Sniffing the Rigol's internal I2C bus

[exciler]

FYI: My DS1054Z has FW 00.04.01.SP2

[Magnum]

FYI: My DS1054Z has FW 00.04.01.SP2

Thanks. Hopefully I'll receive mine tomorrow.

[farzadb82]

FYI: My DS1054Z has FW 00.04.01.SP2

Have you tried using the DS1000z hacks as yet ?  If so, do they work ?

I'm curious because I have the MSO1074Z-S and none of the DS1000Z hacks currently work. Prior to getting the MSO1074Z-S, I had a DS1074Z-S with the older 00.04.00 (I think) firmware and the hacks did work on that scope. I'm suspecting that the firmware image is the same for all DS/MSO1000Z models. From what I can tell, by looking at the firmware image I have, they have changed the way the license keys are generated in 00.04.01.SP2.

[Magnum]

FYI: My DS1054Z has FW 00.04.01.SP2

Same firmware here, codes work.

[toni31]

i think a new thread for 1054z it helps

[pierre288]

Hi,
I recently got a  MSO1074Z-S which is at version 00.04.01.SP2
I tried to add features but did not work either for me.

Any hope to get a rigol utility update soon ?

thanks

[rmd79]

Hi,
I recently got a  MSO1074Z-S which is at version 00.04.01.SP2
I tried to add features but did not work either for me.

Any hope to get a rigol utility update soon ?

thanks

I've got a memory dump of my MSO1074Z-S if anyone wants to have a look into it.  PM me if you're interested.  Its about 8MB compressed.

[alank2]

There was a time when the DS2302 (300MHz) mode was buggy with the 00.02.01.00.03 firmware.  Did the 00.03.00.01.03 version correct the issues?  Is there a downside to running it as a ds2302 compared to a ds2202 any longer?

[hammy]

I've got a memory dump of my MSO1074Z-S if anyone wants to have a look into it.  PM me if you're interested.  Its about 8MB compressed.

Your serial number starts with "DS1ZD" and my serial with "DS1ZC". The following six numbers are the same, except for the last three numbers.
I suppose the "D" is for the model with the signal generator (MSO1074Z-S) and the "C" is for the model without sig-gen (MSO1074Z).

 

[Gandalf_Sr]

There was a time when the DS2302 (300MHz) mode was buggy with the 00.02.01.00.03 firmware.  Did the 00.03.00.01.03 version correct the issues?  Is there a downside to running it as a ds2302 compared to a ds2202 any longer?

I 'upgraded' my MSO2072A to a MSO2302A; so far I have had no issues.  The I2C decode seems slow, you can't look at the decode real time, you have to capture a single shot and then you can see it go past doing the decode.  In this respect, having such a large memory is clearly an advantage, I have a Tektronix MDO2024 at work and it's annoying that you can capture a section of I2C with decode but when you start scrolling through the message chain, it quickly craps out because it's run out of memory.  I'll check on the software versions on my MSO2302A and update this post.

[bistopepmol]

Hey there,

Got my new scope a couple of days ago,  DS2072A ( to replace my Poorly Tektronix 2430a (trig fault) ) Hardware ver 1.0.2.0.2 and firmware 00.03.00.01.03, I followed the great posts on here and now I have a DS2302 and all is well, thank you so much guys for the brilliant posts,     

[alank2]

I 'upgraded' my MSO2072A to a MSO2302A; so far I have had no issues.  The I2C decode seems slow, you can't look at the decode real time, you have to capture a single shot and then you can see it go past doing the decode.  In this respect, having such a large memory is clearly an advantage, I have a Tektronix MDO2024 at work and it's annoying that you can capture a section of I2C with decode but when you start scrolling through the message chain, it quickly craps out because it's run out of memory.  I'll check on the software versions on my MSO2302A and update this post.

Thanks for the info, anyone else, especially those running earlier DS2072 hardware versions having good or bad luck with the 2302 mode with FW 00.03.00.01.03?

Also, I thought I saw discussion about upgrading the bootloader and being unable to downgrade below certain firmware or something.  Was that for the DS2000 series or something else?

[Jog]

Hi together,

good news & bad news....

Scope DS2072a FW 03. SP1, HW2.0

Memory dump with: echo :SYST:UTIL:READ? 15441920,13262848 | ncat -i 1 SCOPE_ADDRESS_HERE 5555 > DS2072A_sdram.bin
works fine. 12,9MB.

rigup DS2072A DS2072A_sdram.bin > opt.txt
works also fine and generates 4 different keys (only all options, 100MHz full option, 200 & 300) and I try all but they sems not to fit.
PS: also rigup scan DS2072A_sdram.bin > ec_decoded.txt works also fine an generates valid entries

BUT entering the key over:
a) Scope directly = 0 reaction
b) over Ultra Sigma SCPI command ":SYSTem:OPTion:INSTall key" = 0 reaction
c) over Ncat via LAN "echo :SYST:OPT:INSTALL A_KEY_FROM_OPTIONS_WITHOUT_DASHES | ncat -i 1 SCOPE_ADDRESS_HERE 5555" = also 0 reaction

 

Any ideas/hints why it fails?

Update: Scope was blocked by to many false tries to enter unknown Options. After factory reset (multipress left gray button #6 multiple during booting) and retry to enter generated keys

  IT works! 

many thanks to all!

[Gandalf_Sr]

@Jog

Glad to hear you got your DS2072A 'upgraded', I was unaware of the factory reset procedure until you posted it.

[farzadb82]

Hi together,

good news & bad news....

Scope DS2072a FW 03. SP1, HW2.0

Memory dump with: echo :SYST:UTIL:READ? 15441920,13262848 | ncat -i 1 SCOPE_ADDRESS_HERE 5555 > DS2072A_sdram.bin
works fine. 12,9MB.

rigup DS2072A DS2072A_sdram.bin > opt.txt
works also fine and generates 4 different keys (only all options, 100MHz full option, 200 & 300) and I try all but they sems not to fit.
PS: also rigup scan DS2072A_sdram.bin > ec_decoded.txt works also fine an generates valid entries

BUT entering the key over:
a) Scope directly = 0 reaction
b) over Ultra Sigma SCPI command ":SYSTem:OPTion:INSTall key" = 0 reaction
c) over Ncat via LAN "echo :SYST:OPT:INSTALL A_KEY_FROM_OPTIONS_WITHOUT_DASHES | ncat -i 1 SCOPE_ADDRESS_HERE 5555" = also 0 reaction

 

Any ideas/hints why it fails?

Update: Scope was blocked by to many false tries to enter unknown Options. After factory reset (multipress left gray button #6 multiple during booting) and retry to enter generated keys

  IT works! 

many thanks to all!

Hi Jog. Do you know if the factory reset procedure is the same for all Rigol scopes ?  I have a MSO1074Z-S scope and I keep getting a message that states I'm unable to enter any more keys for 12 hours.


-- Farzad

[Jog]

Hi, I am not sure but I found it  as pdf on the rigol hp directly. You can search. Rg Jog

[LoyalServant]

This method worked for me with a tweak, see below....

Hi together,

good news & bad news....

Scope DS2072a FW 03. SP1, HW2.0

Memory dump with: echo :SYST:UTIL:READ? 15441920,13262848 | ncat -i 1 SCOPE_ADDRESS_HERE 5555 > DS2072A_sdram.bin
works fine. 12,9MB.

rigup DS2072A DS2072A_sdram.bin > opt.txt
works also fine and generates 4 different keys (only all options, 100MHz full option, 200 & 300) and I try all but they sems not to fit.
PS: also rigup scan DS2072A_sdram.bin > ec_decoded.txt works also fine an generates valid entries

BUT entering the key over:
a) Scope directly = 0 reaction
b) over Ultra Sigma SCPI command ":SYSTem:OPTion:INSTall key" = 0 reaction
c) over Ncat via LAN "echo :SYST:OPT:INSTALL A_KEY_FROM_OPTIONS_WITHOUT_DASHES | ncat -i 1 SCOPE_ADDRESS_HERE 5555" = also 0 reaction

 

Any ideas/hints why it fails?

Update: Scope was blocked by to many false tries to enter unknown Options. After factory reset (multipress left gray button #6 multiple during booting) and retry to enter generated keys

  IT works! 

many thanks to all!

One small tweak:
I changed...

echo :SYST:UTIL:READ? 15441920,13262848 | ncat -i 1 SCOPE_ADDRESS_HERE 5555 > DS2072A_sdram.bin

To:

echo :SYST:UTIL:READ? 15441920,13262848 | ncat -i 1s SCOPE_ADDRESS_HERE 5555 > DS2072A_sdram.bin

The scope is not answering fast enough for some reason so ncat was dropping an empty file.

Confirming the 300Mhz key did NOT work for me.
The output of rigup said it was untested and unconfirmed.. so confirming at least for me it was a no go.
The 200Mhz key did work.

Cheers guys.

[Jog]

Hi Rf, normaly not necessary to change the ncat -i 1 to 1s because -i stands for idle time. For me it was no different because the file size was the same. But know you have a 200mhz. Have fun

[LoyalServant]

Hi Rf, normaly not necessary to change the ncat -i 1 to 1s because -i stands for idle time. For me it was no different because the file size was the same. But know you have a 200mhz. Have fun

Yes, it is the idle time... but the -i option without any additional parameters is assumed to be milliseconds.
That means ncat needs to have some data coming at it within 1 millisecond.... that's cutting it close which is why I had trouble.
Just posted for others that might not know what ncat is or how to use it.

I am curious about the feature that Rigol has in this scope to dump the ram like that...

[Fungus]

After factory reset (multipress left gray button #6 multiple during booting) and retry to enter generated keys...

Is there a secret 'reset' button like this for the DS1000Z ?

[farzadb82]

After factory reset (multipress left gray button #6 multiple during booting) and retry to enter generated keys...

Is there a secret 'reset' button like this for the DS1000Z ?

Unfortunately, there's nothing "officially" documented, that I was able to find. I attempted the procedure above, but had no success.

Without any official documentation or insider information, I think the only way to discover or find features like this would be to disassemble the firmware image and trace code paths. I'm taking a stab at this right now, but have a steep learning curve ahead.


-- Farzad

[Gixy]

http://beyondmeasure.rigoltech.com/acton/attachment/1579/f-02f4/1/-/-/-/-/file.pdf

Reset procedure for DS2000/4000/6000, to be confirmed for DS1000 series.

[seronday]

DS4000 series Bandwidth (model type) Option Codes.

For those who have an interest in the DS4000, I have found the option codes for selecting the bandwidth .
This also sets the model type.

For example the code FAB9 will select 500Mhz, (DS405x), with all Decoders enabled.

The attached file contains all the details.

There are also two un-documented, possibly future, options called "Power Analysis" and "MA".

The option codes have been tested with firmware ver 00.02.00.00.04 and ver 00.02.01.00.03.

*EDIT*
 Attached updated PDF document to include the option selection codes for LIN and 1553B decode.
Also included are two possible future options,  Power Analysis and I2S decode.
Power Analysis has been listed for some time, but the I2S decode is relatively recent.
The original un-documented "MA" option has become the 1553B decode option.

[Gallymimus]

Well thats cool, how did you find these extra ds4000 options? Why do you think they weren't discovered before?

[Fungus]

After factory reset (multipress left gray button #6 multiple during booting) and retry to enter generated keys...

Is there a secret 'reset' button like this for the DS1000Z ?

Unfortunately, there's nothing "officially" documented, that I was able to find. I attempted the procedure above, but had no success.

I tried the above and it reset all the options and went back to Chinese (seems just like "Storage->Default" but it resets the language as well).

Luckily it starts up in a state where it says "Language" on the menu...easy to go to a different language.