EEVblog #978 - Keysight 1000X Hacking

[Bud]

Make it simple for me and give me a link or email. File size is 15Mb.

[Anthocyanina]

Make it simple for me and give me a link or email. File size is 15Mb.

Thank you, I've sent you a message with my email

[Anthocyanina]

I've tried the new firmware using Bud's provided file, and now the weird wrap-around issue is gone when you use ext trigger. the oscilloscope options still report memMax as an unlocked option, but it's now limited to the standard 1M of the 1102g, and it seems to be working great with any combination of channels/trigger source active. Thank again Bud! I'll make the new firmware file available today or tomorrow, still looking for a place to put it

[Anthocyanina]

Here's the packaged firmware with standard 1M memory and everything else liberated. This file will remain available on gofile as long as it's regularly downloaded https://gofile.io/d/joI7Gr

[miket6000]

Wow. I've not been back to this forum for a few months and just saw the work that's happened here. I've put my scope aside for a while as I was having trouble soldering the higher speed opamp and was working on another project. Great to hear you've made such great progress on fixing the strange running issue I noticed. I'll get the scope out of the box, fix up channel 2 and try it out ASAP.

Thanks!

[tsirvoulis]

hello
the link is inactive!!
has anyone else tried this firmware?

[Anthocyanina]

hello
the link is inactive!!
has anyone else tried this firmware?

i've uploaded it again. It only remains available if it's downloaded a lot, the link will last a few days if not downloaded regularly. here it is! https://gofile.io/d/6aOoHF

[tsirvoulis]

thank you Anthocyanina!!!!

i have install it, and now the weird issue is gone!!!!!

best regards from Greece

[Foxtrot813]

Hi!
First of all, thanks for the custom firmware Bud! 70 to 200 MHz is quite a difference 
But when I upgraded my scope, the serial decoder licenses (and maybe some others) didn't apply. I already tried to flash both 2 and 1 Mpt version. The training signals are also gone.
By reverting back to the original firmware, the serial licenses returns (the trial periods are active yet).
Is there anything that I should do before flashing the Bud's firmware?

[Anthocyanina]

Hi!
First of all, thanks for the custom firmware Bud! 70 to 200 MHz is quite a difference 
But when I upgraded my scope, the serial decoder licenses (and maybe some others) didn't apply. I already tried to flash both 2 and 1 Mpt version. The training signals are also gone.
By reverting back to the original firmware, the serial licenses returns (the trial periods are active yet).
Is there anything that I should do before flashing the Bud's firmware?

It worked for me without doing anything else, just installing the firmware. The only thing I can think that may be interfering is having the trial period active, and there is also a license "DIS" on your oscilloscope that i don't see in mine and don't know what that stands for. Maybe wait until the trial period is over and try Bud's liberated firmware again? 

[Foxtrot813]

It worked for me without doing anything else, just installing the firmware. The only thing I can think that may be interfering is having the trial period active, and there is also a license "DIS" on your oscilloscope that i don't see in mine and don't know what that stands for. Maybe wait until the trial period is over and try Bud's liberated firmware again? 

I guess I'll have to wait nearly a month then. 
Gotta keep my fingers crossed! 

[Bud]

Or you can open it up and hook up a UART adapter to see what is going on during boot.

[Foxtrot813]

Or you can open it up and hook up a UART adapter to see what is going on during boot.

I will, but first I'll just use the trial version until it expires to see if that's the case, I'm a bit lazy to get an UART adapter and disassemble the scope.  
Anyway, I'll post my findings once the trial period ends.

[Mwyann]

i've uploaded it again. It only remains available if it's downloaded a lot, the link will last a few days if not downloaded regularly. here it is! https://gofile.io/d/6aOoHF

Hi Anthocyanina, could you reupload this please? 

[Anthocyanina]

here it is! wish i had somewhere to keep it permanently https://gofile.io/d/K2rj0S

[Foxtrot813]

The trial period ended on my scope and then I flashed Bud's firmware again. Now it works with everything unlocked! 

[Bud]

Interesting! Thanks for sharing.

[liuxingkeji]

Hi Anthocyanina, could you reupload this please?

[Anthocyanina]

Hi Anthocyanina, could you reupload this please?

here it is!
https://gofile.io/d/osxVl9

[SteffK]

Sorry if this is in here somewhere, this is a very long thread!

Is the 1200 series hackable? Specifically the DSOX1202G

[Tesla02]

Bad news: https://community.element14.com/members-area/personalblogs/b/gough-lui-s-blog/posts/keysight-sbe-follow-up-1-dso-noise-dmm-calibration-post-teardown-more

DSO Hacking?
I think it’s probably no big secret that the Keysight Infiniivision oscilloscopes have long been the subject of various modifications and hacks to improve bandwidth and functionality. While this is definitely against the wishes of the manufacturer, it seems that individuals doing so have met various levels of success at their own risk.

As someone with a lot of scopes to choose from, I thought it would be interesting to see if the hacks documented for the 1000X series could be applied to the “related” EDUX1052G. The first thing to notice is that the new instruments seem to be Linux based, as opposed to the earlier Windows CE-based counterparts, so firmware/software hacks seem out of the question. Hardware hacks, however, still seem to be a possibility.

A quick search online turned up this post which listed the strapping IDs for this family. As an EDUX1052G, this unit would have an ID of 35. From the family, the logical “upgrade” would be to the DSOX202G which would unlock more memory and bandwidth up to 70MHz. A bit more looking around seemed to suggest the following strapping resistor configurations to be likely valid.

Tearing the unit apart again, I did identify the strapping resistors – although the ones on the board appeared to be a tenth the value listed on the posting. This is no issue, as they function as voltage dividers and only the ratio matters. It is just our luck that changing the 5 to a 3 just means swapping the top and bottom resistor of the second digit – which I managed to achieve.

After performing the modification and restarting, it seemed to have the increased bandwidth and memory, but retaining its original ID. However, it wasn’t entirely successful as the channel buttons and knobs for the math and regular channels did not function as expected, calling up other functions instead. Trying the button test feature, pressing all buttons, I was not able to activate those controls after the modification was done. I suspect this means that the front-panel matrix connection must be different between models despite having the same keypad layout, but I didn’t feel it worth the effort to try chasing that down. I suppose if one always uses the oscilloscope via the remote front-panel, that would be acceptable, but I just couldn’t see that happening for me.

In the end, I’d have to recommend that users don’t try this on their EDUX1052G. Not having a properly functioning front-panel interface is very frustrating, but furthermore, the whole procedure is quite involved and risks damaging the unit. The SMD resistors involved are very tiny – losing them or damaging them would make for a very bad day! Furthermore, the small bandwidth increase is very marginal, although the increased memory would be nice. In the end, I reverted the resistor configuration to the original and called it a day. There may have been a way to make it work … but frankly, I couldn’t be bothered to invest any more effort to try and track it down.

[Anthocyanina]

Hacking into the WinCE shell:

The attached script allows to drop into the WinCE operating system shell. From there you can browse around and explore the application files/data, run external tools from USB to explore the Registry, run DOOM, etc. You can connect a keyboard or mouse to the USB port. This is more of a tool to satisfy your curiosity rather than anything for normal scope use.

This tool is based on an other fellow's work published earlier in this thread. My contribution was to wrap it in a script to make it simple to use.

To try and further explore the scope, I've tried this, but when i connect a mouse or keyboard, they don't work. Do they have to be plugged in at the same time as the usb drive? Thank you!

[Bud]

I did not have or use a USB hub, it was likely i unplugged the USB drive after dropping to WinCE Shell and plugged the keyboard or mouse.

[Anthocyanina]

I did not have or use a USB hub, it was likely i unplugged the USB drive after dropping to WinCE Shell and plugged the keyboard or mouse.

I've tried with two different keyboards, and neither is recognized. not even the lights. Any idea what might be happening? even booting normally and plugging the keyboards does't work

[HighVoltage]

What is the "DIS" option on the 1000X and what does it do?