LeCroy LC series oscilloscope firmware update file format - Page 1
Forum section: electronics / testgear

author: 1Ghz
author_rank: Unknown
timestamp: April 08, 2017, 07:23:59 am
content: Hello,Has anyone reverse engineered LeCroy LC series oscilloscope firmware update file format?I want extract and analyze payload (firmware).AFAIK, firmware is compressed by unknown algorithm.Any help would be appreciated.Thanks.Update 1: Some of firmware update file and screenshot attached.There's some plain text.

author: ollopa
author_rank: Regular Contributor
timestamp: July 27, 2017, 06:16:57 am
content: Are you talking about "The following scopes can be upgraded to these versions with emailed files through the floppy drive or Teledyne LeCroy Scope Explorer via GPIB/TCPIP" ?http://teledynelecroy.com/support/softwaredownload/other_scopes.aspxIf so then I doubt many people even have the update files. Perhaps you should put yours up on a Google drive or somewhere similar.

author: Wuerstchenhund
author_rank: Super Contributor
timestamp: July 27, 2017, 01:10:55 pm
content: The firmware update files for 9300, LC and WR1LT/WR2LT/WP900 are available in the LeCroy Yahoo! group's download section.If the aim is to hack options, save your time as the images for the option GALs for the 9300 Series are freely available in the Yahoo! group, and the same GALs go in the LC Series.

author: nctnico
author_rank: Super Contributor
timestamp: July 27, 2017, 06:30:50 pm
content: AFAIK there are software options too which aren't enabled by the GAL.

author: Wuerstchenhund
author_rank: Super Contributor
timestamp: July 28, 2017, 09:06:20 am
content: Quote from: nctnico on July 27, 2017, 06:30:50 pmNo, the software options for LC and 9300 are pretty much the same. The 9300 relied on GALs while the LC (when running the latest firmware) can use either, GALs or a option key code.

author: ollopa
author_rank: Regular Contributor
timestamp: July 30, 2017, 09:24:11 am
content: I don't think it's compressed. It has a huge section of 0xFF's at the end like empty space in an EEPROM, and and exact size of 0xE0000 with what looks like a 32-bit CRC at the end. There are many plaintext strings, though some of them have 0xFF's inserted into them at odd places.Strings likeQuotemake it pretty obvious you're looking at scope firmware.I gather that this is some kind of a floppy disk image. My membership to the Yahoo! group is pending moderation so I can't access the files and posts there, but I doubt there's anything too mysterious here. There may be file system metadata in the file or some such thing.Rather than try to reverse the update floppy format, it might be easier to just dump it from the chips in the scope.

author: Converter
author_rank: Regular Contributor
timestamp: January 30, 2021, 01:27:32 am
content: Everything seems to be sorted out with advanced options.But who knows how to upgrade an oscilloscope category like WavePro 940 to WavePro 960?Where are these identification settings located?I'm only interested in software settings, expanding the bandwidth of the analog input is not difficult.

author: darkstar49
author_rank: Frequent Contributor
timestamp: January 30, 2021, 03:12:24 pm
content: In more recent models, there's always a bandwidth option as well, not because the scopes are software upgradeable (they're not), but for the software to know the actual model.Those options are not visible by default in the scope's About screen, only in service mode.To my knowledge, those options didn't exist prior to the first generation of Windows scopes. As for the 9xx, my personal best guess is that it was part of the serial, I don't see any other reference to the model ID.

author: Converter
author_rank: Regular Contributor
timestamp: January 30, 2021, 05:37:20 pm
content: I found no hardware difference between the WP940 and WP960 ACQ board. Exchange of motherboards between these oscilloscopes also does not change the identification of the oscilloscope model. From this I conclude that the identification of the model is embedded in the firmware of the ACQ board. However, I do not see a suitable place for this there. According to the diagram, I see only 2 components: GAL16V80 (EECMOS programmable logic device, PLD) and EPC2LC20 (FPGA Configuration Memory IC).

author: djw
author_rank: Newbie
timestamp: January 30, 2021, 06:16:24 pm
content: Elsewhere in the service manual, it details different assembly numbers for the 940 and 960 acquisition boards. PCB likely the same, but component placement is typically not - with front-end component value and presence differences as in most of the LeCroy's. Optimized for their BW, not optimized to be software bandwidth upgrade.The WavePro 9xx acquisition board is an evolution of the LCxxx boards, which come from the 93xx series. In all cases, the scope type and other factory build info is stored in the serial EEPROM, which would likely be U60 (24LC32AT) for the WavePro.

author: Converter
author_rank: Regular Contributor
timestamp: January 31, 2021, 09:48:42 am
content: Yes, you were right about the U60. It's amazing that I didn't see her right away. Now this is changed as I wanted.But there was a problem with the analog bandwidth.No, not what you thought, but on the contrary - in WP940 it is too high. Initially, in my WP940, the rise time was about 375 ps (which by the way is twice as good as guaranteed by the specification), and practically without overshoot (see photo):Now I have to expand the bandwidth, like in WP960, which originally looks like this:But I do not see a single adjustment element for this in the circuit, which refers to the analog path LOZ (50 Ohm). There are only 2 capacitors, which can be influenced by C1035 (1pF) and C1050 (2.2pF), but it looks like they are the same for the entire WP900 series (even for the LC684 they do not differ).So the only difference I found between 960 and 940 is the yellow (multiplexing?) Board. The WP960 has no low-pass filters, but the WP940 board has LC passive filter chains.I moved this WP960 board to WP940 and after that I saw a heavily overcompensated RF signal with high overshoot:The same result is obtained by removing these filters from the WP940 board:But in WP960 not have these filters, and at the same time there is normally set compensation.How is this done in WP960, if there are no adjusting elements, and the marking of the parts does not differ from WP940?How can this excessive RF compensation be corrected? Why is it so high?

author: djw
author_rank: Newbie
timestamp: January 31, 2021, 03:18:36 pm
content: Quote from: Converter on January 31, 2021, 09:48:42 amAssuming the same as other LeCroys, the parts on the mainboard are typically different. Most of the parts involved in the front-end circuitry are small and without markings. You will not see differences, but there surely will be - as well as the different daughterboard like you mention. The service manuals do not always cover all variants - good for reference, not 100% accurate for all flavors.

author: Converter
author_rank: Regular Contributor
timestamp: January 31, 2021, 06:22:28 pm
content: Ok, but look at the diagram above (highlighted in yellow). What electronic parts do you think might be different? It will not be difficult for me to unsolder them and compare them individually.No, you are wrong about other LeCroy oscilloscopes. For example, in the WavePro 7K line of oscilloscopes, all the details of the input modules are the same, except for the ratings of the same passive filter chains that are added between the output from these modules and in front of the ADC input, as I have already shown on the yellow board, above. The same applies to WaveRunner 6K.In the old WaveSurfer, there are indeed several components inside the path that change with models and correct the frequency response, but there is a fundamentally different structure with a common amplification path for both modes of operation: 1M and 50 Ohm, and not 2 separate independent paths, as in this case. This case is rather similar to WavePrp7K, in which there is a separate 50 Ohm path and there really are no control elements for the frequency response (up to the output lines in front of the ADC).Quote from: djw on January 31, 2021, 03:18:36 pm

author: djw
author_rank: Newbie
timestamp: January 31, 2021, 06:52:53 pm
content: A couple things...Quote from: Converter on January 31, 2021, 06:22:28 pmDon't know, but a 2 GHz signal path is not trivial. Factory calibration is typically involved. Bandwidth is only one of the many scope's performance criteria. And also, because of that different daughter-board (and otherwise), a 940 is limited to 8GSs for 1 channel, whereas the 950/960 can do 16GS/s. Changing a scope model type doesn't change the HW build differences which achieve that performance. So unless you are also changing that switching and filtering board (HSY638 vs. HSY644), you can't make a 940 a 960 besides model number only. Something of a Frankenstein - somewhere in between, with impacted measurement accuracy as well.Quote from: Converter on January 31, 2021, 06:22:28 pmThe 6000 series are also not the same hardware build between types - have distinct values that are different on the acquisition boards. In this case, the service manual does explicitly point them out.LeCroy makes their models purpose built (and tested and calibrated) for their bandwidths and related specs, with very few exceptions.

author: Converter
author_rank: Regular Contributor
timestamp: January 31, 2021, 07:24:52 pm
content: Quote from: djw on January 31, 2021, 06:52:53 pmI am writing about this not formally using general wording, but in detail, based on practical experience and specifications for the electronic circuit. Just take and look at the electronic components specification: the circuit and components of the input modules are the same for all models of the WR6K line 350MHz - 2GHz (as in the WP7K line) except for a single passive second order filter that is added at the output of the module (the beginning of the differential connecting line). Service manual confirms this officially. The rest of the function of equalizing the frequency response and phase response in the X-Stream series of oscilloscopes is provided by software. Thus, the source of the overcompensation in WP940 is still not clear to me.I have not yet had the opportunity to study all the functional differences between HSY638 versus HSY644, but after changing the firmware 940 says that it makes 16 GS/s in 1 channel mode)). I haven’t tested it yet, but somehow I’ll come to terms with it if it’s not. I have concerns that the multiplexer here may indeed have hardware limitations.

author: Converter
author_rank: Regular Contributor
timestamp: January 31, 2021, 09:08:09 pm
content: I have to surprise you. I just checked by the number of points (samples) per division on the display and you can clearly see their doubling after turning on the 1 channel mode. Thus, I can state that this module from WP940 supports 16GS/s mode. This fact alone makes flashing WP940 to WP960 or WP950 justified. Bandwidth Limiters 20 MHz, 200 MHz also function normally.But I found that on this "yellow" board from WP960 (HSY638?) varactor diodes SMV1247 (0.7-7pF) are present. Before that, I assumed that these were some kind of overvoltage protection elements. Now the functional purpose of these elements is not clear to me, but they can affect the frequency response. I may have to return the LC filters to the 940 and optimize them for optimal frequency response.By the way, can no one send me a firmware dump from WavePro 960 or WavePro 950?Because, in fact, I am currently using firmware from DDA-260, which is not quite what I need (regarding keyboard functions).

author: djw
author_rank: Newbie
timestamp: January 31, 2021, 11:50:51 pm
content: Quote from: Converter on January 31, 2021, 09:08:09 pmThe firmware is the same on the WavePro / DDA-260 / JTA-260 family scopes. Same as the firmware is the same on the LCxxx vs. DDA12x scopes.

author: Converter
author_rank: Regular Contributor
timestamp: February 01, 2021, 12:15:45 am
content: This is not entirely true. I already wrote that the functionality of some keys after flashing has changed in accordance with the specific functions of the DDA-260 and now does not correspond to the inscriptions on the WP940/960 panel.Quote from: djw on January 31, 2021, 11:50:51 pm

author: djw
author_rank: Newbie
timestamp: February 01, 2021, 01:25:35 am
content: There is only one firmware load for these scopes, 9.3.0 being the last. Instrument identification and behavior is determined by option type and variant settings, not different firmware.

author: Converter
author_rank: Regular Contributor
timestamp: February 01, 2021, 03:09:19 am
content: After all, from the very beginning of our dialogue, we have never touched on the software, which is freely available, and the methodology for generating keys to the device options, right? We meant a way to simply clone a dump of this small chip, which, in addition to the additional option codes, contains an oscilloscope model type identifier that cannot be changed by entering the generated keys in the usual way. Anyway, among the list available to me of all the possible keys that I can add, I do not find an option to change the oscilloscope model (like WP or DDA, 940 or 960).Perhaps you have more information on how to do this easier by entering a special key, and not by way of bitwise rewriting of eeprom using a separate programmer?

author: yuebhugo
author_rank: Contributor
timestamp: August 02, 2021, 03:57:12 pm
content: lecroy wavepro 950

author: Converter
author_rank: Regular Contributor
timestamp: August 02, 2021, 05:18:40 pm
content: Quote from: yuebhugo on August 02, 2021, 03:57:12 pmYuebhugo, could you copy the firmware from the U60 chip (EEPROM 24lc32) with any suitable programming device?I am ready to give you the firmware from DDA-260 and WP940, or express my gratitude in any other way.I highlighted this U60 chip in red in the circuit.To get a copy of the firmware, there is no need to dismantle this chip, I have successfully overwritten it using an 8-pin clothespin and an RT809F programmer.

author: shakalnokturn
author_rank: Super Contributor
timestamp: August 03, 2021, 09:06:59 am
content: Quote from: Converter on January 31, 2021, 09:48:42 amWouldn't it all be on the MUX board, the 940 would be filtered low enough for manufacturing tolerances to not be a problem at the wanted high frequency limit, on the 950, 960 the manufacturing tolerances may be more of a problem and the LTC660/TLE2024 and varactor diodes are added so the step responses can be software trimmed for minimum differences between channels at the HF limit.

author: Converter
author_rank: Regular Contributor
timestamp: August 03, 2021, 01:39:43 pm
content: I tried changing the correction capacitance in this place over a wide range, but this does not solve the problem.Most likely, the model difference lies in the settings of the "TCOIL" correction unit.

author: yuebhugo
author_rank: Contributor
timestamp: August 04, 2021, 03:38:42 am
content: let me find the programming device to try to copy the U60 microchip 24LC32 firmwire.

author: yuebhugo
author_rank: Contributor
timestamp: August 10, 2021, 04:20:20 am
content: Hi, wavepro 950 FW. change the .txt to .hex

author: Converter
author_rank: Regular Contributor
timestamp: August 10, 2021, 04:57:46 am
content: Quote from: yuebhugo on August 10, 2021, 04:20:20 amyuebhugo,How did you get this file? The fact is that both of my 24LC32A images are 4,096 bytes in size with the extension .bin.Look, below I am attaching my images from DDA-260 and WP940 (change the extension to .bin).

author: Converter
author_rank: Regular Contributor
timestamp: August 10, 2021, 05:13:22 am
content: I converted your hexadecimal (HEX) to binary .bin format. I haven't tested it yet, but it looks like it looks like my images now and should work. Thank you for your work.

author: yuebhugo
author_rank: Contributor
timestamp: August 10, 2021, 05:55:16 am
content: read the FW again, and save to the BIN formate, the size is 4k. pls refer the attachment