Author Topic: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?  (Read 1119379 times)

0 Members and 4 Guests are viewing this topic.

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3753
  • Country: ca
  • Living the Dream
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2575 on: December 15, 2020, 08:03:55 pm »
Ok.

False alarm.

It's be me stupid and sticky keyboard  :horse:

full unlock and 500MHz

Thank you for all work you have done here.

and Thank you for help me to go trough even those who want to charge me 650 for someone else work. :-+

I try to contribute more to this forum to pay back

Who was trying to charge you $650 to hack your scope?

edit - I was sent a PM with the username of the person, all I can say is that it is disgusting that someone would offer such a service.
« Last Edit: December 15, 2020, 08:36:46 pm by TheSteve »
VE7FM
 
The following users thanked this post: 2N3055

Offline Xavier64

  • Contributor
  • Posts: 35
  • Country: gi
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2576 on: December 19, 2020, 10:31:31 am »
Does anyone have the 7.35 Firmware already patched ?


Thanks in advance.
 

Offline Mr. Scram

  • Super Contributor
  • ***
  • Posts: 9810
  • Country: 00
  • Display aficionado
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2577 on: December 20, 2020, 04:36:05 pm »
Who was trying to charge you $650 to hack your scope?

edit - I was sent a PM with the username of the person, all I can say is that it is disgusting that someone would offer such a service.
Consider informing Dave. That's not even a silly overstepping of boundaries, but ruthless exploitative behaviour.
 

Offline Saskia

  • Super Contributor
  • ***
  • Posts: 2893
  • Country: de
  • you unlock this door with the key of imagination
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2578 on: December 24, 2020, 07:25:49 pm »
Who was trying to charge you $650 to hack your scope?

edit - I was sent a PM with the username of the person, all I can say is that it is disgusting that someone would offer such a service.
Consider informing Dave. That's not even a silly overstepping of boundaries, but ruthless exploitative behaviour.

I'd say it's not just disgusting, but outright criminal.
 

Offline olento

  • Newbie
  • Posts: 1
  • Country: fi
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2579 on: December 25, 2020, 04:49:07 pm »

An update: I took the plunge and have now achieved a fantastic result (eventually, after a few pitfalls).  Here they are, based on my experience in the hope they might be useful for others.

I based my procedure on Cretone’s list post 2504 for which many thanks (modified for the 3000A obviously).  My own observations, setbacks, pitfalls etc in italics after each step

1.   Download PhillyFlyers’ 3000A series patched firmware 2.50 from the web to a FAT32 USB stick.

The hosting site mega.nz was blocked by my ISP – I needed to temporarily switch DNS servers to Google’s public DNS (8.8.8.8 and 8.8.4.4) to overcome this

2.   Plug the USB stick into the front USB port of the (running) scope, install the patched firmware via the standard firmware update procedure (Utility / File Explorer / goto USB / Load File).  Once the reboot is complete, keep the scope powered up.

Flawless update, scope rebooted immediately, no visible changes or warning messages – excellent. 

3.   Create a file infiniivision.txt with a raw text editor on a PC containing the infiniivisionLauncher command line with the options required (not forgetting to adjust the character count, ie the no. of characters to the right of the #).  Mine was:

93#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW20 -l MSO -l MEMUP

This was the biggest pitfall which took me a day to resolve.  The syntax for each option is hyphen then lowercase l then space then option code.  However, in most forum posts, the lowercase l looked to me like the pipe (vertical bar) character and even though I copied and pasted from the forum into my text editor and ended up (correctly) with lowercase ls, I was convinced it had translated them incorrectly and laboriously went through with a hex editor changing them back to pipes (unicode 7C).  (Eventually, through Telnet / CMD, I found the syntax for the infiniivisionLauncher.exe command and the penny finally dropped)

4.   Unplug the USB stick from the scope, save this infiniivision.txt file onto it, then replug it into the scope.  The file should now be visible through Utility / File Explorer.

Don’t be tempted to try and load the file into the scope like in step 2 – it’s not firmware!

