Difference between revisions of "Link Instruments MSO-19"
| Line 20: | Line 20: | ||
It's just serial-over-USB, supported by the Linux kernel through the '''[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blob;f=drivers/usb/serial/cp210x.c;h=8d7731dbf478f9592d8dff350374dc6375649c44;hb=HEAD cp210x]''' driver, though as of Kernel 2.6.37 it needs to be patched to recognize the Link Instruments Vendor/Product ID ('''3195:f190'''). | It's just serial-over-USB, supported by the Linux kernel through the '''[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blob;f=drivers/usb/serial/cp210x.c;h=8d7731dbf478f9592d8dff350374dc6375649c44;hb=HEAD cp210x]''' driver, though as of Kernel 2.6.37 it needs to be patched to recognize the Link Instruments Vendor/Product ID ('''3195:f190'''). | ||
iSerial was exploited by Link Instruments to store | iSerial was exploited by Link Instruments to store hardware type, hardware revision, calibration quirks and the actual serial number. | ||
*for an iSerial of 4294333650260000000 we have: | |||
**42943 336 502 6 0 000000 | |||
***vbit = 42943 / 10000 | |||
***dacoffset = 336 | |||
***offsetrange = 502 | |||
***hwmodel = 6 | |||
***hwrev = 0 | |||
***serial number = 000000 | |||
== Serial protocol == | == Serial protocol == | ||
Revision as of 01:19, 8 January 2011
The Link Instruments MSO-19 is a 2GSa/s oscilloscope, 200MSa/s logic analyzer, 100MSa/s pattern generator and a TDR. It is also extremely portable and is only $249 (including probe, clips, wires and software).
See Link Instruments MSO-19/Info for more details (such as lsusb -vvv output) about the device.
Hardware
Original software
Link Instruments ships the product with its FrontPanelTM Oscilloscope software. Software is for Windows only. Written in .NET (C#), without any kind of obfuscation, which makes it a real breeze to reverse engineer.
USB protocol
It's just serial-over-USB, supported by the Linux kernel through the cp210x driver, though as of Kernel 2.6.37 it needs to be patched to recognize the Link Instruments Vendor/Product ID (3195:f190).
iSerial was exploited by Link Instruments to store hardware type, hardware revision, calibration quirks and the actual serial number.
- for an iSerial of 4294333650260000000 we have:
- 42943 336 502 6 0 000000
- vbit = 42943 / 10000
- dacoffset = 336
- offsetrange = 502
- hwmodel = 6
- hwrev = 0
- serial number = 000000
- 42943 336 502 6 0 000000
Serial protocol
- Control message
- Fixed header: 0x40, 0x4c, 0x44, 0x53, 0x7e
- Variable size payload, 16bit aligned
- Looks like each 16bits of payload are a register write operation
- register writes are 4bits for addr, 8 bits for value, 2 unused bits and 2 bits im not sure what they are for :)
- .?12 AAAA .?34 5678
- Conversion is: ((v & 0x3f) | ((v & 0xc0) << 6) | ((a & 0xf) << 8) | (((v ^ 0x20) & 0x20) << 1) | (((v ^ 0x80) & 0x80) << 7))
- Byte order is big endian
- Fixed footer: 0x7e