Hacking the Rigol DHO800/900 Scope

[Fungus]

I was actually using the included power supply in the belief it would ground the scope via the 3-pin Schuko plug. Cause why else would they include a power supply with a Schuko plug, when most USB chargers have 2-pin Euro plugs.

I'm not sure how good a ground connection they can make with a USB-C connector.

It's better than nothing I guess but would you trust your life to it?

[norbert.kiszka]

I was actually using the included power supply in the belief it would ground the scope via the 3-pin Schuko plug. Cause why else would they include a power supply with a Schuko plug, when most USB chargers have 2-pin Euro plugs.

I'm not sure how good a ground connection they can make with a USB-C connector.

It's better than nothing I guess but would you trust your life to it?

Did You read all last discussion or just random one post? https://www.eevblog.com/forum/testgear/rigols-new-dho800-oscilloscope-unbox-teardown/msg5590693/#msg5590693

This scope by default is not connected to the PE from grid.

[Fungus]

Did You read all last discussion or just random one post?

All I said was that maybe USB isn't the best way to ground a 'scope for safety purposes.

(or that's what I meant to say)

I also said this a couple of posts above that:

These 'scopes have an earth connector on the back and a big green+yellow cable in the box...

[cte]

I'm not sure how good a ground connection they can make with a USB-C connector.

It's better than nothing I guess but would you trust your life to it?

Yes, that's definitely a valid point to consider. And the traces on the PCB might even be to narrow to hold any large short-circuit current.

On the other hand, the same applies to the ethernet jack. My scope's 4Ω resistance from BNC barrel to protection ground was only coming from the shielded cable of the ethernet connection. The next ethernet switch was a 5-port desktop device without any grounding, so the 4Ω were made from a complex path of multiple connections and protection class I devices somewhere.

I was actually using the included power supply in the belief it would ground the scope via the 3-pin Schuko plug. Cause why else would they include a power supply with a Schuko plug, when most USB chargers have 2-pin Euro plugs.

I'm not sure how good a ground connection they can make with a USB-C connector.

It's better than nothing I guess but would you trust your life to it?

Did You read all last discussion or just random one post? https://www.eevblog.com/forum/testgear/rigols-new-dho800-oscilloscope-unbox-teardown/msg5590693/#msg5590693

This scope by default is not connected to the PE from grid.

Norbert, please try to calm down a little bit.  Fungus was referring to my assumption that the scope would be grounded through the power supply. Nothing wrong with his statement that the USB-C is probably not designed for currents >1kA as they can occur with shorting mains.

[Fungus]

Yes, that's definitely a valid point to consider. And the traces on the PCB might even be to narrow to hold any large short-circuit current.

I've seen people say they melted the ground clip lead on their probes by connecting it to something naughty.

(but that's useful information/feedback when you're working with dangerous things...)

[norbert.kiszka]

(but that's the sort of information/feedback I'd want...)

So You want less technical explanation? Sure...

PSU made by Liteon and supplied with some of DHO800 and DHO900 series (probably not anymore) is highly unsafe and it wasn't made according to safety regulations. Throw it away and buy Delta or Mean Well instead. Doesn't matter if You chose SELV (separated from PE) or PELV (output negative rail shorted with PE from grid).

https://en.wikipedia.org/wiki/Extra-low_voltage

[AndyBig]

I finally made my way through the Android jungle with its heaps of classes, methods, properties, interfaces, callbacks, etc. And with how it all works in Java assembler (.smal). It took me quite a while, but I finally implemented opening the main window to full screen and collapsing it to standard size by clicking on the icon in the upper left corner of the window Well, I repeated from the modification of the previous version the reduction of the measurement sways and the display of the specified probe divider.

[AndyBig]

I've seen people say they melted the ground clip lead on their probes by connecting it to something naughty.

With due diligence, you can burn not only the ground clamp, but also the hook on the central contact )

[Carbedd]

Hello to everyone, I just read anything about this MAD Scope on this forum, my head is smoking... but the job of everyone of you is incredible.

Many compliments to everyone 

P.S. I'm waiting for my new one 804

[mrisco]

Dot mode, exploration and proof of concept

[norbert.kiszka]

What means word pseudo in here? Those dots are real samples or You just "dotted" it?

[gf]

Dot mode, exploration and proof of concept

Aim of Dots Mode (as we know it from Siglent scopes) is the emulation of Random Interleaved Sampling. The prerequisite for this is that the trigger engine determines the trigger point with a higher horizontal resolution than one sample interval of the acquisition sample rate, in order that the waveform of a periodic signal can build up succesively by accumulating sparse points of many traces (each trace with an individual high-resolution horizontal offset) on the persistent display. As with ETS, this allows the Nyquist limit to be overcome for periodic signals. This is of particular interest at low sample rates where there is practically no anti-aliasing filtering.

Does your implementation do that? Does this scope actually provide a high-resolution trigger point position (or horizontal offset) for each acquisition? If not, then I don't see how this kind of Dots Mode can be implemented.

[mrisco]

What means word pseudo in here? Those dots are real samples or You just "dotted" it?

From Rigol manuals:

* Vectors: the sample points are connected by lines and displayed. Normally, this mode can provide the most vivid waveform to view the steep edge of the waveform (such as square waveform).
* Dots: display the sample points directly. You can directly view each sample point and use the cursor to measure the X and Y values of the sample point.

I use the the screen samples memory to get the points, but they seems to be lightly different to the vectors that the DHO shows in the screen. So, maybe the system does some processing before of drawing trace in the screen.

I'm trying to understand some differences, here are some examples. (Captures directly from the device screen)

[iMo]

..I use the the screen samples memory to get the points, but they seems to be lightly different to the vectors that the DHO shows in the screen. So, maybe the system does some processing before of draw the trace in the screen..

They usually do the sinc interpolation, afaik..

[norbert.kiszka]

Can You try single shot with lowest time base and full sample rate 1.25GS/s? Im curious how it will look - if it still will be with interpolation or not.

[mrisco]

Can You try single shot with lowest time base and full sample rate 1.25GS/s? Im curious how it will look - if it still will be with interpolation or not.

[norbert.kiszka]

I mean lowest time base, not highest.

[AndyBig]

So, I have prepared a short instruction on disabling signature verification by the system and installing modified web control and oscilloscope applications.
Disabling signature verification is necessary so that the system considers the installed applications trusted (supposedly they are signed with a system key) and gives these applications access to all services. Without this, the modified oscilloscope application will not be able to save screenshots, and the modified web control will not be able to show the oscilloscope screen.
It is advisable to have a backup of the memory card image just in case, although if you follow the instructions exactly, you should not need it But in extreme cases, this backup can be found on the network or asked from someone

1. System patch to disable signature verification. It is done only once, there is no need to repeat it in the future when updating applications to modified or original ones.

For this, you will need ADB - https://developer.android.com/tools/releases/platform-tools , you need to download it and unpack it into a separate directory. It will be convenient to add this directory to the system environment variables so that you can call adb.exe from anywhere, and not just from this folder.
The oscilloscope must be connected to the local network with a cable or via Wi-Fi.
Download and unzip the archive using the link at the end of the post. It contains three files - modified oscilloscope and web control applications, and a patched system file.
Unzip these files to the directory with ADB (or any other if you added ADB to the system environment variables). Run the command line in this folder (open this folder in Explorer and enter the cmd command in its address bar) and then enter the commands shown below in the command line. You need to enter what is marked in bold italics, you can directly copy the specified commands and paste them into the command line.

The first command is to connect ADB to the device by its IP address. The IP address of the oscilloscope can be seen in the oscilloscope itself in the Utility->IO menu. Substitute the address of your oscilloscope instead of 192.168.1.41:
adb connect 192.168.1.41:55555
In response, ADB should report a successful connection:
connected to 192.168.1.41:55555

Now you need to load the patched system file into the oscilloscope:
adb push services.jar /rigol/data/
And get a response about success:
services.jar: 1 file pushed, 0 skipped. 59.7 MB/s (3179392 bytes in 0.051s)

Now run the ADB shell.
adb shell
In this case, instead of the system command line prompt (for example, D:\Rigol>), the oscilloscope command line prompt will appear, and then the commands are entered in this command line:
rk3399_rigol:/ $

Get administrator rights:
su
The $ symbol in the prompt will change to the # symbol:
rk3399_rigol:/ #

Make the system partition writable:
mount -o rw,remount /system

Delete the original system file:
rm /system/framework/services.jar -f

Also delete its remnants in another directory:
rm /system/framework/oat/arm64/services.odex -f

And delete its cache in another directory too:
rm /data/dalvik-cache/arm64/system@framework@services.jar@classes.dex

Move the patched system file previously loaded into the oscilloscope to the system section:
mv /rigol/data/services.jar /system/framework

Return the system partition to read-only mode:
mount -o ro,remount /system

Synchronization command to ensure that all file system changes are saved:
sync

Reboot the oscilloscope:
reboot now

During the reboot, the ADB shell will be dropped and the command line prompt of your system will return. That's it, now your oscilloscope takes all applications at their word that they are system applications, without checking the correctness of the key they are signed with
After the oscilloscope boots, you can install modified applications and they will work exactly the same as the original ones, without any restrictions (of course, if they are compiled under the system account).

2. Loading modified oscilloscope and web control applications.

First, just in case, give the ADB connection command again:
adb connect 192.168.1.41:55555
Most likely, ADB will respond that it is already connected:
already connected to 192.168.1.41:55555

Uninstall the installed oscilloscope application:
adb uninstall com.rigol.scope
The application on the oscilloscope should close and a success response should be given:
Success

Install the modified application:
adb install -g -r Sparrow_mod.apk
This may take quite a long time, but in the end a success response should be given:
Performing Streamed Install
Success

Repeat the same for the webcontrol application:
adb uninstall com.rigol.webcontrol
adb install -g -r Webcontrol_mod.apk
The oscilloscope application should start itself within 5-20 sec, but if it does not start - just turn off the oscilloscope by long pressing the power button (or by pulling out the power connector) and turn it on again.

I will describe the changes in the modified oscilloscope and web control applications in the next post.

Archive with files Sparrow_mod.apk, Webcontrol_mod.apk and services.jar: https://github.com/Andy-Big/Rigol-DHO800-900-Sparrow_mod/releases/tag/a002_00.01.04.00.02

[AndyBig]

Modified oscilloscope application version a002

• added display of probe dividers in channel icons
• added display of date and time in the lower right corner
• reduced the height of collapsed measurement results items on the right panel, so that now you can see up to 9 measurement results at a time; at the same time, the font of the values ​​​​has been slightly increased for better readability
• the measurement results panel has been made slightly more transparent
• the sensitivity area of ​​​​the arrows for expanding and collapsing measurement items on the right panel has been increased, so that now it is much easier to hit them (in the original interface, this is a real disaster)
• the main oscillogram window can be expanded to full screen and returned to its original size by clicking on the semi-transparent icon in the upper left corner of the window

Screenshots of the modified application:







Modified web control application
- added a button for a screenshot in PNG format, which gives a higher quality picture:


- improved image quality in the "live" video of the oscilloscope screen. For comparison, I provide a screenshot from the video in the original web control and in the modified one:

[mrisco]

This is a little demo showing the average of 10 frames  (up to 100) of the FFT and peak search.

[norbert.kiszka]

I mean lowest time base, not highest.

I missed two more screens (Im blind). Anyway, now I can see, those dots are after interpolation - not original samples from ADC.

[mrisco]

I missed two more screens (Im blind). Anyway, now I can see, those dots are after interpolation - not original samples from ADC.

No, your message arrived just when I was editing and uploading two more images. The last two show differences when the trigger is running and stopping.

[lordstein]

i have problem with the probe compesation on the chanel 3, is the chanel since I already tried another probes.

[mwb1100]

Have you run self-calibration (with all probes removed)?

[norbert.kiszka]

i have problem with the probe compesation on the chanel 3, is the chanel since I already tried another probes.

Looks like overcompensated. Probably self-calibration will do nothing, but it's 15 minutes, so it's worth to try.

If self-calibration will not help, reach Your seller and request guaranty service. I guess it's due to the flux residues or failure at manufacturing IC which is the heart of all four AFD.

Can You measure input capacitance of all four channels?