Hacking the Rigol MSO5000 series oscilloscopes

[perseverance8]

I updated to FW V00.01.03.03.00 then successfully unlocked my MSO5074.

[stevec5000]

You guys can argue about it with Rigol if you want but the latest version they have is 00.01.03.02.02!
https://www.rigolna.com/firmware/

[stevec5000]

I updated to FW V00.01.03.03.00 then successfully unlocked my MSO5074.

How could you when that version is not out?
This is starting to look like Youtube and Amazon where most of the reviews and videos are fakes!+

[supertrabuco]

The FW 00.03.03.00 already works and the Hack also
Also works great on my MSO5104
Greetings

[PeterG]

For those who missed the above post by thm_w. Here is a direct link to the latest firmware.

https://supportcn.rigol.com/Public/Uploads/uploadfile/files/ftp/Firmware/DS5000(ARM)Update%20v00.01.03.03.00.zip

regards

[3PinFanHeader]

Wrong, 00.01.03.02.02 is the latest on the Rigol site that I just downloaded and installed.  If there is another version such as 01.03.03.00 it doesn't seem to be available.

Considering the number of posts before you showing that it does indeed exists, a different level of courtesy would probably be appropriate.

The fact that you are unable to find it doesn't mean it doesn't exist - it only means you are unable to find it.

Source: https://www.rigol.eu

[Codebotjoe]

Apologies if this has been repeated too many times. I'm wondering if anyone is still selling the labels to go over the original mso5xxx sticker. I live in Canada and would make it worth their while. I'd pay shipping plus 25 usd. Or a link to a printable label if they are not being sold like I read a while back. Thanks in advance.

[3PinFanHeader]

Apologies if this has been repeated too many times. I'm wondering if anyone is still selling the labels to go over the original mso5xxx sticker. I live in Canada and would make it worth their while. I'd pay shipping plus 25 usd. Or a link to a printable label if they are not being sold like I read a while back. Thanks in advance.

This ought to help

https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg4735574/#msg4735574

[mwb1100]

You guys can argue about it with Rigol if you want but the latest version they have is 00.01.03.02.02!
https://www.rigolna.com/firmware/

That is currently the latest from the rigolna.com site.  However, the supportcn.rigol.com site has the latest (as of June 2023) 00.01.03.03.00 firmware.

Rigol's firmware download management is a mess.  For example, the Rigol NA download page (https://www.rigolna.com/firmware/) shows the most recent firmware as 1.03.02.02 but when you download it the name of the file you get is MSO5_FW_V1_1_4_4.zip.  However, the contents of the file currently do contain v00.01.03.02.02.  And the version numbers sometimes are given a  leading "00" and are sometimes use single digits sometimes double digits.  Sometimes the device is called "MSO5000" and sometimes "DS5000".  Sometimes a .txt file in the download archive might be in some encrypted (or otherwise undecipherable) like E-SafeNet or "%TSD-Header-###%".

So confusion is the natural state of Rigol's firmware update process.  The release notes in the zip file seem to always accurately describe the version that is inside the archive (if they are readable at all).

The "DS5000(ARM)Update v00.01.03.03.00" archive contains the following files:

DS5000Update.GEL
MSO5000 Release Notes.txt
MSO5000 Upgrade Instructions.txt
MSO5000 升级说明.txt
MSO5000 版本说明.txt

• "MSO5000 Release Notes.txt" file is an unreadable "%TSD-Header-###%" file (Google and the Linux 'file' utility are not helpful in figuring out what a TSD Header file is)
• "MSO5000 Upgrade Instructions.txt" is an English translation of the  "MSO5000 升级说明.txt" file.  The translation is encoded as UTF-16LE with a BOM
• "MSO5000 升级说明.txt" is the "MSO5000 Upgrade Instructions.txt" in Chinese encoded with the "936 Simplified Chinese (GBK)" code page
• "MSO5000 版本说明.txt" is the "MSO5000 Release Notes.txt" in Chinese encoded with the "936 Simplified Chinese (GBK)" code page

The attached file ("MSO5000 版本说明.translated.txt") is a Google Translate for the "MSO5000 版本说明.txt" since ""MSO5000 Release Notes.txt" is unreadable garbage.  The translation looks fine.

Finally, if you want to use the patch for v00.01.03.02.02 post #2470 in this thread has a link (note:  I have not downloaded or tried that link, and the person who posted the download link has made exactly one post to EEVBlog):

  - https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg4733246/#msg4733246

[rpro]

Frankly, I can’t understand why Rigol is simply unable, after years of complaints, to straighten out their firmware release process. There are enough support people working at Rigol NA and EU that would know, at a minimum, that to have unreadable release notes and out of wack numbering for their releases is at best a nightmare to support, and at worse makes their company look hopelessly unprofessional.

[hafrse]

Apologies if this has been repeated too many times. I'm wondering if anyone is still selling the labels to go over the original mso5xxx sticker. I live in Canada and would make it worth their while. I'd pay shipping plus 25 usd. Or a link to a printable label if they are not being sold like I read a while back. Thanks in advance.

This ought to help

https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg4735574/#msg4735574

Whay do you needed it?  the original model number is still visible in the information menu... , the options listed shows upgrade to 350 bandwidth + 4 channels  and thanks to all in this forum who made that possible !

[mopra]

Hello. RIGOL MSO5072 cracked. Question: What settings should I make so that the sensitivity in NORMAL and SINGLE modes is the same as in AUTO mode

[3PinFanHeader]

Interestingly, after... liberating... the MSO5072, I tried the Rigol "Ultra" apps (not so ultra, but if someone hands over a free cookie...)

The UltraScope app doesn't see more than 2 channels even though the scope has all 4 channels enabled.

Since I don't have a 5xx4 scope to test, I don't know if the 2-channel limit is a limitation of the software - or a product of the scope being 2-chan originally.

[bmx]

lol, https://tortel.li/post/insecure-scope/

For all of those who still wonder how the hack works, that's a good sum up.
Sidenote, they went a bit too quick on the "download the gel" part, because we all know it doesn't work like that.
Finally, the conclusion confirms how rigol cares.

[oliv3r]

lol, https://tortel.li/post/insecure-scope/

For all of those who still wonder how the hack works, that's a good sum up.
Sidenote, they went a bit too quick on the "download the gel" part, because we all know it doesn't work like that.
Finally, the conclusion confirms how rigol cares.

What do you mean with 'how the hack works'? The guy just dissasembled a cgi-bin script in the end and found a remote exploit (nice to have, but not very interesting imo).

I saw it on hackernews and as I wrote there, I'm a bit dissapointed by the lack of research that was done.

On a more personal note, i'll try to update the gel archives with 2.2 and 3.3 :p

[Mick B]

Using the modified 3.3 updated firmware. I have noticed sometimes it won't go into sleep / screensaver mode, like it used to. Anyone else noticed this?

[perseverance8]

I updated to FW V00.01.03.03.00 then successfully unlocked my MSO5074.

How could you when that version is not out?
This is starting to look like Youtube and Amazon where most of the reviews and videos are fakes!+

LOL! yes I did & was able to download V00.01.03.03.00 as described/posted earlier in this thread & used the intended "hack"/unlock posted on same, after doing so, all options on my MSO5074 show "forever". So far I've only used one of the unlocked option(s), the RS232 signal analysis feature while, so far, able to measure a ~1.2ns rise time on my unlocked MSO5k with a home brew 74AC14 based TDR long described online & in numerous forums, I'll soon use a PECL oscillator to get a faster edge to see what the MSO5k can measure, sure looks like my scope is unlocked while showing FW 00.01.03.03.00, Build 2023-02-22 13:51:46 in Utility>System>About.   

[BlueBill]

Using the modified 3.3 updated firmware. I have noticed sometimes it won't go into sleep mode, like it used to. Anyone else noticed this?

Sleep mode? My MSO5000 stays on as long as it’s turned on.

[beatman]

Sleep mode? My MSO5000 stays on as long as it’s turned on. I think he means  the screen saver mode

[Mick B]

Thanks, I got frequency display in the measurement setting working again by restoring the default settings, I guess it just lost it way for a minute.

[JCS666]

It is possibly a bug ?

At this point fails.

[std]

I confirm success upgrade 2 pieces RIGOL MSO5074.
(arrived with Firmware 00.01.03.02.02  upgraded to 00.01.03.03.00, all options patch)

P.S. The fan is noisy, ordered Xilence XF037 for replacement.

[Tom620]

For a more high quality fan replacement, you can use the Noctua NF-A8 FLX, 80mm fan. It is dead silent and has a six year warranty.

https://noctua.at/en/products/fan/nf-a8-flx

[YZEPT]

I took the previous posts advice on the Noctua NF-A8 FLX and aside from soldering the 2 pin connector from the original fan to the replacement it is a simple upgrade. At full speed it is dramatically quieter but moves sufficient air to keep temperatures similar to the much noisier factory fan. I am really pleased with the almost silent outcome and for $32 AUD it is a worthwhile upgrade. I used the flexible mounts supplied with the Noctua. I’m not sure how much difference solid mounting it with screws would make but the soft mounting, while a little fiddly to get set in the bracket initially works well and the fan fits without interfering with the back cover.

[DigitalAura]

I'm just about to buy one of these scopes, the MSO5074 and would appreciate it very much if it can be confirmed that this scope can still be hacked. This might not be much money for some, but is a hell of a lot for me and I can't afford to buy it and then find out the hack no longer works.

I hope you can understand my predicament and I really don't wish to appear to be a pain in the ass for asking.

Thanks for all your help.