Hacking the HDO1k/HDO4k Rigol 12 bit scope

[maxwell3e10]

There is no hack for "upgrading" 1K to 4K from obvious reasons.

Would be nice if one could enable 50 Ohm path for DHO1000.  One can see the option in the interface, but it can't be activated. I wonder if it is still being populated on the board.

[skander36]

Would be nice if one could enable 50 Ohm path for DHO1000.  One can see the option in the interface, but it can't be activated. I wonder if it is still being populated on the board.

If the option is encoded in FPGA app I'm doubt that someone will do.

[aurel]

I'm a bit surprised that there isn't any reaction to the new firmware version yet. So here it is.

I've installed firmware v00.02.07 on my HDO1074 and I can't see any obvious issue (only did very basic tests). I can confirm that the hack still works. All the options are still enabled after the upgrade and abd shell is still functional including root access. Also the fan speed can still be reduced in the same way as with previous version.

TLDR: Upgrade without any fear.

[thm_w]

v2.07 release notes:

00.02.07  2023/04/29

     - Custom external attenuation ratio
     - Add the merge display function of MATH window and simulation window
     - Add the window shrink function through Pass-Fail
     - Cursor module zero stagnation function, to solve the problem that the cursor is difficult to capture 0V first
     - Add a toggle switch for merging screens, which can display cursors in each split screen and synchronize the cursors
     - The measurement function adds [cursor area] measurement function requirements
     - Fixed crash issue in German mode
     - Pause to keep the afterglow display after turning on the waveform hold
     - Fixed the truncation problem of enlarged waveform after stopping
     - Fixed the problem that the adjustment trigger point could not be adjusted back to the middle of the screen after moving to the right for more than -50S under a large time base
     - Fixed Crash problem when restarting with probe

[Martin72]

Nice, there´s still more to do..
But the frequency with which the updates are currently appearing gives me good hope for the rigol owners.

[Bit2023]

Hi, would it be possible to post some pictures on the FFT function of the DHO1074?

I'm planning to use that FFT function to check RF frequencies (up to 450MHz), would I be able to do this with the DHO1074 FFT funtion? would I be able to detect harmonics higher than 450MHz?

thank you

[Martin72]

Hi and welcome to the forum.
This is the wrong place for your question as this is the hacking thread about the new rigols.
Place your question here:

https://www.eevblog.com/forum/testgear/rigol-hdo1000-and-hdo4000-12bit-oscilloscopes-launched-in-china/msg4948012/#msg4948012

[HHG]

Hi,

is there a way to turn off the 200MHz band limiter for DHO1k?

[Martin72]

Hi,

I think 200Mhz is the maximum you can get with all channel enabled with one ADC.
The bandwith of the DHO4804 drops down from 800Mhz to 400Mhz when all channel are enabled and this model got two ADCs.

[HHG]

hi,

so 400MHz would be a possibility for working with one channel on DHO1k?

[fumitti]

hello

I bought a DHO1072 on sale in Japan for roughly 480USD.
However, there is no key.data file for my scope.
Also, the FRAM 0x020-0x7ff is filled with zeros.

I want to try different things, so can someone please tell me the format of the key.data file when decrypted with XXTEA?

[fumitti]

Finally it worked.
I generated Key.data using the existing nice tool source, etc. and transferred it to /rigol/data and it worked with that key.

[zrq]

Wow, 480 USD! That would be an instant buy for me.

[fumitti]

Now, after a messy hack, my DHO1072 is now acting as a DHO4804.

The input impedance switching to 50 ohms appears to be working (I can hear the relay clicking).
Signal also seems to be inputting correctly

The display seems to be operating at 500M memory length and 4GSa/s
The 800M bandwidth also seems to be working to some extent

Only 1 channel seems to be working properly, possibly due to missing ADC.

It will be interesting to see what happens when the same hack is performed on the 1074.
I think that 1 and 3 channels may work when the hack is performed on the 1074.

ps
I have tried several games, but due to the extremely low storage capacity, it seems difficult to run modern game/apps.

Code: [Select]

Filesystem            Size  Used Avail Use% Mounted on
rootfs                1.7G  4.2M  1.7G   1% /
tmpfs                 1.8G  436K  1.8G   1% /dev
tmpfs                 1.8G  148K  1.8G   1% /mnt
/dev/block/mmcblk2p10 1.9G  933M  933M  50% /system
/dev/block/mmcblk2p9  122M  116K  113M   1% /cache
/dev/block/mmcblk2p11  12M   40K   11M   1% /metadata
/dev/block/mmcblk2p16 4.1G  852M  3.1G  21% /data
/dev/block/mmcblk2p15 484M  172M  303M  37% /rigol
tmpfs                 1.8G  148K  1.8G   1% /storage
/dev/fuse             4.1G  852M  3.1G  21% /storage/emulated

[dreamcat4]

Now, after a messy hack, my DHO1072 is now acting as a DHO4804.

Only 1 channel seems to be working properly, possibly due to missing ADC.

well when this scope was initially released, dave did a teardown. and i then speculated with a 2nd 1072 to cannibalize the required missing spare parts from...

then you might (*in theory) be able to achieve those stated goals. however clearly the pcb where you have those input bnc inputs needs to be redone.... (*or bodged)

but lets assume that could be done, all of the channels...

then (for a more complete feature parity). there is also some unpopulated section located at the top right corner of the pcb. what was that? maybe auto trigger section for the 4000 series or something? i forget now. however ---> can look at dave's high res photos there. and check whether all of those parts can be ordered from digikey / similar suppliers. also there is at least 1 other forum member here with a 4000 series scope. who can help identify component values on that missing section of the pcb.

so you know, with a bit more work... could be? idk. perhaps transplanting some of these parts could be a bit of a challenge? like those adc sections or the 2nd adc sampler chip / special custom asic ?

... but is would be a fairly 'affordable' source to get those required bom parts list (to get another one at the same price). compared to the price of a genuine 4000 scope.

[dreamcat4]

or an alternative way would be:

to but a 4 channel version + the 2 channel (which you already got).

this then makes the input section 0 work.
and the adcs = 0 work.

and you are left with just transplanting the custom asic from the 2 channel into the 4 channel. plus optionally populating the missing auto-trigger section.

all depending on the price difference between the 2 channel sku and the 4 channel sku. versus the bother / extra work messing about that would be saved.

and here the speculations end! ... because we still have not seen anybody do such efforts yet.

[fumitti]

Yes, I've read most of the posts here.
I believe someone said that the group of unmounted parts in the upper right is the power supply for the active probe.

Buying another 1072 (or 1074) and Frankenscope-izing it is an interesting option.
I think the ability to hack the software aspect adds more dreams to this option.

I like this kind of dream, but I'm lazy and saved up and bought this model so I won't be doing it for the time being.

[HHG]

Can you please describe the process of how you achieved the change from DHO1072 to DHO4804?

[Fungus]

Can you please describe the process of how you achieved the change from DHO1072 to DHO4804?

I'm hoping either the '2' or the '4' is a typo.

(If not, that's quite a hack...)

[dreamcat4]

I'm hoping either the '2' or the '4' is a typo.

Because there is not any such 2-channels version for the higher bandwidths. Rigol only makes in 4 channel version... clearly the point is the bandwidth unlocks for the software side.

[fumitti]

My result is a change from 1072 to 4804 as shown in the attached image.

The settings regarding the model and serial No. are recorded in vendor.bin or FRAM. (through a great discovery by AlphaRne).
It is possible to rewrite either of these and trick it into thinking it is DHO4xxx.
However, as I wrote earlier, this simple hack will adversely affect a significant portion of the system (halving the available CHs, etc.).
Besides that, it can even cause irreversible damage to the hardware.

I believe that modification of the com.rigol.scope App is necessary to get the maximum benefit while actually reducing the impact.
I have not gotten that far yet.

[HHG]

It's still interesting.
Which items in the vendor.bin file must be changed?
And is it necessary to create a new key.data file?

[Wawi]

Many thanks to everyone for the good work!
Btw. there is some 50% OFF on DHO1072, https://www.amazon.co.jp/-/en/DHO1072-oscilloscope-frequency-resolution-real-time/dp/B0BJ2NYKNL
Global shipping available via 3rd party https://www.forward2me.com/

[sintoodio]

Wow, 480 USD! That would be an instant buy for me.

Hey ZRQ, Good Morning, I sent you a private message, could you reply?

[tonywood]

I have to agree, I have the MSO5074, and would like to have 12 bit to play around with. If it goes on sale here in the USA, I would have to consider it. The 10.1" display, low noise and hi resolution acquisition would be worth it to me. Plus, I have a 10mhz reference I could finally use outside a frequency counter