Agilent Infiniium DSO8000A Hacking - anyone done this?

[Wuerstchenhund]

Well, it seems an Agilent DSO8064A will find the way to me. Unfortunately it seems to come with the basic config, so I wonder if anyone managed to hack any of these or any other Infiniium scope. Of course my main interest is to enable the 128M sample memory the scope has, but getting some of the other options would be nice, too.

Any ideas?

[Towger]

Any ideas?

No. But I'll happily take that Agilent abomination off your hands for the cost of the P&P.

[blacknoise]

Well, it seems an Agilent DSO8064A will find the way to me.
...

This DSO8064A:

http://www.keysight.com/main/techSupport.jspx?cc=DE&lc=ger&nid=-32452.536908411&pid=718129&pageMode=DS

...using the same firmware (last version: 05.71) as for example the 54831D?

[Howardlong]

I would be surprised if you couldn't get that to work one way or another... ;-)

[Wuerstchenhund]

Well, it seems an Agilent DSO8064A will find the way to me.
...

This DSO8064A:

http://www.keysight.com/main/techSupport.jspx?cc=DE&lc=ger&nid=-32452.536908411&pid=718129&pageMode=DS

...using the same firmware (last version: 05.71) as for example the 54831D?

That's the one 

And as you said, the download page says it's the same firmware as the Infiniium 54831D:

http://www.keysight.com/main/software.jspx?ckey=566904&lc=eng&cc=US&nid=-32452.536908411&id=566904

My main interest would be unlocking the full 128M of sample memory, but if possible also some of the other options (i.e. 009 InfiniiScan, 002 Jitter, 003 serial data, or the serial decode options).

[G0HZU]

I would be surprised if you couldn't get that to work one way or another... ;-)

Yes, the system they use is very crude. I added a couple of options to my Agilent VNA a few months ago. See post #64 here:
https://www.eevblog.com/forum/buysellwanted/auction-(uk)-test-gear-from-nvidia/50/

I borrowed a big Infiniium scope this week as I'm looking to buy one to use with the 89600 SW.

It was the 80404B 40Gs  4GHz Infiniium model that runs Win XP. This is an 80000 series rather than 8000. I don't know much about these scopes to know what the differences are. I dumped out the program code from it and looking through the program code this scope uses the same 'option' system as my VNA so I found that I could write licence files for the 80404B within a couple of minutes. I managed to create replicas of the existing licences on the scope so I knew straight away that I could write valid licences for it. The licence is locked to the 404BMY46xxxxxx ID. In the code there are a LOT of undocumented options but I have no idea what they do. I think some of them are for other scope models as I found loads of different scope models inside the main program code. It's possible to create time limited or permanent licences and demo licences. However, I'm not an advanced user of modern scopes so I'd never use these options as I would only use a big/fast scope like this to grab raw data for post processing. So the various USB, SATA DDR, Infiniiscan options are all a bit boring to me really. It's easy to remove each of the options by simply deleting the relevant entry in the licence file.

[G0HZU]

I don't have access to the 80404B scope anymore but I did try downloading the firmware for it and installed it on a PC to emulate the scope hardware.

I managed to create a licence file that unlocks this many options (before I got bored) and the GUI does add these features in the menus when it runs. I don't have the real scope anymore to try this on but I do want to buy a decent Windows based Infiniium scope to do data capture. So when I get one I'll report back.

Surely someone has been here already and done this? Looking in the code there appear to be some vulnerabilities in the code that allow generic licencing. This seems a tad reckless... The image below is the bootup/options splash screen for a global licence that probably unlocks every feature listed below on every Agilent Infiniium scope in the whole range that uses this firmware. i.e. this licence isn't locked to the scope serial number. It is locked to every/any infiniium scope in the firmware range.

But I don't have a scope here to try this on. But it works on the PC/emulator. I'd only want to try this on a scope I owned myself so I wouldn't try this on the 80404B even if I still had it because it isn't mine

[blacknoise]

...
Looking in the code there appear to be some vulnerabilities in the code that allow generic licencing.

Yes. As i did not had any genuine license key with a valid signature to reverse and learn the cryption algorithm, my attempt was to modify the firmware so that the values for HOSTID and SIGN are not longer required to validate the option.

At least for the older (05.71) scope firmware (548xxx, xSO8xxx series) and for the current (4.20-5.60) scope firmware (xSO9xxx(x) and MSOSxxx series) a modification / addition of about 10-15 instructions allows to add any option in the license file with "PERMANENT UNCOUNTED HOSTID=VDH=0 SIGN=0" instead of a valid signature.

Even a much more simpler modification is possible in the above named firmwares by changing only one instruction (tst edi,edi --> xor edi,edi). But the disadvantage of this simple solution is a noticeable slower start of the scope application - especially on weak CPUs of older hardware - as during startup the scope tries to enable every single option known by the firmware.

[G0HZU]

Yes, I think you are working in in a completely different part of the code to me.

I think you can either patch the Agilent application (quick/dirty but effective) or attack the core protection system itself which is produced for Agilent by a third party and it is buried inside Agilent's code. When I hacked my VNA I had no example licence file but I didn't want to risk patching the firmware as I'd only had the VNA a few days (and it cost me a LOT of money to buy).

I found that everything you need can be found by running the application in a debugger on a remote PC. It shows the licence file name/location and also the format of the text within the licence file. So I just needed the 12 digit SIGN code for my newly created licence file.

Luckily for me I've spent a lot of time in the distant past reversing this type of protection system so I can configure the debugger to give me the 12 digit key in a few seconds. Many years ago this required me to dig deep down many levels into the core of the third party protection system itself. Once you do this you realise how weak the whole system is. If you look through the code there are all kinds of references to encryption with public and private keys and DES etc. There are also loads of false trails in the code. But the juicy/vulnerable bit of code lies many subroutine levels down inside the protection system itself.  You can set the debug system up to give you the 12 digit key in this part of the code because it checks your default attempt (eg 123456789012) against the correct key in a sequenced/fragmented format... (yes, the system really is this simple/dumb)

I'm sure you already know that the protection system isn't produced by Agilent. They use a third party system for licence management and this is what makes the whole system vulnerable to attack.

Even a much more simpler modification is possible in the above named firmwares by changing only one instruction (tst edi,edi --> xor edi,edi). But the disadvantage of this simple solution is a noticeable slower start of the scope application - especially on weak CPUs of older hardware - as during startup the scope tries to enable every single option known by the firmware.

The crazy thing is that I think the protection coding may allow a simple line of text in a licence file that achieves the same thing on every Infiniium scope. i.e. it seems to allow a generic licence file that unlocks 'everything' on 'every' scope. I tried creating this file and it works on the emulated scope on a PC.
I also noted that it takes much longer for the application to load if I run with this 'bad boy' licence file. It sits on the splash screen for a longer time before I see the GUI appear.

I don't have a scope here to try this on but I'm trying to work out which Infiniium scope to buy. I really only want to run it with the 89600 software. The 80404B that I had access to already had the 89600 SW loaded on it.

But this scope is quite old. The owner said it was about 10 years old? The version of 89600 SW was quite old too. I'm not sure I 'need' 40GS and 4GHz BW and 4 channels so I'm trying to find the best Infiniium scope to buy for my needs.

[Wuerstchenhund]

I would be surprised if you couldn't get that to work one way or another... ;-)

Yes, the system they use is very crude. I added a couple of options to my Agilent VNA a few months ago. See post #64 here:
https://www.eevblog.com/forum/buysellwanted/auction-(uk)-test-gear-from-nvidia/50/

Oh yes, FlexLM. That's also used on the Infiniiums I believe, at least I remember seeing it on my (work) DSO90kA and on some of our DSO9ks.

I borrowed a big Infiniium scope this week as I'm looking to buy one to use with the 89600 SW.

It was the 80404B 40Gs  4GHz Infiniium model that runs Win XP. This is an 80000 series rather than 8000. I don't know much about these scopes to know what the differences are. I dumped out the program code from it and looking through the program code this scope uses the same 'option' system as my VNA so I found that I could write licence files for the 80404B within a couple of minutes. I managed to create replicas of the existing licences on the scope so I knew straight away that I could write valid licences for it. The licence is locked to the 404BMY46xxxxxx ID. In the code there are a LOT of undocumented options but I have no idea what they do. I think some of them are for other scope models as I found loads of different scope models inside the main program code. It's possible to create time limited or permanent licences and demo licences. However, I'm not an advanced user of modern scopes so I'd never use these options as I would only use a big/fast scope like this to grab raw data for post processing. So the various USB, SATA DDR, Infiniiscan options are all a bit boring to me really. It's easy to remove each of the options by simply deleting the relevant entry in the licence file.

Yes, that sounds like FlexLM.

My DSO8064A is supposed to arrive today, and then I can give it a try with some modified software files. 

[Wuerstchenhund]

I think you can either patch the Agilent application (quick/dirty but effective) or attack the core protection system itself which is produced for Agilent by a third party and it is buried inside Agilent's code.
[...]Once you do this you realise how weak the whole system is. If you look through the code there are all kinds of references to encryption with public and private keys and DES etc. There are also loads of false trails in the code. But the juicy/vulnerable bit of code lies many subroutine levels down inside the protection system itself.  You can set the debug system up to give you the 12 digit key in this part of the code because it checks your default attempt (eg 123456789012) against the correct key in a sequenced/fragmented format... (yes, the system really is this simple/dumb)

I'm sure you already know that the protection system isn't produced by Agilent. They use a third party system for licence management and this is what makes the whole system vulnerable to attack.

I agree that attacking FlexLM is probably the best way. Patching the scope application is fine for older scopes that won't see any new software releases (like the DSO8k or the DSO80k), but for newer models like the DSO9k finding a way of creating valid license files is probably a better way long-term so that not every update requires patching the scope application.

I don't have a scope here to try this on but I'm trying to work out which Infiniium scope to buy. I really only want to run it with the 89600 software. The 80404B that I had access to already had the 89600 SW loaded on it.

But this scope is quite old. The owner said it was about 10 years old? The version of 89600 SW was quite old too. I'm not sure I 'need' 40GS and 4GHz BW and 4 channels so I'm trying to find the best Infiniium scope to buy for my needs.

The DSO80404B is old, I think it came out around 2005, and it shares the general architecture with the DSO8064A that hopefully will arrive today and which I hadn't bought if I didn't get it for next to nothing. All these old Infiniiums have in common that they are pretty slow, even by the standards back then, and due to their architecture especially the higher bandwidth models like the DSO80404B suffer from some weird and annoying limitations (i.e. the sample memory drops from 64M to 2M at sample rates above 4GSa/s). HP was amongst the first (together with Nicolet If I remember right) to come up with a Windows based scope but it took Agilent until the DSO9kA to finally do a Windows scope right.

Obviously you need an HP/Agilent/Keysight scope if you want to use it with the 89600 VSA software, but if you don't need huge bandwidth and can live with the VSA software running on a separate PC then a DSO-X Series scope (DSOX3k, 4k) should do. If you want to run the software on the scope, though, I'd say a DSO8kA could be OK if you can live with 600MHz (DSO8064A) or 1GHz (DSO8104A) bandwidth, but if you need more bandwidth then I'd seriously look into an early DSO9kA (running XP).

[Wuerstchenhund]

My DSO8064A has arrived and seems to be working fine. It comes with no options and runs an old version (4.5) of the Infiniium software. There's also an old copy of the 89600 VSA software on the hard drive.

I did a quick test and the -3dB point for this 600MHz scope is at 1.27GHz which isn't bad.

The next step is to create a disk image and replace that horribly slow hard drive with an SSD, and then play around with updating the scope software and unlocking some options.

[blacknoise]

...
You can set the debug system up to give you the 12 digit key in this part of the code because it checks your default attempt (eg 123456789012) against the correct key in a sequenced/fragmented format... (yes, the system really is this simple/dumb)
...

Very interesting! I did not dare to hope that Agilent and/or the originator of the licensing code violates cryptogaphic basic rules in such a way. So, when i tried to add options to the 05.71 firmware some years ago i thought i had to break the encryption algoritm - which seems very difficult to me.

Instead of that i disassembled the code and followed its branches up to the decision: "option valid/invalid"... et voilà... ;-)

And as all instruments which I modified belong to my private amateur lab, i had no qualm at all to manipulate the program code.

[G0HZU]

The DSO80404B is old, I think it came out around 2005, and it shares the general architecture with the DSO8064A that hopefully will arrive today and which I hadn't bought if I didn't get it for next to nothing. All these old Infiniiums have in common that they are pretty slow, even by the standards back then, and due to their architecture especially the higher bandwidth models like the DSO80404B suffer from some weird and annoying limitations (i.e. the sample memory drops from 64M to 2M at sample rates above 4GSa/s). HP was amongst the first (together with Nicolet If I remember right) to come up with a Windows based scope but it took Agilent until the DSO9kA to finally do a Windows scope right.

Obviously you need an HP/Agilent/Keysight scope if you want to use it with the 89600 VSA software, but if you don't need huge bandwidth and can live with the VSA software running on a separate PC then a DSO-X Series scope (DSOX3k, 4k) should do. If you want to run the software on the scope, though, I'd say a DSO8kA could be OK if you can live with 600MHz (DSO8064A) or 1GHz (DSO8104A) bandwidth, but if you need more bandwidth then I'd seriously look into an early DSO9kA (running XP).

I really have no idea which one of these models is best for me. I'm going to try and borrow one again and have a play. I'd like something with about 1GHz BW though...

I had another dig around in the program code and it looks like these scopes can also have their options enabled via a remote (or local) server. I did a google and found that you can still download the server here:

http://www.keysight.com/en/pd-1143488-pn-N5435A/infiniium-application-server-license-for-infiniium-oscilloscopes?pm=OP&nid=-32976.685330&cc=GB&lc=eng

The licence system is a bit more robust for a server (obviously) but I managed to reverse the server program code during the footie today. (so close for Leicester!)
I don't have a scope here but I think I can write server licences for anything on that list on the weblink. The advantage here is that I can test out the options without messing with the scope itself. i.e. I 'think' I can enable the options via a remote PC using the Agilent server SW.

I can certainly write the licence (locked to my MAC address) and start the server and I can replicate the sign keys for existing server licences I found online that lock to other MAC addresses. So if this works, I don't have to tinker inside somebody else's scope

Am I correct in that I should be able to hook the scope up to another PC via LAN and enable the options remotely? (Obviously, the options will only be enabled when the server is there and running and will vanish when the server PC is removed)

[nctnico]

Sounds like a nice application for a Raspberry Pi!

[Howardlong]

I did a quick test and the -3dB point for this 600MHz scope is at 1.27GHz which isn't bad.

The next step is to create a disk image and replace that horribly slow hard drive with an SSD, and then play around with updating the scope software and unlocking some options.

My 600MHz 54831D is about 800MHz 3dB point in real time sampling, but exceeds 1.2GHz in equivalent time.

Thanks to a forum member's help all options have been enabled.

I did also replace the PATA HDD with a PATA SSD: it's still slow to boot, taking a minute or so for the scope screen to appear, but definitely significantly better. The motherboard isn't anything to write home about, quite underpowered in fact. I think the 8000 might benefit from a better resolution touch screen, not sure what the mobo capabilities are.

[Wuerstchenhund]

After spending most of yesterday replacing the hard drive with a SSD and fighting with a RAM problem (and thanks a lot Agilent for hot-glueing the RAM modules to the mainboard ) the scope is now up and running, including the latest firmware modified to enable some of the options. So far so good 

However, I also was quickly reminded again how poor the UI of these scopes was and how limited and simple even the advanced options were. It's been a very long time when I last used one of these scopes (at work we've mostly Agilent/Keysight Infiniiums running Windows 7 which have a much improved UI), but now that I'm sitting in front of one of these scopes again the old complaints are back. Even the latest software for these scopes (5.71 from 2009) still looks and feels like a Windows 95 application. The touch screen can't hide the fact that the UI was designed for mouse control, and a mouse is required for most settings as the 8.4" screen is too small to operate many parts of the UI sensibly. Early DSO9k/90k scopes which run XP use the same UI, but thanks to their large screen the UI becomes much more useable without a mouse. But comparing it with my LeCroy scopes from the same era which have a true touch UI and better options this feels like ten steps backward, not just in the user interface department.

Having said that, the scope runs fine now, and I even managed to enable the 128M sample memory which is nice. Also, the hardware is solidly built (typical HPAK), and (aside from the glued-in RAM) modestly maintenance friendly. The PSU seems to be a Lambda Vega 450 which is a current industrial PSU platform.

My 600MHz 54831D is about 800MHz 3dB point in real time sampling, but exceeds 1.2GHz in equivalent time.

Are you sure? The -3dB point is determined by the analog front end, and should be independent on the sample mode.

Thanks to a forum member's help all options have been enabled.

I guess it's the same member that hooked me up  Many thanks for that (he should know!) 

I did also replace the PATA HDD with a PATA SSD: it's still slow to boot, taking a minute or so for the scope screen to appear, but definitely significantly better. The motherboard isn't anything to write home about, quite underpowered in fact. I think the 8000 might benefit from a better resolution touch screen, not sure what the mobo capabilities are.

The DSO8k/80k hardware has been improved a lot from the old 54800 Series. The mobo is a (for that time) modern intel D915GUX (later replaced by an AdLink M880) LGA775 (P4/Celeron) mainboard with PCIe interface. Mine came with a 2.93GHz Celeron (64bit) and 1GB DDR2-533 RAM (2x 512MB, as I said glued in), which I replaced with 2x 1GB DDR2-800.

The display is a 8.4" XGA (1024x768) touch screen instead of the 8.4" VGA (640x480) non-touch display in the 548xx Series. However, the touch screen doesn't help much as hitting some of the very small UI elements on the small 8.4" screen is still a challenge, which means you still need a mouse.

The hard drive in the DSO8k/80k is a SATA (150Mbps) 2.5" hard drive (in mine it was a 40GB Fujitsu MHV, which like most of these drives has already started to develop bad sectors). I replaced it with an 80GB intel SSD 530 I had laying around. The mobo has 4 SATA ports of which two are used (one for the HDD, another one for the slimline CDROM drive which is a PATA drive connected to SATA via a brigde board).

The sampling subsystem and the PCI interface adapter has changed as well (and both are now more reliable than on the 548xx). Also gone is the separate PCI graphics card with the antique C&T 65545 GPU for the scope application, the DSO8k/80k use the i915 GMA900 graphics in the mainboard's chipset, and connect to the touchscreen via a PCIe2x-to-LVDS adapter card. I haven't done any tests but it seems you can now run dual monitor configs (with the external monitor using a different resolution), however the scope app seems to only run in fullscreen mode.

The network interface that's on the mainboard is a 10/100Mbps NIC only, however since there's a free PCIe 1x slot a fast Gbps network adapter can be plugged in (I already ordered one).

I installed the 89600A VSA software but it did not recognoze the scope. Could well be a firewall issue as the scope app seems to expect the Windows firewall to be disabled (which is a really poor idea) and I re-enabled it and just unblocked the port requests from the scope software.

Now that I have the scope up and running I might even do some performance comparison against my LeCroy WaveRunner 64Xi which is of the same class, same vintage and similar price points (approx $14k for the DSO8064A and $11k for the WR64Xi). 

[Howardlong]

My 600MHz 54831D is about 800MHz 3dB point in real time sampling, but exceeds 1.2GHz in equivalent time.

Are you sure? The -3dB point is determined by the analog front end, and should be independent on the sample mode.

See this video (from 23:09), this is not directly with 3dB points, it's rise time related but it demonstrates the difference between real time and equivalent time sampling apparent bandwidth. Using an RF signal generator correlates the findings too.

https://youtu.be/mS3sCJd_GPk?t=1389

[G0HZU]

When I looked through the program code it was littered with various options including some that appear to be speed/bandwidth. I'm not sure how these get implemented or which scopes they apply to but there are various 'banded' options that look like speed/BW upgrades for this range of Infiniium scopes.

Also some options that may be hidden from the regular option menu system? It's hard to tell because I don't have a scope here to play with.

[G0HZU]

There's often lots of interesting nuggets in the program code.

One future project is to try and upgrade the display hardware in my Agilent E5071 VNA to support full HD. The program code supports it to some degree as you can see in the screenshot below. This is the VNA running in simulator/demo mode but it can also run this resolution in normal operation (if it had the display hardware that is)

I found this simulator (and the hi res graphics) capability when I was reverse engineering the program code to get it to unlock the time domain option.

It supports full HD graphics and this looks very cool indeed! See below for a screenshot of what this VNA is capable of if the display hardware is upgraded. I think the display is only VGA and the graphics adaptor is only good to something like 1024x768.

It has a VGA port at the back but I suspect that this will just display up to the limit of the (puny) display adaptor in the VNA.

But see below for full HD when running on a PC

[andy2000]

The DSO8k/80k hardware has been improved a lot from the old 54800 Series. The mobo is a (for that time) modern intel D915GUX (later replaced by an AdLink M880) LGA775 (P4/Celeron) mainboard with PCIe interface. Mine came with a 2.93GHz Celeron (64bit) and 1GB DDR2-533 RAM (2x 512MB, as I said glued in), which I replaced with 2x 1GB DDR2-800.

Has anyone ever tried replacing the motherboard with something more modern?  Even a Core 2 Duo/quad would be a lot faster than the original P4/Celeron.  It should be possible unless it has a custom BIOS, or drivers that will only work with that specific hardware. 

[Howardlong]

The DSO8k/80k hardware has been improved a lot from the old 54800 Series. The mobo is a (for that time) modern intel D915GUX (later replaced by an AdLink M880) LGA775 (P4/Celeron) mainboard with PCIe interface. Mine came with a 2.93GHz Celeron (64bit) and 1GB DDR2-533 RAM (2x 512MB, as I said glued in), which I replaced with 2x 1GB DDR2-800.

Has anyone ever tried replacing the motherboard with something more modern?  Even a Core 2 Duo/quad would be a lot faster than the original P4/Celeron.  It should be possible unless it has a custom BIOS, or drivers that will only work with that specific hardware.

I did look at one time at trying exactly that about 18 months ago. I can't remember now what the form factor is, but needless to say it isn't one at is common at least nowadays, and I was unable to find a suitable one at the time. YMMV of course. Certainly attempting to increase RAM or improve CPU failed for me, and I didn't much fancy upgrading the BIOS without having any sure means of getting it back in case of failure.

[Wuerstchenhund]

See this video (from 23:09), this is not directly with 3dB points, it's rise time related but it demonstrates the difference between real time and equivalent time sampling apparent bandwidth. Using an RF signal generator correlates the findings too.

https://youtu.be/mS3sCJd_GPk?t=1389

Interesting. Assuming that the front end really goes to 1.2GHz it seems your 54831D artificially limits bandwidth in real-time mode for some reason.

I'll give ETS a try on my DSO8064A, but since the real-time bandwidth is already at 1.2GHz I don't think there'll be any difference.

When I looked through the program code it was littered with various options including some that appear to be speed/bandwidth. I'm not sure how these get implemented or which scopes they apply to but there are various 'banded' options that look like speed/BW upgrades for this range of Infiniium scopes.

Also some options that may be hidden from the regular option menu system? It's hard to tell because I don't have a scope here to play with.

As far as I know none of these scopes were bandwidth-upgradeable, so the older 54800 Series (which uses the same software) has probably only a few front ends which were artificially bw limited to create the various models.

If you want me to try some options let me know.

