Micsig Tablet Oscilloscope tBook mini TO1000

[mikeselectricstuff]

ftp access: user ftp, password ftp
telnet access: user root, password micsig ( not that difficult ;-)

interesting files are in /home/micsig directory

FTP only shows the same as when you connect USB - screencaps etc. & background image
Can't connect via Telnet
Port scan only shows HTTP, FTP, and ports 7,13 and 37

[EEVblog]

Mine is 6.11.0.186
Quite a few option links on the bottom, would be interesting to compare different models.
Bottom row are definitely options as they are pull up/down.
Larger one next to "B" ilooks like a power disconnect link

What does "Ver" on the silk mean I wonder?...

[mikeselectricstuff]

The button on the battery PCB looks like a shipping lock  - cuts power instantly, resets by connecting charger
As expected, the one on the main PCB is a duplicate of the power button

[pascal_sweden]

Regarding isolated inputs:

Does the website clearly indicate whether the model in particular has isolated inputs or not?
Some models do, while others don't. So I hope it is clearly specified for a specific model.

Regarding overall build quality:

It is surprising that the PCB board itself shows high quality, but that they did such an extremely poor job on soldering the BNC jacks of the front-end input to the PCB board, as shown in the video of Dave Jones.

Maybe that unit in particular was a pre-production demo unit with some open quality issues?

Can someone who is in direct contact with Micsig Product Engineering department, ask them about this quality issue, and have it confirmed that in final production units there is a decent soldering joint for the BNC input channels?

I would like to see a BEFORE and AFTER photo from Micsig to get confidence that this problem is solved now, before pulling the trigger on the ORDER NOW button

[mikeselectricstuff]

Regarding isolated inputs:

Does the website clearly indicate whether the model in particular has isolated inputs or not?
Some models do, while others don't. So I hope it is clearly specified for a specific model.

The Micsig website shows that only the MS300 and 500 are isolated.
 

Regarding overall build quality:

hand-soldered parts looked fine on mine

[AndyP]

The "disable gradient waveform" control (3rd button along on the pull up menu from the bottom of the screen), enables a "high speed" mode, and brings up a red H on the status in the top left.
This both disables the variable brightness AND sets the all the entries in Userset->Depth "auto", the excellent video mike did mention he's seen this but wasn't sure what caused it.

In this High speed mode the waveform rate went from ~2K to ~30K.
To get a higher frame rate I set Display->Waveform to dots, and Display->Persist to None

Configured like this I've seen bursts of ~180K waveforms per second captured, with the average over a second as ~140K samples. (see attached diagram of trigger out, logged with an 8Mhz input signal)
I did notice it didn't achieve the highest rates on fastest timebase but required backing off to 50ns / division.

Micsig support quite responsive while I was trying to get the waveforms per second number up.

I've not  discovered how to change the SD in the status on the top left yet, or what it stand for.

A did also contact Micsig about the lack of serial decoders which are in progress and segmented memory, (also useful for going back to look at serial packets).

[pascal_sweden]

So only the handheld scopes and not the tablet scopes are isolated? That's a pity!

[mtdoc]

I've not  discovered how to change the SD in the status on the top left yet, or what it stand for.

The MicSig user manual for their handheld scopes (I recently bought one of the debranded eBay bargains) says that the SD and the number next to it inicates the current channel memory depth.

[davidefa]

The nasty little thing wants to autoupdate.
I was testing the battery life ( stopped the test after 4h 20', with the battery icon showing some 'juice' left, quite happy with battery life ) and the scope notified that an update was downloaded and ready to be installed.
And yes, in the background it downloaded 15M of software 6.0.186 ( a config.xml file it downloads call this version 601.0.186 and/or 6.0.186 )
This happened after I enabled wlan connection.
I'd like to stay on my old software ( not to lose telnet connection )

There is a 7GB device ( /dev/sdcard ) mounted on /sdcard, it contains the four directories available via ftp/usb, think is a simulated SD card

[PartialDischarge]

The nasty little thing wants to autoupdate.
I was testing the battery life ( stopped the test after 4h 20', with the battery icon showing some 'juice' left, quite happy with battery life ) and the scope notified that an update was downloaded and ready to be installed.
And yes, in the background it downloaded 15M of software 6.0.186 ( a config.xml file it downloads call this version 601.0.186 and/or 6.0.186 )
This happened after I enabled wlan connection.
I'd like to stay on my old software ( not to lose telnet connection )

That's why Im reluctant to give to what used to be standalone equipments Internet access, be it a TV, a fridge or a scope.

