Hacking the Rigol DHO800/900 Scope

[Fungus]

When I run adb connect 192.XXXXXXX after a while the message "failed to connect 192.XXXXXXXX" appears.
When I try it again, message "already conneted to 192.XXXXXXXX" appears.

Do you have anything else connected, eg. a phone on USB?

Try doing "adb disconnect"

[Martin72]

The scope is connected via LAN cable to the router, webserver access is no problem, scope is online.
My smartphone is also connected via wlan to the router.
EDIT: second pic attached

[Martin72]

Second try with another pc (notebook), same results.

[rpro]

Second try with another pc (notebook), same results.

Use  scope-ip-address:55555 (five 5's)

The scope should connect right away. If it is hanging, reboot the scope and PC and try again, with the five 5's (not 4).  Hope this helps.

[Martin72]

This was it 

And now...tadaa..

[Fungus]

This was it 

And now...tadaa..

 

[Fungus]

Note that your serial number is in vendor.bin so it will change when you do this.

I predict a lot of 'scopes out there with identical serial numbers...

[Martin72]

 

So, before calibration, only channel 1 have a "huge" offset.
BTW, did you notice that you now have 200µV/Div. ?

[Fungus]

BTW, did you notice that you now have 200µV/Div. ?

Oh, yeah... 

[Martin72]

Offset is not getting better after calibration...
More, it varies with the different V/div steps.
Is there are solution for it ?

Edit:

so you are running OS 01.01.19?

I think not.

[Mechatrommer]

I predict a lot of 'scopes out there with identical serial numbers...

hubertyoung's serial number... who cares?

So, before calibration, only channel 1 have a "huge" offset.
BTW, did you notice that you now have 200µV/Div. ?

so you are running OS 01.01.19? with legit in-scope upgrade method? and then use adb or souldevelop's tool to push hubertyoungs DHO924 verdor.bin? can you check offset for all channels at 200uV, 500uV, 1mV/div etc to b correct? i got all kind of weirdness when overwriting DHO924's vendor.bin into OS V01.00...

Offset is not getting better after calibration...
More, it varies with the different V/div steps.
Is there are solution for it ?

Edit:

so you are running OS 01.01.19?

I think not.

so you got the weirdness thaat i experienced... up to 1 or 5V/div has some nasty offset, but when going up to 10V/div offset is correct again.
later i will try upgrade my legi V01.00 to V01.19 fungus provided and see what happens if i overwrite the DHO924 vendor.bin alone. if calibration ok, then thats should be the better hack. upgrade to DHO924, but still using latest (bug fixed) OS...

[Fungus]

so you are running OS 01.01.19?

I think not.

If you press "About" three times you get the extended firmware version number... 

Offset is not getting better after calibration...

Did self-cal report success?

There's extended calibration options if you enable debug mode as above. Don't ask me what they do though. Some of them said "failed" on mine when I tried them.

[Martin72]

Did self-cal report success?

Yes..

[Fungus]

Did self-cal report success?

Yes..

I just went to 924 again and I have an offset on channel 3. I'm sure I didn't have that before... 

[Martin72]

It varies...

So, after upgrading following your link, the version shows this (Pic).
After that doing the self-cal again, offset problems still persists.
I think I´ll going back to 804..

[Mechatrommer]

It varies...
So, after upgrading following your link, the version shows this (Pic).
After that doing the self-cal again, offset problems still persists.
I think I´ll going back to 804..

go back to original 804, do the legit upgrade to 01.19, then push vendor.bin again. this is what i'm going to try, but not tonight...

[Martin72]

go back to original 804

Dit it, everything´s fine again.
It would probably be better if one could intervene specifically in one's own bin file, but that is beyond my abilities, clear case.

do the legit upgrade to 01.19

I had taken the link from Fungus, it seems that it is not, if you look at my picture "version" (that was after the firmwareupgrade).

[Martin72]

There must be something in the (very small) .bin file that "changes" the offset, because what I have noticed in the last 2 hours is that the offset "varies" depending on the setting of the sensitivity.
For example, you can see a small offset at 5V/div, which should then be "huge" if you go further down.
But this is not so, it is sometimes smaller, sometimes larger.
If I didn't know better, one could think that there are calibration data in the .bin file that don't fit to another scope.
Or it has something to do with the additional 200µV/div, which does not exist in the 800, that something gets mixed up.

[Fungus]

I'm trying to understand some of the early posts in this thread:

https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5074867/#msg5074867

It seems that all that's in vendor.bin is a model number, a serial number, and a MAC address.

In that case: The options that you get are based only on the model number in that file. They aren't selected individually.


The post after that one doesn't make much sense:

https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5075035/#msg5075035

"simply replacing the vendor.bin will cause a 5mV-10mV offset to appear, and it can't be eliminated by self-cal."

Why should that be?

[Fungus]

There must be something in the (very small) .bin file that "changes" the offset, because what I have noticed in the last 2 hours is that the offset "varies" depending on the setting of the sensitivity.
For example, you can see a small offset at 5V/div, which should then be "huge" if you go further down.

That's easy: Each individual range will have its own offset/scale values, all created during calibration.

[Martin72]

Why should that be?

We are currently experiencing that this is the case.
Why this is so, currently no idea, maybe it still comes.

[Fungus]

I found out you can load any firmware you want. It doesn't complain about downgrades...

I've just gone back to 1.00, I wanted to check something.

[Fungus]

I analyzed their apk software using IDA and found that hdcode was indeed used, and this part of the call was made before the system was calibrated, so this can be explained by overriding the vendor.bin Upgrading the DHO800 to the DHO900 will have an offset zero potential and be very noisy. So it's also not clear to me why they don't get the model ID directly through the information inside the vendor.bin.

Could you expand on this? We're trying this upgrade now and hitting this problem.

[Fungus]

I found out you can load any firmware you want. It doesn't complain about downgrades...

I've just gone back to 1.00, I wanted to check something.

I confirmed it!

With firmware 1.00 I see this in my "Options":


After upgrading to firmware 1.01 I see this:

[Martin72]

We had already established that today.
For me, however, this also means that something can still happen with our 800 models.
With a little patience and cleverness (which I certainly do not have in this matter), you could make an 824 with 50 Mpts memory from the 804.