Sniffing the Rigol's internal I2C bus

[neslekkim]

Thank you ,

simply question, how do i practice the NS8H ?
Where must i put it in?

at2

As said, only two pages back you find this: https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg380986/#msg380986

[at2]

Thank you for your best help neslekkim!
It´s working as 300 MHz!

I found the trace two pages before and did it.
Now it`s clear.

at2

[crmaris]

Many thanks to all that contributed in this hack!!!
This is my new DS2072A transformed to a DS2302A.

[at2]

Also thank you Zombie 28!

At2

[excapealex]

Reading the manual I saw this .. (picture attached)
Could you explain me what they intend to?
This has nothing to do with the hardware?

[Rigby]

It means that you can restrict the bandwidth of the scope to either 20MHz or 100MHz when you want to.

So, you buy a 200MHz or 300MHz scope, but you're looking at a signal that is much closer to 20MHz, then you would want to turn on the 20MHz limit and cut out a lot of higher frequency noise.

[Mark_O]

It means that you can restrict the bandwidth of the scope to either 20MHz or 100MHz when you want to.

So, you buy a 200MHz or 300MHz scope, but you're looking at a signal that is much closer to 20MHz, then you would want to turn on the 20MHz limit and cut out a lot of higher frequency noise.

Bandwidth limiting will certainly reduce HF noise.  However if that 20MHz signal you're examining happens to be a square wave, you wouldn't want to BW limit it... unless you preferred seeing a sine wave instead.  A 20 MHz BW Limit would be effective at dealing with noise on signals <=5 MHz though.  Without compromising signal integrity too much.

More often, the BW Limiting is used when you reduce the sample rate.  If the Sa-rate is low, any components in your signal >2x Sa will result in aliasing.  BW Limiting knocks those out.   

[excapealex]

Ok, but it is just a software filtering not hardware.. Right?
It may not be that the 20MHz filter is hardware and 100MHz filter software (enabled together with the unlock of the bandwith at 300MHz) or both hardware and this is the difference between the 2072A and the 2302A?

[Teneyes]

Ok, but it is just a software filtering not hardware.. Right?

@Excapealex No , In a past post and Teardown, you can see there is a Hardware variable Bandwidth Amplifier in the DS2000 (4000, 6000) . This hardware has BW filtering Modes selectable by control bits. The modes are 20,100,200, 350, ......MHz.
So it is hardware filtering. In one past version of FW , 20,100 and 200MHz were available.

[excapealex]

@Excapealex No , In a past post and Teardown, you can see there is a Hardware variable Bandwidth Amplifier in the DS2000 (4000, 6000) . This hardware has BW filtering Modes selectable by control bits. The modes are 20,100,200, 350, ......MHz.
So it is hardware filtering. In one past version of FW , 20,100 and 200MHz were available.

Excellent, just what I was hoping for!
Thank you!

[marmad]

I have a DS2072A, not 2302.... its hacked to 300 mhz..
Well... i have tested and not any problem what so ever until now.... And i believe it wont have any problem right ? its just a serial number freeing the functions, not any jailbreak on software really... you can even uninstall everything, update to stock firmware and use the serial that now you have, and it will give you all the options... so, probably just one serial wont give you any instability on the device right ?

As posted already in this and the other thread, the 1ns time base - in the current firmware - is buggy. There are a couple of things that can make the DSO freeze or crash when on - or going to - 1ns setting.

[idpromnut]

how can we test high frequencies close to 300 ? I dont have any generator.... do you know if i can probe on a computer mainbord something that would be close to those speeds ? like USB port in use, ram memory bus.. i dont know.... what the easiest way to test it at close to 300mhz ?

I don't think there is an "easy" way of testing it; a 300Mhz signal is useless unless you know exactly what it looks like so you can judge how well your scope is able to display it.

Also, the probes that come with the 2072A are 300Mhz if I recall, or 350Mhz, which is getting pretty close to any 300Mhz test signal you might try out.

You could build a Jim Williams pulse generator inspired by one of his app notes (AN47 I believe) which would allow you to get a rough measure of the bandwidth of the scope.  Dave did a video on that in fact.

[RX_Buffer[Broken];]

Hi

I was also curious about performance of the DS2702A pushed to 300Mhz so recently I have done some investigating.
Last week I tested My employers 300Mhz (2gsa/s) Agilent Upto  1Ghz, looking at bandwith and Nyquist response.
1 and 2 channels the later at half sample rate.
I wanted to get a feel for what to expect when I repeat this on the Rigol, However ran out of time and didn't want to stay late!
TODO Next week hopefully.

What I do know for sure is that a Hacked ds2072a(2302A) will display a perfect sine from RF Gen. with no impurities upto 450Mhz (at reduced BW obviously).

The notable dropoff @374Mhz this is were the filter Knee appears to be for mine at least.
And that the 300 Mhz BW option "Tested" as having 1/3 greater BW than the 200Mhz Option logically.
I hope to complete testing and publish results soon.......

And yes Marmad the 1nS time base is prone to locking up the scope when other features are implemented.
 
For me it seemed related to the Rotary Encoders ie:  A fast turn of encoder knobs == lockup.
Hope this is fixed in the future.

[Tabs]

Hi all,

Firstly, thanks to cybernet, zombie28, marmad and all who have contributed to developing the contents of this thread.

I can confirm the following:
DSA815-TG: Preamp, 10Hz RBW & ADV Measurement unlocks work.

cybernets modified DS4k firmware (DS405xUpdate) has upgraded my DS4014 to 500MHz with 1ns timebase. No observed crashes or negative effects.
DS4k all options unlocked works fine.

I used my DSA815-TG to test the 500MHz BW upgrade on the DS4014.

I used a modified setup as described by Dave in


I set my tracking gen to -20dBm, swept from 0Hz to 1.4GHz with a sweep time of 14 seconds. This corresponds to 100MHz/s.
I set the DS4014 to 1sec timebase, 10mv/dev scale. This represented 100MHz/div over the 14 divisions on the DS4014. Additionally, the horizontal reference for the DS4014 was set to 'Trig Pos', and moved to the extreme left
Both instruments were set to external trigger (negative edge on DSA, pulse mode with pulse width > 1.5sec on DS4k). The trigger was a 5V square wave with 15 second period, generated from my DG4062. (at this speed an arduino could produce the trigger)

The results for different BW limits are attached. An envelope detector on the DS4k would have come in useful (If it exists, its bloody hard to find and I've not checked the manual yet). I measured the TG output with the SA side of the DSA815. An excel plot of the extracted CSV data is attached also. For some reason I cant get the DSA to print screen to a USB.

Also, I was not able to figure out how to save CSV data at controlled time intervals on the DS4k or DSA. The two units seem to default to 600 samples (DSA) and 1400 samples (DS4k). This made it difficult for me to align the two data sets in order to subtract the TG output from the frequency response of the DS4k.

You can visually see that at 500MHz, the weird response is linked to the TG output.
Note the black vertical line is just the oscilloscope trace sweeping accross.
SMA cables were used + SMA to BNC adapters. Cables and connectors are good for 12GHz and result in a 1db (tbc) loss at 1G

Regards

Tabs

Edit: I ended up using advanced math> abs(CH1) for envelope detection.

[neslekkim]

Ok, so, I have "upgraded" my scope, kept the bandwidth as I had 200mhz, but all options, very nice solution by zombie28 and tirulerbach.

I got it working by using the hexeditor approach, and rigup, but I could not get it working by using the textfile to list the keys, I could not find the privkey, but atleast i'm up now.
Strange though, the ultrasigma times out so you don't know if you are good or not.

What is also interesting, is that ultrasigma only shows my scope as an ds2202a, not -s, not before, or after the update, and the ultrasigma does not to be an useful app at all, other than issuing idn and installing options, how weird.

Ruu on the other hand looks interresting, only if it will talk to my scope (I don't want to use usb), but I guess I only need to read a bit about that to figure it out.

I would guess that the signalgen commands that are in the programming guide are somewhat similar to other signalgens from rigol?, have anyone created an app to control the signalgen from an computer? similar to what Ruu does?, since it seems like it's an addon inside the rigol I guess it would be possible to use it without it interfering with using the scope?

[swperk]

Hello all,

Thanks to everyone for all of their hard work on this project. I find this all very fascinating!

I recently bought a DS2072A and used the rigup program along with the patched firmware to try to upgrade my scope to a fully optioned 300 MHz DS2302A (NS8H). Unfortunately, the key that was generated was rejected by the scope with the message "License is unavailable!". I regenerated the key a couple more times and carefully read it and re-read it to make sure I was inputting it correctly, but it never worked.

Undeterred, I then generated the key for a fully optioned 200 MHz DS2202A (NSEQ) and it worked fine. Has anyone else succesfully upgraded their "A" version scope all the way to 300 MHz? If so, how? I must be missing something...

Regards,
Stan

[corax]

Undeterred, I then generated the key for a fully optioned 200 MHz DS2202A (NSEQ) and it worked fine. Has anyone else succesfully upgraded their "A" version scope all the way to 300 MHz? If so, how? I must be missing something...

Yes, I have, as well as others.  I used the patched firmware to dump the keys, which I then put into a file with a hex editor, appending the ASCII serial number after the keys, and terminating the file with a zero.  Named this file ds2072a.bin.

Feeding this to rigup:

  ./rigup ds2072a ds2072a.bin

resulted in output of four possible license code combinations, for options NSEH, NSER, NSEQ, and NSFH.

But from the thread, it was found that NSFH wasn't the right code for 300MHz/all options; the correct code was NS8H.
So I edited the rigup source and recompiled it: change the NSFH code to NS8H on line 21 of luxury.c.

Rerunning rigup produced a license code for NS8H that worked for me.
(This was done in Linux.)

[pascal_sweden]

Does this hack work now on a DS2072A without opening up your actual scope?
300 MHz and all options? Actual tests to verify stability and BW limit?

[SPRX]

Great work by the team working on this thread . . !!

It is time to upgrade my DS1102, and this thread is encouraging.

I may convince my pocket for DS4014 over DS2072A if it is really a good investment. I know the price of DS4014 is more than double + in import-duty bracket.

Could you please let me know if the DS4014 is upgradable successfully to 500MHz with options, if you have done an upgrade on DS4K.

[madcrow]

I just don't get it... Some of you (e.g. at2 and crmaris) were able to install the 300MHz (NS8H) option without difficulty. However corax and swperk only managed it by modifying the rigup source files.
How is this possible? Are there multiple paths you can take with the rigup tool to obtain the serial?

@tirulerbach
Is there any chance you could compile a rigup v0.2 which uses the recently discovered NS8H option instead of NSFH? I think a lot of people would be very grateful

And one more question: Do I understand correctly that the same code (NS8H) can used for all the models (2072A ...2202A) to unlock all options?

Thanks!

[hari]

Is there any chance you could compile a rigup v0.2 which uses the recently discovered NS8H option instead of NSFH? I think a lot of people would be very grateful

just change the value in src/luxury.c and recompile. You can also scroll back a few pages to see how you can specify any license code on the command line.

[lovro]

Hi,
I have managed to do it also. 200MHz with all options.

Thank you all who were all involved in this project.
EEVblog forum has a lot added value 

[madcrow]

Is there any chance you could compile a rigup v0.2 which uses the recently discovered NS8H option instead of NSFH? I think a lot of people would be very grateful

just change the value in src/luxury.c and recompile. You can also scroll back a few pages to see how you can specify any license code on the command line.

Do you mean:

Code: [Select]

rigup scan keyfile.txt dump.bin
and

Code: [Select]

rigup license keyfile.txt 0x1C0C7?

In the first command line, is dump.bin the file I create using the Hex editor based on the information spat out by Zombie's patched FW?
Would this work even without modifying luxury.c?

[corax]

I just don't get it... Some of you (e.g. at2 and crmaris) were able to install the 300MHz (NS8H) option without difficulty. However corax and swperk only managed it by modifying the rigup source files.
How is this possible? Are there multiple paths you can take with the rigup tool to obtain the serial?

As has been pointed out, there's apparently a way to specify the code (as 0x1C0C7) on the command-line.

I edited / recompiled because I had to recompile anyhow- the distributed rigup linux executable is 64-bit, and I needed a 32-bit version.

[pa3bca]

Proud owner of a 2072A with “enhanced features”. (all of them, including 300 MHz). Thanks guys!
To test the scope, I made a quick&dirty Jim Williams pulse generator, directly on a male BNC connector, see attached picture.
Transistor is a BSX20 I had laying around. This puppy avalanches nicely at around 80 Volts.
1 meg to +120 Volts, 22pF on the collector, and 2x100 Ohms parallel from emitter to ground. Also about a meter of RG58 to the collector to lengthen the pulse. This lengthening works quite nice, see the attached screenshots. Yellow is the pulse on the emitter (input 1 meg as there is no cable between the pulse generator and the scope so termination is not an issue?).
Channel 2 is the voltage on the collector, measured with the 1:10 probe.
It _looks_ like the pulse is long enough to give a somewhat reliable indication of the rise time.
Rise time is abt 700 ps which would yield a bandwidth of 0.4/700x10^-12 = 570 MHz (which sounds a bit optimistic), but certainly way better than the original 70 MHz…