Hacking the Rigol DHO800/900 Scope

[Fungus]

When I first learned about the 1.25 GSa/s sampling rate on the DHO800/900 series, I thought they might be deliberately throttled to keep some differentiating features for the DHO1000. But then it became known that Rigol had to cripple the DHO900 series by cutting its analog sampling rate in half whenever the digital channels are used. (Which happen to consume half the data rate, capturing 16-bit words at 625 MSa/s.)

I wouldn't call it "crippled".

I see it more like a Swiss Army knife: It has a lot of tools available but you use them individually. You're not supposed to open all the blades at the same time.

This one's strength is the analog part. If you use digital all day long then get an MSO5000 instead. 

[Mechatrommer]

rather than to prove heroness by enabling 314.159265 GSps that possibly the HW cant even support anyway, even though on screen it says it can, even possibly smoking the ADC/FPGA... its better time spent to practically prove the easy way say to change HW 12 to 8 (not 67 nor 3.142) the idea of one SW reusable for 1000 HW is not new, in fact its even before i started learning C nearly 30 years ago...

[ebastler]

I wouldn't call it "crippled".
I see it more like a Swiss Army knife: It has a lot of tools available but you use them individually. You're not supposed to open all the blades at the same time.

What's the point of an MSO if I cannot fully use the digital and analog channels at the same time?

If I wanted a pure logic analyser, something like the Dreamsource Lab devices would be a much better choice. If I wanted a purely analog scope, the DHO800 will suffice. In fact, buying the combination of those two is probably a better idea than buying a DHO900.

But if you want to observe both, analog+digital signals on the same screen, buying an MSO from a different brand is a better choice than the DHO900. (Or buying the MSO5000 if you can live with noisy analog signals.) I would still call a 200 MHz scope which drops to 150 MSa/s under certain circumstances "crippled", in particular when it does not dial back its anti-aliasing filters accordingly.

[AndyBig]

The DRAM or its interface to the FPGA is a likely suspect.

Yes, I think so too. It’s not for nothing that they installed a cheaper FPGA compared to the 1000/4000 series.

[Fungus]

I wouldn't call it "crippled".
I see it more like a Swiss Army knife: It has a lot of tools available but you use them individually. You're not supposed to open all the blades at the same time.

What's the point of an MSO if I cannot fully use the digital and analog channels at the same time?

You can use them all, just not at full bandwidth.

The scissors on a Swiss Army knife aren't as high bandwidth as a pair of real scissors but I've used the scissors on mine a LOT.

[Mechatrommer]

yeah! especially an MSO that you can get at ~$600 including LA probe up the game? probably 1-2GSps MSO? buy siglent SDS800X! and those AFG and LA module sold separately. (ps: i dont mind mentioning the name here as i sense rigol fanboys dont get easily insulted )

[Randy222]

SDCard is not encrypted.  I've had good luck using "testdisk" on Ubuntu.  People talk about mounting using loopback, which I haven't tried.

FYI:  Here are a couple links from searching for "partition" (just the highlights)
Sept:
https://www.eevblog.com/forum/testgear/rigols-new-dho800-oscilloscope-unbox-teardown/msg5048008/#msg5048008
More:
https://www.eevblog.com/forum/testgear/rigols-new-dho800-oscilloscope-unbox-teardown/msg5046892/#msg5046892
Dec:
https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5240010/?topicseen#msg5240010
My post about SDCard partitions:
https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5356541/?topicseen#msg5356541
Most recent, from 3 days ago:
https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5374955/#msg5374955

My DHO 804 sdcard appears to have only two Android partitions, "android_meta" and "android_expand". I think the "16" number mentioned elsewhere in this hackng thread is the number of mount points, and not partitions.

Well, my sdcard might very well be encrypted.
The GUID number for type (used by android) seems to suggest encryption is used.

If the DHO has no HSM to store keys (or does it?), then the question becomes, are the keys on the sd card, and if so maybe they are in the _meta partition. I can't mount _meta either.

Edit: hexdump -C on the _expand partition does show some ascii stuff up front, seems like boot info about cpu and some settings. I am trying to find the expand_ .key file that's used by vold on Android. Without an HSM to access the vold key has to be on sdcard as non-encrypted. The mystery gets deeper.

[norbert.kiszka]

My DHO 804 sdcard appears to have only two Android partitions, "android_meta" and "android_expand". I think the "16" number mentioned elsewhere in this hackng thread is the number of mount points, and not partitions.

Well, my sdcard might very well be encrypted.
The GUID number for type (used by android) seems to suggest encryption is used.

If the DHO has no HSM to store keys (or does it?), then the question becomes, are the keys on the sd card, and if so maybe they are in the _meta partition. I can't mount _meta either.

Use testdisk or binwalk. This is not encrypted.

Edit: You have file systems (partitions) but without any partition table.

[Randy222]

My DHO 804 sdcard appears to have only two Android partitions, "android_meta" and "android_expand". I think the "16" number mentioned elsewhere in this hackng thread is the number of mount points, and not partitions.

Well, my sdcard might very well be encrypted.
The GUID number for type (used by android) seems to suggest encryption is used.

If the DHO has no HSM to store keys (or does it?), then the question becomes, are the keys on the sd card, and if so maybe they are in the _meta partition. I can't mount _meta either.

Use testdisk or binwalk. This is not encrypted.

Edit: You have file systems (partitions) but without any partition table.

It appears to be GPT, it shows 2 partitions., each named, and each has GUID type number, along with start and end blks to each.

Those GUID type numbers are referenced in Android docs under "adopted" storage. At some point playing around I think I did select "internal" when the sdcard error pops up in android when using keybard to poke around the droid menu stuff. Not sure yet. I'll image my sdcard and then much around with the image.

[norbert.kiszka]

My DHO 804 sdcard appears to have only two Android partitions, "android_meta" and "android_expand". I think the "16" number mentioned elsewhere in this hackng thread is the number of mount points, and not partitions.

Well, my sdcard might very well be encrypted.
The GUID number for type (used by android) seems to suggest encryption is used.

If the DHO has no HSM to store keys (or does it?), then the question becomes, are the keys on the sd card, and if so maybe they are in the _meta partition. I can't mount _meta either.

Use testdisk or binwalk. This is not encrypted.

Edit: You have file systems (partitions) but without any partition table.

It appears to be GPT, it shows 2 partitions., each named, and each has GUID type number, along with start and end blks to each.

tesdisk sees 5 partitions.

[gabiz_ro]

BTW, sorry.  I'm not sure I follow this statement.. Maybe i'm tired from Daylight "Savings" time cutting my sleep. 

I don't know is hard to understand what I want to say?
I'm talking about SPI attached to FPGA content and differences.
Hex comparing two files.

Code: [Select]

Address range DHO804 DHO814S
0x00000000 - 0x00376907 different different
0x00376908 - 0x003FFFFF identical identical blank , FF's only
0x00400000 - 0x00776907 identical identical BOOT.fin file
0x00776908 - 0x007FFFFF identical identical blank , FF's only
0x00800000 - 0x00B76907 identical identical BOOT_SelfTest.bin file
0x00B76908 - 0x00FFFFFF identical identical blank , FF's only


[rpro]

Something I thought may be useful to share....Playing around with the Waveforms software that runs the Digilent Analog Discovery AD2 (which is a nice 14-bit little device with great software), it occurred to me that one could use its "spectrum analyzer" to display and manipulate DHO800 FFT traces, leveraging the software features, like multiple measurements, markers, trace colors, etc., etc. 

To begin, the DHO FFT traces can retrieved, e.g. averaged, and saved into a csv file, using a few lines of python code:

Code: [Select]

import pyvisa as visa 
import numpy as np
import pandas as pd

scopedev = 'TCPIP0::192.168.0.10::5555::SOCKET'  #four 5's
nSamples = 100

scope = visa.ResourceManager().open_resource(scopedev)
scope.read_termination = scope.write_termination = '\n'
print("Scope: ", scope.query("*IDN?"))

scope.write(":WAV:SOURCE MATH1;:WAV:FORM ASCii;:WAV:MODE NORMAL")
fstart = float(scope.query(":MATH1:FFT:FREQuency:START?"))
fend = float(scope.query(":MATH1:FFT:FREQuency:END?"))

X = np.linspace(fstart, fend, 1000, endpoint=True)
fftData =[]
for i in range(0,nSamples):
    fftData += [np.array(scope.query(":WAV:DATA?").split(","),dtype=float)]

npData = np.array(fftData)
avgFFTdata = np.mean(npData,axis=0)
maxFFTdata = np.max(npData,axis=0)
       
saveData = pd.DataFrame(columns=["Frequency (Hz)","Avg (dBV)","PeakHold (dBV)"])
saveData["Frequency (Hz)"]=X
saveData["Avg (dBV)"]=avgFFTdata
saveData["PeakHold (dBV)"]=maxFFTdata
saveData.to_csv("TestSAData.csv",index=False)

The Waveforms software, allows you to save a "workspace" which can be configured to have "Spectrum" and "Script" tabs. (BTW, the software is free and it can run in DEMO mode, in which all this works...). The Waveforms script required to import the saved DHO FFT traces from the saved csv file into the "spectrum analyzer" can also be very short:

Code: [Select]

var data = String(FileRead("/Users/Home/temp/TestSAData.csv")).trim().split('\n')
Spectrum1.Trace1.label = "T1: Avg"
Spectrum1.Trace2.label = "T2: MaxHold"

var data_length = data.length
var trace1_mag = var trace2_mag = []
min_f = data[1].split(',')[0]
max_f = data[data_length-1].split(',')[0]

Spectrum1.Frequency.Start.value = min_f
Spectrum1.Frequency.Stop.value = max_f

for(var i = 1; i < data_length; i++){
   trace1_mag.push(data[i].split(',')[1])
   trace2_mag.push(data[i].split(',')[2])
}

Spectrum1.Trace1.setMagnitude(trace1_mag,min_f,max_f)
Spectrum1.Trace2.setMagnitude(trace2_mag,min_f,max_f)
Spectrum1.run()

The python script to retrieve and save the FFT data from the scope, and bring up the Waveforms software can be executed from a single shell script (or separately). To bring up the Waveforms software with the saved workspace (say "WS"), running the script, one just needs to execute 

[path.....]/Waveforms.exe WS.dwf3work  -runscript

I have a shell script that does this mapped to an alias. My saved workspace has measurements, and a few other things set up (with spectrum and script tabs open). So after setting up the FFT on the DHO, on my laptop I just execute the script (mapped to an alias like "fft"), and I get a display looking like the screenshot attached below, where I can further add more markers, measurements, etc...When I change the FFT trace on the scope, I can always re-run the python script to save new traces, and run the Waveforms script on the workspace (with one click) to update the displayed traces (all of this can be done in a running loop, but not really needed...)

[ebastler]

yeah! especially an MSO that you can get at ~$600 including LA probe up the game? probably 1-2GSps MSO? buy siglent SDS800X! and those AFG and LA module sold separately. (ps: i dont mind mentioning the name here as i sense rigol fanboys dont get easily insulted )

I don't want to divert this into a Siglent vs. Rigol argument, but would like to correct the implication that the Rigol solution comes at an unbeatable price. For those who are happy to "hack" their scopes by generating license keys, but don't want to physically hack the hardware, the Siglent prices are actually more favorable. European prices without VAT:

Siglent SDS804 + SLA1016: 700€
Rigol DHO914 + PLA2216: 900€

Surcharge for function generator if you want Bode plotting:
Siglent SAG1021I: 139€ -- or 0€ if you already have an external Siglent generator
Rigol DHO9xx-S version: 100€

In MSO mode the Siglent will give you 2 GSa/s instead of 0.625 for the analog channels, and 1 GSa/s instead of 0.625 for digital. The latter being quite nice since your digital data will be sampled in 1 ns steps instead of somewhat awkward 1.6 ns. (Let's not get into software aspects like FFT, Bode wiggles etc.)

[FileFixer]

After all that 2037 post what i read, I have one simple question....
Is all of that hack what work on DHO804 (BW 100MHz, 50 Mpts memory depth), work also on DHO802?

If i understand only difference between DHO804 and DHO802 is frontend channel number?!

[Antonio90]

OTOH, the 900 is a true MSO, the SDS800 only gets decimated display data from the acquisition hardware on the logic probe.
But yeah, the halved sample rate with LA on is a problem.

[AceyTech]

My DHO 804 sdcard appears to have only two Android partitions, "android_meta" and "android_expand". I think the "16" number mentioned elsewhere in this hackng thread is the number of mount points, and not partitions.

Well, my sdcard might very well be encrypted.
The GUID number for type (used by android) seems to suggest encryption is used.

If the DHO has no HSM to store keys (or does it?), then the question becomes, are the keys on the sd card, and if so maybe they are in the _meta partition. I can't mount _meta either.

Edit: hexdump -C on the _expand partition does show some ascii stuff up front, seems like boot info about cpu and some settings. I am trying to find the expand_ .key file that's used by vold on Android. Without an HSM to access the vold key has to be on sdcard as non-encrypted. The mystery gets deeper.

I used testdisk on Linux on a DD imaged backup of my original Nov/2023 SDCard, and it found several partitions, EXT4 and Unallocated(like other's have) --and most importantly-- I noticed they were all Deleted.  Note: this was only using the quick scan.  Deep scan revealed 100's
I undeleted the main partition, and I was able to do a lot more with the card.  In my case, it's a 64G card that I'm currently thrashing on, and I was able to resize the 29.5 gigs to full size of the card using "disks" GUI tool in Ubuntu.

Also, It appears that Rigol had an image that was slightly too large for the target cards, thus making it difficult to image. i.e., DD complains about 1 byte not getting copied when it finishes quits.  Other users have reported similar findings all the way back when the first scopes were shipped.

I think it might be interesting to make a new card with partitions then imagecopy the useful partitions over.  I don't really know how, but I'll probably try some day.

[Randy222]

My DHO 804 sdcard appears to have only two Android partitions, "android_meta" and "android_expand". I think the "16" number mentioned elsewhere in this hackng thread is the number of mount points, and not partitions.

Well, my sdcard might very well be encrypted.
The GUID number for type (used by android) seems to suggest encryption is used.

If the DHO has no HSM to store keys (or does it?), then the question becomes, are the keys on the sd card, and if so maybe they are in the _meta partition. I can't mount _meta either.

Use testdisk or binwalk. This is not encrypted.

Edit: You have file systems (partitions) but without any partition table.

It appears to be GPT, it shows 2 partitions., each named, and each has GUID type number, along with start and end blks to each.

tesdisk sees 5 partitions.

/system and /data are mount points with a filesystem, they are not partitions.
SSH in to a dho and run mount command.

[norbert.kiszka]

/system and /data are mount points with a filesystem, they are not partitions.
SSH in to a dho and run mount command.

Yes, but most people dont know what is file system, but they often know what is partition. Thats why I wrote that way.

[shapirus]

My DHO 804 sdcard appears to have only two Android partitions, "android_meta" and "android_expand". I think the "16" number mentioned elsewhere in this hackng thread is the number of mount points, and not partitions.

This is interesting. Are you certain that it's indeed the original image and it was never modified? Did you by any chance do anything with that menu in the scope's OS itself, where it says that the storage is damaged in the pull-down menu (that we use to connect to wifi)? I wonder if it would propose to recover the partitions or something like that -- I never cared to open it.

Here's mine. I copied it using dd after one or two boots of the scope, put it aside and operated only on its copies. Using the same sgdisk command:

Code: [Select]

$ sudo sgdisk --print sd-card-image
Creating new GPT entries in memory.
Disk sd-card-image: 61952000 sectors, 29.5 GiB
Sector size (logical): 512 bytes
Disk identifier (GUID): 802A23EF-3BC6-40CF-87EF-68F6FC651712
Partition table holds up to 128 entries
Main partition table begins at sector 2 and ends at sector 33
First usable sector is 34, last usable sector is 61951966
Partitions will be aligned on 2048-sector boundaries
Total free space is 61951933 sectors (29.5 GiB)

Number  Start (sector)    End (sector)  Size       Code  Name

It doesn't see anything. There is no partition table whatsoever.

Testdisk detects the partitions only after executing the "Analyse/Quick search" command:

Code: [Select]

Disk sd-card-image - 31 GB / 29 GiB - CHS 3857 255 63
     Partition               Start        End    Size in sectors
>* Linux                   34  42  9    50 123  9     262144
 P Linux                   50 123 10   311 144 25    4194304 [system]
 P Linux                  311 144 26   313 154 33      32768
 L Linux                  392  34 27  3856  85  5   55652352

Once it detects these partitions (I have no idea how it's doing it, but judging by the speed with which it does it I don't think it's doing a full scan for FS signatures), it can save the partition table referencing them to the image, and then they can be mounted with standard tools like losetup. Otherwise, it's still possible to mount them, but you need to pass the start offset and size parameters to mount.

[norbert.kiszka]

Code: [Select]

Disk sd-card-image - 31 GB / 29 GiB - CHS 3857 255 63
     Partition               Start        End    Size in sectors
>* Linux                   34  42  9    50 123  9     262144
 P Linux                   50 123 10   311 144 25    4194304 [system]
 P Linux                  311 144 26   313 154 33      32768
 L Linux                  392  34 27  3856  85  5   55652352


If You select msdos partition table before quick search, then testdisk will assume 4 root partitions at max. Try to select GPT.

If You want to find much more things, then use binwalk.

[AceyTech]

After all that 2037 post what i read, I have one simple question....
Is all of that hack what work on DHO804 (BW 100MHz, 50 Mpts memory depth), work also on DHO802?

If i understand only difference between DHO804 and DHO802 is frontend channel number?!

Welcome!  Yes, follow the guide by @AndyBig found here.  Have fun!

[ebastler]

Is all of that hack what work on DHO804 (BW 100MHz, 50 Mpts memory depth), work also on DHO802?

Welcome!  Yes, follow the guide by @AndyBig found here.  Have fun!

Umm... but what would be the target model to upgrade to? There is no DHO912 or 922, right?

[AceyTech]

Is all of that hack what work on DHO804 (BW 100MHz, 50 Mpts memory depth), work also on DHO802?

Welcome!  Yes, follow the guide by @AndyBig found here.  Have fun!

Umm... but what would be the target model to upgrade to? There is no DHO912 or 922, right?

Sorry, Yes.  @FileFixer you'll want to upgrade by applying the licenses, not by doing the Vendor (I.e., model number) upgrade.

FYI:  there are 3 methods in that guide., and you don't have to make it a 900 series to get the upgrades.

[ebastler]

FYI:  there are 3 methods in that guide., and you don't have to make it a 900 series to get the upgrades.

Ah, right. I had not recalled that AndiBig's instructions covered all approaches. So approach 2 or 3 will work, but will only provide the bandwidth increase, not the additional decoders and increased memory.

[shapirus]

If You select msdos partition table before quick search, then testdisk will assume 4 root partitions at max. Try to select GPT.

If You want to find much more things, then use binwalk.

Yes correct, the partition layout, even if there is no partition table as such, appears to be GPT:

Code: [Select]

Disk sd-card-image - 31 GB / 29 GiB - CHS 3857 255 63
     Partition               Start        End    Size in sectors
>P Linux filesys. data       548864     811007     262144
 P Linux filesys. data       811008    5005311    4194304 [system]
 P Linux filesys. data      5005312    5038079      32768
 P Linux filesys. data      5047360    6071359    1024000 [rigol]
 P Linux filesys. data      6299648   61951999   55652352