EEVblog Electronics Community Forum
Products => Test Equipment => Topic started by: 1Ghz on April 08, 2017, 07:23:59 am
-
Hello,
Has anyone reverse engineered LeCroy LC series oscilloscope firmware update file format?
I want extract and analyze payload (firmware).
AFAIK, firmware is compressed by unknown algorithm.
Any help would be appreciated.
Thanks.
Update 1: Some of firmware update file and screenshot attached.
There's some plain text.
(https://www.eevblog.com/forum/testgear/lecroy-lc-series-firmware-update-file-format/?action=dlattach;attach=306645;image)
-
Are you talking about "The following scopes can be upgraded to these versions with emailed files through the floppy drive or Teledyne LeCroy Scope Explorer via GPIB/TCPIP" ?
http://teledynelecroy.com/support/softwaredownload/other_scopes.aspx (http://teledynelecroy.com/support/softwaredownload/other_scopes.aspx)
If so then I doubt many people even have the update files. Perhaps you should put yours up on a Google drive or somewhere similar.
-
The firmware update files for 9300, LC and WR1LT/WR2LT/WP900 are available in the LeCroy Yahoo! group's download section.
If the aim is to hack options, save your time as the images for the option GALs for the 9300 Series are freely available in the Yahoo! group, and the same GALs go in the LC Series.
-
AFAIK there are software options too which aren't enabled by the GAL.
-
AFAIK there are software options too which aren't enabled by the GAL.
No, the software options for LC and 9300 are pretty much the same. The 9300 relied on GALs while the LC (when running the latest firmware) can use either, GALs or a option key code.
-
I don't think it's compressed. It has a huge section of 0xFF's at the end like empty space in an EEPROM, and and exact size of 0xE0000 with what looks like a 32-bit CRC at the end. There are many plaintext strings, though some of them have 0xFF's inserted into them at odd places.
Strings like
DE GAUSS
AUTO ZERO
CH2
CH3
PROBE
20Mhz
L93xx
l9350
make it pretty obvious you're looking at scope firmware.
I gather that this is some kind of a floppy disk image. My membership to the Yahoo! group is pending moderation so I can't access the files and posts there, but I doubt there's anything too mysterious here. There may be file system metadata in the file or some such thing.
Rather than try to reverse the update floppy format, it might be easier to just dump it from the chips in the scope.
-
Everything seems to be sorted out with advanced options.
But who knows how to upgrade an oscilloscope category like WavePro 940 to WavePro 960?
Where are these identification settings located?
I'm only interested in software settings, expanding the bandwidth of the analog input is not difficult.
-
In more recent models, there's always a bandwidth option as well, not because the scopes are software upgradeable (they're not), but for the software to know the actual model.
Those options are not visible by default in the scope's About screen, only in service mode.
To my knowledge, those options didn't exist prior to the first generation of Windows scopes. As for the 9xx, my personal best guess is that it was part of the serial, I don't see any other reference to the model ID.
-
I found no hardware difference between the WP940 and WP960 ACQ board. Exchange of motherboards between these oscilloscopes also does not change the identification of the oscilloscope model. From this I conclude that the identification of the model is embedded in the firmware of the ACQ board. However, I do not see a suitable place for this there. According to the diagram, I see only 2 components: GAL16V80 (EECMOS programmable logic device, PLD) and EPC2LC20 (FPGA Configuration Memory IC).
-
Elsewhere in the service manual, it details different assembly numbers for the 940 and 960 acquisition boards. PCB likely the same, but component placement is typically not - with front-end component value and presence differences as in most of the LeCroy's. Optimized for their BW, not optimized to be software bandwidth upgrade.
The WavePro 9xx acquisition board is an evolution of the LCxxx boards, which come from the 93xx series. In all cases, the scope type and other factory build info is stored in the serial EEPROM, which would likely be U60 (24LC32AT) for the WavePro.
-
Yes, you were right about the U60. It's amazing that I didn't see her right away. Now this is changed as I wanted.
But there was a problem with the analog bandwidth.
No, not what you thought, but on the contrary - in WP940 it is too high. Initially, in my WP940, the rise time was about 375 ps (which by the way is twice as good as guaranteed by the specification), and practically without overshoot (see photo):
(https://www.eevblog.com/forum/testgear/lecroy-lc-series-firmware-update-file-format/?action=dlattach;attach=1162148;image)
Now I have to expand the bandwidth, like in WP960, which originally looks like this:
(https://www.eevblog.com/forum/testgear/lecroy-lc-series-firmware-update-file-format/?action=dlattach;attach=1162152;image)
But I do not see a single adjustment element for this in the circuit, which refers to the analog path LOZ (50 Ohm). There are only 2 capacitors, which can be influenced by C1035 (1pF) and C1050 (2.2pF), but it looks like they are the same for the entire WP900 series (even for the LC684 they do not differ).
(https://www.eevblog.com/forum/testgear/lecroy-lc-series-firmware-update-file-format/?action=dlattach;attach=1162156;image)
So the only difference I found between 960 and 940 is the yellow (multiplexing?) Board. The WP960 has no low-pass filters, but the WP940 board has LC passive filter chains.
(https://www.eevblog.com/forum/testgear/lecroy-lc-series-firmware-update-file-format/?action=dlattach;attach=1162160;image)
I moved this WP960 board to WP940 and after that I saw a heavily overcompensated RF signal with high overshoot:
(https://www.eevblog.com/forum/testgear/lecroy-lc-series-firmware-update-file-format/?action=dlattach;attach=1162164;image)
The same result is obtained by removing these filters from the WP940 board:
(https://www.eevblog.com/forum/testgear/lecroy-lc-series-firmware-update-file-format/?action=dlattach;attach=1162180;image)
But in WP960 not have these filters, and at the same time there is normally set compensation.
How is this done in WP960, if there are no adjusting elements, and the marking of the parts does not differ from WP940?
How can this excessive RF compensation be corrected? Why is it so high?
-
But in WP960 not have these filters, and at the same time there is normally set compensation.
How is this done in WP960, if there are no adjusting elements, and the marking of the parts does not differ from WP940?
Assuming the same as other LeCroys, the parts on the mainboard are typically different. Most of the parts involved in the front-end circuitry are small and without markings. You will not see differences, but there surely will be - as well as the different daughterboard like you mention. The service manuals do not always cover all variants - good for reference, not 100% accurate for all flavors.
-
Ok, but look at the diagram above (highlighted in yellow). What electronic parts do you think might be different? It will not be difficult for me to unsolder them and compare them individually.
No, you are wrong about other LeCroy oscilloscopes. For example, in the WavePro 7K line of oscilloscopes, all the details of the input modules are the same, except for the ratings of the same passive filter chains that are added between the output from these modules and in front of the ADC input, as I have already shown on the yellow board, above. The same applies to WaveRunner 6K.
In the old WaveSurfer, there are indeed several components inside the path that change with models and correct the frequency response, but there is a fundamentally different structure with a common amplification path for both modes of operation: 1M and 50 Ohm, and not 2 separate independent paths, as in this case. This case is rather similar to WavePrp7K, in which there is a separate 50 Ohm path and there really are no control elements for the frequency response (up to the output lines in front of the ADC).
Assuming the same as other LeCroys, the parts on the mainboard are typically different. Most of the parts involved in the front-end circuitry are small and without markings. You will not see differences, but there surely will be - as well as the different daughterboard like you mention. The service manuals do not always cover all variants - good for reference, not 100% accurate for all flavors.
-
A couple things...
Ok, but look at the diagram above (highlighted in yellow). What electronic parts do you think might be different? It will not be difficult for me to unsolder them and compare them individually.
Don't know, but a 2 GHz signal path is not trivial. Factory calibration is typically involved. Bandwidth is only one of the many scope's performance criteria. And also, because of that different daughter-board (and otherwise), a 940 is limited to 8GSs for 1 channel, whereas the 950/960 can do 16GS/s. Changing a scope model type doesn't change the HW build differences which achieve that performance. So unless you are also changing that switching and filtering board (HSY638 vs. HSY644), you can't make a 940 a 960 besides model number only. Something of a Frankenstein - somewhere in between, with impacted measurement accuracy as well.
No, you are wrong about other LeCroy oscilloscopes. ... The same applies to WaveRunner 6K.
The 6000 series are also not the same hardware build between types - have distinct values that are different on the acquisition boards. In this case, the service manual does explicitly point them out.
LeCroy makes their models purpose built (and tested and calibrated) for their bandwidths and related specs, with very few exceptions.
-
The 6000 series are also not the same hardware build between types - have distinct values that are different on the acquisition boards. In this case, the service manual does explicitly point them out.
LeCroy makes their models purpose built (and tested and calibrated) for their bandwidths and related specs, with very few exceptions.
I am writing about this not formally using general wording, but in detail, based on practical experience and specifications for the electronic circuit. Just take and look at the electronic components specification: the circuit and components of the input modules are the same for all models of the WR6K line 350MHz - 2GHz (as in the WP7K line) except for a single passive second order filter that is added at the output of the module (the beginning of the differential connecting line). Service manual confirms this officially. The rest of the function of equalizing the frequency response and phase response in the X-Stream series of oscilloscopes is provided by software. Thus, the source of the overcompensation in WP940 is still not clear to me.
I have not yet had the opportunity to study all the functional differences between HSY638 versus HSY644, but after changing the firmware 940 says that it makes 16 GS/s in 1 channel mode)). I haven’t tested it yet, but somehow I’ll come to terms with it if it’s not. I have concerns that the multiplexer here may indeed have hardware limitations.
-
I have to surprise you. I just checked by the number of points (samples) per division on the display and you can clearly see their doubling after turning on the 1 channel mode. Thus, I can state that this module from WP940 supports 16GS/s mode. This fact alone makes flashing WP940 to WP960 or WP950 justified. Bandwidth Limiters 20 MHz, 200 MHz also function normally.
But I found that on this "yellow" board from WP960 (HSY638?) varactor diodes SMV1247 (0.7-7pF) are present. Before that, I assumed that these were some kind of overvoltage protection elements. Now the functional purpose of these elements is not clear to me, but they can affect the frequency response. I may have to return the LC filters to the 940 and optimize them for optimal frequency response.
By the way, can no one send me a firmware dump from WavePro 960 or WavePro 950?
Because, in fact, I am currently using firmware from DDA-260, which is not quite what I need (regarding keyboard functions).
-
By the way, can no one send me a firmware dump from WavePro 960 or WavePro 950? Because, in fact, I am currently using firmware from DDA-260, which is not quite what I need (regarding keyboard functions).
The firmware is the same on the WavePro / DDA-260 / JTA-260 family scopes. Same as the firmware is the same on the LCxxx vs. DDA12x scopes.
-
This is not entirely true. I already wrote that the functionality of some keys after flashing has changed in accordance with the specific functions of the DDA-260 and now does not correspond to the inscriptions on the WP940/960 panel.
The firmware is the same on the WavePro / DDA-260 / JTA-260 family scopes. Same as the firmware is the same on the LCxxx vs. DDA12x scopes.
-
There is only one firmware load for these scopes, 9.3.0 being the last. Instrument identification and behavior is determined by option type and variant settings, not different firmware.
-
After all, from the very beginning of our dialogue, we have never touched on the software, which is freely available, and the methodology for generating keys to the device options, right? We meant a way to simply clone a dump of this small chip, which, in addition to the additional option codes, contains an oscilloscope model type identifier that cannot be changed by entering the generated keys in the usual way. Anyway, among the list available to me of all the possible keys that I can add, I do not find an option to change the oscilloscope model (like WP or DDA, 940 or 960).
Perhaps you have more information on how to do this easier by entering a special key, and not by way of bitwise rewriting of eeprom using a separate programmer?
-
lecroy wavepro 950
-
lecroy wavepro 950
Yuebhugo, could you copy the firmware from the U60 chip (EEPROM 24lc32) with any suitable programming device?
I am ready to give you the firmware from DDA-260 and WP940, or express my gratitude in any other way.
I highlighted this U60 chip in red in the circuit.
To get a copy of the firmware, there is no need to dismantle this chip, I have successfully overwritten it using an 8-pin clothespin and an RT809F programmer.
-
But in WP960 not have these filters, and at the same time there is normally set compensation.
How is this done in WP960, if there are no adjusting elements, and the marking of the parts does not differ from WP940?
How can this excessive RF compensation be corrected? Why is it so high?
Wouldn't it all be on the MUX board, the 940 would be filtered low enough for manufacturing tolerances to not be a problem at the wanted high frequency limit, on the 950, 960 the manufacturing tolerances may be more of a problem and the LTC660/TLE2024 and varactor diodes are added so the step responses can be software trimmed for minimum differences between channels at the HF limit.
-
I tried changing the correction capacitance in this place over a wide range, but this does not solve the problem.
Most likely, the model difference lies in the settings of the "TCOIL" correction unit.
-
let me find the programming device to try to copy the U60 microchip 24LC32 firmwire.
-
Hi, wavepro 950 FW. change the .txt to .hex
-
Hi, wavepro 950 FW. change the .txt to .hex
yuebhugo,
How did you get this file? The fact is that both of my 24LC32A images are 4,096 bytes in size with the extension .bin.
Look, below I am attaching my images from DDA-260 and WP940 (change the extension to .bin).
-
I converted your hexadecimal (HEX) to binary .bin format. I haven't tested it yet, but it looks like it looks like my images now and should work. Thank you for your work.
-
read the FW again, and save to the BIN formate, the size is 4k. pls refer the attachment