EEVblog Electronics Community Forum

Products => Test Equipment => Topic started by: MattSR on December 25, 2014, 11:37:42 am

Title: Is the Rigol MSO1074Z hackable?
Post by: MattSR on December 25, 2014, 11:37:42 am
Hi all, apologies if this is covered elsewhere, but is the Rigol MSO1074Z hackable? I have searched here but found no real references to upgrading this model..

Cheers
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: Howardlong on December 25, 2014, 11:55:39 am
As it currently stands, you will need an appropriate JTAG debugger.

Smgvbest has an excellent how-to here https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg569236/#msg569236 (https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg569236/#msg569236) , far better than my attempt a few posts earlier which had been written some weeks after doing it (for reference here https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg566312/#msg566312 (https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg566312/#msg566312) )

Smgvbest says that the debugger she used is no longer made. I used an Olimex ARM-USB-OCD-H which is still available.
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: MattSR on December 26, 2014, 06:18:52 am
Hi Howard - that's fantastic info, it more than makes up for my lack of google-fu/search-fu!

I'll have a close read and figure out what I need to get to do this.

Thanks again,
Matt!
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: aviphysics on January 05, 2015, 10:14:47 pm
Hi,

would these hacks also apply to the MSO1074Z-S ?

Thanks in advance.
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: fldutchman on January 06, 2015, 04:32:55 am
I just tried the keygen with the riglol option, and had no luck with an MSO1074Z SW 00.04.01.SP2, board 2.1.1. Guess it's JTAG time. I'll post a follow-up when I've had a chance to try the JTAG approach.

--fdm
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: smgvbest on January 07, 2015, 07:09:13 am
MSO1074Z-S is hack-able.  there are several posts int he Rigol I2C thread and this but you must open the scope up and dump memory to get the keys. and you have to use a custom version of rigup to do it which is also posted in the thread.

My post is here https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg569236/#msg569236 (https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg569236/#msg569236)
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: kripton2035 on January 07, 2015, 07:34:40 am
use this excellent software to get the memorydump - dont void the warranty opening the scope or using jtag
http://peter.dreisiebner.at/rigol-bildschirmkopie-lan/#screenshot (http://peter.dreisiebner.at/rigol-bildschirmkopie-lan/#screenshot)
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: hammy on January 07, 2015, 11:29:37 am
use this excellent software to get the memorydump - dont void the warranty opening the scope or using jtag

... no, not possible with the MSO1000z. JTAG is the way to go.
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: kripton2035 on January 07, 2015, 02:15:51 pm
has been tested with DS1104Z :
(http://peter.dreisiebner.at/rigol-bildschirmkopie-lan/20140503_log.png)
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: Howardlong on January 07, 2015, 02:40:29 pm
How do you use the tool to extract a memory dump? At present I am unaware of a SCPI command that works with the DS/MSO1000Z series to perform a memory dump.
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: hammy on January 07, 2015, 02:43:51 pm
has been tested with DS1104Z :

yes, this part is working ... but ... the last time the scpi command for the memory dump was not implemented in the DS/MSO1000z series.

This is now possible? With the new firmware?
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: kripton2035 on January 07, 2015, 04:04:35 pm
I can't recall where, but there is a thread on eevblog where someone pointed me this tool and said it worked for his ds1054z
got the memory dump with a simple usb cable. it was in november or so
I dont have a rigol so I cannot say I personnaly did the hack with this tool.
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: smgvbest on January 07, 2015, 11:22:31 pm
I just did a search of eevblog for this website and the only link was in mention of the DS2000 not the DS1000

I just tried a :SYST:UTIL:READ? 15441920,13262848 using is and the same message on my MSO1074Z-S
There was an error when sending the SCPI command.

If someone can find the message mentioned that would be good but far as we know you can not dump memory thru SCPI on the DS1000Z series scopes.  Opening it and using JTAG is the only known way on these scopes

Also the OP is asking for the MSO1000Z series not the DS1000Z so maybe it does work on the DS1000Z I don't know I do not have one but that is not the OP's question
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: Howardlong on January 08, 2015, 12:00:52 am
Unless it can be shown otherwise, as it currently stands I agree, you need to use JTAG to get the memory dump for the DS/MSO1000Z series as they don't have a RAM read SCPI function. For the avoidance of doubt, for the DS1000Z series, you don't need the dump anyway. But you do for the MSO1000Z series.

Sounds like there's been a bit of hearsay at play, and internet hearsay at that!
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: MattSR on January 08, 2015, 01:06:52 am
For the avoidance of doubt, for the DS1000Z series, you don't need the dump anyway. But you do for the MSO1000Z series.

That lines up with all the research I have done on here.
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: smgvbest on January 08, 2015, 01:41:15 am
Sounds like there's been a bit of hearsay at play, and internet hearsay at that!

Yes, and we know just how reliable the internet can be.
I remember a saying,  Trust but Verify
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: aviphysics on January 08, 2015, 04:20:35 am
Unless it can be shown otherwise, as it currently stands I agree, you need to use JTAG to get the memory dump for the DS/MSO1000Z series as they don't have a RAM read SCPI function. For the avoidance of doubt, for the DS1000Z series, you don't need the dump anyway. But you do for the MSO1000Z series.

