Hi. In a previous video, we took a look at our first steps at trying to hack of the keysight 1,000 X-series oscilloscope and figure out how it did its product configurations and stuff like that. and I'll link that in down below if you haven't seen it. and we got into adding a modification here so that we found some product selection well not products and we found some module selection resistors on the bottom here and we removed those, replace them with a pot as so that we could play around with the different modes on that.

We also added a UART interface which connects into the Windows CE you boot system which is how we were able to find the information. So we got as far as finding the configuration resistors and the to ADC pins on the Spear 600 processor that were actually measuring the module. the Blt module Configuration: The Blt module is this one, you can see it there. This is the processor module at the Mega Zoom for ASIC, the ADC, the FPGA and the Spear 600 processor which is running the Windows CA operating system for the thing.

We found them and we tweaked the pots and everything and we found that we could actually you know modify these ID codes ID 2 ID 0 here and change the BLT module configuration which is this one here which sets the sample rate but not the sample rate of the scope. It in one point showed zero gig samples per second, but it was still sampling and so that was interesting and it may become important in the future. But what we need to do is find this Blt product configuration here, which sets more important stuff like the bandwidth and also that would actually set the sample rate because the low-end Edu oscilloscopes are only one gig samples per second as opposed to 2 gig samples per second. So the $450 scope they've artificially limited the sample rate in there as well as the bandwidth is set to 50 megabits.

We still don't know why it's set to 200 megahertz. We measured the performance in the previous video. it's about 131 mega hertz my 3db point for the front end. anyway.

so I changed these resistors on here and and I changed a couple of the other resistors on here and I could not find that. VLT product configuration Now it makes sense that it actually could be somewhere else. so let's take a look at Tada. If it's not on that board, the processor board and there's no reason to think that it necessarily is, then it could be on the main board here.

So this is our main boy. This is where the module are plugs into here, the main board on the scope. Thankfully, it's accessible, so what we're looking for is another voltage divider resistor that would go through the connector. Now if we actually have a look on here because the other selection resistors are here, it it makes sense for it to be on this header connector.

perhaps because that's closer so that one actually matches up with this one down here. but this is all the function generator stuff around here and the demo signal and everything else. So I Don't think it's that so this one at the top here. Which means that the signals well I don't know which ADC pins they're using I Don't know if they're all up in this one quadrant I Haven't checked the datasheet, but those signals that have to get from here over to here which is no problem.

You know it's just it's just a voltage divider, so it's just a routing problem. But anyway, so what we're looking for around here is that same voltage divider Ie2 and we need two. two resistors are from ground to power tapping off. Plus we need two of them because we've got the two extra signals on the bill.

T If you remember that, there we go. Blt product configuration. So we've got two different ADC pins with two different voltages 1.25 volts and not 0.7 volts or thereabout. so we need to measure those and it would make sense to put them on this main board anyway.

I Guess we know that the low-end non-functioning module does not include the B and C on the front panel for the function generator parts, and most likely they don't populate any of this stuff as well to save cost on the non function generator model. So that makes sense that they would spin different versions of this board. Okay, they've assembled different versions. is board based on what model they're actually selling the generator or the non generator version.

They have four different models, but I don't think there's any difference apart from license keys from the other ones and these products will actually resistance anyway. So it makes sense that they're redoing this board anyway so they can change the resistance. Can you see any suitable resistors around there? You betcha. We can look at these puppies Hi! Just the right number of resistors we need.

four of them going directly into pins of this module which should go into the ADCs so you can see the traces there. They're not going anywhere else. There's one going here and there's one going under there which goes to there and these it looks like these are joined together. go into a via there which is most likely power and these two are going down to most likely ground.

So they are two voltage dividers. You've got to put money on that. Unfortunately, they're underneath the module. What a pain in the butt.

So we're going to have to put some wires on there, get them out, and then we'll be able to measure those pins. And what we're looking for. of course, is there those voltages we've got there? 1.25 volts. Because this is measured from the ADC, we've confirmed that, not 0.7 volts.

There's nothing else connected to it, directly to the pins, which is exactly what you want in there is that configuration we want. It's got to be it. It's got to be feeling lucky and it's probably no coincidence that we're looking for 1.25 volts here. and what do we see on these resistors? Look, these two here are identical value and these two are different.

Okay, so these two with identical values. That means we're going to get a half rail point there with so in the previous video that the rail was 2.5 volts I believe it was. So Bingo! We're going to measure 1 point 2 5 volts on there and not point 6 9 volts give or take on there. Let's go and just add some fresh solder on to these pads so that we can get the mud wires on.

And just like last time, it's worth going to an extra little bit of effort just to secure the pots elsewhere. I've glued the two pots together with super glue and then cific little down to the board's. just a tiny little dab to keep it in place so that you take any stress off the wires. and I've just got those going over to Easy And a pro tip: make sure you have screwdriver access through so I actually angled it so that I could actually get those a screwdriver through like that once it's open.

