Hacking the Rigol MSO5000 series oscilloscopes

[6SN7WGTB]

What i want to ask is this

1. What Sig Gen are you using because at the same frequencies, i'm not getting the amplitude that you're getting, Say at 400MHz and 1GHz
I suppose my Sig Gen  WB-SG1 is likely not going to compare to your one
My rise and fall times are pretty much the same as yours

Appreciate your Q not directed at me, but FYI my results, attached again below, were achieved with:

• Marconi/IFR/Aeroflex 2025
• RS Pro RG58 BNC, specified as up to 1.5GHz (but no rolloff data)
• RS Pro 50Ω inline terminator, specified as  DC-0.5GHz, ditto

[BTO]

What i want to ask is this

1. What Sig Gen are you using because at the same frequencies, i'm not getting the amplitude that you're getting, Say at 400MHz and 1GHz
I suppose my Sig Gen  WB-SG1 is likely not going to compare to your one
My rise and fall times are pretty much the same as yours

No problem, You're welcome. Although i believe i've seen this graph before and you posted it earlier didn't you ?
it's not easy to forget when someone whips out a Marconi

Appreciate your Q not directed at me, but FYI my results, attached again below, were achieved with:

• Marconi/IFR/Aeroflex 2025
• RS Pro RG58 BNC, specified as up to 1.5GHz (but no rolloff data)
• RS Pro 50Ω inline terminator, specified as  DC-0.5GHz, ditto

[6SN7WGTB]

I did, yes, but wasn't sure I'd detailed the kit.

[Odd-Job]

Hi Kean & BTO
Sorry to disappoint you both but it is only a  cheapish unit (pic below) purchased from AliExpress about 8 months ago from memory, to check the validity of a batch of 25, MC12095 single modulus prescaler ic's for  frequency division of a 2.5 GHz input signal, datasheet below.

Kean, output voltage is set to approx 300mV  for the input of the chip (12095's) which work from sine waves. 

It does create a nice sine form about 200Mhz up to 4.2 Gig that a collegues Oscilloscope kindly showed.
The highest my MSO would show freq counter wise was about 1.053 Ghz unreliably, about same as yours BTO.
Kean, in relation to the output from my Sig Gen as shown, it stays within 2.1dbmv from the 300Meg to ~1 Gig , as the set up was also plugged into my 3.2Gig Spec Analyzer.
I was stepping it at about 800mS/step & 50 Megs but took forever.
I suggest that if you watch the you tube link to the sweep below link to slow it to compare V/F.
I did find one screen shot I managed at 1.5Gig which you will have to count the divisions to believe me. Oh and I know you like your colour grad shot's BTO so have included one.
SOOO, to finalize , no  I don't  own some 30K$ wizz bang 10 Gig phosphor oscilloscope, 3.2Spec analyzer is as high as I need (want) to go these days.


Over

[BTO]

Hi Kean & BTO
Sorry to disappoint you both but it is only a  cheapish unit (pic below) purchased from AliExpress about 8 months ago from memory, to check the validity of a batch of 25, MC12095 single modulus prescaler ic's for  frequency division of a 2.5 GHz input signal, datasheet below.

Kean, output voltage is set to approx 300mV  for the input of the chip (12095's) which work from sine waves. 

It does create a nice sine form about 200Mhz up to 4.2 Gig that a collegues Oscilloscope kindly showed.
The highest my MSO would show freq counter wise was about 1.053 Ghz unreliably, about same as yours BTO.
Kean, in relation to the output from my Sig Gen as shown, it stays within 2.1dbmv from the 300Meg to ~1 Gig , as the set up was also plugged into my 3.2Gig Spec Analyzer.
I was stepping it at about 800mS/step & 50 Megs but took forever.
I suggest that if you watch the you tube link to the sweep below link to slow it to compare V/F.
I did find one screen shot I managed at 1.5Gig which you will have to count the divisions to believe me. Oh and I know you like your colour grad shot's BTO so have included one.
SOOO, to finalize , no  I don't  own some 30K$ wizz bang 10 Gig phosphor oscilloscope, 3.2Spec analyzer is as high as I need (want) to go these days.

Over

Hi Kean & BTO
Sorry to disappoint you both but it is only a  cheapish unit (pic below) purchased from AliExpress about 8 months ago

... And here i am thinking that you actually some cool shit worth $30k or above

No, but on a serious note, what got me was...
- You have your Sig Gen and you're producing Sine waves pretty cleanly at around 1V/div
- Now me using my WB-SG1 ... I mean it goes to 8GHz  but the amplitude is low as hell, in the mV range even only 10s of mV's

so i'm wondering, How did you achieve that.  My unit says it does 3V pk/pk  BUT THERE'S A CATCH...
The unit has 2 Channels, Ch 1 does up to 200MHz  at 3.3V Pk/Pk  (however it doesn't always stay on 3.3V)
CH2 starts at 80MHz and makes it up to 8GHz  However it's not 3.3V Pk/Pk it's generally under 500mV

Unlike Traditional Sig Gen's that have multiple waveforms and the ability to select a Voltage up to a preset max, This Sig Gen, which i bought for the sole purpose of seeing
how high in frequency the scope can go, Only supports sine wave (Technically.. Square wave, then it builds on it to form a Sine then it goes back to Square and sometimes transitioning through Sawtooth)
so basically it only has 1 wave (Whichever if feels the need to do ) so you can't select the amplitude of waveform.
it's still ok though, but i think it would have been smarter if it was 5V and not 3.3 because unless it's 5V,  it's useless for things like TTL
so yeah that's why i thought you had a monster of a Sig Gen

The highest my MSO would show freq counter wise was about 1.053 Ghz unreliably, about same as yours BTO.

- Thanks, that's good to know that it's the roughly the same

Oh and I know you like your colour grad shot's BTO so have included one.

- LOL    No actually, let me just clarify this so there is no misunderstanding , I don't want anything thinking that i'm on some psychadelic trip

The shots i provided with color grade were just really to illustrate one thing i noticed.

BEFORE THE 500MHz upgrade and timebase going to 500ps  I ABSOLUTELY observed that my scope worked fine but when color grade was activated it just slowed the firetruck down

From when i bought it... had a poke around, then later i did my video course (Deep Dive) and i got to play with it quite a bit and still whenever on color grade it would chew up resources and
become really slow

AFTER THE UPGRADE TO 500MHz ,  i noticed a few things very quickly
1. the presence of the timebase going to 500ps
2. Colour grade could be switched on and not drag down the scope
3. I could then put it into deep memory , still won't bat an eyelid,  no pauses no nothing
4. to push my luck i could thn put in High Resolution acquistion mode.... Still .. all good
5. and i could do this on a fast timebase and as slow as perhaps 2s / Div

So i posted those shots to show that
It's not that i use color grade all the time, Although since it now works without a problem i can see how it would be useful from time to time.
Before it was more like..... Rigol, why the hell did you put this in if it causes the scope to be as slow as firetruck ?

that's what it was.


YOU KNOW WHAT, I'M GOING TO START A NEW POST 
This post is doing to be dedicated to testing the bandwidth of the MSO5000

[BTO]

OK , SO WE DON'T CLUTTER THIS TOPIC WITH IRRELEVANT STUFF

I HAVE CREATED ANOTHER TOPIC
I suggest we continue this testing conversation over there,

https://www.eevblog.com/forum/testgear/testing-the-rigol-mso5000-series-oscilloscope/new/#new

[Jeronimooooooo]

Hello friends, can anyone help me?

I bought the MSO5074 some time ago, it already came in version 1.3.2.2 with some options installed over a period of time.

I followed the steps to unlock, made the backup, installed version 1.3.2.2, the options did not uninstall.
I updated to 1.3.3.0, the options didn't uninstall either.
I downgraded to 1.3.2.2 and they are still there!
I tried following step 16 "python Rigol_MSO_LicensingUtility_2.10b.py –u x.x.x.x" it appears that it has been uninstalled, but when I restart it it is still there! Can anyone help me?

╒═══════════════╤══════════╤═════════════════════════════════════════════════════╕
│ OPTION CODE   │ STATUS   │ DESCRIPTION                                         │
╞═══════════════╪══════════╪═════════════════════════════════════════════════════╡
│ 2RL           │ ----     │ 200Mpts Deep Memory Option                          │
├───────────────┼──────────┼─────────────────────────────────────────────────────┤
│ COMP          │ 1528min  │ Computer Serial Triggering and Analysis(RS232/UART) │
├───────────────┼──────────┼─────────────────────────────────────────────────────┤
│ EMBD          │ 1528min  │ Embedded Serial Triggering and Analysis(IIC, SPI)   │
├───────────────┼──────────┼─────────────────────────────────────────────────────┤
│ AUTO          │ 1528min  │ Automotive Serial Triggering and Analysis(CAN/LIN)  │
├───────────────┼──────────┼─────────────────────────────────────────────────────┤
│ FLEX          │ 1528min  │ FlexRay Serial Triggering and Analysis              │
├───────────────┼──────────┼─────────────────────────────────────────────────────┤
│ AUDIO         │ 1528min  │ Audio Serial Triggering and Analysis(I2S)           │
├───────────────┼──────────┼─────────────────────────────────────────────────────┤
│ AERO          │ 1528min  │ MIL-STD 1553 Serial Triggering and Analysis         │
├───────────────┼──────────┼─────────────────────────────────────────────────────┤
│ DG            │ ----     │ Dual Channel WaveGen 25 MHz AWG                     │
├───────────────┼──────────┼─────────────────────────────────────────────────────┤
│ PWR           │ ----     │ Integrated Power Analysis                           │
├───────────────┼──────────┼─────────────────────────────────────────────────────┤
│ BW07T1        │ ----     │ 70MHz to 100MHz Bandwidth Upgrade Option            │
├───────────────┼──────────┼─────────────────────────────────────────────────────┤
│ BW07T2        │ ----     │ 70MHz to 200MHz Bandwidth Upgrade Option            │
├───────────────┼──────────┼─────────────────────────────────────────────────────┤
│ BW07T3        │ ----     │ 70MHz to 350MHz Bandwidth Upgrade Option            │
╘═══════════════╧══════════╧═════════════════════════════════════════════════════╛
UNINSTALLING Activated Options......
==================================================
....**DO NOT DISCONNECT POWER OR DATA CABLE** ....
==================================================
UNINSTALLING... **** COMPLETED ****
REBOOTING...
Waiting for device to be back online..........................................................DONE - PREPARE FOR REBOOT
REBOOT COMPLETED
**** DEVICE ONLINE ****

Do I try to patch with these options enabled? Is there any risk?

Thanks

[hussamaldean]

Hi all,
is it still possible to to hack RIGOL MSO5000?
In noticed the latest version is 01.03.03.00.
Is this version hackable or not?

[BTO]

Hi all,
is it still possible to to hack RIGOL MSO5000?
In noticed the latest version is 01.03.03.00.
Is this version hackable or not?

Weird Question......
i can only assume you're reading very old posts.

it has been possible to (as you call it) "HACK"   the correct term is UNLOCK or LICENSE  the MSO5000 on version 1.3.3.0
for a very very very long time now

this version is ABSOLUTELY Hackable

i think the more appropriate question is..... WHAT METHOD ARE YOU USING ?

So, you should understand

1. The first Method, which we called THE PATCH METHOD did have issues on version 1.3.3.0
    it also didn't license the scope correctly and it also had the downfall of...  You have to keep repatching on every single upgrade version.

We no longer have that problem, that's a thing of the past now

3. The current Method is the FULLY LICENSED METHOD
so now... You don't need to worry about
- Which version you are on
- Patching
- Whether you're going to be able to upgrade your scope in the future

THAT'S ALL SORTED

What you do now is this....

go here
https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-dr-mefisto-licensing-method/

Go to the cloud
Download the 1.3.3.0 GEL file and if your scope is not already on that version, then just upgrade it before you start.

Grab the PDF and follow the instructions

Grab the python script  2.10b

that's all you're going to need

we have developed the script now to a point where

- it's much faster than it was
- There are less steps involved for you
- There is very very little risk of you bricking your scope, Unless you do something really really dumb. and you'd have to try hard to do that at this poin in the game. 

You're going to find that you just need to run the script
and then before you know it, your scope will be upgraded and properly licensed and you'll be happy as a cucumber .
this method will get your scope unlocked to 350MHz

get that done first.

we do have a Method to unlock the scope to 500MHz
this method has more risks associated with it and is more technical , but can certainly be done

Just get it to 350MHz first and see how you go and if you need more than that

BUT YES IT'S ABSOLUTELY POSSIBLE TO UNLOCK THE SCOPE WITH VERSION 1.3.3.0

and.. After doing all this, You will NEVER have to hack your scope again,
when future firmware updates come out.  YOU JUST DOWNLOAD THEM AND UPGRADE THE SCOPE AS PER THE NORMAL RIGOL PROCEDURE.
Nothing to worry about .  it will all be there and survive the upgrade.

So.. it looks to me like you are a few years behind the 8 ball

[hussamaldean]

Just wanted to refresh my memory.
On last question, let say during the process, the oscilloscope shut down for power outage or ethernet communication lost and bricked my oscilloscope. Is it possible to bring it back to life?

[BTO]

Just wanted to refresh my memory.
On last question, let say during the process, the oscilloscope shut down for power outage or ethernet communication lost and bricked my oscilloscope. Is it possible to bring it back to life?

Just wanted to refresh my memory.

No problem

On last question, let say during the process, the oscilloscope shut down for power outage or ethernet communication lost and bricked my oscilloscope. Is it possible to bring it back to life?

- IF  very very very very very ........very very BIG "IF" your scope was actually bricked

well, it depends
IF..... You did your backups, Sure we POSSIBLY  could restore it
but then there is also a chance you couldn't.

it depends what was affected, Firstly the term "Bricked" is not a term that should be used with Oscilloscopes.
In short, if we were writing to the FRAM and there was a critical piece of it being written to that was responsible for the basic startup of the scope
then.... NO. you wouldn't be able
if it was something else... then you would be able to

and there is of course the small chance that even if it couldn't start up, we could re flash it.

so on this special of MYTHBUSTERS   we are going to call it   PLAUSIBLE     

But understand a few things

- i have personally helped approx 300 odd people get over the line , some got close to stuffing things up.  BUT NO ONE EVER BRICKED THEIR SCOPE.
i had a few people tell me they bricked it, but it wasn't actually bricked

- these problems occurred more frequently when there was a 2min or so wait time for writing to the FRAM because anything could happen.
a Lightning storm, Power outage, whatever.   Now .. it takes seconds for the actual critical writing process

- that in turn brings the likelihood of bricking down drastically

- Then i have also included reminder messages in the upgrade process to remind you.. check the power, check the ethernet connection etc etc.
there really is only a small window when you can royally stuff your scope

i am yet to see a person who has actually done it..

WOULD YOU LIKE TO BE THE FIRST............. WE'LL MAKE YOU A TROPHY 
because.. if you pulled that off... Honestly. that's an achievement

[Maol]

Code: [Select]

python rigol_mso_util_2.13b.py --offline --sysvendor-file sysvendor.bin --use-sysvendor-key rigol_dec_sysvendor_7767455A7645643701770077456876A8_17301535015725.data --model MSO5504
python rigol_mso_util_2.13b.py --offline --sysvendor-file sysvendor.bin  use-sysvendor-key rigol_dec_sysvendor_7767455A7645643701770077456876A8_17301535015725.data --model MSO5504
python rigol_mso_util_2.13b.py --offline --sysvendor-file sysvendor.bin  use-sysvendor-key rigol_dec_sysvendor_7767455A7645643701770077456876A8_17301535015725.data --model MSO5504
python rigol_mso_util_2.13b.py --sysvendor-key 10.1.1.140
python rigol_mso_util_2.13b.py --offline --sysvendor-file sysvendor.bin  use-sysvendor-key COPY YOUR KEY HERE --model MSO5504

Hello BTO,

Thank you for all your work. 

I tried your method here :
https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg5657031/#msg5657031

Then I tried the update here :
https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg5698755/#msg5698755

It doesn't work for me 
Here is the result of --save-vendor :

Code: [Select]

Reading sysvendor.bin ...done!
Saved sysvendor to 'rigol_sysvendor_17337623951672.data'

Here is the result of --sysvendor-key --sysvendor-key-slow :

Code: [Select]

Reading sysvendor.bin ...done!
Looking for sysvendor.bin key... --== Don't poke the bear. Please be patient ==--failed!

Here is the result of --sysvendor-key --sysvendor-key-fast :

Code: [Select]

Reading sysvendor.bin ...done!
Looking for sysvendor.bin key... --== Don't poke the bear. Please be patient ==--done!
Timers - memory dump: 0.0716 sec | download dump: 0.0314 sec | find key: 0.1679 sec
Device XXTEA key [B8A754A897A647B801770073432E3542] was found after checking 46404 possible keys
Saving decrypted sysvendor.bin locally...done!
sysvendor.bin data:
  size=260 ok! | crc32=1BE11195 [467734933] ok!
Traceback (most recent call last):
  File "C:\Users\manse\Documents\Hobbies\Electronique\RIGOL MSO5000\changeModel\rigol_mso_util_2.13b.py", line 1052, in <module>
    main()
  File "C:\Users\manse\Documents\Hobbies\Electronique\RIGOL MSO5000\changeModel\rigol_mso_util_2.13b.py", line 947, in main
    rigol_sysvendor.print_data(svd, act_key)
  File "C:\Users\manse\Documents\Hobbies\Electronique\RIGOL MSO5000\changeModel\rigol_mso_util_2.13b.py", line 671, in print_data
    decdata = xxtea.decrypt(vdata, xxtea_key, padding=False)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ValueError: Data length must be a multiple of 4 bytes and must not be less than 8 bytes

Both files are created but I can't use the third command.
With dashes:

Code: [Select]

Error: --use_sysvendor_key must be hex

Without dashes :

Code: [Select]

rigol_mso_util_2.13b.py: error: one of the arguments --cfram-file --sysvendor-file is required

BTW I was unsure it was a good idea to send the third comman because I didn't find the "before you start make sure you add sshd at boot" howto.

Can you please help me ?
And give a link to the sshd method. 

Regards,
Olivier

[Bill3745]

Has any work been done on "decoding" the various calibration files (cal.hex, adccat.hex, dgCal.hex, etc.)?  I'm wondering if it would be possible to tune the output of my built-in AWGs to be a little more accurate and meet their flatness specifications.  I did an initial search of the forum and nothing jumped out, so apologies if this has already been discussed.

[BTO]

Has any work been done on "decoding" the various calibration files (cal.hex, adccat.hex, dgCal.hex, etc.)?  I'm wondering if it would be possible to tune the output of my built-in AWGs to be a little more accurate and meet their flatness specifications.  I did an initial search of the forum and nothing jumped out, so apologies if this has already been discussed.

No, no problem at all. to my knowledge we haven't tweaked or even touched the AWG.
we have just been pre occupied with the unlocking part of it.
Although now it seems that things have gotten really quite surrounding the MSO5000

[Maol]

Both files are created but I can't use the third command.

Well, I figured out that I didn't read correctly your guide.
So the 3rd command is :

Code: [Select]

python rigol_mso_util_2.13b.py --offline --sysvendor-file rigol_sysvendor_17337880371446.data --use-sysvendor-key B8A754A897A647B801770073432E3542 --model MSO5504

BTW, the result is :
sysvendor.bin data:
  size=260 ok! | crc32=1BE11195 [467734933] ok!
Traceback (most recent call last):
  File "C:\Users\manse\Documents\Hobbies\Electronique\RIGOL MSO5000\changeModel\rigol_mso_util_2.13b.py", line 1052, in <module>
    main()
  File "C:\Users\manse\Documents\Hobbies\Electronique\RIGOL MSO5000\changeModel\rigol_mso_util_2.13b.py", line 854, in main
    rigol_sysvendor.print_data(svd, act_key)
  File "C:\Users\manse\Documents\Hobbies\Electronique\RIGOL MSO5000\changeModel\rigol_mso_util_2.13b.py", line 671, in print_data
    decdata = xxtea.decrypt(vdata, xxtea_key, padding=False)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ValueError: Data length must be a multiple of 4 bytes and must not be less than 8 bytes

I understand that my key length must be a multiple of 4 bytes and must not be less than 8 bytes and ... wait! It IS a multiple of 4 bytes and it IS 32 bytes!

With two spaces instead of -- I have the following error message :

Code: [Select]

C:\>[...]\python rigol_mso_util_2.13b.py --offline --sysvendor-file rigol_sysvendor_17337880371446.data  use-sysvendor-key B8A754A897A647B801770073432E3542 --model MSO5504

rigol_mso_util_2.13b.py: error: unrecognized arguments: B8A754A897A647B801770073432E3542
Any advice ?

For those who need the sshd on boot activation command, it is :

Code: [Select]

python3 rigol_mso_util_2.13b.py --ssh --start-ssh-on-boot <rigol_ip_address>

Regards,
Olivier

[exider]

@BTO
Hi mate,

I have a quick question as I’ve run into some problems with the whole downgrade/upgrade process.

I was experiencing freezing issues and decided to downgrade/upgrade, but the GEL file (03.02.02) was rejected. Could you please confirm if my hash is correct? I downloaded all firmware versions from your Mega folder.

Here’s the hash I got:

Code: [Select]

00.01.03.02.02> sha256sum.exe .\DS5000Update.GEL  
3823b61b45bf7d79fed4980fc692e121dc4df2454461d85f75d3c6cc05a4f079 *.\\DS5000Update.GEL  

Is this the correct hash?

If the hash is correct, could the rejection be due to the model number? I’m using the 5504 in this case.

Thanks in advance for your help!

[Bill3745]

Has any work been done on "decoding" the various calibration files (cal.hex, adccat.hex, dgCal.hex, etc.)?  I'm wondering if it would be possible to tune the output of my built-in AWGs to be a little more accurate and meet their flatness specifications.  I did an initial search of the forum and nothing jumped out, so apologies if this has already been discussed.

No, no problem at all. to my knowledge we haven't tweaked or even touched the AWG.
we have just been pre occupied with the unlocking part of it.
Although now it seems that things have gotten really quite surrounding the MSO5000

Thanks for the quick reply.  I know some work was done on one of the files (lfcal.hex, I think) way back when people were experiencing overshoot issues, but I didn't find any details on the file format posted.  Out of curiosity, have you looked at how well your AWGs maintain amplitude flatness over frequency?  The spec states +/-0.5 db from a 1 KHz reference.

[mwb1100]

I was experiencing freezing issues and decided to downgrade/upgrade, but the GEL file (03.02.02) was rejected. Could you please confirm if my hash is correct? I downloaded all firmware versions from your Mega folder.

Here’s the hash I got:

Code: [Select]

00.01.03.02.02> sha256sum.exe .\DS5000Update.GEL  
3823b61b45bf7d79fed4980fc692e121dc4df2454461d85f75d3c6cc05a4f079 *.\\DS5000Update.GEL  

I am not @BTO but that hash matches the one I have from a firmware package I downloaded in January 2023 from:

  - https://supportcn.rigol.com/Public/Uploads/uploadfile/files/ftp/Firmware/MSO5000(ARM)Updatev00.01.03.02.02.zip

(note that the URL is now 404).  I haven't tried to downgrade so I can't confirm anything other than the hash matches.