Sniffing the Rigol's internal I2C bus

[Suffer1981de]

is there any guide of how i install the DSER code?

It's actually simple.

Take your serial number (should have been printed on a piece of paper that comes with the scope), surf to http://riglol.3owl.com/, punch it into the first field, select DSER in the field "Options", use the private key (can be found in this thread somewhere, i think it's 6F1106DDA994DA) and hit generate. The Key you are getting should make everything official incl. the bandwith upgrade.

Greetings

[AndersAnd]

use the private key (can be found in this thread somewhere, i think it's 6F1106DDA994DA) and hit generate.

It's actually much simpler than that. Just leave the the private key field blank instead and it will fill it out automatically when you hit generate, finding the correct private key based on what model your entered serial number is for.

Btw. you link is corrupted as you have included a comma at the end of the link.
Here's the correct link: http://riglol.3owl.com
Canadian mirror: http://gotroot.ca/rigol/riglol/
UK mirror: http://rigol.avotronics.co.uk/mirrors/riglol/

Here's part of the source code in riglol.c (source code can be downloaded at the bottom of http://riglol.3owl.com)

Code: [Select]

char DP832_private_key[]   = "5C393C30FACCF4";
char DS2000_private_key[]  = "8EEBD4D04C3771";
char DSA815_private_key[]  = "80444DFECE903E";
char DS1000Z_private_key[] = "6F1106DDA994DA";
char no_private_key[]      = "";
}
char *select_priv_key(char *serial) {
    char *priv_key;
    strtoupper(serial);
    if      (!strncmp(serial, "DS1", 3)) priv_key = DS1000Z_private_key;
    else if (!strncmp(serial, "DS2", 3)) priv_key = DS2000_private_key;
    else if (!strncmp(serial, "DS4", 3)) priv_key = DS2000_private_key;
    else if (!strncmp(serial, "DSA", 3)) priv_key = DSA815_private_key;
    else if (!strncmp(serial, "DP8", 3)) priv_key = DP832_private_key;
    else                                 priv_key = no_private_key;
    return priv_key;
}
As you can see for all entered serial numbers starting with "DS1" it automatically picks the correct private key for DS1000Z.
"DS1" = DS1000Z
"DS2" = DS2000
"DS4" = DS4000 (has the same private key as DS2000)
"DSA" = DSA815
"DP8" = DP832

[Suffer1981de]

use the private key (can be found in this thread somewhere, i think it's 6F1106DDA994DA) and hit generate.

It's actually much simpler than that. Just leave the the private key field blank instead and it will fill it out automatically when you hit generate, finding the correct private key based on what model your entered serial number is for.

You Sir, are correct! *bow*

[toni31]

is there any guide of how i install the DSER code?

It's actually simple.

Take your serial number (should have been printed on a piece of paper that comes with the scope), surf to http://riglol.3owl.com/, punch it into the first field, select DSER in the field "Options", use the private key (can be found in this thread somewhere, i think it's 6F1106DDA994DA) and hit generate. The Key you are getting should make everything official incl. the bandwith upgrade.

Greetings

use the private key (can be found in this thread somewhere, i think it's 6F1106DDA994DA) and hit generate.

It's actually much simpler than that. Just leave the the private key field blank instead and it will fill it out automatically when you hit generate, finding the correct private key based on what model your entered serial number is for.

Btw. you link is corrupted as you have included a comma at the end of the link.
Here's the correct link: http://riglol.3owl.com
Canadian mirror: http://gotroot.ca/rigol/riglol/
UK mirror: http://rigol.avotronics.co.uk/mirrors/riglol/

Here's part of the source code in riglol.c (source code can be downloaded at the bottom of http://riglol.3owl.com)

