Author Topic: Rigol MSO2000 series hacking  (Read 160647 times)

0 Members and 3 Guests are viewing this topic.

Offline Slappy_gTopic starter

  • Regular Contributor
  • *
  • Posts: 53
  • Country: us
Rigol MSO2000 series hacking
« on: July 22, 2014, 03:26:54 pm »
[EDIT: I have added a detailed step-by-step guide further down on page 5.]

I did some searching and found conflicting information on this...

I was about to order an MSO2102A-S (the 100MHz version with the built-in signal generator).

Do any of the DS2000A hacks also work for the MSO2000A series, or am I SOL on attempting to unlock some options?  I honestly care less about the bandwidth as I do the extra memory buffer and advanced triggering options.  I could survive without the rest.

Has anyone had success with applying the DS2000A hacks on the MSO2000A machines?  Many thanks...
« Last Edit: August 19, 2014, 02:53:13 am by Slappy_g »
Unlocked the Rigol MSO2072A to a MSO2302A via JTAG.  Read about how here: https://www.eevblog.com/forum/testgear/rigol-mso2000-series-hacking/msg498454/#msg498454
 

Offline MarcelM

  • Contributor
  • Posts: 23
  • Country: nl
Re: Rigol MSO2000 series hacking
« Reply #1 on: July 22, 2014, 04:56:32 pm »
Yes,
I have successfully "upgraded" my MSO2072A using the rigup published here.
Just be aware that the latest non-downgradeable firmware version requires that you go the JTAG memory dump route described in the megathread about sniffing...
The added piece of mind (for me at least) is that I didn't have to muck about downgrading/upgrading any firmware, potentially bricking my new MSO.
Since I only entered the generated keys, the upgrades should stay intact after future upgrades.

I am completely happy with my fully unlocked 200MHz MSO2072A
(I initially went for the 300MHz, but decided against it for signal fidelity reasons)
Also, accurately probing a real 300MHz signal isn't trivial...

YMMV,

best of luck with your new MSO

Marcel
--------------------------------------------
Electronics is FUN !
If you want me to take it seriously,
... Call, and we'll talk consultancy rates ...
--------------------------------------------
 

Offline Slappy_gTopic starter

  • Regular Contributor
  • *
  • Posts: 53
  • Country: us
Re: Rigol MSO2000 series hacking
« Reply #2 on: July 22, 2014, 08:58:01 pm »
Yes,
I have successfully "upgraded" my MSO2072A using the rigup published here.
Just be aware that the latest non-downgradeable firmware version requires that you go the JTAG memory dump route described in the megathread about sniffing...
The added piece of mind (for me at least) is that I didn't have to muck about downgrading/upgrading any firmware, potentially bricking my new MSO.
Since I only entered the generated keys, the upgrades should stay intact after future upgrades.

I am completely happy with my fully unlocked 200MHz MSO2072A
(I initially went for the 300MHz, but decided against it for signal fidelity reasons)
Also, accurately probing a real 300MHz signal isn't trivial...

YMMV,

best of luck with your new MSO

Marcel

Marcel,

Many thanks for your response. Never messed with JTAG connections before so I guess that will be a learning process for me.

Have you seen any reports of the signal generator function having any effect on the unlocking/upgrading process? If not, then I may order the 70MHz version versus the 100MHz version I was planning to get.

Sent from my SM-N900T using Tapatalk

« Last Edit: July 22, 2014, 10:34:44 pm by Slappy_g »
Unlocked the Rigol MSO2072A to a MSO2302A via JTAG.  Read about how here: https://www.eevblog.com/forum/testgear/rigol-mso2000-series-hacking/msg498454/#msg498454
 

Offline benjamin125

  • Newbie
  • Posts: 2
Re: Rigol MSO2000 series hacking
« Reply #3 on: July 26, 2014, 11:59:29 pm »
Yes,
I have successfully "upgraded" my MSO2072A using the rigup published here.
Just be aware that the latest non-downgradeable firmware version requires that you go the JTAG memory dump route described in the megathread about sniffing...
The added piece of mind (for me at least) is that I didn't have to muck about downgrading/upgrading any firmware, potentially bricking my new MSO.
Since I only entered the generated keys, the upgrades should stay intact after future upgrades.

I am completely happy with my fully unlocked 200MHz MSO2072A
(I initially went for the 300MHz, but decided against it for signal fidelity reasons)
Also, accurately probing a real 300MHz signal isn't trivial...

YMMV,

best of luck with your new MSO

Marcel


Hi
Can you add the link  you did successfully hack your MSO2072A?
thank you !
 

Offline mscreations

  • Contributor
  • Posts: 21
  • Country: us
Re: Rigol MSO2000 series hacking
« Reply #4 on: August 03, 2014, 12:56:23 am »
Yes,
I have successfully "upgraded" my MSO2072A using the rigup published here.
Just be aware that the latest non-downgradeable firmware version requires that you go the JTAG memory dump route described in the megathread about sniffing...
The added piece of mind (for me at least) is that I didn't have to muck about downgrading/upgrading any firmware, potentially bricking my new MSO.
Since I only entered the generated keys, the upgrades should stay intact after future upgrades.

I am completely happy with my fully unlocked 200MHz MSO2072A
(I initially went for the 300MHz, but decided against it for signal fidelity reasons)
Also, accurately probing a real 300MHz signal isn't trivial...

YMMV,

best of luck with your new MSO

Marcel

Marcel,

After performing the JTAG memory dump, what commands and options did you use with the rigup tool? Did you have to have anyone extract the keys from your dump file or did the tool do that automatically? What were the valid option codes for the MSO2000 series? Were they the same as for the DS2000 series?

Thanks!  :-+

Jon
 

Offline PepeK

  • Regular Contributor
  • *
  • Posts: 62
  • Country: sk
Re: Rigol MSO2000 series hacking
« Reply #5 on: August 05, 2014, 09:01:52 pm »
Hi all,

I have just bought the MSO 2072 A,   SW  00.03.00.SP1,   HW  2.2.
Can somebody confirm that the link http://www.gotroot.ca/rigol/DS2000-03_00_01_03.7z" is the exact copy of the latest official firmware  00.03.00.SP1 ?
My plan is to try unlock all features + increase bandwidth but before doing it it would be nice to have some backup file as a safe point where to return.

Thank you. Peter.
 

Offline pascal_sweden

  • Super Contributor
  • ***
  • Posts: 1539
  • Country: no
Re: Rigol MSO2000 series hacking
« Reply #6 on: August 06, 2014, 01:06:03 am »
Do you really need to open the scope and take a memory dump using the JTAG adapter?

I have read about the riglol tool which will generate a key simply based on the serial number of your scope. Or does this riglol tool only work for the DS series and not for the MSO series?

I am looking for confirmation if riglol tool which just requires serial number, also works for the MSO1074Z and MSO2072A series of scopes.

Can anyone out there confirm that he has successfully upgraded his MSO1074Z or MSO2072A series WITHOUT opening up his scope?
 

Offline mscreations

  • Contributor
  • Posts: 21
  • Country: us
Re: Rigol MSO2000 series hacking
« Reply #7 on: August 06, 2014, 01:33:48 am »
After reading the entire "monster" thread (yes really...), I'm pretty sure that you do have to open it up. You need to get the key for the specific unit to make it work. On the DS2000 series, they have the patched firmware that allows them to easily get the keys, but that firmware was v.2 if i remember and v.3 is when the MSO was added. Not sure whether it'd be a good idea to flash that firmware to an MSO just to get the keys.

But at this point for me, it is still theoretical (at least for a little bit). I finally saved up enough to order mine tomorrow so here's to hoping for quick shipping! And then on to some hacking.
 

Offline milek22

  • Contributor
  • Posts: 27
  • Country: pl
Re: Rigol MSO2000 series hacking
« Reply #8 on: August 12, 2014, 05:26:12 am »
After reading the entire "monster" thread (yes really...), I'm pretty sure that you do have to open it up. You need to get the key for the specific unit to make it work. On the DS2000 series, they have the patched firmware that allows them to easily get the keys, but that firmware was v.2 if i remember and v.3 is when the MSO was added. Not sure whether it'd be a good idea to flash that firmware to an MSO just to get the keys.

But at this point for me, it is still theoretical (at least for a little bit). I finally saved up enough to order mine tomorrow so here's to hoping for quick shipping! And then on to some hacking.

I need help:
1 How to update MSO2072A to the full version without opening the oscilloscope?
2 Is there a FW update?
3.How to uzysk? HEX file and the key?
4 My SW 03 and HW 2.2
5 Which patched file .GEL the DS2000 can test?
thank you very much
 

Offline PepeK

  • Regular Contributor
  • *
  • Posts: 62
  • Country: sk
Re: Rigol MSO2000 series hacking
« Reply #9 on: August 12, 2014, 09:20:18 am »
To Milek22 :

1 How to update MSO2072A to the full version without opening the oscilloscope?
As you have SW version 3 and HW version 2.2 it is not possible. Other people tried, the scope refuses a firmware downgrade.
Maybe a solution is to change a header of the 2.0 GEL to pretend it is 3.0.

