Author Topic: Sniffing the Rigol's internal I2C bus  (Read 1839189 times)

0 Members and 1 Guest are viewing this topic.

Offline AndersAnd

  • Frequent Contributor
  • **
  • Posts: 572
  • Country: dk
Re: Sniffing the Rigol's internal I2C bus
« Reply #2675 on: January 20, 2014, 11:30:05 pm »
From the posts begging from page 164 I understood that "tirulerbach" is the man to send the memory dump.
Just upload it to a file hosting site and link to the file in the forum so everyone working on it can have a look.
Several members has uploaded to https://mega.co.nz and posted the lniks in this topic.
 

Offline Git

  • Contributor
  • Posts: 13
  • Country: gb
  • Very old engineer with over 4 decades in design.
Re: Sniffing the Rigol's internal I2C bus
« Reply #2676 on: January 21, 2014, 02:36:25 pm »

that's the 2 digits after the ds2d15, right?
then I also have one from week 46

Is it possible they are algorithmically generating ECC keys etc from digits 7 & 8 of the serial number if that is week number?

Git
 

Offline cidcorp

  • Supporter
  • ****
  • Posts: 105
  • Country: ca
Re: Sniffing the Rigol's internal I2C bus
« Reply #2677 on: January 21, 2014, 02:42:46 pm »

Well after receiving my DS1074Z-S (I a DS2102, but really need the extra 2 channels) I decided to try as is out of the box using the riglol keys generated.
Everything installed without a problem - all option installed.  I didn't reread the thread so I missed the little detail about the 500uV Vert unlock not working.
Sooo I installed the DSFR instead of the DSER (which I believe is everything except the 500uV)... if someone can confirm.

I will be doing the uninstall and reinstall with DSER to clear up a trace off set problem (goes to top of display and can't be brought down) when on the lowest vertical setting.

BTW this little guy is sooo cute.  Like a mini-me of the 4000 or 2000 scopes lol.

[1] Two questions though relating to the DS1000Z's - is there an EXTENDED system/info button trick like the DS2000 ie F7-F6-F7-etc (sorry going from memory which is horrible) for
HW revision FW revision info?
[2] Am I missing something or are both Left and Right menus permanently on screen???
 

Offline granz

  • Regular Contributor
  • *
  • Posts: 136
  • Country: us
  • 6.62606957
Re: Sniffing the Rigol's internal I2C bus
« Reply #2678 on: January 21, 2014, 02:43:55 pm »

AFAIK HW version '2.0' is not Rigol's term, it's just used on this forum to describe new version of DS2k(A) PCB. The newest HW version displayed by DS2kA scopes I've seen so far is 1.0.2.0.2 and it doesn't change after firmware upgrade (take a look at Flipp's screenshots before and after update).

Actually, Rigol does use the "2.0" term on the PCB silkscreen, but I assume that is just to specify the PCB revision.  I would guess that the hardware version shown (someone said set by the smd resistors), is based on the populated components.  So, even with the "2.0" PCB you may get different 1.0.2.0.x numbers.  Perhaps this is how they are trying to get away with a DS2302A model when they didn't sell a DS2302 model (tweaked input stage, etc.).  Anyhow, the 1.0.2.0.x number is the one that really matters and as you pointed out, it doesn't change with firmware changes.

 

Offline alank2

  • Super Contributor
  • ***
  • Posts: 2185
Re: Sniffing the Rigol's internal I2C bus
« Reply #2679 on: January 21, 2014, 03:01:01 pm »
[1] Two questions though relating to the DS1000Z's - is there an EXTENDED system/info button trick like the DS2000 ie F7-F6-F7-etc (sorry going from memory which is horrible) for
HW revision FW revision info?
[2] Am I missing something or are both Left and Right menus permanently on screen???

#1 - I asked this question and no one could answer.  One person was able to do it, but he can't remember exactly how.
#2 - They are permanently on the screen, they don't hide.
 

Offline Wall-E

  • Contributor
  • Posts: 36
  • Country: nl
  • Stijn
Re: hacking dp832
« Reply #2680 on: January 21, 2014, 11:35:25 pm »
Will you share your DP832 memory dumps with us? If so, what firmware version do you have? I'm analyzing 1.08 GEL atm to find out the new license codes format.
                   zombie28
[/quote]
It's now Firmware version  00.01.09 for the DP800 Series including the DP832 (non A).  And I understand that it's not good news with all options lost, and no way to go back to FW 06, or 08.

Note: This Firmware has been provided to DP832 (non A) users by Rigol for those that had requested a FW Update for their units.

Ref.  RIGOL DP832 Power Supply - firmware upgrade, « Reply #36 on: Yesterday at 03:38:23 AM »   Although I don't think Rigol supplied this particular person his FW 09.
« Last Edit: January 22, 2014, 12:08:56 am by Wall-E »
 

Offline marmad

  • Super Contributor
  • ***
  • Posts: 2979
  • Country: aq
    • DaysAlive
Re: Sniffing the Rigol's internal I2C bus
« Reply #2681 on: January 21, 2014, 11:51:16 pm »
[1] Two questions though relating to the DS1000Z's - is there an EXTENDED system/info button trick like the DS2000 ie F7-F6-F7-etc (sorry going from memory which is horrible) for
HW revision FW revision info?

#1 - I asked this question and no one could answer.  One person was able to do it, but he can't remember exactly how.

Seeing as how the DS2000/DS4000/DS6000 all use the same F7-F6-F7 routine to get to the Project Menu, it seems the DS1000Z (the latest member of the UltraVision line) would do as well.
 

Offline Sparky

  • Frequent Contributor
  • **
  • Posts: 450
  • Country: us
Re: hacking dp832
« Reply #2682 on: January 22, 2014, 06:18:01 am »
It's now Firmware version  00.01.09 for the DP800 Series including the DP832 (non A).  And I understand that it's not good news with all options lost, and no way to go back to FW 06, or 08.

Note: This Firmware has been provided to DP832 (non A) users by Rigol for those that had requested a FW Update for their units.

Ref.  RIGOL DP832 Power Supply - firmware upgrade, « Reply #36 on: Yesterday at 03:38:23 AM »   Although I don't think Rigol supplied this particular person his FW 09.

In the post you reference, Sebastian states "the Riglol Keys don't work" --- which is no different from 01.08 where they didn't work either (and why people downgraded to 01.06 to install the keys and then upgraded to 01.08). 

How exactly are you concluding "all options lost"?
 

Offline AndersAnd

  • Frequent Contributor
  • **
  • Posts: 572
  • Country: dk
Re: hacking dp832
« Reply #2683 on: January 22, 2014, 08:15:30 am »
It's now Firmware version  00.01.09 for the DP800 Series including the DP832 (non A).  And I understand that it's not good news with all options lost, and no way to go back to FW 06, or 08.

Note: This Firmware has been provided to DP832 (non A) users by Rigol for those that had requested a FW Update for their units.

Ref.  RIGOL DP832 Power Supply - firmware upgrade, « Reply #36 on: Yesterday at 03:38:23 AM »   Although I don't think Rigol supplied this particular person his FW 09.
In the post you reference, Sebastian states "the Riglol Keys don't work" --- which is no different from 01.08 where they didn't work either (and why people downgraded to 01.06 to install the keys and then upgraded to 01.08). 

How exactly are you concluding "all options lost"?
He wrote that you can't downgrade to FW 06 or 08 anymore after upgrading to FW 09. So he can't install any options by downgrading to FW 06 like you suggest. So that's probably why he wrote all options lost.
 

Offline Git

  • Contributor
  • Posts: 13
  • Country: gb
  • Very old engineer with over 4 decades in design.
Re: Sniffing the Rigol's internal I2C bus
« Reply #2684 on: January 22, 2014, 01:36:00 pm »

Seeing as how the DS2000/DS4000/DS6000 all use the same F7-F6-F7 routine to get to the Project Menu, it seems the DS1000Z (the latest member of the UltraVision line) would do as well.


Unlikely, the DS1000Z family doesn't have an F7 button, unless that is what you call the 'Next Page' pale blue button at the bottom?

Git
 

Offline marmad

  • Super Contributor
  • ***
  • Posts: 2979
  • Country: aq
    • DaysAlive
Re: Sniffing the Rigol's internal I2C bus
« Reply #2685 on: January 22, 2014, 01:50:42 pm »
Unlikely, the DS1000Z family doesn't have an F7 button, unless that is what you call the 'Next Page' pale blue button at the bottom?

Possibly. It might also just be the bottom two selection buttons - so F6-F5-F6 on the DS1000Z.
 

Offline idpromnut

  • Supporter
  • ****
  • Posts: 613
  • Country: ca
Re: Sniffing the Rigol's internal I2C bus
« Reply #2686 on: January 22, 2014, 02:19:59 pm »
Here's a question for you all: I just received my DS2070A and I will do a dump of the memory. But, I also ordered the advanced triggering package, but it was installed on the scope when I received it. Is there a way of recovering the license key (in case I do something silly and wipe/uninstall all the options by mistake)?
 

Offline sled

  • Contributor
  • Posts: 21
  • Country: ch
Re: Sniffing the Rigol's internal I2C bus
« Reply #2687 on: January 22, 2014, 02:43:37 pm »
yay! just received my DS2072A, I'm going to take a dump tonight :P

It's Week 42 :)

Code: [Select]
Model:  DS2072A
Serial:  DS2D1542xxxxx
Software Version: 00.02.00.00.04
Hardware Version: 1.0.2.02
FPGA Version:
   SPU 03.01.09
   WPU 00.07.01
   CCU 12.29.00
   MCU 02.13
 

Offline NikWing

  • Regular Contributor
  • *
  • Posts: 139
  • Country: de
Re: Sniffing the Rigol's internal I2C bus
« Reply #2688 on: January 22, 2014, 05:03:32 pm »
the 300 MHz option doesn't work I think
at least device doesn't change to 2302 or 1 ns TB

:)


(edit)
« Last Edit: January 22, 2014, 06:16:56 pm by NikWing »
 

Offline Rigby

  • Super Contributor
  • ***
  • Posts: 1476
  • Country: us
  • Learning, very new at this. Righteous Asshole, too
Re: Sniffing the Rigol's internal I2C bus
« Reply #2689 on: January 22, 2014, 06:41:12 pm »
I'm going to take a dump tonight

Same here; Mexican food for lunch.

Anyone have the DP832 00.01.09 firmware?  What does it fix?
 

Offline AndersAnd

  • Frequent Contributor
  • **
  • Posts: 572
  • Country: dk
Re: Sniffing the Rigol's internal I2C bus
« Reply #2690 on: January 22, 2014, 06:44:51 pm »
Anyone have the DP832 00.01.09 firmware?  What does it fix?
Maybe the only thing it fixes is the possibility to downgrade, to stop the keygen hack?
They already stopped the keys from working in 08, but people could still downgrade to 06 and use the keys, so that fix didn't really work for them. So now they have stopped the possibility of downgrading in 09.
« Last Edit: January 22, 2014, 06:49:56 pm by AndersAnd »
 

Offline Rigby

  • Super Contributor
  • ***
  • Posts: 1476
  • Country: us
  • Learning, very new at this. Righteous Asshole, too
Re: Sniffing the Rigol's internal I2C bus
« Reply #2691 on: January 22, 2014, 06:51:06 pm »
I think you're right.

After looking for about 250ms, I found this thread (https://www.eevblog.com/forum/testgear/rigol-dp832-power-supply-firmware-upgrade/) which is generally not positive about the 09 firmware.
 

Offline rsivan

  • Contributor
  • Posts: 43
  • Country: it
Re: Sniffing the Rigol's internal I2C bus
« Reply #2692 on: January 22, 2014, 07:50:36 pm »
Hello
If someone can read the spi flash 25x40 of dp832a; I can try to turn my 832 into 832a, because fw is same.
Also other option is a full cloning spi flash + nand flash from 832a to manually program in a 832.
 

Offline marmad

  • Super Contributor
  • ***
  • Posts: 2979
  • Country: aq
    • DaysAlive
Re: Sniffing the Rigol's internal I2C bus
« Reply #2693 on: January 22, 2014, 07:59:57 pm »
After looking for about 250ms, I found this thread (https://www.eevblog.com/forum/testgear/rigol-dp832-power-supply-firmware-upgrade/) which is generally not positive about the 09 firmware.

I would generally be suspicious of any Rigol firmware that comes in two separate sections to load - one following the other: you can pretty much be certain that the bootloader is being changed.
 

Offline rsivan

  • Contributor
  • Posts: 43
  • Country: it
Re: Sniffing the Rigol's internal I2C bus
« Reply #2694 on: January 22, 2014, 08:09:15 pm »
I compared the new 1.09 bootloader of dp800, and almost same file I found in 25x40 spi flash so: bootloader is in 25x40 confirmed!
« Last Edit: January 22, 2014, 08:14:14 pm by rsivan »
 

Offline tirulerbach

  • Contributor
  • Posts: 33
Re: Sniffing the Rigol's internal I2C bus
« Reply #2695 on: January 22, 2014, 09:24:52 pm »
yay! just received my DS2072A, I'm going to take a dump tonight :P

Please contact me, if you have your dumps ready...
 

Offline Sebastian

  • Regular Contributor
  • *
  • Posts: 131
  • Country: at
Re: hacking dp832
« Reply #2696 on: January 22, 2014, 10:13:22 pm »
It's now Firmware version  00.01.09 for the DP800 Series including the DP832 (non A).  And I understand that it's not good news with all options lost, and no way to go back to FW 06, or 08.

Note: This Firmware has been provided to DP832 (non A) users by Rigol for those that had requested a FW Update for their units.

Ref.  RIGOL DP832 Power Supply - firmware upgrade, « Reply #36 on: Yesterday at 03:38:23 AM »   Although I don't think Rigol supplied this particular person his FW 09.

In the post you reference, Sebastian states "the Riglol Keys don't work" --- which is no different from 01.08 where they didn't work either (and why people downgraded to 01.06 to install the keys and then upgraded to 01.08). 

How exactly are you concluding "all options lost"?

The trick with getting the options in 1.06 and then upgrading to 1.08 never worked for me. If I would install all the options in 1.06 and upgrade to 1.08 everything would be lost, not just the trigger option as other people here report for there units. If I would then go back to 1.06 the options would be there again without entering the codes again.
FW1.09 is essentially the same as 1.08, none of the bugs are fixed, the only difference is that you can not flash older versions anymore because of the new bootloader,
 

Offline Rigby

  • Super Contributor
  • ***
  • Posts: 1476
  • Country: us
  • Learning, very new at this. Righteous Asshole, too
Re: Sniffing the Rigol's internal I2C bus
« Reply #2697 on: January 23, 2014, 01:30:28 am »
After looking for about 250ms, I found this thread (https://www.eevblog.com/forum/testgear/rigol-dp832-power-supply-firmware-upgrade/) which is generally not positive about the 09 firmware.

I would generally be suspicious of any Rigol firmware that comes in two separate sections to load - one following the other: you can pretty much be certain that the bootloader is being changed.
Yeah, I'm plenty suspicious.  I feel for Rigol; they're in a hard place right now.  I guarantee there is an engineer or two on their staff that raised a bit of a stink about how easy this stuff would be to compromise, and he was probably dismissed out of hand, and laughingly compared to "Dwight" in the local production of "The Office."

I will admit to using the keygens.  I will also admit that if they fix the holes and produce firmware that i can't do without, I will upgrade to that firmware, even if it means losing the options I've hacked for myself.  The thing is, I purchased the options I needed, and hacked the ones I want to play with.  If any of those options I don't need become options I do need, then I'll buy those, too.

 

Offline thetooth

  • Contributor
  • Posts: 22
Re: Sniffing the Rigol's internal I2C bus
« Reply #2698 on: January 23, 2014, 10:10:20 am »
If any of those options I don't need become options I do need, then I'll buy those, too.
This, i ended up ordering the deep memory option because i do a lot of very large serial captures. I think anyone who uses hacked options at work is just asking for trouble, i'd hate to be the guy who keeps finding "glitches" on a high speed bus because of some ADC error caused by messed up software. :palm:
 

Offline diyaudio

  • Frequent Contributor
  • **
  • !
  • Posts: 683
  • Country: za
Re: Sniffing the Rigol's internal I2C bus
« Reply #2699 on: January 23, 2014, 08:03:44 pm »
Hi all

I just bought a DS2072A (an upgrade from my siglent) and it cost me $1,300 with shipping to south africa, yes it wrecked my wallet.

vie been learning the in and outs of the scope and haven't touched the decoders yet, my time trial is almost over about 3 hours left! can anyone give me a cost breakdown of the decoders ??

why did Rigol not make the time-trial run when in use only.  !!??






« Last Edit: January 23, 2014, 08:05:38 pm by diyaudio »
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf