Hacking Keysight 1000X

[Claus1]

Hello. Has anyone hacked any 1000 series Keysight DSO?  I have seen Dave's vid from 2017. Just wondering has anyone done it. Would be really good value for the price.

[tautech]

Except for the poor mem depth and lack of features that other brands offer at lower prices.

[TK]

The 2 channel models have been hacked: https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg2674032/#msg2674032

[Fungus]

Hello. Has anyone hacked any 1000 series Keysight DSO?

Yes. These days it can be done by inserting a USB stick, no hardware mods necessary:

https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg2062735/#msg2062735

[TK]

It needs to have firmware 1.10 or lower.  I don't think there is a hack for firmware 1.20

[Mr. Scram]

Except for the poor mem depth and lack of features that other brands offer at lower prices.

Siglent dealer says what? 

[tautech]

Except for the poor mem depth and lack of features that other brands offer at lower prices.

Siglent dealer says what? 

Facts !

[Mr. Scram]

Facts !

FUD and propaganda! Consider contributing useful information from your unique position instead of just ripping on any competition like a generic fanboy. Buyers looking for what's best for them aren't served by pissing contests and endless discussions about differences blown out of proportion. We could do without the paid Siglent trolls sucking the nuance out of every discussion.

[Fungus]

It needs to have firmware 1.10 or lower.  I don't think there is a hack for firmware 1.20

I'm sure a hack will appear but meanwhile the difference is very small:

https://www.keysight.com/upload/cmc_upload/All/Keysight_1000A_X_Series_Oscilloscope_Release_Notes_01_20.pdf

(three minor bug fixes and some enhancements in FRA).

Me? I wouldn't pass on it because of that...

[TK]

The problem is that if you receive a new scope with 1.20 installed, there is no way to install an older version, so no hack possible.  It is only possible to downgrade if you have the hacked 1.10 firmware installed.

[Fungus]

The problem is that if you receive a new scope with 1.20 installed, there is no way to install an older version, so no hack possible.  It is only possible to downgrade if you have the hacked 1.10 firmware installed.

Good point.

Time to nag the hackers...

[tv84]

You should install a "special" newer version that will re-enable installation of older versions.

[Claus1]

Except for the poor mem depth and lack of features that other brands offer at lower prices.

I have seen Siglent scopes however 200 Mhz version(4 channels) is almost same as Keysight's hacked 1000 series. Memory depth isn't too important for me, if it's around 1 Million points or more it's good enough. I personally love the knobs above each channel, i can't stand multipurpose knobs.

[Claus1]

You should install a "special" newer version that will re-enable installation of older versions.

Can you give me a link perhaps?

All the other guys, thanks for your help.

[tautech]

Except for the poor mem depth and lack of features that other brands offer at lower prices.

I have seen Siglent scopes however 200 Mhz version(4 channels) is almost same as Keysight's hacked 1000 series.

Older L models ?
They don't even compare with the KS and later Siglent X or X-E models.
X models unfortunately had optional features like the KS however most of those are at zero additional cost for X-E models so it's only the more advanced features in X-E that you would want to hack, WiFi, AWG and MSO and they each have additional HW costs too.

Memory depth isn't too important for me, if it's around 1 Million points or more it's good enough.

Yep understand that but good mem depth is a must have for many.

I personally love the knobs above each channel, i can't stand multipurpose knobs.

I was certainly in the same camp until I got a pre-release SDS1104X-E to beta test, sure it took a few minutes to become comfortable with the physical UI but how Siglent have put it together and how the indicators show which channel is active to the multiplexed control it works surprisingly well.
There has been a suggestion or two on the forum for changes but IMO Siglent got this right from the get go.

[2N3055]

Unless somebody makes a license generator in the style of Riglol, so you can install updates and use latest firmwares, I don't consider hacked Keysight a good thing.

Whole idea is that Keysight is more expensive despite being slightly inferior hardware and capabilities is that it is supposed to have superb quality of support. Which you give up voluntarily if you hack it.
You cannot install newest versions of firmware (with bug fixes) because of hack, and have to wait for months for new hack for new firmware. Not to mention if you have to send it in for warranty, and you have defect that won't let you restore factory firmware. And you have no clue what's gonna happen.

Don't get me wrong, new Rigols are also in that boat, but they don't carry price premium for services you give up on....

[tv84]

Totally agree.

[Fungus]

Whole idea is that Keysight is more expensive despite being slightly inferior hardware and capabilities

I thought it was also the massive power of their ASIC - based chipset, the really fast user interface, etc

is that it is supposed to have superb quality of support. Which you give up voluntarily if you hack it.

Do you give it up? If I take a 'scope back with a dead power supply would Keysight refuse to touch it?

[Claus1]

I guess i will leave Keysight hacking as you suggested. Have to dig into endless Siglent vs Rigol vs GW topics now...

[Fungus]

I guess i will leave Keysight hacking as you suggested. Have to dig into endless Siglent vs Rigol vs GW topics now...

Bear in mind that if they're endless then it means there's no "correct" answer, despite what the resident Siglent salesmen keep on repeating ad nauseam.

(Also: If hacked Keysight version 1.2 firmware appears while you're still deciding then you know what to do...)

[tv84]

FERCSA patched FW enables all the Options from 3 to 39 (attached pic).

Replicating his patch to newer FW is boresome...

Anyone has a memdump of a DSO1000X ?

[Fungus]

FERCSA patched FW enables all the Options from 3 to 39 (attached pic).

Replicating his patch to newer FW is boresome...

It should really be automated by now. 


I don't know the details. Does he do it by hand with a hex editor or is there some sort of scripted search/replace process?

I notice there's an acquisition memory upgrade. Can this be hacked to 4Mb memory? I believe there's 4Mb RAM inside the ASICs.

(one of the reasons this 'scope is so amazingly fast is that the RAM is inside the ASIC but it's a double-edged sword because it means RAM is limited to 4Mb even on the high-end models).

This should probably be in the hacking thread.

[tv84]

FERCSA patched FW enables all the Options from 3 to 39 (attached pic).

Replicating his patch to newer FW is boresome...

It should really be automated by now.

I don't know the details. Does he do it by hand with a hex editor or is there some sort of scripted search/replace process?

I doubt it. This is not a production line... And since (I think) he has done it only once, it's not something that you go and automate right on.

If one automates, it requires lots of tests to be safe. Many times it's not worth the risk for this kind of task.

[tv84]

This should probably be in the hacking thread.

Are we not there? ?

[Fungus]

If one automates, it requires lots of tests to be safe. Many times it's not worth the risk for this kind of task.

The version changes are minor so binary code is unlikely to change much unless Keysight does it deliberately. There's probably not much danger in automating it.

What's really needed is a single automated hack to enable firmware downgrades. After that way people can use tried and trusted hacked firmwares while hacking of newer versions is in progress.


These 'scopes run windows CE, people have managed to get into the Windows desktop and play DOOM on them.

https://ripitapart.com/2018/10/15/gaining-access-to-the-windows-ce-desktop-and-doom-on-the-keysight-dsox1102g-oscilloscope/

There's several things on that page that indicate you can trick it into loading a different firmware during boot or to go to the windows desktop so you can hack around the system. I'm sure a bit of effort could come up with a really nice "downgrade" hack but I don't have a 'scope to play with :-(

[Fungus]

This should probably be in the hacking thread.

Are we not there? ?

Oh, yes, so we are! 

(I mean the original hacking thread, this is a new one...)

[Fungus]

Is it possible to boot the 'scope using firmware v1.0 and the trick detailed here:

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg264356/#msg264356

If so, can you upgrade to the hacked v1.1 firmware?

Even if that doesn't work, it's still a simple way to run the hacked v1.1 firmware directly from USB with zero risk - just pull the stick out and revert to factory firmware.

(at the cost of a 'little bit longer' boot time ... how much longer?)

[TK]

Most of the tricks for the 2000X or 3000X series do not work on the 1000X, i.e. the infiniivision.lnk method never worked on the 1000X.

[tv84]

Most of the tricks for the 2000X or 3000X series do not work on the 1000X, i.e. the infiniivision.lnk method never worked on the 1000X.

Sure, but what FEECSA did on the 1000X could, very well, be used in 2000X and 3000X. Same patch.

[TK]

Most of the tricks for the 2000X or 3000X series do not work on the 1000X, i.e. the infiniivision.lnk method never worked on the 1000X.

Sure, but what FEECSA did on the 1000X could, very well, be used in 2000X and 3000X. Same patch.

Sorry for the confusion, I was replying to Fungus's post about running the firmware from USB, etc... If FERCSA hack could work on the 2000X 3000X, then it is an interesting finding worth sharing on the 2000X/3000X hacking thread