Hacking the Rigol MSO5000 series oscilloscopes

[DrMefistO]

Thanks. I'll check another way to do that via SCPI protocol.

[DrMefistO]

I'm doing so, but using fram tool.

Definitely not so elegant or failure proof.

I cannot find how to write to FRAM via SCPI. Could you help?

[tv84]

I cannot find how to write to FRAM via SCPI. Could you help?

Sure you can. Compared to what you already did, this one should be a piece of cake since you are delimited to the SCPI commands space.

[mwb1100]

I was able to reverse-engineer and understand how the license keys check works.

Awesome!

I'm glad to present this Fully automatic license activator.

Thanks very much!

These are probably dumb questions, but just to be sure I understand: this means that the MSO5000 will be hacked to 350MHz (and all other available options) without having to installed hacked firmware?  In other words a completely different approach to hacking the MSO5000 - more akin to the DS1054Z key hack?  So the 'hacked' options will remain in place even after a unhacked firmware update?

[DrMefistO]

Exactly. No usb flash required, not a single executable modified, so it's a persistant options installator. (Sure, restoring to defaults via SINGLE button will clear a new key and options installed)

[Tabovl]

So, this is it! I was able to reverse-engineer and understand how the license keys check works. And I'm glad to present this Fully automatic license activator.
Use it carefully. Trying to switch off your device during activation may brick it.

Usage:
python rigol_kg.py 192.168.1.1

Is it just my problem or is anyone else unable to download this script? It gives me a 404 error.

[PA0PBZ]

Is it just my problem or is anyone else unable to download this script? It gives me a 404 error.

https://www.eevblog.com/forum/chat/website-error-reports/msg5274616/#msg5274616

[Erronous99]

Hoban new and I am looking to buy the Rigol, I was wondering if this code still works? I am looking into buy a Rigol 5074, and upgrade it to 5354. does it also have the software for debugging RS232, SPI, and other protocols switched free?

Are there more hidden functions?

[thm_w]

Hoban new and I am looking to buy the Rigol, I was wondering if this code still works? I am looking into buy a Rigol 5074, and upgrade it to 5354. does it also have the software for debugging RS232, SPI, and other protocols switched free?

Are there more hidden functions?

Yes. You can look at the options list for what is available. Jitter, power, etc.

[nemitom]

So, this is it! I was able to reverse-engineer and understand how the license keys check works. And I'm glad to present this Fully automatic license activator.
Use it carefully. Trying to switch off your device during activation may brick it.

Usage:
python rigol_kg.py 192.168.1.1

Hello, how to use/run?
or not work for me?
Thanks

[edward-p]

So, this is it! I was able to reverse-engineer and understand how the license keys check works. And I'm glad to present this Fully automatic license activator.
Use it carefully. Trying to switch off your device during activation may brick it.

Usage:
python rigol_kg.py 192.168.1.1

Hello, how to use/run?
or not work for me?
Thanks

I got the same result with my MSO5072 (fw version: 01.03.03).

[RobbiTobi]

Hi guys,

could anybody help me out on finding an encoder replacement part for my MSO5000?
I have a defective dented encoder which is annoying me so much 

Many thanks!

[DrMefistO]

I'll check it on 5072 later, and will update the script if required.

[nemitom]

unlocking the old way works for me... (using a flash drive)

[skander36]

I'll check it on 5072 later, and will update the script if required.

Also for 5074 does not work. It does not activate BW and Deep memory. Tried with the scope unlocked and also with original fw (locked). Also after procedure the scope sometimes does not boot, need to recover with  "Single" key method.

[tv84]

I guess the keygen way of inserting the info into the FRAM is bad. I have suggested doing it with official SCPI way.

@DrMefistO probably is looking into it...

[skander36]

I guess the keygen way of inserting the info into the FRAM is bad. I have suggested doing it with official SCPI way.

@DrMefistO probably is looking into it...

@DrMefistO Can you make the script to output the keys as text?
Thanks!

[BRZ.tech]

Anybody have any issues with their "Scale" encoder jumping/glitching around?

I have one of the earlier 5074s... Just started getting very "touchy" lately when scaling-up or down... Just wondering if the newer firmware did a better job of de-bouncing the encoder output?

BB

Hi
Bit Bug.
I have the same problem on my MSO5074, the Horizontal Scale (Time Adjustment) keeps jumping non-linearly when turning the control, left and right.
Here is a set of photos of the internal part of the MSO5000 taken by Dave:
https://www.flickr.com/photos/eevblog/45756741562/in/photostream/

I think the name for this component is Rotary Encoder, it seems that there are 12 identical parts in the MSO5000, all are SMD type, and with the same type of finish. I think that of all of them, H-SCALE is the most used, maybe that's the reason it's failing, and it could get worse.
Dave made a video and disassembled a Rotary Encoder:


On Aliexpress I found a similar Rotary Encoder, from ALPS model EC11J1524413, but the finish is not exactly the same as the one used in the MSO5000, I don't know how many positions it uses in the MSO5000, and also the Axis Length.
If the Original Part has a Manufacturing Code printed on it, it will be easier to find it, or a similar one.
See the detail in the corners of the ALPS piece:
https://pt.aliexpress.com/item/32867473208.html?spm=a2g0o.productlist.main.7.3f5d2322YoHetL&algo_pvid=d610dbe4-ecf6-4a49-a39c-f9368b1980d8&algo_exp_id=d610dbe4-ecf6-4a49-a39c-f9368b1980d8-3&pdp_npi=4%40dis%21BRL%2121.17%2121.17%21%21%214.10%214.10%21%402101fb0d17063969934018481e45e0%2165479190088%21sea%21BR%210%21AB&curPageLogUid=mRyoZjHUQIVJ&utparam-url=scene%3Asearch%7Cquery_from%3A

There's this one too:
https://pt.aliexpress.com/item/1005001701253298.html?spm=a2g0o.productlist.main.23.3f5d2322YoHetL&algo_pvid=d610dbe4-ecf6-4a49-a39c-f9368b1980d8&algo_exp_id=d610dbe4-ecf6-4a49-a39c-f9368b1980d8-11&pdp_npi=4%40dis%21BRL%2122.20%2118.22%21%21%214.30%213.53%21%402101fb0d17063969934018481e45e0%2112000017211540311%21sea%21BR%210%21AB&curPageLogUid=UQRmvg11R9cI&utparam-url=scene%3Asearch%7Cquery_from%3A

I don't know which of these will fit the MSO5000, and it will require very rigorous work to replace the defective part, so as not to damage the solder islands and tracks.
As long as you do not replace the defective part, you can change the H-SCALE using the TOUCH SCREEN on the screen, in the upper left corner.

This here is a specific topic for MSO5000 Hack, so that we can analyze the solution to the defect in more depth, and how it was you who gave the idea to the subject,

  I suggest that you open a NEW specific TOPIC for discussion:
RIGOL MSO5000 ROTARY Encoder H-SCALE Replace

[beatman]

Hi guys,

could anybody help me out on finding an encoder replacement part for my MSO5000?
I have a defective dented encoder which is annoying me so much 

Many thanks!    I have replaced the encoders on dz1054 and mso5104 with through hole pots  from BI part numb.EN12HS1L. I just cut carefully the legs and solder on the pads.Both scops working as it should"t last two years.

[BRZ.tech]

Hi
Beatman
With this Rotary Encoder EN12HS1L code I did not find the datasheet.

I think that in this type of Rotary Encoder component, the External and Internal Parameters must be STANDARDIZED, and a cross-reference of brands and models will help everyone. Perhaps you can change the Height of the Axis, and its Format, but the Pitch and Functions are the same. This is better than nothing.

I think it's productive, if any of the participants have a DSO from Tektronix or Keysight or Teledyne-Lecroy or Rohde-Schuarz, which have a LIST OF PARTS, and Spare Parts, check the Original Rotary Encoder Code, and inform the link here in this Topic of the datasheet. And check if it is similar, and if it is easy to buy.

The defect in the Rotary Encoder on the MSO5000 may occur in any of the 12 positions on the MSO5000. It's a matter of time when symptoms appear...

I don't know if RIGOL can indicate to Brands the Rotary Encoder models that can be used, and also sell them at a low price to users.

If someone has the symptoms on the MSO5000 during the Warranty Period, they can uninstall the HACK and send it for Free Repair, if the warranty seal has not been broken. It means spending some time without your MSO5000.

[w.v.s.]

With this Rotary Encoder EN12HS1L code I did not find the datasheet.

https://www.ttelectronics.com/TTElectronics/media/ProductFiles/Datasheet/EN12.pdf

[BRZ.tech]

With this Rotary Encoder EN12HS1L code I did not find the datasheet.

https://www.ttelectronics.com/TTElectronics/media/ProductFiles/Datasheet/EN12.pdf

Hi
w.v.s.
Tks for the contribution.
This EN12 model you sent is for PTH mounting.
I checked the TT Electronics website, and they do not manufacture Rotary Encoder for SMD Mounting. Check here:
https://www.ttelectronics.com/site-search?k=rotary%20encode

The manufacturer ALPS has the EC11 line for SMD mounting:
https://tech.alpsalpine.com/e/products/category/encorder/sub/01/series/ec11n/

I think the MSO5000's Rotary Encoder is very sensitive, maybe it has 30 detents or more.
I think ALPS model EC11N152504 can work well, it has the Pressure Switch and Push-on Switch Travel of 1.5mm, and NO THREAD, and it is for SMD mounting. You have to check if the welding feet Islands Pitch and Axis Height are the same on the MSO5000:
https://tech.alpsalpine.com/e/products/detail/EC11N1525404/

When searching on Google, I didn't find the ALPS EC11N152504 to buy.

ALPS does not manufacture the EC12 model for SMD Mounting.

Maybe the @Bit bug didn't throw the defective part in the trash, and can inform the measurements of the MSO5000's ORIGINAL Rotary Encoder:
Shaft Length, Width and Height.

On Aliexpress, I found another Rotary Encoder for SMD Mounting, and WITHOUT THREAD, more similar to the Original MSO5000: but it doesn't have a datasheet, maybe you can use it on the MSO5000, you need to adjust the Shaft Height:
“5Pcs Rotary Encoder Code Switch EC11 30 Position Push Button Switch SMD 5Pin Handle Length 12.5mm 17mm Middle Shaft”
https://pt.aliexpress.com/item/1005001713654182.html?spm=a2g0o.productlist.main.31.36d084e9mL4an8&algo_pvid=e07b3c9e-8d7a-46d1-bd01-ff8afd5e8cb0&algo_exp_id=e07b3c9e-8d7a-46d1-bd01-ff8afd5e8cb0-15&pdp_npi=4%40dis%21BRL%2122.20%2118.22%21%21%214.30%213.53%21%402101c59117064475434413434e5d2e%2112000017260108848%21sea%21BR%210%21AB&curPageLogUid=oIiA39ZHpEZB&utparam-url=scene%3Asearch%7Cquery_from%3A

[RobbiTobi]

Hi guys,

could anybody help me out on finding an encoder replacement part for my MSO5000?
I have a defective dented encoder which is annoying me so much 

Many thanks!    I have replaced the encoders on dz1054 and mso5104 with through hole pots  from BI part numb.EN12HS1L. I just cut carefully the legs and solder on the pads.Both scops working as it should"t last two years.

Hi beatman,

the encoder on my MSO5000 has 30 detents, but what about the pulses/rev?
Is it a 15 or 30 pulses/rev?
The replacement part you used is about how many detents and pulses?

Many thanks

[beatman]

With this Rotary Encoder EN12HS1L code I did not find the datasheet.

https://www.ttelectronics.com/TTElectronics/media/ProductFiles/Datasheet/EN12.pdf

It is 24 klicks pots and works perfect in booth scops 5104 and 1054 on my DHO804 don't need to replace nothing.I try to upload photo from the encoder.

[beatman]