Hacking the Rigol MSO5000 series oscilloscopes

[qali.pro]

Does this patch also block the calling home to Rigol, or does it just enable the license.

I would suggest persons test the new FW before they patch it to see if the FW has any bugs, if we don't test the FW then it will be difficult to report a bug to Rigol. I think there is a general resistance to report issues to support and therefore a number of issues don't get resolved or included in firmware fix. I see the Siglent guys report issues to Tautech instead of calling Siglent support, so this may be related to persons fearing support will discover they have hacked the scope. The manufactures are fully aware the scopes  are hacked, if they made them un-hackable they would lose a lot of business.

Some bugs may take years to be reported as scopes have so many options that many people never use all of them and so bugs go undiscovered.

I did some testing I have confirmed it's blocking all outside requests , (Because of that the online upgrade Button does not work any more).

Hello everybody,



I apologize to everyone for the previous problems.
Here is a new patch for real fix all previous problems (finish tested it's working perfectly well for me).


FW:01_03_00_03
Build: 2021-10-18

(Attachment Link) " alt="" class="bbc_img" />
(Attachment Link) " alt="" class="bbc_img" />
(Attachment Link) " alt="" class="bbc_img" />
(Attachment Link) " alt="" class="bbc_img" />

Hi quali.pro,

thanks for all your effort and congrats 

"zidot" already showed me how to patch my actual firmware.
Can you tell me if you would recommend to update my firmware to yours
(if this is possible?) and afterwards patch it or should I stay and patch it as it is?

I have following data read out of mine:
Firmware:     0A.01.03.00.01
Hardware:    01.01.000
Boot:            2018.06.27
Build:            2021-05-04 15:50:32

Thanks in advance.

Yes i  recommend to update (if you like), it is somewhat safe, to be on the safe side , (if you do crazy stuff ) you must make a backup "rigol/data". (check  #879 https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg2241168/#msg2241168)
You can go to the original F.W anytime you want.

[thm_w]

its these type of thing which Dave was complaining about in his initial review. when it first came out. i have been hoping for a re-review. like an update bug hunt with the newest firmware. but it has not happen yet?

but you would think so. given how many people have bought this scope. there are not others competing much close to it in the raw price / performance. once you figure out the per $ dollar value (per mhz / per msps / per channel). what with all the extra features like the signal gen, spectrum analyzer etc. included too

Because it just does not matter. Don't waste your time waiting for one. Most of the original bugs were related to the logic analyzer, which 99% of people never use (and should not use, unless you just need time corelation). There were never any "showstoppers".

[Howardlong]

Most of the original bugs were related to the logic analyzer, which 99% of people never use (and should not use, unless you just need time corelation).

I use the LA at the very least half the time I switch on the scope.

[dreamcat4]

lol yeah... it's a core feature for me too. I am not at all sure what the other guy was talking about there...

So this is just a speculation. But maybe he meant that we should use the 4 scope channels instead of the LA channels connector, to avoid whatever that specific lag issue is that makes the LA problematic from a timings standpoint?

But how in the world is that not some major bug!?!?!?! For example what if you need more than only 4 digital channels

* Or he only meant 'scope scope its only a scope' features. Instead of the other additional side features?
* Or maybe the LA issues all is fixed now? Which was my original quesitron here and entirely my point

Because blindly assuming this stuff is fixed. Is a completely different thing from actually having somebody go back and prove / demonstrate that an issue really is fixed now, and in the latest firmware(s). The 2nd being far more reassuring for a new buyer. It also includes checking for things like regressions or newly introduced bugs etc. Which might not have existed in earlier versions. Or simply at least showing people that there really are none.

Or am I missing something else here? 

[Howardlong]

lol yeah... it's a core feature for me too. I am not at all sure what the other guy was talking about there...

So this is just a speculation. But maybe he meant that we should use the 4 scope channels instead of the LA channels connector, to avoid whatever that specific lag issue is that makes the LA problematic from a timings standpoint?

But how in the world is that not some major bug!?!?!?! For example what if you need more than only 4 digital channels

* Or he only meant 'scope scope its only a scope' features. Instead of the other additional side features?
* Or maybe the LA issues all is fixed now? Which was my original quesitron here and entirely my point

Because blindly assuming this stuff is fixed. Is a completely different thing from actually having somebody go back and prove / demonstrate that an issue really is fixed now, and in the latest firmware(s). The 2nd being far more reassuring for a new buyer. It also includes checking for things like regressions or newly introduced bugs etc. Which might not have existed in earlier versions. Or simply at least showing people that there really are none.

Or am I missing something else here? 

The only LA specific problem I'm aware of is the 1ns trigger delay.

[dreamcat4]

ah ok... so can this be worked around? For example by setting up the trigger on an analog channel instead? (but to be triggering for the LA capture)

[Howardlong]

ah ok... so can this be worked around? For example by setting up the trigger on an analog channel instead? (but to be triggering for the LA capture)

Well, you could do, but you'd need to deskew the channels anyway, whether there's a 1ns delay or not: on mine I need around a -2ns delay on the analogue channel to the LA with the stock probes.

In practice, it's no biggie to be honest. You get used to it, and while 1ns resolution on the LA is great, it's not all that often you're zoomed in that far that it makes a real difference. Furthermore, it's more typical you'd be using a serial trigger rather than a simple edge anyway.

[qali.pro]

Hello,
Have anyone emulate this oscilloscope with QEMU, please share with me?

[oliv3r]

Hello,
Have anyone emulate this oscilloscope with QEMU, please share with me?

What are you trying to accomplish? Emulating the application in qemu probably isn't hard, but you still have to write the code for the peripherial. As this scope heavily relies on the zynq's FPGA, it'll be quite limited what you can emulate ...

[oliv3r]

Rigol MSO5000 Firmware v00.01.03.00.03 :

[Updated Contents]
--------------------

v00.01.03.00.03 2021/10/18

      - Optimized waveform display in XY mode.
      - Optimized the DC gain calibration algorithm.
      - The La channel is decoded in parallel, which solved the problem of decoding error in negative polarity.

Download:
https://www.rigolna.com/products/digital-oscilloscopes/MSO5000/

Thanks, puhsed those to https://gitlab.com/riglol/rigolee/firmware/
Sorry for the delay

[normi]

Most of the original bugs were related to the logic analyzer, which 99% of people never use (and should not use, unless you just need time corelation).

I use the LA at the very least half the time I switch on the scope.

Have you tested the new firmware to see if there are any improvements on the LA, I had seen the 1ns delay on an a few occasions but was not able to reproduce, I was on a beta firmware so not sure if that made a difference.

[normi]

Hi
I'm new here.
I recently bought an MS05074. And I applied the FW from qali.pro, message 2175. It worked ok. Thankful qali.pro.
I am new to using Digital Oscilloscope. I am learning to use my MSO5074. I don't know if it's a BUG or not, as follows:
1. I want to do the Measuring the Modulation Index of AM Signal using an FFT, using the signal generated in G1 or G2 AWG, and then FFT - Math function in MSO5074.
2. For Unmodulated Signals (Sine/Square) I got a satisfactory result using the FFT function in Math of MSO5074.
3. And then, I want to measure the Deviation Meter for FM modulated signal, using the signal generated in G1 or G2 AWG, and then FFT - Math function in MSO5074.
4. For Measuring the Modulation Index of an AM Signal using an FFT, I found an application note for the SIGLENT SDS 1204X-E, here:
https://siglentna.com/application-note/measuring-the-modulation-index-of-an-am-signal-using-an-fft/?pdf=9065

And that's exactly what I want to do, but using MSO5074. I tried it in different ways, but I couldn't get a satisfactory result. Commands on both MSOs are different.
I ask for your help to find a satisfactory solution, as in the case of SIGLENT SDS 1204X-E.

5. To generate in AWG G1 or G2, Carrier Sine Signal f = 1MHz, with Vpp = 500mV, and Audio Modulator Sine f = 10 KHz, with AM Depth = 80%. I suggest the quick commands on MSO5000:
(Enter G2 SINE WAVE Signal 1 MHz with Modulation to CH-1)
(G2)  (Wave  Sine)  (Frequency)  (Set on Touch Screen  1 MHz)  (Amplitude)  (Set on Touch Screen  500 mV) 
 (AUTO)  (G2) 
(Settings)  (Type  Modulation)  (Type  AM)  (Waveform  Sine)  (Frequency)  (Set on Touch Screen  10 KHz)  (AM Depth  80%)   (Impedance  50R)  (Menu off)
6. I ask to do the sequence of commands on the MSO5000, which it does as shown above. In order to be easily reproduced.
7. Congratulations to all who contribute to the topic.

Possible you should have raised a new post for this, however not sure what issue you are having why you say the results are different. I am getting the same ~80%. The difference you may find are related to the attenuation caused by the cabling being used and the fact that the Siglent scope is averaging the results which the Rigol does not, so the numbers will move up an down by tiny amounts. They are also using a dedicated signal generator which is likely far more accurate than one coming from an oscilloscope. if you use 50ohm output you will need a 50 ohm termination on the scope.

[normi]

The 80% index is correct as the difference in the sidebands and the carrier is around the 7.9dbV mark. The issue you are having is that the modulated carrier appears to be half of the unmodulated carrier, is that correct.

[normi]

I relooked at this with a different generator, a cheap one. I noticed that the modulated carrier dropped in amplitude only for the SG from the MSO5000, the external SG maintained its amplitude. From your screen I can see that the modulated carrier was no longer .5V P-P, not sure if anyone else had observed this as an issue. Will have to check.

The RMS voltage is a real measurement while the FFT is calculated so there will be small differences, you can turn on the Vrms units instead of the DB in the FFT and those should align with each other. The large gap you are seeing is primarily due to you comparing the RMS value  of the entire signal vs the signal of the carrier. Remember there a 3 signals with their own Vrms voltage, 106vrms is the combined wave.

The maths does imply that the carrier should go both higher and lower than its peak when modulated, so I am not sure if some generators vary the way they do AM modulation, and the document you attached does not show details of the modulated wave so I am not able to make comparison to that. May have to search for some you tube videos with examples.

[core]

Hi BRZ,

I have both oscilloscopes (MSO5074 and SDS 1104X-E), so I have replied your experiment.
But instead the built-in generator, I have used the Siglent SDG2042X.

So please find the pictures I have from the experiment. For me it seems that there is no problem, the oscilloscopes are very close.

[core]

Tip, it seems that the DMV measurement is not very reliable for this experiment.
The current value is changing, the average value is more stable, but the DVM value is none of them - is very stable but way off.
See the picture below.

[quakeman]

Maybe we should stay a bit more at the topic in this much too long thread which is hacking the MSS5000 and not analyzing it's performance.
It's hard enough to find the related posts for the patches and co without having to scroll unrelated messages. I think another thread for discussing the MSO5000 functions would be helpful. But these are only my thoughts concerning this thread to stay a bit more at it's topic.

[Cerebus]

Maybe we should stay a bit more at the topic in this much too long thread which is hacking the MSS5000 and not analyzing it's performance.
It's hard enough to find the related posts for the patches and co without having to scroll unrelated messages. I think another thread for discussing the MSO5000 functions would be helpful. But these are only my thoughts concerning this thread to stay a bit more at it's topic.

My thoughts exactly. Please, just keep the discussion in this thread to "Hacking the Rigol MSO5000 series oscilloscopes", just like it says in the thread title. This kind of thread is enormously valuable to a large number of people, thus it's one of those places where the margin of tolerance for off-topic posting should be quite small.

[normi]

If you noted in my post I stated that he should raise this as a new post, however I was wondering whether this was a bug due to firmware so I felt it was necessary to check. I am going to put my last post that I deleted below as this is an easy check that others can do in another thread and produce something conclusive.

"Thanks Core.
You have confirmed what I suggested, the issue is with the SG and the way it generates the signal, as I mentioned the math says the modulated carrier will be larger than the carrier. Your picture shows that the modulated carrier is closer to 1Vp-p vs 500mvp-p. Rigol could be asked to look at the drop in voltage when the modulation starts but the rest is part of the design. My Feeltech SG also does not produce a higher voltage when modulated so this is a form of design. If they don't follow the math in how they implement the AM modulation then the results will be different. "

[BRZ.tech]

@quakeman, @Cerebus, @Megavolt, @normi.
I understood your opinions.
That way, just like @normi, I'll delete my posts relating to this subject. Not to detract from the main purpose of the discussion on this Thread: "Hacking the Rigol MSO5000 series oscilloscopes".

[Martin72]

When I see the pic with the fft....Do the rigol STILL have one colour for all math traces ?? 

[normi]

@quakeman, @Cerebus, @Megavolt, @normi.
I understood your opinions.
That way, just like @normi, I'll delete my posts relating to this subject. Not to detract from the main purpose of the discussion on this Thread: "Hacking the Rigol MSO5000 series oscilloscopes".

I had deleted the previous post because I felt that the conclusions I made were wrong since I later got the correct results, however I realized that the results were affected by the settings related to the impedance and therefore the conclusion could still be correct. Since the issue I doubt is related to the new firmware hack, it would require its own thread. You can raise a support question to Rigol and have them confirm if this is by design, which I suspect it is.

[BRZ.tech]

@normi.
1. Following your suggestion, I start a new Thread, summarizing what we talked about in this thread. Here:
https://www.eevblog.com/forum/testgear/rigol-mso5000-fft-scripts-and-bugs/

[kn4ycd]

Hey there!

I have all the files on a 4gb, fat32 formated jump drive, in the root directory.  I just got my scope today, it has the 0A.01.03.00.01 build 2021-05-04 firmware.

Every time I try to install the patch, I get an error message that 'patch.txt' not found.  Are there files that are supposed to be in a sub-folder?  The zip had everything in one folder.

THanks!

Jim

UPDATE - Win 11 formatting fat32 on the jump drive is no good.  Re-formatted with Rufus, and now I am past that error.  However, getting checksum errors.  Is there a patch file for this version of firmware?

[rgry]

Can I use this firmware and still get all the features turned on with the software hack? Do I need to modify anything?

[Supported Model]    All the MSO5000 Series Digital Oscilloscopes
[Latest Revision Date]  2021/10/18
v00.01.03.00.03 2021/10/18
      - Optimized waveform display in XY mode.
      - Optimized the DC gain calibration algorithm.
      - The La channel is decoded in parallel, which solved the problem of decoding
         error in negative polarity.