Author Topic: Possible GW Instek GDS-1000B hack  (Read 72872 times)

0 Members and 2 Guests are viewing this topic.

Offline tautech

  • Super Contributor
  • ***
  • Posts: 28136
  • Country: nz
  • Taupaki Technologies Ltd. Siglent Distributor NZ.
    • Taupaki Technologies Ltd.
Re: Possible GW Instek GDS-1000B hack
« Reply #25 on: April 15, 2018, 10:59:39 am »
I really really really wish I could buy that. I kind of knew parts of that already. Also it is cheaper as the Instek where I live. But more expensive than where you live. Including taxes or what VAT is...
instek 545.60 €
siglent 510.51 €
rigol 404.00 €
Your sig:
Day 11063 without a scope:
I am starting to feel the effects. I might just go insane.

You already know SDS1104X-E is more than 25% better value but further it's a DSO that can offer more still as your needs grow .....MSO and AWG if/when you need them.

Will you settle for a lesser product and always wonder....what if ?
Avid Rabid Hobbyist
Siglent Youtube channel: https://www.youtube.com/@SiglentVideo/videos
 

Offline nctnico

  • Super Contributor
  • ***
  • Posts: 26751
  • Country: nl
    • NCT Developments
Re: Possible GW Instek GDS-1000B hack
« Reply #26 on: April 15, 2018, 12:11:44 pm »
Define lesser. It comes down to the features you need right now and each scope Distelzombie is looking at has it's pros and cons. There is more to a scope than waveforms/s and bandwidth.
There are small lies, big lies and then there is what is on the screen of your oscilloscope.
 

Offline Distelzombie

  • Frequent Contributor
  • **
  • Posts: 283
  • Country: de
Re: Possible GW Instek GDS-1000B hack
« Reply #27 on: April 16, 2018, 04:59:54 am »
Your sig:
Day 11063 without a scope:
I am starting to feel the effects. I might just go insane.
It is, indeed.  ???
(Yes, I do change it daily. If that is what you are testing here. Otherwise I have no clue at all why you're mention my signature. I tried PHP but that doesn't work.  :( And no, it is not exactly my birthday.)


You already know SDS1104X-E is more than 25% better value but further it's a DSO that can offer more still as your needs grow .....MSO and AWG if/when you need them.

Will you settle for a lesser product and always wonder....what if ?
Yeah, if I can't find it with LayBuy, I have to save money for at least six month, but maybe more like ten.


BTW, I think this thread started to steer in the wrong direction. I just wanted to know what this hack can do and what that means for the GDS-1054B.
Let's hijack this thread instead: https://www.eevblog.com/forum/beginners/is-the-rigol-ds1054z-still-the-best-entry-level-digital-scope-for-the-price/msg1475625/#msg1475625

Offline cyberfish

  • Regular Contributor
  • *
  • Posts: 240
  • Country: gb
Re: Possible GW Instek GDS-1000B hack
« Reply #28 on: July 03, 2018, 02:48:55 pm »
Does anyone have a copy of 1.18 firmware they are willing to share by any chance? :D
 

Offline cyberfish

  • Regular Contributor
  • *
  • Posts: 240
  • Country: gb
Re: Possible GW Instek GDS-1000B hack
« Reply #29 on: July 04, 2018, 12:55:32 am »
The latest pre-1.18 firmware I've been able to find was v1.12, from Tradeport, and it works fine on my GDS-1104B! http://www.tradeport.on.ca/news/72/new-firmware-release-of-digital-storage-oscilloscope-gds1000b-gds1000au

I have only tried serial decode, waveform search, and 300 MHz, they all seem to work. I cannot verify 300 MHz though, but there are now 100 MHz and 200 MHz BW limit options, and they do change the signal.

No idea how this compares to serial decode on other scopes, but with this hack, the GDS-1000B is very good value, especially taking into account the circuit design quality of a certain competitor...
 
The following users thanked this post: Fungus

Offline ripper_pc

  • Newbie
  • Posts: 4
  • Country: us
Re: Possible GW Instek GDS-1000B hack
« Reply #30 on: July 18, 2018, 02:01:20 pm »
Hi!

I just bought a new scope that has 1.21 firmware on it.
The html file does not seem to be working on it.

I get the following message: 'License failed to install, Please check the license version!'

Do i have to downgrade it to 1.12 version using the links in earlier posts for this to work ?

Note: I did use a USB 3.0 pen drive, I'm not sure if that could have caused this ?
 

Offline cyberfish

  • Regular Contributor
  • *
  • Posts: 240
  • Country: gb
Re: Possible GW Instek GDS-1000B hack
« Reply #31 on: July 18, 2018, 02:18:50 pm »
Hi!

I just bought a new scope that has 1.21 firmware on it.
The html file does not seem to be working on it.

I get the following message: 'License failed to install, Please check the license version!'

Do i have to downgrade it to 1.12 version using the links in earlier posts for this to work ?

Note: I did use a USB 3.0 pen drive, I'm not sure if that could have caused this ?

You need to downgrade to 1.18. A very kind forum member sent a copy to me (not sure if they want to be identified). Feel free to PM me with your email addr if you want a copy.
 
The following users thanked this post: ripper_pc

Offline akimmet

  • Contributor
  • Posts: 22
  • Country: us
Re: Possible GW Instek GDS-1000B hack
« Reply #32 on: July 18, 2018, 02:47:26 pm »
I’m glad to hear one of those firmware versions I sent end up being useful.
When it comes to drivers and firmware, I tend to hoard. You never know when a old version will come in handy. Especially when the current trend as of late is to delete first ask questions later.
 

Offline cyberfish

  • Regular Contributor
  • *
  • Posts: 240
  • Country: gb
Re: Possible GW Instek GDS-1000B hack
« Reply #33 on: July 18, 2018, 02:48:32 pm »
I’m glad to hear one of those firmware versions I sent end up being useful.
When it comes to drivers and firmware, I tend to hoard. You never know when a old version will come in handy. Especially when the current trend as of late is to delete first ask questions later.

It was very helpful, thanks! I actually spent a whole afternoon searching online, and could only find 1.12!
 

Offline tonywood

  • Contributor
  • Posts: 10
Re: Possible GW Instek GDS-1000B hack
« Reply #34 on: August 02, 2018, 05:00:24 pm »
Could someone send me the 1.18 firmware also? I would like to try it out. I have the GW Instek GDS-1054B


Thanks in advance  :-+
 

Offline tonywood

  • Contributor
  • Posts: 10
Re: Possible GW Instek GDS-1000B hack
« Reply #35 on: August 09, 2018, 10:39:45 pm »
I got my unit today GDS-1054b, it came with firmware 1.19 so I downgraded to 1.18 and installed the *.lis files and verified they were working. I then upgraded to firmware 1.22 and all the options were still installed and work. Thanks to all for the help on this. Looks like you keep the added features with a firmware update.
 

Offline tonywood

  • Contributor
  • Posts: 10
Re: Possible GW Instek GDS-1000B hack
« Reply #36 on: August 09, 2018, 10:56:21 pm »
Firmware fixes


Version 1.08

1.Fixed the system crash randomly which caused by the ¡§Advance Math¡¨ function
2. Fixed the displaying issue of XY mode under certain circumstances
3. Fixed the time base error when the ¡§AUTOSET¡¨key pressed under ¡§Window Zoom¡¨ mode
4. Fixed the AD malfunction under certain circumstances

Version 1.09
1.Added German & French icons and help menu
2.Adjusted the maximum value of the waveform brightness


Version 1.11
1.Added Korean icons and help menu
2.Added Russian icons
3.Fixed the residue waveform issue
4.Fixed the system freeze bug after the QR code menu activated
5.Added the DVR calibration under distributor mode

Version 1.12
1.Added Russian help menu
2.Fixed the initial value for the ¡§Advance Math default¡¨ expression
3.The output polarity of the Go/No-Go has been adjusted which same as the GDS-2000A series

Version 1.13
1.Fixed the Trigger Filter bug.

Version 1.14
1.Changed the display method for waveform interpolation.
2.Fixed the pictbridge's connectivity issues.
3.The Trigger out function is activated now. (Press UTILITY -> Probe Comp. -> Frequency)

Version 1.15
1.Add Multilanguage: Spanish

Version 1.16
1.Fixed the trigger level offset issue, if the vertical position was shifted out off the screen range.
2.Fixed the ¡§Advance math¡¨ algorithm which caused the system crash.

Version 1.17.001
1.Added USBDelay command in order to solve the USB data leaks for WIN10.
2.Fixed the ext trigger of roll mode which may cause the system crash.
3.Fixed the zoom state malfunction for horizontal position command.
4.Changed the value range of trigger hold off command: the minimum value changed to 4ns from 10ns.

Version 1.18
1.Removed the extra unwanted carriage returns symbol for *LRN? command.
2.Fixed the starting condition of autotrigger for Datalog function (APP funciton)
3.Extended the "Duration" until the 999 hours for Datalog function (APP funciton)

Version 1.19
1.Fixed the Japanese translations error for digital filter menu tree. (APP function)
2.Updated the simplified Chinese menu tree
3.Updated the License encoding rule


Version 1.20
1.The Go/NoGo Invert function is activated now. (Press UTILITY -> System -> more)
2.The firmware upgrade procedure is now ONLY support the ¡§Safe mode¡¨ firmware upgrading from this firmware version.

Version 1.21
1.Fixed the issue that the license file can¡¦t installed properly.
2.Fixed the REF waveform operating issue of interpolation mode for math function.
3.Revised the storage results of average waveform for interpolation mode

Version 1.22
1.Added saved Ref icon.
2.Fixed the system locks up when the multilingual menu was setting in non-English and the ¡§HARDCOPY¡¨ button pressed.
3.Fixed the Go/NoGo Execute SCPI Command settings issue.
4.Fixed the Spanish translations.
5.Fixed the cursor operation which may unable to reactivated within the ¡§zoom¡¨ status.
6.Adjusted the range adjustment behavior within the ¡§Go/NoGo¡¨ status.
7.Fixed the display of ¡§Ratio¡¨ counter which cannot clear completely under non-English Multi-language circumstances.
8.Fixed the specific average number order which cannot be saved as settings file.
 

Offline rhb

  • Super Contributor
  • ***
  • Posts: 3476
  • Country: us
Re: Possible GW Instek GDS-1000B hack
« Reply #37 on: August 23, 2018, 12:54:55 pm »
I bought a Rigol DS1102E some years ago for $400.  It is quite satisfactory for many things.  Even if you spend $20K there will still be limitations.

The DS1054Z is a good 4 channel 50 MHz DSO at a very good price.  In 3- 4 channel mode the 125 MHz Nyquist limit doesn't really support going much higher, though in 1-2 channel mode with 500 MSa/S it can do a decent job at 100 MHz if hacked.

I had the good luck to pick up a GDS-2072E from Amazon for $244 delivered.  They were selling off old stock which they do periodically.  I jumped on it as a test bed for developing  FOSS FW for Zynq based DSOs.  I'd already bought the MSO-2204EA.  But there is no way I was going to risk bricking an $1800 scope.  Yesterday I tried the GDS-2000B BW hack and it worked and now gives me 200 MHz just like the 2204EA.

If your budget is tight, get the Rigol DS1054Z. It will serve you well and you'll have no trouble selling it if you buy a better scope.  It's popular and well established.  At a 25% discount someone like you will buy it in a heartbeat.  You don't often see used Rigol DS1054Zs offered for sale.  I suspect most people selling one sell it to a friend who is looking for a scope.

When I was in grad school in geophysics at Austin all I had was a 5 MHz recurrent sweep Heathkit IO-18.  It didn't even have BNC inputs.  I bought it at a yard sale for $75 and even that was a stretch for my budget.  I learned a great deal using that scope.
 
The following users thanked this post: Mortymore

Offline pa3hfu

  • Contributor
  • Posts: 39
  • Country: nl
Re: Possible GW Instek GDS-1000B hack
« Reply #38 on: October 10, 2018, 11:30:43 am »
Does somebody have Firmware V 1.8 for the Instek 1000 series for me?
In advance many thanks!
 

Offline cyberfish

  • Regular Contributor
  • *
  • Posts: 240
  • Country: gb
Re: Possible GW Instek GDS-1000B hack
« Reply #39 on: October 10, 2018, 11:33:58 am »
Does somebody have Firmware V 1.8 for the Instek 1000 series for me?
In advance many thanks!

Sent!
 

Offline Mortymore

  • Frequent Contributor
  • **
  • Posts: 432
  • Country: pt
Re: Possible GW Instek GDS-1000B hack
« Reply #40 on: October 13, 2018, 11:38:00 am »
Hi

I have a 2074E updated to 1.36 firmware version.
Putty doesn't work with 1.36.
Is there a chance to downgrade to a firmware version suitable to hack? Which one?
I've searched the web for previous firmware for GDS-2000E and found nothing so far.  |O
Can someone be kind to help me out here. I'd be much appreciated.

My scope is not actually a GW-Instek one, but is the same thing, just rebranded as ISO-Tech IDS-2074E.
« Last Edit: October 13, 2018, 11:41:20 am by Mortymore »
 

Offline Mortymore

  • Frequent Contributor
  • **
  • Posts: 432
  • Country: pt
Re: Possible GW Instek GDS-1000B hack
« Reply #41 on: October 13, 2018, 04:08:39 pm »
Thanks to a forum member that provided the necessary firmware to downgrade, and to all others involved in the solution, my scope just went from 70 to 200  :-+
Hope I don't get a speed ticket  :popcorn:

The firmware was afterwards upgraded again to v1.36 and now, some calibration and testing is due.

Offline frogblender

  • Regular Contributor
  • *
  • Posts: 124
Re: Possible GW Instek GDS-1000B hack
« Reply #42 on: November 20, 2018, 11:21:00 pm »
Can anyone confirm that a GDS-1054B works at 300MHz?

According to gwInstek's own website, this series of scope only comes in 50/70/100MHz versions.
 

Offline rhb

  • Super Contributor
  • ***
  • Posts: 3476
  • Country: us
Re: Possible GW Instek GDS-1000B hack
« Reply #43 on: November 21, 2018, 12:59:04 am »
Can anyone confirm that a GDS-1054B works at 300MHz?

According to gwInstek's own website, this series of scope only comes in 50/70/100MHz versions.

What's the sample rate?  Divide by 2 and you have the Nyquist frequency.  That is the maximum frequency possible.  So far as I know, no OEM changes anti-alias filters if you double the sample rate by changing channel count.  The manual and datasheet for the 1000B specify a maximum sample rate, but unlike other models do not specify if there are limitations such as the very common one of requiring you to use channels that use different ADCs in 2 channel mode.

My LeCroy DDA-125/LC684 claims a 1.5 GHz BW.  But sampling 4 channels it has a 1 GHz Nyquist.  So everything above 500 MHz is aliased unless you use 2 channel mode sampling a 4 GSa/S.  But in any case, while it meets the rise time = 0.35/BW it is at the price of 20% overshoot.  I assume that disk drive analysis measuring rise time was more important than an accurate waveform.

My GDS-2072E is hacked for 300 MHz, but the step response is identical to 200 MHz.  I've overlaid the waveforms. To do 300 MHz with the ADCs you would have to switch between two anti-alias filters.  One for 250 MHz Nyquist and one for 500 MHz Nyquist.  This is why GW does not offer a 300 MHz version of the 2000E.

A far more important issue is the amount of EMI the 2000E line emits.  The front panel is shielded and the AFE sections are shielded.  But that's all.  I'm planning to fabricate shielding for the SMPS and the main board.

If you are concerned with BW you need to buy one of Leo Bodnar's excellent 40 pS rise time 10 MHz square wave generators.  These come with a printout of the step response on a 10+ GHz sampling DSO.  Measure the rise time with a single channel and then with each of the other 3 channels.  If it really has 300 MHz BW you will see a different rise time at 1 GSa/S than at 500 MSa/S.  Most likely if you save reference traces for all the permutations of channels, they will all look the same and will have a rise time of 1.75 nS.


As part of my FOSS DSO FW project I am going to do a very detailed review of issues with the 2000E.

Sadly I have come to the conclusion that all the T&M OEMs lie every time their product doesn't quite meet the marketing specs.  For example,  Keysight calculates rise time for the MSOX3104T as 0.35/BW *except* if BW = 1 GHz, then they use 0.45/BW.  HP didn't do such things as far as I can tell.  I've bought a bunch of 20 year old HP gear in the last 18 months.  It's a delight to use and it really does meet expectations.  Keysight still does make really nice gear, but I've learned to be very skeptical of the product brochures and go over  the specifications with a fine tooth comb now.

Modern DSO design commonly  uses dual channel ADCS which will sample one channel at twice the frequency of two channels.  Typical pattern is if you use 1 & 3 both will sample at 1 GSa/S, but if you use 1 & 2 you will sample at 500 MSa/S.
 

Offline TheReverend

  • Newbie
  • Posts: 4
  • Country: de
Re: Possible GW Instek GDS-1000B hack
« Reply #44 on: November 29, 2018, 12:42:28 pm »
Could someone send me the 1.18 Firmware for science purposes so i can contribute too?

Thx in advance
 

Offline toastedcrumpets

  • Regular Contributor
  • *
  • Posts: 175
  • Country: gb
Re: Possible GW Instek GDS-1000B hack
« Reply #45 on: November 29, 2018, 04:22:49 pm »
So, I'm the guy with a GDS-2074A (actually rebranded as a Isotech (RS) IDS-2074A). Sorry for the delay in replying, currently on paternity after the birth of my second child!

Plugging in the device to my linux box using USB I get most of what you're after:

[2604763.960679] usb 3-4: new full-speed USB device number 16 using xhci_hcd
[2604764.113082] usb 3-4: not running at top speed; connect to a high speed hub
[2604764.128062] usb 3-4: New USB device found, idVendor=2184, idProduct=0014, bcdDevice= 2.26
[2604764.128066] usb 3-4: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[2604764.128070] usb 3-4: Product: IDS-2074A
[2604764.128072] usb 3-4: Manufacturer: RS
[2604764.128075] usb 3-4: SerialNumber: 524D093G1
[2604764.135403] cdc_acm 3-4:2.0: ttyACM0: USB ACM device

Hopefully the data you need is in there?

Connecting via RS232 serial, and running the SCPI *IDN? command I get
RS,IDS-2074A,524D093G1,V1.30

Probably RS components, device, serial, and firmware version which is currently 1.30

On reboot, I don't see anything in the RS232 output. Is there some special baud for the message you need? I've tried 19200, 57600, and 115200.

Otherwise, do I have to find a debug header inside the device?

 

Offline toastedcrumpets

  • Regular Contributor
  • *
  • Posts: 175
  • Country: gb
Re: Possible GW Instek GDS-1000B hack
« Reply #46 on: November 29, 2018, 08:41:22 pm »
BTW, with v1.30 can you still generate/insert licenses from the KG that is in this thread?
They don't work, and they also don't work for the first version of the 2000A firmware I have which is v1.18. note this is different firmware to the 2000E series.

I'll dig around inside when I'm back in work on the 12th. I just got a 30ps pulse generator so I should be able to do before and after comparisons on the bandwidth too if I get this working...
 

Offline tv84

  • Super Contributor
  • ***
  • Posts: 3212
  • Country: pt
Re: Possible GW Instek GDS-1000B hack
« Reply #47 on: December 02, 2018, 02:36:11 pm »
Here is the new license generator for the current FWs of GDS1000B and GDS2000E, based on the wgoeo post (msg #3).

Code: [Select]
        private static void InstekKG(string serial)
        {
            // This works for GDS1000B and GDS2000E
            string[] opt = { "PWR", "BUS", "SRH", "SGM", "BW100", "BW200", "BW300", "SA" };   // Prefixes: "DS1KB-"  or "DS2E-"

            // uint[] ClearCode = { 0x11111111, 0xABABABAB, 0x22222222, 0xCDCDCDCD };  // OLD -- GDS1000B (up to v1.18) and GDS2000E (up to v1.28)
            uint[] ClearCode = { 0x74B0DC51, 0x46E87CCD, 0x25E45D32, 0x515F007C };  // NEW or       
            uint[] ClearCode = { 0x19495CFF, 0x257130A3, 0x3D1B58BA, 0x74B0DC51 };  // v1.23, v1.24, ....

            serial = serial.Trim();
            int serial_int = Int32.Parse(serial.Substring(serial.Length - 4, 4));

            int pid_sum = 0;
            for (int i = 0; i < serial.Length - 4; i++)
                pid_sum += serial[i];

            for (int i = 0; i < opt.Length; i++)
            {
                int[] a = new int[2];
                a[0] = (pid_sum << 24) | ((i << 8) & 0xF00);
                a[1] = (1 << 24) | ((serial_int << 8) & 0xFFFF00) | ((pid_sum >> 8) & 0xFF);

                for (int j = 0, k = -0x61C88647; j < 32; j++, k -= 0x61C88647)
                {
                    a[0] += (int)((16 * a[1] + ClearCode[0]) ^ (a[1] + k) ^ ((a[1] >> 5) + ClearCode[1]));
                    a[1] += (int)((16 * a[0] + ClearCode[2]) ^ (a[0] + k) ^ ((a[0] >> 5) + ClearCode[3]));
                }
                Console.WriteLine("DS1KB-{0}.lic / DS2E-{0}.lic - [{1:x8}{2:x8}]", opt[i], a[1], a[0]);
            }
        }

Those who prefer the javascript version can replace just the ClearCode constants in the script (I leave that as homework). The SA option was also added (only for the 2000E).

Edit1: Tested successfully by some members in DS2E and MSO equipments. This will not work on 2000A because the S/N has a different format.

Edit2: It seems there are more than one new combination of ClearCode(s) so test both.
« Last Edit: February 07, 2020, 11:51:50 am by tv84 »
 
The following users thanked this post: Mortymore, Chuck60, Mr_Bean, tatel

Offline nctnico

  • Super Contributor
  • ***
  • Posts: 26751
  • Country: nl
    • NCT Developments
Re: Possible GW Instek GDS-1000B hack
« Reply #48 on: December 02, 2018, 03:30:11 pm »
I can confirm that the license generator with the new values creates valid licenses for more recent firmware. My GDS-2204E accepts and recognises the SA and power analysis options but I can't select these features.
There are small lies, big lies and then there is what is on the screen of your oscilloscope.
 

Offline rhb

  • Super Contributor
  • ***
  • Posts: 3476
  • Country: us
Re: Possible GW Instek GDS-1000B hack
« Reply #49 on: December 03, 2018, 12:48:22 pm »
To access the SA you need to press the button in the lower right corner of the screen area below the small round button. It will then appear as an option on the 3rd button from the left below the screen.  If you do not have an instrument with an AWG, do *not* press the AWG button when in SA mode.  Use the channel select button to exit SA mode.  Pressing the AWG button will crash the DSO and require a power cycle.

As an example of how useful this is here are a couple of screen dumps.

I have a stock Instek 200 MHz probe with the grabber and the ground lead removed.  So it is a 7 mm E field detector.  The cable is stretched out straight and the scope set to 1 mV/div.  I can not detect *any* of the noise on my HP 8560A.

The noise from 40 to 150 KHz is coming from a pair of 4 ft LED T-8 tubes.  There is a Chinese EMI filter in the line which eliminated  a lot of noise.  But my 8560A TG doesn't go below 300 KHz, so I could not test the low frequency effectiveness of the EMI filter.
 
The following users thanked this post: Mortymore


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf