EEVblog

Dave hardware hacks the bandwidth and sample rate on the new Keysight 1000X Oscilloscope, turning his 100Mhz model into 200MHz in this Part 2 video.
And a look at some weird unintended modes along the way.
Will it work across all models?
Part 1: • EEVblog #977 - Keysigh...
Forum: www.eevblog.com...
EEVblog Main Web Site: www.eevblog.com
The 2nd EEVblog Channel: / eevblog2
Support the EEVblog through Patreon!
/ eevblog
EEVblog Amazon Store (Dave gets a cut):
astore.amazon.c...
T-Shirts: teespring.com/s...
💗 Likecoin - Coins for Likes: likecoin.pro/@...

[@ElectroBOOM]

You're good Dave!

[@BiecherBender]

oh hello there

[@dragonengineering6444]

FULL BRIDGE RECTIFIER NOT A PUNY SINGLE DIODE RECTIFIER

[@boriskotov717]

Dave n' Good :)

This is kind of like buying a house with an extra room that is locked by the company that built the house. They will give you the key after you've purchased the house but only for extra cost. Or you could just pick the lock.

[@nrdesign1991]

Perfect analogy. It's just cheaper to build a fully populated board with software unlockable features rather than building all the variants physically. Pretty much every manufacturer will end up doing that to avoid confusion and to save cost in administration and in the warehouse.

[@thomasbland6428]

Toni Lähdekorpi I stayed at a resort where the cabins were designed and operated almost exactly like that. There were 4 bedroom & bathroom suites around a common living area. They only unlocked the number of suites you requested and you paid accordingly.

To be fair; that is actually extra cost for them because of cleaning etc.

[@Astaldoath]

personally i think if you are smart enough to hack it, make it faster and still work you deserve the extra speed

[@yoramstein]

kzbin.info/www/bejne/raCxZKZtpsp4etE

[@ilanmower]

Keysight engineer #1: make sure Dave gets the hackable version with a AC power switch. Keysight engineer #2: Yeah, and don't forget that it can not have ANY standby power usage. Keysight engineer #1: Oh and lets add holes in the casing for a fourth channel and Ethernet. That will throw him off.

[@tubical71]

hmm...why i do think the same....about that "dumpster find".....;)

[@eddiespencer1]

I like how Keysight is being a good sport about this. They had to expect people would try this stuff.

[@tubical71]

they built it in just .....because.....!

[@lmiddleman]

Curious... does Keysight provide the source code to the GPL-licensed uboot? If not, they are in violation of the license.

[@mikeselectricstuff]

In some countries, consumer regs are such that warranty service can only be refused if they can show that the fault was caused by modification. Interestingly Keysight don't tend to use warranty stickers.

[@tubical71]

did you ever needed a waranty...? here in germany our "waranty" covers only the first 6 month...after that you have another 6 month, but wherever you purchase the thing from, will sent it to the manufacturer for further whatever (repair, or x-change) after that you´re pretty much laeft on your own, when the thing dies after just one year. So i give a damn faq about waranty at all....i open my stuff....:)

[@fbnx4219]

The way you described warranty in Germany is incorrect. You have two years of warranty on all your purchases. After six months have passed, the seller can ask for proof that you did not destroy the item ("Beweislastumkehr"). Also the common practice of sending your stuff to the manufacturer for inspection is illegal. The seller has to replace your broken item and is not allowed to redirect you to the manufacturer.

[@tubical71]

thanx for clarification, appreciated :)...still i don´t give a faq about waranty, my parents bought a new flatscreen TV, i already went into and looked at those caps...they´re crap..i bet they wont last for even these two years....

[@ElmerFuddGun]

And that is the way it should be. Just because I open something (electronic or not) to look around doesn't mean I broke it. If the warranty department can show that I modded something that caused damage or removed a heat sink which later caused the part to over heat and die that's fair but not just for taking a stupid warranty sticker off!

[@God-CDXX]

I would re cap that tv before it dies so save stress on the other parts

[@guillep2k]

OK, imagine you work at Keysight and you are one of the engineers that designed this oscilloscope. You see this video: how would you feel? Sad? Excited? Proud? Angry? I myself would seat and watch it like if it were the world cup finals between Australia and Brazil, and cheer Dave for every new finding like if it was a goal from midfield!

[@brad8122]

They must have the face of: "What an asshole I've been this time "

[@caveman123ization]

Does the audio sound distorted to anyone else?

[@paulhamacher773]

yes. something's wrong there

[@stephenholland6328]

I really appreciate and enjoy the exposition of how industry operates. This sort of information is nothing you can deduce from first principles. The general availability of serial out data on the cpu and practice of using voltage dividers to determine board configuration is interesting. The offline investigation with summary display was appreciated. That took a fair amount of time!

[@sarcasm1125]

You could use two digital potentiometers and with arduino control a reset button and go through the process systematicaly checking every possible combination of voltages in small steps, there might be a special mode with just right combination of voltages.

[@Audio_Simon]

Beucan. Bloody fly on my screen, I cant read what you said...

[@nrdesign1991]

That is a great idea. Script some software to control it all, and record each output to gather the raw data of the boot dump, then move on to the service menu etc

[@Gameboygenius]

If you need instructions on how to script some software to control it all, check out the enclosed instruction book.

[@nrdesign1991]

I can't believe YTP's high time was almost ten years ago.

[@Whatsthegeek]

I think you commented on the wrong YT video m8 xD

[@JackZimmermann]

More suspense than a thriller! Great stuff!

[@chingizavishov6838]

So far Rigol 1052 and Rigol 1054 models were most popular in market (at least for non-professionals), but looks like after this video they gonna loose first places to Keysight models. Thanks a lot Dave!

[@Bushougoma]

What I'm getting from this is the 2 voltage dividers enable the features of whatever model you purchased when the scope left the factory. These features are determined by two voltage levels. The software "upgrades" you purchase to enable additional features at a later date (for example a bandwidth upgrade) store some data in the on board NAND Flash to override the configuration set by the hardware (the 2 voltage dividers). Sounds way too complex this had to be intentional they could have simply stored this data in the on board flash and kept the configuration completely in software.

[@SK-dv6yc]

Bushougoma this is what puzzles me too

[@regmigrant]

This way they have only one version of the processor board to manufacture and it can identify which mainboard its been plugged into so the right bits of the firmware can be activated. In other words the mainboard's capabilities are identified in hardware and the boot sequence loads the appropriate routines without needing to check if the Waveform generator is present or if the 200mhz version of the hardware has been fitted. So for the price of a couple of resistors they can mass produce the same boards and get the economy of scale whilst only keeping track of one software version

[@NivagSwerdna]

Best EEVBLOG video for a while. You've got your mojo back. Good on you mate!

[@sebimoe]

To get around voiding warranty you could use conductive adhesive on the resistors to skew the dividers

[@Darieee]

or just do a top notch job soldering/desoldering/resoldering

[@mikeselectricstuff]

Would be interesting to look at the state of the outputs of the HC595 near the front-end

[@amciaapple1654]

Wow Dave! That video is so much more exciting than the recent ones. You've got your Mojo back !

[@Liam-bs7cu]

it's begging for you to put digital pots controlled by a micro on it... sweep through the ranges firing the reset pin and capture the serial data :)

[@userPrehistoricman]

Yeah the Sega Saturn vids were great! I'd love to see updates on that since it's been a while

[@brainndamage]

or just use a DAC

[@MitroBurner]

or just set the voltage from a current source/sink....one wire, no parts removed.

[@Liam-bs7cu]

..a digital pot replicates what Dave did but with an automated control element. Yes, many ways exist to do the same thing, you could use a bank of relays with individual resistors connected to them. A digital pot is a type of DAC, or vice versa depends how you look at it.

[@brainndamage]

True. Most times your solution will vary on what you have available at the moment. Optimal precision is not needed here, since there are only 10 possible values the voltage can translate to. DACs made from PWM followed by a RC or LC filter would be the minimal parts count solution, for an arduino without built in DAC at least. You would probably need to remove the divider (especially zero ohm shunts), and you will be soldering wires to the board anyway.

[@kensmith5694]

When I buy the next Keysight scopes, I will still buy the full up ones. They are priced low enough that it isn't worth taking any risk on scopes needed for production. If I buy one to play with at home then it becomes a maybe because it is interesting to see what happens.

[@dentakuweb]

I've loved these last two videos. Showing the process of figuring it out is worth documenting because it applies to lots of different projects, not just hacking scopes. I got an email from Keysight this afternoon saying "Keysight Technologies is pleased to inform you that you have won a complimentary 1000 X-Series oscilloscope (DSOX1102G)." I'm glad it's the G model because I mostly work with synthesizer/audio circuits so function generators come in handy. This scope will certainly make tuning VCOs and VCFs easier to.

[@EEVblog]

Sweet! Yes, I could have done a 2 minute video says "change these resistors", but that's not educational.

[@Redline-99]

Nice, a *fun* video, thanks Dave :)

[@rob6676]

If doing a mod voids your warranty, but gives you something extra, i'm all for buying one of these. besides, that's what easter eggs are all about. having fun and learning. Grats Dave.

[@lhwg]

9:41 1,337 Volts ..BINGO

[@RetroCarton]

I remember a story like this with some Casio or TI calculators. Just color a pad with a pencil (creating a resistance with the carbon) enabled ALL the mathematical function available only for the +50$ model!!! Moreover it was the only permitted calculator for exams so it was possibled to cheat ;)

[@rikvdmark]

Very Nice Dave! Like how you showed / explained everything :)

[@oldornot]

Looks like Data Acquisition System is needed :D Programmable resistors + recording of the serial dump after each reboot cycle and then 'siesta' :D (GinScope for a scope would look into it asap :D)

[@phoenixcrp]

Yumm a Bacon, Lettuce and Tomato module inside a Keysight DSO. I've have to love it

[@GrayOlson]

8:01 very important technique every electrical engineer should know!!

[@muctop17]

Nice watching a wizard at work! Tnx Dave

[@bfx8185]

I think it's not only abut the hacking, it's also about the experience with Keysight scopes. Let's imagine. If you, as student/enthusiast have an experience with their scopes, their user interface, you will expect same when you will work in some company. It's great marketing tool.And I must say the user interface and response of their scopes is excellent.

[@pinfarmer]

who would down vote this? Keysight maybe?

[@CliveChamberlain946]

No way, Keysight's just taking back sales stolen away by Rigol, Owen and Sig-barf (but why did it take so long?). Wanna bet all the down-votes were from employee's of angry Asian competitors? Ha!

[@marcdavis7583]

I don't think Keysight have ever been in this sector of the scope market. It's Keysight taking away business from Rigol!

[@knorad]

Audio a bit dodgy. Thin and clipping?

[@knorad]

Oh and "BLT" made me hungry on previous video, best sandwich ever! Keep up the great work Dave. 99.9% videos are great in every aspect :)

[@EEVblog]

This video is different. The capture stuff was shot with my Samson Go mic, and the behind camera stuff was shot with a Zoom H1. Both different mics to what I normally use, so yes, it might sound different.

[@knorad]

Ah yes. Zoom and similar mics are quite sensitive. I use the Tascam products. Getting levels right needs work. But going back to my original comment. This one does seem to clip pretty heavily up until timecode 14:22

[@Petertronic]

The audio on the Tagarno footage is quite crusty, noticed it immediately. I have an H1 so know that is pretty awesome!

[@yoramstein]

@@knorad kzbin.info/www/bejne/raCxZKZtpsp4etE

[@md.mostafakhan4529]

They trusted you, Dave! And you have not disappointed. 🙃🙃

[@thomasbland6428]

I thought the resistors looked like EIA96 coded SMDs so I wrote a little spreadsheet do compute the voltage from the divider circuit. When I used an input voltage of 2.5 V and the 09C (12.1k Ω) & 65B (4.64k Ω) resistors, it computed the output voltage as 0.6930 V. Since his results just listed output voltage, we'd just need to solve the equation the other direction to find appropriate resistor values to provide that voltage at a similar current draw.

[@manusoftar]

it shouldn't require more than a keygen like the one someone made for the Signet scope... I wish someone would came up with a keygen for these scopes.

[@AnujArya_Curious]

May be the analog frontend would have some differences in the lower end oscilloscope . Since we see most of the time bandwidth is 200 MHz

[@mikeselectricstuff]

I've run through all the permutations of those two links an unfortunately none of them give a useable improvement on a 100Mhz DSOX1102G. Option 03 looks like it gives 200MHz , and works in some circumstances but there are both time and voltage offset problems.

[@hannonm]

Waits for you to use the i2c line... Use SDL and SDA

[@tra757200]

I got the Rigol for xmas and was sad when this one came out but after seeing this, I am feeling pretty good about the Rigol now. It'll do until the 3000x comes my way.

[@CliveChamberlain946]

Sounds like they took a page right out of the Asian playbook, but upped the anti on the front-end. Now I can't wait to see possible configs and compare with hacked Rigol offerings. The companies must be having a laugh! (probably saying, "ha ha, now 50 percent of what we sell we'll never have to service.. just what we wanted to stomp the competition"). Go go gadget MegaZoom!

[@todkapuz]

Starting to look like this might actually be a decent alternative to the rigol.... just so hard to beat the value for dollars of the rigol at present. Extra hundred for the wave-gen ... really starting to tempt me... provided this works on the 50.

[@electronicsNmore]

Great work!

[@Seegalgalguntijak]

Wow, it must be fun to be able to tinker around with stuff like this (and have the confidence of not breaking it while doing so). Just because you can....

[@qzorn4440]

this is a very nice video... compared to some people trying to state that it is the electron that moves in the circuit.. Mmmm, weird... thanks a lot...:)

[@SamZeloof]

Got pretty lucky with these resistors

[@HerczegZsolt]

I think you your shots are in the wrong order near 7:04 - 7:40. Didn't you check the voltage (7:40) before you change the resistors to potmeters (7:04)?

[@ElmerFuddGun]

Ya, it seemed weird at the time as he was checking the actual voltages before taking out the resistors but 30 seconds earlier in the video they were already gone! LOL. Good catch.

[@over2there]

keep on the work on this, that is really helpful!

[@metalpachuramon]

this would be very cool for school oscilloscopes that doesn't have the digital mode , I mean sometimes you already have the pin header and simply just don't want to use a ADS connected to a computer

[@crimsun7186]

Would be interesting to get some company representative's stance on those kinds of videos.

[@EEVblog]

All publicity is good publicity.

[@ThaVoodoo1]

Unless you own a VW diesel involved in dieselgate.

[@glenwoofit]

keysight will love you.

[@nomadic_rider42]

I'm assuming they kinda put those CONFIG resistors very apparently there to make it bit more hackable, so that it would be a really popular hacker scope.

[@manne3d]

Cool hack! Who is the winner winner chicken dinner of this scope? Will you do a separate video of the winner?

[@tpcdude]

I would not load any software updates from keysight with a hacked scope, they might just look at the S/N and from that know how it was configured when it was shipped and load software that turns it into a paperweight.

[@IvoTrausch]

Dave's got ALL THE GAIN going on this one

[@gordonwedman3179]

Well I hacked my 50MHz Rigol to 100 but that was a pretty cheap scope to experiment on. Don't think I would mess with this one. Nice detective work and interesting in any case

[@Tjita1]

Won't keysight get kinda annoyed at you for doing this?

[@martinsmith3847]

No because they are going to sell more now

[@ethanmye-rs]

Tjita1 not try for a conspiracy, but this is great for Keysight; what's a better way to het people talking about your product than modifications?

[@JohnKha]

Not only that, but I am sure that this voids your warranty and calibration certificate, and probably getting it officially recalibrated would be... interesting.

[@gunnish1337]

Probably. But Dave didn't really say he wouldn't. They know he might try to.

[@randomlambda]

Rigol has known that the DS1054z is hackable for a long time and didn't do anything about it, because they sell a lot of these things. I still think it's not too far to think that Keysight has done this on purpose.

[@hayatepilot]

Great Video, Dave! But what was up with the audio up until 14:20min??? It sounds horribly compressed. Afterwards it's fine...

[@maxusboostus]

I thought you were supposed to be hacking it for more features, not wrecking it for less features! Ha ha nice one Dave excellent!

[@SaNjA2659]

Now we just need someone to try Dave scope's default configs on their lower end model scopes.

[@tubical71]

he already said, he will try this with a lower end model...

[@timlipinski2571]

So do I get a 100 MHz Rigol or this Keysight ? Rigol was $200.00 USD... tjl

[@BlankBrain]

Would it be worthwhile to develop a hacking assistant tool to change the resistor values digitally rather than using a pot? It seem that with this many combinations, some automation could make the search easier. The data is already captured for each attempt, so it can be logged along with the generated resistor values for analysis. Once prospects are in a spreadsheet or database, they can be tested and verified.

[@JonTheBrush]

Cripes Dave, can't you find a bigger soldering iron tip!

[@EEVblog]

Yes, I can.

[@3Dcorps]

I'm going to have to make myself a BLT module after this video

[@AmirHakimiRezaei]

"Keysight 1000X Oscilloscope Hacked!?" -eevblog, the new Ben HecK Show

[@DouglasKryder]

great video, Dave. good methodology on the hunt for a hack point. keysight probably figured you would look into this stuff. you wouldn't falsely make us think better features are not able to be gained, would you? i'd like to see you continue your search, if that is a possibility. somebody had to do stuff like this to those rigols

[@iamjimgroth]

This is some excellent detective work! :)

[@e5frog]

Maybe rate was limited because it's not stable or have other problems so it wasn't running OK at the highest speed? Perhaps the lower quality ones uses components with lower accuracy so ramping settings up to a higher setting will cause crap results... What if it pops up "configuration changed too many times, oscilloscope locked, contact your reseller for unlock code". ;-)

[@lmiddleman]

Instead of fine soldering potentiometers, why not leave the resistors in place, and just hook up a variable DC power supply to the junction point of the dividers? The ADCs and the dividers are high impedance and won't be bothered.

[@CliveChamberlain946]

Too risky and it wouldn't really have made hacking any faster. I would have liked multi-turn pots though to find out just how many equidistant points exist on each ADC. Maybe a lock-out and flash warranty violation gets written to the screen after one month if too many illegal voltage code combinations are attempted. "Please return to factory for repair" Lets see if Dave gets or some other experimenter get a surprise in the next month or so...

[@JGnLAU8OAWF6]

Use power supply to inject voltage and write program for that)

[@23RaySan]

thats the same i thought with injecting voltages

[@84GKSIG]

would love one of these oscilloscopes !

[@voltlog]

Dave you do realize you have given me no choice. Now I have to replace my Rigol DS1054Z and get a new Keysight scope and hack it, maybe even do a video on the process.

[@A13tech]

i would use some DAC and some small MCU eval board (mbed family for example) and do some automatization. Generate voltage, measure voltage, store to table, wait for reboot and confirm a mode. Or advanced - debug uart connect to eval board and trigger it to data, so it find all modes and you can manualy try it.

[@buffler1]

LP1 and LP2 smell like low pass filters in the front end. near the inputs?

[@daveblane6442]

Incredible! Dave! you are amazing!

[@yoramstein]

kzbin.info/www/bejne/raCxZKZtpsp4etE

[@zaphodelektra960]

Dave, what does Keysight think of these hacking? Thumbs up for these BTW. Really good work!

[@panbekon1470]

Time for 3000 and 4000 series !

[@tpcdude]

Next, extract the code, disasemble it, that should take enough time to pay full price for the top end version.

[@valerephotos]

Dave what about hacking your MSO-X 3054T ;-) , maybe it's already full options, but at least it would be nice to see if there is the same resistors even without modifying those.

[@cmssniper]

More of those videos please! :-)

[@pvc988]

At 6:07 there are these 3 resistors at the bottom of the screen which look like some kind of config resistors for something.

[@mahmoudgaber5347]

Just awesome, I hope win one of the scopes at the scopemonth giveaway,

[@miawgogo]

The audio is a bit tinny for me at the beginning

[@yoramstein]

kzbin.info/www/bejne/raCxZKZtpsp4etE

[@irgski]

You’re going to void the warranty!!!

[@bbreeuwer4577]

Jeez, what happened with the audio? The quality is so poor, Problems with sample-rate conversion (typical type of distortion)

[@JohnFT3414]

I hope that modification isn't permanent?

[@KanalFrump]

Dave what did you do to your audio. You sound like you're coming through a 12 bit sampler from the late 1980s.

[@raymundhofmann7661]

I hope in the future it is still ok to buy a scope and just use it.

[@Mr.Laidukas]

Even if I don't believe it could be true still it comes to my mind is this a deliberate action from Keysight and EEVblog to boost this low end scope to hacker/maker market and compete against Rigol and Siglent? EEVblog has good relations with Keysight for meany years. Just please don't get offended, I don't want to accuse Dave, it's just my human nature to be curious. I enjoyed video to every bit!

[@EEVblog]

I've said it several time before, Keysight in no way suggested nor helped with this hacking effort.

[@OlafurArons]

Hey Dave. Something happen to the audio? it sounds like a whiny audioscaling from 24khz to 48khz. Watching the video though cause really curious.

[@rondlh20]

Great job!

[@LilleJohnCom]

Exciting Stuff!!

[@yoramstein]

more exiting stuf ------ kzbin.info/www/bejne/raCxZKZtpsp4etE

[@bulkbogan4320]

Got same one at the shoppe!

[@MatthewSuffidy]

I had this samsung laser printer in my closet. When I went to use it I had this line recurring on the page. It was the spacing of the drum, so I got another cartridge, but before I hacked the printer. Some Russian dudes made some sort of eeprom hack that would make it think it had unlimited pages if you put some electrical tape over the comm pins on the cartridge. So later I have to figure out how to get the toner out of the old one and into the new one and I can use the toner out of the 1st cartridge later. Not to mention it runs out later this way.

[@StingrayOfficial]

I can comment and see this video as well. Not sure if that twas click bait or what dude.

[@tubical71]

This is great stuff....thanx so much, Dave.... Who cares about waranty..?

[@jordanjohnson714]

Was this intended to be that way by Keysight?

[@matooo95]

What's up with the audio? It was peaking ...

[@herauthon]

your smartlevel has burned by last three inner-diodes... please send replacement..

[@hydro16metal]

im waiting for the dso1072b hack ;-)

[@MD0MDI]

Wish someone would have another look at the Rigol dsa-815 with never firmware...