Hacking the Rigol DHO800/900 Scope

[iMo]

After so many new hacks and improvements the Rigol's developers r(certainly reading this thread) would perhaps issue a new firmware version soon.. 

[norbert.kiszka]

After so many new hacks and improvements the Rigol's developers r(certainly reading this thread) would perhaps issue a new firmware version soon.. 

I don't think so. Rigol company is very bad in my eyes. Especially with bode plot bug which makes it unusable. That's the last product I purchased from Rigol. Never ever more.

[Fungus]

Sorry new to this so not really getting it. If the SD card fails how do I rebuild one with a firmware release? My understanding is that the scope will not boot without the SD card, so I am under the impression that in this event I could not use the scope menu to install new firmware on a blank card as it would not start up. Assuming I had a backup of my original vendor.bin and RKey.data, a firmware release, and a blank 32Gb uSD card, how could I get it going again please?

Download the image in the first post of this thread. Put it on an SD card. Start 'scope.

Install latest firmware. Copy your files to it.

[norbert.kiszka]

Who told that sinc interpolation can't be hacked on those series?

[shapirus]

Who told that sinc interpolation can't be hacked on those series?

It sounds like you might be getting close to enabling dot display mode... :)

[norbert.kiszka]

Who told that sinc interpolation can't be hacked on those series?

It sounds like you might be getting close to enabling dot display mode...

Nah... Image is generated by FPGA. Interpolation is managed by library which app uses - I hacked that thing only. Im not sure if hacking FPGA is worth of time.

[mrisco]

Who told that sinc interpolation can't be hacked on those series?

Can be combined with:

[norbert.kiszka]

Who told that sinc interpolation can't be hacked on those series?

Can be combined with:

Show me the same thing with sqare wave generator with fast rising time. We will know if that points are interpolated or not.

[mrisco]

Show me the same thing with sqare wave generator with fast rising time. We will know if that points are interpolated or not.

It is interpolated by sure, that is why I said we should combine your mod with the dot display.

[norbert.kiszka]

Show me the same thing with sqare wave generator with fast rising time. We will know if that points are interpolated or not.

It is interpolated by sure, that is why I said we should combine your mod with the dot display.

Knowing where line breaks, we know where are exact samples. In case of software, we just need to find at least one (probably the first data from the FPGA, but who knows?), because all other are in exact same "distance".

[gf]

Who told that sinc interpolation can't be hacked on those series?

There is one thing I don't understand. The screenshot says 1.25GSa/s and 800ps/point, but in the plot, the horizontal spacing of the points that are connected by straight line segments is more in the order of ~5ns.

[norbert.kiszka]

Who told that sinc interpolation can't be hacked on those series?

There is one thing I don't understand. The screenshot says 1.25GSa/s and 800ps/point, but in the plot, the horizontal spacing of the points that are connected by straight line segments is more in the order of ~5ns.

App makes some calculations and sends data to the FPGA, which then it generates image of the waveform and sends it back to the app. I changed data that is going to FPGA. Horizontal scale is different from reality, but the waveform shape is 100% correct.

BTW. in that scenario, it's funny when I try to move waveform horizontally with a knob, because waveform moves faster than pointers of trigger point.

[norbert.kiszka]

Finally I figured it out. It still needs some work tho.

I don't have source code of this app, so all my work is done with deassembled and decompiled code which is very hard to read and understand.

Anyway, I know how to change sample rate in app, but to make it fully work, I need to do one more thing, however I decided to remove sinc interpolation, which was looking as a much easier thing to do.

[ceut]

Hello,
I have finally bought the DHO804 (calibration date = december 2024).

Many problems with it 

I find it really very noisy

The delta PSU doesn't always give me the red button light, whereas a DELL Laptop USB-C 65W PSU is working great.
Also, sometimes: with the delta PSU: I have a problem with the HDMI port.

Many items seems not to be saved after a reboot/shutdown like brightness, zoom on click ...

Also, I have strange things with all physical buttons:
=>I have some "bounce" effect (sorry, don't know how it is called in english ):
Many times, when I push a button: it makes 2 activations (or more) and open then instantaneously close the window.
(it is like a mouse-click switch failure).

I don't know if it is a problem of my model, or if there is something to do to fix this ?
(I have updated to the last 1.04 and same problem)

Also, I have tried to install @AndyBig firmware, but without any success.
=>From 1.04 version: after the first "adb uninstall com.rigol.scope" : the DHO804 reboots and the 1.03 version is came back.
So I have put another "adb uninstall com.rigol.scope": but "FAILURE [DELETE_FAILED_INTERNAL_ERROR]": it reboots again and came back the 1.03 FW.
Of course, the "adb install -g -r Sparrow_a008_u.apk" doesn't work as there is already the original APK inside (invalid signature message).

I have made 2 backups about everything from ADB and TotalCommander plugin  (including all the rigol folder with all *.hex files): one after unboxing it with the 1.03 and one after updated it to 1.04 and selfcal made.

I have not made any "hack" inside it (I have my genuine vendor.bin file on my computer).

So I think I will send it back.


Thanks for any help you could provide me 

[norbert.kiszka]

I have finally bought the DHO804

From which seller? Aliexpress, Banggood or Amazon?

[ceut]

I have finally bought the DHO804

From which seller? Aliexpress, Banggood or Amazon?

Forget to tell that 
Amazon (it is Rigol EU marketplace, and I have had invoice from RIGOL too )
(I was about buying it from Eleshop, but the price was lower on Amazon).

Brand new, with 3 boxes: the external brown one from Amazon, then a brown one from RIGOL and inside the white one.

[norbert.kiszka]

I think that three resellers are selling those scopes with some problems. I bought mine DHO924S from authorized reseller and I don't have problems (beside of very very rarely hangs up or sd card socket is not always connecting properly - which many people has this problem). Yes, I payed much more than from those three, but I prefer to have something that works more or less correctly (if anybody can say that about those series...) and at least 99.9% of the time.

[ceut]

I think that three resellers are selling those scopes with some problems. I bought mine DHO924S from authorized reseller and I don't have problems (beside of very very rarely hangs up or sd card socket is not always connecting properly - which many people has this problem). Yes, I payed much more than from those three, but I prefer to have something that works more or less correctly (if anybody can say that about those series...) and at least 99.9% of the time.

For the MicroSD socket : on mine they have put a big big black tape on it: I can't see it, or access to it at all.

So you think that Amazon with RIGOL Market place could have problems too ?
(I would never buy tools like this at this price on aliexpress or banggood )

You have bought yours from which seller ?
Usually I buy from Eleshop/Weletron.

[norbert.kiszka]

There is one authorised reseller in Poland and that's NDN.

https://ndn.com.pl/pl/12_rigol

Anyway Im disgusted because of software bugs and lack of support or even any contact from Rigol at all. Also they promised that they will maintain license terms of software that they used (and they used a lot of GPL code) but they failed miserably.

Only upside is hackability. But if You know assembly, then You can hack it whatever You like, including doing Your own software for the scope.

[ceut]

There is one authorised reseller in Poland and that's NDN.

https://ndn.com.pl/pl/12_rigol

Anyway Im disgusted because of software bugs and lack of support or even any contact from Rigol at all. Also they promised that they will maintain license terms of software that they used (and they used a lot of GPL code) but they failed miserably.

Only upside is hackability. But if You know assembly, then You can hack it whatever You like, including doing Your own software for the scope.

Agree with you 
So I end up with it and send it back for refund.

[RAPo]

Great. Is there a way you and AndyBig could team up and make a version that is the best of both worlds?

Finally I figured it out. It still needs some work tho.

I don't have source code of this app, so all my work is done with deassembled and decompiled code which is very hard to read and understand.

Anyway, I know how to change sample rate in app, but to make it fully work, I need to do one more thing, however I decided to remove sinc interpolation, which was looking much easier thing to do.

[norbert.kiszka]

Great. Is there a way you and AndyBig could team up and make a version that is the best of both worlds?

Finally I figured it out. It still needs some work tho.

I don't have source code of this app, so all my work is done with deassembled and decompiled code which is very hard to read and understand.

Anyway, I know how to change sample rate in app, but to make it fully work, I need to do one more thing, however I decided to remove sinc interpolation, which was looking much easier thing to do.

Im not sure about that idea.

Anyway, Im going further with changes. With my overclocking tests, maximal sample rate that is stable is 1.8 G. However, that gives 555.(5) ps per sample, which is not great ("not great, not terrible"). I had tough decision between 1.6 G (625 ps) and 1.666(6) G (600 ps). I decided for second one (speeeeed).

However, with that sample rate, maximum memory depth is 20 k, because Rigol didn't used fastest DDR3 chip for FPGA.

[norbert.kiszka]

Finally I released it. However I decided to put sample rate back to original, because it needs much much more work to be done and in most cases it requires limiting memory depth to around 20 k for all channels, unless I figure something else.

IMHO 125 M points is more useful in most cases than sample rate like 1.6 G or 1.8 G.

https://odysee.com/@norbert.kiszka:6/dho924s_extended_v0.0.1:0

• Removed sinc interpolation (no interpolation at all - just straight lines from sample to sample).
• No bandwidth limit (About 1 GHz after removing LC filters between AFE and ADC).
• Horizontal scale down to 800 ps / div (one div per sample).

Software options from DHO4000:

• I2S trigger / decode
• CAN-FD trigger / decode
• Flexray decode
• MIL-STD-1553 trigger / decode

No need to change vendor.bin or anything like that. It will ignore if You have options enabled or not. All scopes of this series will have full bandwidth and options out of the box.

Power analysis is not working yet, but option is visible in Utility -> Options.

This is alpha/demo so there is a memory depth limit of 5 M. Further version will have 125 M (yes, that's possible on DHO800 since it has same DDR3 chip for FPGA).

Version: v0.0.1.

Compatible only with 1.04.00.02 firmware.

https://www.patreon.com/NorbertKiszka/shop/rigol-dho800-900-sparrow-extended-v0-0-1-1632964

[agaelema]

The options show "Power Analysis". It works?

[norbert.kiszka]

The options show "Power Analysis". It works?

Power analysis is not working yet, but option is visible in Utility -> Options.

It can be enabled (from "start" menu) after small change in app, but it displays empty measurement results - at least on my scope. That's why I published it with this option not visible in start menu.

I decided to put this fix on later. Currently Im working on other changes, like better UI and memory depth 125 M (62.5 M for two channels and 31.25 M for 3&4 channels).

I think UPA (power analysis) will be the next one.

Maybe this will be easy fix or maybe it will be a huge rabbit hole. I experienced both at reverse engineering and hacking or even with physically modifying my scope (not related to software).

Maybe also I will do sample rate around 1.5 G if all tests will be ok. It works up to 1.8 G but only if memory depth is limited to 20 k (it can be as a separate app) and noise is little bigger (currently I don't remember how much), because analog path has not very best shielding and ground rail (that explains why they limited bandwidth to the 250 M with LC filters, which can be done also by changing ADC flags, since it has built in filters).

Theoretically switching (real) sample rate by app (without reinstalling every time) is possible, but that's another story. Im not sure how many people will want that option (personally I do), because it will take huge amount of time to do that.

In future, I want to do my own app from scratch, since modification of existing one is time consuming - especially because I don't have source code or detailed documentation.