Hacking the Rigol MSO5000 series oscilloscopes

[JCS666]

Extract of Release Notes.txt

v00.01.03.02.02 2023/01/04
   
     - Add shortcut button and VNC remote function
    - Waveform, cursor movement, gesture operation vertical and horizontal gear switching speed optimization
    - Cursor optimization: cursor jump optimization, ZOOM area and main time base cursor linkage, etc
    - The color of the CH4 waveform is modified, and the brightness of the waveform is improved
    - ZOOM mode optimization: mask color adjustment, switching speed, area movement optimization
    - SCPI instruction response speed optimization: reset, measurement, waveform read instruction response optimization

[kelemvor]

I decided my scope needed a new label...

[Martin72]

Riglol, nice idea ! 

[gmaker]

followed this instructions https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg3869852/#msg3869852
and got this once tried to apply the patch.. USB stick formatted in FAT32.. so any idea on what's happaning?

[gmaker]

followed this instructions https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg3869852/#msg3869852
and got this once tried to apply the patch.. USB stick formatted in FAT32.. so any idea on what's happaning?

Solved. Just found third USB stick.. the most older one.. and it worked for some reason.

[OHR]

I just completed following the instructions in post "Re: Hacking the Rigol MSO5000 series oscilloscopes
« Reply #2206 on: January 15, 2022, 06:14:13 pm »" to upgrade my MSO5074 I bought from Amazon in December for $799.00 (it had the exact software and firmware needed) and everything worked perfect! I'm now the proud owner of a MSO5074 which functions exactly as a MSO5354!

Thank you so much for this thread!

[OHR]

Wanted to share what I did for a case. Instead of putting out $165.00 for the Rigol case I went with a Harbor Freight protective case (Apache 4800) for $65.00. After plucking the foam for a good fit I added a high quality Nashua ducting tape on the top and bottom sides of the remaining pluckable foam to keep it from pulling loose. Everything fits perfectly and it's super protected now.

[ilyxa]

Thank you very much for a great job.

MSO5072 + LA, Everything needed (hack + backups)  working very well.

I'll buy this Rigol also to use with sigrok/pulseview (as linux user), also using hw with lxi-tools (NI/VISA-independent tool, very nice sometimes), before a had a lot of trouble with some Hantek and Owon (not sure) equipment which costs much less money and was much less predictable (one of strong point to buy rigol/siglent/R&S/etc - I need repeatability every time I'm using an equipment).

Small "bug" (not really) - sigrok/pulseview (btw libsigrok) recognise fully-featured MSO5072 per IDN? string, which returns MSO5072 (2ch model) thus make additional 2 channels unavailable under libsigrok-based application (not a big deal in my scenario as I'm using LA with sigrok, very nice after fx2law in some my home "application"

Also keep in mind sometimes after doing  work with pulseview/sigrok/lxi-tool MSO didn't come up (power on) next boot (stuck on Rigol logo with red stop/run button - normally it's green while come up), solution is power off, power on, press Single button, Restore defaults (work well for me), recalibrate (it tooks about 25 minutes). After that every time I completed my job with this application  I'll just prefer set Defaults before powering off - and everything fine now.

I understand exactly wrong to discuss any linux/non-hw staff here, again, thank you, very nice job!

[faktorqm]

Guys, I installed the latest firmware v00.01.03.02.02, the one who it's not available anymore. Now I can't rollback to v00.01.03.00.03. The oscilloscope tells me that "the file package is wrong" (despite the fact I downloaded it from rigol support site). I have tried with the menu at boot, and the regular upgrade menu. Any hint on this? I sent an email to the rigol support too. Thank you! Regards!

[BRZ.tech]

Hi. faktorqm.
You can enter through the Secret Menu, through the buttons:
1) Power off and then power on your MSO.
2) During the boot sequence, quickly and repeatedly press the Single button in the upper right hand corner of the instrument.
3) Reset to the initial version of your FW.

Then do a self-calibration, even on the old FW.
Turn off and then turn on your MSO.

After that, place the original *.GEL file on the pendrive, without the FW v00.01.03.00.03 hack, and execute the update through the Secret Menu in the Single button.
Then do a self calibration even in FW v00.01.03.00.03
Turn off and then turn on your MSO.

After that, put the original *.GEL file on the pendrive, and without FW v00.01.03.02.02 hack and execute the update through the Secret Menu in the Single button and execute the update through the Secret Menu in the Single button.
Then do a self calibration in FW v00.01.03.02.02
Turn off and then turn on your MSO.

Finally, say your prayers that it works out.
Good luck.

[NoisyBoy]

Rigol just released a version of the 1.03.02.02 on the US website.  When you do the actual download, the file name is MSO5_FW_V1_1_4_4, the upgrade instruction.txt file is still gibberish, likely in a different language.  For the actual GEL file, the checksum was exactly the same as the one in the Chinese site which disappeared earlier.  They never had a professional discipline in managing firmware update when the MSO5000 came out, sadly this trend continues years later. 

Here is the change log, also the same as before:
v00.01.03.02.02 2023/01/04
   
     - Add shortcut button and VNC remote function
    - Waveform, cursor movement, gesture operation vertical and horizontal gear switching speed optimization
    - Cursor optimization: cursor jump optimization, ZOOM area and main time base cursor linkage, etc
    - The color of the CH4 waveform is modified, and the brightness of the waveform is improved
    - ZOOM mode optimization: mask color adjustment, switching speed, area movement optimization
    - SCPI instruction response speed optimization: reset, measurement, waveform read instruction response optimization

While the file is the same as before, at least now you are downloading this patch from the official firmware download site.  So hopefully we will get some support from Rigol in case the upgrade fails. 

Until someone come up with a new patch file, you will lose the "enhancements" if you apply this firmware.  Let's hope this wonderful community can come up with a new patch file soon to share with everyone.

https://www.rigolna.com/firmware/

[mwb1100]

Rigol just released a version of the 1.03.02.02 on the US website.  When you do the actual download, the file name is MSO5_FW_V1_1_4_4, the upgrade instruction.txt file is still gibberish, likely in a different language.  For the actual GEL file, the checksum was exactly the same as the one in the Chinese site which disappeared earlier.  They never had a professional discipline in managing firmware update when the MSO5000 came out, sadly this trend continues years later. 

It's pretty unbelievable.

the upgrade instruction.txt file is still gibberish, likely in a different language.

The file "MSO5000 Upgrade Instructions.txt" has a header that indicates it's a text file that has been encrypted with E-SafeNet encryption.  It seems that the encryption isn't too strong so there's a decent chance the original file (or a large portion of it) could be recovered.  At least if the plaintext is a plain ASCII file.  But I doubt it's worth the trouble - it's almost certain a byte-for-byte copy of riglol's copy of "MSO5000 Upgrade Instructions.txt" file.

[beatman]

i have instaled the new firmware to my 5104 scope start and to the end of one minute stuck on rigol logo.i wait few minutes and power of.i try two times to update no luck.i instal the version i had before and scope starts normaly.

[NoisyBoy]

I have seen some people upgraded successfully, but others have failed. I wonder if hardware version may play a role, what is your hardware version?  They were two versions last time I checked.

[seronday]

This happened on an MSO5074 that I recently installed this new firm ware on.

I solved the issue by bringing up the special boot menu at power on (using the "Single" key) and selecting the option to restore factory defaults.
The unit then started up correctly with the new FW version.

Regards.

[NoisyBoy]

Perhaps this is the secret step in the upgrade instruction that they encrypted  .

mwb1100 was correct, the MSO5000 Upgrade Instructions.txt file is the same as the original one from the Chinese download site. 

[beatman]

try again with factory def.and then do the new updt.no luck.stay with 2021 version for now.

[NoisyBoy]

This is concerning, but not entirely unexpected given Rigol's careless approach to firmware and updates.  To help all in the community who wants the upgrade, can we start a log of:

* Upgrade successful vs. upgrade failed
* Reset to factory default required, vs. not required.
* Hardware version
* Any extra steps taken to perform upgrade

I don't think troubling-shooting Rigol firmware should stay in this thread as it is not related to hacking.  I will suggest those who respond jump over to the hardware/software revisions discussion so we can keep this thread dedicated to hacking.  I hope someone will kindly start looking into a new patch file while we investigate how to install the firmware.

https://www.eevblog.com/forum/testgear/rigol-mso-5000-hardwaresoftware-revisions/msg3868508/#msg3868508

[Arturete]

Greetings, I found this forum because I tried to update my rigol from the version v00.01.03.00.03 hack to the original version v00.01.03.02.02 and now I have a brick, I entered the secret menu but it doesn't let me select restore firmware or upgrade firmware, simply It does not activate anything, I have the backup from when I did the hack. Can someone help me please

[Arturete]

I already managed to solve it, try several times the secret menu and as quickly as possible select restore defaults until it reboots itself and it's working again, updated and without hack

[NoisyBoy]

Glad to see you get it back up and running. 

Given some of the failure we have seen here, if it persists and if I were Rigol, I would have pulled the update and figure out what's going on.  Clearly more testing and a set of update instruction are needed.  No customer should have to jump through hoops just to get a firmware upgrade like what we are witnessing here.   

[Arturete]

I agree, for my part I already sent an email to technical support mentioning the problem I had without mentioning the hack obviously

[MYlol5374]

Quick question:
How do we know there aren't 2 completly diffent IC's under those 2 big heat spreaders?

Let's pretend it's not a 4ch x 2GS/s 8bit ADC and instead it's an 8ch x 200MS/s 6bit ADC
also it's not a Kintex K7 160 but instead maybe a more like a Spartan 7...
you know...
more like...
like...
IC's we''ll find in hardware in the same ballpark.

At around 1.6GS/s this scope would IMHO max out at around 400, maybe 430 MHz 
and if I'd be the in the marketing department and the tec guys are telling me the new fancy schmancy homebrew ADC is an 8 channel, 10 x timesampling, 6bit ADC I would go balls out and just call it X8106A, in yaaaa face!!!

And for the FPGA, if the customer can tell the modell only by looking in the binary... I wonder why they chose a Kintex-7 160, I'd make a Virtex XC7VX1140T 

I maybe just made up a conspiricy theory here,
or Rigol isn't selling this scope at a big loss at all?!?

[faktorqm]

Thanks a lot for your advice BRZ.tech, unfortunately it's not working. It's look like I'm unable to rollback  :'( I regret a lot todid the upgrade because I bought this device solely because reading this thread I knew I can use plenty of the functions. And now...

I will wait until some of the true hackers here provides a patch, if possible to made. In the mean time, I will continue investigating why I can't go back. Thank you! Regards!

[mwb1100]

unfortunately it's not working. It's look like I'm unable to rollback

Are you able to get to the "secret" menu and select "Upgrade Firmware" by the button just under the "Menu Off" button?  What message(s) does the oscilloscope display when you try to do the rollback update from that menu?

It's known that the oscilloscope can be picky about what USB stick is used.  Make sure any USB sticks you use are FAT32 formatted and try more than one of different brands.  Also I'd suggest that the .GEL file be the only file on the stick and make sure the .GEL file is named: "MSO5000Update.GEL"