2 Is there a FW update?
You have the latest firmware, in the future you can upgrade if Rigol releases a new GEL file.

5 Which patched file .GEL the DS2000 can test?
You can try http://gotroot.ca/rigol/DS2000(DSP)update_00.02.01.00.03%20(patched).zip but do not expect it works - see point 1.
 

Offline milek22

  • Contributor
  • Posts: 27
  • Country: pl
Re: Rigol MSO2000 series hacking
« Reply #10 on: August 12, 2014, 10:00:49 am »
To Milek22 :

1 How to update MSO2072A to the full version without opening the oscilloscope?
As you have SW version 3 and HW version 2.2 it is not possible. Other people tried, the scope refuses a firmware downgrade.
Maybe a solution is to change a header of the 2.0 GEL to pretend it is 3.0.

2 Is there a FW update?
You have the latest firmware, in the future you can upgrade if Rigol releases a new GEL file.

5 Which patched file .GEL the DS2000 can test?
You can try http://gotroot.ca/rigol/DS2000(DSP)update_00.02.01.00.03%20(patched).zip but do not expect it works - see point 1.

5 I did not read it but then the file .GEL
2 posts above colleague writes about the patched version of the DS2000 but without success.
This leaves us waiting for? new .GEL
3. How to run a generator "rigup-04" ???
best regards and thanks
« Last Edit: August 13, 2014, 06:24:24 am by milek22 »
 

Offline milek22

  • Contributor
  • Posts: 27
  • Country: pl
Re: Rigol MSO2000 series hacking
« Reply #11 on: August 13, 2014, 03:15:27 pm »
Yes,
I have successfully "upgraded" my MSO2072A using the rigup published here.
Just be aware that the latest non-downgradeable firmware version requires that you go the JTAG memory dump route described in the megathread about sniffing...
The added piece of mind (for me at least) is that I didn't have to muck about downgrading/upgrading any firmware, potentially bricking my new MSO.
Since I only entered the generated keys, the upgrades should stay intact after future upgrades.

I am completely happy with my fully unlocked 200MHz MSO2072A
(I initially went for the 300MHz, but decided against it for signal fidelity reasons)
Also, accurately probing a real 300MHz signal isn't trivial...

YMMV,

best of luck with your new MSO

Marcel


I ask for a link, step by step how to unlock MSO2072A by JTAG?
thanks
« Last Edit: August 13, 2014, 03:17:23 pm by milek22 »
 

Offline pascal_sweden

  • Super Contributor
  • ***
  • Posts: 1539
  • Country: no
Re: Rigol MSO2000 series hacking
« Reply #12 on: August 13, 2014, 03:39:14 pm »
The proposal to change the header of the firmware to make it think that it is newer firmware sounds promising.

Could anyone try this out?

I am looking for hack that works without opening up the scope. This counts for both the MSO2072A and the MSO1074Z.

With a bit of effort, it should be possible to come up with such a hack, that works without opening up the scope.
The whole Rigol community will benefit from this, as the majority of the people are not keen in opening up their scopes.

 

Offline mscreations

  • Contributor
  • Posts: 21
  • Country: us
Re: Rigol MSO2000 series hacking
« Reply #13 on: August 13, 2014, 04:44:42 pm »
As soon as I get my JTAG programmer I'm going to give it a try. I'll make a step by step after getting it working.

As for modifying the firmware I'd love to tackle that bit I don't have any clue where to start.
 

Offline PepeK

  • Regular Contributor
  • *
  • Posts: 62
  • Country: sk
Re: Rigol MSO2000 series hacking
« Reply #14 on: August 13, 2014, 08:49:55 pm »
Do not be afraid of opening the scope - I have done it today. It is not a problem to remove the warranty sticker without destroying it. Simply use some small piece of a waxed / oiled paper (for example a paper for laser printer stickers) and do some "saw type" movement. There is also a video on the youtube showing how to do it. My sticker has been removed completely and waits on a waxed paper in a bag for a case of a warranty repair - see photo.

Think : what do you prefer ? Install a hacked firmware where nobody can be 100% sure if is compatible with a current release of hardware or remove one stupid sticker for using the JTAG adapter and have serials numbers which you simply enter via Ultra sigma ?
 

Offline PepeK

  • Regular Contributor
  • *
  • Posts: 62
  • Country: sk
Re: Rigol MSO2000 series hacking
« Reply #15 on: August 13, 2014, 09:03:52 pm »
It is easy to open the scope : you need a Torx 10 screwdriver and a number 14 wrench.
Opening the scope is also a good opportunity to replace that ugly noisy fan with a silent one. According the datasheet it is about 35 dB and for 5 euros you can buy a 17 dB version. When my JTAG adapter arrive from China, I will inform you about the details.

1. Remove the four screws keeping the back panel - two are visible and two are hidden under the handle (adjust it to 45 degree angle) - see photos.
2. Remove the nut of the BNC connector using a wrench number 14.
3. Remove the 8 screws (4 at the top + 4 at the bottom) holding a shielding together.
4. Congratulations, you scope is now naked as Rigol created it  :)

There is a four pin connector having a "strong" 3.3 Volts, be careful, the voltage is here also when the scope is off (it is maybe a stand-by voltage). All pins are marked, use the Vcc. The JTAG from Blackin chip is also clearly visible. Do not use "weak" 3.3V from the JTAG connector.

 

Offline WesleyK

  • Contributor
  • Posts: 18
Re: Rigol MSO2000 series hacking
« Reply #16 on: August 13, 2014, 09:10:34 pm »
Thanks, great pictures! Will surely be of help when I upgrade mine. Can you also tell something about the hack itself? Did you use windows or linux? If you used Windows, can you tell us something about the required steps as most info is based on hacking using a Linux system.
 

Offline PepeK

  • Regular Contributor
  • *
  • Posts: 62
  • Country: sk
Re: Rigol MSO2000 series hacking
« Reply #17 on: August 13, 2014, 09:42:37 pm »
Thanks, great pictures! Will surely be of help when I upgrade mine. Can you also tell something about the hack itself? Did you use windows or linux? If you used Windows, can you tell us something about the required steps as most info is based on hacking using a Linux system.

I do not have the JTAG adapter now - I am waiting for it to be delivered from China (cheap Altera USB blaster clone for approx 6 euro - there in no reason to buy Olimex for 55 euro) ... The plan is to use Linux, it is easy to create a bootable USB key with Ubuntu. The advantage is, a new operating system is not installed physically, it only runs from RAM. A dump file can be saved to any Windows disk drive, Ubuntu maps them without any problem. This is my first Linux experience, it is not complicated, everything is GUI based and all drivers are loaded automatically.
 

Offline milek22

  • Contributor
  • Posts: 27
  • Country: pl
Re: Rigol MSO2000 series hacking
« Reply #18 on: August 14, 2014, 04:59:50 am »
Thanks gentlemen.
Of course, the whole community formum will not open the oscilloscope.
First Colleague Pepek - on your photo pcb writes DS2000?
2 Do looks the same pcb board MSO 2072? I am your scobe jescze not opened.
3 Is the JTAG as below can be taken?


4 How to do it under Linux?
5 What are the commands you need to type?
Waiting for a description of how to do it step by step through JTAG.
Thank you

1 Support 1.5V, 1.8V, 2.5V, 3.5V and 5.0V.

2nd Support all ALTERA products: CPLD (MAX3000A, MAX7000 devices, MAX9000 and MAX II); FPGA (Stratix, StratixII, Cyclone, CYCLONEII, ACEX 1K, and FLEX 10K APEX20K); Active serial configuration device (EPCS1, EPCS4, EPCS16)

---- Now we have tested chip using this tool is: Cyclone (EP1C3, EP1C6, EP1C12, EP1C20); Cyclone II (EP2C5, EP2C8, EP2C35); Stratix (EP1S10, EP1S20, EP1S25); Stratix II (EP2S60); FLEX10K (EPF10K10, EPF0K30); ACEX1K (EP1K30); MAX7000 (MAX7128SLC84, MAX7128); AETC100 (MAX3000, MAX3128); MAXII (MAXII240, MAXII570, MAXII1270); EPCS (EPCS1, EPCS4, EPCS16); EPC (EPC1, EPC4)

3 Support AS, PS and JTAG program (with Verify and Bank Check function).

---- When we tested the chip above, the use of the different program mode: JTAG (Cyclone, CYCLONEII, Stratix II, Flex10K, Acex1K, MAX7000 and MAX3000A); AS (EPCS1, EPCS4, EPCS16); PS (Stratix, Stratix GX)

4 Support embedded logic analyzer function of SignalTapII

5 Support NIOS II communication and debugger - When you use it to debug your Black Gold, it will not pop-up warning

6 Faster - about 6 times than ByteblasterII

7 USB interface! - You do not need a PC with serial port now

8 100% compatible with Official ALTERA USB Blaster
 

Offline PepeK

  • Regular Contributor
  • *
  • Posts: 62
  • Country: sk
Re: Rigol MSO2000 series hacking
« Reply #19 on: August 14, 2014, 06:47:49 am »
My scope is MSO 2072 A, SW : 3.0.SP1 and HW 2.2. There is no difference between DS 2072 A and MSO 2072 A  from the JTAG connector and memory dump point of view.
According to older posts here, the Altera USB blaster can be used - I have ordered exactly the same. I will add detailed instructions plus photos - delivery of USB blaster is expected in 2-3 weeks.
 

Offline Mark_O

  • Frequent Contributor
  • **
  • Posts: 939
  • Country: us
Re: Rigol MSO2000 series hacking
« Reply #20 on: August 14, 2014, 12:23:15 pm »
I am looking for hack that works without opening up the scope. This counts for both the MSO2072A and the MSO1074Z.

Yes, we know that.

Quote
With a bit of effort, it should be possible to come up with such a hack, that works without opening up the scope.

That is excellent news!  Please let us all know when you have it ready.   :-+ 

Oh, sorry.  You meant a bit of someone else's effort.  None for you.  Silly me.   :palm:

Quote
The whole Rigol community will benefit from this, as the majority of the people are not keen in opening up their scopes.

Sounds like an opportunity for you to be a real hero then, and make a contribution.
 

Offline Gandalf_Sr

  • Super Contributor
  • ***
  • Posts: 1729
  • Country: us
Re: Rigol MSO2000 series hacking
« Reply #21 on: August 14, 2014, 04:19:26 pm »
Guys, I too have an MSO2072A with SW 3.0.SP1 and HW 2.2.

I ordered the $6 'Altera' USB Blaster from eBay, there's a sort option that filters by distance and I found a company in Colorado selling them.  I ordered it on 8/5/14 and it
is supposed to arrive today shipping USPS.

I'm a hardware guy and have no worries about hooking the JTAG connector up but the Linux commands scare me slightly; what if I reformat the memory or something else really bad?  :-BROKE

I have a Dell Netbook that boots to Ubuntu so I that's going to be my first attempt to do the JTAG dump.

Won't get to this before this weekend at the earliest.  I will try to get pictures for y'all.
If at first you don't succeed, get a bigger hammer
 

Offline AntiCat

  • Contributor
  • Posts: 12
Re: Rigol MSO2000 series hacking
« Reply #22 on: August 14, 2014, 04:27:49 pm »
I ordered the scope on monday.
I have a USB Blaster but the scope is delayed 2-3 weeks |O
 

Offline Gandalf_Sr

  • Super Contributor
  • ***
  • Posts: 1729
  • Country: us
Re: Rigol MSO2000 series hacking
« Reply #23 on: August 14, 2014, 04:35:45 pm »
I ordered the scope on monday.
I have a USB Blaster but the scope is delayed 2-3 weeks |O
Not sure where you are on the planet (or even if you ARE on the planet) but Tequipment.net web site says they have 23 in stock and you can get 6% discount by using the code EEVBLOG6 giving a final price of $1,164.66 with free shipping.  I have ordered other stuff from them in the past and they are good to deal with.

Perhaps you could cancel and reorder?
If at first you don't succeed, get a bigger hammer
 

Offline mscreations

  • Contributor
  • Posts: 21
  • Country: us
Re: Rigol MSO2000 series hacking
« Reply #24 on: August 14, 2014, 05:07:49 pm »
I ordered the scope on monday.
I have a USB Blaster but the scope is delayed 2-3 weeks |O
Not sure where you are on the planet (or even if you ARE on the planet) but Tequipment.net web site says they have 23 in stock and you can get 6% discount by using the code EEVBLOG6 giving a final price of $1,164.66 with free shipping.  I have ordered other stuff from them in the past and they are good to deal with.

Perhaps you could cancel and reorder?

Yep! I ordered last Weds and got it on Monday. Very fast!
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf