地角天边
江郎才尽,不足为训
https://www.bidspotter.com/en-us/search-results?searchTerm=oscilloscope
1. Keysight Smart Bench Essentials
目前有四件，外观类似，电源较深因后部是环形变压器。显示均为7"LCD。
EDUX1052A: 50MHz 1G/s Scope示波器,$496
EDU34450A: 5-1/2 DMM万用表,$696?
EDU36311A: ５V６A/2x30V1A 90W三路模拟电源,$840。这个电源不如Lecroy T3PS33203P/T3PS43203P，后者是2x30V3A+5V6A或15VA+5V1A。
EDU33212A: 20M DSS信号源，内有双MPU及FPGA，$915。类似国产UTG962。
总之Keysight这套组合性能偏低。
2. Scope+Gen
示波器：国产50M 4CH的Instek GDS-1054B可破解到100M $310,100M 1G/s的国产有Hantek DSO5102b衰减-1dB故实际带宽超过100M,可破解到200M，Siglent SDX1104X-E可破解到200M $499；SDS2104X Plus可破解到500M。其餘破解：https://blog.wenxuecity.com/myblog/36867/201610/1401114.html offer：https://int.siglent.com/info/detail-49.html
SDS2104X Plus比Rigol MSO5074的噪音小很多，2x2G ADC；后者4x2G ADC最高8GSa。https://www.eevblog.com/forum/testgear/siglent-sds2000x-plus-threadlist/msg3041456/#msg3041456
https://saving.em.keysight.com/en/used/oscilloscopes/msox2002a-e184825189432 70M2CH+8CH digital+DMM/CT+20M Syn
2.1 普源Rigol Mso5000是示波器(2-4CH 70-350M均配350M探头)、逻辑分析仪LGA(16CH需PLA2216探头,1G/s带宽200M)、频谱分析仪(FFT)、任意波形发生器AWG(2CH25M需购AWG软件)、数字电压表(3-digit看来是8bit平均而来)、频率计和累加器(6-digit)、协议分析仪(RS232/UART, I2C, SPI, CAN, LIN, I2S, FlexRay, and MIL-STD-1553)的组合。破解后全功能开放只需加LGA探头。这个品牌俗称日狗，bug多，号称8G/s是4x2G岔开的，数据要直接由RAM导出才有，编程手段多是优点，缺点是Vrms时有效仅3.65bit，SDS04X+是3.92，Keysight 3104T是5.61。Mso5074可破解到350M：https://blog.csdn.net/qq_15242011/article/details/109093569 手册 https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes
MSO5074探头：PLA2216 $399，2.54间距2x25脚插座，用LMH7332x8加保护电阻及频率补偿，输入范围+-15V。VCCI为4V，VCCO 2.5V，VEE -2.5V，有载时各降0.1V，机内Vref为+-1.5V，输入有CMOS 5/3.3/2.5/1.8/LVDS(1.2V)/ECL(-1.3)/PECL(3.7)及可调阀值，输出与LVDS兼容。DIY可用LMH7334x4或TLV3604完全兼容。简化方案用pot调0.65~3.6V阀值直入TTL。我意74LVC8T245PWx2+DSLVDS1047PWTx2(布线见LVDS387手册)，Vccb=4V，Vcca=Vrefx4.9，可用于除ECL/PECL外的原有电平及100MHz。比eBay用SNLVDS1DB约70刀的好：https://www.ebay.com/itm/224648789536?。换74AUC245可工作到200M但输入最高为3V3。稳压片AP7311-WG-7，OP为MCP6006有SOT23或SC70封装。输入为330欧//1n，对地47K，最大输入+10/-5V。https://www.keysight.com/us/en/assets/7018-06707/data-sheets/5968-4632.pdf
需要指出，示波器内置逻辑分析仪只是异步方式，不能用DUT时钟或状态分析，估计触发方式有限不能用指令级比较触发，性能比不上几十年前的旧货，后者很便宜唯体积大。
2.2 Keysight DSO/MSO X2000/X3000
2000系列1GSa A/D，可交错为2G，逻辑仅8CH toggle rate 50M(Max9201x2 7ns)，WaveGen没AWG功能。拆卸：2K https://www.youtube.com/watch?v=fGxusFBMDR0 3K https://www.youtube.com/watch?v=os1agF35jxU 维修手册：https://xdevs.com/doc/HP_Agilent_Keysight/Service%20Guide%20for%202000%203000%20X-Series%20Oscilloscopes%2075019-97084%20c20141015%20%5B150%5D.pdf
由USB启动或修复NVM：https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181
InfiniiVision 3000 X 系列以及2000 X系列 DSO/MSO 示波器USB启动：
1. Unpack the firmware *.cab by 7zip (1st pkg)
2. Unpack infiniiVisionSetup.cab (2nd pkg, e.g. with WinCE CAB Manager 3.0)
3. Copy unpacked Secure folder contents to root of USB
4. Edit Secure|infiniiVision|infiniiVisionCore.dll, change byte sequence at location 0x277e50 from 04 00 a0 e1 to 00 00 a0 e3
Edit in Startup|infiniivision.lnk to contains following sequence "62#usbinfiniiVisioninfiniivisionLauncher.exe -l All -l BW20 -l SCPIPS"
or, "62#usbinfiniiVisioninfiniivisionLauncher.exe -l MSO -l MEMUP -l MEMMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l All"
5. Create infiniivisionStartupOverride.txt file in root of USB containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red message in letf top corner "Unfinalized Software" and "System Concerns detected: OS version is not correct. Please reload system firmware", press a key to pass it, leave USB in scope, self diag shall pass.
InfiniiVision 3000 X 系列以及2000 X系列经济型 DSO 和 MSO 示波器固件下载:
V2.35 https://mega.nz/file/rmgRWYYZ#lIcYsMwQusOA_VAWfyfLkgPDQDnKLVZr0i0C7VnP7NY
v2.65 https://www.keysight.com/us/en/lib/software-detail/instrument-firmware-software/installing-infiniivision-2000-xseries-oscilloscope-firmware-2014479.html patch https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/2713/ 2000/3000A可以，高档报错需将Secureinfiniivisionrename symbols.tte.old换名再继续。maybe need a pre-install step added to the recipe.xml to automatically do that 'rename'. I used Telnet over LAN (4000X) to do the file rename. For 200x and 300x the lnk content are:
146#infiniivisionLauncher.exe -l MSO -l WAVEGEN --perf -l D2000AUTB -l D2000GENB -l D2000BDLB -l BW10 -l BW20 -l SCPIPS -l PLUS -l VID -l CABLE -l ASV
160#SecureinfiniiVisioninfiniivisionLauncher.exe -l DIS -l MSO --perf -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l TOM -l BW35 -l ADVMATH -l EMBD -l EDK -l VID
I opened the oscilloscope and connected the UART port on the motherboard，plug the homemade LAN card (without video) into the oscilloscope.
At the moment of power on, pause the oscilloscope to continue to start through UART, get the IP address（192.168.1.109） , IP address of my computer is configured as：192.168.1.1.
and then enter u-boot mode. After the operation is completed, I try to log in through Telnet, I have downloaded the firmware from the network, start it, and then fix the .ink error.
Search this thread for "Ymodem" to learn how upload firmware via serial.There is an option to load the bin from serial or ymodem mode.But I would need the firmware file. The one can boot from USB.Your serial log says:: Address=0x80361000 Length=0x4E09D90 Name="" Target=RAM You will need to find the firmware version which bin file matches the Length.
This is the most detailed post about how to repair a NAND corrupted scope: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181
"Microsoft Windows CE Bootloader Common Library Version 1.4 Built Aug 12 2011 11:03:19
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008"
My process so far:
-Take a fresh flash drive, formatted FAT16
-Create file infiniivisionStartupOverride.txt with content "True" (excluding quotations)
-Extract contents of 2000XSeries.02.35.2013061800 to flash drive
-Plug in flash drive, power on scope
似乎更简单的办法，v2.41已测：以scope IP或hostname运行下列VB script，需LAN卡：
' Howardlong at #839 from https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/825/
Set x3000a = CreateObject("WScript.Shell")
x3000a.run"telnet"
WScript.Sleep 1500
x3000a.SendKeys"set escape ]"
x3000a.SendKeys("{Enter}")
WScript.Sleep 500
x3000a.SendKeys"open "+WScript.Arguments.Item(0)
x3000a.SendKeys("{Enter}")
WScript.Sleep 2000
x3000a.SendKeys"infiniivision"
x3000a.SendKeys("{Enter}")
WScript.Sleep 500
x3000a.SendKeys"skywalker1977"
x3000a.SendKeys("{Enter}")
WScript.Sleep 500
x3000a.SendKeys"cd secureinfiniivision"
x3000a.SendKeys("{Enter}")
WScript.Sleep 500
x3000a.SendKeys"processmgr kill infiniivisionlauncher.exe"
x3000a.SendKeys("{Enter}")
WScript.Sleep 2000
x3000a.SendKeys"infiniivisionlauncher -l all"
x3000a.SendKeys("{Enter}")
WScript.Sleep 3000
x3000a.SendKeys"]"
WScript.Sleep 500
x3000a.SendKeys"qui"
x3000a.SendKeys("{Enter}")
WScript.Sleep 500
DSOXLAN: 用于MSOX2000-805, DSOX3000-805，但是Eth只是个插座可以DIY：https://www.eevblog.com/forum/projects/lan-adapter-for-the-agilent-keysight-dso-x-3000-2000/ 购买：https://www.eevblog.com/forum/testgear/point-me-to-latest-info-on-dyi-dsoxlan/msg1409765/#msg1409765 单套25刀，可选电阻焊接后启动报错忽略即可，否则需要知道IP以便访问。
逻辑探头是N2756A，常见DIP40F接示波器，普通扁平4线电缆带阻抗小盒，不是HP传统的编织电缆。高频简易探头，可以是390+560+50欧电缆(20:1)。
==
From the Agilent 2.35 upgrade CAB I extracted the files you said:
infiniiVisionLauncher.exe
infiniiVisionCore.dll
Put them on a USB stick, booted the 2.37 scope and got telnet access (infiniivision, skywalker1977)
Killed the running version (a step you didn't mention, probably because it was obvious to you!):
processmgr kill infiniiVisionLauncher.exe
Change to application directory
cd secureinfiniivision
Copy those two old files:
copy usbinfiniiVisionLauncher.exe
copy usbinfiniiVisionCore.dll
Reboot and get firmware concerns message, scope still thinks it has 2.37, no problem.
Put Agilent 2.35 upgrade CAB onto USB stick and up(down)grade as normal. Lots of waiting, scope then reboots with 2.35 up and running.
Then reboot with USB stick with modified 2.37 files to get all options including MSO and full bandwidth.
Many, many thanks sir. I owe you something nice from under my desk!!
====Down grade from 2.39 to 2.35
1. downgrade to 2.37 (it just works)
2. unpack 2000XSeries.02.37.2014052002.cab (ex with WinRAR)
3. extract file infiniiVisionLauncher.exe from infiniiVisionSetup.cab (2.37) (ex with WinCE CAB Manager)
4. unpack 2000XSeries.02.35.2013061800.cab (ex with WinRAR)
5. open infiniiVisionSetup.cab (from 2.35) file in WinCE CAB Manager, find infiniiVisionLauncher.exe on list and delete it
6. add infiniiVisionLauncher.exe (from 2.37 cab) to file list and set all properties like in old file (flags: uncheck all; location: SecureInfiniiVision; Hard-coded path checked)
7. file->save and exit WinCE CAB Manager
8. calc MD5 of edited infiniiVisionSetup.cab and update it in recipe.xml file
9. compress all files (ex with CabPack) from 2.35 firmware with edited infiniiVisionSetup.cab
10. flash new file, now it is 2.35
One detail: In the CabPack software it's important to setting the Compression type to MSZIP
V2.35适用于200X、300X，不适用于300XT和400X。对于 400X，据我所知，V3.12 固件是最后一个接受 USB 启动的固件
== V2.41 #1022
TTL Serial conn：https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895
NVM fail fix: https : //www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that -scope/msg2136181/?topicseen#msg2136181 我按了 r（重置）10-15 次。突然间我在串口通讯中看到示波器开始启动。完全启动后，我将新固件从 Keysight 下载到 USB。并升级了固件，现在一切正常。
MSO3024 full200M:https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/2800/
3000A-series 200MHz board to 500MHz board upgrade how-to.
Similar procedure can be applied to 3000T and 4000A series.
To extend 100/200MHz board to 350/500MHz you'll need to perform serious hardware modification of the main board.
Decent SMD soldering skill and soldering equipment are required to perform this modification.
Thus, it's not recommended to try this mod unless you're really desperate to get extra bandwidth.
This is a description of hardware modifications on sensitive signal paths of the scope!
Applying any of these mods will void your warranty and calibration!
Loss of factory calibration and accuracy is inevitable!
DISCLAIMER: do this at your own risk only! Irreversible damage may be caused by these modifications. You've been warned!
Required materials for 4-channel models:
1. Coilcraft 0603CS-15NXG 0603 15nH 2% inductors - 12 pcs
2. Coilcraft 0603CS-27NXG 0603 27nH 2% inductors - 4 pcs
3. 0603 2.2pF NP0 capacitors - 4 pcs
4. 0603 2.0pF NP0 capacitors - 4 pcs
5. 1206 110R 1% resistor - 4 pcs
6. 0603 162R 1% resistor - 4 pcs
7. 0603 121K 1% resistor - 1 pcs
8. 0603 46.4K 1% resistor - 1 pcs
User cal fixture is required for post-modification calibration.
BACKUP NOTE: save all removed components in separate places for each position and channel to secure way back to original values!
Modification process (see attachments for pictures):
1. For each channel replace yellow-marked parts as follows:
AFE top layer (afe_top_layer_mod.jpg):
L1: 100nH(?) -> 15nH
R1: 215R -> 110R
L2, L3: 47nH(?) -> 15nH
C1: 4.7pF -> 2.2pF
C2: 4.7pF -> 2.0pF
AFE bottom layer (afe_bot_layer_mod.jpg):
L4: 100nH(?) -> 27nH
R2: 261R -> 162R
2. Replace two board strap resistors:
Top layer near CPU (gnd_straps.jpg):
Strap resistor L1: 10K -> 46.4K
Bottom layer under CPU (2v5_straps.jpg):
Strap resistor H1: 100K -> 121K
NOTE: all capacitor values are guessed or measured and may not be 100% correct.
Run a brief per channel check of scope functionality before fully reassembling the scope. For a final assembly be sure to mount all shields and covers. Run User cal procedure with a high-quality user cal fixture to compensate replacement of AFE components.
Done, you'll get a 350MHz scope. 350MHz to 500MHz upgrade is software-only and possibly discussed elsewhere.
infiniivisionLauncher.exe -l all -l BW50 -l SCPIPS #open all options BW 500M on 3000x
MSO3024T 1G:https://www.eevblog.com/forum/testgear/keysight-3000t-scope-1-ghz-hardware-upgrade-mod/
万用表：我有4-1/2位Fluke 87V。4-10A档0.03欧其余1.8欧，电容10kp-10ku，二极管3V，频率200K。注意黄健有多功能例如交直流电流切换，电阻电容切换。在线测量电容时有两个0u1的不对，反而HT206D测对了。HT206D由60A/600A交直流钳表和10M频率计数器，可加0.1欧做6A电流表，加UPB586G可测2.56但需定标。
DSS信号源：国产FY6900 60MHz内置FPGA约$100，UTG962的屏幕更大$123，DIY意思有限，否则可以找找开源的基于FPGA的设计。用AD9834板(淘宝$10+)时，可以输出正弦、锯齿、方波，不会有前者那么多功能，但可增加LCQ测量和100M輸出。又HMC832可编程输出25M~3G(3Hz分辨率)正弦波。DIY信号源的话可设置为单边插件与电源共用LCD显示。MSO5074为2x20M而SDS2104X Plus为50M。25M-6G $102.5：https://www.ebay.com/itm/172209934502
模拟电源：参考Teledyne T3PS43203P或Instek GPD-4303S，前者是4路可调但USB显示是Instek，估计是后者设计的。后者A/V分别有旋转编码器，但不如前者好。
34刀买了HY3002-3电源：2x30V2A+5V3A，待修复用。每路加2N3055可达3A，加2个即为HY3005-3，当然要配散热片和均流电阻。
电源DIY: 1）如果没有硅胶开关的话，可以有一个旋转编码器带确认按键；另一按键为快速数位定点(V/25mV/mV)。4通道各有一按键切换开/电压设置/电流设置，输出电流未到设定值时为CV否则为CC，另加总输出开关，总共6个。2）LCD边缘条触摸菜单: 配置(版本、USB、Eth接口)、模式(电源-自动/CV/CC、负载-CC/CV、电池充放-多种类型带放电曲线)、快速设置(常用电压)、级联设置。3）显示模式参考Lecory有两种：2x2分隔大字显示通道及输出电压、功率及电流，小字显示Vset|OVP、Iset|OCP；曲线显示某通道的电压电流和功率，左侧由上至下为通道号、VCP及其div、虚线为OVP/OCP，也可用于电池充放曲线。4）面板左上为LCD，LCD最下行为菜单触摸，次下可加状态行。面板右上为旋转编码器，其下为4通道开关按钮带灯。面板下由左至右为电源开关、Ch3(+-15V1A)、Ch1(+-30V3A)、GND、Ch2(+-30V3A)、Ch4(+-5V3A)。编码器右侧上下为数位定点键和5V3A USB-A输出。5）如果扩充信号源，可插入面板左侧，由上至下为各输出口，LCD左侧加触摸键可作为相应输出控制；此时LCD显示模式增加两种：信号源与电源可分割或切换显示，单键控制。用带2路12bit D/A的uP控制每路，似乎比2路D/A成本低。
Linux下SCPI编程：https://www.element14.com/community/groups/test-and-measurement/blog/2018/05/27/scpi-on-a-linux-board-part-1-proof-of-concept https://hackaday.com/2016/11/16/how-to-control-your-instruments-from-a-computer-its-easier-than-you-think/
3. 其它
43project https://www.hackster.io/projects/tags/battery+charger
比较器回差计算：http://sim.okawa-denshi.jp/en/compkeisan.htm
免费sch/pcb软件：https://www.electronics-lab.com/top-10-free-pcb-design-software-2019/
LCRT多用测试仪：https://www-mikrocontroller-net.translate.goog/articles/AVR_Transistortester?_x_tr_sl=de&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=sc https://www.aliexpress.com/item/32812264664.html
scope: https://www.aliexpress.com/item/1005002069795138.html 原版: https://accudiy.com/products/dso138mini-diy-kit? 源码：https://github.com/essboyer/DSO138 如果您按照指南进行操作，将无法正常工作。 需要将电池电源连接到 J5 而不是 J7，短路 jp4、jp5 和 jp6。TMS320F281x 16chx12bit ADC可达25Ms,TMS320F2810PBKA
