Metrix Scopix II OX7062 Review / Teardown - Page 1
Forum section: electronics / testgear

author: shakalnokturn
author_rank: Super Contributor
timestamp: December 07, 2018, 11:11:48 am
content: I recently bought a lightly used Metrix OX7062 handheld DSO.It came with the original box, USB-RS232 cable, 10 Base T Ethernet cable, PSU, one HX0030 (10:1 250MHz isolated probe), one HX0034 (80A AC/DC current clamp).At the same time I found a separate set of two HX0004, 10:1 250MHz isolated probes for an extra 25€ postage included. They do not use the scope's Probix bus though.The scope is a dual isolated channel 60MHz model, with 1GS/s real time sampling, 12bit resolution and 2500 samples/channel as standard (50k optional).Display is 320x240 STN colour with resistive touchscreen. (This model also exists with a monochrome display.)The GUI is a primitive windows style, most adjustments can be either accessed either by the top drop-down menus or by double-tapping on areas of the display.The scope's size is a hard compromise between a portable bench scope and a handheld scope, it fits very well on a bench with the rear stand, it's slightly too bulky to my likings to be handheld for a long time.HX0034 current probe has 2 programmable buttons, commonly used for changing A/div, there is a third button for degaussing/zeroing the DCA measurement.HX0030 has the same 2 programmable buttons, the third key lights a white led as an aid to see where you're probing.Connecting or removing a Probix probe brings up a window telling you the acquisition channel it is on, as well as the probe bandwidth and other limitations.The good points:Casing, apart from the rear stand, the casing looks and feels really rugged.Colour display, nice to have it, arguably there is more point to this on a 4 channel version.Battery still lasts about 3 hours of continuous use.Ethernet.1GS/s, 12bits actually gives the FFT option some meaning.The bad points:STN display a little low on resolution and very slow.Resistive touchscreen, would have been nice to have a double-tapping sensitivity adjustment.It is sold as a 5 in 1 instrument "OSCILLOSCOPE ; MULTIMETER ; FFT ANALYSER ;HARMONIC ANALYSER AND RECORDER" but as default there are no harmonic analyser or recorder. These must be added with option keys.DMM autorange is ridiculously slow, also DMM has no dedicated acquisition channel, a Probix adapter must be used on one of the scope inputs.Opening the case...Six T10 headed screws hold the two halves of the shell together.Removing the rear reveals a PCB showing mainly the shielding to the two channel frontends and the unpopulated footprints for the other two channels.Only 2 Phillips head screws at the bottom secure this PCB in place. Once removed the interconnect bottom right opposes a little resistance (do not lift board out from the top, leaver up from bottom right).The scope is split into two PCB's most of it being on the first one. The main PCB holds the frontend and acquisition system, graphics, CPU, some power supplies...The other PCB holds the keyboard, some power supplies including CCFL inverter.LCD panel is a Kyocera KCS057QV1AD-G23.Given the 1GS/s and 12bit specs I was really curious of the acquisition hardware to be found under the shielding.It turns out to be a CCD type of setup.A first ASIC marked "SCALING 0732V2.2" sees to the input amplification/attenuation, BWL.It looks like a AQY216EH static relay is used for bypassing the AC coupling capacitor.A second ASIC marked "PIPELINE V3" must be the CCD storage, the output from this is then fed to a slow AD7472A 12 bit ADC.The isolation is built around transformers (of course!) an ADUM2402 digital isolator and a HCNW2611 high speed logic level opto.The processing, display and interlink are taken care of by a EP1K50 FPGA and XPC823 CPU.Ethernet link is based on a LXT905.I didn't get round to removing the grey plastic isolation shield between channels, it seems that it should slide off pulling towards the Probix connectors but is likely held firmly in place by the screwed-in coaxial connectors themselves, a ribbon cable runs along it's back to connect to the Probix bus.seeing the top side layout I'm not expecting to find much other than passive components on the hidden side.Evolution?Of course one of the motivations to open it was to get a first idea on how much it could be hacked.The top of the series models have 100MHz bandwidth, I suppose this is the one thing that could be hacked easily.The display could be upgraded to a TFT model with LED backlight like the NHD-5.7-320240WFB but that comes at a price.Then there's the stuff to be enabled with software keys, the 50k points memory is probably one of them.Photo album is here (not fantastic photos):https://photos.app.goo.gl/K8jYtuxE7kifzeYx8

author: noidea
author_rank: Unknown
timestamp: December 11, 2018, 04:29:08 pm
content: Thanks, I have seen the 4 channel ones on US ebay and wondered what they were like

