value offset
Partition Number: 1
Image Word Len: 0x000D6468 0x00000CC0 ?
Data Word Len: 0x000D6468 0x00000CC4 ?
Partition Word Len: 0x000D6468 0x00000CC8 ?
Load Addr: 0x00000000 0x00000CCC ?
Exec Addr: 0x00000000 0x00000CD0 ?
Partition Start: 0x000045D0 0x00000CD4
Partition Attr: 0x00000020 0x00000CD8
Section Count: 0x00000001 0x00000CDC ?
Partition Checksum Offset: 0x00000000 ` 0x00000CE0 ?
Unknown 0x00000250 0x00000CE4
Unknown 0x00000000 0x00000CE8
Unknown 0x00000000 0x00000CEC
Unknown 0x00000000 0x00000CF0
Unknown 0x00000000 0x00000CF4
Unknown 0x00000000 0x00000CF8
Checksum: 0xFFD78A86 ` 0x00000CFC
Partition Number: 2
Image Word Len: 0x00003002 0x00000D00 ?
Data Word Len: 0x00003002 0x00000D04 ?
Partition Word Len: 0x00003002 0x00000D08 ?
Load Addr: 0xFFFF0000 0x00000D0C ?
Exec Addr: 0xFFFF0000 0x00000D10 ?
Partition Start: 0x000DAA40 0x00000D14
Partition Attr: 0x00000010 0x00000D18
Section Count: 0x00000001 0x00000D1C
Partition Checksum Offset: 0x00000000 ` 0x00000D20 ?
Unknown 0x00000260 0x00000D24
Unknown 0x00000000 0x00000D28
Unknown 0x00000000 0x00000D2C
Unknown 0x00000000 0x00000D30
Unknown 0x00000000 0x00000D34
Unknown 0x00000000 0x00000D38
Checksum: 0xFFF3C348 0x00000D3C
Partition Number: 0
Image Word Len: 0x00004002 0x00000C80 ?
Data Word Len: 0x00004002 0x00000C84 ?
Partition Word Len: 0x00004002 0x00000C88 ?
Load Addr: 0x00000000 0x00000C8C ?
Exec Addr: 0x00000000 0x00000C90 ?
Partition Start: 0x000005C0 0x00000C94
Partition Attr: 0x00000010 0x00000C98
Section Count: 0x00000001 0x00000C9C ?
Partition Checksum Offset: 0x00000000 ` 0x00000CA0 ?
Unknown 0x00000240 0x00000CA4
Unknown 0x00000000 0x00000CA8
Unknown 0x00000000 0x00000CAC
Unknown 0x00000000 0x00000CB0
Unknown 0x00000000 0x00000CB4
Unknown 0x00000000 0x00000CB8
Checksum: 0xFFFF37E8 0x00000CBC
Looking at some schematics with DDR3 and tracing connections looks like only pins E7 D3 F3 G3 C7 B7 are individual connected to CPU, in our case FPGA.
So if measuring on unpopulated place on this pins and find that is not connected then may be dummy chips.
If there are some readings then PCB have traces from unpopulated place to FPGA but that not means that if soldered will be used.
I think we need to compare content of SPI flash chip between models.
https://www.eevblog.com/forum/blog/eevblog-1563-new-$389-12bit-rigol-dho800-scope-teardown/msg5046301/#msg5046301
Looking at boot log of FPGA and at BOOT.bin from latest firmware and seems to be match on partition addresses and checksums.
Don't know what version was on Dave scope at that date and I search for older firmware and I found one in which BOOT.bin(from DHO800_DHO900(Software)UpdateV00.01.00) is different but partition addresses and checksums are identical.
So either checksums are dummy or are for something else.Code: [Select]value offset
Partition Number: 1
Image Word Len: 0x000D6468 0x00000CC0 ?
Data Word Len: 0x000D6468 0x00000CC4 ?
Partition Word Len: 0x000D6468 0x00000CC8 ?
Load Addr: 0x00000000 0x00000CCC ?
Exec Addr: 0x00000000 0x00000CD0 ?
Partition Start: 0x000045D0 0x00000CD4
Partition Attr: 0x00000020 0x00000CD8
Section Count: 0x00000001 0x00000CDC ?
Partition Checksum Offset: 0x00000000 ` 0x00000CE0 ?
Unknown 0x00000250 0x00000CE4
Unknown 0x00000000 0x00000CE8
Unknown 0x00000000 0x00000CEC
Unknown 0x00000000 0x00000CF0
Unknown 0x00000000 0x00000CF4
Unknown 0x00000000 0x00000CF8
Checksum: 0xFFD78A86 ` 0x00000CFC
Partition Number: 2
Image Word Len: 0x00003002 0x00000D00 ?
Data Word Len: 0x00003002 0x00000D04 ?
Partition Word Len: 0x00003002 0x00000D08 ?
Load Addr: 0xFFFF0000 0x00000D0C ?
Exec Addr: 0xFFFF0000 0x00000D10 ?
Partition Start: 0x000DAA40 0x00000D14
Partition Attr: 0x00000010 0x00000D18
Section Count: 0x00000001 0x00000D1C
Partition Checksum Offset: 0x00000000 ` 0x00000D20 ?
Unknown 0x00000260 0x00000D24
Unknown 0x00000000 0x00000D28
Unknown 0x00000000 0x00000D2C
Unknown 0x00000000 0x00000D30
Unknown 0x00000000 0x00000D34
Unknown 0x00000000 0x00000D38
Checksum: 0xFFF3C348 0x00000D3C
Partition Number: 0
Image Word Len: 0x00004002 0x00000C80 ?
Data Word Len: 0x00004002 0x00000C84 ?
Partition Word Len: 0x00004002 0x00000C88 ?
Load Addr: 0x00000000 0x00000C8C ?
Exec Addr: 0x00000000 0x00000C90 ?
Partition Start: 0x000005C0 0x00000C94
Partition Attr: 0x00000010 0x00000C98
Section Count: 0x00000001 0x00000C9C ?
Partition Checksum Offset: 0x00000000 ` 0x00000CA0 ?
Unknown 0x00000240 0x00000CA4
Unknown 0x00000000 0x00000CA8
Unknown 0x00000000 0x00000CAC
Unknown 0x00000000 0x00000CB0
Unknown 0x00000000 0x00000CB4
Unknown 0x00000000 0x00000CB8
Checksum: 0xFFFF37E8 0x00000CBC
Just did some checks.
Hard to measure under bga chips.
Just poke on external balls for better result need to desolder actual chip.
First I look at pins E7 D3 F3 G3 C7 B7 of not mounted chips, good news is there are some readings in diode mode on multimeter so this pins are connected somewhere.
Pins T3 T7 T8 (address line A13 A14 A8 ) seems to be connected via some resistors (that line of resistors under GDP2BFLM-CA) to their corespondent on GDP2BFLM-CA mounted chip
But T2 (reset) seems to be connected somewhere else or is connected via a higher value resistor.
On address lines value of resistor was around 43 ohms
Also pins A2 A3 A7 (data lines of not mounted chips) doesn't seems to be connected to their corespondent on mounted chip or are connected via a higher value resistor.
In simple words.
PCB seems to have tracks for missing DDR3 chips.
Address lines seems to be common for all three chips.
Data lines seems at first that are not common for DDR3 chips but are connected somewhere.
Reset also seems like is not shared for all chips.
So I'll order 3 MT41K256M16TW-093 and replace GDP2BFLM-CA and if all OK populate also missing chips.
It will take a while until that.
Also take a dump of that 25Q128.
Need to do some comparation.
I don't know on what version is my scope since in about is only 00.01.01
Now let's hope that someone will upload one from other models with more RAM
So only area 0x00000000 - 0x00376907 contain something can't identify.
Looks similar to other files, maybe old version of BOOT.bin or maybe something used for FPGA initialization, who knows?
Now let's hope that someone will upload one from other models with more RAM
It may be
from reload_fpga.sh
is declared as option for --default command option
default_fw_path=/rigol/FPGA/BOOT.bit
default_download_addr=0x000000
But there is no BOOT.bit only bin
bit file is SPU_H12S1.bit I don;t know what is used for.
Also looking at that script I see that after doing and inserting xdma.ko module check for a file and based on that set FPGA boot address
The decompiles SMALI files are in the zips I posted back a few pages. APKTOOL decompiles of all 3 or the Rigol APK's (web scope launcher). Edit the SMALI files all day if you like.
Here's what the .com.rigol.scope MainActivity looks like. attached as .smail.txtYes, thank you, I saw your message with a link to a decompiled application, but to be honest, I’m not yet sure that I’m ready to dive even into Java, not to mention SMALI The last time I dealt with Java was about 12 years ago )However, I am not sure you need to edit SMALI files. The process is to code in Java, compile it, convert to dex using Android dx tool, dex --> smali using baksmali tool
Read these links
https://stackoverflow.com/questions/29051781/convert-java-file-to-smali-file#29052019
https://payatu.com/blog/an-introduction-to-smali/I have seen many reports that the Java code obtained during the decompilation process has inaccuracies and obvious errors. For example, a function may contain a return statement first and then the function code itself. I'm afraid that it will be almost impossible to find and fix all such jambs. At the same time, SMALI has code that matches the application exactly. In addition, I have come across mentions that when compiling from Java, some kind of fiddling is necessary with the external dependencies to be plugged in, or rather with their versions. But here I'm not sure, because... I haven't studied this issue in depth. In fact, the first reason is already quite enough to be very skeptical about assembling from decompiled Java sources
Thanks! @empeka
Is your DHO914 with 3 DDR3 RAM chips?
Compared and
0x00400000 - 0x00776907 is BOOT.bin from FPGA folder size 0x376908
0x00776908 - 0x007FFFFF blank , FF's only
0x00800000 - 0x00B76907 is BOOT_SelfTest.bin from FPGA folder size 0x376908
0x00B76908 - 0x00FFFFFF blank , FF's only
are identical with my DHO804
But area 0x00000000 - 0x00376907 many differences.
Thanks! @empeka
Is your DHO914 with 3 DDR3 RAM chips?
Compared and
0x00400000 - 0x00776907 is BOOT.bin from FPGA folder size 0x376908
0x00776908 - 0x007FFFFF blank , FF's only
0x00800000 - 0x00B76907 is BOOT_SelfTest.bin from FPGA folder size 0x376908
0x00B76908 - 0x00FFFFFF blank , FF's only
are identical with my DHO804
But area 0x00000000 - 0x00376907 many differences.
I already asked in another post what the hidden DDR functions are in the oscilloscope menu. If I may repeat again, what are these hidden settings, especially for DDR?
It is the upper part of the address space that is responsible for initializing FPGA modules!
Looking at some schematics with DDR3 and tracing connections looks like only pins E7 D3 F3 G3 C7 B7 are individual connected to CPU, in our case FPGA.
So if measuring on unpopulated place on this pins and find that is not connected then may be dummy chips.
If there are some readings then PCB have traces from unpopulated place to FPGA but that not means that if soldered will be used.
I think we need to compare content of SPI flash chip between models.
I already asked in another post what the hidden DDR functions are in the oscilloscope menu. If I may repeat again, what are these hidden settings, especially for DDR?Is this from a native 924?
What hardware type # is the device?
My 804 runs as a 914, but I don't see such items in any menu. FW 00.01.02.00.00
It is the upper part of the address space that is responsible for initializing FPGA modules!
What makes you think so?
Not true for the Xilinx FPGAs I have used.
fpga_boot_addr=$(getprop persist.rigol.fpga.boot.addr)
if [[ x"${fpga_boot_addr}" == x"" ]]; then
fpga_boot_addr=0x000000
/rigol/tools/spi2boot ${fpga_boot_addr}
Is your DHO914 with 3 DDR3 RAM chips?
I think I have a method to edit some in basic APK (java) stuff. Not anything in the .so C files (not yet).
So, maybe I try to change CH1 to be "not yellow" ?
If we can achieve that then we know we can edit and run mods.
Is your DHO914 with 3 DDR3 RAM chips?yes, 3* K4B4G1646E-BYMA
I have an 804. If you press "About" three times you will enter debug mode.