Author Topic: Hacking the Rigol MSO5000 series oscilloscopes (Read 1301796 times)

thm_w · « **Reply #1475 on:** January 23, 2020, 10:56:49 pm »

Quote from: tv84 on January 23, 2020, 09:42:51 pm

Finally Rigol acknowledging the use of Open Source in their latest products!!!!!!!!!!

MSO5000 example

well let's assume "acknowledgement" is what they meant.

And, if we could access the source code then that would be a killer factor!

Did you request it? If not I've made a request now, will update if they respond.

BitBug · « **Reply #1476 on:** January 24, 2020, 01:58:31 am »

Quote from: tv84 on January 23, 2020, 09:42:51 pm

And, if we could access the source code then that would be a killer factor!

Quote from: BitBug on March 15, 2019, 07:16:48 pm

It's only a matter of time before we, as a community, pick a relatively inexpensive "base" piece of DSO hardware and make it our own (as in, we maintain the firmware/software - they just compete on the best hardware). What DSO engineering company wouldn't want to be "chosen" by our community as the first hardware "base"? ...Certainly not Rigol - they just want to sell their hardware... and I'm half thinking (at least, in part) this is Rigol's modus operandi when it comes to the ease of hacking their scopes. I'm actually really surprised that a entire source code tree hasn't mysteriously "appeared" on the web to force some companies' sales into the stratosphere... and it would!

Nahh, couldn't be... could it!?

BB

bitseeker · « **Reply #1477 on:** January 24, 2020, 06:21:51 am »

Quote from: tv84 on January 23, 2020, 09:42:51 pm

Finally Rigol acknowledging the use of Open Source in their latest products!!!!!!!!!!

MSO5000 example

well let's assume "acknowledgement" is what they meant.

And, if we could access the source code then that would be a killer factor!

Unfortunately, using open source software in their product is not as interesting as publishing theirs as open source. The software they use is pretty standard stuff (lighttpd, linux, lua, lxi, u-boot, etc.).

Officially acknowledging that they're using it is certainly a good thing.

mabl · « **Reply #1478 on:** January 24, 2020, 06:38:52 am »

Quote from: bitseeker on January 24, 2020, 06:21:51 am

Unfortunately, using open source software in their product is not as interesting as publishing theirs as open source. The software they use is pretty standard stuff (lighttpd, linux, lua, lxi, u-boot, etc.).

However the modified u-boot source as well as kernel and related modules might be nice having.

vr2whf · « **Reply #1479 on:** January 24, 2020, 03:49:06 pm »

Quote from: Martin72 on January 22, 2020, 06:18:15 pm

My last information was "probably end of january".

Chance to add the bode plot feature?

808exe · « **Reply #1480 on:** January 24, 2020, 11:51:39 pm »

Hey, so not totally hacking related but if you bought your scope after 10/1/2019 Rigol will update your license for free.
Now, this does not include the bandwidth, but it enables all the serial decode capabilities, power analysis and also enables the function generator
https://beyondmeasure.rigoltech.com/acton/form/1579/0065:/0/index.htm?sid=TV2:U3tSfkw22
As it is a promo, it does end on 3/30/2020

Martin72 · « **Reply #1481 on:** January 25, 2020, 12:07:38 am »

Quote from: vr2whf on January 24, 2020, 03:49:06 pm

Quote from: Martin72 on January 22, 2020, 06:18:15 pm
My last information was "probably end of january".

Chance to add the bode plot feature?

Once they (rigol EU support) told me clearly, bode will come.
But they did it in may 2019.
Now we got january 2020 and still there´s no update.

BitBug · « **Reply #1482 on:** January 25, 2020, 05:00:16 pm »

Quote from: 808exe on January 24, 2020, 11:51:39 pm

Hey, so not totally hacking related but if you bought your scope after 10/1/2019 Rigol will update your license for free.
Now, this does not include the bandwidth, but it enables all the serial decode capabilities, power analysis and also enables the function generator
https://beyondmeasure.rigoltech.com/acton/form/1579/0065:/0/index.htm?sid=TV2:U3tSfkw22
As it is a promo, it does end on 3/30/2020

Wonder if this is an "online" scope update/promo to see who has hacked their scopes.

BB

808exe · « **Reply #1483 on:** January 26, 2020, 03:34:42 am »

Nope! Upgrade worked for me! Scope does not need to be connected to the internet for the upgrade

What happens is rigol sends your an email with a PDF with a product key
You then punch the product key and serial in to a website they link you too. This then generates a software licensing code, and an authorization file.
Load the authorization file onto a USB and the option install button becomes active. Press it to install and your done

If anyone is interested I can provide screenshots and maybe some files too

kwinz · « **Reply #1484 on:** January 27, 2020, 08:57:35 am »

Thank you all!

After reading 60 pages of this thread again, and also of the almost 40 pages of https://www.eevblog.com/forum/blog/new-rigol-scope/ I successfully

upgraded to 00.01.01.04.08
unlocked the options

What set me up during upgrading?

CR+LF endings in patch.txt that I created manually had to be changed to LF. Easiest is to download and use the pre-created patch.txt from this thread
and the scope refused to read from a 8GB stick. I tried another 32GB one and it succeeded. Both were FAT32.
After that I got massive overshoot with the probes, even on 1kHz that I couldn't compensate for https://www.dropbox.com/s/ep15dh6lag0i3cg/3500.png?dl=0
~~I tried to do a new self-cal without success. I have backups of the old /rigol/data directory so I will try if moving that back helps.~~
Another self-cal fixed it.

So now what still doesn't work?

The RIGOL Web control that worked perfectly in 00.01.01.02.03 now flickers and is unusable.
https://www.dropbox.com/s/lrbsrrf5xrw6rsk/rigol-webcontrol.PNG?dl=0
Print screen works, but only if you manually load image. It's as if the new webserver closes the connection before the screen files are ready. https://www.dropbox.com/s/kj07ejbd3cskwpg/rigol-loadimage.PNG?dl=0
Maybe I should try to put the old /rigol/webcontrol directory back from an earlier backup?
The scope just randomly locked up while I was changing the frequency of the Signal Generator 1.
I can still see the Channel 1 waveform slightly flicker and SSH also still works but button presses on the oscilloscope do nothing. The UI input crashed. Also print screen via Webcontrol shows "Print the image failed" - I don't get as far as doing the "manually load image" trick. Reboot and everything is back to normal.

I already spent too much time on the weekend and I will leave it as is for now.
Anybody can confirm they have the same issue on unlocked 00.01.01.04.08?

Pizzalover · « **Reply #1485 on:** January 30, 2020, 02:09:07 am »

Hi,

My first post.

I read the whole thread and will order a MSO5074 very soon, and armed with the knowledge from this thread will have extended functionality as soon as the unit arrives.

A big thank you to everyone who made this possible.

-Thor-

Cust · « **Reply #1486 on:** January 30, 2020, 01:32:45 pm »

Quote from: AngusBeef on September 11, 2019, 11:25:32 pm

This is just a play-by-play of what I did – I struggled my way through it so there are ways to run things more efficiently or better that I wasn’t aware of at the time.

Step 1: Get your Linux workstation functional, either by installing directly or running it within VirtualBox. I’m using a Windows PC so I’m running everything through VirtualBox, which just adds a couple intermediate steps.

Step 2: Get organized – I made 3 folders, “Upgrade”, “Enable SSH”, and “Patch”.
-   In the Upgrade folder, download the 01.01.04.08 GEL from GitLab and rename it DS5000Update.GEL ([url]https://gitlab.com/riglol/rigolee/blob/MSO5000/GEL/DS5000Update_01.01.04.08.GEL[/url])
-   In the Enable SSH folder, add the GEL file from this post and rename it DS5000Update.GEL ([url]https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg2234076/#msg2234076[/url])
-   In the Patch folder, download the Bpatch folder from this post and remove the .txt extension ([url]https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg2620701/#msg2620701[/url])

Step 3: Upgrade the MSO5000 using the DS5000Update.GEL file from the Upgrade Folder. Put the file onto the root directory of the USB drive and then go to the Utility / System / Help / Local Upgade menu once you’ve put the USB into the MSO5000 and upgrade to 01.01.04.08. Restart the Oscilloscope

Step 4: Now time for the heavy lifting. Put the USB drive back into the computer and remove the update file you just used from the USB stick. Now go to the Enable SSH folder and put that DS5000Update.GEL file onto the USB drive. Put the USB stick into the MSO5000 and run the Local Upgrade again. Oh no, it failed! Except it didn’t, as @mabl stated in his post, it will look like it failed but it works. DO NOT RESTART THE OSCILLOSCOPE, otherwise you will have to run step 4 again. Also, leave the USB stick in the MSO5000 for the next steps.

Step 5: If it’s not already connected, connect your MSO5000 to your LAN or use a crossover cable if you have one to hook it to your computer. If all you have is “normal” LAN cables, you’ll need to use your router and can’t hook directly to your PC. Now go to the Utility/ IO / LAN menu and write down the IP address of your MSO5000.

Step 6: If it’s not already in your distro, go to the software manager and download Putty so that you can SSH (Secure Shell) across the network into your MSO5000. Once it’s downloaded, you’re going to follow some of the instructions from @TopLoser that @TrickTronic posted. First, run PuTTY and put the IP address into the IP window, use Port 22, and select SSH for your connection type. Then, use “root” as the username and “Rigol201” as the pwd. You’re now connected to the Oscilloscope.

Step 7: In the SSH, type (without quotes) “cp /rigol/appEntry /media/sda1/”. Once it’s finished writing it to the USB stick (although it’s probably not the “best” answer, just pull the USB stick out and put it back into your computer. Copy the bspatch file into the root of the USB stick as well. Right click and open a terminal window starting in the USB stick and type “bspatch appEntry appEntryPatched appEntry_01_01_04_08.bpatch” into the terminal. It will create you a new file called appEntryPatched. Rename the original file to appEntryUnpatched or something similar and then rename the patched file to appEntry. Now remove the USB stick and put it back into the Oscilloscope.

Step 8: I hope you kept your SSH open, if not then open it back up. Type “cd /media/sda1”. If the command fails, replace sda1 with sdb1. My MSO5000 mounted the USB drive into this second location when I put it back in. Type “ls” (LS in lower case if the font here sucks) to see the files in the directory. You should see your files. Now run “chmod +x appEntry” to allow the appEntry file to be an executable, otherwise it will not work. To make this next step easier, move back to the root directory using “cd /”. You can type “pwd” at any time in SSH or Terminal to see the directory you’re currently in at any time. Now copy the file back to the oscilloscope, “cp /media/sda1/appEntry /rigol/” and you should be good to go.

Step 9: Restart your Oscilloscope and don’t forget to thank the dozens of people on this forum who made this possible.

Nice! My Rigol is dead!

TK · « **Reply #1487 on:** January 30, 2020, 01:52:35 pm »

Quote from: Cust on January 30, 2020, 01:32:45 pm

Quote from: AngusBeef on September 11, 2019, 11:25:32 pm
This is just a play-by-play of what I did – I struggled my way through it so there are ways to run things more efficiently or better that I wasn’t aware of at the time.

Step 1: Get your Linux workstation functional, either by installing directly or running it within VirtualBox. I’m using a Windows PC so I’m running everything through VirtualBox, which just adds a couple intermediate steps.

Step 2: Get organized – I made 3 folders, “Upgrade”, “Enable SSH”, and “Patch”.
-   In the Upgrade folder, download the 01.01.04.08 GEL from GitLab and rename it DS5000Update.GEL ([url]https://gitlab.com/riglol/rigolee/blob/MSO5000/GEL/DS5000Update_01.01.04.08.GEL[/url])
-   In the Enable SSH folder, add the GEL file from this post and rename it DS5000Update.GEL ([url]https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg2234076/#msg2234076[/url])
-   In the Patch folder, download the Bpatch folder from this post and remove the .txt extension ([url]https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg2620701/#msg2620701[/url])

Step 3: Upgrade the MSO5000 using the DS5000Update.GEL file from the Upgrade Folder. Put the file onto the root directory of the USB drive and then go to the Utility / System / Help / Local Upgade menu once you’ve put the USB into the MSO5000 and upgrade to 01.01.04.08. Restart the Oscilloscope

Step 4: Now time for the heavy lifting. Put the USB drive back into the computer and remove the update file you just used from the USB stick. Now go to the Enable SSH folder and put that DS5000Update.GEL file onto the USB drive. Put the USB stick into the MSO5000 and run the Local Upgrade again. Oh no, it failed! Except it didn’t, as @mabl stated in his post, it will look like it failed but it works. DO NOT RESTART THE OSCILLOSCOPE, otherwise you will have to run step 4 again. Also, leave the USB stick in the MSO5000 for the next steps.

Step 5: If it’s not already connected, connect your MSO5000 to your LAN or use a crossover cable if you have one to hook it to your computer. If all you have is “normal” LAN cables, you’ll need to use your router and can’t hook directly to your PC. Now go to the Utility/ IO / LAN menu and write down the IP address of your MSO5000.

Step 6: If it’s not already in your distro, go to the software manager and download Putty so that you can SSH (Secure Shell) across the network into your MSO5000. Once it’s downloaded, you’re going to follow some of the instructions from @TopLoser that @TrickTronic posted. First, run PuTTY and put the IP address into the IP window, use Port 22, and select SSH for your connection type. Then, use “root” as the username and “Rigol201” as the pwd. You’re now connected to the Oscilloscope.

Step 7: In the SSH, type (without quotes) “cp /rigol/appEntry /media/sda1/”. Once it’s finished writing it to the USB stick (although it’s probably not the “best” answer, just pull the USB stick out and put it back into your computer. Copy the bspatch file into the root of the USB stick as well. Right click and open a terminal window starting in the USB stick and type “bspatch appEntry appEntryPatched appEntry_01_01_04_08.bpatch” into the terminal. It will create you a new file called appEntryPatched. Rename the original file to appEntryUnpatched or something similar and then rename the patched file to appEntry. Now remove the USB stick and put it back into the Oscilloscope.

Step 8: I hope you kept your SSH open, if not then open it back up. Type “cd /media/sda1”. If the command fails, replace sda1 with sdb1. My MSO5000 mounted the USB drive into this second location when I put it back in. Type “ls” (LS in lower case if the font here sucks) to see the files in the directory. You should see your files. Now run “chmod +x appEntry” to allow the appEntry file to be an executable, otherwise it will not work. To make this next step easier, move back to the root directory using “cd /”. You can type “pwd” at any time in SSH or Terminal to see the directory you’re currently in at any time. Now copy the file back to the oscilloscope, “cp /media/sda1/appEntry /rigol/” and you should be good to go.

Step 9: Restart your Oscilloscope and don’t forget to thank the dozens of people on this forum who made this possible.
Nice! My Rigol is dead!

It is most probable that you made a mistake in one of the steps. I think there is a MAGIC button you can press while the scope powers up to recover it from bricked state

Cust · « **Reply #1488 on:** January 30, 2020, 02:00:54 pm »

Hi, yes, I make mistake. I patch patched file.

What is the magic button?

TK · « **Reply #1489 on:** January 30, 2020, 02:08:45 pm »

From a previous post on this thread:

Copy the official firmware to a usb key. Stick it in the scope.
While powering on the scope, keep pressing the single button.
You'll see two options show up and you should be able to flash back to the official firmware.

Cust · « **Reply #1490 on:** January 30, 2020, 02:28:53 pm »

Thanks, my MSO5104 is alive!

Cust · « **Reply #1491 on:** January 30, 2020, 03:55:04 pm »

Patch not work for my Rigol...
I have downloaded new firmware from the official Rigol web. Maybe there's new protection.

Cust

EDIT: I have FFT, I have some features... I do not understand that.

TK · « **Reply #1492 on:** January 30, 2020, 05:01:04 pm »

FFT is standard. For the hack to work you need a specific firmware version installed, as the patched file is for that version only. Make sure your scope has the correct firmware installed.

skander36 · « **Reply #1493 on:** January 30, 2020, 06:35:26 pm »

Quote from: Cust on January 30, 2020, 03:55:04 pm

Patch not work for my Rigol...
I have downloaded new firmware from the official Rigol web. Maybe there's new protection.
Cust

EDIT: I have FFT, I have some features... I do not understand that.

Current firmware available is 00.01.01.04.08 . It is from august 2019 .
If you have this version of firmware try to folow instructions from this post : https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg2785686/#msg2785686

Let us know if you succeed .

Cust · « **Reply #1494 on:** January 31, 2020, 06:37:13 pm »

I had version 00.01.01.04.04 in Rigol. I patched this version. Osciloscope was working. Menu said BW: 100MHz. Then I upgraded (from help menu) to version 00.01.01.04.08. Osciloscope was working. Menu said BW: 100MHz.

I patch this patched and upgraded appEntry again and osciloscope has stopped working - at the loading sw (picture with RIGOL and white loading line - at 100%).

Then I updated fw from safe mode to version 00.01.01.04.08 (RIGOL web, date: 2. august 2019). I patch appEntry with the same result: oscilloscope does not work.

Then I download version 00.01.01.04.04 -> safe mode -> update -> patch -> oscilloscope does not work.
Then I download version 00.01.01.04.08 -> safe mode -> update -> patch -> oscilloscope does not work.

Now, I have unpatched version 00.01.01.04.08.

tv84 · « **Reply #1495 on:** January 31, 2020, 07:17:23 pm »

You must be patching 1.04.08 with the 1.04.04 patch...

Cust · « **Reply #1496 on:** January 31, 2020, 09:33:02 pm »

You mean:
1) downgrade to version 1.04.04
2) upgrade by "DS5000Update_patch_01_01_04_04_usb.GEL"
3) upgrade to version 1.08.08

?
_
or only upgrade from menu ("DS5000Update_patch_01_01_04_04_usb.GEL")?

thm_w · « **Reply #1497 on:** January 31, 2020, 11:57:52 pm »

Quote from: Cust on January 31, 2020, 09:33:02 pm

You mean:
1) downgrade to version 1.04.04
2) upgrade by "DS5000Update_patch_01_01_04_04_usb.GEL"
3) upgrade to version 1.08.08

He is saying you might be applying the 1.04.04 patch to the 1.04.08 firmware which won't work.
Follow the instructions posted recently here, try again from scratch get rid of whatever files you have. Make sure ethernet cable is unplugged from oscilloscope, in case that is interfering with bootup.

If you are on 1.04.08 and its working then no downgrading/upgrading/etc is needed.

Cust · « **Reply #1498 on:** February 01, 2020, 10:43:10 am »

OK, thanks.
I try it on monday.

I always had the ethernet cable connected.

Cust

skander36 · « **Reply #1499 on:** February 01, 2020, 11:38:41 am »

Hello , anybody know if there is a software that can control the AWG in MSO5000 ?
Thank you !


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: Hacking the Rigol MSO5000 series oscilloscopes (Read 1301796 times)

Share me