EEVblog Electronics Community Forum

EEVblog => EEVblog Specific => Topic started by: drieg on September 28, 2010, 09:14:31 am

Title: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: drieg on September 28, 2010, 09:14:31 am
The purpose of this thread is to help/support people with their broken Rigol DS1052E scope.

The most common problem is totally dead scope after unsuccessful firmware "downgrade/upgrade". The only way to recover it is to reprogramm the flash chip (Spansion S29GL064N90TFI04) either via BlackFins's JTAG interface or in external programmer. There is very important part inside the flash with the factory calibration data, which is unique to every unit. These data has to be preserved in a new flash image for proper operation.

Second common issue is partially working scope, which doesn't shows signals correctly after a 100MHz patch (see story of shafri and others for details). These problems are caused by corrupted factory calibraion data which may get corrupted probably when patching via serial cable (especially if you accidentally hit the ENTER instead of sending correct <LF> char). This is the reason, why I strongly recommend: DO NOT USE SERIAL CABLE!

Some people ask me about how to hack scope HW version "xy", FW version "xx.xx.xx". The fact is, that different firmware supports different HW version, so there is always some risk when you are running the FW that doesn't support your HW version. Please don't ask me if it's safe to downgrade to FW 02.02, if you have HW version "57" or "58" - I don't know

Here's the table which FW supports which HW. Higher FW supports all older HW versions.
HW version    FW version
58
00.02.04.01.00
57
00.02.04.00.03
07
00.02.02.02.00


WARNING: Do not experiment with undocumented SCPI commands especially if you don't know the correct syntax. You can corrupt or lost some of imortant calibraion data!


Repair history
repair date        model        (nick)name              details
08/28/2010 DS1052E lynx / SE bricked after unsuccessful FW upgrade
10/08/2010 DS1052E dimlow / UK corrupted calibration data (same as shafri: problem description (http://www.rcgroups.com/forums/showthread.php?t=1222045&page=3#33))
10/08/2010 DS1052E shafri (Mechatrommer) corrupted calibration data (problem description (http://www.rcgroups.com/forums/showthread.php?t=1222045))
09/20/2010 DS1052E jasper / US bricked after unsuccessful FW upgrade
09/26/2010 DS1052E Ben / AU bricked after unsuccessful FW upgrade
10/26/2010 DS1052E Viktor / BY bricked after unsuccessful FW upgrade
10/27/2010 DS1052E Giovambattista / IT bricked after unsuccessful FW upgrade
11/02/2010 DS1052E mainer / AT bricked after unsuccessful FW upgrade
11/03/2010 DS1052E Larry / US bricked after unsuccessful FW upgrade
11/22/2010 DS1052E Peter / AU bricked after unsuccessful FW upgrade
11/23/2010 DS1052E teixeluis corrupted calibration data (problem description (https://www.eevblog.com/forum/index.php?topic=553.msg24179#msg24179))
01/03/2011 DS1102E Mohammad / IR bricked after unsuccessful FW upgrade
02/02/2011 DS1052E Chris / US bricked after unsuccessful FW upgrade
02/03/2011 DS1052E Mel / UK bricked after unsuccessful FW upgrade
02/06/2011 DS1102E Marlon / US bricked after unsuccessful FW upgrade
02/11/2011 DS1052E nasser32 corrupted calibration data (same as shafri: problem description (http://www.rcgroups.com/forums/showthread.php?t=1222045&page=4#60))
02/21/2011 DS1052E Brian/ US bricked after unsuccessful FW upgrade
03/09/2011 DS1052E David / AU bricked after unsuccessful FW upgrade
04/28/2011 DS1052E Denis / RU bricked after unsuccessful FW upgrade
05/05/2011 DS1052E Hans / NL bricked after unsuccessful FW upgrade
06/01/2011 DS1052D Rob / NL corrupted calibration data 
06/29/2011 DS1052E Andres / ES bricked after unsuccessful FW upgrade
10/01/2011 DS1052E Ray / UK bricked after unsuccessful FW upgrade
10/16/2011 DS1052E Jeremy / AU corrupted calibration data 
10/17/2011 DS1052E Doug / US corrupted calibration data 
11/24/2011 DS1052E Aleksandr / RU bricked after unsuccessful FW upgrade
04/10/2012 DS1052E Rob / UK corrupted calibration data 
...
02/11/2019 DS1052E Bruzzel / DE wrong firmware flashed
02/17/2019 DS1042C Taras / UA bricked after unsuccessful FW upgrade
02/21/2019 DS1302CA ivi_yak / UA wrong firmware flashed
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: dimlow on September 28, 2010, 11:10:17 am
Well Drieg has certainly got my hopes up, yesterday i required a scope, so i used my Uni-T UT81B, but it didn't quite meet my needs. Cant look at a 20Mhz signal with a 10Mhz Scope! BTW i love this little meter for when im poking about with micro controllers on a breadboard. I guess a should post my views of it in the UT81B thread.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: nebarnix on September 28, 2010, 02:11:30 pm
 :o Drieg, you have really helped me out! I got the chip back yesterday and I think I soldered it back in record time. I couldn't wait to assemble to scope properly and left the power supply hanging off of the table. Guess what, the scope is alive again!! Thank you!!

To everyone else. my scope was broken when I attempted to upgrade the firmware. I Upgraded, rebooted, and them bam... nothing. Blank. I will admit we had a few beers as an old friend was in town so I was sure that somehow I had put the wrong image on the flash drive. I checked and rechecked but all seemed in order. Its not even my scope so it was somewhat embarrassing to do this in front of a bunch of people including the owner of the scope and have to say "Oh sorry... guess you don't have a scope anymore!".

After trying unsuccessfully for several months with a blackfin programmer and a half-built homebrew programmer in VHDL I met Drieg and I sent my poor blank spansion flash chip off to go see Europe and start a new life there. After becoming sufficiently cultured it crossed the Atlantic once more (I believe that it was quite homesick) and it is perfect working condition!  Thanks so much Drieg! I am lucky that the factory calibration data was not erased  :D

-Nebarnix
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Waifian on September 28, 2010, 03:04:38 pm
Quote
Second common issue is partially working scope, which doesn't shows signals correctly after a 100MHz patch (see story of shafri and others for details). These problems are caused by corrupted factory calibraion data which may get corrupted probably when patching via serial cable (especially if you accidentally hit the ENTER instead of sending correct <LF> char). Currently I'm working on a solution how to correct these data without the need of even opening the scope;)
Would that include a square wave frome a function generator that appeared as a sine wave on the rigol scope. I didn't know what to think. I am still not sure if it was the function generator or the scope as the scope seems okay... I did run the recalibration tool a few times because I also had the issue of the vertical system being wierd at the 5volt per division mark. It was about a volt below ground with nothing connected and seemed to be the worst at the 5volt per division area. After recalibrating it again it seems okay.... I am not sure if my scope is shoddy now or not...   ???
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: armandas on September 28, 2010, 03:42:32 pm
i deleted my previous comment, its nonsense!
pls keep this thread clean guys!

What about all other threads in this forum, shafri? ;)
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: NiHaoMike on September 28, 2010, 11:02:55 pm
Maybe read the calibration data, keep a backup in a safe place, and just try randomly changing values to see what they do? Not much to lose if it's already unusable.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: dimlow on September 29, 2010, 12:20:32 pm
I Just thought id bump this tread as Drieg has updated his first post asking for help. He needs that data for my scope and id love to get it fixed, so please if you have one of the scopes get in contact.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: yyao on October 02, 2010, 03:55:13 pm
Like I said in the other thread (https://www.eevblog.com/forum/index.php?topic=553.msg18626#msg18626 (https://www.eevblog.com/forum/index.php?topic=553.msg18626#msg18626)), this was the situation I was in:

Although it doesn't provide you with an unusable scope, it is kind of annoying.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: d0ss on October 04, 2010, 01:57:52 pm
Like I said in the other thread (https://www.eevblog.com/forum/index.php?topic=553.msg18626#msg18626 (https://www.eevblog.com/forum/index.php?topic=553.msg18626#msg18626)), drieg has a way to fix your scope if you have one that:
  • Came with firmware 2.04 SP1
  • Has been downgraded to firmware 2.02 SP2 for changing the model number
  • Exhibits repetitive noise at high sampling rates after self calibration
  • Cannot be upgraded to 2.04 SP1 (because the firmware isn't available to the public yet)

Just post your problem on this thread and drieg or someone else may be able to assist you.


I've got the same issue as above, and would love to get it fixed. I've tried asking Rigol for the 2.04 SP1 firmware no reply as of yet. Serial starts with DS1ED123, I would appreciate any help given. Thanks
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Polossatik on October 04, 2010, 06:23:04 pm
I have a DS1ED121xxxxxx scope , if you ever need info from that serial range, let me know.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Zap on October 07, 2010, 01:25:25 pm
Drieg has helped me endlessly in my quest to fix my CRO. We have not got there currently ( but that's totally through my lack of skills).

I hope one day i get to buy him a beer and thank him in person because he has helped me so much with advice and personal time and effort. Its so nice to see that there is genuinely fantastic people out there.

If i manage to get it working again i will name thee "Driegol 1053E enhanced" :)
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: dimlow on October 07, 2010, 04:28:08 pm
Yep drieg is one of the good guys. Im hoping to have my scope sorted soon. Without him id be stuck with this dead scope for ever.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: wolen on October 08, 2010, 08:02:41 pm
Dear drieg at I too have spoiled Rigol DS1052E by attempt to change firmware with E on D. >:(
Write please in detail how to restore firmware by a simple way.
At inclusion the white screen. Whether necessarily to take a microcircuit?
Send if it is possible firmware for the chip
I live in Russia, English I know poorly, excuse.
wolend1@mail.ru
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: wolen on October 09, 2010, 10:05:41 am
Dear  drieg I have bought in China (mail) Rigol DS1052E
He well worked.
I have read http: // embedders.org/content/kak-iz-rigol-ds10 52e-sdelat-rigol-ds1102e and has made it.
It has turned out. He well worked. (large difference has not noticed except for 2 n?/d and DS1052E - DS1102E) :)
Then I have tried to change firmware DS1052D in DS1052E through WINHEX and to stitch to her.
It has turned out. He well worked. (nothing has changed except for DS1102E - DS1052D) (LA has not appeared:)) ;D
Then I have tried to replace firmware from another (Not Rigol) I any more do not remember what, it seems and to stitch it(him).
The size firmware was 6 mbytes (on Rigol 4 mbytes)
Has failed. ???? ???????? has passed, I have switched off ??????????? and has switched on it(him) the simply light screen has appeared. There is no reaction to buttons. >:(
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: dimlow on October 09, 2010, 10:43:39 am
@Shafi

Yes. Drieg has sent me the fix for my scope, i have tested it and it seems to be working. I still need to test some more. I did start some further tests and i was going to test it against my 400Mhz HP54502A scope, but when i turned on my old reliable, she is no longer reliable. It popped up with Calibration Memory checksum error. So i spent quite a few hours trying to recalibrate it and failing, it seems that the old HP is dead now  ???

Anyway one thing i noticed is that the rigol, when presented with the same waveform on each channel gives different voltage levels. They differ by about .2 Volts. Although the scope does seem to be working, i think accuracy has been lost in the vertical axis.

Further tests and I will report back.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: drieg on October 09, 2010, 08:57:47 pm
@wolen
I can help you, but you have to desolder the flash chip and send it to me for reprogramming. If you don't have a good hot air rework station around or you are not skilled or brave enough to do it, you can also send me the whole mainboard. PM sent.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: wolen on October 10, 2010, 09:41:51 am
Large thanks Dear Drieg!
I shall send by mail you mine mainboard.
I hope that mine Rigol DS1052E will work.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Mechatrommer on October 10, 2010, 10:28:35 am
my rigol is fixed now. the vertical offsets that i was report about?... its now gone! my rigol is working 100% fine right now. i'm glad that i have my scope back. Thanx Drieg!
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: xoom on October 10, 2010, 10:34:51 am
Nice to hear that :) now anyone can more freely breathe if they brick their scope :)
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: saturation on October 10, 2010, 05:18:30 pm
Great!  Thanks to Drieg, there is hope!  A great start to a full recovery for bricked scopes.

Why is this thread a thumbs down? Its probably the only published solution for a failed hack.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: dimlow on October 10, 2010, 06:20:45 pm
Big Thanks to Drieg, Im satisfied that my scope is now working within spec, Another great fix, Your the man,
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Zap on October 19, 2010, 04:01:45 pm
Thanks to Drieg i now (once again) have a scope.... not only a scope but a 100MHz scope.

I totally bricked it, did a poor job of de-soldering the chip ( i thought i would give him a challenge) he fixed the chip however due to my pin abuse i did not managed to re-solder it.
Drieg then went out of his way to re-program another chip for me and send it around the world to Aus and shazam it now works. The amount of effort and advice he has given me is amazing i will be forever in debt of his kindness, the Driegol 1052E enhanced now lives!

Thank you so much!
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: suppersready on October 20, 2010, 08:33:49 am
Like others, i have bricked my DS1052E trying to downgrade the firmware from 02.04.01.02 to 02.02.02

What happens if i send back it to the seller for repairing, my scope is on warranty.

If it's a bad idea i will send the board to you Drieg.

(sorry for my english i am italian)

Thanks drieg for the great job
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Zero999 on October 20, 2010, 10:27:12 am
I would assume performing hacks like this will void any warranty so do it at your own risk and preferably after the warranty period has expired otherwise you have to take responsibility for repairing it.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Mechatrommer on October 20, 2010, 03:02:24 pm
I would assume performing hacks like this will void any warranty so do it at your own risk and preferably after the warranty period has expired otherwise you have to take responsibility for repairing it.
i dont think sending legitimate RS232/USB command will void the warranty. for me, it shouldnt. even if we feed with random data, the scope should be well protected from that, as proven by Drieg sometime ago, RS232 comm is not so reliable, so meaning the Rigol design got flaw.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: dimlow on October 20, 2010, 04:06:58 pm
I wonder if someone should approach Rigol and just ask them how they stand on this. It would be interesting to see what they have to say about the hack/ undocumented feature. Its obvious that they know about it.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Mechatrommer on October 20, 2010, 05:17:53 pm
I wonder if someone should approach Rigol and just ask them how they stand on this. It would be interesting to see what they have to say about the hack/ undocumented feature. Its obvious that they know about it.
i bet they wont reply. thats their "pant". and they know we keep peeping it, and so they will be busy try covering it. they forgot... thats the thing that makes us interested at them. ;)
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: drieg on October 20, 2010, 05:19:03 pm
@suppersready
If you purchased it from China, then sending the mainboard to me will be surely cheaper & faster solution (I'm from EU too). Drop me an email if you need my help...
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Fraser on October 20, 2010, 09:03:33 pm
In my experience manufacturers take a dim view of any attempted 'hack' of an equipments BIOS. They can probably see what was being attempted by the legacy corrupted data that remains in the memory chip  :( That is not to say that they will not repair it but in every case I have seen, the manufacturer has charged either an administration/handling fee or a 'calibration' fee. Neither is cheap and I have seen charges of between GBP50 and GBP400 quoted for such work. As soon as the OS memory area is corrupted by a user, the warranty is effectively invalidated as this is considered self inflicted unless proven otherwise. I agree that the user should not be able to accidentally damage the 1052E via RS232 but lets not kid ourselves..... Rigol knows that users are regularly attempting to hack the BIOS via this port so I doubt anyone would succeed in convincing them it was an accident.

Many manufacturers refuse to issue firmware updates. I have asked some why this is and had a similar response in each case "we do not wish to handle fault calls from users who have corrupted their equipments firmware due to poor practice or procedure". Such companies will often suggest that a firmware upgrade is normally required only if a problem exists that a later FW version fixes and the equipment should be sent to them for update and calibration.... Credit Card number please...... :'(

OT but relevant ...... I own an ICOM PCR1000 monitoring receiver that uses an unprotected EEPROM containing unique and very important calibration data. It was found that third party control software could and did corrupt the EEPROM data by accident and in an unpredictable fashion. ICOM never admitted any liability in the UK or USA and charged a hefty re-calibration fee. Their view was that the user shouldn't be messing with 3rd party software or the proprietary command set.

Drieg is probabably the only person who can help with a bricked Rigol and we are fortunate indeed that he wishes to use his time to help others.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: beerhunter on October 20, 2010, 09:24:13 pm
I wonder if someone should approach Rigol and just ask them how they stand on this. It would be interesting to see what they have to say about the hack/ undocumented feature. Its obvious that they know about it.

I actually asked the sales engineer at Rigolna about fixing a bricked scope and they said sure they can fix it but your warranty is shot and whats you credit card number? He also said they know all about the mod and told me to be very careful doing it as he knew what I was doing to it. He was very nice though.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: sonicj on October 21, 2010, 07:20:44 pm
manufacturers shouldn't take offense to customers trying to make better use of their products, they should take note! if the thing was perfect, people (most) wouldn't be dickin' around in the insides. "ohh, well apparently no-ones uses our product the way we thought they would and everyone thinks our user interface is garbage" etc.

i got greedy with my spektrum dx7 transmitter. 20 hours of runtime between charges wasn't enough (first gen w/nicads was 4hr) so i replaced the lm317 with a recom 7803 switching regulator. everything went great! until.... i was measuring current consumption of the new regulator and instead of flipping the unit off with the switch, i pulled the probe off the contact. whammy! blew out the eprom. the switch hard cuts power to eprom where as pulling the probe (battery) lets voltage slowly sag over about 5 seconds which apparently kills the thing.

im going for the good customer approach... im sending it back with 3 other genuine warranty claim items. hopefully they won't ream me a new one!
-sj
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Time on October 21, 2010, 07:23:14 pm
PC LOAD LETTER!?  WHAT THE ^&%* DOES THAT MEAN!?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: TheDirty on October 22, 2010, 12:14:41 pm
(http://www.applegazette.com/wp-content/uploads/office-space-copier.jpeg)
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: sonicj on October 22, 2010, 07:21:06 pm
well, the funny thing is the costumes :D if they are wearing the EEVBlog T-Shirt, that will become slightly a different picture. i was about to do that with my Rigol before Drieg comes to rescue.
you haven't seen The Best Movie Evaar? (http://www.imdb.com/title/tt0151804/)
-sj
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: marianoapp on October 22, 2010, 10:23:40 pm
you haven't seen The Best Movie Evaar? (http://www.imdb.com/title/tt0151804/)
the company where I work is certifying the ISO 9000 (http://en.wikipedia.org/wiki/ISO_9000) standards for quality management systems, so I'm gonna be filling TPS-like reports in no time  >:(
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: drieg on October 23, 2010, 08:23:40 am
Please guys, no off-topic in here. I'd like to keep this thread useful and small as possible...
Thanks  ;)
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: .o:0|O|0:o. on October 23, 2010, 05:12:13 pm
In my experience manufacturers take a dim view of any attempted 'hack' of an equipments BIOS.

Then again, if you consider how popular the DS1052E has become as a consequence of being (not-so-)easily upgradable, how many have been purchased, destroyed or repaired (and the business that follows), and how the Rigol name now fills the eBay columns, Internet pages and the wet dreams of nerds world wide, you might be forced to conclude that if the "weakness" were intentional, "it well worked" as a pretty successful marketing strategy!

.o:0| 8) |0:o.


Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: suppersready on November 04, 2010, 10:04:41 pm
Hi all,

Drieg revived my Rigol scope after an unsuccesfully firmware update.


Thank you Drieg
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Meiner on November 06, 2010, 06:21:49 pm
Hi All,

a while ago I reported about bricking my DS1052E while attempting to downgrade. I then had some tries of my own to fix it, but then I bought a second scope and lost track of the bricked one, because I was frustrated and busy with my project for which I use the scope.
Thanks to Drieg it's today alive again. Another Driegol enhanced.... Thank you very much, Drieg!!!
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: tyblu on November 07, 2010, 07:07:00 pm
Could someone of repute, one we can trust to transfer the funds, setup a Paypal donation account for Dreig?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: watermeary2 on November 08, 2010, 03:55:59 am
   
The Dark Side of the Rigol Hack,it is very useful,thanks
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Polossatik on November 08, 2010, 11:50:08 am
Could someone of repute, one we can trust to transfer the funds, setup a Paypal donation account for Dreig?

The best person to do that is Drieg :)
If you're in the Euro zone then simply ask him his IBAN account nr (do not post it somewhere) and transfer what you want.
In contrast to Paypickpocket (for a $1 donation he will get only $0.67) it will mean that he get actually the amount you transfer and not amount minus    2.2% + $0.30 costs.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: drieg on November 09, 2010, 12:15:31 pm
Could someone of repute, one we can trust to transfer the funds, setup a Paypal donation account for Dreig?

The best person to do that is Drieg :)
If you're in the Euro zone then simply ask him his IBAN account nr (do not post it somewhere) and transfer what you want.
In contrast to Paypickpocket (for a $1 donation he will get only $0.67) it will mean that he get actually the amount you transfer and not amount minus 2.2% + $0.30 costs.
Thanks guys for bringing up this topic.

I don't charge anything for my help or repair service, only the postage is to pay (if sending a flash chip is necessary). Of course, there is some work behind it, so if someone whom I helped with his broken scope offers me a small donation, then cool, I gladly provide my paypal account info. I must say, usually people are nice in this regard and most of them already donated me after we managed to fix their problem. Anyway, this is something totally voluntary and of course I'll help to anyone who is in trouble regardless of that. However, anybody who will support my development will not regret ;)
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: dimlow on November 09, 2010, 05:36:01 pm
I have to admit i forgot to send him something, will be doing very soon.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: webrider99 on November 10, 2010, 02:46:48 am
Looking forward to an unopened box brick fix. I am still awaiting my scope delivery and am hoping not to need this fix but will donate to help get this fix accomplished even if I never need it..
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: teixeluis on November 17, 2010, 12:09:00 am
Hi Drieg,

I have reported an issue I'm having, in this topic:

https://www.eevblog.com/forum/index.php?topic=553.255 (https://www.eevblog.com/forum/index.php?topic=553.255)

I'm woundering if given the type of behaviour experienced, upgrading to FW 2.04 SP1 could be the solution in this case, considering that the HW version is unknown (it is blank after the
hack), and that the factory FW version was 2.02 SP2.

Is it possible to dump the full flash through JTAG? With a dump of the flash you could attempt a correction?

Thank you.

Regards,

lteixeira
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: drieg on November 18, 2010, 11:47:47 am
Hi lteixeira,
unfortunately you've corupted some of your factory calibration data (blame it on your fingers).
Drop me and email and hopefully we will find some solution...
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: M84AB1 on November 19, 2010, 05:26:46 am

  • Exhibits repetitive noise at high sampling rates after self calibration


Would you be able to provide us with a picture so that we can see what is considered repetitive noise? The trace on my Rigol 1052E has always had some noise and it is never just a straight trace. I have seen the same with other people's Rigols on youtube. I have recently hacked my Rigol to 100Mhz and it behaves the same the way it did before the hack. I would therefore love to see a picture so that I can know if the noise I am talking about is the same one that you are talking about.

Thanks in advance :-)
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: teixeluis on November 25, 2010, 10:52:54 am
Thanks to Drieg the problem with my scope is now fixed. Hardware version and missing calibration parameters are now recovered/recreated.
While 2.04 SP1 firmware fixed the noise at time base below 500 ns/div, other not so obvious issues were still present, and all deriving from
a BW hack through the serial port. So, for those willing to attempt the BW increase, forget about the serial port method (don't get infected by
the enthusiasm expressed by Dave Jones's video). It's better go for more reliable methods such as USB, using the NI VISA tools.

lteixeira
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: msh959 on December 11, 2010, 10:31:40 am
Hi, I have or it's better to say I had DS1102E.When I press "Yes" button to update it's firmware it went blank and after that when I restart it there wasn't anything to saw in screen except some colored line.How can I repair it?Is this only way to sent DS1102 motherboard to Drieg?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: rudinietz on December 11, 2010, 04:10:11 pm
Hi,

I have a RIGOL DS1052D with LA-Module. After the hack to the DS1102 the noise  (<200ns/Div) is very high.
There can I find the original Firmware 00.02.04.01.00 for the HW58 DS1000D?

Please help me!
Thanks
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: drieg on December 11, 2010, 10:36:17 pm
@msh959
If you have the possiblitily to read/write the flash, you can send me only the dump file, otherwise you have to send me the mainboard or the flash chip.

@rudinietz
Try to ask Rigol for the fresh FW file for your unit.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: darrylp on December 14, 2010, 10:37:58 pm
so Drieg, do you have a copy of the 02.05 firmware yet ?

can i ask how you are recovering most of the failed flash attempts ?  does the JTAG connect to the flash chip ?


Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: drieg on December 17, 2010, 08:57:55 am
No, I don't have 02.05 FW yet. If anyone has it, I'd be interesing to look at it...

Check my 1st post in this thread for your question. Usually the flash desolder/read/write/solder cycle is needed. The JTAG connects to Blackfin only.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: darrylp on December 17, 2010, 10:36:34 am
No, I don't have 02.05 FW yet. If anyone has it, I'd be interesing to look at it...

Check my 1st post in this thread for your question. Usually the flash desolder/read/write/solder cycle is needed. The JTAG connects to Blackfin only.



first post, had indicated the blackfin jtag was daisy chained to the flash....
"The most common problem is totally dead scope after unsuccessful firmware "downgrade/upgrade". The only way to recover it is to reprogramm the flash chip (Spansion S29GL064N90TFI04) either via BlackFins's JTAG interface or in external programmer."


i've got a circuit board with the 02.05....    i've not got the tools to de-solder the flash.... but would be willing to send the board to you, if you have the tools to do the job.  ie. remove the flash, save copy,  place a lower version,  up the model number ;) ,  and then return the 02.05 firmware ?
of course i'd cover the postage both ways, but wouldn't want to send it until the new year ( as my country ( the UK ) is very back-logged on deliveries with the bad weather and the xmas rush )

prehaps continue in email ?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Fraser on December 17, 2010, 11:23:23 am
if you have the tools to do the job.  ie. remove the flash, save copy,  place a lower version,  up the model number ;) ,  and then return the 02.05 firmware ?
prehaps continue in email ?

Darrylp,

If Drieg is willing to do the work for you, I would recommend that you not return your scope to FW2.05 unless Drieg finds that the hardware requires it. As you have HW58 it is very likely that FW2.04SP1 will work perfectly with it and you will then have the ability to do further unofficial firmware updates in the future. FW2.05 would appear to be just a countermeasure release, hobbled to prevent unofficial firmware updates. From my understanding, Rigol were not intending to make any significant improvements to the 2.04 firmware. It's your decsion but given the opportunity I would prefer FW2.04SP1 to FW2.05.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: darrylp on December 17, 2010, 01:27:24 pm
if you have the tools to do the job.  ie. remove the flash, save copy,  place a lower version,  up the model number ;) ,  and then return the 02.05 firmware ?
prehaps continue in email ?

Darrylp,

If Drieg is willing to do the work for you, I would recommend that you not return your scope to FW2.05 unless Drieg finds that the hardware requires it. As you have HW58 it is very likely that FW2.04SP1 will work perfectly with it and you will then have the ability to do further unofficial firmware updates in the future. FW2.05 would appear to be just a countermeasure release, hobbled to prevent unofficial firmware updates. From my understanding, Rigol were not intending to make any significant improvements to the 2.04 firmware. It's your decsion but given the opportunity I would prefer FW2.04SP1 to FW2.05.


yes, i see what you are saying, but the calibration data,  its location ( inferred by Drieg, to be easily corrupted and matched to hardware and firmware level ) would be wrong....  doing a replace of the 2.05 when done, means the scope will work.

if Drieg has ( i'm sure he does ) a DS1052e,  then he can use the board (my board ) with his screen / buttons whilst on a lower version of firmware .... even a calibration to see how it works,  and if needed can be returned to the 'snapshot copy of the firmware before calibration'

it's up to him,   hopefully from it, we will have a binary firmware 2.05 ( which can be used to flash back onto 'scopes )  i'm guessing the newer firmware is looking for a new upgrade filename,  and maybe some checksum (  once we have the file, we can see the CRC of it.  and maybe a file version inside the firmware rather than just in the header 21 bytes.)

either way, we move a step in the right direction to being able to 'unlock' the higher bandwidth in software of the DS1052e scopes. 

ps. this board in question 02.05 firmware is listed as H/W 58. so still no news of a newer hardware revision from the factory.


Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: drieg on December 20, 2010, 10:05:11 am
Aurora is right, if you have HW58, you should be able to run 02.04 SP1 without problems (after Self-Cal).

Unfortunately the flash dump and the firmware file are two (more or less) different things. Most probably they changed file header and/or implemented some kind of protection/encryption or maybe changed the file structure too. To be able to create working FW file from the flash dump, you have to exactly know how.

I think the only way is to wait until somebody manages to get the oficial 2.05 FW file...
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: killerwhale on December 24, 2010, 03:33:58 am
Hi, drieg. If we had a 2.05 FW dump file, would it not be possible by disassembling it to find out exactly how this firmware decides if the update is possible? Of course, if we could somehow find the entry point, init values, etc. Or am I missing something?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: drieg on December 25, 2010, 07:24:33 pm
That would be definitely possible, as long as you have enough time, skills and tools to do so... ;)
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: scrat on December 25, 2010, 11:31:41 pm
Aurora is right, if you have HW58, you should be able to run 02.04 SP1 without problems (after Self-Cal).

Unfortunately the flash dump and the firmware file are two (more or less) different things. Most probably they changed file header and/or implemented some kind of protection/encryption or maybe changed the file structure too. To be able to create working FW file from the flash dump, you have to exactly know how.

I think the only way is to wait until somebody manages to get the oficial 2.05 FW file...

I don't have a clear view of the whole thing (memory inside the Rigol). Could you please explain more in detail?
Are there two programmed memories, one inside the Blackfin and one on a flash chip? Where is (more probably) the calibration data contained? How did you guess that? Did you manage to extract the calibration data among all the memory?
I know this could be part of your professional knowledge, but I'd spend some money to have your insight! ;)

Another reason why I'm asking is that, if it's like I figured it out, writing all data taken from a 2.04SP1 (or 2.X) scope onto a newer one will make the hack possible, maybe at the cost of desoldering/writing/soldering and loosing calibration data.
Am I so wrong?

Thanks,
Sandro
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Fraser on December 27, 2010, 09:41:22 pm
FW 2.05 appears to be hackable  :-)

See here: https://www.eevblog.com/forum/index.php?topic=553.345 (https://www.eevblog.com/forum/index.php?topic=553.345)

Having just checked 'Killerwhales' firmware file, it appears that Rigol changed the header contents to something non ASCII except for the DS1000E identifier. I presume Killerwhale has cut the header from a copy of FW2.05 but know not where he got it from.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: msh959 on January 16, 2011, 12:36:30 pm
Hi everyone,
I have DS1102E.About one month ago I wanted to update the firmware.So I downloaded a firmware and when I tried to update my Rigol it crashed and it didn't show anything in the LCD, so I started to search and find a way to repair it and suddenly I found Drieg in this forum.I send an E-mail to him and I told him what happen to my oscilloscope.After some question I found that the best way is to send the main board to him because I don't have a device to demount the spansion  IC. I live in Asia so it take 8 days to arrived.After that he sent a mail to me that he get the board and fix it.
I think the best way is to send the main board to him. You can just send An E-mail to him and ask him to help.When it finish and he send it back to you, you pay him for his work.
I'm really happy.I turn my Rigol on and saw the 2.05 version on the screen. :)
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: nasser32 on February 11, 2011, 09:45:11 pm
Hi everyone,
Youuuuuuuuuuuuuuuuuuhooooooooooooooooooo!!!
My RIGOL scope works fine again thanks to Mr. Drieg.
One year ago, I bought a RIGOL DS1052 scope and it was a good companion until I tried to hack it to a 1102.
I mistyped a character meanwhile and Yes, my scope ruined. It couldn't be used any more.
I searched to find some way to repair it. but I found that I can't do anything by myself.
when there was no hope,  I found Mr. Drieg and emailed him. after some questions about my problem, he could find a way to repeir it.
he did something for me that no one could do. he repair it "REMOTELY". he sent me a special manipulated firmware which could repair my scope even without openning its case.
He is so tallent I believe.
If you have a similar problem, ask him for help. I bet you'll never regret. this is the closest approach to repair your damaged scope.

>>>>  **** THANK YOU MR. DRIEG FOR YOUR GREAT HELP **** <<<<
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: tonva on April 03, 2011, 07:05:46 pm
That would be definitely possible, as long as you have enough time, skills and tools to do so... ;)
Well, as for me, time and skills enough (retired), just tools missing. May be some cooperation will be useful for all involved?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: tonva on April 03, 2011, 07:17:27 pm
FW 2.05 appears to be hackable ..........
Current DS1052E's come with 02.05.02.00 firmware so the hack for 02.05.01 does not work.
The only long-term solution I see is some "nondestructive" method of firmware downgrade not based on Rigol's update tools.
(using JTAG or so). Has anyone some idea how it can be done?     
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: d.giddy on April 06, 2011, 10:30:27 am
Very pleased to report that Drieg has managed to get my dead DS1052 going again. Here's my story:

- Purchased a DS1052E
- "Upgraded" it to a DS1102E using the widely available USB firmware procedure - seemed to work fine.
- Further updated the firmware to 02.04.03 to get the menus back - seemed to work fine.
- Have since then had an intermittent problem where the scope didn't always boot. Often got to the splash screen and then went to a grey screen with a few wavy lines. Usually only a problem if it had been in use for a while and then was turned off and turned back on. Would fairly reliably start when it was cold, but rarely if it was hot.
- Decided to downgrade back to the 02.02 firmware that I used for the initial patch in the hope of making the start more reliable. In the process the load seemed to fail about 80% through and after power cycling, I get a screen with wavy lines only - no splash screen.
- I sent the main board to Drieg who's got it going now with firmware 02.05.

Thanks Drieg!
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: DenisRU on April 28, 2011, 12:59:25 pm
Sorry for my english.

     Hi everyone!  I live in Russia. I wanted to tell you my story how I killed my Oscilloscope Rigol DS1052E. He came to me with firmware 00.02.05.02., At that time upgrate in DS1102E  was impossible. Not long ago there was information about how to do it. https://www.eevblog.com/forum/index.php?topic=553.msg42404#msg42404. (https://www.eevblog.com/forum/index.php?topic=553.msg42404#msg42404.)
     In short, I flashed it. ... .. After that it could not run. The mood has fallen. I will not tell you how I did it ...
     I turned to Drieg. He told me to read a dump from the chip Spansion S29GL064N90TFI04 and send it back to him. If you’re interested in programming, I had a Triton + V5.7T http://www.triton-prog.ru (http://www.triton-prog.ru). I ordered an adapter for this chip. Not the first time but I managed to read the data correctly.  Posted the dump to Drieg. Soon he sent me a corrected dump. I flashed the chip and soldered it in place. After that, my Rigol alive.
      I would like to express my deep gratitude to Drieg. Thanks very much to him! The world is not without good people. For more of these ...



Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: saturation on April 28, 2011, 01:49:53 pm
Great story.  Drieg's icon is very well deserved, and this thread is a valuable part of the forum.

(https://www.eevblog.com/forum/index.php?action=dlattach;attach=6880;type=avatar)

Sorry for my english.

     Hi everyone!  I live in Russia. I wanted to tell you my story how I killed my Oscilloscope Rigol DS1052E. He came to me with firmware 00.02.05.02., At that time upgrate in DS1102E  was impossible. Not long ago there was information about how to do it. https://www.eevblog.com/forum/index.php?topic=553.msg42404#msg42404. (https://www.eevblog.com/forum/index.php?topic=553.msg42404#msg42404.)
     In short, I flashed it. ... .. After that it could not run. The mood has fallen. I will not tell you how I did it ...
     I turned to Drieg. He told me to read a dump from the chip Spansion S29GL064N90TFI04 and send it back to him. If you’re interested in programming, I had a Triton + V5.7T http://www.triton-prog.ru (http://www.triton-prog.ru). I ordered an adapter for this chip. Not the first time but I managed to read the data correctly.  Posted the dump to Drieg. Soon he sent me a corrected dump. I flashed the chip and soldered it in place. After that, my Rigol alive.
      I would like to express my deep gratitude to Drieg. Thanks very much to him! The world is not without good people. For more of these ...




Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: HB-1905 on May 11, 2011, 08:31:00 pm
Just another chapter in the bricked Rigol DS1052E story:
- planning for the 1052 to 1102 hack
- during the FW downgrade it all seems fine but the reboot prompt at the end did not appear
- switched off/on (perhaps a retry would have been a better idea...)
- ... the scope was not a scope anymore

Looking the internet for other victims and indeed, there were more! Also found Drieg's contact details on this blog. Amazing: being in trouble to find such a (possible) escape! Lucky me, he was able and especially willing to help me. Sent the mainboard since I lack the skills to do the repair on my own.

After only one week the board was back again being sent from The Netherlands. I noticed he did the repair in about one hour! I know, he is professional but nevertheless. On the board there is no trace whatsoever of this repair. Even the numbered label on the chip is placed back very carefully. The (de)soldering? Simply perfect.

So, Drieg did the repair, upgraded to FW 2.05 and did the hack for me. You might call this the safest way ... His skills and service are really remarkable. Also communicating to this guy is enjoyable. I would almost advice to brick your scope on purpose ...
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Kitsyboy on June 09, 2011, 08:22:20 pm
Same story here,

I have a DS1052D which was running a very old firmware version (0105). I tried to hack the scope with the serial interface. Instead of ending the strings with a Linefeed character I accidentally typed CR. followed by some backspaces. After that the initial configuration data of the scope was gone. In the hardware info screen the Hardware version was messed up and the scope was 30% off spec.
(a 10 Volt signal appeared to be 6 volt on the scope).
Drieg has succesfully helped me to restore the initial data. He truly as an awful lot of knowledge about the inner workings of this scope.

Thanks again Drieg for unbricking the scope, and to everyone I would say: Never use the serial method, use the USB method which is far more safe.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: rf-loop on June 26, 2011, 09:46:54 am
@Shafi

.... i was going to test it against my 400Mhz HP54502A scope, but when i turned on my old reliable, she is no longer reliable. It popped up with Calibration Memory checksum error. So i spent quite a few hours trying to recalibrate it and failing, it seems that the old HP is dead now  ???



Off Topic. if need continue, then other thread.

My opinion is that your HP54502A need only new NVRAM and then need do perfect recalibration just following exactly service manual.

(54502A is very sensitive in calibration prosedure and it fails very easy. Sometimes it need some small adjustment before selfcal go ok but inside scope adjustments need special knowledge and instrumets - other way it only go more bad. Also you need good perfect set of calibration cables. )

After NVRAM change it first need factory default and then do ALL steps exactly as service manual explain for calibrating - The manual does not contain any unnecessary words or sentences.

If selfcal fails in any step --> stop and start totally beginning with full factory defaults (reset all selfcal data).
If it fails all times in same step then need do service manual adjustments exactly with required instruments.
If still fails there is HW problem. (mostly littlebit bad input attenuator module.)
Selfcal cables need be perfect quality, many coaxial cables with cheap noname BNC connectors may cause problem becouse specially shield connectors are loose. Also old machine BNC connectors may be dirty. (use pure isopropyl alcohol or "dry" video cleaner. Front BNC' do not use whatever "contact spray", they may damage input attenuator module behind BNC)

BTW 54502A is good scope specially for timing measurements. It is 6 bit adc but it is not problem if use this scope for purposes for what it have designed. (extremely nice is that it have real 50 ohm inputs for rf work. This can not solve using 50 ohm terminator in normal high imbedance input scopes)

Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: dimlow on June 26, 2011, 11:54:50 am
I have since fixed the scope, only needed some new NVRAM!
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: rf-loop on June 26, 2011, 12:56:13 pm
I have since fixed the scope, only needed some new NVRAM!

Oh and just I find this: "dimlow on October 09, 2010, 12:43:39 PM"

So I have write comment to very old message what I accidentally find as I use some other "Search".

But, for common info, these scopes are most common  fails are repairable.
(today there is no company who make this quality in production or specially if look littlebit more old HP's)
EOOT (end of off topic ;) )
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: dimlow on June 26, 2011, 01:47:48 pm
I dont really see what your getting at, and im sure that last quote is not from me
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: gm0otb on October 04, 2011, 12:59:52 pm
I would just like to say a big thank's to Drieg for unbricking my DS1052E after an unsuccessful firmware downgrade attempt.

While attempting a downgrade (don't ask why!) I never received the "Updata successful" message, after turning the scope off, i was never to see life in the old Rigol again, well that's until Drieg breathed new life back in it :)

Thanks Drieg, for the excellent speedy service,  It was with pleasure I made a small donation, you are a credit to the hobby!

Ray. :)
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Balaur on October 05, 2011, 04:46:28 pm
Hello all,

I will like to ask you a few questions. Sorry for barging in like that. I have tried to do my homework, but I'm still at loss with some issues and I'm kindly asking for your help. Much appreciated, thank you.

I'm looking at buying an used Rigol on eBay. The seller modded the scope and it looks like the conversion was successful, in the sense that the model is identified as a DS1102E and the firmware version is 2.02 SP2.

Q1: The other picture shows the scope displaying the internal calibration signal at an amplitude of 300 mV and with a frequency of 1.000KHz (or something like that - the picture is small). Is there any way to check whether the calibration data has been corrupted or not from this very limited info?

Q2: I don't know the hardware revision. The scope seems to be an older version, with the UltraZoom label. Is the serial number useful? Does the HW rev matters?

Q3: Is any useful stuff in later DS1052 firmware revisions that will not longer work on the modded scope? Are newer DS1102 firmwares usable?

Thank you all,
Dan
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: torch on October 05, 2011, 09:23:48 pm
AFAIK, while later hardware versions cannot run early firmware, the opposite is not true: early hardware versions can run the later firmware. (2.04 SP1 is as late as you would want though -- after that, the firmware seems to be buggy).

2.02 SP2 was the last firmware that allowed changing the model number (and hence, allowed the hack). In order to hack a later model, the firmware must first be downgraded to 2.02 SP2, model changed, then the firmware upgraded again before using the scope.

There is a hidden screen that will reveal the hardware version. Press Utility, then advance to page 3 of 3, then System Info. Now, to reveal the hidden screen:

Press Ch1 twice
Press Ch2 twice
Press Math once

Now the screen will show extra info, including the hardware version. H/W 58 is the later version that won't run properly on firmware 2.02. You could ask the seller to send you a picture of that screen.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Balaur on October 06, 2011, 11:37:36 am


Good suggestions. Thank you very much!
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: drieg on October 06, 2011, 02:17:56 pm
Q1: I'm afraid that a bit too little info. There is probably only wrong probe ratio selected (1:1 instead of 1:10), the amplitude of probe compensation output shoudl be about 3V. Try to ask if the hack was done vie serial or USB (USB is safe, while using serial cable there is a risk of corrupting calibration data).

Q2: There is not much diffrerence bewen them. Early units didn't have LED backlight for example, PM me s/n if you have it (3-6 initial numbers are enough) and I can tell you more...

Q3: No, hacked DS1052E scope is same as original DS1102E from the sw point of view. There is no way for the firmware to detect a modded unit (if the hack is done properly). All new firmwares works with older units.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: dougsisco on October 17, 2011, 01:54:09 pm
Thanks to Drieg for fixing my DS1052E!  After attempting the notorious serial port Rigol hack and using the 'enter' key instead of ALT-0-0-0, the delayed-trigger was broken and the hardware revision was scrambled. Drieg created a special 'repair' firmware which fixed the problem; very cool!
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: jeremy on October 19, 2011, 11:26:33 pm
Hey guys,

Drieg just helped me out with his scope, sent me a repair firmware and it works perfectly now. Somebody give this guy a job!

-jeremy
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: dixis on January 23, 2012, 08:40:55 am
Hi to all,
A week ago i have received my ds1052e. The same day i hacked him in 1102E. The original firmware was 2.0.6. It was downgraded to 2.0.2 SP2. Then i changed  it`s serial number. He became 1102E. After that i upgrade him to 2.0.4 SP1. All was fine. After 30 minutes of playing i decided to upgrade it to it`s original 2.0.6 firmware. And then the problems started. Progress bar filled up only 70-80 percent and disappeared without "firmware is successful"  or something like that message. Without a second thought, I rebooted it. After power up it shows nothing. Only keyboard back lights were randomly lighting after each power-up. I have successfully read the firmware of spansion flash-memory via JTAG. Now I can not do anything because I do not know how the 4MB firmware placed in memory map. Could anyone help me? The board has some inscriptions 94V-0 and DEMO8 and a date 2010-12-20. Here is the external link to my broken 2.0.6 firmware (sorry, but i don`t know how to attach files larger than 1MB) http://hotfile.com/dl/143324806/25ead70/broken_2.0.6.bin.zip.html (http://hotfile.com/dl/143324806/25ead70/broken_2.0.6.bin.zip.html)

Regards
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: drieg on January 25, 2012, 08:12:42 am
...solved via PM/email.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: wkb on January 25, 2012, 07:41:42 pm
...solved via PM/email.

Another guy that owes you a couple of beers!  ;D 

Although my hack proved a smooth operation, knowing you were there in case it went south was what made me willing to take the risk!
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: kvitekp on February 01, 2012, 02:14:28 am
Hello all! What a fascinated reading!

Just got myself a brand new Rigol DS1052E with s/w 00.02.05. SP2 and h/w 58 and I'm considering a 100MHz hack. Just wanted to check if Drieg is still out there offering his lifesaving service?

/Peter
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: jgbena on February 03, 2012, 06:06:02 pm
Yeah I just bought one of these... still in the Shipping phase and now I'm scared to try hacking it!!!
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: drieg on February 05, 2012, 09:39:52 am
Yes, I'm still here, ready to help with broken Rigol units (not only DS1052E/D, but also others)  8)
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: jbremnant on February 06, 2012, 03:20:39 am
Wow, I wish I found this thread before I tried out the hack.
I was on 2.05.02 firmware and tried to downgrade to 2.02.02.
Didn't work, and now my DS1052E scope is bricked with blank screen.

I am trying the warranty route since I got it only few days ago.
If I don't have any luck, I hope our "superhero" Drieg can help me out. 
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Yakovlev on April 11, 2012, 12:03:47 pm
Thanks again to Drieg for restoring corrupted calibration on my 3 year old HW03 box.
Brgds, Rob
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: matthewell on July 12, 2012, 03:40:23 pm
Hey has anyone got the jtag port working, i have been trying for a couple days and got only garbage from the TDO pin.

Any help would be great, Matt.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: dixis on July 18, 2012, 11:25:24 am
Hi matthewell,
could you post the connection schematic which you have used for jtag and what the software that handles this
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: sim on November 13, 2012, 02:00:59 am
Hello! My DS1052E purchased in January, 2010 has always displayed a blank "HardVersion" in (extended) System Info. It reads:

00.02.02.02.00
DSP: 02.15
FPGA:02.00
HardVersion:

I recently upgraded it to 2.06 to try to fix usbtmc timeouts (which turned out to be a host problem anyway). This seems to have introduced an ADC offset problem that causes about a half div noise at any voltage scaling, any channel. It is obvious with peak-detect at any sweep rate, or 200us or faster in normal mode. Calibration does not fix it, but reverting to 2.02sp2 makes it all good again. I'm thinking that the new software is defaulting to assuming a newer hardware rev if the field is blank, and breaking the ADC calibration. Any ideas on this? If it can be set, I wonder what it should be set to.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: drieg on November 13, 2012, 09:58:54 pm
Hi sim,
we have to find out the hardware version of your unit (from the serial number or better from PCB version) and then we can fix it. Please contact me via PM/email.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: sim on November 19, 2012, 08:31:11 pm
we have to find out the hardware version of your unit (from the serial number or better from PCB version) and then we can fix it.

So, we did this, and it fixed the problem! Restoring the "HardVersion" to 07 (my board was marked "DEM07") allowed me to upgrade to 2.06 without the ADC offset problem that was present before when the field was blank. It seems my assumptions about the software assuming a newer hardware version were correct. My realtrigdelay/equtrigdelay were also wiped to 0 and I decided to also calibrate those -- not sure what I did originally. Thanks, drieg!
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: matthewell on November 22, 2012, 05:44:53 pm
Hi matthewell,
could you post the connection schematic which you have used for jtag and what the software that handles this

Hey i am using the bus blaster jtag device with urjtag, have you had any luck?


Thanks, Matt.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: equinoxefr on December 31, 2012, 07:13:10 pm
Hi Drieg,

I upgraded my DS1052E today from 3.01 to 2x, hack to 1102E then upgrade to 4.0. Everything has worked but now i've a blank hardversion instead of 58. Is it a problem ?

Regards

Pierre
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: equinoxefr on January 15, 2013, 08:45:28 pm
Little update of my previous post.

Drieg helped me to fix my problem. I lost hw version but I also lost trigger delay calibration.

With the help of Drieg, I try to set calibration data but without success. I can enter calibration data but it was lost upon power off.  So I downgraded my scope from 4.0 version to 3.01 and try again to fix it. Now it work like a charm, I can input trigger delay and fix that annoying problem ;-)

A great thanks to Drieg, our Rigol doctor ;-)
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Blogs14 on January 21, 2013, 09:25:22 pm
Hi equinoxefr,

I think I have the same problem as you did, but I can't seem to find 3.01 firmware file anywhere.
Where did you find it? Do you think you can post a link?

Thanks in advance.
Title: Re: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: equinoxefr on January 22, 2013, 06:13:18 am
Hi equinoxefr,

I think I have the same problem as you did, but I can't seem to find 3.01 firmware file anywhere.
Where did you find it? Do you think you can post a link?

Thanks in advance.

Hi,

I found it on microcontroller.net a little Google search and you will find it. I ask me if you can't grab it.

Pierre

Envoyé depuis mon Nexus 7 avec Tapatalk
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Blogs14 on January 23, 2013, 11:33:10 am
Well that's embarrassing, don't know how I missed that file when I was looking the first time.

Anyway here's the link and checksum for anyone else:
http://www.mikrocontroller.net/attachment/147456/DS1000EUpdate.zip (http://www.mikrocontroller.net/attachment/147456/DS1000EUpdate.zip)
MD5: eac4f449e60e2fe3cec561cbfa543bed

(From: http://www.mikrocontroller.net/topic/261138 (http://www.mikrocontroller.net/topic/261138))

Problem is I still can't get the trigger delay calibration to save between power-ups. It doesn't seem to make a difference which firmware I try.

I know this isn't very serious, but it annoys me that the scope isn't perfect.

Any ideas?

EDIT:
I've managed to sort it out now. In the end I tried FW 4.00 again and set the trigger delay calibration. Then, without powering off, I ran auto calibration and now the settings have been saved. Although the auto calibration changed them slightly, they're pretty much perfect.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: pomonabill221 on March 17, 2013, 02:28:53 am
we have to find out the hardware version of your unit (from the serial number or better from PCB version) and then we can fix it.

So, we did this, and it fixed the problem! Restoring the "HardVersion" to 07 (my board was marked "DEM07") allowed me to upgrade to 2.06 without the ADC offset problem that was present before when the field was blank. It seems my assumptions about the software assuming a newer hardware version were correct. My realtrigdelay/equtrigdelay were also wiped to 0 and I decided to also calibrate those -- not sure what I did originally. Thanks, drieg!
I, too have DEM07.
I have performed the hack to a DS1102E and it worked, and applied FW version 2.04.00.03 but do not have a hardware version, just jumbled characters.
When I did the serial update (I know, I know), I did accidently hit ENTER rather than ALT 000, but it seemed to take ok.
Now I am wondering if my cal data is corrupt because of the missing HW version?
How did you do it?  I see all these posts saying they had success, but NO ONE has said HOW it was done, or is this being kept a guarded method so it won't be done for fun?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: jamess on January 22, 2014, 01:21:07 am
I've managed to brick my 1052e attempting a firmware downgrade :palm:


Drieg, you you have a moment I've sent you a PM with the details, any help/advice is appreciated.

--J
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: jamess on February 01, 2014, 02:59:04 pm
My bricked DS1052e is all fixed up, huge thanks to drieg.

Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: pomonabill221 on February 01, 2014, 05:42:18 pm
That's not fair!!! leaving us in the dark as to what you did to revive your scope!
Did it involve using the JTAG connection?

Good to hear you got your baby back!
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: drieg on February 02, 2014, 10:12:26 am
My bricked DS1052e is all fixed up, huge thanks to drieg.
That's not fair!!! leaving us in the dark as to what you did to revive your scope!
Did it involve using the JTAG connection?

Good to hear you got your baby back!
Yes, if the unit doesn't start at all, you need to reprogramm the flash either in external programmer or via JTAG (as we did in this case).

I'll update my first post with more details when I find the time...
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: pomonabill221 on February 02, 2014, 08:22:08 pm
Thanks for the info... kinda thought so but wanted to make sure.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: szist on March 16, 2014, 03:32:13 pm
I got the Rigol DS1052E after uploading the incorrect firmware . When you turn on the Oscilloscope , nothing is displayed only bright screen. USB does not work. Please help in the recovering the operation via JTAG or reprogramming the flash of chip.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: szist on April 03, 2014, 04:20:52 pm
I wanted to thank Drieg in repairing DS1052E. He sent repaired firmware, and I could upload it via JTAG and my oscilloscope alive. Direg is great and I am very grateful to him for taking the time.  : :-+
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Alliyou David on November 10, 2014, 03:32:09 am
Dear Drieg: Can you send the firmware mentioned in your blog to my E_Mail:David760190@hotmail.com?Thank you very much.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: merseyless on November 19, 2014, 12:53:48 am
Hi there, I have a ds1052e that has been bricked. What steps do I have to go through to fix it?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Zaq on June 12, 2015, 05:57:25 pm
Can some one help me out to get my Rigol DS1052E working again?
Did the 100MHz hack, that worked fine.
Than i want to upgrade firmware and the scope is compleet
dead.
Only white screen, nothing else.
Can you give me instructions what to do.
I dont have a jtag op external programmer.

With regards,
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: ENB on March 01, 2016, 11:27:06 pm
Hi,

Any news for unbrick our scopes? :(

Thanks in advance
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: pantelei4 on January 22, 2017, 07:07:53 am
Hi, who knows how to communicate with drieg ?
I broke my Rigol 1052E, corrupted calibration data. |O
Last time he was here November, 2016.
I left him a message, unanswered ...
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: pantelei4 on January 24, 2017, 10:01:40 am
Thank you, who responded. I restored my oscilloscope itself. After an unsuccessful upgrade was lost HW version=? Therefore, it is uncalibrated. The board has DE03 inscription means HW version=03. With the help of the serial interface and the command :INFO:HARDVERSION 03 value was restored.
Then I set the FW version 00.02.04.01.00 and spent calibration. Everything works fine, it cost me a few days of nerves. I agree with drieg, need to be very careful and neat, when you want something else to do.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: dberdugo on May 17, 2017, 08:36:13 pm
Hello, thanks all for share your experiences and information about our Rigol oscilloscopes.

My case takes about a DS1052D wich I bought less than a year ago, finally I decided to upgrade to DS1102D and got an expensive brick.
This is DS1052D, HW version 58, FW version 00.04.02 SP1, and the serial number is DS1EU175000xxx

Obviously serial commands to change serial and model didn't work.
I tried downgrade directly using "DS1000DUpdate.RGL", the oscilloscope detected pendrive but didn't perform any flashing process.
I tried to modify the header of the FW file to identify the same version as my unit and later, but nothing happens.

Finally I decided to desolder the flash for myself, made a backup with an external programmer, and changes the serial letters (to DS1EA) and model name (DS1102D) at the binary image, but when solder again, the oscilloscope was dead :(
I retried with many images extracted from official FW upgrade files, removing the header and concatenating the 4MB image of this file with the last 4MB of my original backup wich contains serial, model name and suposed calibration data, but the oscilloscope remained dead.

Finally, I got scared and restores exactly the original backup and the oscilloscope breathed again, got back to live, but when enable any channel (analog or logic analyzer) it shows random garbage waveforms, does not matter if I connect the probes to an stable 5V, GND or test waveform pin :(
I performed many times the autocalibration procedure, this makes many tick-tick sounds, complete the progress bars, but when finished, it shows the same behaviour.

I think the factory calibration data is on flash, and I restored the original backup, so it must have this data intact.
Anyone knows how is happening inside my oscilloscope?

Thanks and greetings.
Daniel
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: ivi_yak on July 20, 2017, 06:32:11 pm
hi
I have a brick after firmware updating of DS1302CA |O
Could you post a manual for reflash or advice what to do?
Please post any info about repairing of software bricked RIGOLs
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: ivi_yak on July 20, 2017, 06:46:06 pm
hi, could you share what king of programmer you use for reflash and it will be great for instructions
thanks!
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Bruzzel on January 18, 2019, 11:25:49 pm
Hello,

I have flash a wrong firmware to my old DS1042C and now it is dead, nothing works. |O
What can I do to fix my bricked scope?
Where can I find information and correct Hex-data for reprogramming the Flash?

The DS1042C board is very similar to the DS1042E Board but has only a S29GL032A flash
 (not a S29GL064 flash) and has no second front USB-Port near the serial EEPROM.

The last firmware was 02.03.16.

Can anybody help me?


Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: jarek007 on January 19, 2019, 12:22:30 pm
Hello, When modifying DS1052E probably lost the calibration data - corrupted calibration data. Uploaded firmware 00.04.02 SP1. Interference occurs without a signal.
Please help.
Who knows how to communicate with Drieg
I apologize for the language, but I write from the translator
Jarek
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: drieg on February 06, 2019, 10:17:34 am
Hello Jarek,

drop me a PM, I will look at it.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: drieg on February 06, 2019, 10:20:04 am
Hello,

I have flash a wrong firmware to my old DS1042C and now it is dead, nothing works. |O
What can I do to fix my bricked scope?
Where can I find information and correct Hex-data for reprogramming the Flash?

The DS1042C board is very similar to the DS1042E Board but has only a S29GL032A flash
 (not a S29GL064 flash) and has no second front USB-Port near the serial EEPROM.

The last firmware was 02.03.16.

Can anybody help me?

Can you read the flash content? You can do it via JTAG, external programmer or send me the board for repair..
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: drieg on February 06, 2019, 10:21:36 am
hi
I have a brick after firmware updating of DS1302CA |O
Could you post a manual for reflash or advice what to do?
Please post any info about repairing of software bricked RIGOLs
Hello,

sorry for late reply. Have you managed to fix your problem? If not, feel free to contact me..
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: ivi_yak on February 06, 2019, 08:14:28 pm
 :-+
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: ivi_yak on February 23, 2019, 11:24:59 am
Thanks Mr. Drieg he fix my dump and scope alive now   :-DMM,
I have bricked Rigol ds1302CA after unsuccessfully fw update.
Using XGecu TL866II Plus http://www.xgecu.com/en/ with TSSOP48 adaptor I got a memory dump of S29GL032A90TFIR40.
Drieg fixed my dump at few days and my scope restored now.

Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Bruzzel on February 23, 2019, 05:29:08 pm
I have fix my Rigol DS1042C.
I have unsolder the flash and read it. I found the first part of the firmware file identical at the flash, only the first 20 byte was cut off and the last bytes were different.

I suspect the following: 

The ds1000 firmware starts after 20 byte at the firmware USB file and ends at address 0x1FFFFF.
The ds1000D/E firmware file starts after 21 bytes at the firmware USB file and have double length up to 0x3FFFFF.
 
The DS1042C firmware update is a very stupid program. If it finds a file with the name “DS1000DUpdate.RGL” at the USB stick it cut off the first 20 bytes an write it 1:1 to the flash without any check.
 
Only the bytes after address 0x1FFF00 are not changed because there are individual data about the scope (model, serial no. etc.) and after 0x200000 there are some other calibration data.

The A21 = address input and WE# = Write Enable input are not connected at my Rigol DS1042C with flash S29GL032A.

After cut off the first 20 bytes of the firmware file and program the bytes 0x000000 to 0x1FFF00 to the flash and solder it back to the board the rigol works correct.  :-+

It is not easy to solder a TS048 device!  :--

I have made a firmware update to 3.7.1 and change it to a CA1102C 100Mhz model, see Andreas Schuler's homepage:
http://codenaschen.de/tichyblog/index.php?action=blog&entry=17_Hacking%20Rigol%20DS1022C%20DS1042C%20DS1062C%20DS1102C]
[url]http://codenaschen.de/tichyblog/index.php?action=blog&entry=17_Hacking%20Rigol%20DS1022C%20DS1042C%20DS1062C%20DS1102C (http://[url)[/url]

Thank you drieg for help!   :-+
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: giov on March 06, 2019, 01:46:04 pm
Hi,
I was trying to upgrade my DS1102D to last firmware, and after few minutes stuck a 50% I decided to reboot it :bad idea  |O
Now I only got white screen and random keyboard status after each reboot.
I have no idea how to get it alive again : I have no programmer, and I don't know how to use JTAG interface  :-[ .
Can someone help me out ?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: ivi_yak on March 06, 2019, 04:11:00 pm
Hi, in this case only reflash memory help
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: giov on March 06, 2019, 04:24:58 pm
OK, How can I reflash ? Do I need a programmer of is it possible via jtag ?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: ivi_yak on March 06, 2019, 05:03:28 pm
You need to build jtag chain, basically it's BlackFin and altera and using wiggler cable or j-link get your dump.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: giov on March 06, 2019, 09:07:23 pm
I have got a pirate's v3 card, and I installed openocd : can I reflash with it ?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: reza chavoshi on September 30, 2019, 11:47:43 am
Dear all,
I have faced unsuccessful firmware upgrade (to version:00.04.02.01.00) issue with my rigol DS1052E (My oscilloscope display remains white after booting up and some keys lit up randomly)
As I checked this topic it can be solved by reprogramming the flash IC (part no is: S29GL064N90TF104) with a copy of a healthy dump file.
I have a universal programmer with TSOP48 socket and all I need now is the dump file (copy of hex file stored in the flash chip). :-BROKE
I would be really thankful if any one can send me the file so that I can fix my oscilloscope. |O |O
Many Thanks.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Dimas77 on October 21, 2019, 09:29:33 pm
Help me. My Rigol 1102E freezes after firmware upgrade (to version 00.04.02 sp1) and shows the shifted lines. I read the dump file, but cannot edit it.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Fungus on October 22, 2019, 11:47:29 am
Help me.

Read the messages right above yours in this thread, especially this one (https://www.eevblog.com/forum/blog/the-dark-side-of-the-rigol-hack-bricked-scope-how-to-fix-it/msg2247966/#msg2247966).

No, it's not good news.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Dimas77 on October 22, 2019, 01:14:47 pm
Today changed and rewritten a memory dump.  From the official update, Rigol 4.02.01 cut off the beginning of x21, and copied from the address x000000 to x400000 + information about the serial number.  The oscilloscope came to life, but shows overestimated values.  did auto-calibration - thought it would help.  restarted the oscilloscope, now it shows a white screen.  :-BROKE
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Dimas77 on October 26, 2019, 03:04:18 pm
Does anyone have a dump of S29GL064N90TF104 Rigol 1102/1052? Please share for me.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: ur4mui on November 05, 2019, 08:51:56 pm
have oscilloscope DS1052E how to connect WIGGLER cable .please draw.photo below.Thanks
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: ivi_yak on April 30, 2020, 10:24:03 pm
Hi every one if you need more details pls reply
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: adron on May 11, 2020, 06:40:53 am
I managed to brick my DS1052E by trying to upgrade to the latest firmware, https://beyondmeasure.rigoltech.com/acton/attachment/1579/f-0724/1/-/-/-/-/DS1000EUpdate.zip?sid=TV2:Q2jKaGpUj (https://beyondmeasure.rigoltech.com/acton/attachment/1579/f-0724/1/-/-/-/-/DS1000EUpdate.zip?sid=TV2:Q2jKaGpUj) and now I am trying to recover. What software are you using to dump/rewrite the flash through the jtag connection?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: ivi_yak on May 13, 2020, 09:48:07 am
hxd hex editor :popcorn:
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: adron on May 13, 2020, 10:52:56 am
hxd hex editor :popcorn:
I have hxd, for changing the flash file contents, what I meant was software for the actual communication through jtag. Are you perhaps using openocd or some custom software?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: ivi_yak on May 13, 2020, 06:21:25 pm
topjtag
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: adron on May 31, 2020, 08:45:15 pm
topjtag
Thanks!
I had some issues because I run 64-bit Windows 10 but finally managed to install topjtag flash programmer in a virtual machine. The JTAG chain seems to be working, and it detects the Analog Devices 627A50CBh and the Lattice Semi. 01281043h. Could you advise me on the right configuration to use to read and write the flash memory?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: adron on June 01, 2020, 10:59:00 am
I read the flash memory twice just to be sure it was not getting random errors, and I get some rather strange differences between the flash contents and the RGL file I tried to update the firmware with. Other posts in this thread indicated that there was configuration data at high offsets in the flash, but I have only FF at those locations, and I have several differences at lower offsets. At the lower offsets, all differences seem to be one bit that is set in the rgl and not set in flash, mask 0x04. And then at the higher offsets, areas of FF where the RGL has data. Any ideas for what to do?

Diff at 00102F87 len 00000001  flash: A9   rgl:AD
Diff at 00105787 len 00000001  flash: 49   rgl:4D
Diff at 00107B87 len 00000001  flash: 08   rgl:0C
Diff at 00107F87 len 00000001  flash: 69   rgl:6D
Diff at 0010E787 len 00000001  flash: 08   rgl:0C
Diff at 00114787 len 00000001  flash: CB   rgl:CF
Diff at 00118787 len 00000001  flash: E2   rgl:E6
Diff at 0011D387 len 00000001  flash: 68   rgl:6C
Diff at 00121B87 len 00000001  flash: C2   rgl:C6
Diff at 00128387 len 00000001  flash: 29   rgl:2D
Diff at 0012A387 len 00000001  flash: 50   rgl:54
Diff at 0012EF87 len 00000001  flash: 01   rgl:05
Diff at 00131F87 len 00000001  flash: B1   rgl:B5
Diff at 00132387 len 00000001  flash: 28   rgl:2C
Diff at 00132F87 len 00000001  flash: B0   rgl:B4
Diff at 00133B87 len 00000001  flash: 62   rgl:66
Diff at 00134F87 len 00000001  flash: C0   rgl:C4
Diff at 00135387 len 00000001  flash: D1   rgl:D5
Diff at 00137387 len 00000001  flash: 10   rgl:14
Diff at 00137787 len 00000001  flash: 2A   rgl:2E
Diff at 00138F87 len 00000001  flash: 42   rgl:46
Diff at 00144787 len 00000001  flash: 71   rgl:75
Diff at 00145387 len 00000001  flash: 93   rgl:97
Diff at 00148F87 len 00000001  flash: B9   rgl:BD
Diff at 0014E787 len 00000001  flash: 5A   rgl:5E
Diff at 00152387 len 00000001  flash: 08   rgl:0C

Turned out I was wrong about the rest of the diffs too, I had a small error in my comparison script that only showed the last of a range of errors. Anything after 0x1ff800 in the update file has not been written to flash at all.

Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: adron on June 05, 2020, 07:27:53 pm
I rewrote the single bit errors with data from the RGL file and the scope seems to be working again. I then tried running the firmware update from USB again, and got the exact same single bit errors once more. Something seems to be reproducibly wrong. However, I have now settled for fixing the single bit errors and hopefully that is all that is required. I am unsure why so much of the RGL file is not written to flash?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: rezinj on June 30, 2020, 10:41:04 am
hi. i need to know what kin of programer i need. which software have to use to program flash via jtag. and do you have the file that i have to program in my oscilloscope?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: ivi_yak on July 01, 2020, 11:42:08 am
I rewrote the single bit errors with data from the RGL file and the scope seems to be working again. I then tried running the firmware update from USB again, and got the exact same single bit errors once more. Something seems to be reproducibly wrong. However, I have now settled for fixing the single bit errors and hopefully that is all that is required. I am unsure why so much of the RGL file is not written to flash?

if you have a working dump I'll recommend flash it via MiniPro XGecu TL866II Plus programmer to be sure all fine
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: ivi_yak on July 01, 2020, 11:45:02 am
hi. i need to know what kin of programer i need. which software have to use to program flash via jtag. and do you have the file that i have to program in my oscilloscope?
:scared: don't hesitate take a read 6 pages of this thread and you got all what you need to know
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: adron on July 02, 2020, 01:05:33 pm
rezinj tried to contact me, but his/her inbox was full when I tried to reply. I connected everything to the jtag connections on the scope and used topjtag to read/write the flash memory. I used a https://www.segger.com/products/debug-probes/j-link/models/j-link-edu-mini/ (https://www.segger.com/products/debug-probes/j-link/models/j-link-edu-mini/) Segger J-Link Edu Mini interface, with a SWD to JTAG adapter https://www.electrokit.com/produkt/adapterkort-jtag-2x10-2-54mm-till-swd-2x5-1-27mm/ (https://www.electrokit.com/produkt/adapterkort-jtag-2x10-2-54mm-till-swd-2x5-1-27mm/) and a bunch of wires and a resistor:
[attach=1]
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: patty.o.furniture on July 03, 2020, 09:12:11 pm
Could you advise me on the right configuration to use to read and write the flash memory?

Hey adron, it seems you figured it out. Can you provide us the settings you used? I can properly scan the chain but only read 0xFF's from my flash.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: adron on July 06, 2020, 11:46:15 pm
Sorry about the late reply. These were the settings I used. Same?

I'll also throw in the C# program that I used to compare the dump to the rigol firmware image and to extract sections of it as a .hex file for writing. I have not cleaned it up, so there are hard coded paths and firmware offsets, but perhaps it can be useful.

Edit: I had some trouble dumping the flash sometimes, probably because of the state the hardware was in at the time that topflash started accessing it. I found that it was safest to always start by dumping the first 32 or so bytes from the flash before doing anything else, just to ensure that nothing else in the scope was using the data bus or address bus, and if those bytes came out wrong, I restarted before trying again.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: rezinj on July 17, 2020, 06:14:12 am
I used your setting file and started to read the dump file. i did it throuth xillinx prallel cable programmer and it took about 6 hours. once i used jlink programer the reading time was more(frequency should be very low_1khz). i read the dump file 2 times and each time it wase different. i have to say because my programer need power i turn on oscilloscope to source it throuth +3.3v pin.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: adron on July 17, 2020, 08:39:26 am
I used the segger programmer clocked at 1 MHz; I started at 500 kHz and it was stable so I tried increasing. At 1 MHz I had no errors that seemed to be due to the clock frequency. Dumping the entire flash took a little over one hour, but it is only relevant to dump the parts that are written by the rom, which was the first half in my case. I used 15 cm interconnection wires, it is good to keep them short. The scope has to be powered, the programmer does not power the circuitry. I had a few instances of different dump because the scope was in a bad state when the JTAG interface took control, which caused the first few hundred bytes of the dumps to come out different. Every other time the dumps were exactly the same. When there was a problem, the beginning of the dump was alternating 0x25 0x00 bytes.
 
Compare your dumps: Do they differ in a few bits? Do they differ in many places but are same in some? Is there only a particular range that is different?

Try dumping only the first kilobyte so you can test quickly?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: rezinj on July 17, 2020, 11:28:11 am
are you sure about the setting that you uploaded? i used your setting and read several time. each time some different datas.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: adron on July 17, 2020, 12:56:50 pm
are you sure about the setting that you uploaded? i used your setting and read several time. each time some different datas.

I am fairly sure about it. At least it was the settings file that I used for reading out my dumps, and I reloaded it a few times. It is possible that your oscilloscope is a different hardware version and that it requires different parameters. I screenshotted all of the settings as well, do they match what you had set up?

If most of the data that you read is the same but some differs, I would guess that you are clocking it too fast or that your adapter is malfunctioning. Are all your connections secure? Does detecting/validating the jtag chain work? Does detecting the flash type work?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: patty.o.furniture on July 18, 2020, 09:17:40 pm
Thanks for posting the settings @adron. I've been crazy busy lately.

I can dump the ROM with your settings just fine at 4 MHz. Only a few bytes change here and there between power cycles, but it's the same one or two addresses. I went down to 1 MHz with the same behavior so I'm hoping it's normal.

My dump starts to differ very early on, at address 0xFFEB, but I find long chains of bytes from the RGL data scattered throughout the dump. They tend to be on page boundaries. It's very odd to me.

The other thing I noticed is that I can't seem to write to the low addresses. Probably need to change AWE_B to '0' for that to work.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: rezinj on July 19, 2020, 05:18:42 am
i agree with you. my hardware version is different than others. for example my flash ic is on the buttom layer. how can i found out i read the flash right? i'm sure aboaut reading the chain. should i use multimeter to check the pin connection of flash and other ICs?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: rezinj on September 01, 2020, 07:03:48 pm
any one know where Mr drieg is? i was in connect with him via Gmail. he told me send your dump file for me to repair it. i sent my dump file to him and now he dosen't answer me! any one know him? any one know how i can connect him? any thing bad happend to him?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: darciopp on September 04, 2020, 03:30:04 am
Hello Folks

Anyone here would like to get my DS1052E board to bring it back to life, since it is bricked after an original rigol firmware "upgrade"?

I can pay for that.

Please, PM me!

Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: MiguelAReis on September 09, 2020, 09:24:59 am
Hello, I managed to dump my bricked DS1102E's Flash. Can someone fix it for me? I have no idea on how to do it.

Thanks
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: darciopp on September 09, 2020, 01:56:00 pm
Welcome to the Happy Rigol Bricks Owners Club.

Maybe some units were counterfeit or "after hours" production from a third party manufacturer and Rigol decided that it was hurting its business.

Maybe some genius thought "Lets brick them, just like FTDI made with the counterfeit USB-UART bridge chips" and voilá: a complete set of unusable products. Very clever!

Do they have the right to do it? Sure, but this raised only anger from the community. I can't believe that there wasn't another way to get this around.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: MiguelAReis on September 11, 2020, 10:21:40 am
Well I managed to unbrick my DS1102E but now the serial number is gone and it says its mode is the DS1052E. If anyone could help, I would appreciate it.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: tamamontu on January 20, 2021, 06:07:42 am
Hi There,

I tried to update firmware on my DS1052E and its got bricked. Original firmware was 00.02.01 SP3, i tried to upgrade to 00.04.02.01.00 firmware upgrade process went ok but after restarting the oscilloscope its not working any more, just see white screen.

I read through the forum and trying to figure out how to read the flash. At the start of the forum it  was mentioned to desolder the flash chip half way through the forum i saw a photo where in JTAG connector was connected to the pins on the board and didnt need any desoldering.
https://www.eevblog.com/forum/blog/the-dark-side-of-the-rigol-hack-bricked-scope-how-to-fix-it/msg3115944/#msg3115944 (https://www.eevblog.com/forum/blog/the-dark-side-of-the-rigol-hack-bricked-scope-how-to-fix-it/msg3115944/#msg3115944)

I got a Olimex ARM-USB-Tiny Jtag adapter board could that be used to read the flash contents.

Would any one have a hex dump for firmware V 00.02.01 SP3 Pls.

Thanks
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: darciopp on January 20, 2021, 12:54:30 pm
I tried to update firmware on my DS1052E and its got bricked.

Welcome to the club!

I'm trying to get mine back to life again with no success too
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: tamamontu on January 21, 2021, 07:30:14 am
I got a older firmware version file .RGL for this scope. Could some one please explain how to program this to the flash would help a lot to recover the scope.

thanks
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: eleknam on January 23, 2021, 07:17:30 am
Hi help my DS1102CD. After update bricked DS1102 )). How to extract the dump from the   DS1000EUpdate.RGL file.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: danand on January 24, 2021, 11:11:09 pm
Hi,
when I bought my DS1052E, I did the 100mhz hack (over serial) and upgraded the firmware to 02.04. It went all well and good.
Time flies and my first child was born, second child followed and all my electronics hobby dried up.

Yesterday I built up my electronics workbench again and thought it would be a good idea to update the oscilloscope, since there have been a few firmware updates.

Well, or not so well: the firmware update ran, the DS1052e restarted and after short flickering a black screen is the only thing which is coming up.

I currently have no idea how to solve it on my own, and I am afraid to kill of the calibration data by tinkering around on my own.
I sent Drieg a message, but I am not confident if he still fixes boards, since he started this 10 years ago ...



Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: adron on January 27, 2021, 09:53:31 am
Hi,
when I bought my DS1052E, I did the 100mhz hack (over serial) and upgraded the firmware to 02.04. It went all well and good.
Time flies and my first child was born, second child followed and all my electronics hobby dried up.

Yesterday I built up my electronics workbench again and thought it would be a good idea to update the oscilloscope, since there have been a few firmware updates.

Well, or not so well: the firmware update ran, the DS1052e restarted and after short flickering a black screen is the only thing which is coming up.

I currently have no idea how to solve it on my own, and I am afraid to kill of the calibration data by tinkering around on my own.
I sent Drieg a message, but I am not confident if he still fixes boards, since he started this 10 years ago ...

I did just about exactly the same thing: Back to electronics after having kids, then stupidly assuming that it would be a good idea to start off by updating the firmwares to the latest versions on all my equipment, and ending up with a bricked scope. But it can all be rescued with a couple hours of work if you have (or buy) a JTAG interface that works with the topflash jtag programmer, and hook that up to the scope.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: danand on January 31, 2021, 02:09:26 pm
My dump starts to differ very early on, at address 0xFFEB, but I find long chains of bytes from the RGL data scattered throughout the dump. They tend to be on page boundaries. It's very odd to me.

Same on my side:
comparing with HxD the first different block starts are 0xFFEB

The output of Program.cs is somehow differnt from i.e. FlexHEX binary compare.  I am currently in the situation that I don't want to overwrite important data inside the lower 4MB of the flash with the DS1000EUpdate.RGL file.

However, Programming via Topjtag results in Erase Timeouts. I checked out the static pins, but I have no idea what else I could do to get past the write timeouts. :-(

Cheers
Daniel
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: adron on January 31, 2021, 03:02:02 pm
My Program.cs expects there to be a header on the RGL file. That might explain your differences if you removed the header.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: danand on January 31, 2021, 03:17:06 pm
My Program.cs expects there to be a header on the RGL file. That might explain your differences if you removed the header.

Aha! That explains it.

PS C:\Users\daniel\Downloads> .\Program.exe
Diff at 0000FFEB len 00142E7E
Diff at 00190000 len 00006670
Diff at 00198000 len 00006775
Diff at 0019FFEB len 00030000
Diff at 001D2F03 len 0000000C  flash: 13:20:04:00:60:15:20:02:00:C0:17:20   rgl:00:00:00:00:00:00:00:00:00:00:00:00
Diff at 001D3000 len 0001CFEB
Diff at 001F8000 len 00208000

Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: danand on January 31, 2021, 05:16:13 pm
I still struggle with programming the flash via TopJTAG. I always get Timeout while erasing 000000h to 001FFFh. 

All the rest of the flash can be erased without problems.

Also reading works reliable at 1Mhz.

Could anyone point me to a path what I could do to get around the timeouts?
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: danand on February 01, 2021, 10:58:09 am
Somehow the flash worked so far. I have a mostly working screen again.
Firmware is flashed to 00.04.02 SP1 , but I only have asian fonts in the side menu.  At least I am a step forward.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: danand on February 01, 2021, 12:19:54 pm
I got it!

I just created another USB Stick FAT32 formatted with the DS1000EUpdate.RGL File. Even without the right font, I did the update procedure again.

Then after powering off and on, the DS1052E came back to life :-)

So as long as you have the Segger J-Link-Mini, an adapter for 2.54 connector, a 1k Ohm resistore, a few jumpwires and a breadboard, you can revive the the Rigol DS1052E :-)

Thanks for all the great support :)

Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: eleknam on February 02, 2021, 05:01:12 am
Good afternoon, you can bring the wiring diagram of the wiring JTAG  DS1102CD
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: open loop on May 12, 2021, 10:14:51 pm
Just adding my expereince to this issue.

I while ago I got a DS1052E cheap from eBay as it would not boot at all. It just gave a blank screen - it would not work at all!. Anyway I did the usual checks on the PSU and on board PSU test and I must thank Helene for his hardware studies on this device. Anyway after checking all of this I decided to look at the BlackFin BF532 proc and found it was set up by the BMODE pinns to read from I2C flash chip. Also checked the reset line and clock but I was confused about the zero activity on the I2C of this flash chip. Ithen got hold of a Jtag Tool (Jllink EDU) and wired as directed in previous posts - many thanks for the helpful posts on this thread for setting up Topjtag etc.

From what I now know it seems that not only does the spansion flash chip hold the Firmware for the BF532 but also for the FPGA and possibly the Lattice LCMX0256C - which i think is configured as a memory controller. Anyway when look at the first few thousand bytes of firmware all I got was FF so I thought that the Jtag was not working! so then reomved the Spansion memory chip and then used my TL086 programmer wirh the TSOP 48 adapter to read the firmware. It seem that the Jtag tool was working fine! as all of the initial bytes were at FF up to chip memory address 4FFFF so it looks like that this device had failed in doing a FW update/downgrade.

I then generated a new file joining the firmware from the Rigol forwmare update file (after removing the 21 bytes) and the 2nd half of my original Firmware downladed image. I resoldered the Spansion chi[p back onto the main board and all seemed to work (yippe). Noticed that when adjusting the V/div the trace would jump all over the place. I then re-calibrated the scope but after this it crashed in 2 mins and would not re-start. When it does re-start I was able to re-flash the firmware from USB. Anyway I think the firmware image I created was not quite right.

One interesting point I found was that if I disabled it's data aquisition by presing the run stop to stop with the red LED showing. It seemed to boot more reliably? Anyway I have now reached the limit of what I can do with this repair and I need Dreig's help as he is the person who is able to perform the required magic to the broken firmware images. tried to PM him but I totaly understand that he has a life to lead and may not visit the forum for months on end.

Just adding my 2 cents worth and hopeing that Dreig may be abe to help.

DS1052E
Board has Demo 08 so it's HW version 58
PCB version is 94V-0
Runing version 04.02.01.00 of Firmware.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: f7a7f7a7 on June 02, 2021, 05:57:08 am
Dear Drieg

I am a loser update my Rigol DS1052E to 100M :(
Google lead me to this post when I near give up the DSO. I saw lights in dark.
My DSO's HW version is 03 with firmware 01.02 sp2 originally. Now it's partially working on 04.02.01 and 02.02.02.
Partially working meaning is boot up ok and can enter main menu, but no signal show on screen (no signal line for neither CH1/CH2)
When I do auto-calibration on firmware 04.02.01, screen is blocking on CH1 calibration screen, no moving of progress bar.
When I do auto-calibration on firmware 02.02.02, calibration will finish within 5 min, but still can't see signal line.
I also send you a PM and hope you can help save my DSO.

Thank in advance
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: f7a7f7a7 on June 04, 2021, 01:20:24 pm
Thanks for your sharing. Appreciate very much!
Actually I already PM Drieg for long time. But ten years passed, not sure if he will go back to this blog, everybody has his own life!
So I turn to man who may have the fixed firmware for help.
Anyway, I will compare your firmware with offical one and my mem dump.
Hopes the old DSO can back to life.

Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: frankzam on June 13, 2021, 02:52:58 pm
Good afternoon everyone, after connecting with dl ds1052e through jtag, according to the steps described in this blog, when internalizing, save the memory with the modified firmware 0.4 downloaded from pages back, at 1mhz, it records it, but when verifying it gives me verification error. Could someone with more experience advise me? Thank you so much
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: Mechatrommer on February 14, 2022, 05:31:46 pm
while testing my Battery Powered PSU for Portable Rigol DS1000E/Z (https://www.eevblog.com/forum/projects/battery-powered-psu-for-portable-rigol-ds1000ez/msg4000525/#msg4000525) i got a unstable condition that the DSO stopped and crashed with random color on the screen. when i restart the DSO, the CH1 trace is missing, when doing recalibration, CH2 trace is missing, now both are missing even though countless self-cal and tinkering was done. i suspect it experiences another calibration data corruption as i've experienced about 11 years ago. Drieg helped me fixed my cal corruption before and i still keep the firmware ver 2.0.2, the problem is... i've upgraded the 1052E to ver 4.2.1 sometime ago, and now it refuses to downgrade back to 2.0.2 to do the calibration repair.

but i think i will insist on downgrading to 2.0.2 because it was easier to repair in that version. so based on Drieg's OP post i have no other option than re-flashing the FW through JTAG. i've not found a way in the net to downgrade ver4 to ver2 using USB drive, i've spent many hours today try to read this thread, to recap where i was 11 years ago, and to blow the dust and setup my old knock off Segger J-Link for JTAG flashing. installed the TopJTAG and i have 20 days left to get all this done before it expires and ask for $100.

our dear friend here indicated he used J-Link Edu, but i only have knock off J-Link laying around. based on Drieg's post, i only have to connect to Blackfin's JTAG interface to access Spansion flash, so i did the minimalist connection based on ivi_yak's diagrams (https://www.eevblog.com/forum/blog/the-dark-side-of-the-rigol-hack-bricked-scope-how-to-fix-it/msg3043196/#msg3043196) posted earlier, i skipped the resistor thing and connection to lattice JTAG thinking that it should be ok. turn the dso on, run the TopJTAG and try to detect the JTAG chain, unfortunately none is detected. so i'm out of trick this late night, i'm asking for help and idea on what i'm doing wrong. attached pictures are my setup.

2nd night edit: i managed to get jlink to detect the blackfin device with the following edited attachment, next thing is to figure what is the flash address and static pins means in topjtag setting  :-//..

hope to hear from you people thanks.
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: uoemx on March 23, 2022, 04:24:59 am
Hi everyone I want to help everyone on this topic.
I would remove the flash memory and do a full flash backup using an RT809H or TL899, or similar on my machine in normal use
You load into your Rigol DS1052E, the machine will use normally. All software version serial numbers will of course be mine.
If you agree, I will back up my device and send it to you. Thread may end and this is the final solution and 100% working
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: uoemx on March 23, 2022, 06:19:30 am
My machine can't adjust the trigger to make the signal stable, maybe hardware failure. Can someone tell me what to check?

Status here
https://www.youtube.com/watch?v=FiRbbeDupJ8&ab_channel=04NV340 (https://www.youtube.com/watch?v=FiRbbeDupJ8&ab_channel=04NV340)

here full fLASH 8Mb
https://www.mediafire.com/file/3x54qaymlws23mh/Rigol_1052E.zip/file (https://www.mediafire.com/file/3x54qaymlws23mh/Rigol_1052E.zip/file)
Firmware update 100Mhz
https://www.mediafire.com/file/0gtsusastgtheyk/Rigol_1052E_hack_100Mhz_Tested.zip/file (https://www.mediafire.com/file/0gtsusastgtheyk/Rigol_1052E_hack_100Mhz_Tested.zip/file)
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: malamig on January 21, 2023, 08:29:52 am
Hello!
I was able to restore my 1052E from the dump file gave by UOEMX.
FW Version now is 00.04.02.01.00
However, I cannot upgrade to 100Mhz. Maybe I need to downgrade the FW to 2.04.
I tried both thru Serial command and USB FW but no luck.

Anyway, for now I will just keep my scope running on 50Mhz. Thank you UOEMX!
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: uoemx on January 23, 2023, 09:32:10 am
No problem malamig.  I have finished fixing my oscilloscope.  I have shared the diagram and the broken part, everyone can see the reference.  The diagram is here: http://rigol.codenaschen.de/index.php/Schematics. (http://rigol.codenaschen.de/index.php/Schematics.) 
Here's where I did it
Title: Re: The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it...
Post by: prieten on June 22, 2023, 10:54:23 am
Hello, my RIGOL DS1064B oscilloscope is not working properly after the update. Does anyone have the firmware in the Flah memory S29GL064N90TFI04 for hardware version DB 4.3. I mention that after the update the USB ports are no longer functional, the only solution is to rewrite the flah memory.  Thank you in advance.