The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...

[open loop]

Just adding my expereince to this issue.

I while ago I got a DS1052E cheap from eBay as it would not boot at all. It just gave a blank screen - it would not work at all!. Anyway I did the usual checks on the PSU and on board PSU test and I must thank Helene for his hardware studies on this device. Anyway after checking all of this I decided to look at the BlackFin BF532 proc and found it was set up by the BMODE pinns to read from I2C flash chip. Also checked the reset line and clock but I was confused about the zero activity on the I2C of this flash chip. Ithen got hold of a Jtag Tool (Jllink EDU) and wired as directed in previous posts - many thanks for the helpful posts on this thread for setting up Topjtag etc.

From what I now know it seems that not only does the spansion flash chip hold the Firmware for the BF532 but also for the FPGA and possibly the Lattice LCMX0256C - which i think is configured as a memory controller. Anyway when look at the first few thousand bytes of firmware all I got was FF so I thought that the Jtag was not working! so then reomved the Spansion memory chip and then used my TL086 programmer wirh the TSOP 48 adapter to read the firmware. It seem that the Jtag tool was working fine! as all of the initial bytes were at FF up to chip memory address 4FFFF so it looks like that this device had failed in doing a FW update/downgrade.

I then generated a new file joining the firmware from the Rigol forwmare update file (after removing the 21 bytes) and the 2nd half of my original Firmware downladed image. I resoldered the Spansion chi[p back onto the main board and all seemed to work (yippe). Noticed that when adjusting the V/div the trace would jump all over the place. I then re-calibrated the scope but after this it crashed in 2 mins and would not re-start. When it does re-start I was able to re-flash the firmware from USB. Anyway I think the firmware image I created was not quite right.

One interesting point I found was that if I disabled it's data aquisition by presing the run stop to stop with the red LED showing. It seemed to boot more reliably? Anyway I have now reached the limit of what I can do with this repair and I need Dreig's help as he is the person who is able to perform the required magic to the broken firmware images. tried to PM him but I totaly understand that he has a life to lead and may not visit the forum for months on end.

Just adding my 2 cents worth and hopeing that Dreig may be abe to help.

DS1052E
Board has Demo 08 so it's HW version 58
PCB version is 94V-0
Runing version 04.02.01.00 of Firmware.

[f7a7f7a7]

Dear Drieg

I am a loser update my Rigol DS1052E to 100M
Google lead me to this post when I near give up the DSO. I saw lights in dark.
My DSO's HW version is 03 with firmware 01.02 sp2 originally. Now it's partially working on 04.02.01 and 02.02.02.
Partially working meaning is boot up ok and can enter main menu, but no signal show on screen (no signal line for neither CH1/CH2)
When I do auto-calibration on firmware 04.02.01, screen is blocking on CH1 calibration screen, no moving of progress bar.
When I do auto-calibration on firmware 02.02.02, calibration will finish within 5 min, but still can't see signal line.
I also send you a PM and hope you can help save my DSO.

Thank in advance

[f7a7f7a7]

Thanks for your sharing. Appreciate very much!
Actually I already PM Drieg for long time. But ten years passed, not sure if he will go back to this blog, everybody has his own life!
So I turn to man who may have the fixed firmware for help.
Anyway, I will compare your firmware with offical one and my mem dump.
Hopes the old DSO can back to life.

[frankzam]

Good afternoon everyone, after connecting with dl ds1052e through jtag, according to the steps described in this blog, when internalizing, save the memory with the modified firmware 0.4 downloaded from pages back, at 1mhz, it records it, but when verifying it gives me verification error. Could someone with more experience advise me? Thank you so much

[Mechatrommer]

while testing my Battery Powered PSU for Portable Rigol DS1000E/Z i got a unstable condition that the DSO stopped and crashed with random color on the screen. when i restart the DSO, the CH1 trace is missing, when doing recalibration, CH2 trace is missing, now both are missing even though countless self-cal and tinkering was done. i suspect it experiences another calibration data corruption as i've experienced about 11 years ago. Drieg helped me fixed my cal corruption before and i still keep the firmware ver 2.0.2, the problem is... i've upgraded the 1052E to ver 4.2.1 sometime ago, and now it refuses to downgrade back to 2.0.2 to do the calibration repair.

but i think i will insist on downgrading to 2.0.2 because it was easier to repair in that version. so based on Drieg's OP post i have no other option than re-flashing the FW through JTAG. i've not found a way in the net to downgrade ver4 to ver2 using USB drive, i've spent many hours today try to read this thread, to recap where i was 11 years ago, and to blow the dust and setup my old knock off Segger J-Link for JTAG flashing. installed the TopJTAG and i have 20 days left to get all this done before it expires and ask for $100.

our dear friend here indicated he used J-Link Edu, but i only have knock off J-Link laying around. based on Drieg's post, i only have to connect to Blackfin's JTAG interface to access Spansion flash, so i did the minimalist connection based on ivi_yak's diagrams posted earlier, i skipped the resistor thing and connection to lattice JTAG thinking that it should be ok. turn the dso on, run the TopJTAG and try to detect the JTAG chain, unfortunately none is detected. so i'm out of trick this late night, i'm asking for help and idea on what i'm doing wrong. attached pictures are my setup.

2nd night edit: i managed to get jlink to detect the blackfin device with the following edited attachment, next thing is to figure what is the flash address and static pins means in topjtag setting  ..

hope to hear from you people thanks.

[uoemx]

Hi everyone I want to help everyone on this topic.
I would remove the flash memory and do a full flash backup using an RT809H or TL899, or similar on my machine in normal use
You load into your Rigol DS1052E, the machine will use normally. All software version serial numbers will of course be mine.
If you agree, I will back up my device and send it to you. Thread may end and this is the final solution and 100% working

[uoemx]

My machine can't adjust the trigger to make the signal stable, maybe hardware failure. Can someone tell me what to check?

Status here


here full fLASH 8Mb
https://www.mediafire.com/file/3x54qaymlws23mh/Rigol_1052E.zip/file
Firmware update 100Mhz
https://www.mediafire.com/file/0gtsusastgtheyk/Rigol_1052E_hack_100Mhz_Tested.zip/file

[malamig]

Hello!
I was able to restore my 1052E from the dump file gave by UOEMX.
FW Version now is 00.04.02.01.00
However, I cannot upgrade to 100Mhz. Maybe I need to downgrade the FW to 2.04.
I tried both thru Serial command and USB FW but no luck.

Anyway, for now I will just keep my scope running on 50Mhz. Thank you UOEMX!

[uoemx]

No problem malamig.  I have finished fixing my oscilloscope.  I have shared the diagram and the broken part, everyone can see the reference.  The diagram is here: http://rigol.codenaschen.de/index.php/Schematics. 
Here's where I did it

[prieten]

Hello, my RIGOL DS1064B oscilloscope is not working properly after the update. Does anyone have the firmware in the Flah memory S29GL064N90TFI04 for hardware version DB 4.3. I mention that after the update the USB ports are no longer functional, the only solution is to rewrite the flah memory.  Thank you in advance.