Any ideas?
Well, it seems an Agilent DSO8064A will find the way to me.
...
Well, it seems an Agilent DSO8064A will find the way to me.
...
This DSO8064A:
http://www.keysight.com/main/techSupport.jspx?cc=DE&lc=ger&nid=-32452.536908411&pid=718129&pageMode=DS
...using the same firmware (last version: 05.71) as for example the 54831D?
I would be surprised if you couldn't get that to work one way or another... ;-)
...
Looking in the code there appear to be some vulnerabilities in the code that allow generic licencing.
Even a much more simpler modification is possible in the above named firmwares by changing only one instruction (tst edi,edi --> xor edi,edi). But the disadvantage of this simple solution is a noticeable slower start of the scope application - especially on weak CPUs of older hardware - as during startup the scope tries to enable every single option known by the firmware.
I would be surprised if you couldn't get that to work one way or another... ;-)
Yes, the system they use is very crude. I added a couple of options to my Agilent VNA a few months ago. See post #64 here:
https://www.eevblog.com/forum/buysellwanted/auction-(uk)-test-gear-from-nvidia/50/
I borrowed a big Infiniium scope this week as I'm looking to buy one to use with the 89600 SW.
It was the 80404B 40Gs 4GHz Infiniium model that runs Win XP. This is an 80000 series rather than 8000. I don't know much about these scopes to know what the differences are. I dumped out the program code from it and looking through the program code this scope uses the same 'option' system as my VNA so I found that I could write licence files for the 80404B within a couple of minutes. I managed to create replicas of the existing licences on the scope so I knew straight away that I could write valid licences for it. The licence is locked to the 404BMY46xxxxxx ID. In the code there are a LOT of undocumented options but I have no idea what they do. I think some of them are for other scope models as I found loads of different scope models inside the main program code. It's possible to create time limited or permanent licences and demo licences. However, I'm not an advanced user of modern scopes so I'd never use these options as I would only use a big/fast scope like this to grab raw data for post processing. So the various USB, SATA DDR, Infiniiscan options are all a bit boring to me really. It's easy to remove each of the options by simply deleting the relevant entry in the licence file.
I think you can either patch the Agilent application (quick/dirty but effective) or attack the core protection system itself which is produced for Agilent by a third party and it is buried inside Agilent's code.
[...]Once you do this you realise how weak the whole system is. If you look through the code there are all kinds of references to encryption with public and private keys and DES etc. There are also loads of false trails in the code. But the juicy/vulnerable bit of code lies many subroutine levels down inside the protection system itself. You can set the debug system up to give you the 12 digit key in this part of the code because it checks your default attempt (eg 123456789012) against the correct key in a sequenced/fragmented format... (yes, the system really is this simple/dumb)
I'm sure you already know that the protection system isn't produced by Agilent. They use a third party system for licence management and this is what makes the whole system vulnerable to attack.
I don't have a scope here to try this on but I'm trying to work out which Infiniium scope to buy. I really only want to run it with the 89600 software. The 80404B that I had access to already had the 89600 SW loaded on it.
But this scope is quite old. The owner said it was about 10 years old? The version of 89600 SW was quite old too. I'm not sure I 'need' 40GS and 4GHz BW and 4 channels so I'm trying to find the best Infiniium scope to buy for my needs.
...
You can set the debug system up to give you the 12 digit key in this part of the code because it checks your default attempt (eg 123456789012) against the correct key in a sequenced/fragmented format... (yes, the system really is this simple/dumb)
...
The DSO80404B is old, I think it came out around 2005, and it shares the general architecture with the DSO8064A that hopefully will arrive today and which I hadn't bought if I didn't get it for next to nothing. All these old Infiniiums have in common that they are pretty slow, even by the standards back then, and due to their architecture especially the higher bandwidth models like the DSO80404B suffer from some weird and annoying limitations (i.e. the sample memory drops from 64M to 2M at sample rates above 4GSa/s). HP was amongst the first (together with Nicolet If I remember right) to come up with a Windows based scope but it took Agilent until the DSO9kA to finally do a Windows scope right.
