Hacking the Rigol DHO800/900 Scope

[Mechatrommer]

BTW: The newest RigolTool version I have is 1.0.2  if you need it.

yes i need it, can you provide the link..? thanks

https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5077957/#msg5077957

this is the one i'm running and quit disgracefully. i will try to pm him thanks. i just forgot who made it.

[norbert.kiszka]

this is assuming it is correct infos there (about the gpl license, and it being intree). that this is not been honestly mistaken. and it assumes rigol respects the terms of the linux kernel, and the terms of the gpl license?

Correct. And I would say they will send you the code.

They sent all the GPL code for the MSO5000 to @Olliver. And he has it on his Github page...

Maybe Im little dumb, but I cant find it on Github, Gitlab and nowhere else. Anybody has a link or know where I should look?

[antiquant]

How do you think, do users of these DHO really need to look at two zeroes after decimal point for vertical scale ranges in V/ (in channel tabs)? Maybe, respected AndyBig will remove them in his modded Sparrow.apk (as he did it for added by him divider ratios) if he'd like?

Are you talking about these values that are yellow and white? I think numbers after the decimal point are still needed
(Attachment Link)

Well, I think, it depends. Even for 12bit digital scope the reading "500.00uV/" has no physical sense. This is not a bench 8-digits voltmeter but a graticule scale. Zeroes are very round and nifty though.
But you are right if we talk about fine vertical scale adjustment. Up to 3..4 significant decimal digits are legit.

[S2084]

@antiquant I’m very glad that you liked my solution for upgrading the cooling system, it really works even better than I expected.  As for testing LA, I did not check its operation due to the lack of an LA sampler (I just can’t decide on which project I will do it).  Regarding bringing the HW version into line with the 900 model (HW V , some time ago I did some work to select the location of the configuration resistors on the back side of the board, but unfortunately I could not find the combination I needed, I attach a photo of the options I tested.  in the left column is a combination, in the right column is the HW version shown in the scope shell.  I have to wait until someone shows me a photo of the back of the 900 series board.....

[norbert.kiszka]

@antiquant I’m very glad that you liked my solution for upgrading the cooling system, it really works even better than I expected.  As for testing LA, I did not check its operation due to the lack of an LA sampler (I just can’t decide on which project I will do it).  Regarding bringing the HW version into line with the 900 model (HW V , some time ago I did some work to select the location of the configuration resistors on the back side of the board, but unfortunately I could not find the combination I needed, I attach a photo of the options I tested.  in the left column is a combination, in the right column is the HW version shown in the scope shell.  I have to wait until someone shows me a photo of the back of the 900 series board.....

Im curious if its possible to switch into 9 - for DHO1000, maybe 2G samples per second will be possible?

I have 924S, later I will do some photos.

Very likely GPIO pins are read by hdcode_gpio.ko. Most of Linux modules like that reads hardware (gpio, serial, etc) and makes a file inside /proc or /sys. Couple years ago I was changing existing module to make one more file in /proc and that was pretty simple. So if hdcode_gpio.ko is doing this and only this, then it will be possible to give app any model You want without removing case at all.

[AceyTech]

BTW: The newest RigolTool version I have is 1.0.2  if you need it.

this is the one i'm running and quit disgracefully. i will try to pm him thanks. i just forgot who made it.

I tried to put it on DropBox for you, but they complain that it's a deviant file.  Someone reported on the forums that his app was flagged a while back.  I don't use Windows often, so I wouldn't know/care.

I hope this works.

[AndyBig]

Im curious if its possible to switch into 9 - for DHO1000, maybe 2G samples per second will be possible?

No, It is Immpossible. In 1000 there is really different hardware - another FPGA with different firmware and with other, more powerful capabilities.

[AceyTech]

Maybe Im little dumb, but I cant find it on Github, Gitlab and nowhere else. Anybody has a link or know where I should look?

You are a "little dumb", but that isn't the point...   Hey, your words, not mine.    Oh, and relax d00d, I'm joking around.

Olliver's ^{note 2 L's} username here is @Oliv3r, -in case you want to PM him
--Here is his post about his GPL request
--Here is Rigol's open source ack document  Which has the contact info @Rigol to request the info yourself if you want (Section 1.2, FYI).
--Here is Olliver's LAPod Gitlab project page
--and his main Gitlab page with all his projects. 

Good luck.  Maybe this will help you find what you need.

[norbert.kiszka]

Im curious if its possible to switch into 9 - for DHO1000, maybe 2G samples per second will be possible?

No, It is Immpossible. In 1000 there is really different hardware - another FPGA with different firmware and with other, more powerful capabilities.

I know its completely different FPGA, but of course I will not change binaries, just change it to app and Rigol kernel modules can see different "hardware number". Maybe it will change sample frequency in FPGA or maybe not. Is there any reason that I shouldnt try?

EDIT: Why moderators doesnt ban trolls on this forum?

[AndyBig]

I know its completely different FPGA, but of course I will not change binaries, just change it to app and Rigol kernel modules can see different "hardware number". Maybe it will change sample frequency in FPGA or maybe not. Is there any reason that I shouldnt try?

It's the same as putting an ECU from a Ferrari racing engine into an ordinary Ford engine and hoping that the Ford will make the same power as the Ferrari. But as a result, most likely Ford will not be able to drive at all
If you want, try it, of course. But personally, I will consider it a miracle if something working comes out of this

[Antonio90]

The sample rate on the DHO900 is halved when using the digital channels. That suggests the limit is in the FPGA throughput, one way or the other, or the bus is somehow limited by hardware. It doesn't hurt to try though

[norbert.kiszka]

I know its completely different FPGA, but of course I will not change binaries, just change it to app and Rigol kernel modules can see different "hardware number". Maybe it will change sample frequency in FPGA or maybe not. Is there any reason that I shouldnt try?

It's the same as putting an ECU from a Ferrari racing engine into an ordinary Ford engine and hoping that the Ford will make the same power as the Ferrari. But as a result, most likely Ford will not be able to drive at all
If you want, try it, of course. But personally, I will consider it a miracle if something working comes out of this

You probably never heard about impossible things done by people in Poland.

Swaping racing engines into very cheap, very small and very old cars are done here pretty often...

[AceyTech]

Whoever will be taking apart their scope next, including the removal of the heat sink, please measure the size and thickness of the thermal pads. I have a crazy idea of trying those "phase change thermal pads", but need to know what size to order, and I don't want to take the scope apart again, given that someone here will surely do it sooner or later .

@shapirus, Maybe you already got what you needed, but here are the measurements in case anyone else needs, notated on the picture.  Oh, I forgot to label; 1mm thickness.

[AceyTech]

The sample rate on the DHO900 is halved when using the digital channels. That suggests the limit is in the FPGA throughput, one way or the other, or the bus is somewhat limited by hardware. It doesn't hurt to try though

The FPGA in this design is very capable, and most likely not a bottleneck to performance..  They limit by design, because that's the way scopes are designed..  It's a lot of data to process/handle concurrently. FYI, the bandwidth is halved every time you turn an additional channel as well.

[Mechatrommer]

What does the app do with those bits? In what form are they related to model and/or options?

so easy, it is the hardware version:

         model                                                   hardware version
DHO804 and DHO814                                             12   
DHO802  DHO812                                                   4     
DHO914S DHO924S  DHO914   DHO924                   8     
DHO1072                                                               9     
DHO4000                                                               0

Can't you change the table in software? Is the version configured in the OTP SOC area or in a Rigol ASIC?

The RK3399 chip corresponds to the GPIO in the hardware version number:

bit0= GPIO0_A4   PIN 4   
bit1= GPIO0_B0   PIN 8
bit2= GPIO0_B3   PIN 11
bit3= GPIO0_B4   PIN 12

I don't have a cross-compilation environment for RK3399 here, if anyone can compile a hdcode_gpio.ko by themselves to replace the original factory, you can achieve hardware version number customization.

digging this thread... in an attempt to search HW difference between 8 and 12... attached are the back side of RK3399 and Zynq FPGA of my DHO804, just in case some DHO900 owners is kind enough to spot the differences. maybe the config resistor is there? its difficult to tell if there is no DHO900 pictures for comparison. cheers.

[Mechatrommer]

I hope this works.

thanks, but its binary matched with what i have here...

[shapirus]

Whoever will be taking apart their scope next, including the removal of the heat sink, please measure the size and thickness of the thermal pads. I have a crazy idea of trying those "phase change thermal pads", but need to know what size to order, and I don't want to take the scope apart again, given that someone here will surely do it sooner or later .

@shapirus, Maybe you already got what you needed, but here are the measurements in case anyone else needs, notated on the picture.  Oh, I forgot to label; 1mm thickness.

(Attachment Link)

Perfect, thanks a lot. Data recorded!

...no I haven't opened it since I added the external 120mm fan. Not gonna fix what ain't broke, for the time being, as I've got other stuff at the moment to satisfy my potentially destructive curiosity

[AceyTech]

digging this thread... in an attempt to search HW difference between 8 and 12... attached are the back side of RK3399 and Zynq FPGA of my DHO804, just in case some DHO900 owners is kind enough to spot the differences. maybe the config resistor is there? its difficult to tell if there is no DHO900 pictures for comparison. cheers.

Seems that you and S2084 are working similar paths.  From earlier today.  Check out the full size pic.
 

Regarding bringing the HW version into line with the 900 model (HW V , some time ago I did some work to select the location of the configuration resistors on the back side of the board, but unfortunately I could not find the combination I needed, I attach a photo of the options I tested.  in the left column is a combination, in the right column is the HW version shown in the scope shell.  I have to wait until someone shows me a photo of the back of the 900 series board.....

BTW: here are internal pix from early days 924S teardown by hubertyoung

[AndyBig]

You probably never heard about impossible things done by people in Poland.
Swaping racing engines into very cheap, very small and very old cars are done here pretty often...

But you are not going to rearrange the engine (FPGA), but only the ECU (application)
I didn’t write anything about replacing the engine itself. Putting FPGAs from 1000 into 900 is generally beyond logic, reason and possibilities; it will be easier and cheaper to buy 1000

[Mechatrommer]

Seems that you and S2084 are working similar paths.  From earlier today.  Check out the full size pic.

yes coincidentally but maybe due to different reason. LA triggering is not working on my hacked unit FW1.2.2 while on legit user, its working fine on the same FW... on older FW 1.14, its working on my unit, i think the older FW didnt check for HW difference... here what lead me to open up my dho again...
https://www.eevblog.com/forum/testgear/rigol-dho800900-oscilloscope-bug-reports-firmware/msg5382044/#msg5382044
until it is fixed, the workaround for now is i have to use 2 different SD card FW. if i really need LA triggering, then i will insert FW 1.14.. by default i will run on latest FW 1.2.2 and set analog CH1 to whatever digital signal i want to trigger. fwiw.

[Mechatrommer]

BTW: here are internal pix from early days 924S teardown by hubertyoung

i have those pictures. i tried to find the difference with squint eyes, i cannot find though.. whats missing is the backside of the board..

Check out the full size pic.
 

Regarding bringing the HW version into line with the 900 model (HW V , some time ago I did some work to select the location of the configuration resistors on the back side of the board, but unfortunately I could not find the combination I needed, I attach a photo of the options I tested.  in the left column is a combination, in the right column is the HW version shown in the scope shell.  I have to wait until someone shows me a photo of the back of the 900 series board.....

i dont quite understand on which part it is located... is it in the red circle below? (there is no HW ver 8 in his photo)

[norbert.kiszka]

Ehhh people - always doing simple things with time consuming methods. I never removed heatsink and never soldered anything inside, but I managed to change "Hardware number" with very simple methods. Learn more and be lazy - thats the key.

Code: [Select]

[pid  1885] futex(0x71563a45d8, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  1894] write(62, "\1\0\0\0\0\0\0\0", 8 <unfinished ...>
[pid  1900] <... nanosleep resumed> NULL) = 0
[pid  1894] <... write resumed> )       = 8
[pid  1900] futex(0x7137472df8, FUTEX_WAIT_BITSET_PRIVATE, 2, NULL, ffffffff <unfinished ...>
[pid  1885] <... futex resumed> )       = 1
[pid  1894] ppoll([{fd=56, events=POLLIN}, {fd=62, events=POLLIN}, {fd=63, events=POLLIN}, {fd=64, events=POLLIN}], 4, NULL, NULL, 0 <unfinished ...>
[pid  1852] nanosleep({0, 35000000},  <unfinished ...>
[pid  1894] <... ppoll resumed> )       = 1 ([{fd=62, revents=POLLIN}])
[pid  1851] openat(AT_FDCWD, "/dev/hdcode_gpio", O_RDWR|O_NONBLOCK <unfinished ...>
[pid  1894] read(62,  <unfinished ...>
[pid  1850] <... pselect6 resumed> )    = 0 (Timeout)
[pid  1894] <... read resumed> "\f\0\0\0\0\0\0\0", 8) = 8
[pid  1849] <... nanosleep resumed> NULL) = 0
[pid  1848] <... nanosleep resumed> NULL) = 0
[pid  1894] futex(0x70ac1c7830, FUTEX_WAKE_PRIVATE, 2147483647 <unfinished ...>

[Mechatrommer]

Ehhh people - always doing simple things with time consuming methods. I never removed heatsink and never soldered anything inside, but I managed to change "Hardware number" with very simple methods. Learn more and be lazy - thats the key.

(Attachment Link)

(Attachment Link)

(Attachment Link)

Code: [Select]

[pid  1885] futex(0x71563a45d8, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid  1894] write(62, "\1\0\0\0\0\0\0\0", 8 <unfinished ...>
[pid  1900] <... nanosleep resumed> NULL) = 0
[pid  1894] <... write resumed> )       = 8
[pid  1900] futex(0x7137472df8, FUTEX_WAIT_BITSET_PRIVATE, 2, NULL, ffffffff <unfinished ...>
[pid  1885] <... futex resumed> )       = 1
[pid  1894] ppoll([{fd=56, events=POLLIN}, {fd=62, events=POLLIN}, {fd=63, events=POLLIN}, {fd=64, events=POLLIN}], 4, NULL, NULL, 0 <unfinished ...>
[pid  1852] nanosleep({0, 35000000},  <unfinished ...>
[pid  1894] <... ppoll resumed> )       = 1 ([{fd=62, revents=POLLIN}])
[pid  1851] openat(AT_FDCWD, "/dev/hdcode_gpio", O_RDWR|O_NONBLOCK <unfinished ...>
[pid  1894] read(62,  <unfinished ...>
[pid  1850] <... pselect6 resumed> )    = 0 (Timeout)
[pid  1894] <... read resumed> "\f\0\0\0\0\0\0\0", 8) = 8
[pid  1849] <... nanosleep resumed> NULL) = 0
[pid  1848] <... nanosleep resumed> NULL) = 0
[pid  1894] futex(0x70ac1c7830, FUTEX_WAKE_PRIVATE, 2147483647 <unfinished ...>

if you are a little bit more clearer with those cryptic lines... then we might be capable of replicating... not everybody can speak your language cheers.

[norbert.kiszka]

if you are a little bit more clearer with those cryptic lines... then we might be capable of replicating... not everybody can speak your language cheers.

Now I have 9 like in DHO1000. Wanna see 666 or any other number?



Android is based on Linux kernel with little bit of staff from GNU. Every process leaves trace, and we can strace that. I didnt expect to production app being compiled with flags to trace function calls, but without it its possible to trace all system calls like a opening or closing files. Typically lot of things (including sleeps and many other things), so its better to send it via pipe to a file, to examine it later.

Second thing: In Unix and Unix-like (Linux) systems, everything is a file. So You dont need to write or download any software to do many things - couple basic tools and You can do almost everything.

Third thing: most drivers are layer between real hardware and... guess what is on other side. Spoiler: on other side there is a file.

Fourth thing: solution was practically already on this forum. Module hdcode_gpio.ko was reading some GPIO pins (I dont know which pins, how often and etc) and creating a file to read from there or maybe even to write into.

My suspicions was in /sys or eventually in /proc pseudo-filesystems, where normally more or less strange drivers creates some files. Comparing files listed into text files (Kompare from KDE - very useful), with and without this module (rmmod and insmod) gives me practically nothing. But opened file names visible with strace...

Code: [Select]

[pid  1851] openat(AT_FDCWD, "/dev/hdcode_gpio", O_RDWR|O_NONBLOCK <unfinished ...>
So to make a first test, I decided to unload this module and restart the app. As in my previous post, number was 0 instead of 8 like original.

Inserting this module back and restarting app, still gives 0. Im not a expert with Android. I have very little bit of knowledge with *-nix systems but not specially with Android - more of that, I think that is a very big crap, especially 8 and newer. No surprise for me, they used 7. Currently Im using two mobile phones - one with 7 and second one with 14.

Investigating further with this module...

Code: [Select]

rk3399_rigol:/ $ ls -l /dev/hdcode_gpio
crwxrwxrwx 1 root root 10,  45 2013-01-18 16:50 /dev/hdcode_gpio
C at the beginning means that is not normal file, but a char device - almost the same, but usually created by some kernel module.

I tried to read from it...

Code: [Select]

rk3399_rigol:/ $ cat /dev/hdcode_gpio
Houston, we have a cra... sudden reboot and crash. I almost had a heart attack. Playing too much, can cause to destroy something - for example, small mistake can cause to write into I2C and boom, RK808 gives much much higher voltages than usual. So be careful.

Next experiment was to remove this module from kernel and from Rigol script, where is located insmod command. Mentioned file disappeared  no surprise.

Normally in /dev directory special (magic?) file system is mounted. Root can create and in some cases can delete files from there. Including completely normal files. So whats the problem?

Code: [Select]

echo -n "9" > /dev/hdcode_gpio
I wanted DHO1000 but result was more like DHO9234532487. Jokes aside, app showed hardware number 57...

After about 15 minutes of thinking (I was too much lazy to do experiments with random numbers) I reminded ASCII table. Character 9 is 57 in ASCII.

In ASCII byte 0x9 (9 in decimal) is a tab (\t). So...

Code: [Select]

rk3399_rigol:/ # echo -en "\t" > /dev/hdcode_gpio
After that, little test to confirm I didnt made any mistake:

Code: [Select]

rk3399_rigol:/ # cat /dev/hdcode_gpio                                                                                                                                                       
rk3399_rigol:/ #
And now I have what I always wanted from being 3 years old.

[AceyTech]

i dont quite understand on which part it is located... is it in the red circle below? (there is no HW ver 8 in his photo)

That's the spot!  And it's verified on 8x2 vs 8x4 teardown photos.