地角天邊
江郎才盡,不足為訓
https://www.bidspotter.com/en-us/search-results?searchTerm=oscilloscope
1. Keysight Smart Bench Essentials
目前有四件，外觀類似，電源較深因後部是環形變壓器。顯示均為7"LCD。
EDUX1052A: 50MHz 1G/s Scope示波器,$496
EDU34450A: 5-1/2 DMM萬用表,$696?
EDU36311A: ５V６A/2x30V1A 90W三路模擬電源,$840。這個電源不如Lecroy T3PS33203P/T3PS43203P，後者是2x30V3A+5V6A或15VA+5V1A。
EDU33212A: 20M DSS信號源，內有雙MPU及FPGA，$915。類似國產UTG962。
總之Keysight這套組合性能偏低。
2. Scope+Gen
示波器：國產50M 4CH的Instek GDS-1054B可破解到100M $310,100M 1G/s的國產有Hantek DSO5102b衰減-1dB故實際帶寬超過100M,可破解到200M，Siglent SDX1104X-E可破解到200M $499；SDS2104X Plus可破解到500M。其餘破解：https://blog.wenxuecity.com/myblog/36867/201610/1401114.html offer：https://int.siglent.com/info/detail-49.html
SDS2104X Plus比Rigol MSO5074的噪音小很多，2x2G ADC；後者4x2G ADC最高8GSa。https://www.eevblog.com/forum/testgear/siglent-sds2000x-plus-threadlist/msg3041456/#msg3041456
https://saving.em.keysight.com/en/used/oscilloscopes/msox2002a-e184825189432 70M2CH+8CH digital+DMM/CT+20M Syn
2.1 普源Rigol Mso5000是示波器(2-4CH 70-350M均配350M探頭)、邏輯分析儀LGA(16CH需PLA2216探頭,1G/s帶寬200M)、頻譜分析儀(FFT)、任意波形發生器AWG(2CH25M需購AWG軟件)、數字電壓表(3-digit看來是8bit平均而來)、頻率計和累加器(6-digit)、協議分析儀(RS232/UART, I2C, SPI, CAN, LIN, I2S, FlexRay, and MIL-STD-1553)的組合。破解後全功能開放隻需加LGA探頭。這個品牌俗稱日狗，bug多，號稱8G/s是4x2G岔開的，數據要直接由RAM導出才有，編程手段多是優點，缺點是Vrms時有效僅3.65bit，SDS04X+是3.92，Keysight 3104T是5.61。Mso5074可破解到350M：https://blog.csdn.net/qq_15242011/article/details/109093569 手冊 https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes
MSO5074探頭：PLA2216 $399，2.54間距2x25腳插座，用LMH7332x8加保護電阻及頻率補償，輸入範圍+-15V。VCCI為4V，VCCO 2.5V，VEE -2.5V，有載時各降0.1V，機內Vref為+-1.5V，輸入有CMOS 5/3.3/2.5/1.8/LVDS(1.2V)/ECL(-1.3)/PECL(3.7)及可調閥值，輸出與LVDS兼容。DIY可用LMH7334x4或TLV3604完全兼容。簡化方案用pot調0.65~3.6V閥值直入TTL。我意74LVC8T245PWx2+DSLVDS1047PWTx2(布線見LVDS387手冊)，Vccb=4V，Vcca=Vrefx4.9，可用於除ECL/PECL外的原有電平及100MHz。比eBay用SNLVDS1DB約70刀的好：https://www.ebay.com/itm/224648789536?。換74AUC245可工作到200M但輸入最高為3V3。穩壓片AP7311-WG-7，OP為MCP6006有SOT23或SC70封裝。輸入為330歐//1n，對地47K，最大輸入+10/-5V。https://www.keysight.com/us/en/assets/7018-06707/data-sheets/5968-4632.pdf
需要指出，示波器內置邏輯分析儀隻是異步方式，不能用DUT時鍾或狀態分析，估計觸發方式有限不能用指令級比較觸發，性能比不上幾十年前的舊貨，後者很便宜唯體積大。
2.2 Keysight DSO/MSO X2000/X3000
2000係列1GSa A/D，可交錯為2G，邏輯僅8CH toggle rate 50M(Max9201x2 7ns)，WaveGen沒AWG功能。拆卸：2K https://www.youtube.com/watch?v=fGxusFBMDR0 3K https://www.youtube.com/watch?v=os1agF35jxU 維修手冊：https://xdevs.com/doc/HP_Agilent_Keysight/Service%20Guide%20for%202000%203000%20X-Series%20Oscilloscopes%2075019-97084%20c20141015%20%5B150%5D.pdf
由USB啟動或修複NVM：https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181
InfiniiVision 3000 X 係列以及2000 X係列 DSO/MSO 示波器USB啟動：
1. Unpack the firmware *.cab by 7zip (1st pkg)
2. Unpack infiniiVisionSetup.cab (2nd pkg, e.g. with WinCE CAB Manager 3.0)
3. Copy unpacked Secure folder contents to root of USB
4. Edit Secure|infiniiVision|infiniiVisionCore.dll, change byte sequence at location 0x277e50 from 04 00 a0 e1 to 00 00 a0 e3
Edit in Startup|infiniivision.lnk to contains following sequence "62#usbinfiniiVisioninfiniivisionLauncher.exe -l All -l BW20 -l SCPIPS"
or, "62#usbinfiniiVisioninfiniivisionLauncher.exe -l MSO -l MEMUP -l MEMMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l All"
5. Create infiniivisionStartupOverride.txt file in root of USB containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red message in letf top corner "Unfinalized Software" and "System Concerns detected: OS version is not correct. Please reload system firmware", press a key to pass it, leave USB in scope, self diag shall pass.
InfiniiVision 3000 X 係列以及2000 X係列經濟型 DSO 和 MSO 示波器固件下載:
V2.35 https://mega.nz/file/rmgRWYYZ#lIcYsMwQusOA_VAWfyfLkgPDQDnKLVZr0i0C7VnP7NY
v2.65 https://www.keysight.com/us/en/lib/software-detail/instrument-firmware-software/installing-infiniivision-2000-xseries-oscilloscope-firmware-2014479.html patch https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/2713/ 2000/3000A可以，高檔報錯需將Secureinfiniivisionrename symbols.tte.old換名再繼續。maybe need a pre-install step added to the recipe.xml to automatically do that 'rename'. I used Telnet over LAN (4000X) to do the file rename. For 200x and 300x the lnk content are:
146#infiniivisionLauncher.exe -l MSO -l WAVEGEN --perf -l D2000AUTB -l D2000GENB -l D2000BDLB -l BW10 -l BW20 -l SCPIPS -l PLUS -l VID -l CABLE -l ASV
160#SecureinfiniiVisioninfiniivisionLauncher.exe -l DIS -l MSO --perf -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l TOM -l BW35 -l ADVMATH -l EMBD -l EDK -l VID
I opened the oscilloscope and connected the UART port on the motherboard，plug the homemade LAN card (without video) into the oscilloscope.
At the moment of power on, pause the oscilloscope to continue to start through UART, get the IP address（192.168.1.109） , IP address of my computer is configured as：192.168.1.1.
and then enter u-boot mode. After the operation is completed, I try to log in through Telnet, I have downloaded the firmware from the network, start it, and then fix the .ink error.
Search this thread for "Ymodem" to learn how upload firmware via serial.There is an option to load the bin from serial or ymodem mode.But I would need the firmware file. The one can boot from USB.Your serial log says:: Address=0x80361000 Length=0x4E09D90 Name="" Target=RAM You will need to find the firmware version which bin file matches the Length.
