ZeroPlus Logic Cube Modification

the folks over at OpenSchemes are at it again. This time they’ve cracked open a low end ZerPlus logic analyzer and modified it to function the same as the higher end model. The 16 channel version they purchased appeared to be fully capable of handling the 32 channels of the more expensive model. The installation of the additional components looks like it might be somewhat difficult, but it is certainly cheap.We love seeing things upgraded for cheap. You might recognize OpenSchemes from when they upgraded the DMM tweezers or hacked the USB serial adapters.

[via HackedGadgets]

128 thoughts on “ZeroPlus Logic Cube Modification

  1. Thank you hackaday. Ever since this came out I had a hunch it was very hackable. Shame they had to pull the section on software modding… Anyone have a rapidshare or something?

  2. This is excellent!

    I’m not certain why they (excuse me, their bosses) are afraid of disclosing information they might have obtained by reverse engineering the software, or how and where to modify the EEPROM, or anything else on the matter. Reversing the software is not an issue, they are not touching copyright. Modifying the EEPROM is fine; they had no issues modifying the rest of the board. I fail to see the issue.

    I am all for an open source solution though, that would blow this hack out of the water.

  3. All of these USB oscilloscope and logic analyzer products are scams. They’re hugely over-priced. Avoid them like the plague.

    You’re better off with a Bus Pirate and Open Logic Sniffer from Dangerous Prototypes. Total investment for both is less than $75 USD. There is an oscilloscope add-on for the Open Logic Analyzer in the works too.

    I’m not affiliated with Dangerous Prototypes or SeeedStudio in any way.

  4. Sorry, but I disagree.

    Yes, you can build something low-cost. But it will have low-cost performance. Commercial analyzers offer 500MS/s with a few Megasamples of sample-depth. They offer a proper input stage and they are calibrated (which is important at such high speeds). Yes, they are $5000, and yes, that’s probably only a fraction of the costs – but still, buy a good Virtex FPGA, the fast&big SRAM, the proper interconnection/headers, and you’re at least in the $500-$1k range.

    I like DIY measurement electronics, and I use them a lot. But show me the DIY oscope that goes beyond 100Mhz *and* costs less than, say, a Picoscope with the same specs.

    I *do* agree on that analyzer software (modules) are totally overpriced. I can write a I2C decoder in less than 10 minutes in python, and it costs like $500 for my scope.

  5. USBPort.dll (change device ID):

    –> remove write protection of usbport.dll

    old (2x): 66 c7 05 6A 77 00 10 00 00
    new (2x): 66 c7 05 6A 77 00 10 0B 70 <== 700B = LAP32C128, <== 700A = LAP16C128, <== 700D = LAP32C2000

    old: E8 F4 02 00 00
    new: 90 90 90 90 90

    old: 75 10 8B 55 F4
    new: 90 90 90 90 90

  6. The zeroplus device is a failed design. I don’t see the point of upgrading it to 32 useless channels. The problem of the Zeroplus is the shitty trigger capability. It has only one trigger level! pretty useless for any advanced project. i would rather directly buy from somewhere else.

  7. Look at the (slightly anonymized) EEPROMs Contents of my LAPC-16128:

    0x00: 12 0c 0a 70 99 ff ff ff ff ff ff ff ff ff ff ff
    0x10: 1b 5a 45 52 4f 50 4c 55 53 20 54 65 63 68 6e 6f
    0x20: 6c 6f 67 79 20 43 4f 2c 2e 4c 54 44 ff ff ff ff
    0x30: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    0x40: 24 5a 45 52 4f 50 4c 55 53 20 4c 6f 67 69 63 20
    0x50: 41 6e 61 6c 79 7a 65 72 28 4c 41 50 2d 43 2d 31
    0x60: 36 31 32 38 29 ff ff ff ff ff ff ff ff ff ff ff
    0x70: 0f 30 30 30 30 30 39 30 36 31 5a 2d xx xx xx xx

    or in ASCII

    0x00: ÿÿ.pTÿÿÿÿÿÿÿÿÿÿÿ
    0x10: .ZEROPLUS Techno
    0x20: logy CO,.LTDÿÿÿÿ
    0x30: ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    0x40: $ZEROPLUS Logic
    0x50: Analyzer(LAP-C-1
    0x60: 6128)ÿÿÿÿÿÿÿÿÿÿÿ
    0x70: .000009061Z-xxxx

    Looks like it is very easy to change the VID / PID (0c12/700a) to other devices and correct the checksum

    0x12+0x0c+0x0a+0x70 + 1(!) = 0x99 ;)

  8. @Richard Nibbler
    The Saleae is a toy. It suits is purpose well for debugging simple low bandwidth circuits since people new to logic analyzers don’t have to worry about sample depth or finicky triggering, it just blasts everything to the client over usb limiting it to 24mhz.
    The LAP-C is ostensibly a real logic analyzer in that it records everything to a high speed sram and then offloads that to the PC. This can be a problem for beginners but it is the only way to get sample speeds in the 100+mhz range.
    This hack is amazing because it allows you to upgrade your 100 dollar 32kbit device to the 300 dollar 128kbit device by just twiddling a few values in software. If you take the time to solder all the passives in you can then turn your 100 dollar device into the 700 dollar model. Thats a DAMN good hack.

    @unknown thanks for the hex dumps

  9. So I have a question for @unknown. So, if I am seeing this right, to change a C(16032) to a C(16128) , I need to modify the USBPort.dll as per your post, and then modify the eeprom in the logic Cube to “12 0c 0a 70 99 ” where 99 is the checksum as per your other post. Is that it?

    Thanks so much!

  10. Ok Thanks – I tried the USBPort.dll mod last night and it wouldn’t recognize my C(16032) Logic Cube with the modded dll. I changed the following

    old (2 places): 66 c7 05 6A 77 00 10 00 00
    new (2 places): 66 c7 05 6A 77 00 10 0A 70
    and then the following in one place each:
    old: E8 F4 02 00 00
    new: 90 90 90 90 90

    old: 75 10 8B 55 F4
    new: 90 90 90 90 90
    Did I miss something? I tried running with the same software but no luck. Did I miss a step?

  11. So if I use the UsbPort.dll mod, and make my C16032 a C16128, my registered protocols for the C16032 no longer work. I tried to re-register them via the C16128 software, but they fail. Any thoughts? Does anyone know if the eeprom mod also do this?

  12. OK, just modded my 16032, did a stellar soldering job. Nothing showing up on channels C1-D7. I do a check, and realize that even with the grounding traces on the back of the PCB cut, all 16 channels still show a dead short (~0 Ohms) to ground!

    I can also measure it on the back of the board, between the two pads which have had the trace between them cut, and read a dead short between them. I even went as far as to remove the 245 chip to make sure that wasn’t shorting them somehow.

    Halp! I know there is no way I smoked my ASIC, there were no shorts between pins, yet the last 16 channels all show short to ground. Did they get wise, and do something to the ASIC???


  13. Well, damn it. I lifted one of the input pins on the ASIC for one of the high channels that was showing a short to ground. The short is from the ASIC.

    So, they have done something to this IC to prevent the high 16 channels from being used. Any suggestions? Looks like I may be stuck with a 16128.


  14. Btw, see

    for some more PCB photos of a slightly newer version of the device (the ASIC reads “ZP322MC-5”).

    The sigrok software driver is getting there slowly, you can now get some samples, but there are a few TODOs to be resolved.

    Also, I should mention a new post from bushing which has more info on upgrading the device and a new command line tool for changing the device’s EEPROM:

    HTH, Uwe.

  15. I just bought a 16032 with the “ZP322MC-5” ASIC. I checked the input pins for the second set of 16 bits (C & D) and they are directly shorted to ground like “HALP!” mentioned.

    Can someone with a “ZP322MB-5” ASIC 16032 analyzer please check the pins for ports C & D and see if they are shorted to ground? If they are not, then the new “ZP322MC-5” has the C and D ports internally shorted to ground. :-(
    Hopefully this does not mean it is also not possible to upgrade the memory.

  16. The memory upgrade should still be easily possible. I am using the full 128k x 36 with the ZP322MC-5 ASIC. I am just bummed about the last two ports.

    Jaime, did you purchase yours from NKC? I am considering looking for an older model, but can’t find any other suppliers in the US. I may be stuck with what I have.

  17. Well, that is disappointing. I’m going to look elsewhere for an older one of these units, but it looks like NKC is the only US option. If I buy one straight from China, I’ll probably just end up with the same shorted pin problem.

  18. @Don

    Darn, they will probably order a new batch, which will have the (newer?) ASIC on them :(

    I wonder if there is a way to identify these by the first part of the serial number? I assume the last 4 digits are sequential, and the first digits are more of a model/production run number or something?

  19. Haha, all the US suppliers are selling out fast.

    OK, I suspect that even though the pins for ports C-D on some models show a short to ground, there is probably still a way to make it work. Even with my model with shorted pins, it will acquire data for the upper 16 channels, they just show a low level all the time.

    Someone needs to figure out how to make these ZP322MC-5 IC’s work! I am gonna keep messing with it.

    This is still a sweet mod, even if you can’t get the extra 16 channels.

  20. I have no knowledge of how ASICs work internally, but would connecting the input pins to a voltage source cause a high amount of current to flow through and somehow burn open the internal shorts? That’s probably a long shot and might burn up something other than just the unused ports.

  21. I just received my 16-032 with the ZP322MC-5 chip. As stated the newer ASIC is shorted (ports C-D) but the mod still works beautifully on the available ram (thankfully there still shipping a 4.5Mbit ram chip clocked at 250Mhz).
    I would also like to comment on the protocols. Several people have said this mod will cause you to loose your purchased protocols, that much is true, but if you run the software for your now upgraded unit they come with most (if not all) of the protocols built in for free. Thus saving us the work of hacking the protocols to work.

  22. @Jaime

    The failure mode of diode (like what we should be seeing) as the result of some voltage transient could be a short, but judging from the other people who have reported in, I think this is the manufacturers doing.

    Regardless, I’m pretty happy with a 16128, and its nice that the newer units come with the 250MHz ram.

  23. @Jaime

    Haha, I did the exact same thing. Really friendly people, I’ll definitely do business with them again. When I ordered mine, she said there were only 2 left in stock. She did verify for me that they were all the 0905 date code, so I think they will work fine, all we have to do is swap in the 74 MBit memory and viola! 32200!

  24. I live in Tawan, and the Zeroplus company is also in Taiwan. I aslos want to but the LAP-C 16 channel which are made before 2009 September, and I asked the sales of Zeroplus today directly. they answer me , they do not have the any stock of the 16 channel ZAP-C made before 2009 Septermber. So I think it is very difficult for us to buy buy the 16 channel ZAP-C LA made before 2009 September. The engineers who bought the 16 channel ZAP-C made before 2009 September are very lucky.

  25. Yeah, I got mine Wednesday. 2nd day air FTW :P

    I did the diode check, and this unit will work with all 32 channels for sure!

    Notice, however, that it only has the 166MHz memory. I ordered the 200MHz 72MBit memory IC, I’ll probably made a video of me soldering that on and post it on here. I’m kind of a cheater, though… I have a hot air rework station :D

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.