Hacking/reverse engineering the Instek GDS-2000E

[rhb]

I am engaged in hacking the GDS-2000E line.  I have a 2072E specifically purchased as a target and an MSO-2204EA to do the work.

I am NOT interested in cracking license codes.  My goal is to be allow the user to custom program the instruments and to perform calibrations if suitably equipped. 

The 2000E is an FPGA dev board with some additional features.  So reprogramming should not be all that hard.

A brief examination shows an ADC, a couple of  FPGAs, 256 MB of SDRAM,  128 KB of flash, input attenuators, etc  in the 2072E.  The 2204EA has a lot more stuff in the box.  Both run the same  FW.
The first step is to generate basic system and service data.  From what I've seen that's not too hard to do from a photograph with detailed checking as needed at key points .  DIY "Sam's Photofacts".   Just for fun one could take the topology, feed it into a simulator and calculate the optimal values for the passives using FEM analysis of the PCB.

Basic goal:

A buildable Instek/Xilinx  Linux system with user ability to reconfigure menus and execute SCPI command scripts
Mixture of open and closed source FW, but with APIs fully documented so that independent implementations are possible.
Ability to reload factory FW at any time.

Once one has a reasonably accurate block diagram and has identified the blocks on the PCB, it is fairly easy to select test points for detailed documentation needed for component level trouble shooting.  And the device behavior severely limits the number of possible solutions.
.
One nice aspect is that if everything is kept at VHDL level, the system should be pretty portable and thus a way to update old kit for custom uses.

I also plan to get a Zynq based dev board.  Current favorite is the Zybo V7 - Z20

If anyone has an interest in developing a way to make self maintenance easier and cheaper I'd like to ask you to join in this effort.

'll append a PDF with what I know so far later.

[rhb]

It's very striking how repairable at component level these things are.  Everything is just a general purpose FPGA dev board with a few extra bits added. So just knowing the major  parts gives much of the structure.

0.1"headers:
J500  1x6 (unpop on 2204)
J501 1x5 (unpop on both)
J502 2x5
J1170 1x6 (unpop on 2204)

Does anyone know anything about these?  J501 looks as if it's a JTAG used for factory programming. J502 has lots of traffic, but I haven't identified the bus types yet.

Flash:
S34ML01g100TF100 1 Gib

SDRAM:

Dual H5PS1G63JFR S6C (256MB total)

FPGA 2:
 Spartan 6 XC6SLX4 (apparently LCD and panel controls)