Hacking the Rigol MSO5000 series oscilloscopes

[snik]

I bought an MSO5072 here in Germany three weeks ago and successfully hacked it into an MSO5354 with the latest firmware as described here in a few posts above.

[Mike_Rg]

MSO5074 - Only a few months old that I had updated to 01.03.03.00:

So with great trepidation, I took the plunge and followed the simple instructions of initiating a full backup first..

The Data backup, Fram  dump and Memory dump worked fine, but Nand backup never appeared to complete, after 15 minutes I restarted, removed the Flash drive and found it populated with around 1.4GB of files from the Nand backup, so it appears to work but gives no indication of completing.

Lastly I loaded the 3 patch files, bspatch was 01_03_03_00, process took a few seconds and everything was enabled. 

Finalized with calibrate.

A big thanks to all who made this possible.

[skander36]

There is no more need to backup that files. Just apply the correct patch files and everything is ok.
It is very unlikely to brick this scope. There was a time when the crack was in development and backup has been a recommendation.
In a rare case when scope does not boot, press "Single" key at the very beggining of the boot phase and press "Restore defaults" or "Upgrade firmware" to re-apply the original Fw.

[pcxmac]

Everything was fine here too.

I will use my previous upgrade post, updated for v00.01.03.00.03 -> v00.01.03.03.00.

Steps I've followed :

1. Backup everything just in case (optional but recommended)
https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg2757356/#msg2757356
- get and unzip the first script file, put DS5000Update.GEL on USB stick, then Utility/Help/Local upgrade
- wait until 100%, then turn off/on
- repeat for the second script

2. Install the official firmware v00.01.03.03.00; I have used the above link from rigol.eu
- get the official firmware and unzip
- same steps like above, with the firmware file of course

3. Hack
https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg4821650/#msg4821650
- get and unzip the file 01_03_03_00.zip and put the three files on USB stick
- same steps like above
- there will be some messages on the screen. You will be asked to press a key, two times. At the end the oscilloscope will reboot, just wait.
- all the options will be activated

4. Calibration - very important
- remove the input probes
- Utility/System/SelfCal
- then turn off/on

Thanks everybody !

Thanks alot guys, worked for me great on this day Sep 14th 2023. The meter was built in (this year) April/Calibrated in August. No issues with different firmwares, or the directions, most of the time is spent just being safe. Highly recommend editing the start file to keep ssh open.

[khva89]

Hello.
Could you help me to resolve my problem. I was fail when I try to update firmware in my MSO5000. I got v00.01.03.03.00 from rigol.eu put it to my flashdrive, then I select "Local Upgrade". When updating completed I reboot my MSO5000, and it "not working". The progressbar changing from 0 to 100% and nothing is changed. What I need to do, please help.

[w.v.s.]

What I need to do, please help.

look two posts above:

In a rare case when scope does not boot, press "Single" key at the very beggining of the boot phase and press "Restore defaults" or "Upgrade firmware" to re-apply the original Fw.

Or do you mean the scope is still running, but still with the previous firmware version?

[khva89]

Thank you. I pressed "single" button at the very beginning of the boot and loaded v00.01.03.00.01 firmware, then I tried to load v00.01.03.03.00 once again, but I used old 4GB flash drive. At this time it's succesful. I think, this problem caused by flash drive.

[w.v.s.]

... then I tried to load v00.01.03.03.00 once again, but I used old 4GB flash drive. At this time it's succesful. I think, this problem caused by flash drive.

Yes, the scope can be a bit picky with flash drives.

[saltfishboi]

New MSO5042 user, went for the cheapest option. Just tried the hack today, as of 20230920, the instruction put together by core back from May still works. There are a couple technical difficulties I encountered through the process, i.e., .GEL ran but nothing happen, "Error, no USB mounted..." message. They are all due to USB problem. Once I switched to a newer thumb drive, everything ran as expected. Many thanks to the community.

[SPFXEngineer]

I just purchased this scope, 9/27/2023, from Rigol's website it came with

Firmware: 00.01.03.02.02
Hardware: 01.01.000
Boot: 2018.06.27
Build: 2022-12-05 10:31:33

Completed the ritual, 10/03/2023, successfully and quite easily. I will admit that the price and the difficulty of hacking seemed intimidating at first but the process was extremely simple and satisfying. There is little that can go wrong assuming the scope does not disconnect from power. Some small issues I ran into were setting my IP for the LAN connection using IPv4. The other issue I had was setting my file system to FAT32 on the usb drive; it would default to exFAT due to the size of the drive. I ended up changing the partition size to a smaller value until I got the option. Using the terminal to do an SSH session was also a bit confusing because I did not initially realize you set the username to root and then when typing in the password, Rigol201, it does not show it in the terminal but what you type does get input. I hope this helps and thank you all for making this possible.

[DigitalAura]

Does anybody know if this hack once applied is permanent?

For example a new firmware releases and I update, will the scope still be hacked or will it revert to previous settings?

Only asking as I just updated the firmware yesterday and noted a spelling error in one of the menus, lable instead of label and was thinking it'll need another update at some point.

I was also wondering if the hack can be undone should the scope require repair?

Not applied the hack as yet.

Thanks

[skander36]

Hi!
No, the hack is not permanent. On every fw. update a new hack need to be created and applied. Old one is not valid (read in the thread about bspatch creation).
Spelling errors is something permanent   "Lable" is already notorious.
Yes the hack can be undone by applying official firmware alone.

[thm_w]

I drew out part of the front end for the MSO5000:



The major difference seen between the MSO5000 (350MHz) and MSO7000 (500MHz+) was the populated RLC filter across one of the input resistors. This does extend the bandwidth in simulation, but, I don't know if what I'm simulating is accurate because that is already past 350MHz. So software limit might be employed.
Also seems to have less of an effect on the higher voltage taps. I assume the IC can switch those tap inputs based on what voltage range is selected.

Of course there is the 50 ohm stuff as well, it looks like there might be another 50 ohm path directly into the ASIC. Not much you'd be able to do about that. It looks like it might be grounded on the 5000, need to check.

I don't know what RLC values are used for the MSO7000, the only one I'm sure of is is the inductor Lx is around 2-4nH (it has 4 turns). Any recommendations for values or ideas let me know.

[Earlonics]

Can confirm the Hack still works, as of 09/10/2023. My MSO5104 is now fully upgraded.
Many thanks to those involved in sharing the files and guidance.

[jag]

Hello everyone
Just received my MSO5074 and did exactly what is said here on this forum
My oscilloscope is now an MSO5374, 350 MHz with two function generators and all options have been activated forever. Overjoyed.
I would just like to take the time to thank everyone who provided the information on this site which I have bookmarked in order to study it more deeply and also shared my discoveries which could help others,

Thank you so much

[james_fr]

Hello everyone,

I am about to buy the MSO5104, but I would like to know if there is a difference with the MSO5074...
For sure, I will then make it to 350 MHz!

[skander36]

Hello everyone,

I am about to buy the MSO5104, but I would like to know if there is a difference with the MSO5074...
For sure, I will then make it to 350 MHz!

Hi,
No difference, just buy the 5074 model and apply the patch.
You can also buy the 5072 model but you will get only 2 probes instead of 4.

[mwb1100]

You can also buy the 5072 model but you will get only 2 probes instead of 4.

At the moment the MSO5074 is on promotion for less than the MSO5072.  That might be a US only deal. If so, shipping and duty to other countries would likely wipe out any benefit.

[james_fr]

Thanks for tour answers. In fact, the MSO5104 has the FREE MSO5000-BND included. Is it worth to get it or can I hack to get all the functions?

[mwb1100]

Thanks for tour answers. In fact, the MSO5104 has the FREE MSO5000-BND included. Is it worth to get it or can I hack to get all the functions?

The hack gets you all the MSO5000-BND functions and more (350MHz bandwidth, enabling the AWG, increase memory depth to 200Mpts - can't remember if there are more).

The drawback of the hack is that it has to be reworked by someone for each firmware update - using the official Rigol firmware update will remove the hack.  But the MSO5000 has been out long enough that I think firmware updates will be very infrequent (possibly even no more).

(edit: AWG is included in MSO5000-BND)

[james_fr]

Thanks for your message.
I will get my MSO5104 in a few days
I am trying to get newest hackfiles. can someone help me finding them so I don't fuck up the scope...
Thanks in advance!

[Neekeetos]

Of course there is the 50 ohm stuff as well, it looks like there might be another 50 ohm path directly into the ASIC. Not much you'd be able to do about that. It looks like it might be grounded on the 5000, need to check.

I don't know what RLC values are used for the MSO7000, the only one I'm sure of is is the inductor Lx is around 2-4nH (it has 4 turns). Any recommendations for values or ideas let me know.

Have you considered measuring output circuit of frontend(above ic on your pictures)? It seems that bw limit is not located at input. Just look at fft attached. The noise has roll off with corner freq around 500M. Noise of adc converter is uniform, so this should be frontend amp noise after low pass filter.

[Neekeetos]

Noise of adc converter is uniform, so this should be frontend amp noise after low pass filter.

Made some additional shots. They seem coherent with what I read on different bandwidths of channels. Fastest two in my case is Ch 3 and Ch 4, and Ch 2 is crippled,  Ch 1 is average ~500M.
Good news is that this noise distribution corner frequency is not dependent on gain as far as i can see, thus it should be signal path from frontend to A/D converter.

I also plan to install OCXO instead of reference oscillator in my unit. Does anybody know if additional 0,5 amps at 5V rail at startup will do any harm or not?

Thanks in advance!

[Neekeetos]

Ok, I just found something. There is an LC filter in front of adc with corner frequency of around 500M. I removed it from channel 4 (no caps and inductors replaced with 0 Ohm resistors ) , and rise time dropped from 725ps to 594ps. Not much gain but it could be signal source or coax cable limited.

[thm_w]

Well you are way faster than me, nice work. But I don't know if completely removing it is ideal, as you could get aliasing from the front end amp noise? The MSO7000 also has a filter in this location, though Dave's photos don't show it clearly so I can't tell what component values might be.

From my measurements the CLC was something like 1pF -> 47nH -> 1pF? But I did not remove the components to verify yet. This might be around the 300MHz range.
For MSO7000 I would assume the capacitors are the same and the inductance is decreased to filter at ~700MHz.