5.   Time for Telnet: plug the scope into your local Ethernet, make sure the LAN config is set to automatic (Utility / I/O / LAN settings) wait for it to acquire an IP address (assuming you have a hub or similar with DHCP server capability connected).  Then Telnet into the IP address shown on the I/O information screen, username and password as per previous posts.  The Telnet window should then give the Windows CE command prompt:

Pocket CMD v 6.00
\>

Telnet was rock-solid throughout, and thanks to the patched firmware there seemed to be no restriction on having to time it to coincide with the boot-up phase of the scope.  I was dreading the networking, being an amateur, but simply plugging in to a typical home broadband network with a DHCP-serving hub it was incredibly easy and the scope sorted out its config automatically within seconds.  Alternatives are fiddling with static IP addresses, subnet masks etc and point-point Ethernet (scope – PC) with a crossover cable …

6.   Use the Telnet / CMD session to backup the existing .lnk, then transfer the .txt file from USB and rename it to .lnk thus:

rename \Secure\Startup\infiniivision.lnk \Secure\Startup\infiniivision.bak
copy \usb\infiniivision.txt \Secure\Startup\infiniivision.txt
cd \Secure\Startup
rename infiniivision.txt infiniivision.lnk

An initial worry was that even dir /a /s did not reveal the \Secure directory, however using cd \Secure will navigate to it and then enable dir to list its contents.  The original infiniivision.lnk file was present, but empty (0 bytes) and with the archive flag set - I backed it up nevertheless!  Note the copy command requires the full path and filename for both source and destination – just specifying the destination directory isn’t sufficient.  The cd into \Secure\Startup was necessary because attempting the rename from the root directory gave an error message that the command line (with the full path included in the filenames) was too long.  Finally, there are lots of ‘i’s in infiniivision, I lost count of the number of times I forgot the double i in the middle.

Historically the advice on the forum has been to kill the running inifiniivision.exe instance before doing the file manipulation, but lately this step seems to have been omitted in most recommendations.  I didn’t kill it, because I simply forgot all about that step.  Leaving it running didn’t seem to cause any problems, but of course the scope requires a reboot to pick up the new .lnk file and enable the options.


7.   Turn off the scope – a tense moment for potential bricking, as the die is now cast.  Turned on again, flawless and fast boot up, with all the newly-enabled options present and correct on the About screen (and enabled on the appropriate buttons etc).

This happy result was only after I had fixed the l / | confusion in the .lnk file of course.  When I was still blundering about with the pipe character, the scope booted up correctly (luckily) but naturally none of the additional options appeared on the About screen.

So thanks once again for all the contributions that helped me get to this point. 

I have a horrible temptation to start poking about with the 350MHz hardware mods now ...


Thank you Bill for your precise instructions!  :-+

I'd like to share my experiences with DSOX3014T hacking with few additions to the one above:  Original FW was 07.20.2017102614 when I bought it. I purchased also DIY LAN card, so I went with the LAN route upgrading (via USB stick would have maybe worked as well). There is an error message about LAN/VGA card problem when booting, but that's normal for the DIY LAN option  (because VGA circuitry is not present).  I tried to telnet it and it worked (without any post-boot timeout) with infiniivision/skywalker1977 password.

I got the patched FW from PhillyFlyers with the same version as the old FW was (because I was in the assumption that it was required, a misunderstanding from my part). However when trying to install this version via Utility menu the scope always would complain "could not load file. File type not detected" or something (cannot remember anymore the exact error message). 

At this point I tried a patched version of 07.31.2020012842, which upgraded and booted without any complaints (LAN/VGA nagging is still there of course).  However the skywalker password would not work anymore with this version, so I had to generate the new one and that worked ok.  I'm going to re-share the Python script here (a link posted previously now requires one to create an account):
Code: [Select]
#!/usr/bin/env python
from hashlib import md5
from base64 import b64encode

# Type in the real parameters here
MODEL  = "DSOX3014T"
SERIAL = "MY12345678"
MAC    = "00-12-34-56-78-90"

def makepwd( model, serial, mac ):
    mac  = mac.translate( None, ':- ' ).upper()
    hstr = md5( model + serial + mac ).digest()
    pwd  = b64encode( hstr, 'a1' )[7::-1]
    print 'Model : {0}\nSerial: {1}\nMAC   : {2}\nPasswd: {3}'.format(model, serial, mac, pwd)
    return pwd

makepwd( MODEL, SERIAL, MAC )
Get the IP and MAC addresses from DHCP page of your WiFi/LAN router/DHCP server (the scope uses a DHCP client name such as "k-dx3014t-12345").  Modify the python script and run it.  Use the same username (infiniivision) and the generated password and you can log in.

For enabling options I used the following infiniivision.lnk:
Code: [Select]
104#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW20 -l MSO -l MEMUP -l WAVEGEN
(the D3000BDLA does not contain WAVEGEN option)

Now I have 200mhz 4-channel scope with all the bells and whistles. Merry christmas everyone  8)
 
The following users thanked this post: lowimpedance, mlloyd1

Offline Bud

  • Super Contributor
  • ***
  • Posts: 6911
  • Country: ca
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2580 on: December 28, 2020, 01:51:39 am »
...AFAIK the 1k series still cannot be hacked because the cmdline options do not work on that series scope?  I believe that is what others have been saying on here?

It's done, mate  :D

https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg3383650/#msg3383650
Facebook-free life and Rigol-free shack.
 
The following users thanked this post: hugos31

Offline msuthar

  • Contributor
  • Posts: 29
  • Country: in
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2581 on: December 28, 2020, 03:25:03 am »

It worked on  DSO x 2004A  !!
the Telnet is also back !

73

de VU2EHY
 

Offline Dwaine

  • Frequent Contributor
  • **
  • Posts: 299
  • Country: ca
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2582 on: December 29, 2020, 03:15:46 am »

It worked on  DSO x 2004A  !!
the Telnet is also back !

73

de VU2EHY

+1  Upgrade worked perfectly on a DSOX2004A
 

Offline georges80

  • Frequent Contributor
  • **
  • Posts: 912
  • Country: us
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2583 on: December 29, 2020, 05:31:08 am »
Successful upgrade (have patience, it takes several minutes). MSO-X 2024A.

Thanks much!

cheers,
george.
 

Offline pepperoni7

  • Contributor
  • Posts: 13
  • Country: de
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2584 on: December 29, 2020, 11:36:33 am »
Works fine on my MSOX 3104T, thanks!
If someone needs enhanced security features, use "-l SECA" switch.
It was not obvious (at least for me) since option itself is called DSOXT3SECA
 

Offline xXxzZz

  • Newbie
  • Posts: 3
  • Country: ru
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2585 on: December 30, 2020, 06:22:05 pm »
Hello.

First of all, thank you so much for making this possible!

I have DSOX-3034T with WAVEGEN and MSO licenses installed (purchased) + VGA/LAN module. Original latest Firmware 7.35 installed

Can you please make a step by step guide + telnet commands?

I am new to this and afraid to make mistake and brick my scope.

Thank you. 
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 6911
  • Country: ca
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2586 on: December 31, 2020, 05:29:08 am »

Wow, this is impressive.. someone did some excellent RE work and I would assume live debugging on the target.  Did you do these patches yourself?   I would love to know the debugging setup, ie what debugger did they use, etc...

This is not an easy small patch like all the others, this is some extensive patching and custom routines, etc... I'll have to spend some time looking at this one..

unless you of course can keep making these whenever updates come in?  then I'll just stick to the easy ones :)

The original patch was done to the previous version by user FERCSA  :-+.  I capitalized on his method to make a patch for the latest version. I did all in may head looking at the code and reading between the lines, that was my setup  :D . I did a bit of hardware hacking to access Uboot, but nothing like hooking up a JTAG  or something.

I do not think another one will need to be patched because 1000X models are discontinued. It is unlikely Keysight would release another firmware update.
Facebook-free life and Rigol-free shack.
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 6911
  • Country: ca
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2587 on: December 31, 2020, 05:34:26 am »
umm... Honestly, this is all I know, is making these patches and using the cmd-line options via the link file..

If you know something much easier, please explain how to do it!   I really have no idea what the ":SYSTem:PRODuction:SSCRipt" is, or how you do it.... I only know the methods we've been using forever to enable the options... if there is a better and simpler way please explain and we can work on doing it that way!

I too would like to hear what "activate the options the way it should be" and " officially establish the "Boot Command Line" means.
Facebook-free life and Rigol-free shack.
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 6911
  • Country: ca
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2588 on: December 31, 2020, 05:38:35 am »
Hello.

First of all, thank you so much for making this possible!

I have DSOX-3034T with WAVEGEN and MSO licenses installed (purchased) + VGA/LAN module. Original latest Firmware 7.35 installed

Can you please make a step by step guide + telnet commands?

I am new to this and afraid to make mistake and brick my scope.

Thank you.

I only visit this thread once in a while but I think I've seen "step by step guides" here more than stars in the night sky. You can start by reading the topic backwards to find out if a patch exists for your version of firmware in the first place, then continue from there.
Facebook-free life and Rigol-free shack.
 

Offline Mark

  • Frequent Contributor
  • **
  • Posts: 270
  • Country: gb
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2589 on: December 31, 2020, 04:01:06 pm »
Successfully upgraded mine, thanks to everyone, especially PhillyFlyers. 

It seems there is no option for Bode plot on MSOX3000A series, only 3000T series, even though the app note 5992-0593 "Power Supply Control Loop Response (Bode Plot) Measurements 5992-0593" shows an MSOX3054A   ???

 

 
The following users thanked this post: analogRF

Offline xXxzZz

  • Newbie
  • Posts: 3
  • Country: ru
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2590 on: December 31, 2020, 08:29:54 pm »
Happy New Year Dear All!!!

DSOX-3034T Successfully upgraded!

With:
DSOX 3000T Series:  FW:  7.35.2020120822_patched

infinivision.lnk:
95#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW50 -l SCPIPS -l SEC

Best wishes and Endless thanks all of you!
1142584-0
 

Offline Mr. Scram

  • Super Contributor
  • ***
  • Posts: 9810
  • Country: 00
  • Display aficionado
Successfully upgraded mine, thanks to everyone, especially PhillyFlyers. 

It seems there is no option for Bode plot on MSOX3000A series, only 3000T series, even though the app note 5992-0593 "Power Supply Control Loop Response (Bode Plot) Measurements 5992-0593" shows an MSOX3054A   ???
I always wondered how hard it would be to add a Bode plot to the 2000X and 3000A series. All the other models have the capability and the software platform is fairly similar. It always struck me as odd Keysight ignored these two series despite the hardware being present.
 

Offline Saskia

  • Super Contributor
  • ***
  • Posts: 2893
  • Country: de
  • you unlock this door with the key of imagination
a Bode plot for the 2000 series, that would be fantastic ...
 

Online 2N3055

  • Super Contributor
  • ***
  • Posts: 6660
  • Country: hr
Successfully upgraded mine, thanks to everyone, especially PhillyFlyers. 

It seems there is no option for Bode plot on MSOX3000A series, only 3000T series, even though the app note 5992-0593 "Power Supply Control Loop Response (Bode Plot) Measurements 5992-0593" shows an MSOX3054A   ???
I always wondered how hard it would be to add a Bode plot to the 2000X and 3000A series. All the other models have the capability and the software platform is fairly similar. It always struck me as odd Keysight ignored these two series despite the hardware being present.

2000X and 3000A are same older platform.  3000T is same platform as 4000 and 6000, so it has it.
It might as well be that 2000X and 3000A simply have no resources (memory, CPU, ASIC) to put in other stuff.
Or it can be simply that that those are legacy products, on it's last leg, and significant new development is just not going to happen.

At this point 1200X series is much more powerful than 2000X, except for smaller form factor, which might be pro or con depending on usage..
 

Offline zqcao

  • Newbie
  • Posts: 2
  • Country: cn
I have the same problem, do you repair it?
 

Offline Saskia

  • Super Contributor
  • ***
  • Posts: 2893
  • Country: de
  • you unlock this door with the key of imagination
I think I read somewhere that someone upgraded his 2 channel DSOX2000 to a 4 channel.

Can anyone point me to that particular post, please ?
 

Offline Hexley

  • Regular Contributor
  • *
  • Posts: 198
  • Country: us
I recently had an incident wherein my DSOX3024A lost cal on a couple of channels. Channel 3 was down in amplitude by 10% or so. Channel 2 was showing alarming behavior -- extremely reduced bandwidth and some timing jitter.

