Saleae Logic Analyser Clone Teardown and Reprogramming

I bought a cheap ($18 shipped) logic analyser from China (via AliExpress) which recently arrived in the post.  It’s a clone of the $150 Saleae Logic Analyser.  Here it is:

And here are its insides:

A rather grubby looking board.  I also noticed a couple of small solder balls which could have been shorting out a couple of the pins of the main IC, the Cypress CY7C68013A, so I removed them.  Having done some research on the Saleae Logic, the components didn’t come as much surprise.  The CY7C68013A is an 8051 microprocessor with a USB transceiver bolted on.  Logic states are read via an 8 bit wide IO port and sent back over USB to the software.  The maximum claimed sample rate is 24Mhz.

The only difference to the Saleae Logic is the addition of an HC245, an ‘Octal 3-State Noninverting Bus Transceiver’, on the back of the board.  This was probably added to try and protect the inputs of the CY7C68013A from overvoltage, but it’s ability to do so is questionable.  Still, for all intents and purposes, this clone should function exactly the same as a real Saleae Logic.

Note the 2Kb (256 byte) EEPROM on the bottom right of the final photo.  This contains configuration data for the CY7C68013A, in particular the VID/PID combination. The VID is a 16-bit vendor number (Vendor ID) and the PID is a 16-bit product number (Product ID).  This allows the product to be identified as a ‘Saleae USB Logic Analyzer’, instead of a generic CY7C68013A device.  Also, note that the EEPROM contains no firmware – the firmware is loaded over USB on startup of the logic analyser software.  This make the board itself very generic – the only thing that separates this device from many others on the market is the 4 byte VID/PID!  More on this later…

Testing the Accuracy

I installed the Saleae Logic software, plugged in the clone and it was recognised instantly.  It seemed to work!  Next, I decided to test its accuracy.  I programmed a PIC to output a periodic signal as fast as possible (the chip was clocked at 8MHz):

while(1)
{
SEROUT = 1;
SEROUT = 0;
}

I measured the output with the logic analyser first – it showed a high time of 500ns and a low time of 1500 nanoseconds.  Next I measured the signal with an oscilloscope and measured it to be exactly the same (to my eye!).  So, the accuracy certainly seems reasonable up to at least 500kHz.  (I should have tested at a higher speed, but didn’t have anything faster to hand).

Cloning Other Devices

Another product on the market, the USBee, uses exactly the same hardware.  I was aware of other clones which allowed you to select, via jumper, impersonating either a Saleae or USBee, so I wanted to see if I could do this myself.

The procedure boils down to modifying the VID/PID contained in the EEPROM mentioned earlier.  The software, e.g. Saleae Logic looks for the right VID/PID of the hardware.  If it finds the right VID/PID, it uploads the firmware and starts working.  The same can be said for the USBee software, albeit with a different VID/PID.  Now, the obvious way to change the VID/PID contained in the EEPROM in order to fake a USBee is to desolder the EEPROM, reprogram it and solder it back, but there’s a better way.

Some googling quickly led to this article, explaining how to read the EEPROM contents using the CY7C68013A (which the EEPROM is of course connected to).  So, I downloaded the Cypress EZ-USB development kit (cy3684_ez_usb_fx2lp_development_kit_15.exe) which contained the tools to allow this.

Here’s my step by step guide for doing it with Win7 x64 (note that steps 2 and 5 can be ignored on Win XP.  Infact, if you have an XP box available, it’s easier to do it on that).

  1. Uninstall the Saleae Logic Driver, using Device Manager.
  2. We want to install the generic cyusb.sys Cypress driver which will allow us to send commands to the device using CyConsole.  If you’re using Win XP, goto step 3. Else, download Cypress Suite USB (CySuiteUSB_3_4_7_B204.exe) which contains the Win7 x64 driver.
  3. Locate the appropriate cyusb driver.  For Win 7 x64, this is: C:\Cypress\Cypress Suite USB 3.4.7\Driver\bin\wlh\x64.  For Win XP, we can use the older version of the driver, found in the Dev Kit package, here: C:\Cypress\USB\Drivers\CyUsb.
  4. Open cyusb.inf.  This must be modified to contain the VID/PID of our clone (which is also the VID/PID of the Saleae Logic), so that Windows will accept and install the driver CyUSB.  So, replace all instances of USB\VID_XXXX&PID_XXXX with USB\VID_0925&PID_3881 (note that the VID/PID of the device can be found in device manager).  Also, make sure to uncomment (remove the semi-colon) the lines looking like this: “%VID_0925&PID_3881.DeviceDesc%=CyUsb, USB\VID_0925&PID_3881″.
  5. If you’re Running Windows 7 (and also Vista, I think), you’ll need to force Windows to accept installing unsigned kernel drivers. To do so, restart your computer and press F8 during the boot process, as you do to start in safe-mode.  However, instead of selecting safe-mode from the boot menu, select ‘Disable Driver Signature Enforcement’. Note that this is temporary – the driver won’t remained installed after a reboot.  This is fine for our purposes.
  6. Install the CyUSB driver.
  7. Start CyConsole.
  8. Select ‘EZ-USB Interface’ from the Options menu.
  9. Press the ‘Download’ button.  This allows us to upload our own firmware.
  10. Select the file C:\Cypress\USB\Examples\FX2LP\Vend_ax\Vend_Ax.hex.  You should see the firmware being uploaded and the 8051 will be reset.
  11. Let’s first read our current EEPROM contents:
    • Enter ’0xA2′ into the ‘Req’ box next to the ‘Vend Req’ button.
    • Set ‘Length’ to 8
    • Make sure ‘Dir’ is set to ’1 IN’
    • Now click ‘Vend Req’. You should see 8 bytes of Hex codes starting with ‘C0′. My device read out: ‘C0 25 09 81 38 1B 00 00′.  Note the VID (09 25) and PID (38 81) are stored in little-endian format.  C0 is required by the Cypress chip.  I am unsure what 1B is for.
  12. Now let’s program the VID/PID of the USBee ZX into our EEPROM:
    • Enter the bytes ’C0 A9 08 05 00 84 23 00′ into the ‘Hex Bytes’ field.
    • Now change the ‘Dir’ box to ’0 OUT’
    • Click ‘Vend Req’. The bytes written will be echoed back to the console.
  13.  That’s it!  Make sure your have the USBee Suite installed along with the ZX test pod. Pull out the device, plug it back in and it should be recognised by USBee as the ZX model.

So, while not as easy as switching a few jumpers, the device can be made to look like a USBee ZX without too much effort.  I believe that the USBee driver is just a signed version of the CyUSB driver, which means that the device is recognised by CyConsole (as opposed to the Saleae driver, which seems to be modified such that the device doesn’t show up in CyConsole, hence the rigmarole of installing CyUSB above).  This means that changing back to Saleae Logic is as simple as following steps 7 to 12, but programming with our original bytes ‘C0 25 09 81 38 1B 00 00′.

If you’re constantly switching between firmwares, a better idea may be to remove the EEPROM and solder an 8 DIP socket in it’s place.  By cutting a hole in the back of the case, the EEPROM could then easily be changed.

9 thoughts on “Saleae Logic Analyser Clone Teardown and Reprogramming

  1. Hi,

    I’m trying to follow your instructions, but am stuck at step 10. There’s no C:CypressUSB folder after installing the CySuiteUSB software. The directory structure is C:CypressCypress Suite USB 3.4.7. There’s no FX2LP subfolder anywhere in that directory tree as far as I can tell. Help would be appreciated.

    Thanks,
    Carsten

  2. Ok, had to install the cy3684_ez_usb_fx2lp_development_kit_15.exe first. Maybe that step should be included in the list. Also, the path to the hex file is now C:Cypress – USB – CY3684_EZ-USB_FX2LP_DVK – 1.0 – Firmware – Vend_ax

    (replace ‘-’ with the path seperator)

    Maybe this will help people to get it to work more quickly. Thanks for putting this info together. The USBee AX Pro clone works now with Logic.

  3. After Installing this today, in step 10 the directory should be as stated above by Carsten.

    To install the right software search for the names above and download the ~50MB installer, it should do the trick just fine.

    Great otherwise.
    thanks!

  4. Hi,
    I bought a very cheap clone with “USbee” stamped on it and thanks to the great info here I modified it to a Saleae clone. Works great !
    Also my device has a 74HC245 buffer at the inputs and I discovered that this is not a nice solution. This 74HC245 chip is powered with 3.3V coming from a 3.3V regulator. So far nothing wrong with this, HC technology can be powered from 2 to 6 volts and the buffer will provide (a little) ESD protection for the inputs.
    So what is my point?
    Well, this chip will work O.K when you connect its inputs to a DUT with 3.3V logic. But connecting it to a DUT which has 5V logic can give some serious problems. When I connected one of the inputs to a 5V high signal (’1′) , I saw the analyzer taking a current of 7mA out of my 5V source !! This is not what you want: you want an analyzer with “high impedance inputs” for all signals from 0 – 5V ! The cause is the buffer being a HC type. When HC technology is powered from 3.3V one should NOT feed the inputs with a 5V level ! When using HC technology, the maximum input signal level should NOT exceed Vcc + 0.5V ! (see specs )
    If you ignore this, the chip will take a lot of current and can break down. In my analyzer the current is limited because series resistors of 100 ohms were used. So the chip will not break down, but we can not call this “5V tolerant inputs” because it will act as a heavy load for our connected DUT when signals rise above 3.3V.
    ( note that the Cypress microcontroller ITSELF is 5V tolerant ! )
    So for a DUT with 3.3V logic levels the analyzer is O.K, for a DUT with 5V logic it will NOT offer high impedance inputs when input levels come above 3.3V !

    There are some solutions for this problem.
    1. Remove the 74HC245 and connect its inputpads to the output pads.
    This is an option because the Cypress microcontroller itself is 5V tolerant.
    But now the pins of the microcontroller are directly coupled to the world outside with no kind of protection at all. Maybe not a good idea….

    2. You can modify the pcb tracks in such way that the 74HC245 will be powered from the 5V USB voltage. This will work O.K when connected to a 5V logic DUT, but now in contrast we can get in trouble when we connect a DUT with 3.3V logic: the level of the high (’1′) signal from the 3.3V DUT is maybe not always quite high enough now for being a logic ‘1’ for the 74HC245 inputs…. Not so reliable.
    But adding a select switch to choose the Vcc of the existing 74HC245 chip between 5V of the USB or 3.3V from the regulator could be an option. But the housing is very small and maybe you have to put the PCB in a larger box then.

    3. You can connect an extra 5V tolerant buffer chip to the inputs of the analyzer.
    This can be a 74LCX245 or equivalent, which is 5V tolerant with its Vcc connected to the 3.3V regulator. You will need a bigger box to add this extra chip and a new connector to the testleads. You will have extra timedelay at the inputs which is not wanted, but probably will not give serious problems.

    4. You can REPLACE the 74HC245 chip with a 74LCX245 or equivalent, which is 5V tolerant when its Vcc = 3.3V This will be the best solution using the original box now and the analyzer will have nice high impedance inputs for ALL signal levels from 0 to 5V. This modification calls for good eyes and no shaking hands but is the best option. I made this modification using all kinds of magnifying glasses and with losing a lot of sweat, but I am very satisfied now!

    I heard there are all kinds of these logic analyser clones on the market. So beware that your hardware can be DIFFERENT from my one, having other input circuitry !
    Overall, all these devices are good value for money and it is worth the trouble to do some work to make them really usefull. But it has to be your hobby to do all this.
    If you don’t want all this trouble, buy yourself a decent Saleae analyzer. They have excellent hardware, much better built and in a very nice enclosure.

  5. Well, I just flashed an USBee clone to identify as a Saleae logic using the FX3 Linux software cyusb.

    One word of warning for anyone stumbling over the post in the future: The cyusb GUI thing is horribly broken and will mess up your device if you don’t modify the source. The “Hex” text field converts the data into ASCII before writing to the EEPROM and thinks of the data as a string, i.e. it stops when it encounters a 0×00. And the FX2 inside the device resets the vendor/product ID to a generic FX2 one when it sees less than 8 bytes written.

    What I did is modify gui_src/main.cpp:1041, basically hardcoding the data I want it to write in there. Not beautiful, but works.

    Apart from that, I also modified the vendor ID that shows up several times in the sources to match the USBee clone, otherwise cyusb doesn’t detect the device in the first place.

  6. Thank you so much for this walk-through!

    I wanted to reprogram the USBee clone from dealextreme/dx.com (sku: 148945) to be used with the Saleae software, since the USBee software doesn’t work on OSX.

    I had an old XP laptop that I could use to install the cypress driver, but I had some issues and wanted to share what I did.

    First of all, when you go from USBee to Saleae, the cypress driver needs to be adjusted to the correct PID/VID values in step 4. (not the ones mentioned here!). I read out my PID/VID by going to the device manager, right click on the unknown USB device and get the Hardware ID in the Details tab. Oddly enough, sometimes it wasn’t recognized at all by Windows.

    I also tried installing the driver by simply clicking right > Install on the .inf file, but that didn’t work. When I installed it by going to the device manager and then manually installing and selecting the .inf field there, I was able to install the driver.

    My PID was 1400, VID A908. The corresponding read out value in the Cypress software was C0 A9 08 14 00 00 1B 00.

    I set it to C0 25 09 81 38 1B 00 00 in step 12 (same as the ‘original value’ from the Saleae clone above), and the device was properly recognized by the Saleae Logic software on my mac.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>