Hacking the Rigol MSO5000 series oscilloscopes

[budronator]

Hi BTO!
Thank you for your detailed answer.
To my shame, I didn't read the thread carefully and didn't know that the 2.10b version of the script was specifically created for the MSO5000 series.
I got the desired 500 MHz and a model change to MSO5504 and I am very happy) Special thanks to @reztek
Have a nice day, guys!

[BTO]

Great job @reztek !
Special thanks to Claude AI !
Everything looks great on the scope now))

╒═════════╤═══════════════╤════════════════╤═══════════════════╤═════════════╕
│ Model   │ Serial        │ Version        │ MAC               │ Lic Model   │
╞═════════╪═══════════════╪════════════════╪═══════════════════╪═════════════╡
│ MSO5504 │ MS5A275XXXX │ 00.01.03.03.00 │ 00-19-AF-XX-XX-XX│ MSO5504     │
╘═════════╧═══════════════╧════════════════╧═══════════════════╧═════════════╛

JUST A FOLLOW UP

Point 1 -   RE THIS POINT

In lines 662 and 708 of "rigol_mso_util_2_13b_fixed (1).py" the calls to

Code: [Select]

to_bytes(4) have been changed to

Code: [Select]

to_bytes(4, byteorder='little')
That changes the behavior (the default byteorder is 'big').

I don't know if those changes do anything harmful, but it would be good to understand why they were made.

it's not line 662  it's line 663

Code: [Select]

crc32 = "%08X" % int.from_bytes(val_data[:4], "little")
also happens on Line 669 and 670

Code: [Select]

dsize = int.from_bytes(val_data[4:8], "little") # string size

Code: [Select]

asize = int.from_bytes(val_data[8:12], "little") # total size
Then we have Line 707 and 708

Code: [Select]

dsize = int.from_bytes(val_data[4:8], "little") # total size

Code: [Select]

asize = int.from_bytes(val_data[8:12], "little") # string size
as you can see the default is not "big"  it's "little"  this is not modified this is how it was originally.
My guess would be that someone downloaded the script and modified it and then others passed it onto others forgetting that it was modified.

Line 714 is not broken.
this is Line 713 to 716

Code: [Select]

            if kv.get(key_name) is not None:
                asize = len(kv[key_name])
                decdata = "\x00" * dsize
                decdata = kv.get(key_name) + decdata[asize:]
as for version 2.10b  it does not contain a Line 714, as it only has 690 lines.

Let me know if there's anything else that needs attention and i'll have a look at it as soon as i can.
if there is something broken, as always we are happy to fix it .
We do want the script to run as flawlessly as possible.

But ultimately this has worked for hundreds of people thus far and to my knowledge.  1 person for the MSO7000 and i think 3 for the MSO8000
and among all that , the 2.10b seems to work best for people with MSO5000 and the 2.13b seems to work best for people with 7000 and 8000 series.
but also works for MSO5000 when the 2.10b fails to do so.

Hope that helps

[BTO]

Hi BTO!
Thank you for your detailed answer.
To my shame, I didn't read the thread carefully and didn't know that the 2.10b version of the script was specifically created for the MSO5000 series.
I got the desired 500 MHz and a model change to MSO5504 and I am very happy) Special thanks to @reztek
Have a nice day, guys!

NO PROBLEM MATE.
This thread is so long now that , in all fairness it's hard for newcomers to absorb it all.
A lot of us have contributed to this and i myself have tried to  make things easier and posts shorter.
i remember back in the DS2000A days we had "The Monster Post" and then i created "The Short Post"
and then the short post became another monster post.  what are you gonna do ?

Same thing here. My idea for creating this post
https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-dr-mefisto-licensing-method/
was that everyone would just go to the first page, Post 1 and read that an activate their scope.
As you get deeper, people start to forget about page 1 and comment 1.
So i've put in effort to keep repeating it every now and then.

Ultimately, most people activate without issue, a few people stumble up here and there.
Example : you activated your first scope without issue and the second one tripped up
(and it is interesting, Because you would have used the same script 2.13b on both scopes, it's interesting from a firmware point of view
  as to why 1 scope went through without issue but the second failed) this is largely firmware based

At the end of the day, We escalated from the DS2000A post and went to the MSO5000 this post (no one thought about 7000 and 8000 series at that point).
we had around 11 versions of the script before we settled on 2.10b  the first 5 versions or so involved the same process but it was longer
and you had to wait maybe 1-2 mins for activation.
Most of the waiting time was the script reading through irrelevant parts of memory until it got to the XXTEA key and modified it.
that long wait time did 2 things

1. it confused people as to.... is my scope bricked and is this still working ?
2. it increased the change of.... if a power loss happened your scope would be bricked.

so we decided to just focus on jumping to the specific memory address and changing the key, this reduced the activation time from minutes to seconds.
after that , no one had freezing issues anymore.

Once the MSO5000 script was finished, we added some cosmetic things , I added some things like  ***** Please Wait   and  ***** Restarting now
and things like that to keep people in the loop of what was happening and i added the stars so as to remove doubt of freezing or not.
we made it look a little prettier, we added more detail
we added some back end troubleshooting stuff in case we needed it , which we rarely did.
we added some SSH stuff etc etc

so the 2.10b had a lot of work put into it
after that we focused on 7000 and 8000 series  because this person created an MSO8000 post and wanted an activation.
but then we tried to see how much bandwidth we could actually squeeze out of it as well and to see if other features like Power analysis and Eye Analysis
could be squeezed out of it, Unlike with the patch method, where that was added but not actually supported by the scope, we realized
Eye Analysis is not actually possible from the MSO500 series.
so.. it has been an interesting journey indeed and i have learned a lot from it.

that's what i like about EEV Blog (I have a lot of knowledge about Electronics, I.T. and Telecomnunications)
but i always find myself learning more .  and.... AT MY AGE 52  that is a very welcomed thing.

so yeah... Glad to hear you've activated both scopes.

NOW YOU CAN HEAD OVER (if you like) TO LEARN EVERYTHING ABOUT YOUR SCOPE
AND DOWNLOAD THE VIDEO SERIES THAT I CREATED

The "Deep Dive"
https://www.eevblog.com/forum/testgear/post-hacking-rigol-mso5000-post-hacking-tutorial-deep-dive

the idea here is...
If you want to get beyond just knowing the basic functions of your scope
If you want to know your scope in depth
then this course is for you. it's a long course and do it in your own time, but it's definitely informative.

BE COOL

[hafrse]

Hello,

How can I upgrade to the 500 Mhz bandwidth?  my rigol is now on 350 Mhz . thanks

[toddkrein]

Let me start by thanking all the folks (primarily BTO) that did all the hard work to get this work done, I greatly appreciate it.

I was ultimately successful (after about seven hours) getting my MS)5074 to a 5504 with all the options but FFS it was WAY more difficult than it should have been.

I'm using Win11, Python 13.14.5, FW 00.01.03.02.02, and running rigol_mso_util_2.13b.py.

*EVERY* line in the five suggested steps threw python errors. Even the 'fixed' versions didn't work for me. So I took some time and tried to fix the script. (Python3's differentiation between strings and byte-strings still don't make any sense to me.)

I'm enclosing my 2.13c version for perusal and as an alternative to anyone else who has whatever combination of config that causes problems. My little contribution to the great work.

edit: Not sure what's wrong, but I wasn't able to download the items from the .nz website. It just kept hanging.

[connectTek]

Just bought a MSO5074 Fully hacked to 350Mhz with all options in as new condition for $736 AUD.
Love it.
Now to sell my hacked DS1104Z.
😁

[mabl]

Maybe of interest to some of the folks here: I have finally finished writing my python library to talk to the MSO5000 scope after 6 years - now that AI can finish the tedious work. If you are interested, check out https://github.com/mabl/pyMSO5000 - it really is high quality code that will make your life easier.

What is also really neat to use is its integrated MCP server. That allows your AI agent to talk to the scope while debugging an MCU problem, for example. I have just used it in a bring-up of a PIC23 board with rust-based firmware - for a PIC32 variant that has no public rust support. Feedback would be more than welcome - just drop a line on the github project.

[mikehoopes]

Maybe of interest to some of the folks here: I have finally finished writing my python library to talk to the MSO5000 scope after 6 years - now that AI can finish the tedious work. If you are interested, check out https://github.com/mabl/pyMSO5000 - it really is high quality code that will make your life easier.

What is also really neat to use is its integrated MCP server. That allows your AI agent to talk to the scope while debugging an MCU problem, for example. I have just used it in a bring-up of a PIC23 board with rust-based firmware - for a PIC32 variant that has no public rust support. Feedback would be more than welcome - just drop a line on the github project.

Appreciate the work here, and just getting started on the installation. First thing: the cmd line install string appears to need -tspspi appended to it.
---
pip install pymso5000
Defaulting to user installation because normal site-packages is not writeable
ERROR: Ignored the following versions that require a different python version: 0.1.0 Requires-Python >=3.14; 0.2.0 Requires-Python >=3.14
ERROR: Could not find a version that satisfies the requirement pymso5000 (from versions: none)
ERROR: No matching distribution found for pymso5000

--https://www.google.com/search?q=Could+not+find+a+version+that+satisfies+the+requirement+pymso5000

pip install pymso5000-tspspi
Defaulting to user installation because normal site-packages is not writeable
Collecting pymso5000-tspspi
  Downloading pymso5000_tspspi-0.0.10-py3-none-any.whl.metadata (4.7 kB)
Collecting pylabdevs-tspspi>=0.0.11 (from pymso5000-tspspi)
  Downloading pylabdevs_tspspi-0.0.18-py3-none-any.whl.metadata (2.5 kB)
Requirement already satisfied: numpy>=1.22.4 in .\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.13_qbz5n2kfra8p0\LocalCache\local-packages\Python313\site-packages (from pylabdevs-tspspi>=0.0.11->pymso5000-tspspi) (2.4.6)
Downloading pymso5000_tspspi-0.0.10-py3-none-any.whl (11 kB)
Downloading pylabdevs_tspspi-0.0.18-py3-none-any.whl (20 kB)
Installing collected packages: pylabdevs-tspspi, pymso5000-tspspi
Successfully installed pylabdevs-tspspi-0.0.18 pymso5000-tspspi-0.0.10

--

Ok, tspspi is a different github user, so that installation is not the mabl one with the MCP server.
I'm stumped as to how to proceed here.