the folks over at OpenSchemes are at it again. This time they’ve cracked open a low end ZerPlus logic analyzer and modified it to function the same as the higher end model. The 16 channel version they purchased appeared to be fully capable of handling the 32 channels of the more expensive model. The installation of the additional components looks like it might be somewhat difficult, but it is certainly cheap.We love seeing things upgraded for cheap. You might recognize OpenSchemes from when they upgraded the DMM tweezers or hacked the USB serial adapters.
[via HackedGadgets]
*headtable* Why didn’t this come out 3 days ago, I just ordered another logic analyzer, and this upgraded one would blow mine out of the water!
Thank you hackaday. Ever since this came out I had a hunch it was very hackable. Shame they had to pull the section on software modding… Anyone have a rapidshare or something?
what would one need to measure 23 channels for?
oops 32
@mrgoogfan: for that matter, what’s a logic analyzer?
if you need to ask, you probably don’t need to know all that badly.
note: sarcasm.
Does anyone have the USB id for a 32128? lsusb -v should give it to you. With that information we should be able to correctly program the EEPROM.
Thanks!
But how can you program this EEPROM?
There is an open source software project in the works
http://code.google.com/p/zerominus/
Does anyone know of a way to spoof USB on the host side through software?
There is another open source software in the works too which is supporting many different logic analyzers, the zerominus driver for the zeroplus is currently being ported to it: http://sigrok.org
Cheers Esden
This is excellent!
I’m not certain why they (excuse me, their bosses) are afraid of disclosing information they might have obtained by reverse engineering the software, or how and where to modify the EEPROM, or anything else on the matter. Reversing the software is not an issue, they are not touching copyright. Modifying the EEPROM is fine; they had no issues modifying the rest of the board. I fail to see the issue.
I am all for an open source solution though, that would blow this hack out of the water.
All of these USB oscilloscope and logic analyzer products are scams. They’re hugely over-priced. Avoid them like the plague.
You’re better off with a Bus Pirate and Open Logic Sniffer from Dangerous Prototypes. Total investment for both is less than $75 USD. There is an oscilloscope add-on for the Open Logic Analyzer in the works too.
http://dangerousprototypes.com/
I’m not affiliated with Dangerous Prototypes or SeeedStudio in any way.
Sorry, but I disagree.
Yes, you can build something low-cost. But it will have low-cost performance. Commercial analyzers offer 500MS/s with a few Megasamples of sample-depth. They offer a proper input stage and they are calibrated (which is important at such high speeds). Yes, they are $5000, and yes, that’s probably only a fraction of the costs – but still, buy a good Virtex FPGA, the fast&big SRAM, the proper interconnection/headers, and you’re at least in the $500-$1k range.
I like DIY measurement electronics, and I use them a lot. But show me the DIY oscope that goes beyond 100Mhz *and* costs less than, say, a Picoscope with the same specs.
I *do* agree on that analyzer software (modules) are totally overpriced. I can write a I2C decoder in less than 10 minutes in python, and it costs like $500 for my scope.
USBPort.dll (change device ID):
–> remove write protection of usbport.dll
old (2x): 66 c7 05 6A 77 00 10 00 00
new (2x): 66 c7 05 6A 77 00 10 0B 70 <== 700B = LAP32C128, <== 700A = LAP16C128, <== 700D = LAP32C2000
old: E8 F4 02 00 00
new: 90 90 90 90 90
old: 75 10 8B 55 F4
new: 90 90 90 90 90
The zeroplus device is a failed design. I don’t see the point of upgrading it to 32 useless channels. The problem of the Zeroplus is the shitty trigger capability. It has only one trigger level! pretty useless for any advanced project. i would rather directly buy from somewhere else.
Look at the (slightly anonymized) EEPROMs Contents of my LAPC-16128:
0x00: 12 0c 0a 70 99 ff ff ff ff ff ff ff ff ff ff ff
0x10: 1b 5a 45 52 4f 50 4c 55 53 20 54 65 63 68 6e 6f
0x20: 6c 6f 67 79 20 43 4f 2c 2e 4c 54 44 ff ff ff ff
0x30: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0x40: 24 5a 45 52 4f 50 4c 55 53 20 4c 6f 67 69 63 20
0x50: 41 6e 61 6c 79 7a 65 72 28 4c 41 50 2d 43 2d 31
0x60: 36 31 32 38 29 ff ff ff ff ff ff ff ff ff ff ff
0x70: 0f 30 30 30 30 30 39 30 36 31 5a 2d xx xx xx xx
or in ASCII
ASCII:
0x00: ÿÿ.pTÿÿÿÿÿÿÿÿÿÿÿ
0x10: .ZEROPLUS Techno
0x20: logy CO,.LTDÿÿÿÿ
0x30: ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0x40: $ZEROPLUS Logic
0x50: Analyzer(LAP-C-1
0x60: 6128)ÿÿÿÿÿÿÿÿÿÿÿ
0x70: .000009061Z-xxxx
Looks like it is very easy to change the VID / PID (0c12/700a) to other devices and correct the checksum
0x12+0x0c+0x0a+0x70 + 1(!) = 0x99 ;)
Dude. Just get a logic.
http://www.saleae.com/about/
Salae? Less channels, no RAM, limited to 24MHz and more expensive? That’s a hard sell.
@Richard Nibbler
The Saleae is a toy. It suits is purpose well for debugging simple low bandwidth circuits since people new to logic analyzers don’t have to worry about sample depth or finicky triggering, it just blasts everything to the client over usb limiting it to 24mhz.
The LAP-C is ostensibly a real logic analyzer in that it records everything to a high speed sram and then offloads that to the PC. This can be a problem for beginners but it is the only way to get sample speeds in the 100+mhz range.
This hack is amazing because it allows you to upgrade your 100 dollar 32kbit device to the 300 dollar 128kbit device by just twiddling a few values in software. If you take the time to solder all the passives in you can then turn your 100 dollar device into the 700 dollar model. Thats a DAMN good hack.
@unknown thanks for the hex dumps
So I have a question for @unknown. So, if I am seeing this right, to change a C(16032) to a C(16128) , I need to modify the USBPort.dll as per your post, and then modify the eeprom in the logic Cube to “12 0c 0a 70 99 ” where 99 is the checksum as per your other post. Is that it?
Thanks so much!
Either you change usbport.dll (you need to do this after every update of the software)
Or you change the eeprom data (you only have to do this once)
Ok Thanks – I tried the USBPort.dll mod last night and it wouldn’t recognize my C(16032) Logic Cube with the modded dll. I changed the following
old (2 places): 66 c7 05 6A 77 00 10 00 00
new (2 places): 66 c7 05 6A 77 00 10 0A 70
and then the following in one place each:
old: E8 F4 02 00 00
new: 90 90 90 90 90
old: 75 10 8B 55 F4
new: 90 90 90 90 90
Did I miss something? I tried running with the same software but no luck. Did I miss a step?
You have to download the software for C16128, install it, patch the usbport.dll in the C16128 directory and run the LogicAnalyzer.exe from the C16128 directory.
Has anybody tried this recently? Seems like there is a single piece of software for all devices. Does this hack still work?
Yes, it works!
Worked like a charm – many thanks @unknown!!
So if I use the UsbPort.dll mod, and make my C16032 a C16128, my registered protocols for the C16032 no longer work. I tried to re-register them via the C16128 software, but they fail. Any thoughts? Does anyone know if the eeprom mod also do this?
Hold on some days plase, there is a way to “re-activate” the protocols ;)
Any help on “re-activating” the protocols after doing this mod would be greatly appreciated.
OK, just modded my 16032, did a stellar soldering job. Nothing showing up on channels C1-D7. I do a check, and realize that even with the grounding traces on the back of the PCB cut, all 16 channels still show a dead short (~0 Ohms) to ground!
I can also measure it on the back of the board, between the two pads which have had the trace between them cut, and read a dead short between them. I even went as far as to remove the 245 chip to make sure that wasn’t shorting them somehow.
Halp! I know there is no way I smoked my ASIC, there were no shorts between pins, yet the last 16 channels all show short to ground. Did they get wise, and do something to the ASIC???
:'(
Well, damn it. I lifted one of the input pins on the ASIC for one of the high channels that was showing a short to ground. The short is from the ASIC.
So, they have done something to this IC to prevent the high 16 channels from being used. Any suggestions? Looks like I may be stuck with a 16128.
:'(
Btw, see
http://sigrok.org/wiki/ZEROPLUS_Logic_Cube_LAP-C
for some more PCB photos of a slightly newer version of the device (the ASIC reads “ZP322MC-5”).
The sigrok software driver is getting there slowly, you can now get some samples, but there are a few TODOs to be resolved.
Also, I should mention a new post from bushing which has more info on upgrading the device and a new command line tool for changing the device’s EEPROM:
http://lostscrews.com/viewtopic.php?f=16&t=84
HTH, Uwe.
I just bought a 16032 with the “ZP322MC-5” ASIC. I checked the input pins for the second set of 16 bits (C & D) and they are directly shorted to ground like “HALP!” mentioned.
Can someone with a “ZP322MB-5” ASIC 16032 analyzer please check the pins for ports C & D and see if they are shorted to ground? If they are not, then the new “ZP322MC-5” has the C and D ports internally shorted to ground. :-(
Hopefully this does not mean it is also not possible to upgrade the memory.
The memory upgrade should still be easily possible. I am using the full 128k x 36 with the ZP322MC-5 ASIC. I am just bummed about the last two ports.
Jaime, did you purchase yours from NKC? I am considering looking for an older model, but can’t find any other suppliers in the US. I may be stuck with what I have.
I purchased it from NKC on ebay. I will probably upgrade this to a 162000, but half the memory will be wasted anyway since not all bits will be used.
Well, that is disappointing. I’m going to look elsewhere for an older one of these units, but it looks like NKC is the only US option. If I buy one straight from China, I’ll probably just end up with the same shorted pin problem.
I purchased mine from here:
http://www.mcumall.com/comersus/store/comersus_viewItem.asp?idProduct=4313
It has the ZP322MB-5 Chip, but only has the CY7C1346H-166AXC Memory chip, but I see it is on back-order now.
@Don
Darn, they will probably order a new batch, which will have the (newer?) ASIC on them :(
I wonder if there is a way to identify these by the first part of the serial number? I assume the last 4 digits are sequential, and the first digits are more of a model/production run number or something?
Haha, all the US suppliers are selling out fast.
OK, I suspect that even though the pins for ports C-D on some models show a short to ground, there is probably still a way to make it work. Even with my model with shorted pins, it will acquire data for the upper 16 channels, they just show a low level all the time.
Someone needs to figure out how to make these ZP322MC-5 IC’s work! I am gonna keep messing with it.
This is still a sweet mod, even if you can’t get the extra 16 channels.
@Jake
The first four digits are very likely the date of a manufacturing run, I’ve seen 0906 (June 2009) and 1001 (January 2010) so far, that kinda supports the theory.
Uwe.
OK, mine is a 1001 unit. I have an 0906 unit on the way to my doorstep right now.
Uwe, have you successfully modified any 1001-marked units for 32 channels?
My first 4 digits are 0905 and it uses the ZP322MB-5 Chip as I said earlier.
I have no knowledge of how ASICs work internally, but would connecting the input pins to a voltage source cause a high amount of current to flow through and somehow burn open the internal shorts? That’s probably a long shot and might burn up something other than just the unused ports.
I just received my 16-032 with the ZP322MC-5 chip. As stated the newer ASIC is shorted (ports C-D) but the mod still works beautifully on the available ram (thankfully there still shipping a 4.5Mbit ram chip clocked at 250Mhz).
I would also like to comment on the protocols. Several people have said this mod will cause you to loose your purchased protocols, that much is true, but if you run the software for your now upgraded unit they come with most (if not all) of the protocols built in for free. Thus saving us the work of hacking the protocols to work.
@Jaime
The failure mode of diode (like what we should be seeing) as the result of some voltage transient could be a short, but judging from the other people who have reported in, I think this is the manufacturers doing.
Regardless, I’m pretty happy with a 16128, and its nice that the newer units come with the 250MHz ram.
Yesterday I bought another 16032 from:
http://microcontrollershop.com/product_info.php?products_id=3369
I called and they said their last shipment of 16032 was last September and they read me one of the serial numbers and it was 0905, so hopefully that is the one I get. They only had a few left, so good luck.
@Jaime
Haha, I did the exact same thing. Really friendly people, I’ll definitely do business with them again. When I ordered mine, she said there were only 2 left in stock. She did verify for me that they were all the 0905 date code, so I think they will work fine, all we have to do is swap in the 74 MBit memory and viola! 32200!
The protocol cost seems to vary a bunch.
The ones here:
http://microcontrollershop.com/product_info.php?products_id=3369
are 2x or more expensive than here:
http://www.mcumall.com/comersus/store/LeftStart.asp?idCategory=43
Due to some of the limitations of this logic analyzer (as compared to a “real” logic analyzer), I wonder if they sell much of the the extra protocols?
I live in Tawan, and the Zeroplus company is also in Taiwan. I aslos want to but the LAP-C 16 channel which are made before 2009 September, and I asked the sales of Zeroplus today directly. they answer me , they do not have the any stock of the 16 channel ZAP-C made before 2009 Septermber. So I think it is very difficult for us to buy buy the 16 channel ZAP-C LA made before 2009 September. The engineers who bought the 16 channel ZAP-C made before 2009 September are very lucky.
I suspect that there are still some out there, but you’d probably have to buy from outside of the country.
Got my 0905 16032 today :) Looks like this one will work :)
Yeah, I got mine Wednesday. 2nd day air FTW :P
I did the diode check, and this unit will work with all 32 channels for sure!
Notice, however, that it only has the 166MHz memory. I ordered the 200MHz 72MBit memory IC, I’ll probably made a video of me soldering that on and post it on here. I’m kind of a cheater, though… I have a hot air rework station :D