Obviously you need an HP/Agilent/Keysight scope if you want to use it with the 89600 VSA software, but if you don't need huge bandwidth and can live with the VSA software running on a separate PC then a DSO-X Series scope (DSOX3k, 4k) should do. If you want to run the software on the scope, though, I'd say a DSO8kA could be OK if you can live with 600MHz (DSO8064A) or 1GHz (DSO8104A) bandwidth, but if you need more bandwidth then I'd seriously look into an early DSO9kA (running XP).
I did a quick test and the -3dB point for this 600MHz scope is at 1.27GHz which isn't bad.
The next step is to create a disk image and replace that horribly slow hard drive with an SSD, and then play around with updating the scope software and unlocking some options.
My 600MHz 54831D is about 800MHz 3dB point in real time sampling, but exceeds 1.2GHz in equivalent time.
Thanks to a forum member's help all options have been enabled.
I did also replace the PATA HDD with a PATA SSD: it's still slow to boot, taking a minute or so for the scope screen to appear, but definitely significantly better. The motherboard isn't anything to write home about, quite underpowered in fact. I think the 8000 might benefit from a better resolution touch screen, not sure what the mobo capabilities are.
My 600MHz 54831D is about 800MHz 3dB point in real time sampling, but exceeds 1.2GHz in equivalent time.
Are you sure? The -3dB point is determined by the analog front end, and should be independent on the sample mode.
The DSO8k/80k hardware has been improved a lot from the old 54800 Series. The mobo is a (for that time) modern intel D915GUX (later replaced by an AdLink M880) LGA775 (P4/Celeron) mainboard with PCIe interface. Mine came with a 2.93GHz Celeron (64bit) and 1GB DDR2-533 RAM (2x 512MB, as I said glued in), which I replaced with 2x 1GB DDR2-800.
The DSO8k/80k hardware has been improved a lot from the old 54800 Series. The mobo is a (for that time) modern intel D915GUX (later replaced by an AdLink M880) LGA775 (P4/Celeron) mainboard with PCIe interface. Mine came with a 2.93GHz Celeron (64bit) and 1GB DDR2-533 RAM (2x 512MB, as I said glued in), which I replaced with 2x 1GB DDR2-800.
Has anyone ever tried replacing the motherboard with something more modern? Even a Core 2 Duo/quad would be a lot faster than the original P4/Celeron. It should be possible unless it has a custom BIOS, or drivers that will only work with that specific hardware.
See this video (from 23:09), this is not directly with 3dB points, it's rise time related but it demonstrates the difference between real time and equivalent time sampling apparent bandwidth. Using an RF signal generator correlates the findings too.
https://youtu.be/mS3sCJd_GPk?t=1389
When I looked through the program code it was littered with various options including some that appear to be speed/bandwidth. I'm not sure how these get implemented or which scopes they apply to but there are various 'banded' options that look like speed/BW upgrades for this range of Infiniium scopes.
Also some options that may be hidden from the regular option menu system? It's hard to tell because I don't have a scope here to play with.
Has anyone ever tried replacing the motherboard with something more modern? Even a Core 2 Duo/quad would be a lot faster than the original P4/Celeron. It should be possible unless it has a custom BIOS, or drivers that will only work with that specific hardware.
I did look at one time at trying exactly that about 18 months ago. I can't remember now what the form factor is, but needless to say it isn't one at is common at least nowadays, and I was unable to find a suitable one at the time. YMMV of course. Certainly attempting to increase RAM or improve CPU failed for me, and I didn't much fancy upgrading the BIOS without having any sure means of getting it back in case of failure.
One future project is to try and upgrade the display hardware in my Agilent E5071 VNA to support full HD. The program code supports it to some degree as you can see in the screenshot below. This is the VNA running in simulator/demo mode but it can also run this resolution in normal operation (if it had the display hardware that is)
I found this simulator (and the hi res graphics) capability when I was reverse engineering the program code to get it to unlock the time domain option.
It supports full HD graphics and this looks very cool indeed! See below for a screenshot of what this VNA is capable of if the display hardware is upgraded. I think the display is only VGA and the graphics adaptor is only good to something like 1024x768.
It has a VGA port at the back but I suspect that this will just display up to the limit of the (puny) display adaptor in the VNA.