Hacking the HDO1k/HDO4k Rigol 12 bit scope

[2N3055]

Assuming of course.. the 800MHz "image" loaded onto the FPGA is going to ignore the missing 2nd ADC..

That's where the "hack" would come into it - tweak the firmware to create a Frankenscope. 

Hack the FPGA bitstream? Or code, partially, so part of it behaves like 1000 and part of it like 4000?
Both of these options are not easy...
But again, it is not necessary to convert HDO1000 to crippled HDO4000. Just providing a license to unlock HDO1074 into HDO1204 is enough. Only thing missing is 50Ω inputs. Maybe Rigol decides to enable those anyways on 1000. Or maybe they will remove 50Ω path later as price optimization. HDO1000 are still nowhere to be bought at the moment.
Maybe they spun first revision batch for testing based on 4000 board, but will optimize cost later...
It is still too early to say.
But biggest benefit of 4000 is active probes and additional ADC. Without those, there is no point for scope to show 4000 on the screen. It could be fun and giggles for a  hacker that would do it but no real benefit for a user that would like to use scope for real work..
People were attacking that 2 GS/s and 500 MHz is bullshit, now suddenly 800 MHz  is alright with same sample rate...

[Fungus]

Assuming of course.. the 800MHz "image" loaded onto the FPGA is going to ignore the missing 2nd ADC..

That's where the "hack" would come into it - tweak the firmware to create a Frankenscope. 

Hack the FPGA bitstream? Or code, partially, so part of it behaves like 1000 and part of it like 4000?

The FPGA code will be in a file. What a hacker would do is patch the HDO1000's FPGA flle into the HDO4000's firmware.

But again, it is not necessary to convert HDO1000 to crippled HDO4000. Just providing a license to unlock HDO1074 into HDO1204 is enough. Only thing missing is 50Ω inputs..

Are you sure that's the only difference in the software features? How do you know if you don't actually own either of them?

Maybe Dave can put them side by side and go through the menus/features/abilities.

If I had to bet, I'd put money on the 4000 having a few extra "advanced" features that the 1000 doesn't.

[bob808]

If the RK3399 is running Android then it might have a recovery image (that should be triggered to boot with a button) and maybe even A/B partitioning.

[Fungus]

There's two possibilities here:

a) Rigol used Android's secure boot mechanism to really lock down the firmware and made it very difficult to root/hack.

b) They've said "We'll make a hackable device and let the hackers believe they're fooling us". It's better to only make $100 than have them buy from somebody else.

They've done (b) for a long time now, let's hope this one doesn't bring a change of policy.

[hans]

No one can judge from pictures if the BOM is loaded identically for both boards.  Although the amplifier front-end IC can do 800MHz, the bandwidth limit options could also be set externally. E.g. both the HDO1k and HDO4k have 3 tiers of bandwidth: perhaps this is the max amount of bandwidth limit taps the front-end can support (besides 20MHz) by switching in a few extra passives externally. Many 0402 passives and/or capacitors don't have markings, so it's not possible to tell from pictures if they are different.

W.r.t. FPGA bitstreams: modifying them is not so easy. Many FPGA bitstream formats are not even open format, so good luck finding the right bits for modification. Moreover FPGA vendors/customers are very concerned about protecting IP.. and since most FPGAs are volatile devices (and thus the firmware is loaded externally on-boot), the loaded bitstream must also be protected outside the device. Newer FPGAs support encrypted bitstreams which can't (easily) be modified. With a bit of bad luck, Rigol has decided to use different AES decrypt keys for HDO1k/HDO4k, so transplanting FPGA just the images won't work. Most likely this key is set to read-only on the eFUSE of the FPGA.

Then there the part that a HDO4k FPGA bitstream can very well assume 2 ADCs are fitted. So even if you jumped through all these obstacles to get an image to run.. the device may very will malfunction at this stage without a 2nd ADC fitted. I agree with @2N3055, these are a lot of assumptions and transplanting ADCs is a very risky move to potentially brick 2 scopes. But one can only dream and hope. A hack from 70MHz to 200MHz is still quite decent, as that's a bandwidth jump lots of people were happy with for the Rigol 2000 series.

I'm not sure if Rigol is willing to protect their sales of the HDO4k that little. Purely from starting price and max BW, you can tell the HDO4k and HDO1k have different target groups. The HDO1k is still within hobbyist budget reach. We have one HDO4k on order at work because we don't want to fuss around with hacks and other potentially accuracy/reliability-affecting modifications.

[bob808]

if their customer base is made up from mainly businesses then they might benefit from leaving ways of hacking it. just leave enough hoops such that businesses wouldn't fuss around with, warranty is also on the line.

[Fungus]

No one can judge from pictures if the BOM is loaded identically for both boards.  Although the amplifier front-end IC can do 800MHz, the bandwidth limit options could also be set externally.

The obvious thing to do would be to check for presence of the second ADC.

W.r.t. FPGA bitstreams: modifying them is not so easy. Newer FPGAs support encrypted bitstreams which can't (easily) be modified. With a bit of bad luck, Rigol has decided to use different AES decrypt keys for HDO1k/HDO4k, so transplanting FPGA just the images won't work. Most likely this key is set to read-only on the eFUSE of the FPGA.

It won't be "luck", it will be a decision by Rigol's marketing department - allow hacking or not.

Hacking has sold a lot of Rigol 'scopes in the past, so... let's hope.

I'm not sure if Rigol is willing to protect their sales of the HDO4k that little.

Corporate/educational users aren't going to hack them, they'll pay full price.

[Fungus]

warranty is also on the line.

Warranty isn't, but support contracts might be.

[2N3055]

Are you sure that's the only difference in the software features? How do you know if you don't actually own either of them?

There is a manual and datasheet. We don't know what and what not can Rigol add later. But at this moment it quite clear.
Also there is a fact that I know a bit about how these things are designed and what is and what isn't possible.

If I had to bet, I'd put money on the 4000 having a few extra "advanced" features that the 1000 doesn't.

I told you what is the difference at this moment. Don't trust me, do your homework. Don't ask Dave to do it for you..

[bob808]

The obvious thing to do would be to check for presence of the second ADC.

I saw what appears to be a missing regulator for the 2nd ADC. Rigol might sense its power rail or they might check in software and use an enable line for it (the regulator).

[bob808]

There's this part arrangement that's not populated on the HDO1k. Lower right one is missing. Upper left one has 1.8V label, and could be a linear reg. On the right side one (bottom) there's also a very small part that's missing from the left one. Might be a sense line. If the ADC is using analog and digital rails then maybe the other missing part (one MPPD 3630 marked) is the digital switching reg.

[Fungus]

That's where the "hack" would come into it - tweak the firmware to create a Frankenscope. 

Hack the FPGA bitstream?

No, hack the firmware - where the FPGA bitstream files are stored.

(Reading comprehension??)

Are you sure that's the only difference in the software features? How do you know if you don't actually own either of them?

There is a manual and datasheet. We don't know what and what not can Rigol add later. But at this moment it quite clear.

Weird. All I did was glance at the index of both manuals and I saw the HDO4000 has a whole extra chapter.

It also has three more trigger types than the HDO1000 and three more protocol decoding options.

[bob808]

MPPD 3630 marked device seems to indeed be a switching regulator, and does have an enable line as well.
https://www.monolithicpower.com/en/documentview/productdocument/index/version/2/document_type/Datasheet/lang/en/sku/MPM3630GQV/document_id/2114/
Or just search for MPM3630.

edit:
looking at the footprint in the datasheet I marked the trace for the enable/sync line. probing this at startup should be interesting to see if they also software disable that reg.
at least the enable trace seems to be going to that pad. hard to see.

[Kahooli]

Dave,
I noticed in your teardown you didn't take the board out of the front chassis - can you tell if the active probe pads are part of the main board and covered on the HDO1000, but uncovered for the 4000? Or are they a sub assembly?

[bob808]

And linear reg seems to be a TPS72301 which is a negative linear reg. At least the markings match. And its enable pin seems to be tied to input, on the pcb.

edit: ah yes, on the left side reg there's N1V8 on the silkscreen which must mean negative 1.8V. so HDO1K is missing a set of +/- 1.8V rails. And an ADC.
so theoretically one of the easiest hacks (if they allow it) would be to power the sense lines for these rails, if they have any sense lines on those rail outputs.

[tv84]

I'm not releasing it generally, but for those interested in the MXO44 lockup:
6:40 is when the problem starts.

I've said this before and repeat: I like new R&S scopes.

Having said that, this bug would fuel the whole hell from some of our residents if it was on a Siglent and even more on a Rigol.

I didn't see anything of the sort on this one...     (rush to market, etc. etc.)

[2N3055]

That's where the "hack" would come into it - tweak the firmware to create a Frankenscope. 

Hack the FPGA bitstream?

No, hack the firmware - where the FPGA bitstream files are stored.

(Reading comprehension??)

Are you sure that's the only difference in the software features? How do you know if you don't actually own either of them?

There is a manual and datasheet. We don't know what and what not can Rigol add later. But at this moment it quite clear.

Weird. All I did was glance at the index of both manuals and I saw the HDO4000 has a whole extra chapter.

It also has three more trigger types than the HDO1000 and three more protocol decoding options.

So FPGA bitstream contents... Where you load it from is not relevant.
Three more triggers and three more protocol decodes are not a big difference. Triggers will be in HDO4000 bitstream that you cannot load because you don't have additional ADC...

[bob808]

Found a better picture from the HDO1K teardown.

Upper yellow circled pad seems to actually be the enable line for the +1.8V regulator (but should be checked with dmm). Lower blue circled pad might be a sense line for the -1.8V output.
There's two vias on the output of the positive regulator but they are before filtering so might be from the regulator itself.

[EEVblog]

So what does the second ADC actually do? If the PCB's are the same, and all the four channels are connected to the one ADC, what's the purpose of the other ADC?

The front end chip has diff drivers one going to each ADC. In the HDO4000 each channel is interleaved to get double the sample rate.
The HDO1000 only has one ADC so you only get half the sampel rate maximum, and you can see on the front end, two of the resistors for the 2nd diff pair are missing because they aren't used.

[EEVblog]

I'm not releasing it generally, but for those interested in the MXO44 lockup:
6:40 is when the problem starts.

I've said this before and repeat: I like new R&S scopes.
Having said that, this bug would fuel the whole hell from some of our residents if it was on a Siglent and even more on a Rigol.
I didn't see anything of the sort on this one...     (rush to market, etc. etc.)

FYI, R&S have said they have recreated the problem and are working on it. The firmware is still early release stuff, they mentioned also a known issue with the USB.

[EEVblog]

Dave,
I noticed in your teardown you didn't take the board out of the front chassis - can you tell if the active probe pads are part of the main board and covered on the HDO1000, but uncovered for the 4000? Or are they a sub assembly?

In the HDO4000 teardown you can see it's an entire PCB assembly for hte front active probes, with lots of fusing and the big ribbon cable running to the main PCB.

[EEVblog]

I'm not sure if Rigol is willing to protect their sales of the HDO4k that little.

Corporate/educational users aren't going to hack them, they'll pay full price.

Correct. That's how the game is played.

[EEVblog]

If the RK3399 is running Android then it might have a recovery image (that should be triggered to boot with a button) and maybe even A/B partitioning.

There are three unlabled button populated on the PCB 

[bob808]

Two of them seem right next to RTC battery. One of them might be a reset for that. The third looks like it has a trace going straight to the RK3399 chip.

[bob808]

RK808 which is under the RTC battery is a power management chip, and on the pinout the side towards the battery does have a RTC power line. So the upper two buttons might be related to RTC and something else. RK808 datasheet also shows a button in their application schematic. 

edit: also theoretically there could be some ways to disable AVB but needs to be in fastboot or recovery or something like that. dumping the partitions would also be useful, boot.img could be edited to disable AVB. there's also magisk.
not sure if you can navigate recovery with the front panel controls. but if you get it in recovery try and have it connected to a PC via USB cable and check device manager if anything pops up while in recovery/fastboot.
I didn't yet identify the storage/flash chip.
RK3399 seems to be in OrangePi4 https://www.orangepi.com/index.php?route=product/product&product_id=895 which also has RK808 power management chip.