Sounds like there's been a bit of hearsay at play, and internet hearsay at that!

Why don't you need the dump for the DS?

Also, is there a possibility that someone will eventually be able to create a tool that can generate the codes from whatever number Rigol uses when you buy an upgrade?
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: Howardlong on January 08, 2015, 09:20:04 am
Unless it can be shown otherwise, as it currently stands I agree, you need to use JTAG to get the memory dump for the DS/MSO1000Z series as they don't have a RAM read SCPI function. For the avoidance of doubt, for the DS1000Z series, you don't need the dump anyway. But you do for the MSO1000Z series.

Sounds like there's been a bit of hearsay at play, and internet hearsay at that!

Why don't you need the dump for the DS?

Also, is there a possibility that someone will eventually be able to create a tool that can generate the codes from whatever number Rigol uses when you buy an upgrade?

The way the keys are generated are fundamentally different between the DS1000Z and MSO1000Z. I don't pretend to know the details of it, but that's how it is.
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: crispus on October 20, 2016, 01:33:32 pm
Is the version -s of there MSO hackable (MSO1074Z-S)?
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: Howardlong on October 20, 2016, 11:08:39 pm
Is the version -s of there MSO hackable (MSO1074Z-S)?

Yes, or at least it was when I did mine.
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: kripton2035 on October 21, 2016, 06:40:11 am
did you need a jtag method to hack your mso1074z-s ?
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: Howardlong on October 21, 2016, 07:34:49 am
did you need a jtag method to hack your mso1074z-s ?

Yes. The signal generator is just a bolted on daughter board, plus an extra button on the front panel. It makes no difference to the upgrade process. The thing that makes a difference is whether it's a DS1000Z, DS1000Z+ ot MSO1000Z: the first can be upgraded without the jtag procedure, the latter two need the jtag method as it stands. Recently there has also been some question as to whether newer plusses and MSOs are still all upgradeable. Certainly some are, but it's not clear yet whether those not successful are struggling with the procedure, or whether there's been a recent change preventing the method working.
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: scuff on January 25, 2017, 12:57:48 pm
Hi all,

I've just bought a brand new MSO1074Z-S, which I'm hoping to hack.  Can anyone confirm whether the hack mentioned here and in other linked threads is still working on the latest hardware and firmware?  My unit has:

Software version: 00.04.04.SP1
Board version: 6.1.4

Thanks in advance!
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: mikehs on January 26, 2017, 03:29:22 pm
Unless it can be shown otherwise, as it currently stands I agree, you need to use JTAG to get the memory dump for the DS/MSO1000Z series as they don't have a RAM read SCPI function. For the avoidance of doubt, for the DS1000Z series, you don't need the dump anyway. But you do for the MSO1000Z series.

Sounds like there's been a bit of hearsay at play, and internet hearsay at that!

Why don't you need the dump for the DS?

Also, is there a possibility that someone will eventually be able to create a tool that can generate the codes from whatever number Rigol uses when you buy an upgrade?

The way the keys are generated are fundamentally different between the DS1000Z and MSO1000Z. I don't pretend to know the details of it, but that's how it is.

I don't know if that is still the case.  I just got a new DS1054Z and tried the the Riglol1.03d keygen and got invalid.  I plan on playing a bit more with it before having to go the route of dumping.
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: ebastler on January 26, 2017, 04:05:25 pm
I just got a new DS1054Z and tried the the Riglol1.03d keygen and got invalid.  I plan on playing a bit more with it before having to go the route of dumping.

By all reports on this forum so far, the Riglol key generator still works for all regular DS1054Z scopes. (I.e. non-MSO and non Plus models.) Quite a few users have reported problems with the browser-based key generator, which could always be fixed by
Please have a look at the DS1054Z monster thread, working your way backwards -- there were a few recent posts on this, I believe.
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: mikehs on January 27, 2017, 12:03:01 am
Thank you for the help, it worked!

All newbies like me, you must delete all the characters in the SN entry box before entering your SN. I deleted up to the 'D', but that apparently does not work.
Title: Re: Is the Rigol MSO1074Z hackable?
Post by: typoknig on April 07, 2019, 05:19:42 am
As it currently stands, you will need an appropriate JTAG debugger.

Smgvbest has an excellent how-to here https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg569236/#msg569236 (https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg569236/#msg569236) , far better than my attempt a few posts earlier which had been written some weeks after doing it (for reference here https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg566312/#msg566312 (https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg566312/#msg566312) )

Smgvbest says that the debugger she used is no longer made. I used an Olimex ARM-USB-OCD-H which is still available.

Looks like the link you posted isn't quite right any more.  The apostrophe in "rigol's" breaks things.  Here is the correct link:

https://www.eevblog.com/forum/testgear/sniffing-the-rigol_s-internal-i2c-bus/msg569236/#msg569236 (https://www.eevblog.com/forum/testgear/sniffing-the-rigol_s-internal-i2c-bus/msg569236/#msg569236)