Sniffing the Rigol's internal I2C bus

[IanJ]

IanJ

I had the same problem as you until I realized I was not installing the clip attachments to the probes properly. Try to push them harder together and you should hear a click, very seem very solid to me once I installed them correctly

Aaaaaahhh, yes you are right........

[H.O]

I'd like to thank all the individuals working on this, great stuff!
I can herby confirm it working on a DS4014, Hardware 1.1, Firmware 00.00.03-SP1.

I used the RiGen-1 tool on Windows with the private code found in the thread, a seed of 1 and BAA9 as the option code.
All 5 options now says Official Version, they seem stuck thru soft and hard power cycles and the scopes S/N remained unchanged. And, just in case there are both 13 and 14 char S/N, mine is 13.

The only thing it didn't change was the model number and bandwidth (I didn't expect it to) but I'll keep watching the thread for that 

Again, thanks alot!

[synapsis]

If you want RiGen to change your model number, select it in the app. If you select DS2202, it'll become a DS2202.

[H.O]

Hi,
Thank you. I do realise that but, as wrote I, have a DS4000 series scope - not DS2000.

[true]

All 5 options now says Official Version

I think you should take a closer look...

[fake-name]

All 5 options now says Official Version

I think you should take a closer look...

Whoa, is that typo in the actual firmware, or is it caused by using a keygen-produced key?

Connor Wolf spreads the word via YouTube. EEVblog gets a mention.
He shows the process on a DS4000 

http://youtu.be/-Woslp7HXFM

Who will be next?

Cheers,
Phil

I hope I wasn't stepping on anyone's toes by posting that.  I tried to be really clear that I had nothing to do with the actual work, and all the credit goes to the folks on this forum.

[true]

All 5 options now says Official Version

I think you should take a closer look...

Whoa, is that typo in the actual firmware, or is it caused by using a keygen-produced key?

$ strings DS2000Update.GEL | grep Offcial
Offcial Version

[H.O]

I think you should take a closer look...

Ha, I didn't even notice that (apparently)... But if I understand trues latest post correctly it IS misspelled in the actual firmware and not caused by using the keygen. Then again, the file referenced is DS2000Update.gel while I've got a 4000 series scope but they apparently shares quite a bit of code so it's probably (hopefully) fine.

[Majorstrain]

I hope I wasn't stepping on anyone's toes by posting that.  I tried to be really clear that I had nothing to do with the actual work, and all the credit goes to the folks on this forum.

Mate, I very much doubt that you stepped on any toes, sharing info is what forums are all about.

[true]

is anyone going to jtag dump from ds2000 or ds4000? also having problems compiling the bfin stuff for IDA. (I don't do much on Windows...)

[Giorg]

Two month ago I've decided to buy an owon ds7102 ..then I came accross Dave's review of it and this thead..

And here I am with a shining Ds2072 on my bench completely unlocked.. worth every single cent of my money.. Rigol wins both hands down, absolutly no comparrison between the two instruments.

Thank you all guys for the incredible effort and for making me an happy and not bankrupted student !  O0

SW 00.01.01.00.02
HW 1.0.2.0.0

SPU 03.01.05
WPU 00.06.05
CCU 12.29.00
MCU 02.12

[bronson]

Sorry for the huge, unedited post...  Here's the summary: I tried the unlock, rendered my scope unbootable, reflashed the firmware a dozen times, prodded, poked, panicked, wasted an afternoon, and finally got things back in a decent state.  Yay.

Was it worth it?  Well, my DS2072 is fantastic as is -- I haven't needed more bandwidth or crazier triggers yet (I've only had it a few months though).  In retrospect, I probably should have waited.

But, I gotta say, it did eventually work.  This is some goddamn impressive work guys.  I'm just amazed.

And here's the post that I almost had to send...


Well this is not good...     I thought I followed the instructions carefully but now my DS2072 won't boot.

I keyed in the code and got "Option Installed!".  Then, after soft power off and back on, the scope won't finish booting -- I just get "RIGOL" on the screen forever and the little rectangles underneath quit scrolling.

I tried reflashing 00.00.01 (same as currently installed) and then the newest 00.01.01.  The reflashing succeeds but the scope still won't boot.

Anybody know if I can do a hard reset on a scope that doesn't boot and get a little functionality back?


More detail:

I used

./rikey DS2A1512XXXX3 DSAZ

.  After getting "Option Installed!" I immediately checked the Installed Options screen and everything was listed as "Official Version".  Then I checked System Info and everything looked normal:

   Model:     DS2072                            (unchanged)
   Serial:     DS2A1512XXXX3           (unchanged)
   Software Version: 00.00.01
   Hardware Version: 1.0

Then I soft powered off and back on.  The scope wouldn't boot -- just freezes at the end of the boot sequence.  I tried all combinations of letting it remain frozen for 1/2 hour, hard and soft power offs, etc...  Doesn't make any difference.

FWIW, on 00.00.01 it always freezes on the second to last square whereas 00.01.01 it always freezes on the very last square.  Can't imagine that's important but it's always consistent.

UPDATE:

After another two hours of monkeying, the scope booted!  It was on 00.01.01 at the time, after going back and forth a bunch of times.  No idea why it works now but not before -- I didn't do anything different.

At least now it boots every time.  Alas, it still thinks it's a 2072, the serial number is wiped, and the Options/Installed menu is grayed out so I guess I don't have any options, not even my 1500 remaining trial minutes.

So, shooting in the dark, figure I'll try a Security Clear.  What's the worst that could happen?

That was odd!  Now it reports as a DS2202, and 2ns is available, but the serial number is still wiped and there are still no options.

Firmware is still old so, guess I'll risk another reflash...  That worked, no option changes.

Let's try another unlock, this time with DSA9 instead of DSAZ.

Reflashing with the original serial number fails (makes sense) but ./rikey DS2A0000000001 DSA9 was accepted.  It still thinks it's a 2702 but at least now I have some options!  Guess it's time to reboot, fingers crossed...

Smashing success, it now says it's a 2202 and the 2ns timebase is unlocked.  Boots quick, all options enabled.  Beautiful!!  The serial number is still wiped but I can live with that.  Anyone have any idea what I did wrong?

So, kiss the stars and moon, I got lucky on this one.  Next time I'll read all 150 pages of this stupid thread and the First Impressions thread three times instead of just once and take notes.  Be careful out there!

(edit: split one confusing step into two clear ones)

[Orange]

DSAZ code is questionable. I have used DSA9 with no issues at all.
If you do this make very sure you use it on the latest firmware V 00.01.01.00.02.

[roli_bark]

bronson,
Seems that you didn't carefully pay attention to the explicit [many] warnings on this thread:
"BEFORE trying the keygen make SURE that your FW is uptodate ..."

[Leonard Tatzig]

Besides the fact that i just yesterday ordered a Rigol DS2072 thanks to you guys i really try to understand the way which lead to this great hack.
I hope you don't mind if i bothering you with some "beginner" questions, maybe we'll open a new thread in the beginners section for that?!
In theory you just hook up a logic analyzer, dump the ram with trail and with activated options, then use IDA to reverse engineer and hopefully come up with a solution, am i right?
But it wasn't this easy...

Thanks to andyturk, cybernet, marmad,  mojo-chan, studio25, tinhead, ve7xen and many, many more now the community has this wonderful easy solution.

Some readers here are professionals and others are not, but all of us are share the enthusiasm to hack things and i would be very proud if the guys who made this hack for us could share there knowledge, the exact way of doing this so i could write a little DIY guide of reverse engineering the scope for all the beginners who would like to understand how to do this.

Most important question for me: Witch hardware and software did you used? From the older posts i'd gues:
-Bus Pirate (version 3.6, 4?)
-IDA Pro
-Salea Logic, Logic 16? 
-maybe a Open Workbench Logic Sniffer?
-a JTAGkey-Tiny
-Arduino
-Hexeditor
more??

[olsenn]

Most important question for me: Witch hardware and software did you used? From the older posts i'd gues:
-Bus Pirate (version 3.6, 4?)
-IDA Pro
-Salea Logic, Logic 16? 
-maybe a Open Workbench Logic Sniffer?
-a JTAGkey-Tiny
-Arduino
-Hexeditor
more??

BRAINZ!

[cybernet]

BRAINZ!

not worth summing up, most stuff is dead boring, and the "finale" was somewhat surprising anyway ;-)
already got my DG4062, and i figured 160MHZ would be nize ... will probably start a new thread for it so if somebody wants to join in be there

[bronson]

There are posts in this thread saying DSAZ is problematic so definitely use DSA9, and posts saying DSAZ is more correct so don't use DSA9.  I didn't see an definite conclusion so I went with correctness.  Looks like that was a bad guess!  Also, I read on a Rigol supplier's site that my firmware, .05, was the latest so I figured they were numbered like this: 05, 03, 02...  Didn't take long to realize my mistake but by then I'd already tried the unlock.

I tried to understand all 50 pages, I really did!

Thanks Orange.  If only your clear and explicit message had been on page 49. 

Not that it matters at this point because everything is hunky dory but, just for curiosity, is there an easy way to restore the serial number?

[marmad]

not worth summing up, most stuff is dead boring, and the "finale" was somewhat surprising anyway ;-)
already got my DG4062, and i figured 160MHZ would be nize ... will probably start a new thread for it so if somebody wants to join in be there

You can get 200MHz from it.

[etc6849]

200MHz from the DG4062?  So this is confirmed (or soon to be)?

Is there anyway to unlock the waveform length or is it really only 16kpts?

[synapsis]

BRAINZ!

not worth summing up, most stuff is dead boring, and the "finale" was somewhat surprising anyway ;-)
already got my DG4062, and i figured 160MHZ would be nize ... will probably start a new thread for it so if somebody wants to join in be there

My DG4062 arrived yesterday. There doesn't seem to be a place to enter an upgrade key or anything, but I haven't had much of a chance to mess with it. I've been actually using it.

[KedasProbe]

not worth summing up, most stuff is dead boring, and the "finale" was somewhat surprising anyway ;-)
already got my DG4062, and i figured 160MHZ would be nize ... will probably start a new thread for it so if somebody wants to join in be there

They are not upgradable so there are probably some very small hardware differences, like a different resistor value for ID and/or other output filter.
Anyway I will keep an eye on what you do. (I will not void the warranty of my DG4102 though.)
It's clear that Rigol doesn't document all their SCPI commands.

[Wim13]

I have had a topic on this subject of getting 250 Mhz out of a DG4102

https://www.eevblog.com/forum/testgear/250-mhz-out-of-a-rigol-dg4102-a-100-mhz-waveform-generator/

[true]

Still having trouble on the blackfin IDA stuff...anyone have binaries?

[alank2]

Something that would still be cool is a firmware hack (now that we know we can load custom firmware) that allows going to 1 nS or even 500 pS timebase.  We know that it is possible from the fram hacking days - now just to find that byte or two in firmware that limits it to 2 nS...