Sniffing the Rigol's internal I2C bus

[granz]

There the geltool is mentioned again, where do one find that?

cybernet hasn't released it (yet?). I modified the firmware by hand

Based on my own dissection of the .GEL files I wrote a small "de-GEL-ing" program for my own use (this is unrelated to cybernet's geltool).  I haven't determined what all of the fields are, but the overall structure is correct and it will do CRC-ing for you on the .GEL file.  It's not very sophisticated, as I didn't originally intend to post it.  I've tested on DS2000 and DS4000 .GEL files but nothing else.  After you have the individual sections you can use bfin-objdump to disassemble (see note at top of .c file).

https://mega.co.nz/#!Nx10QALC!ZZ1-0mPUxjAxB0gvgI0YdSzZ-7hJBBUtQPqBR7OYw-s

Here's an example run:

Code: [Select]


$ ./degel DS2000Update_00.02.01.00.03.GEL

Model Name:          DS2202
Software Version:    00.02.01.00.03
Number of Sections:  19

Sec 00: GEL Offset: 0x0000023c (     572) Len: 0x00326e00 ( 3304960) Addr: 0x20040000 [CHECK PASSED]
Sec 01: GEL Offset: 0x0032703c ( 3305532) Len: 0x0017be32 ( 1556018) Addr: 0x20000000 [CHECK PASSED]
Sec 02: GEL Offset: 0x004a2e6e ( 4861550) Len: 0x00010f60 (   69472) Addr: 0x20000000 [CHECK PASSED]
Sec 03: GEL Offset: 0x004b3dce ( 4931022) Len: 0x00035438 (  218168) Addr: 0x20123000 [CHECK PASSED]
Sec 04: GEL Offset: 0x004e9206 ( 5149190) Len: 0x0000245a (    9306) Addr: 0x20173000 [CHECK PASSED]
Sec 05: GEL Offset: 0x004eb660 ( 5158496) Len: 0x000c6c14 (  814100) Addr: 0x20020000 [CHECK PASSED]
Sec 06: GEL Offset: 0x005b2274 ( 5972596) Len: 0x00014d04 (   85252) Addr: 0x200c8000 [CHECK PASSED]
Sec 07: GEL Offset: 0x005c6f78 ( 6057848) Len: 0x000663f4 (  418804) Addr: 0x200f0000 [CHECK PASSED]
Sec 08: GEL Offset: 0x0062d36c ( 6476652) Len: 0x00001d54 (    7508) Addr: 0x20120000 [CHECK PASSED]
Sec 09: GEL Offset: 0x0062f0c0 ( 6484160) Len: 0x0006a30a (  434954) Addr: 0x20000000 [CHECK PASSED]
Sec 10: GEL Offset: 0x006993ca ( 6919114) Len: 0x000032d8 (   13016) Addr: 0x20040000 [CHECK PASSED]
Sec 11: GEL Offset: 0x0069c6a2 ( 6932130) Len: 0x00000b64 (    2916) Addr: 0x20000000 [CHECK PASSED]
Sec 12: GEL Offset: 0x0069d206 ( 6935046) Len: 0x0003c598 (  247192) Addr: 0x20000c00 [CHECK PASSED]
Sec 13: GEL Offset: 0x006d979e ( 7182238) Len: 0x00000118 (     280) Addr: 0x201e4c00 [CHECK PASSED]
Sec 14: GEL Offset: 0x006d98b6 ( 7182518) Len: 0x00009010 (   36880) Addr: 0x2003d400 [CHECK PASSED]
Sec 15: GEL Offset: 0x006e28c6 ( 7219398) Len: 0x00001661 (    5729) Addr: 0x201fd800 [CHECK PASSED]
Sec 16: GEL Offset: 0x006e3f27 ( 7225127) Len: 0x000bb808 (  768008) Addr: 0x20045000 [CHECK PASSED]
Sec 17: GEL Offset: 0x0079f72f ( 7993135) Len: 0x00046ef0 (  290544) Addr: 0x20100000 [CHECK PASSED]
Sec 18: GEL Offset: 0x007e661f ( 8283679) Len: 0x00000040 (      64) Addr: 0x20122800 [CHECK PASSED]

Splitting to 'sec.bin' files...

