Sniffing the Rigol's internal I2C bus

[AndersAnd]

i am sitting on the fence between 1104ZS and 2072, and so far ive only managed to reach page 18 before i realized i woke up and its morning lol ...

well the reason for the fence sitting is because of this video


does anyone think that any of the later firmwares have any effect/improvement on the graduation/shades of the 2072? (sorry it may sound like a nitty gritty Qn)

Off topic. Please don't discuss which scope to buy and compare features in this topic. It's about hacking the scopes, not buying advice.

This video comparison has already been discussed here: https://www.eevblog.com/forum/testgear/intensity-grading-comparison-rigol%27s-ds1104z-ds2202-and-agilent-dsox3404/msg350384/#msg350384
and here: https://www.eevblog.com/forum/testgear/rigol-ds1104z-26242/msg379113/#msg379113

So please keep this discussion in those topics instead. This hacking topic is already way too long as it is, without all the off topic discussions.

And for discussing features, FW bugs etc. for DS2000 series scopes please also read this topic:
REVIEW - Rigol DS2072 - First Impressions of the DS2000 series from Rigol https://www.eevblog.com/forum/testgear/first-impressions-and-review-of-the-rigol-ds2072-ds2000-series-dso/

[tom66]

Does DS2072A still use DSA9 prefix and option codes?

[neslekkim]

It's been a while since I've monitored this thread and it appears plenty of progress has been made. Excellent work everyone!

Took the opportunity to mirror a bunch more useful files permanently at http://www.gotroot.ca/rigol as well as setting up a cron job to pull down the complete thread every day as well. If there's anything else that should be there, send me files or PMs and I will make it so.

How do you pull this thread?, Would it be possible to include the messagenr in the postheader or postbody?, when I'm searching in the file now, it's difficult to find the post on the forum, with an id one could construct the url, or maybe include the a-href info which looks like this:

a href="msg391147/#msg391147"

[Rigby]

Does DS2072A still use DSA9 prefix and option codes?

It doesn't even use the same keygen, necessarily.

read back several pages.  If you see DS2072A then you need to start further in the past. 

Legwork would save many people many questions.  I know there's a lot to read, but you're potentially saving thousands of dollars, here.  Take the time and read.

[KA3YAN]

I can confirm that the process works for unlocking 200MHz and all options on the DS2102A.  I didn't attempt 300MHz because the rigup said that it was untested and unverified (or something to that extent).  If I need 300MHz for something down the line, I'll go back and redo the hack.  I'm happy for now.

[Rigby]

(and yes i am still reading the rest of this thread ... until i reached page 39 ... the sum of 39 pages of hard work of all the super haxors in this community culminated into a windows keygen ... )

The forum software used here makes it a bit difficult to track conversations & offshoots.  No proper threading support.  There are threads, yes, as topics, but not subthreads and branches within a thread.  Not at all Dave's fault; there is no good software out there that actually handles threading properly, we've all just adjusted our expectations and formed habits to accommodate the available software. 

Actually, Discourse might be the ticket here, now that I do some googling and take a look at it.  They have the same complaints about forum software that I have.  ... nice to feel validated.

[Ivan7enych]

Rigol 2072a has been upgraded to 300MHz without problems.
I want to say thank you to everybody, who has made it possible. 

When I return home (I live in Russia, but now I'm in California for 2 weeks), I'll try to compare the bandwidth of this unlocked rigol with my old Tek TDS744A (500MHz 4channels).

By the way, transcend 16GB flash card worked fine with 2072a (for upgrading firmware and for the screenshots).

[madcrow]

I read in the thread that when a BW-upgrade key is applied, the model number of the device also changes in the system info screen. E.g. "DS2072A" becomes "DS2202A".

Is the response of the *IDN? command adapted, too?
If I upgrade my device to, say, 200MHz, will the above query return "RIGOL TECHNOLOGIES,DS2202A,DS2D..." ?

Thanks

[ch.onillon]

[joke mode] because it's not the official rigol support ? 
or rigol sales ? [/joke mode]

need to wait to receive it ...

[Rigby]

I read in the thread that when a BW-upgrade key is applied, the model number of the device also changes in the system info screen. E.g. "DS2072A" becomes "DS2202A".

Is the response of the *IDN? command adapted, too?
If I upgrade my device to, say, 200MHz, will the above query return "RIGOL TECHNOLOGIES,DS2202A,DS2D..." ?

Thanks

yes.

[Giggy]

Interesting, I've had 482 downloads of my 2072A unlocking guide.

Hopefully it is proving useful to people.

[Mark_O]

Interesting, I've had 482 downloads of my 2072A unlocking guide.

Hopefully it is proving useful to people.

If it is, then good.  Anything that reduces the # of repetitive questions here helps all of us.  Even those who don't have a DS2000.

[GlassFET]

Interesting, I've had 482 downloads of my 2072A unlocking guide.

Hopefully it is proving useful to people.

I wanted to thank you for it! I, for one, needed the little bit of additional hand-holding with the hex editor part that you provided. I have convinced four of my pals to buy DS2072As in past few days. These are engineers/hams/audiophiles with decades of experience with Tek and HP equipment. None of us had ever even touched Rigol equipment before. Are you reading that Rigol? Rejoice!

[Dave92F1]

Interesting, I've had 482 downloads of my 2072A unlocking guide.

Hopefully it is proving useful to people.

Hey Giggy - thanks indeed for that!  I've been lurking here for years but just got a 2072A based on this thread (TEquipment.net with the EEVBLOG6 discount - great deal). [Compared to my old DS1102E, the DS2072A is light-years ahead.]

In your guide you say to download Ultra Sigma version 00.01.05.10 but the linked Rigol site only offers 00.01.05.09. 

Maybe Rigol pulled the .10 version to make this hack harder?  Anyway, is there a place I can download the .10 version?

EDIT: Nevermind.  The .10 version is on the CD that came with the scope.

[Dave92F1]

I successfully updated my DS2072A to 200 MHz and all options following Giggy's summary. 

Like a few others, I can't get 300 MHz to work - NSEQ (200 MHz) works OK, but NS8H doesn't (anybody know how to fix that?)

For others who are going to do this, here are some tips to go along with Giggy's PDF:

1 - When powering-on the scope for the initial firmware installation, you need to press HELP twice in VERY QUICK succession immediately after pressing the power button. If it doesn't work, it's because you didn't press HELP twice quickly enough.

2 - It takes a while for the firmware to update; be prepared to wait for a while (4 or 5 minutes) - the CH 1 light will flash until it's done.

3 - The way to check if the new firmware was installed is UTILITY > SYSTEM > SYSTEM INFO, but that does not give the full detailed info you need.

To get the detailed system info (from the hacked firmware you just installed), Giggy says to press [Menu 7] [Menu 6] [Menu 7] [UTILITY].  (And then SYSTEM > SYSTEM INFO).

On each side of the screen (left and right) there are a row of buttons under the MENU button.  The first one under the MENU button is "1", the next down is "2", etc., to "7" which is the bottom button.

So [Menu 7] [Menu 6] [Menu 7] [UTILITY] means press the bottom right menu button (Menu 7), then the one above it (Menu 6), then the bottom one again (Menu 7), then UTILITY.  Press them one at a time, but VERY QUICKLY.  If you do it slowly it won't work.  Then press SYSTEM > SYSTEM INFO.

5 - The link Giggy gives (to rigol.com) for the Ultra Sigma software goes to version 00.01.05.09.  On the CD that came with the scope the newer version 00.01.05.10 is there (I used that).  Supposedly the newer version is also on the batronix.com website (I didn't try this).  [Also the Rigol website downloads very, very slowly.]

6 - The Rigol documentation README for Ultra Sigma tells you to first install "NIVISAruntime.msi" before trying to install Ultra Sigma.

I'm not sure this is really needed - I think the runtime is now included in the Ultra Sigma installer.

But I installed using "visa520runtime.exe" (from the National Instruments website); that worked fine.

7 - I found Giggy's explanation of using HxD a little confusing. Giggy talks about three "columns"; left, middle, and right. 

The "left column" is the hex offset into the file (the address); this is on the left side of the screen in blue.  The "middle" column is the central area with 16 8-bit hex values in each row.  The "right" column is the right portion of the screen showing the same data in ASCII.

So, paste in the "massive string" that appeared after the serial number (don't paste in the whole message - just the long hex string from after the serial number) into the hex section (middle), then the serial number in ASCII goes after that (on the right), and finally one byte of zeros in the hex area.

8 - When entering the code into Ultra Sigma (Giggy's last step), enter it without quote marks.  For example:

:SYSTem:OPTion:INSTall R939MBGNR63H279H993PXZT49K4M

(don't use that exact code; it's just an example - use the code you got from rigup)

I hope this is helpful to somebody.

[corax]

This was mentioned earlier in the thread, but you don't need to use the Ultra Sigma software to use these hacks.
If you have an ethernet connection to the scope (and the scope's TCP/IP settings are useable), you can use telnet to send SCPI commands:
(utility->I/O Setting->LAN set  for TCP/IP setup and/or to see what DHCP address was assigned)

telnet <scopeaddress> 5555

Once connected, send the SCPI command:
*IDN?

... and you'll get the scope's ID string (and keys in the case of the hacked firmware).

That said, a scan with NMAP shows that the scope is also listening on other TCP ports:

root@raven:~# nmap -sS 192.168.1.198
...
80/tcp   open  http
111/tcp  open  rpcbind
5555/tcp open 
5566/tcp open
6666/tcp open  irc
MAC Address: 00:19:AF:28:17:08 (Rigol Technologies)


Port 80 and 5555 are expected (www and SCPI).
Looks like LXI uses RPC on port 111.
I wonder how ports 5566 and 6666 are used.

[tsmith35]

6666/tcp open  irc

Listening on 6666 isn't a good idea. It's a very popular port for malware and hackers to try and gain access to a machine. Strange that Rigol would choose to use that port...

[Rigby]

6666/tcp open  irc

Listening on 6666 isn't a good idea. It's a very popular port for malware and hackers to try and gain access to a machine. Strange that Rigol would choose to use that port...

malware often scans all ports, not just the common ones.  besides, vulnerability depends entirely on what has the port open. if you telnet and get a prompt, that's bad. if you telnet and get disconnected, not so bad.

[Giggy]

Thanks for the feedback Dave92F1,

1-3. I've reworded and added some pictures for clarity
4. ? Haha
5. The link i've provided shows version 01.01.10? They must have updated the page.
6. I installed the program as is, I did see something about an additional runtime, but I don't believe I had to install anything (Although I did have some NI software already?)
7-8. I've also reworded this and added some more information like you have.

Thanks a lot.

Considering the attention and now feedback my upload has had (582 downloads), I've revised the document.

- All word processed (no more hand written notes)
- More illustrations (improved image contrasts)
- Revised structure of document
- Added uninstall command at the end

DS2072A Unlocking Guide rev 1.0
http://www.mediafire.com/view/lk5fla8ib1w2mc1/D2072A_Unlocking_Guide.pdf

[Rigby]

SkyDrive/OneDrive
Dropbox
mega.co.nz
Google Drive
...

There are far better free ways to share files than Mediafire.

[Giggy]

SkyDrive/OneDrive
Dropbox
mega.co.nz
Google Drive
...

There are far better free ways to share files than Mediafire.

....
It was just the first thing that came up.

I open my links, I haven't had pop ups or captcha  etc.
What's wrong with it?
I tried mega originally, the website wouldn't work for half an hour so I gave up.

Also, 3foot, I can't see the file on your google drive account?

[Rigby]

it was more for future readers than you.  wasn't judging.

[Giggy]

@Rigby, okay no worries.

@ 3foot, Must be different country by country? Your link shows the name Lego_hulk.png but the image doesn't load.

It seems like Mega is the way to go, I haven't read about people having issues with them.
I'll make an attempt with Mega again if I make any more revisions.

Thanks.

[Mark_O]

no worries, i think its a regional IP thing. check out the previous post above. it may work

Yes, that last one:

(testing : giggy's rigol guide https://drive.google.com/file/d/0B8yFRtbwGWr5QVBGS2NoMlo2WVU/edit?usp=sharing)

works fine.

[Dave92F1]

I got 300 MHz working on my DS2072A (I was only able to get to 200 MHz before; "NS8H" didn't work).

I did it by installing Zombie28's patched firmware (this allows the DS2xxxxA to use the old DS2xxxx option keys):

https://mega.co.nz/#!FFk10SCY!UuWPXyqZwmca00pa2clOth1ryh1Z-AAgJg2yibfoUw0

Then, instead of rigup, I used the install key generated by http://riglol.3owl.com/ (mirrored, I think, at http://www.gotroot.ca/rigol/riglol/ - note that you can download those web pages and run them locally if you want), using "DSHH" to install "all options".

That worked!

BTW, that patched firmware doesn't recognize any options that were installed with the standard firmware (the options disappear).  Not to worry - you'll get them back when you install the key generated as above.