Hacking the Rigol MSO5000 series oscilloscopes

[rolfdegen]

This is my 100 kHz pulse generator with Teensy4 (1GHz overclocking) and MSO5104 (350MHz hack). The best rise time is 1.12 ns. I measured directly at the BNC connector without a 50 ohm termination. Teensy4 output buffer impedance is 23R.

[BRZ.tech]

Hello
@rolfdegen
I tried using the nanoVNA square wave generator, which you can use a good 50 Ohm cable, and put a 50 Ohm load on the input of your MSO5000.

I used the nanoVNA H. As for the signal frequency, I suggest using higher than 10MHz. But it is worth doing several experiments.

I got the rise time lower than 1ns.

Good luck. 73.

[rolfdegen]

New measurement with a self-built Avalanche Pulser (Jim Williams). Pulserate is 106KHz

DIY Pulser

[rolfdegen]

This is without 50R resistor at the oscilloscope input and 50R coax cable (50cm long) at capacitor C1



And this is with 50 R resistor at the oscilloscope input and 50R coax cable (50cm long) at capacitor C1



And this is with 50 R resistor at the oscilloscope input and without  50R coax cable

[rolfdegen]

This is my Pulser on old Hameg HM203-6 scope 

[6SN7WGTB]

You get the same results as I do. We are at the ‘scope limit I think.

[rolfdegen]

There's news from me here...  https://www.eevblog.com/forum/blog/eevblog-306-jim-williams-pulse-generator/625/

[djidji]

Just went through this process successfully using vadimcreates' older guide - which was super helpful (I was lost before that). 

I updated their guide and made a collection of the files I used to update my 5074 bought in March 2025: https://www.dropbox.com/scl/fi/nopj4f3dm9uhodiv9ywl0/vectorstofinal-update-MSO5xxx.zip?rlkey=zkbu1cx6w6gayx2ijb85a4i8g

OK.....
1. I'm happy you got your scope activated
2. (Although you didn't)   YOU PATCHED YOUR SCOPE

3. Everyone always appreciates when you do something to contribute and then you go out of your way to upload all that to a cloud.... Thank you.

4. Although you need to understand a few things
    - There's no need for people to SSH Into the scope (it causes confusion and adds complexity for the newbies)
    - THE PATCH METHOD IS NOW WELL OUTDATED

5. The Patch Method doesn't survive firmware updates
    As a result TVS84  and DrMefist0 worked out the first PROPERLY LICENSING METHOD.  that's the one you should be using.
   it should also be obvious that the method you used was old because it put you on version 1.3.2.2 and called it "The Latest"  we are on 1.3.3.0 at the moment

6. Here is the link to the current method
https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-dr-mefisto-licensing-method/

Here is the direct link to the download for activation (on the cloud)

https://mega.nz/folder/A8cEgQRI#5FSoMrCurJi71T7VkRPgYQ

so now, from where you are, You can run the new script and select Uninstall as the switch.
then follow the PDF
Now you've already done your backup stuff. so you can skip that part and go straight to licensing FYI

but yeah.. the method that you read is as old as approx 2018 or so ,
do what you like, but really, you should be using the current method as in the future it will mean you just need to download the .GEL file from Rigol officially
and you won't lose your unlocked options.

I mean.. Were you aware of this method ?

It worked like a charm on MSO7014!!! 

Thank you!!

[std]

I finally decided to ask because I risk looking stupid. I have been working with Rigol MSO5074 for a long time. But what I really don't like is that the oscilloscope's probe divider setting is constantly reset. So, before I start working with the oscilloscope, I have to go into the settings of each channel and set the probe divider to 1:10

Yes, there is an option to remember the oscilloscope state and return to it the next power on. In this case, the probe divider setting is saved with other settings, like beam offset, channel Y-amp gain, etc. However, I don't like this. I always like to start from scratch. And I constantly have to set the probe divider to 1:10. This irritates me.

Neither the Rigol DS1054Z nor the Lecroy WaveRunner have this problem, i.e. clean startup for them does not reset the probe divider to 1:1. MSO5074 should not reset the probe divider, but it does!

The question is - did I miss something?

[BTO]

I finally decided to ask because I risk looking stupid. I have been working with Rigol MSO5074 for a long time. But what I really don't like is that the oscilloscope's probe divider setting is constantly reset. So, before I start working with the oscilloscope, I have to go into the settings of each channel and set the probe divider to 1:10

Yes, there is an option to remember the oscilloscope state and return to it the next power on. In this case, the probe divider setting is saved with other settings, like beam offset, channel Y-amp gain, etc. However, I don't like this. I always like to start from scratch. And I constantly have to set the probe divider to 1:10. This irritates me.

Neither the Rigol DS1054Z nor the Lecroy WaveRunner have this problem, i.e. clean startup for them does not reset the probe divider to 1:1. MSO5074 should not reset the probe divider, but it does!

The question is - did I miss something?

Firstly.. that's not a stupid question.

Secondly. Yes you did miss something
- There is the setting that returns the scope to the previous state upon a new restart (but as you're already aware, this doesn't work that great)
- There is a Method by which you can SAVE SETUP and create custom setups and then load them whenever you want.
it goes like this

FIRST WE CREATE A FOLDER TO STORE ALL THESE SETUP FILE
1. Select STORAGE / DISK / Enter the C Drive / NEW FOLDER
and create a new folder and save it

NOW WE CREATE A SETUP FILE
1. Setup your entire scope the way you want it to be

2. Navigate to INSIDE the folder you just created.

3. then do this...
STORAGE / SAVE SETUP
Change the FILENAME from RigolDSO to something more meaningful
Select SAVE

when you do this it takes a snapshot of your settings and saves it in an .stp File (Setup File)


You can create as many of these files as you like to cater to whatever situation you want to start in

RESTORING THE SETUP YOU NEED
STORAGE / LOAD SETUP
Navigate to the file and select LOAD

You will find this will be very easy to do after 2 or 3 tries

Let me know how that works out for you.
I also didn't like the things you described and then i learned about this and i've had no problems since

[std]

You will find this will be very easy to do after 2 or 3 tries. Let me know how that works out for you. I also didn't like the things you described and then i learned about this and i've had no problems since

Thank you. I knew there was a save and load to disk, but I didn't think that loading from disk would be much more convenient. I have to try it next time I work with an oscilloscope, since there is no other way. Thank you again for responding. I appreciate your help.

But how are other people doing? Guys, hello. Please respond. Do you set the probe divider each time, or do you load the settings manually each time? Have you set the option to load the previous state?

[Martin72]

Hi,
This has little to do with hacking the MSO5000. The appropriate thread for this topic is this one:
https://www.eevblog.com/forum/testgear/review-rigol-mso5000-tests-bugs-questions/msg5823955/#msg5823955

[Neekeetos]

Well, I've adjusted a spice model according to 750MHz peaking for 15nH and calculated values so peak should appear at ~1G. This gave 0.5pF+1pF & 10nH  for filter.  After some soldering i got no peaking at 1G , this probably means that at 1G there is no noise from frontend, and likely BW limit lies in its configuration bits. Rise time for modded channel is ~600ps , bit more than for zero resistors replacing filter.

Having scope open, I also covered TCXO with some foam, so it will not drift on any slight air flows around the scope. Now it is possible to look at OCXO at trigger shifts 0.1s and more. Appears as a useful modification.

Ok, removed input lc filters ( mentioned in quote , replacing inductors with 0R ) at ADC input. After unlocking scope to 500M model this does well beyond 600M , rise time with FPGA source is around 350ps

[Retired2]

MSO5354 Attempt to Change Model Failed with additional Issues

After trying to apply 5504 to this model:
As of today 08-11-2025
-= NEW sysvendor.bin =-sysvendor.bin data:
  size=248 ok! | crc32=60C0FE53 [1623260755] ok!

╒════════════╤═════════════════╤══════════════╤═════════════╤══════════════════╤════════════════════════╕
│   key_size │ key_data        │   value_size │ value_crc   │   value_str_size │ value_decrypted_data   │
╞════════════╪═════════════════╪══════════════╪═════════════╪══════════════════╪════════════════════════╡
│         15 │ E_CFG_MODEL_RAW │           56 │ 4B9626E7    │                4 │5504                │
├────────────┼─────────────────┼──────────────┼─────────────┼──────────────────┼────────────────────────┤
│         12 │ E_CFG_SN_RAW    │           52 │ E59DF54E    │               13 │           │
├────────────┼─────────────────┼──────────────┼─────────────┼──────────────────┼────────────────────────┤
│          9 │ E_CFG_MAC       │           56 │ 2AD8E37E    │               17 │      │
╘════════════╧═════════════════╧══════════════╧═════════════╧══════════════════╧════════════════════════╛
Saved sysvendor.bin_mod to 'rigol_sysvendor.bin_mod_17549309591026.data'
sysvendor file has been modified!
PS C:\Users\pspan\MSODump> python rigol_mso_util_2.13b.py --write-sysvendor --write-sysvendor-file rigol_sysvendor.bin_mod_17549309591026.data 192.168.1.4
╒═════════╤═══════════════╤════════════════╤═══════════════════╤═════════════╕
│ Model   │ Serial        │ Version        │ MAC               │ Lic Model   │
╞═════════╪═══════════════╪════════════════╪═══════════════════╪═════════════╡
│ MSO5354 │ │ 00.01.03.03.00 │ │ MSO5000     │
╘═════════╧═══════════════╧════════════════╧═══════════════════╧═════════════╛
╒════════╤══════════╤═════════════════════════════════════════════════════╕
│ Code   │ Status   │ Description                                         │
╞════════╪══════════╪═════════════════════════════════════════════════════╡
│ 2RL    │ Forever  │ 200Mpts Deep Memory Option                          │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ COMP   │ Forever  │ Computer Serial Triggering and Analysis(RS232/UART) │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ EMBD   │ Forever  │ Embedded Serial Triggering and Analysis(IIC, SPI)   │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AUTO   │ Forever  │ Automotive Serial Triggering and Analysis(CAN/LIN)  │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ FLEX   │ Forever  │ FlexRay Serial Triggering and Analysis              │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AUDIO  │ Forever  │ Audio Serial Triggering and Analysis(I2S)           │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AERO   │ Forever  │ MIL-STD 1553 Serial Triggering and Analysis         │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ DG     │ Forever  │ Dual Channel WaveGen 25 MHz AWG                     │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ PWR    │ Forever  │ Integrated Power Analysis                           │
╘════════╧══════════╧═════════════════════════════════════════════════════╛
checking /rigol/tools/fram ...done!
Reading FRAM data ...done!
Patching FRAM binary....done!
Rebooting device...Waiting for device to be back online................................................................done
OK then after reboot I got:
PS C:\Users\pspan\MSODump> python rigol_mso_util_2.13b.py --regen 192.168.1.4

Traceback (most recent call last):
  File "C:\Users\pspan\MSODump\rigol_mso_util_2.13b.py", line 1052, in <module>    main()
    ~~~~^^
  File "C:\Users\pspan\MSODump\rigol_mso_util_2.13b.py", line 881, in main    k_model = helpers.model_to_license_str(model)
 
File "C:\Users\pspan\MSODump\rigol_mso_util_2.13b.py", line 128, in model_to_license_str
    m = re.match(r'([A-Za-z]+)(\d+)([A-Za-z]*)$', model)
 
File "C:\Users\pspan\AppData\Local\Programs\Python\Python313\Lib\re\__init__.py", line 167, in match
    return _compile(pattern, flags).match(string)
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
TypeError: expected string or bytes-like object, got 'NoneType'

NOW
I have issues: NO Model shown in Web Control screen , Cannot login to Web Control with default Login / password but can use VNC viewer. l cannot enable SSH either. Bandwidth is still 350Mhz.
It appears all other scope functions work.

How can this be fixed?
Thank you for reading this and in advance for your help.

[w.v.s.]

Did you already try the reset-procedure?


https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg2250807/#msg2250807

[Retired2]

Thank you for replying.

Yes, I tried defaults and upgrade no avail.
I went into about which shows model etc. Attached picture which shows no model.

[BTO]

You will find this will be very easy to do after 2 or 3 tries. Let me know how that works out for you. I also didn't like the things you described and then i learned about this and i've had no problems since

Thank you. I knew there was a save and load to disk, but I didn't think that loading from disk would be much more convenient. I have to try it next time I work with an oscilloscope, since there is no other way. Thank you again for responding. I appreciate your help.

But how are other people doing? Guys, hello. Please respond. Do you set the probe divider each time, or do you load the settings manually each time? Have you set the option to load the previous state?

You're Welcome,
But.. I've already explained it to you
1. You save a setup file and as many as you need.
2. You ensure your scope is also set to Load LAST state
3. So when you turn your scope on it's in the default state, then you load the .stp file, after that each time you restart it will load the .stp file (Technically it loads the last state, but that is the state of the .stp)

if you wanted to change to another .stp then you can do that it'll load that everytime

[Retired2]

I can access Rigol via Putty:
<root@rigol>ls -la
total 5
drwxr-xr-x    2 root     root          1024 Aug 16 14:53 .
drwxr-xr-x   22 1000     1000          1024 Sep 25  2017 ..
-rw-------    1 root     root             7 Aug 16 14:53 .ash_history
-rw-r--r--    1 root     root             0 Jun  6  2016 .bash_history
-rw-r--r--    1 root     root           175 Jun  6  2016 .bash_logout
-rw-r--r--    1 root     root           161 Jun  6  2016 .bash_profile
<root@rigol>
Is there any way I can copy the "data" folder from the original "out of the box" backup to replace the current files on the scope?  I also have Fram and Nand backups as well.

