Author Topic: Sniffing the Rigol's internal I2C bus  (Read 1840404 times)

0 Members and 4 Guests are viewing this topic.

Offline PedroDaGr8

  • Super Contributor
  • ***
  • Posts: 1283
  • Country: us
  • A sociable geek chemist
Re: Sniffing the Rigol's internal I2C bus
« Reply #3200 on: April 13, 2014, 10:53:35 pm »
Hi there, I,m recently discovered this impresive forum, and it is one of the best forums about electronics  I even seen, so congratulations for your job.
My post is because I, thinking about to buy a Rigol DS1074Z, and my question is if the keygen fror DS2000 could be valid also for this DSO, or if there is someone who is working on it.

Thanks

Icaro

Read the thread, it's well discussed.
The very existence of flamethrowers proves that some time, somewhere, someone said to themselves, "You know, I want to set those people over there on fire, but I'm just not close enough to get the job done." -George Carlin
 

Offline ted572

  • Frequent Contributor
  • **
  • Posts: 399
  • Country: us
  • Radio Communications Equipment/System Design Engr.
Re: Sniffing the Rigol's internal I2C bus
« Reply #3201 on: April 14, 2014, 12:26:51 pm »
Hi there, I,m recently discovered this impresive forum, and it is one of the best forums about electronics  I even seen, so congratulations for your job.
My post is because I, thinking about to buy a Rigol DS1074Z, and my question is if the keygen fror DS2000 could be valid also for this DSO, or if there is someone who is working on it.

Thanks

Icaro
Use one of the On-Line Keygenerator (you want to use it for DS1000z) at* > 
RigLol keygen: http://riglol.3owl.com
Canadian mirror: http://gotroot.ca/rigol/riglol/
UK mirror: http://rigol.avotronics.co.uk/mirrors/riglol/

Do NOT install 500uV Vertical Sensitivity, as it doesn't work properly (buggy*).  Therefore do NOT use 'DSBA' - 500uV Vertical, or 'DSFR' - all options.

1. Type in your unit's Serial Number.
2. Type in DSER* for all options without the 500µV. This Option may not be in the Keygen's list, but it will work!
3. Do NOT enter anything for 'Privatekey', it will be inserted automatically for you (based on the DS1000z).
4. Press [GENERATE], and record the resulting Option Code.
5. When you are done enter the Option Code manually in the DS1000z using a single string without using any 'dash' (-) using Rigol's Procedure for activating the Trial Options in the D1000z.  As I recall the procedure is available on Rigol's Web Site under DS1000z.

    Good Luck, and if you have questions please feel free to ask me.

Note: * Edited from information provided by, and thanks to 'AndersAnd' in Reply #3253 below.
    Thank you AndersAnd, Ted

« Last Edit: April 15, 2014, 01:51:22 am by ted572 »
 

Offline hooverphonique

  • Contributor
  • Posts: 23
  • Country: dk
Re: Sniffing the Rigol's internal I2C bus
« Reply #3202 on: April 14, 2014, 01:33:59 pm »
I think there may have been a timer added if you try to add too many licenses, at least I saw some evidence of this in some of the text strings in one of the newer firmware versions.  You may have to leave it on for awhile to get out of that timer (which may also deplete your trial options).
And while you are at it ... take notes and write down times and stuff. If in fact Rigol did add some counter measures (unconfirmed hypothesis AFAIK), chances are fairly good that you still have a 100% usable instrument. As alank2 suggests, just leave it powered for a while to let it time out.

Success! I have now installed the 300MHz key generated by rigup 0.1 and all options are now listed as official.. I left the scope powered, but off, for some days and it now reacts to ":SYSTEM:OPT:INSTALL <key>" again..

It seems the timeout is somewhere between 2 and 4 days.. the trial keys still had minutes left, so it doesn't appear to be linked to those..

cheers everyone, and thanks for the great work..
« Last Edit: April 14, 2014, 01:45:31 pm by hooverphonique »
 

Offline BTO

  • Frequent Contributor
  • **
  • Posts: 334
  • Country: au
Re: Sniffing the Rigol's internal I2C bus
« Reply #3203 on: April 14, 2014, 03:05:26 pm »
Just thought i would POST the fact that i've managed to upgrade my scope
DS2072A from 70Mhz - 300Mhz

if anyone needs help, let me know
QUESTION EVERYTHING!!!
 

Offline Wim13

  • Regular Contributor
  • *
  • Posts: 241
  • Country: nl
Re: Sniffing the Rigol's internal I2C bus
« Reply #3204 on: April 14, 2014, 04:27:46 pm »
I think there may have been a timer added if you try to add too many licenses, at least I saw some evidence of this in some of the text strings in one of the newer firmware versions.  You may have to leave it on for awhile to get out of that timer (which may also deplete your trial options).
And while you are at it ... take notes and write down times and stuff. If in fact Rigol did add some counter measures (unconfirmed hypothesis AFAIK), chances are fairly good that you still have a 100% usable instrument. As alank2 suggests, just leave it powered for a while to let it time out.

In the FW there is this text: refused to install, please try again after 12 hours,
and also : interval to short, pls try again after 30 seconds.

so it seems there are some brute force restrictions build in.
 

Offline AndersAnd

  • Frequent Contributor
  • **
  • Posts: 572
  • Country: dk
Re: Sniffing the Rigol's internal I2C bus
« Reply #3205 on: April 14, 2014, 06:10:50 pm »
5. Repeat Step 1. through 4. for each Option code (DSAC, DSAE, etc.).
No need to do this. Simply enter DSER as the only option code instead. DSER is all options without the 500µV.
DSFR on the other hand has the buggy 500µV included as well, so only use DSER.
DSER is not listed at the keygen website, but it still works.
I think you should update you post with the guide to use DSER instead.

And while you're at it, http://rigol.avotronics.co.uk/mirrors/riglol/ is just a mirror of the original keygen site http://riglol.3owl.com there's another mirror at http://gotroot.ca/rigol/riglol/

I think you shopuld mention all three sites (some have problems accessing http://riglol.3owl.com and the other sites might be down from time to time too, so better mention all 3:

RigLol keygen: http://riglol.3owl.com
Canadian mirror: http://gotroot.ca/rigol/riglol/
UK mirror: http://rigol.avotronics.co.uk/mirrors/riglol/
« Last Edit: April 14, 2014, 06:23:42 pm by AndersAnd »
 

Offline icaro600

  • Newbie
  • Posts: 5
Re: Sniffing the Rigol's internal I2C bus
« Reply #3206 on: April 15, 2014, 09:09:20 am »
Thanks alot PedrodaGr8 and Ted572¡¡.  Just waiting for my DS1074Z, is comming¡¡¡

 :-+
 

Offline hans

  • Super Contributor
  • ***
  • Posts: 1644
  • Country: nl
Re: Sniffing the Rigol's internal I2C bus
« Reply #3207 on: April 15, 2014, 09:15:24 am »
5. Repeat Step 1. through 4. for each Option code (DSAC, DSAE, etc.).
No need to do this. Simply enter DSER as the only option code instead. DSER is all options without the 500µV.
DSFR on the other hand has the buggy 500µV included as well, so only use DSER.
DSER is not listed at the keygen website, but it still works.
I think you should update you post with the guide to use DSER instead.


Indeed, that would have been nice... It's not listed on the page, and blindly entered the "All Options" option. I've tried the 500uV/div setting, and it is indeed very buggy. Now it's annoying to have the bugged range everytime I scroll back to minimum V/div. Is there any way to undo keys?
My scope runs the SP5 firmware at this moment.

« Last Edit: April 15, 2014, 09:17:17 am by hans »
 

Offline ted572

  • Frequent Contributor
  • **
  • Posts: 399
  • Country: us
  • Radio Communications Equipment/System Design Engr.
Re: Sniffing the Rigol's internal I2C bus
« Reply #3208 on: April 15, 2014, 10:37:17 pm »
Yes, this is off topic.  I wanted to be sure we have an opportunity to get Rigol Service Guides/Manuals for the following:

1. DM3051,2,4,3061,2,4 Series,  2. DM3058,  3. DM3068,  4. DS1000D,E Series, and  5. DS4000.

https://www.eevblog.com/forum/testgear/rigol-service-manuals-where-to-find/msg426526/#msg426526
« Last Edit: April 15, 2014, 10:41:48 pm by ted572 »
 

Offline alexwhittemore

  • Frequent Contributor
  • **
  • Posts: 365
Re: Sniffing the Rigol's internal I2C bus
« Reply #3209 on: April 16, 2014, 07:33:48 am »
Hi

After reading in Suffer1981de's post about the DS1000Z firmware 00.02.03.SP5, I e-mailed my scope dealer and immediately received the new firmware. Although "new" is probably relative: seems to have been released on Jan. 26th, already. Haven't yet looked for changes or bug-fixes but noticed that the measurement menu on the left side has gained the 8 new measurements that are documented in the User Guide from Jan 2014, which is online on Rigol's website for quite some time, already.

Here is a link to the firmware:  http://www.filedropper.com/ds1000zupdate-v000203sp5

Have fun. :-)

This link seems dead. Does anyone have a working one? Is this update legit?

EDIT: Also, I know that the 500µV/div option doesn't seem to work for anyone, but my understanding is that you can set it, but the signal is offset wrong. I enabled the option (or, at least, I fed it a code it took that should have), but I can't seem to go down that low, my lowest vertical setting is 500mV. Incidentally, that setting works.

Oh. Duh. Probe attenuation factor. Set to 1, I see 500µV. Okay, so I've definitely noticed the problem where it flies off screen never to return, but depending on tongue angle it seems to work fine.

That said, I don't think there's anything special going on here: I notice that, with my vertical at 500uV, the discrete ADC steps are clearly visible. They look to be about 60µV tall. When I switch to 1mV/div, I still see steps, about half as tall on screen, which is to say they still look to be 60µV tall. It seems that, in both 1mV and 500uV/div modes, the ADC is scaled to 15.36mV p-p full scale, which actually is close enough that it seems believable that the 2mV/div range is the lowest range where full scale is actually all 8 divisions on screen (and the descretization steps are actually 62.5µV and not 60 as I roughly measured with cursors).

Not to say I'm too bummed out about that, a closer view is still helpful. But I don't think your input resolution is actually improving any when lower than 2mV/div, you're just seeing a digitally zoomed-in picture. If that's true, why not 200µV/div as well? Though at that point you'd only be seeing 3.2 steps per division, which would be almost more misleading than useful.

EDIT again: By the same token, I kind of which I had a 1ns/div timebase setting. Though of course it'd only represent one sample per division.
« Last Edit: April 16, 2014, 08:25:23 am by alexwhittemore »
 

Offline cybermaus

  • Frequent Contributor
  • **
  • Posts: 674
  • Country: nl
Re: Sniffing the Rigol's internal I2C bus
« Reply #3210 on: April 20, 2014, 06:39:57 am »
Hi

After reading in Suffer1981de's post about the DS1000Z firmware 00.02.03.SP5, I e-mailed my scope dealer and immediately received the new firmware. Although "new" is probably relative: seems to have been released on Jan. 26th, already. Haven't yet looked for changes or bug-fixes but noticed that the measurement menu on the left side has gained the 8 new measurements that are documented in the User Guide from Jan 2014, which is online on Rigol's website for quite some time, already.

Here is a link to the firmware:  http://www.filedropper.com/ds1000zupdate-v000203sp5

Have fun. :-)

This link seems dead. Does anyone have a working one? Is this update legit?

Indeed. Anyone has a mirror for that firmware?
Thanks
 

Offline alexwhittemore

  • Frequent Contributor
  • **
  • Posts: 365
Re: Sniffing the Rigol's internal I2C bus
« Reply #3211 on: April 20, 2014, 03:47:09 pm »
Requested an update from rigol of it exists, but I haven't heard back. Also reported a couple existing firmware bugs, haven't heard back there either yet.
 

Offline Mark_O

  • Frequent Contributor
  • **
  • Posts: 939
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #3212 on: April 21, 2014, 03:33:14 pm »
Sadly, this thread no longer has anything to do with its named Subject.  :'(  And hasn't for some time.  It's now the, "Can someone explain to me again (for the 100th time) how to hack the options on my Rigol" thread.  :rant: 

That's too bad, because it used to be quite interesting.  But as a result, I'm no longer following it, and I suspect many others have dropped out as well.   |O

In retrospect, it would have been wise, once the flood of newbies-without-a-clue arrived, to have spawned off a separate discussion for that.  But I suspect no one anticipated how quickly that would take over.  Someone could still do that, but I'm not sure at this point if there's any hope for recovery in this one.  It's likely permanently polluted.  It's serving two completely different audiences, and as a result, does neither well.
 

Offline Sparky

  • Frequent Contributor
  • **
  • Posts: 450
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #3213 on: April 21, 2014, 05:48:53 pm »
Sadly, this thread no longer has anything to do with its named Subject.  :'(  And hasn't for some time....
That's too bad, because it used to be quite interesting.  But as a result, I'm no longer following it, and I suspect many others have dropped out as well.   |O

How about DP832 v01.09 firmware investigation? There has been some change of keys etc after the v01.09 firmware...
 

Offline alexwhittemore

  • Frequent Contributor
  • **
  • Posts: 365
Re: Sniffing the Rigol's internal I2C bus
« Reply #3214 on: April 21, 2014, 06:00:39 pm »
In retrospect, it would have been wise, once the flood of newbies-without-a-clue arrived, to have spawned off a separate discussion for that.

Newbies without a clue? This thread was off topic as soon as the discussion arose of elliptic curve implementation weakness and the possibility of key generation, and it was already a good 30 pages in at the time. Really, 15 pages before even that with trial keys. Hardly the work of newbies without a clue. Have some perspective and try to be a little less holier-than-thou.
 

Offline Gallymimus

  • Regular Contributor
  • *
  • Posts: 178
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #3215 on: April 21, 2014, 11:36:07 pm »
In retrospect, it would have been wise, once the flood of newbies-without-a-clue arrived, to have spawned off a separate discussion for that.

Newbies without a clue? This thread was off topic as soon as the discussion arose of elliptic curve implementation weakness and the possibility of key generation, and it was already a good 30 pages in at the time. Really, 15 pages before even that with trial keys. Hardly the work of newbies without a clue. Have some perspective and try to be a little less holier-than-thou.

Lamenting some level of thread organization in retrospect is far from holier than thou.  What are you smoking?

Even at this stage spinning off threads would probably be sensible.  I'd vote for a new tech discussion thread and leave the "how do I mod my scope" messages here.  The more dedicated technical folks are more likely to embrace a new thread than the 1 post help me'ers
 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 2051
  • Country: nl
Re: Sniffing the Rigol's internal I2C bus
« Reply #3216 on: April 22, 2014, 12:13:36 am »
I'd vote for a new tech discussion thread and leave the "how do I mod my scope" messages here.  The more dedicated technical folks are more likely to embrace a new thread than the 1 post help me'ers

Vote with your keyboard. ;)
 

Offline Gallymimus

  • Regular Contributor
  • *
  • Posts: 178
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #3217 on: April 22, 2014, 12:50:49 am »
I'd vote for a new tech discussion thread and leave the "how do I mod my scope" messages here.  The more dedicated technical folks are more likely to embrace a new thread than the 1 post help me'ers

Vote with your keyboard. ;)

I did! +1
 

Offline Teneyes

  • Frequent Contributor
  • **
  • Posts: 498
  • Country: ca
Re: Sniffing the Rigol's internal I2C bus
« Reply #3218 on: April 22, 2014, 08:06:28 am »
Hello All
   I just received  new FW 00.03.00.01.03 for DS2000
   Has anyone got this version???
   It seems to fix bugs I had found, more testing to do.
   See Pic for new Acquire Menu , room for Logic speed setting I wonder???
IiIiIiIiIi  --  curiosity killed the cat but, satisfaction brought it back
 

Offline ted572

  • Frequent Contributor
  • **
  • Posts: 399
  • Country: us
  • Radio Communications Equipment/System Design Engr.
Re: Sniffing the Rigol's internal I2C bus
« Reply #3219 on: April 22, 2014, 08:23:38 pm »
Hello All
   I just received  new FW 00.03.00.01.03 for DS2000
   Has anyone got this version???
   It seems to fix bugs I had found, more testing to do.
   See Pic for new Acquire Menu , room for Logic speed setting I wonder???
Do you still have 200 MHz BW and the all other Options?
  Thank you for the info, Ted572
 

Offline Teneyes

  • Frequent Contributor
  • **
  • Posts: 498
  • Country: ca
Re: Sniffing the Rigol's internal I2C bus
« Reply #3220 on: April 22, 2014, 09:02:13 pm »
 I just install  new FW 00.03.00.01.03 for DS2000
Do you still have 200 MHz BW and the all other Options?
As much as I can check the configuration was Not Changed . all Offcial
To me it looks like a Self-Cal will be required. ( different Cali. from FW00.02......
Easy to go back older FW 
IiIiIiIiIi  --  curiosity killed the cat but, satisfaction brought it back
 

Offline icaro600

  • Newbie
  • Posts: 5
Re: Sniffing the Rigol's internal I2C bus
« Reply #3221 on: April 24, 2014, 06:33:31 pm »
Use one of the On-Line Keygenerator (you want to use it for DS1000z) at* > 
RigLol keygen: http://riglol.3owl.com
Canadian mirror: http://gotroot.ca/rigol/riglol/
UK mirror: http://rigol.avotronics.co.uk/mirrors/riglol/

Do NOT install 500uV Vertical Sensitivity, as it doesn't work properly (buggy*).  Therefore do NOT use 'DSBA' - 500uV Vertical, or 'DSFR' - all options.

1. Type in your unit's Serial Number.
2. Type in DSER* for all options without the 500µV. This Option may not be in the Keygen's list, but it will work!
3. Do NOT enter anything for 'Privatekey', it will be inserted automatically for you (based on the DS1000z).
4. Press [GENERATE], and record the resulting Option Code.
5. When you are done enter the Option Code manually in the DS1000z using a single string without using any 'dash' (-) using Rigol's Procedure for activating the Trial Options in the D1000z.  As I recall the procedure is available on Rigol's Web Site under DS1000z.


Hi all, my new DS1074Z has arrived. Applying the procedure of Ted572 using the code DSER all options ok. But the 100MHz increase has no effect, the minimum setting of the time base still in 5us. After unblock all the features I have typed in the key generated with the code DSEA, reset the Rigol but still in 5us.
Any suggestion? Maybe I,m forgot something?

Thanks
 

Offline Gallymimus

  • Regular Contributor
  • *
  • Posts: 178
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #3222 on: April 24, 2014, 06:41:06 pm »


Hi all, my new DS1074Z has arrived. Applying the procedure of Ted572 using the code DSER all options ok. But the 100MHz increase has no effect, the minimum setting of the time base still in 5us. After unblock all the features I have typed in the key generated with the code DSEA, reset the Rigol but still in 5us.
Any suggestion? Maybe I,m forgot something?

Thanks

Did you check the model number in the settings on the scope?  If it worked it will say DS1104z instead of DS1074z
 

Offline icaro600

  • Newbie
  • Posts: 5
Re: Sniffing the Rigol's internal I2C bus
« Reply #3223 on: April 24, 2014, 06:46:01 pm »
Sorry guys, I have noted the model has changed to DS1104Z in the System Information window, so this is ok
By the way my firmware version is 00.02.03.SP5

Regards
 

Offline alexwhittemore

  • Frequent Contributor
  • **
  • Posts: 365
Re: Sniffing the Rigol's internal I2C bus
« Reply #3224 on: April 24, 2014, 06:49:42 pm »
I assume you mean 5ns, not 5µs. That's normal, the lowest timebase even on the 1104z is 5ns. With 100MHz of bandwidth, that's one period of a pure 100MHz signal per two divisions. It'd be nice to get a little more zoom, but eh.

Anyway the proper way to verify that the option is enabled is to put in a 100MHz sine wave and verify that it's no more than 3dB lower in amplitude than the same source generating a much lower frequency at the same amplitude setting. But then, finding a 1GHz bandwidth function generator is a tall order, so the REAL way to do it is to measure the rise time on a sharp-edged signal - a positive going digital edge from an Arduino is probably sufficient, but your function generator isn't: I know my Tek FG503 puts out up to 3MHz signals, but it has an output bandwidth of only around 7MHz so 3MHz square waves are QUITE rounded.

Anyway, once you know the rise time of an edge with assumed infinite bandwidth, rule of thumb is scope bandwidth = .35/(rise time). So if the rise time off my function generator square wave, is, for example, 56ns, .35/(56ns) = 6.25MHz.
« Last Edit: April 24, 2014, 07:48:41 pm by alexwhittemore »
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf