Agilent MSO 5000/6000/7000 - anyone hacked these scopes?

[HighVoltage]

OK, I got my DSOX6000A today and tried telnet.
I am getting the login screen the same way as on my 7000 series scope.
But ...
 infiniivision / skywalker1977
does NOT work

[mikeselectricstuff]

There is a different login on the x series - it's mentioned in the 2000/3000X thread somewhere ( but doesn't work on the MSOX30104T)

[HighVoltage]

With a BIG THANK YOU to memset, I was able to hack my DSOX6004A partially so far.

This DSO-X-6004A had all options installed from the factory, except:
Limited to 1 GHz and no MSO

I don't care too much about the MSO feature, but I really would like to have the 6 GHz activated.
And here is the problem, I am getting it only modified to 2.5 GHz

The procedure is similar to the 3000X series and you can find everything here:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg989301/#msg989301

The file structure is a little different and on the 6000X series, the startup folder is hiding in:
\System\startup

Log in with telnet and then copy the lnk file from USB to this startup folder works well.

Here is a picture of my normal setup (No modification)

[HighVoltage]

Here is the change to 2.5 GHz and MSO only

infiniivsion_ext.lnk:
64#\System\infiniivision\infiniivisionlauncher.exe -l MSO -l BW250

Interestingly, it adds the MEMUP, SGM, ADVMATH without having it in the lnk file

MSO and Bandwidth to 2.5 GHz work well

[HighVoltage]

And here is my Full Options lnk file

infiniivsion_ext.lnk:
254#\System\infiniivision\infiniivisionlauncher.exe -l MSO -l BW250 -l FPGAX -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SMG -l MASK -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVMCTR -l USBFL -l USBH -l USBSQ -l SENSOR -l CANFD -l JITTER

But, no matter what I try, the Bandwidth will not go higher than 2.5 GHz

BW400 not working
BW600 not working
BW6, BW6000 BW60 also not working

Anyone here have an idea of what to try?

But having it at 2.5 GHz is already really great.
Seeing the MTB at 100 ps resolution and working for the first time is more than great.

Thanks again memset !

[TheSteve]

Any chance adding multiple bw license options might help such as: -l BW250 -l BW400 -l BW600

[HighVoltage]

Any chance adding multiple bw license options might help such as: -l BW250 -l BW400 -l BW600

TheSteve,
What a great idea, thank you!
4 GHz is working with the combination "-l BW250 -l BW400"
Now lets try 6 GHz ....

[memset]

Nice catch TheSteve! I think 6 should work this way too.

[HighVoltage]

Even better:
6GHz is working perfectly!
But the smallest Time Base is staying at 100 ps, same as with 2.5 GHz and 4 GHz
The original smallest time base was 500 ps at the 1 GHz setting.

infiniivsion_ext.lnk:
91#\System\infiniivision\infiniivisionlauncher.exe -l MSO -l BW250 -l BW250 -l BW400 -l BW600


Now lets add all the other options again

[TheSteve]

If you thought 1 GHz active probes were expensive, just think of the money you can spend now!

[memset]

Now lets add all the other options again

250 option used twice? Also don't forget not to exceed 260 byte file length in total.

[HighVoltage]

250 option used twice? Also don't forget not to exceed 260 byte file length in total.

Ahhh!
When I added all options again, I was at 272 bytes
Removed: MEMUP, SGM, ADVMATH (since they showed up anyways) and made a last lnk file

infiniivsion_ext.lnk:
246#\System\infiniivision\infiniivisionlauncher.exe -l MSO  -l BW250 -l BW400 -l BW600 -l FPGAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l MASK -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l DVMCTR -l USBFL -l USBH -l USBSQ -l SENSOR -l CANFD -l JITTER

All working!
But I am still surprised that 100 ps is the smallest time base setting.

Thank you all
This might be the first hacked 6000X series scope?

[HighVoltage]

If you thought 1 GHz active probes were expensive, just think of the money you can spend now!

I know, oh my!
I have a few 1.5 GHz differential and active probes.
Now the hunt starts for 6 GHz probes.

Plus it seems I need a faster pulse gen.
For the fist time this 450 ps pulse is too slow.

[Berni]

Nice one . That is a surprisingly easy hack once you know what to do.

Hope you have a deep wallet for those 6GHz probes indeed. I got my hands on a presumably broken one with the plastic case missing but when plugging it in it worked!

Oh and by the way getting a pulse fast enough to push 6GHz to its limit is not easy at all. The best i could get out of a jim williams pulse circuit is 150ps. Only way i got to generating signals this fast is my boatanchor 20GHz RF synthesizer.

[Howardlong]

If you thought 1 GHz active probes were expensive, just think of the money you can spend now!

