Rigol MHO98 Teardown

[Feuerbard]

[ptluis]

"a spring ground is included" 

[dietert1]

At Meilhaus.de the info on the MHO98 is:

Special limited edition - only available in an amount of 1998 units worldwide, sales period limited to 2 months: October 13. - December 13., 2025
Analog channels 4 (input impedance 50 Ω/1 MΩ), 1 AUX Out
1 GHz (single-channel);
800 MHz (half-channel);
400 MHz (all channels)
Rise time 420 ps/channel
Memory depth 500 Mpts (single channel), 250 Mpts (half-channel), 125 Mpt (all channels)

They don't offer the MH098 though. I mean i didn't see any price. In Brasil the price seems to be about  R$ 17 000, roughly € 2750. This compares to a MHO984 with 500 Mpts memory depth option.

Regards, Dieter

[0xdeadbeef]

As discussed in the other thread,  it's still sold directly by Rigol, either through Amazon or from their own website.
But in might take 2-3 weeks until the next shipment arrives in Europe:
https://rigolshop.eu/mho98.html
Price here in Germany is and always was €1099 excluding VAT and €1307.81 including 19% VAT.

[norbert.kiszka]

For some reason Im very interested with a image of this SD card

[beta-tester]

For some reason Im very interested with a image of this SD card

would be interesting if the contained apk modules would work on a DHO8xx/9xx as well - maybe thier decoders will work there as well.

[eurofox]

For some reason Im very interested with a image of this SD card

Teach us how to create such a copy 

[0xdeadbeef]

I would guess it boils down to opening the scope and taking out the SD card
Actually, I would like to backup the card just to be safe, but I don't want to tear the seal of warranty just after receiving the scope.

[Martin72]

For some reason Im very interested with a image of this SD card

Why not buy a scope, then you can ruin the warranty yourself.
You'll recoup the money by selling the hacks, which you'll surely offer with Rigol's consent.

[beta-tester]

For some reason Im very interested with a image of this SD card

Teach us how to create such a copy 

maybe something like with the Android debugging tool and ethernet:

Code: [Select]

adb connect ###.###.###.###:55555
adb root
adb shell
dd if=/dev/mmcblk0 of=<usb_mount_point>/backup.img bs=4096

where ###.###.###.### the IP of the scope is and
<usb_mount_point> the mounting point of the inserted USB-memory-stick is.
/mnt/<something> or /media/<something> or /storage/<something> or similar.
you have to look around with ls, where you find the content of your mounted USB stick.

but this makes an image of the running SD card. in case there will be write opperation going on during creating the backup, it might result in a corrupt filesystem inside that backup.img or inside its partition.

EDIT: does the Rigol mount ext4 filesystems? i guess FAT filesystems are not able to create files bigger than 4GByte. so the USB stick must have another filesystem than FAT.

[norbert.kiszka]

For some reason Im very interested with a image of this SD card

Teach us how to create such a copy 

Somehow I missed this post...

Code: [Select]

adb connect ###.###.###.###:55555
adb root
adb shell
dd if=/dev/mmcblk0 of=<usb_mount_point>/backup.img bs=4096


Android uses modified Linux kernel. Some people can't believe in this, but this is true.

SD card data (image accessible all the time like a regular file) should be either in /dev/block/mmcblk0 or /dev/block/mmcblk1 (RK3399 can handle two MMC memory and this 0/1 depends on the settings in so called Device Tree).

Instead of dd, cp can be used safely.

Finally it should look like this:

Code: [Select]

adb connect ###.###.###.###:55555
adb root
adb shell
dd if=/dev/block/mmcblk0 of=/mnt/media_rw/...replace this part with usb FS label name.../backup.img

Or in a much easier way (especially for Windows only users) and directly in the file stored on used computer:

Code: [Select]

adb connect ###.###.###.###:55555
adb root
adb shell
adb pull /dev/block/mmcblk0


EDIT: does the Rigol mount ext4 filesystems? i guess FAT filesystems are not able to create files bigger than 4GByte. so the USB stick must have another filesystem than FAT.

All modern Linux distributions, including Android, uses EXT4 by default. EXT4 is extremely reliable - small damages (like in a dumped image from a running system on it) can be easily fixed by fsck in no time.

When I started using Linux, power loss with huge HDD (disk with spinning plates, not this SSD rubbish), a lot of small files and with EXT3 on it, resulted in 30 minutes of waiting to FSCK finish scanning and repairing. When I used same disk and same data, but I upgraded to EXT4, it was literally seconds, in the worst scenario, about one minute.

Also Android by default mounts /system as a read only. Apps and user data are stored in a separate FS - if any of those will be damaged beyond fixing, it's not a problem.

[norbert.kiszka]

Why not buy a scope, then you can ruin the warranty yourself.

I wish I could.

You'll recoup the money by selling the hacks

About one month ago, I shared my "extreme" earnings. Which are not enough for living. And I can forget about buying any scope.

which you'll surely offer with Rigol's consent.

Did You see any license of software provided by Rigol (beside of their lies about sharing modified open source code)? If there is no license, it means same as: do whatever You want with it.

Rigol used a lot of GPL code in their devices without any consent from creators. Main rule of GPL license is: if You provided compiled binary, You have to give source code to every person who asks for it. Im waiting 2+ years for code from Rigol - and they give no sh** to this very day.

[0xdeadbeef]

Is it known how large the SD card image is? 32GB? This will take a while over WLAN
And is there any personalized data in it like the serial number or license information?

[norbert.kiszka]

Much faster with the Ethernet.

And is there any personalized data in it like the serial number or license information?

I don't need serial number or license files. You can mount image and delete all those files (but leave /rigol/data/default - those are calibration files)

Eventually make a backup of those, make a dump and then recover those files.

[0xdeadbeef]

Much faster with the Ethernet.

Yeah, I was lazy and just wanted to check if it's working in principle, but now I'm at 16GB and don't think it's worth to restart.

I don't need serial number or license files. You can mount image and delete all those files (but leave /rigol/data/default - those are calibration files)

Let's see if I will be able to delete these files with something like Ext2explore. If opening the image will work at all.
Besides, the question is how feasible it is to upload such a large image somewhere. Any idea how big this will be if zipped?

[norbert.kiszka]

Ext2explore.

I guess this is a Windows thing.

On Linux You can use this.

Besides, the question is how feasible it is to upload such a large image somewhere. Any idea how big this will be if zipped?

Most of this is a empty space. It should be around 6-8 GB.

You can use LZMA, XZ, GZ or whatever compression. On a Debian (Linux) I can handle all of them, including extremely rare and old compression methods.

[Fungus]

Let's see if I will be able to delete these files with something like Ext2explore.

Probably not.

Use ADB, it lets you execute Unix command line functions with "shell".

eg.

Code: [Select]

adb connect 192.168.0.XXX:55555
adb shell ls /rigol/data
adb shell rm /rigol/data/vendor.bin


You can copy files between 'scope and PC with pull and push (do this first!):

Code: [Select]

adb pull /rigol/data/vendor.bin
adb push vendor.bin /rigol/data/


[0xdeadbeef]

Yeah, I wasn't aware that mounting or even opening/checking a sector based (DD?) image of an Android device would be such a PITA under Windows.
At the moment, I don't think I will be able to delete serial number and the like from that image.
And most I certainly won't mess around with the file system and delete/remove/rename files there while the scope is running.

This being said, the image I downloaded is 31299993600 bytes in size. If I browse if with a hex editor, it sure contains readable data (and a lot of zeroes).
Zipped with 7zip it's surprisingly only 459MB.

[Fungus]

This being said, the image I downloaded is 31299993600 bytes in size. If I browse if with a hex editor, it sure contains readable data (and a lot of zeroes).

It's mostly empty.

And most I certainly won't mess around with the file system and delete/remove/rename files there while the scope is running.

The 'scope really is just an android app running on Android. You can delete the entire Rigol app and the 'scope will boot just fine and you can use ADB to reinstall it.

I don't see why anybody needs an entire disk image though. It's not more helpful than just the firmware file (is that downloadable?)

If you run "/rigol/build_gel.sh" on the command line it will zip up your current firmware and files into a .GEL file that somebody else could install their 'scope. It's how Rigol devs make firmware update files from their development 'scopes.

You could do that and upload the .GEL file for the hackers. It has no personal info in it.

The destination file is embedded in "build_gel.sh". You can pull that file and see what file it makes (probably "MHO900_Update.GEL"). It goes in "/rigol/"

[norbert.kiszka]

Let's see if I will be able to delete these files with something like Ext2explore.

Probably not.

And why You think like that?

I can access and modify any FS from image - no matter if there is a partition table or not.

[0xdeadbeef]

Yeah, I guess under Linux there are ways to mount the Ex4 partitions in this sector dump, but none of the diverse tools I tried under Windows found any kind of partition in there.
I guess I would have to store partitions from the dump in separate files to open them with Ext4 tools. It's a bit shocking though that none of the tools like OSF Mount or Arsenal Image Mounter is able to detect any kind of partition in there though they claim to support DD files.

[norbert.kiszka]

No surprise for me. Windows and Windows-only software is almost always useless.

[kmoonwalker]

Yeah, I guess under Linux there are ways to mount the Ex4 partitions in this sector dump, but none of the diverse tools I tried under Windows found any kind of partition in there.
I guess I would have to store partitions from the dump in separate files to open them with Ext4 tools. It's a bit shocking though that none of the tools like OSF Mount or Arsenal Image Mounter is able to detect any kind of partition in there though they claim to support DD files.

Disk Emulation software is not a partition type translation software usually so you can not access it in expected way (Arsenal has some translator built in but I find it very simple) plus they are very picky in terms of what you feed em

It is far less problematic from under Linux but Ext2Explore may work for you if all is done properly.

[0xdeadbeef]

Limited success:


The trick here seems to be do download the partitions separately:

Code: [Select]

/dev/block/mmcblk0p10   2031440 970644   1060796  48% /system
/dev/block/mmcblk0p9     124912    116    124796   1% /cache
/dev/block/mmcblk0p11     12016     40     11976   1% /metadata
/dev/block/mmcblk0p16  26855292 293568  26561724   2% /data
/dev/block/mmcblk0p15    495944 202964    292980  41% /rigol
->
adb pull /dev/block/mmcblk0p15
adb pull /dev/block/mmcblk0p16

Still, while there is a "delete" in Ext2explore.exe, it's grayed out...

@Norbert: it would be easier for me to extract file/folder that you need from the Rigol partition. Any specific wishes?

[norbert.kiszka]

This probably will not give bootloader, DT, and other staff. But still most useful are contents from /system, /rigol and probably in /data