EEVblog Electronics Community Forum

Products => Test Equipment => Topic started by: Boscoe on February 07, 2016, 11:57:10 am

Title: MSO1104z hacking possible?
Post by: Boscoe on February 07, 2016, 11:57:10 am
Hi,

I need to hack my MSO1104z scope for the I2C decode option - might as well have all the others too!

I'm unable to do it atm. rigol.3owl.com is down and the other one (gotroot) only gives me an invalid code. Is there any other way of doing this? Is my scope compatible because it's mixed signal?

Thanks
Title: Re: MSO1104z hacking possible?
Post by: kripton2035 on February 07, 2016, 12:36:07 pm
you can use a wayback archive like this :
http://web.archive.org/web/20131215225141/http://riglol.3owl.com/ (http://web.archive.org/web/20131215225141/http://riglol.3owl.com/)
Title: Re: MSO1104z hacking possible?
Post by: CustomEngineerer on February 07, 2016, 05:13:12 pm
Maybe stupid question but are you using the MSO1000Z patched version of rigup (rigup-0.4.1-mso1000z.zip)? If not you can find it on gotroot.ca.
Title: Re: MSO1104z hacking possible?
Post by: Boscoe on February 07, 2016, 05:41:41 pm
Maybe stupid question but are you using the MSO1000Z patched version of rigup (rigup-0.4.1-mso1000z.zip)? If not you can find it on gotroot.ca.

I don't know what this is. Could you give me some more info?
Title: Re: MSO1104z hacking possible?
Post by: kripton2035 on February 07, 2016, 07:45:23 pm
he means here : http://gotroot.ca/rigol/riglol-103d/ (http://gotroot.ca/rigol/riglol-103d/)
Title: Re: MSO1104z hacking possible?
Post by: Boscoe on February 07, 2016, 08:08:29 pm
he means here : http://gotroot.ca/rigol/riglol-103d/ (http://gotroot.ca/rigol/riglol-103d/)

Yes, this doesn't work for me. It says it's invalid and I've tried a few unlock options - all didn't work.
Title: Re: MSO1104z hacking possible?
Post by: CustomEngineerer on February 07, 2016, 08:23:35 pm
he means here : http://gotroot.ca/rigol/riglol-103d/ (http://gotroot.ca/rigol/riglol-103d/)

No, I was referring to http://gotroot.ca/rigol/rigup-0.4.1-mso1000z.zip (http://gotroot.ca/rigol/rigup-0.4.1-mso1000z.zip) .

Its a version of the rigup program that has been patched to work with MSO1000Z memory dump. The link you provided doesn't list MSO1000Z as an option so I would it assume it doesn't work for those scopes, but since I haven't used it I could be wrong.
Title: Re: MSO1104z hacking possible?
Post by: Boscoe on February 08, 2016, 08:21:26 am
he means here : http://gotroot.ca/rigol/riglol-103d/ (http://gotroot.ca/rigol/riglol-103d/)

No, I was referring to http://gotroot.ca/rigol/rigup-0.4.1-mso1000z.zip (http://gotroot.ca/rigol/rigup-0.4.1-mso1000z.zip) .

Its a version of the rigup program that has been patched to work with MSO1000Z memory dump. The link you provided doesn't list MSO1000Z as an option so I would it assume it doesn't work for those scopes, but since I haven't used it I could be wrong.

Are there any instructions on how to use this? The readme just tells you how you should not ask questions and read but it's doesn't provide any information!
Title: Re: MSO1104z hacking possible?
Post by: CustomEngineerer on February 08, 2016, 08:30:22 am
This post lists the exact steps for a MSO1000Z
https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg569236/#msg569236 (https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg569236/#msg569236)


Another thread with some more info, but the link above contains the actual steps.
https://www.eevblog.com/forum/testgear/you-can't-unlock-a-mso1000z-series-scope-without-a-memory-dump-and-other-lessons/ (https://www.eevblog.com/forum/testgear/you-can't-unlock-a-mso1000z-series-scope-without-a-memory-dump-and-other-lessons/)
Title: Re: MSO1104z hacking possible?
Post by: bdpdx on April 16, 2019, 10:55:55 am
I updated my MSO1104Z tonight and enabled all the options.  I have the updated 00.04.04.SP4 firmware (early 2019).

1) Use a JTAG reader with openocd to read the memory of your device.  See https://www.eevblog.com/forum/testgear/sniffing-the-rigol_s-internal-i2c-bus/msg569236/#msg569236 (https://www.eevblog.com/forum/testgear/sniffing-the-rigol_s-internal-i2c-bus/msg569236/#msg569236) for details.

2) I used a Segger J-Link hooked up to my Mac, installed openocd via Homebrew.
    - had to add "adapter_khz 10000" to my interfaces/jlink.cfg
    - had to issue a "halt" command from the telnet session once the scope was up and running.

3) I dumped memory, then compiled rigup 1.4.2 on my Mac and ran `rigup scan mso1104z.bin > mso1104z.txt` (the bin file I dumped following the above post).

4) I expect it's due to the new firmware, but in the mso1104z.txt file the serial number was wrong.  On your scope go to System > System Info and edit the mso1104z.txt file with your correct serial number.

5) Run `rigup license mso1104z.txt 0x1C0FF` and you'll get a license string that will enable all options.