Rigol DP900 / DP2000 Series Hack -

[hve]

This thread is dedicated to hacking the Rigol DC DP900/DP2000 power supplies:

Product	Type	Max Power	Max Voltage	Max Current	Channels	Price (USD)
DP2031	Power Supplies	222 Watts	64 Volts	10 Amps	3	$1,199
DP932U	Power Supplies	210 Watts	64 Volts	6 Amps	3	$529
DP932A	Power Supplies	210 Watts	64 Volts	6 Amps	3	$749

Platform is based on an Allwinner  i40 linux-sunxi platform

There is some firmware available:
https://www.rigol.eu/Public/Uploads/uploadfile/files/20230321/20230321002306_6418886a99c29.zip

Its a rar archive, extract using:

Code: [Select]

unrar x 20230321002306_6418886a99c29.zip
then there's a GEL file, extract using:

Code: [Select]

tar xvf DP900_DP2000_Update.GEL

-rw-r--r-- adil/root  35836928 2023-02-08 13:52 tina-r40-m2ultra.swu
-rw-r--r-- adil/root    105900 2022-04-08 04:44 sousa_fpga.024.bin
-rw-r--r-- adil/root       185 2023-02-08 13:52 image_info.txt
-rw-r--r-- adil/root       108 2023-02-08 13:52 checksum.txt

then there's a cpio archive:

Code: [Select]

cpio -i <tina-r40-m2ultra.swu

-rw-r--r-- 1 henk henk     3656 Apr 12 22:04 sw-description
-rw-r--r-- 1 henk henk      256 Apr 12 22:04 sw-description.sig
-rw-r--r-- 1 henk henk 15728640 Apr 12 22:04 recovery
-rw-r--r-- 1 henk henk  1196032 Apr 12 22:04 uboot
-rw-r--r-- 1 henk henk    32768 Apr 12 22:04 boot0
-rw-r--r-- 1 henk henk  4194304 Apr 12 22:04 kernel
-rw-r--r-- 1 henk henk 14680064 Apr 12 22:04 rootfs


Then there's a squashfs filesystem:

Code: [Select]

file rootfs
rootfs: Squashfs filesystem, little endian, version 4.0, xz compressed, 14674551 bytes, 1446 inodes, blocksize: 262144 bytes, created: Wed Feb  8 12:49:37 2023
So we have a sunix linux system running on your PSU unit together with an FPGA.

Firmware updates are controlled by swupdate https://sbabic.github.io/swupdate/sw-description.html

Update command:

Code: [Select]

swupdate -n -k /etc/swupdate_public.pem $check_version_para $swu_param -e $swu_software,$swu_mode >> $swupdate_log_file 2>&1

File /etc/swupdate_public.pem (RSA 2048):

Code: [Select]

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxO//XV7kM2qvOjdcmqlF
JlzzHZtE3uu9GE5Vu7ba2jrqhhHy9ivXOb7kWbeIM3Jb5dqqAP1jaDjO7A+WF47R
WakMpv++MxDQP/oJNtlcGIraqSBRRxl+N/mIljA+G4uP/ZbLKDcWbh2fQr0yQ1T9
0KK1o10mTKzIvWGP5a7VNVlIfUd1KPjxzTFcFEcBcb7Hy6gVZYFmxdmFAicwVaG8
vHl2OUzG4I4rOVTdwGNp9ivsy3MqJjtHl4uY5HH+cubNnV8V6PaLtDi4YnZiP8cw
dDDY15h95NZ/2+FJCArc4oRaWQQ0VDxQ/9DLLdRYFbVZ1GSDuZ30cHJIIeqviGIo
lwIDAQAB
-----END PUBLIC KEY-----


[Userli]

The model is encrypted and hidden in the file /mnt/app/private/test.dll .
I created the attached file, which hopefully changes the model to DP932A and does not break anything else.
Make a backup and use at your own risk.

[Xoff]

  It's working! 

Thank you Userli! I would like to confirm, that after replacing original test.dll with yours and restarting my DP932E, now it is reporting DP32A model.
All other data are intact (calibration status & date, firmware version (00.00.01.00.20) and unit serial number).
The following options are installed (and working fine): HIRES, ARB, DIO
Monitor option however is not installed.

GOOD JOB! 

[Userli]

I didn't see it mentioned anywhere yet:

The initial password for the web interface is
Rigol1998

The username is empty.

The web interface seems pretty useless though, only allowing to change the network parameters, which somehow is a catch 22 .

[Userli]

A small change to enable the monitoring option. I only gave it a quick try. There might be a reason, why you can't buy the option currently. Use at your own risk!

Apply the attached patch to the version 21 SousaMain file (MD5: 4a0c633eadc7c0f7009a464a16d35747). After patching the MD5 should be fd14f9a93f4310ccbe8b9171ff4ebf25   .

[Xoff]

Apply the attached patch to the version 21 SousaMain file

Are you referring to to the newest FW upgrade version 00.00.01.00.21 (dated 25/05/2023)?
Yesterday have upgraded my DP932E from version 00.00.01.20 (from 08/02/2023) with no need to change 'mnt\app\private\test.dll' file.
Didn't notice any changes to DP900 power supply so fare...

