Spectrum Analyzer - Rigol DSA815

[ted572]

English translation of 'Measuring Low level Phase noise using DSA815-TG' in Dutch from 'fqahmad66' in his Reply (Post) #634 above (https://www.eevblog.com/forum/testgear/spectrum-analyzer-rigol-dsa815/msg703754/#msg703754).  Of course there may be some errors in this document because I do not understand the Dutch language.  I used the Goggle language translation tool for this task.  Feel free to edit and re-post the PDF yourself, or if you prefer to give me feedback for corrections, I will edit the file and re-post it.  In any case I hope this is found to be of value to some users in the group.  At least we can appreciate the basics for performing Phase Noise measurements way beyond the capability of the DSA815 by itself.

[smgvbest]

Now, who wants to work on hacking the newest version with me?

I'll give it a go

[dadler]

Received my 815-TG today from tequipment today. Cal was done March 14, 2015 of this year. Rather surprised it wasn't double boxed(my Rigol DS1054Z was).

Main board: 00:08
RF Frequency board FPGA: 00:05
Digital Board FPGA: 00:05
Firmware: 00:01:12
Version of Boot: 00:01:04

Now, who wants to work on hacking the newest version with me?

My first, with defective display, was double-boxed.

The replacement, with higher SN, came single boxed. Go figure.

[TheSteve]

OK, my FRAM is now in stasis - instead of soldering it I used some bare 30 AWG wire and twisted it around pins 7 and 8. The wire is soft enough it will stretch just slightly when under tension and stay very tight. I verified it is working and will check it now and then just to be 100% sure. Still have 35 + hours left.

So now to the option keys. Here is what I am thinking, if Rigol decided they wanted the DSA815 to actually be secure they will have picked a new private/public key pair that can't be easily reversed. If that is the case then I'd say we're sunk without serious further effort. On the other hand perhaps they just changed the option codes themselves. They did do that with the DP832 after all.  At this point I think we can ignore the bootloader version and just focus on the firmware version as whatever changes they made occurred before they updated the bootloader. Either way we need a JTAG dump to even have a shot at figuring it out. I was hoping to get someone to send me a JTAG dump from an older version but no PM's I've sent have been replied to at this point. I don't currently have any JTAG hardware but am willing to buy it and dump my DSA815 but it would be nice to study an older version to see where the keys and option codes are sitting in ram before looking at the new version. I shall now research the best/cheapest JTAG interface to get for the job. I welcome any and all discussion.

[fqahmad66]

English translation of 'Measuring Low level Phase noise using DSA815-TG' in Dutch from 'fqahmad66' in his Reply (Post) #634 above (https://www.eevblog.com/forum/testgear/spectrum-analyzer-rigol-dsa815/msg703754/#msg703754).  Of course there may be some errors in this document because I do not understand the Dutch language.  I used the Goggle language translation tool for this task.  Feel free to edit and re-post the PDF yourself, or if you prefer to give me feedback for corrections, I will edit the file and re-post it.  In any case I hope this is found to be of value to some users in the group.  At least we can appreciate the basics for performing Phase Noise measurements way beyond the capability of the DSA815 by itself.

Very Nice. Thanks

[smgvbest]

OK, my FRAM is now in stasis - instead of soldering it I used some bare 30 AWG wire and twisted it around pins 7 and 8. The wire is soft enough it will stretch just slightly when under tension and stay very tight. I verified it is working and will check it now and then just to be 100% sure. Still have 35 + hours left.

So now to the option keys. Here is what I am thinking, if Rigol decided they wanted the DSA815 to actually be secure they will have picked a new private/public key pair that can't be easily reversed. If that is the case then I'd say we're sunk without serious further effort. On the other hand perhaps they just changed the option codes themselves. They did do that with the DP832 after all.  At this point I think we can ignore the bootloader version and just focus on the firmware version as whatever changes they made occurred before they updated the bootloader. Either way we need a JTAG dump to even have a shot at figuring it out. I was hoping to get someone to send me a JTAG dump from an older version but no PM's I've sent have been replied to at this point. I don't currently have any JTAG hardware but am willing to buy it and dump my DSA815 but it would be nice to study an older version to see where the keys and option codes are sitting in ram before looking at the new version. I shall now research the best/cheapest JTAG interface to get for the job. I welcome any and all discussion.

Good Idea on the 30awg wire.
As for the work on hacking the keys.   it is possible the option codes where change, it's possible the keys where changed but as with the MSO1000Z they changed the algorithm somewhat I believe.  I tried doing the SCPI dump and running it through the current rigup and if could not find any information,  I don't know if the SCPI dump was bad though or it really couldn't find anything.

