Hacking the HDO1k/HDO4k Rigol 12 bit scope

[RobbiOne]

Hi all. Have done a lot of reading but still not building a full picture of the state of unlocking the HDO4k series.

If I purchased a new 4204, would I be able to unlock memory, decoders and bandwidth?
If so, is there a brief write up somewhere? I'm not seeing it...

.....
Ta!
Austin

Read #msg5241057 ... and you will find a text file with step by step hacking procedure for 1K and 4K.
https://www.eevblog.com/forum/testgear/hacking-the-hdo1khdo4k-rigol-12-bit-scope/msg5241057/#msg5241057

[x33yp]

Hey Guys,
Just curious are there any more updates from the people who are patching the .so files (and potentially apk files) to get the 1074 to have the 400-800 mhz passive bandwidth on a single channel, as well as the increased available memory, and 50ohms impedance front end support, as well as some of the extra feature options available for some of the 4000 scopes. I know that some people had most of this working, and I was really hoping there would be some more updates about which so files need patching. I think most of the details were already written but it would be great if anyone who has done it could detail all the steps available (I'm assuming no one wants to put up the modified files at least, so a step by step by anyone willing would be the next best thing )

[thm_w]

Hey Guys,
Just curious are there any more updates from the people who are patching the .so files (and potentially apk files) to get the 1074 to have the 400-800 mhz passive bandwidth on a single channel, as well as the increased available memory, and 50ohms impedance front end support, as well as some of the extra feature options available for some of the 4000 scopes. I know that some people had most of this working, and I was really hoping there would be some more updates about which so files need patching. I think most of the details were already written but it would be great if anyone who has done it could detail all the steps available (I'm assuming no one wants to put up the modified files at least, so a step by step by anyone willing would be the next best thing )

You won't get 800MHz, for that you need dual ADC's of the DHO4000. 1 ADC = 2Gs/s, 2 ADC = 4Gs/s total shared sample rate.
We already have the ~400MHz BW, at least I do when testing.

But yes, bounty is still open for your request.

[skander36]

You won't get 800MHz, for that you need dual ADC's of the DHO4000.

From a bandwith perspective, we can obtain 800 MHz (at least this show my measurements) , but you can't use for measurement as the values are doubled.

[zelea2]

The DHO800/900 family has recently changed its option licensing AES key and format. I've rewritten the option generator and
since the libscope-auklet.so library is shared between the 800/900/1000/4000 series I believe the following applies to this family of scopes too:
https://github.com/zelea2/rigol_vendor_bin

[the Chris]

Thanks! Rigol put a new v2.12 firmware online yesterday at intl.rigol.com. But it seems to require some sort of "passport"  login to download.

Edit: found the registration portal, but the procedure seems to be broken https://supportint.rigol.com/En/Login/register.html

[lownoise]

The update is from 18.10.23, on the japanese site the download works without registration:
https://jp.rigol.com/jp/products/detail/DHO1000

[skander36]

Thanks! Rigol put a new v2.12 firmware online yesterday at intl.rigol.com. But it seems to require some sort of "passport"  login to download.

Edit: found the registration portal, but the procedure seems to be broken https://supportint.rigol.com/En/Login/register.html

2.12 is not new:

[Updated Contents]

00.02.12 2023/10/18

     - Added DHO1202U and DHO1204U models
     - Fixed the problem of CAN decoding result misalignment when there is an error frame
     - Fixed the problem of wrong value in measurement when switching frequency meter source
     - Optimize customer experience of frequency meter statistics function
     - Fixed the issue where the median boundary value measurement results and cursor indication are incorrect when the display type is percentage.

How Rigol put different version of Fw. on different sites is sometimes misleading ...

[Randy222]

Do any of the FW release notes for 1k/4k ever say "optimized calibration" ?
In DHO800/900 the release notes on almost all the FW's say that. Wondering why 800-900 gets optimized so often, but 1k/4k do not?

[skander36]

Do any of the FW release notes for 1k/4k ever say "optimized calibration" ?
In DHO800/900 the release notes on almost all the FW's say that. Wondering why 800-900 gets optimized so often, but 1k/4k do not?

I don't remember about issues about (auto)calibration on 1K.
My scope  arrived from factory with an offset of 110 mV/1V scale on CH1 and i did performed autocailbration with success.
Maybe some others owners?

[Randy222]

For the 1k-4k
Anyone have the chipset device name that is used by the pwm_fan.ko driver?

[sprhawk]

Is DHO1000 actually locked down by TrustZone of RK3399 ?

If not, we can actually re-write the whole application in Open Source (GPL) license to replace the whole Rigol ones

[zrq]

Is DHO1000 actually locked down by TrustZone of RK3399 ?

If not, we can actually re-write the whole application in Open Source (GPL) license to replace the whole Rigol ones

I don't see any indication of locking down. However, rewriting the application will take a serious amount of time and development skill (including but not only reverse engineering). It would be nice if we can gather some effort to improve the official firmware by making some mods (for example, make the LXI binary readout faster so the scope can work better as a digitizer), but a major rewrite by community doesn't seem practical to me.

[ebastler]

Most readers here are probably following that other thread anyway, but just for awareness: There has been some nice progress modifying the DHO800 software on the GUI level, and some early work digging deeper into the Android system, even trying to replace it with "plain" Linux. Have a look at the most recent page or two of posts if you have not followed this:
https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/

[sprhawk]

Great ! Thanks

[tonywood]

Seeing that the HDO1074 can be had for $548 online. Looks like we now have three low cost 12bit options. The DHO804 and now Siglent SDS804X HD. Great times for digital scopes!

[Veteran68]

Seeing that the HDO1074 can be had for $548 online.

Curious where you're seeing the 1074 now for $548. The 1074 was available for $599 during Black Friday and through December. Some speculated they would be slashing prices more permanently once Siglent's competing 12-bit scopes landed, but all I see right now is a $100 reduction to $899 at RigolNA and every online dealer that just popped up.

The 1072 lists for $599 right now, are you sure that's not the one you're seeing?

[tonywood]

You're right, it was at ValueTronics for 609.14 and they had a 10% off coupon. Looks like it's back to 899 now.

[sizziff]

Hi everyone
My experiments with vendor.bin (1072 operating in 4804 mode) show that 1072 displays a signal up to 800 MHz, but all measurements are overestimated by two times.
It turns out that the bandwidth limitation is softwired, and physically the DHO1000 bandwidth is much wider than 200 MHz.

I read the entire thread, but I still didn't understand if there is any way to expand the DHO1000 to 400 MHz?

[zrq]

I don't have a perfect solution (still no time to look in to the 50Ohm gain problem),  but this accounts for what I did: https://www.eevblog.com/forum/testgear/hacking-the-hdo1khdo4k-rigol-12-bit-scope/msg5247882/#msg5247882

I have confirmed the hackable bandwidth for a HDO1074 is indeed more than 500 MHz.

[sizziff]

I don't have a perfect solution (still no time to look in to the 50Ohm gain problem),  but this accounts for what I did: https://www.eevblog.com/forum/testgear/hacking-the-hdo1khdo4k-rigol-12-bit-scope/msg5247882/#msg5247882

I have confirmed the hackable bandwidth for a HDO1074 is indeed more than 500 MHz.

Thank you for your reply, obviously you have done a great job. But I don't have the competence to get into the source code, can you share the finished binary file?
Or maybe you can make a more detailed instruction(not in all the details, but at least the main steps)?

[TurboTom]

After the findings of the effect of H/W configurations in the DHO800/900 thread, I thought I'ld have a closer look at the DHO1000 hardware configuration - albeit, as I can preemptively already report -- with little further success, but at least with some knowledge gain... 

Since there are no "rear side" photos of the DHO1000 PCB available yet, I took some and added them to this post. There are four resistors that apparently code the H/W version in a binary manner. I hoped for a possibility that the configured H/W may affect the function of the 50 Ohms input relays, but I had to find out it doesn't. Instead, when I changed my H/W version from originally 2 to 0, I wouldn't get a trace on the screen anymore. The scope shows its trigger status as Auto / Run but no trace whatsoever on any channel. Obviously, I returned the configuration back to 2.

Another interesting detail is that the parts not populated on the 1000 vs. the 4000 variety of Rigol's scope are not only limited to the "accessible" side of the PCB, but there's also a lot of stuff missing on the "rear" in the second ADC's vicinity.

Moreover, I found it very difficult to remove the H/W config resistor (10kOhm) -- even 400C hot air for a considerable time and a decent flow rate wouldn't do the trick for me, and I didn't want to go any hotter. It seems there's so much copper planes in the inner layers of the PCB that it conducts the heat away very quickly, and the lead-free solder also doesn't help to ease things up. Finally, I used the "iron" to work on the config R which turned out okay. But this shows that a "serious" modification (i.e. adding the missing ADC, PSU and decoupling stuff) woud require really decent SMD rework tools -- a simple hot air station probably won't be enough unless one would be going high-risk...

Some more details / findings, yet not documented in photos:
- The metalwork of the scope provides orifices for one more USB host, two BNCs next to them and then a place for Rigol's passive logic (MSO) probe connector. There are no such counterparts prepared in the plastic front.
- There are provisions for three more pushbuttons (even equipped with LEDs already) above the "Math" button.
- I found the input BNCs not to be fixed to the front metalwork with nuts (on my specimen). This eliminates the need to remove the whole chassis from the plastic front when removing the PCB, but puts all stress on the PCB when attaching/removing probe connectors. The heat sink with its many screws supports that area pretty well but I'll still remember to be more carefull when I attach a probe with a massive compensation box like Tek's P6015... I'm not sure if it's the same for the DHO4000 with it's additional probe detect/power PCB where bigger probes are expected to be attached.

So unfortunately, no progress with a "Hack", but at least some information gained... 

Cheers 

[mrisco]

Anyone tried this: https://github.com/mriscoc/RIGOL_DHO800_DHO900_GUI/releases/latest in the HDO1k/HDO4k?

[dave2]

Hello everyone, I am new here so apologies if I missed a post with content similar to my problem. I am a hardware engineer not a softie

I bought a DHO1074 a few months ago as I was looking for something small and a bit more up to date than I had.

I noticed a few things that were not as expected and  so came across this forum thread and thought I would try unlocking my scope with the aid of the brilliantly written tutorial.

When I received it, I installed the latest firmware. I successfully connected using a wifi adapter (I had to drop the ./ at the start of the command).  The problem I have is when I retrieving the key data. Opening the file it contains Chinese characters.
I tried a second time with the same result. I hope this is not a an anti hacking strategy but an error on my part.
Thanks for your help.
Dave

 

[skander36]

You don't need to open that file. It has be in the same folder with the script file (rgtool.go). Read again the hack method.