I've learned my lesson well 

[Elektro]

Hello everyone,
First of all, thank you very much for your efforts, especially BTO. With the instructions and firmware, I was able to “update” my MSO5xx4 to MSO5354.

Now I would like to update my MSO5354 to MSO05504 and have already spent hours on this chat.

Current situation:
Firmware: 00.01.03.03.00
All options activated and functional.

I found the following instructions for the update to MSO5504:
https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/2975/
User: „BTO“
« Reply #2981 on: September 27, 2024, 05:29:30 pm »
“Hi Mick sorry for being a stranger, a lot has been going on.

Re your question about changing the Model Number

I can confirm you can now get the MSO5000 Up to 500MHz bandwidth instead of the posted 350MHz
and you're going to find that your timebase will go as fast as 500ps

YOU NEED TO CHANGE THE MODEL NUMBER TO  MSO5504
….”

However, I have a few questions about these instructions that I couldn't find answers to:

1. Are these instructions still up to date?
2. Are the instructions compatible with the above conditions (firmware and options)?
3. How do I put the MSO, the PC, or the MSO and PC into SSH mode?
4. It appears that code changes need to be made in the Python script (rigol_mso_util_2.13b.py).
  Is there a version that already includes the changes?

Thanks for the support.

[J-R]

https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg5657031/#msg5657031

https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg5742123/?topicseen#msg5742123

I personally didn't bother with making SSH start at boot.

[Elektro]

Thanks for the quick reply, but the "rigol_mso_util_2.13b.py" script doesn't seem to work (anymore).

- The SSH command no longer seems to exist:
python3 rigol_mso_util_2.13b.py --ssh --start-ssh-on-boot 192.168.137.246
-> ERROR
See screenshot 1

- If I try this:
python3 rigol_mso_util_2.13b.py --save-sysvendor 192.168.137.246
-> ERROR
See screenshot 2

[mwb1100]

the "rigol_mso_util_2.13b.py" script doesn't seem to work (anymore)

First of all, please copy/paste commands and output as text rather than images if possible (as in this case).  It makes it so much easier for others to determine what's going on because they can copy/paste the text themselves.

The problem with the `--start-ssh-on-boot` option is that it is supposed to be `--start-sshd-on-boot`

I don't know offhand what the problem is when the `--save-sysvendor` option is being used.


It might be useful to copy/paste the output of:

Code: [Select]

C:\>python --version -V
Python 3.10.0 (tags/v3.10.0:b494f59, Oct  4 2021, 19:00:18) [MSC v.1929 64 bit (AMD64)]


[J-R]

Big thing is you'll want to be following BTO's instructions published here: https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-dr-mefisto-licensing-method/
He has some exhaustive documentation and supporting files in his Mega share.

The 2.13b script 100% works.  I recently used it: https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-dr-mefisto-licensing-method/msg5938858/#msg5938858

[Elektro]

Hello mwb1100,

Thanks for correcting of "--start-sshd-on-boot". (Yes - I saw that too when debugging the code.)
I have used the link from J-R,
https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg5742123/?topicseen#msg5742123
and there is the code "python3 rigol_mso_util_2.13b.py --ssh --start-ssh-on-boot <rigol_ip_address>"

It is difficult to figure out what is right, what applies and what has changed.

here my Python-Version:

Code: [Select]

... \Rigol>python --version -V
Python 3.13.7 (tags/v3.13.7:bcee1c3, Aug 14 2025, 14:15:11) [MSC v.1944 64 bit (AMD64)]

I debugged the code in the file "rigol_mso_util_2.13b.py" and found that if I extend the arguments with --model MSO5504, the program runs and saves the file(s) as desired (Step 1 and 2 of the instructions in “Reply #2981”).
However, I don't dare to write these files (the result of the process) to the oscilloscope because I'm not sure whether the extension has an impact on the saved files.

In addition, step 3 of the instructions in “Reply #2981” also fails, with an error message stating that the file is not in HEX format.

[Elektro]

Hello J-R,

I think the link
https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-dr-mefisto-licensing-method/
is not what I need.
In my opinion, this describes the process for obtaining the “general” Oszi options up to 350MHz.

As I wrote in my first chat, I was able to successfully activate this option and all licenses are active.

Or have I misunderstood something?