Sniffing the Rigol's internal I2C bus

[MaxwellsSilverHammer]

It looks like from the screenshot you have found an other hidden menu, where you can enter the scope model, serial number, and fan speed !
Question now is how to get there 

No, I have not found how access to the hidden menu, if it exists. I wish.
Is only that I think there is the possibility to modify the S/N modifying the firmware. And it may only work in some cases, I have not tried.

The capture Hidden_Menu.JPG only shows the ASCII strings of a possible menu.

I thought I read somewhere in this thread where you can access the hidden menu via certain keystrokes. I may be wrong or maybe dreamed it, lol. I will look again and if I find it I will quote/repost here

The keystrokes must be simple and accessible by 4 finger press usually from my experience. I will try and hack it and let you know if I am successful. Cheers

[Carrington]

Ok, I can not wait ... 
LOL...

[cybernet]

infos there -> https://www.eevblog.com/forum/testgear/dg4000-a-firmware-investigation/msg282750/#msg282750

[true]

Please someone who has had the problem with the S/N:
 What S/N have you used to install the options, after the "failure", DS2A0...01 or original S/N?

after failure, original will no longer work, must use the sn reported on info screen.

[Carrington]

Please someone who has had the problem with the S/N:
 What S/N have you used to install the options, after the "failure", DS2A0...01 or original S/N?

after failure, original will no longer work, must use the sn reported on info screen.

Thank you very much.
Now look at this picture:

EEVBLGTECHNOLOGIES??? DS2A140000000???
cybernet: How did you do that?

[cybernet]

ds1000z seems to use the same ecc parameters and private key as the DS2000, so the rikey.c should work (with the ds2000 priv key).
option bits are unknown as i have not yet seen a trial or official key - somebody should try it.

[tinhead]

ds1000z seems to use the same ecc parameters and private key as the DS2000

where you got that? Not from firmware, so i assume you checed PC sw?

[Rory]

So, can you change the FFT trace color ?

[cybernet]

ds1000z seems to use the same ecc parameters and private key as the DS2000

where you got that? Not from firmware, so i assume you checed PC sw?

a user PM'ed strings <firmware.GEL> - curve parameters, primes all the same - public key is different, but derived from the same already known private key, they just used another seed value to generate it - so i believe it will work out of the box with the DS2k keygen.

[nack]

Today I've got my stock DS2072 scope and hooked it up to a home build pulse generator which surprised me!

It is bone stock and havent't entered any license codes yet. Having about 2050 trail minutes left, it clearly shows a much higher bandwidth than the claimed 70 MHz. I've measured a risetime of 1.646ns (50 Ohm terminated) which equates to a bandwidth of roughly 210 MHz. It looks like the higher bandwidth 'option' is also active during the trail period?

[darrylp]

You need to extend the pulse at its high level. The scope is doing a 10 to 90 measurement on a pulse that no doubt doesn't reach its proper peak.

--
 Darryl

[Orange]

Today I've got my stock DS2072 scope and hooked it up to a home build pulse generator which surprised me!

It is bone stock and havent't entered any license codes yet. Having about 2050 trail minutes left, it clearly shows a much higher bandwidth than the claimed 70 MHz. I've measured a risetime of 1.646ns (50 Ohm terminated) which equates to a bandwidth of roughly 210 MHz. It looks like the higher bandwidth 'option' is also active during the trail period?

Is the option screen showing you a 200MHz option ?
Is the system info screen saying it is a DS2072 ?

When I got mine DS2072 there was a standard 4 ns rise time, so I guess Rigol is now giving it away on their 70MHz models, or they made a stupid mistake by configuring it wrongly.

Another possibility is that your scope has been altered by the dealer/seller.

[Orange]

You need to extend the pulse at its high level. The scope is doing a 10 to 90 measurement on a pulse that no doubt doesn't reach its proper peak.

--
 Darryl

You can clearly see from the picture that the rise time is about 1.5 to max 2 ns. so what the scope indicates is probably OK

[nack]

Is the option screen showing you a 200MHz option ?
Is the system info screen saying it is a DS2072 ?

When I got mine DS2072 there was a standard 4 ns rise time, so I guess Rigol is now giving it away on their 70MHz models, or they made a stupid mistake by configuring it wrongly.

Another possibility is that your scope has been altered by the dealer/seller.

The option screen shows a regular 2072 and I have checked the rise time is calculated correctly at the 10% and 90% limits as shown by the cursors set to Auto.
I doubt the dealer has tweaked anything, initially the DS2072 was sold out and it took another three weeks for mine to arrive.

[darrylp]

You need to extend the pulse at its high level. The scope is doing a 10 to 90 measurement on a pulse that no doubt doesn't reach its proper peak.

--
 Darryl

You can clearly see from the picture that the rise time is about 1.5 to max 2 ns. so what the scope indicates is probably OK

Go watch some Rev blog videos where Dave and others had to extend the pulse width to get a full pulse so that scope will measure / calculate the right rise time ...   And hence lead you to a closer analog bandwidth setting.
--
 Darryl

[Orange]

You need to extend the pulse at its high level. The scope is doing a 10 to 90 measurement on a pulse that no doubt doesn't reach its proper peak.

--
 Darryl

You can clearly see from the picture that the rise time is about 1.5 to max 2 ns. so what the scope indicates is probably OK

Go watch some Rev blog videos where Dave and others had to extend the pulse width to get a full pulse so that scope will measure / calculate the right rise time ...   And hence lead you to a closer analog bandwidth setting.
--
 Darryl

I agree with you that the pulser would benefit from a pulse lenght that is longer (replace the capacitor with a open 50 ohms coax of 30 cm), but in this case the pictures from nack leave no room for mis-interpertation, and the measurement is correct !

[darrylp]

You need to extend the pulse at its high level. The scope is doing a 10 to 90 measurement on a pulse that no doubt doesn't reach its proper peak.

--
 Darryl

You can clearly see from the picture that the rise time is about 1.5 to max 2 ns. so what the scope indicates is probably OK

Go watch some Rev blog videos where Dave and others had to extend the pulse width to get a full pulse so that scope will measure / calculate the right rise time ...   And hence lead you to a closer analog bandwidth setting.
--
 Darryl

I agree with you that the pulser would benefit from a pulse lenght that is longer (replace the capacitor with a open 50 ohms coax of 30 cm), but in this case the pictures from nack leave no room for mis-interpertation, and the measurement is correct !

I'd say its measuring 10 to 90% of the pulse it saw, and with a bandwidth most likely closer to 100MHz.
It didn't see all the pulse and as its got a smaller pulse and hence as its a delta. It comes back with a shorter time. Not the real rise time of what the pulse should be to gauge what the bandwidth is.

--
 Darryl

[darrylp]

BTW, I'm not knocking the scope. I have one :-)

But do that plotting points not vectors turn off sin x / x and it shows a different picture.


--
 Darryl

[warp_foo]

Just got notified that my 2072 will be shipped on 8/30 versus 9/24... yay. About the only way I can offer payback for the hack is to provide info. Is anyone looking for info on these units? HW versions, FW versions ...?

[nack]

You need to extend the pulse at its high level. The scope is doing a 10 to 90 measurement on a pulse that no doubt doesn't reach its proper peak.

--
 Darryl

You can clearly see from the picture that the rise time is about 1.5 to max 2 ns. so what the scope indicates is probably OK

Go watch some Rev blog videos where Dave and others had to extend the pulse width to get a full pulse so that scope will measure / calculate the right rise time ...   And hence lead you to a closer analog bandwidth setting.
--
 Darryl

I agree with you that the pulser would benefit from a pulse lenght that is longer (replace the capacitor with a open 50 ohms coax of 30 cm), but in this case the pictures from nack leave no room for mis-interpertation, and the measurement is correct !

I'd say its measuring 10 to 90% of the pulse it saw, and with a bandwidth most likely closer to 100MHz.
It didn't see all the pulse and as its got a smaller pulse and hence as its a delta. It comes back with a shorter time. Not the real rise time of what the pulse should be to gauge what the bandwidth is.

--
 Darryl

When I am thinking about it, you are completely correct. I have added a little capacitance to the main cap to stretch the pulse a little. The risetime is now 2.9ns which equates to about 120 MHz. Much more in line with expectations for a stock 2072.

[darrylp]

You need to extend the pulse at its high level. The scope is doing a 10 to 90 measurement on a pulse that no doubt doesn't reach its proper peak.

--
 Darryl

You can clearly see from the picture that the rise time is about 1.5 to max 2 ns. so what the scope indicates is probably OK

Go watch some Rev blog videos where Dave and others had to extend the pulse width to get a full pulse so that scope will measure / calculate the right rise time ...   And hence lead you to a closer analog bandwidth setting.
--
 Darryl

I agree with you that the pulser would benefit from a pulse lenght that is longer (replace the capacitor with a open 50 ohms coax of 30 cm), but in this case the pictures from nack leave no room for mis-interpertation, and the measurement is correct !

I'd say its measuring 10 to 90% of the pulse it saw, and with a bandwidth most likely closer to 100MHz.
It didn't see all the pulse and as its got a smaller pulse and hence as its a delta. It comes back with a shorter time. Not the real rise time of what the pulse should be to gauge what the bandwidth is.

--
 Darryl

When I am thinking about it, you are completely correct. I have added a little capacitance to the main cap to stretch the pulse a little. The risetime is now 2.9ns which equates to about 120 MHz. Much more in line with expectations for a stock 2072.

Of course a real 200 ~ 225 MHz is only a key gen away :-)

--
 Darryl

[studio25]

I have come a little further with my DB832. Here ist the JTAG pinout. I have already copied a part of the RAM. Exactly the same ECC parameters as the DS series! Can someone please send me a working serial / license combination? AAAB and DSAB not work...

[jasonbrent]

I have come a little further with my DB832. Here ist the JTAG pinout. I have already copied a part of the RAM. Exactly the same ECC parameters as the DS series! Can someone please send me a working serial / license combination? AAAB and DSAB not work...

Hmm, curious. In Dave's tear down of the DP832, the sticker inside said DP832A. Yours seems to show DP800....

-jbl

[studio25]

I have come a little further with my DB832. Here ist the JTAG pinout. I have already copied a part of the RAM. Exactly the same ECC parameters as the DS series! Can someone please send me a working serial / license combination? AAAB and DSAB not work...

Hmm, curious. In Dave's tear down of the DP832, the sticker inside said DP832A. Yours seems to show DP800....

-jbl

It's a screenshot from Dave's video @ 19:02. 

[jasonbrent]

I have come a little further with my DB832. Here ist the JTAG pinout. I have already copied a part of the RAM. Exactly the same ECC parameters as the DS series! Can someone please send me a working serial / license combination? AAAB and DSAB not work...

Hmm, curious. In Dave's tear down of the DP832, the sticker inside said DP832A. Yours seems to show DP800....

-jbl

It's a screenshot from Dave's video @ 19:02. 

Ahhhh... I see.

They must have some that say DP832A and some that say DP800 inside then... </end conspiracy theory>.

:-)

-jbl