Fearing an issue in the front end, I decided to run a user calibration to see if it confirmed a failure. Fortunately, the user cal fixed the issue and restored normal operation. The attached pictures show before and after. The jitter on CH2 was not captured in this screen grab, but the low bandwidth is obvious.

Perhaps this is an indication that the flash memory dropped some bits in the calibration tables. Makes me wonder if that memory is on borrowed time.
 

Online analogRF

  • Frequent Contributor
  • **
  • Posts: 974
  • Country: ca
Successfully upgraded mine, thanks to everyone, especially PhillyFlyers. 

It seems there is no option for Bode plot on MSOX3000A series, only 3000T series, even though the app note 5992-0593 "Power Supply Control Loop Response (Bode Plot) Measurements 5992-0593" shows an MSOX3054A   ???
I always wondered how hard it would be to add a Bode plot to the 2000X and 3000A series. All the other models have the capability and the software platform is fairly similar. It always struck me as odd Keysight ignored these two series despite the hardware being present.

2000X and 3000A are same older platform.  3000T is same platform as 4000 and 6000, so it has it.
It might as well be that 2000X and 3000A simply have no resources (memory, CPU, ASIC) to put in other stuff.
Or it can be simply that that those are legacy products, on it's last leg, and significant new development is just not going to happen.

At this point 1200X series is much more powerful than 2000X, except for smaller form factor, which might be pro or con depending on usage..

even 1000X has FRA. I think it's just a software thing not a hardware limitation. This scope is definitely more powerful than some other new chinese scopes that do have FRA now. It must be a marketing issue perhaps. The actual software is probably in there already.
 

Offline Someone

  • Super Contributor
  • ***
  • Posts: 4531
  • Country: au
    • send complaints here
Successfully upgraded mine, thanks to everyone, especially PhillyFlyers. 

It seems there is no option for Bode plot on MSOX3000A series, only 3000T series, even though the app note 5992-0593 "Power Supply Control Loop Response (Bode Plot) Measurements 5992-0593" shows an MSOX3054A   ???
I always wondered how hard it would be to add a Bode plot to the 2000X and 3000A series. All the other models have the capability and the software platform is fairly similar. It always struck me as odd Keysight ignored these two series despite the hardware being present.

2000X and 3000A are same older platform.  3000T is same platform as 4000 and 6000, so it has it.
It might as well be that 2000X and 3000A simply have no resources (memory, CPU, ASIC) to put in other stuff.
Or it can be simply that that those are legacy products, on it's last leg, and significant new development is just not going to happen.

At this point 1200X series is much more powerful than 2000X, except for smaller form factor, which might be pro or con depending on usage..

even 1000X has FRA. I think it's just a software thing not a hardware limitation. This scope is definitely more powerful than some other new chinese scopes that do have FRA now. It must be a marketing issue perhaps. The actual software is probably in there already.
There is an early implementation of the bode plotter on the 3000A models, hidden away in the power analysis package as the Power Supply Rejection Ratio (PSRR) analysis.

Even on the other scopes that have more recent implementations of the bode plot, its still not great. Acquisition time is relatively slow/inefficient and the auto scaling can fail (with no way to override or fix it). For most real use cases its better off automating the measurements from a user programmable environment:
https://www.eevblog.com/forum/testgear/faster-fra-from-scope-by-external-control-over-visa/msg2282465/#msg2282465
(entirely practical for a raspberry Pi etc to be dedicated to these tasks and kept on the back of the scope)

The resources/capabilities are certainly there on the 3000A/2000A but they aren't getting software features in updates. All run the same SPEAR600 SoC:
1000A/G https://www.flickr.com/photos/eevblog/32335665684/
2000A https://www.flickr.com/photos/eevblog/5736055359/
3000A https://www.flickr.com/photos/eevblog/5736041287/
3000T https://www.flickr.com/photos/eevblog/16055812200/
4000A https://www.flickr.com/photos/eevblog/8181547458/
and all those (but 1000A/G ?) scopes run the same windows CE 6.0 operating system.

different to lower end instruments:
https://www.flickr.com/photos/eevblog/9090298350/
or higher end instruments:
https://www.flickr.com/photos/eevblog/13985658872/
where there are slightly different processor platforms.
 
The following users thanked this post: Mark, Mr. Scram, analogRF

Offline wavylogic

  • Newbie
  • Posts: 4
  • Country: us
Hello, this is my first blog posting.  Many, many thanks to all the people who have been doing the excellent reverse engineering work on this series of scopes.  I have read through parts of this blog searching for general information on the MSOX3000 series and finally decided to get one.  I purchased a new (Keysight demo at 50% off) to me scope from Keysight, and of course it came without any probes or cables.  Probes are not so much of a problem, there are many sources for those.  But the MSO cable is a problem because it is less common. 

After reading through this blog and doing other research on the Keysight web site, I found that the MSO probe cable requirement seens to be the same as used for a series of HP logic analyzers with the same 40 pin pinout, as has been pointed out previously.

An excellent document for this type of cable and its circuit requirements is the Keysight document "Probing Solutions for Logic Analyzers", document number 5968-4632E.  This can be downloaded from the Keysight web site.  In particular, the section from page 47 onward gives a lot of information about this probe system, such as the typical clip lead nose termination network in Fig. 9.1 and 9.36.  All of the networks shown in this document assume use of the 'woven cable' special 40 pin cable to connect the isolation networks for the clip leads to the input of the logic analyzer. 

Figure 9.37 on page 71 shows the signal connections as viewed from the end of the MSO cable connector.  Therefore looking at the front of the scope, pin 1 is at the top right towards the USB connector (top left square pin in the main board top side photo), and pins 1,3,5, and 39 are not connected inside the scope.  You can verify this in some of the main board photos.  Note the black 'key' indicator is at the top of the socket, and Fig. 9.37 is as if you are looking at the end of the cable.  In the scope, all the grounds are on the bottom side. 

The signal paths in this logic probing system are set up the same as normally used in a 10X oscilloscope probe, and require particular conditions to be met to get good bandwidth and transient response at the input of the logic analyzer.  Each of the 16 signal paths (the clock path in a cable from a logic analyzer is not used) consists of the isolation network at the clip end, one signal wire in the cable, and a termination network in the logic analyzer or MSO scope input.  The signal wire is a special type of pseudo coaxial cable made with very fine resistive wire for the center conductor, so that the 1 meter (~40 inch) long woven cable signal path has an end to end DC resistance of about 180 ohms.  The grounds of the paths have very low resistance from end to end.  The measured low frequency capacitance of one signal path to ground is about 50 pF,  and the transmission line TDR surge impedance Zo measures as about 180 ohms also (coincidence?). 

You can see in some previously posted photos of the MSO region of the 3000 series that U1401 to U1404 used as receivers for the MSO signals are MAX9201 quad comparators.  Part of the circuitry used with these comparators is visible on the top side of the PC board, but apparently the remainder is on the bottom side.  I have not been able to find any high resolution photos of the bottom side of the PC board. 

If someone can point to where the backside area under these ICs can be seen, I would greatly appreciate that information.  I am reluctant to disassemble the scope I just bought since it is still in warranty.  Any information on component values would be a bonus.

My goal is to design a replacement for the standard MSO cable which anyone can duplicate.  Obtaining satisfactory frequency response when using a standard ribbon cable for the 'woven cable' requires adding additional compensation networks at each end of the cable.  The values of these networks can be obtained from simulations, but the ones already present in the scope, which cannot be altered, must be known in advance.

Making one's own cable fixtures has the feature that specialized cables can be made for common usage situations, such as using a smaller number of channel connections or using a ganged connector to the target breadboard to make usage easier.  For instance, a pad pattern for a vertical mounting through hole micro USB connector could be added to a PC board design and connected to otherwise unused pins of a CPLD.  In this case, you would have a 5 channel gang connection, which by programming can monitor any signals in the CPLD.  Just alter the CPLD program to move your hardware probe points and reprogram without taking it off of the PC board.  The connector would be left unloaded on boards after the debugging is complete. 

Or you could use an 8 channel connection with a 10 pin header location on the PC board to probe 8 signals as desired, or have only 8 clip leads flying about. 

So what I am asking for is any information that someone can give to help determine the termination networks internal to the MSO 3000 series oscilloscopes.

Thanks for your help!


 
The following users thanked this post: Mark


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf