Author Topic: Hacking the Rigol MSO5000 series oscilloscopes  (Read 310518 times)

0 Members and 4 Guests are viewing this topic.

Offline adras

  • Contributor
  • Posts: 38
  • Country: de
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1125 on: July 29, 2019, 12:56:47 pm »
Looking at the questions from myself and others. How about we add some information into the starting post of this thread? Then we have a central place. Of course it takes some time to keep it up to date, but on the other hands, people wouldn't need to search through the whole thread.
Wish it where so easy, the original author is long gone and awol, and I yet have to receive a pull request on https://gitlab.com/riglol/rigolee or an update on the wiki https://gitlab.com/riglol/rigolee/wikis/home

While I admit I have been tardy (not, just super busy :p) I'll pick up on the subject again once I have more time.

I'm still waiting for someone to share the exact value of the resistor of the uart TX line, so I can solder that :) and I've almost started playing with my FPGA board again, trying to write some code helping to identify the pin used by the uart's RX.
I was hoping a moderator could add the stuff with a notification like "Added by moderator" or something.

Besides that, I just ran into a problem.

Starting from today, as soon as I connect the LAN cable and boot up the oscilloscope it stops reacting to any input after around 7 seconds.

  • I tried it a couple of times, without LAN(with internet) connected, the oscilloscope works fine.
  • But WITH LAN connected, it stops reacting to the touch screen, buttons and knobs after around 5-7 seconds.
  • It seems like the oscilloscope is deactivating itself because it checks with a server and figures out it got hacked.
  • It worked fine yesterday.
  • I also disconnected all probes except one which is connected to the test signal. But even without a probe connected I've got the same issue.

I'm using the DS5000Update_01.01.04.04.GEL firmware

Did anybody else notice that?

 

Online Fungus

  • Super Contributor
  • ***
  • Posts: 11202
  • Country: 00
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1126 on: July 29, 2019, 02:47:02 pm »
Starting from today, as soon as I connect the LAN cable and boot up the oscilloscope it stops reacting to any input after around 7 seconds.

  • I tried it a couple of times, without LAN(with internet) connected, the oscilloscope works fine.
  • But WITH LAN connected, it stops reacting to the touch screen, buttons and knobs after around 5-7 seconds.
  • It seems like the oscilloscope is deactivating itself because it checks with a server and figures out it got hacked.
  • It worked fine yesterday.

I'm using the DS5000Update_01.01.04.04.GEL firmware

Did anybody else notice that?

Hard to believe... but a packet sniffer will confirm it one way or another.

 

Offline Martin72

  • Super Contributor
  • ***
  • Posts: 1461
  • Country: de
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1127 on: July 29, 2019, 03:08:51 pm »

Offline adras

  • Contributor
  • Posts: 38
  • Country: de
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1128 on: July 29, 2019, 08:46:43 pm »
 

Offline serg_77

  • Newbie
  • Posts: 1
  • Country: ru
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1129 on: August 12, 2019, 10:15:36 pm »
Hi people. The site https://cn.rigol.com/Support/SoftDownload/3 has a new firmware MSO5000_00.01.01.04.08. Good luck to all.
 
The following users thanked this post: thm_w, tcottle

Offline thm_w

  • Super Contributor
  • ***
  • Posts: 2295
  • Country: ca
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1130 on: August 12, 2019, 11:55:18 pm »
Hi people. The site https://cn.rigol.com/Support/SoftDownload/3 has a new firmware MSO5000_00.01.01.04.08. Good luck to all.

Quote
v00.01.01.04.08 2019/08/02

      -Fixed system crashed when clicking Default.
      -Fixed 4CH option bug.
      -Fixed noise signal captured.
      -Improved the measure result updating rate.
      -Fixed accurate measurements not updated in ROLL

Not a big upgrade from the notes, no bode plot or high-res fixes.
"4CH option bug" sounds like if you buy the 4-CH option it doesn't work properly? Which could be what I noticed, but it was resolved with a simple self-cal. Surprised someone actually bought it.
The chinese translation version is worded differently: "Fix version 2.3 of the 4CH option, not activated on version 4.4 and later".
 

Offline NoisyBoy

  • Frequent Contributor
  • **
  • Posts: 386
  • Country: us
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1131 on: August 13, 2019, 12:03:10 am »
Well, it would be interesting to see if the "enhancements" still work with this version of the firmware.

Agreed on it being a fairly short list given it takes 5 months to develop, likely all focus was on the MSO8000 scope launch.
 

Offline stmcore

  • Contributor
  • Posts: 5
  • Country: 00
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1132 on: August 13, 2019, 12:12:07 am »
Enhancements "patch" not working with 04.08  but you can downgrade back to 04.04 using the secret menu.  while powering on
keep hitting  single button  :horse:
« Last Edit: August 13, 2019, 12:51:51 am by stmcore »
 
The following users thanked this post: thm_w

Offline NoisyBoy

  • Frequent Contributor
  • **
  • Posts: 386
  • Country: us
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1133 on: August 13, 2019, 12:39:13 am »
Good to know, as the install instruction doc states that firmware cannot be downgraded.

 

Offline mabl

  • Regular Contributor
  • *
  • Posts: 112
  • Country: 00
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1134 on: August 13, 2019, 05:11:12 am »
Not a big upgrade from the notes, no bode plot or high-res fixes.

Don't forget this should fix the overswings on self-cal for every one.

Enhancements "patch" not working with 04.08

Sure. Somebody will need to patch it again and provide a  updated patch to the general public.
 

Offline tv84

  • Super Contributor
  • ***
  • Posts: 1814
  • Country: pt
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1135 on: August 13, 2019, 10:14:52 am »
Good to know, as the install instruction doc states that firmware cannot be downgraded.

It has stated that since the beginning. That will only happen when they change the bootloader.

And, of course, if you have a NAND dump backup, you can always restore it fully to a previous version.
 
The following users thanked this post: NoisyBoy

Offline tv84

  • Super Contributor
  • ***
  • Posts: 1814
  • Country: pt
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1136 on: August 13, 2019, 07:10:40 pm »
MSO5000_00.01.01.04.08:

Code: [Select]
#echo "++ Starting telnet daemon"
#telnetd -l /bin/sh

#echo "++ Starting http daemon"
#httpd -h /var/www

#echo "++ Starting ftp daemon"
#tcpsvd 0:21 ftpd ftpd -w /&

#echo "++ Starting ssh daemon"
#/usr/sbin/sshd

Interesting that the K160 FPGA programming is the same as in the MSO8000 FW released a few days ago.
« Last Edit: August 13, 2019, 09:13:12 pm by tv84 »
 
The following users thanked this post: thm_w

Offline stmcore

  • Contributor
  • Posts: 5
  • Country: 00
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1137 on: August 13, 2019, 09:56:35 pm »
Downgrading from 04.08 back to 04.04 is safe . Tested 100% .

 
The following users thanked this post: kwinz, NoisyBoy, serg_77

Offline thm_w

  • Super Contributor
  • ***
  • Posts: 2295
  • Country: ca
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1138 on: August 13, 2019, 10:10:09 pm »
Interesting that the K160 FPGA programming is the same as in the MSO8000 FW released a few days ago.

This makes me think again that 10GS/s is available or actually used on the MSO5000. Not that it would make a huge difference vs 8GS/s, but its interesting thought.
Sort of what I measured in the other rigol thread, but it could just be software weirdness..
 
The following users thanked this post: serg_77

Offline mabl

  • Regular Contributor
  • *
  • Posts: 112
  • Country: 00
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1139 on: August 15, 2019, 03:36:20 pm »
Just a heads up. On a hacked latest firmware the Jitter analysis works  :popcorn: (Did not get eye to work though.)

I leave it to others to prepare a general auto patcher this time, though. >:D
« Last Edit: August 15, 2019, 03:53:28 pm by mabl »
 

Offline mabl

  • Regular Contributor
  • *
  • Posts: 112
  • Country: 00
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1140 on: August 15, 2019, 04:06:20 pm »
MSO5000_00.01.01.04.08:
Interesting that the K160 FPGA programming is the same as in the MSO8000 FW released a few days ago.

Interestingly, the differences to latest MSO5000 firmware are really pretty minimal:

Code: [Select]
Changes not staged for commit:
  (use "git add/rm <file>..." to update what will be committed)
  (use "git checkout -- <file>..." to discard changes in working directory)

        modified:   firmware/fw4linux.sh
        modified:   firmware/fw4uboot.sh
        deleted:    firmware/kerstrel.config
        deleted:    firmware/kerstrel.dts
        modified:   firmware/logo.png
        modified:   firmware/rootfs/rigol/appEntry
        modified:   firmware/rootfs/rigol/default/cal.hex
        modified:   firmware/rootfs/rigol/drivers/usbtmc_dev.ko
        modified:   firmware/rootfs/rigol/resource/appmeta.xml
        modified:   firmware/rootfs/rigol/resource/boardmeta.xml
        modified:   firmware/rootfs/rigol/resource/dsometa.xml
        deleted:    firmware/rootfs/rigol/resource/satable/hori_2g/100K
        deleted:    firmware/rootfs/rigol/resource/satable/hori_2g/10K
        deleted:    firmware/rootfs/rigol/resource/satable/hori_2g/10M
        deleted:    firmware/rootfs/rigol/resource/satable/hori_2g/1K
        deleted:    firmware/rootfs/rigol/resource/satable/hori_2g/1M
        deleted:    firmware/rootfs/rigol/resource/satable/hori_2g/25M
        deleted:    firmware/rootfs/rigol/resource/satable/hori_2g/50M
        deleted:    firmware/rootfs/rigol/resource/satable/hori_2g/AUTO
        deleted:    firmware/rootfs/rigol/resource/satable/hori_4g/100K
        deleted:    firmware/rootfs/rigol/resource/satable/hori_4g/100M
        deleted:    firmware/rootfs/rigol/resource/satable/hori_4g/10K
        deleted:    firmware/rootfs/rigol/resource/satable/hori_4g/10M
        deleted:    firmware/rootfs/rigol/resource/satable/hori_4g/1K
        deleted:    firmware/rootfs/rigol/resource/satable/hori_4g/1M
        deleted:    firmware/rootfs/rigol/resource/satable/hori_4g/25M
        deleted:    firmware/rootfs/rigol/resource/satable/hori_4g/50M
        deleted:    firmware/rootfs/rigol/resource/satable/hori_4g/AUTO
        deleted:    firmware/rootfs/rigol/resource/satable/hori_8g/100K
        deleted:    firmware/rootfs/rigol/resource/satable/hori_8g/100M
        deleted:    firmware/rootfs/rigol/resource/satable/hori_8g/10K
        deleted:    firmware/rootfs/rigol/resource/satable/hori_8g/10M
        deleted:    firmware/rootfs/rigol/resource/satable/hori_8g/1K
        deleted:    firmware/rootfs/rigol/resource/satable/hori_8g/1M
        deleted:    firmware/rootfs/rigol/resource/satable/hori_8g/200M
        deleted:    firmware/rootfs/rigol/resource/satable/hori_8g/25M
        deleted:    firmware/rootfs/rigol/resource/satable/hori_8g/50M
        deleted:    firmware/rootfs/rigol/resource/satable/hori_8g/AUTO
        modified:   firmware/rootfs/rigol/resource/scpi/SYSTem.xml
        modified:   firmware/rootfs/rigol/shell/start.sh
        modified:   firmware/rootfs/rigol/tools/spi2cpld
        modified:   firmware/rootfs/rigol/tools/spi2dev
        modified:   firmware/rootfs/rigol/tools/spi2k7
        modified:   firmware/rootfs/rigol/tools/spi2pll
        modified:   firmware/rootfs/rigol/webcontrol/lib/libpcre.a
        modified:   firmware/rootfs/rigol/webcontrol/lib/libpcrecpp.a
        modified:   firmware/rootfs/rigol/webcontrol/lib/libpcreposix.a
        modified:   firmware/rootfs/rigol/webcontrol/lib/libz.a
        modified:   firmware/rootfs/rigol/webcontrol/webpages/Help.html
        modified:   firmware/rootfs/rigol/webcontrol/webpages/images/1.jpg
        modified:   firmware/zImage
        modified:   firmware/zynq.bit

Untracked files:
  (use "git add <file>..." to include in what will be committed)

        GEL/DS8000Update_00.01.01.00.00.GEL
        firmware/rootfs/rigol/cups/testPage.bmp
        firmware/rootfs/rigol/resource/satable/hori_10g/
        firmware/rootfs/rigol/resource/satable/hori_20g/
        firmware/rootfs/rigol/resource/satable/hori_2_5g/
        firmware/rootfs/rigol/resource/satable/hori_5g/
        firmware/rootfs/rigol/resource/satable/hori_5g_100m/
        firmware/unknown.config
        firmware/unknown.dts
 
The following users thanked this post: kwinz

Offline Sighound36

  • Frequent Contributor
  • **
  • Posts: 302
  • Country: gb
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1141 on: August 15, 2019, 04:57:07 pm »
Just a heads up. On a hacked latest firmware the Jitter analysis works  :popcorn: (Did not get eye to work though.)

I leave it to others to prepare a general auto patcher this time, though. >:D

Hi mabl

Would you mind posting some images for this in actual operation, mine always crashes after 60 or so seconds then freezes requiring a hard reset.

I have several work colleagues with an opened up 5000 and they all have the same issue.

Firmware is the 04.04 version unit was purchased in April this year and has the build date on Feb 2019, all of the other MSO 5000 exhibit the same issues with the Jitter measurements (also try and engage the histogram) and the eye pattern will not work due to BW limitations I suspect.

The <SO8000 uses 10G/s and 10Mpts for eye pattern measurements I believe.

Seeking quality measurement equipment at realistic cost with proper service backup. If you pay peanuts you employ monkeys.
 

Offline mabl

  • Regular Contributor
  • *
  • Posts: 112
  • Country: 00
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1142 on: August 15, 2019, 05:17:37 pm »
Remember, that jitter feature is not officially part of the MSO5000. The patch just blindly enables all features there are, I rigged up a simple test with the internal wave generator and firmware 01.01.04.08. See attached file. It feels stable. I guess they invested some effort for the MSO8000 launch and we just profit from that . Also auto baud rate detection works rather well.
 
The following users thanked this post: Sighound36

Offline tv84

  • Super Contributor
  • ***
  • Posts: 1814
  • Country: pt
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1143 on: August 15, 2019, 09:09:37 pm »
Remember, that jitter feature is not officially part of the MSO5000.

I somewhat disagree. If that was the case, the option wouldn't be in the available options for MSO5000 (inside the code).

Maybe they decided to cut it off when deciding the BW versions of the 5000...

Would you mind posting some images for this in actual operation, mine always crashes after 60 or so seconds then freezes requiring a hard reset.

Maybe temperature comes into play... And that's why they decided to lower the sample rate...

alexvg has been investing hard in improving the temps.

Anyone knows if the DS7000 / MSO8000 has better thermal architecture than the one described by alexvg?

https://www.eevblog.com/forum/blog/new-rigol-scope/msg2552004/#msg2552004


« Last Edit: August 15, 2019, 09:36:20 pm by tv84 »
 
The following users thanked this post: thm_w

Offline Shodge

  • Contributor
  • Posts: 19
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1144 on: August 16, 2019, 02:39:59 am »
So the previous patch for SSH should work on the new firmware.  Can anyone confirm that?

Following mabl's lead, all that would be necessary to update the .GEL patch with a new appEntry_01_01_04_04.patch.gz file which locates the same code fragment in the updated appEntry.  Then repack...

Correct?

-Stan
« Last Edit: August 16, 2019, 03:56:40 am by Shodge »
 

Offline mabl

  • Regular Contributor
  • *
  • Posts: 112
  • Country: 00
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1145 on: August 16, 2019, 08:39:14 am »
So the previous patch for SSH should work on the new firmware.  Can anyone confirm that?

Confirmed.

Following mabl's lead, all that would be necessary to update the .GEL patch with a new appEntry_01_01_04_04.patch.gz file which locates the same code fragment in the updated appEntry.  Then repack...

You first need a patched appEntry. The license code has changed a bit in wake of the MSO8000 launch I guess. I'm not sure the bit sequences are identical. I just identified the relevant function again and patch it to always return 1. I then copied it over to the scope to /tmp via ssh; marked it executable and then run it. All worked, so I copied it over to /rigol/ on my scope and saved everything with a call to sync.

The patcher is required if others want to have a USB install method. Some pages pack I already provided bspatch/bsdiff compiled with that ancient Xilinx toolchain. That will be a far preferred option than doing that base64 encoding/text patch/decode thingy of my initial patch script. I'm sure based on this others will be able to create a nice solution. I just don't want to commit mass copy right infringements anymore  :-\  For now rest assured that hacking the scope is still possible.

On a side node, the self calibration is now absolutely perfect and I can trim the provided probes to a perfectly flat response. Feels even a bit better than the calibration with the (hacked) beta firmware.
 
The following users thanked this post: thm_w, NoisyBoy

Offline phips

  • Newbie
  • Posts: 2
  • Country: de
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1146 on: August 16, 2019, 09:20:02 am »
Hello community,

just signed up to reply to this amazing thread.
I'm a beginner in hardware hacking and want to understand the hack deeply.
At the moment I don't own a MSO5000.
Nevertheless I want to understand what you did to turn on all functions.

Does anyone know a reference to some kind of walk through, what was patched and how the journey went there?


Best
 

Offline Sighound36

  • Frequent Contributor
  • **
  • Posts: 302
  • Country: gb
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1147 on: August 16, 2019, 09:49:16 am »
Remember, that jitter feature is not officially part of the MSO5000. The patch just blindly enables all features there are, I rigged up a simple test with the internal wave generator and firmware 01.01.04.08. See attached file. It feels stable. I guess they invested some effort for the MSO8000 launch and we just profit from that . Also auto baud rate detection works rather well.

Hi mabl

Thank you for sharing  :)

The jitter feature which is now working on your machine has to be related to the new FW, your machine has three more options installed on the jitter tab.

Something to attend to at the weekend!
Seeking quality measurement equipment at realistic cost with proper service backup. If you pay peanuts you employ monkeys.
 

Offline swansonbroth

  • Newbie
  • Posts: 4
  • Country: de
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1148 on: August 16, 2019, 11:41:17 am »
Can anybody share the new firmware (patched ;-)) with the new Options like Jitter??
 

Online delfinom

  • Regular Contributor
  • *
  • Posts: 76
  • Country: 00
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #1149 on: August 16, 2019, 12:47:53 pm »
I just don't want to commit mass copy right infringements anymore  :-\

I don't blame you with sites like hackaday broadcasting the hack out loud. (Meanwhile hypocritically they censored the Tektronix hacks they had)

Thanks for your work though, easy enough to build upon ;)
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf