Hacking the Rigol DHO800/900 Scope

[norbert.kiszka]

The problem is, from those screenshots, I cannot tell much about the signal, which is supposed to be the whole point of the oscilloscope. There is either no triggering, or the timebase is set incorrectly, is it supposed to be a square wave?

This is a square wave with frequency of 12 MHz from quartz. This scope for the all measurements originally uses data not directly from ADC, but somewhere from the middle of the screen processing. That's exactly why I set time base to 50 us / D.

the spectrum view is difficult to use

Waveform and "Peak Search" windows can be closed - then You have full screen width (minus literally two pixels) for the FFT.

I changed settings of the FFT to cover full sample rate.

And no need to have four significant digits

For some that can be very useful. Adding another setting for this is time consuming, especially when there is no source code. Beside of making hundreds of not very useful settings that later You need to scroll just to forget of what You where looking for...

One other thing - the peak search table could be reduced in size, to (say) default to just 4 values, that's usually more than enough to see your fundamental and the first few harmonics, and people could then choose to view more if they wanted (or have a scroll bar for that, so only the first few are visible). A smaller table would allow that spectrum view to become larger. Also minor thing, but the style of that table looks very out of place compared to the rest of the screenshot.

Currently Im working with compiled binaries (with some tools) instead of source code as it should be. You can ask Rigol for files with source code - likely they will ignore You and You will get no response at all - don't ask why I know that.

I can do whole (much better) scope software from scratch based on current knowledge and little bit more of reverse engineering, but that will take months to complete anything useful. As for now, I don't see too much people running to support me with that.

[shabaz]

Thanks for the detailed response. I didn't know the extent of what was feasible or practical in a reasonable timeframe, but now it's clearer. In any case, the spectrum full screen option that you mention probably helps a lot.

[mrisco]

You could get the frequency values of the peaks using an external application, as shown in the video taken from the screen of a DHO804:

[disago]

@norbert.kiszka I installed the v0.2 normal edition of your firmware and its working well on my DHO814 (I used the installation script that worked perfectly on the first try). My main motivation was the increased memory length (125M from 50M!!). Initially I though something was wrong because the upper icons were squished, but then I noticed from your screenshots that it was expected as a measure to save screen space and difficulty editing the android app assets, and that's OK (I can only image the effort and headaches that came from modifying the app without the source code!  ).

So far almost everything is working well. The only thing that I can´t do is to access the Rigol web control: I have already removed and added the connection and I can ping the oscilloscope, but the web connection is refused (already rebooted many times, take out the dongle, reconfigure WiFi at Android level, but nothing). Did you experience anything related?

@mrisco I can see that you created an improved UI for the original firmware. Just to confirm: it is totally a different project from norbert.kiszka, right?

[Fungus]

@mrisco I can see that you created an improved UI for the original firmware. Just to confirm: it is totally a different project from norbert.kiszka, right?

Yes.

There's now three different ones to choose from...

[mrisco]

@mrisco I can see that you created an improved UI for the original firmware. Just to confirm: it is totally a different project from norbert.kiszka, right?

Yes, it is different:

[norbert.kiszka]

@norbert.kiszka I installed the v0.2 normal edition of your firmware and its working well on my DHO814

Good to know. Smallest information about problems or no problems at all are valuable to me, since this is no longer an experiment. With tools which Im using to do this, any information can save me many days of work. Especially with the DHO800 series - I have DHO924S, not any 800. I bought it little bit by accident, because I didn't have too much time to chose back then.

I used the installation script that worked perfectly on the first try

One week of work to make it possible to run on a cheapest toaster Probably it will also work on a Android, but I didn't make such a test yet.

Initially I though something was wrong because the upper icons were squished, but then I noticed from your screenshots that it was expected as a measure to save screen space and difficulty editing the android app assets, and that's OK (I can only image the effort and headaches that came from modifying the app without the source code!  ).

With the source code, some changes that I made, should be done in like 5 minutes (including 4 m 30 sec for coffee) instead of 5 hours or more... Since scope is using a lot of GPL licensed code that requires to give source code for anybody who asks for it, I asked Rigol only for a kernel with modules. They made a promise for that in attached document (which You can read directly from the app) and yet they ignored me from top to bottom. That didn't stop me from making my own Linux kernel with the drivers for their own chips

Rigol deliberately made this scope much much worse than it is in reality, because they have better money from You, when You buy any higher model. Im 100% sure that Rigol owners don't have completely any knowledge about software engineering and they struggle when they need to find one button to turn on a computer or to make a call with the phone. Sadly it's typical with the other test equipment and many other things.

Speaking of, there was (still is) widely known in the world case in my country, where one of the biggest train manufacturers, made a "protection" that prevents from servicing it in other places than owned by them. And they did some code that disables engines when there are days and months after some year (likely their software "engineers" didn't know how to lock the train after given date - even worse job than that done by Rigol). And some Polish software hackers was called and they reverse engineered those trains I wish that was me, but who am I if I only reverse engineered couple airliners with the cigarette in my mouth at one of the world biggest airports? Speaking of, that font that I used for the boot logo for the scope, was made by Airbus and they used it on the screens that pilots use in flight decks to make You safer - even by making their own font (sadly they made some simple mistakes around redundancy in FBW computers...).

Even with the source code, Android is more like a toy, than operating system. If Android is based around (modified) Linux kernel and it's safer and (as they say...) and more efficient than regular Linux/GNU, then why most expensive data centers (including Google which maintains Android) use "regular" Linux instead?

After countless hours (read: moths) spent on reverse engineering this thing, I have enough knowledge to start making this app from scratch (maybe with the original lib at the beginning) and with a Debian based system that I already did for this scope. At the beginning that will require a lot of time, but later it will save much more of time and bugs that are almost impossible to fix without the source code. There is a lot of owners of those series, but without support, it's very difficult.

Later it should be easy to port this for the Android, because my plan for the UI is very simple - open source API, HTML, CSS and JavaScript (app in the background and browser as the UI and endpoint for the video stream with waveform), so You can make or modify Your own layout very easily without learning low level programming.

Speaking of reverse engineering. Anybody has reeeaaallyy faaaaast scope to borrow? I did a properly working 2 Gsa/s without even overclocking anything, but I don't have proper scope (or at least spectrum analyzer with enough bandwidth) to check PLL with the 2.5 GHz signal - see attached screenshot. Or maybe used DDR chip is too slow, I don't know.

The only thing that I can´t do is to access the Rigol web control: I have already removed and added the connection and I can ping the oscilloscope, but the web connection is refused (already rebooted many times, take out the dongle, reconfigure WiFi at Android level, but nothing). Did you experience anything related?

Yeah... When I was releasing v0.2 I was thinking if it will be that problem or not - at some point it was but later it wasn't. Scope application in reality is made as a three separate apps - one You see on the scope screen, one is managing buttons & leds on the front and one is a web page server. Likely one of those called webcontrol is not executed at boot 

But nothing is lost. If that wasn't started at boot, You can start it manually:

Code: [Select]

adb shell am start com.rigol.webcontrol/.MainActivity
Later I will look what mistake I did, that can prevent it from start at a boot. And I will make an update.

Just to confirm: it is totally a different project from norbert.kiszka, right?

Pretty much separate. Likely also incompatible - at least for the memory depth options, since I changed a lot in this area.

There's now three different ones to choose from...

When people don't have choice, they complain. If there is a choice, they complain. You can do Your own, at there will be four to chose from.

[disago]

@mrisco thank you for your reply. Nice work on that UI!

It's always nice when the hacking community grows around a product: it's more fun and gives more options to everybody and a few shots to begin a hacking journey to newcomers. The downside is if the manufacturer is not open to alternative implementations it can get rough and a lot of work can go wasted in the next update: that is always a risk to invest knowledge and work in a closed platform or ecosystem.

@norbert.kiszka thank you for your suggestion, it worked and provided the web access. Maybe it has something to do with sending the command "am start com.rigol.webcontrol/.MainActivity" to the background. Once I changed line 64 of start_rigol_app.sh it is starting normally every time. The change was only to remove the background operator "&":

Code: [Select]

am start com.rigol.webcontrol/.MainActivity &
to

Code: [Select]

am start com.rigol.webcontrol/.MainActivity

In another topic: I noticed that the WiFi dongle doesn´t connect automatically after the scope is rebooted ("Reboot" option), but it works correctly on the first power on and if its power-cycled. When rebooted, the Android WiFi management shows the connection as "Disabled", if I force it to connect, then it works. I don't know if this happened with the stock firmware.

Regarding the whole-rewrite of the software you should definitely calculate the effort required. Not just the initial version, but the maintenance. It can become such a burden of expectations and work. As a personal project it might be a lot of fun but the community support might not be there.

[norbert.kiszka]

I figured out primary cause of webcontrol not starting automatically at boot and a proper fix. That's why I hate Android...

It's just this:

Code: [Select]

adb shell pm install -r --user 0 /rigol/app/Webcontrol.apk
I updated this in the published package (script) without changing version number.

[dzebrys]

(1) Opened up the scope, peeled back the black tape and removed the uSD card. Put that in a card reader and used HDD Raw Copy Tool to make a backup image of the original factory supplied card. This came with Firmware 1.03. The original uSD card in the scope was a Lexar 32GB V10 633x

could you please check what is the uSD card size in bytes reported by OS?
i've the scope with same card and i'm unable to restore backup from this link
https://www.eevblog.org/files/RigolDHO800-SDcard-dump.zip as the size of card
is lower: 31,299,993,600 instead of required 31,719,424,000 bytes.

could you share your backup with me?

br/Piotr

[AndyBig]

could you please check what is the uSD card size in bytes reported by OS?

Exactly 31 719 424 000 bytes

[dzebrys]

thanks AndyBig but this question was specifically to @pict as he had issue with booting scope after removing uSD card for backup.
i'm in the same situation now and TSG what's going on. certainly my Lexar 32GB is reporting 400MB/819200 sectors less than normal:

Code: [Select]

Disk /dev/mmcblk0: 29.15 GiB, 31299993600 bytes, 61132800 sectors
if anyone uses custom uSD card which is working fine with this scope please share, i likely need to buy a replacement.

[norbert.kiszka]

For some reasons so called U-Boot (first thing that CPU reads) has problems with other SD cards - at least on my scope. But those SD cards are manufactured in the same way within same brand and model. So if You buy same card or same model with size 64 GB it should work. Lexar brand is probably the cheapest one.

[dzebrys]

the question is why my scope behave differently than most others and uboot expose uSD card as mmcblk0 device instead mmcblk1 as for others. do u have any clue?

[norbert.kiszka]

the question is why my scope behave differently than most others and uboot expose uSD card as mmcblk0 device instead mmcblk1 as for others. do u have any clue?

I think we already talk about it. mmcblk0 instead of mmcblk1 was caused by a sinlge change in the Device Tree in which first MMC port was disabled. If both are enabled, kernel reserves 0 for the first MMC memory, which is not connected, but second one is connected to SD card and that's why more or less everybody has mmcblk1 and You had mmcblk0.

Check how it is currently after installed v0.2:

Code: [Select]

ls /dev/block/

[pict]

(1) Opened up the scope, peeled back the black tape and removed the uSD card. Put that in a card reader and used HDD Raw Copy Tool to make a backup image of the original factory supplied card. This came with Firmware 1.03. The original uSD card in the scope was a Lexar 32GB V10 633x

could you please check what is the uSD card size in bytes reported by OS?
i've the scope with same card and i'm unable to restore backup from this link
https://www.eevblog.org/files/RigolDHO800-SDcard-dump.zip as the size of card
is lower: 31,299,993,600 instead of required 31,719,424,000 bytes.

could you share your backup with me?

br/Piotr

The Lexar cards that worked for me (V10 633x 32GB) report as 31,706,841,088 bytes capacity (29.5GB) when formatted FAT32. HDD Raw Copy Tool reports the card as LBA 61,952,000 - 31.71GB

This is the Amazon link to the cards I bought that worked. They are identical to the card supplied with the scope:
https://www.amazon.ca/dp/B094866JD3

PM me your email and I can send you my original image when I have access to the PC they are on (away at work currently).

[norbert.kiszka]

The Lexar cards that worked for me (V10 633x 32GB) report as 31,706,841,088 bytes capacity (29.5GB) when formatted FAT32. HDD Raw Copy Tool reports the card as LBA 61,952,000 - 31.71GB

This is the Amazon link to the cards I bought that worked. They are identical to the card supplied with the scope:
https://www.amazon.ca/dp/B094866JD3

PM me your email and I can send you my original image when I have access to the PC they are on (away at work currently).

Actually, file system internal capacity is always lower than actual size of the physical device (SD card in this case). So what are You talking about?

Every 32 GB SD card has 31 719 424 000 bytes capacity. Doesn't matter if that is Lexar, Samsung, SanDisk or anything else.

Windows and closed source software working only for Windows are highly unreliable. I learned this by myself in a hard way - about 20 years ago. Currently I don't have Windows on any of my computers.

And how You gonna send sd card image with an email? Xzipped image takes about 564 MiB. Email attachments are encoded, because You can't send binary data (without encoding it) within email messages - that increases size to at least 150% of original file.

[mrisco]

Every 32 GB SD card has 31 719 424 000 bytes capacity. Doesn't matter if that is Lexar, Samsung, SanDisk or anything else.

I'm not sure about that, I got several 32GB cards to make the backup and found slightly differences of some sectors between brands, my backup was a hardware level. I was able to restore the backup on cards with identical size, and in cards with larger size but in the lastest some correction was needed, I don't remember exactly but a password dialog was popup, the password was empty, after that all was normal.

Here is a table that can help clarify these differences (from: https://forums.raspberrypi.com/viewtopic.php?t=371242)

Code: [Select]

SD Card Info Capacity GiB Capacity GB "Vendor"
SanDisk Ultra (32GB) 29.72 31.91 Manufacturer: SanDisk - Model: ACLCD - Vendor: SD - Product: SD - HW Version: 0x8 - FW Version: 0x0 - Date Manufactured: 04/2017 - Class: A1 Class 10
Kingston (32GB - 25MHz) 28.86 30.99 Manufacturer: Phison - Model: SD32G - Vendor: PH - Product: SD - HW Version: 0x6 - FW Version: 0x0 - Date Manufactured: 08/2021 - Class: A1 Class 10 V10 U1
KIOXIA EXCERIA (32GB) 28.85 30.98 Manufacturer: Toshiba - Model: SA32G - Vendor: TM - Product: SD - HW Version: 0x7 - FW Version: 0x0 - Date Manufactured: 02/2020 - Class: A1 Class 10 V10 U1
Samsung EVO Plus (32GB) 29.81 32.01 Manufacturer: Samsung - Model: EB1QT - Vendor: SM - Product: SD - HW Version: 0x3 - FW Version: 0x0 - Date Manufactured: 02/2021 - Class: Class 10 U1
SanDisk MAX (32GB) 29.72 31.91 Manufacturer: SanDisk - Model: SH32G - Vendor: SD - Product: SD - HW Version: 0x8 - FW Version: 0x0 - Date Manufactured: 01/2022 - Class: A2 Class 10 V30 U3
Transcend (32GB) 28.33 30.42 Manufacturer: Transcend - Model: USDU1 - Vendor: J` - Product: SD - HW Version: 0x2 - FW Version: 0x0 - Date Manufactured: 01/2021 - Class: A1 Class 10 V10 U1
Samsung EVO (32GB) 29.81 32.01 Manufacturer: Samsung - Model: GB1QT - Vendor: SM - Product: SD - HW Version: 0x3 - FW Version: 0x0 - Date Manufactured: 06/2020 - Class: Class 10
Samsung PRO (32GB) 29.81 32.01 Manufacturer: Samsung - Model: JB1RT - Vendor: SM - Product: SD - HW Version: 0x3 - FW Version: 0x0 - Date Manufactured: 11/2021 - Class: Class 10 U1


[dzebrys]

I've found out personally that when OS init fail to mount /system then we got this android password prompt. this means android lost security configuration likely stored on /system partition and fallback to default.

[norbert.kiszka]

I got several 32GB cards to make the backup and found slightly differences of some sectors between brands

That backup was just files stored on SD card or SD card image?

[mrisco]

That backup was just files stored on SD card or SD card image?

Sector by sector raw image

[pict]

The Lexar cards that worked for me (V10 633x 32GB) report as 31,706,841,088 bytes capacity (29.5GB) when formatted FAT32. HDD Raw Copy Tool reports the card as LBA 61,952,000 - 31.71GB

This is the Amazon link to the cards I bought that worked. They are identical to the card supplied with the scope:
https://www.amazon.ca/dp/B094866JD3

PM me your email and I can send you my original image when I have access to the PC they are on (away at work currently).

Actually, file system internal capacity is always lower than actual size of the physical device (SD card in this case). So what are You talking about?

OP asked me a specific question. I answered it.

Every 32 GB SD card has 31 719 424 000 bytes capacity. Doesn't matter if that is Lexar, Samsung, SanDisk or anything else.

I do not believe this. I have different 32GB cards that report different available capacities, and the differences appear brand specific.

And how You gonna send sd card image with an email? Xzipped image takes about 564 MiB. Email attachments are encoded, because You can't send binary data (without encoding it) within email messages - that increases size to at least 150% of original file.

Stick it on Dropbox and share the link by email was the plan.

[norbert.kiszka]

How does it look?

[norbert.kiszka]

v0.2.1 is ready to go.

Changelog:

• Fixed issue with webcontrol (external access via web browser) which was not starting at boot.
• Fixed boot problems which can happen for some scopes.
• Fixed installation problems caused by modified Device Tree in newer scopes.
• Fixed trigger source spinner (drop down menu list) not showing digital channels.
• FPGA ChDlyPointTime value restored to 800 ps just in case (previously it was the same as in DHO4000 which is 250 ps).
• Average acquisition memory depth limit now is 25 Mpts for single channel and 12.5 Mpts for two or more channels (previously 1 Mpts in each case).
• Removed "bandwidth indicator" from DVM, since DVM bandwidth is always the same as the channel bandwidth and this takes useful space from measurements results.
• "Squished" buttons in navigation list (top right of the screen) now are changed to text buttons.
• Rarely used options from navigation list was moved into Start Menu and often used in Start Menu was added to navigation list.
• UPA (power analysis) option added to Start Menu as an experimental option.
• Increased width of Start Menu for better readability.
• Fixed sizes of various popup windows.
• Fixed sizes of some spinners (dropdown menus) which was way too big.
• XY advanced settings now are always available ("testModel" is hardcoded to always on).
• Removed some unnecessary "features" that decreases app performance, like a hardware version checking, since it's hardcoded to DHO4000.
• Added more shortcuts to the Start Menu.
• Trigger status (top left screen corner) now is also a run/stop button.
• Removed unnecessary icons from notification bar.
• pm now allows to change app permissions which are "not changeable" or "not requested".
• Increased text size in multi windows (all measure, peak search, etc).
• Removed unnecessary files that can't be used at all but takes useful space and boot time.

Just as a reminder, 30% off code is: EEVBLOG

[norbert.kiszka]

2.1 GSa/s and ~130 Mpts are the limits without any hardware modification.

I think this ADC probably will do 2.5 GSa/s, but not with this FPGA and slow DDR3. Theoretically there are DDR3 chips faster than 2133 MHz.

ADS924A has round memory depth options (1 M, 10 M, 100 M), likely because they used code from Rigol. And Rigol "engineers" likely are very bad at basic math - sample rate vs time base vs memory depth is calculated not by math but with structs (tables)... I fixed it and now we can have any memory depth between ~10 pts and ~130 Mpts.