Sniffing the Rigol's internal I2C bus

[stuartk]

Yes Alan, the serial stayed as the mangled DS2A0....001

But it's correct on the advanced system info screen. 

Model number is corrupted on both the basic and advanced screens

I haven't done step 10-12 yet. Hope I won't destroy the damned thing.........

[stuartk]

I selected Model 2102. I could retry it from the top with 2202...

[alank2]

Yes Alan, the serial stayed as the mangled DS2A0....001
But it's correct on the advanced system info screen. 
Model number is corrupted on both the basic and advanced screens
I haven't done step 10-12 yet.

Probably smart to do steps 10 and 11 so you are back to a stock firmware.

Hope I won't destroy the damned thing.........

Maybe you should give up on the serial fix and just use it...

[alank2]

I selected Model 2102. I could retry it from the top with 2202...

You could.  You might even try the ds2072 choice, that one did work for me, but I do have a ds2072.  Even if you get it to "stick" with a ds2072, you can upgrade it with a key anyway.  The question here is why doesn't it stick after issuing the uninstall and restarting.

[stuartk]

OK,

I did it all from the top using the DS2202 as a base in the FW patch

The model number remained at DS2022 with the DS2A000...1 S/N 

I update to the latest firmware

I applied the DSGH code (for fun of course!)

And voila it works!!

The Model comes out as DS2302
The S/N remains mangled at DS2A0000000001

I have all the installed options

The minimum time base is now at 1ns.

Most importantly, I no longer have options (most of which I don't need) counting down annoyingly.

The only down side is that my S/N is wrong and I can no longer take a screen shot with Ultra Sigma.

The thing I haven't tried yet is doing the S/N repair set to a DS2072. When I did it as a 2102 and 2202 there were issues.

Thanks Anders and Alan for your help, 

Regards, Stuart

[alank2]

Thanks Anders and Alan for your help, 

If you are happy and it is working for you that is the what is important!

[AndersAnd]

I used this one. It unlocked everything but CAN Decoding. CAN decoding is now missing from my available licenses, and is not an option for decoding.

Any Ideas? :/

What 4 letter code did you use to generate the key?

[ZeroAviation]

I used this one. It unlocked everything but CAN Decoding. CAN decoding is now missing from my available licenses, and is not an option for decoding.

Any Ideas? :/

What 4 letter code did you use to generate the key?

The wrong one lol DSAZ. DSEZ is the correct one I believe.

-Matt

[AndersAnd]

What 4 letter code did you use to generate the key?

The wrong one lol DSAZ. DSEZ is the correct one I believe.

Yes that's exactly the difference between DSAZ and DSEZ. DSEZ has CAN decoding and DSAZ hasn't. Both are 200 MHz.
But please note none of them include the 50 ohm option included in the A-version. So you should probably use DSFZ instead of DSEZ to support the 50 ohm input option. Only difference is that DSFZ includes the 50 ohm option and DSEZ doesn't.

If you want 300 MHz with all options instead of 200 MHz then use DSHH.
The 300 MHz code with all features except the 50 ohm option is DSGH, this would be more correct to use on models that doesn't support 50 ohm input, even though http://riglol.3owl.com only mentions DSHH for all options.

Read about DSEZ and how to build other letter combinations here: https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg356379/?topicseen#msg356379

[eevblogee]

My first post,

I would like to say thank you first of all to amazing forum/folks which let me learn a lot and buy an ds2072a. With the help of you guys i believe Rigol start to sell more devices, just for the records. As a newbie(i got the idea,no pain nogain ) i went through old posts and realized for ds2072a dumps are needed. My device is DS2D1547xxxxx 00.02.00 hw2. 47th week . I will order an olimex's jtag debugger for dump, afai read it is the fastest, unless somebody comments for better i will go with it. I will also post some pictures when i open it, warranty seal video is really usefull btw. But at the same time  i am also interested in getting dumps from lan port if there is a possibility for future. If we ran a gdbserver on blackfin mpu then will it be possible to get enough info for your investigations? I can help for coding if you guys need help.

Cheers
Newbie

[true]

Good news Everyone!  Attached to this post is a utility to repair corrupted S/N's on DS2000 series scopes!  Someone I know took up the challenge to write a utility to repair corrupted serial numbers as their contribution to all the great work done so far.  It's a simple but very clever Windows .exe file that will ask your model/serial # and modify a .gel file located in the same directory as the executable file.  Note: This utility only works with firmware version 00.01.01.00.02.  If you need a copy of this firmware version, see Marmad's post (Reply #2) in this thread: https://www.eevblog.com/forum/testgear/first-impressions-and-review-of-the-rigol-ds2072-ds2000-series-dso/  The locations of the model & S/N change between firmware versions so it will corrupt any other version of firmware so verify that you have firmware version 00.01.01.00.02.  It also requires the ability to send SCPI commands to the scope.

BRILLIANT, saved me some work (not like I haven't been not busy enough to do any) - thanks

Well maybe I was a bit premature. It doesn't work.

Make sure you follow the instructions to the letter.... especially step 7 to anchor the changes to flash...

7.  Connect using scpi and issue :SYSTem:OPTion:UNINSTall command which will
      uninstall all keys and save to flash

All I did at the end was reinstall the latest firmware and then reinstall the options with DSEZ to give me 200MHz and CAN, Triggers, Decoders and Memory upgrade.
I have cycled the scope a number of times now and it all seems good to go.

The first thing I did was follow the instructions to the letter.

The changes never saved.

I followed the procedure exactly to reset my S/N

...

Now apparently I now own a DS2022 scope, whatever that is, with the S/N unchanged on the basic screen

On the detailed screen the S/N is correct however the model is still DS2022

Yes, same problem here.

"true" only did half the procedure too and had the same problem.

I followed the instructions exactly. Only when it didn't work I tried other things. Obviously you didn't read what I wrote.

Odd.  I sure don't get the 2022 thing.  Did the serial stay the common mangled 14 digit 0001 type one?

In the normal system info screen, it is the 0001 S/N.
In the special system info screen, it is DS2202 with the entered S/N.

What model# did you select for the custom FW? 2072, 2102, 2202 or 2302?

As written in my post, I tried 2072 and 2202. I also tried 2102 with the same results.

Maybe you should give up on the serial fix and just use it...

In short, no.
In length, no. I use it and I will fix this issue.

---

Basically I am having the same exact results as stuartk. Obviously this patch doesn't work. As some have stated success I will look into this and work on my own patch or see if there exists a mechanism to do this with the existing scope software.

[mamalala]

Hey,

does anyone have a dump of the flash memory of the DS1/2/4 scopes at hand? Just a linear dump, as seen by the Blackfin. Maybe i missed it, but so far i have seen only RAM memory dumps here. I'd like to peek a bit into the flash mem instead. Since i don't have a Rigol scope myself yet, i ask here ... If you have concerns about putting such a dump online for all to see, because of some serial number fancieness, feel free to let me know by PM instead. Just don't hand me some dump where the potential s/n is modified after the dump, since that would make it pretty much worthless to what i'd like to try.

Greetings,

Chris

[chebeba]

i went through old posts and realized for ds2072a dumps are needed.

Not any more. You can flash Zombie's patched firmware, which will upgrade you scope to the latest f/w but make it accept pre-A license codes, which means you use the olds keygens to get a license and all works fine.

Only problem with this approach is you will loose your options if you update to stock firmware later.

But please go ahead and do the dumps anyway, to allow more progress. I will as soon as my JTAG arrives.

[sigxcpu]

Good news Everyone!  Attached to this post is a utility to repair corrupted S/N's on DS2000 series scopes! 

....

Tested on several DS2072's w/ original hardware and it works perfectly.  Again, this has not been tested on any hardware versions other than 1.0.  Please don't ask about a Linux version as neither of us are Linux users.  Also, I don't have the source code as the author didn't offer it.  I'm very grateful for his work and won't pester him for the source code.  If you have any issues/suggestions/comments please feel free to contact me.
Edit: Corrected firmware link

Confirmed for HW 2.0. Just recovered my serial number, re-generated the license code and everything is OK.

[eevblogee]

Did anyone tried connecting a ftdi based serial2usb converter to see if a shell is available, i wish they forget the driver for debugging purposes.

[Flipp]

Patched firmware working, BW confirmed, Serial# still there.

[AndersAnd]

Patched firmware working, BW confirmed, Serial# still there.

What scope model and HW version is it?
Patched to 200 or 300 MHz?

[Flipp]

It was a DS2072A before.

[Avotronics]

http://rigol.avotronics.co.uk

is back up 

[egonotto]

Hi,

the restore of SN does by me also not work. It is like by Stuart.

Regards, egonotto


PS:

I have short a timebase of 500ps/DIV

[Rigol-Friend]

I have short a timebase of 500ps/DIV

Yes, but in real this timebase is 1 ns/DIV   

[aadamson]

One of the forum members tested my DS2k 00.02.01.00.03 firmware patch and reported that it works fine, ie. allows to use the old keygen with A scopes without any problems. This patch is a temporary solution for those who cannot or don't want to do memory dumps (at least until it's possible via USB). Of course extracting keys from memory is still preferred method, because license codes created this way should work even with future official firmware releases.

So, enjoy 
https://mega.co.nz/#!FFk10SCY!UuWPXyqZwmca00pa2clOth1ryh1Z-AAgJg2yibfoUw0

For the record this worked on a brand new 2072a with 2.0 hardware.  I didn't go up to 300mhz due to the discussion about filter quality, but I did go to the 200mhz and turned back on all the other options...

oh and mine is a week 47 version for the record.

[marmad]

I didn't go up to 300mhz due to the discussion about filter quality...

Just for the record: the possible issue with the filter would only be when running @ exactly the 1GSa/s sampling rate with Vectors on - because at that sample rate, the Rigol does sin(x)/x interpolation - which would be susceptible to errors with frequencies above the Nyquist frequency (500MHz) - and it's not clear from tests how well the HW v.2 filter blocks those (when 300MHz BW is activated). Until the issue is completely clarified, if you want to be certain of signal fidelity at smaller time bases (i.e. running a DS2302 @ 1GSa/s), probably best to use the 100MHz BW filter.

At the 2GSa/s sampling rate (single channel), the Nyquist frequency is 1GHz, so the filter is totally fine (those frequencies would be well-attenuated) - and at lower sample rates (<= 500MSa/s) it doesn't matter because the DS2000 stops doing sin(x)/x interpolation and instead does linear interpolation - which is not susceptible to the errors (although it can't reconstruct higher frequencies as well with as few samples).

So if you're willing to put up with the idea of having a single-channel 300MHz DSO combined with a dual-channel 100MHz DSO, you can reliably use it that way.   (EDIT: Although I should add that the 1ns time base still seems a little bit buggy).

What we REALLY need is a hack which gives us back the 200MHz BW switch - which would be great to use when running a DS2302 w. 2 channels @ 1GSa/s. I can't understand why Rigol removed that option.

[thetooth]

I didn't go up to 300mhz due to the discussion about filter quality...

Just for the record: the possible issue with the filter would only be when running @ exactly the 1GSa/s sampling rate with Vectors on - because at that sample rate, the Rigol does sin(x)/x interpolation - which would be susceptible to errors with frequencies above the Nyquist frequency (500MHz) - and it's not clear from tests how well the HW v.2 filter blocks those (when 300MHz BW is activated). Until the issue is completely clarified, if you want to be certain of signal fidelity at smaller time bases (i.e. running a DS2302 @ 1GSa/s), probably best to use the 100MHz BW filter.

At the 2GSa/s sampling rate (single channel), the Nyquist frequency is 1GHz, so the filter is totally fine (those frequencies would be well-attenuated) - and at lower sample rates (<= 500MSa/s) it doesn't matter because the DS2000 stops doing sin(x)/x interpolation and instead does linear interpolation - which is not susceptible to the errors (although it can't reconstruct higher frequencies as well with as few samples).

So if you're willing to put up with the idea of having a single-channel 300MHz DSO combined with a dual-channel 100MHz DSO, you can reliably use it that way.   (EDIT: Although I should add that the 1ns time base still seems a little bit buggy).

What we REALLY need is a hack which gives us back the 200MHz BW switch - which would be great to use when running a DS2302 w. 2 channels @ 1GSa/s. I can't understand why Rigol removed that option.

_{I installed the patch last night to try it and semi bricked my scope(would no longer show logo when you powered on), it came down to using a 4GB SD card in a reader, using a 2GB card or dedicated USB stick works so was able to get the firmware loaded up. lel}

As i was about to ask, is it possible to only install the 200Mhz with all the other addons(i am very lazy and hate using that selector knob)? I made the mistake of thinking DSAS was 200Mhz+all options, so now i have installed 200+300+addons options. Would it be fair to say i could remove the 300Mhz option and keep the addons?

Also to note i've managed to keep my serial number and model intact(says 2302A), 50Ohm termination and BW limits(20, 100, 200) are all working as expected. And as a major plus my scope has finally stop crashing if i didn't press any buttons for more than 30 seconds.

[marmad]

As i was about to ask, is it possible to only install the 200Mhz with all the other addons(i am very lazy and hate using that selector knob)? I made the mistake of thinking DSAS was 200Mhz+all options, so now i have installed 200+300+addons options. Would it be fair to say i could remove the 300Mhz option and keep the addons?

Yes, you should be able to.

...and BW limits(20, 100, 200) are all working as expected.

Are you sure you have the 200MHz BW limit? Other people (including myself) have not seen it anymore in the latest FW version (when installing the 300MHz option) - and it's not listed in the Model A Owner's Manual or datasheet for the DS2302A.