Hacking the Rigol DHO800/900 Scope

[mrisco]

I like the bigger screen for these older eyes.

If you plan to connect your oscilloscope to your local network and view the device's screen on your PC, you can use DHOVisor to zoom in on the cloned image.

[norbert.kiszka]

Do your mods affect the rise times at all?

All my three mods are enabling all Rigol options (including full bandwidth) and adds more bandwidth settings. In the upcoming DHO800/900 mod, there will be "only" 72 options including auto bandwidth (AFE low pass filter automatically set to 1/4 of the actual sample rate). This will be as a free update, as usual.

Currently only DHO800/900 mod allows to have input sensitivity (vertical scale in other words) 100 uV/div without forced limited bandwidth.

This upcoming version goes with the design of better LC filters which gives much better pulse response (lower overshot and almost no ringing - barely noticeable). This hardware change is not required (it's just a recommendation) and by default bandwidth will be limited via AFE chip, which You can change any time and separately for each channel. Filter in the AFE chips as I said couple times, has a near perfect pulse response, especially below 150-100 MHz.

In my own opinion definitely it's better to have same bandwidth with better pulse response after spending literally few dollars for few inductors and resistors. Only two downsides are: it requires to open the scope (warranty seal) and to replace very small SMD components - all of them are 0402 (0.5 mm * 1 mm). So I advise to do this only if You have experience with soldering such small components or eventually find some garbage PCB to make some practice before doing the same thing in the much more expensive scope.

On the side note, self calibration fixes DC offset and gain difference (It was working properly even with 3 dB lower signal coming to ADC) created by different filter(s). Even if the change was made only in one channel.

DHO800/900 real bandwidth after bypassing LC filters completely is above 1 GHz. With the price of bigger noise. But limiting bandwidth via AFE instead gives similar noise level, because most of the noise comes from the first stages of the AFE chip (before the software driven chip). This design of replaced filters, has 900 MHz cutoff with significantly lower overshoot and somehow lower noise (I didn't made precise measurements with different scenarios - there is no need for it).

My DHO1000/4000 mod gives 800-900 MHz bandwidth without any hardware modification. DHO1000 with the stock firmware gives 70-200 MHz only...

I like the bigger screen for these older eyes.

If you plan to connect your oscilloscope to your local network and view the device's screen on your PC, you can use DHOVisor to zoom in on the cloned image.

Same thing can be done both via browser and via scrcpy. There are other software for Android to do this, but I think scrcpy is the most popular.

[mrisco]

Same thing can be done both via browser and via scrcpy. There are other software for Android to do this, but I think scrcpy is the most popular.

No, the browser doesn't support native interpolated zooming of only the DHO video, and scrcpy installs additional software on the DHO with lower performance. DHOvisor uses the Rigol's Webcontrol software that is already installed on the DHO.

[norbert.kiszka]

scrcpy works via adbd (adb server on the scope) which is already working with the stock firmware.

[mrisco]

scrcpy works via adbd (adb server on the scope) which is already working with the stock firmware.

Captured from: https://blog.rom1v.com/2018/03/introducing-scrcpy/

DHOvisor only uses the native Rigol's Webcontrol, no other server is injected.

[norbert.kiszka]

Those scopes has more RAM (I mean connected to CPU, not the FPGA RAM which is a sample memory) than needed. Both Scrcpy and Webcontrol are making bigger load on the CPU.

[stj]

i recommend getting the 4 channel version.

1st. you get 2 spare probes that arent exactly cheap to replace.
2nd i suspect if you do any bandwidth hacks it will default to the 4 channel UI anyway.
it will also have higher re-sale value if you upgrade later

[ygi]

It could be an issue on my side but while tinkering with adb today, I noticed my 804 running latest firmware writes a ton of useless logs. By that I mean roughly 20MB of junk per hour are written into /data/logs/aplog* (it spawns a new one every 5MB) as long as the scope's powered on. Not to mention the kernel log + system log that are also saved there by one of Rigol's own shell scripts. That wouldn't bother me so much if the internal memory was emmc but an sdcard doesn't do wear leveling and the never ending write cycles will kill it.
It seems like an unknown app or service keeps crashing and restarting every seconds or so. Since I never used the scope in stock config, I don't know if something I modded caused the issue or if it's a stock bug. In doubt, I'm sharing the story to raise awareness.
For now, my workaround is to create a 5MB tmpfs overlay on top of /data/logs at boot time. If it turns out to be a bug and no one has a cleaner solution, I'll explain how to do it.

[norbert.kiszka]

It could be an issue on my side but while tinkering with adb today, I noticed my 804 running latest firmware writes a ton of useless logs. By that I mean roughly 20MB of junk per hour are written into /data/logs/aplog* (it spawns a new one every 5MB) as long as the scope's powered on. Not to mention the kernel log + system log that are also saved there by one of Rigol's own shell scripts. That wouldn't bother me so much if the internal memory was emmc but an sdcard doesn't do wear leveling and the never ending write cycles will kill it.
It seems like an unknown app or service keeps crashing and restarting every seconds or so. Since I never used the scope in stock config, I don't know if something I modded caused the issue or if it's a stock bug. In doubt, I'm sharing the story to raise awareness.
For now, my workaround is to create a 5MB tmpfs overlay on top of /data/logs at boot time. If it turns out to be a bug and no one has a cleaner solution, I'll explain how to do it.

Whole Android was compiled as a full debug and Rigol didn't care to disable services like GPRS or other which are completely useless. This is also one of the reasons why it's so slow.

Edit: I have downloaded and modified Android 12 with a 5.10 kernel, but it will take some time to make it work on those scopes.

I chose Android 12, because I have some experience with modifing kernel 5.10 and I have working drivers (I did those ) already.

Edit 2: Im just waiting for the moderator Simon to edit my another post here, with some laconic text instead of any explanation what and why he did it.

[ygi]

Looking at those shell scripts and config files, I had an inkling Rigol's build of android's sloppy but I didn't know how sloppy...

Anyway here's my workaround to protect the sdcard:

Connect to the scope using adb:

Code: [Select]

adb connect <scope_IP>:55555
adb root && adb shell
Once connected, create a shell script somewhere. I put mine with Rigol's in /rigol/shell/ and called it remount_logs.sh and adjusted permissions:

Code: [Select]

cat > /rigol/shell/remount_logs.sh << EOF
#!/system/bin/bash
#this creates a 5MB tmpfs partition using the /data/logs directory as mount point
mount -t tmpfs -o size=5M tmpfs /data/logs/
EOF
chmod 750 /rigol/shell/remount_logs.sh
Now you need android to launch that script at boot time. To do that you need to be able to write to read-only system partition:

Code: [Select]

mount -o rw,remount /system
Next you need to create a "service" file that will call the script at boot time. I called mine remount_logs.rc for consistency. If you changed name or path for the shell script, be sure to adjust them here accordingly:

Code: [Select]

cat > /system/etc/init/remount_log.rc << EOF
service remount_logs /rigol/shell/remount_logs.sh
    class main
    user root
    oneshot
EOF
chmod 750 /system/etc/init/remount_log.rc
sync
mount -o ro,remount /system
reboot
If all went according to plan, once you reconnect with adb shell, the output of df -h you should show you something like that:

rk3399_rigol:/ # df -h
Filesystem            Size  Used Avail Use% Mounted on
rootfs                1.7G  4.2M  1.7G   1% /
tmpfs                 1.8G  440K  1.8G   1% /dev
tmpfs                 1.8G  140K  1.8G   1% /mnt
/dev/block/mmcblk0p10 1.9G  919M  1.0G  47% /system
/dev/block/mmcblk0p9  122M  116K  122M   1% /cache
/dev/block/mmcblk0p11  12M   40K   12M   1% /metadata
/dev/block/mmcblk0p16  26G  355M   25G   2% /data
/dev/block/mmcblk0p15 484M  200M  285M  42% /rigol
tmpfs                 1.8G  140K  1.8G   1% /storage
tmpfs                 5.0M  884K  4.1M  18% /data/logs
/data/media            26G  355M   25G   2% /mnt/runtime/default/emulated
/data/media            26G  355M   25G   2% /storage/emulated
/data/media            26G  355M   25G   2% /mnt/runtime/read/emulated
/data/media            26G  355M   25G   2% /mnt/runtime/write/emulated

[norbert.kiszka]

Better but more difficult would be by editing fstab which sits in the initrd.

[hide]

Just wanted to share a little win.
I can recycle  8GB rubbish uSD cards  for DHO804.

Here's the breakdown of what I did to make it fit:
1. Recovered the 5 main ext4 partitions. TestDisk sniffed them out perfectly.

Code: [Select]

     Partition               Start        End    Size in sectors
 P Linux filesys. data       548864     811007     262144
 P Linux filesys. data       811008    5005311    4194304 [system]
 P Linux filesys. data      5005312    5038079      32768
 P Linux filesys. data      5047360    6071359    1024000 [rigol]
 P Linux filesys. data      6299648   45287791   38988144

2. Shrinked the userdata partition at the end down to about 1GB to make the whole image bite-sized use GParted.

(for the purists)
3. Restored all 11 RAW partition entries manually use gdisk.
Yeah, it's mostly "hobby work" and doesn't affect the size, but I wanted.

Code: [Select]

Number  Start (sector)    End (sector)  Size       Code  Name
   1            8192           16383   4.0 MiB     8300  uboot (RAW)
   2           16384           24575   4.0 MiB     8300  trust (RAW)
   3           24576           32767   4.0 MiB     8300  misc (RAW)
   4           32768           65535   16.0 MiB    8300  resource (RAW)
   5           65536          114687   24.0 MiB    8300  kernel (RAW)
   6          114688          180223   32.0 MiB    8300  boot (RAW)
   7          180224          311295   64.0 MiB    8300  recovery (RAW)
   8          311296          540671   112.0 MiB   8300  backup (RAW)
   9          548864          811007   128.0 MiB   8300  cache
  10          811008         5005311   2.0 GiB     8300  system
  11         5005312         5038079   16.0 MiB    8300  metadata
  12         5038080         5038143   32.0 KiB    8300  verity (RAW)
  13         5038144         5040255   1.0 MiB     8300  baseparamer (RAW)
  14         5040256         5041279   512.0 KiB   8300  frp (RAW)
  15         5047360         6071359   500.0 MiB   8300  rigol
  16         6299648         8396799   1024.0 MiB  8300  userdata

4. Backup the image using dd with count=8396800, which gives me a neat 4.2GB img file.

Code: [Select]

sudo dd if=/dev/sdc of=/mnt/USB/DHO804_v00.01.04_Lite.img bs=512 count=8396800 status=progress

Now that it's running, I want to make this even leaner so it can fit on some of my older, trashier 4GB cards.

Does anyone have a "kill list" of unnecessary files or logs that are safe to nuke?
I want to strip this down to the bare essentials without bricking.

[norbert.kiszka]

This is a Android compiled as a debug release with all stuff needed for tablet and phone, bot none of these are needed on a oscilloscope. I never seen anybody making a call from a scope or using it as a car navigation. However, maybe this is not a bad idea...

[stj]

removing crap is good,
but i dont reccomend using small cards, they are generally a lot slower than newer 32gig+ ones.

[ygi]

FYI Rigol just released version v00.01.05.00.01(including the seemingly unreleased v00.01.05.00.00) with the following changelog:

[Model Supported] All the DHO800/900 series oscilloscopes
[Latest Revision Date] 2026/01/20

[Updated Contents]
v00.01.05.00.01 2026/01/20

1.Optimized the Bode plot curve.
2.Fixed the issue where cursors cannot be set in FFT mode.

v00.01.05.00.00 2025/11/25

1.Added user-defined probe ratio setting.
2.Optimized AFG frequency display, highlighting the display.
3.Added the Move Scale sub-menu under the Display menu.
4.Added the Peak Detect on/off sub-menu under the Save tab in the Storage menu, allowing users to select whether to enable or disable peak detection while saving the waveforms.
5.Added the Display Area sub-menu under Math menu, allowing you to select whether to display math waveforms in the main window or math operation window.
6.Added the function of switching the screenshot preview.
7.Added the function of exporting LA (Logic Analyzer) waveform memory data.
8.Added saving images in different formats.
9.Fixed an occasional issue where certain horizontal measurement items failed to measure.
10.Fixed an issue where the UI did not synchronize with the probe ratio unit setting command.
11.Fixed the system reboot issue caused by running in the ZOOM mode for a long period.

I'm not quite sure it even matters to anyone not using the stock scope app but you never know. There may or may not be undocumented fixes to the OS and scripts.
https://download.rigol.com/Firmware/oscilloscopes/DHO800-DHO900%20Firmware.rar
All I can say is it runs and vendor.bin shenanigans still work.

