Hacking the Rigol MSO5000 series oscilloscopes

[TopLoser]

The Christmas gift for all Rigol fans out here:

Go to /rigol/shell/start.sh

and add the "-fullopt" to the command line that executes appEntry (before the &).

PS: And it's not an hack. It's a feature!

Does the license screen show the options as PERMANENT or maybe it is a 30-day demo activation?

On the scope I played with there was no change to the list of displayed options. Things like the AWG's and power analysis are shown as not enabled - BUT they work.

[tv84]

Does the license screen show the options as PERMANENT or maybe it is a 30-day demo activation?

It's a feature so, I think, it's independent from the license scheme. But TopLoser may provide a license menu printscreen.

If I understood correctly, the 4CH option is not activated.

BTW, what is the BND option? Was it activated?

Things like the AWG's and power analysis are shown as not enabled - BUT they work.

If that's the case, then probably all is activated...   Can someone test each of the Options to see if they are active?

[TopLoser]

Does the license screen show the options as PERMANENT or maybe it is a 30-day demo activation?

It's a feature so, I think, it's independent from the license scheme. But TopLoser may provide a license menu printscreen.

If I understood correctly, the 4CH option is not activated.

BTW, what is the BND option? Was it activated?

Things like the AWG's and power analysis are shown as not enabled - BUT they work.

If that's the case, then probably all is activated...   Can someone test each of the Options to see if they are active?

All that I tested is activated. The BND option is the 'Option Bundle'.

Options screen is absolutely unchanged, shows same as out of the box.

[casinada]

Does it activate all the digital decoding options?

[tv84]

All that I tested is activated.

Then I think all is active completely independent from what the license menu says.

I think the options are based on the type of equipment (MSO, DS, DS5000, DS7000, etc).

So, in the DS7000 you might imagine what are the options that the -fullopt" will enable...

Code: [Select]

00    "BW1T2"           DS7000
01    "BW1T3"           DS7000
02    "BW1T5"           DS7000
03    "BW2T3"           DS7000
04    "BW2T5"           DS7000
05    "BW3T5"           DS7000
06    "MSO"
07    "2RL"    MSO5000  DS7000
08    "5RL"             DS7000
09    "BND"    = COMP + EMBD + AUTO + FLEX + AUDIO + AERO + PWR + AWG
10    "COMP"   MSO5000  DS7000
11    "EMBD"   MSO5000  DS7000
12    "AUTO"   MSO5000  DS7000
13    "FLEX"   MSO5000  DS7000
14    "AUDIO   MSO5000  DS7000
15    "SENSOR
16    "AERO"   MSO5000  DS7000
17    "ARINC"
18    "AWG"    MSO5000
19    "JITTER"
20    "MASK"
21    "PWR"    MSO5000  DS7000
22    "DVM"
23    "CTR"
24    "EDK"
25    "4CH"
26    "BW07T1" MSO5000
27    "BW07T2" MSO5000
28    "BW07T3" MSO5000
29    "BW07T5"

[mrpackethead]

We have an interesting situation here now, and it will tell us what rigols intention is.

If they move to close this 'feature', then we coudl summize that they don't want to allow people to hack their scopes;
If they dont, then you can assume that they are deliberately doing this.

[iMo]

That is an intention, sure. That is a clever way how to dump and not to be subject to anti-dumping.

[thesgoat]

Can’t say if it turns a 2 channel into a 4 channel, mine is the 5074. I paid the extra 90 euros for a 4 channel as that way I got warranty on all 4 channels and an extra couple of probes. I would imagine it enables 4 channels though, can’t see why it wouldn’t.

Anybody with  a 7000 series can give it a go, it’s a very simple process.

I don’t think there are any two-channel 7000 series scopes. The base model is the 7014 four channel.

Tried this with our DS7014, now has full 500MHz bandwidth and 500M memory...

[BravoV]

How odd! That was remarkably easy to do...

Disappointed? You wanted more of a fight...? 

To be honest, yes, I'm quite disappointed as this hack is so easy that is not even funny.

[mrpackethead]

 Team China, apparently took a differnet approached and patched the firmware.

I'm not sure why but i am thinking that i read rumours of this thing running up to 1Ghz.    Was i just dreaming? 

EDIT. No dave posted that someone has claimed its running up to 1Ghz. THat is a bit of a different level of post.

[BravoV]

Tried this with our DS7014, now has full 500MHz bandwidth and 500M memory...

Any chance to see the verification of 500 MHz bandwidth ?

[mrpackethead]

Well thats really strange. They said that it is trival. So, how about you to ask them for the reason why they dont choose to release it now?

Btw, you have said that you re interested in embedded system security, why do you dont analyze firmware yourself? The process of analysing is more fun than the answer. So, dont hesitate to wait our answer anymore. Try to find your own! LOL

simply just wanting to make sure that posting it here was ok.   And once that was ok, well, just 3 hours later their answer was posted.   It also works on the 7000 series.      Sadly rgwan, if you did hack it first, you'll never get remembered as the guy who did it. That honor goes to tv84 who published a hack first..   Now your hack, may have been different.   My suspicion is that you patched the firmware?  This would be a different approach and potentially quite interesting as well, if you'd like to share it and save face ( 留面子 )

[mikeselectricstuff]

Has anyone got hands on a MSO pod yet - that would be the obvious next thing to investigate

[RobBarter]

To keep Rigol happy, if it wasn't for this hack I would not be considering a Rigol as my next scope, more likely RTB2000 or RTM3000 (discounted the Keysight now) but with gritted teeth due to the ridiculous option pricing).  Now firmly back in my option list (just can't decide if 5000 or 7000).

[maginnovision]

If the "hack" worked after 1 or two more patches I'd definitely go 7000 over 5000.

[JPortici]

To keep Rigol happy, if it wasn't for this hack I would not be considering a Rigol as my next scope, more likely RTB2000 or RTM3000 (discounted the Keysight now) but with gritted teeth due to the ridiculous option pricing).  Now firmly back in my option list (just can't decide if 5000 or 7000).

you were considering a scope with a 10bit adc, now you are considering a scope that at the max amplification will be a 5-6 bit scope (1mV/div is 5mV/div digitally zoomed!) then look at how the decode and search is implemented
having options for free is tempting, but consider everything (maybe you don't care at all about small signals, or looking at data lines in a certain way)

[MrW0lf]

you were considering a scope with a 10bit adc, now you are considering a scope that at the max amplification will be a 5-6 bit scope

Are you trying to steal the christmas? It is well established that cheap and hackable renders all other "nuances" irrelevant...

[Fungus]

Some people are able recognize that they actually spend most of their time in 1 or 2 volts/div and that presence/absence of a uV range is therefore moot.

Raw bandwidth, number of channels, etc.? That never goes out of fashion.

If you need uV and massive DC offset ability then that's fine, buy a 'scope that can do it. Just don't waste yout life hating on 'scopes that don't do it. Lots of people genuinely don't need it.

[RobBarter]

£970 vs £2500 (incl. the 50% PK1 pack) is quite persuasive but I appreciate that the R&S is the next level up.  And that comparison doesn't cover bandwidth.

[Fungus]

£970 vs £2500 (incl. the 50% PK1 pack) is quite persuasive but I appreciate that the R&S is the next level up.  And that comparison doesn't cover bandwidth.

Yep. The next step up from this is now a huge difference in price. You'll pay dearly for those little extras.

(a bit like the next step up from the DS1054Z was huge until that Siglent came along)

[nctnico]

£970 vs £2500 (incl. the 50% PK1 pack) is quite persuasive but I appreciate that the R&S is the next level up.  And that comparison doesn't cover bandwidth.

Yep. The next step up from this is now a huge difference in price. You'll pay dearly for those little extras.

I wouldn't call protocol decoding which is actually working a 'little extra' if you need this kind of functionality. It is kind off buying a car without windscreen whipers. If it never rains that will be OK but if you drive through rain regulary then such a car will become useless real quick.

[Fungus]

I wouldn't call protocol decoding which is actually working a 'little extra' if you need this kind of functionality.

It's very easy to not buy one of these if those are your needs.

It is kind off buying a car without windscreen whipers. If it never rains that will be OK but if you drive through rain regulary then such a car will become useless real quick.

No it isn't. It's more like buying a car that can't fit a sofa in the back - useless if you're a removal man but fine for most people.

[MrW0lf]

Lots of people genuinely don't need it.

Most people actually do not need new scope at all, but then suddenly something black with pink ring around female connector surfaces... Pretty dirty move!

[Fungus]

Note that channel 3 costs extra. 

(who says Rigol doesn't understand marketing?)

[tv84]

Tried this with our DS7014, now has full 500MHz bandwidth and 500M memory...

Could you upload a pic of your licensing menu? Just for comparison with 5000.