| Products > Test Equipment |
| Sniffing the Rigol's internal I2C bus |
| << < (699/899) > >> |
| 1.21gigawatts:
I have successfully upgraded an MSO2072A-S using an "Altera" bus blaster (which I already had from another project). No problems at all following the instructions in this thread and others. Yes, I got the warning about the fixed frequency, but it worked fine anyway. One thing, though (and this has nothing to do with the upgrade): I'm having a hell of a time with Ultra Station downloading waveforms to the "-S" part of the instrument. It is recognized by Ultra Sigma (and I have edited the .ini file to apply Ultra Station to this scope). I can edit a wave form and download it, but the only thing that gets set is the frequency. The waveform never actually appears. Any idea what's going on here? Any better place to ask? |
| Gandalf_Sr:
I've just successfully 'upgraded' an MSO2072A to a MSO2302A. I had to go the JTAG dump route because I have the MSO, not the DS. My cheap 'Altera' USB Blaster didn't work, nor did a Bus Blaster from dangerous prototopyes. The device that worked was the Olimex ARM-USB-OCD from Sparkfun. Follow Slappy_g's instructions and you will prevail. |
| pinkman:
Thanks to anyone who can give me advice: Since I have one of the new DSA815-TG's with the new boot loader/firmware, it sounds like I need to buy a JTAG interface and get busy dumping my memory to hopefully find a new private key. Is this correct? I am definitely capable of doing this. I just would like someone to advise me whether this should help or if Rigol has found some way to make the memory dump useless. I assume that I'll void my warranty by breaking the silver seals, so I only want to do that if it is necessary :) |
| Bukurat:
--- Quote from: pinkman on September 02, 2014, 09:27:47 pm ---Thanks to anyone who can give me advice: I assume that I'll void my warranty by breaking the silver seals, so I only want to do that if it is necessary :) --- End quote --- It's possible to remove the seal without damage if you are careful. There are YouTube how to videos referenced somewhere earlier in these threads |
| sptm14:
--- Quote from: DocSnyder on August 31, 2014, 09:52:57 am ---Again the MSO1074Z-S. Can anyone give a description how the private key and the option keys for the DS1000Z has ever been found? Maybe they have changed for the MSO. --- End quote --- I don't have time to dig for the algorithm or public key, but enabling all options on MSO1074Z is actually quite easy. All you need to do is patch one function. get_opt_trial_state() must return 0x03. Thank you Rigol for debug info in firmware, totally insecure board configuration, and soldered-in JTAG header. In OpenOCD for firmware version 04.00, just issue these two commands: mww 0x40223FF4 0xE3A00003 mww 0x40223FF8 0xE12fff1e (this translates to mov r0,0x03; bx lr) Unfortunately, you cannot permanently flash the image back until somebody writes a flash driver for the IMX28 processor. Current version of OpenOCD does no have it. I have not tried patching a firmware update image and flashing it through the update process, considering how insecure the device is, it might work. |
| Navigation |
| Message Index |
| Next page |
| Previous page |