I bought a cheap ($18 shipped) logic analyser from China (via AliExpress) which recently arrived in the post.  It’s a clone of the $150 Saleae Logic Analyser.  Here it is:

And here are its insides:

A rather grubby looking board.  I also noticed a couple of small solder balls which could have been shorting out a couple of the pins of the main IC, the Cypress CY7C68013A, so I removed them.  Having done some research on the Saleae Logic, the components didn’t come as much surprise.  The CY7C68013A is an 8051 microprocessor with a USB transceiver bolted on.  Logic states are read via an 8 bit wide IO port and sent back over USB to the software.  The maximum claimed sample rate is 24Mhz.

The only difference to the Saleae Logic is the addition of an HC245, an ‘Octal 3-State Noninverting Bus Transceiver’, on the back of the board.  This was probably added to try and protect the inputs of the CY7C68013A from overvoltage, but it’s ability to do so is questionable.  Still, for all intents and purposes, this clone should function exactly the same as a real Saleae Logic.

Note the 2Kb (256 byte) EEPROM on the bottom right of the final photo.  This contains configuration data for the CY7C68013A, in particular the VID/PID combination. The VID is a 16-bit vendor number (Vendor ID) and the PID is a 16-bit product number (Product ID).  This allows the product to be identified as a ‘Saleae USB Logic Analyzer’, instead of a generic CY7C68013A device.  Also, note that the EEPROM contains no firmware – the firmware is loaded over USB on startup of the logic analyser software.  This make the board itself very generic – the only thing that separates this device from many others on the market is the 4 byte VID/PID!  More on this later…

Testing the Accuracy

I installed the Saleae Logic software, plugged in the clone and it was recognised instantly.  It seemed to work!  Next, I decided to test its accuracy.  I programmed a PIC to output a periodic signal as fast as possible (the chip was clocked at 8MHz):

while(1)
{
SEROUT = 1;
SEROUT = 0;
}

I measured the output with the logic analyser first – it showed a high time of 500ns and a low time of 1500 nanoseconds.  Next I measured the signal with an oscilloscope and measured it to be exactly the same (to my eye!).  So, the accuracy certainly seems reasonable up to at least 500kHz.  (I should have tested at a higher speed, but didn’t have anything faster to hand).

Cloning Other Devices

Another product on the market, the USBee, uses exactly the same hardware.  I was aware of other clones which allowed you to select, via jumper, impersonating either a Saleae or USBee, so I wanted to see if I could do this myself.

The procedure boils down to modifying the VID/PID contained in the EEPROM mentioned earlier.  The software, e.g. Saleae Logic looks for the right VID/PID of the hardware.  If it finds the right VID/PID, it uploads the firmware and starts working.  The same can be said for the USBee software, albeit with a different VID/PID.  Now, the obvious way to change the VID/PID contained in the EEPROM in order to fake a USBee is to desolder the EEPROM, reprogram it and solder it back, but there’s a better way.

Some googling quickly led to this article, explaining how to read the EEPROM contents using the CY7C68013A (which the EEPROM is of course connected to).  So, I downloaded the Cypress EZ-USB development kit (cy3684_ez_usb_fx2lp_development_kit_15.exe) which contained the tools to allow this.

Here’s my step by step guide for doing it with Win7 x64 (note that steps 2 and 5 can be ignored on Win XP.  Infact, if you have an XP box available, it’s easier to do it on that).

1. Uninstall the Saleae Logic Driver, using Device Manager.
2. We want to install the generic cyusb.sys Cypress driver which will allow us to send commands to the device using CyConsole.  If you’re using Win XP, goto step 3. Else, download Cypress Suite USB (CySuiteUSB_3_4_7_B204.exe) which contains the Win7 x64 driver.
3. Locate the appropriate cyusb driver.  For Win 7 x64, this is: C:\Cypress\Cypress Suite USB 3.4.7\Driver\bin\wlh\x64.  For Win XP, we can use the older version of the driver, found in the Dev Kit package, here: C:\Cypress\USB\Drivers\CyUsb.
4. Open cyusb.inf.  This must be modified to contain the VID/PID of our clone (which is also the VID/PID of the Saleae Logic), so that Windows will accept and install the driver CyUSB.  So, replace all instances of USB\VID_XXXX&PID_XXXX with USB\VID_0925&PID_3881 (note that the VID/PID of the device can be found in device manager).  Also, make sure to uncomment (remove the semi-colon) the lines looking like this: “%VID_0925&PID_3881.DeviceDesc%=CyUsb, USB\VID_0925&PID_3881″.
5. If you’re Running Windows 7 (and also Vista, I think), you’ll need to force Windows to accept installing unsigned kernel drivers. To do so, restart your computer and press F8 during the boot process, as you do to start in safe-mode.  However, instead of selecting safe-mode from the boot menu, select ‘Disable Driver Signature Enforcement’. Note that this is temporary – the driver won’t remained installed after a reboot.  This is fine for our purposes.
6. Install the CyUSB driver.
7. Start CyConsole.
8. Select ‘EZ-USB Interface’ from the Options menu.
9. Press the ‘Download’ button.  This allows us to upload our own firmware.
10. Select the file C:\Cypress\USB\Examples\FX2LP\Vend_ax\Vend_Ax.hex.  You should see the firmware being uploaded and the 8051 will be reset.
11. Let’s first read our current EEPROM contents:
    • Enter ’0xA2′ into the ‘Req’ box next to the ‘Vend Req’ button.
    • Set ‘Length’ to 8
    • Make sure ‘Dir’ is set to ’1 IN’
    • Now click ‘Vend Req’. You should see 8 bytes of Hex codes starting with ‘C0′. My device read out: ‘C0 25 09 81 38 1B 00 00′.  Note the VID (09 25) and PID (38 81) are stored in little-endian format.  C0 is required by the Cypress chip.  I am unsure what 1B is for.
12. Now let’s program the VID/PID of the USBee ZX into our EEPROM:
    • Enter the bytes ’C0 A9 08 05 00 84 23 00′ into the ‘Hex Bytes’ field.
    • Now change the ‘Dir’ box to ’0 OUT’
    • Click ‘Vend Req’. The bytes written will be echoed back to the console.
13.  That’s it!  Make sure your have the USBee Suite installed along with the ZX test pod. Pull out the device, plug it back in and it should be recognised by USBee as the ZX model.

So, while not as easy as switching a few jumpers, the device can be made to look like a USBee ZX without too much effort.  I believe that the USBee driver is just a signed version of the CyUSB driver, which means that the device is recognised by CyConsole (as opposed to the Saleae driver, which seems to be modified such that the device doesn’t show up in CyConsole, hence the rigmarole of installing CyUSB above).  This means that changing back to Saleae Logic is as simple as following steps 7 to 12, but programming with our original bytes ‘C0 25 09 81 38 1B 00 00′.

If you’re constantly switching between firmwares, a better idea may be to remove the EEPROM and solder an 8 DIP socket in it’s place.  By cutting a hole in the back of the case, the EEPROM could then easily be changed.