Hacking the Rigol MSO5000 series oscilloscopes

[Crambone]

Sticker for your scope. I had some stickers made up to upgrade scope model if anyone is interested just send $2 PayPal and I will mail out to address on your PayPal. CONUS only please.
They need to have the white trimmed off and they don’t fit side to side perfect but with a little care they will look good, I rushed on this one just to try it. I’m going to make the next one exact fit with a bit of white showing on each end and just use a permanent black marker to rid the dreaded black.

PayPal: KB2LMN@gmail.com

[lmamakos]

Thanks for the list of steps to do this upgrade.   One thing I'll note is that if you elect to do the other process to enable ssh access, it will complain about a failed update but it does the thing.   Don't be like me and try it one or two more times as the same thing gets added to the start-up file.

While fixing that, it occurs to me that in addition to (or maybe instead of) starting sshd from the startup.sh file, one could add a line like:

[ -f /media/sda1/init.sh ] && . /media/sda1/init.sh

to the end of the file that would just include and run a shell script from the USB stick plugged into the scope.  My intention was to use this to add a .ssh directory to the root user's home directory (which is initialized from scratch when the scope boots) so password authentication wasn't going to be necessary.

I'm also going to see why sshd takes so long to start the session; likely it's trying to do some reverse DNS lookup of the address of the remote end of the ssh session.

[luma]

Thanks to everyone for the info in this thread, scope is now up to latest and the VNC support is great!

[faktorqm]

Hi guys, I upgraded my oscilloscope perfectly well and smooth. I made a guide to help all the users to get through the upgrade process.

I hope you can find it useful and of course, any suggestion to improve the guide will be very welcome.

https://www.mediafire.com/folder/zh1uiu3umgoai/Documents

I uploaded to mediafire because I can't share them here. The firmware.rar files contains all the files needed to work with the guide. The Word file is the guide with images.

Thanks a lot!!!!

[MegaVolt]

I made a guide to help all the users to get through the upgrade process.

You have a new firmware in the archive that is different from all that I have seen here. Where did you get it?

b84331279e96a0cba499dcb9d447b048 *DS5000Update.GEL

Size: 71 669 760 byte

[faktorqm]

I think it is the one uploaded in first place in Rigol china site, and then they removed the firmware and published again. It's not the same file?

Anyway the "firmware package" is only for users comodity, I posted all the links to download the files by themselves.

[Protegimus]

v00.01.03.02.02 2023/01/04

Successful firmware update with default setting on boot (reverted from Last for the purpose of the update).

Observations:
1. 500uV range is no longer available on CH1
(listed under page 18, Overview of the MSO5000 Series Technical Specifications > Vertical System Analog Channel > Vertical Sensitivity Range)

2. Selecting 1mV range automatically engages 20MHz bandwidth limit, with B indicated in the channel status label

If someone can confirm that would be appreciated.

@luma what do you use to create the animated .gifs - they are incredibly helpful to include.

[skander36]

I can confirm 1 mV limit on all channels instead of 500 uV.
Corner menu is also extended/rearanged.

[tv84]

While scouring my old notes (lots of stuff on this MSOs endeavour...) I just saw this small pic that I did while testing the several Models, by changing the FRAM contents.

Light green - officially released
Dark green - possible but not officially released (as the BW wasn't fully reached)
Red - unrecognized

I leave it here just for reference.

[lmamakos]

I've been doing a little more hacking around to improve the SSH access, and a bit more flexible way to play with the scope.  I did two things to make the SSH experience much snappier

• Disable DNS resolution in the /etc/sshd_config file to avoid waiting for DNS resolutions to time out
• Install a .ssh/authorized_keys file so that you don't need to enter root's password (Rigol201 these days) each time you log in.  Or want to use scp to copy files out.

It involves just a few steps.  First, once you've enabled the SSH server as described previously, you can SSH into the scope and modify the last line that was added to the /rigol/shell/start.sh file on the scope to look like this instead:

/usr/sbin/sshd &  [ -f /media/sda1/init/init.sh ] && sh /media/sda1/init/init.sh

This just appends that latter conditional expression which checks for a file called init.sh in the init directory on the USB stick plugged into the scope.  The embedded Linux in there has an old-school "ed" UNIX line editor that works just fine.  Or you could just append that new bit to the file for the same effect from the shell with a command like

echo >> /rigol/shell/start.sh  '[ -f /media/sda1/init/init.sh ] && sh /media/sda1/init/init.sh'

Make sure you use two >> characters to append and not overwrite the file!  Because of the risk of screwing up that file, it was better to change that start.sh file just once and experiment elsewhere with a separate script.

Now you need to create some files on the USB stick that you'll leave plugged into the scope.   This is intended to be the same one that you might leave in there for saving screenshots or configurations.   An init directory is created on the USB stick.  Then you then put a file in the init directory called init.sh, like the one that I've attached.  (Note I had to attach a .txt suffix to enable it to be attached to this post.)  Also, you can put an authorized_keys file next to the shell script in the same directory with your SSH public key(s) in there.  If the authorized_keys file is missing, it just skips that step.

So now, each time your scope starts, it starts with checking to see if that init directory and init.sh script are present and then it will fix the SSH server's DNS lookup and install your authorized_keys file.  It's necessary to do these fixes the scope boots as the root file system is RAM based and changes don't persist over reboots.

The other alternative I looked at was making an init directory in the /user directory on the scope.   This is the "C" drive and where screenshots and save configurations land if you don't put them on a USB stick.   I chose to do the USB stick instead, so if something went stupid, you could just unplug it when starting the scope and skip this.  The script that I wrote looks for the various files in the same directory it was started from.

I'm sure this can be merged into a more general process like was used to install the sshd as an "upgrade" as described earlier in the thread.  I thought it might be useful for others with some Linux experience to test-drive this before going that far.

[CosteC]

v00.01.03.02.02 2023/01/04

Successful firmware update with default setting on boot (reverted from Last for the purpose of the update).

So hack disappears, like others reported?

Observations:
1. 500uV range is no longer available on CH1
(listed under page 18, Overview of the MSO5000 Series Technical Specifications > Vertical System Analog Channel > Vertical Sensitivity Range)

CH1 only or all channels?

2. Selecting 1mV range automatically engages 20MHz bandwidth limit, with B indicated in the channel status label

Previous software version engaded 20 MHz limit on 0.5 mV/1 mV / 2 mV if I remember correcly. Datasheet mentions those ranges are software created from 4 mV/div (which is not directly available - as there is 5 mV/div step, so seems HW is more binary with some VGA too)

[blubillcanada]

How did you get VNC to function?

Nevermind, it was my network cable wasn't connected lol.

[lmamakos]

How did you get VNC to function?

Just one thing that I bumped up against...  I couldn't get the VNC interface to work with "Screen Sharing" on my macOS computer.  In the past, I've used this as a VNC client with success.  However, when pointed at the MSO5000, it would connect; then ask for username/password and then sit there.  No display window, nothing.  I tried diddling around with various options (add a password, or not, etc.)

Eventually I tried a VNC client from a Linux computer and it work just fine and display popped up immediately!  It works wonderfully, and I think it'll probably be easier to do screen captures from the VNC window than finding the file the MSO5000 creates.

Maybe this will save someone some time.. I haven't investigated the macOS side of things yet to see WTF was going on.

[skander36]

v00.01.03.02.02 2023/01/04

Successful firmware update with default setting on boot (reverted from Last for the purpose of the update).

So hack disappears, like others reported?

Observations:
1. 500uV range is no longer available on CH1
(listed under page 18, Overview of the MSO5000 Series Technical Specifications > Vertical System Analog Channel > Vertical Sensitivity Range)

CH1 only or all channels?

2. Selecting 1mV range automatically engages 20MHz bandwidth limit, with B indicated in the channel status label

Previous software version engaded 20 MHz limit on 0.5 mV/1 mV / 2 mV if I remember correcly. Datasheet mentions those ranges are software created from 4 mV/div (which is not directly available - as there is 5 mV/div step, so seems HW is more binary with some VGA too)

1. After every upgrade hacked options dissapear and need a new hack.
2. All channels
3. Correct

[Trax]

So are the hacks stil working with the newest hardware revisions?
And what to get as a basic model?
Rigol MSO5074 and for the LA probes Rigol PLA2216 ?

[thm_w]

So are the hacks stil working with the newest hardware revisions?
And what to get as a basic model?
Rigol MSO5074 and for the LA probes Rigol PLA2216 ?

Yes, MSO5074 if you want 4 probes. 5072 if you only need 2.
I wouldn't bother with LA feature, unless you need the extreme sample rates. A more user friendly PC LA can be had for less.

[lmamakos]

For about $80, you can buy a alternative logic analyzer pod from ebay, based on a design that was posted in another thread on the forums.  It doesn't have the adjustable threshold that the Rigol pod has, but works for 3.3v/5v logic levels.  Just search for PLA2216.

https://www.eevblog.com/forum/testgear/low-cost-logic-analyzer-probe-for-rigol-mso5000-easyeda-project/ which seems to be based on https://eltguy.de/en/selbstbauprojekte-elektronik-technik-hobbytechnologien/logic-probe-ein-digitaler-16-kanal-tastkopf-fuer-oszilloskop/

There's another project where you can build your own after ordering some boards.  You'd need to be comfortable doing surface mount assembly, etc.

[gharac]

https://www.eevblog.com/forum/testgear/low-cost-logic-analyzer-probe-for-rigol-mso5000-easyeda-project/ which seems to be based on https://eltguy.de/en/selbstbauprojekte-elektronik-technik-hobbytechnologien/logic-probe-ein-digitaler-16-kanal-tastkopf-fuer-oszilloskop/

It the other way around, but both work fine and are only slightly different in design.

[Landys]

Thanks a lot everyone, the latest hack for Update v00.01.03.02.02 works fine again. 

Here is full update and hack package in one zip: https://ulozto.cz/tamhle/ZetrB98R0FaJ#!ZJV1MwR2AmR5ZJD2MQVjBGOvZQyyA0cuEwOyLyAnMxABnQV3Aj==

[mosafet]

For anyone looking for a pseudo-OEM looking label (the fonts are similar at best). PNG, SVG, and PDF.

All of my printers are broken at the moment so if someone tries this, let me know how it fits and I can make adjustments as needed. Colour matching may take some effort too.




The Rigol logo and designs are owned by RIGOL TECHNOLOGIES CO., LTD. and I have no affiliation or intent to infringe.

[klen_s]

another good confirmation!
update was from 1.3.0.3 + patch -> 1.3.2.2
after the reboot, the device did not rise ... after entering the boot menu, I repeated the procedure - the result is the same.
as we now assume that the fault is the configuration data from the previous firmware.
performed the update with the previous firmware 1.3.0.3 + patch -> 1.3.0.3 and the device came to life
then everything was as described above - update to 1.3.2.2 and apply the patch
enjoy!
thank you very much for your work!

[cuestalf]

Just to confirm yet another successful modification, as of March 5th, 2023, following faktorqm's document/guide step by step.
In about 1hour (I know, very slow, patience is key ) it has now a full licensed option list.
Only one, at least for me, not so clear detail: "root/Rigol201" refers to the Login (root) AND Password (Rigol201) for the SSH interface (I used Putty).
One (unnecessary) thing I did differently: before starting the whole process (even the back up) I did a factory reset (explained later on, at some point, in the guide) and I preferred to re-enter LAN's settings twice rather than to change to "Power On->Last"
All in all, I am very thankful that I found this well written guide.

[lmamakos]

When I did the latest update, I didn't reset the network configuration, but simply changed the "Power On" setting from "Last" to "Default" which seemed to do the trick for me.  My network settings survived.

[JCS666]

Hi guys, I upgraded my oscilloscope perfectly well and smooth. I made a guide to help all the users to get through the upgrade process.

I hope you can find it useful and of course, any suggestion to improve the guide will be very welcome.

https://www.mediafire.com/folder/zh1uiu3umgoai/Documents

I uploaded to mediafire because I can't share them here. The firmware.rar files contains all the files needed to work with the guide. The Word file is the guide with images.

Thanks a lot!!!!

Veo que eres Español, yo hackee mi rigol al principio en cuanto aparecio el hack valido, pero viendo tu guia intuyo que se puede seguir otro metodo, seria mucho problema ponerla tambien en castellano, mi dominio del ingles deja mucho que desear, gracias en cualquier caso.

I see that you are Spanish, I hacked my rigol at the beginning as soon as the valid hack appeared, but seeing your guide I sensed that another method could be followed, it would be a lot of trouble to also put it in Spanish, my command of English leaves much to be desired, thanks in any case case.

[tv84]

This is an english forum!