[mikeselectricstuff]

There is a 7GB device ( /dev/sdcard ) mounted on /sdcard, it contains the four directories available via ftp/usb, think is a simulated SD card

Can you copy files from the other partition into this?

[davidefa]

Can you copy files from the other partition into this?

Yes.
Additionally an inserted usb stick is automounted on /udisk, so
If someone want to take a glimpse to the software it will be available at the following link ( the text file included is a partial log of a few telnet sessions, it includes the output of the 'ps' command )

P.S.
If you want to take a scope snapshot via the web interface you can point the browser to cgi-bin/autoplay.cgi
It will refresh the page every 5 sec ( it will also modify the screen.png image every 5 sec, so not a good idea to stay on this page forever )

[cmpxchg]

It's certainly full of GPLed software. They have even helpfully left the symbols in for the main oscilloscope UI software. This would make a great hardware platform for an open source scope.

(Most importantly, the oscilloscope software and other parts of the system are linked to Qt 4.8.7 open source versions, which means that if you have bought this scope, you are legally entitled to a copy of the source code of their oscilloscope software and lots more)

[cmpxchg]

For those playing along at home, firmware updates are retrieved from http://www.micsig.com.cn/upgrade/config.xml

The .bin files consist of 37912 bytes of header and the remainder is data, both "encrypted" with a fixed AES key in ECB mode (hence the repetitive 16 byte blocks, particularly in the header which is 99% nulls)

The AES key used is

Code: [Select]

\x19\x05\x14\x20\x11\x27\x27\x11\x06\x05\x13\x20\x20\x03\x84\x19\x09\x02\x89\x19\x27\x03\x12\x20\x16\x05\x12\x20\x31\x09\x12\x20
Notice that 37912 is not a multiple of 16 so you can't just decrypt it all at once as the data isn't 16-byte aligned. The decrypted data then will be a Makeself shell-script (https://github.com/megastep/makeself) that the scope just runs. The shell script decompresses the actual firmware, which is a .tar.gz appended to the script. This archive doesn't contain the entire filesystem, just the Micsig binaries for the oscilloscope software, settings etc. and a few files that are selectively copied to other places such as /usr/lib.

The system isn't Android but rather a normal Linux (OpenWRT?) and all the interface stuff is done with Qt. Since updates are retrieved over HTTP, not signed and simply executed after download I wouldn't really recommend connecting these tablets to the internet.

[mikeselectricstuff]

not signed

... so patched FW for hacks looks feasible ?

[Howardlong]

After a couple more stints with this, as well as adding to the wishlist of serial trigger & decode, plus direct access for Auto/Normal triggering, a direct access for Default Setup would be nice. There's a Factory Reset which seems to do this although it sounds more fundamental than Default Setup, but it's a couple more clicks away than I'd like. I have become used to the UI more quickly than I anticipated, but I still have some niggles about trying to find some non-obvious or hidden features buried in the menu system.

In single channel mode on my example, rise time is 2.66ns and 3dB bandwidth is 150MHz, both measured using an external 50 ohm BNC inline termination. For rise time I used an HP 54121T with a measured system rise time of <33ps, and for 3dB bandwidth I used an HP 8656B RF signal generator with 3Vpp signal.

This scope at the current price point has the makings of a seriously useful instrument. If they wanted to really shake up the market, serial trigger & decode would be the way to do it. Cleaning up the UI would be nice. It's somewhat frustrating that something that's so close has a few too many quirks in operation, as if the UI's been designed by software developers with little input from hardware engineers.

Micsig are clearly moving in a new direction with the tBook Mini, as their earlier devices were aimed at a very different market.

The TO1104 I purchased from Batronix was €539 ex-VAT as there is currently a €360 discount on this model. It has all the current options installed except 500uV and the extended warranty, and comes with a battery and carrying strap (that I still haven't figured out!). From Mike's video it looks like you can't just throw in your own battery, it has a bunch of proprietary electronics that comes with the battery.

If you're going to buy one check the following options to help you make the comparison:

Channels, 2 or 4
Bandwidth, 70 or 100MHz
Battery
Vertical 500uV
Warranty 4-10 year
Storage 28M vs 2.8M
HDMI
Auto Range
Frequency Meter
WLAN
High/Low pass
Carry strap

[mikeselectricstuff]

Micsig are clearly moving in a new direction with the tBook Mini, as their earlier devices were aimed at a very different market.

..And AFAICS not very successfully - the 10" ones seem to have been around a coupel of years with very little profile.  I agree they were aiming too high with what was a new type of product from an unknown manufacturer.
I don't think the extra size has much benefit, and reduces portability.

Re. the battery - I'm pretty sure that a "no battery" one will come with a dummy PCB to pass the incoming supply through to the unit.  As & when the battery dies it probably wouldn't be hard to replace the cells.

If they were to go all-out with the non-M version with decodes at a price similar to comparable desktops they could do really well, as they seem to have done a decent job on it, both software and hardware, probably better than any of the other Chinese manufacturers.

It would be interesting to see if there are any hardware differences between the M and non-M version. Somewhere I saw a reference to an "online" version, maybe suggesting they were going to sell different versions through traditional distributors. I can see some logic in that so distributors aren't undercut by direct sales, but both versions seem to be available on Aliexpress.
 

[davidefa]

The .bin files consist of 37912 bytes of header and the remainder is data, both "encrypted" with a fixed AES key in ECB mode (hence the repetitive 16 byte blocks, particularly in the header which is 99% nulls)

The AES key used is

Code: [Select]

\x19\x05\x14\x20\x11\x27\x27\x11\x06\x05\x13\x20\x20\x03\x84\x19\x09\x02\x89\x19\x27\x03\x12\x20\x16\x05\x12\x20\x31\x09\x12\x20
Notice that 37912 is not a multiple of 16 so you can't just decrypt it all at once as the data isn't 16-byte aligned.

That's great info man!
I used openssl to decrypt the update package v6.0.186 ( available at this link )
I padded the file and decrypted using openssl with --nopad option and -K 'hexkey' ( without complaining )
But when I run the decripted script it complains that md5 is not correct ( so I modify the md5 stored in the script and everything executes/extracts correctly even if gzip throws an error at the end saying 'unexpected end of file' )
I padded the file adding 8 caracters at the end ( tried 0x00 and 0x08, no joy )
What am I doing wrong?
How to decrypt using gpg?

P.S. now I'm more confortable to update to v6.0.186 knowing not to lose telnet connection

[pmcouto]

The TO1104 I purchased from Batronix was €539 ex-VAT as there is currently a €360 discount on this model. It has all the current options installed except 500uV and the extended warranty, and comes with a battery and carrying strap (that I still haven't figured out!).

I also purchased a TO1104 with battery from Batronix.
However, my unit came without carrying strap and WLAN option is not activated. 500 uV option is activated though.
There seems to be some inconsistency regarding delivered options…

I would like to have the WLAN option, but Batronix is not selling it at the moment.
Considering the firmware investigation work already done by some forum members, we may not have to wait much for all software options. 
Those BNC dust caps that came with Mike’s scope are also a nice accessory I would gladly purchase, if available.

I also performed some BW tests on my TO1104 using a R&S SM300 to generate a 1 Vrms signal and a 50ohm feed-through terminator and found the -3db point to be near 135 MHz. This result is consistent on all 4 channels.
Although severely attenuating the signal (as expected) the scope is still able to trigger and display a stable 250 MHz sine wave. Above 250 MHz things start to go south very quickly (1 GSa/s plays a big role here…). 

As said before, serial decoding option(s) would be more than welcome.

The UI can surely be improved, but as it is now is surprisingly easy to use and it only takes a few minutes to get used to it – In my opinion, this is a very strong point for a new product so radically different.

Let’s wait and see what Micsig do in the future; So far they seem to be on the right path.

[cmpxchg]

That's great info man!
I used openssl to decrypt the update package v6.0.186 ( available at this link )
I padded the file and decrypted using openssl with --nopad option and -K 'hexkey' ( without complaining )
But when I run the decripted script it complains that md5 is not correct ( so I modify the md5 stored in the script and everything executes/extracts correctly even if gzip throws an error at the end saying 'unexpected end of file' )
I padded the file adding 8 caracters at the end ( tried 0x00 and 0x08, no joy )
What am I doing wrong?
How to decrypt using gpg?

P.S. now I'm more confortable to update to v6.0.186 knowing not to lose telnet connection

I didn't actually run the script that you get after decrypting, I just asked binwalk to extract the *.tar.gz from it. I think mine might have said "unexpected end of file" but there wasn't anything missing/corrupt so I figured no harm. I used a python script and pycrypto for decrypting.

You mentioned you had the 1074 without the options, so it would be interesting to compare your /firmware/scope/sn115508.dat (this seems to store the options and bandwidth setting) to someone elses with the 1104. Could someone extract theirs? (for science, I had a look at the code that reads/sets the options and I'll look into that further but just as the update files it's super weird..)

[Howardlong]

Oh I forgot, colour coded BNCs would be nice. I've put labels next to the BNCs. The colour scheme doesn't match what I'm most used to, but then again all manufacturers seem to have their own colour scheme. Not a problem when I'm using it, just a mInor PITA when setting it up, as unlike my bench scopes, which have their probes almost permanently attached, a portable scope doesn't.

[davidefa]

I've connected to the scope via microusb and using python-usbtmc sending commands to the scope:
*IDN? -> replay with model, serial, hardware rev
:SYS:SN? -> serial
:PRIV:MACH? -> TO1074
:PRIV:BAND? -> 70
:PRIV:STAT? -> 0

unable to change bandwith and model :-(

other interesting commands ( I think ), found in Desktop executable from addr 0x72f90:
:PRIVate:STARt
:PRIVate:STOP
:PRIVate:STATe
:PRIVate:STRingcode

Tried sending different strings, and start commands, but state do not change

[cmpxchg]

I've looked some more into the Micsig software and particularly the config parts. The result of that is a tool to upgrade the config files of a Micsig TO scope:

https://github.com/stschake/micsig-upgrade

This will enable 100MHz (for the 70MHz models) and among others the 500uV, WLAN, HDMI options. It does require that you can access and change files on the scope over e.g. telnet or FTP, so it might be interesting to package this as a firmware update that can simply be put onto storage.

[mikeselectricstuff]

Re. the battery - I'm pretty sure that a "no battery" one will come with a dummy PCB to pass the incoming supply through to the unit.  As & when the battery dies it probably wouldn't be hard to replace the cells.

Can someone with a non-battery version confirm Mike's theory? Would it be possible to add a battery by simply connecting another tablet battery to a non-battery dummy PCB? I've got several broken tablets with usable batteries.
Yes, I do understand that is not what Mike was saying.

No ( at least not easily) , because the PCB also has the charging circuit and the protection.
It may be that the dummy PCB could be an unpopulated version of the charger PCB ( or maybe even a populated one?). Would be interesting to see, but hard to see why anyone would buy one of these without the battery. 

[AndyP]

It would be interesting to know what is in the config file of the M versions of the 'scope, since they look to be the same scope but trimmed down specs (2.8Mpts, 20K wfm/s) vs the full version (28Mpts, 80k wfm/s).
Since 2.8Mpts still won't fit into the XC6SLX45 block ram it seems likely the M version still has the memory chips fitted (or at least some memory chips fitted).

A price somewhere between M series and normal price for the 70MHz could give the Rigol 1054Z a real run for it's money once the serial decoders arrive.

A few groups at my office are interested, though being a large company we obviously buy the full spec needed. For day to day problems we'd get more use from a handful of these than one Keysight DSO3034 series, and for a lower cost. Normal caveats apply, w.r.t. right tool for the job, some problems require a higher spec 'scope.