Hacking the Rigol MSO5000 series oscilloscopes

[oliv3r]

I've attached pictures of what is visible from the side of the 2 big heatsinks. That adhesive is really strong, there's no way I'm going to risk trying to break those heatsinks off...

Haha, you've done more then enough already!! But if someone gets his hands on a broken one ... send it to TopLoser, I'm sure he'll <dave voice> take it apart</dave voice> and take nice PCB X-rays

As for the photos. The analog part looks like a single chip, probably the ADC as we all expect.
The kintex 7 probably looks like this is my guess
You mentioned a few times that you saw several parts, so this kinda confirms it, it's the main die (nakid) with some resistor networks etc next to it.

The kintex7 packaging documentation shows something that looks very much like the photos I posted earlier...

I should have looked at that (and at the picture before)... busy mind busy mind

So I think we more or less 'confirmed' that is indeed, a kintex-7. And until someone proves us wrong (by the only means possible, a heatsinkless foto' that's how it is

[oliv3r]

Missing is indeed, the 4x analog frontends; so that would map to Beta Phoenicis chip?

Yes.

We then have the first BOTTOM BIG heatsinked chip. This is the ADC. So what's that, is that anka? Is that a standard ADC?

No, it is not standard A/D. It is Rigol designed ADC with first level of signal processing that is tailored for scopes, as opposed to general purpose ADC.

Rest of chips are different from DS7000 which revolves arround  Zync-7000

While I'm not familiar with the DS7000; so this confirms my suspicion at least, that the scope is a whole bunch of FPGA's but credits where credits are do; they did do their own analog front end chip + ADC chip. The rest is all FPGA work.

[oliv3r]

The kintex7 packaging documentation shows something that looks very much like the photos I posted earlier...

So, 2 kyntex?

No, One Kyntex-7, One artix-7 (in the Zynq-7015), one spartan 6 and one tiny Asic for the keyboard.

[tv84]

The kintex 7 K160 seems to have different neighborhood than what is shown in Toploser's pictures.

[TopLoser]

I think it’s available in hundreds of possible packaging options with different sets of pins bonded out.

Your picture shows a different layout to the picture oliv3r posted.

[oliv3r]

The kintex 7 K160 seems to have different neighborhood than what is shown in Toploser's pictures.

That's the one, looks identical just 90-ish degree's rotated.

You can see those two capacitor networks very nicely in TopLosers pictures. I did just google a random Kintex-7 of course. No clue which exact model it is. There are a few with a heatspreader on top as well ...

[bmx]

Has anybody figured or worked around the new mso5k wfm file format?

so far,
A short header followed by 53 fairly short zflated blocks, separated by varying junk.
Then a huge blank of around ~5,000,000 x'00s
Then an assortment of ~17,000,000 x'c7 or x'c8 or x'c9 (with some interludes). Maybe data per chan.

datafile as binary: 17Mb
datafile as wfm : 22 Mb
datafile as csv: 278Mb, 17,420,000 lines, CH2 only

here is the list of inflated data with *obvious* strings:

Code: [Select]

zlib @002c:

00000000: 0000 0000 0001 0000 0000 001e 0000 0024  ...............$
00000010: 0b00 0000 5200 4900 4700 4f00 4c00 2000  ....R.I.G.O.L. .
00000020: 5300 6300 6f00 7000 6500 241a 0000 003a  S.c.o.p.e.$....:
00000030: 002f 0070 0069 0063 0074 0075 0072 0065  ./.p.i.c.t.u.r.e
00000040: 0073 002f 0075 0074 0069 006c 0069 0074  .s./.u.t.i.l.i.t
00000050: 0079 002f 0073 0063 0072 002e 006a 0070  .y./.s.c.r...j.p
00000060: 0067 0001 0000 00                        .g.....

zlib @00a8:

00000000: 00a0 8601 0000 0000 0000 0000 0000 0100  ................
00000010: 0000 0000 0000 0000 0000 0000 0000 0003  ................
00000020: 0000 0024 0300 0000 4300 4800 3400 0006  ...$....C.H.4...
00000030: 0000 0000 0000 0000 0000 00              ...........

zlib @00e4:

00000000: 00a0 8601 0000 0000 0000 0000 0000 0100  ................
00000010: 0000 0000 0000 0000 0000 0000 0000 0003  ................
00000020: 0000 0024 0300 0000 4300 4800 3300 0006  ...$....C.H.3...
00000030: 0000 0000 0000 0000 0000 00              ...........


zlib @0120:

00000000: 0140 420f 0040 2bfe ff00 0000 0000 0100  .@B..@+.........
00000010: 0000 0000 0000 0000 0000 0000 0000 0003  ................
00000020: 0000 0024 0300 0000 4300 4800 3200 0006  ...$....C.H.2...
00000030: 0000 0000 0000 0000 0000 00              ...........

zlib @015c:
00000000: 0088 1300 00d8 2700 0000 0000 0000 0100  ......'.........
00000010: 0000 0000 0000 0000 0000 0000 0000 0003  ................
00000020: 0000 0024 0300 0000 4300 4800 3100 0006  ...$....C.H.1...
00000030: 0000 0000 0000 0000 0000 0000 0000 00    ...............

zlib @0198:
00000000: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000010: 0000 0000 00f0 ff1f 0000 0000 0001 0000  ................
00000020: 00c0 5c15 00c0 5c15 0001 0000 0000 0000  ..\...\.........
00000030: 0000 0005 0000 0000 0000 0024 0200 0000  ...........$....
00000040: 4400 3000 0100 0000 2402 0000 0044 0031  D.0.....$....D.1
00000050: 0002 0000 0024 0200 0000 4400 3200 0300  .....$....D.2...
00000060: 0000 2402 0000 0044 0033 0004 0000 0024  ..$....D.3.....$
00000070: 0200 0000 4400 3400 0500 0000 2402 0000  ....D.4.....$...
00000080: 0044 0035 0006 0000 0024 0200 0000 4400  .D.5.....$....D.
00000090: 3600 0700 0000 2402 0000 0044 0037 0008  6.....$....D.7..
000000a0: 0000 0024 0200 0000 4400 3800 0900 0000  ...$....D.8.....
000000b0: 2402 0000 0044 0039 000a 0000 0024 0300  $....D.9.....$..
000000c0: 0000 4400 3100 3000 0b00 0000 2403 0000  ..D.1.0.....$...
000000d0: 0044 0031 0031 000c 0000 0024 0300 0000  .D.1.1.....$....
000000e0: 4400 3100 3200 0d00 0000 2403 0000 0044  D.1.2.....$....D
000000f0: 0031 0033 000e 0000 0024 0300 0000 4400  .1.3.....$....D.
00000100: 3100 3400 0f00 0000 2403 0000 0044 0031  1.4.....$....D.1
00000110: 0035 0000 0000 0001 0000 0002 0000 00    .5.............

zlib @0270:
00000000: 0800 0000 8013 8119 0000 0000 2403 0000  ............$...
00000010: 0041 0044 0044 0000 0202 0202 0270 a28d  .A.D.D.......p..
00000020: 0a00 0000 0000 1827 fa04 0000 0000 e40b  .......'........
00000030: 5402 0000 0000 0000 0000 0000 0000 10a5  T...............
00000040: d4e8 0000 0000 d098 d4af 7100 0000 a031  ..........q....1
00000050: a95f e300 0000 0057 d347 0100 0000 00d2  ._.....W.G......
00000060: 496b 0000 0000 0005 0000 0000 0000 0005  Ik..............
00000070: 0000 0001 0102 0101 0000 0000 0000 0000  ................
00000080: 0000 0000 0103 0000 0000 0000 0000 0000  ................
00000090: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000b0: 0000 0000 0000 0000 0000 0000 0000       ..............

zlib @02ec:

00000000: 0000 0000 0000 0000 0000 0000 2403 0000  ............$...
00000010: 0041 0044 0044 0000 0202 0202 0200 65cd  .A.D.D........e.
00000020: 1d00 0000 0000 9435 7700 0000 0000 e40b  .......5w.......
00000030: 5402 0000 0000 0000 0000 0000 0000 10a5  T...............
00000040: d4e8 0000 0000 5039 278c 0400 0000 a072  ......P9'......r
00000050: 4e18 0900 0000 0057 d347 0100 0000 00d2  N......W.G......
00000060: 496b 0000 0000 0005 0000 0000 0000 0005  Ik..............
00000070: 0000 0001 0102 0101 0000 0000 0000 0000  ................
00000080: 0000 0000 0103 0000 0000 0000 0000 0000  ................
00000090: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000b0: 0000 0000 0000 0000 0000 0000 0000       ..............

zlib @0358:
00000000: 0000 0000 0000 0000 0000 0000 2403 0000  ............$...
00000010: 0041 0044 0044 0000 0202 0202 0200 65cd  .A.D.D........e.
00000020: 1d00 0000 0000 9435 7700 0000 0000 e40b  .......5w.......
00000030: 5402 0000 0000 0000 0000 0000 0000 10a5  T...............
00000040: d4e8 0000 0000 5039 278c 0400 0000 a072  ......P9'......r
00000050: 4e18 0900 0000 0057 d347 0100 0000 00d2  N......W.G......
00000060: 496b 0000 0000 0005 0000 0000 0000 0005  Ik..............
00000070: 0000 0001 0102 0101 0000 0000 0000 0000  ................
00000080: 0000 0000 0103 0000 0000 0000 0000 0000  ................
00000090: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000b0: 0000 0000 0000 0000 0000 0000 0000       ..............

zlib @03c4:

00000000: 0000 0000 0000 0000 0000 0000 2403 0000  ............$...
00000010: 0041 0044 0044 0000 0202 0202 0200 65cd  .A.D.D........e.
00000020: 1d00 0000 0000 9435 7700 0000 0000 e40b  .......5w.......
00000030: 5402 0000 0000 0000 0000 0000 0000 10a5  T...............
00000040: d4e8 0000 0000 5039 278c 0400 0000 a072  ......P9'......r
00000050: 4e18 0900 0000 0057 d347 0100 0000 00d2  N......W.G......
00000060: 496b 0000 0000 0005 0000 0000 0000 0005  Ik..............
00000070: 0000 0001 0102 0101 0000 0000 0000 0000  ................
00000080: 0000 0000 0103 0000 0000 0000 0000 0000  ................
00000090: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000b0: 0000 0000 0000 0000 0000 0000 0000       ..............

zlib @049c:
00000000: 0000 0000 0000 0000 0000 0004 0000 0024  ...............$
00000010: 0400 0000 5200 4500 4600 3100 0000 0000  ....R.E.F.1.....
00000020: 0300 0000 2404 0000 0052 0045 0046 0032  ....$....R.E.F.2
00000030: 0000 0000 0002 0000 0024 0400 0000 5200  .........$....R.
00000040: 4500 4600 3300 0000 0000 0100 0000 2404  E.F.3.........$.
00000050: 0000 0052 0045 0046 0034 0000 0000 0000  ...R.E.F.4......
00000060: 0000 0024 0400 0000 5200 4500 4600 3500  ...$....R.E.F.5.
00000070: 0000 0000 0400 0000 2404 0000 0052 0045  ........$....R.E
00000080: 0046 0036 0000 0000 0003 0000 0024 0400  .F.6.........$..
00000090: 0000 5200 4500 4600 3700 0000 0000 0200  ..R.E.F.7.......
000000a0: 0000 2404 0000 0052 0045 0046 0038 0000  ..$....R.E.F.8..
000000b0: 0000 0001 0000 0024 0400 0000 5200 4500  .......$....R.E.
000000c0: 4600 3900 0000 0000 0000 0000 2405 0000  F.9.........$...
000000d0: 0052 0045 0046 0031 0030 00              .R.E.F.1.0.


zlib @0bf1:
00000000: 240c 0000 0031 0039 0032 002e 0031 0036  $....1.9.2...1.6
00000010: 0038 002e 0031 002e 0031 0030 0024 0d00  .8...1...1.0.$..
00000020: 0000 3200 3500 3500 2e00 3200 3500 3500  ..2.5.5...2.5.5.
00000030: 2e00 3200 3500 3500 2e00 3000 240b 0000  ..2.5.5...0.$...
00000040: 0031 0039 0032 002e 0031 0036 0038 002e  .1.9.2...1.6.8..
00000050: 0031 002e 0031 0024 0b00 0000 3100 3900  .1...1.$....1.9.
00000060: 3200 2e00 3100 3600 3800 2e00 3100 2e00  2...1.6.8...1...
00000070: 3100 0300 0000                           1.....

zlib @0c5d:
00000000: 240e 0000 006d 0061 0069 006c 002e 0072  $....m.a.i.l...r
00000010: 0069 0067 006f 006c 002e 0063 006f 006d  .i.g.o.l...c.o.m
00000020: 0019 0000 0024 1200 0000 7200 6900 6700  .....$....r.i.g.
00000030: 6f00 6c00 5f00 6400 7300 4000 7200 6900  [email protected].
00000040: 6700 6f00 6c00 2e00 6300 6f00 6d00 2409  g.o.l...c.o.m.$.
00000050: 0000 0052 0069 0067 006f 006c 0030 0036  ...R.i.g.o.l.0.6
00000060: 0031 0034 0024 1200 0000 7200 6900 6700  .1.4.$....r.i.g.
00000070: 6f00 6c00 6d00 6100 6900 6c00 4000 7300  [email protected].
00000080: 6900 6e00 6100 2e00 6300 6f00 6d00 0000  i.n.a...c.o.m...
00000090: 0000 2400 0000 00                        ..$....


[Fungus]

Has anybody figured or worked around the new mso5k wfm file format?

I can't imagine it's very different to DS1054Z/DS2000Z format.

so far,
A short header followed by 53 fairly short zflated blocks, separated by varying junk.
Then a huge blank of around ~5,000,000 x'00s
Then an assortment of ~17,000,000 x'c7 or x'c8 or x'c9 (with some interludes). Maybe data per chan.

The channel data in a DS1054Z file is saved in screen pixel positions.

The screen has 400 pixels vertically and it only uses 200 values from the data to draw the trace, ie. no scaling is done and vertical resolution is in two-pixel steps.

IIRC the bottom pixel on screen is mapped to 0x18 and the top pixel is mapped to 0xe0, ie. there's 0x18 unused values below the screen and 0x20 values above.

Somewhere in the header there's floating point voltage offset+scale values. These are used to convert the screen positions into voltage values.

[Fungus]

LED backlight voltage is a standard 3 x 3.3v LED string so 9.9v - it's not modulated in any way.

Datasheets seem to indicate 10.2v max is allowed (with reduced life) but it's already plenty bright enough for me anyway.

I would have thought it would be in mA, not volts. 

Whatever ... if datasheet says 10.2V and it's measured as 9.9V then there's not much room for boosting it. People will have to look elsewhere for an upgrade.

[texaspyro]

Whatever ... if datasheet says 10.2V and it's measured as 9.9V then there's not much room for boosting it. People will have to look elsewhere for an upgrade.

Once above threshold, the current in a LED driven by a voltage source goes up sort-of exponentially.  So the current (and brightness) difference between 9.9 and 10.2V into a string of 3 LEDs can be quite a bit.

[jrs45]

I'm having trouble with mine.  It's firmware 00.01.01.02.03 (Boot 2018.06.27 Build 2018-10-11:16:45:53), and I login as root/root, make the change below, verify that it saved correctly, but when I reboot nothing has unlocked, and it's reverting back to the original unedited file.

Any idea what's wrong?  Do I need to upgrade to .04 first?

So disappointed!  Thanks for any help.

CONFIRMATION

Hey Guys! Thx a million times you crafty geniuses!! 

Type: MSO5074
Firmware: 00.01.01.02.04

Successful SSH Login via Putty:
USR: root
PWD: Rigol201

I followed the instructions from @TopLoser:
##################################
Download and install PuTTY on your PC
On your scope find its IP address by UTILITY, IO, LAN
Run PuTTY and connect using that IP address and SSH with port 22
Login as ‘root’ password ‘root’
Enter ‘cd /rigol/shell’
Enter ‘vi start.sh’

Change line 82 to read:
‘/rigol/appEntry  $PowerOn -run -fullopt &’

Google vi commands to find out how to insert text into the file
Basically press ‘i’ to enter edit mode then move cursor, insert text and then ESC to exit edit mode.

Save the file and quit ‘:wq’

Reboot.
##################################

Rock on guys! Great work!

[TopLoser]

Try typing ‘sync’ when you’ve finished editing the file.

Linux is a bit lazy updating files on this scope...

[jrs45]

Thanks!  I think that did it - the change was retained but the option list doesn't show anything, and the license countdown for some demo options is still running (~2000minutes).   

BUT the waveform generators are working to 25MHz, and I can access the power quality analysis, so does that mean it unlocked successfully? w00t!

(I'll have to go find a source to check the 350MHz BW!)

[TopLoser]

Option list won’t show any change at all. You’re good.

[Martin72]

[luma]

I think we're all still waiting for the backordered scopes to arrive

[Fungus]

I think we're all still waiting for the backordered scopes to arrive

Gotta fix that firmware!

[Bax]

I received an MSO5074 in mid February. Another larger shipment into North America is expected at the end of February.

As was mentioned, the current firmware of the units being delivered is 00.01.01.02.03. I was told that the next revision is being tested.

_________________

If anyone is looking for a soft padded carrying case for the MSO5074, take a look at the G-MIXERBAG-1515 from Gator Cases. It's bigger than the scope, leaving 7"X15" of space for other storage.

https://gatorcases.com/products/mixer/mixer-bags/g-mixerbag/15-x-15-x-5-5-mixergear-bag-g-mixerbag-1515/

[mindy]

I received an MSO5074 in mid February. Another larger shipment into North America is expected at the end of February.

Can you check and confirm if you have a perfectly aligned compensation square wave or get similar as discussed here please ?
https://www.eevblog.com/forum/blog/new-rigol-scope/msg2215035/#msg2215035

[Bax]

I received an MSO5074 in mid February. Another larger shipment into North America is expected at the end of February.

Can you check and confirm if you have a perfectly aligned compensation square wave or get similar as discussed here please ?
https://www.eevblog.com/forum/blog/new-rigol-scope/msg2215035/#msg2215035

It is the same as yours, slight overcompensation on all channels that can't be dialed out. Swapping through the Rigol probes doesn't change anything. 

I tried an old set of probes from a Hameg scope, the amount of overcompensation that couldn't be dialed out was worse. I then tried a P6109 Tektronix 10X probe (from a Tek 2235A scope) and it compensated to a better square wave on all channels of the MSO5074 but still slightly overcompensated.

The question is, do the Rigol PVP2350 probes meet their intended specs.

[offmar]

The question is, do the Rigol PVP2350 probes meet their intended specs.

What's the result if the probes are set at 1x? On my 'scope the signal has the same overshoot as with 10x compensated. Both times getting signal from the 1kHz compensation generator.

[Martin72]

Hi,

Today I did a test, posted in there:

https://www.eevblog.com/forum/blog/new-rigol-scope/msg2217990/#msg2217990



This thread here is about hacking the rigol…..

Martin

[2N3055]

After hack I would presume that Auto Calibration would need to performed. Maybe it does some kind of signal path verification/calibration in front end chip?

[Martin72]

It could be, when I did firmware upgrades on the scopes, Lecroy, Siglent and Rigol got it in their upgrade instructions, to do a auto-calibration after the upgrade.

[2N3055]

Well, Rigol says that front end analog chip has full bandwidth and attenuator control inside. And since chip is supposed to good to 4GHz, it would stand to reason that it would have some kind of equalization built in for board layout and channel difference tuning. Self calibration could use it to compensate and equalize channels.