started dumping memory via JTAG on the DG4000 - no probs at all exact same layout as the DS2000's JTAG - aux 3,3V can be stolen from the header next to it if needed for jtag adapter.
My now that I'm finished working on my truck (10 days in Arizona summer), maybe I can finally play with the DG4000.
unless this is already public knowledge while looking for a way to change the model type, i stumbled over the secure code which is "
2010" - this will enable the Test/Cal Submenu on the DG4062/FW 00.01.04
Here are links to
DG4062 firmware (.GEL files), in case it is helpful to this effort
00.01.04.00.02 (date: 6/13/2012)
00.01.06.00.02 (date: 5/9/2013)
cybernet; thank you. Just in general, thank you. I appreciate you sharing the benefits of your curiosity.
-jbl
No didn't know that, thanks! good to know in case it's needed.
It works on my DG4102. (I have the same version 00.01.06.00.02)
The only extra thing I know so far (from this forum) was this extra version number info by pressing the first third and fifth side button in the version screen.
anyone with a
200Mhz DG4
062 ?
this is has been done with jtag hackery, because im too lazy to reverse yet another piece of their cryptobs.
the way it works is that u place a file <something>.CEN which needs to contain a special header, and then some crypted bits and pieces, which will then update the model type.
the message says it updated model type & serial - but i dont see that happening atm it only gets passed the new model type - by forging the right jump and tweaking the arguments of the sub (e.g. string to new model type) a bit .. you can enabled whatever u like - and yes it sticks - i went for a DG4202 ;-) ... also tried a DG4162 - and there are more
you need to have a jtag adapter to do this, and u need to open the devicecalibration is obviously off above 60Mhz (vpp, freq is fine) - time to play with the cal menu.
FW 0.4 models:ROM:CB1924 aDg4052_0: ascii "DG4052",0
ROM:CB192C aDg4062_5: ascii "DG4062",0
ROM:CB1934 aDg4072_1: ascii "DG4072",0
ROM:CB193C aDg4102_0: ascii "DG4102",0
ROM:CB1944 aDg4162_0: ascii "DG4162",0
ROM:CB194C aDg4072e_0: ascii "DG4072E",0
ROM:CB1954 aDg4202_0: ascii "DG4202",0
ROM:CB195C aDg4072a_0: ascii "DG4072A",0
ROM:CB1964 aDg4102a_0: ascii "DG4102A",0
ROM:CB196C aDg4162a_0: ascii "DG4162A",0
ROM:CB1974 aDg4202a_0: ascii "DG4202A",0
ROM:CB197C aDg4102e_0: ascii "DG4102E",0
did a fw upgrade to 0.6 afterwards, model type sticks
Were you also able to measure if the rise/fall time changed after you changed your 60MHz to 160/200MHz?
If it takes the information from a file you provide, it sounds like it could be possible to update the model through a hidden menu with a crypto-signed file on a USB stick. (I don't know, I haven't looked through the firmware.)
Were you also able to measure if the rise/fall time changed after you changed your 60MHz to 160/200MHz?
only got my DS2062 erm 2202 ;-) - sine wave looks good, but amplitude drops after 60mhz, i played with the call thingy, and probably need some true rms voltmeter to correct it.
the way it works that u go over the items one by one, and input the measured values, then save the results ... "LOAD" is the one thats for the output regulation.
for me its not super important because im more after quick arb and rect than sine stuff ..
If it takes the information from a file you provide, it sounds like it could be possible to update the model through a hidden menu with a crypto-signed file on a USB stick. (I don't know, I haven't looked through the firmware.)
true, u can do that - and u can add calibrations, and it seems u can even replace the builtin arb tables ;-)
Once I get time to play with my DG4000, I can put it on my HP 5335A 200Mhz counter (with Rubidium reference) to check rise/fall/amplitude.
Once I get time to play with my DG4000, I can put it on my HP 5335A 200Mhz counter (with Rubidium reference) to check rise/fall/amplitude.
PM3082 (CRO) and DS2 show slightly below 5ns risetime/falltime for a 50mhz square wave
Im not a Rigol fan, but coudnt help notice that the FW is 9.7MB?
the Instek GDS-3352 is 18MB.
Bananas vs. Apples jajajaja
Once I get time to play with my DG4000, I can put it on my HP 5335A 200Mhz counter (with Rubidium reference) to check rise/fall/amplitude.
PM3082 (CRO) and DS2 show slightly below 5ns risetime/falltime for a 50mhz square wave
Will your "DG4202" go a bit higher in frequency limit than the 4162 in the square (50MHz), ramp (4MHz), pulse 40MHz) and harmonic (80MHz) modes ?
Will your "DG4202" go a bit higher in frequency limit than the 4162 in the square (50MHz), ramp (4MHz), pulse 40MHz) and harmonic (80MHz) modes ?
my DG4202
sine: 200M
square: 50M
ramp: 5M
pulse: 50M
harmonic: 100M
arb: 50M
vs DG4162 (acc. batronix homepage):
sine: 160M
square: 50M
pulse: 40M
ramp: 4M
harmonic: 80M
arb: 40M
so its an improvment id say
the model set routine copies a ton of values to non volatile memory, that determines the limits. manual tweaking probably doable to increase it even further, but i lack
the equipment to judge whats then outputted in terms of quality
Gee whiz, that's amazing. nicely done.
Nice work Cybernet!
Attached is the latest firmware (00.01.07.00.03)
Nice work Cybernet!
Attached is the latest firmware (00.01.07.00.03)
thx (yet another update, wow) - if someone is willing to look into the algo and how to reverse it let me know via PM. my holidays are over so got to do some real work the next weeks ;/
Nice work Cybernet!
Attached is the latest firmware (00.01.07.00.03)
This file gives an error when trying to extract? (only empty folders)
edit: it does work with 7zip, not with winRAR or Windows 7 zip, Thanks for sharing
So, I have decided to purchase the Rigol DG4062, and would like to know if it is hackable up to the 4102/4162.
Thanks.
I guess it will be much better you join the huge thread
Sniffing the Rigol's internal I2C bus, be prepared to crack open your scope, dump the firmware and post it there too, hopefully it will get "fixed" sooner rather than posting another new thread solely just for you.
Just a suggestion.