author: widlokm
author_rank: Contributor
timestamp: March 30, 2019, 09:07:41 am
content: Hello shakalnokturn,Are You still playing with OX7062? I have very similar model OX7042 (scopix III) - looks almost the same from the inside and I also thinking about hacking it. In fact I already tried to read firmware directly from onboard flash (failed, but it is possible) and I got the bin file from Metrix update tool.The scope uses VxWorks OS and some java code, but this is everything I know now from the software perspective.Scope board also has BDM (debug interface for MPC823) connector on its side and it was possible to connect some interface to it, however it is rather unpopular connection and much more work is needed to use it.Anyway if You still thinking about hacking the scope pleas tell me, maybe we can work together.Regards,Michael Widlok

author: ServoTom
author_rank: Newbie
timestamp: November 21, 2019, 03:40:01 pm
content: Hi,did someone succesfully hacked the scopix so far? I own a OX7042 as well.Best regardsTom

author: shakalnokturn
author_rank: Super Contributor
timestamp: November 21, 2019, 05:10:28 pm
content: Not that I know of.I'm not into software much besides I don't rely on this scope often enough to want to go to the bother on my own right now.Could do with some detailed photos of front ends of other models to determine if there are a couple of passives to change to gain bandwidth or if it is software clipped.

author: bestel
author_rank: Contributor
timestamp: September 05, 2020, 03:37:15 pm
content: Hi guys!Some update.I've unpacked all firmware (not encrypted) from the "firmware update manager" and try to disassemble it.I've not figure out how to decompile the code, but I think I found something.All models (not the 1st & 2nd one) have in memory some strange strings, that look like this :Code:.....OptionsNonInstallees.... - Multimeter4rdfGP45... - Harmonic78jdfs#KL4... - Recorder%%%%%%hdf<... - Memory:df$$z89AZ*$... - ColorDisplay@6Yg45... - PowerMeter45sdfq%.... - Extension1*.^12nNq........|.......|.......It could be a non initialized memory, but it's seems to be a string... so very strange.And if you take that one for example : "Memory:df$$z89AZ*$" and you try to encode it in base64, it give you that :"TWVtb3J5OmRmJCR6ODlBWiok" = Amazing! This is what the software want, 6 x 4 = TWVt b3J5 OmRm JCR6 ODlB WiokI've tried to enter this code in reverse, lowercase, uppercase.... nothing works...For those who will want to try something, here is my program for unpacking the "vers.mx" file containing all the "XPC8xx" firmware based :(Still a Work in progress - and yes it's dirty)The program need to be launch in the same directory, and will output 3 type of file :OUTRAW_x => It's the hexadecimal code without any modifications (beside removal of "HEX" protocol and CRC). You can open it with an hexadecimal editor.OUTPUT_x => will be the main output : it's OUTRAW converted from HEX. You can open it with an hexadecimal editor.O_TEXT_x => It's the OUTPUT_x directly in ASCII. You can open it with any text software.Code:#include <stdio.h>#include <stdlib.h>#include <string.h>#include <unistd.h>typedef enum{STATE_SYNC,STATE_ID,STATE_SIZE,STATE_ADDR,STATE_DATA,STATE_CRC,STATE_END,} STATE;int main(){FILE *mx, *raw, *binary, *text;printf("Let's begin!\n");mx = fopen("vers.mx", "rb");if(mx == NULL){perror("fopen read");return EXIT_FAILURE;}STATE current = STATE_SYNC;char buf;unsigned read_length, addr_length, data_length;unsigned real_read;unsigned char new_file = 1;unsigned char state_id = 0;unsigned char output_id = 0x30;char outputRAW_str, outputBIN_str, outputTEXT_str;strncpy(outputRAW_str, "OUTRAW_x.txt", 12);outputRAW_str = 0;strncpy(outputBIN_str, "OUTPUT_x.txt", 12);outputBIN_str = 0;strncpy(outputTEXT_str, "O_TEXT_x.txt", 12);outputTEXT_str = 0;while(1){// SELECT HOW MANY TO READswitch(current){case STATE_SYNC:{read_length = 1;break;}case STATE_ID:{read_length = 1;break;}case STATE_SIZE:{read_length = 2;break;}case STATE_ADDR:{read_length = addr_length;break;}case STATE_DATA:{read_length = data_length;break;}case STATE_CRC:{read_length = 1;break;}case STATE_END:{printf("Should not be there\n");break;}}// READreal_read = fread(buf, 1, read_length, mx);if(real_read != read_length){current = STATE_END;}// PROCESSswitch(current){case STATE_SYNC:{if(buf == 'S'){current = STATE_ID;}break;}case STATE_ID:{state_id = buf - 0x30;switch(state_id){// Special memory ? Bootloader ?case 1:// Real shitcase 2:{if(new_file == 1){new_file = 0;outputBIN_str = output_id++;binary = fopen(outputBIN_str, "w+");if(binary == NULL){perror("fopen write");}outputRAW_str = outputBIN_str;raw = fopen(outputRAW_str, "w+");if(raw == NULL){perror("fopen write");}outputTEXT_str = outputBIN_str;text = fopen(outputTEXT_str, "w+");if(text == NULL){perror("fopen write");}}current = STATE_SIZE;break;}// EOF - but not the end of the mx filecase 9:{new_file = 1;fclose(raw);fclose(binary);fclose(text);current = STATE_SIZE;break;}default:{printf("ERROR: WRONG ID %d -- %x -- RESYNC\n", state_id, buf);current = STATE_SYNC;break;}}break;}case STATE_SIZE:{int size = ( (buf-0x30) *16) + (buf-0x30);if(size > 20){printf("ERROR: SIZE=%d - SKIP and RESYNC\n", size);current = STATE_SYNC;if(new_file == 0){new_file = 1;fclose(raw);fclose(binary);fclose(text);}break;}switch(state_id){case 1:{addr_length = 4;data_length = (size * 2) - addr_length - 2;break;}case 2:{addr_length = 6;data_length = (size * 2) - addr_length - 2;break;}case 9:{addr_length = 4;data_length = 2;break;}}current = STATE_ADDR;break;}case STATE_ADDR:{current = STATE_DATA;break;}case STATE_DATA:{char data;char hex;for(int i=0 ; i < data_length /2 ; i++){hex = buf[(i*2)];hex = buf[(i*2)+1];data = (char)strtol(hex, NULL, 16);}// Output raw unpacked datafwrite(buf, 1, data_length, raw);//fwrite("\n", 1, 1, raw);// Output converted bytesfwrite(data, 1, data_length /2, binary);// Output converted bytes to asciifor(int i=0 ; i < data_length /2 ; i++){if(data >= 0x20 && data < 0x7F){fprintf(text, "%c", data);}else{fprintf(text, ".");}}current = STATE_CRC;break;}case STATE_CRC:{current = STATE_SYNC;break;}// EOFcase STATE_END:{fclose(mx);return EXIT_SUCCESS;}}}printf("Over!\n");}UPDATEIt seems that evey code is unique, so it seems to be more complicated than this.Here is the source in french :Quote

author: shakalnokturn
author_rank: Super Contributor
timestamp: September 05, 2020, 05:14:48 pm
content: I recently acquired a used Scopix III with options installed when I find some time and quiet I'll try dumping the flash and post it here along with the scope's serial number.If the option keys are in flash the corresponding serial could help find the math behind it.

author: bestel
author_rank: Contributor
timestamp: September 05, 2020, 07:27:31 pm
content: Quote from: shakalnokturn on September 05, 2020, 05:14:48 pmYes, for the moment I have no idea where the UID is... maybe a unused part of the flash.Do you know a cheap solution to dump the flash?I hope they did not used the FPGA for the "security" part

author: shakalnokturn
author_rank: Super Contributor
timestamp: September 06, 2020, 10:02:50 pm
content: Yes, hopefully not the FPGA.I was hoping for a I²C EEPROM somewhere for serial number, factory calibration, option keys... I haven't spotted one.I know of no easy way to dump the flash, no doubt it can be done over Ethernet when you know how to. I don't so the plan is to take a little risk and desolder the TSOP then read it externally.I wish at least some service software and schematics would leak from C.A. once in a while.

author: bestel
author_rank: Contributor
timestamp: September 07, 2020, 04:21:09 pm
content: Is there any law to force them to provide these information?Something like "the right to repair something I bought"?I could try to ask them

author: shakalnokturn
author_rank: Super Contributor
timestamp: September 22, 2020, 12:51:10 am
content: Did you also get free Probix probes with your free scope? I can't believe how hard it is to get hold of those at a decent price.I finally got round to completely removing the FE PCB on the OX7062-CTo do that the input coax connectors centre must first be de-soldered, then you either need a specific tool with 4 teeth that will slide between the coax shield and the surrounding plastic or you can get away with just a piece of metal tube if it has the right diameter and is slightly conical, that's what I did.There's not that much going on on the hidden side of the PCB, a lot of decoupling capacitors, and a little extra on CH4 for the DMM input.I made some in circuit measurements of FE capacitor values (DE-5000 @100kHz) and partially sketched the input.Added a few photos to the gallery.