[Userli]

Yes, this is the version I was referring to.
The test.dll should be independent of the version.

[Xoff]

Thank you Userli,

Unfortunately I don't know how to patch SousaMain file.
I can upload/download it from root\mnt\app\  (using SSH file transfer protocol).
Can you please explain, how I can apply the patch?

[Userli]

It's a standard bpatch. You could do for instance:
bspatch.exe SousaMain SousaMain_patched SousaMain_patch

SousaMain_patched would be the new file.

[Xoff]

OK. Working great! After the restart of DP932A(E) 'option' Monitor is now active (of course it is NOT mentioned in 'Utility >Option' menu.

Thank you again for your help! 

To control my instruments I'm using M1 macOS (Monterey v12.6.7), so to patch SousaMain file, I have used MultiPatch 2.0 app (by Paul Kratt from GitHub). The trick is, you have to add BDF extension to your 'SousaMain_patch.bdf' file. You also need to change permissions of patched file to match original SousaMain (-rwxrwxrwx). New file has the same file size of 23705744 bytes.

[Userli]

Well done! 

I found that the monitor switches off after triggering, which doesn't seem very user friendly to me. Maybe this can be tweaked....

[Xoff]

In 'Monitor > CH1' menu you can set various output conditions for Volts, Current and Power, as well as, (after pushing the 'Settings' button) three actions (to be selected independently): 'Output Off', 'Warning' and/or 'Beeper'.

So fare Output Off and Warning are working great in my instrument. However no 'Beeper' tone ever triggered.
So if you want to be only warned of some output conditions, you can select checkbox 'Warning', while leaving 'Output Off' unchecked.

You are right that after the first message 'Monitor Warning', monitoring switches off, but otherwise you will be 'spammed' the same message again and again (on screen and in the LOG). For the 'Beeper' however this behaviour is not needed. Maybe this is the reason why the 'Monitor' option is not officially released yet?

 

[KrzysztofB]

Hi.
Any chance of enabling HiRes and High current mode on 2000 model?

[Userli]

Try the attached patch, also for version 00.00.01.00.21 . At your own risk!

[Xoff]

Checked new patch on original SousaMain, but no new options on DP900

[Userli]

To my understanding, the 10A option requires the DP2000 hardware. So even if you would enable it on your DP900, it wouldn't work. If somebody finds that this is not the case, I'll be happy to look, how to enable this option for the DP900, too.
It would in fact be nice to have pictures of the interior of both devices.

[KrzysztofB]

I have DP2031 PSU so can try that.
There were inside pictures in the past here in one of my posts.

https://www.eevblog.com/forum/testgear/rigol-dp2031/msg4551335/#msg4551335

[KrzysztofB]

I patched SousaMain with last patch you sent.
Seem like Monitor got activated, however Options: HADC and 10A are not installed.

[Userli]

Indeed interesting. It was not straight forward. Hopefully the attached patch works.

[KrzysztofB]

Tried it.
Now when you go to Options window it says:
HADC: Office, 10A: Office
But not possible to lift current limit to 5A

[Userli]

Interesting! Faking a DP2031 on a DP932, I could set the current limit to 10A on CH3 . Does the high speed sampling work?

[Userli]

Here pictures of the internals of the DP932:
The transformer is different, 2 ADCs SGM58600 are missing and a few other parts.

[KrzysztofB]

Will check tomorrow.
But. Do I need to change that dll file also? Or only patch?

[Userli]

For the DP2031 you don't need to change the test.dll . Please note that only channel 3 allows for 10A.

[KrzysztofB]

For the DP2031 you don't need to change the test.dll . Please note that only channel 3 allows for 10A.

I didn't note the fact it's for CH3, thanks for pointing that. That was absolutely spot on. Works like a charm. High sampling rate also.
Also, a note, that when 10A is enabled, CH1 and CH2 have to go down to 2A.

[Userli]

Glad it works!
Do you know if the high sampling rate also works for Ch3?
If I might ask, could you take some pictures of the connectors for the remote connections on the back and possibly measure the pitch? I assume those are also Würth connectors https://www.we-online.com/en/components/products/em/connectors/terminal_blocks/pluggable_connector_contbl3 but they exist in different pitches (5mm and 5.08mm).

[KrzysztofB]

Digital I/O connector is 5pin 3.81mm pitch
CH3 is 4pin 5mm pitch, CH1/2 is 8 pin

Actually after checking 8 pin CH1/2, i think it's more 5.08mm
But those are nearly identical. (7x0.08mm) 0.56mm over 8 pin connector wouldnt make any difference

Manual states:
DP2000 series power supply provides three preset current sampling rate options for
CH1 and CH2.
Tap CurrSampRate drop-down button to select 3.75K SPS, 7.5K SPS, or 29 SPS.

[manupthehills]

Slightly OT:
We have two DP932A, from the front panel they were showing FW 01.00.01, so I upgraded one with the latest FW available (that should be 01.00.21).
Now the display shows 00.00.01. Very interesting.
So I connect them to the PC, and the firmware shown is:
- 01.00.01.00.16 for the stock one
- 00.00.01.00.21 for the upgraded one

Please note the 01 at the beginning of the stock one. Which one is the latest?? What is the first 01 meaning?
Anyone found a revision history for these FW?

