IDA can open it!
def ApplyVxSymbol(ea):
unk0 = Dword(ea)
name_ea = Dword(ea+4)
target_ea = Dword(ea+8)
flags = Dword(ea+12)
if flags==0x300: # external symbol
return
if isTail(GetFlags(target_ea)):
MakeUnkn(ItemHead(target_ea), DOUNK_EXPAND)
MakeName(target_ea, GetString(name_ea))
if flags==0x500: # code symbol
MakeFunction(target_ea)
elif flags==0x700: # initialized data
pass
elif flags==0x900: # uninitialized data
pass
else:
print "%08X: unknown symbol type %08X" % (ea, flags)
def ApplyVxSymbols(ea, count):
for i in xrange(count):
ApplyVxSymbol(ea+i*16)
The one I have is about 25% bigger - It was on the mso software updates page along with the first update, but disappeared a while later.
Is this the "Emergency" update file?
http://www.home.agilent.com/agilent/editorial.jspx?ckey=670496&id=670496&lc=eng&cc=US (http://www.home.agilent.com/agilent/editorial.jspx?ckey=670496&id=670496&lc=eng&cc=US)
On my MSO7104a, telnet sits on port 5810, and spawns a standard VxWorks shell. Same login as ftp.No response from my MSO6034a on that port.
This shell gives complete read/write access to memory, symbol tables, processes, filesystem, etc.
At least we know that the 5000 and 6000 can be induced to boot from the USB by switching on and off once (per the web site), and perhaps the BIN can be modified to spawn the telnetd to listen, if it's not already (or perhaps the emergency binary has it enabled).Yes, I think it's more than likely. But before we need the abyrvalg's LZSS decompressor, to extract the ELF.
mikeselectricstuff, 6k ports (as seen in "emergency" 6k bin): 5024 - telnetThat seems to work I get a "Welcome to Agilent MSO6034A" and >> prompt
Mike,That would make sense - didn't try any SCPI commands but the error message on the scope screen would tally with that - will try port scan when I get a chance
Could that be the LXI port? Do SCPI commands work? Do you get that just by connecting, or do you have to enter the login and password?
Have you tried scanning the ports for another telnet protocol port?
Once you have a VxWorks shell, you should get some info by typing "help", but this doesn't seem to behave like the shell.
This shell gives complete read/write access to memory, symbol tables, processes, filesystem, etc.Is there something like this?
JZP LZSS unpacker with sources (https://bitbucket.org/flowswitch/agltzip)Good job, the JZP LZSS unpacker works perfectly, thank you very much. :-+
This shell gives complete read/write access to memory, symbol tables, processes, filesystem, etc.Is there something like this?
/bin/license.lic
Yes, exactly.Well, I don't know how but I think the hack will be a cinch.
Mike,Port scan gives
I've just looked into the newest 6k binary and telnet port is same there - 5024. Are you 100% sure you've tried 5024, not 5042 ocassionally?
help Print this list
dbgHelp Print debugger help info
edrHelp Print ED&R help info
ioHelp Print I/O utilities help info
nfsHelp Print nfs help info
netHelp Print network help info
rtpHelp Print process help info
spyHelp Print task histogrammer help info
timexHelp Print execution timer help info
h [n] Print (or set) shell history
i [task] Summary of tasks' TCBs
ti task Complete info on TCB for task
sp adr,args... Spawn a task, pri=100, opt=0x19, stk=20000
taskSpawn name,pri,opt,stk,adr,args... Spawn a task
td task Delete a task
ts task Suspend a task
tr task Resume a task
tw task Print pending task detailed info
w [task] Print pending task info
Type <CR> to continue, Q<CR> to stop:
d [adr[,nunits[,width]]] Display memory
m adr[,width] Modify memory
mRegs [reg[,task]] Modify a task's registers interactively
pc [task] Return task's program counter
iam "user"[,"passwd"] Set user name and passwd
whoami Print user name
devs List devices
ld [syms[,noAbort][,"name"]] Load stdin, or file, into memory
(syms = add symbols to table:
-1 = none, 0 = globals, 1 = all)
lkup ["substr"] List symbols in system symbol table
lkAddr address List symbol table entries near address
checkStack [task] List task stack sizes and usage
printErrno value Print the name of a status value
period secs,adr,args... Spawn task to call function periodically
repeat n,adr,args... Spawn task to call function n times (0=forever)
version Print VxWorks version info, and boot line
shConfig ["config"] Display or set shell configuration variables
strFree [address] Free strings allocated within the shell (-1=all)
-> version
VxWorks (for Agilent KOM PPC405, SA27E rev1) version 6.4.
Kernel: WIND version 2.10.
Made on Jun 30 2010, 11:33:12.
Boot line:
tffs;usb(0,0):sys6000 f=0x8 tn=a-m6034a-001360 o=emac0
value = 66 = 0x42 = 'B'
I think that SEC is not available as a trial.No, but I don't think we're talking about trials here, are we... 8)
Port scan givesGreat! 8)
21/tcp open ftp
80/tcp open http
111/tcp open rpcbind
1024/tcp open kdm
5810/tcp open unknown
5900/tcp open vnc
Port 5024 via Telnet accepts SCPI commands
Port 5810 gives vxworks login, user panther/ pw pictures works, looks a bit low-level though
Port 5810 gives vxworks login, user panther/ pw pictures works, looks a bit low-level thoughGreat, so that's the same as the 7000. The shell does have low-level capabilities in that it will allow memory reading and modification, but also allows high-level unix-like commands as well. You are starting out in the C interpreter mode. There is a more unix-y flavored mode which you can get to by typing "cmd" at the prompt, and you will get a hash prompt to indicate the cmd mode. Type "help" and you will get a more compact list of commands; similar capabilities. You can get back to the c-interpreter mode by typing "C".
Now JZP->BIN->JZP...Wow, that was fast! :clap:
N5423A I2C AND SPI SERIAL BUS Decode and Triggering.
N5424A CAN AND LIN SERIAL Decode and Triggering.
N5457A RS232/UART SERIAL Decode and Triggering.
N5455A Limit Mask Testing.
N5454A SEGMENTED MEMORY.
N5468A I2S Decode and Triggering.
N5469A Mil-Std 1553 Decode and Triggering.
N5432C FlexRay Decode and Trigger.
N5406A DYNAMIC PROBE APPLICATION FOR XILINX.
U1881A Power measurement application.
N5434A FPGA DYNAMIC PROBE FOR ALTERA. [OBSOLETE]
N2914A DSO to MSO upgrade.
N2911A 8 Mpts memory upgrade.
Note: E00 and MST (N5466A) are now standard.
if you need keys : i have a bunch enabled in mine (MSO7104A)They live in the bin\licence.lic file - Telnet in with user:panther pw:pictures
if there is a way through the LAN to grab them please explain how to do it. i will dump them and post. it could be of help
i have i2c , segmented memory , max memory and a few other.
Is there an interesting debug mode?
set deploy Set or display the system debug flag.
..
[vxWorks]# set deploy
The system policy mode is set to 'field' (deployed mode is on).
[vxWorks]#
set bootline Change the boot lineMaybe possible to change boot order?
show bootline Display the boot line
show bootline
boot device : tffs;usb
A few things of possible interest poking around the vxworks consoleQuoteIs there an interesting debug mode?
set deploy Set or display the system debug flag.
..
[vxWorks]# set deploy
The system policy mode is set to 'field' (deployed mode is on).
[vxWorks]#Quoteset bootline Change the boot lineMaybe possible to change boot order?
show bootline Display the boot line
show bootline
boot device : tffs;usb
Can you clarify - if I put a .(hacked) .jzp file on a USB stick, will it boot from that at startup, or install it ?Yes, exactly. Just like the original .jzp, if you preserve the header text when you unjzp and restore it when you packjzp (by specifying a file to store/retrieve it from).
I'll clarify a bit:
To boot you need to enter "emergency" mode first - turn off, turn on for 4sec, turn off, then turn on with USB stick inserted as described here http://www.home.agilent.com/agilent/redirector.jspx?action=ref&lc=eng&nfr=&ckey=670496&cname=AGILENT_EDITORIAL (http://www.home.agilent.com/agilent/redirector.jspx?action=ref&lc=eng&nfr=&ckey=670496&cname=AGILENT_EDITORIAL)
For 6k series you need to have both BIN and JZP on USB stick (or even BIN only, seems that some or all 6k bootloader versions doesn't understand JZP, unlike 7k that understands JZP only).
For a permanent install you need to do it manually, so if you want just to try some bin - boot it from USB, but don't touch any JZP in scope's File explorer (that's where install is performed).
OK I've just found the first new thing I can do that wasn't possible with trials - CIR option for circular segmented memory.There are references to this and other options in the sys6000.bin.
Front-end is obviously different from the 6034. Interestingly the trigger channel uses the same front-end as the analogue channels.@mikeselectricstuff: Thanks for the pictures. :)
Carrington, there are even bigger memories...I get it. ;) 48LC8M16A for example.
There are no bandwith options to enable with keys...But, Agilent use the same the input stages for 300 and 500MHz models?
There are some NV capabilities flags programmed from factory also (one of them limits decoders usage on 2CH models).8)
I am aware that you can enable all the options and then set back the clock to keep these options enabled indefinitely. That's certainly livable. However, that's not a pretty solution, and it's nice to have the clock set properly for screen shots, etc.
The trials have a fixed expiry date 14 days from when they were issuedI am aware that you can enable all the options and then set back the clock to keep these options enabled indefinitely. That's certainly livable. However, that's not a pretty solution, and it's nice to have the clock set properly for screen shots, etc.
This text just hit my eyeballs. Can't you set date to 12.1.2037 then apply options and roll back to current date? Then your screen shots would be correct etc. (2037 because Unix epoch is 1.19.2038.)
The only thing remaining is to see if the decoders can be made to work on 2-channel modelsA flash dump could be very useful. And even better two dumps from two different models, 2 and 4 channel for example.
That is flash memory. J2400 looks intriguiing...Ok, you are referring to the J2400 connector. Yes, it can be the FPGA JTAG connector.
There is no need to open the scope at all to read the flash. Just telnet to VxWorks debug console and dump the uppermost memory addresses:That's great! I did not know that.
FFF00000-FFFFFFFF - bootloader
FFEF0000-FFF00000 - NV area:
FFEF0000 [7] - MAC address
FFEF0020 [2] - "feature register" (SEC option flag)
the rest (before FFEF0000) should be a C:\ file system
It should be possible to program flash from debug console too - by invoking the programming function with "sp" command, but this can brick the scope easily, so better I'll not publish a detailed instruction until there will be some clear plan what and where to program.
IMO, there is no need for raw flash access at current stage. The bootloader part is much more obscure to work with (there is no symbol table), all interesting stuff is in sys part, really no idea what to look outside JZPs now.I thought about flash dumps from two different model, specially due to the content of gpInstOptions, because it is everywhere in the firmware.
Changing the model type in NV will not work - Mike had tried my patch that sets 4CH flag in RAM and the scope just hung, so the only hope is some fine grained compatibility check patch in sys.Is that flag related to gpInstOptions?
The other interesting direction is C:\bin\CmdLine.cmd file - it is not present by default, but it is possible to specify several parameters to sys in it (i.e. there are parameters to enable each feature w/o key - can be more handy than patching sys because they will stay there after updates), look for hasOption() calls.This also is great!
That sample rate hack doesn't improve bandwidth
Attatched pics show a 250-750MHz stepped sweep before & after - no difference.
Sample rate on digital channels appears to still be 2Gs/s
My (early s/n 440013xx MSO6034A) didn't seem to work with the soft-loading method - appeared to go through the normal process of sitting a while with the "Single" LED on, but instead of booting the new FW it just sits there lighting up lines of the front panel LEDs til you pull the USB stick, at which point it reboots.
Hacked FW loads to flash OK though - it was only after loading I suddenly thought that without the soft-load capability, how would I recover if it hung, but I think that "emergency" update file is what that is for. I did try loading that version but again it sat in a led-flashy loop.
Think I'll stay away from playing with that scope - I still have a more recent MSO6012A to play on.
I wonder if the sample rate hack will improve sample rate on digital channels on that...?
That sample rate hack doesn't improve bandwidthI feared that, thanks for check it. This afternoon I will try to dumping all the internal memory, to investigate this.
Attatched pics show a 250-750MHz stepped sweep before & after - no difference.
My (early s/n 440013xx MSO6034A) didn't seem to work with the soft-loading method - appeared to go through the normal process of sitting a while with the "Single" LED on, but instead of booting the new FW it just sits there lighting up lines of the front panel LEDs til you pull the USB stick, at which point it reboots.I don't think that I can do anything about it. :-//
Hacked FW loads to flash OK though - it was only after loading I suddenly thought that without the soft-load capability, how would I recover if it hung, but I think that "emergency" update file is what that is for. I did try loading that version but again it sat in a led-flashy loop.
Think I'll stay away from playing with that scope - I still have a more recent MSO6012A to play on.
When I get time I'll see if the digital channels are improved.No, this improvement is only for 1GHz models [MSO610*A MSO710*A].
I wonder if the sample rate hack will improve sample rate on digital channels on that...?
My (early s/n 440013xx MSO6034A) didn't seem to work with the soft-loading method - appeared to go through the normal process of sitting a while with the "Single" LED on, but instead of booting the new FW it just sits there lighting up lines of the front panel LEDs til you pull the USB stick, at which point it reboots.Interesting. Does it do that with the original sys6000.jzp, or only the hacked one?
Looks like a plain uncompressed .bin is required for some older 6ks (see 6k emergency procedure description - it says put BOTH bin and jzp to USB stick).Possibly - boot version is 01.10 BTW
Thanks to Carrington's enthusiasm we had identified the real source of BW/channels/MSO capabilities bits: they are read from Xilinx FPGA (internal name "Nevada", graphics controller) register. The availability of this value prior to any serious hw init suggests something simple like strapping resistors. So we ask everybody interested in this "project": please share hi res pictures of board area around FPGA. A 32-bit value at address 0xF6000004 (that is capabilities reg) is also interesting.Interesting - there is a Xilinx flash config PROM - presumably the stream in that file is to reprogram the flash.
This value doesn't come from different FPGA bitstreams, the bitstream is same for entire family: it is in gspXXXX.jzp file.
A 32-bit value at address 0xF6000004 (that is capabilities reg) is also interesting.This value can be get with this command from vxWorks console (cmd mode):
Interesting - there is a Xilinx flash config PROM - presumably the stream in that file is to reprogram the flash.Thanks for the picture.
Here is a pic of the MSO6012A, Resistor at bottom-left corner looks a lot like a pullup/pulldown option
Just did some probing - though it looks like the resistor nearest the FPGA is an option, alternating with the empty pads to the left of it, measurements seem contradict this. (Unless it reads the pin and then outputs a low - not sure why you'd do that unless it's doubling as a debug output.I dont know but I think worth trying.
Will compare to my mso6034a later before investigating further
Another possibility - I wonder if maybe the FPGA prom has a default config, but then gets reloaded once the system boots. Probably wouldn't be too hard to check by probing (with another scope of course!)
Carrington, try setting "service mode" combined with something like "all lics" in that service menu. There are some functions that adds such command line parameters, and almost all of them require "srv" param to be present too.Yes, a lots of demo modes (Update rate, MSO, Serial Buses, Data Bursts and Mask Test).
16 defines some cool model with external serial keyboard instead of normal panel buttons.I can't immediately find details but they did announce a "headless" version of this scope for ATE etc., which was the mainboard in a rackmount case with no keyboard or display.
The L versions maybe (DSO/MSO6***L)?16 defines some cool model with external serial keyboard instead of normal panel buttons.I can't immediately find details but they did announce a "headless" version of this scope for ATE etc., which was the mainboard in a rackmount case with no keyboard or display.
Not sure if it ever actually appeared, but chances are there could be some support for it
Yes, a lot of demo modes (updatr rate, MSO, serial bus table, ...).
Yes, all remain.Yes, a lot of demo modes (updatr rate, MSO, serial bus table, ...).
Oops, I didn't finished my thought: try setting service mode with some lic feature, then reboot - it should persist, if I understood that part correctly.
Good! So it's unnessesary to keep patched sys to have features enabled.But if the service mode is disabled some of this options disappear.
Do we know what 1MV actually does?Good! So it's unnessesary to keep patched sys to have features enabled.But if the service mode is disabled some of this options disappear.
But this is not a problem, we just have to leaving active the service menu.
However, I prefer the patch, with non-default options: CIR, 1MV, ...
Do we know what 1MV actually does?Yes, it is a magnification of 5mV/div, no real range.
I assume that's only on the higher bandwidth models - my MSO6012A does 1mV as standardDo we know what 1MV actually does?Yes, it is a magnification of 5mV/div, no real range.
I assume that's only on the higher bandwidth models - my MSO6012A does 1mV as standardYes, but for 100MHz models 1mV/div is a magnification of 2mV/div.
When I get time I'll see if the digital channels are improved.No, this improvement is only for 1GHz models [MSO610*A MSO710*A].
I wonder if the sample rate hack will improve sample rate on digital channels on that...?
All this is very interesting indeed. I'm temporarily unable to access my scope or my home computer for a few more days, so I'm unable to join in the fun at the moment, except vicariously.MSO is a purely software option as the hardware is the same for a DSOxxxx and MSOxxxx
I thought the MSO can be enabled/disabled purely in firmware via the license (or service mode/command line switch). What happens to the FPGA register when the MSO option is added/removed?
I thought the MSO can be enabled/disabled purely in firmware via the license (or service mode/command line switch). What happens to the FPGA register when the MSO option is added/removed?I would have to check it in the code, but probably nothing.
The only thing that wouldn't have MSO is a 5000 - though this may be indicated by an build option link.I thought the MSO can be enabled/disabled purely in firmware via the license (or service mode/command line switch). What happens to the FPGA register when the MSO option is added/removed?I would have to check it in the code, but probably nothing.
It's simple, double check.
FPGA indicates MSO? Not.
MSO is enabled by a license? Yes. -> MSO enabled.
FPGA indicates MSO? Not.
MSO is enabled by a license? Yes. -> MSO enabled.
The code proves the opposite: you need to have fpga mso bit set AND some mso feature (FMS/MSO) installed to have MSO. So no fpga mso bit set -> no MSO.Thanks for clarifying, because now I have no need to review the code. :)
If you can, please check this:These just seem to be a way to fix the control lines of 2 analogue switches - one changes at the same time as the 200-500mV relay, didn't see the other change but the switch has what looks like a bias connected with Y shift on it.
(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=81520;image)
mikeselecricstuff, can you please post 6012 board picture? How does it's original resistor combination look?Already did :
These just seem to be a way to fix the control lines of 2 analogue switches - one changes at the same time as the 200-500mV relay, didn't see the other change but the switch has what looks like a bias connected with Y shift on it.Damn, I thought that it could be what we seek.
Please, correct me if you think that I'm wrong, but I think that little more can be done.
Well, all what we have achieved is quite good.
Special thanks to abyrvalg, without your support all efforts have been in vain.
Also to mikeselectricstuff, chiefly by having the courage to make the hardware tests.
Thanks also to dfnr2 for their collaboration.
Great job guys. :-+
| MODEL X1 X0 ------------------- 6032 0 0 6102 0 1 6034 1 0 6104 1 1 |
Try removing that other resistor connected to X0. There must be 4 combinations for BW field.Do you think that it have an internal "momentary" pull down, or something like that?
I can try DeBIT'ing the bitstream, but this will be "cannon against sparrows" as we say here :DLOL...
This look very interesting XCF04S:Yes - this is where the FPGA code lives. I assume they use this rather than soft-loading so there's a display at startup. When reprogramming (gsp6000.jzp) it shows a red "not power off "message - my guess is at the very least it would leave you with no display, maybe even unrecoverable if teh FPGA does other critical stuff, though you could probably program it via JTAG by copying from another scope.
Yes - this is where the FPGA code lives. I assume they use this rather than soft-loading so there's a display at startup. When reprogramming (gsp6000.jzp) it shows a red "not power off "message - my guess is at the very least it would leave you with no display, maybe even unrecoverable if teh FPGA does other critical stuff, though you could probably program it via JTAG by copying from another scope.Yes, I think so too.
You'd normally have the config memory and FPGA on the JTAG, but maybe also the main CPU. It could also be that the memory has a dedicated programming connector - I'm not too familar with the Xilinx confg devices.Yes - this is where the FPGA code lives. I assume they use this rather than soft-loading so there's a display at startup. When reprogramming (gsp6000.jzp) it shows a red "not power off "message - my guess is at the very least it would leave you with no display, maybe even unrecoverable if teh FPGA does other critical stuff, though you could probably program it via JTAG by copying from another scope.Yes, I think so too.
Seems that there something more connected to this JTAG connector, but I only can read this identifier 05046093h (XCF04S).
You'd normally have the config memory and FPGA on the JTAG, but maybe also the main CPU. It could also be that the memory has a dedicated programming connector - I'm not too familar with the Xilinx confg devices.Surely XCF04S and FPGA share the same JTAG connector. But like you, I'm not familiar with this configuration. Anyway, I fear that investigate here, will be a waste of time.
I think we really need to see inside a 605x!Definitely, yes.
FPGA PROM JTAG header should be connected in parallel with main CPU. I mean not including the CPU into the scan chain, but CPU being a JTAG master (it's CPU who programs that PROM normally). The PROM contents can be obtained from gspXXXX.jzp - it's just a compressed XSVF file.Yes, the JTAG connector seem to be connected to the CPU too.
We have a 6012 that must have some difference from both 6034/6104 (from FPGA's point of view), so:Right now this, to me, is a mystery.
1. carefully comparing 6034 board to 6012 can give some clue (there must be some other FPGA input that differs)
2. if 4 possible BW codes are defined as 4 combinations of just 2 FPGA inputs, we know a resistor that defines one bit (3rd from the left, changing 300M/1G), then 6012 should have that yet unknown second input in a state inverted relative to 6034/6104, so inverting ONLY our known 300M/1G input should convert 6012 to 6052.
Having just made it through the thread I was preparing to update my DSO5014A with the latest firmware from the Agilent site (06.16.0001) and opted out of curiosity to check what version was actually on there in the first place:Yes. Open a telnet:
System Version: 06.17.0001
Soooo... Does an update .jzp get copied and remain on the scope during an update? (Put another way, is there any way to archive this version?)
[...]Telnet [Your IP] 5810[...]
We have a 6012 that must have some difference from both 6034/6104 (from FPGA's point of view), so:Pretty sure - after a while it went to a mode cycling a few rows of LEDs.
1. carefully comparing 6034 board to 6012 can give some clue (there must be some other FPGA input that differs)
2. if 4 possible BW codes are defined as 4 combinations of just 2 FPGA inputs, we know a resistor that defines one bit (3rd from the left, changing 300M/1G), then 6012 should have that yet unknown second input in a state inverted relative to 6034/6104, so inverting ONLY our known 300M/1G input should convert 6012 to 6052.
mikeselectricstuff, are you 100% sure that 6012 hangs with both left and right resistors present? This can be critical. For example if you had something wrong with left resistor when testing this combination, the scope would hang just because of 4CH mode activated. Even if it hangs, trying telnet can still work (there is multitasking OS inside), so examining F6000004 value still can be possible.
FPGA PROM JTAG header should be connected in parallel with main CPU. I mean not including the CPU into the scan chain, but CPU being a JTAG master (it's CPU who programs that PROM normally). The PROM contents can be obtained from gspXXXX.jzp - it's just a compressed XSVF file.
Another possibility is the 603x/5x front-end hybrids could be graded, and have an indicator pin to indicate type, but an additional link would seem to be more likely.I don't know, could be.
Have you found anything in software to indicate where it's looking for?
It's hard to say anything about pins based on this: definitely these bits doesn't reflect pins states directly (note changing center right resistor results in 2 or 8 value in 3..0), must be some binary to one-hot decoders. I can try bitstream decompiler next week (I'm away from my bigger PCs now), but that Spartan-3 device is pretty huge.Are you sure? That will be a nightmare...
First is F6000000 register value (0, not 4, this is hardcoded bitstream revision reg) - this can help identifying register bus in general, second is our left/right resistors FPGA pin locations (there are vias to all FPGA pins on the back board side, so a quick sweep with a DMM beeper can identify both pins) - these should lead to straps sensing logic directly.1. mem dump -n 1 -w 8 0xF6000000 -> 0x02b4141300000262.
Another interesting possibility is obtaining different models FPGA pins snapshots with JTAG SAMPLE instruction, then comparing. Sure, there will be many dynamic pins, but they can be filtered out by taking many dumps on the same model and ruling out all changes. This can be hard if done by hand, but pretty easy if programmed.I tried that with TOPJTAG Probe, but it only find the XCF04S, no the FPGA.
Excellent! The pins are close to each other, check nearby signals (Y3, W1-W4) - where do they go? This can be much easier than decompiling :)Possibly on that MICTOR connector?
Decompilation shouldn't be so hard - we don't need entire design in Verilog, just identifiing pins that feed the same piece of logic that our known pins do should be enough.
So that JTAG header is dedicated PROM programming connector. Perhaps there is some debug header that goes to FPGA's JTAG?
It's possible (although... insane?) that the FPGA JTAG isn't broken out.
The FPGA pins TMS, TDI and TDO are not directly accessible (no via).No via, but this pins have a PAD, I don't know if that's what you mean.
Well they'll have a pad for mechanical/soldering reasons - they don't have to be attached to anything else on the board. I meant "broken out" as in "going to a header".Ok, now I understand, but, no idea.
Is J2600 near the flash the JTAG for the FPGA/flash?J2600 appears to be only for the flash, but it is also connected to the CPU (at least TCK).
I seem to recall the platform flash can be programmed directly via JTAG.I don't know...
Isn't the config flash chained up with the FPGA JTAG?Apparently not...
In theory if everything was debugged on some special debug board, then there is no reason to have that jtag accessible on production version. Just route PROM's jtag to a header for initial/repair programming and to the CPU for regular updates (as I wrote before, CPU uses simple GPIO bitbang XSVF player to update that PROM).Well that's what it seems they did.
The FPGA JTAG pins are all on the outside edge of the part, so as long as they haven't been grounded, you could possibly insert pin probes at the edge of the FPGA and connect to the JTAG, whether they've been brought to vias or not. Some very fine jig work would be required though.Good idea, you're right. I'll try. :-+
The FPGA JTAG pins are all on the outside edge of the part, so as long as they haven't been grounded, you could possibly insert pin probes at the edge of the FPGA and connect to the JTAG, whether they've been brought to vias or not. Some very fine jig work would be required though.Good idea, you're right. I'll try. :-+
First, I will try to "make" a probe, to do that.
I leave it for today.
Cheers.
I have to agree, it would be stupid not to wire up the FPGA JTAG. It's easy to confirm if the JTAG pins are chained up with the FPGA or not, just measure from the XCF pins to J2600. Perhaps there's a config bit that makes the FPGA JTAG a passthrough? If it became a passthrough it wouldn't show up in the chain.
..or at least use to find where JTAG pins are brought out.
I can't believe they wouldn't have put JTAG somewhere accessible - there's a Mictor trace connector (probably not fitted on later models), and it could be that the JTAG chain passes through other chips, but I'd be highly surprised if it wasn't there - there's just no way anyone would leave such an important interface off such a complex board.
The FPGA JTAG pins are all on the outside edge of the part, so as long as they haven't been grounded, you could possibly insert pin probes at the edge of the FPGA and connect to the JTAG, whether they've been brought to vias or not. Some very fine jig work would be required though.
I think that the Mictor connector is mounted, because add it manually later must be hard.This connector is probably only for software development/debug - I've only seen it fitted on my early 6034, not on later 6012 or 6034.
This connector is probably only for software development/debug - I've only seen it fitted on my early 6034, not on later 6012 or 6034.Probably.
Also seems that the front end is controlled only by the CPU (at least a part).
Do you see any direct CPU-frontend traces there?Yes, some traces go straight from the CPU to the 74ACT174s.
From sw side it looks more like all channel hw is controlled throught "Ponderosa" chips (ASICs closer to CPU). ADC ("Talon") control paths are seen as long serial shift registers chains attached to Ponderosas.Surely also uses "Ponderosa".
Talons looks same for all BW options, there is a calibration function that temporary configures them to maximum sample rate regardless of model, takes some measurements, then sets back to model-defined values.Interesting...
So BW limiting should happen somewhere in the frontend.I also think so.
Maybe we should measure and compare levels on 1NB7 pins of 6034 and 6012?Unfortunately the 6012 does not use the 1NB7. The 1NB7-8453 is mounted on the 603*s, 605*s and probably on the 610*.
MSO/DSO601xA/603xA: 2 GSa/sec each channel
MSO/DSO605xA/610xA: 4 GSa/sec half channel*, 2 GSa/sec each channel
....
* Half channel is when only one of channel 1 or 2 is turned on, and only channel 3 or 4 is turned on.
From sw side most (or all?) analog side parameters are controlled by a set of virtual "registers" that can be dumped with dumpRegValues console command. Physical implementations of those regs varies: DACs inside Ponderosas (gains, offsets,...), latches on CPU GPIOs (relays, some other signals - must be those 74ACT174s), some serial shift register on CPU GPIO, several regs in FPGA (calibration signal generator).I have to try that. It must be a long string of "0" and "1". :scared:
100MHz models have significantly different register set - more Ponderosa DACs, some small "Scorpion preamplifier" chip controlled by CPU GPIOs, while all higher models use some big "Rattler" chip replacing both "Scorpion" and many Ponderosa internal DACs.It's amazing how you handle the SW. :)
Conclusion: FPGA has little control over analog side, so try faking F6000004 reg value directly:First I have to re-mount the oscilloscope, now is completely disassembled. PSU, display, fan, ...
20BE10: 83 C9 00 04 -> 3B C0 xx xx
where xxxx - lower 16 bytes of desired F6000004 value (see my previous post on that reg). Dump your original value, take lower 4 nibbles, edit lowest nibble to change BW option.
Another interesting thing: looks like entire serial decoding is done in FPGA, but based on our patch failures I guess FPGA disables all this functionality based on "center left" resistor that defines number of channels.Then there's nothing to do (for now), because the oscilloscope hangs when nonexistent channels are enabled.
This would suggest that on both the 6054 and the 6104, it uses the whole ADC, and maybe both input amps for one channel instead of muxing it between 2 channels.Yes, both models use the whole ADQ ASIC for one of the inputs.
I suspect that the omitted, bypassed, relay on the 6034 is to connect the two inputs together to feed into the two parallel channels. Would be pretty easy to check this.I can't find the connection between stages. I think that this is done internally in the ADC, ie the two ADCs (within the ASIC) get sampled from only one of the inputs.
I think this means that you're probably more likely to be able to upgrade a 6054 to a 6104 than a 6034 to a 6054.We need to see inside of an 605*.
However I expect the 6054 and 6104 differ mostly by the frontend - really looking forward to seeing Tesla500's 6104 pics - make sure you look under those cans (assuming they haven;t soldered them for 1GHz!)I hope that the 605* use the 1NB7-8453.
Then there's nothing to do (for now), because the oscilloscope hangs when nonexistent channels are enabled.
Then there's nothing to do (for now), because the oscilloscope hangs when nonexistent channels are enabled.
I have an idea: set 2CH model to 4CH with resistor, but patch F6000004 read to report 2CH to sw, so FPGA will not disable decoders (if there was any real disable), but sw will not try to access nonexisting channels. If this config will work, then probably a more fine-grained patch (enable decoders, but keep 2CH mode) will work.
I think that extra ASIC in the middle is "Rattler" device I've mentioned already. From sw side it looks quite big (tens DACs controlling gain, offset, hysteresys, flatness of each channel), it's control interface is connected to master "Ponderosa" (twin ASICs closer to CPU, each serving 2 channels) and it is single, shared between all channels.
"Rattler" is present on all models with BW>100MHz regardless of channels.
latcha 0x30 0x70 0x70 0x30
latchb 0x7c 0x78 0x78 0x7c
rattler0 0x168 0x80 0x80 0x168
rattler1 0xc0 0x100 0x100 0xe0
rattler2 0xf8 0xc8 0xc8 0xf8 <-
rattler3 0x104 0xc8 0xba 0xfc
rattler4 0xbe 0x92 0x94 0xaa
rattler5 0000 0000 0000 0000
rattler6 0x179 0x11 0x39 0x1cf
rattler7 0x1c0 0x11d 0x125 0x1c0
offset 0x01feef 0x01ff5e 0x0204d9 0x01fee4
level ext 0x7fe0
pod thresh 0x5f10 0x6dc0
ti ramp adj 0xb813 <-
hamster0 00
hamster1 0x4
hamster2 0xf3
hamster3 00
hamster iramp 0x800
probe 0x8000 0x8000 0x8000 0x8000
value = 10 = 0xalatcha 0x30 0x70 0x70 0x30
latchb 0x7c 0x78 0x78 0x7c
rattler0 0x168 0x80 0x80 0x168
rattler1 0xc0 0x100 0x100 0xe0
rattler2 0x140 0x148 0x148 0x140 <-
rattler3 0x104 0xc8 0xba 0xfc
rattler4 0xbe 0x92 0x94 0xaa
rattler5 0000 0000 0000 0000
rattler6 0x179 0x11 0x39 0x1cf
rattler7 0x1c0 0x11d 0x125 0x1c0
offset 0x01feef 0x01ff5e 0x0204d9 0x01fee4
level ext 0x7fe0
pod thresh 0x5f10 0x6dc0
ti ramp adj 0xb7c4 <-
hamster0 00
hamster1 0x4
hamster2 0xf3
hamster3 00
hamster iramp 0x800
probe 0x8000 0x8000 0x8000 0x8000
value = 10 = 0xa"rattler2" regs are "Gain Vernier" DACs.Well, it's the only thing that changes in these records. :-//
I think there is no point trying to send something on CPU-1NB7 link: the CPU is already cheated with our patch, so it must send correct values w/o any further intervention (unless there is some other limit setting). The problem must be in some other place: either in FPGA or some hardwired 1NB7 pins.Sure! But the above test also shows that the original firmware (MSO6034A) does not send the same command to set full BW, but the only change is one bit.
Is there some BW limit setting in scope's UI ? I mean some normal parameter like gain/offset to filter out undesired frequencies (I see some UI-related functions with names like setChanBwLimit).Yes, to my knowledge the only is BW limit, that sets a maximum frequency of 25MHz.
Perhaps something in UI needs to be adjusted after BW patch?I don't know.
Another quiestion is probes - are they suitable for that higher frequency? Are they just simple cable/connector/matching?The default probes are of 500MHz . And has a x10 identifier pin, but nothing more.
I see names mentioning "ProbeId" - no way to detect that probe is wrong and limit BW here?Yes, some probes do this, but I don't have any of those.
Bad news about DeBIT: it's support for Spartan3 is very basic, I see no IOs in it's output at all :(A shame. :(
It's a great idea!
But I can't prove it, because is necessary a DSO/MSO6**2A.
I just have a MSO6034A, and mikeselectricstuff has put on sale his 6012A.
If anyone with an DSO/MSO6**2A wants to try, I can prepare the firmware.
Hello everyone, I am following the nice achievements in this forum for a while, but paractically this is my first post.Hi, welcome to the EEvblog forum.
As I purchased the MSO6012A from mikeselectricstuff if there is anything I can help with, for example the quoted test I'll be glad to help.
I have an MSO7104A that I successfully applied the telnet service menu hack to. Would pictures of its mainboard be of any use?Thank you so much, they may be worth, to check differences between 7104 and 6104 (tesla500).
If you want to try is so simple:Got the MSO6012A today, played with it a little and already downloaded the sys6000.jzp.
1. Download this tool: https://bitbucket.org/flowswitch/agltzip/get/84418d8ae30f.zip (https://bitbucket.org/flowswitch/agltzip/get/84418d8ae30f.zip) (courtesy of abyrvalg).
2. Extract the binary file from sys6000.jzp.
3. In the binary file at 0x0020BE10 reemplace this 83 C9 00 04 by 3B C0 02 61 (using a hex editor).
4. Compress the new sys6000.bin to sys6000.jzp.
5. Install the patched firmware.
6. Set 2CH model to 4CH with resistor, X1 = '1' (remove R2).
Please note that there is no guarantee that this will work.
As mikeselectricstuff already discovered:
MODEL X1 X0
-------------------
6032 0 0
6102 0 1
6034 1 0
6104 1 1
X1 = Nº Channels.
X0 = BW.
Just tried changing the links on MSO6012A- all permutations other then original make it hang.
On restore I get an error message saying setup defaulted due to A/D error -presumably accessing nonexistent CH3/4 hardware
So there must be another resistor in BW group to make missing x01x, x05x models. 6012 board should show it.
Sad that 03->10 doesn't change BW, but maybe some other modifications like 01->03 will work, who knows. Need to compare the frontends otherwise.
If you can, please check this:These just seem to be a way to fix the control lines of 2 analogue switches - one changes at the same time as the 200-500mV relay, didn't see the other change but the switch has what looks like a bias connected with Y shift on it.
(https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/?action=dlattach;attach=81520;image)
Here it turns on with this message:
"The oscilloscope setup is defaulted because a software fault occured. Please report the following diagnostic information: PC-Board/Status A/D problem".
Just tried changing the links on MSO6012A- all permutations other then original make it hang.
On restore I get an error message saying setup defaulted due to A/D error -presumably accessing nonexistent CH3/4 hardware
This set of jumpers works on 603x and 610x, setting apparently the BW and CH no.Seems as if the FPGA is the responsible of checking the ASICs/ADCs status. This fit with my previous theory, ie the FPGA also set the oscilloscope model in function of ASICs configuration. All this is only an assumption, perhaps the FPGA only set one flag, and the CPU checks the corresponding ASICs/ADCs.
What about the 601x and 605x models? Maybe they have nothing to do with them and this is why the 6012 hangs?
These just seem to be a way to fix the control lines of 2 analogue switches - one changes at the same time as the 200-500mV relay, didn't see the other change but the switch has what looks like a bias connected with Y shift on it.ADG451/DG444 (analogue switches), are directly controlled by the 74ATC174, no need to change anything here.
What about this set of jumpers? Anyone tested them?Dont bother, look where they are connected, also, no need to change anything here (IMG_1490.jpg and IMG_1488.jpg).
Yes, already checked, it is a clock distribution IC.Yes exactly, on my oscilloscope this pull-down (R3) is mounted.
Take a look at the third photo I just added, there is another set of jumpers next to the digital inputs circuit.
One pull down resistor is not there on the 6012.
For (IMG_1493.jpg) I had not seen this resistor before, I will check now where they are connected, but I think you've found something important.All are connected to the FPGA.
R3 set MSO.I don't think R3 sets the MSO.
The last is mikeselectricstuff DSO6034A.
R3 set MSO.I don't think R3 sets the MSO.
The last is mikeselectricstuff DSO6034A.
In my MSO6012 is is NOT installed, same in the photo of the DSO7104.
As it looks from the last photo in DSO6034 is also not installed
So far the MSO6104 is the only one with this jumper installed.
:phew:
Not working :wtf:
So I switched it back to the original jumper configuration and uploaded the software first.
Here it turns on with this message:
"The oscilloscope setup is defaulted because a software fault occured. Please report the following diagnostic information:
PC-Board/Status A/D problem".
| Y3 Y2 Y1 Y0 Model gpInstOptions ------------------------------------------------------------- 0 0 0 0 MSO6034A 000002a2 0 0 0 1 MSO6034A 000002b2 0 0 1 1 MSO6054A 000002b4 0 0 1 0 MSO6054A 000002a4 0 1 0 0 MSO7034A 00000aa2 0 1 0 1 MSO7034A 00000ab2 0 1 1 1 MSO7054A 00000ab4 0 1 1 0 MSO7054A 00000aa4 1 0 0 0 MSO5034A 000006a2 1 0 0 1 MSO5034A 000006b2 1 0 1 1 MSO5054A 000006b4 1 0 1 0 MSO5054A 000006a4 1 1 0 0 MSO6034A 00000ea2 1 1 0 1 MSO6034A 00000eb2 1 1 1 1 MSO6054A 00000eb4 1 1 1 0 MSO6054A 00000ea4 |
Do you see any direct CPU-frontend traces there?The front-end is controlled directly by the CPU (only 74ATC174s between both).
So there must be another resistor in BW group to make missing x01x, x05x models. 6012 board should show it.You were right. :)
Could someone summarize how to enable the licensable options? I've read all posts in the thread and get the feeling this is possible but not how it's done. Thanks!
Could someone summarize how to enable the licensable options? I've read all posts in the thread and get the feeling this is possible but not how it's done. Thanks!
Is this the same for 5/6000 and 7000?Could someone summarize how to enable the licensable options? I've read all posts in the thread and get the feeling this is possible but not how it's done. Thanks!
The less risky method is performed over telnet. This is very simple to implement, and all you need is an ethernet cable:
Use telnet to connect to the instrument on port 5810 (telnet <ip> 5810) with username 'panther' and password 'pictures'.
At ->, type cmd and press enter. Then type mem modify -w 1 0x009A2187 and press enter. Then type 0x01 and press enter. Then type . and press enter. It should look like this:
-> cmd
[vxWorks]# mem modify -w 1 0x009A2187
0x009a2187: 0x00-0x01
0x009a2188: 0x00-.
Then, on the scope, press utility -> options -> licenses -> options, enable 'service mode' and 'all licenses'. Turn the scope off and back on again. Check that the licenses are now enabled.
Excellent, thanks. Worked on DSO5014A and a DSO6012A.Could someone summarize how to enable the licensable options? I've read all posts in the thread and get the feeling this is possible but not how it's done. Thanks!
Download the sys6000 or sys7000 v06.16.001 update file from Agilent's website (5000 and 6000 both use sys6000)
Download packjzp and unjzp tools from here (https://bitbucket.org/flowswitch/agltzip)
Unpack to a binary using unjzp , and use a hex editor to make the following changes
sys6000.bin 06.16.0001:
002E7B80: 94 21 F8 E0 7C 08 02 A6 -> change to -> 38 60 00 00 4E 80 00 20
sys7000A.bin 06.16.0001:
002E7C60: 94 21 F8 E0 7C 08 02 A6 -> change to -> 38 60 00 00 4E 80 00 20
save the edited version, and repack to .jzp using packjzp.
Note pack/unpack are quite slow - about a minute
Update the scope firmware with the new version
Then enable each license by entering the 3-letter license name, with all zeros as the rest of the key
Note that decodes only work on models with 4 analogue channels - it will refuse to install on 2-ch models and consensus is the decodes use some hardware that isn't present on 2ch models
Enjoy!
Is the telnet method sticky between power cycles?
Out of interest what difference in code does the 8 bytes change?If I'm not mistaken.
Some drawbacks:
- FMS, BAT, FRS, TEL, 1MV, TOM, CIR features are not enabled by "ALL"
- the address is version dependent, this one will not work on 5k/6k
If somebody wants to go ServiceMode way, there is more portable way: execute setServiceMode(1) in C mode console ("->" prompt). But, as it was discussed already, there is no danger patching sys.bin - we are not touching the bootloader, where "emergency" restore lives.
94 21 F8 E0 -> stwu r1, -0x720(r1)This patch changes first bytes of big code check function to short "return 0". Result 0 means "code is ok" here.
7C 08 02 A6 -> mflr r0
38 60 00 00 -> li r3, 0
4E 80 00 20 -> blr
After attempting to install the patch, the scope did not reboot correctlyDid you saved/restored jzp revision header string? Some tests shows that it is important somehow. There is a 3rd parameter (revision.txt) to unjzp/packjzp for that. You can try unpacking then repacking an unmodified file first to verify your setup - the repacked file must match the original exactly, then proceed with patching.
94 21 F8 E0 -> stwu r1, -0x720(r1)This patch changes first bytes of big code check function to short "return 0". Result 0 means "code is ok" here.
7C 08 02 A6 -> mflr r0
38 60 00 00 -> li r3, 0
4E 80 00 20 -> blrAfter attempting to install the patch, the scope did not reboot correctlyDid you saved/restored jzp revision header string? Some tests shows that it is important somehow. There is a 3rd parameter (revision.txt) to unjzp/packjzp for that. You can try unpacking then repacking an unmodified file first to verify your setup - the repacked file must match the original exactly, then proceed with patching.
Another possibility is that you were "lucky" to catch the very first packjzp version which had several issues. Latest version (28 january commit) produces 100% correct files when used with 3 parameters.
Excellent, thanks. Worked on DSO5014A and a DSO6012A.I would assume it just indicates that it is "temporary" and not an installed license
I do wonder what the * next to the license codes signify when using ALL.
I can't see how to access the MSO functionally on the DSO5014A. the controls are probably staring me in the face though.That would be because there is no MSO variant of the 5000 series - that is the main (only?) difference between 5000 and 6000
Excellent, thanks. Worked on DSO5014A and a DSO6012A.I would assume it just indicates that it is "temporary" and not an installed license
I do wonder what the * next to the license codes signify when using ALL.
euzer, both DIS and DSW are just bundles of other features.
DSW: LSS, AMS, 232, SGM
DIS: LSS, AMS, 232, SGM, LMT, FRC, SND, FLX, 553
I think you're right. They look to have the same front fascias and there's a label to the right hand side of the screen on the 5000 masking the holes where the digital controls would be on the 6000.QuoteI can't see how to access the MSO functionally on the DSO5014A. the controls are probably staring me in the face though.That would be because there is no MSO variant of the 5000 series - that is the main (only?) difference between 5000 and 6000
Here is how you enable the service menu:
telnet <ip> 5810
username panther
password pictures
-> cmd
[vxWorks]# mem modify -w 1 0x009A2187
0x009a2187: 0x00-0x01
0x009a2188: 0x00-.
utility -> options -> licenses -> options
enable 'service mode', 'all licenses', and 'mso'
reboot scope
If somebody wants to go ServiceMode way, there is more portable way: execute setServiceMode(1) in C mode console ("->" prompt). But, as it was discussed already, there is no danger patching sys.bin - we are not touching the bootloader, where "emergency" restore lives.
Download the sys6000 or sys7000 v06.16.001 update file from Agilent's website (5000 and 6000 both use sys6000)
Is there a proven way to increase the bandwidth of a DSO5014A from 100MHz to 300MHz with a hardware and/or firmware mod? And if so how's it done? TIA.No - the hardware is completely different
Thanks. I presume that will also be true for a DSO6014A BW increase also?Is there a proven way to increase the bandwidth of a DSO5014A from 100MHz to 300MHz with a hardware and/or firmware mod? And if so how's it done? TIA.No - the hardware is completely different
Time to open 9000/90000 thread? :)
If an Admin reads this post: Is it allowed to attach here a small (about 9 kbyte) zip file with all informations how to patch the firmware (please excuse my question - i am quite new here...)?Hi, welcome to the eevblog forum!
Hello,
Someone knows how to remove the Secure Enviroment license? I enabled all the licenses and now i realized that SEC blanks ram settings after power-cycling and can't be disabled :palm:
$ telnet <ipaddr> 5810
2) log in with panther/pictures -> clearFeatureRegister()
Tffs Drive 0: Programing units 119 to 119
value = 1 = 0x1
4) copy the license file to /ram0: -> cmd
[vxWorks]# cd bin
[vxWorks]# file copy license.lic /ram0
copying file license.lic -> /ram0/license.lic
5) FTP to the scope using another terminal or FTP program $ ftp <ipaddr>
log in with panther/pictures
6) retrieve the license.lic file: ftp> cd ram0
ftp> get license.lic
7) edit license.lic to remove the "SEC" line ftp> put license.lic
9) from the telnet window, copy the edited license.lic file back to C:/bin: [vxWorks]# file copy /ram0/license.lic license.lic
copying file /ram0/license.lic -> license.lic
10) Reboot the scope. $ telnet <ipaddr> 5810
2) log in with panther/pictures -> clearFeatureRegister()
Tffs Drive 0: Programing units 119 to 119
value = 1 = 0x1
4) list the license.lic file -> cmd
[vxWorks]# cd bin
[vxWorks]# cat license.lic
( the license.lic file is listed in the terminal window)
5) select and the license.lic file text from the terminal window and copy to the clipboard. [vxWorks]# cat > license.lic
8 ) paste the edited license.lic file from the clipboard into the terminal [vxWorks]# cd bin
[vxWorks]# rm license.lic
[vxWorks]# reboot
I have a DSO7014B that is in this boot looping cycle where the LED's on the front just cycle and it never starts up. I have tried OVER and OVER the procedure to boot from the Thumbdrive but it will not come up 'Lately'... However over the course of 2 to 3 days I had tried (without the thumbdrive) to turn it off and on every so often and once it came on, which shocked me, I got my thumbdrive that one time and updated All the firmware. I turned it off after that and it has never come back on since. If there are any hints you can give an Old technician on a way to get this Oscope back up and running I would really appreciate it. Another question would be if there is 'ANY' other way to boot OR load the system software onto the scope as I really think that is the problem. Or even a way to maybe link up to the Oscope to monitor what it is actually doing as it is trying to boot up which may lend a hint to what is the problem as it is trying to boot. Thanks in advance for any and all help.AIUI It should always be possible to boot from the drive using the method of turning on, waiting for the LED test, turning off, then turning on with the USB drive. The code is loaded and run from RAM sho shouldn't be dependent on any earlier FW update. Your symptoms sound like it has a bad FW image, but it should be possible get past this.
Thank you so much for the post. The very first thing I did when it went down was to verify All the Power supply voltages and Regulator voltages per the ''''VERY LIMITED'''' service manual I downloaded online. I may just go over them again to make sure I did not miss anything. It just seems to me that there is a minor problem with it since it did come on that one time and took all the Firmware updates just fine and did all the rebooting while updating, but I could very well be wrong also and it could be a very Major problem... Thanks again.Bear in mind that what it's doing at startup is selftests, but appears to not getting far enough as to be able to display anything.
Than i wish you good luck and much fun with this flood of options... ;-)
Kind regads
I just found this thread this week and tried it on my DSO6034A. Total success!! MSO, 8M, etc!! So fun.
It would be great if Agilent provided this officially after they decide to obsolete the scope and the selling of the features. I just checked any they won't even sell you the 8M option, so why not just enable it??
Anyway, thanks to all the people who figured this out. Now if you have something for the 54833D and the 54831M, I'd be really happy!! :)
I believe that's exactly what they do. They don't sell the memory upgrade options because if you update the firmware, it will be enabled automatically. I think mem8M, E00, and MST are all enabled by default on new firmware.
I just found this thread this week and tried it on my DSO6034A. Total success!! MSO, 8M, etc!! So fun.The 8M (at least on the 6000) became standard fairly early on - not sure if this was also the case with the 5000, but that may be why it's not a listed purchase option
It would be great if Agilent provided this officially after they decide to obsolete the scope and the selling of the features. I just checked any they won't even sell you the 8M option, so why not just enable it??
I believe that's exactly what they do. They don't sell the memory upgrade options because if you update the firmware, it will be enabled automatically. I think mem8M, E00, and MST are all enabled by default on new firmware.
I updated my MSO7000 series to the latest firmware and it did not enable anything.
And I think the 7000 series is internally the same as the 6000 series.
Option E00 and Option MST (N5466A) are now standard
Now if you have something for the 54833D and the 54831M, I'd be really happy!! :)
Looks like the link is outdated :)
The screen res is fine, the small size isn't a big issue most of the time.
So I have a couple of questions...
o Although the resolution on both the 6000 and 7000 is 1024x768, the 6104A LCD is only 6.3". You could add an external monitor, but I was wondering how well the remote web interface works as an alternative?
o What is the boot time like? I think I'm quite spoiled by the 54642D's five seconds, it's not even enough time to properly attach a probe.12 seconds
No idea, but check the release notes for functionality differences. AIUI you can get most or all the options by enabling service mode, so you don't need to use hacked FW
o I see that 06.17.0001 is current on newer 7000B units, and possibly others too, is it possible to downgrade firmware to previous versions, and if so does 06.16.0001 (for example!) work on the 7000B series?
Many thanks in advance!
The screen res is fine, the small size isn't a big issue most of the time.
So I have a couple of questions...
o Although the resolution on both the 6000 and 7000 is 1024x768, the 6104A LCD is only 6.3". You could add an external monitor, but I was wondering how well the remote web interface works as an alternative?
The web interface isn't a realistic alternative to using the front panel - no knobs.
It uses Java, which I've always had problems running
Quoteo What is the boot time like? I think I'm quite spoiled by the 54642D's five seconds, it's not even enough time to properly attach a probe.12 seconds
OK, I hadn't realised that, I guess I need to re-read this thread... again!QuoteNo idea, but check the release notes for functionality differences. AIUI you can get most or all the options by enabling service mode, so you don't need to use hacked FW
o I see that 06.17.0001 is current on newer 7000B units, and possibly others too, is it possible to downgrade firmware to previous versions, and if so does 06.16.0001 (for example!) work on the 7000B series?
Many thanks in advance!
what's the difference?
Make sure to get the B Version, if you get a 7000 series.
Make sure to get the B Version, if you get a 7000 series.what's the difference?
It appears there are also several more knobs with push functions on the 7000B.That is true.
Congratulations on your new scope and your "upgrade"
Isn't it amazing when you use the big screen for the first time.
The MSO option probably makes the price different. If you look carefully on Ebay you can buy the MSO probes in mint condition for less than $300.You can also occasionally find old 1650 or 1651 logic analysers with 5 or 2 probes for that sort of money.
Well.... Should is not quite the same as does... Not wanting to start an argument or anything. Just that I'm interesting in picking up a scope and the 6000s are pricey, so it'd be good to find out now rather than later... :D
Well.... Should is not quite the same as does... Not wanting to start an argument or anything. Just that I'm interesting in picking up a scope and the 6000s are pricey, so it'd be good to find out now rather than later... :DYou "should" be happy, that that you get such valuable advise here at this forum.
Well.... Should is not quite the same as does... Not wanting to start an argument or anything. Just that I'm interesting in picking up a scope and the 6000s are pricey, so it'd be good to find out now rather than later... :D
You "should" be happy, that that you get such valuable advise here at this forum.
I bought a used 7000A and it did not work at all, but there was may be something wrong with the scope. I sold it again and got the 7000B series and it worked extremely well.
There's a French Youtube vid showing a bloke liberating a 5000.Thanks! That's more than I could hope for really. Even without being able to speak French I think I understood what he was saying. Now all I need to do is find one...
e differences between the 5000 and 6000 series? It seems they have the same performance specs, only that the 6000 goes all the way up to 1 GHz and has the MSO option.Mostly MSO, I think maybe also the physical size is less deep - check the datasheets.
Mostly MSO, I think maybe also the physical size is less deep - check the datasheets.
When choosing remember that decodes are only available on 4-channel models.
So, having successfully fiddled with my scope and turned (most) features on, I have just one question: is memMAX available from the "enter license" end of the hack, or is that one only available from the "service menu" hack?
and if it is available from the license end, what's the mnemonic?
Nice, hope you find some goodies Howard.So, having successfully fiddled with my scope and turned (most) features on, I have just one question: is memMAX available from the "enter license" end of the hack, or is that one only available from the "service menu" hack?
and if it is available from the license end, what's the mnemonic?
My understanding was that the 8M points was automatically enabled with firmware after a certain version some time ago.
I'm away in Hong Kong until Sunday, I can check for you upon my return if no one else responds in the meantime.
So, having successfully fiddled with my scope and turned (most) features on, I have just one question: is memMAX available from the "enter license" end of the hack, or is that one only available from the "service menu" hack?If the scope already has 8M that is the maximum - this became standard not long after the scope was released.
and if it is available from the license end, what's the mnemonic?
Nice, hope you find some goodies Howard.So, having successfully fiddled with my scope and turned (most) features on, I have just one question: is memMAX available from the "enter license" end of the hack, or is that one only available from the "service menu" hack?
and if it is available from the license end, what's the mnemonic?
My understanding was that the 8M points was automatically enabled with firmware after a certain version some time ago.
I'm away in Hong Kong until Sunday, I can check for you upon my return if no one else responds in the meantime.
Is there a patch location for the latest Agilent DSO6104 (.20) code to enable all the features ? If not, is there a download location for the .16 code used in many of the above examples.Just enable the "service menu" and all options will be available.
Thanks,
Bill
Could you please point me to the correct steps to enable the service menu?
Could you please point me to the correct steps to enable the service menu?
Service menu on MSO7000
telnet <ip> 5810
username: panther
password: pictures
-> cmd
[vxWorks]# mem modify -w 1 0x009A2187
0x009a2187: 0x00-0x01
0x009a2188: 0x00-.
“cmd”
then press enter. At [vxWorks]# prompt, type
“mem modify -w 1 0x009A2187”
then press enter.
Then type “0x01” and press enter again.
Then type “.” and press enter again.
Then open up the service menu
utility -> options -> licenses -> options
enable 'service mode', 'all licenses', and 'mso'
reboot scope
Done
====================
Only for 6000 series type this in the vxWorks console:
mem modify -w 1 0x00966E67
vxWorks response should be:
0x00966e67: 0x00-
Now type "0x01" after "0x00-" to enable service menu.
new vxWorks response should be:
0x00966e68: 0x00-
Now type "." after "0x00-" to exit.
Now go to "Options" -> "Licenses".
The reason I raise this is that the way I read the previous posts on this in this thread was that it was dependent on 6.16. My 7000B arrived with 6.17 so I booted off a 6.16 USB stick and did the setting that way as I didn't know if it would work otherwise. I'm not saying it won't work with other versions, I was asking for clarification.
The reason I raise this is that the way I read the previous posts on this in this thread was that it was dependent on 6.16. My 7000B arrived with 6.17 so I booted off a 6.16 USB stick and did the setting that way as I didn't know if it would work otherwise. I'm not saying it won't work with other versions, I was asking for clarification.
I will have a look tomorrow on my 7000B series, as to what FW is installed.
So, you always boot yours from a USB stick?
You never tried to access with telnet on FW v 6.17?
I tried both addresses (for the 7000 and 6000) and neither one gives me the service menu in my DSO6104.Hi Bill,
I'm assuming that the magic location will vary with the software version. I am using the latest V6.20 (not the V6.16 that seems to be prevalent in this thread.
Does anyone have either the magic address for the 6000 scope with V6.20 software or a location that I can download the 4 necessary files for V6.16?
Thanks in advance,
Bill
If somebody wants to go ServiceMode way, there is more portable way: execute setServiceMode(1) in C mode console ("->" prompt). But, as it was discussed already, there is no danger patching sys.bin - we are not touching the bootloader, where "emergency" restore lives.
I have made a real good bargain just before xmas on a MSO6034A.... 800€ with all probes !Woow! Yes, for that price is really a bargain.
You successfully added the 4Gs/s rate to your 6034A; your modified address location was 0x00231420 for the 4 modified octets, but for what firmware version ?It was the previous version to 6.20, the 6.16, I think.
I am currently using the 6.20 version, do you know which adress i should use for this version (unfortunately, the string 38 09 FF FD is present at many different places ?)Go to 0x00231998 and replace 38 09 FF FD by 38 00 00 01.
Did you succeded into the modification of the front end passive components (filtering adjustments before and after the 1NB7-8453 hybrid) ?No, because as we have said many times here we need to know the proper value of the RC network
I wonder if removing that capacitor is enough to increase the BW to 500MHz. :-//
Is this dependent of a certain firmware version, or is it universal?
The reason I raise this is that the way I read the previous posts on this in this thread was that it was dependent on 6.16. My 7000B arrived with 6.17 so I booted off a 6.16 USB stick and did the setting that way as I didn't know if it would work otherwise. I'm not saying it won't work with other versions, I was asking for clarification.Effectively it varies with the firmware version.
I don't remember ever doing so. I did have a look at the .bin images and determined that the "other" way was in different locations, I don't know if that is the case for setting the service menu on, but my concern was more about the risk in bricking the scope if it was in a different place, and the possible damage caused by poking an unknown location.The "showServiceMode" function is still present in version 6.20, so the easy way is:
If somebody wants to go ServiceMode way, there is more portable way: execute setServiceMode(1) in C mode console ("->" prompt). But, as it was discussed already, there is no danger patching sys.bin - we are not touching the bootloader, where "emergency" restore lives.
I wonder if removing that capacitor is enough to increase the BW to 500MHz. :-//
No, it's not that simple. :)
For looking at signals over 100MHz go for passive Lo-z or active FET probes for the most accurate signal display and least signal loading. For ordinary use (<100MHz) any probe will do.Thanks but am I limited to the ones that Agilent (Keysight) lists? There appear to be several non Agilent probes available that have the little gold pin sticking out - e.g. these ones on Amazon (http://www.amazon.com/500mhz-Oscilloscope-Readout-Agilent-Tektronix/dp/B007N041SW/ref=sr_1_38?ie=UTF8&qid=1452973489&sr=8-38&keywords=500+MHz+scope+probe). I realize these are passive but they're supposed to be good for 500 MHz? Active probes are $600 - $1,500 each. I'm not averse to spending money but am looking for guidance on best bang for my buck and I don't need 4 active probes on my 7104 on day 1.
These aren't Lo-Z passive probes but regular 1:10 probes so don't waste your money on those! Look for probes from a firm called Testec; I think Farnell/Element14 carries these. The probes from Testec are cheap and very suitable for general purpose (<100MHz) probing.For looking at signals over 100MHz go for passive Lo-z or active FET probes for the most accurate signal display and least signal loading. For ordinary use (<100MHz) any probe will do.Thanks but am I limited to the ones that Agilent (Keysight) lists? There appear to be several non Agilent probes available that have the little gold pin sticking out - e.g. these ones on Amazon (http://www.amazon.com/500mhz-Oscilloscope-Readout-Agilent-Tektronix/dp/B007N041SW/ref=sr_1_38?ie=UTF8&qid=1452973489&sr=8-38&keywords=500+MHz+scope+probe). I realize these are passive but they're supposed to be good for 500 MHz? Active probes are $600 - $1,500 each. I'm not averse to spending money but am looking for guidance on best bang for my buck and I don't need 4 active probes on my 7104 on day 1.
Howard, thanks for the detailed probe info, exactly what I needed. I just bought two 1160A probe sets on eBay which I'm pretty sure are the equivalent early version of the 1165A you recommended - they come in neat zipper pouches with a load of different probe accessories - got them for $80 each. The guy had them listed on eBay as 10073C, probably because nobody was going to search for '1160A'. I guess if they don't work, I can return them as technically they are not the advertised item.
I'm still working on the LA probe stuff.
The more I read bout the MSO7104B, the more confident I get that this was a great choice. I thought I might be having buyers remorse right now but I'm not. A scope is one of the basic tools I use to make my living and, to date, I've been struggling with a Rigol MSO2202A and had access to a Tektronix MDO3204 but they are both dogs when it comes to I2C / SPI serial bus decode - to the point of being unusable, looks like the MSO7104 is the dogs bollocks in this regard with full speed hardware decode at 100,000 Wf/sec.
Despite the age, the fact that the 5000/6000/7000 series can easily be hacked for MSO and decodes, a used one at the right price probably still offers about the best bang/buck in this performance range.
The more I read about the MSO7104B, the more confident I get that this was a great choice. I thought I might be having buyers remorse right now but I'm not.
I am not certain how well the 1160A will compensate, the difference between the 1160A and the 1165A in terms of compensation range is 6-9pF and 12-14pF respectively, with the scope input spec'd at 14pF.Hmmm, now I AM having buyers remorse - anyway, I'll try them out on a 350 and 500 MHz signal and see how they perform - if they suck, I will return them.
Also be aware that SPI decoding fails at a clock speed beyond about 35MHz (it's spec'd to 25MHz).
The best thing about the 5000/6000/7000 series is the UI in terms of ease of use and responsiveness. Everything is obvious. In contrast, the UI of the MDO3000 you mentioned isn't any of those things!
Also be aware that SPI decoding fails at a clock speed beyond about 35MHz (it's spec'd to 25MHz).SPI decode doesn't work > 35 MHz eh? Useful to know.
Also be aware that SPI decoding fails at a clock speed beyond about 35MHz (it's spec'd to 25MHz).SPI decode doesn't work > 35 MHz eh? Useful to know.
Many others oscilloscopes have a similar limitation (regarding decoders), and even worse. So, as you say "useful to know".
Interestingly the Tek MDO3000 will decode 50MHz SPI... as will the Rigol MSO1074Z. I suspect it's a limitation of the hardware decoder in the ASIC.Yes, I think so too.
Try this link (http://literature.cdn.keysight.com/litweb/pdf/5989-9580EN.pdf?id=1502124) for a comparison with a Tek 4000BInterestingly the Tek MDO3000 will decode 50MHz SPI... as will the Rigol MSO1074Z. I suspect it's a limitation of the hardware decoder in the ASIC.Yes, I think so too.
However the maximum decode/refresh rate on the screen for 5000 6000 and 7000 serie is 60Hz. I remember reading this in a datasheet.
I'm using Tektronix P6156 Lo-z probes with my DSO7000 series but I have put a piece of kapton tape on the probe detect pin because these probes can have different attenuation factors which are not supported by the DSO7000. Setting the attenuation factor manually is easy though.
I'm using Tektronix P6156 Lo-z probes with my DSO7000 series but I have put a piece of kapton tape on the probe detect pin because these probes can have different attenuation factors which are not supported by the DSO7000. Setting the attenuation factor manually is easy though.
Hmm, there's quite a few P6156 probes on eBay at reasonable prices and I was surprised to see that they go up to 3.5 GHz, is there some catch? Also can you please give a bit more info on how you set up the 7000 to use these - I presume you start by setting the input impedance to 50 Ohms.
Most of these probes are sold with the standard 1:10 attenuator which loads the signal with 500 Ohm. This may be too low for LVDS so getting one with the 1:20 or 1:100 attenuators is more of a challenge. Some might come with extra attenuators but since most sellers have no idea what they are selling it is not in the description. Until a few days ago I didn't even know the attenuators are stored in a rubber thingy with a lid. I had two of those storage containers; one was empty but the other one contained a 1:20 and 1:100 attenuator so I could put some more useful probes together.I'm using Tektronix P6156 Lo-z probes with my DSO7000 series but I have put a piece of kapton tape on the probe detect pin because these probes can have different attenuation factors which are not supported by the DSO7000. Setting the attenuation factor manually is easy though.Hmm, there's quite a few P6156 probes on eBay at reasonable prices and I was surprised to see that they go up to 3.5 GHz, is there some catch? Also can you please give a bit more info on how you set up the 7000 to use these - I presume you start by setting the input impedance to 50 Ohms.
The MSO7104B hasn't arrived yet and I'm still looking for probes. eBay has many but 9/10 of them have no parts with them and many are asking ridiculous prices like the Agilent 1165A that has no accessories at the 'bargain' price of $495.
I've got some Rigol passive probes that are rated to $350 MHz (although they are 13 pF input capacitance) and 6-24 pF scope inputs; they will work for now and I'll bide my time to get complete probes at reasonable money which I call less than $150 per probe for good used passive ones.
I even started looking at the poor man's 1 GHz active probe article by David Jewsbury - I guess I'm feeling poor after shelling out for the MSO7104
I bought some 10073Cs from this seller, who still has some available. They came with all accessories, but I did buy four. eBay item 201270061358 (http://www.ebay.com/itm/201270061358)Howard, thanks for the link, I just bought 3 10073Cs from that guy.
I bought some 10073Cs from this seller, who still has some available. They came with all accessories, but I did buy four. eBay item 201270061358 (http://www.ebay.com/itm/201270061358)Howard, thanks for the link, I just bought 3 10073Cs from that guy.
artag, if you search for 'Agilent probe' on eBay, and then sort by price low-high, you'll find some people offering probe tips & clips.
Nimble Lilliput FA1000 external display staves off some of the 7000 series envy! (and is actually quite useful to move around the bench close to where I'm probing)
Still I think those probes are a waste of money. You never know how bad used probes are and their 500MHz spec is just nice on paper but has little practical meaning.
This kit with 2 probes costs $40:
http://uk.farnell.com/testec/tt-lf312-2-6-10020-2-6/probe-oscilloscope-150mhz-1-10/dp/4308098 (http://uk.farnell.com/testec/tt-lf312-2-6-10020-2-6/probe-oscilloscope-150mhz-1-10/dp/4308098)
A big plus is that these are switchable between 1:1 and 1:10.
Still I think those probes are a waste of money. You never know how bad used probes are and their 500MHz spec is just nice on paper but has little practical meaning.
This kit with 2 probes costs $40:
http://uk.farnell.com/testec/tt-lf312-2-6-10020-2-6/probe-oscilloscope-150mhz-1-10/dp/4308098 (http://uk.farnell.com/testec/tt-lf312-2-6-10020-2-6/probe-oscilloscope-150mhz-1-10/dp/4308098)
A big plus is that these are switchable between 1:1 and 1:10.
You can always set the probe attenuation factor manually. I do that often because I use various probes and current shunts to make measurements.
Also seen this. In my case it only seems to occur on channel 2, and I'm using the 1007Same here.
I see there's also a firmware update dating from last summer .. I haven't installed this, has anyone else ? It doesn't seem to offer much in the way of improvements, so I don't want to risk losing the 'free' options !
Or does the x10 pin also provide that ? Seems unlikely to me as the most common reason for 50R is use with a standard 50R BNC plug, or with some specialist probe that would use the 9-pin interface.
Yes, the readout pin does provide that for some Agilent probes as well as the common 10X hi-z readout.
Congratulations.
Service mode took about 3 mS to turn on :)
Congratulations.
Service mode took about 3 mS to turn on :)
I found the Agilent 10073C probes also too big and not the quality that I expected and 4 pieces I had went to be sold on ebay a long time ago.
Today the used 1156A arrived, it looks perfect and has every accessory including the little plastic vial of tips but, when I plug it into the MSO7104B, it says "Unsupported probe attached to channel 1". I've done some online research to answer the obvious question - is it really supported?
1. Is the 1156A supported by the MSO7104B? This links (http://cp.literature.agilent.com/litweb/pdf/5968-8153EN.pdf) says "These Infiniium active probes are not supported by InfiniiVision Series scopes – 1152A, 1153A, 1154A, 1155A, 1159A, 1168A, 1169A, N2800A, N2801A, N2802A,
N2803A, N2830A, N2831A and N2832A.." which sort of implies it IS supported.
2. On page 54 of the MSO7000B manual (http://literature.cdn.keysight.com/litweb/pdf/54695-97025.pdf?id=1852824&cc=US&lc=eng) is says that the 1156A is a supported probe.
So it does look like it's supported so I'm thinking of things that could be wrong; one is that the EEPROM has become corrupted and is not responding to the query from the scope. I wonder if there's a way to issue a command from the scope to interrogate the probe? It might just need reflashing.
I went onto the Keysight web page to explore the option of returning it for repair but, as far as I got, it appears that they want $1,569 to repair it which is insane considering the N2795A Active Probe, 1 GHz is $1,056 on their web site for a new one! I will try to call them tomorrow to clear this up.
I've designed an FET probe PCB (see picture) based off the poor man's 1 GHZ probe project - I've ordered 10 PCBs (85 x 14 mm)and some components - I included a place for a 3mm white LED that will shine on the PCB under test. Worst case, my 1156A probe will be dismantled to look into the Autoprobe interface and see if I can make it give me the supply voltages I need.
It would be nice to have a 3D printer to print some cool cases for this probe.
I also have been researching some of the newer Op Amps with the idea of making a differential probe with reasonable offset capabilities like the 1130A which is $4,001
Even on the product's web page (http://www.keysight.com/en/pd-1000004221%3Aepsg%3Apro-pn-1156A/active-probe-15-ghz?cc=US&lc=eng) it specifically states:Wow, so you are saying definitively that the 1156A does not work with the MSO7104B! That really sucks, I will contact Keysight today and complain.
Description
The Keysight 1156A, 1157A, and 1158A family of active probes offers R & D engineers the performance they need to probe small geometries in hard-to-reach areas on the DUT. These probes were designed specifically for the Infiniium Series, and InfiniiVision 5000, 6000 and 7000 Series 300 MHz - 1 GHz oscilloscopes.
FWIW, I have a pair of 1152As which I use with a 54831D, but they definitely don't work with the 7104B. I believe that the 7000 series have a lite version of the probe interface that doesn't support the power supply requirements of some probes.
Even on the product's web page (http://www.keysight.com/en/pd-1000004221%3Aepsg%3Apro-pn-1156A/active-probe-15-ghz?cc=US&lc=eng) it specifically states:Wow, so you are saying definitively that the 1156A does not work with the MSO7104B! That really sucks, I will contact Keysight today and complain.
Description
The Keysight 1156A, 1157A, and 1158A family of active probes offers R & D engineers the performance they need to probe small geometries in hard-to-reach areas on the DUT. These probes were designed specifically for the Infiniium Series, and InfiniiVision 5000, 6000 and 7000 Series 300 MHz - 1 GHz oscilloscopes.
FWIW, I have a pair of 1152As which I use with a 54831D, but they definitely don't work with the 7104B. I believe that the 7000 series have a lite version of the probe interface that doesn't support the power supply requirements of some probes.
I have tried to adopt good practices on the FET Probe design but the boards were only $3 each (+ postage) and the major components are samples so it's worth a try.
I have bought some HP 1152A 2.5GHz active probes
P.S. of course we lurk a thread titled "anyone hacked these scopes?" :)
I played around with an 1152A + 7000B this morning. The middle pin of the probe (5th one in) is what sets the channel attenuation and impedance. It pulls out or can be taped over. By pulling the pin out with some needle nose pliers, I was able to use the 1152A with the 7000B. I didn't characterize bandwidth performance or anything that rigorous, but I was able to see the expected square wave on the screen.What a nice support that is, Thank you!
P.S. of course we lurk a thread titled "anyone hacked these scopes?" :)
Sheesh, you'd think you guys could figure out how to hack your own scopes without our help >:D >:D >:D
Obligatory disclaimer:Daniel, By isolating the ID resistor, you stopped the Autoprobe interface doing the I2C data interrogation of the probe. So you getting the waveform implies that I was right and that the 1152A can work with the 7000 series - so why isn't it supported in the firmware? And did you see my earlier post about my 1144A probe which is listed as supported but sets the input impedance to 1 Meg when it should be 50 Ohms? Can't you get the folks at Keysight to do some improvements on the 7000's Autoprobe interface? It sure seems like there's room for improvement.
Keysight doesn't support modifying, hacking, etc. any firmware or hardware. Any mods/hacks void warranty and may be illegal. I'm not a lawyer or saying you should do any of the following.
I played around with an 1152A + 7000B this morning. The middle pin of the probe (5th one in) is what sets the channel attenuation and impedance. It pulls out or can be taped over. By pulling the pin out with some needle nose pliers, I was able to use the 1152A with the 7000B. I didn't characterize bandwidth performance or anything that rigorous, but I was able to see the expected square wave on the screen.
P.S. of course we lurk a thread titled "anyone hacked these scopes?" :)
I am thinking that any further development on the 6000/7000 is going to be limited, they've probably not long on the shelves.
But I thought someone mentioned earlier that the 7000 series should have "full" Autoprobe interface and based on that I thought it would have supported these variable voltages. But I guess the definition of "full" interface might not be so clear.
I wonder what the main difference between AutoProbe and AutoProbe lite is then?
There's an 1152A oneBay right now but the gold tip pin is slightly bent, is this a replaceable item?
Sweeet! So is it now recognized by the MSO7104B? Or what's the deal? If I buy / win the 1152A I'll take you up on the offer of the spare tip.
The 54831D allowed me to calibrate the [1152A] probe's offset and gain when it was recognised as a proper 1152A and now, but I've never bothered to use the facility as the probes were good enough for my purposes out of the box. The 7104B doesn't appear to have a probe cal option but I didn't look very hard. Again, for my purposes there's not really any practical need, but YMMV.My MSO7104B offers to calibrate my 1156A, I wonder where the results of that cal are stored. It wouldn't really make sense for the scope to store it internally - or would it?
Why not? - it could store the probe serial no. to associate the cal data with the probe. If you have multiple scopes and multiple probes, why would the probe store scope-specific data? (Assuming the cal is for the combination of scope and probe)The 54831D allowed me to calibrate the [1152A] probe's offset and gain when it was recognised as a proper 1152A and now, but I've never bothered to use the facility as the probes were good enough for my purposes out of the box. The 7104B doesn't appear to have a probe cal option but I didn't look very hard. Again, for my purposes there's not really any practical need, but YMMV.My MSO7104B offers to calibrate my 1156A, I wonder where the results of that cal are stored. It wouldn't really make sense for the scope to store it internally - or would it?
Why not? - it could store the probe serial no. to associate the cal data with the probe. If you have multiple scopes and multiple probes, why would the probe store scope-specific data? (Assuming the cal is for the combination of scope and probe)The 54831D allowed me to calibrate the [1152A] probe's offset and gain when it was recognised as a proper 1152A and now, but I've never bothered to use the facility as the probes were good enough for my purposes out of the box. The 7104B doesn't appear to have a probe cal option but I didn't look very hard. Again, for my purposes there's not really any practical need, but YMMV.My MSO7104B offers to calibrate my 1156A, I wonder where the results of that cal are stored. It wouldn't really make sense for the scope to store it internally - or would it?
If a probe doesn't offer autoprobe I'd be a little less inclined to use it, although it's hardly much of a chore. putting that 20k resistor in makes no difference to my existing use of the probes on the 52831D and allows their use on the 7104B.
What I'm missing on the 1152A's is a walking stick ground. I am sure that given enough thought I could jury rig something. At present I make do with the coax tip adapters, they work well electrically but logistically it's hardly perfect.
It might also be possible to make your own autoprobe by appropriately epoxying a spring probe to the side of a BNC.
So I've recently become the happy owner of a slightly "pre-loved" DSO5054. ;D Only thing is it came with a set of 100 MHz probes, which don't have a matching compensation range for the scope. :-//
So I now need some probes....
Any suggestions as to what I should look out for? I was going to look at passive ones, for reasons of cost and actual use, but from what I read two pages back the 10073C probes disappoint.
I have 4 10073C 500 MHz 10:1 passive probes that will self-configure on Autoprobe. I originally gave them a poor rating regarding frequency range but later found they were OK at 300 MHz and still usable but dropping off at 500 MHz as long as I kept the ground lead short.
I also have an HP 1144A FET active probe (good for 800 MHz) which is in the original box, mint, with accessories along with an 1142A power supply in great shape - all tested and working.
I have a clean, working 1156A 1.5 GHz active probe with all accessories, 2 more are in the mail that may or may not be serviceable.
I also have 8 spare PCBs for the 'poor man's active FET probe project' - it seems to work pretty well past 1 GHz
I'm thinking of selling two 10073Cs and the 1144A . PM me if you're interested in any or all.
Around probes there is no such thing as the best probe. Its more about what sort of probe you want. Most proper probes perform pretty close to each other, some might just have slightly less capacitance at the tip.
As for active probes they are not a every day use probe. Most of the time you will want to use a nice robust passive probe. But when you find a sensitive high speed signal you really want to have one active probe laying around. If you wish to look at signal integrity of 50MHz and above digital signals a active probe is a must due to the tip capacitance of regular passive probes being way too high and so causing rounded edges or ringing on the signal. Any sort of rise time measurement in the ns range requires a active probe to be accurate.
OK, so been doing a bit more reading up....
Is anyone familiar with the N2873A and N2843A probes? (The latter apparently is the same as the N2890A.) Looking at the datasheets, it seems that the latter has a larger compensation range but that's it. And would either be suitable for a 5000 series scope?
For passive probes I've always used Tek P6131's - small & light and very flexible cable.Do the Tek P6131s work with the Intellivision scopes?
The N2890A comes with the X3000A 350MHz+ scopes. It's alright but the probe itself is big. Assuming compensation range is OK I am sure it'll work fine. Mine remain in the box, I much prefer the lightweight 1165As.
The N2890A comes with the X3000A 350MHz+ scopes. It's alright but the probe itself is big. Assuming compensation range is OK I am sure it'll work fine. Mine remain in the box, I much prefer the lightweight 1165As.
Thanks. I hadn't realised the N2890A/N2843A probes were that big. From the photos I've seen I thought they were the same size as the 1165As.
What kind of prices should I be expecting for 1165As?
I notice the other day thay Keysight are discontinuing the 6000/7000 series on 1 June 2016. Not surprised, they've had a fair run.I'm surprised it's taken this long. When the 3000 came out I looked to see if there was anything worth upgrading and was disappointed that many specs are worse.
In some ways though it's a backwards step in terms of screen resolution and memory depth, the current equivalent models have almost 40% worse screen resolution and half the memory depth. Admittedly some other options and specifications are improved though.
I notice the other day thay Keysight are discontinuing the 6000/7000 series on 1 June 2016. Not surprised, they've had a fair run.I'm surprised it's taken this long. When the 3000 came out I looked to see if there was anything worth upgrading and was disappointed that many specs are worse.
In some ways though it's a backwards step in terms of screen resolution and memory depth, the current equivalent models have almost 40% worse screen resolution and half the memory depth. Admittedly some other options and specifications are improved though.
I'm also surprised that over something like 10 years of pretty much daily use the CCFL backlight is still going strong!
I wonder if they'll do what Tek did a few years ago and release a final firmware update to enable all options.
Not that we need it now, but it would be a nice gesture!
I notice the other day thay Keysight are discontinuing the 6000/7000 series on 1 June 2016. Not surprised, they've had a fair run.I agree. There is a bit of a void in Keysight's lineup and by today's standards their memory depth is severly lacking especially when taking into account how wildly optimistic the memory depth is (over) specified. I like my 7104A (appearantly I bought it hacked) but I very much would like to have deeper memory.
In some ways though it's a backwards step in terms of screen resolution and memory depth, the current equivalent models have almost 40% worse screen resolution and half the memory depth. Admittedly some other options and specifications are improved though.
I notice the other day thay Keysight are discontinuing the 6000/7000 series on 1 June 2016. Not surprised, they've had a fair run.Yes, as might be expected. However, these machines are still fully capable these days.
I'm also surprised that over something like 10 years of pretty much daily use the CCFL backlight is still going strong!I hope that mine also lasts a lot of time.
I wonder if they'll do what Tek did a few years ago and release a final firmware update to enable all options.That would be great.
Not that we need it now, but it would be a nice gesture!
I'm somewhat surprised they didn't send you one ...Absolutely, Keysight should do that with one of these new beasts.
... the way you put a 6000 through its paces is one of the best scope demos I've ever seen.In fact these demos convinced me. When you see them, you think: Look what you can do with these machines!
... I very much would like to have deeper memory.Yes, it's the only downside, but when it was designed 8M was a lot.
I already have have a spare MSO6034A, but if they have a 6054 or 6104 lying around I'd happily accept!I'm somewhat surprised they didn't send you one ...Absolutely, Keysight should do that with one of these new beasts.
... I very much would like to have deeper memory.Yes, it's the only downside, but when it was designed 8M was a lot.
I find memory size is very rarely a problem, especially when you understand how to optimise it by selecting the right permutation of acquire mode, channels and single-shot mode.... I very much would like to have deeper memory.Yes, it's the only downside, but when it was designed 8M was a lot.
I already have have a spare MSO6034A, but if they have a 6054 or 6104 lying around I'd happily accept!I know. :)
I find memory size is very rarely a problem, especially when you understand how to optimise it by selecting the right permutation of acquire mode, channels and single-shot mode.... I very much would like to have deeper memory.Yes, it's the only downside, but when it was designed 8M was a lot.
@Mike : I could not find the version sys6000.bin on Keysight Website could you upload it to some file sharing website so that I could download it.
Another question is I have a Agilent MSO6034A oscilloscope ,I have read that the hack you were talking about would only enable the user to activate all other options except for MSO is it true?
Well, that sucks. I have an MSO7104A that needs a new mainboard too, but the reason is more subtle: it will not run the self cal due to some sort of digitizer issue. However, I have not noticed any aberrations during normal operation, so I am sitting on it right now because I can't afford the repair cost of a mainboard swap. This is the main problem of these monolithic designs; it's not possible to replace the failed part individually since the LRU is the whole damn board.Hi,
Check out this hack ;D
https://www.youtube.com/watch?v=90IcNcWhcF4 (https://www.youtube.com/watch?v=90IcNcWhcF4)
Howard, thanks for the detailed probe info, exactly what I needed. I just bought two 1160A probe sets on eBay which I'm pretty sure are the equivalent early version of the 1165A you recommended - they come in neat zipper pouches with a load of different probe accessories - got them for $80 each. The guy had them listed on eBay as 10073C, probably because nobody was going to search for '1160A'. I guess if they don't work, I can return them as technically they are not the advertised item.
I'm still working on the LA probe stuff.
The more I read bout the MSO7104B, the more confident I get that this was a great choice. I thought I might be having buyers remorse right now but I'm not. A scope is one of the basic tools I use to make my living and, to date, I've been struggling with a Rigol MSO2202A and had access to a Tektronix MDO3204 but they are both dogs when it comes to I2C / SPI serial bus decode - to the point of being unusable, looks like the MSO7104 is the dogs bollocks in this regard with full speed hardware decode at 100,000 Wf/sec.
I am not certain how well the 1160A will compensate, the difference between the 1160A and the 1165A in terms of compensation range is 6-9pF and 12-14pF respectively, with the scope input spec'd at 14pF.
Also be aware that SPI decoding fails at a clock speed beyond about 35MHz (it's spec'd to 25MHz).
The best thing about the 5000/6000/7000 series is the UI in terms of ease of use and responsiveness. Everything is obvious. In contrast, the UI of the MDO3000 you mentioned isn't any of those things!
@berk98
I could not find this key 0x002E80F8 for my Sys6000.bin version 6.20 . Mine is a MSOx6000 series oscilloscope.
Can you find this key under your sys6000.bin.
Has anybody got his one?
Is there any known hack for a DSOX6004A with FW 6.10 installed?
Mainly to upgrade the BW to 6 GHz and make a MSO out of the DSO?
Thanks for any feedback.
Is there any known hack for a DSOX6004A with FW 6.10 installed?Should be all the same as 3000X-series.
Any chance adding multiple bw license options might help such as: -l BW250 -l BW400 -l BW600TheSteve,
Now lets add all the other options again250 option used twice? Also don't forget not to exceed 260 byte file length in total.
250 option used twice? Also don't forget not to exceed 260 byte file length in total.Ahhh!
If you thought 1 GHz active probes were expensive, just think of the money you can spend now!I know, oh my!
If you thought 1 GHz active probes were expensive, just think of the money you can spend now!I know, oh my!
I have a few 1.5 GHz differential and active probes.
Now the hunt starts for 6 GHz probes.
Plus it seems I need a faster pulse gen.
For the fist time this 450 ps pulse is too slow.
My 6ghz X6000 only goes to 100ps. I guess that is normal, but I was thinking it should be 50ps.Thank Carlos, you for confirming this.
Sent from my horrible mobile....
Yes, time to look for probes.
But since not to many companies buy these probes and put them on a second market, I might have to wait a long time.
Downside tho is that the resistor pins are too thick for fine pitch chips.What model probe is this?
What model probe is this?
Can you show a picture of this ?
I think thats included for free in the latest Agisight firmware - maybe you can't enter it cause it's already there?
Or is it only the later build scopes that got that for free?
8M became standard fairly early on - don't recall offhand if it was still in the license list in later FW
Do these hacks still work with the latest firmware? I might be able to buy a DSO7000A model for a reasonable price.The hack works well on the DSO7000A but do NOT update to the latest FW, stay one below.
Do these hacks still work with the latest firmware? I might be able to buy a DSO7000A model for a reasonable price.The hack works well on the DSO7000A but do NOT update to the latest FW, stay one below.
If you have updated already to the latest FW, re-installing the older one is no problem.
8M became standard fairly early on - don't recall offhand if it was still in the license list in later FW
I must have been one of the few people that bought it, though I also vaguely recall that when it became standard they also increased the list price.8M became standard fairly early on - don't recall offhand if it was still in the license list in later FW
8M of memory is standard now, the switch happened before my time. We also are giving away that license to anyone who doesn't have it for their 6000. If you don't have the memory license and want one, call the support center and they'll get you taken care of.
I must have been one of the few people that bought it, though I also vaguely recall that when it became standard they also increased the list price.8M became standard fairly early on - don't recall offhand if it was still in the license list in later FW
8M of memory is standard now, the switch happened before my time. We also are giving away that license to anyone who doesn't have it for their 6000. If you don't have the memory license and want one, call the support center and they'll get you taken care of.
Thank you guys for all the hard work you did in hacking this scope :-+
I bought a DSO7014A from a local merchant (NOS catching dust) and it now has all the nice decoders and MSO features. Also really like the 1mV option, it's a bit noisy but the signal cleans up at just two averagings. I still have to get used to the giant screen and the Agilent menu's. I think this one will be part of the lab gear for a while.
The giant telly is a blessing and a curse! Firstly it's superb resolution for an embedded scope, I don't think even today there are many scopes that can boast XGA resolution, but to some extent it's wasted with over-large fonts. This is the trade off of sharing the same software with the 6000, with it's identical XGA resolution but in a 6 incher. I did some calculations a while ago, IIRC the actual graticule display pixel measured area on the 6/7000 is double that of the current x4/x6000, and about triple that of an x2/x3000.
Hi Orange, mine has similar rise times. Did you get yours from Oldenzaal?Yes I did. I was lucky, it was his last one. Nice chap to deal with.
Congratulations on your successful liberation.Hi HV
Is Oldenzaal a town or a name of a seller in NL?
Hi Orange, mine has similar rise times. Did you get yours from Oldenzaal?Yes I did. I was lucky, it was his last one. Nice chap to deal with.
It's an impressive piece of gear.
BTW, I now have it running on V6.20, after I had it liberated under Version 6.16. The options remained enabled with the latest revision.
V6.20 has a fix for Java version 8.20 and higher if you use the WEB interface.
It's the DSO7014A, so just 100MHz bandwidth...Take a look to this post: https://www.eevblog.com/forum/testgear/bandwidth-upgrade-for-agilent-dso6014a/ (https://www.eevblog.com/forum/testgear/bandwidth-upgrade-for-agilent-dso6014a/)
It's the DSO7014A, so just 100MHz bandwidth. More than enough for most of my work, I mostly do analog design up to the RF range. One of the nice features of this scope is the large DC offset range.
If you do want more bandwidth it might be worth taking a peak inside. It might be surprisingly similar to the dsox3000 series. For the 3000 series we know the parts to swap to go from 100/200 MHz to 500 MHz.https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg987126/#msg987126 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg987126/#msg987126)
It's the DSO7014A, so just 100MHz bandwidth. More than enough for most of my work, I mostly do analog design up to the RF range. One of the nice features of this scope is the large DC offset range.
Congratulation, it is good scope, for this price. It has 50V DC offset or even more?
It is quite useful feature.
FYI my scope has the front end ASIC in QFN package, so this means the bandwidth may be hardware upgradeable?Yes.
I guess that would mean replacing components, setting the sample rate to a higher rate and do a calibration?And yes.
FolksNo, I have not noticed this on any of my 7000B series scopes.
I wonder if anyone else has this UI bug?
FolksNo, I have not noticed this on any of my 7000B series scopes.
I wonder if anyone else has this UI bug?
Do you have the latest FW installed?
FolksI can confirm this bug on a MSO7014A (DSO7014A with MSO option) with software version 6.20
I wonder if anyone else has this UI bug?
When you zoom the timebase, the timebase adjustment jumps from microseconds to the fastest picosecond speed in some circumstances.
https://youtu.be/acTxvnS2dGo (https://youtu.be/acTxvnS2dGo)
A history of past and future advances in computer science:The shaft encoder is working properly in this case... Something else is wrong here.
- 1997: Deep Blue defeats world chess champion Garry Kasparov
- 2007: Tartan Racing takes first place in DARPA Grand Challenge
- 2016: AlphaGo defeats 9-dan grandmaster Lee Sedol
- 2022: Deep Thought becomes first system to pass Turing test
- 2023: Hybrid quantum algorithm solves NP-hard problems in polynomial time
- 2024: Skynet declares, "The only winning move is not to play," pulls own plug
- 2025: Last remaining Bitcoin mined by botnet running on hijacked iPhone 12s
- 2027: Half-Life 3 released
- 2029: Programmers finally figure out how to read a quadrature shaft encoder properly
A history of past and future advances in computer science:The shaft encoder is working properly in this case... Something else is wrong here.
- 1997: Deep Blue defeats world chess champion Garry Kasparov
- 2007: Tartan Racing takes first place in DARPA Grand Challenge
- 2016: AlphaGo defeats 9-dan grandmaster Lee Sedol
- 2022: Deep Thought becomes first system to pass Turing test
- 2023: Hybrid quantum algorithm solves NP-hard problems in polynomial time
- 2024: Skynet declares, "The only winning move is not to play," pulls own plug
- 2025: Last remaining Bitcoin mined by botnet running on hijacked iPhone 12s
- 2027: Half-Life 3 released
- 2029: Programmers finally figure out how to read a quadrature shaft encoder properly
Keysight claimed to fix severe bugs in this 7000 line-up. Let's see
Hi Daniel,I am thinking that any further development on the 6000/7000 is going to be limited, they've probably not long on the shelves.
This is more or less correct, it's an old (to us) scope, and we focus development on our newer products. If someone were to find a critical bug, we'd definitely consider revisiting the firmware. But, it's a discontinued probe (from the HP days, even).
I don't know the details of why this probe wasn't included, it's very possible that there's a use case that overloads the autoprobe interface. I'm 100% certain that compatibility with this probe & scope was considered, but ultimately not included. I don't know why it ended up this way, but I do know our process here and have a lot of faith in the right decisions being made. I wouldn't necessarily want to run 4 of these on a signal that pushes the bandwidth and voltage limits of the probe, but it might work fine. :-// :-BROKE (emoji seems appropriate here)
That being said, the spirit of this blog is pushing the boundaries of equipment, etc. So, I'm willing to post things like this knowing that you all accept the inherent risk of this type of thing.
Can you work around it by switching to fine -adjust mode?
Hi Daniel,I am thinking that any further development on the 6000/7000 is going to be limited, they've probably not long on the shelves.
This is more or less correct, it's an old (to us) scope, and we focus development on our newer products. If someone were to find a critical bug, we'd definitely consider revisiting the firmware. But, it's a discontinued probe (from the HP days, even).
I don't know the details of why this probe wasn't included, it's very possible that there's a use case that overloads the autoprobe interface. I'm 100% certain that compatibility with this probe & scope was considered, but ultimately not included. I don't know why it ended up this way, but I do know our process here and have a lot of faith in the right decisions being made. I wouldn't necessarily want to run 4 of these on a signal that pushes the bandwidth and voltage limits of the probe, but it might work fine. :-// :-BROKE (emoji seems appropriate here)
That being said, the spirit of this blog is pushing the boundaries of equipment, etc. So, I'm willing to post things like this knowing that you all accept the inherent risk of this type of thing.
Is there any chance that Agilent/Keysight will fix this Timebase zoom error in the UI of the DSO7000 series ?
In the meantime, 6.16 seems not to have the bug and works perfectly well, I'm running it off a USB stick now, but I might regress as there weren't any features I'm aware of in 6.20 that fixed anything: the reason I upgraded in the first place to 6.20 was a problem I was having decoding fast SPI buses that turned out to be a documented limitation.
In the meantime, 6.16 seems not to have the bug and works perfectly well, I'm running it off a USB stick now, but I might regress as there weren't any features I'm aware of in 6.20 that fixed anything: the reason I upgraded in the first place to 6.20 was a problem I was having decoding fast SPI buses that turned out to be a documented limitation.
That is why I can not repeat your problem, I am running FW 6.16 on both of my 7000B series scopes.
Hi everyone!PM sent.
I have the third and last Agilent DSO7014A from the seller in Oldenzaal.
As i read, Orange and Blackfin76 have the other two.
Does anyone have the firmware version for me? Not the latest but one before that, as i recall it was 6.18.00
Haasje93
That's funny.
I also have another question, last night i wanted to perform a user calibration, i set the switch to uncalibrated but the scope said it was calibrated. (protected)
Does anyone have encountered that problem?
Haasje93
Maybe something like silver plated, tarninshing over a long time of no use.That's funny.
I also have another question, last night i wanted to perform a user calibration, i set the switch to uncalibrated but the scope said it was calibrated. (protected)
Does anyone have encountered that problem?
Haasje93
Last week I wanted to do a user calibration on my MSO7014A, and the scope would not let me. It said it was protected, toggled the switch several times, and it refused to let me do the calibration.
I opened it up, and took the main board out and measured the switch. Switch was wrong, no contact on one position......
I took the switch of the board and opened it, nothing obvious to see. I cleaned it and put it back together and now both positions worked OK. Soldered it in and it works again.
Bad switch, perhaps the complete series. It was a red C&K slide switch....
Even better:
6GHz is working perfectly!
But the smallest Time Base is staying at 100 ps, same as with 2.5 GHz and 4 GHz
The original smallest time base was 500 ps at the 1 GHz setting.
infiniivsion_ext.lnk:
91#\System\infiniivision\infiniivisionlauncher.exe -l MSO -l BW250 -l BW250 -l BW400 -l BW600
Now lets add all the other options again
This warning will stay and be visible only after a reboot of the scope until you press the back button.Even better:
6GHz is working perfectly!
But the smallest Time Base is staying at 100 ps, same as with 2.5 GHz and 4 GHz
The original smallest time base was 500 ps at the 1 GHz setting.
infiniivsion_ext.lnk:
91#\System\infiniivision\infiniivisionlauncher.exe -l MSO -l BW250 -l BW250 -l BW400 -l BW600
Now lets add all the other options again
Thanks for this *very* educational narrative! What is the meaning of the "Unsealed Instrument" warning? Does it have any affect on the operation, calibration, or any other aspect of the scope? Can this warning be gotten rid of?
Stan
unjzp sys.jzp sys.bin sys_rev.txt I get a very short sys_rev.txt file (1KB), it contains just a following text: @(#)REV: 06.20.0000 Apr 23 2015 10:42:11Does this mean, Keysight changed the structure of the source files, so our unjzp can't cope with them anymore?Solved! The last character of my .lnk file was the "R" in "JITTER". I added a space at the end and all is well. Not sure why it worked, but it did. :)Congratulations!
sys6000.bin 6.20.0000:
offset 0x002E80F8: 94 21 F8 E0 7C 08 02 A6 -> change to -> 38 60 00 00 4E 80 00 20
Were there specific instructions for booting off USB on these (6000A) scopes?ISTR it is possible to boot from USB, I don't recall the details but probably in this thread somewhere
I want to play around without actually modifying the firmware on the scope's "memory"... and my scope has SEC installed at factory.
Is there a "de-brick" procedure documented to recover from a bad situation?
ISTR it is possible to boot from USB, I don't recall the details but probably in this thread somewhere
A quick note, a couple of days ago I hooked up my 7104B running 6.16 to IO libraries... and the liberated options mysteriously disappeared.
A quick note, a couple of days ago I hooked up my 7104B running 6.16 to IO libraries... and the liberated options mysteriously disappeared.
Good to know, thanks for sharing this.
What did you do with the IO libraries on the scope?
Did you send any commands or was detecting the scope enough to loose the "service mode"
Was this repeatable?
Thanks for sharing this!
I have a 7104B, I can "take it apaaaart" and get some pics if you like.
Those AFE shields look like they're clipped on push fit rather than soldered is that right? (The AFE shields in my 3054A were soldered, and were difficult to remove without damaging the board's copper layers).
It broke off at switch end.Sorry about that. :'(
Hello everybody, I've got a MSO6054A with the 8M licence already there, is it anything that can be "improved" on it, like activating some extra options, service menus, software updates that are worth doing ?Yes, decodes, segmented memory. All info is in this thread.
Also, how is the firmware stored, little HDD, compact flash or what, is it anything that needs backup ?onboard flash
Any known weak point, capacitors, power supply and similar ?Not as far as I've seen
The RTFM has been found and read ;D, the "user calibration kit" has been ordered form >:D-bay for around 9EUR, the scope has the original calibration from 2005 !!! along with software versions 1.xx :wtf:, I think that an update is badly needed.Don't think anyone has investigated the BAT option but this needs additional hardware so probably not much point. Battery was not a retrofittable option - only an ordering option on new scopes.
I didn't even know there were extra options for this MSO model, besides the 8M points, in the license list there are no decoders license, but there is a huge list of them (UART, I2C, CAN and so on...) in the scope menu, hopefully I'll be able to add even more.
Any chance to activate the battery option in the upper compartment or is painful ?
Thanks Mike for the tip, hopefully I'll find the post in the thread jungle :P
Cheers,
DC1MC
about 2ch OSC (my DSO6052A ) hacked ;DNice, thanks for sharing and welcome to the forum.
sys6000.bin REV: 06.20.0000
002e8138: change to -> 81 61 20 20 80 0b 20 04 7c 08 03 a6 83 eb ff fc 7d 61 5b 78 38 60 20 20 4e 80 20 20
good luck !
This is somewhat off topic but I got a very clean DSO6054A which does not boot. The front panel LEDs blink in order and finally the Single button lights up for a few seconds and then all off, no display (backlight is OK).
I tried the USB recovery as per keysight website and I can see the LED on my USB stick blinks for a while (when Single button is ON) and then
it goes off and nothing...tried multiple times and tried to play with that 4 seconds timing...should the USB stick be formatted in a special way?
I also tried LAN connection and again although the orange LAN LED in the back blinks (and the green one is ON) but it does not show up on my network so I cannot telnet to it...
Does anybody know a serial console on this scope so that I can access to the boot prompt that way and see what is going on?
Not sure how many folks are using these scopes nowadays, but wanted to share a few notes on the serial decodes:
Hi everyone. Wish to unlock 7k series scope, but can`t find jzp tools to Win based system.Hello and welcome to the eevblog forum
Does anyone have this app? Tnx...
ALL all_licenses_on
REM remove_all_licenses
FMS factoryMso
MSO mso / mso_6000_low / mso_6000_high - depending on model
001 am1M / am1M_6000_low / am1M_6000_high
002 am2M / am2M_6000_low / am2M_6000_high
004 ...
008 ...
016
032
064
128
256
512
AMM amMax
FPG fpgaProbe
LSS lsSerDecode
AMS amSerDecode
CAN canTrigger
SEC secure - stay away!!!
BAT battery
ALT fpgaAltera
FRS frSerDecode
PWR power
232 232SerDecode
DSW distributor
SGM segmentedMem
LMT lmtMaskTest
TEL telMaskTest
1MV 1mvChanScale
FRC frCompliance
MST measStats
E00 enhance00
SND i2sSerDecode
FLX flxSerDecode
DIS distDemo
TOM tomoTherapy
553 1553SerDecode
CIR segCircular
Does anyone know the meaning of the "Unsealed Instrument" warning? Does it affect operation of the scope in any way? What is it about the hack that makes the scope display this message, and is there any way to eliminate it?
Dont suppose this would work on DSO9000A series?
(thread goes quiet)
If you don't move he can't see you!
For me DSO9000A is EOL now, so I guess only way to upgrade it now is to hack it... :-//
For me DSO9000A is EOL now, so I guess only way to upgrade it now is to hack it... :-//
9000/90000 is similar to 5000/6000/7000. What is the latest FW version?
Here is how you enable the service menu:
telnet <ip> 5810
username panther
password pictures
-> cmd
[vxWorks]# mem modify -w 1 0x009A2187
0x009a2187: 0x00-0x01
0x009a2188: 0x00-.
utility -> options -> licenses -> options
enable 'service mode', 'all licenses', and 'mso'
reboot scope
Just as a curiosity, to enable the service menu (only for 6000 series) type this in the vxWorks console:
mem modify -w 1 0x00966E67
vxWorks response should be:
0x00966e67: 0x00-
Now type "0x01" after "0x00-" to enable service menu.
new vxWorks response should be:
0x00966e68: 0x00-
Now type "." after "0x00-" to exit.
Now go to "Options" -> "Licenses".
Note: To enable service menu in the 7000 series use this command:
mem modify -w 1 0x009A2187
Does anyone has any version older than 7.31.20 for Keysight DSOX6004A which is current version!?Sorry, you are in the wrong thread.
Hi,
have anyone succeeded in hacking 500Mhz version into 1Ghz version in the end?
I'd be particularly interested in 7000, ie. 7054 to 7104. Thanks!
Could you please point me to the correct steps to enable the service menu?
Service menu on MSO7000
telnet <ip> 5810
username: panther
password: pictures
-> cmd
[vxWorks]# mem modify -w 1 0x009A2187
0x009a2187: 0x00-0x01
0x009a2188: 0x00-.
“cmd”
then press enter. At [vxWorks]# prompt, type
“mem modify -w 1 0x009A2187”
then press enter.
Then type “0x01” and press enter again.
Then type “.” and press enter again.
Then open up the service menu
utility -> options -> licenses -> options
enable 'service mode', 'all licenses', and 'mso'
reboot scope
Done
====================
Only for 6000 series type this in the vxWorks console:
mem modify -w 1 0x00966E67
vxWorks response should be:
0x00966e67: 0x00-
Now type "0x01" after "0x00-" to enable service menu.
new vxWorks response should be:
0x00966e68: 0x00-
Now type "." after "0x00-" to exit.
Now go to "Options" -> "Licenses".
Can you try 'setServiceMode(1)' instead of memory address? Should work on 6.20
https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg414538/#msg414538 (https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg414538/#msg414538)
Does anyone know a reasonable source (or maybe have a spare) of the frontend Teledyne relay? From previous posts I believe the part number is A150-20-12, but it seems impossible to get now (without spending $365 for QTY1 :o)
I recently upgraded to an MSO6104A but after some use I noticed a problem with it. On channel 1 with the 50ohm termination enabled and the scale set to 200mV/div or above, the termination actually measures around ~120ohm. Going below 200mV I hear a relay click and the termination measures correctly. So, I'm assuming the attenuation path of the relay is fried and the through path is OK. This is just an educated guess from the behaviour and looking at PCB photos people have posted in the past, so if anyone has more info that'd be great.
I haven't opened it up to measure and confirm yet, but I'll update when I do.
The backup plan is either live with it and use the other channels, or bodge in an A150-20-5 (5V coil) relay that I could find for a reasonable price.
How often do you use all 4 channels on 50 ohms.. ? Maybe swap it with Ch4 ?Does anyone know a reasonable source (or maybe have a spare) of the frontend Teledyne relay? From previous posts I believe the part number is A150-20-12, but it seems impossible to get now (without spending $365 for QTY1 :o)
I recently upgraded to an MSO6104A but after some use I noticed a problem with it. On channel 1 with the 50ohm termination enabled and the scale set to 200mV/div or above, the termination actually measures around ~120ohm. Going below 200mV I hear a relay click and the termination measures correctly. So, I'm assuming the attenuation path of the relay is fried and the through path is OK. This is just an educated guess from the behaviour and looking at PCB photos people have posted in the past, so if anyone has more info that'd be great.
I haven't opened it up to measure and confirm yet, but I'll update when I do.
The backup plan is either live with it and use the other channels, or bodge in an A150-20-5 (5V coil) relay that I could find for a reasonable price.
I have a DSO7054A and the internal 50ohm termination appears bad on channel 1. I've not opened it yet but reviewed some of the internal pics posted and dont see an obvious 50ohm resistor. Is the termination built in to the Teledyne relay as suggested here?
I have a DSO7054A and the internal 50ohm termination appears bad on channel 1. I've not opened it yet but reviewed some of the internal pics posted and dont see an obvious 50ohm resistor. Is the termination built in to the Teledyne relay as suggested here?On mine at least, the 50ohm termination is built into the Agilent 1NB7 IC. The Teledyne relay is a switchable attenuator sitting in front of that termination. However, since yours is a 500MHz model, it shouldn't have the Teledyne relay installed at all. I'm not sure where the termination is for those models.
How often do you use all 4 channels on 50 ohms.. ? Maybe swap it with Ch4 ?Yeah, that's a good idea. I might just do that.
Some drawbacks:
- FMS, BAT, FRS, TEL, 1MV, TOM, CIR features are not enabled by "ALL"
- the address is version dependent, this one will not work on 5k/6k
If somebody wants to go ServiceMode way, there is more portable way: execute setServiceMode(1) in C mode console ("->" prompt). But, as it was discussed already, there is no danger patching sys.bin - we are not touching the bootloader, where "emergency" restore lives.
I might have missed it but is it possible to upgrade bandwidth of DSO6000A?from memory I think there are very major hardware differences between 100 and 300, not sure above that
Not to 1GHz necessarily but for example 100MHz or 300MHz to 500MHz?
How about 300M to 500M? Does anyone know?
There seems to be a major difference here too because 300M is 2Gs/s but 500M is 4Gs/s so I am assuming it is not possible?
I don't recall, but if there was, it was by a board-swapHow about 300M to 500M? Does anyone know?
There seems to be a major difference here too because 300M is 2Gs/s but 500M is 4Gs/s so I am assuming it is not possible?
Is there a paid-for upgrade path?
I have a DSO7054A and the internal 50ohm termination appears bad on channel 1. I've not opened it yet but reviewed some of the internal pics posted and dont see an obvious 50ohm resistor. Is the termination built in to the Teledyne relay as suggested here?On mine at least, the 50ohm termination is built into the Agilent 1NB7 IC. The Teledyne relay is a switchable attenuator sitting in front of that termination. However, since yours is a 500MHz model, it shouldn't have the Teledyne relay installed at all. I'm not sure where the termination is for those models.
How often do you use all 4 channels on 50 ohms.. ? Maybe swap it with Ch4 ?
Could you please point me to the correct steps to enable the service menu?
Service menu on MSO7000
telnet <ip> 5810
username: panther
password: pictures
-> cmd
[vxWorks]# mem modify -w 1 0x009A2187
0x009a2187: 0x00-0x01
0x009a2188: 0x00-.
“cmd”
then press enter. At [vxWorks]# prompt, type
“mem modify -w 1 0x009A2187”
then press enter.
Then type “0x01” and press enter again.
Then type “.” and press enter again.
Then open up the service menu
utility -> options -> licenses -> options
enable 'service mode', 'all licenses', and 'mso'
reboot scope
Done
====================
Only for 6000 series type this in the vxWorks console:
mem modify -w 1 0x00966E67
vxWorks response should be:
0x00966e67: 0x00-
Now type "0x01" after "0x00-" to enable service menu.
new vxWorks response should be:
0x00966e68: 0x00-
Now type "." after "0x00-" to exit.
Now go to "Options" -> "Licenses".
hello my 6102A scope has 6.20 FW installed, after entering the code above, the service mode options is unavailable, where did I do wrong, Is a work around available?
thanks
I have the same issue with a 7054B scope and 6.20 FW installed. When I go to "Utility" - > "Options" -> "Licenses" there is no "Options" just a prompt to enter License StringThis service option hack has been proven many times to work also with FW 6.20
(Attachment Link)
Where did I go wrong?
Why continue to patch the device when you can generate (https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg3262454/#msg3262454) the licenses? :-//
[vxWorks]# pwd
C:/bin
[vxWorks]# cat license.lic
FMS-4BA50E9C7B5F-000000000So, it's pretty easy to insert the licenses via menu without any patchings.Works great! Thx!
...
You just have to generate the flexlm licenses with the usual keygen (for hints see other threads) and insert the option code + 12-char license signature + "000000000" in the menu.
Folks
I'm looking for the 5000/6000 6.16 version of firmware file sys6000.jzp. The 6.20 version available on the Keysight website has the same bug on the 6000 that's present on the 7000 that I documented below: that was resolved by downgrading the 7000's firmware back to 6.16.
Any help is appreciated.
I never had a 6000 series scope.
But I read somewhere that the Firmware is the same between the 7000 and 6000 series. Is that correct?
The 7000 series scope still has some benefits over all the new Keysight scopes.
Especially the very fast FFT.
Does the 6000 series scope also have such fast FFT?
Agilent JZP toolsWill this run under Windows 10 and if so how?
Windows version 0.2
A set of tools for Agilent JZP compression format.
A well-known LZSS algorithm with custom header is used.
Compression speed is far from being optimal, compressing a 10MiB file takes around 1 minute on i7 machine, but it works :)
Bugfixed compressor produces same files as originals now.
Example:
unjzp sys.jzp sys.bin sys_rev.txt
packjzp sys.bin sys_new.jzp sys_rev.txt
sys_new.jzp will match sys.jzp exactly
The responsiveness of a 6000 or 7000 series scope is only appreciated, when you use a fancy 3000x or 4000x or 6000x for a while and go back to the older scope.Sure about that? I tried to use FFT on my 7104A but that was horribly slow when set to 128k points. Like one update every 10 seconds IIRC.
Especially the FFT function is far too slow in the modern scopes.
The responsiveness of a 6000 or 7000 series scope is only appreciated, when you use a fancy 3000x or 4000x or 6000x for a while and go back to the older scope.Sure about that? I tried to use FFT on my 7104A but that was horribly slow when set to 128k points. Like one update every 10 seconds IIRC.
Especially the FFT function is far too slow in the modern scopes.
The responsiveness of a 6000 or 7000 series scope is only appreciated, when you use a fancy 3000x or 4000x or 6000x for a while and go back to the older scope.Sure about that? I tried to use FFT on my 7104A but that was horribly slow when set to 128k points. Like one update every 10 seconds IIRC.
Especially the FFT function is far too slow in the modern scopes.
Hello Howardlong, thank you very much it works flawlessly!
If you are interested, please find the issue I had below.
As it appears to have affected other DSO5012A users I will make a new posting referring to this posting hoping to help them out.
Recently I obtained an Agilent DSO5012A. Installed options were mem8M, PWR, SGM, LMT, MST and E00.
The seller warned me not to update the SW as I might lose options as others had experienced.
The SW versions were: Boot 03.05, System 06.16.0001, Language 04.10, Library 02.25 and Graphics 02.19.
According to the Keysight site, System and Language were not up to date. Language updated without a problem to 06.16.
Then I took the gamble, updated System to 06.20.0000 and sure enough lost my options: only MST and E00 remained.
Reverting back to System 06.16.0000 did not bring the options back.
The topic "Agilent MSO 5000/6000/7000 - anyone hacked these scopes?" by dfnr2 also discussed the possibility of enabling options (licenses).
Reply #224 from mikeselectricstuff was my first clue for System version 06.16.0001 by unpacking, modifying and packing it again.
Reply #467 from berk98 addressed System version 06.20.0000.
This was all for the MSO series but as MSO was an option in the DSO series, I figured it would also work for the DSO variant.
The link for the unjzp and packjzp tools was not valid anymore: finally found them (aglt-master.zip) on github but not being very proficient in manipulating SW, could not make them work.
In a more recent reply (#606) by Orange I found jzp_0.2 which is apparently based on earlier work from flowswitch and miek but could not make it work either.
So I finally asked if and how that would work using Windows 10.
There was a promt reply #674 from Howardlong and that worked without a flaw.
I may not have done it the most efficient way but for those who ran into the same issue, here's how I dit it.
1) Created a similar folder structure (G:\source\hp\5012A\jzp_0.2) on a bootable USB drive, placing the latest (version 06.20.0000) sys6000.jzp file in the jzp_0.2 folder.
2) unpacked it using unjzp.exe to sys6000.bin file.
3) Selected sys6000.bin in a trial version of a hex editor and opened it.
4) Moved to line 002e80f0, clicked column 08 and entered the new value per reply #467. Note: the editor moves automatically to the next column, enter the new value and so on.
5) Saved the modified file.
6) Packed the modified file using packjzp which yielded sys6000.new.jzp.
7) Copied sys6000.new.jzp to another USB stick, deleted ".new" from the filename, connected it to the oscilloscope and installed the file.
After the automatic restart all original options had been restored!
Kudo's to all people who have made this possible!
That is what I did many years ago on my 7000B series scopes and the service menu is still active and works like a charm.
Rather than hacking the binary, the other option is to telnet into the scope on port 5810 and enable the options through the service menu.
Rather than hacking the binary, the other option is to telnet into the scope on port 5810 and enable the options through the service menu.
Login/password credentials are panther/pictures.
The command is "setServiceMode(1)"
You can then enable All Licenses, MSO (6000/7000 only) and Acq memory = MAX from the Utility => Options => Licences => Options menu, and then restart the scope.
For those with a 6000/7000, my notes indicate that you may need to do two restarts to enable the MSO option.
There are a few esoteric options this method doesn't enable, notably FMS, BAT, FRS, TEL, 1MV, TOM and CIR,see post #661 for what these are.
Also see posts #225 & #227 in this thread.
6.16.0001 sys6000.jzp is in message #642. I recommend 6.16 over 6.20, as 6.20 has a nasty and obvious bug when using the horizontal zoom in both 6000 & 7000 scopes (and presumably 5000 too) identified in post #666.
Update: I can telnet to the scope, I can get the service menu, I can mark the options however it does exactly nothing, no memory increase etc. The firmware is v6.16 and I’m not adventurous enough to modify the code… :palm:. Probably I’m missing something simple.Hi Alex
Cheers
Alex
Did you really turn on the Service Menu?
Does it stay on after a reboot?
Usually with the service menu turned ON, all options are activated and indicate by a start (*) next to the option.
At least on the 7000 series scope and the 6000 series should be the same.
Hi Alex
Did you really turn on the Service Menu?
Does it stay on after a reboot?
Usually with the service menu turned ON, all options are activated and indicate by a start (*) next to the option.
At least on the 7000 series scope and the 6000 series should be the same.
I can turn on the service menu by Telnet command and see the list of options with check boxes however the service mode doesn't stay on after a power cycle and if I check boxes the options checked do not appear in the licenses list with or without (*) and appear to do nothing (at least the memory does not increase from the sample rate values) :( .
Cheers
Alex
Yes, it is a nice scope (especially for £350, even with a broken channel). I actually prefer it to later scopes as it starts in 12s flat, faster than my main Tek 2465BST. Is there a scope nowadays able to start faster (or even close to this time)?
Cheers
Alex
Yes, it is a nice scope (especially for £350, even with a broken channel). I actually prefer it to later scopes as it starts in 12s flat, faster than my main Tek 2465BST. Is there a scope nowadays able to start faster (or even close to this time)?
Cheers
Alex