Hacking the Rigol MSO5000 series oscilloscopes

[Fungus]

Will this hack work with Rigol MSO5074?

Yes.

If you meet the prerequisite FW and build versions then quite likely yes.

You know about the secret menu, right?

https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg2248542/#msg2248542

[baggerbole]

Hi all,
I´m new to this forum and have been trying to find my way around this thread. This is not so easy, the thread is miles long....
I have a Rigol MSO5074 and would like to use the frequency expansion and function generator. Can someone please summarize the current state of the hack and explain it to me for dummies?
I am still a virgin as far as Linux is concerned....
Is post #2251 the latest hack?

[tv84]

Lesson #1 for dummies: if 91 pages of thread is too much to read then you don't need to "hack" your scope just yet.

[baggerbole]

That is very wise.
Thank you tv84 

Are there any more helpful tips?

[ve2mrx]

Tip: On long threads, it is usually a good idea to read a few pages starting from the end. People keep asking the same questions because they didn't read the whole thread. The answers are usually repeated a few times.

Still, there's nuggets of useful information across the whole thread that go unnoticed unless you give it a good read.

Martin

[Ogawa Mitsuaki]

Tip: For example, it's a good idea to search for "patch" and read the search results carefully from behind and read them over and over again.
I think there are various search terms.
The latest firmware is "01_03_00_03", so you can skip it before that.

Then you will be grateful for the power and effort of everyone in this threads.
(But everything is at your own risk.)

[Parzival]

This is my first post to the forum. I have been a lurker for far too long so I thought it best to, at the very least, provide some positive feedback to this thread!

I recently purchased a Rigol MSO5074 from Amazon in the UK, with the intention of unleashing it's full potential.

It arrived with the following setup: -

Model   MSO5074
Firmware   00.01.03.00.03
Hardware   01.01.000
Boot   2018.06.27
Build   18/10/2021  14:14:08



I am very happy to say that I was successful and it took no time at all by following the instruction provided by qali.pro in the following post: -

https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg3869852/#msg3869852

Thanks to all concerned! I hope this success of mine, through the vast expertise of others, gives more people the confidence to upgrade.

 

PS: Can't believe my username wasn't already taken! No "Ready Player One" fans out there?

[brainiac94]

I cannot thank you all enough for making this possible. I bought the scope after finding out about this thread, and it really was as easy as installing a single patch (Same parameters as Parzival). Unbelievable!

While the self cal is running: Does anyone else have coil whine in their scope?


-brain

[empo]

Hmm...  What am I doing wrong 

I can download the Patch.zip file, but I get an error when trying to open it, and then somehow Windows removes it from my disk 🙈

How did you guys manage to unzip the patch?

[ve2mrx]

Check your antivirus logs, I expect a false positive or some malware from somewhere else...

Martin

[empo]

Thanks mate !

It was the "real time antivirus protection" in windows.

I at least would have expected Win11 to notify me if it interfered with actions started by me.

[tv84]

... with actions started by me.

How does it distinguish them?? 

[empo]

How does it distinguish them?? 

I'd Imagine the OS knows that a double click from the mouse is user initiated, and from there it goes down the rabbit hole until it tries to open winrar. But the red thread should remain through on the whole journey

[jjoonathan]

Yeah, but messing with engineers is the favorite hobby of most antivirus.

Seriously, though, this is why 1st party antivirus is so much better than 3rd party: the OS vendors are in a position to make cross-cutting changes while 3rd party AV has to hook everything. I'm not familiar with the Windows stack, but on Mac OS typing into a password field actually activates a separate event pathway that is more difficult to snoop. Imagine the number of coordinated changes needed to make that happen, and now imagine if you had to inject and maintain those changes on top of someone else's codebase -- someone else who has no obligation to move slowly or notify you if they change things. Yuck.

Unfortunately 1st party AV can be made to look like "doing nothing" by rivals in the Game of Aeron Chairs, so many businesses unwisely choose to use 3rd party AV and everyone suffers.

[crgarcia]

How does it distinguish them?? 

I'd Imagine the OS knows that a double click from the mouse is user initiated, and from there it goes down the rabbit hole until it tries to open winrar. But the red thread should remain through on the whole journey

I don't think so, I think mouse clicks are coming from a driver, and can be done from software by somebody that has full admin rights.
Anyways, I checked the file (https://www.virustotal.com/gui/file/8d5c76efa07d9030c76ff467ec091ca61e3ba361a5f784b40c73615a10e30ab0?nocache=1) and nobody detects anything strange, only Defender for windows (I had the same issue)

Thanks!

PS: If you just want to patch your Rigol but got lost in the thread, here all what you need: https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg3943042/#msg3943042

[TK]

Rigol has a back to school promo on the MSO 5074 for just $799 through 9/30/2022.  It can be purchased at saelig with the EEVBLOG coupon for an extra 6% discount.  On tequipment I guess you need to request quote asking for the 6% discount.

[TerminatorBetaTester]

Hi all,

Thanks for the great work in this thread.

I'm trying to upgrade my recently purchased MSO5240 with the auto-patcher per posts:

• 2169
• 2208

It shipped with:

• Firmware 00.01.03.00.3
• Hardware 01.01.000
• Build 2021-10-18

I'm having trouble getting the scripts to execute.  The backup scripts finished far too quickly to be copying any data and I found no additional directories on the flash afterward. The auto patcher also fails with a "'patch.txt' not found" similar to post 2202. Is my problem with the flash formatting? I formatted with macOS diskutil with the default parameters.

edit: UPDATE

I resolved the issue, and the explanation is consistent with behavior indicated with post 2202.

The partition table MUST be MBR. By default, in macOS, it's GUID. I suspect that's also the case in W11.  All scripts executed successfully once I reformatted the drive:

Code: [Select]

sudo diskutil eraseDisk FAT32 USB MBRFormat /dev/diskX
Where X is the USB disk number.

[ve2mrx]

The format of the USB storage has to be FAT or FAT32, nothing else.

Practically, this limits the usable MSD size but 16/32GB should be ok.

Martin

[tdftdf]

hi everybody.
latest firmware v00.01.03.00.03 downloaded from    https://www.rigolna.com/firmware/

[MegaVolt]

This is an old version. Since last year.

[JCS666]

I hack my mso5104, now all options are licensed forever, but the rise time is not god, about 3.5ns not 1.7ns
wat is your rise time after hack ? 

[thm_w]

I hack my mso5104, now all options are licensed forever, but the rise time is not god, about 3.5ns not 1.7ns
wat is your rise time after hack ? 

tv84 was getting ~440ps. Seems slow, but, probably an issue with your source no? Do you have anything to verify the source is capable of 1.7ns?
Also make sure you've run the self-calibration.

[JCS666]

I hack my mso5104, now all options are licensed forever, but the rise time is not god, about 3.5ns not 1.7ns
wat is your rise time after hack ? 

tv84 was getting ~440ps. Seems slow, but, probably an issue with your source no? Do you have anything to verify the source is capable of 1.7ns?
Also make sure you've run the self-calibration.

Splain this video: and this is the diagram cicuit: https://drive.google.com/drive/folders/1__66ZhlC1BKuy__uELK9CTNxm6QUgCCk
Is a simple schmitt trigger oscillator.

[JCS666]

The hack not open bw on my mso5104 :-(

[Nx-1997]

Got the scope last week (MSO5074, Build 2021, Boot 2018, FW 1.03.00.03). I was also concerned about the bandwidth after the hack. So, I decided to test it using my signal generator, 1Vrms. I forgot to reset the statistics for the before images. The before images (before applying the patch) and after images (after applying the patch and selfcal). The hack works fine.