Hacking the Rigol MSO5000 series oscilloscopes

[jemangedeslolos]

Here we learn every day 

[tv84]

We can even recreate a FRAM from scratch so I think there are no reasons for elevating the DEFCON level.

Point of clarification: DEFCON means Defense Readiness Condition.  So you lower the DEFCON level when closer to danger, not elevate it.

   I was totally aware of it, although I wrote "level" when I meant "state" of alert. Thanks for the correction.

[Sighound36]

I thought that only meant defcon one was Tautech was on the prowl

[tautech]

I thought that only meant defcon one was Tautech was on the prowl

Who me ? Always ! 

[marshalljmp]

https://www.temcom.com/instruments-presented-by-rigol-at-embedded-world-2020/

"As a further novelty, the BodePlot function has now been integrated in all MSO5000 series oscilloscopes as an addition to the existing standard application."

Can anybody confirm the Bodeplot function ?

[TK]

https://www.temcom.com/instruments-presented-by-rigol-at-embedded-world-2020/

"As a further novelty, the BodePlot function has now been integrated in all MSO5000 series oscilloscopes as an addition to the existing standard application."

Can anybody confirm the Bodeplot function ?

From the same source: Both series (MSO8000 and MSO5000) have been expanded with a 12-bit high resolution mode.

[jemangedeslolos]

and nothing for MSO7000 

[Fungus]

We can even recreate a FRAM from scratch so I think there are no reasons for elevating the DEFCON level.

Point of clarification: DEFCON means Defense Readiness Condition.  So you lower the DEFCON level when closer to danger, not elevate it.

DEFCON 1 is at the top of the list so you go upwards towards it.

[Sighound36]

The bode plot is coming very, very soon by the end of the month for the 5000.

Along with some long standing bug fixes as well

The 7000 and 8000 will follow in the next month.

Not sure about the 12 bit high resolution mode though? as they all already have both high resolution and precision modes.

[the Goat]

We can even recreate a FRAM from scratch so I think there are no reasons for elevating the DEFCON level.

Point of clarification: DEFCON means Defense Readiness Condition.  So you lower the DEFCON level when closer to danger, not elevate it.

DEFCON 1 is at the top of the list so you go upwards towards it.

Ha ha!  You got me there. 

[piskers]

The scope doesn't have any mechanism to check if it's an "official" or "unofficial" license.

There is no way to be sure of that! There are plenty of possibilities they could use to detect if the firmware is modded. The easiest of which is to simply call the license checking function with an "unused/invalid" license ID that the user could not have a licence for. I don't want to overpanic, but remember we (atleast I) don't even fully understand the structure of their firmware yet. Who is calling the license checking function and whats the context? How is the license file being read and certified? They seem to hide that stuff pretty good from a disassembler. I only found the license checking function back then because it checked the -fullopt flag in earlier versions.  There a also plenty of places they could use to store whether a scope was hacked or not (not only the dedicated 8KiB FRAM IC): Zynq-7000 Soc/FPGA (eFuses), Kintex K7 FPGA (eFuses), Spartan-6 FPGA (eFuses). Let's not be foolish, I'm sure they also have some very clever software developers at rigol and it would be easy for them to trick us!

I didnt put a lot of effort into reverse engineering the firmware (yet), maybe some of you did. Maybe you understand the whole system, if so I'm sorry.

P.S. I also found some instructions that look for a "magic" file on an inserted USB drive. More about that if I find some more time to dig into it.

[tv84]

The scope doesn't have any mechanism to check if it's an "official" or "unofficial" license.

There is no way to be sure of that! There are plenty of possibilities they could use to detect if the firmware is modded.

Re-read my phrase. I talked about licenses, not modded FW.

"Some of you" group: CHECK!

[piskers]

Well, but thats definitely not true because of the e-fuses:

BTW, with a full NAND backup you can reflash any of theses MSOs from scratch as long as you have your bootloader healthy.

[tv84]

Well, but thats definitely not true because of the e-fuses:

BTW, with a full NAND backup you can reflash any of theses MSOs from scratch as long as you have your bootloader healthy.

  Who talked about e-fuses? And changing e-fuses? Read carefully my words, as I and others (besides Rigol) have recreated the scope from scratch. I never said anything about creating perfect copycats...

[piskers]

You said you can reflash the devices from scratch, for example after a future firmware update when they try to detect modded firmwares. All I'm saying is that there are ways for rigol in which this is not true and one could loose warranty forever. Once written eFuses cannot be cleared again. There are many cases where manufacturers in the past used eFuses to prevent warranty service (Samsung Knox e.g.)

[delfinom]

They seem to hide that stuff pretty good from a disassembler.

They don't hide anything. It's just a C++ application which will always make the resulting assembly more irritating to follow than C, especially with the heavy use of QT5 which has many of its own types instead of using stl types.

[skander36]

All I'm saying is that there are ways for rigol in which this is not true and one could loose warranty forever. Once written eFuses cannot be cleared again. There are many cases where manufacturers in the past used eFuses to prevent warranty service (Samsung Knox e.g.)

Yes there are ways to do more than that, but no producer will do . All  important scope brands are hacked but no one has taken such measures as far as I know ... they act to improve FW to be hard to crack but not like this .
One of the reason to not reacting as you said  is  that the procent of cracked fw of scopes is little from all sales.
The benefit is much bigger observing us reporting bugs and other info for their scopes .


 

[tv84]

I think I have already posted this somewhere but here it is again...

[peppy88]

1.02.00.02 patch

Before: 78d71292a1828ee597a341bd14797e18
After: 86d162a29297ae03af88a6d8f7c40247

Hi I am following this guide: https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg2833308/#msg2833308

My MSO 5072 is already patched with the older 01.01.04.04 firmware and I already made a backup containing the memdump and backup folder.

Can someone please confirm if these are the correct steps to update to this:
1) Download Update from here https://int.rigol.com/Public/Uploads/uploadfile/files/ftp/DS/%E8%BD%AF%E5%9B%BA%E4%BB%B6/MSO5000(ARM)Update.rar
2) Unrar the files and copy the DS5000Update.GEL to blank usb (fat32)
3) Copy 01.02.00.02.bspatch.txt to usb and remove the .txt extension
4) Edit patch.txt file

file_to_patch=/rigol/appEntry
file_to_patch_md5sum=78d71292a1828ee597a341bd14797e18
patch_file=01.02.00.02.bspatch
after_patch_md5sum=86d162a29297ae03af88a6d8f7c40247

5) Save and copy to usb
6) Files on usb are
- DS5000Update.GEL
- 01.02.00.02.bspatch
- patch.txt
7) Attach the USB Drive back to the Scope, turn it on;
8 ) Wait for the screen shows that USB Drive was attached.
9) Press Utility/System/Help/Local upgrade
10) The screen will turn to white background and follow the instruction to press any keys.
11) After the upgrade process is finished, the scope will reboot.
12) Done! Enjoy!

Just want to confirm this is the correct procedure to minimize the change of bricking.


Thanks

[NoisyBoy]

Well done!  Do you now get channel 3 coming on even if you have nothing attached to it when you press Auto (if you have a signal on channel 1)?  So far, this appears to be a major bug they introduced in the new firmware, but I don’t know if this is affecting all scopes, mine has 1.00.00 hardware.

If that is the case with you as well, my personal recommendations is not to upgrade until they fix the Auto problem, unless you see something in the small fix list that you need. 

No idea how the “in your face” Auto problem ever pass any QA test in Rigol. 

[Sighound36]

The MSO 8000 does not suffer this channel 3 issue NB

[peppy88]

Has anyone done the 01.02.00.02? Can you please confirm that the steps above are the correct ones?

https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg2963402/#msg2963402

[skander36]

Has anyone done the 01.02.00.02? Can you please confirm that the steps above are the correct ones?

https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg2963402/#msg2963402

v00.01.02.00.02 and 03 has a bug.
Is better to stay at 00.01.01.04.08.

[DeKu]

Well done!  Do you now get channel 3 coming on even if you have nothing attached to it when you press Auto (if you have a signal on channel 1)?  So far, this appears to be a major bug they introduced in the new firmware, but I don’t know if this is affecting all scopes, mine has 1.00.00 hardware.

If that is the case with you as well, my personal recommendations is not to upgrade until they fix the Auto problem, unless you see something in the small fix list that you need. 

No idea how the “in your face” Auto problem ever pass any QA test in Rigol.

I have the same Issue but its Channel 4 and sometimes Channel 2 on my Device. Its an MSO5104 HW. 1.00.00

But i seem to have a bigger Problem. Can someone try the same and tell me (or show me) the Results?

I used the Integrated Function Generator and am a bit surprised on how it looks.. Unfortunately i dont have another Osci at hand, so i cant check if its the Generator or Something else. Is it supposed to look like this?

Settings are in the Screenshots. Thx in advance for any Help

DeKu

[NoisyBoy]

You referring to the color grading being on?  It should default to off, does everything go back to yellow if you press default button?

Perhaps you have your scope set up to start from previous state rather than default?  And it had been turned on at some point in the past.

If you are referring to square wave distortion at higher frequency, it is not new.  As the AWG in it is a relatively low spec AWG.

I also saw channel 2 and 3 came on when there’s nothing attached, but it only did it on channel 2 a couple times.