Hacking the Rigol MSO5000 series oscilloscopes

[mwb1100]

I specifically looked for how to make 500 MHz. I found many references to this. But there I did not find a working recipe that can be repeated

I'm guessing that references to a hacked MSO5074 being a "500MHz scope" are from measured performance.  There are several youtubes that show people measuring the bandwidth performance (where a 3dB drop is detected) before the hack and after.  Those vids often show that after the hack the scope gets to a 3bD drop at around 500MHz - at least when you're only using one channel (the 3dB drop is before 500MHz if you're using more than one channel).

I imagine you will find similar results for many 350MHz scopes - the vendor guarantees 350Mhz, but the scope can actually be pushed further in many cases.

[Fungus]

I'm guessing that references to a hacked MSO5074 being a "500MHz scope" are from measured performance.

It's definitely not an official option.

I imagine you will find similar results for many 350MHz scopes - the vendor guarantees 350Mhz, but the scope can actually be pushed further in many cases.

Yes. Many 'scopes seem to manage 30-40% extra in practice.

(350*1.4) = 490 ... near enough "500Mhz"

[tv84]

I have read this thread from the very beginning. And then again I specifically looked for how to make 500 MHz. I found many references to this. But there I did not find a working recipe that can be repeated

The "baked cake" is here. The recipe was never published.

You have no need to change the model because, AFAIR, with the MSO5354 model gives you the BW up to the scope's limit.

[Esamon]

After applying the liberator to my 5072 everything is forever. Has anyone tried using UltraSigma/UltraScope after doing this? and does your HDMI out work?
Thanks to everyone involved in this endeavor for all your hard work and time. I'm sure I speak for everyone that took advantage of your work. YOU ARE ALL GREATLY APPRECIATED!

Mick B has already asked it and i could not finde an answer eithe.

Does someone know whether it is safe to use Ultra Sigma and UltraScope after the "Update"

[Exeu]

Hello!

so i ended up patching my rigol with the newest FW out there. So far it works. But i can not access the WebControl anymore.. It is asking me always for a PW which i dont have.
I tried using "admin:rigol" but without success..

Do you know anything about it? Most likely it is also here in the thread but i can not find it...

[bmx]

The recipe is trivial when you know how to manipulate the ingredients. We also discuss a bit about it at the start of the thread. The gitlab repository also have the recipe. And the recipe can be rediscovered when you know how to unpack the think from scratch. But yes, it's hard to explain in simple words how to do it, when it's already hard for many  to put the baked cake on a key.

[amri_amin]

Hi,

I have successfully patched my MSO5074 but it is impossible to do a self calibration. the process stop at 6% with a message "Status : Error: Data line".
Do you have an idea what is causing this?
All channels are disconnected of course and the oscilloscope was on for more than 30 minutes as recommended.
Thanks.

Update:
by fast pressing buttons MENU MENU FORCE MENU UTILITY->System->SelfCal  , hidden menus appear where you can choose the items you want to calibrate and you have a more verbose mode (screenshot below)

[mabl]

Looks linke you found the official way to the "project mode"! https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg2671677/#msg2671677

How did you manage this?

[amri_amin]

found here:
https://www.eevblog.com/forum/testgear/rigol-ds1000z-series-buglist-continued-(from-fw-00-04-04-03-02)/msg1190818/#msg1190818

[tv84]

found here:
https://www.eevblog.com/forum/testgear/rigol-ds1000z-series-buglist-continued-(from-fw-00-04-04-03-02)/msg1190818/#msg1190818

    

[Kahooli]

I think this is displayed at the bottom of the network config pages. root / rigol default.

Also, I just 'patched' my new scope up to max options, which for the current promotion added mem depth and bandwidth unlock.
Thanks again to all that made this possible. I hope I will be able to return the favor with some FOSHW I've been working on to share.

[Greid]

With soany pages and so much information here was there ever a step by step post or document made of how to do the hack? If so can someone direct me to where it is? I've read about the first 10 pages and see lots of pieces or information but get confused because it's all broken up across multiple posts.

[ve2mrx]

Just read the last few pages, the post was linked recently.

Martin

[Alekkomi]

With soany pages and so much information here was there ever a step by step post or document made of how to do the hack? If so can someone direct me to where it is? I've read about the first 10 pages and see lots of pieces or information but get confused because it's all broken up across multiple posts.

I did it this way.

Get the Firmware
Download FW 00.01.03.00.01 from message 1808
Put DS5000Update.GEL on a USB stick.
Make sure it is the only file.

Load the Firmware
Upgrade via "Secret Menu"
(Other options failed)

Power On
Wait for lights out (Before “Rigol” and progress bar)
Press [Single]

Two options are displayed
Upgrade or Restore

Select Upgrade.

Scope should now show FW 00.01.03.00.01

Get the Patch
Download zip file from message 1663
put 01_03_00_01.bspatch
and patch.txt on a usb stick

Get DS5000Update.GEL from message 1667
Put this with the two other files

Only 3 files should be on the USB stick.

Load the Patch
Select:
Utility>System>Help>Local Upgrade>Ok

Scope should show all options:
Utility>System>Help>Option list

Self Calibration
Utility>System>Self Cal>Start

If you are checking calibration
Make sure probes are decent and are set to x1

[Martin72]

Self Calibration
Utility>System>Self Cal>Start

If you are checking calibration
Make sure probes are decent and are set to x1

Probes must be disconnected when performing self-cal...

[py-bb]

Let's not be paranoid. The only thing that could stop (meaning: make it sufficiently difficult) an attack is activating secure boot. All other things are within reach.

@lukier, SHA1 is an hash algorithm, not a digital signing algo! The fact that the NAND blocks are hashed doesn't mean much.

I don't think we have reached the secure boot point but, if we did, this is an electronics community forum so, something like this:
How to Break Secure Boot on FPGA SoCs through Malicious Hardware would be possible with the right guys...

SHA1 is broken anyway so that helps right?

[qali.pro]

Hello everybody,
Here is new modified post with detailed instructions to patch mso5000 and most asked questions for new users.

https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg3866693/#msg3866693
Have Fun 

[BRZ.tech]

Hello everybody,
Here is new modified post with detailed instructions to patch mso5000 and most asked questions for new users.

https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg3866693/#msg3866693
Have Fun 

Hello qali.pro and other readers.
Qali.pro, the MSO5000 has in its two AWG the maximum frequency in sine wave of 25MHz. And in square wave of 15MHz.
The question is to extend the maximum frequency of the two AWGs.
The suggestion is a minimum of 60MHz in sine mode.
For square wave, whatever is possible.


Also the frequency meter has a maximum resolution of 6 digits. It will be very good to extend the resolution to 8 digits or more.

These  will be very good if it is put in the next update.
All good.

[ve2mrx]

@BRZ.tech,

If I understand your post correctly, you should ask Rigol, not us. The patch only exposes the work of Rigol. We don't modify the operation of the scope beyond activating what is already present.

Martin

[JeremyC]

+1.

Temperatures have increased since the fan noise was reduced(by lowering the rpm).
Asked the support and they answered this is OK and tested before.

Martin72, you owned the SDS2104X Plus. Was this scope running so hot as the MSO5074?
68.8C/155.8F it’s little bit scary.

Howardlong have had problem with his, I’m wondering if the high temperature contributed to that(?)
https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg3704050/#msg3704050

[JeremyC]

Have a nice day to everyone! I recently bought myself such an oscilloscope and hacked it as you have described everything. Everything went well. The only thing that bothers me is the heating of the oscilloscope. Is this normal? Below I attach the pictures taken with a thermal imager. Sorry for my English.

It's hot.
Could you repeat your test when running FFT for ~30 minutes?

[Alekkomi]

Have a nice day to everyone! I recently bought myself such an oscilloscope and hacked it as you have described everything. Everything went well. The only thing that bothers me is the heating of the oscilloscope. Is this normal? Below I attach the pictures taken with a thermal imager. Sorry for my English.

It's hot.
Could you repeat your test when running FFT for ~30 minutes?

I upgraded the cooling system, as they wrote in another forum thread. I turned the fan to blow out the air. I made a box, a casing over the radiators under the fan, because they are the most heated. I put an additional fan in the next grate, which blows air inside from the outside.  I don't understand why the engineers who made this oscilloscope made it so that the hot air had to pass through the entire body and come out by itself, and the whole board was greatly affected by this. After upgrading, my oscilloscope is practically not heated, the external connectors have become slightly warm. This upgrade has made a huge difference to the cooling system. I am very happy about it.

[JetForMe]

I'm trying to follow the steps to upgrade my newly-arrived MSO5074, but it keeps eating my USB drives. That is, I put a new, never-used USB thumb drive in my Mac. Copy the DS5000Update.GEL file to it, stick that in the front USB port on the Rigol. The default menu has a "local update" option, so I choose that. It says "No package found."

I pull the drive out (I see no "eject" option anywhere), stick it back in the Mac…and it doesn't mount as a drive. It also doesn't show up as a disk device in /dev or Disk Utility.app.

I figured something died with that thumb drive, so I try another new one…same issue. The Rigol is severely altering my USB thumb drives (although they still enumerate on the Mac, as "IOUSBHubDevice").

Any suggestions? Thanks!

[thm_w]

I'm trying to follow the steps to upgrade my newly-arrived MSO5074, but it keeps eating my USB drives. That is, I put a new, never-used USB thumb drive in my Mac. Copy the DS5000Update.GEL file to it, stick that in the front USB port on the Rigol. The default menu has a "local update" option, so I choose that. It says "No package found."

I pull the drive out (I see no "eject" option anywhere), stick it back in the Mac…and it doesn't mount as a drive. It also doesn't show up as a disk device in /dev or Disk Utility.app.

I figured something died with that thumb drive, so I try another new one…same issue. The Rigol is severely altering my USB thumb drives (although they still enumerate on the Mac, as "IOUSBHubDevice").

Any suggestions? Thanks!

Did you format the USB key as FAT32?

[JetForMe]

I'm trying to follow the steps to upgrade my newly-arrived MSO5074, but it keeps eating my USB drives. That is, I put a new, never-used USB thumb drive in my Mac. Copy the DS5000Update.GEL file to it, stick that in the front USB port on the Rigol. The default menu has a "local update" option, so I choose that. It says "No package found."

I pull the drive out (I see no "eject" option anywhere), stick it back in the Mac…and it doesn't mount as a drive. It also doesn't show up as a disk device in /dev or Disk Utility.app.

I figured something died with that thumb drive, so I try another new one…same issue. The Rigol is severely altering my USB thumb drives (although they still enumerate on the Mac, as "IOUSBHubDevice").

Any suggestions? Thanks!

Did you format the USB key as FAT32?

Yes, finally, on a hunch, I tried that, and all is well, with the third USB drive (and thanks for the suggestion, which I didn't see until I came back to update my post). The other two appear to be toast; I don't know how to get them recognized by macOS or Windows in Parallels (they do show up as Disk drives, but no volumes mount) in order to reformat them.