Low Cost PCB's Low Cost Components

Author Topic: Sniffing the Rigol's internal I2C bus  (Read 1346952 times)

0 Members and 3 Guests are viewing this topic.

Offline IanJ

  • Frequent Contributor
  • **
  • Posts: 713
  • Country: scotland
  • Pro EE guy many years ago, now it's a hobby.
    • IanJohnston.com
Re: Sniffing the Rigol's internal I2C bus
« Reply #700 on: July 28, 2013, 06:08:22 AM »
IanJ

I had the same problem as you until I realized I was not installing the clip attachments to the probes properly. Try to push them harder together and you should hear a click, very seem very solid to me once I installed them correctly

Aaaaaahhh, yes you are right........ ::)
 

Offline H.O

  • Frequent Contributor
  • **
  • Posts: 528
  • Country: se
Re: Sniffing the Rigol's internal I2C bus
« Reply #701 on: July 28, 2013, 07:11:24 AM »
I'd like to thank all the individuals working on this, great stuff!
I can herby confirm it working on a DS4014, Hardware 1.1, Firmware 00.00.03-SP1.

I used the RiGen-1 tool on Windows with the private code found in the thread, a seed of 1 and BAA9 as the option code.
All 5 options now says Official Version, they seem stuck thru soft and hard power cycles and the scopes S/N remained unchanged. And, just in case there are both 13 and 14 char S/N, mine is 13.

The only thing it didn't change was the model number and bandwidth (I didn't expect it to) but I'll keep watching the thread for that  ;)

Again, thanks alot!
 

Offline synapsis

  • Regular Contributor
  • *
  • Posts: 139
  • Country: us
    • Blackcow
Re: Sniffing the Rigol's internal I2C bus
« Reply #702 on: July 28, 2013, 08:50:13 AM »
If you want RiGen to change your model number, select it in the app. If you select DS2202, it'll become a DS2202.
 

Offline H.O

  • Frequent Contributor
  • **
  • Posts: 528
  • Country: se
Re: Sniffing the Rigol's internal I2C bus
« Reply #703 on: July 28, 2013, 02:14:22 PM »
Hi,
Thank you. I do realise that but, as wrote I, have a DS4000 series scope - not DS2000.
 

Offline true

  • Frequent Contributor
  • **
  • Posts: 290
  • Country: us
  • INTERNET
Re: Sniffing the Rigol's internal I2C bus
« Reply #704 on: July 28, 2013, 02:42:24 PM »
All 5 options now says Official Version

I think you should take a closer look...
 

Offline fake-name

  • Regular Contributor
  • *
  • Posts: 74
Re: Sniffing the Rigol's internal I2C bus
« Reply #705 on: July 28, 2013, 02:46:13 PM »
All 5 options now says Official Version

I think you should take a closer look...

Whoa, is that typo in the actual firmware, or is it caused by using a keygen-produced key?

Connor Wolf spreads the word via YouTube. EEVblog gets a mention.
He shows the process on a DS4000  :clap:



Who will be next?

Cheers,
Phil

I hope I wasn't stepping on anyone's toes by posting that.  I tried to be really clear that I had nothing to do with the actual work, and all the credit goes to the folks on this forum.
« Last Edit: July 28, 2013, 02:47:45 PM by fake-name »
 

Offline true

  • Frequent Contributor
  • **
  • Posts: 290
  • Country: us
  • INTERNET
Re: Sniffing the Rigol's internal I2C bus
« Reply #706 on: July 28, 2013, 03:28:18 PM »
All 5 options now says Official Version
I think you should take a closer look...
Whoa, is that typo in the actual firmware, or is it caused by using a keygen-produced key?
$ strings DS2000Update.GEL | grep Offcial
Offcial Version
 

Offline H.O

  • Frequent Contributor
  • **
  • Posts: 528
  • Country: se
Re: Sniffing the Rigol's internal I2C bus
« Reply #707 on: July 28, 2013, 04:01:27 PM »
Quote
I think you should take a closer look...
Ha, I didn't even notice that (apparently)... But if I understand trues latest post correctly it IS misspelled in the actual firmware and not caused by using the keygen. Then again, the file referenced is DS2000Update.gel while I've got a 4000 series scope but they apparently shares quite a bit of code so it's probably (hopefully) fine.
 

Offline Majorstrain

  • Contributor
  • Posts: 38
Re: Sniffing the Rigol's internal I2C bus
« Reply #708 on: July 28, 2013, 06:47:36 PM »
I hope I wasn't stepping on anyone's toes by posting that.  I tried to be really clear that I had nothing to do with the actual work, and all the credit goes to the folks on this forum.

Mate, I very much doubt that you stepped on any toes, sharing info is what forums are all about.
 

Offline true

  • Frequent Contributor
  • **
  • Posts: 290
  • Country: us
  • INTERNET
Re: Sniffing the Rigol's internal I2C bus
« Reply #709 on: July 29, 2013, 09:00:13 AM »
is anyone going to jtag dump from ds2000 or ds4000? also having problems compiling the bfin stuff for IDA. (I don't do much on Windows...)
« Last Edit: July 29, 2013, 09:50:40 AM by true »
 

Offline Giorg

  • Contributor
  • Posts: 14
  • Country: it
    • G--labs
Re: Sniffing the Rigol's internal I2C bus
« Reply #710 on: July 30, 2013, 12:53:29 AM »
Two month ago I've decided to buy an owon ds7102 ..then I came accross Dave's review of it and this thead..

And here I am with a shining Ds2072 on my bench completely unlocked.. worth every single cent of my money.. Rigol wins both hands down, absolutly no comparrison between the two instruments.

Thank you all guys for the incredible effort and for making me an happy and not bankrupted student !  :clap: O0

SW 00.01.01.00.02
HW 1.0.2.0.0

SPU 03.01.05
WPU 00.06.05
CCU 12.29.00
MCU 02.12
 

Offline bronson

  • Regular Contributor
  • *
  • Posts: 172
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #711 on: July 30, 2013, 05:04:42 PM »
Sorry for the huge, unedited post...  Here's the summary: I tried the unlock, rendered my scope unbootable, reflashed the firmware a dozen times, prodded, poked, panicked, wasted an afternoon, and finally got things back in a decent state.  Yay.

Was it worth it?  Well, my DS2072 is fantastic as is -- I haven't needed more bandwidth or crazier triggers yet (I've only had it a few months though).  In retrospect, I probably should have waited.

But, I gotta say, it did eventually work.  This is some goddamn impressive work guys.  I'm just amazed.

And here's the post that I almost had to send...



Well this is not good...   :-BROKE  I thought I followed the instructions carefully but now my DS2072 won't boot.

I keyed in the code and got "Option Installed!".  Then, after soft power off and back on, the scope won't finish booting -- I just get "RIGOL" on the screen forever and the little rectangles underneath quit scrolling.

I tried reflashing 00.00.01 (same as currently installed) and then the newest 00.01.01.  The reflashing succeeds but the scope still won't boot.

Anybody know if I can do a hard reset on a scope that doesn't boot and get a little functionality back?


More detail:

I used
./rikey DS2A1512XXXX3 DSAZ
.  After getting "Option Installed!" I immediately checked the Installed Options screen and everything was listed as "Official Version".  Then I checked System Info and everything looked normal:


   Model:     DS2072                            (unchanged)
   Serial:     DS2A1512XXXX3           (unchanged)
   Software Version: 00.00.01
   Hardware Version: 1.0


Then I soft powered off and back on.  The scope wouldn't boot -- just freezes at the end of the boot sequence.  I tried all combinations of letting it remain frozen for 1/2 hour, hard and soft power offs, etc...  Doesn't make any difference.

FWIW, on 00.00.01 it always freezes on the second to last square whereas 00.01.01 it always freezes on the very last square.  Can't imagine that's important but it's always consistent.

UPDATE:

After another two hours of monkeying, the scope booted!  It was on 00.01.01 at the time, after going back and forth a bunch of times.  No idea why it works now but not before -- I didn't do anything different.

At least now it boots every time.  Alas, it still thinks it's a 2072, the serial number is wiped, and the Options/Installed menu is grayed out so I guess I don't have any options, not even my 1500 remaining trial minutes.

So, shooting in the dark, figure I'll try a Security Clear.  What's the worst that could happen?

That was odd!  Now it reports as a DS2202, and 2ns is available, but the serial number is still wiped and there are still no options.

Firmware is still old so, guess I'll risk another reflash...  That worked, no option changes.

Let's try another unlock, this time with DSA9 instead of DSAZ.

Reflashing with the original serial number fails (makes sense) but ./rikey DS2A0000000001 DSA9 was accepted.  It still thinks it's a 2702 but at least now I have some options!  Guess it's time to reboot, fingers crossed...

Smashing success, it now says it's a 2202 and the 2ns timebase is unlocked.  Boots quick, all options enabled.  Beautiful!!  The serial number is still wiped but I can live with that.  Anyone have any idea what I did wrong?

So, kiss the stars and moon, I got lucky on this one.  Next time I'll read all 150 pages of this stupid thread and the First Impressions thread three times instead of just once and take notes.  Be careful out there!

(edit: split one confusing step into two clear ones)
« Last Edit: July 31, 2013, 01:35:52 AM by bronson »
 

Offline Orange

  • Frequent Contributor
  • **
  • Posts: 272
  • Country: nl
Re: Sniffing the Rigol's internal I2C bus
« Reply #712 on: July 30, 2013, 05:34:47 PM »
DSAZ code is questionable. I have used DSA9 with no issues at all.
If you do this make very sure you use it on the latest firmware V 00.01.01.00.02.
 

Offline roli_bark

  • Regular Contributor
  • *
  • Posts: 170
Re: Sniffing the Rigol's internal I2C bus
« Reply #713 on: July 30, 2013, 06:19:10 PM »
bronson,
Seems that you didn't carefully pay attention to the explicit [many] warnings on this thread:
"BEFORE trying the keygen make SURE that your FW is uptodate ..."
 

Offline Leonard Tatzig

  • Contributor
  • Posts: 5
  • Country: de
Re: Sniffing the Rigol's internal I2C bus
« Reply #714 on: July 30, 2013, 08:16:42 PM »
Besides the fact that i just yesterday ordered a Rigol DS2072 thanks to you guys i really try to understand the way which lead to this great hack.
I hope you don't mind if i bothering you with some "beginner" questions, maybe we'll open a new thread in the beginners section for that?!
In theory you just hook up a logic analyzer, dump the ram with trail and with activated options, then use IDA to reverse engineer and hopefully come up with a solution, am i right?
But it wasn't this easy...

Thanks to andyturk, cybernet, marmad,  mojo-chan, studio25, tinhead, ve7xen and many, many more now the community has this wonderful easy solution.

Some readers here are professionals and others are not, but all of us are share the enthusiasm to hack things and i would be very proud if the guys who made this hack for us could share there knowledge, the exact way of doing this so i could write a little DIY guide of reverse engineering the scope for all the beginners who would like to understand how to do this.

Most important question for me: Witch hardware and software did you used? From the older posts i'd gues:
-Bus Pirate (version 3.6, 4?)
-IDA Pro
-Salea Logic, Logic 16? 
-maybe a Open Workbench Logic Sniffer?
-a JTAGkey-Tiny
-Arduino
-Hexeditor
more??
 

Offline olsenn

  • Frequent Contributor
  • **
  • Posts: 997
Re: Sniffing the Rigol's internal I2C bus
« Reply #715 on: July 30, 2013, 11:35:04 PM »
Quote
Most important question for me: Witch hardware and software did you used? From the older posts i'd gues:
-Bus Pirate (version 3.6, 4?)
-IDA Pro
-Salea Logic, Logic 16? 
-maybe a Open Workbench Logic Sniffer?
-a JTAGkey-Tiny
-Arduino
-Hexeditor
more??


BRAINZ!
 

Offline cybernet

  • Regular Contributor
  • *
  • Posts: 246
  • Country: 00
  • pm deactivated, use the search function ...
Re: Sniffing the Rigol's internal I2C bus
« Reply #716 on: July 31, 2013, 12:47:16 AM »
BRAINZ!
:-+

not worth summing up, most stuff is dead boring, and the "finale" was somewhat surprising anyway ;-)
already got my DG4062, and i figured 160MHZ would be nize ... will probably start a new thread for it so if somebody wants to join in be there ;)
___________________
"all rights reversed :-)"
R0=-0x18;
UNLINK;
RTS;
 

Offline bronson

  • Regular Contributor
  • *
  • Posts: 172
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #717 on: July 31, 2013, 01:17:38 AM »
There are posts in this thread saying DSAZ is problematic so definitely use DSA9, and posts saying DSAZ is more correct so don't use DSA9.  I didn't see an definite conclusion so I went with correctness.  Looks like that was a bad guess!  Also, I read on a Rigol supplier's site that my firmware, .05, was the latest so I figured they were numbered like this: 05, 03, 02...  Didn't take long to realize my mistake but by then I'd already tried the unlock.

I tried to understand all 50 pages, I really did!

Thanks Orange.  If only your clear and explicit message had been on page 49.  :)

Not that it matters at this point because everything is hunky dory but, just for curiosity, is there an easy way to restore the serial number?
 

Offline marmad

  • Super Contributor
  • ***
  • Posts: 2986
  • Country: aq
    • DaysAlive
Re: Sniffing the Rigol's internal I2C bus
« Reply #718 on: July 31, 2013, 02:05:07 AM »
not worth summing up, most stuff is dead boring, and the "finale" was somewhat surprising anyway ;-)
already got my DG4062, and i figured 160MHZ would be nize ... will probably start a new thread for it so if somebody wants to join in be there ;)

You can get 200MHz from it.
 

Offline etc6849

  • Contributor
  • Posts: 19
Re: Sniffing the Rigol's internal I2C bus
« Reply #719 on: July 31, 2013, 02:34:06 AM »
200MHz from the DG4062?  So this is confirmed (or soon to be)? :)

Is there anyway to unlock the waveform length or is it really only 16kpts?
 

Offline synapsis

  • Regular Contributor
  • *
  • Posts: 139
  • Country: us
    • Blackcow
Re: Sniffing the Rigol's internal I2C bus
« Reply #720 on: July 31, 2013, 02:37:16 AM »
BRAINZ!
:-+

not worth summing up, most stuff is dead boring, and the "finale" was somewhat surprising anyway ;-)
already got my DG4062, and i figured 160MHZ would be nize ... will probably start a new thread for it so if somebody wants to join in be there ;)

My DG4062 arrived yesterday. There doesn't seem to be a place to enter an upgrade key or anything, but I haven't had much of a chance to mess with it. I've been actually using it. :)
 

Offline KedasProbe

  • Frequent Contributor
  • **
  • Posts: 460
  • Country: be
Re: Sniffing the Rigol's internal I2C bus
« Reply #721 on: July 31, 2013, 04:01:00 AM »
not worth summing up, most stuff is dead boring, and the "finale" was somewhat surprising anyway ;-)
already got my DG4062, and i figured 160MHZ would be nize ... will probably start a new thread for it so if somebody wants to join in be there ;)
They are not upgradable so there are probably some very small hardware differences, like a different resistor value for ID and/or other output filter.
Anyway I will keep an eye on what you do. (I will not void the warranty of my DG4102 though.)
It's clear that Rigol doesn't document all their SCPI commands.
Not everything that counts can be measured. Not everything that can be measured counts.
[W. Bruce Cameron]
 

Offline Wim13

  • Regular Contributor
  • *
  • Posts: 225
  • Country: nl
Re: Sniffing the Rigol's internal I2C bus
« Reply #722 on: July 31, 2013, 04:26:12 AM »

I have had a topic on this subject of getting 250 Mhz out of a DG4102

http://www.eevblog.com/forum/testgear/250-mhz-out-of-a-rigol-dg4102-a-100-mhz-waveform-generator/
 

Offline true

  • Frequent Contributor
  • **
  • Posts: 290
  • Country: us
  • INTERNET
Re: Sniffing the Rigol's internal I2C bus
« Reply #723 on: July 31, 2013, 09:21:18 AM »
Still having trouble on the blackfin IDA stuff...anyone have binaries?
 

Offline alank2

  • Super Contributor
  • ***
  • Posts: 1708
Re: Sniffing the Rigol's internal I2C bus
« Reply #724 on: July 31, 2013, 10:56:33 AM »
Something that would still be cool is a firmware hack (now that we know we can load custom firmware) that allows going to 1 nS or even 500 pS timebase.  We know that it is possible from the fram hacking days - now just to find that byte or two in firmware that limits it to 2 nS...
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf