Hacking the HDO1k/HDO4k Rigol 12 bit scope

[TurboTom]

I just experimented a little with the vendor.bin of my DHO1074 by modifying it with an instrument type "HDO2204" using @trinacria's "create_dodgy_vendor_dot_bin.txt" program. I didn't modify the S/N into the format one would expect for the DHO2000, though.

Apparently, the instrument accepts the new file and offers some new features (50 Ohm), but toggling the switches won't actuate the corresponding relay inside (??) and also the impedance at the BNCs doesn't change. Waveforms measured while changing the impedance show no traces of any glitch or another indication of an internal reconfiguration.

Decoders get lost (except Parallel and CAN) but may possibly be optioned-up later. In the main menu, a new icon "UPA" (probably power analysis) appears but cannot be activated (message "Option unavailable" or the like appears), so probably another key is required to activate this.

Maximum Sampling memory still is 100M and altogether, the setup appears pretty much similar to the DHO1000. No higher bandwidth, only 50 Ohm impedance (if it can be got to work) and power analysis could be gained at the risk of getting stuck eventually if Rigol decides not to "Support" the "gost of the DHO2000" in their rigol.scope app in future anymore...

Right now, I'll stay with the original vendor.bin

Maybe I'll open up my DHO to check if it actually contains the input impedance switching relays or if they were "economized" in the series run... 

[Martin72]

Hi,
First screenshot shows 10V/div and 50 Ohm, this in itself shows that something is wrong, because in 50 ohm mode the maximum is 1V/div.
Unless you had the input on x10, which is unfortunately not shown in the channel info box in the rigol scope.

[ebastler]

I just experimented a little with the vendor.bin of my DHO1074 by modifying it with an instrument type "HDO2204" [...]

Thanks for giving that a try! And what a pity that it did not do anything more useful...

When trinacria tried a DHO4000-style vendor.bin, the 50 Ohm option did at least make the relays click and caused a measurable 50 Ohm impedance at the inputs. Strange that the fake DHO2000 has even less functionality. As you said, maybe the relays were not populated on the PCB. Does the scope you received also have a relatively early build date (mine was December 2022), or is it a later version?

It seems that the "DHO2000" does not accept any of the options that were in place for the DHO1000, so they would need to be recreated via the GO script (for the proper device ID). For example, the serial protocol decoders could hopefully be re-enabled via the EMBD option. Hopefully I²S etc. could also be installed via the respective options. Strange that CAN survived on its own.

On the positive side, maybe the lack of preinstalled options means that 100 MPts are the standard memory, and it can be upgraded to 250 MPts or so? [Just noticed that an active memory upgrade is already displayed in your options dialog, so 100 MPts are probably the end of the line.] One could also try the BW2T4 upgrade, although it's not that likely to work. And there is a UPA option listed in the GO script, which (according to the DHO4000 manual) is indeed power analysis.

I am being a good boy at the moment, leaving my DHO1000 stored away until Christmas, but will probably give this another shot then. Although the hope of enabling the 50 Ohm inputs was one of the main attractions to me -- and, as you said, one runs the risk of ending up with an "orphaned" model after future firmware updates. At least it's easy enough to look at the Auklet.apk inside a .GEL file before installing an update, for a plausibility check whether it still knows about the HDO2000.

[NE666]

I am being a good boy at the moment, leaving my DHO1000 stored away until Christmas

Krampus approves.  Maybe St. Nick will bring you 50 ohms for the New Year 

[TurboTom]

My DHO1074 has a calibration date from mid January 2023 so it may actually be from a slightly newer production run.

@Martin72: Well spotted, I actually didn't notice this. But since I also tried to activate the 50 Ohms impedance on the other channels (set to 50mV/div) which didn't show any function either, I don't think that this was the cause of the problem.

I may swap vendor.bin files again and attempt a complete default / auto calibration since I didn't try anything like this the last time. Or use the hardware tools and have a peep inside... 

[ebastler]

If you are not tired of the vendor.bin game yet, maybe try the HDO4804 variant, which at least made the 50 Ohm relays click for trinacria? If it does not get any response in your scope, then the relays might unfortunately be unpopulated.

Or, the other way round: @trinacria -- could you give a vendor.bin with an "HDO2204" model a try? It might be quite useful indeed on your hardware, which is known to have working 50 Ohm relays.

My DHO1074 also has a January calibration date (Jan 13th). I am not sure where I got the December manufacturing date from -- thought it was on the cal certificate, but it is not. Is it displayed in the Info dialog? Or did I mistake a firmware build date for the manufacturing date? Anyway, my scope might well come from the same batch as yours. So I am keeping fingers crossed that we will still be able to make some relays click...

[skander36]

I just experimented a little with the vendor.bin of my DHO1074 by modifying it with an instrument type "HDO2204" using @trinacria's "create_dodgy_vendor_dot_bin.txt" program. I didn't modify the S/N into the format one would expect for the DHO2000, though.

Apparently, the instrument accepts the new file and offers some new features (50 Ohm), but toggling the switches won't actuate the corresponding relay inside (??) and also the impedance at the BNCs doesn't change. Waveforms measured while changing the impedance show no traces of any glitch or another indication of an internal reconfiguration.

Decoders get lost (except Parallel and CAN) but may possibly be optioned-up later. In the main menu, a new icon "UPA" (probably power analysis) appears but cannot be activated (message "Option unavailable" or the like appears), so probably another key is required to activate this.

Maximum Sampling memory still is 100M and altogether, the setup appears pretty much similar to the DHO1000. No higher bandwidth, only 50 Ohm impedance (if it can be got to work) and power analysis could be gained at the risk of getting stuck eventually if Rigol decides not to "Support" the "gost of the DHO2000" in their rigol.scope app in future anymore...

Right now, I'll stay with the original vendor.bin

Maybe I'll open up my DHO to check if it actually contains the input impedance switching relays or if they were "economized" in the series run... 

Because this model does not exist. It's just s reference in a file.
Did you try with a real model (4804)?
For this model the 50 ohm relays are activated (input impedance changing), memory is displayed as 500 Mpts, BW is extended to 800 MHz, timebase to 500 ps. But do not expect a usefull behaviour as it does not have two ADC's. Also calibration my be inaccurate and it cannot be too much improved. This experiment is as is , an experiment, until someone will modify main application or find another way to trick the software to use only one ADC ... so any comment on the inconsistencies of the displayed settings and parameters is futile.

[ebastler]

Because this model does not exist. It's just s reference in a file.
Did you try with a real model (4804)?

Well, the DHO2000 series was never released. But there seems to be some preparation for it in the Auklet firmware beyond "just a reference in a file". E.g. the 50 Ohm control is made active in the software -- although maybe not functional -- and Power Analysis is offered as an option.

Agreed, it is a long shot; we don't know how complete the implementation is and what level of testing was done on it. But since the DHO2000 series uses a single ADC and the exact same FPGA configuration as the DHO1000, there is some hope that it can work in a useful way on the DHO1000 hardware. (In contrast to the DHO4000 configuration, which we know to be incompatible hardware-wise.)

[TurboTom]

Since I'm faster with the screwdriver than with coding, I already had my DHO1074 apart. Interestingly, Rigol changed several semiconductors vs. dave's teardown photos -- possiblly due to availability problems. I found a total of 14 components to be replaced with non-footprint-compatible types, installed on (more or less) tiny adapter PCBs. Rigol even spun a complete linear regulator made up of (almost discrete) individual components. I attached a few photos with some details of these modifications.

And to answer the most relevant question: Yes, the 50 Ohms relays and passives are still installed in the AFE section... I may tinker some more with the configuration  .

I agree with @ebastler that the DHO2000 approach is the one most promising for successfully enabling the input impedance option for someone not deeply involved in firmware reverse engineering... If the relays are controlled via the FPGA and the DHO1000/2000 configuration file already "lost" its capability to control the ones used for impedance switching, we may be out of luck, though. And a patch will be next to impossible.

[skander36]

... there is some hope that it can work in a useful way on the DHO1000 hardware. (In contrast to the DHO4000 configuration, which we know to be incompatible hardware-wise.)

Yeah, I also hope, but I'm doubt. I think the main reason for Rigol didn't do that is the danger for 4k series wich will be severely affected. Beside the 4 GSa's and active probe support there is nothing to offer that justify such price. And as most users are not interested in active probes (the cost of the single probe is prohibitive as is propietary bus) then 4 GS will not atract much interest with this price. Maybe a price cuts.

Also for TuboTom   "Right now, I'll stay with the original vendor.bin". In the current stage there is nothing to make us thinking otherway. This is just a "proof of concept" made by some of the users here. They clearly stated that there is no practical use for this mod as is for DHO800.

[ebastler]

Interestingly, Rigol changed several semiconductors vs. dave's teardown photos -- possiblly due to availability problems. I found a total of 14 components to be replaced with non-footprint-compatible types, installed on (more or less) tiny adapter PCBs. Rigol even spun a complete linear regulator made up of (almost discrete) individual components. I attached a few photos with some details of these modifications.

Ouch -- that must have hurt them. I have never seen so many patches on a production board. Let's hope they did a decent job with the engineering and the soldering... An interesting finding!

[TurboTom]

Just to be sure, I also checked input impedance switching with the "super_dodgy_vendor.bin" (coutesy of "diode gone wild"  ) of the DHO4202 -- and, as others reported before, the relays just operate normally. So I very much assume that the fpga config files for the DHO1k SPU_H12S2*.bit eventually got deprived of their ability to control the 1M/50R relays, presuming that they are / were responsible for controlling those relays. This would mean that here we're at a dead end of hacking the 50 Ohm inputs of the DHO1k series.

Since I lost my oldest FPGA config file when updating to the current firmware witout previously pulling a back-up copy, does anyone have a really old version of the FPGA config file (before December 2022)  "SPU_H12S2.bit"? I'ld love to do some testing with it!

Edit: Did some additional testing: Assuming that the FPGA config that's being used (with DHO1k and DHO2k configuration) is "SPU_H12S2.bit" and with DHO4k configuration it's "SPU_H12S4.bit", (after backing up) I changed the name of "SPU_H12S4.bit" to "SPU_H12S2.bit" so the DHO2k configuration should use the DSO4k FPGA setup. Surprise: Still no 50 Ohm input switching. So after all, maybe the FPGA isn't resposible for relay control... interesting!

[skander36]

Here. Just rename it from mp3 to bit.

[ebastler]

So I very much assume that the fpga config files for the DHO1k SPU_H12S2*.bit eventually got deprived of their ability to control the 1M/50R relays, presuming that they are / were responsible for controlling those relays. This would mean that here we're at a dead end of hacking the 50 Ohm inputs of the DHO1k series.

Since I lost my oldest FPGA config file when updating to the current firmware witout previously pulling a back-up copy, does anyone have a really old version of the FPGA config file (before December 2022)  "SPU_H12S2.bit"? I'ld love to do some testing with it!

Darn...

Firmware versions 02.00 and 02.04 are still available for download at https://rigolshop.eu/dho4204.html. Version 02.00 is the one with the interesting version number "lower than 00.02.00, please update this first"... FPGA files are dated mid-December in 02.04, and November 1st in 02.00.

[vindoline]

Another very happy customer here! I can confirm that my DHO1074 ‘upgrade’ was simple and frustration-free by following the simple directions below. Thanks!

EDIT 08/15/:

finally i was able to upgrade following  this thread: https://www.eevblog.com/forum/testgear/hacking-the-hdo1khdo4k-rigol-12-bit-scope/msg4793000/#msg4793000

[TurboTom]

Most "fellas" interested in Rigol's DHO 800/900/1k/4k may have followed the other thread about the broken FlatTop FFT window function. I wrote a small basic (yes, really!  ) program that calculates the correct window file -- the windows executable is attached. Here's how to replace the broken file:

You need to have the ADB toolkit downloaded on your PC and the simplest way is to have the newly generated window file placed in the same directory.

Code: [Select]


adb connect [your scope's IP address]:55555

adb push flatTop_1048576.hex /rigol/resource/window/


Edit: just checked - the following steps aren't required for the patch to work I'm not sure if the file mode flags, owner and group are relevant but I changed them anyway so they match the other window files. Attention: After issueing the "su" command, you can do real harm in the scope's file system!

Code: [Select]


adb shell

su

cd /rigol/resource/window

ls -l


Now make sure the pushed window file is there, it should look somewhat like this:

Code: [Select]

rk3399_rigol:/rigol/resource/window # ls -l
total 40960
-rwxrwxrwx 1 root  root  4194304 2023-11-26 11:14 blackmanWin_1048576.hex
-rw-rw-rw- 1 shell shell 4194304 2023-12-04 04:11 flatTop_1048576.hex
-rwxrwxrwx 1 root  root  4194304 2023-11-26 11:14 hammingWin_1048576.hex
-rwxrwxrwx 1 root  root  4194304 2023-11-26 11:14 hanning_1048576.hex
-rwxrwxrwx 1 root  root  4194304 2023-11-26 11:14 triangle_1048576.hex
rk3399_rigol:/rigol/resource/window #

Now change the properties:

Code: [Select]


chmod a+x flatTop_1048576.hex

chown root flatTop_1048576.hex

chgrp root flatTop_1048576.hex

ls -l


And check that the changes took effect:

Code: [Select]


rk3399_rigol:/rigol/resource/window # ls -l
total 40960
-rwxrwxrwx 1 root root 4194304 2023-11-26 11:14 blackmanWin_1048576.hex
-rwxrwxrwx 1 root root 4194304 2023-12-04 04:11 flatTop_1048576.hex
-rwxrwxrwx 1 root root 4194304 2023-11-26 11:14 hammingWin_1048576.hex
-rwxrwxrwx 1 root root 4194304 2023-11-26 11:14 hanning_1048576.hex
-rwxrwxrwx 1 root root 4194304 2023-11-26 11:14 triangle_1048576.hex
rk3399_rigol:/rigol/resource/window #


To close the session type:

Code: [Select]


sync

reboot


Now your scope should restart and activate the new FFT FlatTop window file.

This step-by-step walkthrough was probably "Kindergarten" for many but it may help those who never ever typed on a unix terminal... 

[alexamod]

good evening guys
Today my HDO1072 arrived, I am a Windows user and I see that to activate the licenses (200mhz and memory) there are Android codes.
How could I do?
Thank you.

[ebastler]

good evening guys
Today my HDO1072 arrived, I am a Windows user and I see that to activate the licenses (200mhz and memory) there are Android codes.
How could I do?
Thank you.

Android is already provided -- it runs on the scope itself. 

If you can't be bothered reading the thread, this video provides a good starting point. It walks you through the process for the smaller DHO800 oscilloscope, but the approach is exactly the same for the DHO1072.

[TurboTom]

I poked around and threw a few more things at my DHO1074 in order to enable it beyond the RLU (memory) and 200MHz BW option -- unfortunately, without any real success. Here's what I tried:

DHO2k route:
- change model to DHO (HDO) 2204: 50R impedance switch available but hasn't got any effect. Decoder options available and get accepted but no function, neither corresponding trigger options get enabled.
- change S/N to proper format HDO1B* -> HDO2B*: No change
- revert F/V to 00.02.00: No change
The lack of any functions indicate that the DHO2k idea must have been dropped quite early in the development process, so it's probably no use to follow this road any further.

DHO4k route:
- change model to DHO4204: All functions and options appear to work but sampling engine obviously gets messed up - if signal is input to Ch1, it gets displayed on Ch1 and 2, vice versa for channels 3&4. Phase errors in sampled data (no surprise)
- copied SPU_H12S2*.bit (DHO1/2k) to H12S4*.bit (DHO4k) FPGA configuration files. No obvious change.

So I'm here at a dead end. I'm by far not experienced enough to figure out how to individually enable function in the com.rigol.scope app. I guess we (I)  can be happy with a fully featured DHO1204 at the very competitive BF pricing...   

[voltsandjolts]

- change model to DHO4204: All functions and options appear to work but sampling engine obviously gets messed up

Did the 50 Ohm input switching work?

[TurboTom]

- change model to DHO4204: All functions and options appear to work but sampling engine obviously gets messed up

Did the 50 Ohm input switching work?

Yes it did but only if the model was configured as DHO4k.

[ZhuraYuk]

Can someone please explain why in the firmware update archive DHO1000-DHO4000(software)Updatev00.02.11.zip for DHO1000 there is only file named DHO4000Update.GEL? The firmware upgrade instruction clearly mention DHO1000Update.GEL, should I just rename the file?

[skander36]

Can someone please explain why in the firmware update archive DHO1000-DHO4000(software)Updatev00.02.11.zip for DHO1000 there is only file named DHO4000Update.GEL? The firmware upgrade instruction clearly mention DHO1000Update.GEL, should I just rename the file?

No need to rename. Use this file. Don't forget to use Storage->Upgrade, path.   

[core]

Since I'm faster with the screwdriver than with coding, I already had my DHO1074 apart. Interestingly, Rigol changed several semiconductors vs. dave's teardown photos -- possiblly due to availability problems. I found a total of 14 components to be replaced with non-footprint-compatible types, installed on (more or less) tiny adapter PCBs. Rigol even spun a complete linear regulator made up of (almost discrete) individual components. I attached a few photos with some details of these modifications.

And to answer the most relevant question: Yes, the 50 Ohms relays and passives are still installed in the AFE section... I may tinker some more with the configuration  .

I agree with @ebastler that the DHO2000 approach is the one most promising for successfully enabling the input impedance option for someone not deeply involved in firmware reverse engineering... If the relays are controlled via the FPGA and the DHO1000/2000 configuration file already "lost" its capability to control the ones used for impedance switching, we may be out of luck, though. And a patch will be next to impossible.

What hardware version do you have ?
It seems that there are versions from 2 up to 9.
I have version 2, and user ZhuraYuk told us about version 9.

[TurboTom]

I have H/W 2, but maybe this version number is also related to the configuration: Mine is a 4-channel model (DHO1074), yours as well (I assume...) but ZhuraYuk's is a DHO1072.