Thanks!

[tv84]

I think that 01 means "Beta" FW. Not for release.

[Userli]

I investigated the possibility to add remote sensing to the DP900 series. The cut outs in the housing exist, so it would be easy to add the connectors.
On the PCB it looks like mainly 3 relays with their periphery would need to be added. I was able to deduce the relay driver components from other relays on the board (see attached image) but not the ones in the signal path. Unfortunately the resolution of the DP2031 images is not sufficient to see the component values in this region.
@KrzysztofB if you still have the original of your board images, would you mind to post a highres version of the region corresponding to the attached image? It's on the top PCB.

[KrzysztofB]

Can make those on Monday

[Userli]

I populated the parts required for switching to remote sensing but somehow can't make it switch. The panel will indicate that it is using 4 wires but the signal to the relay doesn't get set. The line for this signal originates from the IC on the attached picture. Does anybody know, what it is? I can't find any information about it, so I assume it is a custom chip? It also handles the ADC signals.

[2N3055]

Hercules Microelectronics HME-H3 FPGA

[ArcticGeek]

@userli @xoff

Sorry for my ignorance, but can give me some more info on how you are changing this test.dll file?  How are you accessing the file system on the power supply?

I have a DP932E on order, and if I can convert this to the DP932A it would be super cool (it won't arrive until sometime in Sept)

I'm a bit of a hardware bigot, so I'm a bit of a fish out of water when it comes to software stuff, but with some good instructions I can probably manage.
Thanks,

[MaTkEOxjC]

Very nice, also upgraded my DP932E to a (almost) DP932A with Arb, HighRes, Monitor, DigitalIO

Replaced test.dll with the file from here;

The model is encrypted and hidden in the file /mnt/app/private/test.dll .
I created the attached file, which hopefully changes the model to DP932A and does not break anything else.
Make a backup and use at your own risk.

Got the SousaMain file, patched it and uploaded it again via SCP

A small change to enable the monitoring option. I only gave it a quick try. There might be a reason, why you can't buy the option currently. Use at your own risk!

Apply the attached patch to the version 21 SousaMain file (MD5: 4a0c633eadc7c0f7009a464a16d35747). After patching the MD5 should be fd14f9a93f4310ccbe8b9171ff4ebf25   .

SSH Password is Rigol001 (already posted by another user)

Kinda interesting that the DP932A is specified with 32V for Ch1&2 and DP932E is specified with 30V

[MaTkEOxjC]

Sorry for my ignorance, but can give me some more info on how you are changing this test.dll file?  How are you accessing the file system on the power supply?

You can use SCP (secure copy) to transfer the files.
I'm using a Linux laptop for that, you need to look for a ssh/scp tool on your OS.
It's located in /mnt/app/private/test.dll

So your command would be: (you need to adapt the IP of the device and the local target directory.
$ scp root@192.168.XXX.XXX:/mnt/app/private/test.dll ./local_target/directory
$ scp ./local_source_directory/text.dll root@192.168.XXX.XXX:/mnt/app/private/

Always make backups and save the previous states.
Only restart when everything has been changed.

[ArcticGeek]

Thanks for the reply.

I'm still wondering how you are accessing the file system from your laptop. 

My assumption is that you are connecting is serial cable from the laptop to the power supply and using SSH to establish the connection - is that right?   What baud rate/parity/stop bit setting are you using for this?

Or am I way off base in my assumption and I would need to do something else?

[Quarren42]

Or am I way off base in my assumption and I would need to do something else?

The power supply has an Ethernet port in the rear, which you connect to in order to SSH into it. It'll auto-configure the IP address, which you can find in the power supply menus. You'll then SSH with username "root" and password "Rigol001" and can follow the commands MaTkEOxjC posted.

Worth mentioning that I did this on windows and the scp command didn't work for me, but I still got the files over by using a flash drive inserted in the front USB port. The flash drive will mount to /mnt/UDISK (may be EX_UDISK, not currently at bench to verify) which you can then copy the files off of using the cp or mv command when SSH'd into the power supply.

[bobo1239]

My newly arrived DP932E (calibrated on 2022-12-02) didn't have a /mnt/app/private/test.dll (just a test2.dll which is different). The hack still worked though so just a PSA.

[PeterB]

Somewhere in the thread the following is written:
"Kinda interesting that the DP932A is specified with 32V for Ch1&2 and DP932E is specified with 30V"

Can anyone confirm that when applying the hack to a DP932E, the range moves from 30V to 32V, or does it just stay at 30V.
If the latter, it makes me wonder whether there are minor HW differences on the DP932E compared to the DP932U/DP932A which limits the range on the DP932E to 30V.

[bobo1239]

My stock DP932E was able to reach 31.50 V before the firmware would refuse to go further. After the hack the limit is 33.600 V.

[ToThePub]

Interesting. I have a DP832 (yes different to the DP900/DP2000, it's fully unlocked) and the firmware (which is unmodified/unpatched) allows setting 32V/3.2A on the high outputs and 5.3V/3.2A on the low output.
Documented (and marked on the front of the machine) specs are 30V/3A and 5V/3A.

So it seems Rigol have previous allowed their power supply to "overclock" a little.

[LogicalDave]

Has anyone tested the current measurement accuracy of the hacked HIRES feature? 
The 932E is priced attractively but seems to be a broken 932A (1mA current resolution but worse than 10mA accuracy is just silly and not having a sense input is odd for a PS at this price-point).
Also, are any of the DP power supplies silent (fan not running) under light load?
Thanks!

[thm_w]

Has anyone tested the current measurement accuracy of the hacked HIRES feature? 
The 932E is priced attractively but seems to be a broken 932A (1mA current resolution but worse than 10mA accuracy is just silly and not having a sense input is odd for a PS at this price-point).
Also, are any of the DP power supplies silent (fan not running) under light load?
Thanks!

The datasheet accuracy spec is 0.15%+5mA, where did you get 10mA from? Usually the fan is always running but I don't have one to say for sure.
Sense input is not really needed on a 3A output, and there is no space on the front panel.
You can read a bit more here: https://www.eevblog.com/forum/testgear/news-about-rigol-dp932e/

[d.v.ermakov]

Hi all.
Just received DP932E with firmware 00.01.01.00.22. Port 5025 was not answer, downgrade to 00.01.01.00.20 was not successful. Any known ways to open SSH/SCP port for change test.dll? SCPI command or direct connection to PCB? Or, maybe, how to downgrade firmware?

[sensille]

After 2 weeks of waiting I received my DP932e directly from Rigol. Firmware identifies as 01.00.01. ssh into it works with the know password. Something is listening on port 5025. Haven't tried anything else yet.

[hve]

Also, are any of the DP power supplies silent (fan not running) under light load?
Thanks!

No on my 2031 the FAN is always on, slightly annoying.
Still running the old firmware...

[sensille]

The stock firmware in my DP932 is 01.00.01.00.16. I can confirm that replacing test.dll works as expected. After the report from d.v.ermakov I don't dare to upgrade to .22. Version .21 is not available anymore. Does anyone still have it and would be willing to provide it?
Or the other way round, can anyone confirm that .22 does not close the ssh port?

[Ronnyvs]

Hello all,
At first wish you all happy Holydays!!

I got my DS932E today, and i did the update with the test.dll from Userli...

But now is my next question...
I also want to open the monitor function...

My model  is according to the "about" screen  DP932A
and my firmware version is in the "About" screen 00.01.01

now when i login in the userinterface, it tells me that my firmware version is
Firmware Revision:   00.00.01.00.01

With this firmware , i think, its not good to patch it...
But when i download the new firmware it is the .22 firmware...
so i think i don't can patch this either...
 
i think, i can only patch the .21 firmware with the software patch from userli...

am i right or am i totally wrong?

waiting for an answer,

friendly regards!!
Ronnyvs

[Ronnyvs]

Hi all.
Just received DP932E with firmware 00.01.01.00.22. Port 5025 was not answer, downgrade to 00.01.01.00.20 was not successful. Any known ways to open SSH/SCP port for change test.dll? SCPI command or direct connection to PCB? Or, maybe, how to downgrade firmware?

You have to use port 22 ssh
putty or winSCP (SFTP)

username: root
passwd:     Rigol001

[BC547B]

Hi, I have a DP2031, FW ver. 00.01.01

After I overwrote the original SousaMain with the patched SousaMain file, and rebooted the PSU. It hangs at boot, I had to re-upload the original file. I don't know what am I doing wrong.

Here's what I've done hopefully someone will point me in the right direction, and will be a guide for FW hacking beginners and newcomers like me:

0- [Backup]: I've downloaded the SousaMain file from my PSU by connecting it via ethernet using scp root@[rigol psu ip]:/mnt/app/SousaMain /SousaMainOriginal
1- [Download the patch]: I've downloaded the SousaMain patch by userli attached in his Reply #18
2- [Patch Sousa Main]: I've patched the original file using bspatch.exe that I've downloaded from Romhacking.net and then executed bspatch.exe SousaMainOriginal SousaMain_patched SousaMain_patch
3- Renamed the patched file to SousaMain
4- [Upload the patched file to root directory]: scp /SousaMain_patched root@[rigol psu ip]:/
5- [SSH to the machine] SSH'd to the PSU
6- Moved the file to /mnt/app using: mv SousaMain /mnt/app
7- On the PSU went to Utility > Option, it kept saying HADC: not installed, 10A not installed.
8- Turned it off and back on. It shows the Rigol logo and starts filling up the loading bar and then stops.
9- I got lucky and I could still SCP/SSH to it to reupload the original file 
10- I've tried all the above again and still faced the same problem.

I hope someone would let me know what I'm doing wrong.
-
There are few things I don't understand:
- Could someone explain what does the swupdate command posted by hve in the beginning of this post do? Do I need to execute it on the psu to be able to apply the patch by userli?
- Do I have to repatch when a new firmware is released?

Thank you

[Ronnyvs]

Hi BC547B,

When you say your firmware is: FW ver. 00.01.01
Then this is not the whole firmware syntax...
The whole firmwaresyntax looks like: 00.01.01.00.22,
Where te last number is the actually version where Userli made the patch for...
and the patch is made for .21 at the end.

To check your version, you can login with the ultrasigma tool from Rigol and do an SCPI command "*IDN?"
this gives you the full info about your device... It looks like this:

*IDN?
Rigol Technologies,DP932A,DP9D123456789,00.01.01.00.22

If you want to patch it your firmware has to be 21 at the end.

To check the MD5 you can test it on:
https://emn178.github.io/online-tools/md5_checksum.html

In this threat Userli also wrote down the MD5 file-size from  Sousamain before and after the patch.
These numbers should be the same!

Regards,

Ronny

[Ronnyvs]

As i'm still writing now,

i will post my remote control which i made for the 932 power supply's.
I only tested it with mij 932, but i think it wil work with most of the Rigol powersupply's.

I made it by changing the web-control from the known BB3-powersupply.

It's working and still very simple...
you can set the voltage and current, it shows in which mode it works and the meters for reading out are live.
they show U, I and P.

I post it now, so that other smart and willing engineers and hobbyists like it to make it more and better.
I only did the start...

It's working with eez-studio and that a very nice tool to operate other devices(including a lot of Rigol Scopes)
eez-studio download:

https://www.envox.eu/studio/studio-introduction/

my projects are attached...
the project-file is to run and the dashboard-file is to edit.
have fun with it!

[BC547B]

Hello Ronnyvs, thanks for pointing out the required version for the patch to work, mine says .22 unfortunately I couldn't find .21 firmware anywhere on the internet 

I just downloaded Eezstudio, is this a software that allow me to control my lab equipment from the computer? And you project is like a plugin for it to work on the DP900 and DP2000?

[sensille]

At least that information confirms that even with .22 the ssh port is still open, so I can update from .16 to .22 now If someone provides the SousaMain from .21 I can try to port the patch to .22.

[Ronnyvs]

Glad that it became more clear with the firmware.
Maybe Userli can write a patch for the .22....

According to EEZ-studio...
with EEZ-studio , you can write software which control equipment...
for example GUI's for stm32, arduino , webapplications etc...

with the last one , i made the control for the powersupply.
if you open eez-studio, then in EEZ-studio you can open my files and control the powersupply.
Its possible to have a lot of devices, or projects opened at the same time..

i also use an other instrument from Rigol to open the connection to the device...
although i noticed another port in this forum, the port=5555
In my software there has to be made an connect/disconnect button... (still not there)

Let me know if it works...
Ronny

[ivantankj]

Hi All,

I believe this is the firmware 00.21 that everyone of you are looking for?

Need some verification because the website seem to have mislabeled it as .20. This firmware dates 25th May 2023. My unit has not arrived yet so can't verify at the moment.

https://drive.google.com/file/d/1Wlrnk3dYLdw3fNQwgDsmt8e85K32Fa6g/view?usp=sharing

[sensille]

I believe this is the firmware 00.21 that everyone of you are looking for?

I can confirm that the contained SousaMain has the expected md5sum of 4a0c633eadc7c0f7009a464a16d35747.

[ivantankj]

I believe this is the firmware 00.21 that everyone of you are looking for?

I can confirm that the contained SousaMain has the expected md5sum of 4a0c633eadc7c0f7009a464a16d35747.

Fantastic! So you have managed to downgrade your firmware from .22 successfully?

[BC547B]

Hi Ronny, first I'd like to thank you for introducing me to this software I didn't know there's something like that! is this supposed to work on DP2000 series? I've never used this EEZsoftware before, but when I click run all I see is a dialog box called instrument and the list is empty and close and select, even though I have my psu online and pingable. The error is Not connected to the instrument.

[Ronnyvs]

Hello BC547B,

i already noticed this in my last post:

"i also use an other instrument from Rigol to open the connection to the device...
although i noticed another port in this forum, the port=5555
In my software there has to be made an connect/disconnect button... (still not there)"

what i did:
een eez-studio-> tab"Home"
At the right top the green button "add instrument"
choose from Generic SCPI  (only use it for making an connection...)
Then on the SCPI-Instrument you can open the connection to your powersupply

Now open the powersupply from the file i made and you can control it

The files i made hasn't been converted to a "instrument"
I would also like to add a connect/disconnect button.
Then you don't "need "another device for making the connection...

Ronny

[sensille]

Fantastic! So you have managed to downgrade your firmware from .22 successfully?

No. For one my device is still on the stock .16 it arrived on 2 weeks ago. My plan is to try to port the patch to .22 first.

[ivantankj]

Fantastic! So you have managed to downgrade your firmware from .22 successfully?

No. For one my device is still on the stock .16 it arrived on 2 weeks ago. My plan is to try to port the patch to .22 first.

I just received my unit and it's on firmware .22 unfortunately but I managed to get the test.dll file onto the PSU and it unlocked the usual 3 options. I guess I have to wait for you or someone to port the patch to .22 then. Thanks for looking into it.

[sensille]

I just received my unit and it's on firmware .22 unfortunately but I managed to get the test.dll file onto the PSU and it unlocked the usual 3 options. I guess I have to wait for you or someone to port the patch to .22 then. Thanks for looking into it.

If you feel  adventurous, I have the ported the patch from Userli to .22, but haven't tested it yet. I plan to do the update and test on the weekend.
SousaMain original: ec69fba52309f6370ed81c55552c4e08
patched: 5e277fe9ad537a6918ec22ecc696e3f7

[ivantankj]

I just received my unit and it's on firmware .22 unfortunately but I managed to get the test.dll file onto the PSU and it unlocked the usual 3 options. I guess I have to wait for you or someone to port the patch to .22 then. Thanks for looking into it.

If you feel  adventurous, I have the ported the patch from Userli to .22, but haven't tested it yet. I plan to do the update and test on the weekend.
SousaMain original: ec69fba52309f6370ed81c55552c4e08
patched: 5e277fe9ad537a6918ec22ecc696e3f7

I'm all for adventure! And guess what? It works!

The patch file you have attached has some character encoding issues on the filename I think, I had to rename it totally for bspatch to work properly.

Attaching the renamed patch in this reply as well.

Thanks once again Genius!

[Ronnyvs]

Hi all,
very nice the patch for .22 works!!! Good job! (didn't tested it myself, i'll try it this week)

I was busy with my eezproject to make the power supply as an Instrument.

Glad, now it works! The connect button works well and the Instrument is also working...

For those who like it to give it a try, i added the zip file (you can immediately add it as an instrument in EEZ studio)
I also made an instruction manual how i made the an instrument of an "dashboard"-file
this is also added as an pdf-file

hope you all will appreciate it...

Ronnyvs

[BC547B]

Hi, thanks sensille for supplying the patch and thanks ivantakj. I patched mine the check sum is the same as the one you provided but didn't work it still says: HADC: not installed and 10A not installed. But the monitor feature now works... but the others are not.

Ivantakj can you confirm that HADC and 10A are working for you please? because here they are still not installed, I checked that by trying to set 10A manually on channel 3 (because it's the only channel that allows 10A) and also by going to utility > option. I've attached some photos.
Thanks!

[ivantankj]

Hi, thanks sensille for supplying the patch and thanks ivantakj. I patched mine the check sum is the same as the one you provided but didn't work it still says: HADC: not installed and 10A not installed. But the monitor feature now works... but the others are not.

Ivantakj can you confirm that HADC and 10A are working for you please? because here they are still not installed, I checked that by trying to set 10A manually on channel 3 (because it's the only channel that allows 10A) and also by going to utility > option. I've attached some photos.
Thanks!

Hi, there are actually 2 different patches for both the DP900 and the DP2000 series. This one we are talking about now is for the DP900 series and for me personally, the DP932E specifically. You could perhaps request the Genius for the DP2000 version be ported as well.

[sensille]

Hi, there are actually 2 different patches for both the DP900 and the DP2000 series. This one we are talking about now is for the DP900 series and for me personally, the DP932E specifically. You could perhaps request the Genius for the DP2000 version be ported as well.

I have much less confidence with that one. No idea what Userli has done there. So if it works, all credits to them, if not, all blame on me.
Patched md5sum is 365adc3f5d69599eb6ac7c54c333ea45.

[Ronnyvs]

Things with EEZ Studio are working really well...

[BC547B]

Hi sensille! Thank you ever so much for porting the patch to DP2031 FW version ending with .22  I confirm that the patch is working! And thank you to Userli for making all this magic happen!

With this patch SousaMain_patch_22_2031.zip posted by sensille I've achieved

- High Current Option: CH3 10 A high range mode
- Fast Sampling: 7.5 k/s high-speed sampling option
- Monitor Mode: You can set the power supply to watch over voltage current power and either warn you or turn the output off or make a beep

I've attached pictures to confirm it's working!
 

Happy New Years guys thank yyou!!

[BC547B]

Hi Ronnyvs! WOW dude this is looking good already! Can't wait to try it on the DP2031 tomorrow! I hope it works on mine!
Thanks for sharing you work with us!

[ivantankj]

One of the features of the Rigol PSUs is the data logger in *.ROL format.

The following package from Rigol specifies the long arduous process of reading these proprietary files.

 

[Phili76]

Thanks sensille & Userli! Another DP2031 working!
Had some issues with the md5 not matching but found out that mine was still on 00.00.01.00.19. (md5 7ad7aeb10e312aa11eded45a098de412) So checking md5 before helps.
Did an update, back to Chinese language, recognized as an DP932, hard reboot, change of file, hard reboot and all OK: 10A, HADC and Monitor.

EEZ Studio is also great, for the DP2031 only the 6V/3A has to be changed to 6V/10A (or 5A). Another rabbit hole to go down.
Thanks!!
 

[Ronnyvs]

To Phili76 and all the others,
I made some changes to the EEZ-file's.
i can't test them by myself, but i think they should work...
Just le me know

Succes,
Ronny

[eebc]

I just received my unit and it's on firmware .22 unfortunately but I managed to get the test.dll file onto the PSU and it unlocked the usual 3 options. I guess I have to wait for you or someone to port the patch to .22 then. Thanks for looking into it.

If you feel  adventurous, I have the ported the patch from Userli to .22, but haven't tested it yet. I plan to do the update and test on the weekend.
SousaMain original: ec69fba52309f6370ed81c55552c4e08
patched: 5e277fe9ad537a6918ec22ecc696e3f7

I'm all for adventure! And guess what? It works!

The patch file you have attached has some character encoding issues on the filename I think, I had to rename it totally for bspatch to work properly.

Attaching the renamed patch in this reply as well.

Thanks once again Genius!

Hi, I have a DP932U, firmware version 00.01.01.00.22, replaced the test.dll and patched SousaMain with the patch file above. I wasn't able to use the Monitoring function. What was the step missing to enable that? Thanks.

[Ronnyvs]

I think,

not sure,

The patchfile above was written for the 2031 serie...

[Phili76]

 DP2031-1.0.1.zip (443.82 kB - downloaded 32 times.)weird, nothing matches the "CH3:6V/10A" reply.
Found the SwitchCase is missing the 5A and 10A and the slot widget data also.
maybe, :
!loaded ? 0 : slot.model == "32V/3A" || slot.model == "6V/3A" || slot.model == "6V/10A" || slot.model == "6V/5A"? 1 : 2

Don´t know if the instrument is correct, but it´s working with my DP2031.
br
philipp

[Ronnyvs]

Hi Philipp, i think your correct.

It's hard to make something and you can't test it by yourself.
Therefore i uploaded everything including all files, so anybody can edit and modify it.

according to me, one of the main reasons to publish on forums and share knowledge.

so thanks and hopefully other people can also modify, add and upgrade it.

regards,

Ronny

[eebc]

I tried to patch the .22 SousaMain with the patch from Userli in reply #4. Now the DP932U got stuck in the boot up screen forever....
Please help if anyone knows how to fix it.

Updates:
I am lucky that WinSCP can still connects to the device. I was able to access the device through ethernet. Glad that I can revert it back to the .22 SousaMain before Patch. I would better wait for some Genius to figure out the hack for enabling monitoring on DP932U with .22 firmware....

[ivantankj]

I just received my unit and it's on firmware .22 unfortunately but I managed to get the test.dll file onto the PSU and it unlocked the usual 3 options. I guess I have to wait for you or someone to port the patch to .22 then. Thanks for looking into it.

If you feel  adventurous, I have the ported the patch from Userli to .22, but haven't tested it yet. I plan to do the update and test on the weekend.
SousaMain original: ec69fba52309f6370ed81c55552c4e08
patched: 5e277fe9ad537a6918ec22ecc696e3f7

I'm all for adventure! And guess what? It works!

The patch file you have attached has some character encoding issues on the filename I think, I had to rename it totally for bspatch to work properly.

Attaching the renamed patch in this reply as well.

Thanks once again Genius!

Hi, I have a DP932U, firmware version 00.01.01.00.22, replaced the test.dll and patched SousaMain with the patch file above. I wasn't able to use the Monitoring function. What was the step missing to enable that? Thanks.

If you use the patch that I’ve attached in the above post and not the one originally from Useli (meant for .21), you should easily access the on screen monitor option after a reboot. Works the first time around for me. Make sure you get a new patched file after patching and rename that to the original SousaMain without any file extensions

[eebc]

Thanks ivantankj, I tried the patch file you posted. That works for the DP932U! Thanks a lot.

[mm1]

Quick note - Rigol Canada has the DP932U on sale at %50 off. $350 cnd seems like good value for the supply. Even if it does has the safety banana plugs......

[mm1]

Hi,
Does anyone have the "Monitor" function working ? What is it  ? - I don't see anything in the user manual.
Thanks !

[thm_w]

Hi,
Does anyone have the "Monitor" function working ? What is it  ? - I don't see anything in the user manual.
Thanks !

I didn't get the PSU yet but monitor should let you set various logic for over/under voltage over power, etc. and then switch off the output. If its the same as on the DP800 manual: https://beyondmeasure.rigoltech.com/acton/attachment/1579/f-01c1/1/-/-/-/-/DP800%20Datasheet.pdf

Does it open for you at all, or tell you its not licensed or something?

[mm1]

Hi thm_w,
It says 'Option is not installed, please buy it". Which is interesting as I don't see it's an option for sale. There is over current and over voltage protection, so I'm not sure what other value this would bring.
Cheers !

[thm_w]

For some reason my PSU would detect the USB key but not show any files on it.
So I used the bootloader to upgrade: Power on, keep pressing the Utility button, screen will show up with four options (Key test, LCD test, Downgrade, Return). Select Downgrade and it should find the GEL file now. Once it finished booting you'll need to go back to Settings, System (first tab) and change the language back to English.

After that now the PSU reads the USB key (exUDISK or exUDISK2), so maybe some early FW bug.

Summary:
- Updated to .22 (link)
- Backup/rename files
- Login to SSH (root, pw: Rigol001)
- Copy SousaMain from PSU to USB (cp /mnt/app/SousaMain /mnt/exUDISK/)
- Patched SousaMain (bspatch SousaMain SousaMainPatched SousaMain_patch)
- Copied patched SousaMain with SSH
- Copied test.dll with SSH (cp /mnt/exUDISK/test.dll /mnt/app/private)

edit: I will pay if someone wants to patch out the garbage font rigol decided to use for the main display.

[thm_w]

I see the following in /etc/fonts/conf.d:

Code: [Select]

-a----        12/03/2024   4:33 PM              0 10-hinting-slight.conf
-a----        12/03/2024   4:33 PM              0 10-scale-bitmap-fonts.conf
-a----        12/03/2024   4:33 PM              0 20-unhint-small-vera.conf
-a----        12/03/2024   4:33 PM              0 30-metric-aliases.conf
-a----        12/03/2024   4:33 PM              0 30-urw-aliases.conf
-a----        12/03/2024   4:33 PM              0 40-nonlatin.conf
-a----        12/03/2024   4:33 PM              0 45-latin.conf
-a----        12/03/2024   4:33 PM              0 49-sansserif.conf
-a----        12/03/2024   4:33 PM              0 50-user.conf
-a----        12/03/2024   4:33 PM              0 51-local.conf
-a----        12/03/2024   4:33 PM              0 60-latin.conf
-a----        12/03/2024   4:33 PM              0 65-fonts-persian.conf
-a----        12/03/2024   4:33 PM              0 65-nonlatin.conf
-a----        12/03/2024   4:33 PM              0 69-unifont.conf
-a----        12/03/2024   4:33 PM              0 80-delicious.conf
-a----        12/03/2024   4:33 PM              0 90-synthetic.conf
These all look like standard fonts, I don't see custom ones here.

So I went to SousaMain, there are functions that look relevant:
basicUIRefresh ->
dispChanHandler ->
dispChannelData ->
dispDataNum(int param_1,int param_2,int param_3,int param_4,undefined4 param_5) ->
lv_label_set_text(local_24,&local_38);

I assume that is drawing the voltages and currents to the screen.

Search for font gives the following: lv_font_montserrat, lv_font_msyahei, lv_font_msyh, lv_font_numkey, lv_font_rigol, lv_font_simsun. I assume 'lv_font_rigol' is the garbage one.
So it could be possible to: replace the Rigol font directly in memory, change the font being pointed to.

Trying the second approach:
There is a function in dispChanInit, "lv_label_create" which initializes using two of the rigol fonts: lv_font_rigol_36 + lv_font_rigol_55:

Code: [Select]

        0016afc0 31 df 01 eb     bl         lv_label_create                                  undefined lv_label_create()
        0016afc4 00 20 a0 e1     cpy        r2,r0
        0016afc8 c4 35 0e e3     movw       r3,#0xe5c4
        0016afcc 83 3e 40 e3     movt       r3,#0xe83
        0016afd0 30 20 83 e5     str        r2,[r3,#0x30]=>stCHxView[48]
        0016afd4 c4 35 0e e3     movw       r3,#0xe5c4
        0016afd8 83 3e 40 e3     movt       r3,#0xe83
        0016afdc 30 00 93 e5     ldr        r0,[r3,#0x30]=>stCHxView[48]
        0016afe0 90 3c 0a e3     movw       r3,#0x7460                                       //Set small font
        0016afe4 6b 31 40 e3     movt       r3=>lv_font_rigol_36,#0x16b
        0016afe8 00 20 a0 e3     mov        r2,#0x0
        0016afec 00 10 a0 e3     mov        r1,#0x0
...
        0016aee4 b0 35 07 e3     movw       r3,#0x75b0                               //Set large font
        0016aee8 6b 31 40 e3     movt       r3=>lv_font_rigol_55,#0x16b
Replacing 0x16b7460 with 0x0168ac90 (montserrat_36) should be ok, but there is no other 55 size font for the large digits.

edit: it did change the font but only when the channel was opened, so obviously I'm editing in the wrong area. Also the font was much wider, but we do have horizontal space so it could be shifted to the left a bit.

[thm_w]

OK this is the correct location for the main voltage/current font of all three channels:

Code: [Select]

        00164df0 b0 35 07 e3     movw       channel,#0x75b0
        00164df4 6b 31 40 e3     movt       channel=>lv_font_rigol_55,#0x16b

Original font:


If I replace with 0x016b7738 lv_font_simsun_40 it looks like this:


WAY better but bit small. The bad thing is there is no way to scale, I think you can only choose an existing font size. So replacing the Rigol font might be the better option.


To test out:
- File -> Export Program -> SousaMain from Ghidra to USB key (original file)
- Plug USB in scope
- Navigate to /mnt/exUDISK or /mnt/exUDISK2 and check your patched file is there
- Run: pidof SousaMain
- Run: kill *pidhere* ; ./SousaMain_patched

[deano76]

Hi

Has anyone managed to get the monitoring patch working on the DP932E?

D

[thm_w]

Hi

Has anyone managed to get the monitoring patch working on the DP932E?

What problem are you having? It should be the same steps as for DP932U as outlined above.

[deano76]

test.ddl works fine, but using the .22 patch it flashes a message about not available and then back to "Option not installed, please buy it".

I'm applying the patch using multipatch on my Mac. Seems to apply the patch fine. I'm SCP the file over rm SousaMain and replacing with the patched file. Checked the file permissions and they are the same as the original SousaMain.

Any ideas what I'm missing?

[deano76]

Simple fix. Reading the serial number on the back I realised the first letter was a G not a C. Works perfectly.