Some time ago I broke down and finally bought an Agilent DSOX3024A oscilloscope. It had the software bundle package already installed, but it was missing a few things that I really wanted, such as the MSO option. I decided to follow the instructions provided in the thread here to install the additional options:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?topicseenAs a part of the hack, I designed my own LAN interface PCB so that I could telnet into my scope from my laptop. That process was quite easy, and I was able to hack my scope with no problems. Following that process, however, I felt like I needed a challenge, something to break in my new “fancy” scope. I decided to go ahead and spend $200 on a real DSOXLAN LAN/VGA board from Agilent with the sole intent of reverse-engineering it. I thought the $200 price tag was a bit steep and wanted to see if I could do better, with hobby-level board houses being dirt cheap these days. I decided to document my experience with reverse-engineering this board here, with the hope that it might encourage and inspire others to try new things and step outside of their comfort zone.
After receiving the DSOXLAN board in the mail, the first thing I did was open up the case and remove the board from the enclosure ("Don't turn it on, TAKE IT APART!"). Once I had the board itself in-hand, the first step was to generate a bill of materials for the components used on the PCB. Unfortunately, none of the passive parts had designators labeled in silkscreen, which made keeping track of them very difficult. To solve this problem, I decided to assign my own designators. The Ethernet and VGA connectors were very bulky, so I first desoldered them and removed them from the board. I then placed the board in a scanner to get a flat image of the top and bottom of the PCB. You can find links to my (somewhat) high-res scans of the top and bottom layers here:
High-Resolution Top Layer ScanHigh-Resolution Bottom Layer ScanThe next step was to display them side-by-side and scale them to 1:1 dimensions. I decided to import the photos into a SolidWorks drawing, which would allow me to add designators as well as identify which tracks connected to which pads.
Images Side-By-Side In SolidworksAfter properly scaling the high-res images within a SolidWorks drawing, I used the text tool to apply my designators, left-to-right and top-to-bottom on the front and then the back side of the board. Once I had all of the designators assigned for the populated parts, I added designators to the unpopulated parts. I would have included these in the original sequencing but applying designators to the unpopulated parts was more of an after-thought.
When I was finished adding all of the designators, I was finally ready to create my bill of materials. I started by printing off an enlarged copy of my SolidWorks drawing on an 11" x 17" sheet of paper, so that I could easily see the individual parts. I then proceeded to desolder each of the passive components one-by-one, measuring each one with a multimeter before re-soldering it to the PCB. Each time I took a measurement I recorded it next to the designator on the enlarged print, so that I could keep track of the values. After completing these measurements of all the passives, I created an Excel spreadsheet using the given designators, grouped by the values that I determined previously. I also added each of the ICs and connectors, determining their part numbers based on their SMD codes and labels. For the passive components I did a parametric search to find current (non-obsolete) manufacturers and part numbers, which I then used in the bill of materials.
Excel BOMFrom there, back in SolidWorks I used the sketch tool to draw lines, rectangles, and circles outlining the location and connectivity of traces, copper pours, pads, and vias. I used different sketch layers in SolidWorks to differentiate between top-layer tracks and pads, bottom-layer tracks and pads, vias, mounting holes, and the board outline. This took a little bit of time, but when it was finally finished, I removed the images from the background and was left with a general idea of the PCB layout.
Tracing Out In SolidworksIt was by no means complete, but it gave me a good place to start. And this is where the 1:1 scaling became extremely useful: I exported the SolidWorks drawing as a DXF with the appropriate dimensions, which I then imported into Altium Designer. This gave me most of the critical dimensions, as well as provided a guide for where to place the components, traces, vias, mounting holes, and so on. I mapped each DXF layer to an Altium mechanical layer to make it easier to identify where the elements were to be located.
DXF Imported Into Altium DesignerMy original hope was that this board was only four layers - top and bottom for signals, and two inner planes for power and ground. Unfortunately, throughout the tracing process I found several blind vias which did not go to either power or ground, indicating that there were at least two internal signal layers as well. I decided to put off this issue for later and just proceed with tracing out the top and bottom. I figured I would cross the bridge of determining the additional connections when I come to it. Therefore, I simply continued to place the components in Altium, and then route them using the mechanical layers for routing guides. I was able to get a significant portion of the top and bottom layers done, though some traces were hidden underneath parts such as the FPGA, SRAM, and VGA transmitter. I ended up saving those connections for later after sketching out the schematic and determining their logical placement.
Based on the positions of some of the vias I knew there had to be internal power and ground planes. I went ahead and added them to the board stackup in Altium, along with the innermost signal layers. I didn't know what was going to be on them, but I knew they had to be put there eventually.
Next was the most tedious and time-consuming process of all: Tracing out the signals. I set my DMM to resistance/continuity test mode and spent a few hours every day for the next several weeks probing every pin and every pad on the board, noting where they were connected. At the same time, I was drawing my schematic in Altium, assigning my own temporary net names such as "U1_1", "U3_25", etc. indicating where each signal connected to a component. The center of attention was the FPGA, since nearly everything else in the circuit connected to the FPGA in one way or another. Assigning net names based on what pins of the FPGA they connected to simplified things significantly. I knew I could always go back and change the names to something more descriptive if I figured out what the signal was used for. After 2-3 long weeks of probing pins, pads, vias, and connectors I finally reached what I believed to be the end. I was fairly certain I had found all of the connections and the schematic was accurate.
The next couple of days consisted of me tidying up the schematic and giving the nets descriptive titles, all the while studying the design to make sure I understood it. There was one thing that stumped me, however, and it had been bugging since a week or so after I began the project. First of all, as I mentioned earlier, the heart of this circuit is an FPGA (a Xilinx Spartan 3E). I knew I was probably never going to be able to write code for it from scratch, considering I had no idea how the oscilloscope communicated with the module to provide VGA at its output. I was also unsure of whether or not I would be able to pull configuration information directly from the non-volatile memory for my own use. What bugged me (at first, anyway) was that I could not find any NVM devices on the board whatsoever. There was no FLASH, only an SRAM chip which I knew was used as a frame buffer. I had no idea of how I was going to capture the initialization code I needed to make my board operate like the original. After tracing out the schematic and reading through the Spartan 3E datasheet, however, it finally dawned on me: there were three connections on the board which told the FPGA how it was going to be programmed, and the connections I found while probing indicated that the FPGA was configured using slave-serial mode. This meant that the processor in the host oscilloscope would load the FPGA with its configuration information at runtime, and that the module itself is pure hardware. This was a very exciting discovery for me, as it meant that I would not need to deal with any FPGA code whatsoever. It simplified the project immensely, and put my goals well within reach.
At this point I had a nearly completed schematic, but I was still missing the copper for the four internal layers of the PCB layout. I eventually arranged to have the official DSOXLAN PCB X-rayed by a friend of mine in order to (hopefully) show how the internal layers were routed. However, I was not too keen on shipping this $200 board half way across the country, and I eventually decided to simply route the internal layers myself, since I was fairly confident that I had found all of the connections by probing the points on the outermost layers. I updated my PCB layout with my schematic information in order to show the airwires, indicating where I needed to route the traces. I then proceeded to lay my tracks on the internal signal layers and split up the power plane to meet the requirements of the FPGA power rails. I left the entire ground plane intact to ensure all signals had a reliable return path.
At last, after about a month of scanning, tracing, routing, probing, sketching, and more routing, I finally had what I believe to be the final PCB design:
Complete DSFAUXLAN LayoutI ordered the PCBs from JLCPCB (not a sponsor, I just enjoyed their service) for about $10/ea. Keep in mind that these were 6-layer gold-plated boards, so this was a fantastic deal. About a week later I received the blanks and proceeded to assemble one of them to test it out. I discovered that I had only missed two connections when I buzzed everything out with my multimeter, which I felt was pretty impressive for a first go! After modding the board, I was able to get it to display an image on a VGA monitor just like the original. I had successfully reverse-engineered the design of the DSOXLAN module and replicated the circuit and performance, and I dubbed it the “DSFAUXLAN”.
Jumping ahead about four months, I decided that since I already reverse-engineered the board, I should finish the project by reverse-engineering the enclosure as well. This process was much simpler, and simply consisted of me using a set of calipers and measuring the original casing piece-by-piece and recreating them in SolidWorks. Many of the dimensions are not perfect, likely due to tolerances, drafts, and measurement errors, but I was successfully able to recreate the enclosure in a way that would fit the PCB.
ALM19-02 EnclosureAt the time of this writing I have not had any enclosures made and I have not created a model for the two halves of the metal shield, but that may change in the future.
Reverse-engineering the DSOXLAN LAN/VGA interface module was a very enjoyable process and a great learning experience for me. Using the knowledge that I gained from this project, I eventually designed and developed my own version of the module that provides an HDMI output instead of VGA, with the intent of it working better for more modern displays. If you have any questions about my HDMI version, feel free to send me a PM. I am not sure I am ready to post about it on the public forum yet, though.
I hope this project has also inspired someone else to go and reverse-engineer something too, and to use that newfound understanding to create something new of his or her own!
UPDATE:For anyone who is interested, the reverse-engineered 3D case models, BOM, and schematic for the original LAN/VGA module can be found in the attached ZIP file.
Home
Help
Search
Login
Register