All right, let's pair it up and 1.2 0 volts in here enough and not point seven. Come on. point seven point Six seven, we got them. and now it's all about finding out which way around.

I've got the pots, which one applies to which configuration bit and which direction turns them in what voltage? So you're going to come up with a little cheat sheet like this and get your tongue at the right angle and get in there and tweak them. So once you've got that information which pots do what then I can adjust them and find the window that the product IDs come up at. That's quite a laborious trial and error type thing because you've got to reboot the thing every time because it's not going to live. update those values so you're going to tweak it once.

reboot and all that sort of jazz, but cycle each of the four configuration things through all of their I Believe there's four configuration options for each one. So yeah, at least I have the pots now to do it. It it beauty. Alright, here we go I've got hooked up to the terminal program here and we're going to boot up the pot sir at mid-level So whenever like both at one point to five volts or near enough to pinch out come set from the factory, power it up on one way one will be gonna put in.

Tada, we're in like Flynn let me change the horizontal. There we gone up to two gig. Whoa. Time out we're trying to stop tellin clocks, hardware error, hardware error.

Oh no, it doesn't like that at all. So what do we got? Product configuration: 200 megahertz for example a second I Know one can seek 43-year We have to change that back. Id3 and idea. There we go.

One volt and one point three seven volts Id3 Id4 So it really is not a happy camper. But that's good. We're on our way. Alright, so figured out what all my pots do and I have changed the BLT module back to its original factory configuration that we had and I have modified the product configuration just randomly I put one down to zero volts.

so it's now ID 0 and it's ID - it was showing BLT product config 24 before now it's showing product config Oh - But nothing here seems to change. the bandwidth still the same. The board revision FPR yes it was FPR before and now it's saying LP one. So whatever that means our bolduan still the same for gig samples, a second is still the same, the land fires still the same, and if we go into the service menu here, we can still see that it's a DSO x11 o to G I'm the same hundred megahertz bandwidth.

Nothing looks to be different. So oh, we've got one winner chicken dinner. Look at this product config 0-0 I Set both of the pots on the product concede to zero and and width has changed. 70 megahertz.

Bandwidth and keysight sell the 70 megahertz bandwidth model, so I've got to do the measurement to actually are confirm to find the minus 3db. I point on that, but hey, hey, notice the screen as well. One geek sample per second. Let me change their time base.

Yeah, there you go, we've got it. I've changed the time base there and that limits the sample rate as well. So bingo, we've got it. It looks like you can change the bandwidth and the sample rate at least with just the configuration resistance.

I Hope that's the case now. This is interesting. The data on the oscilloscope it still says it's in 1102 G but the bandwidth has changed to 50 megahertz. so that's different to what we've got over here.

which is the bandwidth 70 megahertz. So what's going on? I'm going to feed in a signal and find out what the actual analog bandwidth of this thing is, see if it's changed. Well, this is strange. I'm feeding in a 50 megahertz signal here and I've confirmed that's one volt peak-to-peak on my 500 Mcbomb website scope and it's one volt peak-to-peak here.

So so much for the 70 megahertz bandwidth here and so much for the 50 megahertz bandwidth. This as it is in the configuration service menu on the scope. What? I Kid you not, this is a 200 megahertz signal on the input confirmed as one volt peak-to-peak on my 500 Mexico and 50 Ohm are terminated and it's still not 3 DB down. It's point Eight.

Six volts at that point 707. What? This thing has greater than 200 megahertz bandwidth on the analog front end. That explains why it's 200, why it was showing 200 megahertz before if you remember that in our original configuration, and maybe why they're supplying 200 Meg probes with it so that later they can upgrade the bandwidth or provide a 200 models. Wow In fact, I confirm that the minus 3db band went to this front end is 224 megahertz in this mode.

Well now, unfortunately, when I try to combine different modes like for example, going ID 1 and ID 2 here or 82 an ID 1 to give us a BLT product config of 12, then I Yeah, we get all these stop talent clock error messages and we get basically no waveform. You can see that the channel is on there, but yeah, nobody's home. so there are various modes like that. so it's just a matter of finding a product configuration that actually actually gives you the results that you know the combination of bandwidth and sample rate that you actually want.

I Think we have a problem here. I've set the product configuration to 10 and that gives us the 2.5 gig sample per second which is fantastic. That gives us a full 5 gig sample rate, but there. What? what? What's going on here? Something is seriously wrong at very slow time basis, so it's obviously not are designed to do that so you're a 2.5 gig.

Samples comes at a price there. What's this, You know? Yeah, Ok, let's not use that one now. I've actually done a table here of the various configuration options with config 1 all at 0 first both 0 volts and the and 0 ID the volt. The ID corresponds to the vault and then I increment it the ID of the product config 0 bit there and these are the voltages I just happen to turn the pot - I wasn't determining the window values or anything like that I haven't determined those I'm busy.

You know they're going to be like an equal equidistant kind of thing between there for the 8, well, for the year for the 9, our configurations possible there, and that directly corresponds to the code over here. and I've determined that when you put this on, it goes up in increments of 10. So if you combine this bit of 1 and this bit of 1 here, your code, your product can fit code according to that. boot up will be 1 1.

So like that, config 1 is first and then the config 0 is the second digit there. and then this is the bandwidth from the dump that was that the boot dot says that it's set to this is the revision whatever that means I Don't know, but it seems to be separated once you go up to 5, but that seems to be our 5 to 8. there is LP - and this is LP 1 and you'll notice anything with no wave here means you get no waveform on screen. You get all those boot clock errors and things like that.

But all of the ones in LP mode LP 1 with 220 me and the ones here in LP 2 were a combination of the 50 mega bandwidth which they sell and 140 and 140 odd Meg bandwidth which is 100 mega Hertz limiter. So that seems to be a combination of an actual 50 megahertz front end limited bandwidth and the hundred mega bandwidth is world, not the full 20. So it seemed to have three different modes there I don't know where the 70 mid one are comes in with. we have not seen them and we've seen it up here in the dump mode, but it doesn't correspond to an actual measured bandwidth yet that I've found anyway.

And of course the sample rate does change on this. lower on is the 50 mega bandwidth limit modes. It changes to one gig samples per second exactly as the product datasheet tells you. it does.

So obviously Jana Hackett you only want the 204 220 mega analog bandwidth with the two gig sample right there. and as I mentioned, don't touch the 2.5 the example rate because that seems to have some sort of memory sample issue. Don't recommend that at all. So I'm going to call it quits for this video now, but there you have it.

Absolutely fascinating I Didn't think we'd be able to hack the bandwidth of this thing just by setting those product code resistors on there that is absolutely amazing the analog bandwidth of this 220 Meg's front end. Obviously as they you know there's a reason that they built that ever they had the existing design these winner why not all they about these software options in their to do that or any way they plan to have like a more models in the future that have 200 megahertz bandwidth. It might be why their supply and are 200 megahertz bandwidth Pros as standard with this thing even with the 50 megahertz model I believe But yeah I'm not going to say like it's totally hack now but it shows that you can actually do this because one of the problems is is I've got the 1102 G I've already got the fully populated model here so you know really I need to try this hack on the base model 50 megahertz unit with the function gen. If you're going to buy one of these, make sure it has the function gen so that you can get that possibility in the future.

And I did note that on some of the modes that I was using it would actually the bandwidth 100 megahertz bandwidth software option and also the wave gen would actually vanish. In fact, where is the way Gen Wave Gen doesn't seem to be there. whoops, The way Gen Generation insurers not been enabled. There you go.

so I could do so. The current mode I've got this set to has disabled the wave Gen so like there are so many options on this thing. but I've seen that it does actually vanish a few times. So it is absolutely fascinating.

and I haven't even gotten through all the possible modes. There are just so many configurations and not only just the product config, but I haven't even changed the module config. so maybe thats are the error we saw in the 2.5 gig sample rate. With the memory problem and all that, that might be a that might be fixable by changing the other the other resistors in there on the processor board which is the module configure.

this product can see there's like so many combinations of code things you miss it. You know it doesn't take you forever to go through and systematically check them all. but in theory I can do that now. I've got the pops in there I can tweak the the product configure pots from the top here and I can configure the set the change the module config once from the pots on the side so we're on our way.

but this is absolutely fascinating to be able to get that extra bandwidth. Terrific. Umm like I haven't done any measurements on this yet with the I You know, pulse response and all that sort of stuff. But yeah, the analog bandwidth is there.

It's probably there for a reason. I You know, say it's good. So if you can actually buy the Edu function Gen version and then increase the bandwidth to 200 Meg arm and the sample rate to 2 gig, then this thing I think is going to be really, really popular. Why wouldn't it be? Um, even without, like the serial decode and stuff like that you can do that to the 50 Megan then that's going to be terrific.

But yeah, that remains to be seen but looking promising. But of course it must be said. Downsides of hacking your scope hardware wise like this is that you instantly you lose your 3-year warranty because this puppy has a decent warranty on it. If you start going and modifying the resistors in there, they're going to know and your warranties void.

So yeah, that's a risk you take. So ultimately you can actually get useful bandwidth. Increasing this by the looks of it, hopefully it works. Work on the 50 megahertz model as well.

I Couldn't get the bottle number there to change, but you know who cares, right? As long as the thing actually works then you know who cares would actually shows up. But yes, it's to be repeated on the 50 Megahertz model. but it's looking very, very promising that all that stuff is in the configuration. resistors good on your keysight.

They were just asking for people to up modify and have a play around with this thing, and that's certainly what we did. so that is some progress anyway. All sorts of things yet to be confirmed, and then there's probably people working on like the keygen hacks and things like that. I'm no good at that sort of thing, so I won't be doing that sort of stuff.

But the hardware hacks work. and if you liked this video, please give it a big thumbs up because that always helps a lot. And I'll link to the hacking thread on the Eevblog forum down below and that's where everyone should consolidate their information for this thing as it comes to hand. Hope you liked it.

Catch you next time.