Hacking the Rigol MHO900 Scope

[lordrafa]

hi, I was double checking the code and I have a couple of questions:

In:

Code: [Select]

s := fmt.Sprintf("%sXXXXXX#0#%s#4#0#0", deviceId, feature)

what doesn't mean the Xs, the 0s and the 4 and why to swap each nibble in the cyphertext..... just curious if anyone has decoded this....


On the other hand the key is an AES key nothing to do with brainpoolP256r1 why was this append just to have something before the ; ??

Rigol has an interesting mess of security what I see in here... why symmetric keys and why allow root.... it looks like an interesting security design.... death star design level

[cncjerry]

Thought I posted this... Used gsobol's instructions, worked fine.  Lots of features were already enabled.  Only issue I had was getting the files off the scope.  I couldn't get scp to work, used adb connected in root mode and then adb pull.  had to install go, that was a new language for me. Scope reports 380ps risetime on Leo's pulser that I measured with my 11801 below 27ps.  Impressive little scope, hooked up a mouse, I'd like to find a 10" or better touchscreen that would work on the hdmi port, any ideas?

thanks!

Jerry

[aardee]

Works perfectly! no need to buy paid options.

[ffb.boy]

Do you you think it can work on a MHO984 ?
I've just bought one.

[ffb.boy]

I've tested the script on my MHO984
at startup,  I add
1 CAN-FD
2 Flexraay
3 Audio serial 
4 MIL-STD-1553
5 500Mpts
6 dual 50 Mhz
7 dual 100Mhz
all written as Limit.
To launch the script you must install python package
   pip install adbutils
   pip install pyvisa-py
   pip install pycryptodome
   pip install zeroconf
   pip install psutil

At the end of the script I've
 Key 046FA071513C......
:SYST:OPT:INST MHO900-AUTOA@......
:SYST:OPT:INST MHO900-FlexA@......
:SYST:OPT:INST MHO900-AUDIOA......
:SYST:OPT:INST MHO900-AEROA@......
:SYST:OPT:INST MHO900-RLU05@......
:SYST:OPT:INST MHO900-AFG100@......
:SYST:OPT:INST MHO900-BWU03T05@......
:SYST:OPT:INST MHO900-BWU05T08@......
:SYST:OPT:INST MHO900-BWU03T08@......

and one the scope
only CAN-FD Flexray and audio serial are Forever the rest still as Limit 

Update :
finally after 3 or 4 time all the options are Forever
Now the list change
1 CAN-FD
2 Flexray
3 Audio serial bus
4 MISL-STD-1553
5 500Mpts storage depth
6 dual channel 100Mhz
7 Serial bus trigger and analysis (New) but the option was in the 984 at startup
8 Auto serial bus serial bus and analysis (New)


the dual channel 50mhz disappear

I add all the option in the script

Many thanks to dka for the script, rnelectro for the list and  neptunus0001 for the tiny modification.

I put the script I use with all the modification below.


Hope it can help someone.

IT WORKS 

[ffb.boy]

I've bought this scope to works with slow MIPI signal around 500Mhz not enought money to buy a bigger one.
Do you think is it possible to add some MIPI decoders options 

[RF-Engineer]

Norbert,

I updated my MHO954 with your firmware and installation went well.  However, even before the update, I noticed that my Channel 3 is intermittent and now believe it's a hardware problem.  If I need to revert back to the original Rigol firmware before factory repair, how is that accomplished?  Thank you! 

Paul

[TUMEMBER]

Norbert,

I updated my MHO954 with your firmware and installation went well.  However, even before the update, I noticed that my Channel 3 is intermittent and now believe it's a hardware problem.  If I need to revert back to the original Rigol firmware before factory repair, how is that accomplished?  Thank you! 

Paul

https://www.patreon.com/norbertkiszka/shop

Norbert was permanently banned from this forum some time ago. You can add your question/answer at the link above.

[0xdeadbeef]

I've bought this scope to works with slow MIPI signal around 500Mhz not enought money to buy a bigger one.

You mean a 500MHz clock? Good luck with that. Even using the MHO98 with only one channel enabled (i.e. full 1GHz bandwidth, full 4GSa/s), a 500 MHz clock (letting aside the LVDS/differential part etc.) will look more like a sine since the higher frequency components are attenuated too much. Since you need at least two channels to decode something, the sampling rate lowers to 2GSa/s, i.e. there are only 4 sampling point per clock cycle. Hard to imagine that a decoder could work under these conditions.

[David_L312]

I cannot trust myself with manually looking for strings in memory dumps, so I made a simple script that uses instructions by gsobol to auto-activate oscilloscope over the network.

Thanks dka for the script. I'm close to applying it to my 954.

I'm first working on making sure I have a good backup of the SD Card.  To be extra safe, I want to clone the card, run off the clone and park the original away. I'll keep a dd image parked away too.

My scope is running firmware 00.01.00.  I haven't taken the update yet.

Am I correct that this method of unlocking the scope is independent of the firmware version?  And not effected by taking a firmware upgrade?  I like that we're not hacking the scope to do anything beyond what the manufacturer provides.

[gsobol]

I cannot trust myself with manually looking for strings in memory dumps, so I made a simple script that uses instructions by gsobol to auto-activate oscilloscope over the network.

Thanks dka for the script. I'm close to applying it to my 954.

I'm first working on making sure I have a good backup of the SD Card.  To be extra safe, I want to clone the card, run off the clone and park the original away. I'll keep a dd image parked away too.

My scope is running firmware 00.01.00.  I haven't taken the update yet.

Am I correct that this method of unlocking the scope is independent of the firmware version?  And not effected by taking a firmware upgrade?  I like that we're not hacking the scope to do anything beyond what the manufacturer provides.

Effectively you are following the same steps that Rigol would (in a nutshell).  If they decide to change the process, they would have to reissue new activation codes to everyone and that would be a major PITA, so chances are that once features are activated, they will remain activated.  Now, the process of obtaining all necessary pieces to generate what you need - THAT has a fair chance of being locked out or patched by the new release.  So, just because this process works now, there is no guarantee it will in the future. 

[David_L312]

That's an excellent point. Every Rigol update includes a risk for breaking the process.

I have a clone card installed.  And will try the script next.
(gotta make sure I have all the python pieces)

Thanks.

[rteodor]

I add all the option in the script

Many thanks to dka for the script, rnelectro for the list and  neptunus0001 for the tiny modification.

I put the script I use with all the modification below.


Hope it can help someone.

IT WORKS 

TY.

I've also made basically 2 modifications to your script:
1. to try to import 'Crypto' then fall back on 'Cryptodome'. It worked with the later in my case because that was the only package that apt-get could install on my system. This change is supposed to be harmless.
2. There was no detection of the device on the network, so I added an option to directly specify the IP address. Its a mystery for me what pyVISA is supposed to do on the network to discover the device. Maybe scan all the IP's ? However, with this change that mystery auto-detection is not done anymore.

It worked for me over the network, except one license failed the first time (AUDIOA) and I made a second run only for that. Mostly to test the script.

[TheShooter]

Hey. Welcome everyone. Thanks for the contribution.

Do we have any successful activations with the newest v00.01.00.00.26 firmware?

I understand that the firmware should not have any influence on the activation process as it was indicated by gsobol but I just wanted to double check.

[TheShooter]

That's an excellent point. Every Rigol update includes a risk for breaking the process.

I have a clone card installed.  And will try the script next.
(gotta make sure I have all the python pieces)

Thanks.

Do you have a spare warranty sticker?

[unixb0y]

Hey. Welcome everyone. Thanks for the contribution.

Do we have any successful activations with the newest v00.01.00.00.26 firmware?

I understand that the firmware should not have any influence on the activation process as it was indicated by gsobol but I just wanted to double check.

I can confirm the script with minor modification still works today; my scope shows the version as "00.01.00", latest build, which seems to be from May 2026.

I used the version without VISA from Darius121 and it had this bug:

Code: [Select]

devices = [(None, args.ip, 'Manual')]

needs to become:

Code: [Select]

devices = [(f"TCPIP0::{args.ip}::INSTR", args.ip, 'Manual')]


[TheShooter]

Are you guys interested in Rigol warranty stickers? It is a major PITA to get them. Just let me know lf you need them.