Hacking the Rigol MSO5000 series oscilloscopes

[MegaVolt]

DSO5104

This topic is about another oscilloscope.

[sem21]

Sorry, I made a mistake with the name MSO5104.

[MegaVolt]

Then a white screen appeared with inscriptions, after which it was not possible to unlock the functions. Please, help!

What is your version of the device?
What is written on a white screen?
By pressing the "Single" button on the boot time, you can get into the secret menu and restore everything as it was.

[sem21]

version 00.01.03.00.01

[MegaVolt]

version 00.01.03.00.01

The error is written on the screen: the device does not see the USB flash drive. You need to search another flash drive of a small size. (1-4GB)

[sem21]

Here I changed the flash drive, and what happened in the photo.

[MegaVolt]

It looks like your file has a newer version and other checksum. And you need a new file "Patch.txt". Unfortunately, I do not know how to do it

One way to install the firmware from Rigol. Hack is designed for it.

[kkol]

Here I changed the flash drive, and what happened in the photo.

Sem21.
Before all you need to check what version FW is installed on your device.
And after this you will "dance" from this point.
Make the screenshot of your FW and show it here.

Сначала проверь какая версия фирмваре установлена на твоем устройстве.
От этой точки и плясать.
Сделай скрин и покажи здесь. 

[nix239]

Anybody have problems with zeropoint.
After downgrade firmware and open 350mhz some problems with zeropoint. Show dc -160mv. Calibration not help.

[sem21]

Thank you for responding. Here is a screen.

[Tiak]

I just liberated my new MSO5074 yesterday, FW 01.03.00.01 build 2020-05-18, easy peasy and purring like a pussy.

I've attached the necessary files and describe below what I did for the convenience of others. Nothing new, it all comes from previous posts.

Steps I took to liberate the scope:

• Verified installed FW is version 01.03.00.01 build date May 18, 2020 (Utility => System => About)
• Copied three files, that can be extracted from attached .7z archive, to root of empty 8GB FAT32 USB drive
• Started up scope
• Inserted drive to front panel USB port
• Utility => System => Help => Local upgrade
• "Upgrade system firware?" => OK
• Let the scope do its thing - takes a minute or two, or five, go with the flow
• Reboot scope
• Verified all options now licensed ...forever... (Utility => System =>  Help => Option list)
• Bob's your uncle

I suppose I shiouuld recalibrate now too, which according to Olliver goes like this:

• Make sure that the instrument has been operating for at least 30 minutes
• Disconnect all input channels (including probes)
• Utility => System => Self-Cal => Start
• Self calibration takes ~ 35 minutes to complete
• When complete, reboot the scope

I verified that all options were upgraded ...forever... (notwithstanding what the effects may be of any future official FW updates I may decide to apply). I did not verify that the patch disables the "phone home" firmware upgrade check, but I have no reason to think it doesn't. This patch does not enable the sshd daemon. To ssh as root into the scope, follow mabl's instructions - which needs to be reapplied after each scope reboot whenever you want SSH access.

This is not going to work for you if your installed FW is not version 01.03.00.01 and having build date May 18, 2020. In that case you will need to adjust the patch.txt file in accordance with instructions that can be found in other posts.

Where the files and info came from:

• Basic GEL file from mabl https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg2704640/#msg2704640
• Modification to disable "call home" FW updates from typoknig https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg3024342/#msg3024342
• Modification for FW version 01.03.00.01 May 2020 build from omgoleus https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg3344172/#msg3344172

Hi do i need to do any backup before upgrading with this method?

[ultranalog]

Thanks to all the usual suspects for their knowledge and work.

I got my 5074 with a voucher for the BND option (all except bandwidth and 200 mpt memory). I did go and get the official .lic file which unlocked the BND options.
Anyone interested in analyzing that file (for... educational purposes...) send me a PM.

[ilya_z]

Anybody have problems with zeropoint.
After downgrade firmware and open 350mhz some problems with zeropoint. Show dc -160mv. Calibration not help.

After downgrade the problem of the zero point appeared. Calibration worked well for me

[h2oo]

@my fellow Europeans (especially Germany, because who'd guessed I am from Germany  ):

which Distributor can you recommend and do you know which Firmware they are shipping with their devices (hopefully a not to0oo stupid question)

[justme1968]

i got mine (mso5000) mid june from batronix. i can absolutely recommend them. super fast delivery, payment on invoice and they will match the price if you find anything cheaper. and you probably get a (small) additional discount if you ask via e-mail.

the firmware then was the correct version for the latest patch. but maybe they ship never versions now.

[Mick B]

After applying the liberator to my 5072 everything is forever. Has anyone tried using UltraSigma/UltraScope after doing this? and does your HDMI out work?
Thanks to everyone involved in this endeavor for all your hard work and time. I'm sure I speak for everyone that took advantage of your work. YOU ARE ALL GREATLY APPRECIATED!

[Peter_the_diver]

Hi guys and thank you for that great stuff here!
Got my MSO5074 last week from BATRONIX - a good choice! As justme1968 wrote, don't put it to your shopping cart directly, ask for an offer. I got 3% discount without any diskussion. I have liberated and calibrated the scope today as described here - everything's fine (Firmware: 00.01.03.00.00 Build:2020-05-18)! If you like, here a few lable files for your "new" device. Print it out on self-adhesive foil and stick it on your liberated MSO.

[justme1968]

thanks for the labels. i was already thinking about making some. yours will be a good start. for printing them: have a look at the dm photo sticker print service (probably germany only). they are very good quality, at least water resistant and quite durable. (the idea is not mine, but comes from the bosch power tools forum where they use them to create third party l-boxx labels to blend in with the manufacturer ones.)

[MegaVolt]

Here's another sample sticker that was in this thread earlier.

[Peter_the_diver]

....and here a version, made for sticker sevice of Kaufland, DM, CEWE,..... Choose sticker-format 4pieces 57mm × 82mm  - diagonal but fitts!

[Crenwick]

Hi all,

Just ordered my scope

Can you please give me the exact sticker size needed ?

Bernard

[dreamcat4]

ok so it's a simple quick question: purely from the prospects of unlocking as far as possible. what would be the best specific model to get new these days? can it be mso5072 ? or should it be something higher up in the range, eg the mso5074?

 

[ToThePub]

ok so it's a simple quick question: purely from the prospects of unlocking as far as possible. what would be the best specific model to get new these days? can it be mso5072 ? or should it be something higher up in the range, eg the mso5074?

If you order the 5072, you only get two probes. Makes sense, it's only a 2 channel scope.
If it was me, I would order the 5074. Yes it costs a little extra, but you don't have to worry about buying extra probes and you always have 4 channels to fall back on if you want to sell it later and remove the patched firmware.
Considering you are not paying for any options (as you can just unlock them), just spend the extra for the 5074. Surely your time is worth more than the extra messing around to get more probes.

But to answer your actual question, there is zero difference between the 5072 and 5074 as far as unlocking is concerned. Part of the unlocking process will enable channel 3 and 4 if you have the 5072.

[ToThePub]

Hi All,

Just a quick note that the MSO5000 free options bundle that includes:

    MSO5000-COMP - Computer Serial Triggering and Analysis (RS232/UART)
    MSO5000-EMBD - Embedded Serial Triggering and Analysis (I2C, SPI)
    MSO5000-AUTO - Automotive Serial Triggering and Analysis (CAN/LIN)
    MSO5000-FLEX - FlexRay serial bus trigger and analysis (FlexRay)
    MSO5000-AUDIO - Audio Serial Triggering and Analysis (I2S)
    MSO5000-AERO - MIL-STD 1553 Serial Triggering and Analysis
    MSO5000-AWG - Dual Channel 25MHz Waveform Generator
    MSO5000-PWR - Integrated Power Analysis

Ends at the end of this month (30th of September).
Who knows if this offer will be extended (probably will, but I have zero contact/idea if that'll happen).

So if you are thinking of getting the MSO5000 series scopes, I'd get one before the end of the month so you can get your free (legitimate) license for these options.
Obviously, this isn't really needed because you can just unlock the features, but it's always nice to have the "real" license for these options in case you want to sell it, or need to restore the factory firmware for some reason.

[Howardlong]

Hmmm.... switched on my MSO5000 to check something about it for someone (it only has about 20 hours of use), after about ten minutes on it powered itself down and I was left with a repeating click and short LED panel flash every second or two.

Took it apaaaart, there's a near short (0.4 ohms) on the PSU connector's 5V pins to ground on the main board.

PSU seems to supply voltages fine.

After giving it a visual, there was not much to be seen so I made up a cable to my bench PSU to power all the 3 supplies (5V, +7.5V, -7.5V), sure enough the 5V was shorting. By the way, the connector is the same as a normal PC ATX connector cut in half, so I made up a cable.

After a bit of manual probing of the obvious power supplies, I got nowhere, the Schottkys all seemed fine.

Got out the IR cam, and the perp showed up like a Christmas tree. Looks like the ISL8203M 3.3V SMPS is dead. I didn't immediately look at this because #1 eyeball was looking for inductors: this device interestingly enough has integrated inductors, quite a feat, I've not seen this before.

So a replacement device is on order.

Anyone else had a similar problem?