I know, oh my!
I have a few 1.5 GHz differential and active probes.
Now the hunt starts for 6 GHz probes.

Plus it seems I need a faster pulse gen.
For the fist time this 450 ps pulse is too slow.

If you can deal with the loading, 54006a lo-z probes turn up on ebay quite regularly, although as I write there's slim pickings. Make sure they have all parts including the SMA cable (itself worth a few bob), through capacitor, reassuringly branded BNC-SMA, walking sticks and spare resistors.

Another option although it's only good to 2.5GHz is the 1152A. Again, check for all the bits & pieces, and check it's compatible with your scope, some of these probes dropped off the supported list of newer Agisights, but you can work around that, either with a resistor if you open up the probe or by using an external board.

https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg868073/#msg868073

http://www.alciom.com/images/stories/downloads/powerprobe%201a.pdf

[rx8pilot]

My 6ghz X6000 only goes to 100ps. I guess that is normal, but I was thinking it should be 50ps.

Sent from my horrible mobile....

[HighVoltage]

My 6ghz X6000 only goes to 100ps. I guess that is normal, but I was thinking it should be 50ps.

Sent from my horrible mobile....

Thank Carlos, you for confirming this.

It is indeed interesting:
1 GHz = 500 ps
2.5 GHz = 100 ps
4 GHz = 100 ps
6 GHz = 100 ps

I also expected 50 ps as a smallest setting for the time base.

Yes, time to look for probes.
But since not to many companies buy these probes and put them on a second market, I might have to wait a long time.

[plesa]

Wow, nice hack, I hope it will makes 6kX series more attractive:)

[HighVoltage]

Just for completeness:

I used the scope all day long today and had no issues at all.
Then I removed the .lnk file and updated the FW to 06.12.2016010702
And then I reinstalled the .lnk file.

All working as expected.

[rx8pilot]

Yes, time to look for probes.
But since not to many companies buy these probes and put them on a second market, I might have to wait a long time.

I suspect it will take a long time for me to acquire the appropriate probes for this scope. So far I only have 4x 500Mhz 10:1 passives and two 100mhz differential amplifiers.

Needed:
2x DC current probes >30Mhz >30A continuous
4x 2.5Ghz single ended active probes for daily use
2x 6Ghz diff probes
1x HV differential low frequency probes for AC power analysis.

Not cheap, but at least there is a business to justify the expense. Looking for deals, but can only wait so long. As soon as I am able to start on my next design, it will define what probes are needed first. The scope is like a camera without a lens. A dedicated photographer always wants a huge variety of lenses to capture the moment just right. Some lenses rarely get used.

[Howardlong]

YMMV of course, but 99% the time I still probe with light-weight miniature passive Hi-Z probes. Maybe once a week or two I break out the expensive probes. These probes simply tend to be fiddly to set up logistically, either because you need to solder in a probe point or because there is usually no concept of just clipping onto a signal, you have to either hand hold it or set up a clamp/balancing jig. Some of these probes also include expensive consumables like tip resistors: as an example, this'll make you cringe, $44 for _one_ resistor tip, a diff probe needs two:

http://www.ebay.co.uk/itm/01131-62102-01131-62107-for-E2658A-E2663A-E2668A-E2669A-E2675A-E2676A-/231422124137

[rx8pilot]

There is nothing inexpensive at this bandwidth, thats for sure. It's not just technically challenging, but also generally associated with business which adds up to big prices.

Sent from my horrible mobile....

[Berni]

Yeah most of the time the fancy active probes sit in a box. But when a need for one comes up they save the day. Yesterday i used one of my probes to check if a 330MHz differential MIPI clock had good integrity (Tiny signal, picky loading, commonmode crap etc makes it difficult to do with a regular probe), before that the probes was last used months ago id guess.

The diff probe i have makes use of regular trough hole resistors by giving you a coax to female header adapter along with a pack of resistors. This means i can use any cheep resistor as long as the pin is the same thickness. Downside tho is that the resistor pins are too thick for fine pitch chips.

[HighVoltage]

Downside tho is that the resistor pins are too thick for fine pitch chips.

What model probe is this?
Can you show a picture of this ?

[Berni]

What model probe is this?
Can you show a picture of this ?

It is part of the "E2669A InfiniiMax Differential/Single-ended Connectivity Kit" that i got it with the Agilent 1131A Diff probe(3.5GHz), its missing parts but the one of interest is the 3rd cable from top to bottom in the photo.
http://www.keysight.com/en/pd-339402-pn-E2669A/infiniimax-differential-connectivity-kit?cc=SI&lc=eng

The other one above is is direct solder in using some super tiny trough hole resistors that actually have a square body instead of round. Those probably work for 0.5mm pitch chips but i never used it.