Rigol MSO2000 series hacking

[ZartPARZ]

Hi, everyone.

First, sorry to dig the old thread. I just want to contribute my experience and say thank to all people contributed in this thread.

I just got my MSO2072A scope. It come with all options except bandwidth in trial mode. The scope has 00.03.04.SP2 firmware and hardware version is 2.2. I try to hack it using information shared in this thread and susceed. All options change to never expire, including 300 MHz bandwidth. The model in system information is alsochange to MSO2302A.

This is the procedure I did:

Requirement
1. The scope, connect via LAN
2. RigolBildschirmkopie http://peter.dreisiebner.at/rigol-bildschirmkopie-lan/
3. rigup 0.4 http://www.gotroot.ca/rigol/

Procedure
1. Start RigolBildschirmkopie and find your scope (select button)
2. Dump scope memory using   :SYST:UTIL:READ? 1,33554432  (Device SCPI-Command)
3. Save data (tick "Save only informative data")
4. run rigup:   rigup ds2072a mem.bin
where ds2072a is your scope model and mem.bin is your memory dump file name, this work for my MSO2072A
5. Note the option codes (rigup generate codes with dash)
6. Send SCPI-Command to install the option you want, romove all dashes
:SYSTem:OPTion:INSTall XXXXXXXXXXXXXXXXXXXXXXXXXXXX
7. Done. Check your option in UTILITY/OPTIONS/Installed


All credits go to those who contribute in this thread.

Thank you.

[pascal_sweden]

For those who own an MSO2000 series. Can you make some YouTube videos?
At this moment there is only one YouTube video about this MSO, and I am looking for a more thorough YouTube video review.

Does the logic analyzer in the MSO2000 operate as a timing analyzer (rely on asynchronous sampling), or a state analyzer (use the system clock for sampling)? Or can it operate both as a timing analyzer and a state analyzer?

[wange]

Hi, everyone.

First, sorry to dig the old thread. I just want to contribute my experience and say thank to all people contributed in this thread.

I just got my MSO2072A scope. It come with all options except bandwidth in trial mode. The scope has 00.03.04.SP2 firmware and hardware version is 2.2. I try to hack it using information shared in this thread and susceed. All options change to never expire, including 300 MHz bandwidth. The model in system information is alsochange to MSO2302A.

This is the procedure I did:

Requirement
1. The scope, connect via LAN
2. RigolBildschirmkopie http://peter.dreisiebner.at/rigol-bildschirmkopie-lan/
3. rigup 0.4 http://www.gotroot.ca/rigol/

Procedure
1. Start RigolBildschirmkopie and find your scope (select button)
2. Dump scope memory using   :SYST:UTIL:READ? 1,33554432  (Device SCPI-Command)
3. Save data (tick "Save only informative data")
4. run rigup:   rigup ds2072a mem.bin
where ds2072a is your scope model and mem.bin is your memory dump file name, this work for my MSO2072A
5. Note the option codes (rigup generate codes with dash)
6. Send SCPI-Command to install the option you want, romove all dashes
:SYSTem:OPTion:INSTall XXXXXXXXXXXXXXXXXXXXXXXXXXXX
7. Done. Check your option in UTILITY/OPTIONS/Installed


All credits go to those who contribute in this thread.

Thank you.

Thousand thanks to you and of course both software providers! It was a 10 minute job to make me very happy.
Extrem helpfull, exact description!
Very happy to read in System Information
Model: MSO2202A (20 minutes ago was a MSO2072A)
Software Version: 00.03.04.SP2
Hardware Version: 2.2
all options permanent!

Power off, power on -> same reading!     

[Slappy_g]

Hi, everyone.

First, sorry to dig the old thread. I just want to contribute my experience and say thank to all people contributed in this thread.

I just got my MSO2072A scope. It come with all options except bandwidth in trial mode. The scope has 00.03.04.SP2 firmware and hardware version is 2.2. I try to hack it using information shared in this thread and susceed. All options change to never expire, including 300 MHz bandwidth. The model in system information is alsochange to MSO2302A.

This is the procedure I did:

Requirement
1. The scope, connect via LAN
2. RigolBildschirmkopie http://peter.dreisiebner.at/rigol-bildschirmkopie-lan/
3. rigup 0.4 http://www.gotroot.ca/rigol/

Procedure
1. Start RigolBildschirmkopie and find your scope (select button)
2. Dump scope memory using   :SYST:UTIL:READ? 1,33554432  (Device SCPI-Command)
3. Save data (tick "Save only informative data")
4. run rigup:   rigup ds2072a mem.bin
where ds2072a is your scope model and mem.bin is your memory dump file name, this work for my MSO2072A
5. Note the option codes (rigup generate codes with dash)
6. Send SCPI-Command to install the option you want, romove all dashes
:SYSTem:OPTion:INSTall XXXXXXXXXXXXXXXXXXXXXXXXXXXX
7. Done. Check your option in UTILITY/OPTIONS/Installed


All credits go to those who contribute in this thread.

Thank you.

I'm rejoining the forum after being away for a couple years, but it's great to see people still getting value from the old information.

Sent from my SM-N910T3 using Tapatalk

[TurboTom]

I recently got myself a DS2072A-S to replace a "prehistoric" TDS220  in my small "basement lab". I found it on the european Rigol clearance sales page: http://www.rigol.eu/clearance/#a_DS2072A-S

The price was quite good so I gave it a go, of course having the hacking options in the back of my mind. The instrument appeared unused but clearly had been taken out of the box before, so no problem here, just as specified in the description. Yet, directly when I powered it up, the "greyed-out" sign of the logic analyzer was displayed in the bottom row of the screen. Further tests showed it was working as expected, yet, I could select the digital inputs as trigger sources.

Since I anyway intended to swap out the multi-function encoder with a detented one, I disassembled the device and guess what I found: It countains the PCB with the fully populated MSO section (one more FPGA, all the input comparators and the corresponding "chicken food"... Even the socket that accepts the digital probe is installed.

One more thing that caught me by surprise is that the installed firmware is 00.03.05.00.01, a version that isn't available for download yet. The hack worked as described in this thread before -- thanks a lot for the nice step-by-step guide by the way!

Once the instrument was completely stripped of it´s covers (back and front), I powered it up and shorted the contacts of the logic analyzer menu button that was missing from the silicone switch membrane and of course, the menu and the LA traces popped up. So I guess after a certain "shakedown period", I´ll cut out the corresponding holes in the bezel (simple thing since there are anyway reinforced guides inside) and salvage a rubber key from an obsolete telly remote or similar scrap item. The only tricky thing might be making the LA probe set. I think I remeber someone reported the prices for a spare original one from Rigol are completely beyond reason.

Does anybody know if Rigol currently sells all their DS2072A-S with a full MSO board inside or was I just lucky to receive a "one-of-a-kind"?

Cheers,
Thomas

[Orange]

One more thing that caught me by surprise is that the installed firmware is 00.03.05.00.01, a version that isn't available for download yet. The hack worked as described in this thread before -- thanks a lot for the nice step-by-step guide by the way!

Firmware 3.05 can be downloaded from here
https://www.eevblog.com/forum/testgear/first-impressions-and-review-of-the-rigol-ds2072-ds2000-series-dso/msg997548/#msg997548

[TurboTom]

Finally I decided to make use of a grinder and converted my recently acquired DS2072A-S to a full MSO2302A-S. Opening up the slot for the parallel probe connector wasn't that difficult since it anyway had the guiding sleeve molded internally. Finding, modifying and attaching the missing "LA" key to the silicone rubber membrane caused me much more headache. But finally I found an obsolete VCR remote control with silicone buttons of the proper size that could be modified to fit the oscope's front panel half-way decently. I had the choice between the "volume" symbol or "P" for program up/down, so I went for the one with the "P" for "parallel"  .

It works perfectly well with the probe set from an MSO4000 but even though I've got that set, I'll probably make another, short one to use with this modified scope in my small basement lab. I'll have to check if I can get along with just plain ribbon cable if short enough (maybe 20cm) or if I definitely need high-impedance shielded wire. First I'll have to have a connector pcb made anyway.

Cheers,
Tom

[Gazza2]

Hello there, just wanted to let you guys know that I did not have any success with my new DS2072A with software version: 00.03.05.SP1 and hardware version 2.3 using the LAN method as rigup0.4 cant find any keys in the memory dump

[Daruosha]

Hello there, just wanted to let you guys know that I did not have any success with my new DS2072A with software version: 00.03.05.SP1 and hardware version 2.3 using the LAN method as rigup0.4 cant find any keys in the memory dump

Could you take a successful memory dump with RigolBildschirmkopie tool?

[Gazza2]

Hello there, just wanted to let you guys know that I did not have any success with my new DS2072A with software version: 00.03.05.SP1 and hardware version 2.3 using the LAN method as rigup0.4 cant find any keys in the memory dump

Could you take a successful memory dump with RigolBildschirmkopie tool?

 Yes that worked no problems

[Daruosha]

Hello there, just wanted to let you guys know that I did not have any success with my new DS2072A with software version: 00.03.05.SP1 and hardware version 2.3 using the LAN method as rigup0.4 cant find any keys in the memory dump

Could you take a successful memory dump with RigolBildschirmkopie tool?

 Yes that worked no problems

And what command did you use to generate the keys? does it show any error or the generated keys cannot be accepted by scope? Give us some more troubleshooting details and perhaps I can help.

[Gazza2]

Hello there, just wanted to let you guys know that I did not have any success with my new DS2072A with software version: 00.03.05.SP1 and hardware version 2.3 using the LAN method as rigup0.4 cant find any keys in the memory dump

Could you take a successful memory dump with RigolBildschirmkopie tool?

 Yes that worked no problems

And what command did you use to generate the keys? does it show any error or the generated keys cannot be accepted by scope? Give us some more troubleshooting details and perhaps I can help.

 I used rigup ds2073A memoryDump.scpi It comes up with Scanning 'memoryDump.scpi' failed: No keys

[Gazza2]

Just to help I used zor01's instructions from https://www.eevblog.com/forum/testgear/unlockinghacking-the-rigol-ds2000a-series-scope-the-short-post/100/

[Daruosha]

My suggestion is to upload your memory dump and send me link to download, I can investigate and check it out and see where the problem is, perhaps

[jps379]

I would like to say thank you to all the great people who worked to make this possible! My MSO2072A is now reporting to be a MSO2302A.

The MSO2702A came with the free options (using Rigol webpage to obtain a key) and
Software version 00.03.04.SP2
Hardware version 2.3

The steps i used were as below
1) Initially installed the key for all the options as provided by Rigol website (this is optional but i did it first anyway)
2) Connected to scope via LAN using RigolBildschirmkopie
3) Used RigolBildschirmkopie to dump the memory and saved to file
4) Used rigup 0.4 with the following command "rigup ds2072a memorydumpfile"

this resulted in 4 keys for:

a) all options, no bandwidth upgrade
b) all options, bandwidth 100MHz
c) all options, bandwidth 200MHz
d) all options, bandwidth 300MHz

5) I entered key d manually using the onscreen keyboard
6) Success !!!!

Thanks!

[AlphaRomeo]

Hi, everyone.

First, sorry to dig the old thread. I just want to contribute my experience and say thank to all people contributed in this thread.

I just got my MSO2072A scope. It come with all options except bandwidth in trial mode. The scope has 00.03.04.SP2 firmware and hardware version is 2.2. I try to hack it using information shared in this thread and susceed. All options change to never expire, including 300 MHz bandwidth. The model in system information is alsochange to MSO2302A.

This is the procedure I did:

Requirement
1. The scope, connect via LAN
2. RigolBildschirmkopie http://peter.dreisiebner.at/rigol-bildschirmkopie-lan/
3. rigup 0.4 http://www.gotroot.ca/rigol/

Procedure
1. Start RigolBildschirmkopie and find your scope (select button)
2. Dump scope memory using   :SYST:UTIL:READ? 1,33554432  (Device SCPI-Command)
3. Save data (tick "Save only informative data")
4. run rigup:   rigup ds2072a mem.bin
where ds2072a is your scope model and mem.bin is your memory dump file name, this work for my MSO2072A
5. Note the option codes (rigup generate codes with dash)
6. Send SCPI-Command to install the option you want, romove all dashes
:SYSTem:OPTion:INSTall XXXXXXXXXXXXXXXXXXXXXXXXXXXX
7. Done. Check your option in UTILITY/OPTIONS/Installed


All credits go to those who contribute in this thread.

Thank you.

Indeed, it works like a champ!  My brand new DS2072A now it says: DS2308A, all options installed, never expires. This is sweet. Thanks a million!  I'll buy the beers.  My only question is: will the scope hack survive a firmware update? 

[MrFox]

Indeed, it works like a champ!  My brand new DS2072A now it says: DS2308A, all options installed, never expires. This is sweet. Thanks a million!  I'll buy the beers.  My only question is: will the scope hack survive a firmware update?

Updating after the hack worked for me:
DS2072A
Software 03.04.SP2
Hardware 2.3

Used rigolbildschirmkopie to get the memory dump across LAN.
Then I used rigup 0.4 to get the keys (0.4.2 doesn't work), and I entered the 300MHz key manually.

After that I updated to 03.05.00.01 without losing anything.

[AlphaRomeo]

Updating after the hack worked for me:
DS2072A
Software 03.04.SP2
Hardware 2.3

Used rigolbildschirmkopie to get the memory dump across LAN.
Then I used rigup 0.4 to get the keys (0.4.2 doesn't work), and I entered the 300MHz key manually.

After that I updated to 03.05.00.01 without losing anything.

It survived, thanks a lot for your time.

[Cariad61]

Hi, everyone.

First, sorry to dig the old thread. I just want to contribute my experience and say thank to all people contributed in this thread.

I just got my MSO2072A scope. It come with all options except bandwidth in trial mode. The scope has 00.03.04.SP2 firmware and hardware version is 2.2. I try to hack it using information shared in this thread and susceed. All options change to never expire, including 300 MHz bandwidth. The model in system information is alsochange to MSO2302A.

This is the procedure I did:

Requirement
1. The scope, connect via LAN
2. RigolBildschirmkopie http://peter.dreisiebner.at/rigol-bildschirmkopie-lan/
3. rigup 0.4 http://www.gotroot.ca/rigol/

Procedure
1. Start RigolBildschirmkopie and find your scope (select button)
2. Dump scope memory using   :SYST:UTIL:READ? 1,33554432  (Device SCPI-Command)
3. Save data (tick "Save only informative data")
4. run rigup:   rigup ds2072a mem.bin
where ds2072a is your scope model and mem.bin is your memory dump file name, this work for my MSO2072A
5. Note the option codes (rigup generate codes with dash)
6. Send SCPI-Command to install the option you want, romove all dashes
:SYSTem:OPTion:INSTall XXXXXXXXXXXXXXXXXXXXXXXXXXXX
7. Done. Check your option in UTILITY/OPTIONS/Installed


All credits go to those who contribute in this thread.

Thank you.

I just cant get this to unlock the 300MHz bandwidth  with my DS2202A.  I have successfully achieved all options.

I have tried the NS8H code and the NS8N code generation, but all return licence not available.

I am on Current Software Version is 00.03.04.SP2

I have also tried entering the codes manually.

Any help much appreciated.

Paul

[window69]

hello,
i have just updated my new DS2072A with success using the next procedure:
software version: 00.03.05
hardware version: 2.3

    Connect your oscilloscope to your LAN
    Find out its IP address:
     Utility button, IO Setting, LAN Set.
    Download and install Rigol Bildschirmkopie LAN/USB
    Go in the Device/Select... menu and connect to your scope.
    Use the program to perform a memory dump.
     This is done through the Device/SCPI-Command... menu
    Do not forget to press "save" to write the memory dump file
     (name it DS2072A_sdram.bin)
    Install the DS2000A Upgrade utility.
     I got it from http://gotroot.ca/rigol/DS2000A_Upgrade_Utility_1_0_0_1_Installer.exe
    Copy the memory dump file to the upgrade utility install folder
    (usually C:\Program Files (x86)\DS2000A Upgrade Utility)
    In a windows command prompt, cd to the upgrade utility folder.
    Run the rigup command to extract your scope's private keys:
    rigup scan DS2072A_sdram.bin > EC-keys.txt
    Run the rigup command again to generate your option keys:
    rigup DS2072A DS2072A_sdram.bin > Options.txt
    Open the Options.txt file and choose a key that you want to use. You can either use your scope's interface to enter the key or use Rigol Bildschirmkopie LAN/USB to  send an SCPI command to install the options. I used the program to save time as the Rigol's onscreen keyboard is slow. If you opt to use the SCPI command, remove the dashes from the chosen key.
    Return to Rigol Bildschirmkopie LAN/USB and create a new SCPI command:
    :SYST:OPT:INSTALL A_KEY_FROM_OPTIONS_WITHOUT_DASHES

it was a big task to surge for the right procedure, because there are a lot of different ways witch will work or not.
so you know this worked for me!
now i have to test if everything is working fine!
if i run into some trouble, i will let you know.
thanks everyone for providing the necessary tools to do this.

[Blisk]

Is it still possible to upgrade MSO2072A to all options and 300MHz??
As I read somewhere it is some new hardware in it.

[dawid_m]

Another MSO2072A hacked!.
I can confirm - it is still possible. I have just hacked new MSO2072A purchased yesterday from authorized distributor to MSO2302A (all options unblocked)!
Software version: 00.03.05.SP1
Hardware version: 2.3

Thank you all for contribution to this thread and for providing necessary tools to upgrade scope so easily. 

[Blisk]

After buying Siglent I see now I should buy rigol and hack it.

[colorado.rob]

After buying Siglent I see now I should buy rigol and hack it.

If your needs are met with 2 analog channels, it's not a bad option.  Just remember, part of the cost difference between the 100MHz version and 200MHz version is in the more expensive 350MHz probes.  If you hack your scope and intend to use if for signals above 100MHz, you still need to buy probes designed of operating at that frequency.

[Blisk]

yes, but with rigol I get logic probes with oscilloscope and all can be unlocked.
With siglent I need to pay about half of price of oscilloscope.