Author Topic: Rigol MSO2000 series hacking  (Read 160635 times)

0 Members and 1 Guest are viewing this topic.

Offline iDevice

  • Regular Contributor
  • *
  • Posts: 134
  • Country: be
Re: Rigol MSO2000 series hacking
« Reply #100 on: August 23, 2014, 08:33:46 pm »
Did you check that the Noiseblocker is specified for equivalent air flow and (more important) pressure ?
 

Offline WesleyK

  • Contributor
  • Posts: 18
Re: Rigol MSO2000 series hacking
« Reply #101 on: August 23, 2014, 08:54:40 pm »
See this post:
https://www.eevblog.com/forum/testgear/who-has-replaced-a-rigol-oscilloscope-fan-because-of-noise/msg497352/#msg497352
It moves slightly less air but that should be ok in normal operating conditions.
 

Offline PepeK

  • Regular Contributor
  • *
  • Posts: 62
  • Country: sk
Re: Rigol MSO2000 series hacking
« Reply #102 on: August 23, 2014, 09:41:24 pm »
Did you check that the Noiseblocker is specified for equivalent air flow and (more important) pressure ?

Air flow is a bit lower. I will measure the temperature inside after 1 hour of operating and share it here. I do not expect troubles, as the room temperature is max 25 degrees Celsius.
 

Offline milek22

  • Contributor
  • Posts: 27
  • Country: pl
Re: Rigol MSO2000 series hacking
« Reply #103 on: August 24, 2014, 03:37:39 am »
Gentlemen.
I need drivers for USB JTAG-BLASTER - Win7.
Can someone give a link to strowników?
Win7 does not see me cards USB-BLASTER.
I have a question: Do you need to connect the USB-Blaster JTAG-SCOPE to install drivers ???
Thank you very much.
 

Offline Gandalf_Sr

  • Super Contributor
  • ***
  • Posts: 1729
  • Country: us
Re: Rigol MSO2000 series hacking
« Reply #104 on: August 24, 2014, 01:43:26 pm »
Might be getting somewhere but I'm stuck again...

After much frigging around, I finally managed to get my Bus Blaster running.  Now it's connected to the MSO2072A and talking to the BF526.

The problem appears to be that the readmem command always tells me that it can't dump the contents of external memory, it seems not to matter what range I type in for the second value, I tried 0x0000FFFF, the response is still exactly the same as the dump below.  I'm trying to follow Slappy_g's instructions on page 3 of this topic but I always get the response below.  What are the missing steps 4,5 & 12?  Any ideas?

Code: [Select]
UrJTAG 0.10 #1869
Copyright (C) 2002, 2003 ETC s.r.o.
Copyright (C) 2007, 2008, 2009 Kolja Waschk and the respective authors

UrJTAG is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
There is absolutely no warranty for UrJTAG.

jtag.c:518 main() Warning: UrJTAG may damage your hardware!
Type "quit" to exit, "help" for help.

jtag> cable jtagkey interface=0
Connected to libftd2xx driver.
jtag> frequency 5000000
Setting TCK frequency to 5000000 Hz
jtag> detect
IR length: 5
Chain length: 1
Device Id: 00100010011111100100000011001011 (0x227E40CB)
  Manufacturer: Analog Devices (0x0CB)
  Part(0):      BF526 (0x27E4)
  Stepping:     2
  Filename:     c:\program files (x86)\urjtag\data/analog/bf527/bf527
bfin-part-bfin.c:155 bfin_wait_ready() Warning: untested cable or frequency, set
 wait_clocks to 21
jtag> initbus bf526_ezkit
jtag> readmem 0x00000000 0x001FFFFF output.dmp
Error: blackfin.c:87 bfin_bus_area() out of bounds: reading external memory not
supported
jtag>
If at first you don't succeed, get a bigger hammer
 

Offline PepeK

  • Regular Contributor
  • *
  • Posts: 62
  • Country: sk
Re: Rigol MSO2000 series hacking
« Reply #105 on: August 24, 2014, 04:54:35 pm »
@Gandalf :

Do you use two separate console windows ? (gdbproxy + gdb )

What is returned when you type the "info mem" as gdb command ?

The gdb command for a dump is "dump binary memory destination_file  0x00000000 0x07FFFFFF".
 

Offline Gandalf_Sr

  • Super Contributor
  • ***
  • Posts: 1729
  • Country: us
Re: Rigol MSO2000 series hacking
« Reply #106 on: August 24, 2014, 06:23:34 pm »
@PepeK

I was attempting to use urJTAG; as far as I know, urJTAG only runs with the one command window and the commands are different to (gdb).

I am doing it wrong? Anybody?
If at first you don't succeed, get a bigger hammer
 

Offline iDevice

  • Regular Contributor
  • *
  • Posts: 134
  • Country: be
Re: Rigol MSO2000 series hacking
« Reply #107 on: August 24, 2014, 09:47:56 pm »
Did you check that the Noiseblocker is specified for equivalent air flow and (more important) pressure ?

Air flow is a bit lower. I will measure the temperature inside after 1 hour of operating and share it here. I do not expect troubles, as the room temperature is max 25 degrees Celsius.

Yes but remember, air flow is not the whole story.
Pressure is as important because air flow is measured in open air.
As soon as you load the fan, air flow drops.
One of the reason these silent fans are low noise is because they rotate slowly and blades have a different shape.
The major drawback is that they are not capable of much pressure, which means that as soon as they are loaded with a relatively cluttered enclosure, air flow drops to almost nothing sometimes.
I experienced that in one of my analog scope and I had to go back to a relatively more noisy fan to have sufficient cooling.
Open air flow characteristics were equivalent though.
So beware...
 

Offline PepeK

  • Regular Contributor
  • *
  • Posts: 62
  • Country: sk
Re: Rigol MSO2000 series hacking
« Reply #108 on: August 24, 2014, 10:06:28 pm »
@PepeK
I was attempting to use urJTAG; as far as I know, urJTAG only runs with the one command window and the commands are different to (gdb).
I am doing it wrong? Anybody?

Sorry, I mean Linux way, I have not recognized you are using urJTAG in Win. Have you ever considered the Linux way ? It is possible to boot from an USB key and nothing is installed physically on the computer.
 

Offline Slappy_gTopic starter

  • Regular Contributor
  • *
  • Posts: 53
  • Country: us
Re: Rigol MSO2000 series hacking
« Reply #109 on: August 24, 2014, 11:55:15 pm »
@PepeK

I was attempting to use urJTAG; as far as I know, urJTAG only runs with the one command window and the commands are different to (gdb).

I am doing it wrong? Anybody?
Sorry, I had terrible luck with urJTAG, and ended up giving up after no success.
Unlocked the Rigol MSO2072A to a MSO2302A via JTAG.  Read about how here: https://www.eevblog.com/forum/testgear/rigol-mso2000-series-hacking/msg498454/#msg498454
 

Offline Gandalf_Sr

  • Super Contributor
  • ***
  • Posts: 1729
  • Country: us
Re: Rigol MSO2000 series hacking
« Reply #110 on: August 25, 2014, 12:51:26 am »
@Slappy_g

So your multi-point bullet list is for gdb?  If yes, is it under Linux or Windows?  I think you went Windows.

I too am unimpressed with urJTAG, the Olimex ARM-USB-OCD is supposed to arrive next Wednesday.
If at first you don't succeed, get a bigger hammer
 

Offline Bukurat

  • Regular Contributor
  • *
  • Posts: 65
  • Country: au
Re: Rigol MSO2000 series hacking
« Reply #111 on: August 25, 2014, 08:03:05 am »
@Slappy_g

Your post gave me some hope as I have been trying to get the Olimex ARM-USB-OCD working on Windows 7 32 bit.

Following your post I swapped out the Olimax drivers for the WinUSB ones using Zadig, now I'm seeing a warning message about TD0 being stuck at 0.

Did you encounter this in your travels?
Do you know if its possible to test communication with the Olimex ARM-USB-OCD device without attaching it to a TAG connector?



 
 

Offline navzptc

  • Contributor
  • Posts: 26
Re: Rigol MSO2000 series hacking
« Reply #112 on: August 25, 2014, 05:57:33 pm »
@Slappy_g

Your post gave me some hope as I have been trying to get the Olimex ARM-USB-OCD working on Windows 7 32 bit.

Following your post I swapped out the Olimax drivers for the WinUSB ones using Zadig, now I'm seeing a warning message about TD0 being stuck at 0.

Did you encounter this in your travels?
Do you know if its possible to test communication with the Olimex ARM-USB-OCD device without attaching it to a TAG connector?

I had that problem when I installed the 'H' version on Win 7 64 bit, and it all came down to the drivers  :palm:

I stumbled across these drivers (H version) and after installing the drivers and following Slappy_g's excellent write up am now fully up and running  :-+

If you try and run the program NOT connected to the JTAG header it will come up with an error message, but not the TDO stuck one.

Good luck, you will get there eventually!!

Andy
 

Offline mscreations

  • Contributor
  • Posts: 21
  • Country: us
Re: Rigol MSO2000 series hacking
« Reply #113 on: August 25, 2014, 08:02:59 pm »
Just a point of advice for anyone looking to do this. Don't waste your time or money with the cheap chinese USB Blaster clones... I had an Olimex adapter overnighted and it is currently dumping the memory without issue (Running Ubuntu 14.04LTS 64bit). I'll report back after getting it dumped and trying to do the key generation whether I run into any problems, but so far it has been FAR less painless then mucking about with that chinese crap I bought the first time.

AND... COMPLETE SUCCESS!! Took about 30 minutes or so to dump the memory and then used rigup on the resulting memory dump. Few seconds later I had my key. Now I've got an optioned MSO2202A!
« Last Edit: August 25, 2014, 08:44:51 pm by mscreations »
 

Offline Bukurat

  • Regular Contributor
  • *
  • Posts: 65
  • Country: au
Re: Rigol MSO2000 series hacking
« Reply #114 on: August 26, 2014, 03:23:39 am »

I had that problem when I installed the 'H' version on Win 7 64 bit, and it all came down to the drivers  :palm:

I stumbled across these drivers (H version) and after installing the drivers and following Slappy_g's excellent write up am now fully up and running  :-+

If you try and run the program NOT connected to the JTAG header it will come up with an error mmy WIN essage, but not the TDO stuck one.

Good luck, you will get there eventually!!

Andy

This morning I tried installing everything on my Win 7 64 bit laptop, following Slappy_g's post.

It doesn't find the device at all.


C:\GNU Toolchain\elf\bin>bfin-gdbproxy.exe --debug

Remote proxy for GDB, v0.7.2, Copyright (C) 1999 Quality Quorum Inc.
MSP430 adaption Copyright (C) 2002 Chris Liechti and Steve Underwood
Blackfin adaption Copyright (C) 2008 Analog Devices, Inc.

GDBproxy comes with ABSOLUTELY NO WARRANTY; for details
use `--warranty' option. This is Open Source software. You are
welcome to redistribute it under certain conditions. Use the
'--copying' option for details.

debug:     bfin: bfin_open ()
error:     bfin: cable initialization failed
debug:     bfin: bfin_open ()
error:     bfin: cable initialization failed
^C
C:\GNU Toolchain\elf\bin>


This was with the Olimex ARM-USB-OCD connected, but not the DSO.

On the 32 Bit Win 7 laptop it at least finds the Olimex adapter. and appears to connect to it as the LED changes from green to red and it tells me its using the libftdi driver!

Mine is not the H version adaptor.

I get the TDO stuck low error message irrespective of whether its connected to the DSO or not.



« Last Edit: August 26, 2014, 03:47:45 am by Bukurat »
 

Offline Bukurat

  • Regular Contributor
  • *
  • Posts: 65
  • Country: au
Re: Rigol MSO2000 series hacking
« Reply #115 on: August 26, 2014, 03:55:16 am »
Just a point of advice for anyone looking to do this. Don't waste your time or money with the cheap chinese USB Blaster clones... I had an Olimex adapter overnighted and it is currently dumping the memory without issue (Running Ubuntu 14.04LTS 64bit). I'll report back after getting it dumped and trying to do the key generation whether I run into any problems, but so far it has been FAR less painless then mucking about with that chinese crap I bought the first time.

AND... COMPLETE SUCCESS!! Took about 30 minutes or so to dump the memory and then used rigup on the resulting memory dump. Few seconds later I had my key. Now I've got an optioned MSO2202A!

Are you using the blackfin toolchain?.If so, which one?

I have an old IBM laptop that has Ubuntu 32 bit installed.
 

Offline Gandalf_Sr

  • Super Contributor
  • ***
  • Posts: 1729
  • Country: us
Re: Rigol MSO2000 series hacking
« Reply #116 on: August 26, 2014, 11:03:04 am »
Just a point of advice for anyone looking to do this. Don't waste your time or money with the cheap chinese USB Blaster clones... I had an Olimex adapter overnighted and it is currently dumping the memory without issue (Running Ubuntu 14.04LTS 64bit). I'll report back after getting it dumped and trying to do the key generation whether I run into any problems, but so far it has been FAR less painless then mucking about with that chinese crap I bought the first time.

AND... COMPLETE SUCCESS!! Took about 30 minutes or so to dump the memory and then used rigup on the resulting memory dump. Few seconds later I had my key. Now I've got an optioned MSO2202A!

I can120% definitely, positively, agree with this statement.  My new MSO2072A has been sitting on the bench, opened up, while I ordered, waited for, set up, and failed with:

1. A $7 'Altera' USB Blaster from eBay
2. A Bus Blaster from dangerousprototypes.com

I tried Ubuntu, Windows, gdb, and urJTAG.  If you want to do this, buy the Olimex device from Sparkfun.

The Olimex JTAG-USB-OCD is supposed to arrive tomorrow....
If at first you don't succeed, get a bigger hammer
 

Offline leppie

  • Frequent Contributor
  • **
  • Posts: 269
  • Country: za
Re: Rigol MSO2000 series hacking
« Reply #117 on: August 26, 2014, 11:15:51 am »
I tried Ubuntu, Windows, gdb, and urJTAG. 

Is using OpenOCD not possible? Has anyone tried with a JLink clone?
 

Offline mscreations

  • Contributor
  • Posts: 21
  • Country: us
Re: Rigol MSO2000 series hacking
« Reply #118 on: August 26, 2014, 04:23:04 pm »
Just a point of advice for anyone looking to do this. Don't waste your time or money with the cheap chinese USB Blaster clones... I had an Olimex adapter overnighted and it is currently dumping the memory without issue (Running Ubuntu 14.04LTS 64bit).

Are you using the blackfin toolchain?.If so, which one?

I have an old IBM laptop that has Ubuntu 32 bit installed.

I used the 64 bit 2004 r1 45 blackfin tool chain.
 

Offline Macman

  • Regular Contributor
  • *
  • Posts: 77
  • Country: gb
Re: Rigol MSO2000 series hacking
« Reply #119 on: August 26, 2014, 05:08:07 pm »
There seems to be some different versions of the Altera Clone blaster. The one I have which uses the Silabs F321 chip and works fine (although quite slowly) with the 32 bit version of the toolchain. I used the 32bit version as I seem to remember it being metioned somewhere  that there were problems trying to use the 64 bit version with the clone USB blasters.
 

Offline Gixy

  • Regular Contributor
  • *
  • Posts: 232
  • Country: fr
Re: Rigol MSO2000 series hacking
« Reply #120 on: August 27, 2014, 12:01:08 am »
Hi guys,
First of all, congratulations for your tremendous work, very impressive!
I'm preparing the future hacking of the MSO2072A I intend to order and started to download everything to comply with the Slappy_g procedure. Problem: Avast anti-virus software is detecting a malware (win32:EVo-gen) in the Blackfin Toolchain for windows .exe. Is it a false alert and can I in your opinion download safely this file (which is not so easy with Avast running...)?
Thx in advance,
Denis
 

Offline Bukurat

  • Regular Contributor
  • *
  • Posts: 65
  • Country: au
Re: Rigol MSO2000 series hacking
« Reply #121 on: August 27, 2014, 12:56:08 am »
Hi guys,
First of all, congratulations for your tremendous work, very impressive!
I'm preparing the future hacking of the MSO2072A I intend to order and started to download everything to comply with the Slappy_g procedure. Problem: Avast anti-virus software is detecting a malware (win32:EVo-gen) in the Blackfin Toolchain for windows .exe. Is it a false alert and can I in your opinion download safely this file (which is not so easy with Avast running...)?
Thx in advance,
Denis


I saw that on the download to the 64 bit Win install.  I turned off the virus checker while downloading and added the program to the do not scan list while installing.   It's complaining about the uninstall program in the installer.
It you let it scan while installing it will drop that one in the chest.
 
Once I uninstall I'll run a full scan on the Laptop just to be sure. It didn't complain when I downloaded the 32 bit version on another laptop
 

Offline Slappy_gTopic starter

  • Regular Contributor
  • *
  • Posts: 53
  • Country: us
Re: Rigol MSO2000 series hacking
« Reply #122 on: August 27, 2014, 01:10:04 am »
Might be getting somewhere but I'm stuck again...

After much frigging around, I finally managed to get my Bus Blaster running.  Now it's connected to the MSO2072A and talking to the BF526.

The problem appears to be that the readmem command always tells me that it can't dump the contents of external memory, it seems not to matter what range I type in for the second value, I tried 0x0000FFFF, the response is still exactly the same as the dump below.  I'm trying to follow Slappy_g's instructions on page 3 of this topic but I always get the response below.  What are the missing steps 4,5 & 12?  Any ideas?

I've been away a few days...  I missed this post.  There are no missing steps - I was just skipping some lines to make the formatting easier and got lazy.
Unlocked the Rigol MSO2072A to a MSO2302A via JTAG.  Read about how here: https://www.eevblog.com/forum/testgear/rigol-mso2000-series-hacking/msg498454/#msg498454
 

Offline Slappy_gTopic starter

  • Regular Contributor
  • *
  • Posts: 53
  • Country: us
Re: Rigol MSO2000 series hacking
« Reply #123 on: August 27, 2014, 01:13:05 am »
Hi guys,
First of all, congratulations for your tremendous work, very impressive!
I'm preparing the future hacking of the MSO2072A I intend to order and started to download everything to comply with the Slappy_g procedure. Problem: Avast anti-virus software is detecting a malware (win32:EVo-gen) in the Blackfin Toolchain for windows .exe. Is it a false alert and can I in your opinion download safely this file (which is not so easy with Avast running...)?
Thx in advance,
Denis

As I indicated in my post, I have used the 32-bit toolchain running under Windows 7 64-bit.  Weird, but I didn't want to take changes with the x64 toolchain.  I have not had any virus warnings from my AV tools, so I'm guessing it's a false positive, provided you got it from the original source and not some other site.
Unlocked the Rigol MSO2072A to a MSO2302A via JTAG.  Read about how here: https://www.eevblog.com/forum/testgear/rigol-mso2000-series-hacking/msg498454/#msg498454
 

Offline Slappy_gTopic starter

  • Regular Contributor
  • *
  • Posts: 53
  • Country: us
Re: Rigol MSO2000 series hacking
« Reply #124 on: August 27, 2014, 01:17:57 am »
@Slappy_g

Your post gave me some hope as I have been trying to get the Olimex ARM-USB-OCD working on Windows 7 32 bit.

Following your post I swapped out the Olimax drivers for the WinUSB ones using Zadig, now I'm seeing a warning message about TD0 being stuck at 0.

Did you encounter this in your travels?
Do you know if its possible to test communication with the Olimex ARM-USB-OCD device without attaching it to a TAG connector?

I had that problem when I installed the 'H' version on Win 7 64 bit, and it all came down to the drivers  :palm:

I stumbled across these drivers (H version) and after installing the drivers and following Slappy_g's excellent write up am now fully up and running  :-+

If you try and run the program NOT connected to the JTAG header it will come up with an error message, but not the TDO stuck one.

Good luck, you will get there eventually!!

Andy

Glad it worked for you!  Thanks also for posting these drivers.  They will be helpful to anyone with the -H version of the product.  Out of curiosity, how long did your process take?  I'm guessing the H version is much faster.  Mine took 1-2 hours or so.
Unlocked the Rigol MSO2072A to a MSO2302A via JTAG.  Read about how here: https://www.eevblog.com/forum/testgear/rigol-mso2000-series-hacking/msg498454/#msg498454
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf