Author Topic: DPO3000 Hacks  (Read 35368 times)

0 Members and 1 Guest are viewing this topic.

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1021
  • Country: ca
Re: DPO3000 Hacks
« Reply #50 on: August 28, 2020, 01:56:29 pm »
can options (not necessarily the BW) be enabled on DPO4000 using the SCPI commands?
 

Offline VooDust

  • Regular Contributor
  • *
  • Posts: 70
  • Country: ch
Re: DPO3000 Hacks
« Reply #51 on: August 28, 2020, 07:49:05 pm »
But w.r.t. calibration, did you check the bandwidth? is it in fact >=500MHz?

I probed a 433Mhz carrier signal earlier this week. It allowed me to build a clone of my garage door opener. Since I only own 200 MHz probes, I presume the signal was attenuated heavily.

However, at 100 MHz, or 150 MHz (which is the available low pass setting when running the 500 MHz model) the RF signal was virtually nonexistent! With 500 MHz however, I got 800mV peak-to-peak!

So yes the upgrade is the bomb! I'm not able to provide details like trigger sensitivity, rise time etc. since I lack the equipment (and knowledge).

Cheers.
« Last Edit: August 28, 2020, 07:52:16 pm by VooDust »
 

Offline VooDust

  • Regular Contributor
  • *
  • Posts: 70
  • Country: ch
Re: DPO3000 Hacks
« Reply #52 on: August 28, 2020, 07:58:58 pm »
If only I could upgrade from 2 to 4 channels... I would trade the 500 Mhz for this  |O
 

Offline smaultre

  • Regular Contributor
  • *
  • Posts: 198
  • Country: us
Re: DPO3000 Hacks
« Reply #53 on: September 02, 2020, 02:46:46 pm »
Sure i make some research. It works, but there in the 4054 has no much dac's and demux chips on the board physically  :-//
Its the perfect way upgrade 4034 to 4054 !
« Last Edit: September 02, 2020, 06:00:58 pm by smaultre »
Start a new life here!!!
 

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1021
  • Country: ca
Re: DPO3000 Hacks
« Reply #54 on: November 25, 2020, 02:58:46 pm »
I upgraded my DPO3012 from 100MHz to 500Mhz. After my initial joy  :scared: I noticed something very odd:



The "zero line" (i.e. measuring ground) is out of alignment - it's always minus half-a-div for vertical divs >= 50mV. So:

  • 10mV - OK
  • 20mV - OK
  • 50mV - minus 1/2 div, AVG is -25mV
  • 100mV - minus 1/2 div, AVG is -50mV
  • 200mV - minus 1/2 div, AVG is -100mV
  • and so on...

I ran some checks and this happens for either 500MHz and 300MHz settings, with 300MHz being off minus 1 div instead. Kind of a deal breaker...

Does anyone have a clue what's going on? It happens regardless of input termination, AC/DC coupling (!), trigger settings, or probe attenuation and bandwith settings. I tried adjusting the "Offset" parameter of the probe, but that just shifts the phosphor line, the wrong voltage values remain.

Luckily I was able to downgrade back to 100MHz and everything is back to normal  :phew:

would you mind saying which of the commands/methods you used for BW upgrade? also was your S/N >C020xxxx or <C020xxxx?

 
The following users thanked this post: sicco

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1021
  • Country: ca
Re: DPO3000 Hacks
« Reply #55 on: November 25, 2020, 03:19:19 pm »
I cannot get these to work and my IDA skills are too bad to figure out what is happening.

As I said in the other thread, there should also be a debug console avalible that is accessible through TCPIP but I cannot figure out how to connect to it....

Just a guess, but maybe Telnet? I have an MSO3034 -  I'll give it a try later today and see what happens.

Jay

OK, so using telnet didn't work, but using my browser (Firefox) brings up a Tektronix menu.
I selected the tab "DATA" and I'm able to talk to the scope using GPIB commands.
I then sent the following per abyrvalg's post:

:SETMODELID 5
:HWAccountant:ACQBandwidth 500

Then power-cycled the unit. It did not make any changes.
So I used the back door password first:

:PASSWord "INTEKRITY"
:SETMODELID 5
:HWAccountant:ACQBandwidth 500

Then power-cycled the unit again. Still no change. I'm probably doing something wrong; I'm an idiot when it comes to stuff like this...  :-//

Jay

OK, it's confirmed, I am an idiot.  :-/O Remove the quotes around the password:
:PASSWord INTEKRITY
:SETMODELID 5
:HWAccountant:ACQBandwidth 500

Voila, it reports that it is a MSO5054!

Thank you very much abyrvalg!  :clap: Now to do some bandwidth testing!

Jay

Was your serial number >C0200000 or less?
was the upgrade successful both in triggering, amplitude and also in doing measurements?
 

Offline KrzysztofB

  • Regular Contributor
  • *
  • Posts: 101
  • Country: pl
Re: DPO3000 Hacks
« Reply #56 on: June 09, 2022, 09:06:02 am »
I know topic is a bit old, but does anyone know if anything changed?
I was trying to unleash some serial decoding features on our old C01xxx DPO3034 to see if it would be worth purchasing it, but somehow ":ARMDEMO" seems to not work what so ever?
Anyone something about the topic?
 

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1021
  • Country: ca
Re: DPO3000 Hacks
« Reply #57 on: August 01, 2022, 04:16:30 pm »
Has anyone tried doing the factory adjustment on DPO3000? Is it possible to do it DIY without Fluke calibrator?

perhaps JWalling can comment on this  ;)
 

Offline Jwalling

  • Supporter
  • ****
  • Posts: 1517
  • Country: us
  • This is work?
Re: DPO3000 Hacks
« Reply #58 on: August 02, 2022, 09:05:17 am »
Has anyone tried doing the factory adjustment on DPO3000? Is it possible to do it DIY without Fluke calibrator?

perhaps JWalling can comment on this  ;)

I've never tried...
Jay

System error. Strike any user to continue.
 

Offline OYAZI

  • Newbie
  • Posts: 6
  • Country: jp
Re: DPO3000 Hacks
« Reply #59 on: August 15, 2022, 01:32:22 am »
Hello,
DPO/MSO3000
I was success that change of a model name and B/W.
Does anyone know the way to change s/n?
 

Offline darkstar49

  • Frequent Contributor
  • **
  • Posts: 309
Re: DPO3000 Hacks
« Reply #60 on: August 15, 2022, 04:18:20 pm »
That info is at the beginning of the thread…
What’s the point changing the serial ? Do you expect to fool Tek in case you’d use their servicing ?
I’d be careful doing that… the instrument Id, which is if I remember well, derived from the serial, and is used to compute option keys… and I’m’pretty sure the instrument Id is stored at several places, either in the NVRAM, on the file system (flash), or both… and I wouldn’t be too confident that the call to alter the serial will update everything as it should…
« Last Edit: August 15, 2022, 04:23:43 pm by darkstar49 »
 

Offline ebastler

  • Super Contributor
  • ***
  • Posts: 7375
  • Country: de
Re: DPO3000 Hacks
« Reply #61 on: August 16, 2022, 09:36:33 pm »
Does anyone know the way to change s/n?

Did you steal your scope or do you plan to use it to commit a crime?  ::)
 

Offline OYAZI

  • Newbie
  • Posts: 6
  • Country: jp
Re: DPO3000 Hacks
« Reply #62 on: August 17, 2022, 01:51:14 am »
There is DPO3000 which damaged physically and there is other DPO3000 to which the mainboard is failed.
Don't you think to replace a mainboard with other machines?
 

Offline ebastler

  • Super Contributor
  • ***
  • Posts: 7375
  • Country: de
Re: DPO3000 Hacks
« Reply #63 on: August 17, 2022, 05:46:46 am »
No worries, I was just kidding.

If my scope needed repair via a new (used) mainboard, I would not mind if it ended up with a different serial number in firmware vs. the stricker on the enclosure. Same as with an engine swap on a car, I guess. And as others have said, it is probably not so easy to change the serial number.
 

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1021
  • Country: ca
Re: DPO3000 Hacks
« Reply #64 on: August 17, 2022, 03:12:41 pm »
No worries, I was just kidding.

If my scope needed repair via a new (used) mainboard, I would not mind if it ended up with a different serial number in firmware vs. the stricker on the enclosure. Same as with an engine swap on a car, I guess. And as others have said, it is probably not so easy to change the serial number.
but it will be an issue if you decide to sell the scope (or the car)

Changing the SN is easy to do either with SCPI or through the UART. But I have a bigger problem at hand which I hope someone can shed some light on

I have had this DPO3054 for about 2 years with a cooked front end board (TEK calls it attenuator board). The FPGA on the attenuator board was literally cooked.
So I finally got my hands on a very broken DPO3034 with broken case, missing PSU, and devoured main board but with good attenuator board. So I replace it and the scope works perfecly albeit totally out of calibration but it even passes SPC. However, it fails the self test (even power on self test) and the only reason is Attenuator board serial number mismatch It shows up as "No Ser" and I have not been able to enter/program the SN of the new atten board into the scope.

Does anybody know what needs to be done?
 

Offline darkstar49

  • Frequent Contributor
  • **
  • Posts: 309
Re: DPO3000 Hacks
« Reply #65 on: August 19, 2022, 09:20:01 am »

There are two options to address the issue...

The first one would be to patch the firmware to ignore the mismatch, the second is to alter the serial on either side, assuming they're to be identical, and not somehow 'related' via some computation...???
A detailed 'system config' dump of a genuinely 'normal' DPO3K could perhaps help clarify this, if someone has one at hand.
Do you know where the FE board's serial is stored ? Is it 'burned' into the FPGA or stored in some NVRAM on the FE board ?
 

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1021
  • Country: ca
Re: DPO3000 Hacks
« Reply #66 on: August 19, 2022, 10:40:23 am »


Do you know where the FE board's serial is stored ? Is it 'burned' into the FPGA or stored in some NVRAM on the FE board ?

How to alter the serial? That was my question. That's what I have been trying to do...

There are no eeprom on that board. Can they store it in a FPGA?


in a good scope, the SN of the atten board appears in the list on the config page. in this scope, it shows "No Ser"

 

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1021
  • Country: ca
Re: DPO3000 Hacks
« Reply #67 on: August 19, 2022, 12:03:43 pm »
the thing is I can change SN of all the othe modules, PSU, FP board, Display, Main board...it is just the Attenuator board that cannot be changed  |O |O |O
 

Offline lern01

  • Regular Contributor
  • *
  • Posts: 94
  • Country: cn
Re: DPO3000 Hacks
« Reply #68 on: November 02, 2023, 04:05:24 am »
Very sorry, restart the thread, DPO3000 module crack someone successful?
 

Offline lern01

  • Regular Contributor
  • *
  • Posts: 94
  • Country: cn
Re: DPO3000 Hacks
« Reply #69 on: November 02, 2023, 08:28:14 am »
Looks like some things (including BW upgrade) can be done over GPIB, but I don't have a scope to verify. Somebody willing to try?

Some interesting commands:
:PASSWord "password"- enable special modes
  Valid passwords:
  "XYZZY" - "user's password"
  "INTEKRITY" - "backdoor password" (this is the right one for other "backdoor" mode commands)
  "PUBLIC" - "public password"
  "TRESPASS" - "developer password"
  "MKTDEMO" - ???

:SETMODELID id - set model
  Valid IDs:
  0 - MSO/DPO3012 (MSO/DPO is selected by digital channels presense)
  1 - MSO/DPO3014
  2 - MSO/DPO3032
  3 - MSO/DPO3034
  4 - MSO/DPO3052
  5 - MSO/DPO3054

:HWAccountant:SERIAL - get/set serial number

:HWAccountant:INSTRumentid - get instrument id (no set here, it is generated from model+serial)

:HWAccountant:ACQBandwidth bw - bandwidth upgrade
  valid values:
  300
  500

:ARMDEMO pass, num_days - activate demo mode
   pass: "DontMakeTheWookieMad"
   num_days 1-30



I successfully connected to the computer through the LAN, and the following situation appears when I entered the command. What is the cause?
« Last Edit: November 02, 2023, 08:31:46 am by lern01 »
 

Offline lern01

  • Regular Contributor
  • *
  • Posts: 94
  • Country: cn
Re: DPO3000 Hacks
« Reply #70 on: November 02, 2023, 08:56:41 am »
My oscilloscope DPO3014,Version:2.38 Serial Number:C02xxxx.
 

Offline BillCRM

  • Contributor
  • Posts: 27
  • Country: cn
Re: DPO3000 Hacks
« Reply #71 on: September 13, 2024, 01:07:04 pm »
Looks like some things (including BW upgrade) can be done over GPIB, but I don't have a scope to verify. Somebody willing to try?

Some interesting commands:
:PASSWord "password"- enable special modes
  Valid passwords:
  "XYZZY" - "user's password"
  "INTEKRITY" - "backdoor password" (this is the right one for other "backdoor" mode commands)
  "PUBLIC" - "public password"
  "TRESPASS" - "developer password"
  "MKTDEMO" - ???

:SETMODELID id - set model
  Valid IDs:
  0 - MSO/DPO3012 (MSO/DPO is selected by digital channels presense)
  1 - MSO/DPO3014
  2 - MSO/DPO3032
  3 - MSO/DPO3034
  4 - MSO/DPO3052
  5 - MSO/DPO3054

:HWAccountant:SERIAL - get/set serial number

:HWAccountant:INSTRumentid - get instrument id (no set here, it is generated from model+serial)

:HWAccountant:ACQBandwidth bw - bandwidth upgrade
  valid values:
  300
  500

:ARMDEMO pass, num_days - activate demo mode
   pass: "DontMakeTheWookieMad"
   num_days 1-30
The command for change serial number seems doesn't work, I tried on dpo2014 and dpo3054 and failed, the hack for model and bandwidth worked well. Maybe I didn't use it correctly?
Could you provide a command example?
 

Offline phenol

  • Regular Contributor
  • *
  • Posts: 153
Re: DPO3000 Hacks
« Reply #72 on: December 18, 2024, 11:03:42 pm »
i updated a dpo3034 with a serial C01… to dpo3054 with :SETMODELID 6. While the -3db point went above 500MHz, the pulse response didn’t look quite right-too much overshoot, jittery rise time readings and unstable triggering. The pulse source was tested on a higher bandwidth scope and was reasonably flat. I wasn’t content with the result so i bumped it back down to 3034 with SETMODELID 4. After rebooting it was back to stock 300MHz.
However, the self test started to return a cpu error (see attached image) erratically. looks like a voltage somewhere is too low. I doubt it’s related to my attempt at hacking it, but who knows, maybe a coincidence? Anyway, i reseated some connectors on the cpu board and it now passes the self test every time.
Does anyone know where and what U0801 is? Ill go back in and measure the voltage on that pin 7 if it craps out again
 

Online analogRF

  • Super Contributor
  • ***
  • Posts: 1021
  • Country: ca
Re: DPO3000 Hacks
« Reply #73 on: December 18, 2024, 11:37:45 pm »
i updated a dpo3034 with a serial C01… to dpo3054 with :SETMODELID 6. While the -3db point went above 500MHz, the pulse response didn’t look quite right-too much overshoot, jittery rise time readings and unstable triggering. The pulse source was tested on a higher bandwidth scope and was reasonably flat. I wasn’t content with the result so i bumped it back down to 3034 with SETMODELID 4. After rebooting it was back to stock 300MHz.
However, the self test started to return a cpu error (see attached image) erratically. looks like a voltage somewhere is too low. I doubt it’s related to my attempt at hacking it, but who knows, maybe a coincidence? Anyway, i reseated some connectors on the cpu board and it now passes the self test every time.
Does anyone know where and what U0801 is? Ill go back in and measure the voltage on that pin 7 if it craps out again

u0801 is a temperature and fan controller and pin 7 is the tacho pin of one of the fans that it can control. so probably the fan is failing.

these scopes never had an official BW upgrade and I have had bad experience trying to upgrade the BW by SETMODELID.
the board is not really calibrated up to 500MHz and then just limited by software to 300MHz like in MDO3000 or ol TDS3000
it will need a full adjustment
 

Offline phenol

  • Regular Contributor
  • *
  • Posts: 153
Re: DPO3000 Hacks
« Reply #74 on: December 18, 2024, 11:49:31 pm »
thanks for the input. to my knowledge this thing only has one fan. I'll look into it.
as for the "upgrade ", im actually happy i could downgrade it back to its stock settings.
years ago i did that to a TDS3034 (3064 now) with greater success- good step response, stable triggering
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf