I modified the firmware, as you indicated, it produces the same effect as my previous patch, but is more elegant.
Also without changing any parameters between firmwares, dumpRegValues returns this:
1. Original firmware (MSO6034A):latcha 0x30 0x70 0x70 0x30
latchb 0x7c 0x78 0x78 0x7c
rattler0 0x168 0x80 0x80 0x168
rattler1 0xc0 0x100 0x100 0xe0
rattler2 0xf8 0xc8 0xc8 0xf8 <-
rattler3 0x104 0xc8 0xba 0xfc
rattler4 0xbe 0x92 0x94 0xaa
rattler5 0000 0000 0000 0000
rattler6 0x179 0x11 0x39 0x1cf
rattler7 0x1c0 0x11d 0x125 0x1c0
offset 0x01feef 0x01ff5e 0x0204d9 0x01fee4
level ext 0x7fe0
pod thresh 0x5f10 0x6dc0
ti ramp adj 0xb813 <-
hamster0 00
hamster1 0x4
hamster2 0xf3
hamster3 00
hamster iramp 0x800
probe 0x8000 0x8000 0x8000 0x8000
value = 10 = 0xa
2. Patched firmware (MSO6054A):latcha 0x30 0x70 0x70 0x30
latchb 0x7c 0x78 0x78 0x7c
rattler0 0x168 0x80 0x80 0x168
rattler1 0xc0 0x100 0x100 0xe0
rattler2 0x140 0x148 0x148 0x140 <-
rattler3 0x104 0xc8 0xba 0xfc
rattler4 0xbe 0x92 0x94 0xaa
rattler5 0000 0000 0000 0000
rattler6 0x179 0x11 0x39 0x1cf
rattler7 0x1c0 0x11d 0x125 0x1c0
offset 0x01feef 0x01ff5e 0x0204d9 0x01fee4
level ext 0x7fe0
pod thresh 0x5f10 0x6dc0
ti ramp adj 0xb7c4 <-
hamster0 00
hamster1 0x4
hamster2 0xf3
hamster3 00
hamster iramp 0x800
probe 0x8000 0x8000 0x8000 0x8000
value = 10 = 0xa
After doing several tests, I discovered that the oscilloscope used a serial protocol to communicate with the 1NB7-8453.
To open captures, download this software:
http://tools.asix.net/download/analyzers/sigma-omega_2013-09-19_en.exe? The last string recivier, is returned on falling edges (1NB7-8453 output) .
Q1[0] New data to the 1NB7-8453, it get on rising edges (1NB7-8453 input).
Q0[0] CLK to the 1NB7-8453 (1NB7-8453 input).
Q2[0] As indicator (1NB7-8453 input).
Example Q1[0]:
BW Limit CH4 ---------------
0101 1001 1101
0010 1001 0000
0111 0011 0000
---------------------------------
Full BW CH4 -----------------
0100 0001 1101
0010 0110 0000
0111 1001 0000
---------------------------------
What the hell we must send to set a BW of 500MHz?
Full captures:
Star Up: Star_Up_CH4_.zip (see attached files).
BW Limit to Full BW: LMT-BW_to_Full-BW_CH4_.zip (see attached files).
Q0[0] = (see pictures).
Q1[0] = (see pictures).
Q2[0] = (see pictures).
Q3[0] = U308 (CH2).
Q4[0] = U308 (CH2).
Q5[0] = Unknown.
Q0[1] = Relay.
Q1[1] = AC/DC.
Q2[1] = Unknown.
Q3[1] = Relay.
Q4[1] = TRT Q400 (CH3).
Q5[1] = Unknown.
Note: [1] registry is related to latcha.
Edit1: I have corrected some errors, sorry.
Edit2: I added a partial protocol description, it may be wrong (no documentation).