The Rigol DS1052E

[saturation]

I'm sorry to hear of this, this is what I fear can happen albeit its not been the majority of reports.  I hope there is a solution to this problem.

I've set up a poll to find out how many have done the mod and succeeded, not done the mod, done the mod nothing happened, finally done the mod and lost the scope's functionality.

[Mechatrommer]

I've set up a poll to find out how many have done the mod and succeeded, not done the mod, done the mod nothing happened, finally done the mod and lost the scope's functionality.

i'm not in the list. i've done the mod partially succesful... and partially lost the functionality. partially means... some bad... and some still good

@halman... i think there are 3 ways i can suggest:
1) find out yourself if there is a way to re-flash without poking the hardware out, i've searched and found nothing. next move... is yours tell us if you've found out.
2) poke out the flash, re-program it parallely
3) sneak into rigol company, ask the good engineer inside, on how to do it.
I might suggest the 4th, but... maybe that isnt friendly... buy another one and dont do the mod whatsoever. Cheers!

[beerhunter]

The biggest problem I had was getting the RS232 port to talk to the Rigol. I tried the USB adapter and gave up after a week of frustration. My old IBM laptop with a real 232 port refused to work also even though it
works programming a few radios I have.

I finally discovered that my old P4 downstairs has two 232 ports and worked just fine to upgrade it to a 100 Mhz. scope. I also got my scope from Tequipment and I wonder if I trashed my warranty with the hack.

Anybody know if its possible to upload the firmware from a 2.04.01 scope and get it on a USB stick? I have searched far and wide to find the FW with the help files to no avail.

[Mechatrommer]

halman... u ar better than i am since you have access to the programmer. if i have it, i'll poke the spansion out... carefully, read the content and compare with the firmware file *.rgl and make some necessary mod/hack. i wish u could read the content and publish here... i can give my "free" service to analyze it ;P. there must be still some usefull data inside to do the matching. we can re-modify it, and repair yours, and... i can find the location for the calibration data... to repair mine

[beerhunter]

"It must have been an incomplete flash. I inserted an usb stick with the firmware and ran it from the menu system, once it was done I restarted the scope, it was then it refused to start up properly. Strange things go on with the button lights they light up randomly and if i do quick restarts they move...it looks kinda like a counter is incrementing."



Halman, what if someone was to send you a working USB stick that was known to work fine and try to re flash your firmware? Seems to me that two possibilities are present. One, your USB stick is trashed. Two,the copy of the FW from your computer to the USB stick is trashed.

I think this might work cuz' sometime in the manufacturing process the CPU memory is a clean slate and someone has to flash the FW into the system.

Where do you live? If in the states a whole bunch of us has done the upgrade and still might have the stick handy with the 2.04 FW on it.

(EDIT) Dang it! I just checked my stick and its blank, sorry.

[beerhunter]

Just got a reply from Rigol NA in Ohio. A firmware bricked scope will cost "North of 200 bucks in parts and labor" to fix. The repair not covered under warranty of course and a hacked scope is NOT covered under warranty anymore.

Got no answer if a bricked scope can be fixed by just re installing a USB stick firmware download. Would really like to see if it can be done though.

[alm]

Either they replace the complete mainboard (not unreasonable if the IC is soldered down), or they just want to discourage hacking it. Can't argue with the fact that hacking it voids the warranty.

[Polossatik]

@ halman: just to know, did you use the firmware file included in the "DS1052E to DS1102E.zip" file ?

I also added a extra warning to the USB guide to double check your USB stick works with the rigol.

[beerhunter]

Now heres an interesting development. Rigol NA in Ohio sent me a version of the firmware that is only designated 00.02.04 .I asked them to send me the latest FW with the help files. So I was expecting the 00.02.04.01 file.  I was in a what the hell mode so I loaded the file into my USB stick and shoved it into the front panel port. It immediately told me that there is a higher rev FW and do I want to update?

Sure, what the hell and I hit the OK button. Not expecting much I reset the scope after it was done and now the help files are working again!! Yayy!! I am glad I didn't turn the scope into a wheel chock or a brick.
If anybody is interested I'll attach the file or you can contact Rigol in Ohio directly for the file.

Oh, and the 100 Mhz. upgrade is still there so not to worry.

[rf-loop]

Whole version is not (afaik) displayed on scope system info. 00 and 01 displays in system info as 00.02.04
You can ask it with *IDN command and there may be 00.02.04.01 or something else.

[beerhunter]

Whole version is not (afaik) displayed on scope system info. 00 and 01 displays in system info as 00.02.04
You can ask it with *IDN command and there may be 00.02.04.01 or something else.

Now its getting to be more fun. You're right, only using the *IDN command via the RS-232 port does the full revision number show up. My scope is now at firmware  00.02.04.00.03 .


You can now download this firmware version at the USB upgrade for dummies thread. This file was downloaded directly from my USB stick that was used for my scope.

[slburris]

I've update my scope with this firmware, and the help menus
are indeed back!  Nothing bad seems to have happened :-)

Thanks!

Scott

[beerhunter]

I've update my scope with this firmware, and the help menus
are indeed back!  Nothing bad seems to have happened :-)

Thanks!

Scott

Great! Thanks for the report Scott. I was(am) concerned that it would go right on other scopes.

[claes]

My scope is now at firmware  00.02.04.00.03 .

You can now download this firmware version at the USB upgrade for dummies thread. This file was downloaded directly from my USB stick that was used for my scope.

Works as advertised Now my firmware is 00.02.04.00.03 (verified using usb-cable and "Visa VC demo"). Help system also works. And it still reports DS1102E.

[beerhunter]

My scope is now at firmware  00.02.04.00.03 .

You can now download this firmware version at the USB upgrade for dummies thread. This file was downloaded directly from my USB stick that was used for my scope.

Works as advertised Now my firmware is 00.02.04.00.03 (verified using usb-cable and "Visa VC demo"). Help system also works. And it still reports DS1102E.

Nice!! Now I can sleep better, THANKS!

[Meiner]

Hello,

I seem to have bricked my scope while performing the firmware downgrade… When I restart the scope it does not boot up but one can see that the lcd is turned on but there is no image…

Any tips, can I somehow trigger a reflash from this state?

I have access to the necessary equipment to desolder and reflash most types of memories in a programmer .. but i rather not if there is any other way… 

Hello Everybody,

I'm new on this forum... also tried the firmware downgrade, but unfortunately used the 02.01.01 Firmware for downgrading. Result was the same as Halman's:
Fan running, but no image on the screen and no response on USB and RS232.
I was trying to figure out the pinning of the internal JTAG header:


                --------
                | o   o |
                |        |
                |      o |>  GND
                |        |
       GND  <| o   o |>  CPU Pin85 = TMS
                |        |
       GND  <| o   o |>  CPU Pin94 = TCK
                |        |
       GND  <| o   o |
                |        |
       GND  <| o   o |>  CPU Pin86 = TDI
                |        |
       GND  <| o   o |>  CPU Pin87 = TDO
                --------

There should also be a 3V3 Pin at least on the header, I haven't checked it yet.

Flash S29GL064N90TFI04 runs at 3.3V, word-mode

CPU ADSP - BF531

    Pin95-BMODE1 = 0V
    Pin96-BMODE0 = 3V3
--> Boot from (16bit) Flash

The CPU's datasheet mentions a internal ROM; I'm not sure if it's really a ROM (meaning that even Rigol hasn't changed it) and I want to find out it's content. My goal is to get access to the CPU via the JTAG interface to try to reflash the FLASH.

Has anybody found out about the Flash's layout? It's 8MBytes large, but the *.rgl files are only 2MBytes large...?

@halman, shafri: Please give an update about your work.

Thanks
Meiner

[Mechatrommer]

*.rgl is 4MB (thats in my keeping 2.02 and 2.04) but mostly blank inside, i havent thought of the ROM thing, might some useful data from inside. JTAG i found is similar to yours. i remember those ground"s" pin"s". but i dont have the JTAG programmer, so whats the point? for me! i cannot trace the Altera connection to the spansion since its BGA underground, rigol PCB is at least 3 layers, so .

my only hope lies in the dissambly of the rigol FW, finding where the important interrupts point will be and crack it to take control from there. but i never got strong feeling for it, i want to continue to make some productive work to do. and.... nobody seems interesting, since i guess, its the software thing, and... the undocumented one btw: if anyone want the nicely (well... not so nice) compiled opcodes for blackfin BF531 in csv/xls format, be happy to ask. i've done it in the hardway.

your problem same with halman is worst since i dont see your rigol will ever reach the interrupt (USB FW re-upgrade, RS232 comm etc), probably you've tossed your bootloader as well! a brighter hope lies in halman, since he got parallel programmer as he mentioned.

[Meiner]

*.rgl is 4MB (thats in my keeping 2.02 and 2.04) but mostly blank inside, i havent thought of the ROM thing, might some useful data from inside. JTAG i found is similar to yours. i remember those ground"s" pin"s". but i dont have the JTAG programmer, so whats the point? for me! i cannot trace the Altera connection to the spansion since its BGA underground, rigol PCB is at least 3 layers, so .

my only hope lies in the dissambly of the rigol FW, finding where the important interrupts point will be and crack it to take control from there. but i never got strong feeling for it, i want to continue to make some productive work to do. and.... nobody seems interesting, since i guess, its the software thing, and... the undocumented one btw: if anyone want the nicely (well... not so nice) compiled opcodes for blackfin BF531 in csv/xls format, be happy to ask. i've done it in the hardway.

your problem same with halman is worst since i dont see your rigol will ever reach the interrupt (USB FW re-upgrade, RS232 comm etc), probably you've tossed your bootloader as well! a brighter hope lies in halman, since he got parallel programmer as he mentioned.

You are right, the *.rgl is 4 MBytes. That's exact the size of the 4 async memory banks in the ADSP CPU (datasheet page6, starting at address 0x20000000). That's the cause why the *.rgl is only 4 MBytes while the flash is bigger (but cannot be fully accessed by the ADSP CPU). Boot mode 01 (Use boot ROM to load from 8-bit or 16-bit flash) starts the internal boot ROM with a 10-byte header read from the external flash to load the internal code memory and start executation from there afterwards.

I didin't understand why you want to trace from the altera to the spansion flash? In my opinion the flash is connected to the ADSP-BF531, not to the altera. I'm still trying to find a way to reflash the spansion via the ADSP's JTAG interface? If not possible, Plan B would be to desolder the flash and replace it with a new one flashed in an external programmer.

I think the 02.01.01 firmware I used for downgrading uses a different boot block inside the flash which is not compatible with my hardware. Replacing the whole 4MBytes flash content should therefore make the scope work again. I only hope that the 4 MBytes used are at the beginning of the entire 8MBytes flash...

[Mechatrommer]

I didin't understand why you want to trace from the altera to the spansion flash? In my opinion the flash is connected to the ADSP-BF531, not to the altera.

some other forumers speculated that the 8MB spansion is shared between the blackfin and altera. and my specific problem is with the internal calibration data which possibly lies in the next 4MB which inaccessible to blackfin.

I'm still trying to find a way to reflash the spansion via the ADSP's JTAG interface?

if you have the JTAG programmer, then i think you should find the manual for the adsp on how to say... program it, read or write to spansion from the programmer. but be sure to backup at least the bootloader. if you lost it, i think you can program the adsp for other kind of DSO , i've found one open source attempt on a certain dso brand, cant remember whats it, its somewhere here in the net. the hardware is pretty close to our rigol.

If not possible, Plan B would be to desolder the flash and replace it with a new one flashed in an external programmer.

do you have the original content? if not, how u gonna fill the blank flash?

I think the 02.01.01 firmware I used for downgrading uses a different boot block inside the flash which is not compatible with my hardware.

why go down further to 2.01? ppl suggesting just downgrade to 2.02? i might have missed the earlier forum/posts

Replacing the whole 4MBytes flash content should therefore make the scope work again. I only hope that the 4 MBytes used are at the beginning of the entire 8MBytes flash...

i really hope so, and you can report your success and more usefull data for this rigol hacking.

[akschu]

I'm been reading about this for a little while, but I still am not making much sense of this.

Can someone tell me if this mod still works on the currently shipping scopes or did they fix the problem in the newer firmware with no way to revert?  I would like to do this if it's not too late.

schu

[rf-loop]

Read carefully this:

https://www.eevblog.com/forum/index.php?topic=553.0



 ...and follow it carefully step by step.

(first you need "downgrade" FW to right version for mod (new versions are "modification locked"! (be careful: use exactly right FW version and check it before insert USB stick to front USB connector of scope.)

------------

Also nobody know what time Rigol do next  HW/FW versions and they maybe do not accept downgrade FW to 02.02xxxx versions.
(I believe they are thinking it... but also nobody know what is wise for....for what... selling volume is only one point. In every case DS1000E do not kontinue in production long time forward) In every case Rigol name is now more well known as before DS1000E series...

[Meiner]

Hello again,

I've desoldered the spansion flash and read out the content (file.rar). Last Action before was downgrading to 02.01.01 (the packed *.rgl file in the attachment). I want to analyze the file to find out, where the *.rgl file has been placed. With this information I hope to be able to replace the 01.01 with a (working) 01.02 or 01.04.

Thans for any comments
Meiner

[marianoapp]

i've been looking the files and i think the *.rgl hasn't been placed anywhere..   

the *.rgl has over 2MB worth of content, yet the the other file barely reaches 140KB [not counting the big blocks filled with 0x00 and 0xFF in neither file]
i've also been unable to find anything meaningful or code-like in the other file, except for the model and serial number. The model it's stored at position 0x1FFF40 and in reverse byte order [LSB?], e.g. "SD0125.E"

oh, and the other file content starts all over again at position 0x400000

[Mechatrommer]

I've desoldered the spansion flash and read out the content (file.rar). Last Action before was downgrading to 02.01.01 (the packed *.rgl file in the attachment). I want to analyze the file to find out, where the *.rgl file has been placed. With this information I hope to be able to replace the 01.01 with a (working) 01.02 or 01.04.

i agree with marianoapp, i cant find any codelike data inside. by just looking at the flash compressed file 71KB vs original 8MB, your flash only contains a highly redundant bytes with some database/structured/tabular like format chunks inside. maybe your flash got formatted by the bootloader or something... i think.

added: the bin is separated into 2 equal sized 4MB space with a header in each section... the contents are identical except in the middle of 1st section (around 2MB location, some additional data OOOOPPPP..CCCCC where in the same location for the 2nd section, its emptied with FFFFFFFFFFFFFFF

this is interesting, @meiner & others... can you suggest a flash reader to me, if the price and availability is right, i think i'm going to get one as well to read my spansion, preferably from ebay, cheaper but reliable. i'm suspecting something from the tabular data in the flash bin, but i think better not to say it for now, only speculating.

ps: i wish a more generic eeprom reader that can read not just spansion, but samsung, atmel etc, so it will be more useful to me, i got quite a number of salvaged samsung eeprom here.

[Meiner]

The model it's stored at position 0x1FFF40 and in reverse byte order [LSB?], e.g. "SD0125.E"

You're probably right, the byte order in the file.rar may be wrong. I have no flash reader of my own, so I went to a local dealer who sold some stuff to the company I work for, asked him for some help and he read the spansion's content for me. After reading he told me that the byte order might be wrong and that he could simply flip it. Because I didn't know the right order, I told him not to do so.

@shafri: sorry, I can't remember the brand of their flash reader, but I think it was an expensive one...

I came to the same result: the spansion's content is quite poor. Anyhow I don't think that the *.rgl code is placed in any other non-volatile storage inside the scope, so it should be in the spansion. I have no idea why it isn't. But I guess that's why my scope is definitely doing nothing but blowing the fan.

Next step for me is to find out the correct spansion's content. Maybe I should try to write the *.rgl (without the first 16 byte header) to the lower 4MB and just try it. But on the other hand I can't try this often, because the spansion has no socket.... any suggestions where to get a socket?

Thanks
Meiner