The fort is falling. Liberating Keysight DSOX 1200 (Linux, black) series scopes.

[Bud]

You have to download the Spear600 Flashing Utility and follow instructions in the doc folder to install Spear600 driver.

https://www.st.com/en/development-tools/stsw-spear009.html

Check the Device Manager as you go. In the end you should get a new COM port appeared there.



And select that COM port in the Flashing Utility to get Uboot prompt.



Be careful and do not fool around with the Flasher if you do not know what you are doing, you can brick the scope.
This is only a starting point. There is more involved in backing up the NOR and changing it to get the full boot log and everything else.

[candrian]

Ah ok I understand. I now have the USB device mounted but not the com port yet installed. In the documentation it says ". During the connect operation Flashing tool sends the DDR driver and firmware (using lib-usb) interface. These binaries are present in binaries/ folder of the package. " Will this step affect the scope? It's not clear if its going to overwrite something already working on the scope or it will write it on non persistent memory and will then be reset.

[Bud]

Connect step does not affect the scope, it only loads the DDR driver and basic Uboot.

[candrian]

Thank for your information.

I followed the documentation line by line. The device is recognized as I previously mentioned, I downloaded "USB flasher for SPEAR" 2.4 as the latest 3.2.5 package includes only a file system rootfs_nand_smallpage.jffs2 and not the application itself but when I click the connect button I instantly get an error message "Firmware could not be uploaded. Please restart the board and try again". The message pups up so instantly that it doesn't look to make any tries before. Is this something you came across?

[Bud]

Check the VID/PID in Device Manager and see if it matches the ones in usb_send source code main.c

You can also search the source code .C files and .TCL scripts for the error message and track what conditions causes it.

P.S.: I just noticed your screenshot's Device Manager  shows "libusb (WinUSB)". Mine is "libusb-Win32". Did you select the correct library in Zadig ?
 

[candrian]

Nice catch. For some reason it winusb was installed instead of lib-usb from Zadig. Now I have the com port mounted.

Next step is to manage and have the full boot log and get the nand content.

[Anthocyanina]

today i got curious about the 1204's insides. I haven't been able to find teardown photos of these scopes anywhere. only the 2 channel edu one. I'm curious about how they do the function generator in the 4 channel ones. could anyone share pictures of the inside of those please? thank you!

[samsh]

I would also be curious to see a teardown, and came up short looking for videos too, although there are some videos on here about replacing the fan in the DSOX1204g and thats as much of the inside as I have seen. I'm pretty sure the Megazoom IV can take four ADC inputs so it will probably be extremely similar (possibly the exact same seperate processor board as in the EDU models) but with more front ends. I would assume the FPGA runs the sig gen.

Sorry for derailing the thread a bit, but I am looking to buy either one of these (70 MHz + upgrade to either 100 MHz or 200 MHz, new with warranty and included 1x/10x probes), or a 3000A series (200 MHz, used but in good condition, no warranty, would be using my own 10x 150 MHz probes). Not quite sure which way to go tbh. The 1204g looks cute and has a nice form factor (included probes like nice as well), but yeah, the 3000A is a lot more scope for the same price. You guys seem quite fond of the little black scope, and Dave seems to use it quite a lot, so I felt this might be a good place to ask for anyones opinion. Is the DSOX1204g substantially more portable?

[Bud]

today i got curious about the 1204's insides. I haven't been able to find teardown photos of these scopes anywhere. only the 2 channel edu one. I'm curious about how they do the function generator in the 4 channel ones. could anyone share pictures of the inside of those please? thank you!

I believe i saw a photo, they crammed the FG into the space on the right hand side of the board below the LAN connector.

[samsh]

Ended up picking up one a DSOX1204g used for a very good price (with probes). It is nice and compact and a little bit adorable in person, but the fan is pretty horrific (if you are at all sensitive to fan noise you have been warned) so I have ordered a Noctua replacement. It was either this or a 3000A for a lot more money (4x cost!), and the compactness and more recent design (no PSU issues or Flash rot) were the deciding factor (I am upgrading from an analogue Tek). It works just as well as any other Keysight unit and is as responsive and intuitive as expected; the encoders feel very nice and all click in exe.

Naturally I have taken it apart, and I will note that the main processor board is the same as the other 1000x units but with a later revision number. The PSU/Fan is the exact same as is most of the metalwork, the only difference to the disassembly process from Dave's video is additional nut/fasteners on the external trigger BNC on the back of the unit, and the metalwork differs around the (mechanical) power switch. I have annotated some photos to highlight some stuff, including the function generator. Overall, the PCB is significantly denser than other units, and I have not seen anything unpopulated apart from those debug headers (but I have only looked at one side). The main PCB is marked as X1004AG, so I assume that just means 1000 series, 4 channels with a generator, and what is 'unique' about the 1200x series is just the software/black colour scheme as opposed to anything about the hardware which is evidently completely common to the 1100x models (but there was no 1104x released).

In terms of hacking, obviously the 200 MHz would be nice but I think ADVMATH and to a lesser extent ARINC429 are also worthy unlock goals. I want to speculate that possibly the AFG can be unlocked. I assume the single MegaZoom is using its AFG to power the demo signals as well as the function generator - so maybe there is a path there (also the BNC is marked AWG on the PCB  )? It appears that (from the hardware and interacting with the unit) the linux operating system features a complete reimplementation of the Megazoom IV capabilities. I don't think the engineers just decided not to implement the 2000x features and I would speculate that perhaps this product might have been a testbed for plans to maybe switch the G-series scopes away from windows embedded due to licensing or longevity reasons, but that plan simply never eventuated. Perhaps some tinkering with the OS will reveal some commonality with the HD3 but I doubt it, and all the newer scopes (i.e., Tek 2 series) seem to implement cryptographic keys stored in secure enclaves inside the SOCs.

Let me know if there is anything you want to see from this unit specifically. I don't think I am yet brae enough to pull up the spear flashing utility but who knows. All screws are T9 except the frontend which is T6 (no solder, also the trim cap is accessible without removing the shield). No calibration or warranty void stickers are present, but you do anything at your own risk exe.

[samsh]

More photos

[Bud]

I think ADVMATH and to a lesser extent ARINC429 are also worthy unlock goals.

I do not think ARINC429 exists in 1000X series.

[tv84]

I think ADVMATH and to a lesser extent ARINC429 are also worthy unlock goals

I think those are only possible with patched FW, from my recollections.

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3823583/#msg3823583

[samsh]

ARINC429 decoding is done within the ASIC I think (it could be on the FPGA), and it was unlocked on the 1100 series with the modified firmware per https://www.fercsa.com/keysight/hack_2.png, although I didn't see an explicit demonstration of it in action and I know some functions that were 'unlockable' didn't actually function correctly (power analysis stuff iirc), so perhaps it falls into that category? Interestingly I am looking at buying another scope (professionally) and some Siglent models support ARINC429 decoding but not triggering.

I don't understand Fercsa's method and I am probably not technically skilled enough to crack this one myself, but as Bud said I think its when not if.

[Bud]

Ah, it is a serial method. Then yes it should be unlocked in a liberated FW. As to being functional, the scope has training signals generation feature, which may has it.