EDUX1002A hacking, conversion to DSOX1002G - Page 1
Forum section: electronics / testgear

author: alpher
author_rank: Frequent Contributor
timestamp: April 11, 2020, 10:31:56 pm
content: Hi, I know that there is a multipage thread about DSOX100x hack that Dave posted a couple of years back, nonetheless I'd like to start a new one, dedicated specifically to the conversion of the much cheaper EDUX series scopes into their full-fledged DSOX versions. Intend to do a full hardware mod including the generator, have pretty much everything lined up (except a few func/gen parts) and right of the bat I run into a snag.To make sure that I have the proper "Product config" installed a serial port connection as in Dave's video, booted the scope numerous times and try as I migh, the U-boot doesnt show that section at all, To be clear it is this section what I'm looking for (copied from Daves U-boot log) :Code:=========================================BLT Product Config 24Bandwidth : 200MHz#Channel : 2Board Rev : FPRClk Gating : BaldwinSample Rate : 4GSaLAN PHY : NoBLT Module Config 02Rev : LP3Sample Rate : 5GSa/s=========================================BLT_PRODUCT_CONFIG_0, 1.251v, ID4BLT_PRODUCT_CONFIG_1, 0.692v, ID2BLT_MODULE_CONFIG_0, 0.687v, ID2BLT_MODULE_CONFIG_1, 0.005v, ID0CANINE_BOARD_REV, 0.002v, ID0CANINE_MODEL_NAME: MARSUPIAL, 1.738v, ID6, MARSUPIALCANINE_EXTMODULE, 2.488v, ID8, SWID8CANINE_MSO_REV, 0.628v, ID2, SWID2SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]SHIM [AgilentPalSStorage.dll] Get Process AddressesReleased build, Sep 28 2016, 00:17:51Initializing FPGA...************************************FPGA Type: MarsupialVer: 1.067 ReleasedBuild Time: Tue Jun 14 17:13:42 2016Build Machine: 2UA5461ZWH************************************Now here are complete Uboot logs from my EDUX machine, first from a factory firmware that came with the scope 1.10 and the second from the Fercsa hacked version:Code:U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500CPU: SPEAr600DRAM: 128 MiBFlash: 512 KiBNAND: internal ecc 128 MiBDebug serial initialized ........OKRTC: 2024-20-4 1:81:32.35 UTCMicrosoft Windows CE Bootloader Common Library Version 1.4 Built Oct 29 2015 01:39:04Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 boardAdaptation performed by Agilent Technologies (c) 2008PHY not found.System ready!Preparing for download...RTC: 2024-20-4 1:81:32.35 UTCLoading image 1 from memory at 0xD0600000OBL_IMAGE_TYPE_BINXXXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOOXXOOXXXOXXOOOOXOOXXOOXOXOOOOXOXOOOOOXOOOXOOXOXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXOOOXOOXOOOOXOOOOXOOXXOOXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXOXOXOOXOXOOOXOOOXOOXOXXOXOOOXOXXXXXOXOXXOXXXXXOXOXOXOOXXXOXXXXXXOXXXXXXXOXXXXXXOXOXXOXOOOXXXXXOXXXXOOOXOXXOOXXOXXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOXOXOOOXOXXXXXXXXXXXXXrom_offset=0x0.XXImageStart = 0x80361000, ImageLength = 0x1A84978, LaunchAddr = 0x80362000Completed file(s):-------------------------------------------------------------------------------: Address=0x80361000 Length=0x1A84978 Name="" Target=RAMLoading image 1 succeeded.ROMHDR at Address 80361044hPreparing launch...RTC: 2024-20-4 1:81:32.38 UTCLaunching windows CE image by jumping at address 0x 362000Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33Setting up for a Cold RebootDone Setting up for a Cold RebootWindows CE Firmware InitBSP 1.0.0 for the SPEARHEAD600AB board (built Jan 28 2018)Adaptation performed by ADENEO (c) 2005+OALIntrInit-OALIntrInit(rc = 1)Initialize driver globals Zeros area...pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)Initialize driver globals Zeros area...doneOALKitlStartFirmware Init Done.OALIoctlHalEnterI2cCriticalSection init i2c cs++SER_Init: context Drivers\Active\14SER_Init, dwIndex:2SER2 got sysintr:0x00000017SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)OHCI\system.c, GCFG_USBH1_SW_RSTOHCI\system.c, GCFG_USBH2_SW_RSTLAN PHY NOT detected.DeleteP500EnetRegistry:\Comm\GMAC 0x0\Comm\GMAC1 0x0\Comm\Tcpip\Linkage 0x0\Drivers\Virtual 0x0\Drivers\BuiltIn\LIN 0x5LIN: Data ValidBALDWIN_DDI: cBaldwinHwIf::Init: Initializing...BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.BALDWIN_DDI: cBaldwinHwIf::Init: Success!Device load time:NANDFLASH: 0 msSNANDFLASH: 0 msSHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]SHIM [AgilentPalIO.dll] Get Process AddressesLaunchInfiniiVision:SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]SHIM [AgilentPalSStorage.dll] Get Process AddressesReleased build, Jan 28 2018, 21:24:15Initializing FPGA...************************************Ver: 1.067 Released************************************Calibration mode UserCal Date Fri Mar 29 10:57:54 2019Startup sequence is complete.System has been running 14.401954 secondsStart Up Sequence 5.340947Memory Load 49%System Physical Memory 35.984 / 73.465 MBProcess Virtual Memory 44.000 / 1024.000 MB-----> InfiniiVision is running <-----will do USB phy workaround: CheckCRCFERCSA firmaware bootlog:Code:U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500CPU: SPEAr600DRAM: 128 MiBFlash: 512 KiBNAND: internal ecc 128 MiBDebug serial initialized ........OKRTC: 2024-20-4 7:97:57.14 UTCMicrosoft Windows CE Bootloader Common Library Version 1.4 Built Oct 29 2015 01:39:04Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 boardAdaptation performed by Agilent Technologies (c) 2008PHY not found.System ready!Preparing for download...RTC: 2024-20-4 7:97:57.14 UTCLoading image 1 from memory at 0xD0600000OBL_IMAGE_TYPE_BINXXXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOOXXOOXXXOXXOOOOXOOXXOOXOXOOOOXOXOOOOOXOOOXOOXOXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXOOOXOOXOOOOXOOOOXOOXXOOXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXOXOXOOXOXOOOXOOOXOOXOXXOXOOOXOXXXXXOXOXXOXXXXXOXOXOXOOXXXOXXXXXXOXXXXXXXOXXXXXXOXOXXOXOOOXXXXXOXXXXOOOXOXXOOXXOXXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOXOXOOOXOXXXXXXXXXXXXXrom_offset=0x0.XXImageStart = 0x80361000, ImageLength = 0x1A84978, LaunchAddr = 0x80362000Completed file(s):-------------------------------------------------------------------------------: Address=0x80361000 Length=0x1A84978 Name="" Target=RAMLoading image 1 succeeded.ROMHDR at Address 80361044hPreparing launch...RTC: 2024-20-4 7:97:57.17 UTCLaunching windows CE image by jumping at address 0x 362000Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33Setting up for a Cold RebootDone Setting up for a Cold RebootWindows CE Firmware InitBSP 1.0.0 for the SPEARHEAD600AB board (built Jan 28 2018)Adaptation performed by ADENEO (c) 2005+OALIntrInit-OALIntrInit(rc = 1)Initialize driver globals Zeros area...pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)Initialize driver globals Zeros area...doneOALKitlStartFirmware Init Done.OALIoctlHalEnterI2cCriticalSection init i2c cs++SER_Init: context Drivers\Active\14SER_Init, dwIndex:2SER2 got sysintr:0x00000017SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)OHCI\system.c, GCFG_USBH1_SW_RSTOHCI\system.c, GCFG_USBH2_SW_RSTLAN PHY NOT detected.DeleteP500EnetRegistry:\Comm\GMAC 0x0\Comm\GMAC1 0x0\Comm\Tcpip\Linkage 0x0\Drivers\Virtual 0x0\Drivers\BuiltIn\LIN 0x5LIN: Data ValidBALDWIN_DDI: cBaldwinHwIf::Init: Initializing...BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.BALDWIN_DDI: cBaldwinHwIf::Init: Success!Device load time:NANDFLASH: 0 msSNANDFLASH: 0 msSHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]SHIM [AgilentPalIO.dll] Get Process AddressesLaunchInfiniiVision:SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]SHIM [AgilentPalSStorage.dll] Get Process AddressesReleased build, Jan 28 2018, 21:24:15Initializing FPGA...Ver: 1.067 Released#Kirk -Without freedom of choice there is no creativity#FERCSA -Exactly!*** Reset, energize: MSO*** Reset, energize: FPGA Probe*** Reset, energize: Acq Memory Dflt*** Reset, energize: Acq Memory Max*** Reset, energize: Acq Memory Max*** Reset, energize: Embedded serial decode and trigger*** Reset, energize: Automotive serial decode and trigger*** Reset, energize: FPGA Altera*** Reset, energize: Flex Ray serial decode*** Reset, energize: Power application*** Reset, energize: Segmented Memory*** Reset, energize: Mask limit testing*** Reset, energize: Telecom Mask Test*** Reset, energize: 500MHz Bandwidth*** Reset, energize: 200MHz Bandwidth*** Reset, energize: 100MHz Bandwidth*** Reset, energize: 70MHz Bandwidth*** Reset, energize: Flex Ray Compliance*** Reset, energize: Audio serial decode and trigger*** Reset, energize: Distributor license*** Reset, energize: Education kit license*** Reset, energize: WaveGen license*** Reset, energize: 1553 & 429 serial decodes*** Reset, energize: Enhanced Video Triggering*** Reset, energize: Advance Math*** Reset, energize: Flex Ray Plus*** Reset, energize: Distributor license*** Reset, energize: Distributor license*** Reset, energize: Enhanced Video Triggering*** Reset, energize: Digital Voltmeter*** Reset, energize: ASV*** Reset, energize: Cable Calibration*** Reset, energize: Infiniium Mode*** Reset, energize: Remote Log*** Reset, energize: Circular Segmented Memory*** Reset, energize: Tomotherapy*** Reset, energize: F8AEAE82Calibration mode UserCal Date Fri Mar 29 10:57:54 2019Startup sequence is complete.System has been running 14.541350 secondsStart Up Sequence 5.218473Memory Load 50%System Physical Memory 36.188 / 73.465 MBProcess Virtual Memory 44.750 / 1024.000 MB-----> InfiniiVision is running <-----will do USB phy workaround: CheckCRCI'm I missing something obvious here?

author: TK
author_rank: Super Contributor
timestamp: April 12, 2020, 12:30:50 am
content: The product ID is changed by replacing the resistors in the main board, under the BLT. ID for DSOX1102G is 24. You can check if it was set correctly by checking the scope info page under utility. If it shows segmented memory, waveform generator, then you are in the correct DSOX1102G mode. No need to look at the serial port dump

author: alpher
author_rank: Frequent Contributor
timestamp: April 12, 2020, 01:07:06 am
content: That I understand, but why my Uboot logs dont show any BLT info?It looks like the FPGA is not there at all? My scope is from 2018 and came with 1.10firmware, anybody else run into this issue?

author: tv84
author_rank: Super Contributor
timestamp: May 29, 2020, 06:20:55 pm
content: Quote from: alpher on April 11, 2020, 10:31:56 pmYes, you are. Look at Dave's FW version (attached).You have 1.10. I think it's obvious that KS removed that from the FW, after Dave released his investigations, in order to make the hack harder.What I don't understand is why do you need to change the config resistors since it can be done by software.Can't FERCSA hack open all the limitations (minus the HW missing)? What is missing?

author: TK
author_rank: Super Contributor
timestamp: May 29, 2020, 10:44:46 pm
content: When using the FERCSA hack on an EDUX scope, you need to mod the external trigger section and the CH1-CH2 front end. The EDUX is hardware limited to 50MHz. You should not need the resistor mod. Resistor mod is only when changing the EDUX to DSOX without any software hack to enable 70MHz and all the features included in the standard DSOX (segmented memory, more sample memory, external digital input and so on)

author: alpher
author_rank: Frequent Contributor
timestamp: May 30, 2020, 01:02:31 am
content: I did mod the trigger and front end sections, but i still believe that to get the full 200MHz bandwidth I had to change the product Id from the 21 (EDUX1002A) to 23 (DSOX1102A). Not sure now, still waiting for some crucial parts to install missing wavegen, when I do, i will try to go back to id 21 and see if it makes any difference.

author: tv84
author_rank: Super Contributor
timestamp: May 31, 2020, 01:03:40 pm
content: Lookhere.And continue this thread there.