WTB: broken Rigol DS10xxZ scope/mainboard - Page 1
Forum section: electronics / general

author: tmbinc
author_rank: Frequent Contributor
timestamp: March 13, 2017, 11:02:47 pm
content: My little pet project is to re-write the firmware for the Rigol DS10xxZ. Now, before you get too excited, no, it hasn't happened yet. But hey, I got parts of the hardware figured out to at least run Linux on it!However I really want to map out the FPGA<>iMX connections, and for that I need to de-populate a board. But I do not have the hearth to kill working scope, not even in the name of science.Thus I'm looking for an Rigol DS10xxZ mainboard (or ideally a full scope) that is broken enough that it can't be (economically) repaired. I would not want to pay more than 150 EUR (+Shipping) on this, unless you tell me a good reason why it's worth it. But remember - if it still works (or could easily be repaired), I don't want it (not even for free).Should be either EU or US/CA, otherwise shipping it won't be economical either.

author: bitseeker
author_rank: Super Contributor
timestamp: March 13, 2017, 11:36:40 pm
content: Kudos on your work thus far.I wish I had a broken one for you. I'll keep my eyes peeled.

author: james_s
author_rank: Super Contributor
timestamp: March 14, 2017, 12:15:12 am
content: Hah, well now that you've got Linux running on your scope, what else could you possibly need?

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: March 14, 2017, 12:43:06 am
content: Does the iMX have JTAG ? - that might be another way to map connections

author: tmbinc
author_rank: Frequent Contributor
timestamp: March 14, 2017, 07:38:32 am
content: Thanks!iMX's JTAG is exposed (it's what I currently use to upload the software), and likely is the FPGA's. (bitstream loading uses serial, so JTAG isn't used in normal operation). You're right that using boundary scan on both sides may work, or I could also just reverse enough of the iMX side to understand in detail what configuration is used to transfer configuration and waveform data (appears to be a multi-bit SPI bus, which sounds weird, I know). Reversing the existing software (plus running code and trying) is what got me LCD, Frontpanel buttons&leds, Ethernet, USB, UART(*) support.But to be honest, I'd rather like to throw some money on the problem and do it the easier way. I'm mostly time-constrained on this project so I want to focus on the fun things. Especially I also need to map out other FPGA connections like ADC and the acq. memory.(*) Unfortunately I didn't find any unused UART pins, so I'm using the frontpanel UART for debug spew.

author: mubes
author_rank: Regular Contributor
timestamp: March 14, 2017, 08:35:52 am
content: At the risk of simply creating more work for you, can I suggest you set up a justgiving page or just a gifting paypal account or something? There are enough owners of these scopes around that you stand a pretty good chance of collecting enough cash to actually _buy_ a guttable scope if everyone chucked in a few dollars/euros/quid. The fact that you've got this far is a proof-point that it's not just a pie-in-the-sky idea and you're actually serious about doing it.DAVE

author: frozenfrogz
author_rank: Frequent Contributor
timestamp: March 14, 2017, 08:59:17 am
content: Also: How about getting the board x-rayed?Maybe you have a doctor-friend that can help you out, or a university lab near by?http://makezine.com/2015/08/11/homemade-x-ray-inspector-reveals-pcb-secrets/Anyway: Nice project and thanks for sharing it with us!

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: March 14, 2017, 10:05:36 am
content: Quote from: frozenfrogz on March 14, 2017, 08:59:17 amx-rays are of limited use for reversing PCBs, even less so on a populated PCB. Unless you know someone with a microfocus CT system.Medical X-ray probably not enough resolution - dental maybe just, but small imaging area.Patreon may be another funding option.

author: mubes
author_rank: Regular Contributor
timestamp: March 14, 2017, 11:16:08 am
content: (Didn't know about Patreon - good catch)One investigation vector might be via the update (GEL) files. At least on the DS2072 the FPGAs are reprogrammed seperately to the main program code, so it might be possible to find a way in there if there are any experts around who know what they're looking for.DAVE

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: March 14, 2017, 11:19:50 am
content: Probably worth setting up a saved/favorite seacrh on ebay, with the model numbers and a price limit, to catch any that get listed.

author: lukier
author_rank: Unknown
timestamp: March 14, 2017, 11:50:49 am
content: If you have both JTAGs available then maybe this tool can be adapter for iMX and Spartan FPGA:http://www.alexforencich.com/wiki/en/projects/ftjrev/startalex.forencich is active on this forum, so maybe he can help.

author: BravoV
author_rank: Super Contributor
timestamp: March 14, 2017, 01:09:10 pm
content: +1 for Patreon.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: March 14, 2017, 01:12:37 pm
content: Quote from: BravoV on March 14, 2017, 01:09:10 pmAnd also a Paypal address for anyone that just wants to throw a 1-off donation.

author: tmbinc
author_rank: Frequent Contributor
timestamp: March 14, 2017, 02:58:23 pm
content: Thank you for the offers on helping me buy a scope, but that's unfortunately not a solution for me. I've worked on a crowdfunded project (indirectly) before and I definitely don't want to do this again. I understand it would be a donation, no strings attached (technically) etc., but in the end, people would donate with the idea that it helps this project and have expectations. I don't know if I will ever work on this project (likely yes, but I want that to be my own decision), or when I will work on this project (likely at some point, but I'd be free to re-prioritize), and I don't want to disappoint _anyone's_ expectations. In reverse, though, if someone wants to reverse-engineer I'd be happy to donate something - just because it's not a solution for me it may be for someone else.ftjrev is definitely worth a try. I'm slightly hesitant driving random IOs on both sides but worst case it solves my issue in finding a broken scope.Reversing the update file - or actually just the NAND contents, which includes the FPGA image - is more difficult than said, as unfortunately there are very little resources on reverse-engineering FPGA bitstreams.

author: JPortici
author_rank: Super Contributor
timestamp: March 14, 2017, 03:03:51 pm
content: jeez we're talking about 400$ not an indiegogo 100k with flexible fundingeven by donating 1$ with no expectation you could finance a sacrificial scope in no timei'd be happy to toss a couple of bucks for the science! you may make me reconsider selling it for a better scope, i could keep it around instead waiting for a better OS (while i use a better scope of course)

author: james_s
author_rank: Super Contributor
timestamp: March 14, 2017, 03:55:02 pm
content: I have access to an xray machine if you happen to be in the seattle area. It's been handy for reverse engineering on occasion.

author: Aigor
author_rank: Contributor
timestamp: March 14, 2017, 08:00:28 pm
content: Hi, i don't know if is usefull, i have a broken ds 1052E, is laying in my "lab" if you want, i can send to you

author: tmbinc
author_rank: Frequent Contributor
timestamp: March 14, 2017, 08:03:59 pm
content: Thank you, but unfortunately a DS1052E doesn't help because it has a very different architecture.

author: 5n44p
author_rank: Contributor
timestamp: April 20, 2017, 01:11:37 pm
content: Any news on this project?Seems interesting

author: ebastler
author_rank: Super Contributor
timestamp: April 20, 2017, 02:47:39 pm
content: I'll pitch in 50 Euro towards a new DS1054Z to take apart, if this project actually goes forward.@tmbinc: Would you still be interested in doing this?