Code: [Select]

char DP832_private_key[]   = "5C393C30FACCF4";
char DS2000_private_key[]  = "8EEBD4D04C3771";
char DSA815_private_key[]  = "80444DFECE903E";
char DS1000Z_private_key[] = "6F1106DDA994DA";
char no_private_key[]      = "";
}
char *select_priv_key(char *serial) {
    char *priv_key;
    strtoupper(serial);
    if      (!strncmp(serial, "DS1", 3)) priv_key = DS1000Z_private_key;
    else if (!strncmp(serial, "DS2", 3)) priv_key = DS2000_private_key;
    else if (!strncmp(serial, "DS4", 3)) priv_key = DS2000_private_key;
    else if (!strncmp(serial, "DSA", 3)) priv_key = DSA815_private_key;
    else if (!strncmp(serial, "DP8", 3)) priv_key = DP832_private_key;
    else                                 priv_key = no_private_key;
    return priv_key;
}
As you can see for all entered serial numbers starting with "DS1" it automatically picks the correct private key for DS1000Z.
"DS1" = DS1000Z
"DS2" = DS2000
"DS4" = DS4000 (has the same private key as DS2000)
"DSA" = DSA815
"DP8" = DP832

Thanks guys

[Mike G]

Unable to generate unlock key, solution at last, phew!!
Hi, this is my first post, wanted to say thanks for all the information in this thread and to offer a little bit to the discussion about the key generator for the DS1000Z scope.
Despite reading everything I could find in this thread I was unable to generate an unlock code. The Riglol key generator would tell me if the private key was the wrong length or if the options field was invalid but with the correct information in all fields flatly refused to do anything.         Anyhow having slept on it I wondered if the Windows OS was causing the problem!  My workshop PC is running XP so I have just fired up my Windows 7 laptop and all now works fine.  Hope this can help someone.
My 1074 should be here later today so will post again as to how the "mod" goes. Have generated the DSER key as I don't need the 500uV range.
Thanks again to you all.

[mark03]

I received my DS2072A yesterday, and of course first thing, had to try generating a key for it.  But for some reason, it's not working.  Trying to use NS8H for 300 MHz + all options.  And yes, I have read the entire thread. 

Because I don't have Windows at home, I used Arkku's method on Linux (post #3105).  Everything appears fine until code entry, at which point the "unavailable" message appears momentarily on-screen.  I first tried entering the code over SCPI (using telnet), then on the scope's front panel.  No luck.  All of the options are still "trial," and same thing after power cycling. 

Someone else had reported the same problem, but I didn't see negative reports for "following the PDF tutorial" i.e. running the tools on Windows and using a hex editor.  So I went through that process today on a Windows 7 machine, and the proposed license key is exactly the same.  (It is kind of comforting to verify that the two methods for putting together the binary data file---Ruby script and manual hex editing---do in fact match.  The size is 146 bytes which matches the tutorial.)

I noticed that a rigup version 0.4 appeared on the gotroot.ca mirror in the last couple of days (I was using version 0.1), so I tried that as well.  All three workflows result in exactly the same key, the one which isn't working.

Tonight when I get home I will try a few more things:
1) change the firmware back to the non-custom (non-IDN-dumping) version
2) send SCPI "uninstall" command
3) try the key again
4) if that doesn't work, generate a key with NSEQ (200 + options) and try it; some folks reported that it works when NS8H does not.

So a huge thanks to all the folks that worked on this; I've been amazed at the level of effort, and am truely grateful.  But, I am starting to wonder if there are some scopes out there for which the existing hack does not quite work?  Unless someone can find a mistake in the above?  The only "nonconforming" thing I've done AFAIK is to use telnet <scope IP> 5555 for entering my SCPI commands instead of installing the Rigol bloat-ware.  Surely that can't make any difference?  People are using the front panel to enter keys successfully too, aren't they?

In case it matters, the key output:

Code: [Select]

RC5KEY1:    82158CF252D2F8EB573A09E3DB176F65
RC5KEY2:    29640D3EB586CF86D65AB36AF88E3BBB
XXTEAKEY:   B759083BEC0B3807D69980B5136E6D94
PUBKEY:     00163745B6A8327B
PRIVKEY:    001B71CCF74A466E
SERIAL:     DS2D154700xxx


[mrflibble]

One thing I noticed when generating a license key for the DSA815... I used rikey_dsa.c from your local friendy mirror and compiled as per the provided instructions.

Then installed license with :SYSTem:LKEY <lic_key> using alex.forencich's python-vxi11 from a quick script. No need for visa bloatware or windoze.

Anyways, the thing to be aware of: the keys that rikey_dsa spits out have minus characters '-' in it. You have to remove those for that :SYSTem:LKEY <lic_key> scpi command.

I don't have my 1074Z yet (hopefully monday! @_@), so cannot comment on that. But just in case some of you run into something as silly as minus characters messing up the key installation.

[Mike G]

Just a quick update.  My DS1074Z arrived midday, entered the key and now have a nice 1104 with everything other than the 500uV range.  I am a very happy bunny   
I read in the thread that you couldn't enter during the trial period but in my case this wasn't so, it went in without a problem.  Thanks everyone for the info in this lengthy thread.

[BTO]

Hello Guys, I'm new to the forum

Just bought My Rigol DS2072A 70MHz Scope about 3 days ago

Recently Discovered that i can upgrade My Scope to 200MHz, Possibly even 300MHz.

I have read the entire threads Post's (Wow, to say the least), I've noticed that a lot of info is everywhere.

i would love to thank Cybernet for all his Hard Work
i would Like to thank Dave from EEV Blog
and everyone else that contributed to the reverse engineering of this.

Now. FOR EVERYONE IN MY POSITION WHO OWNS A RIGOL DS2037A

I'll Sum it up for you


1. I don't have an Actual Solution Just yet
2. this is what you need to do step by step

1. Buy the Scope
2. Ensure you have the latest Firmware Installed
3. Obtain Your Scopes Firmware Details by doing the following (And Post it to the forum if you need to ask a question

in your scope Press the "UTILITY" Button that is located at the top of the scope
Now.. Select the "SYSTEM" option by pressing the button to the right of the word "SYSTEM"

Now. Select "SYSTEM INFO" but pressing the button to the right of the option.

My Sceen output is as follows

==================================================
Manufacturer :  RIGOL TECHNOLOGIES
Model :             DS2072A
Serial :             DS2D1XXXXXXXX              (this is your serial number, You'll need it Later)
Software Version : 00.02.01
Hardware Version : 2.0

(THIS NEXT PART WONT SHOW UP BUY DEFAULT), if you want to see it there is a way to do it, but i forgot how)
FPGA Version:   SPU 03.01.09
                         WPU 00.07.01
                         CCU  12.29.00
                         MCU   00.005
============================================================

Now that you have your System information handy...
You'll need to know how to input the Unlock key, when the time comes.

Here is how you get to the menu to input the unlock key..

in your scope Press the "UTILITY" Button that is located at the top of the scope
Now.. Select the "OPTIONS" option by pressing the button to the right of the word "OPTIONS" (if you can't see "OPTIONS" find the very bottom blue arrow buttons and scroll down to get the option "OPTIONS")

at this stage you have the option to select "INSTALLED" (if you do, this will show you What options are Trial version and how much time is remaining on them.
this is the section that you want to come back to you , later, to confirm that the upgrade worked
FOR NOW
Select "SETUP"
NOW.. on this screen the top option will be called "EDITOR" if Editor is OFF (Switch it on, by Pressing the button to the right of EDITOR)

NOTE: if at any point the Menu Bar dissappears, You can make it re appear by Pressing the BLUE "MENU" Button at the top of all the other buttons on the right side of the screen

and just a quickie (if the menu thing gets annoying, you can set the time at which the menu will dissapear by  selecting..
"DISPLAY" Button at the top
"MENU DISPLAY"
Select the Amount of "S" (Seconds you wish) or "Infinite"

NOW, back to the point

Under Utility/Options/Setup

Use the "Intensity" Knob, that is located at the very top of the Scope, next to the Blue "MENU" button
turn it to select your character that you need to input
Push the knob in until you get a click, this will select your character

THIS IS THE AREA WHERE YOU INSERT YOUR UNLOCK KEY

Now.. Your first need to get the unlock key

You will need to do this first

1. Plug your scope into Windows  (I'm using Windows 7 Ultimate)
2. Go to Device Manager,  You will notice that Windows will require a Driver for your Scope
   (Emona did not bother to supply a disk,  instead they said to download it from rigol's site,  Which honestly , is a frickin headache)

You really need to download Just 2 Things


1. Rigol's Ultra Sigma Software (it's a big download,  about 500 MB or so)
here's the link for the Rigol 2072A

http://www.rigolna.com/products/digital-oscilloscopes/ds2000a/ds2072a/

You will need to scroll down the page to the part that says "
Software Applications"
you will see a bunch of PDF's that dont look to be of much relevance (BUT THEY ARE)

2. go to the PDF that Says "Ultra Sigma" and open it
You will come to a stupid looking page that looks like you hit a speed hump

you will see this

=====================================================

Download
Thank You For your request

Please click the link below to open/download your chosen resource.
If you see an Error below please hit Refresh.

THEN IN BIG LETTERS under that you will see


ULTRA SIGMA  (you need to click on the Word "ULTRA SIGMA"

Apparently someone at Emona thought this was "Obviously" a Hyperlink  LOL

if your download does not start, You need to register for a free account (it's pretty quick and easy)
after you do that, come back to the download page and repeat the process

Now.. make a cup of coffee and pray to god that if you download the file , that it actually isn't corrupted

i had to try 5 Times, Downloading (yes i have a stable and fast internet connection)
When i went to extract the file the last 2 Archives appeared to be corrupted and i had to re download the whole bloody thing

it will happen eventually,

Since the File is a .zip file, you will need Winzip to Extract it
My advise is.. Make a New folder, Place the file in that folder and extract it, to that folder

This software now needs to be installed
upon download it will be called   Ultra Sigma(PC)Installer_00.01.05.10

when you open it, there will be an application file called "Setup"
Obviously,  Run this file as Administrator and install, as you would any other application.
it takes a while

at about 15 % or so, you will notice that it will install the Driver package (so you don't have to do that seperately)

Once it's all installed
You will have 2 New Icons on your desktop
Ni Max    and
Ultra Sigma

if you open Ultra Sigma
Select USB-TMC
and double click on your Scope's Name

this will bring up a  "SCPI" Command
(now, i'm not sure what to enter here, but.. i do know this part is relevant to the solution)

NOW, THIS IS WHERE I'M UP TO

You need 3 Things to get your Scope Unlocked

1. You serial Number,  as stated above (or.. it's on the sticker on the bottom of your scope)
2. You need to know the OPTIONS Key that you need to use
Here they are (Choose what you wish to unlock)
DS2000 device options:
first character: D = official, V = trial
DSAB - Advanced Triggers
DSAC - I2C, SPI and RS232 Decoders
DSEA - CAN Decoder
DSAE - 56M Memory
DSAJ - 100MHz
DSAS - 200MHz
DSCA - 300MHz
DSHH - all options

You will Most likely want all the options and the highest Bandwidth, therefore
you will want to use   "DSHH"  (Remember this)

3. now, you need to the "PRIVATE KEY"

go to this site
http://riglol.3owl.com/

First Enter the OPTION

Then Your "Serial Number"

Then you need to enter the Private Key  (Now. here's the catch)
According to the forum this is the private key

8EEBD4D04C3771  (for this model of Scope)

and the idea is ....
Enter the OPTION
ENTER your serieal Number
Enter the private key

then click  GENERATE

a new window will open and it will display a Key (this is the Unlock key you need to enter into your Scope AS DESCRIBED ABOVE

and the result should be,  you will find that your Trial Options Are not longer trials but fully licensed and you Bandwidth will either go up to 200 Mhz or 300 MHz  (i think it's 300 MHz)

the thing about the private key is ... (it's private)  LOL

so, thanks to CYBERNET  (READ THIS, IT'S HELPFUL)
http://svn.clifford.at/handicraft/2013/rigol-ds2000-shell/rigol-4in1-keygen.c
and this
http://hackaday.com/2013/07/24/a-keygen-for-the-rigol-2000-series-scopes/

he has issued us this .txt doc
Rigolkey.c

Now. apparently this .txt doc is supposed to be compiled in some way
and then loaded onto a USB stick
and then inserted into the scope upon bootup

Your supposed to Hold down the HELP button and the press the POWER button
then quickly press the Help button twice

and that's supposed to load the firmware from the Stick to unlock your Scope

the other thing is .. You can apparently just enter the number


NOW.. HERE'S MY PROBLEM

AND IF ANYONE CAN HELP, I WOULD GREATLY APPRECIATE IT

Please Note : I have a Rigol DS2072A     Not  DS2072

I'm using this
http://riglol.3owl.com/

in combination with my Serial Number
and i've tried the following Options

DSA9
DSHH

I've tried the following private keys

8EEBD4D04C3771
there was one other
but.. neither one worked

I keep getting the following message

"License is unavailable"    Thus.. it didn't work

Please advise,
what am i doing wrong
What have i overlooked

Thanks ahead of time

Sorry for the length Post
I just thought i would help all the Newbies to the scope out there
and help them overcome the issues i had.

Hope to hear from you guys soon

I would appreciate input from CYBERNET  (he seems to be  "The Man" at this point.

Be Cool Guys,
All Help is greatly appreciated.

[hooverphonique]

you're mixing up procedures for the A and non-A versions.. the combinations you are listing (DS**) are for the non-A only and for use with the riglol site..

for the A model you need to flash a custom firmware to get access to a blob of data that is needed for input to the rigup program in order for it to generate the licenses...

try reading the thread again... or at least the last handful of pages..

[BTO]

I don't know if this is relevant or not,

but, all of my above attempts to enter the key, were done DURING the Trial Period
I have 743 Minutes left to go

i suppose if i don't find a solution in that time
i will repeat everything that i have tried, after the Trial period and advise the forum if it works

further to that, i think i'm just using the incorrect private key, Perhaps.

[BTO]

HELLO hooverphonique
Oh OK
I did notice (of course that some of these entries are a little old and date back to the DS1000 Series, and there was a lot to filter through and decide what was not relevant and what was), I had to piece bits and pieces together and figure it all out.

Now.. i don't mind re reading the whole thing over again
but.. are you referring to that thing that CYBERNET put up about Flashing the Custom Firmware so that when you load it onto the scope the DS2072A will show up as a DS2022

is that what your referring to ?

if so, i then need to build a PC and Load Linux onto it (My linux skills are limited, Probably good enough to Use Basic Shell Commands in Linux, but I'm not  Linux Expert by any means)

the part that confuses me is when we mention the work "compile"

i sort of understand that you need a compiler to (Put together) or "compile" if you will
a script or program
the issue is i don't know how to compile

if it's just an issue of Somehow Getting a .txt file from my PC or from the scope and editing it, using a text editor ... (no worries), i just need to know what line of code to edit

if it's a matter of convert one numbering system to another piece of code,  I'm good with that also

I just need to be pointed in the right direction
i understand the point is not, to hand this to me on a platter,

and in all honesty, i would prefer to learn how this is done
but, at the same time, i would like full access to my scope ASAP

either way, i'm going to go back through the POSTS and read it all again and learn how it was reverse engineered to begin with ,  Reverse engineering is something that i don't understand fully.

so.. What help can you offer me from this point.

thanks

[BTO]

@    hooverphonique

Hey Mate

you had me confused at first

i think i'm on the right track now,
at least that something

thanks for the guidance

I'll keep at it and see where i get to

one problem i have is that most of the download files are no longer at their Download locaitons

anyway, i'll keep at it and when i get a solution i'll post it for other to see.

[mark03]

anyway, i'll keep at it and when i get a solution i'll post it for other to see.

A tutorial already exists:
http://gotroot.ca/rigol/D2072A%20Unlocking%20Guide.pdf
and you should find all of your missing links there too.

[GlassFET]

A tutorial already exists:
http://gotroot.ca/rigol/D2072A%20Unlocking%20Guide.pdf
and you should find all of your missing links there too.

Five of us have used that same guide to upgrade our DS2000A scopes. Worked each time. Just follow the instructions EXACTLY. If you're using a Mac or Linux, borrow a Windows machine to run the prescribed programs. You can always wash your hands and return safely to your Mac or Linux later...

[mark03]

Five of us have used that same guide to upgrade our DS2000A scopes. Worked each time.

...and one has not.  See my post above.

[mark03]

Follow-up to my report earlier today (#3228):

I can now confirm that the code NS8H does not work on my DS2072A.  This is after changing the firmware back to stock (00.02.01.00.03), rebooting, sending :SYSTEM:OPTION:UNINSTALL, rebooting again, and trying the key again.  It simply says "License is unavailable!"

However, upon trying code NSEQ, it worked right away the first time.  Surveying the last few months of posts, it seems like many have had the same experience.  Enough not to dismiss them as mistakes (although I admit I did before now).  There really does seem to be something odd about the 300-MHz option, where it works with some serial #'s and not with others, or it depends on some other variable we haven't controlled.

It would sure be nice to understand what is going on; however, I'm happy to declare victory.  Thanks again! 

[Arkku]

Because I don't have Windows at home, I used Arkku's method on Linux (post #3105).

…

So I went through that process today on a Windows 7 machine, and the proposed license key is exactly the same.  (It is kind of comforting to verify that the two methods for putting together the binary data file---Ruby script and manual hex editing---do in fact match.

Thanks for verifying that, I was worried for a bit that I had messed something up. =)

I updated the Linux/OS X/*nix guide with the suggestion to try NSEQ if NS8H fails.

[BTO]

This is Exellent News, I'm just trying to access the download file at the posted location
https://mega.co.nz/#!FFk10SCY!UuWPXyqZwmca00pa2clOth1ryh1Z-AAgJg2yibfoUw0


However the file is no longer available, where can i get another copy

thanks up front

[hooverphonique]

This is Exellent News, I'm just trying to access the download file at the posted location
https://mega.co.nz/#!FFk10SCY!UuWPXyqZwmca00pa2clOth1ryh1Z-AAgJg2yibfoUw0


However the file is no longer available, where can i get another copy

thanks up front

the required files should be available at gotroot.ca/rigol

[hooverphonique]

I'm considering using the patched firmware to get my scope options licensed as my scope still won't accept any license keys anymore...

Am I correct in saying that the patched firmware is actually a fw for the non-A version, patched to run on the A version, accepting the non-A licenses generated by riglol? will the licenses stay on the scope after reverting back to the original 02.01.00.03 firmware? Are there any downsides to using this approach compared to using the rigup way?

[mrflibble]

I'm considering using the patched firmware to get my scope options licensed as my scope still won't accept any license keys anymore...

Am I correct in saying that the patched firmware is actually a fw for the non-A version, patched to run on the A version, accepting the non-A licenses generated by riglol? will the licenses stay on the scope after reverting back to the original 02.01.00.03 firmware? Are there any downsides to using this approach compared to using the rigup way?

As in I think it went like this: rigol original firmware DS2072A ==> creative person => patched firmware to be used on DS2072A.

Anyways, the SOLE purpose of the patched firmware is to extract the private key on a DS2072A. Once you have the priv key, you can restore everything to factory original by restoring original firmware.

After that you have your paws on the private key, plonk that into your favorite keygen to generate license keys. Those license keys should then be viable for a DS2072A with original firmware and also viable for a DS2072A with patched firmware.

Again, once you have the private key for your particular scope you can use rigol original firmware.

And the big-ass disclaimer is that I don't own a DS2072A, but try more or less to keep up with this thread.

[hooverphonique]

Anyways, the SOLE purpose of the patched firmware is to extract the private key on a DS2072A. Once you have the priv key, you can restore everything to factory original by restoring original firmware.

After that you have your paws on the private key, plonk that into your favorite keygen to generate license keys. Those license keys should then be viable for a DS2072A with original firmware and also viable for a DS2072A with patched firmware.

Again, once you have the private key for your particular scope you can use rigol original firmware.

And the big-ass disclaimer is that I don't own a DS2072A, but try more or less to keep up with this thread.

thanks for that, but that's the procedure that doesn't work for me (read my posts from earlier this week)..
I was referring to the firmware on gotroot.ca/rigol by the name of "(patched)", not the license dump one..

[Arkku]

Am I correct in saying that the patched firmware is actually a fw for the non-A version, patched to run on the A version, accepting the non-A licenses generated by riglol? will the licenses stay on the scope after reverting back to the original 02.01.00.03 firmware? Are there any downsides to using this approach compared to using the rigup way?

AFAIK there are two patched firmwares, both modified from the A-version firmware:

1) License keys dump firmware
2) A-version firmware that accepts non-A-keys

The first one is used to generate valid A-version license keys, which continue to work on official (non-patched) firmware versions. The second one is used to circumvent the need for A-version keys on that firmware version only. The former is obviously better since the keys will work on official firmware as well, whereas it seems to me that the latter needs someone to patch every new firmware version.

[icaro600]

Hi there, I,m recently discovered this impresive forum, and it is one of the best forums about electronics  I even seen, so congratulations for your job.
My post is because I, thinking about to buy a Rigol DS1074Z, and my question is if the keygen fror DS2000 could be valid also for this DSO, or if there is someone who is working on it.

Thanks

Icaro