| Products > Test Equipment |
| Sniffing the Rigol's internal I2C bus |
| << < (740/899) > >> |
| Trax:
--- Quote from: 0ff on December 09, 2014, 10:41:24 pm ---To all you MSO1000Z Owners: It's done, we found what Rigol changed for the MSO1k and we patched rigup to generate working keys. Usage: Well, get the file, compile the source, call rigup like this: --- Code: ---./rigup license mso1074z.txt 0x1C0FF --- End code --- Note: The License option *must* be supplied as hex, these are valid values: 0x1C001 - TRIGGER 0x1C002 - DECODER 0x1C004 - MEM-DEPTH 0x1C008 - RECORDER 0x1C00F - All of the above There are also these options, but they will modify your scope into a MSO1000Z. They are mostly untested and might harm your children. 0x1C010 - 0x1C020 - 0x1C040 - 0x1C080 - 0x1C0FF - all Options Generate the mso1074z.txt like this: --- Code: ---./rigup scan YourDump.bin > mso1074z.txt --- End code --- Note: You will need to open the scope to get a dump. I'm not going to change that, but if anyone of you would like to reverse the firmware signing process, there is a hidden DBGCMD that might provide useful as an entry point for custom SCPI logic. I want to thank rmd79 for his continuing efforts as well as all original authors of the rigup tool! You guys are the one who deserve any credit! Also, thanks to sptm14 for you keeping all the info from the public. This motivated me to actually walk through their code! Best regards, Fabian --- End quote --- wow so just to clarify this with this tool I can unlock all features of a MSO1074z scope if I buy one for Xmas? is that right? |
| Howardlong:
FWIW here is what I understand to be the list of options: (CSAR = 0x1C001) Triggers (CSAB = 0x1C002) Decoders (CSA3 = 0x1C004) Mem-depth (CSAJ = 0x1C008) Recorder (CSAS = 0x1C010) DG (CSRA = 0x1C020) 500uV (CSBA = 0x1C040) Power Ana. (CS3A = 0x1C080) Bandwidth (100MHz) (CSHY = 0x1C0FF) All I don't know what "DG" or "Power Ana" is. As with the DS1000Z series, 500uV doesn't work properly. Here is my understanding. On ch2, 3, 4 was tried, the traces for those channels went off the top of the screen and they couldn't be retrieved without dropping back to 1mV/div. Ch1 worked at 500uV on the example I am aware of but had about -400uV of DC offset. A self calibration was run, but it made no difference. The bandwidth on this example before applying the CS3A 100MHz option, measured with an HP 8656B 50 ohm terminated RF signal generator, was 91MHz and after it was 141MHz. |
| msraya:
Hello! Good work and thank you to share knowledge! :-+ I have in the lab a ICEbear Blackfin JTAG debugger (http://www.section5.ch/icebear) that I have never used :-// . You do think it is possible to use this tool to dump the memory? Someone use it for that purpose? Regards Manuel |
| 0ff:
Hey Manuel, that depends on your scope. My MSO1074z is not built around a blackfin, but rather the freescale iMX28. It's really only important to have an adapter that's compatible with openOCD, that's all that matters. Oh an Howard: Thanks for your input with completing the license codes, this is just awesome :) Regards |
| swanawood:
Hi folks! My new DS1054Z has just arrived; I am trying to dum mem via SCPI command (windoz). I got no success: with Rigol Bildschirmkopie LAN When I send(&receive) the dump command: :SYST:UTIL:READ? 1,33554432 I get the error "There was an error when sending the SCPI command." Other commands via Bildschirmkopie works (for example ":SYSTem:LANGuage?" gives "ENG") With the netcat via command prompt (192.168.200.22 is the rigol IP address): echo :SYST:UTIL:READ? 1,33554432 | ncat -i 1 192.168.200.22 5555 > memory.dump the file is created but inside there is "command error" My versions: sw ver: 00.04.02.SP3 board ver: 0.1.1 Any idea ? does someone has the same versions and able to dump ? p.s. Anyway I succeded in installing options via caroot k**gen, but I would like to be able to dump memory. Thanks |
| Navigation |
| Message Index |
| Next page |
| Previous page |