[N8AUM]

If I can help in some small way please let me know.
Can someone recommend the necessary Jtag hardware needed for you firmware gurus ?
My 815-TG was purchased this past January.

Main board: 00:08
RF Frequency board FPGA: 00:05
Digital Board FPGA: 00:05
Firmware: 00:01:12
Version of Boot: 00:01:04

73  N8AUM

[jamesb]

Is there any chance someone has the latest firmware available for download somewhere?
I've emailed Rigol via their ridiculous "request" form every single day for the past week - no response. Talk about bad service!

[ted572]

Is there any chance someone has the latest firmware available for download somewhere?
I've emailed Rigol via their ridiculous "request" form every single day for the past week - no response. Talk about bad service!

http://beyondmeasure.rigoltech.com/acton/ct/1579/s-0660-1505/Bct/l-3g32/l-3g32/ct3_0/1?sid=pwnRoPaTQ

[jamesb]

Thanks a ton, Ted!

[DD4DA]

1. Can I safely upgrade to v1.09 or v1.12? and will all my unlocked options still be available?

Yes

2. What version should I upgrade too?, from the rigol website I can only get the v1.12?

1.12.002 works pretty

3. If I want to have the v1.09 where to get it?
ask someone

4. Is there any website I can download older versions? to revert back?
nope

The most problems are related to the the newer hw version of the 815 and bootloader 1.04 that will unable to flash older versions of FW.
I absolutly sure that an older bootloader version like 1.2 will enables flashing older firmware with all possibilities they gives free.

dd4da

[smgvbest]

The most problems are related to the the newer hw version of the 815 and bootloader 1.04 that will unable to flash older versions of FW.
I absolutly sure that an older bootloader version like 1.2 will enables flashing older firmware with all possibilities they gives free.

dd4da

Curious,  flash using the boot loader doesn't work, has anyone tried to flash via JTAG to load the older boot loader so you can apply the codes then try a normal upgrade back to the current bootloader???

[Telonic]

The power sweep issue has now been fixed! see video below:

[tomlut]

Minimum Loss 50 to 75 Ohm Matching Pad for Rigol DSA815-TG

How to make one, and why you might want to. . .
See PDF attachment:

Son of a b...! It still has a 50 Ohm termination when 75 Ohm is selected?

All afternoon I was trying to work out why my down converter 75 Ohm IF measurements weren't adding up. That'll teach me to not read the instructions. I have a 75-50 pad. Try again tomorrow.

Thanks for the heads up.

[Velund]

Son of a b...! It still has a 50 Ohm termination when 75 Ohm is selected?

Yes, it just adjust displayed values for external minimum loss pad.

[jlmoon]

Since following this thread for a while, I presume if today I order a New 815 it will arrive with the new firmware which will lock the unit from any clandestine hacks or option enablements.
 

[dadler]

Since following this thread for a while, I presume if today I order a New 815 it will arrive with the new firmware which will lock the unit from any clandestine hacks or option enablements.

This is extremely likely. I bought one in May from Tequipment and it already had the new, non-fun firmware and bootloader.

[N8AUM]

There's always the hardware mod but it has to be done BEFORE the clock runs out.

Has any one tried out the new firmware ?
I informed Rigol back in December about the power sweep bug, only took them 8 MONTHS to come up with fix !

[mandigit]

Thanks for proposal about U1105. I have successfully connect 7,8 pins with resistor 680 Ohm. It's as phoenix bird!

[dadler]

The Rigol FW page still shows .12 as the latest firmware for the 815.

Anyone have the .13 firmware, as shown in the video above, that fixes the power sweep issue?

[Skibane]

Thanks for proposal about U1105. I have successfully connect 7,8 pins with resistor 680 Ohm. It's as phoenix bird!

Is that like Darmok and Jalad, at Tanagra?

[Velund]

Does anyone know, what does "Generate License" page on Rigol NA website (Home > Customer Center > Make License)? Fields to enter is "Key" "Serial Number".

[tomlut]

It generates the licence number you use to unlock options like the Advanced Measurement functions. You get the key when you purchase a licence.

[smgvbest]

Thanks for proposal about U1105. I have successfully connect 7,8 pins with resistor 680 Ohm. It's as phoenix bird!

Is that like Darmok and Jalad, at Tanagra?

Love the reference and loved that episode

[smgvbest]

Does anyone have Hi-Res photo's of the DSA832 or DSA875's main board?
If not is anyone willing to open it up and gets some really good hi-res photo's of both sides of the PCB?

Thank you