EEVblog Electronics Community Forum

Products => Test Equipment => Topic started by: dfnr2 on January 14, 2014, 09:16:11 pm

Title: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dfnr2 on January 14, 2014, 09:16:11 pm
Update: This has been an amazing demonstration of skill and teamwork.  Abyrvalg, without physical hardware in hand, had this nut cracked so quickly I scarcely had time to get coffee.  Mike and Carrington supplied lots of useful info and insight. 

Full hack summary for v6.16 firmware:Mike has summarized neatly the procedure for the full hack, which allows fine-grained selection of licences using the license dialog, in this post. (https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg414039/#msg414039)  v6.20 firmware address changes are listed in this post (https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg963722/#msg963722).

Service Menu hack summary for firmware v6.16 Alex has written a nice summary of the service-menu hack, which enables multiple options and does not require a modified binary, but doesn't give the undocumented options or allow fine-grained control, in this thread. (https://www.eevblog.com/forum/testgear/agilent-mso7000-series-opinions-wanted/msg408947/#msg408947)  To to this on any firmware version: Instead of modifying a memory location, use the function call 'setServiceMode(1)' from the C shell, which works on all firmware versions.  (link here (https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg414538/#msg414538)).

Removing the SEC option:The workings of the SEC option were elucidated by abyrvalg, the hero of this thread.  The technique for removing the option is detailed here (https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg488361/#msg488361).

Original Post:I am aware that you can enable all the options and then set back the clock to keep these options enabled indefinitely.  That's certainly livable.  However, that's not a pretty solution, and it's nice to have the clock set properly for screen shots, etc.  The recent thread on hacking the MSO-X-2000/3000 series scopes piqued my curiosity. 

Unlike the MSOX-3000 update packages, the MSO5000/6000/7000 packages appear to be packed using a proprietary ZIP-derived format.

Another forum member found an emergency binary for the 5000, which indicates that this is running on VxWorks on a Power PC.  He also pointed to some possible telnet login info embedded in the binary, but telnet service doesn't appear to be enabled. 

Poking around with a 7000 series scope, I found that FTP is enabled, and you can log in with "panther", "pictures".  However, there doesn't seem to be much in the ftp directory--just a subdirectory labeled RAM0, apparently empty.  (It would be cool if that were a running RAM image, but no hint that's the case.)

If anyone has any ideas, it would be nice to post in this thread.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 15, 2014, 08:53:38 am
I'm also interested in this topic.  :D

For the DSO6000 and 7000 series, the MSO is an option. But I think that the 5000 series does not have LA i.e. only DSO version.
And for all of them no option to increase the BW. Moreover I'm not sure that the 100 and 300MHz versions have the same input stage.
Other options are, memory and serial decoders. But I think that the versions with two analog channels don't have available the serial decoding.

Hybrid chip at the DSO5054A and DSO6034A is 1NB7-8453.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on January 15, 2014, 09:44:17 am
That's all pretty much correct.  I recall looking at an "Emergency" update file  which was a lot less compressed/obscured than the normal updates, and appeared to have a service menu function to enable all licenses
Trials only have an expiry time, 14 days after the license is issued, but there is no check on start time, and if it expires it can be reinstalled once the clock is set back before the expiry time.
Although you can request trials for decodes on 2-analogue channel models, they don't work -  decodes are only supported on models with 4 analogue channels.

The scope runs VxWorks, so much less info around than for the  WinCE used on more recent scopes. 

The only potential risk is that as these scopes get more obsolete, at some point the trials may disappear from the Agilent Keysight website.

The actual license keys are quite short - don't recall the length exactly but most of it is the license name and the expiry date, so may be viable to reverse-engineer, or work out from a number of sample licenses & instrument IDs
 
 
 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dfnr2 on January 20, 2014, 01:17:13 am
On my MSO7104a, telnet sits on port 5810, and spawns a standard VxWorks shell.  Same login as ftp. 

This shell gives complete read/write access to memory, symbol tables, processes, filesystem, etc.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 25, 2014, 05:10:27 pm
I found this:
http://www.elitepvpers.com/forum/general-coding/103793-what-extension-does-jzp-go.html (http://www.elitepvpers.com/forum/general-coding/103793-what-extension-does-jzp-go.html)

But does not seem for Agilent oscilloscopes?



Is this the "Emergency" update file?
http://www.home.agilent.com/agilent/editorial.jspx?ckey=670496&id=670496&lc=eng&cc=US (http://www.home.agilent.com/agilent/editorial.jspx?ckey=670496&id=670496&lc=eng&cc=US)



Key format:
                                                                            Format: OPT-XXXXXXXXXXXX-Expires
POWER MEASUREMENT APPLICATION    ->   License Key: PWR-55284189E48F-10FEB2006
FPGA DYNAMIC PROBE FOR ALTERA        ->   License Key: ALT-4E46465F6684-10FEB2006
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on January 25, 2014, 10:31:54 pm
JZP is Agilent's implementation of LZSS compression. I have decompressor 99% ready (still have some problem with 3-5 last bytes of some kinds of files), will release it with sources next week.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on January 25, 2014, 10:55:05 pm
I have  copy of an uncompressed update form 2005 - ISTR this was some sort of "emergency" update to recover a failed normal  update.
It appears to have an "enable all licenses" function in a service menu.

Let me know if anyone wants a copy to investigate
 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 25, 2014, 11:49:49 pm
ELF = Executable and Linkable Format.

The first four bytes are always 0x7F followed by ELF in ASCII and constitute the magic number.
...

From sys6000.bin:

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=78534;image)

Source: http://en.wikipedia.org/wiki/Executable_and_Linkable_Format (http://en.wikipedia.org/wiki/Executable_and_Linkable_Format) 
There is a lot of information on the web about ELF + VxWorks.  :)
And exactly is running on a Power PC (14). IDA can open it!
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on January 26, 2014, 12:52:00 am
IDA can open it!

Sure. It even has a symbol table inside (not normal ELF symbols, but some OS-specific table). Use this script to apply them:
Code: [Select]
def ApplyVxSymbol(ea):
unk0 = Dword(ea)
name_ea = Dword(ea+4)
target_ea = Dword(ea+8)
flags = Dword(ea+12)

if flags==0x300: # external symbol
return

if isTail(GetFlags(target_ea)):
MakeUnkn(ItemHead(target_ea), DOUNK_EXPAND)

MakeName(target_ea, GetString(name_ea))

if flags==0x500: # code symbol
MakeFunction(target_ea)
elif flags==0x700: # initialized data
pass
elif flags==0x900: # uninitialized data
pass
else:
print "%08X: unknown symbol type %08X" % (ea, flags)


def ApplyVxSymbols(ea, count):
for i in xrange(count):
ApplyVxSymbol(ea+i*16)

Look for "Adding %ld symbols" string ref to find table ea and count.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on January 26, 2014, 12:38:22 pm

Is this the "Emergency" update file?
http://www.home.agilent.com/agilent/editorial.jspx?ckey=670496&id=670496&lc=eng&cc=US (http://www.home.agilent.com/agilent/editorial.jspx?ckey=670496&id=670496&lc=eng&cc=US)

The one I have is about 25% bigger - It was on the mso software updates page along with the first update, but disappeared a while later.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on January 26, 2014, 12:45:01 pm
On my MSO7104a, telnet sits on port 5810, and spawns a standard VxWorks shell.  Same login as ftp. 

This shell gives complete read/write access to memory, symbol tables, processes, filesystem, etc.
No response from my MSO6034a on that port.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 26, 2014, 04:09:45 pm
This is the powerpc Mictor debug connector.

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=78620;image)

Agilent MSO6034A scope mini-teardown (https://www.youtube.com/watch?v=5lYbD9_eIko#ws)
(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=78622;image)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dfnr2 on January 26, 2014, 04:18:43 pm
I am pretty sure that all the tools are there, if you can log into the VxWorks shell.  Hopefully it's enabled on the 5000 and 6000 series, but at least we know that the 5000 and 6000 can be induced to boot from the USB by switching on and off once (per the web site), and perhaps the BIN can be modified to spawn the telnetd to listen, if it's not already (or perhaps the emergency binary has it enabled).  Have you tried scanning the ports with NMAP for a telnet service?

For the 7000 series, the boot order can be set from the shell; by default it's flash then USB, but this can be reversed, which will allow experimentation without having to modify the working system.

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 26, 2014, 05:26:47 pm
At least we know that the 5000 and 6000 can be induced to boot from the USB by switching on and off once (per the web site), and perhaps the BIN can be modified to spawn the telnetd to listen, if it's not already (or perhaps the emergency binary has it enabled).
Yes, I think it's more than likely. But before we need the abyrvalg's LZSS decompressor, to extract the ELF.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dfnr2 on January 26, 2014, 06:47:16 pm
A decompressor is available if you log into the scope.  Abyrvalg gets credit for pointing that out.

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on January 26, 2014, 06:58:39 pm
mikeselectricstuff, 6k ports (as seen in "emergency" 6k bin): 5024 - telnet, 5025 - Sockets (???), 5042 - WebSockets (???).

dfnr2, Agilent's troubleshooting page describes the same USB boot procedure for 7k (turn on for 4sec), the only difference is that 5k/6k's bootloader doesn't support decompression, so it requires a plain ELF (bin), but 7k boot can load JZP directly, so no emergency BIN for it. An interesting question is: does 7k strictly require JZP or can load BIN too? In this case it is possible to start experimenting directly with unpacked BINs (no need to make a compressor).
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on January 26, 2014, 07:24:13 pm
mikeselectricstuff, 6k ports (as seen in "emergency" 6k bin): 5024 - telnet
That seems to work I get a "Welcome to Agilent MSO6034A" and >> prompt
Now what...?
Doesn't seem to respond to any obvious commands - just get the >> prompt back and "unidentified header" on the scope screen
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dfnr2 on January 27, 2014, 05:14:05 am
Mike,

Could that be the LXI port?  Do SCPI commands work?  Do you get that just by connecting, or do you have to enter the login and password?

Have you tried scanning the ports for another telnet protocol port?

Once you have a VxWorks shell, you should get some info by typing "help", but this doesn't seem to behave like the shell.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on January 27, 2014, 03:16:23 pm
Mike,

Could that be the LXI port?  Do SCPI commands work?  Do you get that just by connecting, or do you have to enter the login and password?

Have you tried scanning the ports for another telnet protocol port?

Once you have a VxWorks shell, you should get some info by typing "help", but this doesn't seem to behave like the shell.
That would make sense - didn't try any SCPI commands but the error message on the scope screen would tally with that  - will try port scan when I get a chance
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on January 27, 2014, 03:32:18 pm
Mike,

I've just looked into the newest 6k binary and telnet port is same there - 5024. Are you 100% sure you've tried 5024, not 5042 ocassionally?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on January 27, 2014, 03:34:55 pm
JZP LZSS unpacker with sources (https://bitbucket.org/flowswitch/agltzip)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 27, 2014, 05:50:34 pm
This shell gives complete read/write access to memory, symbol tables, processes, filesystem, etc.
Is there something like this?
/bin/license.lic
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 27, 2014, 05:53:46 pm
JZP LZSS unpacker with sources (https://bitbucket.org/flowswitch/agltzip)
Good job, the JZP LZSS unpacker works perfectly, thank you very much.  :-+
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on January 27, 2014, 06:29:26 pm
Latest experiments had shown that 7k doesn't accept raw BIN for boot, so JZP compressor is needed too, working...
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dfnr2 on January 27, 2014, 06:51:45 pm
Nice work, abyrvalg!  The compressor works perfectly on the mso7000.bin file here.  Of course it perfectly matches the .bin produced by the native uncompress routine.

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dfnr2 on January 27, 2014, 06:52:24 pm
This shell gives complete read/write access to memory, symbol tables, processes, filesystem, etc.
Is there something like this?
/bin/license.lic

Yes, exactly.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 27, 2014, 07:02:48 pm
Yes, exactly.
Well, I don't know how but I think the hack will be a cinch.
If you can, look for "license" as text in IDA.

Settings:
Processor: PowerPC big-endian.
Assembler: GNU Assembler.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on January 27, 2014, 07:06:11 pm
One warning as & when the licenses get figured out.
Stay away from the SEC option - apparently it disables all methods of saving data and is designed to not be removable - see this thread on the Agilent forums :

http://www.home.agilent.com/owc_discussions/thread.jspa?threadID=36931&tstart=0 (http://www.home.agilent.com/owc_discussions/thread.jspa?threadID=36931&tstart=0)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 27, 2014, 07:07:47 pm
I think that SEC is not available as a trial.



I found this IP in the sys6000.bin 130.29.67.163 and "got the time".
http://db-ip.com/130.29.67.163 (http://db-ip.com/130.29.67.163)



Note: lib6000.bin also is ELF, the others files, no.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on January 27, 2014, 09:20:59 pm
Mike,

I've just looked into the newest 6k binary and telnet port is same there - 5024. Are you 100% sure you've tried 5024, not 5042 ocassionally?
Port scan gives
21/tcp   open  ftp
80/tcp   open  http
111/tcp  open  rpcbind
1024/tcp open  kdm
5810/tcp open  unknown
5900/tcp open  vnc
[/quote]

Port 5024 via Telnet accepts SCPI commands
Port 5810 gives vxworks login,  user panther/ pw pictures works, looks a bit low-level though
Quote
help                           Print this list
dbgHelp                        Print debugger help info
edrHelp                        Print ED&R help info
ioHelp                         Print I/O utilities help info
nfsHelp                        Print nfs help info
netHelp                        Print network help info
rtpHelp                        Print process help info
spyHelp                        Print task histogrammer help info
timexHelp                      Print execution timer help info
h         [n]                  Print (or set) shell history
i         [task]               Summary of tasks' TCBs
ti        task                 Complete info on TCB for task
sp        adr,args...          Spawn a task, pri=100, opt=0x19, stk=20000
taskSpawn name,pri,opt,stk,adr,args... Spawn a task
td        task                 Delete a task
ts        task                 Suspend a task
tr        task                 Resume a task
tw        task                 Print pending task detailed info
w         [task]               Print pending task info

Type <CR> to continue, Q<CR> to stop:

d         [adr[,nunits[,width]]] Display memory
m         adr[,width]          Modify memory
mRegs     [reg[,task]]         Modify a task's registers interactively
pc        [task]               Return task's program counter
iam       "user"[,"passwd"]    Set user name and passwd
whoami                         Print user name
devs                           List devices
ld        [syms[,noAbort][,"name"]] Load stdin, or file, into memory
                               (syms = add symbols to table:
                               -1 = none, 0 = globals, 1 = all)
lkup      ["substr"]           List symbols in system symbol table
lkAddr    address              List symbol table entries near address
checkStack  [task]             List task stack sizes and usage
printErrno  value              Print the name of a status value
period    secs,adr,args...     Spawn task to call function periodically
repeat    n,adr,args...        Spawn task to call function n times (0=forever)
version                        Print VxWorks version info, and boot line
shConfig  ["config"]           Display or set shell configuration variables
strFree   [address]            Free strings allocated within the shell (-1=all)

Quote
-> version
VxWorks (for Agilent KOM PPC405, SA27E rev1) version 6.4.
Kernel: WIND version 2.10.
Made on Jun 30 2010, 11:33:12.
Boot line:
tffs;usb(0,0):sys6000 f=0x8 tn=a-m6034a-001360 o=emac0
value = 66 = 0x42 = 'B'



Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on January 27, 2014, 09:21:47 pm
Compressor added to repository. Slow (~1min for sysXXX.bin on modern machine), but working. Also if you do JZP->BIN->JZP, compressed files will be different in most cases (there are many ways to compress), but if you do one more JZP->BIN step, BINs will match (that's important part :D).
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on January 27, 2014, 09:40:57 pm
I think that SEC is not available as a trial.
No, but I don't think we're talking about trials here, are we... 8)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 28, 2014, 12:04:57 am
Port scan gives
21/tcp     open  ftp
80/tcp     open  http
111/tcp   open  rpcbind
1024/tcp open  kdm
5810/tcp open  unknown
5900/tcp open  vnc

Port 5024 via Telnet accepts SCPI commands
Port 5810 gives vxworks login,  user panther/ pw pictures works, looks a bit low-level though
Great!   8)



Is a PPC405 (Technology: IBM CMOS SA-27E, 0.18?m). Maybe, like this:
http://www.o2xygen.com/photo/PPC405EP-3LB266C/PPC405EP-3LB266C_001.pdf (http://www.o2xygen.com/photo/PPC405EP-3LB266C/PPC405EP-3LB266C_001.pdf)
Or this:
http://www.ic72.com/pdf_file/i/445461.pdf (http://www.ic72.com/pdf_file/i/445461.pdf)
Or ...

It have 4KB on-chip memory (OCM) static RAM.  ???



Amontec JTAGkey should read the JTAG ID. -> Exact PPC405 model.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dfnr2 on January 28, 2014, 07:01:34 am
Port 5810 gives vxworks login,  user panther/ pw pictures works, looks a bit low-level though
Great, so that's the same as the 7000.  The shell does have low-level capabilities in that it will allow memory reading and modification, but also allows high-level unix-like commands as well.  You are starting out in the C interpreter mode.  There is a more unix-y flavored mode which you can get to by typing "cmd" at the prompt, and you will get a hash prompt to indicate the cmd mode.  Type "help" and you will get a more compact list of commands; similar capabilities.  You can get back to the c-interpreter mode by typing "C". 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on January 28, 2014, 07:07:33 pm
Compressor updated.  Now JZP->BIN->JZP produces exact copy of source JZP, revision string is preserved too (check options).

Some new info: FlexLM v7 is used to verify "magic numbers", worth googling ;)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 28, 2014, 09:10:44 pm
Quote
Now JZP->BIN->JZP...
Wow, that was fast!  :clap:
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on January 29, 2014, 12:39:03 pm
http://pastebin.com/6MhpX1aB (http://pastebin.com/6MhpX1aB)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 29, 2014, 02:27:23 pm
DSO/MSO6000A's options:
Code: [Select]
N5423A I2C AND SPI SERIAL BUS Decode and Triggering.
N5424A CAN AND LIN SERIAL Decode and Triggering.
N5457A RS232/UART SERIAL Decode and Triggering.
N5455A Limit Mask Testing.
N5454A SEGMENTED MEMORY.
N5468A I2S Decode and Triggering.
N5469A Mil-Std 1553  Decode and Triggering.
N5432C FlexRay Decode and Trigger.
N5406A DYNAMIC PROBE APPLICATION FOR XILINX.
U1881A Power measurement application.
N5434A FPGA DYNAMIC PROBE FOR ALTERA. [OBSOLETE]
N2914A DSO to MSO upgrade.
N2911A 8 Mpts memory upgrade.

Note: E00 and MST (N5466A) are now standard.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on January 29, 2014, 02:54:04 pm
Something that would be interesting is to establish whether the lack of decode support on models with 2 analogue channels is a real hardware limitation, or a software crippling. A hack to enable decodes on 2-channel models would be very handy. 
I do also have a MSO6012A which I can look at to compare hardware  to the MSO6034A - could be the FPGA is smaller.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dfnr2 on January 29, 2014, 05:19:33 pm
Amazing abyrvalg--Very elegant.

By the way folks, don't get curious because of Mike's warning and try to enable the "SEC" option!  Don't ask me how I know.

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 29, 2014, 05:43:35 pm
@mikeselectricstuff:

Do you know if there is any 1K "ROM"/eeprom near of the ppc405?



Anyone have photographs of the mainboard of an DSO/MSO6054A or an DSO/MSO6104A?
I have searched but can not find anything ...
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: jahonen on January 29, 2014, 05:45:48 pm
Abyrvalg, thanks! That indeed worked like a charm.

Regards,
Janne
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on January 29, 2014, 06:06:24 pm
7000:
000 - Dummy license
ALL - All licenses (not all from this list actually)
REM - Remove all licenses
FMS - Factory MSO
MSO - MSO
FPG - FPGA Probe
001 - Acq Memory 1M
002 - Acq Memory 2M
004 - Acq Memory 4M
008 - Acq Memory 8M
AMM - Acq Memory Max
LSS - Low speed serial decode
AMS - Automotive serial decode
CAN - CAN trigger
SEC - Secure environment (!!! NONVOLATILE !!! Can't be removed with REM !!! STAY AWAY !!!)
BAT - Battery operation
ALT - FPGA Altera
FRS - Flex Ray serial decode
PWR - Power application
232 - UART/RS232 serial decode
DSW - Distributor license (package)
SGM - Segmented Memory
LMT - Limit Mask Test
TEL - Telecom Mask Test
1MV - 1mv Chan Scale Lmt
FRC - Flex Ray Compliance (package)
MST - Measurement Statistics
E00 - Enhancement 00
SND - I2S serial decode
FLX - Flex Ray serial decode package
DIS - Distributor license (package)
TOM - Tomotherapy LAN reset license
553 - MIL-STD-1553 serial decode
CIR - Circular segmented memory license
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: free_electron on January 29, 2014, 07:49:29 pm
if you need keys : i have a bunch enabled in mine (MSO7104A)
if there is a way through the LAN to grab them please explain how to do it. i will dump them and post. it could be of help

i have i2c , segmented memory , max memory and a few other.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on January 29, 2014, 08:03:01 pm
if you need keys : i have a bunch enabled in mine (MSO7104A)
if there is a way through the LAN to grab them please explain how to do it. i will dump them and post. it could be of help

i have i2c , segmented memory , max memory and a few other.
They live in the bin\licence.lic file - Telnet in with user:panther pw:pictures
cmd
file concat bin/lincense.lic

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on January 29, 2014, 08:13:32 pm
A few things of possible interest poking around the vxworks console
Quote

set deploy          Set or display the system debug flag.
..
[vxWorks]# set deploy
The system policy mode is set to 'field' (deployed mode is on).
[vxWorks]#
Is there an interesting debug mode?
Quote
set bootline        Change the boot line
show bootline       Display the boot line
show bootline
boot device          : tffs;usb
Maybe possible to change boot order?

















Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dfnr2 on January 29, 2014, 08:46:29 pm
A few things of possible interest poking around the vxworks console
Quote

set deploy          Set or display the system debug flag.
..
[vxWorks]# set deploy
The system policy mode is set to 'field' (deployed mode is on).
[vxWorks]#
Is there an interesting debug mode?
Quote
set bootline        Change the boot line
show bootline       Display the boot line
show bootline
boot device          : tffs;usb
Maybe possible to change boot order?

The boot order can be changed using (cmd)#set bootline , just as you suspect.  It doesn't seem to make much difference, as you can force the USB boot using the power cycle trick.

I am not certain about the deploy flag, but the VxWorks shell has some pretty potent debug capabilities, including searching the symbol table, stopping and restarting running processes, setting breakpoints, executing loaded functions directly from the command line with parameter passing, examining and modifying memory, disassembling functions that are loaded in RAM, and more.

By the way, for moving small files, you can log in via ftp and telnet; you can ftp small files to/from /ram0, and then within the shell move files between the /ram0 and the "bin" directory or elsewhere.  For larger files, such as a .bin file, a small usb stick works the same.


Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dfnr2 on January 29, 2014, 08:58:52 pm
Also by the way, placing a .bin file in the /bin directory results in a faster boot, if that's important.  However, there's not much room in the filesystem, so the .jzp file would have to be deleted first, and the .bin file copied from a usb stick (which could put there by ftp, if convenient.)  However, using a .bin instead of .jzp potentially reduces the available internal flash space for setups and mask files from about 700K to about 200K.

Note that .bin files apparently can not be used to boot from USB or for firmware updates, so the .jzp compressor is a crucial tool for making the process smooth.

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on January 30, 2014, 01:06:52 am
Can you clarify - if I put a .(hacked) .jzp file on a  USB stick, will it boot from that at startup, or install it ?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dfnr2 on January 30, 2014, 05:49:06 am
Can you clarify - if I put a .(hacked) .jzp file on a  USB stick, will it boot from that at startup, or install it ?
Yes, exactly.  Just like the original .jzp, if you preserve the header text when you unjzp and restore it when you packjzp (by specifying a file to store/retrieve it from).

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on January 30, 2014, 09:00:02 am
I'll clarify a bit:
To boot you need to enter "emergency" mode first - turn off, turn on for 4sec, turn off, then turn on with USB stick inserted as described here http://www.home.agilent.com/agilent/redirector.jspx?action=ref&lc=eng&nfr=&ckey=670496&cname=AGILENT_EDITORIAL (http://www.home.agilent.com/agilent/redirector.jspx?action=ref&lc=eng&nfr=&ckey=670496&cname=AGILENT_EDITORIAL)
For 6k series you need to have both BIN and JZP on USB stick (or even BIN only, seems that some or all 6k bootloader versions doesn't understand JZP, unlike 7k that understands JZP only).

For a permanent install you need to do it manually, so if you want just to try some bin - boot it from USB, but don't touch any JZP in scope's File explorer (that's where install is performed).
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 30, 2014, 02:09:49 pm
Hidden Menus (service).

Easter Egg:
Scope Easter Egg: Jumping letters on Agilent DSO6000 series (https://www.youtube.com/watch?v=OjsANKDRnjg#)
(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=79129;image)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 30, 2014, 05:00:39 pm
I know that not exist options to increase BW. But has anyone tried 500-000000000000-29FEB2029?                                                                                                         
Title: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: madshaman on January 30, 2014, 05:04:58 pm

I'll clarify a bit:
To boot you need to enter "emergency" mode first - turn off, turn on for 4sec, turn off, then turn on with USB stick inserted as described here http://www.home.agilent.com/agilent/redirector.jspx?action=ref&lc=eng&nfr=&ckey=670496&cname=AGILENT_EDITORIAL (http://www.home.agilent.com/agilent/redirector.jspx?action=ref&lc=eng&nfr=&ckey=670496&cname=AGILENT_EDITORIAL)
For 6k series you need to have both BIN and JZP on USB stick (or even BIN only, seems that some or all 6k bootloader versions doesn't understand JZP, unlike 7k that understands JZP only).

For a permanent install you need to do it manually, so if you want just to try some bin - boot it from USB, but don't touch any JZP in scope's File explorer (that's where install is performed).

Sweet!!!  I'm neck deep in other *h*t right now, but this is what I wanted to hear.

Enormous thanks to everyone hacking around with this right now; it's much appreciated.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on January 30, 2014, 05:10:12 pm
Had a quick play with a hack abyrvalg sent to try enabling decodes on a 2-channel scope but no joy yet (gives "Option not supported" when it boots)

Had a look for license names in the sys6000.bin image  :
AFAICS the list is the same as the 7000 one posted earlier

Tried ALL, Which enables some demos - these are for use in conjunction with a demo board - ISTR having this when I had a scope on loan before buying mine.
When enabled, licnse info shows FPG*,LSS*,AMS*,CAN*,ALT*,232,FRC*,SND*,FLX*,553*

I had a look insode my MSO6012A, and apart from the front-end and ch3/4 ASICs it looks the same - same FPGA, so might be viable to enable decodes on 2ch models.

Front-end is obviously different from the 6034. Interestingly the trigger channel uses the same front-end as the analogue channels.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on January 30, 2014, 05:15:20 pm
OK I've just found the first new thing I can do that wasn't possible with trials - CIR option for circular segmented memory.
 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 30, 2014, 05:32:44 pm
OK I've just found the first new thing I can do that wasn't possible with trials - CIR option for circular segmented memory.
There are references to this and other options in the sys6000.bin.
For example: 1mV Chan Scale lmt.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 30, 2014, 05:36:54 pm
Front-end is obviously different from the 6034. Interestingly the trigger channel uses the same front-end as the analogue channels.
@mikeselectricstuff: Thanks for the pictures.  :)
That's why I want to see pictures of the MSO/DSO6054A motherboard.



Note: There must be a memory of at least 1M (1024K) for the rom (rom6000.bin).
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on January 30, 2014, 06:05:42 pm
Carrington, there are even bigger memories, check https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg377764/#msg377764 (https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg377764/#msg377764) - that's a full list.
There are no bandwith options to enable with keys, but there are some NV capabilities flags programmed from factory also (one of them limits decoders usage on 2CH models).
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 30, 2014, 06:09:59 pm
Carrington, there are even bigger memories...
I get it.  ;) 48LC8M16A for example.

There are no bandwith options to enable with keys...
But, Agilent use the same the input stages for 300 and 500MHz models?
Hybrid chip at the DSO5054A and DSO6034A is 1NB7-8453.

There are some NV capabilities flags programmed from factory also (one of them limits decoders usage on 2CH models).
  8)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on January 30, 2014, 06:42:09 pm
Since our little "project" has advanced to a more hw-specific testing, but I don't have any hw (but have lots of work waiting), I think it's time to quit.
I've attached two scripts for anyone who has IDA and enough will to continue.
types.idc contains some useful type declarations, ApplyVxSymbols.py is a modified symbol table processing script (table format is a bit different in new versions). Set "demangled names -> names",  "assume gcc 3.x names", "general -> auto comments" IDA options, apply symbol table and you'll have a pretty readable output with names speaking for themselves.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 30, 2014, 06:54:40 pm
@ abyrvalg: Thank you very much for everything.  :-+



Another tool, readelf: http://code.google.com/p/lumpy/source/browse/trunk/compilers/c/bin/readelf.exe?r=57 (http://code.google.com/p/lumpy/source/browse/trunk/compilers/c/bin/readelf.exe?r=57)
Works with lib6000.bin
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on January 30, 2014, 09:03:39 pm
Symbols that readelf understands (ELF/DWARF) are understood by recent IDA versions directly (starting from 6.2 or 6.3, don't remember already). But sysXXXX.bin doesn't have that kind of symbols, it has VxWorks-specific table in data segment instead. That's why there is a special script for it. Look for "Adding %ld symbols" string, then follow a xref to it - there will be a function that xrefs 3 data items - some uninitialized var (.space 4), symbol count value (.long 0xXXXX) and the table itself (sparse initialized area starting with 00s).

Btw, libXXXX is referenced as "OpenSourceLibrary" in sys. I guess it contains some GPL code that can't be included into the "commercial" part (otherwise they must publish all their own  source code that is linked with GPLed code). Nothing actually interesting there. Model checks are inside initializeFeatures() function in sys (gpInstOptions var).
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Pehtoori on February 01, 2014, 08:54:23 pm
I am aware that you can enable all the options and then set back the clock to keep these options enabled indefinitely.  That's certainly livable.  However, that's not a pretty solution, and it's nice to have the clock set properly for screen shots, etc.

This text just hit my eyeballs. Can't you set date to 12.1.2037 then apply options and roll back to current date? Then your screen shots would be correct etc. (2037 because Unix epoch is 1.19.2038.)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 02, 2014, 12:22:02 am
Pehtoori, no, the feature key contains an absolute expiration date like 02FEB2014
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 02, 2014, 12:33:12 am
I am aware that you can enable all the options and then set back the clock to keep these options enabled indefinitely.  That's certainly livable.  However, that's not a pretty solution, and it's nice to have the clock set properly for screen shots, etc.

This text just hit my eyeballs. Can't you set date to 12.1.2037 then apply options and roll back to current date? Then your screen shots would be correct etc. (2037 because Unix epoch is 1.19.2038.)
The trials have a fixed expiry date 14 days from when they were issued
But with the license hack, it's no longer an issue.

The only thing remaining is to see if the decoders can be made to work on 2-channel models
 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 02, 2014, 02:24:19 am
I edited ApplyVxSymbols, now it also work with IDA v6.1 and python v2.6.6.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 02, 2014, 03:14:31 pm
The only thing remaining is to see if the decoders can be made to work on 2-channel models
A flash dump could be very useful. And even better two dumps from two different models, 2 and 4 channel for example.
Is this a flash? It is connected to the FPGA or to the PPC405?
(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=79576;image)

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: free_electron on February 02, 2014, 05:15:18 pm
That is flash memory. J2400 looks intriguiing...
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 02, 2014, 06:40:51 pm
There is no need to open the scope at all to read the flash. Just telnet to VxWorks debug console and dump the uppermost memory addresses:
FFF00000-FFFFFFFF - bootloader
FFEF0000-FFF00000 - NV area:
  FFEF0000 [7] - MAC address
  FFEF0020 [2] - "feature register" (SEC option flag)
the rest (before FFEF0000) should be a C:\ file system

It should be possible to program flash from debug console too - by invoking the programming function with "sp" command, but this can brick the scope easily, so better I'll not publish a detailed instruction until there will be some clear plan what and where to program.

IMO, there is no need for raw flash access at current stage. The bootloader part is much more obscure to work with (there is no symbol table), all interesting stuff is in sys part, really no idea what to look outside JZPs now. Changing the model type in NV will not work - Mike had tried my patch that sets 4CH flag in RAM and the scope just hung, so the only hope is some fine grained compatibility check patch in sys. The other interesting direction is C:\bin\CmdLine.cmd file - it is not present by default, but it is possible to specify several parameters to sys in it (i.e. there are parameters to enable each feature w/o key - can be more handy than patching sys because they will stay there after updates), look for hasOption() calls.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 02, 2014, 06:52:23 pm
That is flash memory. J2400 looks intriguiing...
Ok, you are referring to the J2400 connector. Yes, it can be the FPGA JTAG connector.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 02, 2014, 07:09:22 pm
There is no need to open the scope at all to read the flash. Just telnet to VxWorks debug console and dump the uppermost memory addresses:
FFF00000-FFFFFFFF - bootloader
FFEF0000-FFF00000 - NV area:
  FFEF0000 [7] - MAC address
  FFEF0020 [2] - "feature register" (SEC option flag)
the rest (before FFEF0000) should be a C:\ file system

It should be possible to program flash from debug console too - by invoking the programming function with "sp" command, but this can brick the scope easily, so better I'll not publish a detailed instruction until there will be some clear plan what and where to program.
That's great! I did not know that.

IMO, there is no need for raw flash access at current stage. The bootloader part is much more obscure to work with (there is no symbol table), all interesting stuff is in sys part, really no idea what to look outside JZPs now.
I thought about flash dumps from two different model, specially due to the content of gpInstOptions, because it is everywhere in the firmware.
I think that their content makes the difference between diferentes family features.

Changing the model type in NV will not work - Mike had tried my patch that sets 4CH flag in RAM and the scope just hung, so the only hope is some fine grained compatibility check patch in sys.
Is that flag related to gpInstOptions?

The other interesting direction is C:\bin\CmdLine.cmd file - it is not present by default, but it is possible to specify several parameters to sys in it (i.e. there are parameters to enable each feature w/o key - can be more handy than patching sys because they will stay there after updates), look for hasOption() calls.
This also is great!
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 02, 2014, 07:35:09 pm
I found this simulator: https://www-01.ibm.com/chips/techlib/techlib.nsf/products/PowerPC_4XX_Instruction_Set_Simulator_%28ISS%29 (https://www-01.ibm.com/chips/techlib/techlib.nsf/products/PowerPC_4XX_Instruction_Set_Simulator_%28ISS%29)
And this can also be helpful: http://pds.twi.tudelft.nl/vakken/in101/labcourse/instruction-set/ (http://pds.twi.tudelft.nl/vakken/in101/labcourse/instruction-set/)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 06, 2014, 05:58:47 pm
Hi guys!

I have news, thanks to the help of abyrvalg (he is a genius), my MSO6034A is now a MSO6054A.  :-+
The hybrid chip at the input stage supports 500MHz, but I don't have a signal generator to test.
Aslo the fastest pulse that I found was 800ps (tr), so I could not estimate the real BW.

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=80181;image)

Can anyone test the BW?

Note:In the attached files are the instructions to apply the patch.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 08, 2014, 11:31:50 am
That sample rate hack doesn't improve bandwidth
Attatched pics show a 250-750MHz stepped sweep before & after - no difference.

When I get time I'll see if the digital channels are improved.

My (early s/n 440013xx MSO6034A) didn't seem to work with the soft-loading method - appeared to go through the normal process of sitting a while with the "Single" LED on, but instead of booting the new FW it just sits there lighting up lines of the front panel LEDs til you pull the USB stick, at which point it reboots.

Hacked FW loads to flash OK though - it was only after loading I suddenly thought that without the soft-load capability, how would I recover if it hung, but I think that "emergency" update file is what that is for. I did try loading that version but again it sat in a led-flashy loop.
Think I'll stay away from playing with that scope - I still have a more recent MSO6012A to play on.

I wonder if the sample rate  hack will improve sample rate on digital channels on that...?
 





Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 08, 2014, 11:59:35 am
That sample rate hack doesn't improve bandwidth
Attatched pics show a 250-750MHz stepped sweep before & after - no difference.

Sample rate on digital channels appears to still be 2Gs/s

My (early s/n 440013xx MSO6034A) didn't seem to work with the soft-loading method - appeared to go through the normal process of sitting a while with the "Single" LED on, but instead of booting the new FW it just sits there lighting up lines of the front panel LEDs til you pull the USB stick, at which point it reboots.

Hacked FW loads to flash OK though - it was only after loading I suddenly thought that without the soft-load capability, how would I recover if it hung, but I think that "emergency" update file is what that is for. I did try loading that version but again it sat in a led-flashy loop.
Think I'll stay away from playing with that scope - I still have a more recent MSO6012A to play on.
I wonder if the sample rate  hack will improve sample rate on digital channels on that...?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 08, 2014, 01:47:33 pm
That sample rate hack doesn't improve bandwidth
Attatched pics show a 250-750MHz stepped sweep before & after - no difference.
I feared that, thanks for check it. This afternoon I will try to dumping all the internal memory, to investigate this.
For now I have the bootloader.

My (early s/n 440013xx MSO6034A) didn't seem to work with the soft-loading method - appeared to go through the normal process of sitting a while with the "Single" LED on, but instead of booting the new FW it just sits there lighting up lines of the front panel LEDs til you pull the USB stick, at which point it reboots.

Hacked FW loads to flash OK though - it was only after loading I suddenly thought that without the soft-load capability, how would I recover if it hung, but I think that "emergency" update file is what that is for. I did try loading that version but again it sat in a led-flashy loop.
Think I'll stay away from playing with that scope - I still have a more recent MSO6012A to play on.
I don't think that I can do anything about it.  :-//
Maybe it can be permanent "modified" using a command from VxWoks console.

When I get time I'll see if the digital channels are improved.
I wonder if the sample rate  hack will improve sample rate on digital channels on that...?
No, this improvement is only for 1GHz models [MSO610*A MSO710*A].
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dfnr2 on February 08, 2014, 07:36:50 pm
My (early s/n 440013xx MSO6034A) didn't seem to work with the soft-loading method - appeared to go through the normal process of sitting a while with the "Single" LED on, but instead of booting the new FW it just sits there lighting up lines of the front panel LEDs til you pull the USB stick, at which point it reboots.
Interesting.  Does it do that with the original sys6000.jzp, or only the hacked one?
Did you make certain the header was saved to a temp file on unzp and restored from that file on packjzp?  The header looks like:

@(#)REV: 06.16.0001 Apr 27 2011 15:25:28

And you should see it at the beginning of the hacked .jzp file if done properly.

Is it just the USB boot that fails, or does it not load via the file explorer "load file" mechanism?

By loading to flash, do you mean logging in via VxWorks and copying the file from USB to C:/bin?  It seems odd that the .jzp would load from the C:/bin directory, but not from usb.

I wonder if there is a Vxworks difference.  In my vxworks shell (in C mode,) version() yields:

-> version()
VxWorks (for Agilent KOM PPC405, SA27E rev1) version 6.4.
Kernel: WIND version 2.10.
Made on Apr 27 2011, 15:25:40.
Boot line:
tffs;usb(0,0):sys7000A f=0x8 tn=a-m7104a-040060 o=emac0
value = 67 = 0x43 = 'C'

What do you get from your version() call?


Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 08, 2014, 07:44:11 pm
Looks like a plain uncompressed .bin is required for some older 6ks (see 6k emergency procedure description - it says put BOTH bin and jzp to USB stick).
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 08, 2014, 08:10:43 pm
Looks like a plain uncompressed .bin is required for some older 6ks (see 6k emergency procedure description - it says put BOTH bin and jzp to USB stick).
Possibly - boot version is 01.10 BTW
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dfnr2 on February 08, 2014, 08:32:30 pm
Is it just the USB emergency boot that won't use the .jzp?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 14, 2014, 02:18:03 pm
Thanks to Carrington's enthusiasm we had identified the real source of BW/channels/MSO capabilities bits: they are read from Xilinx FPGA (internal name "Nevada", graphics controller) register. The availability of this value prior to any serious hw init suggests something simple like strapping resistors. So we ask everybody interested in this "project": please share hi res pictures of board area around FPGA. A 32-bit value at address 0xF6000004 (that is capabilities reg) is also interesting.

This value doesn't come from different FPGA bitstreams, the bitstream is same for entire family: it is in gspXXXX.jzp file.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 14, 2014, 03:02:06 pm
Thanks to Carrington's enthusiasm we had identified the real source of BW/channels/MSO capabilities bits: they are read from Xilinx FPGA (internal name "Nevada", graphics controller) register. The availability of this value prior to any serious hw init suggests something simple like strapping resistors. So we ask everybody interested in this "project": please share hi res pictures of board area around FPGA. A 32-bit value at address 0xF6000004 (that is capabilities reg) is also interesting.

This value doesn't come from different FPGA bitstreams, the bitstream is same for entire family: it is in gspXXXX.jzp file.
Interesting - there is a Xilinx flash config PROM - presumably the stream in that file is to reprogram the flash.
Here is a pic of the MSO6012A, Resistor at bottom-left corner looks a lot like a pullup/pulldown option
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 14, 2014, 03:05:11 pm
A 32-bit value at address 0xF6000004 (that is capabilities reg) is also interesting.
This value can be get with this command from vxWorks console (cmd mode):
mem dump -n 1 -w 8 0xF6000004
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 14, 2014, 03:07:29 pm
Interesting - there is a Xilinx flash config PROM - presumably the stream in that file is to reprogram the flash.
Here is a pic of the MSO6012A, Resistor at bottom-left corner looks a lot like a pullup/pulldown option
Thanks for the picture.


From your MSO6034A video:
(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=81420;image)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 14, 2014, 03:14:56 pm
Just did some probing - though it looks like the resistor nearest the FPGA is an option, alternating with the empty pads to the left of it, measurements seem contradict this. (Unless it reads the pin and then outputs a low - not sure why you'd do that unless  it's doubling as a debug output.

Will compare to my mso6034a later before investigating further

Another possibility - I wonder if maybe the FPGA prom has a default config, but then gets reloaded once the system boots. Probably wouldn't be too hard to check by probing (with another scope of course!)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 14, 2014, 03:25:48 pm
Just did some probing - though it looks like the resistor nearest the FPGA is an option, alternating with the empty pads to the left of it, measurements seem contradict this. (Unless it reads the pin and then outputs a low - not sure why you'd do that unless  it's doubling as a debug output.

Will compare to my mso6034a later before investigating further

Another possibility - I wonder if maybe the FPGA prom has a default config, but then gets reloaded once the system boots. Probably wouldn't be too hard to check by probing (with another scope of course!)
I dont know but I think worth trying.



If all this fails, we still have a patch for MSO6034A that allows 1ns/div and 4GSPS, but unfortunately the BW remains at 300MHz.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 14, 2014, 04:05:47 pm
Just as a curiosity, to enable the service menu (only for 6000 series) type this in the vxWorks console:
   mem modify -w 1 0x00966E67
vxWorks response should be:
   0x00966e67:    0x00-
Now type "0x01" after "0x00-" to enable service menu.
new vxWorks response should be:
   0x00966e68:    0x00-
Now type "." after "0x00-" to exit.

Now go to "Options" -> "Licenses".



Note: To enable service menu in the 7000 series use this command:
mem modify -w 1 0x009A2187
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 14, 2014, 05:28:52 pm
The bitstream is reprogrammed during update only, no load at each start. If the scope finds gsp file present in c:/bin at start, it programs it into PROM (there is a GPIO bitbang JTAG XSVF player), then deletes.

The BW bitfield of caps reg is 4 bits wide with possible values 1,2,4,8.

Other bitfields:
2 bits defining number of channels with possible values 1-2CH, 2-4CH
5 bits defining MSO capability and some yet unknown caps with possible values 0,1,2,4,8,16, 1 means "no MSO", rest are MSOs with some additional options, 16 defines some cool model with external serial keyboard instead of normal panel buttons.

It's unclear how FPGA itself samples those resistors - there can be something more than 0/1, like floating state detection, also possible values sets suggest "something to one-hot" decoding  (it would look silly to sacrifice so many IO pins for direct one-hot strapping), so it's time for hw test.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 14, 2014, 05:32:50 pm
Carrington, try setting "service mode" combined with something like "all lics" in that service menu. There are some functions that adds such command line parameters, and almost all of them require "srv" param to be present too.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 14, 2014, 05:39:20 pm
Carrington, try setting "service mode" combined with something like "all lics" in that service menu. There are some functions that adds such command line parameters, and almost all of them require "srv" param to be present too.
Yes, a lots of demo modes (Update rate, MSO, Serial Buses, Data Bursts and Mask Test).
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 14, 2014, 05:41:53 pm
16 defines some cool model with external serial keyboard instead of normal panel buttons.
I can't immediately find details but they did announce a "headless" version of this scope for ATE etc., which was the mainboard in a rackmount case with no keyboard or display.
Not sure if it ever actually appeared, but chances are there could be some support for it
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 14, 2014, 05:53:08 pm
16 defines some cool model with external serial keyboard instead of normal panel buttons.
I can't immediately find details but they did announce a "headless" version of this scope for ATE etc., which was the mainboard in a rackmount case with no keyboard or display.
Not sure if it ever actually appeared, but chances are there could be some support for it
The L versions maybe (DSO/MSO6***L)?

(http://pribory-si.ru/upload/iblock/a15/Oscillograf.jpg)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 14, 2014, 06:05:14 pm
Yes, a lot of demo modes (updatr rate, MSO, serial bus table, ...).

Oops, I didn't finished my thought: try setting service mode with some lic feature checkboxes (service mode checkbox must be set, not just that flag in memory) then reboot - it should persist, if I understood that part correctly.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 14, 2014, 06:08:17 pm
Yes, a lot of demo modes (updatr rate, MSO, serial bus table, ...).

Oops, I didn't finished my thought: try setting service mode with some lic feature, then reboot - it should persist, if I understood that part correctly.
Yes, all remain.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 14, 2014, 06:10:18 pm
Good! So it's unnessesary to keep patched sys to have features enabled.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 14, 2014, 06:20:21 pm
Good! So it's unnessesary to keep patched sys to have features enabled.
But if the service mode is disabled some of this options disappear.
But this is not a problem, we just have to leaving active the service menu.
However, I prefer the patch, with non-default options: CIR, 1MV, ...
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 14, 2014, 06:36:52 pm
Good! So it's unnessesary to keep patched sys to have features enabled.
But if the service mode is disabled some of this options disappear.
But this is not a problem, we just have to leaving active the service menu.
However, I prefer the patch, with non-default options: CIR, 1MV, ...
Do we know what 1MV actually does?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 14, 2014, 06:38:46 pm
Do we know what 1MV actually does?
Yes, it is a magnification of 5mV/div, no real range.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 14, 2014, 06:48:04 pm
I have a MSO6034A for a week now, is 7 years old, but a internal file indicate that was calibrated by TestEquity half a year ago.
Is necessary a special equipment to calibrate it or not?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 14, 2014, 07:29:48 pm
Do we know what 1MV actually does?
Yes, it is a magnification of 5mV/div, no real range.
I assume that's only on the higher bandwidth models - my MSO6012A does 1mV as standard
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 14, 2014, 07:32:45 pm
I assume that's only on the higher bandwidth models - my MSO6012A does 1mV as standard
Yes, but for 100MHz models 1mV/div is a magnification of 2mV/div.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 14, 2014, 09:58:59 pm
Better close-up of 6034A - resistor in different position, but voltages are the same.

However if they're using links to indicate hardware versions, chances are there are other differences which probably mean there's limited scope for useful enhancements.

I had a play with the centre two resistors (1K) on the 6034A :
Left  Right
N     N   6104A
N     Y    6034A
Y      Y    6102A
Y      Y    6032A

In 6104 mode, timebase goes to 500ps/div , but no extra bandwidth  :(

Also something odd happens when 50R input selected - I suspect the relay control lines may be used differently on the 610xA
Will try on 6012A tomorrow.




Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 14, 2014, 11:14:31 pm
So there must be another resistor in BW group to make missing x01x, x05x models. 6012 board should show it.
Sad that 03->10 doesn't change BW, but maybe some other modifications like 01->03 will work, who knows. Need to compare the frontends otherwise.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dfnr2 on February 14, 2014, 11:54:15 pm
All this is very interesting indeed.  I'm temporarily unable to access my scope or my home computer for a few more days, so I'm unable to join in the fun at the moment, except vicariously.

I thought the MSO can be enabled/disabled purely in firmware via the license (or service mode/command line switch).  What happens to the FPGA register when the MSO option is added/removed? 

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 14, 2014, 11:56:34 pm
Well, that's great.  :-+
So we just have to dig a bit deeper.

No 500MHz version yet? Intriguing...  :scared:
I know that the frontends (hybrid chip) at the DSO5054A and MSO/DSO6034A is 1NB7-8453.
But perhaps, the BW is set by a jumper on the same input stage, and 20MHz BW limit is set by a separate pin.

The 6000 series datasheet says:
   MSO/DSO601xA/603xA 2GSa/sec each channel.
   MSO/DSO605xA/610xA 4GSa/sec half channel; 2GSa/sec each channel.
   Equivalent-time sample rate: 400GSa/s (real-time off)
   LA sample rate: 2GSa/sec one pod; 1GSa/sec each pod.

So this is not true (in red) for 6000 series (I mistook with the 30000X series, I'm sorry):
When I get time I'll see if the digital channels are improved.
I wonder if the sample rate hack will improve sample rate on digital channels on that...?
No, this improvement is only for 1GHz models [MSO610*A MSO710*A].

Mike, many thanks for testing.  :-+
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 15, 2014, 12:19:13 am
All this is very interesting indeed.  I'm temporarily unable to access my scope or my home computer for a few more days, so I'm unable to join in the fun at the moment, except vicariously.

I thought the MSO can be enabled/disabled purely in firmware via the license (or service mode/command line switch).  What happens to the FPGA register when the MSO option is added/removed?
MSO is a purely software option as the hardware is the same for a DSOxxxx and MSOxxxx
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 15, 2014, 12:31:42 am
I thought the MSO can be enabled/disabled purely in firmware via the license (or service mode/command line switch).  What happens to the FPGA register when the MSO option is added/removed?
I would have to check it in the code, but probably nothing.

It's simple, double check.
FPGA indicates MSO? Not.
MSO is enabled by a license? Yes. -> MSO enabled.

With the BW option is different, some BW features (GSa/s, ns/div) can be forced by a firmware patch, but others not.
To force something via software, the HW must have ability to do that and also the HW must allow enable it by SW.



I apologize for my English, sometimes is not easy to me express what I really mean.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 15, 2014, 01:28:28 am
I thought the MSO can be enabled/disabled purely in firmware via the license (or service mode/command line switch).  What happens to the FPGA register when the MSO option is added/removed?
I would have to check it in the code, but probably nothing.

It's simple, double check.
FPGA indicates MSO? Not.
MSO is enabled by a license? Yes. -> MSO enabled.

The only thing that wouldn't have MSO is a 5000 - though this may be indicated by an build option link.
My guess is that anything that is selected by a hardware link needs a different hardware build - why would they limit themselves?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 15, 2014, 10:55:45 am
FPGA indicates MSO? Not.
MSO is enabled by a license? Yes. -> MSO enabled.

The code proves the opposite: you need to have fpga mso bit set AND some mso feature (FMS/MSO) installed to have MSO. So no fpga mso bit set -> no MSO.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 15, 2014, 11:37:47 am
The code proves the opposite: you need to have fpga mso bit set AND some mso feature (FMS/MSO) installed to have MSO. So no fpga mso bit set -> no MSO.
Thanks for clarifying, because now I have no need to review the code.  :)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 15, 2014, 12:27:45 pm
I'm getting a feeling these fpga bits are not for cutting the options, but to indicate true hw limits like no 4ch - no sw way to use it, no MSO circuit - again, no sw can fix that, serial terminal instead of normal panel - no way to use normal panel, no battery compartment - no battery option (found such value in 5-bit group recently). Only BW options are under question - same frontend chips on some models gives hope.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 15, 2014, 01:57:08 pm
Just tried changing the links on MSO6012A- all permutations other then original make it hang.
On restore I get an error message saying setup defaulted due to A/D error -presumably accessing nonexistent CH3/4 hardware
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 15, 2014, 03:05:47 pm
If you can, please check this:

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=81520;image)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 15, 2014, 03:35:17 pm
7000 series mainboard:
(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=81522;image)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 15, 2014, 08:19:43 pm
mikeselecricstuff, can you please post 6012 board picture? How does it's original resistor combination look?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 15, 2014, 08:26:47 pm
If you can, please check this:

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=81520;image)
These just seem to be a way to fix the control lines of 2 analogue switches - one changes at the same time as the 200-500mV relay, didn't see the other change but the switch has what looks like a bias connected with Y shift on it.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 15, 2014, 08:27:50 pm
mikeselecricstuff, can you please post 6012 board picture? How does it's original resistor combination look?
Already did :
https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg387483/#msg387483 (https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg387483/#msg387483)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 15, 2014, 08:33:13 pm
These just seem to be a way to fix the control lines of 2 analogue switches - one changes at the same time as the 200-500mV relay, didn't see the other change but the switch has what looks like a bias connected with Y shift on it.
Damn, I thought that it could be what we seek.
Thanks for testing.  :-/O
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dfnr2 on February 15, 2014, 11:05:51 pm
I agree with abyrvalg that the FPGA strap options is most likely setting hard limits; so MSO=(6000/7000), /MSO=(5000).  Probably these decisions were wired in before the marketing department started gearing up.

Obviously the question is, did Agilent purposely cripple the scopes to prevent 2-channel serial decodes, or do they disallow it to prevent an invalid condition. 

For example, I could imagine that the implementation is such that the MUXes in the FPGA (or ASIC) want to talk to all digital + All 4 analog channels, but if only 2 channels are active, some handshaking never happens and the decoder hangs, but if all four channels are activated on a 2-channel scope, then some handshaking at the A/D FIFO doesn't happen, and the scope hangs, etc.

So, it might be interesting to follow the serial decode code, both option setup, and decode setup to see how it sets up the hardware.  I think that if it's not a hardware limitation, that is where the answer lies.  BTW, do the 5000 series have the serial trigger option, or nothing at all?

Dave
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 15, 2014, 11:32:14 pm
Enabling decodes by software patches lets you get as far as enabling, but as soon as acquisition starts it hangs.
This seems to suggest some reliance on hardware that's only present on 4ch models. Hard to see what this could be, as 2ch models use the same size of FPGA.
I wonder if maybe the acquisition ASIC has something, memory perhaps, that is used for 2ch and also 4ch , but the same hardware in the second ASIC fitted in the 4ch models is used for decodes.
As they already have the licensing scheme, and a system that lets them charge more for the same license on higher-end models, I can't see why there would be any reason to have additional disables on decodes, so I think it's reasonable to assume the decodes need some hardware that's not in the 2ch build.
 
Thinking about it, on the 2ch, the ASIC handles 2 analogue plus 16 digital channels, but on 4ch, it only has to deal with the additional 2 analogue channels, so maybe the MSO logic is somehow shared with decodes.

I may be mis-remembering this, but ISTR reading that on the MSOX models, you can't do decodes on the digital channels, which suggests some shared resources.
 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 16, 2014, 04:18:28 pm
Please, correct me if you think that I'm wrong, but I think that little more can be done.
Well, all what we have achieved is quite good.

Special thanks to abyrvalg, without your support all efforts have been in vain.
Also to mikeselectricstuff, chiefly by having the courage to make the hardware tests.
Thanks also to dfnr2 for their collaboration.

Great job guys.  :-+
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 16, 2014, 04:33:34 pm
Please, correct me if you think that I'm wrong, but I think that little more can be done.
Well, all what we have achieved is quite good.

Special thanks to abyrvalg, without your support all efforts have been in vain.
Also to mikeselectricstuff, chiefly by having the courage to make the hardware tests.
Thanks also to dfnr2 for their collaboration.

Great job guys.  :-+

I'd tend to agree, though 300->500MHz might be possible - if we could see the inside of a 605x that would be handy to compare.
ISTR reading the specs many years ago and noticing the 1GHz versions looked like they were significantly different, but don't recall why - may have been that they gang up channel pairs.  There is certainly something different about the relay switching, and there is an unpopulated, bypassed relay position on the 6034A.
However there may still be other hardware differences that preclude anything useful here.

However a lot of useful functionality has been acheived :
1) Freedom from reliance on Agilent to supply trial licenses, which could stop at any time, and not needing to set the date back.
2) 8M memory for old scopes which didn't have it as standard (they changed to 8M standard and increased the cost fairly early on)
3) Circular segmented memory
4)? firmware support for DIY battery option?
 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 16, 2014, 07:21:30 pm
Time to open 9000/90000 thread? :)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dfnr2 on February 17, 2014, 11:32:38 pm
Hey guys, this has been a very educational experience.  Thanks to abyrvalg for the magic and wisdom.  I will still have to work my way through all the recent discoveries when I can get back to the scope.  Thanks to Carrington and Mike for energy and for pushing forward.

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 17, 2014, 11:44:09 pm
I just scored a DSO6034A (now MSO6034+all the goodies!)  for GBP1750, so will be selling the MSO6012A soon - let me know if any info is needed  from this model, though it doesn't appear that much is possible apart from non-trial SGM, CIR and LMT options.
 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 17, 2014, 11:56:17 pm
This motherboard is an agilent 7000 series.
As can be appreciated is very similar to the 6000 series.

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=81800;image)

This other is an DSO6104A, also there are some differences.

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=81804;image)

Unfortunately these images don't have enough detail to see the resistors near the FPGA.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 18, 2014, 12:11:55 am
And another MSO6104A.

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=81807;image)

Is very likely that the 1NB7-8453 support up to 1GHz. But all the 6104A boards have additional hardware compared with 6034A.
I was unable to find any 6054A board.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: tesla500 on February 18, 2014, 12:57:22 am
I have an MSO6104A, I'll get some pictures later.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 18, 2014, 03:17:38 pm
This look very interesting XCF04S:
(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=81935;image)

Platform Flash series of in-system programmable configuration PROMs. Available in 1 to 32 Megabit (Mbit) densities, these PROMs provide an easy-to-use, cost-effective, and reprogrammable method for storing large Xilinx FPGA configuration bitstreams.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 18, 2014, 04:39:02 pm
As mikeselectricstuff already discovered:

MODEL    X1 X0
-------------------
6032       0    0
6102       0    1
6034       1    0
6104       1    1

X1 = Nº Channels.
X0 = BW.

How is set 605*? 

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=81891;image)

603 SMD Marking Code:
33C = 21.5 x 1000 = 21K5.
01B = 10.0 x 100 = 1K.



X1=X0=0 -> 6032:
   mem dump -n 1 -w 8 0xF6000004  ->  0x00000262

X1=0, X0=1 -> 6102:
   mem dump -n 1 -w 8 0xF6000004  ->  0x00000268

X1=1, X0=0 -> 6034:
   mem dump -n 1 -w 8 0xF6000004  ->  0x000002A2

X1=X0=1 -> 6104:
   mem dump -n 1 -w 8 0xF6000004  ->  0x000002A8
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 18, 2014, 06:44:03 pm
For the moment I have only clear one thing, is impossible convert a 603* in a 610*, due to the absence of a lot of components (I'll upload pictures later).
Seems that the jumpers and FPGA just indicates the capabilities, as abyrvalg was feared.

However I continue searching jumpers, but we need pictures of a 605*.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 18, 2014, 07:01:24 pm
Try removing that other resistor connected to X0. There must be 4 combinations for BW field.
I can try DeBIT'ing the bitstream, but this will be "cannon against sparrows" as we say here :D
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 18, 2014, 07:07:59 pm
Try removing that other resistor connected to X0. There must be 4 combinations for BW field.
Do you think that it have an internal "momentary" pull down, or something like that?

No resistance (X0 side), no effect, still indicates 6104. 
Only 1K as (X0 side) pull down, still indicates 6034.
Only 1K as (X0 side) pull up, still indicates 6014.
So there is nothing unusual here... But it is clear, the FPGA also should indicate 605*.

@mikeselectricstuff: What returns your 6012 (default settings) to "mem dump -n 1 -w 8 0xF6000004"?

I can try DeBIT'ing the bitstream, but this will be "cannon against sparrows" as we say here :D
LOL...
Yes, highly probable...
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 18, 2014, 08:57:32 pm
Looks like no more jumpers near the FPGA.  >:(

  - 69X (51.1 ohm) and 01A (100 ohm) seen to maintain signal integrity.
  - 01C (10K) are oscillator pull up.

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 18, 2014, 10:03:57 pm
This look very interesting XCF04S:
Yes - this is where the FPGA code lives. I assume they use this rather than soft-loading so there's a display at startup. When reprogramming (gsp6000.jzp) it shows a red "not power off "message - my guess is at the very least it would leave you with no display, maybe even unrecoverable if teh FPGA does other critical stuff, though you could probably program it via JTAG by copying from another scope.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 18, 2014, 10:28:30 pm
Yes - this is where the FPGA code lives. I assume they use this rather than soft-loading so there's a display at startup. When reprogramming (gsp6000.jzp) it shows a red "not power off "message - my guess is at the very least it would leave you with no display, maybe even unrecoverable if teh FPGA does other critical stuff, though you could probably program it via JTAG by copying from another scope.
Yes, I think so too.
Seems that there something more connected to this JTAG connector, but I only can read this identifier 05046093h (XCF04S).
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 18, 2014, 10:35:27 pm
Yes - this is where the FPGA code lives. I assume they use this rather than soft-loading so there's a display at startup. When reprogramming (gsp6000.jzp) it shows a red "not power off "message - my guess is at the very least it would leave you with no display, maybe even unrecoverable if teh FPGA does other critical stuff, though you could probably program it via JTAG by copying from another scope.
Yes, I think so too.
Seems that there something more connected to this JTAG connector, but I only can read this identifier 05046093h (XCF04S).
You'd normally have the config memory and FPGA on the JTAG, but maybe also the main CPU. It could also be that the memory has a dedicated programming connector - I'm not too familar with the Xilinx confg devices. 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 18, 2014, 11:02:48 pm
You'd normally have the config memory and FPGA on the JTAG, but maybe also the main CPU. It could also be that the memory has a dedicated programming connector - I'm not too familar with the Xilinx confg devices.
Surely XCF04S and FPGA share the same JTAG connector. But like you, I'm not familiar with this configuration. Anyway, I fear that investigate here, will be a waste of time.



I wonder if these resistors will make a difference between 603* and 605*. The strange thing is that they are 0 ohm.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 18, 2014, 11:09:22 pm
I think we really need to see inside a 605x!
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 18, 2014, 11:13:58 pm
I think we really need to see inside a 605x!
Definitely, yes.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 19, 2014, 12:01:01 am
We have a 6012 that must have some difference from both 6034/6104 (from FPGA's point of view), so:
1. carefully comparing 6034 board to 6012 can give some clue (there must be some other FPGA input that differs)
2. if 4 possible BW codes are defined as 4 combinations of just 2 FPGA inputs, we know a resistor that defines one bit (3rd from the left, changing 300M/1G), then 6012 should have that yet unknown second input in a state inverted relative to 6034/6104, so inverting ONLY our known 300M/1G input should convert 6012 to 6052.
mikeselectricstuff, are you 100% sure that 6012 hangs with both left and right resistors present? This can be critical. For example if you had something wrong with left resistor when testing this combination, the scope would hang just because of 4CH mode activated. Even if it hangs, trying telnet can still work (there is multitasking OS inside), so examining F6000004 value still can be possible.

FPGA PROM JTAG header should be connected in parallel with main CPU. I mean not including the CPU into the scan chain, but CPU being a JTAG master (it's CPU who programs that PROM normally). The PROM contents can be obtained from gspXXXX.jzp - it's just a compressed XSVF file.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: havok1919 on February 19, 2014, 12:25:07 am
Having just made it through the thread I was preparing to update my DSO5014A with the latest firmware from the Agilent site (06.16.0001) and opted out of curiosity to check what version was actually on there in the first place:

System Version: 06.17.0001

Soooo... Does an update .jzp get copied and remain on the scope during an update?  (Put another way, is there any way to archive this version?)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 19, 2014, 12:51:00 am
To set the 25MHZ BW limit, does not use a serial protocol, for all the other parameters  no idea, I can't see changes (I used a DMM).

Edit: Yes, it uses a serial protocol.



FPGA PROM JTAG header should be connected in parallel with main CPU. I mean not including the CPU into the scan chain, but CPU being a JTAG master (it's CPU who programs that PROM normally). The PROM contents can be obtained from gspXXXX.jzp - it's just a compressed XSVF file.
Yes, the JTAG connector seem to be connected to the CPU too.

We have a 6012 that must have some difference from both 6034/6104 (from FPGA's point of view), so:
1. carefully comparing 6034 board to 6012 can give some clue (there must be some other FPGA input that differs)
2. if 4 possible BW codes are defined as 4 combinations of just 2 FPGA inputs, we know a resistor that defines one bit (3rd from the left, changing 300M/1G), then 6012 should have that yet unknown second input in a state inverted relative to 6034/6104, so inverting ONLY our known 300M/1G input should convert 6012 to 6052.
Right now this, to me, is a mystery.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 19, 2014, 01:03:18 am
Having just made it through the thread I was preparing to update my DSO5014A with the latest firmware from the Agilent site (06.16.0001) and opted out of curiosity to check what version was actually on there in the first place:

System Version: 06.17.0001

Soooo... Does an update .jzp get copied and remain on the scope during an update?  (Put another way, is there any way to archive this version?)
Yes. Open a telnet:

Telnet [Your IP] 5810
VxWorks login: panther
Password:pictures
->cmd
[vxWorks]#show devices
[vxWorks]#cd C:
[vxWorks]#cd bin
[vxWorks]#ls
[vxWorks]#file copy sys5000.bin /usb0/
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: havok1919 on February 19, 2014, 03:50:49 am
[...]Telnet [Your IP] 5810[...]

Awesome.  Thanks!

I pulled "@(#)REV: 06.17.0001 Dec  1 2011 16:02:27" from my machine (it was a factory reconditioned unit from December 2012).  The patch address appears to be 0x002E7B20 in this version.

I have no idea how it differs from 06.16.0001, but since it seems not to be available from the Agilent website let me know if anyone else wants to check it out.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 19, 2014, 09:28:32 am
We have a 6012 that must have some difference from both 6034/6104 (from FPGA's point of view), so:
1. carefully comparing 6034 board to 6012 can give some clue (there must be some other FPGA input that differs)
2. if 4 possible BW codes are defined as 4 combinations of just 2 FPGA inputs, we know a resistor that defines one bit (3rd from the left, changing 300M/1G), then 6012 should have that yet unknown second input in a state inverted relative to 6034/6104, so inverting ONLY our known 300M/1G input should convert 6012 to 6052.
mikeselectricstuff, are you 100% sure that 6012 hangs with both left and right resistors present? This can be critical. For example if you had something wrong with left resistor when testing this combination, the scope would hang just because of 4CH mode activated. Even if it hangs, trying telnet can still work (there is multitasking OS inside), so examining F6000004 value still can be possible.

FPGA PROM JTAG header should be connected in parallel with main CPU. I mean not including the CPU into the scan chain, but CPU being a JTAG master (it's CPU who programs that PROM normally). The PROM contents can be obtained from gspXXXX.jzp - it's just a compressed XSVF file.
Pretty sure - after a while it went to a mode cycling a few rows of LEDs.
As the 6012 has a completely different front-end I don't think there;s anything worth exploring there.

Another possibility is the 603x/5x front-end hybrids could be graded, and have an indicator pin to indicate type, but an additional link would seem to be more likely.
Have you found anything in software to indicate where it's looking for?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 19, 2014, 10:41:14 am
Another possibility is the 603x/5x front-end hybrids could be graded, and have an indicator pin to indicate type, but an additional link would seem to be more likely.
Have you found anything in software to indicate where it's looking for?
I don't know, could be.
But I'm pretty sure that the capabilities are indicated by the FPGA, because the firmware patched to switch from MSO6034A to MSO6054A, just modify the registry returned by the FPGA (
and it works perfectly).
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 19, 2014, 11:35:29 am
FPGA stands in the way, concealing those pins. From CPU side I can see that BW option is defined by bits 3..0 of F6000004 reg:
1 - 100MHz
2 - 300MHz
4 - 500MHz
8 - 1GHz.

Other bits there:
7..6 are number of channels:
1 - 2CH
2 - 4CH

14..10 are instrument family and some other features:
0 - MSO 0 (TBD)
1 - DSO 2
2 - MSO 2
4 - MSO 1
8 - MSO 0 with battery
16-MSO 2 with serial keyboard
families: there are 3 major instrument families selected by bits above, bandwidth bits selects an instrument inside that family:
0: 5462x (never selected),   5464x (never selected), 601x, 603x, 605x, 610x
1: 601x, 603x, 605x, 610x
2: 703x, 705x, 710x,   501x (DSO only), 503x (DSO only), 505x (DSO only)

Carrington's F6000004 dumps:
6034 - 2A2 : bits 14..10=0 -> MSO family 0, bits 7..6=2 -> 4CH, bits 3..0=2 -> 300MHz
6104 - 2A8 : bits 14..10=0 -> MSO family 0, bits 7..6=2 -> 4CH, bits 3..0=8 -> 1GHz

It's hard to say anything about pins based on this: definitely these bits doesn't reflect pins states directly (note changing center right resistor results in 2 or 8 value in 3..0), must be some binary to one-hot decoders. I can try bitstream decompiler next week (I'm away from my bigger PCs now), but that Spartan-3 device is pretty huge, so I'll need some infos to identify that specific part of logic somehow: first is F6000000 register value (0, not 4, this is hardcoded bitstream revision reg) - this can help identifying register bus in general, second is our left/right resistors FPGA pin locations (there are vias to all FPGA pins on the back board side, so a quick sweep with a DMM beeper can identify both pins) - these should lead to straps sensing logic directly.

Another interesting possibility is obtaining different models FPGA pins snapshots with JTAG SAMPLE instruction, then comparing. Sure, there will be many dynamic pins, but they can be filtered out by taking many dumps on the same model and ruling out all changes. This can be hard if done by hand, but pretty easy if programmed.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 19, 2014, 12:22:32 pm
It's hard to say anything about pins based on this: definitely these bits doesn't reflect pins states directly (note changing center right resistor results in 2 or 8 value in 3..0), must be some binary to one-hot decoders. I can try bitstream decompiler next week (I'm away from my bigger PCs now), but that Spartan-3 device is pretty huge.
Are you sure? That will be a nightmare...

First is F6000000 register value (0, not 4, this is hardcoded bitstream revision reg) - this can help identifying register bus in general, second is our left/right resistors FPGA pin locations (there are vias to all FPGA pins on the back board side, so a quick sweep with a DMM beeper can identify both pins) - these should lead to straps sensing logic directly.
1.  mem dump -n 1 -w 8 0xF6000000  -> 0x02b4141300000262.
2.  X0 FPGA pin is (AB20) (Red circle).
3.  X1 FPGA pis is (AA20) (Blue circle).
Please see attached pictures.

Another interesting possibility is obtaining different models FPGA pins snapshots with JTAG SAMPLE instruction, then comparing. Sure, there will be many dynamic pins, but they can be filtered out by taking many dumps on the same model and ruling out all changes. This can be hard if done by hand, but pretty easy if programmed.
I tried that with TOPJTAG Probe, but it only find the XCF04S, no the FPGA.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 19, 2014, 01:14:37 pm
Excellent! The pins are close to each other, check nearby signals (Y3, W1-W4) - where do they go? This can be much easier than decompiling :)
Decompilation shouldn't be so hard - we don't need entire design in Verilog, just identifiing pins that feed the same piece of logic that our known pins do should be enough.

So that JTAG header is dedicated PROM programming connector. Perhaps there is some debug header that goes to FPGA's JTAG?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 19, 2014, 01:19:41 pm
Excellent! The pins are close to each other, check nearby signals (Y3, W1-W4) - where do they go? This can be much easier than decompiling :)
Decompilation shouldn't be so hard - we don't need entire design in Verilog, just identifiing pins that feed the same piece of logic that our known pins do should be enough.

So that JTAG header is dedicated PROM programming connector. Perhaps there is some debug header that goes to FPGA's JTAG?
Possibly on that MICTOR connector?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 19, 2014, 06:35:39 pm
I have taken these photographs, they can serve as a reference or comparison.
Unfortunately, the legend on the smaller components, can't be read... LOL, I need more megapixels.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 19, 2014, 06:36:43 pm
Rear side:
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: taemun on February 19, 2014, 06:37:38 pm
It's possible (although... insane?) that the FPGA JTAG isn't broken out, and it just reads the bitstream from the XCF chip on boot.  Not sure how they debugged the FPGA in-circuit, or maybe that was all done by the time this board was laid out.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 19, 2014, 06:46:50 pm
It's possible (although... insane?) that the FPGA JTAG isn't broken out.
The FPGA pins TMS, TDI and TDO are not directly accessible (no via).
No via, but this pins have a PAD, I don't know if that's what you mean.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: taemun on February 19, 2014, 06:48:15 pm
Well they'll have a pad for mechanical/soldering reasons - they don't have to be attached to anything else on the board. I meant "broken out" as in "going to a header".
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 19, 2014, 06:53:19 pm
Well they'll have a pad for mechanical/soldering reasons - they don't have to be attached to anything else on the board. I meant "broken out" as in "going to a header".
Ok, now I understand, but, no idea.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: tesla500 on February 19, 2014, 07:05:02 pm
Isn't the config flash chained up with the FPGA JTAG? I seem to recall the platform flash can be programmed directly via JTAG. Is J2600 near the flash the JTAG for the FPGA/flash?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 19, 2014, 07:46:03 pm
Is J2600 near the flash the JTAG for the FPGA/flash?
J2600 appears to be only for the flash, but it is also connected to the CPU (at least TCK).

I seem to recall the platform flash can be programmed directly via JTAG.
I don't know...

Isn't the config flash chained up with the FPGA JTAG?
Apparently not...



And no idea of what is connected to the MICTOR connector.

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 19, 2014, 07:51:58 pm
In theory if everything was debugged on some special debug board, then there is no reason to have that jtag accessible on production version. Just route PROM's jtag to a header for initial/repair programming and to the CPU for regular updates (as I wrote before, CPU uses simple GPIO bitbang XSVF player to update that PROM).
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 19, 2014, 07:54:39 pm
In theory if everything was debugged on some special debug board, then there is no reason to have that jtag accessible on production version. Just route PROM's jtag to a header for initial/repair programming and to the CPU for regular updates (as I wrote before, CPU uses simple GPIO bitbang XSVF player to update that PROM).
Well that's what it seems they did.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: tesla500 on February 19, 2014, 09:11:56 pm
The FPGA JTAG pins are all on the outside edge of the part, so as long as they haven't been grounded, you could possibly insert pin probes at the edge of the FPGA and connect to the JTAG, whether they've been brought to vias or not. Some very fine jig work would be required though.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 19, 2014, 09:15:57 pm
The FPGA JTAG pins are all on the outside edge of the part, so as long as they haven't been grounded, you could possibly insert pin probes at the edge of the FPGA and connect to the JTAG, whether they've been brought to vias or not. Some very fine jig work would be required though.
Good idea, you're right. I'll try.  :-+
First, I will try to "make" a probe, to do that.



I leave it for today.
Cheers.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 19, 2014, 11:15:21 pm
The FPGA JTAG pins are all on the outside edge of the part, so as long as they haven't been grounded, you could possibly insert pin probes at the edge of the FPGA and connect to the JTAG, whether they've been brought to vias or not. Some very fine jig work would be required though.
Good idea, you're right. I'll try.  :-+
First, I will try to "make" a probe, to do that.



I leave it for today.
Cheers.

..or at least use to find where JTAG pins are brought out.
I can't believe they wouldn't have put JTAG somewhere accessible - there's a Mictor trace connector (probably not fitted on later models), and it could be that the JTAG chain passes through other chips, but I'd be highly surprised if it wasn't there - there's just no way anyone would leave such an important interface off such a complex board.
 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: tesla500 on February 20, 2014, 12:02:59 am

..or at least use to find where JTAG pins are brought out.
I can't believe they wouldn't have put JTAG somewhere accessible - there's a Mictor trace connector (probably not fitted on later models), and it could be that the JTAG chain passes through other chips, but I'd be highly surprised if it wasn't there - there's just no way anyone would leave such an important interface off such a complex board.
 
I have to agree, it would be stupid not to wire up the FPGA JTAG. It's easy to confirm if the JTAG pins are chained up with the FPGA or not, just measure from the XCF pins to J2600. Perhaps there's a config bit that makes the FPGA JTAG a passthrough? If it became a passthrough it wouldn't show up in the chain.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 20, 2014, 09:12:09 am
The FPGA JTAG pins are all on the outside edge of the part, so as long as they haven't been grounded, you could possibly insert pin probes at the edge of the FPGA and connect to the JTAG, whether they've been brought to vias or not. Some very fine jig work would be required though.

Even no need to go under the edge, those vias at the top side of BGA edges go to underlying two outer ball rows, just scratch the green mask a bit to reveal copper.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 20, 2014, 11:34:10 am
The probe was a success. Is a piece of enameled wire with a diameter of ~0.3mm, with the tip bent 90º, see attached image (probe.jpg).

Vias and pads are aligned, but the trace that join them not always join the adjacent via with the adjacent pad, see attached image (bga.jpg).
For this reason some of the connections mentioned in my previous posts are incorrect. I'm going to edit these posts, now. Leaving only the connections that are correct for sure.

These are the good news, see attached image (FPGA-JTAG.jpg). Now I just have to follow this traces.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 20, 2014, 06:04:46 pm
The FPGA JTAG seems to be forming a chain with the ASICs and CPU JTAG (excluding XCF04S). This chain could be accessed from the Mictor connector, but this circuit (the chain) is not fully implemented. Looks like Agilent only fully assembled this circuit, if necessary, adding and/or removing some components (probably some resistors). I think that the Mictor connector is mounted, because add it manually later must be hard.

The JTAG connector J2600 is exclusively for the XCF04S, but CPU also accesses this port.
The connector J2400, also seems to be connected to the CPU JTAG.

TMS and TDI (FPGA) are connected to the ASICs U29000, TDO ends on a open jumper between the FPGA and the Mictor, and I have been unable to find where TCK goes.
However I don't think that it matters...

Also seems that the front end is controlled only by the CPU (at least a part).
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 20, 2014, 06:25:45 pm
I think that the Mictor connector is mounted, because add it manually later must be hard.
This connector is probably only for software development/debug - I've only seen it fitted on my early 6034, not on later 6012 or 6034.


Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 20, 2014, 07:05:30 pm
This connector is probably only for software development/debug - I've only seen it fitted on my early 6034, not on later 6012 or 6034.
Probably.



The input stage (with a bit more detail).

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=82199;image)

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=82201;image)

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 20, 2014, 09:47:54 pm
Also seems that the front end is controlled only by the CPU (at least a part).

Do you see any direct CPU-frontend traces there? From sw side it looks more like all channel hw is controlled throught "Ponderosa" chips (ASICs closer to CPU). ADC ("Talon") control paths are seen as long serial shift registers chains attached to Ponderosas.

Talons looks same for all BW options, there is a calibration function that temporary configures them to maximum sample rate regardless of model, takes some measurements, then sets back to model-defined values. So BW limiting should happen somewhere in the frontend. Maybe we should measure and compare levels on 1NB7 pins of 6034 and 6012?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 20, 2014, 11:32:25 pm
Do you see any direct CPU-frontend traces there?
Yes, some traces go straight from the CPU to the 74ACT174s.

From sw side it looks more like all channel hw is controlled throught "Ponderosa" chips (ASICs closer to CPU). ADC ("Talon") control paths are seen as long serial shift registers chains attached to Ponderosas.
Surely also uses "Ponderosa".

Talons looks same for all BW options, there is a calibration function that temporary configures them to maximum sample rate regardless of model, takes some measurements, then sets back to model-defined values.
Interesting...

So BW limiting should happen somewhere in the frontend.
I also think so.
But the question is: What chip sets the BW? CPU, FPGA, ASCIs or 1NB7-8453. And how? A command, a jumper, ...

Maybe we should measure and compare levels on 1NB7 pins of 6034 and 6012?
Unfortunately the 6012 does not use the 1NB7. The 1NB7-8453 is mounted on the 603*s, 605*s and probably on the 610*.



This frontend is not from a 603*, I don't know to which model belongs.

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=82221;image)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 20, 2014, 11:47:11 pm
I had a recollection that there was something odd about the 6104 so I re-read the datasheet and spotted this :
Quote
MSO/DSO601xA/603xA: 2 GSa/sec each channel
MSO/DSO605xA/610xA: 4 GSa/sec half channel*, 2 GSa/sec each channel
....
*  Half channel is when only one of channel 1 or 2 is turned on, and only channel 3 or 4 is turned on.

This would suggest that on both the 6054 and the 6104, it uses the whole ADC, and maybe both input amps for one channel instead of muxing it between 2 channels.
I suspect that the omitted, bypassed, relay on the 6034 is to connect the two inputs together to feed into the two parallel channels. Would be pretty easy to check this.
I think this means that you're probably more likely to be able to upgrade a 6054 to a 6104 than a 6034 to a 6054, however I expect the 6054 and 6104 differ mostly by the frontend - really  looking forward to seeing Tesla500's 6104 pics - make sure you look under those cans (assuming they haven;t soldered them for 1GHz!)

 



Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: tesla500 on February 21, 2014, 08:15:04 am
Here's an imgur album of MSO6104A images

http://imgur.com/a/7vAeG (http://imgur.com/a/7vAeG)

This scope is (I believe) from 2006, I purchased it in 2008 from Newark as a refurbished former demo unit. I figured if it survived being shipped around so much it's probably pretty solid. They stupidly listed a bunch of them on ebay at the same time with no reserves, got it for $5k. All the future auctions had reserve prices after that  ;D They even gave me a free 8M upgrade because the listing said it had that, but it only came with 1M enabled :-DD.

Uses a different hybrid than the others, 1NB7-8477.

Edit:
Found a pic of the hybrid with the top popped off. I wonder what scope that's from, and what they're trying to do with those coax cables soldered onto the outputs?
http://i.imgur.com/j20E81s.jpg (http://i.imgur.com/j20E81s.jpg)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 21, 2014, 12:40:47 pm
From sw side most (or all?) analog side parameters are controlled by a set of virtual "registers" that can be dumped with dumpRegValues console command. Physical implementations of those regs varies: DACs inside Ponderosas (gains, offsets,...), latches on CPU GPIOs (relays, some other signals - must be those 74ACT174s), some serial shift register on CPU GPIO, several regs in FPGA (calibration signal generator).

100MHz models have significantly different register set - more Ponderosa DACs, some small "Scorpion preamplifier" chip controlled by CPU GPIOs, while all higher models use some big "Rattler" chip replacing both "Scorpion" and many Ponderosa internal DACs.

Conclusion: FPGA has little control over analog side, so try faking F6000004 reg value directly:
20BE10: 83 C9 00 04 -> 3B C0 xx xx
where xxxx - lower 16 bytes of desired F6000004 value (see my previous post on that reg). Dump your original value, take lower 4 nibbles, edit lowest nibble to change BW option.

Another interesting thing: looks like entire serial decoding is done in FPGA, but based on our patch failures I guess FPGA disables all this functionality based on "center left" resistor that defines number of channels.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 21, 2014, 03:00:48 pm
@ tesla500:

Wow! Thank you so much for the pictures.  :-+
Now we can definitely discard the 1GHz option.

I found a picture of the bottom, see attachments.



Now, we need to see inside of an 605*.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 21, 2014, 03:02:21 pm
From sw side most (or all?) analog side parameters are controlled by a set of virtual "registers" that can be dumped with dumpRegValues console command. Physical implementations of those regs varies: DACs inside Ponderosas (gains, offsets,...), latches on CPU GPIOs (relays, some other signals - must be those 74ACT174s), some serial shift register on CPU GPIO, several regs in FPGA (calibration signal generator).
I have to try that. It must be a long string of "0" and "1".  :scared:

100MHz models have significantly different register set - more Ponderosa DACs, some small "Scorpion preamplifier" chip controlled by CPU GPIOs, while all higher models use some big "Rattler" chip replacing both "Scorpion" and many Ponderosa internal DACs.
It's amazing how you handle the SW.  :)

Conclusion: FPGA has little control over analog side, so try faking F6000004 reg value directly:
20BE10: 83 C9 00 04 -> 3B C0 xx xx
where xxxx - lower 16 bytes of desired F6000004 value (see my previous post on that reg). Dump your original value, take lower 4 nibbles, edit lowest nibble to change BW option.
First I have to re-mount the oscilloscope, now is completely disassembled. PSU, display, fan, ...
But don't hesitate, I'll try that.  :-+

Another interesting thing: looks like entire serial decoding is done in FPGA, but based on our patch failures I guess FPGA disables all this functionality based on "center left" resistor that defines number of channels.
Then there's nothing to do (for now), because the oscilloscope hangs when nonexistent channels are enabled.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 21, 2014, 03:38:37 pm
This would suggest that on both the 6054 and the 6104, it uses the whole ADC, and maybe both input amps for one channel instead of muxing it between 2 channels.
Yes, both models use the whole ADQ ASIC for one of the inputs.

I suspect that the omitted, bypassed, relay on the 6034 is to connect the two inputs together to feed into the two parallel channels. Would be pretty easy to check this.
I can't find the connection between stages. I think that this is done internally in the ADC, ie the two ADCs (within the ASIC) get sampled from only one of the inputs.

I think this means that you're probably more likely to be able to upgrade a 6054 to a 6104 than a 6034 to a 6054.
We need to see inside of an 605*.

However I expect the 6054 and 6104 differ mostly by the frontend - really  looking forward to seeing Tesla500's 6104 pics - make sure you look under those cans (assuming they haven;t soldered them for 1GHz!)
I hope that the 605* use the 1NB7-8453.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 21, 2014, 04:11:02 pm
Then there's nothing to do (for now), because the oscilloscope hangs when nonexistent channels are enabled.

I have an idea: set 2CH model to 4CH with resistor, but patch F6000004 read to report 2CH to sw, so FPGA will not disable decoders (if there was any real disable), but sw will not try to access nonexisting channels. If this config will work, then probably a more fine-grained patch (enable decoders, but keep 2CH mode) will work.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 21, 2014, 08:52:24 pm
Then there's nothing to do (for now), because the oscilloscope hangs when nonexistent channels are enabled.

I have an idea: set 2CH model to 4CH with resistor, but patch F6000004 read to report 2CH to sw, so FPGA will not disable decoders (if there was any real disable), but sw will not try to access nonexisting channels. If this config will work, then probably a more fine-grained patch (enable decoders, but keep 2CH mode) will work.

It's a great idea!
But I can't prove it, because is necessary a DSO/MSO6**2A.
I just have a MSO6034A, and mikeselectricstuff has put on sale his 6012A.

If anyone with an DSO/MSO6**2A wants to try, I can prepare the firmware.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 21, 2014, 09:12:50 pm
I still think there must be some fundamental reason why decodes aren't enabled on 2ch - why would they lose out on the potential license sales, and why would they impose a restriction over what the existing licensing system implements?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: tesla500 on February 21, 2014, 09:57:46 pm
Perhaps the FPGA doesn't get the raw "digital" (analog channel after going through a comparator) signals fed to it? I wonder if the trigger is less advanced on the 2 channel models, or the external trigger channel takes up the comparator that would otherwise be used for the serial decode.

Do we have a board picture of a 2 channel 300MHz+ version? Mike's 6012A has only the ADC + one ASIC, the 4channel ones have 2 ADCs feeding 2 ASICs and another ASIC in between the two. Does the 6xx2A have the extra ASIC as well, or does it look like the 6012 with only 2?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 21, 2014, 10:25:08 pm
I think that extra ASIC in the middle is "Rattler" device I've mentioned already. From sw side it looks quite big (tens DACs controlling gain, offset, hysteresys, flatness of each channel), it's control interface is connected to master "Ponderosa" (twin ASICs closer to CPU, each serving 2 channels) and it is single, shared between all channels.
"Rattler" is present on all models with BW>100MHz regardless of channels.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: tesla500 on February 21, 2014, 11:05:10 pm
I think that extra ASIC in the middle is "Rattler" device I've mentioned already. From sw side it looks quite big (tens DACs controlling gain, offset, hysteresys, flatness of each channel), it's control interface is connected to master "Ponderosa" (twin ASICs closer to CPU, each serving 2 channels) and it is single, shared between all channels.
"Rattler" is present on all models with BW>100MHz regardless of channels.

Thanks for the insight! That makes sense, I didn't think that "Rattler" would have much to do with the primary acquisition functions, otherwise it would be a major architecture change between 100MHz and higher models.

Another tidbit, apparently the SEC option can be removed. At my previous job, we bought a 7000 series off demo that had SEC enabled. I really wanted it removed, and after fighting awhile with Agilent (initially they were going to give out a "kill" license that removes all licenses, but later said that wouldn't work for SEC), they agreed to remote in via network and remove it. Unfortunately we had some firewall problems that delayed it, and I left the company before we could do it. I was planning to do a packet capture when it happened to know what they did and maybe get a lead on hacking it. Would have been nice to have this hack 3+ years ago.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 22, 2014, 12:04:53 am
There are many things that we don't know. I have no idea why Agilent not design the models with two channels to allow digital decoding.

I would love to know what's under the sink that is in between the two ASICs, ie "Rattler".
It should not be a big IC, because under the heatsink can be seen a lot of parts around, but I can't see the periphery of the ASIC.

Today I almost finished cleaning it, tomorrow will be completely assembled, it will look like new.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 22, 2014, 09:01:16 am
tesla500, the magic command is writeFeatureRegister(0xFFFF) in C shell. Confirmed by another forum user who had activated SEC for curiosity. That "feature register" is just a location in flash.

Rattler looks like a big patch for the original architecture (single chip replaces so many functions originally belonging to both Ponderosas). I suspect something went wrong with Podnerosa at higher frequencies, but it was too late (ASIC in production), so they had fixed it this way.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 24, 2014, 03:57:51 pm
I modified the firmware, as you indicated, it produces the same effect as my previous patch, but is more elegant.

Also without changing any parameters between firmwares, dumpRegValues returns this:

1. Original firmware (MSO6034A):

Code: [Select]
latcha                 0x30          0x70          0x70          0x30
latchb                 0x7c          0x78          0x78          0x7c
rattler0              0x168          0x80          0x80         0x168
rattler1               0xc0         0x100         0x100          0xe0
rattler2               0xf8          0xc8          0xc8          0xf8             <-
rattler3              0x104          0xc8          0xba          0xfc
rattler4               0xbe          0x92          0x94          0xaa
rattler5               0000          0000          0000          0000
rattler6              0x179          0x11          0x39         0x1cf
rattler7              0x1c0         0x11d         0x125         0x1c0
offset             0x01feef      0x01ff5e      0x0204d9      0x01fee4
level ext            0x7fe0
pod thresh           0x5f10        0x6dc0
ti ramp adj          0xb813             <-
hamster0                 00
hamster1                0x4
hamster2               0xf3
hamster3                 00
hamster iramp         0x800
probe                0x8000        0x8000        0x8000        0x8000
value = 10 = 0xa

2. Patched firmware (MSO6054A):

Code: [Select]
latcha                 0x30          0x70          0x70          0x30
latchb                 0x7c          0x78          0x78          0x7c
rattler0              0x168          0x80          0x80         0x168
rattler1               0xc0         0x100         0x100          0xe0
rattler2              0x140         0x148         0x148         0x140             <-
rattler3              0x104          0xc8          0xba          0xfc
rattler4               0xbe          0x92          0x94          0xaa
rattler5               0000          0000          0000          0000
rattler6              0x179          0x11          0x39         0x1cf
rattler7              0x1c0         0x11d         0x125         0x1c0
offset             0x01feef      0x01ff5e      0x0204d9      0x01fee4
level ext            0x7fe0
pod thresh           0x5f10        0x6dc0
ti ramp adj          0xb7c4             <-
hamster0                 00
hamster1                0x4
hamster2               0xf3
hamster3                 00
hamster iramp         0x800
probe                0x8000        0x8000        0x8000        0x8000
value = 10 = 0xa

After doing several tests, I discovered that the oscilloscope used a serial protocol to communicate with the 1NB7-8453.
To open captures, download this software: http://tools.asix.net/download/analyzers/sigma-omega_2013-09-19_en.exe (http://tools.asix.net/download/analyzers/sigma-omega_2013-09-19_en.exe)

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=82824;image)

?        The last string recivier, is returned on falling edges (1NB7-8453 output) .
Q1[0] New data to the 1NB7-8453, it get on rising edges (1NB7-8453 input).
Q0[0] CLK to the 1NB7-8453 (1NB7-8453 input).
Q2[0] As indicator (1NB7-8453 input).

Example Q1[0]:
   BW Limit CH4 ---------------
   0101 1001 1101
   0010 1001 0000
   0111 0011 0000
   ---------------------------------

   Full BW CH4 -----------------
   0100 0001 1101
   0010 0110 0000
   0111 1001 0000
   ---------------------------------

What the hell we must send to set a BW of 500MHz?  :scared:

Full captures:
   Star Up: Star_Up_CH4_.zip (see attached files).
   BW Limit to Full BW: LMT-BW_to_Full-BW_CH4_.zip (see attached files).



Q0[0] = (see pictures).
Q1[0] = (see pictures).
Q2[0] = (see pictures).
Q3[0] = U308 (CH2).
Q4[0] = U308 (CH2).
Q5[0] = Unknown.

Q0[1] = Relay.
Q1[1] = AC/DC.
Q2[1] = Unknown.
Q3[1] = Relay.
Q4[1] = TRT Q400 (CH3).
Q5[1] = Unknown.

Note: [1] registry is related to latcha.



Edit1: I have corrected some errors, sorry.
Edit2: I added a partial protocol description, it may be wrong  (no documentation).
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on February 24, 2014, 08:54:14 pm
"rattler2" regs are "Gain Vernier" DACs.

I think there is no point trying to send something on CPU-1NB7 link: the CPU is already cheated with our patch, so it must send correct values w/o any further intervention (unless there is some other limit setting). The problem must be in some other place: either in FPGA or some hardwired 1NB7 pins.

Is there some BW limit setting in scope's UI ? I mean some normal parameter like gain/offset to filter out undesired frequencies (I see some UI-related functions with names like setChanBwLimit). Perhaps something in UI needs to be adjusted after BW patch?

Another quiestion is probes - are they suitable for that higher frequency? Are they just simple cable/connector/matching? I see names mentioning "ProbeId" - no way to detect that probe is wrong and limit BW here?

Bad news about DeBIT: it's support for Spartan3 is very basic, I see no IOs in it's output at all :(
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 25, 2014, 12:46:47 am
"rattler2" regs are "Gain Vernier" DACs.
Well, it's the only thing that changes in these records.  :-//
Which of them corresponds to the BW?

I think there is no point trying to send something on CPU-1NB7 link: the CPU is already cheated with our patch, so it must send correct values w/o any further intervention (unless there is some other limit setting). The problem must be in some other place: either in FPGA or some hardwired 1NB7 pins.
Sure! But the above test also shows that the original firmware (MSO6034A) does not send the same command to set full BW, but the only change is one bit.
   
   Full BW CH4 -----------------
   0100 0001 1001
   0010 0110 0000
   0111 1001 0000
   ---------------------------------

Is there some BW limit setting in scope's UI ? I mean some normal parameter like gain/offset to filter out undesired frequencies (I see some UI-related functions with names like setChanBwLimit).
Yes, to my knowledge the only is BW limit, that sets a maximum frequency of 25MHz.

Perhaps something in UI needs to be adjusted after BW patch?
I don't know.

Another quiestion is probes - are they suitable for that higher frequency? Are they just simple cable/connector/matching?
The default probes are of 500MHz . And has a x10 identifier pin, but nothing more.

I see names mentioning "ProbeId" - no way to detect that probe is wrong and limit BW here?
Yes, some probes do this, but I don't have any of those.
I don't have a signal generator that reached up to 500 MHz, so I rely only on the impulse response (tr).

Bad news about DeBIT: it's support for Spartan3 is very basic, I see no IOs in it's output at all :(
A shame. :(
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 25, 2014, 04:26:30 pm
I think so, ie, is required another firmware patch to set the BW in the 1NB7-8453.



Everything that starts with 0111 is offset.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on February 28, 2014, 10:54:13 pm
As we know the last BW patch is as follows (6000 series): At 0x0020BE10: 83 C9 00 04 -> 3B C0 02 A*
Where * corresponds with bits 3 to 0 of 0xF6000004 (FPGA): 0x1 -> 100MHz, 0x2 -> 300MHz, 0x4 -> 500MHz and 0x8 -> 1GHz.
Now the content of gpInstOptions[A8]=0x00966E60 acquires its value based on bits 3 to 0 of 0xF6000004, and it can be:
0x03 -> 300MHz, 0x04 -> 500MHz and 0x05 -> 1GHz (among other).

So, if now in cmd mode, with the command "mem modify -w 1 0x00966E60" we change the value pointed by gpInstOptions[A8]
by one of the above, ie (0x03,0x07,0x04,0x08 or 0x05) and after that, in C mode we execute "initFamilyMemberDiff", then ta-daah!
We have changed many front end parameters (BW limit, rise time limit, etc). However, not all the hardware is compatible between different models, so you may get unwanted results.
But the important thing is, it does not check anything, it just try to apply changes.

So, the patch does what it should do, so extra BW patches are not needed. Now, why a significant increase in BW is not appreciated going from 6034A to 6054A? No idea, may be is necessary do a calibration after the patch. Or the HW does not support this BW, no idea.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Emanuel on March 04, 2014, 08:31:54 pm

It's a great idea!
But I can't prove it, because is necessary a DSO/MSO6**2A.
I just have a MSO6034A, and mikeselectricstuff has put on sale his 6012A.

If anyone with an DSO/MSO6**2A wants to try, I can prepare the firmware.


Hello everyone, I am following the nice achievements in this forum for a while, but paractically this is my first post.
As I purchased the MSO6012A from mikeselectricstuff if there is anything I can help with, for example the quoted test I'll be glad to help.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on March 04, 2014, 09:09:04 pm
Hello everyone, I am following the nice achievements in this forum for a while, but paractically this is my first post.
As I purchased the MSO6012A from mikeselectricstuff if there is anything I can help with, for example the quoted test I'll be glad to help.
Hi, welcome to the EEvblog forum.

If you want to try is so simple:

1. Download this tool: https://bitbucket.org/flowswitch/agltzip/downloads/jzp_0.2.zip (https://bitbucket.org/flowswitch/agltzip/downloads/jzp_0.2.zip) (courtesy of abyrvalg).
2. Extract the binary file from sys6000.jzp.
3. In the binary file at 0x0020BE10 reemplace this 83 C9 00 04 by 3B C0 02 61 (using a hex editor).
4. Compress the new sys6000.bin to sys6000.jzp.
5. Install the patched firmware.
6. Set 2CH model to 4CH with resistor, X1 = '1' (remove R2).

Please note that there is no guarantee that this will work.

Edit: I added a link to the correct tool.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Emanuel on March 04, 2014, 10:16:45 pm
Well, unless there is a serious hardware change between the 2 and 4 ch. versions I believe that eventually it will work.
So far, during the last week I managed to apply the FLIR E4 and Rigol DSA815 mods, you guys do a great job, I highly appreciate your enthusiasm and skills.

The MSO is supposed to be in my hands hopefully before the weekend (it was shipped today) and I will make the test.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: bg8up on March 07, 2014, 05:13:22 am
The hybird module 200M_VB1985;500M_1NB7-8453,new is 2AD2-0001;1G_8477;2G_8511should include BW limiter

174 drive the Relays?DG444

ASIC U2900?3000 is MEGA ZOOM 1821-1465?include ACQMEM?DAC(offset,balance,gain,triglvl;based PWM)?logic channel Acq(U2900 only)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on March 07, 2014, 08:15:10 pm
Hi guys.

Around the ASIC (U2900 and U3000) there are a lot of 0 ohm resistors (603 smd case) probably used as jumpers, because these resistors connects some ASIC's pins to VDD (2.5V) or GND. Perhaps these resistors set the ASIC configuration (slave/master) and other features. And why not, these resistors and the FPGA may define the oscilloscope model.

That's why I want to see pictures of one DSO/MSO6054A mainboard or an DSO/MSO7054A, with enough resolution/detail to compare with a MSO6034A mainboard. But I can't find any, and I have searched and searched for several days. I found only what is shown in attached files (source agilent website).

So please, can anyone with one of these oscilloscopes (DSO/MSO6054A or DSO/MSO7054A) take some photographs (both sides if possible)?

Thanks in advance.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: alex.forencich on March 08, 2014, 12:46:11 am
I have an MSO7104A that I successfully applied the telnet service menu hack to.  Would pictures of its mainboard be of any use?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on March 08, 2014, 01:12:06 am
I have an MSO7104A that I successfully applied the telnet service menu hack to.  Would pictures of its mainboard be of any use?
Thank you so much, they may be worth, to check differences between 7104 and 6104 (tesla500).
So if you can take pictures, go ahead. But I still needing images from a MSO6054A.
Thank you again.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Emanuel on March 09, 2014, 09:10:30 pm
If you want to try is so simple:

1. Download this tool: https://bitbucket.org/flowswitch/agltzip/get/84418d8ae30f.zip (https://bitbucket.org/flowswitch/agltzip/get/84418d8ae30f.zip)  (courtesy of abyrvalg).
2. Extract the binary file from sys6000.jzp.
3. In the binary file at 0x0020BE10 reemplace this 83 C9 00 04 by 3B C0 02 61 (using a hex editor).
4. Compress the new sys6000.bin to sys6000.jzp.
5. Install the patched firmware.
6. Set 2CH model to 4CH with resistor, X1 = '1' (remove R2).

Please note that there is no guarantee that this will work.
Got the MSO6012A today, played with it a little and already downloaded the sys6000.jzp.
Tomorrow I will make the jumper setting and see what happens  :palm:
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Emanuel on March 11, 2014, 03:43:28 pm
Not working  :wtf:
If I move the resistor it hangs at start-up and keeps running the labels illumination in a sequence.
I tried to upload the sys6000.jzp from the usb (.bin was also on the usb) using the emergency procedure...nada.
So I switched it back to the original jumper configuration and uploaded the software first.
Here it turns on with this message:
"The oscilloscope setup is defaulted because a software fault occured. Please report the following diagnostic information:
PC-Board/Status A/D problem".

I uploaded the changed sys6000.jzp, switched the resistor and goes again in "hang" mode.

It seems the MSO6012A won't accept any jumper setting other than the original which is with R3 removed.
However, looking at photos at the thread's beginning, I see a different setting, maybe this is what is causing it to hang.

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Emanuel on March 11, 2014, 06:11:38 pm
As mikeselectricstuff already discovered:

MODEL    X1 X0
-------------------
6032       0    0
6102       0    1
6034       1    0
6104       1    1

X1 = Nº Channels.
X0 = BW.


As I had the same findings as mikeselectricstuff had while playing with this set of jumpers (MSO6012A hangs at startup);

Just tried changing the links on MSO6012A- all permutations other then original make it hang.
On restore I get an error message saying setup defaulted due to A/D error -presumably accessing nonexistent CH3/4 hardware

I went back to the early pages and there is something missing, already noticed by abyrvalg

So there must be another resistor in BW group to make missing x01x, x05x models. 6012 board should show it.
Sad that 03->10 doesn't change BW, but maybe some other modifications like 01->03 will work, who knows. Need to compare the frontends otherwise.

This set of jumpers works on 603x and 610x, setting apparently the BW and CH no.
What about the 601x and 605x models? Maybe they have nothing to do with them and this is why the 6012 hangs?

I noticed another set of jumpers was found, also with no results.

If you can, please check this:

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=81520;image)
These just seem to be a way to fix the control lines of 2 analogue switches - one changes at the same time as the 200-500mV relay, didn't see the other change but the switch has what looks like a bias connected with Y shift on it.

What about these other sets of jumpers? Any idea?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on March 11, 2014, 06:51:56 pm
Here it turns on with this message:
"The oscilloscope setup is defaulted because a software fault occured. Please report the following diagnostic information: PC-Board/Status A/D problem".
Just tried changing the links on MSO6012A- all permutations other then original make it hang.
On restore I get an error message saying setup defaulted due to A/D error -presumably accessing nonexistent CH3/4 hardware
This set of jumpers works on 603x and 610x, setting apparently the BW and CH no.
What about the 601x and 605x models? Maybe they have nothing to do with them and this is why the 6012 hangs?
Seems as if the FPGA is the responsible of checking the ASICs/ADCs status. This fit with my previous theory, ie the FPGA also set the oscilloscope model in function of ASICs configuration. All this is only an assumption, perhaps the FPGA only set one flag, and the CPU checks the corresponding ASICs/ADCs.

Enable decoders for two-channel models, with firmware patches, may be a nightmare. The firmware was not designed for that purpose, however I still thinking that Agilent did not allow this feature intentionally.

Quote
These just seem to be a way to fix the control lines of 2 analogue switches - one changes at the same time as the 200-500mV relay, didn't see the other change but the switch has what looks like a bias connected with Y shift on it.
ADG451/DG444 (analogue switches), are directly controlled by the 74ATC174, no need to change anything here.

What about this set of jumpers? Anyone tested them?
Dont bother, look where they are connected, also, no need to change anything here (IMG_1490.jpg and IMG_1488.jpg).
http://www.onsemi.com/pub_link/Collateral/MC100LVEL14-D.PDF (http://www.onsemi.com/pub_link/Collateral/MC100LVEL14-D.PDF)

For (IMG_1493.jpg) I had not seen this resistor before, I will check now where they are connected, but I think you've found something important.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Emanuel on March 11, 2014, 06:59:39 pm
Yes, already checked, it is a clock distribution IC.
Take a look at the third photo I just added, there is another set of jumpers next to the digital inputs circuit.
One pull down resistor is not there on the 6012.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on March 11, 2014, 07:03:23 pm
Yes, already checked, it is a clock distribution IC.
Take a look at the third photo I just added, there is another set of jumpers next to the digital inputs circuit.
One pull down resistor is not there on the 6012.
Yes exactly, on my oscilloscope this pull-down (R3) is mounted.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on March 11, 2014, 07:20:21 pm
For (IMG_1493.jpg) I had not seen this resistor before, I will check now where they are connected, but I think you've found something important.
All are connected to the FPGA.  
I have a trick to quickly find where they are connected, is a conductive foam.   
Will I have to discard my earlier theory?  :scared:  Hopefully!
The circuit is as follows:
(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=84743;image)
(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=84745;image)

Note: Until tomorrow I can't do any tests.



Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: bg8up on March 11, 2014, 08:37:02 pm
Two pictures
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on March 11, 2014, 08:46:32 pm
@bg8up: Good pictures, thank you very much.   :-+

More pictures:
R3 set MSO.
The last is mikeselectricstuff DSO6034A.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Emanuel on March 11, 2014, 09:08:19 pm
R3 set MSO.
The last is mikeselectricstuff DSO6034A.
I don't think R3 sets the MSO.
In my MSO6012 is is NOT installed, same in the photo of the DSO7104.
As it looks from the last photo in DSO6034 is also not installed
So far the MSO6104 is the only one with this jumper installed.

 :phew:
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on March 11, 2014, 09:21:29 pm
R3 set MSO.
The last is mikeselectricstuff DSO6034A.
I don't think R3 sets the MSO.
In my MSO6012 is is NOT installed, same in the photo of the DSO7104.
As it looks from the last photo in DSO6034 is also not installed
So far the MSO6104 is the only one with this jumper installed.

 :phew:

Well, you may be right, it has been a fast deduction.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: bg8up on March 11, 2014, 09:23:58 pm
R3 maybe  extension,

R2 maybe model family .
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: bg8up on March 12, 2014, 02:04:43 am
Not working  :wtf:

So I switched it back to the original jumper configuration and uploaded the software first.
Here it turns on with this message:
"The oscilloscope setup is defaulted because a software fault occured. Please report the following diagnostic information:
PC-Board/Status A/D problem".


seem the picture?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Emanuel on March 12, 2014, 08:29:26 am
yes, this is what I got when uploaded the hacked sys6000.jzp
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on March 13, 2014, 03:34:44 pm
First results of the test (X1=1, X0=0):

Y3  Y2  Y1  Y0        Model            gpInstOptions
-------------------------------------------------------------
0    0    0    0         MSO6034A    000002a2
0    0    0    1         MSO6034A    000002b2
0    0    1    1         MSO6054A    000002b4
0    0    1    0         MSO6054A    000002a4

0    1    0    0         MSO7034A    00000aa2
0    1    0    1         MSO7034A    00000ab2
0    1    1    1         MSO7054A    00000ab4
0    1    1    0         MSO7054A    00000aa4

1    0    0    0         MSO5034A    000006a2
1    0    0    1         MSO5034A    000006b2
1    0    1    1         MSO5054A    000006b4
1    0    1    0         MSO5054A    000006a4

1    1    0    0         MSO6034A    00000ea2
1    1    0    1         MSO6034A    00000eb2
1    1    1    1         MSO6054A    00000eb4
1    1    1    0         MSO6054A    00000ea4

Plus other 16 other combinations with X0 = 1. And other 32 with X1=0.
But please, note that I will not test the 64 combinations.  :phew:

The previous firmware patch produces the same effect, ie no BW improvement. But I still have an ace under the sleeve.  :)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on March 13, 2014, 08:04:21 pm
Do you see any direct CPU-frontend traces there?
The front-end is controlled directly by the CPU (only 74ATC174s between both).

So there must be another resistor in BW group to make missing x01x, x05x models. 6012 board should show it.
You were right.  :)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on March 14, 2014, 12:09:24 am
Great!

I think there is no need to try all 64 combinations since reg bits looks grouped independently (combining BW bits shouldn't affect model family and vice versa). Just match these new bits with my reg fields table: https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg390572/#msg390572 (https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg390572/#msg390572)

I was wrong about "Rattler" device: I've looked at some wrong register access function which made me thinking that "Rattler" is some single chip attached to "Ponderosa" ASIC, but in fact "Rattlers" are accessed throught GPIO and latches as 12 bits long serial devices (one device per channel, each one has eight 9-bit wide regs, so 3 bits of 12 selects reg, rest 9 bits are data) - all this matches Carrington's info on 1NB7 chips control interface: https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg394190/#msg394190 (https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg394190/#msg394190)
So "Rattlers" must be 1NB7-xxxx frontend chips themselves, so we can inspect their regs with dumpRegValues command. But here rises another question: since we are cheating the CPU with a patch/straps, it should write correct values into 1NB7 regs, but this doesn't affect real BW. So there must be some other BW limiting factor: ether a different 1NB7 model (the worst case) or some straps right on 1NB7 pins or some different component values in frontend section. So we are back: we need to see real 6054/7054 board.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: bg8up on March 15, 2014, 04:26:23 am
PONDEROSA=MeagZoom III ASIC
      NEVADA=FPGA Display Core
        TALON=ADC @4Gas/S ?include 32 TalonSlices @125Ms/S
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on March 15, 2014, 09:37:46 am
bg8up, thanks, that confirms our guesses. Can you please check who are "Rattler" and "Scorpion"?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on March 15, 2014, 03:11:29 pm
32 slices @ 125Ms/s woow!  :o
That explains why the 1NB4-5057 is always cold as ice.
All are integrated on the same chip, so I hope that it keep the interleaved distortion within a reasonable margins.
http://www.ti.com/lit/wp/snaa111/snaa111.pdf (http://www.ti.com/lit/wp/snaa111/snaa111.pdf)

I attach some related images.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: tesla500 on March 25, 2014, 11:48:10 pm
Here's some papers on the Talon ADC, written by one of the designers:

http://poulton.net/papers.public/2002isscc_10_1_tal.pdf (http://poulton.net/papers.public/2002isscc_10_1_tal.pdf)
http://poulton.net/papers.public/2002isscc_10_1_tal_slides.pdf (http://poulton.net/papers.public/2002isscc_10_1_tal_slides.pdf)

And lots of other interesting papers: http://poulton.net/papers.html (http://poulton.net/papers.html)

(http://i.imgur.com/Bbe8rHQ.png)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on March 26, 2014, 12:31:07 am
@Tesla500: Excellent documentation, thank you very much.  :-+

Carbon printed resistor and smd capacitors inside the hybrid!

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=86548;image)

I've got this faulty board (this is my ace), perfect for testing and I don't rule out a front-end schematic and a "transplant".

And other possibility to achieve 500 MHz is the TELEDYNE relay (A150-20-12), but only with 50 Ohm option. The problem is that each relay costs ~55 € ($76):
http://www.mouser.com/ds/2/404/a150-16358.pdf (http://www.mouser.com/ds/2/404/a150-16358.pdf)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: bg8up on March 26, 2014, 03:34:18 pm
Wonderful paper!Thanks TESLA500  a lot!  :-+
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on March 26, 2014, 04:42:02 pm
Between 500MHz and 300MHz models, only change the values of three RC networks (two at the top and one at the bottom), the rest is identical for both. However, these RC networks are set according to the BW and to the 1NB7 (ie as a external compensation). Seems that hybrids are pre selected to be as similar as possible, generally they have consecutive serial/batch numbers.

The TELEDYNE relay is only used for 1GHz models, but all the 1NB7-8453s are pin to pin compatible with the 1NB7-8477s, and with the same functionality. Additionally is possible modify the input stage to allow the use the TELEDYNE relay with the 1NB7-8453 (only for 6000 and 7000 boards). On the other hand, is not logical do that, and is not cheap (>220€ four channels).

Well, I just wanted comment all this as a curiosity.

The next board is a DSO5054A, RC networks in red (only top), serial/batch numbers in green.

Cheers.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: euzer on March 27, 2014, 12:34:37 pm
Could someone summarize how to enable the licensable options? I've read all posts in the thread and get the feeling this is possible but not how it's done. Thanks!
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on March 27, 2014, 03:15:45 pm
Could someone summarize how to enable the licensable options? I've read all posts in the thread and get the feeling this is possible but not how it's done. Thanks!

Download the sys6000 or sys7000 v06.16.001 update file from Agilent's website (5000 and 6000 both use sys6000)
Download packjzp and unjzp tools from here  (https://bitbucket.org/flowswitch/agltzip)

Unpack to a binary using unjzp , and use a hex editor to make the following changes

sys6000.bin 06.16.0001:
002E7B80: 94 21 F8 E0 7C 08 02 A6 -> change to -> 38 60 00 00 4E 80 00 20

sys7000A.bin 06.16.0001:
002E7C60: 94 21 F8 E0 7C 08 02 A6 -> change to -> 38 60 00 00 4E 80 00 20

save the edited version, and repack to .jzp using packjzp.

Note pack/unpack are quite slow - about a minute

Update the scope firmware with the new version

Then enable each license by entering the 3-letter license name, with all zeros as the rest of the key

Note that decodes only work on models with 4 analogue channels - it will refuse to install on 2-ch models and consensus is the decodes use some hardware that isn't present on 2ch models

Enjoy!

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: alex.forencich on March 28, 2014, 03:32:42 am
Could someone summarize how to enable the licensable options? I've read all posts in the thread and get the feeling this is possible but not how it's done. Thanks!

The less risky method is performed over telnet.  This is very simple to implement, and all you need is an ethernet cable:

Use telnet to connect to the instrument on port 5810 (telnet <ip> 5810) with username 'panther' and password 'pictures'. 

At ->, type cmd and press enter.  Then type mem modify -w 1 0x009A2187 and press enter.  Then type 0x01 and press enter.  Then type . and press enter.  It should look like this:

-> cmd
[vxWorks]# mem modify -w 1 0x009A2187
0x009a2187:  0x00-0x01
0x009a2188:  0x00-.

Then, on the scope, press utility -> options -> licenses -> options, enable 'service mode' and 'all licenses'.  Turn the scope off and back on again.  Check that the licenses are now enabled. 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on March 28, 2014, 08:43:31 am
Could someone summarize how to enable the licensable options? I've read all posts in the thread and get the feeling this is possible but not how it's done. Thanks!

The less risky method is performed over telnet.  This is very simple to implement, and all you need is an ethernet cable:

Use telnet to connect to the instrument on port 5810 (telnet <ip> 5810) with username 'panther' and password 'pictures'. 

At ->, type cmd and press enter.  Then type mem modify -w 1 0x009A2187 and press enter.  Then type 0x01 and press enter.  Then type . and press enter.  It should look like this:

-> cmd
[vxWorks]# mem modify -w 1 0x009A2187
0x009a2187:  0x00-0x01
0x009a2188:  0x00-.

Then, on the scope, press utility -> options -> licenses -> options, enable 'service mode' and 'all licenses'.  Turn the scope off and back on again.  Check that the licenses are now enabled.
Is this the same for 5/6000 and 7000?

I wonder if there is some "hidden" way to enable service mode from the front panel.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on March 28, 2014, 09:42:43 am
Some drawbacks:
- FMS, BAT, FRS, TEL, 1MV, TOM, CIR features are not enabled by "ALL"
- the address is version dependent, this one will not work on 5k/6k

If somebody wants to go ServiceMode way, there is more portable way: execute setServiceMode(1) in C mode console ("->" prompt). But, as it was discussed already, there is no danger patching sys.bin - we are not touching the bootloader, where "emergency" restore lives.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: euzer on March 28, 2014, 10:41:22 am
Could someone summarize how to enable the licensable options? I've read all posts in the thread and get the feeling this is possible but not how it's done. Thanks!

Download the sys6000 or sys7000 v06.16.001 update file from Agilent's website (5000 and 6000 both use sys6000)
Download packjzp and unjzp tools from here  (https://bitbucket.org/flowswitch/agltzip)

Unpack to a binary using unjzp , and use a hex editor to make the following changes

sys6000.bin 06.16.0001:
002E7B80: 94 21 F8 E0 7C 08 02 A6 -> change to -> 38 60 00 00 4E 80 00 20

sys7000A.bin 06.16.0001:
002E7C60: 94 21 F8 E0 7C 08 02 A6 -> change to -> 38 60 00 00 4E 80 00 20

save the edited version, and repack to .jzp using packjzp.

Note pack/unpack are quite slow - about a minute

Update the scope firmware with the new version

Then enable each license by entering the 3-letter license name, with all zeros as the rest of the key

Note that decodes only work on models with 4 analogue channels - it will refuse to install on 2-ch models and consensus is the decodes use some hardware that isn't present on 2ch models

Enjoy!
Excellent, thanks. Worked on DSO5014A and a DSO6012A.
I do wonder what the * next to the license codes signify when using ALL.
I can't see how to access the MSO functionality on the DSO5014A. the controls are probably staring me in the face though. The MSO on the DSO6012A seems Ok but haven't connected a cable up yet.
Out of interest what difference in code does the 8 bytes change?
Is the telnet method sticky between power cycles?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Hugoneus on March 28, 2014, 04:27:25 pm
Thank you.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: alex.forencich on March 28, 2014, 08:35:33 pm
Is the telnet method sticky between power cycles?

Yes, it is.  Otherwise it would be a bit of a pain.  The only thing you need to do is leave 'service mode' enabled.  If you turn that off, then the menu (and licenses) will go away and you'll need to enable the service menu via telnet again. 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on March 28, 2014, 08:37:48 pm
Out of interest what difference in code does the 8 bytes change?
If I'm not mistaken.

94 21 F8 E0 -> stwu r1, -0x720(r1)
7C 08 02 A6 -> mflr r0

38 60 00 00 -> li r3, 0
4E 80 00 20 -> blr

This force to accept any license string (like XXX-000000000000-000000000).
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: alex.forencich on March 28, 2014, 08:53:33 pm
Some drawbacks:
- FMS, BAT, FRS, TEL, 1MV, TOM, CIR features are not enabled by "ALL"
- the address is version dependent, this one will not work on 5k/6k

If somebody wants to go ServiceMode way, there is more portable way: execute setServiceMode(1) in C mode console ("->" prompt). But, as it was discussed already, there is no danger patching sys.bin - we are not touching the bootloader, where "emergency" restore lives.

Well, now that is an even simpler method of enabling service mode.  Might be able to do the whole thing as a one-liner script. 

As for the patching method, I was unable to get that to work for some reason.  I am unsure why.  After attempting to install the patch, the scope did not reboot correctly and (after some consternation) I had to use the emergency recovery off of the flash drive with the original firmware. 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on March 28, 2014, 09:57:27 pm
94 21 F8 E0 -> stwu r1, -0x720(r1)
7C 08 02 A6 -> mflr r0

38 60 00 00 -> li r3, 0
4E 80 00 20 -> blr
This patch changes first bytes of big code check function to short "return 0". Result 0 means "code is ok" here.

After attempting to install the patch, the scope did not reboot correctly
Did you saved/restored jzp revision header string? Some tests shows that it is important somehow. There is a 3rd parameter (revision.txt) to unjzp/packjzp for that. You can try unpacking then repacking an unmodified file first to verify your setup - the repacked file must match the original exactly, then proceed with patching.
Another possibility is that you were "lucky" to catch the very first packjzp version which had several issues. Latest version (28 january commit) produces 100% correct files when used with 3 parameters.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: alex.forencich on March 28, 2014, 10:09:44 pm
94 21 F8 E0 -> stwu r1, -0x720(r1)
7C 08 02 A6 -> mflr r0

38 60 00 00 -> li r3, 0
4E 80 00 20 -> blr
This patch changes first bytes of big code check function to short "return 0". Result 0 means "code is ok" here.

After attempting to install the patch, the scope did not reboot correctly
Did you saved/restored jzp revision header string? Some tests shows that it is important somehow. There is a 3rd parameter (revision.txt) to unjzp/packjzp for that. You can try unpacking then repacking an unmodified file first to verify your setup - the repacked file must match the original exactly, then proceed with patching.
Another possibility is that you were "lucky" to catch the very first packjzp version which had several issues. Latest version (28 january commit) produces 100% correct files when used with 3 parameters.

I did save and restore the version information, IIRC.  Also, I had to make a couple of minor changes to a couple of the source files to get it to compile on my computer (Arch Linux).  I don't think these would have affected the operation of the program, though. 

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on March 28, 2014, 10:31:41 pm
Excellent, thanks. Worked on DSO5014A and a DSO6012A.
I do wonder what the * next to the license codes signify when using ALL.
I would assume it just indicates that it is "temporary" and not an installed license
Quote
I can't see how to access the MSO functionally on the DSO5014A. the controls are probably staring me in the face though.
That would be because there is no MSO variant of the 5000 series - that is the main (only?) difference between 5000 and 6000
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: alex.forencich on March 28, 2014, 11:06:51 pm
Excellent, thanks. Worked on DSO5014A and a DSO6012A.
I do wonder what the * next to the license codes signify when using ALL.
I would assume it just indicates that it is "temporary" and not an installed license

That sounds about right to me.  Anything that the 'all licenses' option enables has a * after it, but everything that was installed separately does not.  For example, one scope that I enabled this on has segmented memory installed, and it appears as SGM.  The other scope does not, and it appears as SGM*. 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: euzer on March 31, 2014, 02:50:04 pm
Can anyone report what the DIS and DSW distributor package options do?
The 1MV code seems to allow a vertical resolution of 10mV/div rather than 1mV.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on March 31, 2014, 03:26:17 pm
euzer, both DIS and DSW are just bundles of other features.
DSW: LSS, AMS, 232, SGM
DIS:   LSS, AMS, 232, SGM, LMT, FRC, SND, FLX, 553
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: alex.forencich on April 01, 2014, 03:49:15 am
euzer, both DIS and DSW are just bundles of other features.
DSW: LSS, AMS, 232, SGM
DIS:   LSS, AMS, 232, SGM, LMT, FRC, SND, FLX, 553

I have not looked in to this in depth, but I think one of these two also activates the 'demo' menu that appears on the power-up menu and the utiliy menu.  This menu appeared after enabling 'all licenses' on my scope. 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: euzer on April 01, 2014, 10:12:38 am
Quote
I can't see how to access the MSO functionally on the DSO5014A. the controls are probably staring me in the face though.
That would be because there is no MSO variant of the 5000 series - that is the main (only?) difference between 5000 and 6000
I think you're right. They look to have the same front fascias and there's a label to the right hand side of the screen on the 5000 masking the holes where the digital controls would be on the 6000.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: bg8up on April 06, 2014, 12:30:04 am
BW is limited in factorycal.dat and singnal path hardware?

There are two hardware version ?546xx-66510 is old ?1NB7-84XX applied?546xx-66410 is new witch behind  2009?2AD2-000X applied?

On new platform witch used 2AD2?70-200 is the same singnal path,300-500 is the same path.

In pictures,upper is 7104,blow is 7054.

 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Sailor on April 17, 2014, 02:31:04 pm
@alex.forencich
Quote
Here is how you enable the service menu:

telnet <ip> 5810
username panther
password pictures

-> cmd
[vxWorks]# mem modify -w 1 0x009A2187
0x009a2187:  0x00-0x01
0x009a2188:  0x00-.

utility -> options -> licenses -> options
enable 'service mode', 'all licenses', and 'mso'
reboot scope

I have tried this on my MSO7054B, but it doesn't alter the menus on the scope i.e. utility -> options -> licenses shows the standard menu i.e. Spell, Enter, Apply (greyed out), and Show license information (and the all-zeros license number waiting to be entered). I double-checked by re-entering the mem modify -w 1 0x009A2187 again, and it returned 0x009a2187:  0x01-, so it had evidently entered correctly the first time. I powered the scope off and on and re-connected to VxWorks again. 0x009a2187 again returned 0x00, so it looks like the 0x01 didn't stick through the power cycle (should it have?), and I am beginning to wonder if that address is perhaps not correct for my scope. The About Oscilloscope screen shows:

System version 06.15.0001
Language version 06.15 Oct 5 2010, 08:07:47
Library version 02.25
Graphics version 01.46

The version info from the C shell is:

-> version
VxWorks (for Agilent KOM PPC405, SA27E rev1) version 6.4.
Kernel: WIND version 2.10.
Made on Oct 15 2010, 11:26:58.
Boot line:
tffs;usb(0,0)boot:sys7000A f=0x8 o=emac0
value = 52 = 0x34 = '4'
->

Do you have any suggestions?

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on April 17, 2014, 04:52:44 pm
@ Sailor

If somebody wants to go ServiceMode way, there is more portable way: execute setServiceMode(1) in C mode console ("->" prompt). But, as it was discussed already, there is no danger patching sys.bin - we are not touching the bootloader, where "emergency" restore lives.

But better first:

Download the sys6000 or sys7000 v06.16.001 update file from Agilent's website (5000 and 6000 both use sys6000)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Sailor on April 18, 2014, 12:16:10 am
Jeeez, how did I miss that? Thank you so much, and all others involved in this great work.  :-+
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: euzer on June 10, 2014, 03:27:56 pm
Is there a proven way to increase the bandwidth of a DSO5014A from 100MHz to 300MHz with a hardware and/or firmware mod? And if so how's it done? TIA.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on June 10, 2014, 03:30:48 pm
Is there a proven way to increase the bandwidth of a DSO5014A from 100MHz to 300MHz with a hardware and/or firmware mod? And if so how's it done? TIA.
No - the hardware is completely different
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: euzer on June 10, 2014, 03:50:12 pm
Is there a proven way to increase the bandwidth of a DSO5014A from 100MHz to 300MHz with a hardware and/or firmware mod? And if so how's it done? TIA.
No - the hardware is completely different
Thanks. I presume that will also be true for a DSO6014A BW increase also?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on June 24, 2014, 10:04:16 pm
Today I tested the information in this thread on my 7000 Series scope.
Thanks to the people in this thread, I was able to activate all licenses.
A big thank you to all the people, who made this happened.
I did this just for fun and entertainment.





Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: manorth on July 22, 2014, 11:24:55 pm
Time to open 9000/90000 thread? :)

I'd love to start working on 9000/90000 hacks, I own 2 MSO9104A scopes. Also we repair 9000 and 90000 series scopes.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: blacknoise on July 24, 2014, 12:18:16 am
I have modified the firmware 4.20.0008 (the last FW for the Windows XP version) on my older MSO9254A to accept any license key without valid HOTIDs and SIGN(atures).

Precisely spoken, after the patch 14 respectively 12 zeros are sufficient for the HOTIDs and SIGN(ature)s in the license file.

For this patch you have to modify about 40 bytes of the code in the file "agscope.exe" using a hex editor.

If an Admin reads this post: Is it allowed to attach here a small (about 9 kbyte) zip file with all informations how to patch the firmware (please excuse my question - i am quite new here...)?

In some weeks i should receive a new Agilent 9xxx with Windows 7 - and of course i will try to "port" my patch to the more actual firmware of this instrument... ;-)

Kind regards
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on July 24, 2014, 12:27:55 am
If an Admin reads this post: Is it allowed to attach here a small (about 9 kbyte) zip file with all informations how to patch the firmware (please excuse my question - i am quite new here...)?
Hi, welcome to the eevblog forum!

I'm not an administrator, but I don't think there is any problem with that.  ;)

Cheers.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: blacknoise on July 24, 2014, 01:13:37 am
Than i wish you good luck and much fun with this flood of options... ;-)

Kind regads
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: blacknoise on July 24, 2014, 04:03:12 pm
Some time ago i tinkerd a simililar license hack for the Agilent MSO54831D with the 5.71.0000 firmware on Windows XP - see the attachement.

Kind regards
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: eb4fbz on July 30, 2014, 08:17:24 am
Hello,

Someone knows how to remove the Secure Enviroment license? I enabled all the licenses and now i realized that SEC blanks ram settings after power-cycling and can't be disabled  :palm:
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on July 30, 2014, 10:15:11 am
Hello,

Someone knows how to remove the Secure Enviroment license? I enabled all the licenses and now i realized that SEC blanks ram settings after power-cycling and can't be disabled  :palm:

What Model are you talking about?

I think I read somewhere here in this forum to stay away from this SEC option, but I am not sure anymore to what model this was in regards.
I have the MSO7000B Series and enabled all options and have absolutely no problems.

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on July 30, 2014, 01:29:31 pm
I'm pretty sure someone found a way to remove SEC - I think it's somewhere in this thread
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: eb4fbz on July 30, 2014, 02:06:43 pm
MSO6032A. I've read the entire post after my mistake, but no one explains how to remove SEC, just https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg392716/#msg392716 (https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg392716/#msg392716) but doesn't explain it's consecuences and i'm scared, does it remove all licenses?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: eb4fbz on July 30, 2014, 02:28:03 pm
Ok, just tried readFeatureRegister, that returned 0xFFFE.
Then writeFeatureRegister(0xFFFF) but all licenses were still there, readFeatureRegister returned 0xFFFF, but after power cycling it's again at 0xFFFE.
Also tested writeFeatureRegister(0x0), that remains at 0 after power cycling, but same licenses are still there, including SEC.

Also tried removing SEC-000000000000-000000000 line from /bin/license.bak but i guess it's just a backup.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dfnr2 on July 31, 2014, 05:05:36 am
How to clear the SEC option for MSO5000/6000/7000 scopes:

This fix is thanks to abyrvalg.

The SEC option clears the lowest bit in a nonvolatile "Feature Register."  If this bit is clear, the setup directories /setups,/data,/config, and /masks  are remapped from persistent drive C: to ram drive /ram0, to prevent persistent storage of setup information.

If the SEC option is detected at startup, the Feature Register bit is cleared.

In order to permanently clear the SEC option, you must

1) clear the Feature Register (reset to 0xffff)
2) Remove the SEC option from the license file.


Using FTP and Telnet:

1) Telnet into the scope:
Code: [Select]
   $ telnet <ipaddr> 5810
2) log in with panther/pictures
3) clear the feature register:
Code: [Select]
   -> clearFeatureRegister()
   Tffs Drive 0: Programing units 119 to 119
   value = 1 = 0x1
4) copy the license file to /ram0:
Code: [Select]
   -> cmd
   [vxWorks]# cd bin
   [vxWorks]# file copy license.lic /ram0
   copying file license.lic -> /ram0/license.lic
5) FTP to the scope using another terminal or FTP program
Code: [Select]
   $ ftp <ipaddr>
   log in with panther/pictures
6) retrieve the license.lic file:
Code: [Select]
   ftp> cd ram0
   ftp> get license.lic
7) edit license.lic to remove the "SEC" line

8 ) put the license.lic file back on the scope:
Code: [Select]
   ftp> put license.lic
9) from the telnet window, copy the edited license.lic file back to C:/bin:
Code: [Select]
   [vxWorks]# file copy /ram0/license.lic license.lic
   copying file /ram0/license.lic -> license.lic
10) Reboot the scope.





If you don't have an FTP client, but can capture text from the telnet program, you can use the following variant:

Using TELNET only:

1) Telnet into the scope:
Code: [Select]
   $ telnet <ipaddr> 5810
2) log in with panther/pictures
3) clear the feature register:
Code: [Select]
   -> clearFeatureRegister()
   Tffs Drive 0: Programing units 119 to 119
   value = 1 = 0x1
4) list the license.lic file
Code: [Select]
   -> cmd
   [vxWorks]# cd bin
   [vxWorks]# cat license.lic
   ( the license.lic file is listed in the terminal window)
5) select and the license.lic file text from the terminal window and copy to the clipboard.

6) Paste the selection into an editor, remove the line containing the "SEC" option, and select the resulting text, and copy back to the clipboard.

7) re-write the license.lic file:
Code: [Select]
   [vxWorks]# cat > license.lic
8 ) paste the edited license.lic file from the clipboard into the terminal

9) hit Ctrl-D to close and write the license.lic file

10) Reboot the scope.


If you don't have any licenses on the scope that you wish to preserve, the you can skip steps 4-10 in the above procedures.  Just delete the license.lic file:
Code: [Select]
   [vxWorks]# cd bin
   [vxWorks]# rm license.lic
   [vxWorks]# reboot


Dave
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on July 31, 2014, 06:48:41 am
Thank you so much for this valuable information
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: eb4fbz on July 31, 2014, 10:21:05 am
Thanks so much!!! I was able to remove SEC license!

You need to write 0xFFFF to License register and remove the SEC-000000000000000-00000000 line from license.lic. I suppose that the register triggers license re-check from license.lic file.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: cjpilot on October 03, 2014, 12:18:45 pm
I have a DSO7014B that is in this boot looping cycle where the LED's on the front just cycle and it never starts up.  I have tried OVER and OVER the procedure to boot from the Thumbdrive but it will not come up 'Lately'...  However over the course of 2 to 3 days I had tried (without the thumbdrive) to turn it off and on every so often and once it came on, which shocked me, I got my thumbdrive that one time and updated All the firmware.  I turned it off after that and it has never come back on since.  If there are any hints you can give an Old technician on a way to get this Oscope back up and running I would really appreciate it.  Another question would be if there is 'ANY' other way to boot OR load the system software onto the scope as I really think that is the problem.  Or even a way to maybe link up to the Oscope to monitor what it is actually doing as it is trying to boot up which may lend a hint to what is the problem as it is trying to boot.  Thanks in advance for any and all help.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on October 03, 2014, 12:38:15 pm
I have a DSO7014B that is in this boot looping cycle where the LED's on the front just cycle and it never starts up.  I have tried OVER and OVER the procedure to boot from the Thumbdrive but it will not come up 'Lately'...  However over the course of 2 to 3 days I had tried (without the thumbdrive) to turn it off and on every so often and once it came on, which shocked me, I got my thumbdrive that one time and updated All the firmware.  I turned it off after that and it has never come back on since.  If there are any hints you can give an Old technician on a way to get this Oscope back up and running I would really appreciate it.  Another question would be if there is 'ANY' other way to boot OR load the system software onto the scope as I really think that is the problem.  Or even a way to maybe link up to the Oscope to monitor what it is actually doing as it is trying to boot up which may lend a hint to what is the problem as it is trying to boot.  Thanks in advance for any and all help.
AIUI It should always be possible to boot from the drive using the method of turning on, waiting for the LED test, turning off, then turning on with the USB drive. The code is loaded and run from RAM sho shouldn't be dependent on any earlier FW update. Your symptoms sound like  it has a bad FW image, but it should be possible get past this.
Once booted from RAM you can then do a firmware update 
Of course it is possible there may be a hardware fault preventing it starting - the fact it came on once could suggest this is the case. At the very least I'd suggest checking all the supply rails coming out of the PSU for voltage and ripple , as PSU issues are quirte common (in general, not on this particular scope) and easy to test for. 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: cjpilot on October 03, 2014, 01:50:21 pm
Thank you so much for the post.  The very first thing I did when it went down was to verify All the Power supply voltages and Regulator voltages per the ''''VERY LIMITED'''' service manual I downloaded online.  I may just go over them again to make sure I did not miss anything.  It just seems to me that there is a minor problem with it since it did come on that one time and took all the Firmware updates just fine and did all the rebooting while updating, but I could very well be wrong also and it could be a very Major problem... Thanks again.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on October 03, 2014, 02:17:00 pm
Thank you so much for the post.  The very first thing I did when it went down was to verify All the Power supply voltages and Regulator voltages per the ''''VERY LIMITED'''' service manual I downloaded online.  I may just go over them again to make sure I did not miss anything.  It just seems to me that there is a minor problem with it since it did come on that one time and took all the Firmware updates just fine and did all the rebooting while updating, but I could very well be wrong also and it could be a very Major problem... Thanks again.
Bear in mind that what it's doing at startup is selftests, but appears to not getting far enough as to be able to display anything.
Did you update the Graphics FW file? This is the FPGA code - dodgy FPGA config might be consistent with failing before display starts. 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: cjpilot on October 03, 2014, 02:36:58 pm
Updated all Four files.  sys7000A.jzp , gsp7000A.jzp , lib7000a.jzp , lpk7000A.jzp  And after that I think it only came back on ONE time.  And has never come out of the boot loop since...
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: cjpilot on October 03, 2014, 05:59:17 pm
Is there any way to took link a computer or device to this Oscope to monitor the process of the boot up sequence to possibly see where/what it is hanging up??

Is there any other way to Load the sys firmware onto the machine besides the USB way to get it to boot up??

Would it be to any advantage to try to use an Older version of the SYS firmware on a thumbdrive to see if it would take the older version??  And where might I locate an older version?

Sorry for all the questions but it sure would be nice to be able to get this going without having to send it in.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dfnr2 on October 03, 2014, 06:59:28 pm
Are you able to telnet in to the scope during the looping?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: cjpilot on October 03, 2014, 07:44:33 pm
Not sure what that is.  I will have to research this and find out what hookups are necessary and what software I will need.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: cjpilot on October 06, 2014, 07:23:47 pm
From what I am reading about linking up to the Oscope you need to actually gain access to the menu's in the Oscope to tell it you are trying to Link with it over the Network OR Direct to your PC????  Maybe I am not reading about this correctly but since my Oscope wont even boot I dont think I would be able to SEE/TALK to the Oscope??  Thanks again everyone for all your comments to try and help me to get this to boot up again.  And if anyone at all has any more ideas I welcome your input and thank you ahead of time very much.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: bitrat on October 14, 2014, 03:50:32 pm
Than i wish you good luck and much fun with this flood of options... ;-)

Kind regads

it works! Thx soooooooo much!

And I think the only reason why there's no reply for the wonderful hacking is few people have a 9000 series scope. >:D

Look forward to your next surprise.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: cjpilot on October 23, 2014, 02:23:45 pm
Just had another of these scopes DSO7014B go into the Boot Looping Cycle.  WOW.  It is like an EPIDEMIC around here.  Now the total is at Three of them.  The first one has never responded again and continues to Loop.  The second one 'Finally' read from the USB drive and booted and I updated ALL 4 files -- and it was fine for 3 weeks being turned on/off every other day, But I just tried it again and it has failed.  Now a third one is Looping, and it Will Not boot for the USB drive either.  I have questioned the person that was using it when this third one went out and here is what they said..." I pushed the ON button and just after that (about 2 seconds) I inserted my USB Thumbdrive and all I got was those looping lights".  If anyone out there might have any more ideas about solving this boot up issue I would really appreciate it so very much.  Thanks in advance.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: alex.forencich on October 23, 2014, 04:10:55 pm
Try putting all of the update files on the root of an empty flash drive and boot the scope with the drive plugged in. I think I may have run into this issue before when an update did not compete successfully. The scope should have a failsafe boot loader that can boot off of the flash drive. Reinstall all four files when it boots up, then reboot it again.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: cjpilot on October 23, 2014, 05:50:20 pm
Thank you so very much for the reply/suggestion.  I have already tried that several times with all three scopes.  I really hate to have to send these in for repair as I know they will change the mainboard and it will be very very expensive.  Thanks again.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: alex.forencich on October 23, 2014, 09:36:08 pm
Well, that sucks.  I have an MSO7104A that needs a new mainboard too, but the reason is more subtle: it will not run the self cal due to some sort of digitizer issue.  However, I have not noticed any aberrations during normal operation, so I am sitting on it right now because I can't afford the repair cost of a mainboard swap.  This is the main problem of these monolithic designs; it's not possible to replace the failed part individually since the LRU is the whole damn board. 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: cjpilot on October 27, 2014, 01:38:53 pm
I know just what your saying, AND agree fully.  I am 'Pretty' sure that the only problem with mine is the booting process.  It has become corrupted very badly for some reason or another, but the problem could very well be something else.  I do wish there was a way to monitor/watch the booting process to see what is actually going on and/or where it is stopping.  Those two plugs on the main board have to in some way have some information available on them and I just wish I knew what/how to hook up to them and see what information may be available there that could tell me something about the issue with these Oscopes.  Probably in the 'END' they will have to be returned for repair.  The so very very strange thing is that the Second one that failed 'Finally' came back up after trying it several times over several days, AND I updated all files, AND it worked everytime I tried it for about 2 weeks, and then all of the sudden just two days ago it failed again and will not boot up.  It only Loops over and over.  Thanks again for your post...
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: tonykara on December 22, 2014, 07:30:18 pm
I just found this thread this week and tried it on my DSO6034A. Total success!! MSO, 8M, etc!! So fun.
It would be great if Agilent provided this officially after they decide to obsolete the scope and the selling of the features. I just checked any they won't even sell you the 8M option, so why not just enable it??
Anyway, thanks to all the people who figured this out. Now if you have something for the 54833D and the 54831M, I'd be really happy!! :)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: alex.forencich on December 22, 2014, 07:35:32 pm
I just found this thread this week and tried it on my DSO6034A. Total success!! MSO, 8M, etc!! So fun.
It would be great if Agilent provided this officially after they decide to obsolete the scope and the selling of the features. I just checked any they won't even sell you the 8M option, so why not just enable it??
Anyway, thanks to all the people who figured this out. Now if you have something for the 54833D and the 54831M, I'd be really happy!! :)

I believe that's exactly what they do.  They don't sell the memory upgrade options because if you update the firmware, it will be enabled automatically.  I think mem8M, E00, and MST are all enabled by default on new firmware. 

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on December 22, 2014, 08:55:52 pm
I believe that's exactly what they do.  They don't sell the memory upgrade options because if you update the firmware, it will be enabled automatically.  I think mem8M, E00, and MST are all enabled by default on new firmware.

I updated my MSO7000 series to the latest firmware and it did not enable anything.
And I think the 7000 series is internally the same as the 6000 series.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on December 22, 2014, 09:38:25 pm
I just found this thread this week and tried it on my DSO6034A. Total success!! MSO, 8M, etc!! So fun.
It would be great if Agilent provided this officially after they decide to obsolete the scope and the selling of the features. I just checked any they won't even sell you the 8M option, so why not just enable it??
The 8M (at least on the 6000) became standard fairly early on - not sure if this was also the case with the 5000, but that may be why it's not a listed purchase option
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: alex.forencich on December 23, 2014, 12:32:57 am
I believe that's exactly what they do.  They don't sell the memory upgrade options because if you update the firmware, it will be enabled automatically.  I think mem8M, E00, and MST are all enabled by default on new firmware.

I updated my MSO7000 series to the latest firmware and it did not enable anything.
And I think the 7000 series is internally the same as the 6000 series.

Interesting.  The release notes (http://www.keysight.com/upload/cmc_upload/All/Agilent_7000_Series_Oscilloscope_Readme_06160001.html) for release 5.26 state that:

Quote
Option E00 and Option MST (N5466A) are now standard

So I am presuming that these are automatically enabled in that firmware version.  However, they may never have done this for the memory size option as I cannot find any reference to that in the release notes.  Then again, the scope I have had these options enabled when I received it, so I'm not entirely sure how it works for scopes that don't already have these enabled. 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: blacknoise on December 23, 2014, 04:00:30 pm
Now if you have something for the 54833D and the 54831M, I'd be really happy!! :)

If you are searching for the firmware 05.71.0000 for the 5483x with unleashed options, feel free to visit my ftp. Please send me a personal message, to get it's address and access data.



Kind regards


Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: bitrat on February 06, 2015, 04:46:07 am
Looks like the link is outdated :)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: blacknoise on February 06, 2015, 12:02:58 pm
Looks like the link is outdated :)

I sent yo a personal message...

Kind regards
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: kloss on April 28, 2015, 04:53:15 pm
I cannot get the unjzp and packjzp applications to run, i've tried on 4 different computers with Win7, Win 8.1 and Win XP. The version I have is from the download folder JZP_0.2 Does anyone have the sys6000.jzp already modified correctly? Even if I had the binary file available to work on, I wouldn't be able to repack it  :palm:
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on April 28, 2015, 07:21:57 pm
kloss, jzp tools are console apps, you need to run them in a shell and supply correct params. Works fine on Win8.1 machine.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: lokamber on May 01, 2015, 04:02:42 am
Prompt how to use the tool jzp.??? to unpack a file.
How correctly to start unjzp.exe and with what parametres?
Excuse for bad English.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on May 01, 2015, 06:29:48 pm
Unpack:
unjzp sys6000.jzp sys6000.bin rev.txt

Apply patches to sys6000.bin, don't touch rev.txt

Pack:
packjzp sys6000.bin sys6000.jzp rev.txt
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on July 17, 2015, 11:29:18 am
As if I didn't have enough scopes already, I'm quite tempted by a second hand 6104A or 7104A/B, primarily for the higher resolution screen, but also because the UI responsiveness looks superb in the many videos Mike's done. I already have a 54642D which has now become my main work scope on the bench, I just love the UI's design and responsiveness: the UI for the 6000/7000 series looks like it's based on the same platform. For decoding serial stuff I tend to use a 54831D which has a massive 128Mpt deep memory but the decode is done in software so you need to be smart about how you set up the acquisition and selectively turn on and off the decode or the scope becomes very sluggish.

So I have a couple of questions...

o Although the resolution on both the 6000 and 7000 is 1024x768, the 6104A LCD is only 6.3". You could add an external monitor, but I was wondering how well the remote web interface works as an alternative?

o What is the boot time like? I think I'm quite spoiled by the 54642D's five seconds, it's not even enough time to properly attach a probe.

o I see that 06.17.0001 is current on newer 7000B units, and possibly others too, is it possible to downgrade firmware to previous versions, and if so does 06.16.0001 (for example!) work on the 7000B series?

Many thanks in advance!
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on July 17, 2015, 12:20:18 pm

So I have a couple of questions...
o Although the resolution on both the 6000 and 7000 is 1024x768, the 6104A LCD is only 6.3". You could add an external monitor, but I was wondering how well the remote web interface works as an alternative?
The screen res is fine, the small size isn't a big issue most of the time.
The web interface isn't a realistic alternative to using the front panel - no knobs.
It uses Java, which I've always had problems running
Quote
o What is the boot time like? I think I'm quite spoiled by the 54642D's five seconds, it's not even enough time to properly attach a probe.
12 seconds
Quote

o I see that 06.17.0001 is current on newer 7000B units, and possibly others too, is it possible to downgrade firmware to previous versions, and if so does 06.16.0001 (for example!) work on the 7000B series?

Many thanks in advance!
No idea, but check the release notes for functionality differences. AIUI you can get most or all the options by enabling service mode, so you don't need to use hacked FW
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on July 17, 2015, 01:25:16 pm

So I have a couple of questions...
o Although the resolution on both the 6000 and 7000 is 1024x768, the 6104A LCD is only 6.3". You could add an external monitor, but I was wondering how well the remote web interface works as an alternative?
The screen res is fine, the small size isn't a big issue most of the time.
The web interface isn't a realistic alternative to using the front panel - no knobs.
It uses Java, which I've always had problems running

I noticed that it was Java, certainly I'd rather not have Java enabled on a web browser but if it was reasonably responsive as a remote screen I might make an exception. I wasn't really thinking of using it as a replacement for the knobs, more as a way of having a bigger telly particularly if there's a lot going on on the screen, such as when the digital channels are on.

Quote
Quote
o What is the boot time like? I think I'm quite spoiled by the 54642D's five seconds, it's not even enough time to properly attach a probe.
12 seconds

Excellent.

Quote

Quote

o I see that 06.17.0001 is current on newer 7000B units, and possibly others too, is it possible to downgrade firmware to previous versions, and if so does 06.16.0001 (for example!) work on the 7000B series?

Many thanks in advance!
No idea, but check the release notes for functionality differences. AIUI you can get most or all the options by enabling service mode, so you don't need to use hacked FW
OK, I hadn't realised that, I guess I need to re-read this thread... again!

Thanks for your input.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on July 17, 2015, 01:25:24 pm
I have the MSO7104B and just love it and it has become my main scope.


Boot time is 15-16 Seconds
All options enabled
FW 01.16.0001


The only thing I am missing is a reference (REF) button to store a reference waveform for easy comparison. And it does not make sense that Agilent left it out, since the space for the button is free. But besides this little thing, it is an amazing scope.

Make sure to get the B Version, if you get a 7000 series.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on July 17, 2015, 02:41:42 pm

Make sure to get the B Version, if you get a 7000 series.
what's the difference?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on July 17, 2015, 03:06:48 pm
Make sure to get the B Version, if you get a 7000 series.
what's the difference?

The front panel was re-arranged, the search button was added and on the lower left of the scope the little round "back" button was added. As far as I know, the main board was not changed.

However, I first bought a 7014A very cheap on ebay Germany and I was not able to get the service mode enabled, not even with a fw update. I sold that one and got the MSO7104B and turned the service mode on and enabled ALL options.

Just an amazing scope, if you don't need a REF waveform in the background.


Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on July 17, 2015, 03:31:07 pm
Right hand panel of 7000A on left, 7000B on right. It looks a lot busier on the 7000B, quite a substantial rearrangement. Nice to see a dedicated default setup button for example on the 7000B.

(http://i34.photobucket.com/albums/d123/photobucket391/Capture_zpscdx41mss.png) (http://s34.photobucket.com/user/photobucket391/media/Capture_zpscdx41mss.png.html)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on July 17, 2015, 05:14:41 pm
More here https://www.eevblog.com/forum/testgear/agilent-mso7000-series-opinions-wanted/msg408932/#msg408932 (https://www.eevblog.com/forum/testgear/agilent-mso7000-series-opinions-wanted/msg408932/#msg408932)

It appears there are also several more knobs with push functions on the 7000B.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on July 17, 2015, 06:12:45 pm
It appears there are also several more knobs with push functions on the 7000B.
That is true.
It becomes second nature to use these push buttons ... I had forgotten about the lag of these on the A series.
Nice side by side comparison picture you posted of the panel.

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on July 31, 2015, 08:14:39 pm
I can report success on a DSO 7104B with no options other than the standard mem8M, E00 and MST, using the service menu method.

The scope was supplied with 06.17.0001, but the service menu instructions are for 06.16.0001, and I chose to boot 06.16.0001 from USB to set the service mode rather than try to figure out where the magic location is on 06.17.0001.

I first booted from the USB stick (256MB formatted as basic FAT with 4096 bytes sectors) following the instructions here (Troubleshooting 5000/6000/7000 Series Oscilloscope Software Downloads) (http://www.keysight.com/main/editorial.jspx?cc=GB&lc=eng&ckey=670496&nid=-33843.924870&id=670496). The only file on the USB stick was the unadulterated 06.16.0001A sys7000A.jzp file.

Once the scope had booted off the USB stick (I found it took not much longer than a normal boot), I did the tweak in the service menu procedure (https://www.eevblog.com/forum/testgear/agilent-mso7000-series-opinions-wanted/msg408947/#msg408947).

I removed the USB stick, rebooted to 06.17.0001B and the settings were maintained, including MSO and the other options.

(http://i34.photobucket.com/albums/d123/photobucket391/03C10C04-F1AA-4002-A1BC-F16256BA6042_zpsvv4ubhii.jpg) (http://s34.photobucket.com/user/photobucket391/media/03C10C04-F1AA-4002-A1BC-F16256BA6042_zpsvv4ubhii.jpg.html)

(http://i34.photobucket.com/albums/d123/photobucket391/DADCE1AD-64FC-477E-9977-34D9AECD19BD_zpsag7ojuoq.jpg) (http://s34.photobucket.com/user/photobucket391/media/DADCE1AD-64FC-477E-9977-34D9AECD19BD_zpsag7ojuoq.jpg.html)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on July 31, 2015, 11:01:30 pm
Congratulations on your new scope and your "upgrade"
Isn't it amazing when you use the big screen for the first time.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on July 31, 2015, 11:40:31 pm
Congratulations on your new scope and your "upgrade"
Isn't it amazing when you use the big screen for the first time.

Agreed, but just possibly toooo big... dread to think about how the 4000X and 6000X are with the same physical screen size but lower resolution. I can see why Mike reckons the 6+" is OK, because they don't really use the XGA screen to its best advantage when scaled up to 12". 8 or 10" might've been a really nice size.

Replaced the scope stack above the main monitor with this one now. I've gained another 3-4" of depth on the desk as everything can be pushed back now.

(http://i34.photobucket.com/albums/d123/photobucket391/99E235E0-6EC8-4A5F-A47B-461FEB1AAFCC_zps6xfg0b4o.jpg) (http://s34.photobucket.com/user/photobucket391/media/99E235E0-6EC8-4A5F-A47B-461FEB1AAFCC_zps6xfg0b4o.jpg.html)

(http://i34.photobucket.com/albums/d123/photobucket391/DF055E34-7155-4DCE-9DF2-9D7694BE379C_zpsb43ywwxe.jpg) (http://s34.photobucket.com/user/photobucket391/media/DF055E34-7155-4DCE-9DF2-9D7694BE379C_zpsb43ywwxe.jpg.html)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: nctnico on August 01, 2015, 05:50:42 pm
I have a DSO7104A and I realy like the big screen. Finally a scope where you can have 2 traces on top of eachother without cramming the screen contents. Mine was appearantly hacked by the previous owner; I could enable the circular segmented memory option by entering a bogus key.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on August 01, 2015, 08:58:02 pm
It is also a little surprise to me, that the 6000 series 1GHz scope has a higher list price on the keysight store than the 7000 series 1 GHz.
May be it is the MSO option, that makes the difference
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: nctnico on August 01, 2015, 09:40:17 pm
The MSO option probably makes the price different. If you look carefully on Ebay you can buy the MSO probes in mint condition for less than $300.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on August 01, 2015, 09:45:54 pm
The MSO option probably makes the price different. If you look carefully on Ebay you can buy the MSO probes in mint condition for less than $300.
You can also occasionally find old 1650 or 1651 logic analysers with 5 or 2 probes for that sort of money.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on August 01, 2015, 11:29:35 pm
I already had two sets of probes from the 54622D and 54642D that I have, so that wasn't a problem for me.

Unfortunately I have had to travel to Hong Kong at short notice so I won't be able to do any nerding about until I return on Sunday night.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on August 02, 2015, 12:02:08 am
I also already had three 10073C 500MHz passive probes. There's a fella selling brand new ones on ebay at the moment for $60, that's pretty darned good for a branded 500MHz probe. I bought three, but was sent four :-)

They are totally new, in original packaging, with standard accessories.

http://www.ebay.co.uk/itm/191634169278?_trksid=p2057872.m2749.l2649&ssPageName=STRK%3AMEBIDX%3AIT (http://www.ebay.co.uk/itm/191634169278?_trksid=p2057872.m2749.l2649&ssPageName=STRK%3AMEBIDX%3AIT)

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: knotlogic on August 21, 2015, 07:08:15 am
Has anyone tried this out with a 5000 series scope?  Any luck?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on August 21, 2015, 08:06:35 am
The software is the same for 5000,6000 and 7000 so should work.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: knotlogic on August 21, 2015, 08:27:06 am
Well.... Should is not quite the same as does...  Not wanting to start an argument or anything.  Just that I'm interesting in picking up a scope and the 6000s are pricey, so it'd be good to find out now rather than later...  :D
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Berni on August 21, 2015, 09:05:10 am
Well.... Should is not quite the same as does...  Not wanting to start an argument or anything.  Just that I'm interesting in picking up a scope and the 6000s are pricey, so it'd be good to find out now rather than later...  :D

Relax the firmware update file on the Keysight website is the same for both 5000 and 6000. The 7000 even has a separate firmware file and it still works on it.

http://www.keysight.com/main/software.jspx?ckey=2211091&lc=eng&cc=SI&nid=-32924.0.00&id=2211091 (http://www.keysight.com/main/software.jspx?ckey=2211091&lc=eng&cc=SI&nid=-32924.0.00&id=2211091)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on August 21, 2015, 10:05:30 am
Well.... Should is not quite the same as does...  Not wanting to start an argument or anything.  Just that I'm interesting in picking up a scope and the 6000s are pricey, so it'd be good to find out now rather than later...  :D
You "should" be happy, that that you get such valuable advise here at this forum.
I bought a used 7000A and it did not work at all, but there was may be something wrong with the scope. I sold it again and got the 7000B series and it worked extremely well.
 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on August 21, 2015, 02:37:22 pm
Well.... Should is not quite the same as does...  Not wanting to start an argument or anything.  Just that I'm interesting in picking up a scope and the 6000s are pricey, so it'd be good to find out now rather than later...  :D

There's a French Youtube vid showing a bloke liberating a 5000.

https://www.youtube.com/watch?v=xGGEh8KaM84 (https://www.youtube.com/watch?v=xGGEh8KaM84)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: knotlogic on August 21, 2015, 04:27:10 pm
You "should" be happy, that that you get such valuable advise here at this forum.
I bought a used 7000A and it did not work at all, but there was may be something wrong with the scope. I sold it again and got the 7000B series and it worked extremely well.

Oh believe me, I am.  The only thing I am not "quite" so happy about is I  never found this place years ago.  ;D

There's a French Youtube vid showing a bloke liberating a 5000.
Thanks!  That's more than I could hope for really.  Even without being able to speak French I think I understood what he was saying.  Now all I need to do is find one...

I am curious though, what *are* the differences between the 5000 and 6000 series?  It seems they have the same performance specs, only that the 6000 goes all the way up to 1 GHz and has the MSO option.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on August 21, 2015, 05:12:16 pm
e differences between the 5000 and 6000 series?  It seems they have the same performance specs, only that the 6000 goes all the way up to 1 GHz and has the MSO option.
Mostly MSO, I think maybe also  the physical size is less deep - check the datasheets.
When choosing remember that decodes are only available on 4-channel models.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: knotlogic on August 26, 2015, 04:11:27 pm
Mostly MSO, I think maybe also  the physical size is less deep - check the datasheets.
When choosing remember that decodes are only available on 4-channel models.

Yep the 5000s are definitely less deep.  I'm surprised that the MSO option would need that much more space on the 6000.  Or maybe the 1 GHz units need some of it too.  :-//

So this is one of the rare times I've been lucky.  I found someone with one to sell.  The catch is he can't complete the self test.  Apparently there's a keypad test, and the last item is the calibration protect switch on the back.  He doesn't know what that switch does and isn't comfortable flipping it.

What *does* that switch do?  My understanding is that it just locks out the option to do a user cal from the service menu.

Also, what's the test flow like for the self test?  Is there any useful information that comes up before hitting the keypad test?  I'm on the fence on this one.  It's a nice scope to have, but I'm not confident of handling any repairs should it need any.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: wreeve on August 26, 2015, 05:41:13 pm
Yes it just locks out the user cal. Ironically I had to give it a good few actions to get it working on my 'scope! Guess it gets little use!
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: knotlogic on September 01, 2015, 02:32:20 pm
Uh, anyone have a copy of the v06.16.001 firmware for the 5000? Or could point me in the direction of it.  The only version I could find on the website is v6.20.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dolphin42 on November 28, 2015, 08:18:05 am
So, having successfully fiddled with my scope and turned (most) features on, I have just one question: is memMAX available from the "enter license" end of the hack, or is that one only available from the "service menu" hack?

and if it is available from the license end, what's the mnemonic?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on November 28, 2015, 08:38:00 am
So, having successfully fiddled with my scope and turned (most) features on, I have just one question: is memMAX available from the "enter license" end of the hack, or is that one only available from the "service menu" hack?

and if it is available from the license end, what's the mnemonic?

My understanding was that the 8M points was automatically enabled with firmware after a certain version some time ago.

I'm away in Hong Kong until Sunday, I can check for you upon my return if no one else responds in the meantime.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: tautech on November 28, 2015, 08:40:39 am
So, having successfully fiddled with my scope and turned (most) features on, I have just one question: is memMAX available from the "enter license" end of the hack, or is that one only available from the "service menu" hack?

and if it is available from the license end, what's the mnemonic?

My understanding was that the 8M points was automatically enabled with firmware after a certain version some time ago.

I'm away in Hong Kong until Sunday, I can check for you upon my return if no one else responds in the meantime.
Nice, hope you find some goodies Howard.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on November 28, 2015, 08:58:15 am
So, having successfully fiddled with my scope and turned (most) features on, I have just one question: is memMAX available from the "enter license" end of the hack, or is that one only available from the "service menu" hack?

and if it is available from the license end, what's the mnemonic?
If the scope already has 8M that is the maximum - this became standard not long after the scope was released.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Berni on November 28, 2015, 10:20:51 am
No the 8M memory still needs a license. Just the scopes sold after a certain date all had the license on for free. I had to enter a license for it on mine.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dolphin42 on November 28, 2015, 10:33:34 am
Right then, well I have the 8M already. Guess "mission accomplished". :)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on November 28, 2015, 10:49:43 am
So, having successfully fiddled with my scope and turned (most) features on, I have just one question: is memMAX available from the "enter license" end of the hack, or is that one only available from the "service menu" hack?

and if it is available from the license end, what's the mnemonic?

My understanding was that the 8M points was automatically enabled with firmware after a certain version some time ago.

I'm away in Hong Kong until Sunday, I can check for you upon my return if no one else responds in the meantime.
Nice, hope you find some goodies Howard.

Only there for eight hours to pick up some parts for a production run next week that went missing somewhere in the logistics ether. Might pop over to Pacific Place if I get chance to take in Mike's handiwork.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: bc17101 on November 29, 2015, 07:35:12 pm
Is there a patch location for the latest Agilent DSO6104 (.20)  code to enable all the features ? If not, is there a download location for the .16 code used in many of the above examples.

Thanks,

Bill
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on November 29, 2015, 08:16:46 pm
Is there a patch location for the latest Agilent DSO6104 (.20)  code to enable all the features ? If not, is there a download location for the .16 code used in many of the above examples.

Thanks,

Bill
Just enable the  "service menu" and all options will be available.
It is the easiest way to activate the options.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: bc17101 on November 29, 2015, 08:34:37 pm
Could you please point me to the correct steps to enable the service menu?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on November 29, 2015, 08:38:45 pm
Could you please point me to the correct steps to enable the service menu?

Service menu on MSO7000

telnet <ip> 5810
username: panther
password: pictures

-> cmd
[vxWorks]# mem modify -w 1 0x009A2187
0x009a2187:  0x00-0x01
0x009a2188:  0x00-.

“cmd”
then press enter.  At [vxWorks]# prompt, type
“mem modify -w 1 0x009A2187”
then press enter. 
Then type “0x01” and press enter again. 
Then type “.” and press enter again.


 Then open up the service menu
utility -> options -> licenses -> options
enable 'service mode', 'all licenses', and 'mso'

reboot scope

Done


====================
Only for 6000 series type this in the vxWorks console:
   mem modify -w 1 0x00966E67
vxWorks response should be:
   0x00966e67:    0x00-
Now type "0x01" after "0x00-" to enable service menu.
new vxWorks response should be:
   0x00966e68:    0x00-
Now type "." after "0x00-" to exit.

Now go to "Options" -> "Licenses".

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: bc17101 on November 29, 2015, 10:29:34 pm
I tried both addresses (for the 7000 and 6000) and neither one gives me the service menu in my DSO6104.
I'm assuming that the magic location will vary with the software version. I am using the latest V6.20 (not the V6.16 that seems to be prevalent in this thread.
Does anyone have either the magic address for the 6000 scope with V6.20 software or a location that I can download the 4 necessary files for V6.16?

Thanks in advance,

Bill
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on November 29, 2015, 10:30:51 pm
Could you please point me to the correct steps to enable the service menu?

Service menu on MSO7000

telnet <ip> 5810
username: panther
password: pictures

-> cmd
[vxWorks]# mem modify -w 1 0x009A2187
0x009a2187:  0x00-0x01
0x009a2188:  0x00-.

“cmd”
then press enter.  At [vxWorks]# prompt, type
“mem modify -w 1 0x009A2187”
then press enter. 
Then type “0x01” and press enter again. 
Then type “.” and press enter again.


 Then open up the service menu
utility -> options -> licenses -> options
enable 'service mode', 'all licenses', and 'mso'

reboot scope

Done


====================
Only for 6000 series type this in the vxWorks console:
   mem modify -w 1 0x00966E67
vxWorks response should be:
   0x00966e67:    0x00-
Now type "0x01" after "0x00-" to enable service menu.
new vxWorks response should be:
   0x00966e68:    0x00-
Now type "." after "0x00-" to exit.

Now go to "Options" -> "Licenses".

Is this dependent of a certain firmware version, or is it universal?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on November 29, 2015, 10:51:43 pm
This information was found and collected from post's in this thread in regards to the 6000 and 7000 series.
Personally I have only tried it on the 7000 series.
I got it to work on a couple of 7000B series scopes without any problems.

May be the 6000 series has the telnet access on a different port?
May be you can make quick scan?

I am not sure if it is depending on FW.


 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on November 29, 2015, 11:02:11 pm
The reason I raise this is that the way I read the previous posts on this in this thread was that it was dependent on 6.16. My 7000B arrived with 6.17 so I booted off a 6.16 USB stick and did the setting that way as I didn't know if it would work otherwise. I'm not saying it won't work with other versions, I was asking for clarification.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on November 29, 2015, 11:06:19 pm
The reason I raise this is that the way I read the previous posts on this in this thread was that it was dependent on 6.16. My 7000B arrived with 6.17 so I booted off a 6.16 USB stick and did the setting that way as I didn't know if it would work otherwise. I'm not saying it won't work with other versions, I was asking for clarification.

I will have a look tomorrow on my 7000B series, as to what FW is installed.
So, you always boot yours from a USB stick?
You never tried to access with telnet on FW v 6.17?
 

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on November 30, 2015, 07:17:54 am
The reason I raise this is that the way I read the previous posts on this in this thread was that it was dependent on 6.16. My 7000B arrived with 6.17 so I booted off a 6.16 USB stick and did the setting that way as I didn't know if it would work otherwise. I'm not saying it won't work with other versions, I was asking for clarification.

I will have a look tomorrow on my 7000B series, as to what FW is installed.
So, you always boot yours from a USB stick?
You never tried to access with telnet on FW v 6.17?

I don't remember ever doing so. I did have a look at the .bin images and determined that the "other" way was in different locations, I don't know if that is the case for setting the service menu on, but my concern was more about the risk in bricking the scope if it was in a different place, and the possible damage caused by poking an unknown location.

So to minimise risk I booted off a USB stick with 6.16, enabled the service menu with the location given, and then rebooted back to 6.17 that was on the scope already. I've since updated to 6.20, and unlike 6.16, 6.17 wasn't ever available on the Keysight web site as far as I could see, so I don't have 6.17 available to try any more.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on November 30, 2015, 03:40:13 pm
I tried both addresses (for the 7000 and 6000) and neither one gives me the service menu in my DSO6104.
I'm assuming that the magic location will vary with the software version. I am using the latest V6.20 (not the V6.16 that seems to be prevalent in this thread.
Does anyone have either the magic address for the 6000 scope with V6.20 software or a location that I can download the 4 necessary files for V6.16?

Thanks in advance,

Bill
Hi Bill,

Try this:

If somebody wants to go ServiceMode way, there is more portable way: execute setServiceMode(1) in C mode console ("->" prompt). But, as it was discussed already, there is no danger patching sys.bin - we are not touching the bootloader, where "emergency" restore lives.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: RFasic on January 13, 2016, 03:02:55 pm
Hi to all DSO6000  family owners,

I have made a real good bargain just before xmas on a MSO6034A.... 800€ with all probes !
This reliable machine is now fully modified by using the Mike's method (a nice and easy way to avoid the SEC option without forgetting the other ones).

I have a question for "Carrington" who dare to try to modify his 6034A to reach the 6054A level performances ... :
You successfully added the 4Gs/s rate to your 6034A; your modified address location was 0x00231420 for the 4 modified octets, but for what firmware version ?
I am currently using the 6.20 version, do you know which adress i should use for this version (unfortunately,  the string 38 09 FF FD is present at many different places ?)

Did you succeded into the modification of the front end passive components (filtering adjustments before and after the 1NB7-8453 hybrid) ?

Thanks again to Mike, Carrington and Abyrvalg for this very informative post.  :-+
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 13, 2016, 04:46:56 pm
I have made a real good bargain just before xmas on a MSO6034A.... 800€ with all probes !
Woow! Yes, for that price is really a bargain.

You successfully added the 4Gs/s rate to your 6034A; your modified address location was 0x00231420 for the 4 modified octets, but for what firmware version ?
It was the previous version to 6.20, the 6.16, I think.

I am currently using the 6.20 version, do you know which adress i should use for this version (unfortunately,  the string 38 09 FF FD is present at many different places ?)
Go to 0x00231998 and replace 38 09 FF FD by 38 00 00 01.

Did you succeded into the modification of the front end passive components (filtering adjustments before and after the 1NB7-8453 hybrid) ?
No, because as we have said many times here we need to know the proper value of the RC network see inside the front end  on the 500MHz versions, and unfortunately no one has contributed.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 15, 2016, 07:02:18 pm
Please, take a look to the next picture, is from an DSO5054A:
(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=194139;image)

Now look at this other:
(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=82831;image)

I wonder if removing that capacitor is enough to increase the BW to 500MHz.  :-//
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Keysight DanielBogdanoff on January 15, 2016, 07:52:28 pm
I wonder if removing that capacitor is enough to increase the BW to 500MHz.  :-//

No, it's not that simple.  :)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 15, 2016, 08:02:48 pm
Is this dependent of a certain firmware version, or is it universal?
The reason I raise this is that the way I read the previous posts on this in this thread was that it was dependent on 6.16. My 7000B arrived with 6.17 so I booted off a 6.16 USB stick and did the setting that way as I didn't know if it would work otherwise. I'm not saying it won't work with other versions, I was asking for clarification.
Effectively it varies with the firmware version.
Excuse me for taking so long time to reply, I checked today.

I don't remember ever doing so. I did have a look at the .bin images and determined that the "other" way was in different locations, I don't know if that is the case for setting the service menu on, but my concern was more about the risk in bricking the scope if it was in a different place, and the possible damage caused by poking an unknown location.
The "showServiceMode" function is still present in version 6.20, so the easy way is:
If somebody wants to go ServiceMode way, there is more portable way: execute setServiceMode(1) in C mode console ("->" prompt). But, as it was discussed already, there is no danger patching sys.bin - we are not touching the bootloader, where "emergency" restore lives.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 15, 2016, 08:15:03 pm
I wonder if removing that capacitor is enough to increase the BW to 500MHz.  :-//

No, it's not that simple.  :)

Opps Keysight cauhgt us! LOL...

Hi, Daniel, just kidding, sorry.
Thanks for the clarification, but obviously you can't help us with that, right?

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on January 16, 2016, 07:05:30 pm
Just picked up a MSO7104B but need to get some probes before anything else.  There's a list of probes in the generic datasheet but there seems to be more probes available than is listed on the datasheet.  Questions:

1. Can ordinary non-Agilent probes be used for low frequency (100 MHz) stuff?
2. For faster stuff (350 MHz) what is the best probe to look for? I'm thinking a couple of passive 500 MHz probes and maybe look out for an active single-ended 800 MHz or 1 GHz probe or two - any suggestions?
3. For the MSO probe, the datasheet lists 01650-61607 and 54620-68701, are these the only 2 that will work with the MSO7104B?

Thanks,
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: nctnico on January 16, 2016, 07:15:02 pm
For looking at signals over 100MHz go for passive Lo-z or active FET probes for the most accurate signal display and least signal loading. For ordinary use  (<100MHz) any probe will do.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on January 16, 2016, 07:50:41 pm
For looking at signals over 100MHz go for passive Lo-z or active FET probes for the most accurate signal display and least signal loading. For ordinary use  (<100MHz) any probe will do.
Thanks but am I limited to the ones that Agilent (Keysight) lists?  There appear to be several non Agilent probes available that have the little gold pin sticking out - e.g. these ones on Amazon (http://www.amazon.com/500mhz-Oscilloscope-Readout-Agilent-Tektronix/dp/B007N041SW/ref=sr_1_38?ie=UTF8&qid=1452973489&sr=8-38&keywords=500+MHz+scope+probe). I realize these are passive but they're supposed to be good for 500 MHz?  Active probes are $600 - $1,500 each.  I'm not averse to spending money but am looking for guidance on best bang for my buck and I don't need 4 active probes on my 7104 on day 1.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on January 16, 2016, 08:14:54 pm
Any passive probe is fine in terms of actually working, the x10 pin ID is standard across all probes and scopes.
 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: nctnico on January 16, 2016, 08:16:58 pm
For looking at signals over 100MHz go for passive Lo-z or active FET probes for the most accurate signal display and least signal loading. For ordinary use  (<100MHz) any probe will do.
Thanks but am I limited to the ones that Agilent (Keysight) lists?  There appear to be several non Agilent probes available that have the little gold pin sticking out - e.g. these ones on Amazon (http://www.amazon.com/500mhz-Oscilloscope-Readout-Agilent-Tektronix/dp/B007N041SW/ref=sr_1_38?ie=UTF8&qid=1452973489&sr=8-38&keywords=500+MHz+scope+probe). I realize these are passive but they're supposed to be good for 500 MHz?  Active probes are $600 - $1,500 each.  I'm not averse to spending money but am looking for guidance on best bang for my buck and I don't need 4 active probes on my 7104 on day 1.
These aren't Lo-Z passive probes but regular 1:10 probes so don't waste your money on those! Look for probes from a firm called Testec; I think Farnell/Element14 carries these. The probes from Testec are cheap and very suitable for general purpose (<100MHz) probing.

I'm using Tektronix P6156 Lo-z probes with my DSO7000 series but I have put a piece of kapton tape on the probe detect pin because these probes can have different attenuation factors which are not supported by the DSO7000. Setting the attenuation factor manually is easy though.

Here is some more info on high frequency probing:
http://paulorenato.com/joomla/index.php?option=com_content&view=article&id=93:praise-for-the-lo-z-probe&catid=4:projects&Itemid=4 (http://paulorenato.com/joomla/index.php?option=com_content&view=article&id=93:praise-for-the-lo-z-probe&catid=4:projects&Itemid=4)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on January 16, 2016, 11:16:02 pm
Here are my experiences with probes on the 7000.

The 10073c/d 500MHz passive probes turn up fairly regularly on eBay, the only difference as far as I can tell is that the D versions are ROHS.

I bought four 10073C for just under £150 total for all four in the past few months including all accessories like spring grounds, coloured ident rings and ground croc leads.

The 1165A have slightly lower capacitance loading and are spec'd to 600MHz. I've bought several of these over the past eighteen months, ranging from £25 (£50/2) to about £50 each on eBay, all with cases and ground and ident clips etc. They are much nicer probes ergonomically than the 10073x, much lighter weight, and have thinner lighter coax with a longer reach too.

For day to day use, I find the light weight and slightly smaller form factor of the 1165A much better than the 10073x.

All well and good, but the capacitive loading and frequency response of the "high impedance" passive probes often renders them useless in high speed digital.

You can also find lo-z 1.5GHz probes like N2874 (10:1) and N2876 (100:1) which will correctly auto ident with the 7000B. I bought two each at £50 each recently on eBay, together with accessories like spring and low inductance copper grounds as well as the usual flying lead croc clips.

For FET probes recently I bought a 1130A 1.5GHz probe with appropriate accessories including a single ended browser with tips for £50 on eBay but that is exceptional. A 3.5GHz 1131A with differential browser was £185 from the same seller (a TE sales and rental house) which I consider a bargain too.

Be careful of unsupported probes: the Infiniimax "standard" has caveats, so probes like the fairly widely available 1152A 2.5GHz single ended probe don't work with the 7000B, the probe interface is physically identical but it doesn't support the probe's voltage/power requirements.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on January 16, 2016, 11:32:54 pm
Regarding the digital LA probe, these turn up regularly on eBay for about $200 or so. Worth every penny, but make sure that they come with all flying leads. The spring clips on the other hand can be purchased anywhere, and I hardly ever use them, preferring soldered in machined pin probe points instead.

Those probe pods are not just a bit a bit of reassuringly expensive ribbon cable, by the way! Well, not if you probe anything more than an S-100 bus anyway.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on January 17, 2016, 11:20:20 am
Howard, nctnico, thanks for the detailed probe info, exactly what I needed.  I just bought two 1160A probe sets on eBay which I'm pretty sure are the equivalent early version of the 1165A you recommended except they are only 500 MHz - they come in neat zipper pouches with a load of different probe accessories - got them for $80 each.  The guy had them listed on eBay as 10073C, probably because nobody was going to search for '1160A'.  I guess if they don't work, I can return them as technically they are not the advertised item.

I'm still working on the LA probe stuff.

The more I read about the MSO7104B, the more confident I get that this was a great choice.  I thought I might be having buyers remorse right now but I'm not.  A scope is one of the basic tools I use to make my living and, to date, I've been struggling with a Rigol MSO2202A and had access to a Tektronix MDO3204 but they are both dogs when it comes to I2C / SPI serial bus decode - to the point of being unusable, looks like the MSO7104 is the dogs bollocks in this regard with full speed hardware decode at 100,000 Wf/sec.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on January 17, 2016, 11:40:03 am
Howard, thanks for the detailed probe info, exactly what I needed.  I just bought two 1160A probe sets on eBay which I'm pretty sure are the equivalent early version of the 1165A you recommended - they come in neat zipper pouches with a load of different probe accessories - got them for $80 each.  The guy had them listed on eBay as 10073C, probably because nobody was going to search for '1160A'.  I guess if they don't work, I can return them as technically they are not the advertised item.

I'm still working on the LA probe stuff.

The more I read bout the MSO7104B, the more confident I get that this was a great choice.  I thought I might be having buyers remorse right now but I'm not.  A scope is one of the basic tools I use to make my living and, to date, I've been struggling with a Rigol MSO2202A and had access to a Tektronix MDO3204 but they are both dogs when it comes to I2C / SPI serial bus decode - to the point of being unusable, looks like the MSO7104 is the dogs bollocks in this regard with full speed hardware decode at 100,000 Wf/sec.

I am not certain how well the 1160A will compensate, the difference between the 1160A and the 1165A in terms of compensation range is 6-9pF and 12-14pF respectively, with the scope input spec'd at 14pF.

Also be aware that SPI decoding fails at a clock speed beyond about 35MHz (it's spec'd to 25MHz).

The best thing about the 5000/6000/7000 series is the UI in terms of ease of use and responsiveness. Everything is obvious. In contrast, the UI of the MDO3000 you mentioned isn't any of those things!
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on January 17, 2016, 11:48:25 am

The more I read about the MSO7104B, the more confident I get that this was a great choice.  I thought I might be having buyers remorse right now but I'm not. 
Despite the age, the fact that the 5000/6000/7000 series can easily be hacked for MSO and decodes, a used one at the right price probably still offers about the best bang/buck in this performance range.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on January 17, 2016, 02:28:09 pm
I totally agree, the 7000B series scope is by far my favorite scope in the lab.
Especially after I added the fitting 1147B current probe.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on January 17, 2016, 04:46:47 pm
I am not certain how well the 1160A will compensate, the difference between the 1160A and the 1165A in terms of compensation range is 6-9pF and 12-14pF respectively, with the scope input spec'd at 14pF.

Also be aware that SPI decoding fails at a clock speed beyond about 35MHz (it's spec'd to 25MHz).

The best thing about the 5000/6000/7000 series is the UI in terms of ease of use and responsiveness. Everything is obvious. In contrast, the UI of the MDO3000 you mentioned isn't any of those things!
Hmmm, now I AM having buyers remorse - anyway, I'll try them out on a 350 and 500 MHz signal and see how they perform - if they suck, I will return them.
[EDIT] I have contacted the seller and told them that if tehse are 1160A probes then I want him to cancel my order.

SPI decode doesn't work > 35 MHz eh?  Useful to know.

Yes, given the cost, I was unimpressed with the Tek MDO3204 with the legit serial decode unit, I would be asking for my money back if I had bought it (it  is on a client site).

I also ordered an HP 01650-61607 cable plus an Agilent E5383A flying lead set for $50 and $25 respectively so I now have the LA connection side covered too.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 17, 2016, 05:37:50 pm
Also be aware that SPI decoding fails at a clock speed beyond about 35MHz (it's spec'd to 25MHz).
SPI decode doesn't work > 35 MHz eh?  Useful to know.

Many others oscilloscopes have a similar limitation (regarding decoders), and even worse. So, as you say "useful to know".
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on January 17, 2016, 07:35:53 pm
Also be aware that SPI decoding fails at a clock speed beyond about 35MHz (it's spec'd to 25MHz).
SPI decode doesn't work > 35 MHz eh?  Useful to know.

Many others oscilloscopes have a similar limitation (regarding decoders), and even worse. So, as you say "useful to know".

Interestingly the Tek MDO3000 will decode 50MHz SPI... as will the Rigol MSO1074Z. I suspect it's a limitation of the hardware decoder in the ASIC.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on January 17, 2016, 07:53:51 pm
Interestingly the Tek MDO3000 will decode 50MHz SPI... as will the Rigol MSO1074Z. I suspect it's a limitation of the hardware decoder in the ASIC.
Yes, I think so too.
However the maximum decode/refresh rate on the screen for 5000 6000 and 7000 serie is 60Hz. I remember reading this in a datasheet.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on January 17, 2016, 10:14:26 pm
Yes, the real issue is with decoding is the screen refresh rate, my experiences with the Tek MSO3204 were terrible.  The Rigol MSO2202 was better than the Tek but it only decoded what was on the screen and you had to stop the capture and wait for the decode to catch up!

I managed to contact the eBay seller and my 1160A purchase is now cancelled.  Now to look for some good probes.  I can't believe I was looking at such cheap probes when I bought such an awesome scope - like buying a Ferrari and putting retread tires on it.  The 1165A is what I'm looking for as per Howard's advice.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on January 17, 2016, 10:26:45 pm
Interestingly the Tek MDO3000 will decode 50MHz SPI... as will the Rigol MSO1074Z. I suspect it's a limitation of the hardware decoder in the ASIC.
Yes, I think so too.
However the maximum decode/refresh rate on the screen for 5000 6000 and 7000 serie is 60Hz. I remember reading this in a datasheet.
Try this link (http://literature.cdn.keysight.com/litweb/pdf/5989-9580EN.pdf?id=1502124) for a comparison with a Tek 4000B

In it, Agilent makes this claim...
• Up to 500,000 times faster when tektronix enables the features they promote like 10M of memory, digital channels and/or serial decode
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on January 17, 2016, 11:00:41 pm
I'm using Tektronix P6156 Lo-z probes with my DSO7000 series but I have put a piece of kapton tape on the probe detect pin because these probes can have different attenuation factors which are not supported by the DSO7000. Setting the attenuation factor manually is easy though.

Hmm, there's quite a few P6156 probes on eBay at reasonable prices and I was surprised to see that they go up to 3.5 GHz, is there some catch?  Also can you please give a bit more info on how you set up the 7000 to use these - I presume you start by setting the input impedance to 50 Ohms.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on January 17, 2016, 11:08:14 pm
Another "feature" of the MDO3000 is that when you switch on even one channel of the LA, the update rate goes down from about 50kHz down to a an average of about 60Hz but in bursts of about 130Hz with two 70ms gaps every 1/4s, so it's very noticeable. And that's without any decoding at all.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on January 17, 2016, 11:17:53 pm
I'm using Tektronix P6156 Lo-z probes with my DSO7000 series but I have put a piece of kapton tape on the probe detect pin because these probes can have different attenuation factors which are not supported by the DSO7000. Setting the attenuation factor manually is easy though.

Hmm, there's quite a few P6156 probes on eBay at reasonable prices and I was surprised to see that they go up to 3.5 GHz, is there some catch?  Also can you please give a bit more info on how you set up the 7000 to use these - I presume you start by setting the input impedance to 50 Ohms.

I don't have any experience with those particular probes, they look like lo-z ones. They will work with the 7000 but you'll need to manually set the 50ohm and vertical scaling manually as I doubt the readout is compatible: for example the Agilent N2874 (10:1) and N2876 (100:1) which have readout compatible with the 7000 isn't recognised by the MDO3000 I also have here. I suspect that only the 11k ohm 10X readout is "standard" across brands, but ISTBC. Not a big deal, it's only in recent years I've had scopes with readout capability, so I've been more than used to either manually setting the scope or much more frequently doing the conversion in my head, yes I am that old.

Just make sure that any probes you purchase have all the relevant accessories like spring/walking stick grounds and tips or you might end up with an expensive but largely useless tool!
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: nctnico on January 17, 2016, 11:34:22 pm
I'm using Tektronix P6156 Lo-z probes with my DSO7000 series but I have put a piece of kapton tape on the probe detect pin because these probes can have different attenuation factors which are not supported by the DSO7000. Setting the attenuation factor manually is easy though.
Hmm, there's quite a few P6156 probes on eBay at reasonable prices and I was surprised to see that they go up to 3.5 GHz, is there some catch?  Also can you please give a bit more info on how you set up the 7000 to use these - I presume you start by setting the input impedance to 50 Ohms.
Most of these probes are sold with the standard 1:10 attenuator which loads the signal with 500 Ohm. This may be too low for LVDS so getting one with the 1:20 or 1:100 attenuators is more of a challenge. Some might come with extra attenuators but since most sellers have no idea what they are selling it is not in the description. Until a few days ago I didn't even know the attenuators are stored in a rubber thingy with a lid. I had two of those storage containers; one was empty but the other one contained a 1:20 and 1:100 attenuator so I could put some more useful probes together.

As Howard noted it is important to look for complete probes: ground clip, probe housing, ground spring, etc. Setting up the DSO7000 is easy: set the input to 50 Ohms and adjust the probe scaling factor. You'll need to isolate the extra pin next to the BNC though. The reason I have the P6156 probes is because I used to own Tektronix scopes which could work with these probes but there is not much magic to them. The adjustment knob for the attenuator setting only adjust the resistance the scope sees on the pin next to the BNC connector.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on January 19, 2016, 01:49:54 pm
The MSO7104B hasn't arrived yet and I'm still looking for probes.  eBay has many but 9/10 of them have no parts with them and many are asking ridiculous prices like the Agilent 1165A that has no accessories at the 'bargain' price of $495.
I've got some Rigol passive probes that are rated to $350 MHz (although they are 13 pF input capacitance) and 6-24 pF scope inputs; they will work for now and I'll bide my time to get complete probes at reasonable money which I call less than $150 per probe for good used passive ones.
I even started looking at the poor man's 1 GHz active probe article by David Jewsbury - I guess I'm feeling poor after shelling out for the MSO7104
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on January 19, 2016, 02:29:17 pm
Take a look at the Agilent probes N2873A
I got 4 of them for my 7000 series scope and paid around $ 80 each from eBay USA.
They are 500 MHz, 400V, 10 MOhm, 10:1
Nice is the extra tiny tip diameter.


Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: artag on January 19, 2016, 02:31:25 pm
I've bought 4 1165a probes over the last year, since I got a dso7014a. Not strictly necessary for this lower specced version of the scope but they are more beautiful than the stock 10074c.

However, one was missing accessories (nice and cheap, though !) and another came with two spikes instead of a spike and a hook. So I could do with another couple of hook tips. Are these only available as Keysight accessories or are they made by someone else ? I recall someone mentioning another source but not sure if they're the same series.

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on January 19, 2016, 02:43:21 pm
The MSO7104B hasn't arrived yet and I'm still looking for probes.  eBay has many but 9/10 of them have no parts with them and many are asking ridiculous prices like the Agilent 1165A that has no accessories at the 'bargain' price of $495.
I've got some Rigol passive probes that are rated to $350 MHz (although they are 13 pF input capacitance) and 6-24 pF scope inputs; they will work for now and I'll bide my time to get complete probes at reasonable money which I call less than $150 per probe for good used passive ones.
I even started looking at the poor man's 1 GHz active probe article by David Jewsbury - I guess I'm feeling poor after shelling out for the MSO7104

Patience will work.

I bought some 10073Cs from this seller, who still has some available. They came with all accessories, but I did buy four. eBay item 201270061358 (http://www.ebay.com/itm/201270061358)

Here are the pair of 1165As I bought for $75 for the pair 151837366588 (http://www.ebay.com/itm/151837366588), again with all accessories.


Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on January 19, 2016, 04:06:19 pm
I bought some 10073Cs from this seller, who still has some available. They came with all accessories, but I did buy four. eBay item 201270061358 (http://www.ebay.com/itm/201270061358)
Howard, thanks for the link, I just bought 3 10073Cs from that guy.

artag, if you search for 'Agilent probe' on eBay, and then sort by price low-high, you'll find some people offering probe tips & clips.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on January 19, 2016, 06:34:59 pm
I bought some 10073Cs from this seller, who still has some available. They came with all accessories, but I did buy four. eBay item 201270061358 (http://www.ebay.com/itm/201270061358)
Howard, thanks for the link, I just bought 3 10073Cs from that guy.

artag, if you search for 'Agilent probe' on eBay, and then sort by price low-high, you'll find some people offering probe tips & clips.

Not sure if you saw this bit in the ad regarding buying 4 units:

Please note that if you take 4 piece or more, I will ship them via FedEx instead of registered post
( 2 to 4 working days to most countries )
And you will get a packet accessories for FREE ( complete )

So I don't know if you get the bits like probe idents and spring grounds if you buy less than 4 units. However they are standard 5mm probes so you may already have spring grounds.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on January 19, 2016, 06:47:04 pm
No, I didn't see that but, by good luck, the seller is away until Jan 25th so I was able to add an extra one to the order and I sent them a message asking them to honor the FedEx + accessories deal.  Thanks for bringing it to my attention Howard.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: nctnico on January 19, 2016, 06:57:45 pm
Still I think those probes are a waste of money. You never know how bad used probes are and their 500MHz spec is just nice on paper but has little practical meaning.
This kit with 2 probes costs $40:
http://uk.farnell.com/testec/tt-lf312-2-6-10020-2-6/probe-oscilloscope-150mhz-1-10/dp/4308098 (http://uk.farnell.com/testec/tt-lf312-2-6-10020-2-6/probe-oscilloscope-150mhz-1-10/dp/4308098)

A big plus is that these are switchable between 1:1 and 1:10.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: voltsandjolts on January 19, 2016, 07:29:12 pm
Personally, I really like tek probes, readily available and active probes are much cheaper than agilent (used prices).
OK P6139s response probably isn't going to be as flat as spec'd agilent probes but for my 6034 bandwidth I'm happy to compromise.
Nimble Lilliput FA1000 external display staves off some of the 7000 series envy! (and is actually quite useful to move around the bench close to where I'm probing)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: KE5FX on January 19, 2016, 09:06:11 pm
Nimble Lilliput FA1000 external display staves off some of the 7000 series envy! (and is actually quite useful to move around the bench close to where I'm probing)

Don't forget that your scope has a full-fledged VNC server built in.  You can display and control it from any monitor in the house with nothing more than an Ethernet cable.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: artag on January 19, 2016, 10:03:00 pm
Still I think those probes are a waste of money. You never know how bad used probes are and their 500MHz spec is just nice on paper but has little practical meaning.
This kit with 2 probes costs $40:
http://uk.farnell.com/testec/tt-lf312-2-6-10020-2-6/probe-oscilloscope-150mhz-1-10/dp/4308098 (http://uk.farnell.com/testec/tt-lf312-2-6-10020-2-6/probe-oscilloscope-150mhz-1-10/dp/4308098)

A big plus is that these are switchable between 1:1 and 1:10.

I don't think that's a plus. Several of my cheap chinese probes (as shipped with all hantek/owon/rigol etc) have the x1/x10 switch. I tape them up to keep them in the x10 position. x1 probes are a rare and unusual need due to the huge bandwidth loss they suffer - if you need something like that you probably should be looking for differential probes instead.

On the other hand, I wish I could find x10/x100 probes. Preferably with a really stiff switch.

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on January 19, 2016, 10:59:55 pm
Still I think those probes are a waste of money. You never know how bad used probes are and their 500MHz spec is just nice on paper but has little practical meaning.
This kit with 2 probes costs $40:
http://uk.farnell.com/testec/tt-lf312-2-6-10020-2-6/probe-oscilloscope-150mhz-1-10/dp/4308098 (http://uk.farnell.com/testec/tt-lf312-2-6-10020-2-6/probe-oscilloscope-150mhz-1-10/dp/4308098)

A big plus is that these are switchable between 1:1 and 1:10.

The 10073Cs I received from that seller appeared to be brand new when I received them, from the packaging they arrived in I assumed they were new-old stock that were bundled with scopes from when Agilent moved over to the 10073D. I have been pretty happy with 10073Cs on an Agilent 54642D (500MHz scope) for some time.

The 1165As were brand new, in original unscuffed and unmarked cardboard Agilent packaging with the pouches inside and a full complement of accessories.

You are right though that when it comes to probing at these frequencies the capacitive loading of hi-z passive probes is usually a severely limiting factor: the TPS0250/0500/1000 probes that come with the MDO3000 are much better in that regard with their 3.9pF loading, but they only work with Tek scopes with the right interface. But better to have either a lo-z probe or a FET job, horses for courses in that regard.

Those Testecs have no readout by the way. I guess I'm spoilt nowadays though after many years of working it out in my head! Not sure practically how much use a 1X probe is to the OP, I can't remember the last time I used one, but there again I am sure it's of use to some. The 1X/10X switching is a double edged sword, if either you forget or it accidentally gets nudged out of the expected position.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: nctnico on January 19, 2016, 11:10:26 pm
You can always set the probe attenuation factor manually. I do that often because I use various probes and current shunts to make measurements.
The 1x position is handy to look at low level signals where the additional bandwidth limiting actually helps to eliminate noise from the signal.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on January 20, 2016, 12:22:05 am
You can always set the probe attenuation factor manually. I do that often because I use various probes and current shunts to make measurements.

Sure, but to be honest I don't bother myself, I'm too old in the tooth, and spent too many years of doing it in my head to consider it worth the effort for general probing about. For documenting things yes, but I can't remember the last time I actually needed to set the scale factor manually.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: KE5FX on January 20, 2016, 01:06:02 am
It may have been mentioned earlier in the thread, but something you need to keep an eye out for on the DSO/MSO6000-series scopes is that the 1x/10x probe sense circuit isn't all that reliable.  Due to poor pin contact or some other property of the 10073C probe, the firmware can occasionally turn on the 50-ohm input terminator.   The orange LED status indicator for 50-ohm mode is very dim and easy to overlook at a glance, so you end up wondering why the signal you're looking for isn't showing up.   

There are a few complaints about this on Keysight's customer forum.  It would be nice if they allowed the user to disable probe recognition entirely, and set each channel to 1x/10x/50R manually in a way that would persist between power cycles. 

I wonder if the 10073D probes still do this? 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on January 20, 2016, 01:31:56 am
I can't say I've ever encountered that on my 7000: I do fairly frequently switch probes between the 1165A and other Agilent readout probes including some 10:1 and 100:1 lo-z ones which are detected correctly. I used to use 10073Cs before the 1165As arrived. That's not to say it doesn't happen, I've just never encountered it myself.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on January 20, 2016, 08:05:07 am
I've seen the 50R issue very occasionally, not enough to be a problem
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: artag on January 20, 2016, 12:48:00 pm
Also seen this. In my case it only seems to occur on channel 2, and I'm using the 10074C probes which have only a x1/x10 pin, no 50R ident as far as I know

Or does the x10 pin also provide that ? Seems unlikely to me as the most common reason for 50R is use with a standard 50R BNC plug, or with some specialist probe that would use the 9-pin interface.

On another subject ..  I did the service menu modification months ago (the ability to do that is what made me choose the scope - it just wouldn't have been worth the cost without those built-in features) but I recently found the options gone and the service menu disabled. Not sure where it went, or if it timed out in some way, but the same procedure worked perfectly a second time.

I see there's also a firmware update dating from last summer .. I haven't installed this, has anyone else ? It doesn't seem to offer much in the way of improvements, so I don't want to risk losing the 'free' options !



Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on January 20, 2016, 12:54:16 pm
Also seen this. In my case it only seems to occur on channel 2, and I'm using the 1007
I see there's also a firmware update dating from last summer .. I haven't installed this, has anyone else ? It doesn't seem to offer much in the way of improvements, so I don't want to risk losing the 'free' options !
Same here.
I saw the update but did not install it for the possibility of loosing the service menu.

And I never hat the 50 Ohm problem either
May be it is related to the "A" versions and not the "B" version of the scope?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on January 20, 2016, 01:41:34 pm
Passive Probes - Thanks for all the input.  I already have two 150 MHz scope probes with x1 x10 switch and two 350 MHz Rigol probes, all passive, so buying the Testec probes seemed pointless.  I like the idea of having the probes auto-configure and, given Howard's experience, those "used, mint" 10073C probes at $55 each with free shipping seems like a good deal - the seller has come back to me and confirmed that he'll ship all 4 together and give me the FedEx + accessories deal.

Active Probes - Still looking for bargains, there's an Agilent 1156A 1.5 GHz Active Probe listed on eBay for $149 that is in the original zipper case with all accessories but it's listed as "for parts or not working", I contacted the sellers and they told me that they had tested it but got no signal from it - taking a chance, I made them a low offer - It's possible that it works but, more likely, I'll have a probe that I can dissect and try to fix and the worst case is that I'll have a perfect set of accessories if I find one later that has no accessories like most eBay offerings.

Sorry if I've turned this thread into a probe discussion, when my Scope arrives, we can get back to the main subject.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on January 20, 2016, 05:47:11 pm
Or does the x10 pin also provide that ? Seems unlikely to me as the most common reason for 50R is use with a standard 50R BNC plug, or with some specialist probe that would use the 9-pin interface.

Yes, the readout pin does provide that for some Agilent probes as well as the common 10X hi-z readout.

Examples I have are the N2874A and N2876A (10:1 lo-z and 100:1 lo-z respectively) which automatically set the 50 ohm termination and the scale. I did measure the readout resistance and they're different to the common 11k ohm for the hi-z 10X. ISTR the 10:1 lo-z is 14k or so, I can't remember what the 100:1 was. I am sure you can check it by hooking up a resistance decade box.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on January 21, 2016, 01:00:07 am
I won the "not working" Agilent 1156A probe with my low bid (eventually after a couple of counter bids); I have this weird feeling that it works but I'm probably wrong, it does look perfect, comes in the original box with all the accessories, and the datasheet says it's got 5 kV ESD protection - what can be wrong with it?  I have this whacky idea that, if it's broken, I can incorporate the poor man's 1GHz probe (http://elektrotanya.com/files/forum/2009/10/e04a036.pdf) into the casing.

There are other threads here on the Autoprobe interface (https://www.eevblog.com/forum/projects/agilent-probe-interface-(-autoprobe-and-probe-id)/msg43788/#msg43788), go to the end and you'll find a patent document that gives a lot of info; there are specific resistance values that correspond to specific ratios and impedances.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: artag on January 21, 2016, 08:36:56 pm


Yes, the readout pin does provide that for some Agilent probes as well as the common 10X hi-z readout.


Looks like you're right : I had the problem again today - auto selected 50R and the menu to force 1M was disabled. The only way i could get it to clear was to disconnect and reconnect the probe.

The pin's resistance to ground is close to 11k (maybe 10k9) on these 10074C probes, as it is on a tek P6131.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on January 23, 2016, 06:39:33 pm
Scope is finally on its way.  I was looking at the various software options (I think mine will ship with 06.17 but they may have updated it to 06.20) and 06.16 added support for the Agilent N2744A T2A probe interface adapter (http://www.keysight.com/en/pd-1912818-pn-N2744A/t2a-probe-interface-adapter?cc=US&lc=eng) that adapts and translates for certain Tektronix probes - cool but expensive at nearly $500.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on January 29, 2016, 04:13:41 pm
Well the MSO7104 is here and it's big and beautiful, everything works as it should, I set the inputs to 50 Ohms and connected a 0 dBm signal via a BNC cable and got solid response all the way to 1.2 GHz (I didn't test higher); my probe selection is proving to be a bit more troublesome.

I used my 350 MHz Rigol RP3300A probes at first and they worked as expected. 

Then my '500 MHz' Agilent 10073C probes arrived; as Artag predicted, they are not really very good, really no better than the Rigol probes and they are bigger and clunkier, the only thing they do is set the correct probe ratio when you plug them in. However, where the 10073Cs really disappoint is in frequency response, they're falling off noticeably at 250 MHz, pathetic at 350 MHz, and unusable at 500 MHz and that's fed by an Agilent Sig Gene with a 50 Ohm output impedance; I see an eBay auction in their future.

Then the HP/Agilent 1144A 800 MHz active probe arrived along with an 1142A power supply ($99/$42 respectively on eBay), the probe is in excellent condition, has all the accessories, and gave me an almost flat response out through 800 MHz and is still usable at 1 GHz+; it has a very small offset that I thought would be corrected by the controls on the 1142A but it seems that this probe only uses the ±15 volt supply, maybe there's a trimmer pot inside the BNC case? I'll look into that later.  The 1142A power supply is a bit clunky but I can put it way to the right of my test bench and the cable reaches so it's OK really - at least it gives me 0.8 ~ 1 GHz capability for now.

Service mode took about 3 mS to turn on just to try it out but it is now turned off
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on January 29, 2016, 04:27:58 pm

Service mode took about 3 mS to turn on  :)
Congratulations.

I found the Agilent 10073C probes also too big and not the quality that I expected and 4 pieces I had went to be sold on ebay a long time ago.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on January 31, 2016, 12:38:19 pm

Service mode took about 3 mS to turn on  :)
Congratulations.

I found the Agilent 10073C probes also too big and not the quality that I expected and 4 pieces I had went to be sold on ebay a long time ago.

You should see the size of the N2890A's Keysight ship with the x3000A >=350MHz, they're even bigger and heavier! I switched to the lightweight 1165As that I also have on the 7104B. The 1165A also have thin, flexible and lightweight leads making the logistics of probing that much easier.

Ergonomically, this is where Tek seem to have some ground, the TPP0250/0500/1000 series probes for example that ship with the MDO3000 are small and lightweight, and only have a 3.9pF load which is unsurpassed for a Hi-Z passive probe as far as I know. The downside of the Tek probes is that they only work with compatible Tek scopes, which perform compensation inside the scope, not on the probe.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on February 02, 2016, 01:53:07 am
I did a few more tests today with the 10073C probes and found they are not as bad as I thought - I was falling into the long ground wire trap - still getting used to having a 1GHz scope.  I got a small black tip with ground spring accessory and used that to connect to my signal generator, the probe did OK out to 500 MHz where the voltage was falling off but the signal was still good - about ½ voltage (-3dB?) so I will keep a couple at least.

Today the used 1156A arrived, it looks perfect and has every accessory including the little plastic vial of tips but, when I plug it into the MSO7104B, it says "Unsupported probe attached to channel 1".  I've done some online research to answer the obvious question - is it really supported?

1. Is the 1156A supported by the MSO7104B?  This links (http://cp.literature.agilent.com/litweb/pdf/5968-8153EN.pdf) says "These Infiniium active probes are not supported by InfiniiVision Series scopes – 1152A, 1153A, 1154A, 1155A, 1159A, 1168A, 1169A, N2800A, N2801A, N2802A,
N2803A, N2830A, N2831A and N2832A.." which sort of implies it IS supported.

2. On page 54 of the MSO7000B manual (http://literature.cdn.keysight.com/litweb/pdf/54695-97025.pdf?id=1852824&cc=US&lc=eng) is says that the 1156A is a supported probe.

So it does look like it's supported so I'm thinking of things that could be wrong; one is that the EEPROM has become corrupted and is not responding to the query from the scope.  I wonder if there's a way to issue a command from the scope to interrogate the probe? It might just need reflashing.

I went onto the Keysight web page to explore the option of returning it for repair but, as far as I got, it appears that they want $1,569 to repair it which is insane considering the N2795A Active Probe, 1 GHz is $1,056 on their web site for a new one!  I will try to call them tomorrow to clear this up.

I've designed an FET probe PCB (see picture) based off the poor man's 1 GHZ probe project - I've ordered 10 PCBs (85 x 14 mm)and some components - I included a place for a 3mm white LED that will shine on the PCB under test.  Worst case, my 1156A probe will be dismantled to look into the Autoprobe interface and see if I can make it give me the supply voltages I need. 

It would be nice to have a 3D printer to print some cool cases for this probe.

I also have been researching some of the newer Op Amps with the idea of making a differential probe with reasonable offset capabilities like the 1130A which is $4,001
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on February 02, 2016, 12:12:28 pm
Today the used 1156A arrived, it looks perfect and has every accessory including the little plastic vial of tips but, when I plug it into the MSO7104B, it says "Unsupported probe attached to channel 1".  I've done some online research to answer the obvious question - is it really supported?

1. Is the 1156A supported by the MSO7104B?  This links (http://cp.literature.agilent.com/litweb/pdf/5968-8153EN.pdf) says "These Infiniium active probes are not supported by InfiniiVision Series scopes – 1152A, 1153A, 1154A, 1155A, 1159A, 1168A, 1169A, N2800A, N2801A, N2802A,
N2803A, N2830A, N2831A and N2832A.." which sort of implies it IS supported.

2. On page 54 of the MSO7000B manual (http://literature.cdn.keysight.com/litweb/pdf/54695-97025.pdf?id=1852824&cc=US&lc=eng) is says that the 1156A is a supported probe.

So it does look like it's supported so I'm thinking of things that could be wrong; one is that the EEPROM has become corrupted and is not responding to the query from the scope.  I wonder if there's a way to issue a command from the scope to interrogate the probe? It might just need reflashing.

I went onto the Keysight web page to explore the option of returning it for repair but, as far as I got, it appears that they want $1,569 to repair it which is insane considering the N2795A Active Probe, 1 GHz is $1,056 on their web site for a new one!  I will try to call them tomorrow to clear this up.

Even on the product's web page (http://www.keysight.com/en/pd-1000004221%3Aepsg%3Apro-pn-1156A/active-probe-15-ghz?cc=US&lc=eng) it specifically states:

Description
The Keysight 1156A, 1157A, and 1158A family of active probes offers R & D engineers the performance they need to probe small geometries in hard-to-reach areas on the DUT. These probes were designed specifically for the Infiniium Series, and InfiniiVision 5000, 6000 and 7000 Series 300 MHz - 1 GHz oscilloscopes.


FWIW, I have a pair of 1152As which I use with a 54831D, but they definitely don't work with the 7104B. I believe that the 7000 series have a lite version of the probe interface that doesn't support the power supply requirements of some probes.

I was lucky enough to pick up an 1130A for $75 with the E2676A single ended browser, and a 1131A for ~$250 with the E2675A differential browser on eBay, I think I was around at the right time for those though. The maintenance on these can be shocking, just the 91 ohm resistor tips are about $60 each, so these only come out on special occasions!

Quote
I've designed an FET probe PCB (see picture) based off the poor man's 1 GHZ probe project - I've ordered 10 PCBs (85 x 14 mm)and some components - I included a place for a 3mm white LED that will shine on the PCB under test.  Worst case, my 1156A probe will be dismantled to look into the Autoprobe interface and see if I can make it give me the supply voltages I need. 

It would be nice to have a 3D printer to print some cool cases for this probe.

I also have been researching some of the newer Op Amps with the idea of making a differential probe with reasonable offset capabilities like the 1130A which is $4,001

I'm sure there's interest in something like this that's easily built. I did a board based on that design myself a few months ago but I wasn't too impressed with my initial results, mostly down to the physical ergonomics of my probe in particular the probe tips where I used spring probes: the inflexibility of it means it's sitting in a box with other similar homebrew probes.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on February 02, 2016, 01:58:38 pm
Even on the product's web page (http://www.keysight.com/en/pd-1000004221%3Aepsg%3Apro-pn-1156A/active-probe-15-ghz?cc=US&lc=eng) it specifically states:

Description
The Keysight 1156A, 1157A, and 1158A family of active probes offers R & D engineers the performance they need to probe small geometries in hard-to-reach areas on the DUT. These probes were designed specifically for the Infiniium Series, and InfiniiVision 5000, 6000 and 7000 Series 300 MHz - 1 GHz oscilloscopes.


FWIW, I have a pair of 1152As which I use with a 54831D, but they definitely don't work with the 7104B. I believe that the 7000 series have a lite version of the probe interface that doesn't support the power supply requirements of some probes.
Wow, so you are saying definitively that the 1156A does not work with the MSO7104B! That really sucks, I will contact Keysight today and complain.

I have tried to adopt good practices on the FET Probe design but the boards were only $3 each (+ postage) and the major components are samples so it's worth a try.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Keysight DanielBogdanoff on February 02, 2016, 09:02:39 pm
Hi,

I contacted the oscilloscope support team yesterday about this, and here's what they have to say:

"
In the InfiniiVision Oscilloscope Probes and Accessories datasheet, bottom of page 4, it states that 1152A (among some others) is not supported by InfiniiVision.
http://literature.cdn.keysight.com/litweb/pdf/5968-8153EN.pdf (http://literature.cdn.keysight.com/litweb/pdf/5968-8153EN.pdf)
"

I believe the 1156A should work, so I'm following up on that with them. 

Regarding the "Autoprobe" interface, the 7000 has the full "Autoprobe" and not "Autoprobe lite."  The only difference between the two is the amount of power you can draw with the probes.  It boils down to being able to use 4 active probes instead of 2 on the lite version. 

The InfiniiVision scopes don't have the "precision BNC" interface, so none of the Infiniium probes with the "precision BNC" connection will be compatible.  You'll end up breaking the scope's input BNC.

I'll follow up on the 1156A.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on February 02, 2016, 10:39:16 pm
Even on the product's web page (http://www.keysight.com/en/pd-1000004221%3Aepsg%3Apro-pn-1156A/active-probe-15-ghz?cc=US&lc=eng) it specifically states:

Description
The Keysight 1156A, 1157A, and 1158A family of active probes offers R & D engineers the performance they need to probe small geometries in hard-to-reach areas on the DUT. These probes were designed specifically for the Infiniium Series, and InfiniiVision 5000, 6000 and 7000 Series 300 MHz - 1 GHz oscilloscopes.


FWIW, I have a pair of 1152As which I use with a 54831D, but they definitely don't work with the 7104B. I believe that the 7000 series have a lite version of the probe interface that doesn't support the power supply requirements of some probes.
Wow, so you are saying definitively that the 1156A does not work with the MSO7104B! That really sucks, I will contact Keysight today and complain.

I have tried to adopt good practices on the FET Probe design but the boards were only $3 each (+ postage) and the major components are samples so it's worth a try.

Pretty sure Daniel has covered this now, but I was referring to 1152A, not 1156A which you have for the avoidance of doubt.

One note of caution regarding building your own probes: before you know it you'll become a rise time nut (https://www.eevblog.com/forum/testgear/show-us-your-square-wave/).
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on February 03, 2016, 01:04:33 am
Howard, I now see that your second statement about compatibility refers to the 1152A so maybe the 1156A is compatible.  Daniel is checking so we'll get the official word soon.

I called up Keysight today and they had me update all the firmware which I did.  What was odd was that the 1156A was then recognized but not consistently and usually not at all on Ch1.  When it was plugged in and recognized, it was stuck at a permanent high so the representative thought the probe was probably bad - we then discussed return and repair of the 1156A for the 'bargain' price of $1,569 - I pointed out that this was absurd as the current Keysight page on the 1156A links to the N2795A as the recommended replacement, an active 1 GHz probe that lists at $1,056.

He then said they would see what they could do for a more reasonable repair price and get back with me tomorrow. Sigh
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on February 04, 2016, 11:35:14 am
Well Keysight came back and confirmed that the 1156A is compatible with the MSO700B series scopes but they didn't improve on the quoted price of $1,569 to repair my apparently broken 1156A probe. The price of a new N2795A 1 GHz active probe - one of their recommended replacements - is $1,056 on their website it seems they are effectively not supporting their recent products.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Keysight DanielBogdanoff on February 04, 2016, 03:58:56 pm
Hi,

Sorry for the delay.  I had a response composed yesterday and apparently didn't hit send :( .   Repairs can sometimes be expensive for these things.  I'll explore some other options for you, PM sent.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on February 06, 2016, 01:26:17 pm
Well, I'm getting used to my new MSO7104B.  The best probe so far is the old HP 1144A that I got for $100 but it needed a 1142A PSU which I got for $70, all on eBay - the 1144A actually goes up past 1 GHz.  One gripe is that, although the 1144A is claimed as a compatible probe for the MSO7104B, the scope sets the input impedance to 1 Meg when it should be 50 Ohms - it does switch the ratio to 10:1 and I can set it to 50 ohms manually after I've plugged in. 

The US patent on Autoprobe (https://www.eevblog.com/forum/projects/agilent-probe-interface-(-autoprobe-and-probe-id)/?action=dlattach;attach=137885) indicates that the value of the ID resistor (I measured 10.76 k) would set the scope up as it does (see Table II on page 10) but that changing the ID resistor to 14.7 k would make the scope set 10:1 and 50 ohms; I will probably open it up and change the resistor value.

Autoprobe seems badly implemented for a company of the likes of Aglient / Keysight.  I think I'll start another thread on Autoprobe and dig deeper there.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: nctnico on February 06, 2016, 01:29:33 pm
Reading this I start to wonder if the whole autoprobe thing is worth the money&trouble of getting DSO7000 compatible probes.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on February 07, 2016, 01:04:14 pm
My eBay experience so far trying to buy used Agilent probes is that they either they don't work or, even if they do, the Autoprobe doesn't recognize them properly.  Also, the cost of Agilent probes both new and used seems exorbitant and the fact that the cost of 'repair' is 150% of the cost of a new one (e.g. 1156A) makes me want to go buy Tektronix probes which appear to be awesome engineering and are available for very reasonable cost on eBay e.g. P6245 1.5 GHz active probe available for around $60.

Ironically, Keysight sells the Agilent N2744A T2A adapter (http://literature.cdn.keysight.com/litweb/pdf/5990-6477EN.pdf?id=1967544) for $491 and they CLAIM it fully supports a whole load of different Tek probes including the P6245.  Annoyingly, the two N2744A T2A probe interface adapters on eBay right now are asking $595 and $650 which are both more than the list price.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on February 07, 2016, 09:10:17 pm
Of the twenty or so Agilent probes I've bought on eBay the only problem with them has been lack of accessories, like ground walking sticks or resistive tips for example. If they're in the eBay picture, unless it states otherwise you are due those parts. But of four active probes (as well as all the passives) I've purchased, all have worked as expected.

I think you've been unlucky, but if the ad states, for example, that the seller couldn't test the probe, then particularly if it's active, all bets are off.

Some things it might be worth a punt on. I bought a 20GHz delay line for an HP sampling scope quite recently, the seller said they couldn't test it, but as all that's in there is a length of transmission line (admittedly made on the thighs of virgin unicorns if the original new selling price is anything to go by) I thought I'd take a punt, and it proved to be fine.

Or maybe I've been lucky of course, but my previous experience of life doesn't refelect that ;-)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on February 08, 2016, 12:38:38 pm
At Gandalf_Sr:

I also think you are kind of unlucky.
I have bought many Agilent probes on ebay and usually they worked perfectly.
Some I have bought broken and fixed them.
Like this current probe here that works perfectly with the 7000 series scope:
https://www.eevblog.com/forum/repair/agilent-1147b-current-probe-%282013%29-repair-need-advise/msg748761/#msg748761 (https://www.eevblog.com/forum/repair/agilent-1147b-current-probe-%282013%29-repair-need-advise/msg748761/#msg748761)

I also bought an active probe, the N2795A
Perfect condition in original holster and a very low price
Here are some pictures:

 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on February 08, 2016, 09:19:43 pm
Well, it seems my luck has changed :D  I bought another 'untested' 1156A from eBay for $125 (I know, I'm a chancer) and I kept quiet about it, not wishing to push my luck.

Anyway, it arrived, and at first it didn't seem to work - the scope said it was unsupported - twice! And then it was recognized but the output was stuck at -15 volts :(  I was about to pull it from the scope in disgust and in doing so, I wiggled the probe to scope connector and the trace went to zero, then I was able to run cal which it passed and I can now see the waveform of the test output as expected :D

It looks like the Autoprobe scope interfaces are a bit finicky.

The working 1156A didn't come with any accessories but the dud one had everything so now I can combine the good probe with the accessory set and have a fully working 1156A for about $200 which is not bad.  I've also think I've figured out how to connect my dud probe Autoprobe system to the DIY 1GHz MOSFET probe I'm building - my PCBs haven't got here yet.  Can anyone explain how the offset system works from the patent info posted previously?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Berni on February 09, 2016, 07:28:53 am
I have bought some HP 1152A 2.5GHz active probes and out of all 4 there was one that is broken. But it is broken in a very subtle way.

If you put the probe on the good ol front panel probe compensation signal it looks fine, but when i was looking at a PRBS digital signal it seamed to jitter all over the place while it looked fine when using another 1152A. I tried fiddling with pots on it but those only seam to set DC levels and such. The response on quick sharp transitions kinda looks like a passive probe with its compensation out of wack, but here it only shows up on very fast signals. The seller likely had no idea it was broken since it works fine at low frequency.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on February 09, 2016, 10:18:56 am
I have bought some HP 1152A 2.5GHz active probes

Hi Berni, What scope are you using your 1152A probes on?  As long as you didn't pay too much, 3 out of 4 working is OK for eBay.

I made the eBay seller of my working 1156A an offer to buy another one (there are 3 left) at the same price and they turned me down - then sent me a message saying they had done me a favor with the first one as I was a first time buyer. Hmmm, given they are saying it's for parts or not working and returns are not allowed then they can't expect to get working quality prices - eBay is a crap shoot.  I haven't tested my 1156A at 1 GHz yet, I will do that today.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Berni on February 09, 2016, 01:48:06 pm
I use those probes on a DSO9204H (That turned itself in to a MSO9404A pretty much) and i love them. But these probes will NOT work on 5000/6000/7000 series scopes(Says unsupported probe and refuses to use it when i tried to plug one in to my MSO6034A) so careful when buying!

A active probe that i got to work on my 6000 series scopes is a Agilent 1134A  InfiniiMax7GHz differential probe since all probes that have the word "InfiniiMax" in the name should work with these scopes. That probe was bought as broken with its case missing but turned out to actually work. A working one runs very expensive on ebay.

However it is possible to make the abundant 1152A probes work on a 6000 scope if you create an adapter that provides external power to the smart probe interface pins as the reason that they don't work is due to the 6000 scopes not being capable of providing enough voltage to them from what i hear. It might be possible to run the probe undervolted or add a boost converter inside the connector as there is a lot of empty space inside. However if you do that you still need to change the EEPROM contents to make it think its a probe it can support.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on February 09, 2016, 05:54:04 pm
Berni, Interesting stuff.  Daniel from Keysight who lurks here has stated that the 7000 series has a 'real' Autoprobe interface, not a 'lite' one.  It's possible that the 1152As could work with the IntelliVision series and that all that's stopping that from happening is that Keysight won't tweak their firmware to make it so?
I find it ironic that Keysight sells a $491 N2744A T2A adapter that supports a bunch of Tektronix probes; apparently, when you plug in the N2744A, it comes up with a menu of Tektronix probes and asks you to pick which one you're using with the adapter - they can build that into the scope but not support for many existing Agilent probes.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Keysight DanielBogdanoff on February 09, 2016, 06:43:35 pm
Obligatory disclaimer:
Keysight doesn't support modifying, hacking, etc. any firmware or hardware.  Any mods/hacks void warranty and may be illegal.  I'm not a lawyer or saying you should do any of the following.

I played around with an 1152A + 7000B this morning.  The middle pin of the probe (5th one in) is what sets the channel attenuation and impedance.  It pulls out or can be taped over.  By pulling the pin out with some needle nose pliers, I was able to use the 1152A with the 7000B.  I didn't characterize bandwidth performance or anything that rigorous, but I was able to see the expected square wave on the screen.

P.S. of course we lurk a thread titled "anyone hacked these scopes?"  :)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: TheSteve on February 09, 2016, 07:49:59 pm
P.S. of course we lurk a thread titled "anyone hacked these scopes?"  :)

Sheesh, you'd think you guys could figure out how to hack your own scopes without our help  >:D >:D >:D
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on February 09, 2016, 07:54:28 pm
I played around with an 1152A + 7000B this morning.  The middle pin of the probe (5th one in) is what sets the channel attenuation and impedance.  It pulls out or can be taped over.  By pulling the pin out with some needle nose pliers, I was able to use the 1152A with the 7000B.  I didn't characterize bandwidth performance or anything that rigorous, but I was able to see the expected square wave on the screen.
What a nice support that is, Thank you!
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Keysight DanielBogdanoff on February 09, 2016, 11:52:51 pm
P.S. of course we lurk a thread titled "anyone hacked these scopes?"  :)

Sheesh, you'd think you guys could figure out how to hack your own scopes without our help  >:D >:D >:D

Yeah, I'm really looking forward to getting free software options!
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on February 10, 2016, 12:39:36 am
Obligatory disclaimer:
Keysight doesn't support modifying, hacking, etc. any firmware or hardware.  Any mods/hacks void warranty and may be illegal.  I'm not a lawyer or saying you should do any of the following.

I played around with an 1152A + 7000B this morning.  The middle pin of the probe (5th one in) is what sets the channel attenuation and impedance.  It pulls out or can be taped over.  By pulling the pin out with some needle nose pliers, I was able to use the 1152A with the 7000B.  I didn't characterize bandwidth performance or anything that rigorous, but I was able to see the expected square wave on the screen.

P.S. of course we lurk a thread titled "anyone hacked these scopes?"  :)
Daniel, By isolating the ID resistor, you stopped the Autoprobe interface doing the I2C data interrogation of the probe.  So you getting the waveform implies that I was right and that the 1152A can work with the 7000 series - so why isn't it supported in the firmware?  And did you see my earlier post about my 1144A probe which is listed as supported but sets the input impedance to 1 Meg when it should be 50 Ohms?  Can't you get the folks at Keysight to do some improvements on the 7000's Autoprobe interface?  It sure seems like there's room for improvement.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on February 10, 2016, 01:20:46 am
I am thinking that any further development on the 6000/7000 is going to be limited, they've probably not long on the shelves.

Well, I was about to turn in after an 18 hour day, glass of wine poured, and read Daniel's note about the 1152A, so I _had_ to try it.

In the meantime, here's an 1152A on a 7104B with a sliver of Kapton tape over the middle pin probing a 54121A TDR output (measured at <33ps rise time). Those brave enough might consider hacking the probe to make it a 50 ohm 10x with the appropriate resistor.

(http://i34.photobucket.com/albums/d123/photobucket391/scope_0_zpsieyv4lyp.png) (http://s34.photobucket.com/user/photobucket391/media/scope_0_zpsieyv4lyp.png.html)

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Keysight DanielBogdanoff on February 10, 2016, 05:09:49 am
I am thinking that any further development on the 6000/7000 is going to be limited, they've probably not long on the shelves.

This is more or less correct, it's an old (to us) scope, and we focus development on our newer products.  If someone were to find a critical bug, we'd definitely consider revisiting the firmware.  But, it's a discontinued probe (from the HP days, even). 

I don't know the details of why this probe wasn't included, it's very possible that there's a use case that overloads the autoprobe interface.  I'm 100% certain that compatibility with this probe & scope was considered, but ultimately not included.  I don't know why it ended up this way, but I do know our process here and have a lot of faith in the right decisions being made.  I wouldn't necessarily want to run 4 of these on a signal that pushes the bandwidth and voltage limits of the probe, but it might work fine.  :-//  :-BROKE (emoji seems appropriate here)

That being said, the spirit of this blog is pushing the boundaries of equipment, etc. So, I'm willing to post things like this knowing that you all accept the inherent risk of this type of thing.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 10, 2016, 08:49:52 am
I'd hope that the probe power supply is sufficiently protected that the worst that would happen is it would cut out or brown out if overloaded rather than letting any smoke out.....
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Berni on February 10, 2016, 09:21:34 am
When i get home il try the trick with the 6000 and try to measure what voltages are present on the pins versus plugging it in to the 9000 as well as check the performance of it between the two.

If anyone thinks there is a particular thing i should check in the tests bring it up.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on February 10, 2016, 10:01:35 am
I have looked at the PCB in the Autoprobe (scope) end of my dud 1156A and know which resistor to change - the one that's in there is 46.4k which is the value that, according to US patent on Autoprobe (https://www.eevblog.com/forum/projects/agilent-probe-interface-(-autoprobe-and-probe-id)/?action=dlattach;attach=137885), tells the scope to talk digitally to the probe via I2C. Although I haven't seen the PCB from inside the 1152A, I'd bet a pint or 3 that it's the same PCB because the one in my dud 1156A has components missing e.g. U4 on the bottom side - as an electronics designer, I'd take the same approach, have a single PCB that can be used in multiple products.  Anyway, Table II under column 6 in the patent gives values for the ID resistor that allow you to chose input ratio, impedance, and whether or not offset is used.

The bit I don't fully understand is the offset system - I can see that the scope has the ability to adjust for a volt offset (I think) but is it done during calibration and, if so, where is the calibration stored?  When I power down my 7104B with the 1156A (good one) plugged in and calibrated, it comes back up as calibrated when I power up; remove the probe for 2 seconds and plug it back in and I think it needs recalibrating.

To make the scope work with the 1152A, option 1 would be to swap the ID resistor on the PCB but option 2 would be to decipher the contents of the serial EEPROM that's on the board and then rewrite it to fool the scope into thinking that the 1152A is a different supported probe.  Of course Daniel's right that there are probably reasons why the 1152A was not supported - call me cynical but maybe one was that Agilent wanted to sell more probes?

If you want to go look, I did a tear down thread on the dud 1156A (https://www.eevblog.com/forum/testgear/agilent-1156a-teardown/), it turns out that there were broken (blown?) wire bonds on the dead bug IC in the business end of the probe; my pictures also show the PCB in question.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: hs3 on February 10, 2016, 11:51:24 am
Was the 1152A already a few generations old when the 7000B scopes were introduced? Maybe already discontinued? Maybe they didn't have the parts to make new probes or fix old ones at the time anymore or were running out of existing stock and were not planning to get more. If they would have added support for the probe then it would have created more demand for these probes and getting damaged probes fixed too. But if they didn't have parts for repairing these probes anymore then it would have lead to more disappointed customers when their probe couldn't be fixed. Maybe a bit similar situation to the 1156A probe mentioned here.

Anyway just one though of a slightly different angle to the reasons they might have had. And I'm sure the idea of then selling more new probes doesn't hurt in the decision process either. ;)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on February 10, 2016, 12:35:23 pm
HS3, Your suggestions are all possibilities but, given that Autoprobe was already an established standard, wouldn't Agilent want to sell a scope that supported expensive probes that were already out there in large quantities?  Heck, the reason that they made and sold (still sell) the N2744A T2A adapter was so that people who owned Tektronix active probes would be able to buy the 7000B and still use the non-Agilent probes they had paid good money for.

I accept that, now the 7000B is no longer current, this gets to be an exercise in futility - the one I bought from the eBay Keysight store is an Agilent MSO7104B with a little 'Keysight' sticker stuck on the front.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Berni on February 12, 2016, 07:49:15 am
I did some testing on a HP 1152A (Or might have been the Agilent branded one) and here is what i found.

The tape over the middle pin does indeed make it work on my MSO6034A, Just have to manually select 50Ohm and 10:1 mode and off you go. So what is the difference? Turns out that when plugging it in to a DSO9000 makes use of another pin that signals the scope to raise the low voltage supply to +/- 4V while the 6000 series scope appears to be missing this circuitry as that pin is floating, as a result it always supplies +/- 3V on that rail resulting in the probe running on a lower voltage than it was designed for.

So how does this affect the probes performance? I simulated this by covering both the center pin and the pin that signals it it what supply voltage to use on the DSO9000 and did some tests.  Turns out that the 2.5GHz bandwidth of the probe is still there (Not that it matters as those scopes dont go this high) but there is a difference in the probes THD performance at high input voltages. When the probe is running in 'compatibility mode' it slightly distorts signals larger than 12Vpp centered around zero. Also the DC offset feature of the probe is unavailable where the scope feeds back in to the probe a offset voltage that lets the probe look at signals that ride on large DC levels like 20V. :-+

So was Agilent trying to force us in to buying new probes? Looks like no. Its just that the lower end scopes had a cost cutting measure to simplify the circuitry of the autoprobe interface because most likely all the modern probes did not need the low voltage rail to be anything other than 3V.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: hs3 on February 12, 2016, 08:39:24 am
Ah yes that is indeed one difference. I remember noticing myself that the 1152A asks for 4V supply unlike some other probes that ask for 3V. I remember the 3000 series and probably? other similar newer series scopes only supported 3V. But I thought someone mentioned earlier that the 7000 series should have "full" Autoprobe interface and based on that I thought it would have supported these variable voltages. But I guess the definition of "full" interface might not be so clear.

But if the 7000 series scopes are only able to supply 3V then it's of course clear why probes like 1152A are not supported.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Keysight DanielBogdanoff on February 12, 2016, 07:00:47 pm
But I thought someone mentioned earlier that the 7000 series should have "full" Autoprobe interface and based on that I thought it would have supported these variable voltages. But I guess the definition of "full" interface might not be so clear.

So, I did a little digging.  The autoprobe interface can be different for different lines (Infiniium vs InfiniiVision) and for different models (i.e. what year was that scope released?).

So, the 7000s have the "full" autoprobe (aka not "autoprobe lite"), but it isn't necessarily the exact same hardware as other scopes with the autoprobe interface.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: hs3 on February 12, 2016, 07:21:13 pm
I wonder what the main difference between AutoProbe and AutoProbe lite is then? I always thought one significant difference would have been the lack of support for these variable voltages in the lite version. But I admit I have never looked into it closely.

Hmm, I just now decided to have a look if I could find some information about AutoProbe Lite. I found these documents that suggest that the 7000 series might actually have the Lite version?

http://www.alliedelec.com/catalog/catalogpages/201112/1636.pdf (http://www.alliedelec.com/catalog/catalogpages/201112/1636.pdf)
http://www.tevetllc.com/downloads/5989-7650EN.pdf (http://www.tevetllc.com/downloads/5989-7650EN.pdf)
http://www.testequity.com/documents/pdf/scope-family.pdf (http://www.testequity.com/documents/pdf/scope-family.pdf)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Keysight DanielBogdanoff on February 12, 2016, 07:29:55 pm
I wonder what the main difference between AutoProbe and AutoProbe lite is then?

Generally speaking, AutoProbe Lite supports two active probes, AutoProbe supports four. 

This is the general guidance, but it's more of a probe current-draw limitation. 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on February 13, 2016, 09:54:26 am
hs3's last link (p35) says that 7000B is Autoprobe Lite.  Daniel is saying that this is really just a current limitation so we think that the 1152A works but you couldn't have more than 2 of them.  There's an 1152A oneBay right now but the gold tip pin is slightly bent, is this a replaceable item?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on February 13, 2016, 10:25:09 am
There's an 1152A oneBay right now but the gold tip pin is slightly bent, is this a replaceable item?

Yes, there is a Wiha nut driver tool that comes with the full probe kit labelled 265 3/32". You can remove the tip with a pair of pliers if you're desperate.

I also have about 20 spare tips, more than I anticipate ever needing, so if you need one or two I'll be happy to mail them to you.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on February 13, 2016, 01:44:22 pm
I just tried adjusting the autoprobe resistor on two 1152A probes from 56.2k to 14.7k (for x10, 50 ohm) by putting a 20k in parallel with the existing 56.2k, and it seems to work nicely in terms of attenuation accuracy (I measured around 0.5% DC accuracy with a 34401A).

The offset seems to depend on the scope you're using not just the probe itself. For the vast majority of probing I do, the offset is fine on a 54831D (that detects an 1152A out of the box) and MSO7104B. I wouldn't bother using it on an MSOX3054A, a 400mV offset is going to confuse things.

Offsets:
Scope      Probe 1   Probe 2
54831D      -17mV   -31mV
MSO7104B      +29mV   +12mV
MSOX3054A   +370mV   +410mV

The peak DC voltages before saturation or, for negative voltages, overload protection kicks in, are below:

Min/MaxV:
Scope      Min      Max
54831D      -13.5V   +12.5V
MSO7104B      -10.5V   +15.7V

Open up the 'scope end of the probe lead by gently prising the four visible plastic clip points one at a time, while separating the upper and lower parts of the enclosure as appropriate. It takes a little while to get the knack, and those clips are asking to be broken (if they're not already).

Then put an 0805 20k 1% resistor on top of the existing 56.2k resistor... see pictures.

Before...
(http://i34.photobucket.com/albums/d123/photobucket391/d8ff6a9f-3662-41cb-b8f8-83c7d3a8a66c_zpsd1961ym7.jpg) (http://s34.photobucket.com/user/photobucket391/media/d8ff6a9f-3662-41cb-b8f8-83c7d3a8a66c_zpsd1961ym7.jpg.html)

After...
(http://i34.photobucket.com/albums/d123/photobucket391/993bdfa7-1079-402c-aec9-0dc95db0d962_zpscqh1ecdj.jpg) (http://s34.photobucket.com/user/photobucket391/media/993bdfa7-1079-402c-aec9-0dc95db0d962_zpscqh1ecdj.jpg.html)

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on February 13, 2016, 05:20:25 pm
Sweeet!  So is it now recognized by the MSO7104B? Or what's the deal?  If I buy / win the 1152A I'll take you up on the offer of the spare tip.

I built the first of my 1 GHz FET probes today (I ordered 10 boards) and ran it up alongside the 1156A.  I set up my E4433B to produce a 32 step sweep from 50 MHz to 1.2 GHz all at -10 dBm and the result is below.  The 1156A was calibrated but I haven't tried to calibrate the home brew probe yet - can you do manula cal on the 7000 series?

Those amplitude changes look like variations in the output level of the E4433B as it steps through all that internal magic, what's really interesting is that the home brew probes matches the shape and amplitude changes almost perfectly.  It's also nice to have a 1 GHz scope that really goes up to and past 1 GHz

[Edit] The top pink trace is the home brew probe, the bottom blue trace is the 1156A
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on February 13, 2016, 06:32:14 pm
Sweeet!  So is it now recognized by the MSO7104B? Or what's the deal?  If I buy / win the 1152A I'll take you up on the offer of the spare tip.


It is recognised in so much as it's a generic 10x 50 ohm probe. The 54831D allowed me to calibrate the probe's offset and gain when it was recognised as a proper 1152A and now, but I've never bothered to use the facility as the probes were good enough for my purposes out of the box. The 7104B doesn't appear to have a probe cal option but I didn't look very hard. Again, for my purposes there's not really any practical need, but YMMV.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on February 13, 2016, 09:14:10 pm
The 54831D allowed me to calibrate the [1152A] probe's offset and gain when it was recognised as a proper 1152A and now, but I've never bothered to use the facility as the probes were good enough for my purposes out of the box. The 7104B doesn't appear to have a probe cal option but I didn't look very hard. Again, for my purposes there's not really any practical need, but YMMV.
My MSO7104B offers to calibrate my 1156A, I wonder where the results of that cal are stored.  It wouldn't really make sense for the scope to store it internally - or would it?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 14, 2016, 01:14:52 am
The 54831D allowed me to calibrate the [1152A] probe's offset and gain when it was recognised as a proper 1152A and now, but I've never bothered to use the facility as the probes were good enough for my purposes out of the box. The 7104B doesn't appear to have a probe cal option but I didn't look very hard. Again, for my purposes there's not really any practical need, but YMMV.
My MSO7104B offers to calibrate my 1156A, I wonder where the results of that cal are stored.  It wouldn't really make sense for the scope to store it internally - or would it?
Why not? - it could store the probe serial no. to associate the cal data with the probe. If you have multiple scopes and multiple probes, why would the probe store scope-specific data? (Assuming the cal is for the combination of scope and probe)
 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on February 14, 2016, 08:18:20 am
The 54831D allowed me to calibrate the [1152A] probe's offset and gain when it was recognised as a proper 1152A and now, but I've never bothered to use the facility as the probes were good enough for my purposes out of the box. The 7104B doesn't appear to have a probe cal option but I didn't look very hard. Again, for my purposes there's not really any practical need, but YMMV.
My MSO7104B offers to calibrate my 1156A, I wonder where the results of that cal are stored.  It wouldn't really make sense for the scope to store it internally - or would it?
Why not? - it could store the probe serial no. to associate the cal data with the probe. If you have multiple scopes and multiple probes, why would the probe store scope-specific data? (Assuming the cal is for the combination of scope and probe)

The 1152A is recognised only by the 56.2k probe readout resistor, there's no communication of a serial number I'm afraid. These probes are based on the 54701A probe that used an separate external 1143A power supply to offset instead of the integrated connector method of the 1152A. The only active device in the integrated connector is a Linear Tech 8 pin SOIC device, I assume an op amp of some sort.

The Calibrate Probe option is greyed out with the 10x 50 ohm 14.7k readout (56.2k // 20.0k) on the 7104B. When I plug in an 1130A, that option is avaialable. Again, I've never felt the need to do a probe cal on these probes for my purposes (unlike passive Hi-Z probes), any gain or offset aberration present hasn't been significant in my use cases, but I could see how it might be for low voltage analogue stuff.

 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on February 15, 2016, 10:39:52 am
I made a low ($135) offer on an 1152A that had all the accessories but the seller responded with $200 as a counteroffer which I declined.  I then offered $130 each for two 1156As (no accessories but I have a full set) from the same company I got my first one from and who'd refused my second $125 offer; since that refusal, their asking price had come down from $200 to $140.  They claim that the probes were taken from working equipment but say they're for "parts or not working" and don't accept returns.  Anyway, they just accepted that offer so I have 2 more 1156As on the way but no 1152A.  If I end up with 3 working 1156As I think I'll stop looking so proactively for voltage probes and maybe sell either one 1156A or the 1144A with the 1142A power supply. A current probe will probably be the next thing on my list and I have an Elektor circuit for a differential probe that's good for 2 GHz but has a 4.6 k input impedance.

Messed with the BF998 FET home brew probe some more, I found that covering the probe in heatshrink made the DC level wobble up and down around 5 mV, there is similar wobble on the 1156A too but not quite so much, maybe 1 or 2 mV.  I took the heatshrink off around the input end - which includes a 0.5 pF capacitor formed by plates either side of the PCB and it got better, maybe a can screening the input cct would help as is done on the 1156A. I also wonder how the probe would perform with a straight 0.5 pF capacitor - why use a PCB cap? The 1156A probe interface that I hooked my FET probe to sets the scope for DC input but the FET probe has capacitive coupling so can only do AC - maybe it would be better without the Autoprobe end although picking up power from the scope is neat.  My LED illuminator works but it's annoying, I think I'll make it so it's only on when the user presses a button.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on February 15, 2016, 05:40:45 pm
If a probe doesn't offer autoprobe I'd be a little less inclined to use it, although it's hardly much of a chore. putting that 20k resistor in makes no difference to my existing use of the probes on the 52831D and allows their use on the 7104B.

What I'm missing on the 1152A's is a walking stick ground. I am sure that given enough thought I could jury rig something. At present I make do with the coax tip adapters, they work well electrically but logistically it's hardly perfect.

It might also be possible to make your own autoprobe by appropriately epoxying a spring probe to the side of a BNC.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Berni on February 15, 2016, 05:53:32 pm
If a probe doesn't offer autoprobe I'd be a little less inclined to use it, although it's hardly much of a chore. putting that 20k resistor in makes no difference to my existing use of the probes on the 52831D and allows their use on the 7104B.

What I'm missing on the 1152A's is a walking stick ground. I am sure that given enough thought I could jury rig something. At present I make do with the coax tip adapters, they work well electrically but logistically it's hardly perfect.

It might also be possible to make your own autoprobe by appropriately epoxying a spring probe to the side of a BNC.

You don't really need a super short ground clip with these probes anymore due to the tiny tip capacitance. I found that using crocodile ground clips for passive probes work pretty well with the 1152A. The clip slides over the exposed metal tip just fine and gives you a very clean looking signal. For critical high speed stuff i still use the proper ground spring but it does not really make that much of a difference (It makes a massive difference with passive probes tho)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: knotlogic on February 16, 2016, 06:48:03 am
So I've recently become the happy owner of a slightly "pre-loved" DSO5054.  ;D  Only thing is it came with a set of 100 MHz probes, which don't have a matching compensation range for the scope.  :-//

So I now need some probes....

Any suggestions as to what I should look out for?  I was going to look at passive ones, for reasons of cost and actual use, but from what I read two pages back the 10073C probes disappoint.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Berni on February 16, 2016, 10:01:29 am
Around probes there is no such thing as the best probe. Its more about what sort of probe you want. Most proper probes perform pretty close to each other, some might just have slightly less capacitance at the tip.

As for active probes they are not a every day use probe. Most of the time you will want to use a nice robust passive probe. But when you find a sensitive high speed signal you really want to have one active probe laying around. If you wish to look at signal integrity of 50MHz and above digital signals a active probe is a must due to the tip capacitance of regular passive probes being way too high and so causing rounded edges or ringing on the signal. Any sort of rise time measurement in the ns range requires a active probe to be accurate.

But my favorite excuse for using active probes is that having a long ground clip does not mess up the signal since getting a reliable short ground is always a pain in the ass.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on February 16, 2016, 01:37:01 pm
I have 4 10073C 500 MHz 10:1 passive probes that will self-configure on Autoprobe.  I originally gave them a poor rating regarding frequency range but later found they were OK at 300 MHz and still usable but dropping off at 500 MHz as long as I kept the ground lead short.
I also have an HP 1144A FET active probe (good for 800 MHz) which is in the original box, mint, with accessories along with an 1142A power supply in great shape - all tested and working.
I have a clean, working 1156A 1.5 GHz active probe with all accessories, 2 more are in the mail that may or may not be serviceable.
I also have 8 spare PCBs for the 'poor man's active FET probe project' - it seems to work pretty well past 1 GHz

I'm thinking of selling two 10073Cs and the 1144A .  PM me if you're interested in any or all.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on February 16, 2016, 02:22:30 pm
So I've recently become the happy owner of a slightly "pre-loved" DSO5054.  ;D  Only thing is it came with a set of 100 MHz probes, which don't have a matching compensation range for the scope.  :-//

So I now need some probes....

Any suggestions as to what I should look out for?  I was going to look at passive ones, for reasons of cost and actual use, but from what I read two pages back the 10073C probes disappoint.

The 10073Cs are OK for a passive Hi-Z probe but I find them physically a bit bulky. I much prefer the lower mass probes like the 1165A if you can find those at a reasonable price. By lower mass and bulk, I mean both the probe and the cable, the 1165A has a very flexible thin cable making them easier to use logistically than your average probe.

I agree with Berni, unlike the passive probes, the FET probes don't come out every day.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: knotlogic on February 17, 2016, 02:32:50 pm
I have 4 10073C 500 MHz 10:1 passive probes that will self-configure on Autoprobe.  I originally gave them a poor rating regarding frequency range but later found they were OK at 300 MHz and still usable but dropping off at 500 MHz as long as I kept the ground lead short.
I also have an HP 1144A FET active probe (good for 800 MHz) which is in the original box, mint, with accessories along with an 1142A power supply in great shape - all tested and working.
I have a clean, working 1156A 1.5 GHz active probe with all accessories, 2 more are in the mail that may or may not be serviceable.
I also have 8 spare PCBs for the 'poor man's active FET probe project' - it seems to work pretty well past 1 GHz

I'm thinking of selling two 10073Cs and the 1144A .  PM me if you're interested in any or all.

Thanks!  Will drop you a PM about it.

Around probes there is no such thing as the best probe. Its more about what sort of probe you want. Most proper probes perform pretty close to each other, some might just have slightly less capacitance at the tip.

As for active probes they are not a every day use probe. Most of the time you will want to use a nice robust passive probe. But when you find a sensitive high speed signal you really want to have one active probe laying around. If you wish to look at signal integrity of 50MHz and above digital signals a active probe is a must due to the tip capacitance of regular passive probes being way too high and so causing rounded edges or ringing on the signal. Any sort of rise time measurement in the ns range requires a active probe to be accurate.

Yes, but the thing is looking at the Keysight website alone as a reference leaves me a little confused.  I saw at least 4 options for passive 10:1 500 MHz probes.  That and my relative lack of experience with probes at this end of the market leaves me wondering what I should be looking for.

Then there is the issue of other manufacturers, assuming that is, that their probes are compatible.

Honestly, I'm thinking that if I'm looking at signals above 300 MHz, I should be putting aside the probes and working with splitters and terminators and more BNC cabling than I like to deal with.  :P
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: knotlogic on February 18, 2016, 03:04:18 pm
OK, so been doing a bit more reading up....

Is anyone familiar with the N2873A and N2843A probes?  (The latter apparently is the same as the N2890A.)  Looking at the datasheets, it seems that the latter has a larger compensation range but that's it.  And would either be suitable for a 5000 series scope?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on February 18, 2016, 03:18:32 pm
For passive probes I've always used Tek P6131's - small & light and very flexible cable.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on February 18, 2016, 06:49:55 pm
OK, so been doing a bit more reading up....

Is anyone familiar with the N2873A and N2843A probes?  (The latter apparently is the same as the N2890A.)  Looking at the datasheets, it seems that the latter has a larger compensation range but that's it.  And would either be suitable for a 5000 series scope?

The N2890A comes with the X3000A 350MHz+ scopes. It's alright but the probe itself is big. Assuming compensation range is OK I am sure it'll work fine. Mine remain in the box, I much prefer the lightweight 1165As. Passive probes is one area that Tek seem to be winning over Agilent, the TPS0250/0500/1000 probes they supply with their MDO3000 are really nice lightweight probes with only 3.9pF loading. The one major downside is that they can only be used with modern Tek scopes as they're dependent on a proprietary compensation schems within the scope itself.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on February 19, 2016, 01:40:31 am
For passive probes I've always used Tek P6131's - small & light and very flexible cable.
Do the Tek P6131s work with the Intellivision scopes?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: knotlogic on February 19, 2016, 10:43:18 am
The N2890A comes with the X3000A 350MHz+ scopes. It's alright but the probe itself is big. Assuming compensation range is OK I am sure it'll work fine. Mine remain in the box, I much prefer the lightweight 1165As.

Thanks.  I hadn't realised the N2890A/N2843A probes were that big.  From the photos I've seen I thought they were the same size as the 1165As.

What kind of prices should I be expecting for 1165As?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Gandalf_Sr on February 19, 2016, 05:33:08 pm
The N2890A comes with the X3000A 350MHz+ scopes. It's alright but the probe itself is big. Assuming compensation range is OK I am sure it'll work fine. Mine remain in the box, I much prefer the lightweight 1165As.

Thanks.  I hadn't realised the N2890A/N2843A probes were that big.  From the photos I've seen I thought they were the same size as the 1165As.

What kind of prices should I be expecting for 1165As?

I've been watching on eBay for a while and I haven't yet seen an 1165A that I thought was reasonable.  If they have all the accessories with them, they are $200 - $250 but you can buy 1156A active probes for that kind of money!

I just got the two 1156As that I got as 'for parts or not working' and they are both good :D Now I have:

Four 10073C 500 MHz passive probes like new
Three 1156A 1.5 GHz active probes and 1 full set of accessories for them
One 1144A active FET probe with case and all accessories (plus the 1142A power supply unit for it)
Ten of my self-designed BF998 FET probes - I've made up 2 of the PCBs so far and I've got a buddy working on a CAD design for a case that I can 3D print.

The Tektronix active and passive probes seem like much better value for money but we need to figure out which ones work and what to do about powering them up.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on April 01, 2016, 08:51:58 pm
I notice the other day thay Keysight are discontinuing the 6000/7000 series on 1 June 2016. Not surprised, they've had a fair run.

In some ways though it's a backwards step in terms of screen resolution and memory depth, the current equivalent models have almost 40% worse screen resolution and half the memory depth. Admittedly some other options and specifications are improved though.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on April 01, 2016, 09:14:35 pm
I notice the other day thay Keysight are discontinuing the 6000/7000 series on 1 June 2016. Not surprised, they've had a fair run.

In some ways though it's a backwards step in terms of screen resolution and memory depth, the current equivalent models have almost 40% worse screen resolution and half the memory depth. Admittedly some other options and specifications are improved though.
I'm surprised it's taken this long. When the 3000 came out I looked to see if there was anything worth upgrading and was disappointed that many specs are worse.

I'm also surprised that over something like 10 years of pretty much daily use the CCFL backlight is still going strong!

I wonder if they'll do what Tek did a few years ago and release a final firmware update to enable all options.
Not that we need it now, but it would be a nice gesture!
 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on April 01, 2016, 09:24:21 pm
I notice the other day thay Keysight are discontinuing the 6000/7000 series on 1 June 2016. Not surprised, they've had a fair run.

In some ways though it's a backwards step in terms of screen resolution and memory depth, the current equivalent models have almost 40% worse screen resolution and half the memory depth. Admittedly some other options and specifications are improved though.
I'm surprised it's taken this long. When the 3000 came out I looked to see if there was anything worth upgrading and was disappointed that many specs are worse.

I'm also surprised that over something like 10 years of pretty much daily use the CCFL backlight is still going strong!

I wonder if they'll do what Tek did a few years ago and release a final firmware update to enable all options.
Not that we need it now, but it would be a nice gesture!

I'm somewhat surprised they didn't send you one, the way you put a 6000 through its paces is one of the best scope demos I've ever seen.

Edit, warning scope nerd porn alert:

https://www.youtube.com/watch?v=9GqfZMcrAFY (https://www.youtube.com/watch?v=9GqfZMcrAFY)

https://www.youtube.com/watch?v=7TedIzmguP0 (https://www.youtube.com/watch?v=7TedIzmguP0)

https://www.youtube.com/watch?v=9ulInr0ldj0 (https://www.youtube.com/watch?v=9ulInr0ldj0)

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: nctnico on April 01, 2016, 09:31:34 pm
I notice the other day thay Keysight are discontinuing the 6000/7000 series on 1 June 2016. Not surprised, they've had a fair run.

In some ways though it's a backwards step in terms of screen resolution and memory depth, the current equivalent models have almost 40% worse screen resolution and half the memory depth. Admittedly some other options and specifications are improved though.
I agree. There is a bit of a void in Keysight's lineup and by today's standards their memory depth is severly lacking especially when taking into account how wildly optimistic the memory depth is (over) specified. I like my 7104A (appearantly I bought it hacked) but I very much would like to have deeper memory.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on April 02, 2016, 03:40:51 pm
I notice the other day thay Keysight are discontinuing the 6000/7000 series on 1 June 2016. Not surprised, they've had a fair run.
Yes, as might be expected. However, these machines are still fully capable these days.

I'm also surprised that over something like 10 years of pretty much daily use the CCFL backlight is still going strong!
I hope that mine also lasts a lot of time.

I wonder if they'll do what Tek did a few years ago and release a final firmware update to enable all options.
Not that we need it now, but it would be a nice gesture!
That would be great.

I'm somewhat surprised they didn't send you one ...
Absolutely, Keysight should do that with one of these new beasts.

... the way you put a 6000 through its paces is one of the best scope demos I've ever seen.
In fact these demos convinced me.  When you see them, you think: Look what you can do with these machines!
Of course, I also had in mind its specifications and price (used one).

... I very much would like to have deeper memory.
Yes, it's the only downside, but when it was designed 8M was a lot.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on April 02, 2016, 05:27:00 pm
Quote
I'm somewhat surprised they didn't send you one ...
Absolutely, Keysight should do that with one of these new beasts.
I already have have a spare MSO6034A, but if they have a 6054 or 6104 lying around I'd happily accept!
Quote
... I very much would like to have deeper memory.
Yes, it's the only downside, but when it was designed 8M was a lot.
Quote
... I very much would like to have deeper memory.
Yes, it's the only downside, but when it was designed 8M was a lot.
I find memory size is very rarely a problem, especially when you understand how to optimise it by selecting the  right permutation of acquire mode, channels and single-shot mode.
 And a lot of the situations where memory is an issue can be dealt with using segmented. 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on April 03, 2016, 11:53:12 am
I already have have a spare MSO6034A, but if they have a 6054 or 6104 lying around I'd happily accept!
I know.  :)
But I was referring to one of those with an X in its name.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: nctnico on April 03, 2016, 04:43:37 pm
... I very much would like to have deeper memory.
Yes, it's the only downside, but when it was designed 8M was a lot.
I find memory size is very rarely a problem, especially when you understand how to optimise it by selecting the  right permutation of acquire mode, channels and single-shot mode.
 And a lot of the situations where memory is an issue can be dealt with using segmented.
[/quote]
Ofcourse you can jump through some hoops and make most of it (only using channel 1 & 3 and use single shot mode) but still more memory makes life easier in general. For example: my first logic analyser (Philips PM-something-) had 2kbit per channel. Ofcourse setting the triggering and samplerate would allow for making most of it but for many measurements you had to take several acquisitiongs with different settings and then piece everything together. Fast forward to today: my fourth logic analyser has 32Mbit per channel. If I need to measure something I just let it trigger on a line starting to wiggle and go from there. It can capture long timespans with a lot of details so nowadays I often take just one acquisition which has all the data and analyse offline.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on April 03, 2016, 04:58:02 pm
My only comment about segmented memory is that it's a bit of a fiddle to set up. My default mode is to just do without, but when I do use it I have to switch down a gear because of the setup, and generally I never get it right first time. It just gets in the way of my workflow a bit, but equally, it's a damn fine answer to "how much deep memory is enough?" because in some very sparse scenarios effectively you have almost unlimited memory.

Given the choice between, say, 4Mpt/ch with segmented memory and 20Mpt/ch without, it's a tough choice because I want it all! I guess in the end, segmented memory realistically gives you more options as long as you have a reasonably repeatable scenario to get your triggering, timebase and segmented memory just right.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on April 03, 2016, 05:23:14 pm
As long as you have  a good trigger, most scenarios that need a lot of memory can be dealt with segmented - you very rarely need all of a large acquisition, only a small part of it. If you can capture all the small parts, not only does that save memory, but also gives additional useful info like the number in a sequence, i.e. you know that a particular burst is the <segnum>'th burst, and how many burst have occurred, which is something that can be  hard to do with a single deep acquisition.

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: barryforever on May 15, 2016, 12:54:02 pm
@Mike : I could not find the version sys6000.bin on Keysight Website could you upload it to some file sharing website so that I could download it.
Another question is I have a Agilent MSO6034A oscilloscope ,I have read that the hack you were talking about would only enable the user to activate all other options except for MSO is it true?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Berni on May 15, 2016, 02:03:53 pm
@Mike : I could not find the version sys6000.bin on Keysight Website could you upload it to some file sharing website so that I could download it.
Another question is I have a Agilent MSO6034A oscilloscope ,I have read that the hack you were talking about would only enable the user to activate all other options except for MSO is it true?

I tweaked the hack to work on the new firmware file since i could not find the old one anywhere.

As for the MSO i wouldn't know since my scope already was MSO before. But i don't see why it wouldn't work since there is a license code for enabling MSO (Comes as part of a MSO upgrade kit that includes MSO probes and a new sticker that says MSO).
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on May 15, 2016, 02:18:33 pm
Certainly on my ex-DSO7000 it miraculously became an MSO7000. You will, of course, need to find the physical LA probes too!
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Samogon on May 17, 2016, 04:25:40 pm
Well, that sucks.  I have an MSO7104A that needs a new mainboard too, but the reason is more subtle: it will not run the self cal due to some sort of digitizer issue.  However, I have not noticed any aberrations during normal operation, so I am sitting on it right now because I can't afford the repair cost of a mainboard swap.  This is the main problem of these monolithic designs; it's not possible to replace the failed part individually since the LRU is the whole damn board.
Hi,
I have the same error on my DSO5054A on ch1
And ch1 and ch2 showing sine 1Ghz and 200V with no imput on them. This error prevent self calibration which prevents using auto set functionality. Did you find anything?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on June 16, 2016, 06:53:20 pm
Can someone here please provide me the older firmware version for the 7000B series
I am looking for the FW file:
"sys7000A.bin 06.16.0001"

It is no longer available on the Keysight website.

Thank you.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on June 16, 2016, 09:10:52 pm
Check out this hack ;D
https://www.youtube.com/watch?v=90IcNcWhcF4 (https://www.youtube.com/watch?v=90IcNcWhcF4)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: plesa on June 16, 2016, 09:15:04 pm
Check out this hack ;D
https://www.youtube.com/watch?v=90IcNcWhcF4 (https://www.youtube.com/watch?v=90IcNcWhcF4)

Best hack of Agilent/Keysight scope ever.
Congratulation!
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on June 16, 2016, 09:45:26 pm
WOW that is a real FW update out of the Enterprise !
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Berni on June 16, 2016, 09:55:24 pm
Dang i need to try that firmware on my MSO6034A. But then again it would ruin then nice quick boot time.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: KE5FX on June 16, 2016, 10:21:34 pm
That's the fabled "HP Way" in action.   :-+  Where HP = Harry Potter.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: berk98 on June 17, 2016, 01:50:07 am
The hack which Mike detailed before (https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg414039/#msg414039) also seems to work with firmware version v6.20.0000, at least on my DSO 6000 scope.  Only difference was the offset where the edit is made.  Same data and all.  In short,

sys6000.bin 6.20.0000:
002E80F8: 94 21 F8 E0 7C 08 02 A6 -> change to -> 38 60 00 00 4E 80 00 20

I think the same is true for the 7000 series, since the magic sequence appears at offset 002E81D8, but I haven't tried it.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: TheSteve on June 22, 2016, 01:39:41 am
Howard, thanks for the detailed probe info, exactly what I needed.  I just bought two 1160A probe sets on eBay which I'm pretty sure are the equivalent early version of the 1165A you recommended - they come in neat zipper pouches with a load of different probe accessories - got them for $80 each.  The guy had them listed on eBay as 10073C, probably because nobody was going to search for '1160A'.  I guess if they don't work, I can return them as technically they are not the advertised item.

I'm still working on the LA probe stuff.

The more I read bout the MSO7104B, the more confident I get that this was a great choice.  I thought I might be having buyers remorse right now but I'm not.  A scope is one of the basic tools I use to make my living and, to date, I've been struggling with a Rigol MSO2202A and had access to a Tektronix MDO3204 but they are both dogs when it comes to I2C / SPI serial bus decode - to the point of being unusable, looks like the MSO7104 is the dogs bollocks in this regard with full speed hardware decode at 100,000 Wf/sec.

I am not certain how well the 1160A will compensate, the difference between the 1160A and the 1165A in terms of compensation range is 6-9pF and 12-14pF respectively, with the scope input spec'd at 14pF.

Also be aware that SPI decoding fails at a clock speed beyond about 35MHz (it's spec'd to 25MHz).

The best thing about the 5000/6000/7000 series is the UI in terms of ease of use and responsiveness. Everything is obvious. In contrast, the UI of the MDO3000 you mentioned isn't any of those things!

I recently purchased four 1161A's for my DSOX3014A, the seller sent me three 1161A's and one 1160A by mistake. The seller sent a replacement 1161A but also told me to keep the 1160A. I really didn't think it would work as its compensation range is listed as 6-9 pF. I gave it a try and it compensated fine on my 3014A which has a specified input capacitance of 14 pF. I wouldn't recommend buying a probe that is not in the range of the scope but perhaps the 1160A's have a larger range then specified.

edit - one other thing I noticed. A full 1160A/1161A kit includes a replacement probe tip. If you swap the tips between probe types it looks to switch the official compensation range.
Also on the DSOX3014A the 1161A is detected as a 10x probe and disables the 50 ohm menu, the 1160A is also detected as a 10X probe but does not disable the 50 ohm termination menu. I don't believe they are officially supported probes on my scope and this thread is for the 5000/6000/7000 but I thought I'd include the info for the sake of completeness.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Neganur on June 22, 2016, 06:18:17 pm
the 1160-series is quite nice, I got a couple 1161A and one 1163A for cheap. I did not imagine them this small and I think they're nicer than the newer 2.5mm probes that come with the 4000X series and above.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: barryforever on July 25, 2016, 08:50:35 am
@berk98

I could not find this key 0x002E80F8 for my Sys6000.bin version 6.20 . Mine is a MSOx6000 series oscilloscope.
Can you find this key under your sys6000.bin.

Has anybody got his one?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Berni on July 25, 2016, 10:59:38 am
@berk98

I could not find this key 0x002E80F8 for my Sys6000.bin version 6.20 . Mine is a MSOx6000 series oscilloscope.
Can you find this key under your sys6000.bin.

Has anybody got his one?

Looks like Keysight was quick to patch that one. Rigol already gave the sales of there x3000 series scopes quite a blow, image what people turning there 6000 to x3000 would do to there sales :-DD
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on July 26, 2016, 08:40:38 am
Is there any known hack for a DSOX6004A with FW 6.10 installed?
Mainly to upgrade the BW to 6 GHz and make a MSO out of the DSO?
Thanks for any feedback.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Berni on July 26, 2016, 10:04:48 am
Is there any known hack for a DSOX6004A with FW 6.10 installed?
Mainly to upgrade the BW to 6 GHz and make a MSO out of the DSO?
Thanks for any feedback.

Considering how rare and new these scopes are there proabobly is none yet. But seeing the software has an awful lot in common with the x3000 the way to do it is likely similar. If you have a X6000 to hand try poking around with the existing X3000 hack methods.

Even the fairly old by now 9000 series had no hack out there, I had to develop one on my own. But from what I saw it poroabobly works on all modern windows based scopes, including the S series that is software upgradable to 8GHz (but I don't have access to one in order to test it out.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: memset on July 26, 2016, 10:31:33 am
Is there any known hack for a DSOX6004A with FW 6.10 installed?
Should be all the same as 3000X-series.
BTW, it's interesting what people think about 6000X vs. DSO-S series.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on July 28, 2016, 07:59:28 pm
OK, I got my DSOX6000A today and tried telnet.
I am getting the login screen the same way as on my 7000 series scope.
But ...
 infiniivision / skywalker1977
does NOT work


Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on July 28, 2016, 08:45:41 pm
There is a different login on the x series - it's mentioned in the 2000/3000X thread somewhere ( but doesn't work on the MSOX30104T)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on August 08, 2016, 10:53:22 pm
With a BIG THANK YOU to memset, I was able to hack my DSOX6004A partially so far.

This DSO-X-6004A had all options installed from the factory, except:
Limited to 1 GHz and no MSO

I don't care too much about the MSO feature, but I really would like to have the 6 GHz activated.
And here is the problem, I am getting it only modified to 2.5 GHz

The procedure is similar to the 3000X series and you can find everything here:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg989301/#msg989301 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg989301/#msg989301)

The file structure is a little different and on the 6000X series, the startup folder is hiding in:
\System\startup

Log in with telnet and then copy the lnk file from USB to this startup folder works well.

Here is a picture of my normal setup (No modification)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on August 08, 2016, 10:56:32 pm
Here is the change to 2.5 GHz and MSO only

infiniivsion_ext.lnk:
64#\System\infiniivision\infiniivisionlauncher.exe -l MSO -l BW250

Interestingly, it adds the MEMUP, SGM, ADVMATH without having it in the lnk file

MSO and Bandwidth to 2.5 GHz work well

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on August 08, 2016, 11:04:25 pm
And here is my Full Options lnk file

infiniivsion_ext.lnk:
254#\System\infiniivision\infiniivisionlauncher.exe -l MSO -l BW250 -l FPGAX -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SMG -l MASK -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVMCTR -l USBFL -l USBH -l USBSQ -l SENSOR -l CANFD -l JITTER


But, no matter what I try, the Bandwidth will not go higher than 2.5 GHz

BW400 not working
BW600 not working
BW6, BW6000 BW60 also not working

Anyone here have an idea of what to try?

But having it at 2.5 GHz is already really great.
Seeing the MTB at 100 ps resolution and working for the first time is more than great.

Thanks again memset !
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: TheSteve on August 08, 2016, 11:10:29 pm
Any chance adding multiple bw license options might help such as: -l BW250 -l BW400 -l BW600
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on August 08, 2016, 11:19:47 pm
Any chance adding multiple bw license options might help such as: -l BW250 -l BW400 -l BW600
TheSteve,
What a great idea, thank you!
4 GHz is working with the combination "-l BW250 -l BW400"
Now lets try 6 GHz ....

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: memset on August 08, 2016, 11:29:05 pm
Nice catch TheSteve! I think 6 should work this way too.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on August 08, 2016, 11:30:26 pm
Even better:
6GHz is working perfectly!
But the smallest Time Base is staying at 100 ps, same as with 2.5 GHz and 4 GHz
The original smallest time base was 500 ps at the 1 GHz setting.

infiniivsion_ext.lnk:
91#\System\infiniivision\infiniivisionlauncher.exe -l MSO -l BW250 -l BW250 -l BW400 -l BW600


Now lets add all the other options again

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: TheSteve on August 08, 2016, 11:31:05 pm
If you thought 1 GHz active probes were expensive, just think of the money you can spend now!
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: memset on August 08, 2016, 11:33:40 pm
Now lets add all the other options again
250 option used twice? Also don't forget not to exceed 260 byte file length in total.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on August 08, 2016, 11:59:56 pm
250 option used twice? Also don't forget not to exceed 260 byte file length in total.
Ahhh!
When I added all options again, I was at 272 bytes
Removed: MEMUP, SGM, ADVMATH (since they showed up anyways) and made a last lnk file

infiniivsion_ext.lnk:
246#\System\infiniivision\infiniivisionlauncher.exe -l MSO  -l BW250 -l BW400 -l BW600 -l FPGAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l MASK -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l DVMCTR -l USBFL -l USBH -l USBSQ -l SENSOR -l CANFD -l JITTER


All working!
But I am still surprised that 100 ps is the smallest time base setting.

Thank you all
This might be the first hacked 6000X series scope?

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on August 09, 2016, 12:14:46 am
If you thought 1 GHz active probes were expensive, just think of the money you can spend now!
I know, oh my!
I have a few 1.5 GHz differential and active probes.
Now the hunt starts for 6 GHz probes.

Plus it seems I need a faster pulse gen.
For the fist time this 450 ps pulse is too slow.


Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Berni on August 09, 2016, 05:23:15 am
Nice one :-+. That is a surprisingly easy hack once you know what to do.

Hope you have a deep wallet for those 6GHz probes indeed. I got my hands on a presumably broken one with the plastic case missing but when plugging it in it worked!

Oh and by the way getting a pulse fast enough to push 6GHz to its limit is not easy at all. The best i could get out of a jim williams pulse circuit is 150ps. Only way i got to generating signals this fast is my boatanchor 20GHz RF synthesizer.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on August 09, 2016, 06:17:37 am
If you thought 1 GHz active probes were expensive, just think of the money you can spend now!
I know, oh my!
I have a few 1.5 GHz differential and active probes.
Now the hunt starts for 6 GHz probes.

Plus it seems I need a faster pulse gen.
For the fist time this 450 ps pulse is too slow.

If you can deal with the loading, 54006a lo-z probes turn up on ebay quite regularly, although as I write there's slim pickings. Make sure they have all parts including the SMA cable (itself worth a few bob), through capacitor, reassuringly branded BNC-SMA, walking sticks and spare resistors.

Another option although it's only good to 2.5GHz is the 1152A. Again, check for all the bits & pieces, and check it's compatible with your scope, some of these probes dropped off the supported list of newer Agisights, but you can work around that, either with a resistor if you open up the probe or by using an external board.

https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg868073/#msg868073 (https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg868073/#msg868073)

http://www.alciom.com/images/stories/downloads/powerprobe%201a.pdf (http://www.alciom.com/images/stories/downloads/powerprobe%201a.pdf)

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: rx8pilot on August 09, 2016, 08:12:01 am
My 6ghz X6000 only goes to 100ps. I guess that is normal, but I was thinking it should be 50ps.

Sent from my horrible mobile....

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on August 09, 2016, 08:30:59 am
My 6ghz X6000 only goes to 100ps. I guess that is normal, but I was thinking it should be 50ps.

Sent from my horrible mobile....
Thank Carlos, you for confirming this.

It is indeed interesting:
1 GHz = 500 ps
2.5 GHz = 100 ps
4 GHz = 100 ps
6 GHz = 100 ps

I also expected 50 ps as a smallest setting for the time base.

Yes, time to look for probes.
But since not to many companies buy these probes and put them on a second market, I might have to wait a long time.

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: plesa on August 09, 2016, 06:55:42 pm
Wow, nice hack, I hope it will makes 6kX series more attractive:)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on August 09, 2016, 06:59:11 pm
Just for completeness:

I used the scope all day long today and had no issues at all.
Then I removed the .lnk file and updated the FW to 06.12.2016010702
And then I reinstalled the .lnk file.

All working as expected.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: rx8pilot on August 09, 2016, 07:13:22 pm
Yes, time to look for probes.
But since not to many companies buy these probes and put them on a second market, I might have to wait a long time.

I suspect it will take a long time for me to acquire the appropriate probes for this scope. So far I only have 4x 500Mhz 10:1 passives and two 100mhz differential amplifiers.

Needed:
2x DC current probes >30Mhz >30A continuous
4x 2.5Ghz single ended active probes for daily use
2x 6Ghz diff probes
1x HV differential low frequency probes for AC power analysis.

Not cheap, but at least there is a business to justify the expense. Looking for deals, but can only wait so long. As soon as I am able to start on my next design, it will define what probes are needed first. The scope is like a camera without a lens. A dedicated photographer always wants a huge variety of lenses to capture the moment just right. Some lenses rarely get used.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on August 09, 2016, 09:37:53 pm
YMMV of course, but 99% the time I still probe with light-weight miniature passive Hi-Z probes. Maybe once a week or two I break out the expensive probes. These probes simply tend to be fiddly to set up logistically, either because you need to solder in a probe point or because there is usually no concept of just clipping onto a signal, you have to either hand hold it or set up a clamp/balancing jig. Some of these probes also include expensive consumables like tip resistors: as an example, this'll make you cringe, $44 for _one_ resistor tip, a diff probe needs two:

http://www.ebay.co.uk/itm/01131-62102-01131-62107-for-E2658A-E2663A-E2668A-E2669A-E2675A-E2676A-/231422124137 (http://www.ebay.co.uk/itm/01131-62102-01131-62107-for-E2658A-E2663A-E2668A-E2669A-E2675A-E2676A-/231422124137)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: rx8pilot on August 09, 2016, 10:06:06 pm
There is nothing inexpensive at this bandwidth, thats for sure. It's not just technically challenging, but also generally associated with business which adds up to big prices.

Sent from my horrible mobile....

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Berni on August 10, 2016, 05:23:49 am
Yeah most of the time the fancy active probes sit in a box. But when a need for one comes up they save the day. Yesterday i used one of my probes to check if a 330MHz differential MIPI clock had good integrity (Tiny signal, picky loading, commonmode crap etc makes it difficult to do with a regular probe), before that the probes was last used months ago id guess.

The diff probe i have makes use of regular trough hole resistors by giving you a coax to female header adapter along with a pack of resistors. This means i can use any cheep resistor as long as the pin is the same thickness. Downside tho is that the resistor pins are too thick for fine pitch chips.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on August 10, 2016, 06:55:25 am
Downside tho is that the resistor pins are too thick for fine pitch chips.
What model probe is this?
Can you show a picture of this ?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Berni on August 10, 2016, 07:59:02 am
What model probe is this?
Can you show a picture of this ?

It is part of the "E2669A InfiniiMax Differential/Single-ended Connectivity Kit" that i got it with the Agilent 1131A Diff probe(3.5GHz), its missing parts but the one of interest is the 3rd cable from top to bottom in the photo.
http://www.keysight.com/en/pd-339402-pn-E2669A/infiniimax-differential-connectivity-kit?cc=SI&lc=eng (http://www.keysight.com/en/pd-339402-pn-E2669A/infiniimax-differential-connectivity-kit?cc=SI&lc=eng)

The other one above is is direct solder in using some super tiny trough hole resistors that actually have a square body instead of round. Those probably work for 0.5mm pitch chips but i never used it.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: laptopmd on September 23, 2016, 12:09:16 pm
Hi !

I want to thank everyone posted on this thread. I wanted an MSO scope from the day i saw the youtube video of mikeselectricstuff about reverse engineering the ipod lcd protocol.

I have crawled the web searching for a used MSO6034 or 6054 until i found this thread where you explain how to convert a DSO6034A into an MSO and then i have searched for this last one.

So, following mikeselectricstuff  suggestion i just bought a used Agil..ehm... Keysight DSO6034A from official ebay store at the price of 2000$ (free shipping) and can't wait to "upgrade" it to mso  ^-^ >:D

Thank you again for your hard work figuring out how to patch the fw, you are the best!
Dave
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: laptopmd on October 05, 2016, 06:42:15 pm
Got the scope and uploaded the new FW.

Everything work apart option code 8ML , it says it is not valid. Someone tried it ?
Thanks
Dave
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: voltsandjolts on October 05, 2016, 06:51:29 pm
I think thats included for free in the latest Agisight firmware - maybe you can't enter it cause it's already there?
Or is it only the later build scopes that got that for free?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: laptopmd on October 05, 2016, 06:53:51 pm
I think thats included for free in the latest Agisight firmware - maybe you can't enter it cause it's already there?
Or is it only the later build scopes that got that for free?

Thanks voltsandjolts.

My information screen say mem2M, maybe i am confused and 8ML is only an hardware upgrade and not only software... sorry
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: voltsandjolts on October 05, 2016, 07:30:29 pm
I'm fairly sure its a software option for all DSO/MSO6000

Yup:

Option 8ML
8 Mpts memory for MSO/DSO603xA models
From page 22 of datasheet:
http://www.upc.edu/sct/documents_equipament/d_194_id-665.pdf (http://www.upc.edu/sct/documents_equipament/d_194_id-665.pdf)

 :-//

For 500MHz and 1GHz seems to have been called option 8MH
But I see you have a 6034 (same here, great scope BTW!)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on October 05, 2016, 08:22:40 pm
8M became standard fairly early on - don't recall offhand if it was still in the license list in later FW
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: laptopmd on October 05, 2016, 08:42:27 pm
8M became standard fairly early on - don't recall offhand if it was still in the license list in later FW

Wow Mike !! Your suggestion sent me in the right direction, thanks !

I have opened sys6000.bin with an Hex editor to read which options are availables. 8ML is not more available but i found that i have enabled every single option but not "ALL" !!
Then i have entered "ALL" licence and.. bam !! now it show memMAX :-)

Thank you again, i am using this scope from 2hr but i am already super happy with it !
Dave
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: laptopmd on October 05, 2016, 09:03:52 pm
Found other codes in fw. (EDIT : already posted before, sorry)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: nctnico on October 05, 2016, 09:11:13 pm
AFAIK CIR is not an official option but it is nice to have because segmented recording keeps running until you press stop in circular segmented mode. Only the user interface isn't very clear on what is going on so I guess that is the reason it never got official.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: blackfin76 on October 19, 2016, 09:46:52 am
Do these hacks still work with the latest firmware? I might be able to buy a DSO7000A model for a reasonable price.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on October 19, 2016, 09:50:20 am
Do these hacks still work with the latest firmware? I might be able to buy a DSO7000A model for a reasonable price.
The hack works well on the DSO7000A but do NOT update to the latest FW, stay one below.
If you have updated already to the latest FW, re-installing the older one is no problem.

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: blackfin76 on October 19, 2016, 10:06:26 am
Do these hacks still work with the latest firmware? I might be able to buy a DSO7000A model for a reasonable price.
The hack works well on the DSO7000A but do NOT update to the latest FW, stay one below.
If you have updated already to the latest FW, re-installing the older one is no problem.

I don't think the scoop has been updated to the latest firmware, in fact it might be the original firmware from 2009. But say I would update the firmware, the latest would not be a good idea. Where could one get the former latest firmware? The manufacturer doesn't offer it on it's website.

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on October 19, 2016, 10:22:12 am
Send me a PM
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Keysight DanielBogdanoff on October 19, 2016, 05:33:01 pm
8M became standard fairly early on - don't recall offhand if it was still in the license list in later FW

8M of memory is standard now, the switch happened before my time. We also are giving away that license to anyone who doesn't have it for their 6000. If you don't have the memory license and want one, call the support center and they'll get you taken care of.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on October 19, 2016, 05:58:09 pm
8M became standard fairly early on - don't recall offhand if it was still in the license list in later FW

8M of memory is standard now, the switch happened before my time. We also are giving away that license to anyone who doesn't have it for their 6000. If you don't have the memory license and want one, call the support center and they'll get you taken care of.
I must have been one of the few people that bought it, though I also vaguely recall that when it became standard they also increased  the list price.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Keysight DanielBogdanoff on October 20, 2016, 05:20:01 pm
8M became standard fairly early on - don't recall offhand if it was still in the license list in later FW

8M of memory is standard now, the switch happened before my time. We also are giving away that license to anyone who doesn't have it for their 6000. If you don't have the memory license and want one, call the support center and they'll get you taken care of.
I must have been one of the few people that bought it, though I also vaguely recall that when it became standard they also increased  the list price.

It all happened before my time, so I don't really know details of what all went down. I do know that we do periodic (usually small) price increases every 6 months, so it's possible those two events happened at the same time.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: blackfin76 on October 20, 2016, 09:21:45 pm
Thank you guys for all the hard work you did in hacking this scope  :-+

I bought a DSO7014A from a local merchant (NOS catching dust) and it now has all the nice decoders and MSO features. Also really like the 1mV option, it's a bit noisy but the signal cleans up at just two averagings. I still have to get used to the giant screen and the Agilent menu's. I think this one will be part of the lab gear for a while.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on October 20, 2016, 10:14:25 pm
Thank you guys for all the hard work you did in hacking this scope  :-+

I bought a DSO7014A from a local merchant (NOS catching dust) and it now has all the nice decoders and MSO features. Also really like the 1mV option, it's a bit noisy but the signal cleans up at just two averagings. I still have to get used to the giant screen and the Agilent menu's. I think this one will be part of the lab gear for a while.

The giant telly is a blessing and a curse! Firstly it's superb resolution for an embedded scope, I don't think even today there are many scopes that can boast XGA resolution, but to some extent its wasted with over-large fonts. This is the trade off of sharing the same software with the 6000, with it's identical XGA resolution but in a 6 incher. I did some calculations a while ago, IIRC the actual graticule display pixel measured area on the 6/7000 is double that of the current x4/x6000, and about triple that of an x2/x3000.

Edit: grocer's apostrophe.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Berni on October 21, 2016, 05:12:32 am

The giant telly is a blessing and a curse! Firstly it's superb resolution for an embedded scope, I don't think even today there are many scopes that can boast XGA resolution, but to some extent it's wasted with over-large fonts. This is the trade off of sharing the same software with the 6000, with it's identical XGA resolution but in a 6 incher. I did some calculations a while ago, IIRC the actual graticule display pixel measured area on the 6/7000 is double that of the current x4/x6000, and about triple that of an x2/x3000.

Yeah the fonts would become a bit hard to read at a bit of distance if they ware any smaller on the tiny DSO6000s display. But due to the resolution on a tiny display the fonts look superbly clear without any antialiasing.

I always wanted a DSO7000 but i could never find one for a good price so i had to settle for a 6000
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Orange on October 28, 2016, 08:21:53 am
Hi,

Just some screen shots from my new DSO7014A with enabled options and rise time measurements. I used an Tek 284 for this, which has about 70ps rise time

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: blackfin76 on October 29, 2016, 12:34:07 pm
 Hi Orange, mine has similar rise times. Did you get yours from Oldenzaal?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Orange on October 29, 2016, 12:50:03 pm
Hi Orange, mine has similar rise times. Did you get yours from Oldenzaal?
Yes I did. I was lucky, it was his last one. Nice chap to deal with.
It's an impressive piece of gear.
BTW, I now have it running on V6.20, after I had it liberated under Version 6.16. The options remained enabled with the latest revision.
V6.20 has a fix for Java version 8.20 and higher if you use the WEB interface.

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on October 29, 2016, 01:12:18 pm
Congratulations on your successful liberation.
Is Oldenzaal a town or a name of a seller in NL?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Orange on October 29, 2016, 03:07:31 pm
Congratulations on your successful liberation.
Is Oldenzaal a town or a name of a seller in NL?
Hi HV
The seller is located in Oldenzaal (close to the German border) http://skye-electronics.com/ (http://skye-electronics.com/)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: nctnico on October 29, 2016, 03:11:58 pm
How much did you pay? The prices on their website are easely beaten by Ebay.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: blackfin76 on October 30, 2016, 05:16:48 pm
Hi Orange, mine has similar rise times. Did you get yours from Oldenzaal?
Yes I did. I was lucky, it was his last one. Nice chap to deal with.
It's an impressive piece of gear.
BTW, I now have it running on V6.20, after I had it liberated under Version 6.16. The options remained enabled with the latest revision.
V6.20 has a fix for Java version 8.20 and higher if you use the WEB interface.

Yes, he's a very nice chap. Has a nice collection of equipment.
I will have a look into version V6.20, I have not tested the webinterface.

@ntcnico, I paid €1500,- for the scoop. Very nice price for this type of equipment, even though they are from 2009.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: nctnico on October 30, 2016, 05:22:43 pm
@blackfin: if you paid 1500 euro for an Agilent DSO7104A (or B) then that is an insanely good deal. Almost too good to be true or is it a lower bandwidth model?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: blackfin76 on October 30, 2016, 06:13:18 pm
It's the DSO7014A, so just 100MHz bandwidth. More than enough for most of my work, I mostly do analog design up to the RF range. One of the nice features of this scope is the large DC offset range.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on October 30, 2016, 06:14:48 pm
It's the DSO7014A, so just 100MHz bandwidth...
Take a look to this post: https://www.eevblog.com/forum/testgear/bandwidth-upgrade-for-agilent-dso6014a/ (https://www.eevblog.com/forum/testgear/bandwidth-upgrade-for-agilent-dso6014a/)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: plesa on October 30, 2016, 06:21:35 pm
It's the DSO7014A, so just 100MHz bandwidth. More than enough for most of my work, I mostly do analog design up to the RF range. One of the nice features of this scope is the large DC offset range.

Congratulation, it is good scope, for this price. It has 50V DC offset or even more?
It is quite useful feature.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: TheSteve on October 30, 2016, 06:25:26 pm
If you do want more bandwidth it might be worth taking a peak inside. It might be surprisingly similar to the dsox3000 series. For the 3000 series we know the parts to swap to go from 100/200 MHz to 500 MHz.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on October 30, 2016, 06:26:56 pm
If you do want more bandwidth it might be worth taking a peak inside. It might be surprisingly similar to the dsox3000 series. For the 3000 series we know the parts to swap to go from 100/200 MHz to 500 MHz.
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg987126/#msg987126 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg987126/#msg987126)

I'll try to modify my MSO as soon as I can get a good RF generator.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: blackfin76 on October 30, 2016, 09:08:50 pm
It's the DSO7014A, so just 100MHz bandwidth. More than enough for most of my work, I mostly do analog design up to the RF range. One of the nice features of this scope is the large DC offset range.

Congratulation, it is good scope, for this price. It has 50V DC offset or even more?
It is quite useful feature.

5V when <10mV/div. 20V for 10...200mV/div and 75V for >200mv/div

FYI my scope has the front end ASIC in QFN package, so this means the bandwidth may be hardware upgradeable?
I guess that would mean replacing components, setting the sample rate to a higher rate and do a calibration?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Carrington on October 31, 2016, 12:06:55 am
Lucky one.

FYI my scope has the front end ASIC in QFN package, so this means the bandwidth may be hardware upgradeable?
Yes.

I guess that would mean replacing components, setting the sample rate to a higher rate and do a calibration?
And yes.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on December 04, 2016, 05:22:48 pm
Folks

I wonder if anyone else has this UI bug?

When you zoom the timebase, the timebase adjustment jumps from microseconds to the fastest picosecond speed in some circumstances.

https://youtu.be/acTxvnS2dGo (https://youtu.be/acTxvnS2dGo)

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on December 04, 2016, 08:33:22 pm
Folks
I wonder if anyone else has this UI bug?
No, I have not noticed this on any of my 7000B series scopes.
Do you have the latest FW installed?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on December 04, 2016, 08:36:57 pm
Folks
I wonder if anyone else has this UI bug?
No, I have not noticed this on any of my 7000B series scopes.
Do you have the latest FW installed?

6.20.00, it appears to be the latest according to the Keysight website; right at the end of the video this is mentioned. Perhaps it only affects the 1GHz version, I don't know.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Orange on December 06, 2016, 09:02:53 am
Folks

I wonder if anyone else has this UI bug?

When you zoom the timebase, the timebase adjustment jumps from microseconds to the fastest picosecond speed in some circumstances.

https://youtu.be/acTxvnS2dGo (https://youtu.be/acTxvnS2dGo)
I can confirm this bug on a MSO7014A (DSO7014A with MSO option) with software version 6.20

On this system set to 500us for the main timebase, it jumps from 1uS to 5ns in zoom mode.
Looks like the scopes jump to the smallest possible TB setting at some point.
Using the fine setting is working OK....

Time for a bug fix ?


Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on December 06, 2016, 10:51:25 am
Thanks for trying this, kinda weird this hasn't come up before, it's a very common use-case. I'll see if I can reproduce in an earlier firmware version.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: KE5FX on December 06, 2016, 11:24:48 am
A history of past and future advances in computer science:
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Orange on December 06, 2016, 04:07:59 pm
A history of past and future advances in computer science:
  • 1997: Deep Blue defeats world chess champion Garry Kasparov
  • 2007: Tartan Racing takes first place in DARPA Grand Challenge
  • 2016: AlphaGo defeats 9-dan grandmaster Lee Sedol
  • 2022: Deep Thought becomes first system to pass Turing test
  • 2023: Hybrid quantum algorithm solves NP-hard problems in polynomial time
  • 2024: Skynet declares, "The only winning move is not to play," pulls own plug
  • 2025: Last remaining Bitcoin mined by botnet running on hijacked iPhone 12s
  • 2027: Half-Life 3 released
  • 2029: Programmers finally figure out how to read a quadrature shaft encoder properly
The shaft encoder is working properly in this case... Something else is wrong here.
Keysight claimed to fix severe bugs in this 7000 line-up. Let's see
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on December 06, 2016, 04:23:31 pm
A history of past and future advances in computer science:
  • 1997: Deep Blue defeats world chess champion Garry Kasparov
  • 2007: Tartan Racing takes first place in DARPA Grand Challenge
  • 2016: AlphaGo defeats 9-dan grandmaster Lee Sedol
  • 2022: Deep Thought becomes first system to pass Turing test
  • 2023: Hybrid quantum algorithm solves NP-hard problems in polynomial time
  • 2024: Skynet declares, "The only winning move is not to play," pulls own plug
  • 2025: Last remaining Bitcoin mined by botnet running on hijacked iPhone 12s
  • 2027: Half-Life 3 released
  • 2029: Programmers finally figure out how to read a quadrature shaft encoder properly
The shaft encoder is working properly in this case... Something else is wrong here.
Keysight claimed to fix severe bugs in this 7000 line-up. Let's see

Yes, when I first encountered this some time ago, I assumed it was the old encoder jitters, but I realised pretty soon that it's not that, it's completely reproducible and predictable.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on December 06, 2016, 04:40:42 pm
Can you work around it by switching to fine -adjust mode?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Orange on December 06, 2016, 07:19:37 pm
I am thinking that any further development on the 6000/7000 is going to be limited, they've probably not long on the shelves.

This is more or less correct, it's an old (to us) scope, and we focus development on our newer products. If someone were to find a critical bug, we'd definitely consider revisiting the firmware.  But, it's a discontinued probe (from the HP days, even). 

I don't know the details of why this probe wasn't included, it's very possible that there's a use case that overloads the autoprobe interface.  I'm 100% certain that compatibility with this probe & scope was considered, but ultimately not included.  I don't know why it ended up this way, but I do know our process here and have a lot of faith in the right decisions being made.  I wouldn't necessarily want to run 4 of these on a signal that pushes the bandwidth and voltage limits of the probe, but it might work fine.  :-//  :-BROKE (emoji seems appropriate here)

That being said, the spirit of this blog is pushing the boundaries of equipment, etc. So, I'm willing to post things like this knowing that you all accept the inherent risk of this type of thing.
Hi Daniel,

Is there any chance that Agilent/Keysight will fix this Timebase zoom error in the UI of the DSO7000 series ?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on December 06, 2016, 08:20:35 pm
Can you work around it by switching to fine -adjust mode?

Yes, if you watch the vid, that's what I do.

In the meantime, 6.16 seems not to have the bug and works perfectly well, I'm running it off a USB stick now, but I might regress as there weren't any features I'm aware of in 6.20 that fixed anything: the reason I upgraded in the first place to 6.20 was a problem I was having decoding fast SPI buses that turned out to be a documented limitation.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on December 06, 2016, 08:41:29 pm
I am thinking that any further development on the 6000/7000 is going to be limited, they've probably not long on the shelves.

This is more or less correct, it's an old (to us) scope, and we focus development on our newer products. If someone were to find a critical bug, we'd definitely consider revisiting the firmware.  But, it's a discontinued probe (from the HP days, even). 

I don't know the details of why this probe wasn't included, it's very possible that there's a use case that overloads the autoprobe interface.  I'm 100% certain that compatibility with this probe & scope was considered, but ultimately not included.  I don't know why it ended up this way, but I do know our process here and have a lot of faith in the right decisions being made.  I wouldn't necessarily want to run 4 of these on a signal that pushes the bandwidth and voltage limits of the probe, but it might work fine.  :-//  :-BROKE (emoji seems appropriate here)

That being said, the spirit of this blog is pushing the boundaries of equipment, etc. So, I'm willing to post things like this knowing that you all accept the inherent risk of this type of thing.
Hi Daniel,

Is there any chance that Agilent/Keysight will fix this Timebase zoom error in the UI of the DSO7000 series ?

From the DSO7104B page it states it's currently supported. It was however discontinued in June of this year.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on December 06, 2016, 09:06:47 pm

In the meantime, 6.16 seems not to have the bug and works perfectly well, I'm running it off a USB stick now, but I might regress as there weren't any features I'm aware of in 6.20 that fixed anything: the reason I upgraded in the first place to 6.20 was a problem I was having decoding fast SPI buses that turned out to be a documented limitation.

That is why I can not repeat your problem, I am running FW 6.16 on both of my 7000B series scopes.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on December 06, 2016, 09:41:12 pm

In the meantime, 6.16 seems not to have the bug and works perfectly well, I'm running it off a USB stick now, but I might regress as there weren't any features I'm aware of in 6.20 that fixed anything: the reason I upgraded in the first place to 6.20 was a problem I was having decoding fast SPI buses that turned out to be a documented limitation.

That is why I can not repeat your problem, I am running FW 6.16 on both of my 7000B series scopes.

I've since reverted to 6.16 which luckily I still have here in my treasure trove, that version seems to have disappeared from Keysight's pages. Thanks for looking, it's appreciated.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Haasje93 on January 25, 2017, 07:00:01 am
Hi everyone!

I have the third and last Agilent DSO7014A from the seller in Oldenzaal.
As i read, Orange and Blackfin76 have the other two.
Does anyone have the firmware version for me? Not the latest but one before that, as i recall it was 6.18.00

I also have another question, last night i wanted to perform a user calibration, i set the switch to uncalibrated but the scope said it was calibrated. (protected)
Does anyone have encountered that problem?

Haasje93
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on January 25, 2017, 09:03:10 am
Hi everyone!

I have the third and last Agilent DSO7014A from the seller in Oldenzaal.
As i read, Orange and Blackfin76 have the other two.
Does anyone have the firmware version for me? Not the latest but one before that, as i recall it was 6.18.00

Haasje93
PM sent.
Welcome to the forum

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Orange on March 17, 2017, 08:47:34 pm

I also have another question, last night i wanted to perform a user calibration, i set the switch to uncalibrated but the scope said it was calibrated. (protected)
Does anyone have encountered that problem?

Haasje93
That's funny.
Last week I wanted to do a  user calibration on my MSO7014A, and the scope would not let me. It said it was protected, toggled the switch several times, and it refused to let me do the calibration.
I opened it up, and took the main board out and measured the switch. Switch was wrong, no contact on one position......

I took the switch of the board and opened it, nothing obvious to see. I cleaned it and put it back together and now both positions worked OK. Soldered it in and it works again.

Bad switch, perhaps the complete series. It was a red C&K slide switch....
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on March 18, 2017, 12:37:40 am

I also have another question, last night i wanted to perform a user calibration, i set the switch to uncalibrated but the scope said it was calibrated. (protected)
Does anyone have encountered that problem?

Haasje93
That's funny.
Last week I wanted to do a  user calibration on my MSO7014A, and the scope would not let me. It said it was protected, toggled the switch several times, and it refused to let me do the calibration.
I opened it up, and took the main board out and measured the switch. Switch was wrong, no contact on one position......

I took the switch of the board and opened it, nothing obvious to see. I cleaned it and put it back together and now both positions worked OK. Soldered it in and it works again.

Bad switch, perhaps the complete series. It was a red C&K slide switch....
Maybe something like silver plated, tarninshing over a long time of no use.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: swperk on March 29, 2017, 04:27:52 am
Even better:
6GHz is working perfectly!
But the smallest Time Base is staying at 100 ps, same as with 2.5 GHz and 4 GHz
The original smallest time base was 500 ps at the 1 GHz setting.

infiniivsion_ext.lnk:
91#\System\infiniivision\infiniivisionlauncher.exe -l MSO -l BW250 -l BW250 -l BW400 -l BW600


Now lets add all the other options again

Thanks for this *very* educational narrative! What is the meaning of the "Unsealed Instrument" warning? Does it have any affect on the operation, calibration, or any other aspect of the scope? Can this warning be gotten rid of?

Stan

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on March 29, 2017, 07:53:04 am
Even better:
6GHz is working perfectly!
But the smallest Time Base is staying at 100 ps, same as with 2.5 GHz and 4 GHz
The original smallest time base was 500 ps at the 1 GHz setting.

infiniivsion_ext.lnk:
91#\System\infiniivision\infiniivisionlauncher.exe -l MSO -l BW250 -l BW250 -l BW400 -l BW600



Now lets add all the other options again

Thanks for this *very* educational narrative! What is the meaning of the "Unsealed Instrument" warning? Does it have any affect on the operation, calibration, or any other aspect of the scope? Can this warning be gotten rid of?

Stan
This warning will stay and be visible only after a reboot of the scope until you press the back button.
I have found no limitations at all and all operations are working perfectly to specifications.

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: swperk on March 31, 2017, 12:32:17 am
Thanks for the clarification. One other thing: I tried installing the all options .lnk file and when my scope started up, it showed it as a 6 GHz scope with all options except the last one in the string (JITTER). I checked and re-checked, verified the length of the string as 246 characters, and reloaded it and restarted the scope several times, but no luck. It always comes up with everything but the jitter option, and when I press the jitter key, it confirms this by telling me that it's not installed. My scope is a 1 GHz MSOX6004A with the app bundle, so by default it has the jitter option. I can see the jitter option (along with all the other options) when I remove the .lnk file from the \System\Startup folder and reboot the scope. Any ideas? Thanks!
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: swperk on March 31, 2017, 04:00:45 am
Solved! The last character of my .lnk file was the "R" in "JITTER". I added a space at the end and all is well. Not sure why it worked, but it did. :)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: tomvid on March 31, 2017, 07:55:55 am
Hello,

well I wish I knew this forum some years ago, when older versions of bin/jzp files were available. I just downloaded the actual versions (6.20) for the scope 6000. After running
Code: [Select]
unjzp sys.jzp sys.bin sys_rev.txt I get a very short sys_rev.txt file (1KB), it contains just a following text:
Code: [Select]
@(#)REV: 06.20.0000 Apr 23 2015 10:42:11Does this mean, Keysight changed the structure of the source files, so our unjzp can't cope with them anymore?
Does anybody have the older files, that can be adjusted? I would like to play with my scope a bit...
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on March 31, 2017, 09:26:38 am
Solved! The last character of my .lnk file was the "R" in "JITTER". I added a space at the end and all is well. Not sure why it worked, but it did. :)
Congratulations!
Small things in the .lnk file have huge influences, great that you solved it.

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on March 31, 2017, 11:41:56 pm
tomvid, short txt file is correct. It's just a revision string from jzp header to pack it back later. Don't touch it, look at bin.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: andreathepsyco on August 21, 2017, 11:27:06 pm
Hi everybody! I've been lurking this topic for a long time and finally i got my hands on a MSO6034A and i'm pretty happy of the purchase :) . Unfortunately i wasnt' able to make the bin file hack to work. I'm using version 6.20 and the instruction provided earlier in this thread (Go to 0x00231998 and replace 38 09 FF FD by 38 00 00 01). Can anybody tell me where am i mistaking? Or lend me a copy of firmware 6.16? Thank you!

EDIT: I hadn't searched well enough apparently... As was already pointed out by @berk98 many pages ago the fix is the same as before but with a different offset:

Quote
sys6000.bin 6.20.0000:
offset 0x002E80F8:  94 21 F8 E0 7C 08 02 A6 -> change to -> 38 60 00 00 4E 80 00 20

tested: it works!
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: GotObsoleteScopes? on September 19, 2017, 02:42:47 pm
Hi all - I've had a great time reading through this whole thread. It's awesome seeing how knowledgeable many of y'all are is just sweet. I'm working on implementing the servo d me u hack on a DSO6054a, but I'm not getting anything in the option menu when I finish the VxWorkd mod, and CD bin doesn't show a license file either. Any guidance for next steps? I'm not quite ready to modify the bin yet, but I will if I have to. Any advice for the bin mod on the DSO6054a?

Sent from my SM-G955U using Tapatalk

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: johnmx on October 13, 2017, 09:32:44 am
What are the options TEL, TOM and CIR?

I cannot find any info about them anywhere...
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: nctnico on October 13, 2017, 07:42:59 pm
CIR is circular segmented recording. Normally the oscilloscope would capture X segments and then stop. With CIR you get an extra setting which continues to capture segments until you press stop. The UI doesn't really show what is going on so I guess that is the reason Agilent never made this very usefull feature available as a normal option.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: zitt on April 20, 2018, 09:14:28 pm
Were there specific instructions for booting off USB on these (6000A) scopes?

I want to play around without actually modifying the firmware on the scope's "memory"... and my scope has SEC installed at factory.
Is there a "de-brick" procedure documented to recover from a bad situation?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on April 21, 2018, 07:59:35 am
Were there specific instructions for booting off USB on these (6000A) scopes?

I want to play around without actually modifying the firmware on the scope's "memory"... and my scope has SEC installed at factory.
Is there a "de-brick" procedure documented to recover from a bad situation?
ISTR it is possible to boot from USB, I don't recall the details but probably in this thread somewhere
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: zitt on April 21, 2018, 08:24:15 pm
ISTR it is possible to boot from USB, I don't recall the details but probably in this thread somewhere

I grew a pair last night and threw caution to the wind. After realising the scope would boot from USB using the 4 second reset rule.

I started by removing SEC option as documented by abyrvalg at this post (https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg488361/#msg488361).

Once I saw how easy SEC was to disable and I had the scope booting off usb; I went ahead and modified the copy of the .jzp per 6.20 instructions here (https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg963722/#msg963722) and the tools here (https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg376323/#msg376323). Once I had all the .lic installed for the software I was interested in and verified the usb hack would work. I went ahead and upgraded the scope using the usb modified binary. Everything seems good.

Does anyone know if the USB ports can really be used with a USB keyboard? Mine doesn't seem to recognise the keyboard.
I couldn't figure out how to bring up the utility menus from within VNC. :(
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on May 12, 2018, 09:19:20 pm
A quick note, a couple of days ago I hooked up my 7104B running 6.16 to IO libraries... and the liberated options mysteriously disappeared.

FWIW I was using the service menu method.

I re-enabled them again using the same method afterwards.

I won't be using IO libraries again!
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on May 13, 2018, 08:16:01 am
A quick note, a couple of days ago I hooked up my 7104B running 6.16 to IO libraries... and the liberated options mysteriously disappeared.

Good to know, thanks for sharing this.

What did you do with the IO libraries on the scope?
Did you send any commands or was detecting the scope enough to loose the "service mode"
Was this repeatable?

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on May 13, 2018, 08:47:51 pm
A quick note, a couple of days ago I hooked up my 7104B running 6.16 to IO libraries... and the liberated options mysteriously disappeared.

Good to know, thanks for sharing this.

What did you do with the IO libraries on the scope?
Did you send any commands or was detecting the scope enough to loose the "service mode"
Was this repeatable?

I was looking at running a SCPI command to set a non standard high baud rate on the uart serial decoder without having to spend ages twiddling the knob.

I only noticed afterwards that the options had disappeared after a restart the next day. I’ve been using it liberated pretty much daily for the past two year or so with no problems until now.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Haasje93 on May 14, 2018, 01:01:12 pm
Thanks for sharing this!
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: jameswhong on May 30, 2018, 06:15:05 pm
Just writing to say it works on DSO7054B.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on May 30, 2018, 06:25:12 pm
Thanks for sharing this!

FWIW, I ended up achieving my aim of being able to directly key in large arbitrary UART baud rates perfectly well using telnet without any problems, no need for the Keysight I/O libraries and BenchVue etc. I am sure many already knew this, for some reason I incorrectly thought there was more to it.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: TiN on July 05, 2018, 05:42:06 pm
Hello all,

Hope you guys don't mind if I join this little party?

Received my 7014A (circa 2009) today. It's all working, so I used info to "improve" it a little.
Figured out strap for 7104, but obviously 1G 50ohm hardware is missing, so I think we need schematics for front end to perform a proper modification.
My PCB does not have the Teledyne relay spot, so it will be more challenging than popping some parts on PCB..

(https://xdevs.com/doc/HP_Agilent_Keysight/DSO7000A/img_tin/dso_mod_1.jpg)

To add some photos into collection, my 7014A HW (stock condition):

(https://xdevs.com/doc/HP_Agilent_Keysight/DSO7000A/img_tin/dso7014a_top_1.jpg) (https://xdevs.com/doc/HP_Agilent_Keysight/DSO7000A/img_tin/dso7014a_top.jpg) (https://xdevs.com/doc/HP_Agilent_Keysight/DSO7000A/img_tin/dso7014a_bot_1.jpg) (https://xdevs.com/doc/HP_Agilent_Keysight/DSO7000A/img_tin/dso7014a_bot.jpg)

PCB Rev 002  54693-26410
PCB sticker number 54689-66410 , which is bit puzzling as it's not the one known in other DSO7xxx posts.
Original firmware was ver5.25

Front end magic:

(https://xdevs.com/doc/HP_Agilent_Keysight/DSO7000A/img_tin/dso7014a_front_ch12_1.jpg) (https://xdevs.com/doc/HP_Agilent_Keysight/DSO7000A/img_tin/dso7014a_front_ch12.jpg)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on July 06, 2018, 10:40:59 am
I have a 7104B, I can "take it apaaaart" and get some pics if you like.

Those AFE shields look like they're clipped on push fit rather than soldered is that right? (The AFE shields in my 3054A were soldered, and were difficult to remove without damaging the board's copper layers).
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: TiN on July 06, 2018, 12:14:58 pm
I have a 7104B, I can "take it apaaaart" and get some pics if you like.

Those AFE shields look like they're clipped on push fit rather than soldered is that right? (The AFE shields in my 3054A were soldered, and were difficult to remove without damaging the board's copper layers).

Yes, please. More the better.
Shields are clipped, but you will have to take the board out (or lift it slightly), because shields fixed by screw, which is not accessible (blocked by frame metal). You'd need unfasten PCB screws, remove 4 small screws near BNC ports from front, release two plastic clips and then board comes out very easy.
It took me 5 minutes to take board out.

Ideally I'd need photos of both sides.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on July 06, 2018, 04:07:20 pm
I strongly suspect there are some AFE similarities between the DSOX3000A series and the DSO6000/7000A/B series from your pictures.

Below are some 3000A links with pics about upgrading a 100/200MHz AFE to 350/500MHz, plus some 3000A 1GHz AFE pics. I can't remember if anyone managed a 1GHz upgrade: the 3000A 1GHz model has a different board layout plus an additional expensive looking Teledyne canned relay.

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg983061/#msg983061 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg983061/#msg983061)
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg983501/#msg983501 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg983501/#msg983501)
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg985356/#msg985356 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg985356/#msg985356)
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg987126/#msg987126 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg987126/#msg987126)
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg993078/#msg993078 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg993078/#msg993078)

The 7104B is always the one that I turn to first! The front panel is a little better than the 7104A as it has a couple of extra knobs and buttons, and I believe that more knobs have push functions on the B. The GUI is as fast as it gets on a DSO.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on July 06, 2018, 08:00:52 pm
I'm not so sure it's good news, as well as the Teledyne relay, there looks to be a "special" ASIC on the 7104B.

This is split into three posts due to the upload limit.

The original hi-res image links are here:

7104B Pic 1 (https://1drv.ms/u/s!Ak3HU3AygNouhbQTChXo0YFywOkaTQ)
7104B Pic 2 (https://1drv.ms/u/s!Ak3HU3AygNouhbQWI_mnfOLkY6iFMg)
7104B Pic 3 (https://1drv.ms/u/s!Ak3HU3AygNouhbQSqSOLrKY9PT2Bbw)
7104B Pic 4 (https://1drv.ms/u/s!Ak3HU3AygNouhbQRzUTzL23HfbDTYQ)
7104B Pic 5 (https://1drv.ms/u/s!Ak3HU3AygNouhbQXIIzD4YHdhRGIdw)
7104B Pic 6 (https://1drv.ms/u/s!Ak3HU3AygNouhbQUedn_RfPm7P5nkQ)
7104B Pic 7 (https://1drv.ms/u/s!Ak3HU3AygNouhbQVGjyhqs2qEdNtsg)

One note when re-assembling: mine has apparently had its fan cable trapped since manufacture as it's squished. When I re-assembled it, I tried to do it without trapping the cable, but in so doing, I forgot about paying attention to the on/off switch, so I managed to break the plastic mechanical switch extension thingy going to the front panel. It broke off at switch end. I managed to superglue it back together with a shim splint reinforcement made out of a bit of PCB, and it seems to have worked.

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=470258;image)

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=470264;image)

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=470270;image)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on July 06, 2018, 08:03:34 pm
Some more (sorry of some are a bit glary, I didn't realise until afterwards)...

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=470276;image)

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=470282;image)

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=470288;image)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on July 06, 2018, 08:08:31 pm
Last one.

Also some links to higher res versions below.

(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=470294;image)

7104B Pic 1 (https://1drv.ms/u/s!Ak3HU3AygNouhbQTChXo0YFywOkaTQ)
7104B Pic 2 (https://1drv.ms/u/s!Ak3HU3AygNouhbQWI_mnfOLkY6iFMg)
7104B Pic 3 (https://1drv.ms/u/s!Ak3HU3AygNouhbQSqSOLrKY9PT2Bbw)
7104B Pic 4 (https://1drv.ms/u/s!Ak3HU3AygNouhbQRzUTzL23HfbDTYQ)
7104B Pic 5 (https://1drv.ms/u/s!Ak3HU3AygNouhbQXIIzD4YHdhRGIdw)
7104B Pic 6 (https://1drv.ms/u/s!Ak3HU3AygNouhbQUedn_RfPm7P5nkQ)
7104B Pic 7 (https://1drv.ms/u/s!Ak3HU3AygNouhbQVGjyhqs2qEdNtsg)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: TiN on July 07, 2018, 05:40:21 am
Quote
It broke off at switch end.
Sorry about that.  :'(

Thank you for photos. Your unit was build beginning of 2005, so it is older and have ceramic hybrid front end chip, instead of newer plastic 2DA2-0001 one. Plastic chip still can do faster BW, it's used in real 1.5G scopes too.
It's start for me to start on schematics for front-end.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Orange on July 07, 2018, 09:39:13 am
TiN,

You might want to have a look on the mods I did to make it a 500MHz model.

https://www.eevblog.com/forum/testgear/agilent-dso7014a-upgrade-to-mso7054a/ (https://www.eevblog.com/forum/testgear/agilent-dso7014a-upgrade-to-mso7054a/)

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: TiN on July 07, 2018, 09:42:24 am
Yes, I already did that, but my ultimate goal would be 1 jiggagurz :=\.
Thanks for sharing BTW.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Orange on July 07, 2018, 09:46:03 am
Let see if this is possible, BTW your fotos are very much appreciated, such high detail, and ultra sharp !

ps. which strap config did you use to get an 1GHz model ?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: DC1MC on August 18, 2018, 07:13:42 am
Hello everybody, I've got a MSO6054A with the 8M licence already there, is it anything that can be "improved" on it, like activating some extra options, service menus, software updates that are worth doing ?

Also, how is the firmware stored, little HDD, compact flash or what, is it anything that needs backup ?

Any known weak point, capacitors, power supply and similar ?

How does the user calibration goes and is it a document somewhere describing it in detail ?

And finall, the unicorn, any service documents, schematic ?


 Thanks for any information and cheers,
 DC1MC

EDIT:
Calibration and Service Manual found here:
http://engineering.case.edu/lab/circuitslab/sites/engineering.case.edu.lab.circuitslab/files/docs/Agilent_6000_Series_Oscilloscope_Service_Guide.pdf (http://engineering.case.edu/lab/circuitslab/sites/engineering.case.edu.lab.circuitslab/files/docs/Agilent_6000_Series_Oscilloscope_Service_Guide.pdf)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on August 18, 2018, 12:16:11 pm
Hello everybody, I've got a MSO6054A with the 8M licence already there, is it anything that can be "improved" on it, like activating some extra options, service menus, software updates that are worth doing ?
Yes, decodes, segmented memory. All info is in this thread.
Quote
Also, how is the firmware stored, little HDD, compact flash or what, is it anything that needs backup ?
onboard flash
Quote
Any known weak point, capacitors, power supply and similar ?
Not as far as I've seen
How does the user calibration goes and is it a document somewhere describing it in detail ?
[/quote]
RTFM

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: DC1MC on August 18, 2018, 02:53:21 pm
The RTFM has been found and read  ;D, the "user calibration kit" has been ordered form  >:D-bay for around 9EUR, the scope has the original calibration from 2005 !!! along with software versions 1.xx  :wtf:, I think that an update is badly needed.
I didn't even know there were extra options for this MSO model, besides the 8M points, in the license list there are no decoders license, but there is a huge list of them (UART, I2C, CAN and so on...) in the scope menu, hopefully I'll be able to add even more.

Any chance to activate the battery option in the upper compartment or is painful ?

Thanks Mike for the tip, hopefully I'll find the post in the thread jungle  :P

 Cheers,
 DC1MC
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: mikeselectricstuff on August 18, 2018, 03:57:16 pm
The RTFM has been found and read  ;D, the "user calibration kit" has been ordered form  >:D-bay for around 9EUR, the scope has the original calibration from 2005 !!! along with software versions 1.xx  :wtf:, I think that an update is badly needed.
I didn't even know there were extra options for this MSO model, besides the 8M points, in the license list there are no decoders license, but there is a huge list of them (UART, I2C, CAN and so on...) in the scope menu, hopefully I'll be able to add even more.

Any chance to activate the battery option in the upper compartment or is painful ?

Thanks Mike for the tip, hopefully I'll find the post in the thread jungle  :P

 Cheers,
 DC1MC
Don't think anyone has investigated the BAT option but this needs additional hardware so probably not much point. Battery was  not a retrofittable option - only an ordering option on new scopes.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: DC1MC on August 19, 2018, 09:21:42 am
Kindly please disregard the original content of this post, there was some kind of imbecile default setting of bless (Linux hex editor), insert mode instead of overwrite  :palm:, as well as a PEBAK, because I  didn't verify the file size  |O. How did the thing booted, it's a small wonder to me  :-//.
Everything works absolutely perfect, one more time thanks to all the people involved  :-+.

Now I have a couple of more questions:
- are there any application notes from Agilent describing in detail the usage of each option, especially the FPGA (do they need a separate adapter or are they working with the supplied pod).

- Is  there a chance to move the 500MHz variant to "jigaaaheertz", even with some soldering needed, like 300 -> 500 ?

 Thanks,
 DC1MC


I wanted to try the cool hack described here, but with the latest fw from the Keysight site it doesn't work, the header is:
... snip ...
[

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: dogbert on June 28, 2019, 06:21:42 am
What's the 3-letter name for the 8Mpts memory? MEM-8M and 8ML doesn't seem to work. Thanks!
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Haasje93 on June 28, 2019, 10:31:11 am
Hi there,

The codes are 008 of AMM

Regards,
Christiaan
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: syau on July 05, 2019, 03:35:52 am
Anybody doing similar hack for MSO9000 series  8)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: jxjbsd on September 26, 2019, 05:00:33 pm
about 2ch OSC (my DSO6052A ) hacked  ;D
sys6000.bin    REV: 06.20.0000
002e8138: change to ->  81 61 20 20 80 0b 20 04 7c 08 03 a6 83 eb ff fc 7d 61 5b 78 38 60 20 20 4e 80 20 20 

good luck !
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on September 26, 2019, 05:13:07 pm
about 2ch OSC (my DSO6052A ) hacked  ;D
sys6000.bin    REV: 06.20.0000
002e8138: change to ->  81 61 20 20 80 0b 20 04 7c 08 03 a6 83 eb ff fc 7d 61 5b 78 38 60 20 20 4e 80 20 20 

good luck !
Nice, thanks for sharing and welcome to the forum.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: analogRF on March 08, 2020, 04:33:33 am
This is somewhat off topic but I got a very clean DSO6054A which does not boot. The front panel LEDs blink in order and finally the Single button lights up for a few seconds and then all off, no display (backlight is OK).
I tried the USB recovery as per keysight website and I can see the LED on my USB stick blinks for a while (when Single button is ON) and then
it goes off and nothing...tried multiple times and tried to play with that 4 seconds timing...should the USB stick be formatted in a special way?

I also tried LAN connection and again although the orange LAN LED in the back blinks (and the green one is ON) but it does not show up on my network so I cannot telnet to it...

Does anybody know a serial console on this scope so that I can access to the boot prompt that way and see what is going on?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: KE5FX on March 08, 2020, 07:44:54 am
This is somewhat off topic but I got a very clean DSO6054A which does not boot. The front panel LEDs blink in order and finally the Single button lights up for a few seconds and then all off, no display (backlight is OK).
I tried the USB recovery as per keysight website and I can see the LED on my USB stick blinks for a while (when Single button is ON) and then
it goes off and nothing...tried multiple times and tried to play with that 4 seconds timing...should the USB stick be formatted in a special way?

I also tried LAN connection and again although the orange LAN LED in the back blinks (and the green one is ON) but it does not show up on my network so I cannot telnet to it...

Does anybody know a serial console on this scope so that I can access to the boot prompt that way and see what is going on?

The 6000-series scopes (including mine) had a widespread problem similar to this that was generally solved with a motherboard swap at Agilent.  :( The service bulletin is probably still floating around on the 'net. 

I don't believe I ever found out exactly what was wrong, possibly a soldering defect that showed up after multiple heat cycles.  Hopefully yours is just a power supply issue or something similarly obvious.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: analogRF on March 08, 2020, 11:54:34 am
It's not power supply issue, I have checked all the regulators on the main board and every one of them is ok
I found that Agilent service note that you mentioned. Well , it applies to DSO6034A and for low serial numbers <MY44001000.
Mine has a MY5007xxxx serial number. So apparently that service bulletin does not apply to it.

It seems the firmware (or just the bootloader) is running to some point but then stops. I need to find a serial console on the board
that I can attach to and see if there is any error or clue. It reads the USB stick but then does nothing. Maybe it tries to load into memory (SRAM) and fails. Bad SRAM maybe? The LAN LED blinks when I connect it to router but no IP

Does the rescue USB need to have a special format? FAT16 or FAT32 etc?

Is anyone aware of a serial console port on the board?

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: analogRF on March 13, 2020, 12:24:42 am
please read my posts about the above fault in here
https://www.eevblog.com/forum/repair/agilent-dso6054a-boot-problem/ (https://www.eevblog.com/forum/repair/agilent-dso6054a-boot-problem/)

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Venturi962 on April 08, 2020, 09:34:21 pm
Not sure how many folks are using these scopes nowadays, but wanted to share a few notes on the serial decodes:

Max UART / RS232 Decode is 5 Mbps, can decode two streams but only one baud rate at a time.

Signal:
(https://lh3.googleusercontent.com/56I2orAHNSAXlirNnqjXy22bvZx9k9uSMWHfDEASUgRPZFCCROBCJr6J0ec86WjdbwabFyKMjdOkA97ZpJvypecVx2kO_1vSbLT_thuvbRgMT4uGR4zcLLDUIps52oqWJSc9BMAaeev3VnifXOWKrCCBzo1Bhanka47l1tGn_fGC-FqIuMaWmKZECdL_4SLpApbYcrtFNNwgnLi6CuR752l1XN4j5HiJdTyuYxsXybf9uUoRDbXX0OxnT5vsGQ7zfgLf3IyAKSEWdt1YxADkrNB9LiZijPq4P52A_Y__1ismxAKqnT27v4JQOs36GqD6xOKWjDK8kvJks-7Y7_fGwfnKM5Ieg-Y4Sxr5xfgA_wa5BFzFrSuNihK9_Ea0gvLa48cjmfmNyJ96fltQUPv6Zpl7YUb2Hd1YZtdXKSEpL4KPWq4QwkFYnyosl6MAVK88GD4IJYAXyL4p3KndDiglWcS_3QguX5tPBQL4UeSYURzhl8OoSZC0e0s3BwaiQRaaFMmIS0jd3wMObBt6XofqYBl0aiaKe53hIElVaMbKKaj1o4EHg-pYR2KLJm1PuHk-twjaKQ14jmyD59taUWl1s0T8jF057HNajS2ghWosga--ze3sdZtLI7AzyZq74IGWTmHeb5lWLe9o2rJLx2FlAM0GZSyBWd05Gc75fTW_zen_DemJ4s68pvJHwxZvtw=w1024-h829-no)

Decode:
(https://lh3.googleusercontent.com/3Zf-KoXvwhinokjXDmuVZTpr3B_6uM48Kc4FM6A_O3Re6i8mI6lCTvxTxm25-NsWTHVXaJfMw7_W3ozGN3r9KzllvbDy-ry_mjb6g8AATGWlIGP3_Guc7OFx730cxT6iof0x3fzqTQcmSqnhe8LMZl9AVlXmJe9SVf8SjsgzPbCKcNhHnn1-ll9t5JlMBZo50xTuN2iZnYwgqp61RE_eCk9ewoo776SxHh0u1O18KZPKAy5-YElnD-uOeRLFNbmv1_qZUwxE4qmJmBh53o6AaSvs4IQI8OMg3bcZYg8XDtA8wNKTYUNjJUY--Qhhn_9hzgfZJw7VMyjmWdP2SXCqxAo7tHUmDI5v3ba5Ljjateo_Hm672efCAlzs6Vc39n2H4e5SEPOYhkbK41JPqFynb34pybd8DrSmMKgPXom6SzTSkv1G47Frf0Z837UMW16X2sOS6MKwsROKAepZczKdAhXK0cfds21EXSR9EThxUU9DARtd1utyABhuO9mT80RytlYV2TA5DT0REeTZUo5RDkP6ke0FQwQqEVPQO8ENKiQaJ4kRYWV4C8lflyRosnKsrENUi10-qyUFx5yHAptEKqS43gHxE5LdgJV24jU7M5G4RdQv5H-i5EZMFK1ciq6d5rY52hkH3LaQTE-wRZrtqK4Melj0rkkzyFYpWywKUNk5tgHlIGodDBljobltkA=w1024-h829-no)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Teichhermelin on July 28, 2020, 09:37:13 pm
Is there a key for the service menu on a DSO5054A? Or is it just the hex code? :-/O
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: wp_wp on August 24, 2020, 07:03:08 am
The link of tools is not available now,can someone give a new link?Thank you.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on August 25, 2020, 02:53:32 pm
Not sure how many folks are using these scopes nowadays, but wanted to share a few notes on the serial decodes:

I have an MSO7104B, it remains my go to scope on the bench, despite having a number of other more modern and "more capable" scopes around. Why? It has the fastest and most usable UI, fast boot time, and a nice big telly too.

Note there's a limit on the SPI decode speed as well, it falls over at about 35MHz, spec is to 25MHz.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on August 26, 2020, 06:19:49 am
Same here with me. I have two 7000 series scopes and they are my favorite scopes every day.
The 6000X series scope is not used much.
 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: smetankin on September 16, 2020, 07:47:56 pm
Hi everyone. Wish to unlock 7k series scope, but can`t find jzp tools to Win based system.
Does anyone have this app? Tnx...
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on September 16, 2020, 09:41:42 pm
Hi everyone. Wish to unlock 7k series scope, but can`t find jzp tools to Win based system.
Does anyone have this app? Tnx...
Hello and welcome to the eevblog forum
The easiest way to unlock the 7000 series scope is through the service mode.
The detailed description is earlier in this thread.



Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: smetankin on September 17, 2020, 03:44:09 pm
I`m so unlucky?  :)

(http://i.piccy.info/i9/4e5882ce7ea818ba6ed9b87a99274005/1600357099/13146/1396697/155putty_500.jpg) (http://piccy.info/view3/13982967/0dd4184162caf6329038e18df888208f/)(http://i.piccy.info/a3/2020-09-17-15-38/i9-13982967/500x262-r/i.gif) (http://i.piccy.info/a3c/2020-09-17-15-38/i9-13982967/500x262-r)
(http://i.piccy.info/i9/5b1b8c05be0551aac98f72936ced2210/1600357119/28590/1396697/89015photo_2020_09_17_18_36_45_500.jpg) (http://piccy.info/view3/13982969/9db7e472f71924bff712612d5c62628f/)(http://i.piccy.info/a3/2020-09-17-15-38/i9-13982969/472x353-r/i.gif) (http://i.piccy.info/a3c/2020-09-17-15-38/i9-13982969/472x353-r)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Miek on September 17, 2020, 04:16:34 pm
Just in case anyone does still need it, I've got a copy of agltzip here: https://github.com/miek/agltzip (step back one commit for the original version)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Orange on September 17, 2020, 04:54:14 pm
Agilent JZP tools
Windows version 0.2


A set of tools for Agilent JZP compression format.
A well-known LZSS algorithm with custom header is used.

Compression speed is far from being optimal, compressing a 10MiB file takes around 1 minute on i7 machine, but it works :)
Bugfixed compressor produces same files as originals now.
Example:

unjzp sys.jzp sys.bin sys_rev.txt
packjzp sys.bin sys_new.jzp sys_rev.txt
sys_new.jzp will match sys.jzp exactly
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Orange on September 17, 2020, 06:51:06 pm
DSO 7000A/B firmware V6.16
Part 1


This is the patched version which allows you to enter the options without the key
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Orange on September 17, 2020, 06:51:50 pm
DSO 7000A/B firmware V6.16
Part 2


This is the patched version which allows you to enter the options without the key
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Orange on September 17, 2020, 07:14:22 pm
DSO 7000A/B firmware V6.20
Part 1


This is the patched version which allows you to enter the options without the key
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Orange on September 17, 2020, 07:15:10 pm
DSO 7000A/B firmware V6.20
Part 2


This is the patched version which allows you to enter the options without the key
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: smetankin on September 18, 2020, 08:24:26 pm
Orange, awesome, thanks a lot.  :-+
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: wp_wp on September 19, 2020, 10:26:58 am
Special thanks to Orange
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: wp_wp on September 19, 2020, 02:05:34 pm
I download the V7.31 file for Infiniivision 6000X from Keysight web.Based on this file,I modify something to hack DSOX6002A.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on September 20, 2020, 12:06:26 pm
I am still running the scope on FW 7 without any problems

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: wp_wp on September 20, 2020, 01:49:03 pm
It does not need telnet,it is just using a usb stick to hack a 6000X.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: wp_wp on September 25, 2020, 07:26:00 am
I extracted the ksx file of DSOX/MSOX6000A scope,I found the winCE kernel file is not comp file any more,it is nk.hth.
Maybe this file is encrypted by Symantec SHA256 algorithm,so I can't analyze it.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: TheSteve on September 25, 2020, 08:18:33 pm
Congrats - that is a very nice scope!
This thread deals with with the older generation of scopes though, the hacks mentioned don't apply the "X" series.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: wp_wp on September 26, 2020, 10:13:02 am
With my file,I helped some friends to hack their 6000X scope.

(http://[attachurl=1])
(http://[attachurl=2])
(http://[attachurl=3])
(http://[attachurl=4])
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: tv84 on October 04, 2020, 05:49:36 pm
With the help of abyrvalg here (https://www.eevblog.com/forum/testgear/re-enabling-options-on-an-agilent-dso81204a/msg3259836/#msg3259836) is the end to option patching also on these old scopes (5000/6000/7000).

The license format is:

FEATURE segmentedMem agilent 1.0 permanent uncounted 000000000000 HOSTID=ID_STRING=001122334455

where 001122334455 is your MAC address.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: abyrvalg on October 04, 2020, 08:08:06 pm
short name -> lmcrypt name:
Code: [Select]
ALL  all_licenses_on
REM remove_all_licenses
FMS factoryMso
MSO mso / mso_6000_low / mso_6000_high - depending on model
001 am1M / am1M_6000_low / am1M_6000_high
002 am2M / am2M_6000_low / am2M_6000_high
004 ...
008 ...
016
032
064
128
256
512
AMM amMax
FPG fpgaProbe
LSS lsSerDecode
AMS amSerDecode
CAN canTrigger
SEC secure - stay away!!!
BAT battery
ALT fpgaAltera
FRS frSerDecode
PWR power
232 232SerDecode
DSW distributor
SGM segmentedMem
LMT lmtMaskTest
TEL telMaskTest
1MV 1mvChanScale
FRC frCompliance
MST measStats
E00 enhance00
SND i2sSerDecode
FLX flxSerDecode
DIS distDemo
TOM tomoTherapy
553 1553SerDecode
CIR segCircular

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: swperk on October 08, 2020, 03:12:24 am
@Erik: Good job!

Does anyone know the meaning of the "Unsealed Instrument" warning? Does it affect operation of the scope in any way? What is it about the hack that makes the scope display this message, and is there any way to eliminate it?

Thanks,
Stan
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on October 08, 2020, 07:14:30 am
The 7000 series scope is very easy to be put in to service mode
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: VooDust on October 08, 2020, 09:11:41 am
So I can buy the 1 GHz edition and hack it to 6 GHz?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: HighVoltage on October 08, 2020, 10:05:08 am
The 6000 Series scope is my every day scope

Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: tv84 on October 08, 2020, 10:23:31 am
Does anyone know the meaning of the "Unsealed Instrument" warning? Does it affect operation of the scope in any way? What is it about the hack that makes the scope display this message, and is there any way to eliminate it?

Keysight protects the system by enabling a "seal flag" which prevents changes to the licensing, command line and other settings.

The hack that is public overrides that "seal" setting in a global way. By doing so, when the scope reads the status of the "seal" for any kind of operation, you get an unsealed setting and the change is allowed.

IMHO Keysight wanted to be sure that the config is "sealed" before shipping and, as such, developed that msg warning.

That state shouldn't create any harm unless people (or a bug) do operations that shouldn't be done that, in normal circumstances, would be barred by the "sealing".

BTW, all this talk about the X-models is OT in this thread!
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: wp_wp on October 09, 2020, 05:24:46 am
So I can buy the 1 GHz edition and hack it to 6 GHz?
The short answer is Yes,
I did that 2 year ago trough telnet and it seems that wp_wp found a way to do the same over USB
Thank you,HighVoltage.
I can hack infiniivision 2000X,3000X,3000T,4000X also.
I hack these scopes just with a USB stick,with one step.
 
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: wolfy007 on October 09, 2020, 06:21:59 am
Dont suppose this would work on DSO9000A series?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Keysight DanielBogdanoff on October 09, 2020, 03:37:24 pm
Dont suppose this would work on DSO9000A series?

Totally different operating systems.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: jjoonathan on October 09, 2020, 04:56:12 pm
(thread goes quiet)

If you don't move he can't see you!
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: wolfy007 on October 09, 2020, 05:33:31 pm
(thread goes quiet)

If you don't move he can't see you!

 :-DD

For me DSO9000A is EOL now, so I guess only way to upgrade it now is to hack it...   :-//
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: tv84 on October 09, 2020, 05:52:55 pm
For me DSO9000A is EOL now, so I guess only way to upgrade it now is to hack it...   :-//

9000/90000 is similar to 5000/6000/7000. What is the latest FW version?
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on October 09, 2020, 06:27:49 pm
For me DSO9000A is EOL now, so I guess only way to upgrade it now is to hack it...   :-//

9000/90000 is similar to 5000/6000/7000. What is the latest FW version?

Pretty sure 9000 is Windows 7 based, not vxWorks or WinCE.

Maybe this thread? https://www.eevblog.com/forum/testgear/exploring-the-secrets-of-agilent-9000h-series-scopes/ (https://www.eevblog.com/forum/testgear/exploring-the-secrets-of-agilent-9000h-series-scopes/)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: tv84 on October 09, 2020, 07:20:03 pm
https://www.keysight.com/main/editorial.jspx?cc=PT&lc=eng&ckey=1378160&nid=-32976.771275&id=1378160 (https://www.keysight.com/main/editorial.jspx?cc=PT&lc=eng&ckey=1378160&nid=-32976.771275&id=1378160)

The only thing WinCE on this thread is the OT stuff of the X-models. But when I said similar it because of the flexlm licensing system.
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: Howardlong on October 09, 2020, 07:26:44 pm
As are the 8000, 80000 and 5483x.

Sorry, I was only trying to give you a subtle hint as to where you might find an answer to your question ;-)
Title: Re: Agilent MSO 5000/6000/7000 - anyone hacked these scopes?
Post by: tv84 on October 09, 2020, 08:10:32 pm
But I think this (https://www.eevblog.com/forum/testgear/re-enabling-options-on-an-agilent-dso81204a/msg3259836/#msg3259836) doesn't work with the 9000.