Hacking the Rigol MSO5000 series oscilloscopes

[mwb1100]

I got lucky and found a used MSO5074 in perfect condition for less than $400. I've just received it.

Nice score!

[BTO]

I got lucky and found a used MSO5074 in perfect condition for less than $400. I've just received it.

Nice score!

Lucky Bastard huh,   Gets a 5000 series for the price of a DS1054z   

[BTO]

Yes thanks a lot, I've already read some stuff on this post about those methods. In fact, that's the reason why I chose to buy this cheap MSO5074
I'll do it in a few hours !

No problem, i'm off to bed now, i'll check again when i wake up, Hopefully you'll have it all unlocked.

Also remember after it

1. Do your backup again
2. Ensure you are on the latest version
3. Ensure you have everything unlocked
4. Do your Self Calibration
5. Do the 3 Self Check Tests

Then.. if you like i can shoot you a setup file if you want to see it and apply it
and finally you can check out the tutorial videos if you like

speak soon

[django]

It worked, again thanks a lot for your great job 
Despite the fact I had some problems with the network part...
If it can help someone, let me share it with you.

• I received the MSO5074 with the 1.3.2.2 firmware, with a few features activated for 24 hours (I don't know why)
• As instructed, I backed up everything (backup script + nand script) and upgraded the firmware from 1.3.2.2 to 1.3.3
• I installed the python libs mentionned in the PDF file using a single line : pip install lib1 lib2...

So far, everything worked fine. Things started to become tricky when I plugged an Ethernet cable from the router into the scope.
Though I checked DHCP and Auto IP, the assigned gateway was not the same as my router's IP. The scope's IP was consistent with my LAN settings though (192.168.1.10). And my router has been working without any trouble for years now, I mean it's properly configured, DHCP is activated and every device gets the same IP as it was given after it reconnects (by the way be aware of that, if when the scope reboots your scope gives it another IP the script won't manage to reach it !). I never had a single problem with all my other devices.
As expected, I wasn't able to ping the scope from my computer. I hit Apply many times, and I even got an APIPA IP (169.254.162.162). It seemed that the DHCP transaction with my router went wrong.
Even if checking DHCP and Auto IP, I noticed that after hitting apply, DHCP was unchecked. Maybe a bug on the scope's side ?
So I decided to hard-code the parameters (Static IP option), I assigned a free IP to the scope through its interface as well as the gateway and the DNS.
Then I could ping it, and I launched the script to retrive some information and this time it was able to communicate with the rigol.

After that I used the -r option to regenerate the key.
The scope rebooted, but as you can see in my screenshot it was not detected anymore  : the script was indefinitely waiting for it to come online again. When i verified the LAN parameters on the scope, I saw it had successfully got a valid IP from the router, but this IP was not the one I put in the script parameters before (the one I hard-assigned).
Hence I forced again the scope's IP to be like it was before the reboot, so that the script could find the scope again. And it worked !! as shown in the picture   

But after that I was curious and I made a few tests, I only checked "DHCP" and hit apply, but I got a "DHCP config failed" from the scope. If I only checked Auto IP, I got an APIPA IP again.
I guess that during the upgrade process mentionned above, the scope's behaviour indicates that as it couldn't get an IP from DHCP, it made a self-generation of an APIPA.

I even tried to reboot the scope with Auto IP and DHCP both checked, and the Rigol behaved quite randomly : sometimes I got a proper IP with the real DNS and gateway, other times I got a proper IP with false DNS and gateway IPs, some other times I got APIPA.

So either it's a bug with the scope or...maybe (most likely) I just missed something.

I don't know if I made myself clear 

Anyway, it's fully upgraded now and I look forward to learn how to use this scope !

[BTO]

It worked, again thanks a lot for your great job 
Despite the fact I had some problems with the network part...
If it can help someone, let me share it with you.

• I received the MSO5074 with the 1.3.2.2 firmware, with a few features activated for 24 hours (I don't know why)
• As instructed, I backed up everything (backup script + nand script) and upgraded the firmware from 1.3.2.2 to 1.3.3
• I installed the python libs mentionned in the PDF file using a single line : pip install lib1 lib2...

So far, everything worked fine. Things started to become tricky when I plugged an Ethernet cable from the router into the scope.
Though I checked DHCP and Auto IP, the assigned gateway was not the same as my router's IP. The scope's IP was consistent with my LAN settings though (192.168.1.10). And my router has been working without any trouble for years now, I mean it's properly configured, DHCP is activated and every device gets the same IP as it was given after it reconnects (by the way be aware of that, if when the scope reboots your scope gives it another IP the script won't manage to reach it !). I never had a single problem with all my other devices.
As expected, I wasn't able to ping the scope from my computer. I hit Apply many times, and I even got an APIPA IP (169.254.162.162). It seemed that the DHCP transaction with my router went wrong.
Even if checking DHCP and Auto IP, I noticed that after hitting apply, DHCP was unchecked. Maybe a bug on the scope's side ?
So I decided to hard-code the parameters (Static IP option), I assigned a free IP to the scope through its interface as well as the gateway and the DNS.
Then I could ping it, and I launched the script to retrive some information and this time it was able to communicate with the rigol.

After that I used the -r option to regenerate the key.
The scope rebooted, but as you can see in my screenshot it was not detected anymore  : the script was indefinitely waiting for it to come online again. When i verified the LAN parameters on the scope, I saw it had successfully got a valid IP from the router, but this IP was not the one I put in the script parameters before (the one I hard-assigned).
Hence I forced again the scope's IP to be like it was before the reboot, so that the script could find the scope again. And it worked !! as shown in the picture   

But after that I was curious and I made a few tests, I only checked "DHCP" and hit apply, but I got a "DHCP config failed" from the scope. If I only checked Auto IP, I got an APIPA IP again.
I guess that during the upgrade process mentionned above, the scope's behaviour indicates that as it couldn't get an IP from DHCP, it made a self-generation of an APIPA.

I even tried to reboot the scope with Auto IP and DHCP both checked, and the Rigol behaved quite randomly : sometimes I got a proper IP with the real DNS and gateway, other times I got a proper IP with false DNS and gateway IPs, some other times I got APIPA.

So either it's a bug with the scope or...maybe (most likely) I just missed something.

I don't know if I made myself clear 

Anyway, it's fully upgraded now and I look forward to learn how to use this scope !

COOL,,,
So i'm awake now from a WELL NEEDED Rest. and popped on to check up on you.
CONGRATULATIONS ON ACTIVATING YOUR SCOPE.

From here , whenever a new update is released, You just upgrade like normal, Your options will always survive the upgrade.
If you ever need to take it back for service and feel the need to uninstall the options, (Although... why would you bother in my opinion) you can always use the uninstall option to do that.
You can now go up and down and between firmware versions as you please and you'll keep the options even if you downgrade.

As for the "why would you bother" thing.
Some will argue that they don't want rigol to know...... TRUST ME !!   RIGOL KNOWS. I've spoken to them.

As for the dillemma of , We are hacking their scopes.   SO WHAT ?
Originally they played a hand, so to speak. that was.. they made 1 scope capaable of Max. Bandwidth and locked it up in software. 
THE GAMBLE WAS... "We don't think that anyone will figure it out"

Well.... Rigol forgot to understand that they are selling to technical people and the bottom line is... WE DID FIGURE IT OUT.
and when we buy it, it's ours to do with whatever we please, so if rigol does question you on it.  Just say to them politely  "Yes,  i unlocked it, What's your point ? The scope is mine to do with
as i please, i can pull it apart, take it's components out, i can build a robot with it if i please, you banked on the fact we wouldn't see this , but we did. ok... that's business. what's your point ?"

don't be afraid of speaking to rigol.

anyway, i digress....

It worked, again thanks a lot for your great job 

Thank you, Appreciate it

• I received the MSO5074 with the 1.3.2.2 firmware, with a few features activated for 24 hours (I don't know why)

That's done for Marketing reasons, they temporarily unlock (on a timer) certain Software options that they want to market. They've been doing that since Rigol DS100E

• As instructed, I backed up everything (backup script + nand script) and upgraded the firmware from 1.3.2.2 to 1.3.3

GOOD, AND NOW AFTER THE UPGRADE, BACKUP EVERYTHING AGAIN, so that this new state is your restore state.

So either it's a bug with the scope or...maybe (most likely) I just missed something.

No.. i think it's a scope thing.. Well done on the troubleshooting.
I will reach out to the Engineers at Rigol and put this to them because you're correct, DHCP should just work Automatically.

I don't know if I made myself clear 

Anyway, it's fully upgraded now and I look forward to learn how to use this scope !

No that was pefectly clear.
Enjoy the scope, Be Cool

[django]

About the temporary (marketing) features, that's what I thought, but that would mean that the previous owner didn't use the scope that much 
In my opinion, not only do they know, but instead of seeing the hacking fact as a drawback they understood that they get free advertisement and SEO because the names of their scopes are mentioned more than usual all around the web 
I've downloaded your videos, thanks for this great contribution too !
It's very different from my previous scope (Hantek DSO2D15, which I used for basic purpose) and has a lot of "extra" features (even the "non-hacked" version !).

[bmx]

don't connect it to the inter-net.
- Get a laptop
 - go offline
 - create a local net
 - join both with a direct ethernet patch cable
 - and assign an ip manually in the scope.
Now, the laptop should be able to communicate with the scope, but nothing else, you're safe.

The dhcp setup on the scope is sketchy, and what do we know it could do if dhcp worked and went thought the gateway, hmm.

Local Net Safety First.

[BTO]

About the temporary (marketing) features, that's what I thought, but that would mean that the previous owner didn't use the scope that much 
In my opinion, not only do they know, but instead of seeing the hacking fact as a drawback they understood that they get free advertisement and SEO because the names of their scopes are mentioned more than usual all around the web 
I've downloaded your videos, thanks for this great contribution too !
It's very different from my previous scope (Hantek DSO2D15, which I used for basic purpose) and has a lot of "extra" features (even the "non-hacked" version !).

but that would mean that the previous owner didn't use the scope that much 

Seems that way doesn't it ?
Either he didn't use it much, or he didn't know about the upgrade or couldn't figure it out and didn't use the scope much.
In any case, You got a cool score.

, not only do they know, but instead of seeing the hacking fact as a drawback they understood that they get free advertisement and SEO because the names of their scopes are mentioned more than usual all around the web 

EXACTLY, it is an intentional move.
However i was referring to the individual sales person you come across when you put your scope in for service or repair.
sometimes they have a chip on their shoulder and they like to say things like
"No when you buy that scope it still remains our INTELLECTUAL PROPERTY"
LOL
well... I told that bloke where to royally shove it (Politely , of course).
He expected me to lie to him about the unlock and upgrade.  Instead, i told him openly that i did it .
I also told him openly, if Rigol would create individual scopes that were hard controlled and not software locked, we would still buy them.
I... WOULD still buy the top model.   After that he didn't say much.
but yes they did this intentionally .. AND IT WORKED

I've downloaded your videos, thanks for this great contribution too !

You're Welcome... it took a very long time to make those videos so enjoy it and learn from it and watch it over and over if you need to.
there's some cool tricks in their

It's very different from my previous scope (Hantek DSO2D15

Ohh mate.. IT'S MILES APART,  Chalk and Cheese, You cant compare it.

Although, with the course that i provided for you, you will get a deeper understanding of your Hantek As well,
that course can translate to any scope be it CRO or Digital or whatever brand.
Yes, i demonstrated everything on an MSO5000 and to some degree A Tek CRO and a Rigol DS2000A  but it's more understanding features
and what they do and how you can use them effectively for troubleshooting.   Take CURSORS for example,  that's on most scopes

so the course is more about Deep Scope knowledge than Rigol MSO5000 specific knowledge
the idea was to get beginners to go beyond just using Horizontal  and Vertical Scale and then not knowing what to do

ENJOY IT MAN
BE COOL

[BTO]

don't connect it to the inter-net.
- Get a laptop
 - go offline
 - create a local net
 - join both with a direct ethernet patch cable
 - and assign an ip manually in the scope.
Now, the laptop should be able to communicate with the scope, but nothing else, you're safe.

The dhcp setup on the scope is sketchy, and what do we know it could do if dhcp worked and went thought the gateway, hmm.

Local Net Safety First.

Yes, this is a wise comment.
I might even add, if a person has a router just sitting in the garage,
Connect to that , that'll do the job

[django]

Setting up a small lan with my old WRT54G is what I thought about, but fortunately there was no timeout in the .py script, hence I had enough time to set the IP manually again on the scope after it rebooted 

[ptluis]

I'll give you my 2 cents on this: when is not possible to obtain a valid IP on a certain LAN node, the trick is to always disable one of the dhcp services, normally we leave the dhcp service on the router ON, and the device connecting on the router with the dhcp OFF and we set manually an IP and proper gateway addresses. This trick works with ip cameras, extra routers, printers, wifi repeaters and so on. It is advisable to write the ip we define mannualy on a piece of paper and stick it to the device, this way we always know what IP belong to what machine in case of troubleshooting

[django]

Indeed ! And also remember that in some cases (for instance my router does) the router keeps a track of the devices that have been connected to it, even if ther aren't online anymore.

[BTO]

Indeed ! And also remember that in some cases (for instance my router does) the router keeps a track of the devices that have been connected to it, even if ther aren't online anymore.

Correct

[BTO]

I'll give you my 2 cents on this: when is not possible to obtain a valid IP on a certain LAN node, the trick is to always disable one of the dhcp services, normally we leave the dhcp service on the router ON, and the device connecting on the router with the dhcp OFF and we set manually an IP and proper gateway addresses. This trick works with ip cameras, extra routers, printers, wifi repeaters and so on. It is advisable to write the ip we define mannualy on a piece of paper and stick it to the device, this way we always know what IP belong to what machine in case of troubleshooting

Absolutely Agree, thanks the for the input

[hussamaldean]

Hi,
I uninstalled the options, but it remains active for 24 hours I think.
Should I redo it again?

[hussamaldean]

Hacked
That was easier than I thought.
Even easier than Rigol DS1054z.

[BTO]

Hacked
That was easier than I thought.
Even easier than Rigol DS1054z.

Glad to hear it, Enjoy it

Don't forget

1. Do another backup of your scope after the upgrade
2. Do a Self Cal
3. Do a the 3 Self Check Tests

then.. to familiarize yourself with the scope you can watch these videos

https://www.eevblog.com/forum/testgear/post-hacking-rigol-mso5000-post-hacking-tutorial-deep-dive/

[hussamaldean]

Hacked
That was easier than I thought.
Even easier than Rigol DS1054z.

Glad to hear it, Enjoy it

Don't forget

1. Do another backup of your scope after the upgrade
2. Do a Self Cal
3. Do a the 3 Self Check Tests

then.. to familiarize yourself with the scope you can watch these videos

https://www.eevblog.com/forum/testgear/post-hacking-rigol-mso5000-post-hacking-tutorial-deep-dive/

I made calibration.
Will do backup.
Self test performed and everything looks great.

[BTO]

Hacked
That was easier than I thought.
Even easier than Rigol DS1054z.

Glad to hear it, Enjoy it

Don't forget

1. Do another backup of your scope after the upgrade
2. Do a Self Cal
3. Do a the 3 Self Check Tests

then.. to familiarize yourself with the scope you can watch these videos

https://www.eevblog.com/forum/testgear/post-hacking-rigol-mso5000-post-hacking-tutorial-deep-dive/

I made calibration.
Will do backup.
Self test performed and everything looks great.

Excellent

[Neekeetos]

Well, I rebuilt connection to scope and took different oscillator, now rise rime is ~530ps. Probe construction is from https://jahonen.kapsi.fi/Electronics/DIY%201k%20probe/ with feed through termination. Some cable reflections thus seen from 17pF @ oscilloscope input, but bearable.

Updated recently my scope patch to mefisto's one, and changed model to 500MHz.  There is a difference in freq. response comparing to 350BW option. Also. my mod with lowpass filter @ adc frontend now makes sence. Measurements were made with nanovna gen via 10db att at scope input.

[vermin123]

1. My version initially was: 00.01.03.00.01
2. Used python script - got "Forever" for all options
3. Upgraded to 00.01.03.03.00
Rebooted and during boot it stuck forever at very end of progress bar...       

4. Tried to "upgrade" to 00.01.03.02.02 thru the boot menu - failed... (btw - it is strange!)
5. Got back to boot menu and used "Restore Defaults" and Voila! it's booted
Now on 00.01.03.03.00 with all options "Forever"   

Many thanks to all who made it possible! 

Only one question left: do I still need to apply "01_03_03_00.bspatch" ?

[BTO]

1. My version initially was: 00.01.03.00.01
2. Used python script - got "Forever" for all options
3. Upgraded to 00.01.03.03.00
Rebooted and during boot it stuck forever at very end of progress bar...       

4. Tried to "upgrade" to 00.01.03.02.02 thru the boot menu - failed... (btw - it is strange!)
5. Got back to boot menu and used "Restore Defaults" and Voila! it's booted
Now on 00.01.03.03.00 with all options "Forever"   

Many thanks to all who made it possible! 

Only one question left: do I still need to apply "01_03_03_00.bspatch" ?

1. Yeah i've heard of that happening before. i call that "The scope having a blonde moment or a brain fart"
don't worry about it, so long as you activated and passed your Self Cal and Self Tests, You're good.

2.

Only one question left: do I still need to apply "01_03_03_00.bspatch" ?

NO, NEVER AGAIN

The patch method is gone, On the MSO5000, 7000 and 8000 we are never doing that again.
the scope is now properly lilcensed , that means, from now if you want to upgrade, you just need to go to the rigol site
and install is as per the normal method. Your software options will be there after the upgrades as the firmware update
remembers the unlocked options before it upgrades (Assuming it has a valid certificate) which it does. (that was the entire point of this method)

IF....
- For any reason you lose your options during a future upgrade (which.. will NEVER !! Happen)
  You can just re activate your scope

- For any reason you need to return it to Rigol and you feel you don't want them to know that you unlocked it. (not that it matters)
  You can juts use the script to uninstall the options, then reinstall them when you get your scope back

so, No there is nothing further for you to do , You can discard the bsptach if you like

[vermin123]

so, No there is nothing further for you to do , You can discard the bsptach if you like

Thanks!

So, I understood all correctly but was not 100% sure.
Unfortunately different instruction on Mega somewhat confusing... 
IMHO too much text and big red labels :-) - it could be way shorter, simpler and clean.
For example - Rufus not needed at all, basic Windows functionality is more then enough.
Also python modules installation can be automated...
Better instruction will eliminate a lot of dumb questions here.

[BTO]

so, No there is nothing further for you to do , You can discard the bsptach if you like

Thanks!

So, I understood all correctly but was not 100% sure.
Unfortunately different instruction on Mega somewhat confusing... 
IMHO too much text and big red labels :-) - it could be way shorter, simpler and clean.
For example - Rufus not needed at all, basic Windows functionality is more then enough.
Also python modules installation can be automated...
Better instruction will eliminate a lot of dumb questions here.

I Absolutely understand.
However..

Unfortunately different instruction on Mega somewhat confusing... 

1. What was different ?
2. What was somewhat confusing ?

IMHO too much text and big red labels :-) - it could be way shorter, simpler and clean.

- I Absolutely agree with you
- But you need to understand something as well, Not everyone is on the same level of intelligence and logic as you are (and .. i'm really putting that politely).

Over the years i started the PDF with what I THOUGHT was understandable.
I have had to modify it to suit others , The goal of the PDF was not necessarily to be pretty, instead it was
1. To get people to activate and license their scopes
2. To stop them from bricking their scopes and doing stupid stuff... And.. that goal has been achieved 

so Yes, from a point of view the document could be a lot shorter, but it was necessary for it to be the way it is.
The Red Labels are there to be as bloody obvious as obvious can be.
So are the Yellow and Black labels.

it could be shorter, simpler and cleaner,  However the newbies don't pay attention to it that way.

For example - Rufus not needed at all, basic Windows functionality is more then enough.

- Absolutely correct,
However the newbies don't know that , they also don't feel comfortably doing it the windows way.
Also, not everyone has Windows.
So Rufus was chosen to keep everyone on the same path and not confuse them.

Also python modules installation can be automated...

Yes it could be.
The idea here was to give those that have absolutely no experience with python some basic understanding and hands on experience with python
before they go and do anything with their scope, So that's why it wasn't Automated.

Better instruction will eliminate a lot of dumb questions here.

LOL... NO NO.. You missed the point.
I'd rather dumb questions here all day long vs a Person bricking their scope because they didn't ask dumb questions.
and then they come back to me and say
"I Bricked my scope,
i didn't do anything,
Please help"

No No.. Bring on the dumb questions... ANY DAY
This way i can walk them through it, They can gain confidence and then know exactly what they are expecting and therefore this eliminates
the possibility of catastrophic failure

so.. I Understand your points and i agree with them and if we were doing this only for Technicians and Engineers then it would have been written differently.
but the technical people are not the issue, the one's bricking the scopes are the cowboys and the newbies and they generally tend to invest their life savings
into these scopes , so when they brick it it means more to them than it does to me (I run my own business and have a very healthy income)

so that's why it's done that way.
it's proven over time to work and not have many people asking too many questions.

Appreciate the input though, it's always welcomed

[vectorstofinal]

NOTE: here's the better/proper version of this process
https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-dr-mefisto-licensing-method/

Below is what I just did, the older patch method with some notes from a Mac user:
-----
Just went through this process successfully using vadimcreates' older guide - which was super helpful (I was lost before that). 

I updated their guide and made a collection of the files I used to patch my 5074 bought in March 2025: https://www.dropbox.com/scl/fi/nopj4f3dm9uhodiv9ywl0/vectorstofinal-update-MSO5xxx.zip?rlkey=zkbu1cx6w6gayx2ijb85a4i8g