Author Topic: Hacking the Rigol MSO5000 series oscilloscopes  (Read 901404 times)

reztek and 9 Guests are viewing this topic.

Online tv84

  • Super Contributor
  • ***
  • Posts: 3212
  • Country: pt
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #75 on: December 05, 2018, 03:19:45 pm »
So if someone can get such a dump (from the lucky ones having the real device already on their benches), it will inform my analysis. I know this information is rather fragmented and incomplete, but I'm still putting the pieces together and have more juicy bits for future posts.

Attached is the contents of the 256 kB  file env.bin. (It starts with a CRC32, the file attached, and the rest is 0x00...)

What would be interesting to know, is if the AES_KEY is the same for all machines, or if each one is unique.

It's the same since it's embedded in the cfger app. You can see the decrypted_scripts of the DS7000 using the same key in my updated DS7000 msg.


BTW, interesting that the memdump contains these references:

200MHz to 350MHz Bandwidth Upgrade Option
200MHz to 500MHz Bandwidth Upgrade Option
350MHz to 500MHz Bandwidth Upgrade Option
600MHz to 1GHz Bandwidth Upgrade Option
600MHz to 2GHz Bandwidth Upgrade Option
1GHz to 2GHz Bandwidth Upgrade Option
« Last Edit: December 05, 2018, 05:43:21 pm by tv84 »
 

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2845
  • Country: nz
  • D Size Cell
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #76 on: December 05, 2018, 07:06:07 pm »
I received an unsolicted Private message last night.  It was from a user with NO posts, and just registered yesterday.   I'm sure they are reading the thread.   Their github profile suggests they are in China. but who knows.    I checked the github repo, and i coud'nt find anything relevent.. Anyone else get this message.



Hello, I have cracked the MSO5074 into 350MHz model version, and I will publish it to my github (http://github.com/__deleted__) until all option unlocked. But I did a wrong thing: I erased my scope's option FRAM. So If you have buy a MSO5074, I can upgrade it's bandwidth, and I want a FRAM dump from your scope to reverse the option part for this scope. Thanks!

You can contact me by this mail:  deleted@gmail.com
On a quest to find increasingly complicated ways to blink things
 

Offline maginnovision

  • Super Contributor
  • ***
  • Posts: 1963
  • Country: us
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #77 on: December 05, 2018, 07:32:07 pm »
I received an unsolicted Private message last night.  It was from a user with NO posts, and just registered yesterday.   I'm sure they are reading the thread.   Their github profile suggests they are in China. but who knows.    I checked the github repo, and i coud'nt find anything relevent.. Anyone else get this message.



Hello, I have cracked the MSO5074 into 350MHz model version, and I will publish it to my github (http://github.com/__deleted__) until all option unlocked. But I did a wrong thing: I erased my scope's option FRAM. So If you have buy a MSO5074, I can upgrade it's bandwidth, and I want a FRAM dump from your scope to reverse the option part for this scope. Thanks!

You can contact me by this mail:  deleted@gmail.com

Did you contact him? Did the github have anything relevant?
 
The following users thanked this post: Simon_RL

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2845
  • Country: nz
  • D Size Cell
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #78 on: December 05, 2018, 07:46:12 pm »
The GitHub repo, didtn appear to have anything relevant in it, no and no i've not contacted him. 


« Last Edit: December 06, 2018, 07:15:47 am by mrpackethead »
On a quest to find increasingly complicated ways to blink things
 

Offline Carrington

  • Super Contributor
  • ***
  • Posts: 1202
  • Country: es
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #79 on: December 05, 2018, 08:35:07 pm »
LOL ... What a funny and weird situation.  :)
My English can be pretty bad, so suggestions are welcome. ;)
Space Weather.
Lightning & Thunderstorms in Real Time.
 

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2845
  • Country: nz
  • D Size Cell
Unconfirmed 'cracking' of Rigol 5000
« Reply #80 on: December 06, 2018, 07:14:59 am »
A unconfirmed claim of of the MSO5000 has been made by a chinese student.   

Quote
"Well, I have patched the firmware, let it jump out license verify produce. But I can't make it public until next year March. Because Rigol sold out about less than 300 units now.

In fact I'm working on my friend's scope and I havent ordered yet (lack of money...Im just a ungraduated). I m wonder if I make it public prematurely, maybe they will fix it and it can't be cracked anymore.

Btw, there's no keygen for 5000 series oscilloscope because it cant be realize. The only way to crack it is to patch firmware.

The detail of crack this scope I will
publish it to my github when my scope is successfully cracked."

Sadly he does not want to provide the info, I think he is worried that Rigol will patch the issue before he has collected enough money to buy his own.      If he was able to crack it, i'm sure that others will be able to do it as well, pretty quickly.   if he wants the 'claim to fame' of being the guy who cracked it, he will need to publish it before anyone else does i guess.   though it seems he just wants the 350Mhz scope for the 70Mhz price.









On a quest to find increasingly complicated ways to blink things
 

Offline EEVblog

  • Administrator
  • *****
  • Posts: 37661
  • Country: au
    • EEVblog
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #81 on: December 06, 2018, 12:54:23 pm »
I just got an email from someone (who is not anonymous) that claims to have cracked the scope and is seeing performance up to 1GHz after setting the front end chip to 4GHz bandwidth.
 
The following users thanked this post: thm_w, mrpackethead, Nx-1997, Agne

Offline BravoV

  • Super Contributor
  • ***
  • Posts: 7547
  • Country: 00
  • +++ ATH1
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #82 on: December 06, 2018, 01:00:54 pm »
I just got an email from someone (who is not anonymous) that claims to have cracked the scope and is seeing performance up to 1GHz after setting the front end chip to 4GHz bandwidth.

I guess this mark the beginning of gigantic pages ahead for this thread.  :-DD

Online Fungus

  • Super Contributor
  • ***
  • Posts: 16561
  • Country: 00
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #83 on: December 06, 2018, 01:09:28 pm »
I just got an email from someone (who is not anonymous) that claims to have cracked the scope and is seeing performance up to 1GHz after setting the front end chip to 4GHz bandwidth.

Rigol is now one firmware update away from completely owning the non-pro 'scope market?  :popcorn:

 

Offline maginnovision

  • Super Contributor
  • ***
  • Posts: 1963
  • Country: us
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #84 on: December 06, 2018, 06:11:17 pm »
I just got an email from someone (who is not anonymous) that claims to have cracked the scope and is seeing performance up to 1GHz after setting the front end chip to 4GHz bandwidth.

If they aren't anonymous who was it? Or are they planning on sharing later?
 

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2845
  • Country: nz
  • D Size Cell
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #85 on: December 06, 2018, 07:19:31 pm »
The problem with claims is that they are just claims untill there is something to substainate them.
On a quest to find increasingly complicated ways to blink things
 

Offline JPortici

  • Super Contributor
  • ***
  • Posts: 3452
  • Country: it
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #86 on: December 06, 2018, 07:38:46 pm »
so does this mean that we're going to have another big wave of scopes with shitty hardware design choices (such as the 2mV/div and 1mV/div which are zoomed 8 bit data) and shitty software design choices (such as how decoding is displayed) where no complaints are allowed because shut up they're cheap and hackable?
 

Online Fungus

  • Super Contributor
  • ***
  • Posts: 16561
  • Country: 00
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #87 on: December 06, 2018, 07:40:46 pm »
The problem with claims is that they are just claims untill there is something to substainate them.

From what we've seen so far it doesn't look like it will be difficult for somebody who really knows the Xilinx system.

OTOH if it can be unlocked to 1GHz then Rigol has a real problem on its hands: How on earth are they going to manufacture enough of them?
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #88 on: December 06, 2018, 07:41:42 pm »
If the scopes can do 1 GHz and are reasonably flat I'd consider adding a 50 ohm termination internally on one channel. It would be permanently 50 ohms but could perform well. Pretty easy to power an HP 1152a active probe externally.
VE7FM
 

Offline tautech

  • Super Contributor
  • ***
  • Posts: 28136
  • Country: nz
  • Taupaki Technologies Ltd. Siglent Distributor NZ.
    • Taupaki Technologies Ltd.
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #89 on: December 06, 2018, 07:43:20 pm »
so does this mean that we're going to have another big wave of scopes with shitty hardware design choices (such as the 2mV/div and 1mV/div which are zoomed 8 bit data) and shitty software design choices (such as how decoding is displayed) where no complaints are allowed because shut up they're cheap and hackable?
Quite possibly, we've seen this happen before.  ::)
Avid Rabid Hobbyist
Siglent Youtube channel: https://www.youtube.com/@SiglentVideo/videos
 
The following users thanked this post: JPortici

Offline Monkeh

  • Super Contributor
  • ***
  • Posts: 7990
  • Country: gb
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #90 on: December 06, 2018, 07:44:32 pm »
Im quite suprized.  They certainly dont' seem to have made too much effort 'so far' to secure things.
Why are you surprised? According to Dave a lot of functionality needs at least some attention. Securing things usually is last on the list. Get the product out first. Rigol can always choose to plug holes in later firmware releases if necessary.

Which is a bass ackwards way of developing and shipping an appliance with a network connection no matter how you look at it.

so does this mean that we're going to have another big wave of scopes with shitty hardware design choices (such as the 2mV/div and 1mV/div which are zoomed 8 bit data) and shitty software design choices (such as how decoding is displayed) where no complaints are allowed because shut up they're cheap and hackable?
Quite possibly, we've seen this happen before.  ::)

And the next big Siglent release will probably come with a buttload of shilling and aggressive forum posts from people with a financial stake in their sales, what's new?
« Last Edit: December 06, 2018, 07:46:03 pm by Monkeh »
 
The following users thanked this post: Mr. Scram

Offline tautech

  • Super Contributor
  • ***
  • Posts: 28136
  • Country: nz
  • Taupaki Technologies Ltd. Siglent Distributor NZ.
    • Taupaki Technologies Ltd.
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #91 on: December 06, 2018, 08:31:59 pm »
so does this mean that we're going to have another big wave of scopes with shitty hardware design choices (such as the 2mV/div and 1mV/div which are zoomed 8 bit data) and shitty software design choices (such as how decoding is displayed) where no complaints are allowed because shut up they're cheap and hackable?
Quite possibly, we've seen this happen before.  ::)

And the next big Siglent release will probably come with a buttload of shilling and aggressive forum posts from people with a financial stake in their sales, what's new?
Ok so you missed the member being banned for daring to question the capabilities of the forums favorite DSO.
Go have a look in the Supporters lounge for links that can point you to those events.
Avid Rabid Hobbyist
Siglent Youtube channel: https://www.youtube.com/@SiglentVideo/videos
 

Offline FireBird

  • Regular Contributor
  • *
  • Posts: 68
  • Country: at
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #92 on: December 06, 2018, 08:34:35 pm »
Gentlemen, please discuss this in the generic MSO5000 thread.
 
The following users thanked this post: Sparky, thm_w, TopLoser, jaromir, hansibull, lukier, TheSteve

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2845
  • Country: nz
  • D Size Cell
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #93 on: December 06, 2018, 09:30:18 pm »
Gentlemen, please discuss this in the generic MSO5000 thread.

And leave moderation to the moderators.. Thats their job.
On a quest to find increasingly complicated ways to blink things
 

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2845
  • Country: nz
  • D Size Cell
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #94 on: December 06, 2018, 09:33:54 pm »
The problem with claims is that they are just claims untill there is something to substainate them.

From what we've seen so far it doesn't look like it will be difficult for somebody who really knows the Xilinx system.

OTOH if it can be unlocked to 1GHz then Rigol has a real problem on its hands: How on earth are they going to manufacture enough of them?

But we have not 'seen' anything other than claims. 

On a quest to find increasingly complicated ways to blink things
 

Online nctnico

  • Super Contributor
  • ***
  • Posts: 26753
  • Country: nl
    • NCT Developments
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #95 on: December 06, 2018, 09:38:14 pm »
The problem with claims is that they are just claims untill there is something to substainate them.
From what we've seen so far it doesn't look like it will be difficult for somebody who really knows the Xilinx system.

OTOH if it can be unlocked to 1GHz then Rigol has a real problem on its hands: How on earth are they going to manufacture enough of them?
Even at a low price having 1GHz of bandwidth without real 50 Ohm inputs is going to be a problem. Then again the same hack may work on the MSO7000.
There are small lies, big lies and then there is what is on the screen of your oscilloscope.
 

Offline Mr. Scram

  • Super Contributor
  • ***
  • Posts: 9810
  • Country: 00
  • Display aficionado
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #96 on: December 06, 2018, 09:49:12 pm »
Which is a bass ackwards way of developing and shipping an appliance with a network connection no matter how you look at it.

And the next big Siglent release will probably come with a buttload of shilling and aggressive forum posts from people with a financial stake in their sales, what's new?
It's always the same people singing the same song, isn't it?  ::)
 

Offline Carrington

  • Super Contributor
  • ***
  • Posts: 1202
  • Country: es
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #97 on: December 06, 2018, 09:54:20 pm »
Obviously I'm not going to say who they are ...
I wonder if Banksy has anything to do with all this.  ;D
My English can be pretty bad, so suggestions are welcome. ;)
Space Weather.
Lightning & Thunderstorms in Real Time.
 
The following users thanked this post: mrpackethead

Offline maginnovision

  • Super Contributor
  • ***
  • Posts: 1963
  • Country: us
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #98 on: December 06, 2018, 10:49:33 pm »
We actually plan to release it after the RIGOL fix their bugs...

I can not believe you're refusing to release the hack method.
 

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2845
  • Country: nz
  • D Size Cell
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #99 on: December 06, 2018, 10:50:13 pm »
Screen shots are one thing.  However untill a method is published and is verified independently it's unconfirmed.   The first party to publish it, will be able to 'claim' it.. It seems there are several parties all claiming to have done it so far.   I would guess its only going to be a matter of days before the first hacks are published.   
On a quest to find increasingly complicated ways to blink things
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf