Hacking the Rigol MSO5000 series oscilloscopes

[ebclr]

Finally, the time arrives and I will trigger an order for 5072 or 5074

Are the new ones hackable same way, as the old ones?

Any terrifying problem that can void the new order plan?

Still the best Scope for 1K USD?  ( assuming I will hack, and I will )

[tv84]

Could someone please help?
I really don't have a notion about what I'm doing wrong...

Which patch_file did you use? Reference it's origin.

Finally, the time arrives and I will trigger an order for 5072 or 5074

Are the new ones hackable same way, as the old ones?

Any terrifying problem that can void the new order plan?

Still the best Scope for 1K USD?  ( assuming I will hack, and I will )

Y N Y

[nelson_mendes]

Hi TV84,

I got it from here and called it MABI.GEL just to make it simple during the bsdiff/bspatch process:
https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg2704640/#msg2704640

Let me see if I got this right...

Do I need to do "bsdiff Firmware_04.08.gel Mabi.GEL patch04.08.bpatch" or "bsdiff appEntry Mabi.GEL patch04.08.bpatch"?

Or is it something even different?


Thanks!

[TK]

Finally, the time arrives and I will trigger an order for 5072 or 5074

Are the new ones hackable same way, as the old ones?

Any terrifying problem that can void the new order plan?

Still the best Scope for 1K USD?  ( assuming I will hack, and I will )

And Rigol has a promotion where you can get lots of the software options included for free (does not include BW upgrade, 4-channel in case you purchase 2-channel model and maybe some other options are not included in the promotion)... but you can still hack it and get all  the options activated.

[tv84]

I got it from here and called it MABI.GEL just to make it simple during the bsdiff/bspatch process:

Or is it something even different?

Way off! Read mabl's msg carefully. You need to place the 3 files in the USB pen. And, mabl's doesn't include any patching info. So, you must create it yourself or get it from another place.

mabl's GEL is just a patcher tool.

[nelson_mendes]

Good evening!

I finally made it! A very special thanks to Mabi, AngusBeef, Delfinon, TV84 and many others...

It happens I was being such a "Nabo da Serra" and was mixing the md5sums... All good now...


//Nelson

[AngusBeef]

The latest firmware got my interest due to fix the overshoot in the 4 channels, something that also seen in my scope in channels 3 and 4.

Being ungodly unblessed with any kind of hacking skills, I tried my best to follow the instructions given to other members and attached You can see what I got.

The .04.08 patch didn't fix my overshoot issues, I used the calibration data that @Mabl had posted  before on a different topic and it worked for me.

https://www.eevblog.com/forum/blog/new-rigol-scope/msg2240841/#msg2240841

EDIT3:
The problematic calibration is lfcal.hex. Just replacing that file gives perfectly shaped squares again.

mabl, would it be possible for you to upload, or send to me, your working lfcal.hex?

See attached.

I will check later to be sure, but I suspect that auto-cal does nothing... I have the overshoots on 3 channels and nothing changes when I use auto-cal. I even did it while I had input signals fed to all channels - the result didn’t change, everything looked as before, and I suppose that in that scenario the ‘scope should have lost calibration.

Cannot confirm. When using the default calibration, the spikes are less pronounced then after the autocalibration. Things do not change afterwards however.

[tv84]

Backup scripts for Rigol MSO5000 and MSO/DS7000

Attached is a .GEL that does a backup of the /rigol/data directory and the 8 kB FRAM memory. Run as a normal update.

It also does a memdump (450MB) so you should use a USB disk with size >= 512 MB. (Why this one? Because sometimes its useful...  )

With /rigol/data and FRAM, we can recreate the scope from scratch (as long as the bootloader is OK).

If anyone tests the script, please report the results and how much time it took.

Edit1: Added a .GEL that does a backup of the full NAND (mt0->mt12). Since the NAND is 1 GB in size, you must be patient! It could take some minutes.

[sbehnke]

Man, I hope I just did something wrong that is easily fixable. I updated to 01.01.04.08, enabled SSH, ssh'ed in and grabbed the appEntry. I then removed the USB stick and put it in my PC where I ran the bspatch and the put the appEntry back into the /rigol folder after making sure it was executable. Now my MSO 5074 starts up and show the progress bar going completely across the screen, but the Rigol logo does not disappear and the scope does nothing. Any ideas how I can fix this?

[tv84]

Any ideas how I can fix this?

Here.

[sbehnke]

Thanks. I found that after I stopped freaking out a bit. So I believe the issue was that I did an online upgrade from Rigol to get to official firmware before I did the binary patch on appEntry. Clearly the version posted is different from the version included in the steps here. I haven't been able to find it on rigolna though.

[sbehnke]

Well, I went back and tried it with the version from https://gitlab.com/riglol/rigolee/blob/MSO5000/GEL/DS5000Update_01.01.04.08.GEL but I got the same results where the scope wouldn't get past the boot screen  I'm not sure what I've done wrong, but at least I've back to 01.01.04.04 with all options and that silly overshoot still.

[TK]

backup + FRAM: 2 minutes 40 seconds
NAND: not tested yet

[sbehnke]

backup + FRAM: 2 minutes 40 seconds
NAND: not tested yet

I'm sorry, if this was to me, I'm not sure what you mean.

[sbehnke]

I resolved my issues and now am good to go with the fixed Cal data provided earlier, the 01.01.04.08 firmware and all of the options. Thanks everyone!

[skander36]

NAND backup does not work. After one second get message that upgrade is completed and need reboot but on the stick there is nothing saved.

[TK]

backup + FRAM: 2 minutes 40 seconds
NAND: not tested yet

I'm sorry, if this was to me, I'm not sure what you mean.

Sorry, it is for TV84

[Jean-Michel]

Hello,

I have full opetion mode version 01.01.04.04, does someone try to make the upgrade 01.01.04.08?
Do you always keep the full option?

[skander36]

Sorry I have to finish some home business .
The task was completed succesfully in about 10 minutes .
On disk I found this files (attached).
Scope is 5074 witn FW: 00.01.01.04.08 with mod (bspatch).

[sbehnke]

Hello,

I have full opetion mode version 01.01.04.04, does someone try to make the upgrade 01.01.04.08?
Do you always keep the full option?

You don't. You have to apply the new fix for the patched appEntry, but it is possible after a bit of tinkering I was able to get it to work last night.

[typoknig]

Does anyone know why the FW update is still absent from the North America site?

And still absent in europe (rigol.eu), strange….
I´ve ask them about without getting an answer.
I´ll try again.

And another month passes with no update

[Martin72]

Yep..
I´ve asked again on october 29th, answer was sorry for delaying but it should happen "soon".....

[Ditiris]

Just wanted to drop a big THANK YOU! on this thread.

[nikolai]

Got my MSO5074 from China two weeks ago. Hardware revision 01.01.000 FW revision 00.01.01.04.08 out of the box.
Hacked successfully. Big thanks to all smart contributers for the creative solutions.

[ilyacniihm]

Hello. please tell me again how to hack the firmware 01.01.04.08 correctly.

1) Сopy DS5000Update.GEL  file on the USB drive.

2) Download the Bpatch file from this post and remove the .txt extension (https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg2620701/#msg2620701)
and copy on USB drive

3) create configuration file on USB drive "patch.txt"

file_to_patch=/rigol/appEntry
file_to_patch_md5sum=afe3e7c2d38bdebb66d3f1f11d910743
patch_file=appEntry_01_01_04_08.bpatch
after_patch_md5sum=3f95cb3236b47826e303de960596f966

4) Connect USB drive and go to the Utility / System / Help / Local Upgade menu


correct me if something is wrong. I have never worked with linux.
Thank you very much.