Author Topic: Sniffing the Rigol's internal I2C bus  (Read 1840859 times)

0 Members and 3 Guests are viewing this topic.

Offline nmz787

  • Newbie
  • Posts: 4
Re: Sniffing the Rigol's internal I2C bus
« Reply #2750 on: January 31, 2014, 08:31:37 am »
This and the subsequent post mention an offset that self-cal doesn't fix:
https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg346806/#msg346806

I plugged the signal generator into the input, and indeed with 0mV offset on generator and 20mV PP, you can easily see the signal isn't centered on 0 (not just in 500uV mode either).

Edit: I've got a DS1104Z
« Last Edit: January 31, 2014, 08:40:02 am by nmz787 »
 

Offline alank2

  • Super Contributor
  • ***
  • Posts: 2185
Re: Sniffing the Rigol's internal I2C bus
« Reply #2751 on: January 31, 2014, 01:56:47 pm »
nmz787 - use the scpi uninstall command (somebody posted a tool to do this not long ago) and then reboot your scope.  Then reinstall a new key without the 500uv option.
 

Offline RX_Buffer[Broken];

  • Newbie
  • Posts: 2
Re: Sniffing the Rigol's internal I2C bus
« Reply #2752 on: January 31, 2014, 05:04:29 pm »
Hi All, (noob)

I have been watching the DS2xxxn topic for a few weeks , I have Z's Patched F/W on a what was a 2072A.  "Nice Job Z"
However not wanting to turn up to the party empty handed (linux, Jtag & sharing Dumps are not my redeeming features) So I have been investigating other routes.

I have found a DS2xxx  SCPI command that appears un-documented and may be of interest if still supported in f/w.
Having tried on my own unit I get a buss time out error, maybe patched F/W or maybe that all options are already installed, unsure??
It would be interesting to know what reply you get from a standard unit? or if anyone already knows about this CMD already ?

SYSTem:OPTion:VALid?



 

Offline MrsR

  • Regular Contributor
  • *
  • Posts: 118
  • Country: au
Re: Sniffing the Rigol's internal I2C bus
« Reply #2753 on: January 31, 2014, 11:50:55 pm »
Hi! Guys,
I am having problems with my RIGOL 2072 DSO modified to 300MHz.
Is there a way to turn it back into a 70 or even a 200MHz model.
I used the 3owl site.
The fault is that I get  screen messages "Parameter out of Range" when I know it isn't.
I did the same tests with works AGILENT scope no problems.
Also I can't put it into Peak Detect well I can but on using, it jumps to Normal.

Thanks Guys
Rachael :-+
 

Offline AndersAnd

  • Frequent Contributor
  • **
  • Posts: 572
  • Country: dk
Re: Sniffing the Rigol's internal I2C bus
« Reply #2754 on: February 01, 2014, 12:14:02 am »
Hi! Guys,
I am having problems with my RIGOL 2072 DSO modified to 300MHz.
Is there a way to turn it back into a 70 or even a 200MHz model.
I used the 3owl site.
The fault is that I get  screen messages "Parameter out of Range" when I know it isn't.
I did the same tests with works AGILENT scope no problems.
Also I can't put it into Peak Detect well I can but on using, it jumps to Normal.

Thanks Guys
Rachael :-+
Yes just use the SCPI uninstall command as mentioned several times in this topic.
 

Offline stuartk

  • Regular Contributor
  • *
  • Posts: 102
  • Country: ca
Re: Sniffing the Rigol's internal I2C bus
« Reply #2755 on: February 01, 2014, 01:01:27 am »
I've had an unanticipated error in Ultra Sigma after placing the codes for my DS2102

The print screen function no longer works. I can still communicate by SCPI.

Uninstalling/reinstalling Ultra Sigma - NI  or the scope made no difference.

Has anyone else noticed this behavior? I wonder if it's a consequence of mangled serial number syndrome.

Thanks, Stuart
 

Offline Marc M.

  • Regular Contributor
  • *
  • Posts: 132
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #2756 on: February 01, 2014, 11:33:48 am »
...if servicing a scope, if we had to do a board swap how would we program the instrument's SN and KEY to the new board?...

In the case of Rigol with hardware V1.0 boards - they don't.  At least not the S/N, I can't say how keys are handled as I didn't have any installed.  A while back I sent my scope in to Rigol NA for warranty work.  When I received the repaired scope back, sure enough I had the dreaded corrupted S/N reset to ...001  :--.  I used the serial/model # file I posted earlier to successfully correct the  S/N. 

While verifying my info was still correct, I happened to notice that my horizontal timebase now topped out at 500ps :-+.  I verified that it was indeed sweeping at 500ps/div by applying a 400 MHz signal and making sure it displayed a period of 5 divisions which it did (naysayers see attached pics).  I then re-applied the 300 MHz codes and it retained the 500ps setting.  Finally, I power cycled the scope and it lost the 500 ps setting.  At that point I again uninstalled the options via SCPI and the 500ps sweep rate returned.  I power cycled the scope again and tried sending the uninstall command again (without any active licenses) and it did not activate the 500ps sweep rate.  I didn't notice this behavior until after correcting my serial # and I see at least one other member mentioning having a 500ps time base setting as well.  Throughout this process, my model # has been stuck as DS2302 regardless of what/any licenses installed.  I was running firmware 00.02.01.00.03 with license code DSHH. 

At this point I removed all licenses and reflashed 00.01.01.00.02 firmware.  After power cycling the scope, my model # reverted back to DS2072.  I then applied the old DSA9 license code, power cycled, and the model changed to DS2202 as expected.  I again uninstalled the options and checked the horizontal timebase and sure enough, I had 500ps again.  However, this time the timebase was actually still running at 1ns even when switched to 500ps, just throwing the trigger point off a couple of divisions.  Once again, the 500ps setting disappeared after power cycling the scope.

Next, I reflashed the 00.02.01.00.03 firmware back onto the scope.  After power cycling the model remained DS2072.  I then installed the DSHH codes.  Although all options were installed, the model # remained DS2072.  The 500ps setting returned but again it was still running at 1ns/div. with the offset trigger.

The only obvious difference between when I had real 500ps horizontal rate and the fake 500ps rate was the model number.  So I took a chance and used the snmodfix.exe utility I posted earlier to forcefully change the model # back to DS2302 to see if it had any effect on the 500ps rate. This time around, I was unable to change the model # - it stayed DS2072 even with DSHH applied. I then tried to change both the S/N and model number.  The S/N changed but the model # didn't - still stuck on 2072.  If I reflash .02 firmware and apply the DSA9 key, it changes to 2202.

I've been too busy with other things lately to play further.  At this point it appears that the model # may affect the behaviour of applied keys inferred from having a real 500ps timebase when it was a DS2302 to a 5ns timebase (even with the DSHH key applied) when it's model # is 2072.  Also, it appears that there are certain circumstances where the utility to alter model/serial numbers will fail to do so as other members have experienced.  So far the author doesn't understand why it's failing to work and hasn't been able to replicate the failure on his scope.  The good news is I've confirmed it's capable of a 500ps horizontal time base if we can just determine the mechanism required to invoke it permanently.  As I get some free time I'll experiment further.
Don't replace the cap, just empty the filter!
 

Offline marmad

  • Super Contributor
  • ***
  • Posts: 2979
  • Country: aq
    • DaysAlive
Re: Sniffing the Rigol's internal I2C bus
« Reply #2757 on: February 01, 2014, 11:52:27 am »
The good news is I've confirmed it's capable of a 500ps horizontal time base if we can just determine the mechanism required to invoke it permanently.  As I get some free time I'll experiment further.

Interesting story - but just because the DSO is capable of being forced into providing a function which isn't listed in the specs, doesn't mean it's advantageous in the grander scheme of things to do so. This is evidenced by the fact that the 1ns time base (which is a by-product of the 300MHz option) is fairly buggy.

During the 15 previous months I owned the DS2000, I found it extremely stable - perhaps locking up (i.e. crashing) 3 or 4 times in total over that period. OTOH, after enabling the 300MHz/1ns option, I had that many crashes within a week. Conclusion: the trouble was not worth the small benefit gained.
 

Offline zombie28

  • Regular Contributor
  • *
  • Posts: 69
Re: Sniffing the Rigol's internal I2C bus
« Reply #2758 on: February 01, 2014, 08:10:30 pm »
What chances are there to patch a firmware so that it outputs the key and serial when you send it
"*IDN?". That would be good.

Done!

https://mega.co.nz/#!MdcEWTgL!0EEmSr-Q6TxaFSsyEmjhRrgqDvFCoXg9K49BalL5Uxc

No need for JTAG memory dumps anymore, just send *IDN? command and you'll get your license encryption keys in response (tested on my DS2072A that has just arrived).
« Last Edit: February 01, 2014, 09:10:34 pm by zombie28 »
 

Offline tiagobaracho

  • Regular Contributor
  • *
  • Posts: 66
Re: Sniffing the Rigol's internal I2C bus
« Reply #2759 on: February 01, 2014, 08:16:38 pm »
Guys... Sorry to bother..
I bought one Rigol DS2072A
It shows Software version 00.02.00 and Hardware version 2.0... Is that possible to use the 200 mhz and high memory settings ?
I have been reading a lot of pages in this thread but i could not find....
Thanks
 

Offline nmz787

  • Newbie
  • Posts: 4
Re: Sniffing the Rigol's internal I2C bus
« Reply #2760 on: February 01, 2014, 09:19:04 pm »
nmz787 - use the scpi uninstall command (somebody posted a tool to do this not long ago) and then reboot your scope.  Then reinstall a new key without the 500uv option.

alank2,
Can you be a bit more specific about the tool. I'm new around here. I found the RUU tool, downloaded NI VISA 5.4, rebooted my PC, and attempted to connect, but then the RUU tool errored out and then crashed on my with an array-out-of-bounds error. (I was clicking connect too fast or something). After entering the correct IP address with the weird prefix and suffix, the :: stuff, it stopped complaining about not being able to find the instrument, and doesn't ask for the IP anymore upon starting the software and clicking connect. Now it just presents a message box "DSO not responding to query and/or command - RUU closing connection"

I'm downloading the UltraSigma installer now from the DS4000 Rigol page... I can't tell from the 'instructions' on RUU (which of course aren't in a README in the .zip) whether this is needed or not.
 

Offline zombie28

  • Regular Contributor
  • *
  • Posts: 69
Re: Sniffing the Rigol's internal I2C bus
« Reply #2761 on: February 01, 2014, 09:25:36 pm »
Guys... Sorry to bother..
I bought one Rigol DS2072A
It shows Software version 00.02.00 and Hardware version 2.0... Is that possible to use the 200 mhz and high memory settings ?
I have been reading a lot of pages in this thread but i could not find....
Thanks

You can use either my first firmware patch (https://mega.co.nz/#!FFk10SCY!UuWPXyqZwmca00pa2clOth1ryh1Z-AAgJg2yibfoUw0) with old keygen (riglol.3owl.com) or my newest patch from the post above with the new tirulerbach's keygen (if he decides to publish it).
 

Offline alank2

  • Super Contributor
  • ***
  • Posts: 2185
Re: Sniffing the Rigol's internal I2C bus
« Reply #2762 on: February 01, 2014, 09:29:34 pm »
alank2, Can you be a bit more specific about the tool. I'm new around here.

https://www.eevblog.com/forum/testgear/sniffing-the-rigol%27s-internal-i2c-bus/msg375454/#msg375454

I don't know much about it, haven't tested it, but it says it can issue an uninstall command...
 

Offline tiagobaracho

  • Regular Contributor
  • *
  • Posts: 66
Re: Sniffing the Rigol's internal I2C bus
« Reply #2763 on: February 02, 2014, 02:30:35 am »
Guys... Sorry to bother..
I bought one Rigol DS2072A
It shows Software version 00.02.00 and Hardware version 2.0... Is that possible to use the 200 mhz and high memory settings ?
I have been reading a lot of pages in this thread but i could not find....
Thanks

You can use either my first firmware patch (https://mega.co.nz/#!FFk10SCY!UuWPXyqZwmca00pa2clOth1ryh1Z-AAgJg2yibfoUw0) with old keygen (riglol.3owl.com) or my newest patch from the post above with the new tirulerbach's keygen (if he decides to publish it).
Thanks man..
Have it been tested on DS2072A with   Hardware version 2.0 ? yours is 2.0 ?
Does its keeps even after reboot? IF i use DSHH ( add all) would it have any negative side ? I just ask because i saw that you can choose fewer options, so i thought " why would someone choose not all options ?
Which difference of both your versions ? the newest and the older ? i cannot use the newest unless tirulerbach's keygen is out right ? (sorry, i am into using it, not the hacking( i have not enough knowledge, but would love to use it and post back the results.
Thanks very much.
« Last Edit: February 02, 2014, 03:42:35 am by tiagobaracho »
 

Offline nmz787

  • Newbie
  • Posts: 4
Re: Sniffing the Rigol's internal I2C bus
« Reply #2764 on: February 02, 2014, 04:40:36 am »
alank2, Can you be a bit more specific about the tool. I'm new around here.

https://www.eevblog.com/forum/testgear/sniffing-the-rigol%27s-internal-i2c-bus/msg375454/#msg375454

I don't know much about it, haven't tested it, but it says it can issue an uninstall command...


I ended up downloading the ~500 Mb Rigol Ultra Sigma software
Code: [Select]
http://us.rigol.com/prodserv/DS4000/software/ and after entering the IP address of the scope, and right-clicking on the unit, I found the SCPI terminal and issued
Code: [Select]
:SYSTem:OPTion:UNINSTall, rebooted the scope, and found all options uninstalled (though I couldn't tell if this 100MHz unit reverted to 70MHz). Then I went back to the own3 site and put in the serial # and the options needed to reinstall. Removed the hyphens (-) from the pop-up messsage code, then pasted that just after this command in the SCPI terminal:
Code: [Select]
:SYSTem:OPTion:INSTall licenseCode
 

Offline poida_pie

  • Regular Contributor
  • *
  • Posts: 119
  • Country: au
Re: Sniffing the Rigol's internal I2C bus
« Reply #2765 on: February 02, 2014, 05:18:03 am »
Good golly man, this sorts out any need to open the 2072A machines now.
I myself have a non A series 2072 so the riglol keygen works fine for me.

But now, the problem for A series owners seems to be sorted thanks to this.

Correct me if I am wrong but the steps to hack an A series  Rigol 2000 DSO is
1 - flash it with attached firmware
2 - connect, issue "*IDN?", write down serial and keys
3 - flash it with current firmware or not, up to you.
4 - find the keygen that you can put in your specific private keys (where would I find that, exactly? I forget.)
5 - generate keys
6 - stuff them into the DSO
7 - get a beer from the fridge, done.

This means no more jtag, no more opening up the new A series DSOs. No more worrying about warranty.
zombie28 you are The Man.
I have a  fridge full of home brew, if ever you are traveling by the way of Melbourne AUS...
P.

What chances are there to patch a firmware so that it outputs the key and serial when you send it
"*IDN?". That would be good.

Done!

https://mega.co.nz/#!MdcEWTgL!0EEmSr-Q6TxaFSsyEmjhRrgqDvFCoXg9K49BalL5Uxc

No need for JTAG memory dumps anymore, just send *IDN? command and you'll get your license encryption keys in response (tested on my DS2072A that has just arrived).
 

Offline AndersAnd

  • Frequent Contributor
  • **
  • Posts: 572
  • Country: dk
Re: Sniffing the Rigol's internal I2C bus
« Reply #2766 on: February 02, 2014, 12:07:35 pm »
Have it been tested on DS2072A with   Hardware version 2.0 ? yours is 2.0 ?
Every DS2000A series scope has HW 2.
It's only the older DS2000 non-A series scopes that comes with HW 1, but the newer non-A DS2000 also has HW 2, like the A models.
 

Offline diyaudio

  • Frequent Contributor
  • **
  • !
  • Posts: 683
  • Country: za
Re: Sniffing the Rigol's internal I2C bus
« Reply #2767 on: February 02, 2014, 01:53:18 pm »
What chances are there to patch a firmware so that it outputs the key and serial when you send it
"*IDN?". That would be good.

Done!

https://mega.co.nz/#!MdcEWTgL!0EEmSr-Q6TxaFSsyEmjhRrgqDvFCoXg9K49BalL5Uxc

No need for JTAG memory dumps anymore, just send *IDN? command and you'll get your license encryption keys in response (tested on my DS2072A that has just arrived).


zombie28 ! great work!

Can anyone do a demo and upload to youtube for us. please. 




 

Offline ju1ce

  • Regular Contributor
  • *
  • Posts: 96
  • Country: fi
Re: Sniffing the Rigol's internal I2C bus
« Reply #2768 on: February 02, 2014, 02:51:18 pm »
Done!

https://mega.co.nz/#!MdcEWTgL!0EEmSr-Q6TxaFSsyEmjhRrgqDvFCoXg9K49BalL5Uxc

No need for JTAG memory dumps anymore, just send *IDN? command and you'll get your license encryption keys in response (tested on my DS2072A that has just arrived).
Thanks. I tried this and got the keys. I'm afraid I can't do anything with them though unless a keygen is published. I tried earlier to do a memory dump using Segger J-Link, but it failed after about 48 hours...

zombie28 ! great work!

Can anyone do a demo and upload to youtube for us. please.
Install this firmware (you get the update instructions pdf from Rigol if you request a firmware update). Connect the scope to your windows PC using lan or usb and send the IDN command using Rigol's Ultra Sigma software (I'm sure there are other alternatives as well). The keys are in the output as told in the readme file. Anything simpler and it soon becomes too easy...
 

Offline tirulerbach

  • Contributor
  • Posts: 33
Re: Sniffing the Rigol's internal I2C bus
« Reply #2769 on: February 02, 2014, 03:03:20 pm »
You can use either my first firmware patch (https://mega.co.nz/#!FFk10SCY!UuWPXyqZwmca00pa2clOth1ryh1Z-AAgJg2yibfoUw0) with old keygen (riglol.3owl.com) or my newest patch from the post above with the new tirulerbach's keygen (if he decides to publish it).

Decided: https://mega.co.nz/#!qAkUkTZB!XG12bUKhIz4CmQt6DbBnGRMvEe5AvUjEaBxi4R03tw8  ;)
 

Offline zombie28

  • Regular Contributor
  • *
  • Posts: 69
Re: Sniffing the Rigol's internal I2C bus
« Reply #2770 on: February 02, 2014, 03:35:00 pm »
I tried this and got the keys. I'm afraid I can't do anything with them though unless a keygen is published.

Now you can (thanks tirulerbach!)

The keygen requires memory dump in a binary form, so you will need some hex editor (like HxD) to create one. Just paste the keys as a sequence of bytes, append your scope's serial number as plain text and terminate it with 0. Now you can use the keygen, like this:

Code: [Select]
rigup.exe DS2072A dump.bin
« Last Edit: February 02, 2014, 09:47:18 pm by zombie28 »
 

Offline diyaudio

  • Frequent Contributor
  • **
  • !
  • Posts: 683
  • Country: za
Re: Sniffing the Rigol's internal I2C bus
« Reply #2771 on: February 02, 2014, 03:43:48 pm »
Done!

https://mega.co.nz/#!MdcEWTgL!0EEmSr-Q6TxaFSsyEmjhRrgqDvFCoXg9K49BalL5Uxc

No need for JTAG memory dumps anymore, just send *IDN? command and you'll get your license encryption keys in response (tested on my DS2072A that has just arrived).
Thanks. I tried this and got the keys. I'm afraid I can't do anything with them though unless a keygen is published. I tried earlier to do a memory dump using Segger J-Link, but it failed after about 48 hours...

zombie28 ! great work!

Can anyone do a demo and upload to youtube for us. please.
Install this firmware (you get the update instructions pdf from Rigol if you request a firmware update). Connect the scope to your windows PC using lan or usb and send the IDN command using Rigol's Ultra Sigma software (I'm sure there are other alternatives as well). The keys are in the output as told in the readme file. Anything simpler and it soon becomes too easy...

hi ju1ce ! Thanks for those steps.  (Sorry for coming across lazy) will download the software now.


 

Offline ju1ce

  • Regular Contributor
  • *
  • Posts: 96
  • Country: fi
Re: Sniffing the Rigol's internal I2C bus
« Reply #2772 on: February 02, 2014, 04:39:26 pm »

Decided: https://mega.co.nz/#!qAkUkTZB!XG12bUKhIz4CmQt6DbBnGRMvEe5AvUjEaBxi4R03tw8  ;)
Thank you for your work and for releasing this keygen!

Now you can (thanks tirulerbach!)

The keygen requires memory dump in a binary form, so you will need some hex editor (like HxD) to create one. Just paste the keys as a sequence of bytes, append your serial number as plain text and terminate it with 0. Now you can use the keygen, like this:
Got it. Thanks for the instructions and everything you've done for this hack. I successfully installed the options, as you can see.
 

Offline ZeroAviation

  • Contributor
  • Posts: 34
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #2773 on: February 02, 2014, 05:33:19 pm »
I used the 'special' firmware to dump my keys. Then used the rigup keygen with the following results.

The 100MHZ (NSER) works for me. However the 200MHZ (NSEQ) does not. (Says licenses unavailable on the scope)

Any ideas? Mine is a week 47 scope.

Cheers guys! Thanks for the hard work.
-Matt
« Last Edit: February 02, 2014, 05:35:08 pm by ZeroAviation »
 

Offline kado

  • Regular Contributor
  • *
  • Posts: 51
  • Country: de
Re: Sniffing the Rigol's internal I2C bus
« Reply #2774 on: February 02, 2014, 05:55:57 pm »
Hello to all,

i can´t download tirulerbach´s keygen from mega.co.nz. Too much download requests this time or hacked from PRC?

Please can anybody mirror this file?

Thanks,
Karsten

 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf