Hacking the Rigol DHO800/900 Scope

[ebastler]

Look it that way: he is not selling the rigol binary, he is only selling the changes to it.

That's rather like "I'm not selling that Rolling Stones song on Youtube, just the animation I made for it." Not going to fly.

[mrisco]

Could be interesting to intercept the press of a physical button to assign other functions, especially the "Default" button.

[S2084]

Could be interesting to intercept the press of a physical button to assign other functions, especially the "Default" button.

If you manage to do this, it will be absolutely wonderful!  I think almost every DHO owner would want this.  In your modifications, you step by step translate into reality those things that have been discussed here for a very long time, but the matter has not yet reached further discussions.  You are one of the few who say little and just do it, don’t stop!... You shouldn’t pay attention to the opinion of the local “theorists” who are only capable of criticism, in turn doing nothing except this very criticism!

[ebastler]

You are one of the few who say little and just do it, don’t stop!... You shouldn’t pay attention to the opinion of the local “theorists” who are only capable of criticism, in turn doing nothing except this very criticism!

If you are referring to the discussion of legal risks and limitations, I beg to differ. Nobody is saying that mrisco's modifications aren't worthwhile. In fact, I find them very impressive and they are certainly desirable improvements. (Which I wish Rigol would make..)

But it seems only fair to point out the legal risks to mrisco. He is the one who might expose himself to these risks, e.g. by offering the modified binaries for sale on Patreon.

Actually, I find your attitude rather selfish: "Please make those modifications, because I want them. I don't care whether you get into hot water, because I as a user will not have those legal risks."

[Evi]

Join to Free Software Foundation and forget the risks.

[AceyTech]

I've been conflicted since this came to light. My thoughts, if anyone cares;
To my knowledge, Rigol doesn't have a website that offers paid option/model# upgrades that turn a DHO804-->DHO924 or a 914-->924
Yet, we seem to be fine generating these license keys to save $$$. Even when some of these upgrades legitimately take keep money from their bottom line.  Hypocrites, the lot of us.

For the majority of us, de-compiling/editing/re-compiling an APK is a daunting task.  @Andybig, @shapirus, @Randy222 did an amazing job, laying the foundation for the UI hacking mods. I hope to someday "repay them in kind" with one of my development/hacks.

I guess if you look at @mrisco's work as a modification service, packaging a custom APK model makes the most sense.  That's a helluva lot of work, and for the asking price, it should come with a commitment to support the app after future OEM upgrades, or other defects.
The APK is worthless to anyone without a DHO scope, so it's not like it's a direct threat to their financial well being like other app developers.

[TurboTom]

The proper approach for Rigol would be to get in touch with @mrisco, offer him a contract to have him work as an employee or freelancer to improve/fine tune their scope software. As it seems, they could very well use some more talented programmers that also have an understanding of what would make their product more enjoyable / useful for their customers.

[ebastler]

To my knowledge, Rigol doesn't have a website that offers paid option/model# upgrades that turn a DHO804-->DHO924 or a 914-->924
Yet, we seem to be fine generating these license keys to save $$$. Even when some of these upgrades legitimately take keep money from their bottom line.  Hypocrites, the lot of us.

For the majority of us, de-compiling/editing/re-compiling an APK is a daunting task.  @Andybig, @shapirus, @Randy222 did an amazing job, laying the foundation for the UI hacking mods. I hope to someday "repay them in kind" with one of my development/hacks.

I guess if you look at @mrisco's work as a modification service, packaging a custom APK model makes the most sense.  That's a helluva lot of work, and for the asking price, it should come with a commitment to support the app after future OEM upgrades, or other defects.
The APK is worthless to anyone without a DHO scope, so it's not like it's a direct threat to their financial well being like other app developers.

I never raised any moral concerns about the various "hacking" approaches. Everybody can assess that for themselves, whether as a user or developer of hacks, and draw their personal conclusions. Also, I certainly agree that mrisco's effort is worth some remuneration from users.

All I wanted to point out is that it violates various terms & conditions. The reverse engineering alone is already in conflict with Rigol's terms; offering modifications for sale makes them much more visible, and also conflicts with Patreons usage terms. Again, mrisco is free to draw is own conclusions of course, but it seems fair to highlight the potential hassles.

I agree that Rigol does not lose any revenue through these hacks -- they might even gain some, from people who only buy the scope because some of its original weaknesses have been addressed. Nevertheless they might not like the availability of hacks which create a scope that behaves differently from the official version. Just think about support and warranty issues, and potential reputation damage:

E.g. users might complain (to Rigol or in a public forum) about bugs which are not Rigol's but are caused by a hack. Or hacks might be developed which overclock parts of the scope logic, causing unreliable operation or even damaging the scope. Either scenario would cause reputation damage to Rigol. This is all hypothetical at this time -- but it is sufficient that someone at Rigol thinks about such hypothetical scenarios, and they may come to the conclusion that they don't like hacks which create functionality beyond Rigol's official offering and act against those who are offering such hacks.

[AceyTech]

To my knowledge, Rigol doesn't have a website that offers paid option/model# upgrades that turn a DHO804-->DHO924 or a 914-->924
Yet, we seem to be fine generating these license keys to save $$$. Even when some of these upgrades legitimately take keep money from their bottom line.  Hypocrites, the lot of us.

For the majority of us, de-compiling/editing/re-compiling an APK is a daunting task.  @Andybig, @shapirus, @Randy222 did an amazing job, laying the foundation for the UI hacking mods. I hope to someday "repay them in kind" with one of my development/hacks.

I guess if you look at @mrisco's work as a modification service, packaging a custom APK model makes the most sense.  That's a helluva lot of work, and for the asking price, it should come with a commitment to support the app after future OEM upgrades, or other defects.
The APK is worthless to anyone without a DHO scope, so it's not like it's a direct threat to their financial well being like other app developers.

I never raised any moral concerns about the various "hacking" approaches. Everybody can assess that for themselves, whether as a user or developer of hacks, and draw their personal conclusions. Also, I certainly agree that mrisco's effort is worth some remuneration from users.

All I wanted to point out is that it violates various terms & conditions. The reverse engineering alone is already in conflict with Rigol's terms; offering modifications for sale makes them much more visible, and also conflicts with Patreons usage terms. Again, mrisco is free to draw is own conclusions of course, but it seems fair to highlight the potential hassles.

I agree that Rigol does not lose any revenue through these hacks -- they might even gain some, from people who only buy the scope because some of its original weaknesses have been addressed. Nevertheless they might not like the availability of hacks which create a scope that behaves differently from the official version. Just think about support and warranty issues, and potential reputation damage:

E.g. users might complain (to Rigol or in a public forum) about bugs which are not Rigol's but are caused by a hack. Or hacks might be developed which overclock parts of the scope logic, causing unreliable operation or even damaging the scope. Either scenario would cause reputation damage to Rigol. This is all hypothetical at this time -- but it is sufficient that someone at Rigol thinks about such hypothetical scenarios, and they may come to the conclusion that they don't like hacks which create functionality beyond Rigol's official offering and act against those who are offering such hacks.

Hey bud.   We get it.  You have made your point, several times.      You're not the only smart person in this room. 

Can we get back to the goddamned topic E.g., "hacking the DHO800/900" now?

[AceyTech]

I, and several others here would enjoy having the ability to map buttons for our liking.  Here, from earlier this year:

For the software hackers in the thread. I installed a very simple Android/Kotlin program on the scope to capture the "key" events when twiddling all the knobs and dials. Attached is an image of the key codes each generates.

Useful if you want to write some side-loaded software that uses the scope's controls.

These were all captured and tested on a 924S even though the image shows an 814. Hopefully you can see where I added key codes for the missing buttons.

NOTE: Each of the key codes shown is added to 0x40000000, so the Run/Stop button produces key code 0x4000000C.

Is it possible to remap one of them them to open up the Android info screen?

There's plenty of buttons on there that I'll never use...

Here is the GitHub Repo with the "Android-Keys" program I used to discover the keycodes.

https://github.com/stephenhouser/Android-Keys

Could be interesting to intercept the press of a physical button to assign other functions, especially the "Default" button.

Maybe this can be done In software, maybe it has to be hardware/firmware..  It could be a pretty useful hack.

I'm also curious about the ARM controller that scans the buttons on the front panel.  -mainly, what kind of interface does it use to communicate with the mainboard/RK3399?  I'm thinking they might've implemented a USB HID keyboard, which if true, might be fairly easy to modify.

I started digging into it, and it's on my list to work on.



Edit: I have a copy of the PDF, but can't find a good download link to attach for the GD32F350K8U6 on the control panel PCB

[mrisco]

If an application was able to decode the keys pressing then it is very possible that the keys are interfaced as a hid device.

[AceyTech]

If an application was able to decode the keys pressing then it is very possible that the keys are interfaced as a hid device.

Thanks.  I think more investigation would be worthwhile, because somewhere in here, Android or the app is translating these keyevents & actions.  Here is his reply about HID that I failed to add to my post earlier.

Edit: For convenience:

This question/answer might be of use for key-remapping, though I've not looked into it.

From StackExchange: https://android.stackexchange.com/questions/249423/how-to-remap-keyboard-shortcut

I'll post the GitHub link to the KeyReporter program later this evening. Thought I already had it there, but apparently not.

I did not see the keyboard as a USB device (using `lsusb`) but I may not have interpreted it correctly.

I also played with controlling the LEDs by calling into the binary shared library (extracted from Sparrow.apk -- the "scope" program). Unfortunately, when calling the "Post" function the library seems to start up the FPGA or something else on the scope and kills the active program on me.

Now that I know what LSUSB does, I'll take a closer look.

[AndyBig]

I have a copy of the PDF, but can't find a good download link to attach for the GD32F350K8U6

https://www.gigadevice.com.cn/Public/Uploads/uploadfile/files/20240403/GD32F350xxDatasheetRev3.0.pdf
https://www.gigadevice.com.cn/Public/Uploads/uploadfile/files/20240407/GD32F3x0_User_Manual_Rev2.9.pdf

[AceyTech]

I have a copy of the PDF, but can't find a good download link to attach for the GD32F350K8U6

https://www.gigadevice.com.cn/Public/Uploads/uploadfile/files/20240403/GD32F350xxDatasheetRev3.0.pdf
https://www.gigadevice.com.cn/Public/Uploads/uploadfile/files/20240407/GD32F3x0_User_Manual_Rev2.9.pdf

Thanks Andy!  Sadly, those links haven't produced a PDF for me lately.  I tried and didn't want to post a dead link.  Maybe this firewall is causing 404 on *.cn domains

[mrisco]

Thanks Andy!  Sadly, those links haven't produced a PDF for me lately.  I tried and didn't want to post a dead link.  Maybe this firewall is causing 404 on *.cn domains

Try by looking at Google: GD32F350xxDatasheetRev

[AndyBig]

Thanks Andy!  Sadly, those links haven't produced a PDF for me lately.  I tried and didn't want to post a dead link.  Maybe this firewall is causing 404 on *.cn domains

Probably yes, there are problems either with the firewall or with the provider. I can open these links without problems, including through servers in the USA

[mrisco]

Could be interesting to intercept the press of a physical button to assign other functions, especially the "Default" button.

It was relatively easy, but now I'm not convinced about changing the functionality of the physical buttons, I think maybe it's better to create virtual buttons. (How to attach an animated Gif?) I can open Android Settings from the Rigol app by pressing the Default button.

[AceyTech]

Could be interesting to intercept the press of a physical button to assign other functions, especially the "Default" button.

It was relatively easy, but now I'm not convinced about changing the functionality of the physical buttons, I think maybe it's better to create virtual buttons.

Very cool!  Virtual, as in onscreen?  That would be nice for touch and/or external monitor use.

[mrisco]

Very cool!  Virtual, as in onscreen?  That would be nice for touch and/or external monitor use.

Maybe I could add buttons to the utility drawer that opens when the Rigol symbol is pressed.

[Fungus]

It was relatively easy ... I can open Android Settings from the Rigol app by pressing the Default button.

That's really all that's needed.

If that can be installed via ADB then it makes it very easy to set up the WiFi, etc.

[mrisco]

That's really all that's needed.

If that can be installed via ADB then it makes it very easy to set up the WiFi, etc.

Yes but, when the display is at the Android settings screen it is necessary turn off the DHO to return to the scope application if there isn't any virtual back/home button installed.
I put a new "Settings" icon in the start menu to go to Android Settings, currently available in the updated 0.4.1 version.

[mrisco]

It was relatively easy, but now I'm not convinced about changing the functionality of the physical buttons, I think maybe it's better to create virtual buttons. (How to attach an animated Gif?) I can open Android Settings from the Rigol app by pressing the Default button.

I can intercept a physical keypress inside of the scope application but not from outside, so currently it is not possible to map a physical button to, for example, return to the scope application.

[airwolf1988]

Planing to buy DHO and have a question.
If I buy DHO804 and install vendor file from 924 will this get me CAN and LIN decoding plus 125MHz bandwidth?

[Fungus]

Planing to buy DHO and have a question.
If I buy DHO804 and install vendor file from 924 will this get me CAN and LIN decoding plus 125MHz bandwidth?

Yes.

(nb. 250MHz bandwidth)

[arturmariojr]

Hi, I`m trying to hack my DHO804 and really need your help, as don`t want brick my scope:
First, I downloaded and upgrade it to 00.01.02.00.02
So, the instructions told to copy two files from /rigol/data directory:
- vendor.bin -- ok!
- key.data  or   RKey.data - but none of them exists on my scope.

What should I do?

adb shell
rk3399_rigol:/ $ su
rk3399_rigol:/ # cd rigol
rk3399_rigol:/rigol # cd data
rk3399_rigol:/rigol/data # ls
cal_adc.hex           cal_afe_zero.hex cal_lsb.hex      default vendor.bin
cal_afe_bandwidth.hex cal_ddr.hex      cal_vertical.hex probe
rk3399_rigol:/rigol/data # ls -la
total 1136
drwxrwxrwx  4 root   root     4096 2013-01-18 09:14 .
drwxrwxrwx 10 root   root     4096 1970-01-01 08:00 ..
-rwxrwxrwx  1 system system   1876 2013-01-18 09:03 cal_adc.hex
-rwxrwxrwx  1 system system    348 2013-01-18 08:50 cal_afe_bandwidth.hex
-rwxrwxrwx  1 system system    348 2013-01-18 08:53 cal_afe_zero.hex
-rwxrwxrwx  1 system system     76 2013-01-18 08:54 cal_ddr.hex
-rwxrwxrwx  1 system system    156 2013-01-18 08:57 cal_lsb.hex
-rwxrwxrwx  1 system system 538300 2013-01-18 09:26 cal_vertical.hex
drwxrwxrwx  2 root   root     4096 2023-09-19 17:36 default
drwxrwxrwx  2 root   root     4096 2013-01-18 16:50 probe
-rwxrwxrwx  1 system system    136 2013-01-18 08:51 vendor.bin
rk3399_rigol:/rigol/data # pwd
/rigol/data