Hacking Keysight 1000X - Page 1
Forum section: electronics / testgear

author: Claus1
author_rank: Contributor
timestamp: October 03, 2019, 09:35:47 pm
content: Hello. Has anyone hacked any 1000 series Keysight DSO? I have seen Dave's vid from 2017. Just wondering has anyone done it. Would be really good value for the price.

author: tautech
author_rank: Super Contributor
timestamp: October 03, 2019, 09:45:12 pm
content: Except for the poor mem depth and lack of features that other brands offer at lower prices.

author: TK
author_rank: Super Contributor
timestamp: October 03, 2019, 11:49:06 pm
content: The 2 channel models have been hacked:https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg2674032/#msg2674032

author: Fungus
author_rank: Super Contributor
timestamp: October 04, 2019, 02:45:16 am
content: Quote from: Claus1 on October 03, 2019, 09:35:47 pmYes. These days it can be done by inserting a USB stick, no hardware mods necessary:https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg2062735/#msg2062735

author: TK
author_rank: Super Contributor
timestamp: October 04, 2019, 10:26:41 am
content: It needs to have firmware 1.10 or lower. I don't think there is a hack for firmware 1.20

author: Mr. Scram
author_rank: Super Contributor
timestamp: October 04, 2019, 11:16:31 am
content: Quote from: tautech on October 03, 2019, 09:45:12 pmSiglent dealer says what?

author: tautech
author_rank: Super Contributor
timestamp: October 04, 2019, 11:18:01 am
content: Quote from: Mr. Scram on October 04, 2019, 11:16:31 amFacts !

author: Mr. Scram
author_rank: Super Contributor
timestamp: October 04, 2019, 12:05:21 pm
content: Quote from: tautech on October 04, 2019, 11:18:01 amFUD and propaganda! Consider contributing useful information from your unique position instead of just ripping on any competition like a generic fanboy. Buyers looking for what's best for them aren't served by pissing contests and endless discussions about differences blown out of proportion. We could do without the paid Siglent trolls sucking the nuance out of every discussion.

author: Fungus
author_rank: Super Contributor
timestamp: October 04, 2019, 12:58:32 pm
content: Quote from: TK on October 04, 2019, 10:26:41 amI'm sure a hack will appear but meanwhile the difference is very small:https://www.keysight.com/upload/cmc_upload/All/Keysight_1000A_X_Series_Oscilloscope_Release_Notes_01_20.pdf(three minor bug fixes and some enhancements in FRA).Me? I wouldn't pass on it because of that...

author: TK
author_rank: Super Contributor
timestamp: October 04, 2019, 01:10:23 pm
content: The problem is that if you receive a new scope with 1.20 installed, there is no way to install an older version, so no hack possible. It is only possible to downgrade if you have the hacked 1.10 firmware installed.

author: Fungus
author_rank: Super Contributor
timestamp: October 04, 2019, 01:19:48 pm
content: Quote from: TK on October 04, 2019, 01:10:23 pmGood point.Time to nag the hackers...

author: tv84
author_rank: Super Contributor
timestamp: October 04, 2019, 01:37:11 pm
content: You should install a "special" newer version that will re-enable installation of older versions.

author: Claus1
author_rank: Contributor
timestamp: October 04, 2019, 07:48:17 pm
content: Quote from: tautech on October 03, 2019, 09:45:12 pmI have seen Siglent scopes however 200 Mhz version(4 channels) is almost same as Keysight's hacked 1000 series. Memory depth isn't too important for me, if it's around 1 Million points or more it's good enough. I personally love the knobs above each channel, i can't stand multipurpose knobs.

author: Claus1
author_rank: Contributor
timestamp: October 04, 2019, 07:49:55 pm
content: Quote from: tv84 on October 04, 2019, 01:37:11 pmCan you give me a link perhaps?All the other guys, thanks for your help.

author: tautech
author_rank: Super Contributor
timestamp: October 04, 2019, 08:31:44 pm
content: Quote from: Claus1 on October 04, 2019, 07:48:17 pmOlder L models ?They don't even compare with the KS and later Siglent X or X-E models.X models unfortunately had optional features like the KS however most of those are at zero additional cost for X-E models so it's only the more advanced features in X-E that you would want to hack, WiFi, AWG and MSO and they each have additional HW costs too.QuoteYep understand that but good mem depth is a must have for many.QuoteI was certainly in the same camp until I got a pre-release SDS1104X-E to beta test, sure it took a few minutes to become comfortable with the physical UI but how Siglent have put it together and how the indicators show which channel is active to the multiplexed control it works surprisingly well.There has been a suggestion or two on the forum for changes but IMO Siglent got this right from the get go.

author: 2N3055
author_rank: Super Contributor
timestamp: October 04, 2019, 09:14:55 pm
content: Unless somebody makes a license generator in the style of Riglol, so you can install updates and use latest firmwares, I don't consider hacked Keysight a good thing.Whole idea is that Keysight is more expensive despite being slightly inferior hardware and capabilities is that it is supposed to have superb quality of support. Which you give up voluntarily if you hack it.You cannot install newest versions of firmware (with bug fixes) because of hack, and have to wait for months for new hack for new firmware. Not to mention if you have to send it in for warranty, and you have defect that won't let you restore factory firmware. And you have no clue what's gonna happen.Don't get me wrong, new Rigols are also in that boat, but they don't carry price premium for services you give up on....

author: tv84
author_rank: Super Contributor
timestamp: October 05, 2019, 08:36:29 am
content: Totally agree.

author: Fungus
author_rank: Super Contributor
timestamp: October 05, 2019, 09:58:39 am
content: Quote from: 2N3055 on October 04, 2019, 09:14:55 pmI thought it wasalsothe massive power of their ASIC - based chipset, the really fast user interface, etcQuote from: 2N3055 on October 04, 2019, 09:14:55 pmDo you give it up? If I take a 'scope back with a dead power supply would Keysight refuse to touch it?

author: Claus1
author_rank: Contributor
timestamp: October 05, 2019, 03:23:43 pm
content: I guess i will leave Keysight hacking as you suggested. Have to dig into endless Siglent vs Rigol vs GW topics now...

author: Fungus
author_rank: Super Contributor
timestamp: October 05, 2019, 06:21:47 pm
content: Quote from: Claus1 on October 05, 2019, 03:23:43 pmBear in mind that if they're endless then it means there's no "correct" answer, despite what the resident Siglent salesmen keep on repeating ad nauseam.(Also: If hacked Keysight version 1.2 firmware appears while you're still deciding then you know what to do...)

author: tv84
author_rank: Super Contributor
timestamp: October 06, 2019, 11:47:57 am
content: FERCSA patched FW enables all the Options from 3 to 39 (attached pic).Replicating his patch to newer FW is boresome...Anyone has a memdump of a DSO1000X ?

author: Fungus
author_rank: Super Contributor
timestamp: October 06, 2019, 01:05:53 pm
content: Quote from: tv84 on October 06, 2019, 11:47:57 amIt should really be automated by now.I don't know the details. Does he do it by hand with a hex editor or is there some sort of scripted search/replace process?I notice there's an acquisition memory upgrade. Can this be hacked to 4Mb memory? I believe there's 4Mb RAM inside the ASICs.(one of the reasons this 'scope is so amazingly fast is that the RAM is inside the ASIC but it's a double-edged sword because it means RAM is limited to 4Mb even on the high-end models).This should probably be in the hacking thread.

author: tv84
author_rank: Super Contributor
timestamp: October 06, 2019, 01:14:02 pm
content: Quote from: Fungus on October 06, 2019, 01:05:53 pmI doubt it. This is not a production line... And since (I think) he has done it only once, it's not something that you go and automate right on.If one automates, it requires lots of tests to be safe. Many times it's not worth the risk for this kind of task.

author: tv84
author_rank: Super Contributor
timestamp: October 06, 2019, 01:15:28 pm
content: Quote from: Fungus on October 06, 2019, 01:05:53 pmAre we not there? ?

author: Fungus
author_rank: Super Contributor
timestamp: October 06, 2019, 01:37:46 pm
content: Quote from: tv84 on October 06, 2019, 01:14:02 pmThe version changes are minor so binary code is unlikely to change much unless Keysight does it deliberately. There's probably not much danger in automating it.What's really needed is a single automated hack to enable firmware downgrades. After that way people can use tried and trusted hacked firmwares while hacking of newer versions is in progress.These 'scopes run windows CE, people have managed to get into the Windows desktop and play DOOM on them.https://ripitapart.com/2018/10/15/gaining-access-to-the-windows-ce-desktop-and-doom-on-the-keysight-dsox1102g-oscilloscope/There's several things on that page that indicate you can trick it into loading a different firmware during boot or to go to the windows desktop so you can hack around the system. I'm sure a bit of effort could come up with a really nice "downgrade" hack but I don't have a 'scope to play with :-(

author: Fungus
author_rank: Super Contributor
timestamp: October 06, 2019, 01:54:04 pm
content: Quote from: tv84 on October 06, 2019, 01:15:28 pmOh, yes, so we are!(I mean the original hacking thread, this is a new one...)

author: Fungus
author_rank: Super Contributor
timestamp: October 06, 2019, 02:15:34 pm
content: Is it possible to boot the 'scope using firmware v1.0 and the trick detailed here:https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg264356/#msg264356If so, can you upgrade to the hacked v1.1 firmware?Even if that doesn't work, it's still a simple way to run the hacked v1.1 firmware directly from USB with zero risk - just pull the stick out and revert to factory firmware.(at the cost of a 'little bit longer' boot time ... how much longer?)

author: TK
author_rank: Super Contributor
timestamp: October 06, 2019, 10:52:54 pm
content: Most of the tricks for the 2000X or 3000X series do not work on the 1000X, i.e. the infiniivision.lnk method never worked on the 1000X.

author: tv84
author_rank: Super Contributor
timestamp: October 06, 2019, 11:31:50 pm
content: Quote from: TK on October 06, 2019, 10:52:54 pmSure, but what FEECSA did on the 1000X could, very well, be used in 2000X and 3000X. Same patch.

author: TK
author_rank: Super Contributor
timestamp: October 07, 2019, 12:07:15 am
content: Quote from: tv84 on October 06, 2019, 11:31:50 pmSorry for the confusion, I was replying to Fungus's post about running the firmware from USB, etc... If FERCSA hack could work on the 2000X 3000X, then it is an interesting finding worth sharing on the 2000X/3000X hacking thread