Possible GW Instek GDS-1000B hack

[rhb]

Just to give some idea of how extremely useful the SA function is here are some more screen dumps.

The H field probe is a 3-4 mm loop of copper wire wound on mandrels to be a push on fit to the probe tip and then insulated with several layers of heatshrink tubing.

The E field probe is a probe tip insulator with a bit of heatshrink over the probe tip.

So nothing fancy or expensive.  But safe to poke around without having to worry about causing a short.

I placed the probe about 1 cm from  the SMPS transformer of my GDS-2072E.  For the H field I rotated the probe to find the max and min orientations.  The E field was taken in the same location.

It's very easy to detect signals on ribbon cables, etc, though some shielding of the transformer fields would be needed to not have that dominate the spectrum.

[toastedcrumpets]

This will not work on 2000A because the S/N has a different format.

Nooooo! I've just got back to work after four weeks of paternity and found this disappointing news. Is there anything I can do to help fix this? I've cracked the case on the GDS-2074A scope I have and I'm probing for the JTAG/serial interface as we speak....

[Mortymore]

Hope they are OK with this... if not let me know, please.

Summed the parts provided by wgoeo (reply #3) and tv84 (reply #47), and made a "soup" for my 2074E, since I was interested in the Spectrum Analyzer (SA) option.
The "soup" was named lis2.txt, and should be renamed to lis2.html

The SA option was installed with the latest firmware gds2000e_v1.38 (2019-01-26) on the scope.

As rhb explained "To access the SA you need to press the button in the lower right corner of the screen area below the small round button.", the OPTION button. Now I have a use for him.

Hope everything is alright, but it worked for me, as can be seen from the print screens attached.

Thanks for your work

PS: Sorry rhb I had to press AWG button. My scope didn't crash... until I go further, playing with Generators menus that the scope doesn't have.

[pa3hfu]

I updated my 2104E to V1.38, but pressing the 'Option' button the scope says: Not supported for this model!

[Mortymore]

I updated my 2104E to V1.38, but pressing the 'Option' button the scope says: Not supported for this model!

The OPTION button accessing the SA option, has no direct relation with the firmware version. You have to install the SA license.

[AC360]

Hope they are OK with this... if not let me know, please.

Summed the parts provided by wgoeo (reply #3) and tv84 (reply #47), and made a "soup" for my 2074E, since I was interested in the Spectrum Analyzer (SA) option.
The "soup" was named lis2.txt, and should be renamed to lis2.html

The SA option was installed with the latest firmware gds2000e_v1.38 (2019-01-26) on the scope.

As rhb explained "To access the SA you need to press the button in the lower right corner of the screen area below the small round button.", the OPTION button. Now I have a use for him.

Hope everything is alright, but it worked for me, as can be seen from the print screens attached.

Thanks for your work

PS: Sorry rhb I had to press AWG button. My scope didn't crash... until I go further, playing with Generators menus that the scope doesn't have.

Does it work for GDS-1000B?

[AC360]

Here is the new license generator for the current FWs of GDS1000B and GDS2000E, based on the wgoeo post (msg #3).

Code: [Select]

        private static void InstekKG(string serial)
        {
            // This works for GDS1000B and GDS2000E
            string[] opt = { "PWR", "BUS", "SRH", "SGM", "BW100", "BW200", "BW300", "SA" };   // Prefixes: "DS1KB-"  or "DS2E-"

            // uint[] ClearCode = { 0x11111111, 0xABABABAB, 0x22222222, 0xCDCDCDCD };  // OLD -- GDS1000B (up to v1.18) and GDS2000E (up to v1.28)
            uint[] ClearCode = { 0x74B0DC51, 0x46E87CCD, 0x25E45D32, 0x515F007C };  // NEW

            serial = serial.Trim();
            int serial_int = Int32.Parse(serial.Substring(serial.Length - 4, 4));

            int pid_sum = 0;
            for (int i = 0; i < serial.Length - 4; i++)
                pid_sum += serial[i];

            for (int i = 0; i < opt.Length; i++)
            {
                int[] a = new int[2];
                a[0] = (pid_sum << 24) | ((i << 8) & 0xF00);
                a[1] = (1 << 24) | ((serial_int << 8) & 0xFFFF00) | ((pid_sum >> 8) & 0xFF);

                for (int j = 0, k = -0x61C88647; j < 32; j++, k -= 0x61C88647)
                {
                    a[0] += (int)((16 * a[1] + ClearCode[0]) ^ (a[1] + k) ^ ((a[1] >> 5) + ClearCode[1]));
                    a[1] += (int)((16 * a[0] + ClearCode[2]) ^ (a[0] + k) ^ ((a[0] >> 5) + ClearCode[3]));
                }
                Console.WriteLine("DS1KB-{0}.lic / DS2E-{0}.lic - [{1:x8}{2:x8}]", opt[i], a[1], a[0]);
            }
        }
Those who prefer the javascript version can replace just the ClearCode constants in the script (I leave that as homework). The SA option was also added (only for the 2000E).

Edit1: Tested successfully by some members in DS2E and MSO equipments. This will not work on 2000A because the S/N has a different format.

Does it can upgrade the GDS-1000B to BW200 or BW300 MHz?

[Mortymore]

@AC360

I don't think you can go further than 100MHz on GDS-1000B, since they are available with 50/70/100MHz bandwidth options.

Unless better opinion... I believe the code that tv84 provided, is able to work on the GDS-1000B, but only for the options that can be accepted by the scope. In that manner, the SA, 200MHz, 300MHz licenses among others, will probably not be accepted.

Be aware that the lis2.txt file I attached is "modded" for 2000E series. That was my homework as tv84 "ordered".  Do yours! 

[tv84]

You passed the test, Morty.

The code works with the GDS-1000B version as stated in the code.

From what I remember, the licenses are generated based on the "option" index. So it's irrelevant the true name of the options.

In the GDS-1000B the BW options are  50/70/100MHz.

These are unlocking licenses, not HW upgrades!

[AC360]

You passed the test, Morty.

The code works with the GDS-1000B version as stated in the code.

From what I remember, the licenses are generated based on the "option" index. So it's irrelevant the true name of the options.

In the GDS-1000B the BW options are  50/70/100MHz.

These are unlocking licenses, not HW upgrades!

So the "SA" option only work with GDS2000E series?

[nctnico]

Just try it. I don't think there is much difference in the firmware between the 1000B and 2000E series.

[Gazmon]

Are these hacks in reply 4 still working please

[nctnico]

You need to combine reply3 and reply47. This should create a working key generator you can run in your webbrowser.

[Gazmon]

I downloaded the file in reply 3 and followed the instructions, have renamed to an html file , when I opened in a browser it was just code text


How do I combine the code please? cant seem to get any key generator?

Wondered if anyone could maybe help me out in what im  doing wrong?

thanks for any info

[Gazmon]

Bump..... anyone with a few tips

have a GDS 1000B

appreciate the help

[nctnico]

Try a different browser or check whether you have visible extensions and your file is not actually called html.txt .

[Gazmon]

ok , but do I just need to combine the code in reply 4 and 47

in an html file?

[Gazmon]

Try a different browser or check whether you have visible extensions and your file is not actually called html.txt .

yep that worked, downgraded to 1.12 first... serial decode, waveform search, 200mhz (scope says its upgraded to this in system info), and segmented memory all installed

Bus button and search features have come to life

Upgraded back to 1.23 , all systems still good so far, needs checking to see whats there

cheers

[nctnico]

Also thanks for acknowledging that this hack also makes serial decode available on the GDS-1000B. Did you also install the SA license? Pressing the 'option' button should bring up a menu with the spectrum analyser button.

[Gazmon]

SA button, not sure I can get this on 1000b

correct me if I am wrong

the only option i didnt install was the `power analysis` is that worth having?

[Mortymore]

... 200mhz (scope says its upgraded to this in system info)...

What scope exactly do you have?
Can you add a photo please? (or a screen capture of the System info, with the serial number blurred)

It's just that if you have a 1000B, I wasn't expecting it to reach 200MHz. I'm intrigued now 

About the SA option (Spectrum Analyser) that nctnico is talking about, if it's available, you can access it with the "OPTION" button on the lower right corner near LCD screen (below "Menu off" button).

[Gazmon]

photo attached, I have the 1102b 2 channel version

Serial decoding works but is not available for the parallel and SPI options it seems which is a bit disappointing

any idea what power analysis is, I didn't install this tbh


And the option button still does not do anything on my scope after the upgrades I did

Still pretty good scope after the hack

[nctnico]

Parallel is for digital channels only and SPI is only available on 4 channel models because you need 4 signals (clock, sel, MISO and MOSI) for SPI.

[Gazmon]

Ok thats sorts that out, really just need to do a bandwidth check on the so called 200mhz that my scope claims to have now

being fairly new to all this what the easiest way to do this ?

any help appreciated

[Mortymore]

any idea what power analysis is, I didn't install this tbh

All I can tell is that power analysis is available for GDS-3000 Series, and it didn't work for me on the 2000E.
If that's just a matter of software or some hardware may be needed, I don't know. A current clamp for scope could be bought separately to deal with current, but I never look for intel on what could be holding the 1000B and 2000E so they can't have the power analysis option working.