Hacking the Rigol DHO800/900 Scope

[Fungus]

Good morning, afternoon or evening depending on where you all are in the world. I have an issue when trying hack my DHO804 on 1.0.4. If i try and follow the instructions on the video and went to the pined link for the updated instructions for the newer firmware.

What video? What link? What version does it show after the update?

All you need to do is put it on a USB stick then go to "update" in the utility menu.

[Norros87]

[/quote]

What video? What link? What version does it show after the update?

All you need to do is put it on a USB stick then go to "update" in the utility menu.
[/quote]

 hello, i am referring to the one on page 1 of this topc that is in top post.  There is a link to a video under the line "MOD EDIT: Here is the latest instructions:" that Video links to a video for newer firmware above 1.0.1 as the pinned comment. Since my scope is on 1.0.4 i went to that link. its the following video posted by The Retro Channel.



While that Video dose not state it is for 1.0.4 multiple people hare stated it worked for them. however when i fallow the steps in that video the Scope will boot and report as a 924 when i try and prove probe for a signal it dose not see anything. if i connect the calibration post on the front next to channel 4 and hit auto it just says no signal and will default back to channel one regardless of what channel the probe is on.

I also tired the to fallow the bellow instructions that where also on the original post as well. but i just get a black screen and it never really boots.  The only change i had was flashed the image to a new SD card so i didn't lose the current working OS.


@hubertyoung has provided a DHO804 FW1.14 image with the DHO924 vendor file preloaded. It can be extracted using 7zip then flash using HDD Raw Copy Tool (compressed image).

https://mega.nz/file/UjBC3KRY#Kqv1BCHNQdPcUGMfR8IqbuUwHUsUhU4GpO1keTAXqf8

@Luc7777 provided some guidelines on how has has achieved this.

Quote from: Luc7777 on September 22, 2023, 06:48:48 am
Hi,

This is what I've done:
1. Run the Win32 Disk Imager
2. Backup the SD
3. Flash the SD with the image from the link
4. Run the claibartation (offset gone) - device identifies as DHO804
5. Connect the scope to ethernet
6  Run adb:
    6.1 adb devices
    6.2 adb connect 192.xxx.x.xxx:55555
    6.3 "adb pull /rigol/data/vendor.bin"
    6.4 backup the generated vendor bin file from the adb folder to a new location
    6.5 copy in the adb folder the DHO924 image
    6.6 "adb push vendor.bin /rigol/data"

[norbert.kiszka]

Ad 1. To make a copy of any disk (including SD card), we don't need to use any "win32 imager" or any other software, beside of anything able to copy files. Because in the /dev directory there are binary (1:1) representations of all disks, SD card or "fake" (loop devices) disks. Source file to make a binary image of SD card: /dev/mmcblk0

To flash SD card with image, we can do the opposite. Copy from image file into SD card device file.

[joseblo]

I'm just starting the process based on finding the same video, and ordering a Rigol HSO804. I knew they used to be hackable years ago, but didn't realize it was still a thing.

Of course I expect it will also have the latest FW 1.04 so I'm quite interested in your results. I won't have scope for a few days still, but hoping the reflash and recalibration goes smoothly.

Pleas post any updates or if you find a more recent thread. Once I get mine, I'll report if it goes well, or there are any issues.

*** edit ***
I was able to find a more recent post from Dec 2024 with an updated 8xx Model config. Hope that helps.
Also, look at page 61 of this Forum Thread.

As you know, the new firmware version 00.01.04.00.02 supports the new DHO824 model with a bandwidth of 200 MHz and a memory depth of 50M, so you can change your DHO8xx to 824, and not to 924 with its non-working logic analyzer panel.
I recompiled (for Windows) the utility from zelea2, adding the DHO824 model to it.
Other community members also added the 824 model to this utility:
- for Mac OS - https://www.eevblog.com/forum/testgear/rigol-dho800900-new-firmware-v00-01-04-00-02-2024111/msg5729989/#msg5729989
- for Android, to run directly on the oscilloscope - https://www.eevblog.com/forum/testgear/rigol-dho800900-new-firmware-v00-01-04-00-02-2024111/msg5732037/#msg5732037


(Attachment Link)

[sonic]

I have a usb wifi module, the model is EW-7611ULB, it seems to be rtl8723 driver. It can connect to wifi using the forum method, but it cannot connect to wifi automatically after restarting, and the wifi is disabled in the setting, so adb must be used to deal with it. I would like to ask how to make the wifi automatically reconnect when it restarts, assuming I don't have a keyboard or hub

See e.g. here and leave ethernet disconnected.

[Norros87]

So i tried using the 824 model and i ran in to the same issue. but i decided to poke around in the firmware to see if i could figure out what was going on. well i came across the self calibrate option in the software tree and ran that and it fixed my issue. See i thought when they said run the calibration i thought it meant the probe calibration and did not realize their was a calibration option for the system. To be fair this is my Frist scope so its a bit of a learning curve on some of this stuff. but yeah if you fallow the steps in the video i linked and make sure you self calibrate the scope it works. I just tested it on my SNES and i could see my button pushes in real time just like before the hack and i was able to find the clock signal on the right pin.

[mrisco]

DHOTools waterfall proof of concept

[dzwer]

I've installed the latest FW v00.01.04.00.02 to my DHO804 and then replaced the vendor.bin file with the ready one from here:https://github.com/norbertkiszka/rigol_vendor_bin/tree/main/generated_ready_to_use/DHO824
And rebooted and in About menu is shown DHO824.
After that I used the generate all options method from here: https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5344076/#msg5344076
I used the second option - with adb push generate_all_options /rigol/data/ method with the file from here: https://github.com/zelea2/rigol_vendor_bin/releases/tag/v1.3
Now I have 25Mpts and 625MSa/s when only one channel is ON...
Anybody know why?
When all 4 channels are ON, then I have 10Mpts and 312.5MSa/s as it should be after the hack, but for 1 channel I don't have the full 50Mpts and 1.25GSa/s...

This is the output from the second step:
WARNING: linker: /rigol/data/generate_all_options: unsupported flags DT_FLAGS_1=0x8000001

Rigol 'vendor.bin' encoder/decoder v1.3 - Zelea
-----------------------------------------------------------
Model: DHO824
SN:   
MAC:   
-----------------------------------------------------------
Generating options for DHO824
-----------------------------------------------------------
RLU BW7T10 EMBD AUTO COMP
-----------------------------------------------------------

[shapirus]

Now I have 25Mpts and 625MSa/s when only one channel is ON...
Anybody know why?

Check if you have any measurement or triggers or frequency counters etc. referring to any channel but the one that is enabled.
They still mark the channels they refer to as being in use even if the channel is "disabled" in terms of the front panel button not being lit.

[norbert.kiszka]

As the shapirus said. First of all, You need to switch trigger to same channel as You have enabled, because in that case You have two channels enabled - second one is "hidden", because it still works, but as a trigger.

any measurement

From my experience, measurements never caused this problem. Only trigger must be switched.

[dzwer]

After SelfCal everything is OK
Now I remember, that the trigger was set to channel 3 or 4, but I switched them OFF to see only channel 1.

[gamerpaddy]

Anyone figured out why trace options are greyed out in xy mode?

[norbert.kiszka]

I think You need to enable test mode (or some other name of this mode - I don't remember right now). Main menu -> utility -> touch (or click) "about" three times.

[peter.andaluz@gmail.com]

I have got the android system installed and got the models and vendor list but when I try to pull the data it says more the one emulator running and I can't get past this. Help would be appreciated.

[DisasterPeas]

I think You need to enable test mode (or some other name of this mode - I don't remember right now). Main menu -> utility -> touch (or click) "about" three times.

This is correct.

[mrisco]

I think You need to enable test mode (or some other name of this mode - I don't remember right now). Main menu -> utility -> touch (or click) "about" three times.

Also, It is enabled by default in the Rigol Sparrow Extended UI

[dzwer]

I have got the android system installed and got the models and vendor list but when I try to pull the data it says more the one emulator running and I can't get past this. Help would be appreciated.

This is from the Windows itself!
If you have a LAN and WiFi on the PC - unplug the LAN and leave only the WiFi to perform all steps for hacking the Rigol.
Also make a restart of the Windows and on fresh start make the procedures.

[RAPo]

Or you could use the -s parameter in the connection string, like
adb -s 192.168.232.2:55555
(of course, use your own IP)

I have got the android system installed and got the models and vendor list but when I try to pull the data it says more the one emulator running and I can't get past this. Help would be appreciated.

This is from the Windows itself!
If you have a LAN and WiFi on the PC - unplug the LAN and leave only the WiFi to perform all steps for hacking the Rigol.
Also make a restart of the Windows and on fresh start make the procedures.

[norbert.kiszka]

I never had such issue on Linux. If I had, I will do: `killall adb` or eventually: `killall -9 adb`.

-9 is the same as -SIGKILL and by default it's SIGTERM which is more gentle, because process is responsible to do "something" and kill itself.

[Fungus]

I have got the android system installed and got the models and vendor list but when I try to pull the data it says more the one emulator running and I can't get past this. Help would be appreciated.

You only need to do adb connect once.

Check you're not trying to connect again.

[norbert.kiszka]

Source code for adb on Windows should be the same as on Linux, beside of system API. So on both it should be impossible to connect twice into the same device. Programmers are not so dumb, not even Google programmers.

[helmy]

Just got a DHO914S and have gone through several pages of this thread. Besides the well-known vendor file swap to identify it as a 924S and unlock 250 MHz bandwidth instead of 125 MHz, are there any other hacks available?

Also, I was looking for a centralized, wiki-style summary of all the key information from this massive thread. The EEVblog wiki https://www.eevblog.com/wiki/ seemed like the ideal place for something like this, but I couldn’t find any relevant entries. Have similar summaries been created for other long hacking threads about test equipment? If so, maybe we could start one for the DHO series?

[mrisco]

... are there any other hacks available?...

You can improve the UI of your DHO924

[Fungus]

Besides the well-known vendor file swap to identify it as a 924S and unlock 250 MHz bandwidth instead of 125 MHz, are there any other hacks available?

https://github.com/mriscoc/RIGOL_DHO800_DHO900_GUI/tree/master

[norbert.kiszka]

https://github.com/Andy-Big/Rigol-DHO800-900-Sparrow_mod