Hacking the Rigol MSO5000 - Dr Mefisto Licensing Method

[BTO]

Thanks for that,
I'll have a look at it later as i have a lot of things going on right now.
But, appreciate the effort, THANK YOU

[robiom]

UPDATE : The Step by Step Instructional PDF is now available (it's detailed)

Also if possible (Because i'm interested to know) could you please leave comments if this worked for you or if it didn't , i think this will start working for everyone.

Many thanks for all the hard work and effort for providing this "licensing method".

Yesterday I attempted to license my MSO5074 and to be honest, it didn't go as smoothly as I hoped.

I started by updating to 1.3.2.2 from a very old version that I had patched. After finding all the missing modules for python I successfully connected to the 'scope and received the information screen. I then used the -u switch to uninstall the patched options and the display was refreshed with all the options gone. So far so good.

Then the problems began. Upon rebooting the 'scope acquired a new IP address and that caused me many problems trying to get the information screen back .... even though I was able to ping both the 'scope and the laptop,

Finally I was able to reconnect and successfully used the -r switch BUT after it had read CFRAM and then writing CFRAM successfully the 'scope rebooted and again the 'scope acquired another IP address so the "activation process" failed to connect to the 'scope and carry out activating the options.

I checked and the priv.pem file had been produced so after entering the correct IP address and using the -a switch .....SUCCESS. The script didn't read and write the CFRAM because it had already produced the priv.pem and so the 'scope didn't reboot causing the IP problems.

It might be worth adding that the 'scope reboots and may change the IP address causing the -a switch part of the -r switch routine would fail.

I was worried the -a switch would again cause the CFRAM reading/writing and the 'scope to reboot leaving me in exactly the same trouble. Thankfully that was not the case.

Once again a big thank you for all your hard work and efforts.

Rob

[BTO]

UPDATE : The Step by Step Instructional PDF is now available (it's detailed)

Also if possible (Because i'm interested to know) could you please leave comments if this worked for you or if it didn't , i think this will start working for everyone.

Many thanks for all the hard work and effort for providing this "licensing method".

Yesterday I attempted to license my MSO5074 and to be honest, it didn't go as smoothly as I hoped.

I started by updating to 1.3.2.2 from a very old version that I had patched. After finding all the missing modules for python I successfully connected to the 'scope and received the information screen. I then used the -u switch to uninstall the patched options and the display was refreshed with all the options gone. So far so good.

Then the problems began. Upon rebooting the 'scope acquired a new IP address and that caused me many problems trying to get the information screen back .... even though I was able to ping both the 'scope and the laptop,

Finally I was able to reconnect and successfully used the -r switch BUT after it had read CFRAM and then writing CFRAM successfully the 'scope rebooted and again the 'scope acquired another IP address so the "activation process" failed to connect to the 'scope and carry out activating the options.

I checked and the priv.pem file had been produced so after entering the correct IP address and using the -a switch .....SUCCESS. The script didn't read and write the CFRAM because it had already produced the priv.pem and so the 'scope didn't reboot causing the IP problems.

It might be worth adding that the 'scope reboots and may change the IP address causing the -a switch part of the -r switch routine would fail.

I was worried the -a switch would again cause the CFRAM reading/writing and the 'scope to reboot leaving me in exactly the same trouble. Thankfully that was not the case.

Once again a big thank you for all your hard work and efforts.

Rob

1. Glad to hear that your scope is now properly licensed

2.

I was worried the -a switch would again cause the CFRAM reading/writing and the 'scope to reboot leaving me in exactly the same trouble. Thankfully that was not the case.

And... that's not going to be the case because we have put in fail safes so the scope doesn't get bricked.

3.

It might be worth adding that the 'scope reboots and may change the IP address causing the -a switch part of the -r switch routine would fail.

I believe i have already added that the scope reboots on it's own.
off Memory i think we did this in version 8 or something like that, Where the -r Reboot became Automatic, so that people weren't left staring at the scope
wondering should they reboot it or not.

As for the I.P. Address thing.  Honestly....Out of HUNDREDS i think you're the first to mention that problem.
so i would chance a guess to say , that's an issue with your P.C. , Router or Scope Settings.
have you checked if your P.C. (Assuming it's windows) Network is not by chance set to PUBLIC Network ?

in any case, it doesn't matter now.
and you are correct.. there is the off chance that it happens to someone else...

BUT AGAIN.. that's why we have the failsafes.    so .. it is rare to occur, but IF it did occur, it's still not a problem anyway.

Enjoy your scope
and check out the videos that i posted for beginners to understand their scopes

Enjoy, Be Cool

[bajticzek]

HACKING THE RIGOL MSO5000 - Dr Mefisto's Fully Automatic License Activator

Hello, today I tried to do the upgrade and unlock all options. Well I guess I bricked my scope.

It's Rigol MSO5104 and it was on firmware 00.01.03.00.03 with no Options installed. I downloaded all files from the mega source, prepared my usb stick, prepared the ethernet connection between laptop and scope (it is not really needed thanks to the patch, or is it?). I then unpacked all files from archive "UPGRADING TO 350MHz (1.3.3.0).zip" and did both the memory and NAND backups. Then I had to upgrade the scope to version 00.01.03.03.00 which I did. Take note that I always safely unplugged the flash drive so the filesystem didn't corrupt. I proceeded to do the upgrade, it asked me to power off my scope (as it did in both the previous backup steps) so I did. After powering back on I was greeted with the Rigol logo and loading bar. The bar reached the end and stayed there. I waited 5 minutes, 5 more minutes, 10 more minutes... It was an hour in total so I powered off the scope. Powering it back on - the same story.

Now what to do with it? If I enter the preboot menu (pressing "Single" button repeatedly) I then cannot select either Upgrade Firmware or Restore Defaults option. The buttons do nothing, touch does not work either.

What can I do now?

EDIT:

After powering the scope down, letting it rest for ~1 hour and then entering the preboot menu I was able to Restore Defaults by pressing corresponding hardware button. It worked without an issue. I have no idea why I couldn't proceed before. Then, after resetting to defaults, the scope booted successfully. I then installed the patch - again via usb - and now the scope is fully unlocked.

[robiom]

So, I've just read your latest pdf instruction brochure and yes, you do mention after the -r switch the scope reboots after a load of licenses are attempted to be applied. My scope rebooted before the licenses were applied and when the scope restarted it had a different IP address. All the time the python script is saying "waiting for the scope to reboot and connect" which of course it never could as the IP address had changed.

It might have been just me with the IP address changing problem but after I exited the script and got the new IP address and checked the state of the options (-i switch) there were none activated so I ran the script again with the -a switch and then I saw all the licenses being applied.

Again the scope rebooted and hey presto ... everything is licensed FOREVER!

Great work on the script and instructions, a real great piece of work.

Rob

[BTO]

HACKING THE RIGOL MSO5000 - Dr Mefisto's Fully Automatic License Activator

Hello, today I tried to do the upgrade and unlock all options. Well I guess I bricked my scope.

It's Rigol MSO5104 and it was on firmware 00.01.03.00.03 with no Options installed. I downloaded all files from the mega source, prepared my usb stick, prepared the ethernet connection between laptop and scope (it is not really needed thanks to the patch, or is it?). I then unpacked all files from archive "UPGRADING TO 350MHz (1.3.3.0).zip" and did both the memory and NAND backups. Then I had to upgrade the scope to version 00.01.03.03.00 which I did. Take note that I always safely unplugged the flash drive so the filesystem didn't corrupt. I proceeded to do the upgrade, it asked me to power off my scope (as it did in both the previous backup steps) so I did. After powering back on I was greeted with the Rigol logo and loading bar. The bar reached the end and stayed there. I waited 5 minutes, 5 more minutes, 10 more minutes... It was an hour in total so I powered off the scope. Powering it back on - the same story.

Now what to do with it? If I enter the preboot menu (pressing "Single" button repeatedly) I then cannot select either Upgrade Firmware or Restore Defaults option. The buttons do nothing, touch does not work either.

What can I do now?

EDIT:

After powering the scope down, letting it rest for ~1 hour and then entering the preboot menu I was able to Restore Defaults by pressing corresponding hardware button. It worked without an issue. I have no idea why I couldn't proceed before. Then, after resetting to defaults, the scope booted successfully. I then installed the patch - again via usb - and now the scope is fully unlocked.

You're not supposed to install THE PATCH
The patch method is outdated, it is YEARS old

You're supposed to use  THE CORRECT LICENSING METHOD
i can tell that you did it incorrectly because you said,  the scope asked you to restart and YOU restarted.

in the new method, the scope restarts itself

Where did you get the link from ?

[BTO]

So, I've just read your latest pdf instruction brochure and yes, you do mention after the -r switch the scope reboots after a load of licenses are attempted to be applied. My scope rebooted before the licenses were applied and when the scope restarted it had a different IP address. All the time the python script is saying "waiting for the scope to reboot and connect" which of course it never could as the IP address had changed.

It might have been just me with the IP address changing problem but after I exited the script and got the new IP address and checked the state of the options (-i switch) there were none activated so I ran the script again with the -a switch and then I saw all the licenses being applied.

Again the scope rebooted and hey presto ... everything is licensed FOREVER!

Great work on the script and instructions, a real great piece of work.

Rob

THANK YOU

No No, that's normal.
Depending on which version of script you used, there was a time when ...
First try (with everyone) it didn't license, it showed that the license was not applied
then.. Second try and it IT WORKS
that happened with everyone.

so.. what you did was perfectly normal.

Congratulations

[BTO]

All you were supposed to do was this..

1. You don't need to upgrade and downgrade and all that anymore..

2. Just go the link
https://mega.nz/folder/A8cEgQRI#5FSoMrCurJi71T7VkRPgYQ

3. You need the PDF
the 2.10b  script
the 1.3.3.0  zip file

4. with the zip file 
You do the backup stage  Stage 1

You get the GEL file from (Stage 2)

You skip Stage 3,  You don't do patching

Just follow the PDF

so do it again, But this time to remove the patch,  use the uninstall switch
Start with the scope not licensed and do it again Using the Licensing Method

DON'T DO THE PATCH METHOD

[overheater]

Hello,
I got my Rigol MSO5074 yesterday. Unfortunately it is an older one with hardware version 01.01.000. The firmware was older too and I updated to 00.01.03.03.00 from the Rigol site. Have I to fear any issues when doing the licensing method because of this oldness?

Is your version of the 01.03.03.00 file a special one, or is it equal with the Rigol one? So, have I to flash your one instead?

Btw: Price of this new scope was 680 € in Germany including shipping - excl. vat.

are there differences between this hardware and newer ones?

[overheater]

another question: is it equal, which version of Python for install?
The newest one or is a special version necessary for this script?

I think about Arduino...... there sometimes it wasn't equal at all......

[mwb1100]

Unfortunately it is an older one with hardware version 01.01.000.

I believe that is the latest hardware version (though from 5 years or more ago).  It has fixes for an LCD brightness issue and a change to reduce fan noise.

[overheater]

You make me happy! I thought it is an old version because of the price.

[BTO]

You make me happy! I thought it is an old version because of the price.

No.. THE MSO5000 Hardware is the same in each scope and each version.
it's possible that the seller of your scope thought it was old.... BUT I'TS NOT

You just need to update the firmware and that's it.
if it passes Calibration and the self tests.  it's probably still fine

I have a DS2000A that .. i think is close to 15 years old now. still going strong

[overheater]

Nice to here this from two sides.
@ BTO,
to do the licence method I have two questions open:

is it equal, which version of Python for install?
The newest one or is 3.12.3 version necessary for this script as shown on the photo in your PDF manual?

I already updated to 00.01.03.03.00 from the Rigol site. Is your version of the 01.03.03.00 file equal with the Rigol one or is it a special one?
So, have I to flash your one instead?

[BTO]

Nice to here this from two sides.
@ BTO,
to do the licence method I have two questions open:

is it equal, which version of Python for install?
The newest one or is 3.12.3 version necessary for this script as shown on the photo in your PDF manual?

I already updated to 00.01.03.03.00 from the Rigol site. Is your version of the 01.03.03.00 file equal with the Rigol one or is it a special one?
So, have I to flash your one instead?

Oh, i see

1. The version of Python that you use doesn't really matter, Although it's good practice to use the latest version.
so if there is a newer version than the pdf i created, USE THE NEWER VERSION.
in any case, python just runs scripts and the libraries and modules that you're going to use don't change .

2.
My Version of EVERY GEL FILE in the Fully Licensed method is the Original Version taken from the Official Rigol Website.
it's not Modified as it doesn't need to be.

For the record... if you were to download the 1.3.3.0 from Rigol yourself, it would still work.
I've just included for people's convenience so that everything is in one place

but NO, there's nothing special about the GEL Files, they are completely Stock from Rigol

[gitm]

Can I get a clarification on if you already have the original patched GEL file/hack installed, you don’t need to downgrade the version first before running the new script?  I’m understanding that all you need to do is run the script and uninstall the options before proceeding.  Is that correct?

[BTO]

Can I get a clarification on if you already have the original patched GEL file/hack installed, you don’t need to downgrade the version first before running the new script?  I’m understanding that all you need to do is run the script and uninstall the options before proceeding.  Is that correct?

What you're referring to was relevant around 2 years ago when we were patching the scope.
We don't do that anymore, don't worry about it

it starts like this..
You buy a MSO 5000 and it's on a certain Firmware Version
It no longer matters which version you are on before the upgrade
and if you are on 1.3.3.0 you DO NOT need to downgrade first

Then your scope will have trial timers
You do not need to wait for them to expire, you can just go ahead and do the upgrade and run the script

It is advisable before upgrade to get onto the latest firmware version, but it's not mandatory.
Keep in mind if you are on version 1.3.2.2 or lower you will still unlock your scope but you won't have VNC Viewer

Can I get a clarification on if you already have the original patched GEL file/hack installed

You don't need to hack the GEL File,  Just use the one that i've provided

If your scope has already been PATCHED then you need to Uninstall the Options

but other than that
Use the provided GEL File, Follow the PDF and just run the script
My suggestion is forget what you already know about this process as it seems like you are remembering old information that is no longer relevant.
Just follow the PDF

[gitm]

Maybe I wasn’t clear in my question.  I already owned the scope for 2+ years and it is already hacked with the hacked GEL.  I would like to replace the hacked GEL options with the version that your script provides.  Do I need to install the non-hacked GEL first -or- can I run the script and just uninstall the hacked options before continuing?

[BTO]

Maybe I wasn’t clear in my question.  I already owned the scope for 2+ years and it is already hacked with the hacked GEL.  I would like to replace the hacked GEL options with the version that your script provides.  Do I need to install the non-hacked GEL first -or- can I run the script and just uninstall the hacked options before continuing?

Oh Ok
well

1. Use the script to Uninstall the Options
2. The just follow the steps in the PDF using My GEL file , which is not Modified and Rigol Official

if your scope was hacked 2+ years ago, chances are you did it with the Patched Method.
We are past that, as the patch method doesn't survive firmware upgrades

this current method, once implemented, properly licenses the scope and moving forward, you can upgrade via the official GEL File from the Rigol Site.
No more hacking required...EVER !!

so Just uninstall the options and follow the PDF and you should be good to go

[overheater]

Hello,

all is done for me and all worked as described!!!!

Many thanks for this script and the introduction!

Writing to the Ram of the Scope did only last several seconds.....

 

[BTO]

Hello,

all is done for me and all worked as described!!!!

Many thanks for this script and the introduction!

Writing to the Ram of the Scope did only last several seconds.....

 

Good Job and Well Done
Enjoy your scope
and yes, we optimized the process so that it is shorter.

The idea here was
1. The Longer it lasts, the More people worry
2. The Longer it lasts, the more probability there is that someone touches the keyboard and causes issues
3. The Longer it is , The higher the probability that you get caught in a power outage and you brick your Scope

and making the write time shorter has improved a lot of things

[eleBoy]

Trying to use the the Dr Mefisto's method and got stuck at step 15:

Code: [Select]

Python Rigol_MSO_LicensingUtility_2.10b.py -i 192.168.128.101
Traceback (most recent call last):
  File "C:\Users\xxx\Rigol_MSO_LicensingUtility_2.10b.py", line 740, in <module>
    main()
  File "C:\Users\xxx\Rigol_MSO_LicensingUtility_2.10b.py", line 629, in main
    k_model = model_to_license_str(model)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\xxx\Rigol_MSO_LicensingUtility_2.10b.py", line 424, in model_to_license_str
    m = re.match(r'([A-Za-z]+)(\d+)([A-Za-z]*)$', model)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python312\Lib\re\__init__.py", line 167, in match
    return _compile(pattern, flags).match(string)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
TypeError: expected string or bytes-like object, got 'NoneType'

Brand new scope, 1.3.2.2 firmware

The PC certainly is seeing the scope - can ping it...

I believe I was following the pdf instructions very carefully...

[BTO]

Trying to use the the Dr Mefisto's method and got stuck at step 15:

Code: [Select]

Python Rigol_MSO_LicensingUtility_2.10b.py -i 192.168.128.101
Traceback (most recent call last):
  File "C:\Users\xxx\Rigol_MSO_LicensingUtility_2.10b.py", line 740, in <module>
    main()
  File "C:\Users\xxx\Rigol_MSO_LicensingUtility_2.10b.py", line 629, in main
    k_model = model_to_license_str(model)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\xxx\Rigol_MSO_LicensingUtility_2.10b.py", line 424, in model_to_license_str
    m = re.match(r'([A-Za-z]+)(\d+)([A-Za-z]*)$', model)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python312\Lib\re\__init__.py", line 167, in match
    return _compile(pattern, flags).match(string)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
TypeError: expected string or bytes-like object, got 'NoneType'

Brand new scope, 1.3.2.2 firmware

The PC certainly is seeing the scope - can ping it...

I believe I was following the pdf instructions very carefully...

OK, i won't go into it technically as to what's happening, But basically
You are trying to bring up scope INFORMATION with the -i switch.
that SHOULD work flawlessly

Do this first..
You're on a brand new scope and your firmware is version 1.3.2.2

UPGRADE IT TO 1.3.3.0 Using the file provided in the cloud (it's a legitimate Rigol upgrade file)
then try to run the -i switch again and tell me if it worked

I'm thinking that the new upgrade file may fix the error pertaining to the scope Model number

but i'm also curious, before the upgrade while you are still on 1.3.2.2  can you provide a screenshot or picture
of what the scope actually shows in system information ?
I'm not interested in the Serial Number, I'm interested in what is displayed for the Model Number

[eleBoy]

Upgraded to 1.3.3.0 - getting the same issue with the script as before

[BTO]

(Attachment Link)

Upgraded to 1.3.3.0 - getting the same issue with the script as before

Hmm Interesting.
Question...
Re "Python Rigol_MSO_LicensingUtility_2.10b.py -i 192.168.128.101"
Why is your I.P. Address 192.168.128.101  ??
why isn't it 192.168.0.101   or .1.101  ??

Do me a favour and check if your router Has DHCP enabled and if your scope has DHCP enabled
or the other way to go around this is...
If you have an old router in the garage or bedroom, Plug it in and use that and see if you get the same result.
it doesn't need internet connection and doesn't need to be a new router, it can be any old piece of crap as long as it powers up and runs DHCP
and has a few Ethernet Ports

it looks to me like either it's a subdomain issue or a firewall within the router issue.
so far i wouldn't worry about your scope being bricked.  it's safe for now
but if you can't bring up, information..... something is wrong from a network point of view
or it could be python, but i doubt it

Do you have another router you can try it with ?   Most times you can get routers for free from gumtree and what not.
Try that an let me know how you go and let me know what the DHCP status of your scope is

if needed, i'm happy to jump on skype and help you with this one on one if you like
or we can continue like this