This is not a critical part.

[wxqhigh]

Tadaaaa New KEYSIGHT EDUX1052A Teardown
It's almost identical to previous 1000x version
New features:
1.LAN port(MicroChip 8710A)
2.Fan controller(LP2951)
3.The frontend removes two capacitors and one resistor,using OPA4872 instead of LMH6574 and changing some resistor's value.
4.Larger RAM and ROM in BLT board,It may be designed to adapt new Linux sysytem and 2M memory depth.(Now has 256M rom and 128M ram(for MegaZOOM asic),Old 1000x has 128M rom and 64M ram)

[wxqhigh]

This bnc jack is well fitted and made by Dosin China. (It's also difficult to find in China,this bnc jack is finest quality that i can find in mass production)

Part number:801-0033, (https://www.china-guan.com/product-item/dosin-801-0033)

BUY here: https://detail.1688.com/offer/657779171916.html?spm=a26286.8292848.success-action.2.b308749fX3nwpG
(I have confirmed they can express to forign countries)

Update:
Another high quality BNC jack,It seems better than Dosin and much cheaper than Doisn,showing in picture BNC3.
BUY here: https://detail.1688.com/offer/627726966672.html?spm=a261y.7663282.combination.5.2cb465d0GekFEA

[EinErik]

Hi all,

Meet problems here, my EDUX1002G show no waves at all.
Product config is set to be 24, FW=1.20 patched; no other hardware mod is performed.
I re-installed the official FW1.20 but still failed and showed same error.

Self test failed: ADC:TrigComp & MUX
User test is unable to finish.
The boot log via UART mainly says:

HARDWARE ERROR!!!!! ******** I-Clock failure ******** (12)
HARDWARE ERROR!!!!! ******** Timeout while trying to stop Talon clocks ******** (2)
HARDWARE ERROR!!!!! ******** P-Clock failure ******** (13)
HARDWARE ERROR!!!!! ******** Timeout while trying to stop Talon clocks ******** (2)
 
I have no idea what's gone wrong here, it's so frustrating as I am new to hack hardwares and it's my first scope.
Please, can anyone help? Appreciate any help or comment.

Regards,
Eric

Code: [Select]


U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
 
CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB
 
Debug serial initialized ........OK
RTC: 2024-21-6   7:88:5.6 UTC
 
Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
 
PHY not found.
 
System ready!
Preparing for download...
RTC: 2024-21-6   7:88:5.6 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN
 
X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOOXXOXOXXOXXOOOXOOOXXOOXOXOOOOXOXOOOOOXOOOXOOXOXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOX
OOOOOOXOOOXOOXOOOOXOOOOXOOXXOOXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXXOOXOOXOXOOOXOOOXOOXXOXOXOOOXOXXXXXOXOXXXOXXXOXOXXOOOXXXOXXXXXXXXOXXXXXXXOXXXXOXOXXOXOOOXXXXXOXXXXOOOXOXXOOX
XXOXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOOXOXOOOXOOXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1A857C0, LaunchAddr = 0x80362000
 
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1A857C0  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2024-21-6   7:88:5.9 UTC
Launching windows CE image by jumping at address 0x  362000
 
Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jun 10 2019)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
LAN PHY NOT detected.
DeleteP500EnetRegistry:
   \Comm\GMAC 0x0
   \Comm\GMAC1 0x0
   \Comm\Tcpip\Linkage 0x0
   \Drivers\Virtual 0x0
   \Drivers\BuiltIn\LIN 0x5
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Device load time:
   NANDFLASH: 0 ms
   SNANDFLASH: 0 ms
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
LaunchInfiniiVision:
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
Released build, Jun 10 2019, 21:13:39
Initializing FPGA...
************************************
Ver: 1.067 Released
************************************
*** Liberating License: Acq Memory Max
*** Liberating License: Embedded serial decode and trigger
*** Liberating License: Automotive serial decode and trigger
*** Liberating License: Flex Ray serial decode
*** Liberating License: Power application
*** Liberating License: Segmented Memory
*** Liberating License: Mask limit testing
*** Liberating License: Telecom Mask Test
*** Liberating License: 500MHz Bandwidth
*** Liberating License: 200MHz Bandwidth
*** Liberating License: Audio serial decode and trigger
*** Liberating License: Education kit license
*** Liberating License: WaveGen license
*** Liberating License: 1553 & 429 serial decodes
*** Liberating License: Enhanced Video Triggering
*** Liberating License: Advance Math
*** Liberating License: Flex Ray Plus
*** Liberating License: Digital Voltmeter
*** Liberating License: ASV
*** Liberating License: Cable Calibration
*** Liberating License: Infiniium Mode
*** Liberating License: Remote Log
*** Liberating License: Circular Segmented Memory
*** Liberating License: Tomotherapy
*** Liberating License: F8AEAE82
Calibration mode User
Cal Date Tue Feb 23 08:31:11 2021
Expected 0x38 got 0x0
HARDWARE ERROR!!!!! ******** I-Clock failure ******** (12)
HARDWARE ERROR!!!!! ******** Timeout while trying to stop Talon clocks ******** (2)
Expected 0x38 got 0xc6 Baldwin 0 (Master = 0, Slave = 1)
Continuing as if there weren't a problem
HARDWARE ERROR!!!!! ******** P-Clock failure ******** (13)
Startup sequence is complete.
HARDWARE ERROR!!!!! ******** Timeout while trying to stop Talon clocks ******** (2)
HARDWARE ERROR!!!!! ******** Timeout while trying to stop Talon clocks ******** (2)
HARDWARE ERROR!!!!! ******** Timeout while trying to stop Talon clocks ******** (2)
HARDWARE ERROR!!!!! ******** Timeout while trying to stop Talon clocks ******** (2)
System has been running 14.704744 seconds
Start Up Sequence 5.387492
Memory Load 50%
   System Physical Memory 36.211 / 73.465 MB
   Process Virtual Memory 44.750 / 1024.000 MB
-----> InfiniiVision is running <-----
will do USB phy workaround: CheckCRC
HARDWARE ERROR!!!!! ******** Timeout while trying to stop Talon clocks ******** (2)
HARDWARE ERROR!!!!! ******** Timeout while trying to stop Talon clocks ******** (2)



[JDubU]

Assuming that you removed the BLT board to get to the config resistors, carefully check all of the BLT and matching motherboard connectors, including their solder joints, for damage.

[Bud]

Could be incorrect strapping resistors value or position. Double check the product ID config for 1102G

You only change resistors on the main board, not on BLT board.

[JDubU]

Config resistors are on the main board but the connectors can be damaged when removing the BLT board to get access to them.  Those board to board connectors can be very tight and require significant force to separate them.

[wxqhigh]

I use these filter showing in pictures, all parts are easy to buy and make full use of them.
(NOT offical values,unless someone will measure and share them )

https://rf-tools.com/lc-filter/

The  0603 ferrite beads near EL5166ISZ and EL5166ISZ which you can get them from channel 1,2.(only EDU version)
I use TDK MPZ2012S601AT000 as another 0805 ferrite bead.(600 OHM@100MHZ 2A)

[wxqhigh]

Hi Bud, I have a question, what’s the meaning of this part and how to set C13's value?
Thanks!

[Bud]

The value is in the PDF version of the schematic in reply #835. It was selected based on minimum ringing  in a circuit simulator with  step voltage applied to pin 3.