[stasalt]

FYI Rigol just released version v00.01.05.00.01(including the seemingly unreleased v00.01.05.00.00) with the following changelog:

[Model Supported] All the DHO800/900 series oscilloscopes
[Latest Revision Date] 2026/01/20

[Updated Contents]
v00.01.05.00.01 2026/01/20

1.Optimized the Bode plot curve.
2.Fixed the issue where cursors cannot be set in FFT mode.

v00.01.05.00.00 2025/11/25

1.Added user-defined probe ratio setting.
2.Optimized AFG frequency display, highlighting the display.
3.Added the Move Scale sub-menu under the Display menu.
4.Added the Peak Detect on/off sub-menu under the Save tab in the Storage menu, allowing users to select whether to enable or disable peak detection while saving the waveforms.
5.Added the Display Area sub-menu under Math menu, allowing you to select whether to display math waveforms in the main window or math operation window.
6.Added the function of switching the screenshot preview.
7.Added the function of exporting LA (Logic Analyzer) waveform memory data.
8.Added saving images in different formats.
9.Fixed an occasional issue where certain horizontal measurement items failed to measure.
10.Fixed an issue where the UI did not synchronize with the probe ratio unit setting command.
11.Fixed the system reboot issue caused by running in the ZOOM mode for a long period.

I'm not quite sure it even matters to anyone not using the stock scope app but you never know. There may or may not be undocumented fixes to the OS and scripts.
https://download.rigol.com/Firmware/oscilloscopes/DHO800-DHO900%20Firmware.rar
All I can say is it runs and vendor.bin shenanigans still work.

Why isn't it on the official update website?

[phantom]

hi to all! idiot question! i 've used this guide



to unlock all the potential of mine dho804.

i've used the -o option, because i want to mantain my original model. but now i have 100mhz 50 mpts. is it normal? isn't possible to have 250mhz without flashing 924 vendor.bin?

thank you

[rims]

Hello, after installing version NK-MOD-042, I am having trouble with the MemDepth setting. Only Auto can be set; everything else jumps to 100, but even Auto does not go above 100. Am I doing something wrong?

[mrisco]

The new firmware 00.01.05 has some bugs such as some UI elements misplaced, UltraAcquire mode doesn't work, etc. However there are also enhancements such as the possibility of move the math trace to the main waveform window, move the vertical scale, User defined probe ratio, etc.

So, the UPA mode now allows the Math AxB trace to be placed in the main waveform area:

[ststefanov13]

Has anyone already written to Rigol Support about the problem in the new firmware with UltraAcquire mode?

[RogerG]

i've used the -o option, because i want to mantain my original model. but now i have 100mhz 50 mpts. is it normal? isn't possible to have 250mhz without flashing 924 vendor.bin?

Hi,

unlocking options of a DHO 804 maxes out at 100MHz.
If you want more, you have to change the model.

Regards
Roger

[ststefanov13]

About the problem in the new firmware with UltraAcquire mode Rigol AI bot :

Hello, based on the available information, the UltraAcquire mode of the DHO800 series oscilloscope is one of its core features, supporting waveform capture rates of up to 1,000,000 wfms/s. If you are experiencing issues with the UltraAcquire mode in the latest firmware version 1.05, it is recommended that you take the following steps:

    Check Settings:
        Ensure the oscilloscope is set to single-channel mode.
        Set the horizontal time base to 50 ns.
        Input a 10 MHz sine wave signal with an amplitude of 4 div.
        Ensure other settings are at their default values.

    Firmware Version Confirmation:
        Check if the current firmware version is correctly installed.
        If there are issues with the firmware version, it is advisable to re-download and install the latest version.

    Contact Technical Support:
        If the problem persists, it is recommended to contact RIGOL technical support through the following methods:
            Visit the RIGOL international website at https://int.rigol.com/.
            Alternatively, submit your issue via the Get a Quote page.

Note: AI responses are for reference only. For further assistance, please contact RIGOL customer service.

[washley]

Has anyone already written to Rigol Support about the problem in the new firmware with UltraAcquire mode?

Even if they have, it's better that two people independently report the issue than just one.

[mrisco]

Warning: It appears that .stp files saved using the old firmware are incompatible with version 00.01.05. Loading an old .stp file could result in the device becoming 'soft-bricked'.

Another bug: it is not possible to create stp files using the SCPI command: :SAVE:SETup C:/123.stp in the firmware 00.01.05

[iMo]

..btw, there is a special thread for the dho800 bugs..
https://www.eevblog.com/forum/testgear/rigol-dho800900-oscilloscope-bug-reports-firmware/msg6181555/#msg6181555