Has anyone ever tried replacing the motherboard with something more modern?  Even a Core 2 Duo/quad would be a lot faster than the original P4/Celeron.  It should be possible unless it has a custom BIOS, or drivers that will only work with that specific hardware. 

The board is a standard intel or AdLink mainboard with Agilent BIOS to enable support for the LVDS to PCIe adapter. Replacing the board means you need a microATX board with PCI that has support for an internal LVDS display and supports WinXP (so you're looking at an industrial mobo). It should also fit the ATX cut-out in the back of the chassis, unless you like to use a hacksaw to make it fit. But in general, yes, it could work.

The real question is why you would want to do that. The current board/CPU combo in the DSO8k/80k is already 64bit, but since the OS is 32bit XP and the drivers only work with 32bit XP there's really no use in having more than 4GB RAM, which is already supported by the current mainboard. Also, since the whole "scope" part is built on Agilent ASICs upgrading the CPU will not change or improve any scope functionality whatsoever. For running XP plus some kind of Office a fast Pentium4 processor and 2+GB RAM are more than adequate, especially when combined with a decent SATA SSD which improves on the boot times as much as possible (the scope app alone prevents this from ever becoming a 'quickstarter' like a scope built on an embedded platform).

I did look at one time at trying exactly that about 18 months ago. I can't remember now what the form factor is, but needless to say it isn't one at is common at least nowadays, and I was unable to find a suitable one at the time. YMMV of course. Certainly attempting to increase RAM or improve CPU failed for me, and I didn't much fancy upgrading the BIOS without having any sure means of getting it back in case of failure.

It's probably more difficult for the 54800 Series as they rely on a separate graphics card with antique Chips & Technology chipset for displaying Windows and the scope app via hardware overlay. Replacing the mainboard with anything more modern (i.e. PCIe based) will very likely not work as on newer boards (like the ones in the DSO8k/80k) the PCI slots are connected via bridges that add latency. Which is probably why DSO8k/80k have a different PCI interface card to connect to the acquisition subsystem.

[Wuerstchenhund]

One future project is to try and upgrade the display hardware in my Agilent E5071 VNA to support full HD. The program code supports it to some degree as you can see in the screenshot below. This is the VNA running in simulator/demo mode but it can also run this resolution in normal operation (if it had the display hardware that is)

I found this simulator (and the hi res graphics) capability when I was reverse engineering the program code to get it to unlock the time domain option.

It supports full HD graphics and this looks very cool indeed! See below for a screenshot of what this VNA is capable of if the display hardware is upgraded. I think the display is only VGA and the graphics adaptor is only good to something like 1024x768.

It has a VGA port at the back but I suspect that this will just display up to the limit of the (puny) display adaptor in the VNA.

I doubt that. The older E5071As had a Pentium-M Celeron processor (400Mhz FSB) I think, with intel chipset with GMA900 graphics. Later ones had again a Pentium-M Celeron, but this time with 533MHz FSB and GMA950 graphics. And the current ones have some mobile Core i7 with intel HD graphics. And even the oldest variant (GMA900) supports 1920x1080 or 1920x1200 via digital and analog, as well as multi-monitor operation.

The question is what is supported by the LVDS hardware driver, and by the BIOS. Have a look into the BIOS settings if you can find a setting which allows you to configure the panel variant (i.e. a list with panel resolutions, or just a number).

It could very well be as easy as just replacing the panel with a suitable high resolution one (IPS preferrably).

[G0HZU]

I think some of these VNAs have an onboard graphics port (15 pin VGA) and also a PCI graphics card.

As it stands, my VNA exclusively uses the plug in PCI card and this only has 1M of video memory. I've not taken it apart but I think it also uses this card to interface to the LCD via a ribbon cable and it also has a 15 pin VGA connector at the back. So my VNA has two VGA connectors at the back. One from the mobo (disabled in BIOS?) and one from the PCI card.

On one of the E5071B models at work this mobo display port is enabled but it only supports 640x480  256 colours (same as the LCD) even if I mess with the settings in control panel.

I'm hoping that there's a way to have the higher resolution graphics on a remote monitor via some system tweaking/mods. But I'm in no hurry.