$



[granz]

One of the forum members tested my DS2k 00.02.01.00.03 firmware patch and reported that it works fine, ie. allows to use the old keygen with A scopes without any problems.

Nice. And the 50 ohm input option still works?

Here is quote from his mail:

I did this to verify your patched firmware:

-- Used SYSTEM:UNINSTALL to remove all my current options that I got using tirulerbach's rigup keygen (verified back to trial versions etc.)
-- Flashed your patched GEL
-- Installed DSHH key from riglol 1.03c

50 Ohm option + serial etc. are all intact.  I have 2ns

Also 1ns TB, but I guess I left that off by mistake...

[chebeba]

I can confirm that zombie's patched f/w works just fine on my (ex) DS2072A. Hats off. 

[Altemir]

zombie28 and cybernet
Do You have the opportunity to patch last DS4k firmware 00.02.01.00.03 for MSO4024 to 350 and (or) 500MHz? Thank You in advance.

[Mark_O]

So, enjoy 
https://mega.co.nz/#!FFk10SCY!UuWPXyqZwmca00pa2clOth1ryh1Z-AAgJg2yibfoUw0

"Your browser seems a bit outdated."   

Is there some reason I'm unaware of that a downloader site would force you to have a recent version of a browser?  So my browser is "outdated".  So what?  It happens to be the last version of Firefox that will run on my older XP system.

I don't get the attitude.  Oh, and it might be worthwhile for the Browser Police at Mega to learn how to spell "Recommended", so they don't look like morons (misspelled it twice, on the same page).

[AndersAnd]

So, enjoy 
https://mega.co.nz/#!FFk10SCY!UuWPXyqZwmca00pa2clOth1ryh1Z-AAgJg2yibfoUw0

"Your browser seems a bit outdated."   

Is there some reason I'm unaware of that a downloader site would force you to have a recent version of a browser?  So my browser is "outdated".  So what?  It happens to be the last version of Firefox that will run on my older XP system.

Mega has plugins for Chrome and Firefox that quote: "reduces loading times, improve download performance and strengthen security".
I believe you need a recent version of Chrome or Firefox to be able to install these plugins.
You can use Mega without these plugins, but with less security and performance.

Firefox App: https://mega.co.nz/#firefox
Chrome App: https://mega.co.nz/#chrome
Mobile Apps: https://mega.co.nz/#mobile
Sync Client (coming soon): https://mega.co.nz/#sync

Oh, and it might be worthwhile for the Browser Police at Mega to learn how to spell "Recommended", so they don't look like morons (misspelled it twice, on the same page).

Doesn't help much complaining about it here. Report a bug: bug@mega.co.nz
Kim Dotcom (the famous guy behind Mega) is German so his English spelling might not be perfect.

[George10256]

 
Great work! Zombies patched f/w works just fine with my DS2072A.
Thanks a lot.

My jtag adapter is on the way. Soon I can help if more dumps are required.

[marmad]

"Your browser seems a bit outdated." = You are: A)  An old, out-of-touch geezer.  B) Completely uncool.  C) Hopelessly untechnical.  D) All of the above.

[Swap_File]

I've got a Mini JTAG blaster on the way too, ready to experiment once it arrives.

[Mark_O]

"Your browser seems a bit outdated." = You are: A)  An old, out-of-touch geezer.  B) Completely uncool.  C) Hopelessly untechnical.  D) All of the above.

I guess if those are my choices, I'll have to pick...  A.

Can't be B, since it's 60F where I'm sitting right now.    I'm very cool.

[Mark_O]

Mega has plugins for Chrome and Firefox that quote: "reduces loading times, improve download performance and strengthen security".
I believe you need a recent version of Chrome or Firefox to be able to install these plugins.

Thanks, Anders.  Another way of saying it is that they've decided to be incompatible with browsers that some (many?) folks are using.  I would have just flipped to my newer version of IE, but I guess that's not worth them "supporting".

You can use Mega without these plugins, but with less security and performance.

I'd be more than happy to do so.  However, there's no such option available, that I can see.

Doesn't help much complaining about it here. Report a bug: bug@mega.co.nz

Yeah, I know.  I was just annoyed by what I perceived to be arrogance on their part, and took the opportunity to criticize their spelling.  Very juvenile of me. 

[Avotronics]

rigol.avotronics.co.uk is down for maintenance. Actually I'm moving to a newer server to please be patient.
Should be back up tomorrow sometime.

[bluesmoke]

Good news Everyone!  Attached to this post is a utility to repair corrupted S/N's on DS2000 series scopes! 

Marc: Tried the SNMODFIX utility and it worked a treat restoring my serial. Been waiting a while for that one!
A BIG thank you to you and your anonymous friend for your great work!!! 

[true]

Good news Everyone!  Attached to this post is a utility to repair corrupted S/N's on DS2000 series scopes!  Someone I know took up the challenge to write a utility to repair corrupted serial numbers as their contribution to all the great work done so far.  It's a simple but very clever Windows .exe file that will ask your model/serial # and modify a .gel file located in the same directory as the executable file.  Note: This utility only works with firmware version 00.01.01.00.02.  If you need a copy of this firmware version, see Marmad's post (Reply #2) in this thread: https://www.eevblog.com/forum/testgear/first-impressions-and-review-of-the-rigol-ds2072-ds2000-series-dso/  The locations of the model & S/N change between firmware versions so it will corrupt any other version of firmware so verify that you have firmware version 00.01.01.00.02.  It also requires the ability to send SCPI commands to the scope.

BRILLIANT, saved me some work (not like I haven't been not busy enough to do any) - thanks

[Rigol-Friend]

Hi Gentlemen,

a question about the Rigol DS2000:
With the left menu-key I can display a lot of selected informations at the bottom of the screen. I meen that what I marked in the attachment with big white points 

But I don't find any information how to remove this entries.   
My week english don't allow to understand the english manual completly   

Does anybody has a hint for me for removing?

Thanks a lot,
Rigol-Friend

[Mark_O]

a question about the Rigol DS2000:
With the left menu-key I can display a lot of selected informations at the bottom of the screen. I meen that what I marked in the attachment with big white points 

But I don't find any information how to remove this entries.   
My week english don't allow to understand the english manual completly   

Does anybody has a hint for me for removing?

How about:  Measure -> Clear -> Item N  ?

[Rigol-Friend]

@Mark_O:

Phantastic, sometimes I think I'm blind. 

Thank you so much,
Rigol-Friend

[stuartk]

Hi all,

I have, I hope a not too distracting question from a newbie. I've purchased a DS2102 some time ago and upgraded using the Keygen on the forum.

Unfortunately, I selected the DS2102 option by mistake. I then re-entered the code using the DS2202 and I have the following installed screen which is somewhat ambiguous as to what the scope bandwidth actually is.

At home I only have a POS AWG that can put out a maximum 25Mhz sine wave. Using a 2v p-p signal, my p-p voltage at 25mhz was 1.92v down from 2.24v. That works out to 1.3 dB loss (I think), which doesn't make sense if the scope were at 200Mhz.

Does anyone have a quick and easy method to ballpark the actual bandwidth with spit and chewing gum?

Should I reset the options by putting the code for the trial options for the DS2102 back in and redo it?

Kudo's to all the very large brains on the forum that made this all possible. 

Thanks, S.

[MrKrabs]

Hey cybernet,

I was reverse engineering your reverse engineering , trying to port your DS4000 firmware hack which is version 00.02.00.00.04 to the latest version 00.02.01.00.03.

I was able to find the 2 magic bytes to modify (0x4899 into 0x2060) in the new firmware and then recalculated the CRC for section 00.

Then I updated the firmware on my DS4014 with my patched firmware. The update worked fine (I know because I had a 00.01.xx firmware), BUT it didn't enable the BW options neither gave me 1ns TB option.

I then went back to your 00.02.00.00.04 firmware and confirmed it enabled the BW options & 1ns TB, so I know it works on my DS4K.

Do you have any idea what the deal is with the latest DS4K firmware? I found the 0x4899 byte at 0x128a3c. It at least matched the nearby bytes almost perfectly when comparing with your firmware.

There's a big chance, of course, I was just changing the wrong bytes

Here's a diff of the hexdumps:

Code: [Select]

$ diff DS4000Update.00.02.01.00.03.orig.GEL.hex DS4000Update.00.02.01.00.03.modified.GEL.hex
4c4
< 00000030  32 62 77 f0 00 00 00 00  00 00 04 20 01 00 00 00  |2bw........ ....|
---
> 00000030  5d 10 2a 87 00 00 00 00  00 00 04 20 01 00 00 00  |].*........ ....|
75940c75940
< 00128a30  00 e8 00 00 09 e1 2d 0d  49 e1 e7 00 48 99 01 e8  |......-.I...H...|
---
> 00128a30  00 e8 00 00 09 e1 2d 0d  49 e1 e7 00 20 60 01 e8  |......-.I... `..|

Cheers!

Aha! I've got it working now.

 I found the right place to patch it. Here's the diff, for the curious:

Code: [Select]

$ diff DS4000Update.00.02.01.00.03.GEL.hex DS4000Update.00.02.01.00.03.MrKrabs.GEL.hex
4c4
< 00000030  32 62 77 f0 00 00 00 00  00 00 04 20 01 00 00 00  |2bw........ ....|
---
> 00000030  54 8b 5e f6 00 00 00 00  00 00 04 20 01 00 00 00  |T.^........ ....|
79428c79428
< 00136430  48 99 01 e8 00 00 10 00  00 e8 00 00 09 e1 2b 1d  |H.............+.|
---
> 00136430  20 60 01 e8 00 00 10 00  00 e8 00 00 09 e1 2b 1d  | `............+.|

I've successfully tested it on my DS4014. Got the 200MHz, 100MHz and 20MHz BW limit options and 1ns timebase. 

Model number remained DS4014. Riglol keys continued to work.

I've uploaded the file here: http://wikisend.com/download/164218/DS4000Update.00.02.01.00.03.MrKrabs.GEL.zip

[MrKrabs]

There the geltool is mentioned again, where do one find that?

cybernet hasn't released it (yet?). I modified the firmware by hand

Based on my own dissection of the .GEL files I wrote a small "de-GEL-ing" program for my own use (this is unrelated to cybernet's geltool).  I haven't determined what all of the fields are, but the overall structure is correct and it will do CRC-ing for you on the .GEL file.  It's not very sophisticated, as I didn't originally intend to post it.  I've tested on DS2000 and DS4000 .GEL files but nothing else.  After you have the individual sections you can use bfin-objdump to disassemble (see note at top of .c file).

https://mega.co.nz/#!Nx10QALC!ZZ1-0mPUxjAxB0gvgI0YdSzZ-7hJBBUtQPqBR7OYw-s

Here's an example run:

Code: [Select]


$ ./degel DS2000Update_00.02.01.00.03.GEL

Model Name:          DS2202
Software Version:    00.02.01.00.03
Number of Sections:  19

Sec 00: GEL Offset: 0x0000023c (     572) Len: 0x00326e00 ( 3304960) Addr: 0x20040000 [CHECK PASSED]
Sec 01: GEL Offset: 0x0032703c ( 3305532) Len: 0x0017be32 ( 1556018) Addr: 0x20000000 [CHECK PASSED]
Sec 02: GEL Offset: 0x004a2e6e ( 4861550) Len: 0x00010f60 (   69472) Addr: 0x20000000 [CHECK PASSED]
Sec 03: GEL Offset: 0x004b3dce ( 4931022) Len: 0x00035438 (  218168) Addr: 0x20123000 [CHECK PASSED]
Sec 04: GEL Offset: 0x004e9206 ( 5149190) Len: 0x0000245a (    9306) Addr: 0x20173000 [CHECK PASSED]
Sec 05: GEL Offset: 0x004eb660 ( 5158496) Len: 0x000c6c14 (  814100) Addr: 0x20020000 [CHECK PASSED]
Sec 06: GEL Offset: 0x005b2274 ( 5972596) Len: 0x00014d04 (   85252) Addr: 0x200c8000 [CHECK PASSED]
Sec 07: GEL Offset: 0x005c6f78 ( 6057848) Len: 0x000663f4 (  418804) Addr: 0x200f0000 [CHECK PASSED]
Sec 08: GEL Offset: 0x0062d36c ( 6476652) Len: 0x00001d54 (    7508) Addr: 0x20120000 [CHECK PASSED]
Sec 09: GEL Offset: 0x0062f0c0 ( 6484160) Len: 0x0006a30a (  434954) Addr: 0x20000000 [CHECK PASSED]
Sec 10: GEL Offset: 0x006993ca ( 6919114) Len: 0x000032d8 (   13016) Addr: 0x20040000 [CHECK PASSED]
Sec 11: GEL Offset: 0x0069c6a2 ( 6932130) Len: 0x00000b64 (    2916) Addr: 0x20000000 [CHECK PASSED]
Sec 12: GEL Offset: 0x0069d206 ( 6935046) Len: 0x0003c598 (  247192) Addr: 0x20000c00 [CHECK PASSED]
Sec 13: GEL Offset: 0x006d979e ( 7182238) Len: 0x00000118 (     280) Addr: 0x201e4c00 [CHECK PASSED]
Sec 14: GEL Offset: 0x006d98b6 ( 7182518) Len: 0x00009010 (   36880) Addr: 0x2003d400 [CHECK PASSED]
Sec 15: GEL Offset: 0x006e28c6 ( 7219398) Len: 0x00001661 (    5729) Addr: 0x201fd800 [CHECK PASSED]
Sec 16: GEL Offset: 0x006e3f27 ( 7225127) Len: 0x000bb808 (  768008) Addr: 0x20045000 [CHECK PASSED]
Sec 17: GEL Offset: 0x0079f72f ( 7993135) Len: 0x00046ef0 (  290544) Addr: 0x20100000 [CHECK PASSED]
Sec 18: GEL Offset: 0x007e661f ( 8283679) Len: 0x00000040 (      64) Addr: 0x20122800 [CHECK PASSED]

Splitting to 'sec.bin' files...

$



Thanks a lot, granz! Your tool made it much easier to recalculate the CRC and get the segment lengths & locations!

[true]

Good news Everyone!  Attached to this post is a utility to repair corrupted S/N's on DS2000 series scopes!  Someone I know took up the challenge to write a utility to repair corrupted serial numbers as their contribution to all the great work done so far.  It's a simple but very clever Windows .exe file that will ask your model/serial # and modify a .gel file located in the same directory as the executable file.  Note: This utility only works with firmware version 00.01.01.00.02.  If you need a copy of this firmware version, see Marmad's post (Reply #2) in this thread: https://www.eevblog.com/forum/testgear/first-impressions-and-review-of-the-rigol-ds2072-ds2000-series-dso/  The locations of the model & S/N change between firmware versions so it will corrupt any other version of firmware so verify that you have firmware version 00.01.01.00.02.  It also requires the ability to send SCPI commands to the scope.

BRILLIANT, saved me some work (not like I haven't been not busy enough to do any) - thanks

Well maybe I was a bit premature. It doesn't work.

After loading the firmware and showing the advanced serial screen, the serial is correct, but the model is still incorrect (showing 2202). After following the instructions I still get DS2202 with 14-digit xx0001 SN. Yes, I selected DS2072 in the tool. Do codes need to be installed before starting this?

I can load new codes for my original SN, so parts of it seem to be working, but the display is still wrong :/

EDIT: I've tried using DS2202 model option, but it still doesn't work.
After rebooting I can't send a code against my serial number until I enable the advanced system info menu, then I can. So it is loading (at least the serial portion), but looks like whatever is supposed to save the serial isn't working or has some other problem.

[Altemir]

MrKrabs
You have got 500MHz DSO with this FW, but SysInfo show DS4014? Do you already have frequency response tests?

[johna]

Hi,
I've read big part of this thread  and I could understand most of it - I've downloaded and compiled keygen code. I've also downloaded modified firm ware. What I don't understand is:
1. I know you have to change DS2xxxA firmware with 2xxx in order the keygen to work. the most important thing is can this be reversed. It's quite an expensive instrument to risk warranty. Can it go to standard non-options firmware (or with the options you buyed if you had.
1.1. can options be removed?  how?
1.2. will the scope (DS2072A) accept official unpatched firmware upgrade from Rigol after it's flashed with patched DS2072 version. What will happen to installed options if you update it back again to DS2072A. Will there be a trace/log of installed codes (warranty). Or is there any kind of log of what you are trying to put on your scope - firmware, codes ... etc.
2. what does GEL mean? I guess I missed the explanation.
3. Do I have to open my scope in order to upgrade it? I know it would help if I sniff the internal bus and send the results, but I can't afford to risk the warranty.
Most of the people are happy how they are gonna boost their scope and no one asks about warranty. And most of the people can't afford to buy these options, so the loss if the scope brakes and they refuse to fix it/replace it will be quite high.

It might be good if someone (andyturk) puts those in the first post which could be used as a wiki page.

I'm sure Rigol have good reasons to put those prices on the options and I'm sure you haven't already payed for it when you are buying the scope - they probably just lowered the price with the idea to compensate when options are sold. But ... I can't afford them and I don't make tons of money from it so my conscience is clean. So good job and big thanks to all guys making this possible.

[bluesmoke]

Good news Everyone!  Attached to this post is a utility to repair corrupted S/N's on DS2000 series scopes!  Someone I know took up the challenge to write a utility to repair corrupted serial numbers as their contribution to all the great work done so far.  It's a simple but very clever Windows .exe file that will ask your model/serial # and modify a .gel file located in the same directory as the executable file.  Note: This utility only works with firmware version 00.01.01.00.02.  If you need a copy of this firmware version, see Marmad's post (Reply #2) in this thread: https://www.eevblog.com/forum/testgear/first-impressions-and-review-of-the-rigol-ds2072-ds2000-series-dso/  The locations of the model & S/N change between firmware versions so it will corrupt any other version of firmware so verify that you have firmware version 00.01.01.00.02.  It also requires the ability to send SCPI commands to the scope.

BRILLIANT, saved me some work (not like I haven't been not busy enough to do any) - thanks

Well maybe I was a bit premature. It doesn't work.

Make sure you follow the instructions to the letter.... especially step 7 to anchor the changes to flash...

7.  Connect using scpi and issue :SYSTem:OPTion:UNINSTall command which will
      uninstall all keys and save to flash

All I did at the end was reinstall the latest firmware and then reinstall the options with DSEZ to give me 200MHz and CAN, Triggers, Decoders and Memory upgrade.
I have cycled the scope a number of times now and it all seems good to go.

[MrKrabs]

MrKrabs
You have got 500MHz DSO with this FW, but SysInfo show DS4014? Do you already have frequency response tests?

That's correct, SysInfo shows DS4014. The 500MHz bandwidth on the hacked DS4014 has been confirmed by many others on this thread and in some Youtube videos.

I don't have anything to test the 500MHz BW, but was thinking of trying to probe Gigabit Ethernet (125MHz) for fun.