Products > Test Equipment

Sniffing the Rigol's internal I2C bus

<< < (809/899) > >>

smgvbest:
Thank you cybernet
I need to get a header on my JTAG port as I looks like mine was no populated then I will try that
I'm sure others have noticed but the newer keys seem to be mixed case vs. uppercase.
not sure what that implies though.


--- Quote from: cybernet on October 10, 2015, 11:30:08 pm ---if u are after the bootloader for the DSA than i would assume that it is located at 0x2000 0000 in the Flash as a LDR stream. (thats how the DS2x does it)
0x2000 0004 contains the length of the LDR stream for the bootloader

try to dump that and use a tool like ldrviewer to see if it actually contains a LDR stream if so - i have a nice LDR loader for ida pro that i can share.
usually the bootldr (again DS2x knowledge) then loads yet another LDR which is the actual APP image.
dumping from 0x0 onwards is RAM - which gets overwritten by the bootloader with the APP image, so i doubt u get that data out with SCPI.

best to use gdb, and break the boot process before the APP image gets executed.

from my old notes


--- Code: ---BootMode (BMODE) is 0001b

The kernel boots from address 0x20000000 in asynchronous memory bank 0.
The first byte of the boot stream contains further instructions whether the memory is eight or 16 bits wide.
BootLoader takes care of:

bfin init (EBIU, PLL, PORTS, DMA, SPORT)
fpga init
lcd init and displaying ultravision & rigol logo
load the application image LDR from flash @0x20040000+0x4 (first 4 bytes contain length of LDR stream)
optionally firmware upgrade via DS2000Update.GEL
run bfin executable from RigolDsExe.ldr (you need to disable any interrupts quickly or it will crash)
--- End code ---

--- End quote ---

JHERCULEES1:

--- Quote from: seronday on October 03, 2014, 12:52:52 pm ---DS4000 series Bandwidth (model type) Option Codes.

For those who have an interest in the DS4000, I have found the option codes for selecting the bandwidth .
This also sets the model type.

For example the code FAB9 will select 500Mhz, (DS405x), with all Decoders enabled.

The attached file contains all the details.

There are also two un-documented, possibly future, options called "Power Analysis" and "MA".

The option codes have been tested with firmware ver 00.02.00.00.04 and ver 00.02.01.00.03.

--- End quote ---

here he mentions unlocking the options in the rigol 4000 series but no mention of the private key that is needed for the tool to work ?

does anyone know what posts talk about the private key for the 4000 series , i located the private keys for both the 1000 and 2000 series but no 4000  private key

Macbeth:
Re: Dead Rigol DM3058. Thanks to a lot of pointers in this thread I've managed to fix my DMMs corrupt flash.  :-+ Rigol wanted me to send it to them for some weird reason. Other manufacturers like Keithley have not had issue sending me raw chip level firmware files so I can hardware flash my own, but Rigol wouldn't. Sorry, but I prefer to DIY.

Oh. Windows 10 appears to be rubbish with this sort of stuff. BSOD's constantly since trying to get drivers to work with Olimex and Altera Blaster. The absurd driver protection scheme rules out most FTDI based devices. Linux is a far more sensible environment. Dual Boot FTW (with the grub loader remembering what OS I last booted)  :-+

MarkF:

--- Quote from: JHERCULEES1 on October 21, 2015, 09:42:59 pm ---here he mentions unlocking the options in the rigol 4000 series but no mention of the private key that is needed for the tool to work ?

does anyone know what posts talk about the private key for the 4000 series , i located the private keys for both the 1000 and 2000 series but no 4000  private key

--- End quote ---

I have a DS1000Z series scope.  However, if the DS4000 series is the same, the Riglol key generator will fill in the private key after you enter your serial number..

nbritton:
What is the DS4064? I did a strings dump on the firmware update and that was in there.


--- Code: ---$ strings DS4000Update.GEL | grep DS406
DS4064
--- End code ---

Given Rigol's model naming system that would imply a 600 MHz DS4000 exists.

Navigation

[0] Message Index

[#] Next page

[*] Previous page

There was an error while thanking
Thanking...
Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod