Has anyone hacked or cracked OWON XDS series? - Page 1
Forum section: electronics / testgear

author: Plasmateur
author_rank: Regular Contributor
timestamp: December 07, 2021, 08:20:01 pm
content: I'm considering to purchase an OWON just for the higher bit resolutions - for a dedicated application I have in mind.I want the functionality of a XDS3204AE and was wondering what base model I could purchase in order to crack it up to this model. Searching on the internet I haven't found too much information on this.Link to scopes -https://www.owon.com.hk/products_owon_xds3000-e_series_4ch_8_|_14bit_touchscreen_digital_oscilloscopeAlso, searching EEVBlogs I see a few threads and discussion about OWON scopes, but not nearly the amount that are found on Rigol or Siglent. Overall the sentiment seems pretty negative. I've also watched both of Dave's videos on the XDS3202A and he stated that scope wasn't all that bad, but it wasn't good either.So from all of this, I figured, if I can get a base model like the XDS3064E and crack it up to a XDS3204AE, I wouldn't mind spending sub $500 on a scope like this. With that said, has anyone hacked this? If not, any suggestions on how I go about getting started on doing that myself?

author: maxwell3e10
author_rank: Frequent Contributor
timestamp: December 08, 2021, 03:42:54 am
content: I have a few XDS scopes and generally like them. They are not without problems, but it's nice to have high vertical resolution, larger memory and larger screen than a basic scope. Higher bandwidth doesn't make that much sense since 12 bit is limited at 500 MHz sample rate for one channel. So XDS3064AE and XDS3062A are mostly sufficient and they do have a little larger bandwidth than spec. There is also a cheaper XDS2102A model. One can also get relatively inexpensively touchscreen, build-in function generator and internal battery options. So, it's a cheap version of "high-end" scope.I am not aware of hacking attempts and to what extend the hardware already exists in lower models.

author: Kosmic
author_rank: Super Contributor
timestamp: December 08, 2021, 04:20:58 am
content: I don't think anyone hacked a Owon XDS scope. That been said this guy (http://blog.weinigel.se/2016/05/01/sds7102-hacking.html) did a lot of reverse engineering on a older model (SDS7102). I guess the XDS series share a lot similarities.

author: mawyatt
author_rank: Super Contributor
timestamp: December 08, 2021, 01:57:44 pm
content: Quote from: maxwell3e10 on December 08, 2021, 03:42:54 amIs this actually using true 12 bit ADC? If so, do you know what ADC? Does the vertical channel chain hold-up to the 12 bit resolution? Asking since we are considering this as the Siglent 6000 will not be offered in NA, and the LeCroy is quite expensive for us, we are on a limited budget.Thanks for any help.Best,

author: maxwell3e10
author_rank: Frequent Contributor
timestamp: December 08, 2021, 03:54:59 pm
content: There is discussion of ADCs in the EEVblog review. 12/14 bit models use HMCAD1520, I suspect 8 bit model uses HMCAD1511. I posted some data on the noise of XDS3062A here at one point.

author: mawyatt
author_rank: Super Contributor
timestamp: December 09, 2021, 01:17:48 am
content: Quote from: maxwell3e10 on December 08, 2021, 03:54:59 pmIf you could do an FFT in the 12 bit mode (14 bit if it's available) at maximum FFT resolution for say a clean sinewave 1MHz signal and show result, I would greatly appreciate it. A two tone test would show how good the ADC and input amplifiers are, we've used a tone at 1MHz and at 1MHz +10KHz summed together with a resistive network of 1K & 50 ohm shunt to show the resultant IMD artifacts, but this is a lot to ask.Thanks so muchBest,

author: maxwell3e10
author_rank: Frequent Contributor
timestamp: December 09, 2021, 03:21:33 am
content: Does this help:https://www.eevblog.com/forum/testgear/signal-quality-of-budget-waveform-generators/msg3047624/#msg3047624

author: mawyatt
author_rank: Super Contributor
timestamp: December 09, 2021, 01:09:58 pm
content: Were those FFT plots generated within the DSO using it's built-in FFT feature, or generated with an outside software routine acting upon a data file from the DSO?Edit: Having looked more into the valuable plots you've done. If these 25MHz tones were created by the DSO and not the generator as mentioned, this points to the scope input circuits prior to the HMCAD1520 ADC. This ADC has a SFDR of 60~75dB in 12 bit mode (data sheet), so if this is a legit AD part then the additional distortion must be coming prior to the ADC, thus pointing to the scope "front end". This is what we feared OWON had done, simply replace an 8 bit input channel and ADC with a higher resolution ADC but still using the same front end designed for 8 bit use, so the overall result isn't much better than 8 bit performance from a usable dynamic range standpoint.If Siglent could use this 1520 ADC with the superb front end design in the SDS2000X+, one might benefit from the full DR of the 1520 ADCA True 8/12/14 Bit, with ERES on top of that, and all the features in the SDS2000X+ baseline MSO would emergeDon't think the competition would like to see thatThanks so much for the informationBest,

author: maxwell3e10
author_rank: Frequent Contributor
timestamp: December 10, 2021, 12:53:46 am
content: The analog input circuit is not so bad, since for shorted input the spectrum is pretty clean. Also see this comparison to other scopeshttps://www.eevblog.com/forum/testgear/owon-xds3062a-input-noise-(good)-and-glitches-(bad)/msg1433850/#msg1433850I think the broad artifacts that appear when a signal is applied are due to clock jitter.

author: mawyatt
author_rank: Super Contributor
timestamp: December 10, 2021, 02:04:14 am
content: The noise level certainly looks good on the input, but I was more concerned about the linearity of the input chain to the ADC. The classic two tone IMD will show this. BTW we have two of the SDS2000X+ and can confirm the low input referenced noise on these.Best,

author: seronday
author_rank: Regular Contributor
timestamp: December 10, 2021, 10:30:53 am
content: Atttached are screen prints of a 2 Tone Test with a 12 bit OWON XDS2102A and Siglent SDS2000X plus.The signal source is a Rigol DG4062 generator with Ch1 set to 1.0Mhz and Ch2 set to 1.01Mhz and then combined via 1K resistors to the 1M ohm Ch1 input on the DSO.The Owon XDS2102A is the lower cost version of the XDS3000A series. ( the main circuit board in the XDS2102A is marked as XDS3000 ).Regards.

author: mawyatt
author_rank: Super Contributor
timestamp: December 10, 2021, 12:49:29 pm
content: If you don't mind could you redo this test with a ~100 ohm shunt resistor to ground at the sum of the 2 1K resistors (this helps isolate the two signal sources better). Since the OWON FFT doesn't have the resolution of the Siglent FFT, increase the 2nd frequency for a 20KHz offset (10.02MHz) which may show the 3rd order products (F1 -deltaF, F2+deltaF, where deltaF = F2-F1) a little better on the OWON.BTW what's the difference between the lower cost XDS2102A and the XDS3000A?Thanks so much for the test, much appreciatedBest,

author: maxwell3e10
author_rank: Frequent Contributor
timestamp: December 11, 2021, 03:24:50 am
content: This calls for a Wavetek 195 generator which has 4 channels that can be all summed internally. Incidentally, it was manufactured by Aim/TTI and still sold until recently as Aim/TTi TGA1244 and Fluke 284.Here is a capture of 0.9 MHz, 0.99 MHz, 1.01 MHz and 1.1 MHz sine waves, each 2Vpp. The vertical scale is 10 dB/div. One can get SFDR of 60 dB, its probably better than that since little peaks are just random. If output of the function generator is turned off the noise level goes down another 5dB.

author: seronday
author_rank: Regular Contributor
timestamp: December 11, 2021, 11:35:30 am
content: @mawyattTwo tone test repeated as requested with 100 ohm termination and 20Khz separation.Have also applied some averaging to find the IMD signals buried in the noise.I have not used an XDS3000A DSO, but from reading the spec sheets for both the XDS2102A and XDS3000A series, it seems that the main difference being the XDS2102A is offered with none of the options.The specifications for both are attached.

author: seronday
author_rank: Regular Contributor
timestamp: December 11, 2021, 12:28:23 pm
content: Picture of XDS2102A main board.

author: tv84
author_rank: Super Contributor
timestamp: December 11, 2021, 12:35:12 pm
content: Any UART output, boot log, flash dump, memdump?

author: mawyatt
author_rank: Super Contributor
timestamp: December 11, 2021, 12:57:26 pm
content: Quote from: seronday on December 11, 2021, 11:35:30 amVery nice, exactly what I was looking for. With ~80dB IMD, shows that the input amplifier chain is not limited the DR performance!!Looks as if the PCB is the same for both 2102A and 3000A.Thanks so much for the test & informationBest,

author: seronday
author_rank: Regular Contributor
timestamp: December 11, 2021, 10:35:27 pm
content: Owon XDS series are also re-badged and sold under other names.MULTICOMP PRO - MP720024 sold by Farnell is a re-badged XDS2102AQuote from: tv84 on December 11, 2021, 12:35:12 pmAttached is the only UART output that I have found.

author: maxwell3e10
author_rank: Frequent Contributor
timestamp: December 12, 2021, 07:41:11 am
content: @serondayI was wondering how you got the spectrum "XDS2102A 2 Tone test.png", did you do any averaging? What are the FFT settings? I can't get any better than about -90dB noise level with built-in FFT.

author: tv84
author_rank: Super Contributor
timestamp: December 12, 2021, 09:36:51 am
content: Quote from: seronday on December 11, 2021, 10:35:27 pmSo, ashere.Could anybody sniff the SPI bus, at boot, and dump the loading of the NAND? Should be simple.

author: seronday
author_rank: Regular Contributor
timestamp: December 12, 2021, 12:01:57 pm
content: Quote from: maxwell3e10 on December 12, 2021, 07:41:11 amThe averaging was set to 64.All other settings are as shown on the screen printRegards.

author: priitv8
author_rank: Newbie
timestamp: May 18, 2022, 08:39:06 pm
content: Dear fellow Owon XDS users!I can contribute the shots of my XDS3064E internals.I had to pull the MoBo out of my scope in order to ship it back to factory for warranty repair.Sorry that I did not take better closeups of the front-end...I suspect the repair must have consisted of some sort of reflashing or software fix, as I see no signs of any interventions to PCB.The support person also told me that they are not in a position to replace the MoBo as a unit, so I shall send mine in for repair.Last but not least - how do you guys charge the battery pack for this scope?First time it broke down with a no-start condition after 8 months of usage.I had left it connected to AC power, in turned off state, to recharge the battery.After some 4 hours of charging, the oscilloscope did not start! Now, just 3 days ago, about a year after I got it repaired in warranty, it happened again!I can see the splash screen, but after that it turns off.Only the RUN/STOP button lights up in red, no others have the green light, as they should.It is very disturbing, that the battery charging can break the whole oscilloscope.I think it should not be used with the battery at all. Otherwise there is constant risk of having this non-start condition with this device.Or should I charge the battery only in the powered on state of the scope?PS Lucky me, I got it back into running state, with the firmware flasher I was sent by support tech the first time. Back then it did not help, hence I was asked to send the MoBo in.

author: maxwell3e10
author_rank: Frequent Contributor
timestamp: May 18, 2022, 11:33:59 pm
content: Thanks. I am curious if on 3064E scope (8 bit) they use HMCAD1511 or use HMCAD1520 and limit it to 8 bit in firmware. I think it's chip U45.

author: priitv8
author_rank: Newbie
timestamp: May 19, 2022, 05:42:34 am
content: Quote from: maxwell3e10 on May 18, 2022, 11:33:59 pmI tried to make most of my shot, and i can see the following:-the last number is painted over-the third number is 1, not 2I shall take the back cover off again and take a better picture.

author: maxwell3e10
author_rank: Frequent Contributor
timestamp: May 19, 2022, 09:06:42 am
content: It's interesting the last number is painted over. There is HMCAD1510, with maximum sample rate of 500 MSPS, HMCAD1511 with maximum sample rate of 1000MSPS, HMCAD1512 with maximum sample rate of 900 MSPS but without support for quad channel mode, and HMCAD1513 with maximum sample rate of 500 MSPS in dual mode only. So they should be using 1511, but I wonder if they managed to use one of the other chips.

author: JOSM
author_rank: Contributor
timestamp: June 08, 2022, 08:45:51 am
content: Quote from: maxwell3e10 on May 18, 2022, 11:33:59 pmHere is a photo of the chip on my XDS2102A.It says HAD1520.

author: maxwell3e10
author_rank: Frequent Contributor
timestamp: August 11, 2023, 11:16:13 am
content: For reference, here is another plug for Owon scopes. I was testing Owon XDS3062A directly against Rigol DHO1074 and it came out ahead in high dynamic range. In this plot, I can resolve the phase noise of HP 3326A synthesizer using Owon oscilloscope, but not using Rigol's DHO series. So the old HMCAD1520 chip is holding up well. It doesn't have very high sample rate, but for low frequency work seems quite good.

author: SPO
author_rank: Newbie
timestamp: January 20, 2025, 05:14:37 pm
content: Quote from: priitv8 on May 18, 2022, 08:39:06 pmHello there!It seems I have the same issue, may I ask you to send me the flasher utility?

author: Sammtillman-
author_rank: Newbie
timestamp: June 29, 2025, 06:53:16 pm
content: I also have the owon handheld hds272s. Stopped coming on after a long period on the charger. It’s not a battery issue. It’s brand new. Wish I could do the flasher too. Are get the number for the warranty people. Thanks

author: kmoonwalker
author_rank: Frequent Contributor
timestamp: June 29, 2025, 08:45:57 pm
content: Quote from: Sammtillman- on June 29, 2025, 06:53:16 pmopen rear battery compartment cover and check the batteries

author: MadTux
author_rank: Frequent Contributor
timestamp: September 11, 2025, 03:34:43 pm
content: Not much with hacking on Owon XDS 3000 series, from what I know.slow 8bit variants with slow 8bit ADC (crappy E and non-A versions)slow 12bit variants with 1x 12bit ADC, 2CH 200MS/s@12bit, 2CH 500MS/s@8bit, 1CH 1GS/s@8bit, (downgraded A versions, 3062A and likely 3102A)fast 12/14bit variants with 2x 12bit ADC, should have 2CH 500MS/s@12bit or 2CH 1GS/s@8bit(XDS3202A)fast 8bit variants, likely 2x 8bit ADC interleaved (XDS3302 non A)Every option is hardware only, function generator is extra FPGA, crappy DMM option is extra board.Just got myself a 3062A with 4 probes for about 200€, not perfect, but better than Hameg 1507-3 and Tek7904A for digital stuff....Price towards XDS3202A is crazy, about 1200€ on aliexpress.