| Products > Test Equipment |
| LeCroy Probus reverse engineering |
| << < (3/10) > >> |
| ollopa:
--- Quote from: Scratch.HTF on February 06, 2019, 06:41:26 am ---I've seen ProBus modules which contain license keys for certain options (one of which was for Telecom Mask Testing) which can be transfered scope to scope. --- End quote --- Hi Scratch, That would be the PP100 which looks like this: 01 08 00 50 50 31 30 30 0x01 = name = "PP100" 53 04 00 02 0x53 = ?? Count of licenses maybe? 0x002 61 0D 00 4D 54 30 31 2C 4D 54 30 32 00 "MT01,MT02" and a null terminator Very easy to fake. These are not actual instrument licenses, though. For example if you put "I2C" in there you will not get the I2C protocol decode option. These wind up in a different option store as mentioned in the manual on the SCPI command to retrieve the list of custom application options: --- Quote ---The CU_OPT? query identifies options currently enabled due to the presence of a PP100. These options can also be enabled by the normal ‘option key’ mechanism. If so, they are reported by the *OPT? query instead of CU_OPT?. The response to CU_OPT? consists of a series of response fields listing all the options enabled due to the presence of a PP100. RESPONSE FORMAT CU_OPT <option_1>, <option_2>,...,<option_n><option_n> = MT01: Mask Tester option for ITU MT02: Mask Tester option for ANSI MT03: Mask Tester for Optical Signals 0: No custom options installed --- End quote --- |
| ollopa:
OK thanks to Mechatrommer's PP090 I've noticed the significance of another packet type: 0x11 = Probe attenuation attribute. In the PP090 it's divide by 2 and the data is 11 06 00 00 00 40 so 0x00000040 = divide by 2. In the AP100 it's divide by 5 and the data is 11 06 00 00 A0 40 so 0x0000a040 = divide by 5. D1305 is divide by 2.828, data is 11 06 81 04 35 40 so 0x81043540 is divide by 2.828. D1330 11 06 C8 A7 D8 40 divide by 6.770 CP015 11 06 00 00 20 41 is divide by 10 when copied into AP100 This is a single-precision float: 2 = 0x40000000 5 = 0x40A00000 10 = 0x41200000 0x40350481 = 2.82839989662 And another: 0x41 = Delay attribute, single precision float LE |
| ollopa:
Refresh the thread and see my updates. It's actually a single-precision float with the bytes in reverse and represents the probe delay attribute. 230e-12 (230ps) = 0x2F7CE33F as a float. In reverse that's 3f e3 7c 2f. Edit: Added 0x62 BW in GHz (newer probes like ZD200) Single point precision float, reversed bytes. See bottom of first post for an up-to-date list of the tags I've identified so far. |
| Mechatrommer:
--- Quote from: ollopa on February 06, 2019, 06:58:05 am ---Unfortunately not a very exciting EEPROM. There's no serial number (0x04) and likely no cal or anything else. --- End quote --- i think an "adapter" like PP090 wont have cal data, the coax cable will just run straight through from input to output, so transfer function should be... 1? i'm interested to see eeprom comparison of active probes like AP020 and AP034. there should be some interesting data thats unique to each probe? i'm thinking to do this kind of work but i cant get to this yet, since i'm locked with other stuffs my desk piled up with things. --- Quote from: ollopa on February 06, 2019, 08:52:48 am ---OK thanks to Mechatrommer's PP090 I've noticed the significance of another packet type: --- End quote --- i ar wun aint no have an PP090 :-// i think its tv84 who provided it.. |
| MilkmanCDN:
--- Quote from: Mechatrommer on February 06, 2019, 12:15:02 pm --- --- Quote from: ollopa on February 06, 2019, 08:52:48 am ---OK thanks to Mechatrommer's PP090 I've noticed the significance of another packet type: --- End quote --- i ar wun aint no have an PP090 :-// i think its tv84 who provided it.. --- End quote --- No worries. They were mine. :) |
| Navigation |
| Message Index |
| Next page |
| Previous page |