This is the most detailed post about how to repair a NAND corrupted scope: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181
"Microsoft Windows CE Bootloader Common Library Version 1.4 Built Aug 12 2011 11:03:19
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008"
My process so far:
-Take a fresh flash drive, formatted FAT16
-Create file infiniivisionStartupOverride.txt with content "True" (excluding quotations)
-Extract contents of 2000XSeries.02.35.2013061800 to flash drive
-Plug in flash drive, power on scope
似乎更簡單的辦法，v2.41已測：以scope IP或hostname運行下列VB script，需LAN卡：
' Howardlong at #839 from https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/825/
Set x3000a = CreateObject("WScript.Shell")
x3000a.run"telnet"
WScript.Sleep 1500
x3000a.SendKeys"set escape ]"
x3000a.SendKeys("{Enter}")
WScript.Sleep 500
x3000a.SendKeys"open "+WScript.Arguments.Item(0)
x3000a.SendKeys("{Enter}")
WScript.Sleep 2000
x3000a.SendKeys"infiniivision"
x3000a.SendKeys("{Enter}")
WScript.Sleep 500
x3000a.SendKeys"skywalker1977"
x3000a.SendKeys("{Enter}")
WScript.Sleep 500
x3000a.SendKeys"cd secureinfiniivision"
x3000a.SendKeys("{Enter}")
WScript.Sleep 500
x3000a.SendKeys"processmgr kill infiniivisionlauncher.exe"
x3000a.SendKeys("{Enter}")
WScript.Sleep 2000
x3000a.SendKeys"infiniivisionlauncher -l all"
x3000a.SendKeys("{Enter}")
WScript.Sleep 3000
x3000a.SendKeys"]"
WScript.Sleep 500
x3000a.SendKeys"qui"
x3000a.SendKeys("{Enter}")
WScript.Sleep 500
DSOXLAN: 用於MSOX2000-805, DSOX3000-805，但是Eth隻是個插座可以DIY：https://www.eevblog.com/forum/projects/lan-adapter-for-the-agilent-keysight-dso-x-3000-2000/ 購買：https://www.eevblog.com/forum/testgear/point-me-to-latest-info-on-dyi-dsoxlan/msg1409765/#msg1409765 單套25刀，可選電阻焊接後啟動報錯忽略即可，否則需要知道IP以便訪問。
邏輯探頭是N2756A，常見DIP40F接示波器，普通扁平4線電纜帶阻抗小盒，不是HP傳統的編織電纜。高頻簡易探頭，可以是390+560+50歐電纜(20:1)。
==
From the Agilent 2.35 upgrade CAB I extracted the files you said:
infiniiVisionLauncher.exe
infiniiVisionCore.dll
Put them on a USB stick, booted the 2.37 scope and got telnet access (infiniivision, skywalker1977)
Killed the running version (a step you didn't mention, probably because it was obvious to you!):
processmgr kill infiniiVisionLauncher.exe
Change to application directory
cd secureinfiniivision
Copy those two old files:
copy usbinfiniiVisionLauncher.exe
copy usbinfiniiVisionCore.dll
Reboot and get firmware concerns message, scope still thinks it has 2.37, no problem.
Put Agilent 2.35 upgrade CAB onto USB stick and up(down)grade as normal. Lots of waiting, scope then reboots with 2.35 up and running.
Then reboot with USB stick with modified 2.37 files to get all options including MSO and full bandwidth.
Many, many thanks sir. I owe you something nice from under my desk!!
====Down grade from 2.39 to 2.35
1. downgrade to 2.37 (it just works)
2. unpack 2000XSeries.02.37.2014052002.cab (ex with WinRAR)
3. extract file infiniiVisionLauncher.exe from infiniiVisionSetup.cab (2.37) (ex with WinCE CAB Manager)
4. unpack 2000XSeries.02.35.2013061800.cab (ex with WinRAR)
5. open infiniiVisionSetup.cab (from 2.35) file in WinCE CAB Manager, find infiniiVisionLauncher.exe on list and delete it
6. add infiniiVisionLauncher.exe (from 2.37 cab) to file list and set all properties like in old file (flags: uncheck all; location: SecureInfiniiVision; Hard-coded path checked)
7. file->save and exit WinCE CAB Manager
8. calc MD5 of edited infiniiVisionSetup.cab and update it in recipe.xml file
9. compress all files (ex with CabPack) from 2.35 firmware with edited infiniiVisionSetup.cab
10. flash new file, now it is 2.35
One detail: In the CabPack software it's important to setting the Compression type to MSZIP
V2.35適用於200X、300X，不適用於300XT和400X。對於 400X，據我所知，V3.12 固件是最後一個接受 USB 啟動的固件
== V2.41 #1022
TTL Serial conn：https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895
NVM fail fix: https : //www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that -scope/msg2136181/?topicseen#msg2136181 我按了 r（重置）10-15 次。突然間我在串口通訊中看到示波器開始啟動。完全啟動後，我將新固件從 Keysight 下載到 USB。並升級了固件，現在一切正常。
MSO3024 full200M:https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/2800/
3000A-series 200MHz board to 500MHz board upgrade how-to.
Similar procedure can be applied to 3000T and 4000A series.
To extend 100/200MHz board to 350/500MHz you'll need to perform serious hardware modification of the main board.
Decent SMD soldering skill and soldering equipment are required to perform this modification.
Thus, it's not recommended to try this mod unless you're really desperate to get extra bandwidth.
This is a description of hardware modifications on sensitive signal paths of the scope!
Applying any of these mods will void your warranty and calibration!
Loss of factory calibration and accuracy is inevitable!
DISCLAIMER: do this at your own risk only! Irreversible damage may be caused by these modifications. You've been warned!
Required materials for 4-channel models:
1. Coilcraft 0603CS-15NXG 0603 15nH 2% inductors - 12 pcs
2. Coilcraft 0603CS-27NXG 0603 27nH 2% inductors - 4 pcs
3. 0603 2.2pF NP0 capacitors - 4 pcs
4. 0603 2.0pF NP0 capacitors - 4 pcs
5. 1206 110R 1% resistor - 4 pcs
6. 0603 162R 1% resistor - 4 pcs
7. 0603 121K 1% resistor - 1 pcs
8. 0603 46.4K 1% resistor - 1 pcs
User cal fixture is required for post-modification calibration.
BACKUP NOTE: save all removed components in separate places for each position and channel to secure way back to original values!
Modification process (see attachments for pictures):
1. For each channel replace yellow-marked parts as follows:
AFE top layer (afe_top_layer_mod.jpg):
L1: 100nH(?) -> 15nH
R1: 215R -> 110R
L2, L3: 47nH(?) -> 15nH
C1: 4.7pF -> 2.2pF
C2: 4.7pF -> 2.0pF
AFE bottom layer (afe_bot_layer_mod.jpg):
L4: 100nH(?) -> 27nH
R2: 261R -> 162R
2. Replace two board strap resistors:
Top layer near CPU (gnd_straps.jpg):
Strap resistor L1: 10K -> 46.4K
Bottom layer under CPU (2v5_straps.jpg):
Strap resistor H1: 100K -> 121K
NOTE: all capacitor values are guessed or measured and may not be 100% correct.
Run a brief per channel check of scope functionality before fully reassembling the scope. For a final assembly be sure to mount all shields and covers. Run User cal procedure with a high-quality user cal fixture to compensate replacement of AFE components.
Done, you'll get a 350MHz scope. 350MHz to 500MHz upgrade is software-only and possibly discussed elsewhere.
infiniivisionLauncher.exe -l all -l BW50 -l SCPIPS #open all options BW 500M on 3000x
MSO3024T 1G:https://www.eevblog.com/forum/testgear/keysight-3000t-scope-1-ghz-hardware-upgrade-mod/
萬用表：我有4-1/2位Fluke 87V。4-10A檔0.03歐其餘1.8歐，電容10kp-10ku，二極管3V，頻率200K。注意黃健有多功能例如交直流電流切換，電阻電容切換。在線測量電容時有兩個0u1的不對，反而HT206D測對了。HT206D由60A/600A交直流鉗表和10M頻率計數器，可加0.1歐做6A電流表，加UPB586G可測2.56但需定標。
DSS信號源：國產FY6900 60MHz內置FPGA約$100，UTG962的屏幕更大$123，DIY意思有限，否則可以找找開源的基於FPGA的設計。用AD9834板(淘寶$10+)時，可以輸出正弦、鋸齒、方波，不會有前者那麽多功能，但可增加LCQ測量和100M輸出。又HMC832可編程輸出25M~3G(3Hz分辨率)正弦波。DIY信號源的話可設置為單邊插件與電源共用LCD顯示。MSO5074為2x20M而SDS2104X Plus為50M。25M-6G $102.5：https://www.ebay.com/itm/172209934502
模擬電源：參考Teledyne T3PS43203P或Instek GPD-4303S，前者是4路可調但USB顯示是Instek，估計是後者設計的。後者A/V分別有旋轉編碼器，但不如前者好。
34刀買了HY3002-3電源：2x30V2A+5V3A，待修複用。每路加2N3055可達3A，加2個即為HY3005-3，當然要配散熱片和均流電阻。
電源DIY: 1）如果沒有矽膠開關的話，可以有一個旋轉編碼器帶確認按鍵；另一按鍵為快速數位定點(V/25mV/mV)。4通道各有一按鍵切換開/電壓設置/電流設置，輸出電流未到設定值時為CV否則為CC，另加總輸出開關，總共6個。2）LCD邊緣條觸摸菜單: 配置(版本、USB、Eth接口)、模式(電源-自動/CV/CC、負載-CC/CV、電池充放-多種類型帶放電曲線)、快速設置(常用電壓)、級聯設置。3）顯示模式參考Lecory有兩種：2x2分隔大字顯示通道及輸出電壓、功率及電流，小字顯示Vset|OVP、Iset|OCP；曲線顯示某通道的電壓電流和功率，左側由上至下為通道號、VCP及其div、虛線為OVP/OCP，也可用於電池充放曲線。4）麵板左上為LCD，LCD最下行為菜單觸摸，次下可加狀態行。麵板右上為旋轉編碼器，其下為4通道開關按鈕帶燈。麵板下由左至右為電源開關、Ch3(+-15V1A)、Ch1(+-30V3A)、GND、Ch2(+-30V3A)、Ch4(+-5V3A)。編碼器右側上下為數位定點鍵和5V3A USB-A輸出。5）如果擴充信號源，可插入麵板左側，由上至下為各輸出口，LCD左側加觸摸鍵可作為相應輸出控製；此時LCD顯示模式增加兩種：信號源與電源可分割或切換顯示，單鍵控製。用帶2路12bit D/A的uP控製每路，似乎比2路D/A成本低。
Linux下SCPI編程：https://www.element14.com/community/groups/test-and-measurement/blog/2018/05/27/scpi-on-a-linux-board-part-1-proof-of-concept https://hackaday.com/2016/11/16/how-to-control-your-instruments-from-a-computer-its-easier-than-you-think/
3. 其它
43project https://www.hackster.io/projects/tags/battery+charger
比較器回差計算：http://sim.okawa-denshi.jp/en/compkeisan.htm
免費sch/pcb軟件：https://www.electronics-lab.com/top-10-free-pcb-design-software-2019/
LCRT多用測試儀：https://www-mikrocontroller-net.translate.goog/articles/AVR_Transistortester?_x_tr_sl=de&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=sc https://www.aliexpress.com/item/32812264664.html
scope: https://www.aliexpress.com/item/1005002069795138.html 原版: https://accudiy.com/products/dso138mini-diy-kit? 源碼：https://github.com/essboyer/DSO138 如果您按照指南進行操作，將無法正常工作。 需要將電池電源連接到 J5 而不是 J7，短路 jp4、jp5 和 jp6。TMS320F281x 16chx12bit ADC可達25Ms,TMS320F2810PBKA
