Author Topic: Hacking the Rigol MSO5000 series oscilloscopes  (Read 902231 times)

0 Members and 4 Guests are viewing this topic.

Offline oliv3r

  • Frequent Contributor
  • **
  • Posts: 279
  • Country: nl
    • Rigol related stuff!
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #450 on: December 30, 2018, 09:25:28 am »
so far, rough diff is:

app.img:

shell/start.sh          # add -average_filter option to appEntry
shell/send_mail.sh  # finally! add model/version/serial/date to the body  :clap:
resource/scpi/MEAsure.xml # cmd id + 1??
bunch of other xml, hlp or hex files
appEntry (of course)
default/precision.hex
K160_TOP.bin

(edit) many many changes in appEntry, hard to diff, but so far, no change about our prefered start option.

system.img:

/etc/passwd                 #we already knew that
/etc/init.d/rcS              # remove echo ++ Starting ftp daemon
/etc/inittab                  # swap shell on ttyPS0 from /bin/ash to /bin/login, huh?
+/etc/passwd.root       # this is the old one
- /lib/firmware/rtfwifi/rtl{8812,8192}*.bin # bye bye

I wonder how it compares to the MS07000 firmware :)

The change from ash to login is so that you have to log in using the serial shell. While it makes sense, it's annoying :p

as for the wifi; I don't think they had the kernel module; so the firmware's didn't do much anyway.

Offline rgwan

  • Contributor
  • Posts: 24
  • Country: us
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #451 on: December 30, 2018, 09:28:17 am »
Well, that proved that the 1.1.2.4 version firmware isn't the new firmware that Rigol solved this three issues.
 

Offline rgwan

  • Contributor
  • Posts: 24
  • Country: us
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #452 on: December 30, 2018, 09:31:14 am »
But one interesting thing is they haven't disabled sshd yet. Although my worries come true, I still don't know why they don't disable it.
 

Offline Rerouter

  • Super Contributor
  • ***
  • Posts: 4694
  • Country: au
  • Question Everything... Except This Statement
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #453 on: December 30, 2018, 09:37:28 am »
However, what if it is NOT a hacked firmware, but the actual firmware from the device. Just extracted from. Like in this case u-boot. I don't see how that would be wrong?

That's something I would like clarification on as well, my guess is no, because "copyright" but I'm curious because over on the siglent side of the fence I have been typo patching. does nothing to bypassing features, just fixes typos that where present that broke a few existing commands.
 

Offline tv84

  • Super Contributor
  • ***
  • Posts: 3213
  • Country: pt
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #454 on: December 30, 2018, 10:25:54 am »
I did a search for all types of start options and here is a list:

Code: [Select]
-notrace_ch     servtrace.cpp
-notrace_digi   servtrace.cpp
-notrace_eye    servtrace.cpp
-notrace_dx     servtrace.cpp
-notrace_la     servtrace.cpp
-log_trace      servtrace.cpp
-log_ch         servtrace.cpp
-log_la         servtrace.cpp
-log_eye        servtrace.cpp
-no_trace       tracethread.cpp  (trace not running)
-debug
-fullopt
-novcal             (calibration??)
-no_cfg         cdsophy.cpp
-noprivacy      servdso_session.cpp
-default        servdso_session.cpp (default settings)
-nonv
-ds8000         
-log_id         dsoengine_trace.cpp
-no_horiplay    dsoengine_playback.cpp
-log_engine     dsoengine_playback.cpp
-log_adc_cal    cdsorecengine_adc.cpp
-log_hori       cdsorecengine_hori.cpp
-noinit         cplatform.cpp
-no_autoplay    cdsoautostopengine.cpp
-log_afe        chcal.cpp
-average_filter cdsorecengine_ch.cpp
-peak_compress  horiunit.cpp
-wait_assert    iphyccu.cpp

On the right is the source code module that (I think) relates to it.

If anyone wants to do experiments and share their discoveries...


ATTENTION: use at your own risk; you may brick your scope!
« Last Edit: December 30, 2018, 12:44:36 pm by tv84 »
 

Offline Noy

  • Frequent Contributor
  • **
  • Posts: 361
  • Country: de
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #455 on: December 30, 2018, 10:45:47 am »
 -DS8000 ??? :scared:
 

Offline oliv3r

  • Frequent Contributor
  • **
  • Posts: 279
  • Country: nl
    • Rigol related stuff!
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #456 on: December 30, 2018, 01:08:54 pm »
-DS8000 ??? :scared:
But what about DS9000! That would be over 9000 easy!
Code: [Select]
USB device disconnected
DS7000Update.GEL
MSO8
DS8000Update.GEL
MSO5
DS5000Update.GEL
MSO9
DS9000Update.GEL
media
RIGOL TECHNOLOGIES,DS1000Z,SPARROW,201212

Looks like appEntry even borrows some code from the faithful sparrow line of devices!

For me, that's the trigger to get a MSO5000 now :)

There will be others based on the zynq platform; but there won't be a cheaper variant. Rigol may 'upgrade' the ancient DS1000Z series (DS3000?) or whatever but I doub't they'll do anything cheaper then the MSO5k. So I think Rigol wants the hacker/cheap market with the good old DS1000Z and the MSO5000 series is the first one up after that.

(I was thinking of getting a DS1000Z last year after being quite happy with my really old DS1052E, and a DS1054Z at work. I was in the 'hmm they are quite old platforms, I wonder when rigol will release an upgrade to these aging platforms. So it turns out to be the MSO5k series. And while I'd prefer to wait for a v2 hardware version (who knows what bugs linger in the current one) I think this is as good as it'll get for the next 10 years anyway in the low-budget end).
« Last Edit: December 30, 2018, 01:14:22 pm by oliv3r »
 

Offline EddyCurrent

  • Newbie
  • Posts: 1
  • Country: 00
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #457 on: December 30, 2018, 01:29:38 pm »
Luckily, the MSO5000 is not the first platform, which operates their Phoenix chip. I guess, they already made improvements in the first issue of MSO5000 (improved cooling of analog frontend e.g.) compared to MSO7000. This lowers risk of purchasing a buggy hardware. By the way, my first post on EEVblog plus I ordered a MSO5000 as well  :-+
 

Offline tv84

  • Super Contributor
  • ***
  • Posts: 3213
  • Country: pt
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #458 on: December 30, 2018, 10:50:59 pm »
Interesting piece of code:

Code: [Select]
    deb_msg(&v7, "servrecord_spy.cpp", 120, "void servRecord::disable_xxx(servRecord::RecordState)");
    QMessageLogger::debug(&v6);
    v3 = sub_43774(&v6, "servrecord_spy.cpp");
    v4 = sub_4F428(v3);
    v5 = sub_43774(v4, "stat:");
    sub_4F428(v5);
    result = QDebug::~QDebug(&v6);
 

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2845
  • Country: nz
  • D Size Cell
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #459 on: December 30, 2018, 11:04:05 pm »
Spy as in spy on what you are doing and send it somewhere?


Interesting piece of code:

Code: [Select]
    deb_msg(&v7, "servrecord_spy.cpp", 120, "void servRecord::disable_xxx(servRecord::RecordState)");
    QMessageLogger::debug(&v6);
    v3 = sub_43774(&v6, "servrecord_spy.cpp");
    v4 = sub_4F428(v3);
    v5 = sub_43774(v4, "stat:");
    sub_4F428(v5);
    result = QDebug::~QDebug(&v6);
On a quest to find increasingly complicated ways to blink things
 

Offline Rerouter

  • Super Contributor
  • ***
  • Posts: 4694
  • Country: au
  • Question Everything... Except This Statement
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #460 on: December 30, 2018, 11:13:50 pm »
doesn't quite read that way to me unless it ties into a much larger function, looks more like a thread hook to request a status string??

sub_43774 looks to be what pushes out a message and returns the value.
 

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2845
  • Country: nz
  • D Size Cell
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #461 on: December 30, 2018, 11:37:54 pm »
Any guess's as to what -ds8000 does?  I'll give this a whirl in a few weeks, but curious to kno...


I did a search for all types of start options and here is a list:

Code: [Select]
-notrace_ch     servtrace.cpp
-notrace_digi   servtrace.cpp
-notrace_eye    servtrace.cpp
-notrace_dx     servtrace.cpp
-notrace_la     servtrace.cpp
-log_trace      servtrace.cpp
-log_ch         servtrace.cpp
-log_la         servtrace.cpp
-log_eye        servtrace.cpp
-no_trace       tracethread.cpp  (trace not running)
-debug
-fullopt
-novcal             (calibration??)
-no_cfg         cdsophy.cpp
-noprivacy      servdso_session.cpp
-default        servdso_session.cpp (default settings)
-nonv
-ds8000         
-log_id         dsoengine_trace.cpp
-no_horiplay    dsoengine_playback.cpp
-log_engine     dsoengine_playback.cpp
-log_adc_cal    cdsorecengine_adc.cpp
-log_hori       cdsorecengine_hori.cpp
-noinit         cplatform.cpp
-no_autoplay    cdsoautostopengine.cpp
-log_afe        chcal.cpp
-average_filter cdsorecengine_ch.cpp
-peak_compress  horiunit.cpp
-wait_assert    iphyccu.cpp

On the right is the source code module that (I think) relates to it.

If anyone wants to do experiments and share their discoveries...


ATTENTION: use at your own risk; you may brick your scope!
On a quest to find increasingly complicated ways to blink things
 

Offline rgwan

  • Contributor
  • Posts: 24
  • Country: us
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #462 on: December 31, 2018, 11:02:52 am »
Finally, I got the scope. Its firmware version is 1.1.2.3. So, I have to wait for new firmware...
 

Offline Swap_File

  • Newbie
  • Posts: 6
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #463 on: December 31, 2018, 03:53:44 pm »
This won't help rgwan, but if anyone is looking for specific versions of the firmware:

Reply #396 has a copy of 1.1.2.3
Reply #445 has a copy of 1.1.2.4
Reply #386 has a modified copy of 1.1.2.3 that you can apparently downgrade to from 1.1.2.4
 

Offline rgwan

  • Contributor
  • Posts: 24
  • Country: us
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #464 on: December 31, 2018, 06:40:20 pm »
New bug found, signal generator frequency rounding off error. It causes non-synchronous between two channels.

For example, you can't output 1MHz and 12MHz by this scope and get a stable display on a scope, because the frequency of "12MHz output" / 12 does not exactly equal "1MHz output", in some scenario it will cause low-frequency oscillation.
« Last Edit: December 31, 2018, 06:52:57 pm by rgwan »
 

Offline oliv3r

  • Frequent Contributor
  • **
  • Posts: 279
  • Country: nl
    • Rigol related stuff!
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #465 on: January 01, 2019, 12:01:00 am »
Happy New Year all,

and with the new year I present to you the GEL unpacker and firmware analysis repo :)

https://gitlab.com/riglol/rigolee

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2845
  • Country: nz
  • D Size Cell
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #466 on: January 01, 2019, 12:23:27 am »
Nice work Oliver.
On a quest to find increasingly complicated ways to blink things
 

Offline bmx

  • Contributor
  • Posts: 30
  • Country: fr
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #467 on: January 01, 2019, 03:44:00 pm »
@Oliv3r, thanks for the qspi push, but could you fix the missing / at col2 line 1 in qspi_unpack.sh and remove the -eu also?
« Last Edit: January 01, 2019, 04:10:48 pm by bmx »
 

Offline tv84

  • Super Contributor
  • ***
  • Posts: 3213
  • Country: pt
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #468 on: January 01, 2019, 07:00:52 pm »
Has anyone done a bandwidth sweep with -fullopt and -ds8000 simultaneously?
 

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2845
  • Country: nz
  • D Size Cell
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #469 on: January 01, 2019, 07:07:07 pm »
Has anyone done a bandwidth sweep with -fullopt and -ds8000 simultaneously?

What are you thinking might happen?     I need some high speed signal generators it seems.
On a quest to find increasingly complicated ways to blink things
 

Offline tv84

  • Super Contributor
  • ***
  • Posts: 3213
  • Country: pt
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #470 on: January 01, 2019, 07:10:46 pm »
I need some high speed signal generators it seems.

Precisely that.
 

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2845
  • Country: nz
  • D Size Cell
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #471 on: January 01, 2019, 07:44:04 pm »
I need some high speed signal generators it seems.

Precisely that.

I'll get my scope mid next week,  though i'll not be in teh lab. ( picking it up in teh US, on my way home )..
Can we restore the scope if we brick it yet?
On a quest to find increasingly complicated ways to blink things
 

Offline tv84

  • Super Contributor
  • ***
  • Posts: 3213
  • Country: pt
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #472 on: January 01, 2019, 07:58:48 pm »
I need some high speed signal generators it seems.

Precisely that.

I'll get my scope mid next week,  though i'll not be in teh lab. ( picking it up in teh US, on my way home )..
Can we restore the scope if we brick it yet?

You have to do it with uboot, via serial port (requires open the box). Or JTAG...

First thing is do a NAND dump.
 

Offline mrpackethead

  • Super Contributor
  • ***
  • Posts: 2845
  • Country: nz
  • D Size Cell
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #473 on: January 01, 2019, 08:34:29 pm »
I need some high speed signal generators it seems.

Precisely that.

I'll get my scope mid next week,  though i'll not be in teh lab. ( picking it up in teh US, on my way home )..
Can we restore the scope if we brick it yet?

You have to do it with uboot, via serial port (requires open the box). Or JTAG...

First thing is do a NAND dump.

I'm ok, with opening the box.
On a quest to find increasingly complicated ways to blink things
 

Offline nimish

  • Regular Contributor
  • *
  • Posts: 144
  • Country: us
Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #474 on: January 01, 2019, 08:59:33 pm »
Anyone played around with trying to make the fullopt stuff permanent? Tried Radare2 but I am not that great with it and appEntry is huge.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf