Products > Test Equipment
Sniffing the Rigol's internal I2C bus
<< < (896/899) > >>
geo999:
Hi guys,

I got myself a DSO1074Z-plus thinking the upgrade to 100Mhz is as easy as for DS1054Z.
After introducing the wrong serial codes for a few times I ended up on this page reading tens of pages.

I also did a :SYSTem:OPTion:UNINSTall such that now I'm left without any option that came preinstalled.

In the end the rigol seal lasted for less than 4 hours since it got into my possession :).

I hooked up the Olimex-JTAG/OpenOCD and did a dump of the memory.
I double checked that the dump is correct by doing a second dump and comparing md5sums.
The dump was done after the scope completed booting - ready to work.

now for the fun part,
I tried different rigup versions with different results, none of them providing valid keys.


rigup-0.4.zip:

    scan:
        RC5KEY1:        xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
        RC5KEY2:        xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
        XXTEAKEY:      xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
        PUBKEY:         xxxxxxxxxxxxxxxx
        PRIVKEY:        xxxxxxxxxxxxxxxx
    --> SERIAL: this line is not present in the output of the scan command,
    even if I can find the serial in the dump with grep.

    the search command crashes with a segfault.
    after a little debugging it turns out that this is due to the missing SERIAL like in the scan output.
    after adding manually the SERIAL line entry with the serial from the label on the back of the scope the output of search command is:
   
        6 lines with serial numbers all failed
        xxxxxxx-xxxxxxx-xxxxxxx-xxxxxxx                        Failed.

rigup-0.4.1-mso1000z.zip:
    failed: No keys

rigup-0.4.2.zip:
    failed: No keys
   

rig-up from https://www.dropbox.com/sh/1yrh8s90ityn90s/AAA6PXlJk9gGQwoDOwO6TDQua?dl=0,
    failed: No keys

DS1074Z plus
00.04.04.SP4
00.04.04.04.03
Board: 2.1.4

labels on the board:
DS1000Z_MAINBRD_V01.04_20141024
Hardware Version: V[654][32].[10]
SP Version: [987]

a firmware update attempt it's saying that it's already at the same version.
   
question is: what I'm doing wrong here ?
- do I need to do a dump at a different stage ?
- do I need a different rigup tool version ?

later edit:
the serial number starts with: DS1ZC
rigup, compiled on Linux x86-64

thank you

KK1L:
Hi GEO999,

I would not be surprised if Rigol support wouldn't send you the code to open up the options they now ship with these rigs. It is worth a shot! Tech Support under "Support" on rigolna.com...worked for me!

You have gotten further than me with the memory dump. I think I am going have to buy an ARM ready debugger (like the Olimex) to get past my timeout issue. There is a post maybe in this quite expansive thread where there were a pair of leading zeroes in the keys which needed to be removed. I do not recall if this was automatically handled in rigup.

https://www.eevblog.com/forum/testgear/sniffing-the-rigol_s-internal-i2c-bus/msg3361424/#msg3361424 
KK1L:
Some success, but ultimately a failure still :(

I had reported on trouble using the SiSpeed debugger. I ended up buying an Olimex ARM-USB-TINY-H. It is great and worked well the first time...6MHz, 1MHz, whatever. Far superior to the SiSpeed in this application.

That being said...despite getting a clean 64k memory dump I have been unsuccessful finding keys in the file....until!

So it is not exactly true that the DS1074Z-Plus is the same as an MSO1074Z. The signature to find the keys in the binary dump file are the SAME as the DS1074Z. So you need to run the unmodified rigup code to pull out the keys! MSO1000Z look for "01 00 84 00 10 00". DS1000Z look for "02 00 84 00 10 00".

Bottom line is the 1074Z-Plus is a hybrid of sorts. You must use JTAG to pull the memory file, but must use the DS1000 family rigup to pull the keys out!
I used version 0.4 from http://gotroot.ca/rigol...specifically rigup-0.4.zip. However the serial number is in the format of the MSO, so rigup will not extract the serial from the DS1074Z-S Plus. You need to add that with the "serial" option of rigup.


--- Code: ---./rigup scan keyfile.txt ds1074z-plus.bin
./rigup serial keyfile.txt <your serial number>
./rigup license keyfile.txt DSEA 0x1c0ff 0x1c080
--- End code ---
You can direct the output of the license generation to a file if you like.

1st keyfile looks like this:
RC5KEY1:        72A369AC1CzipitydodaB9E27EAF0513
RC5KEY2:        582A21C677zipitydodaA302642B08E8
XXTEAKEY:       D07D6B66E6zipitydodaAA551326D9DE
PUBKEY:         005zipitydoda230
PRIVKEY:        009zipitydoda8D0

2nd keyfile looks like this:
RC5KEY1:        72A369AC1CzipitydodaB9E27EAF0513
RC5KEY2:        582A21C677zipitydodaA302642B08E8
XXTEAKEY:       D07D6B66E6zipitydodaAA551326D9DE
PUBKEY:         005zipitydoda230
PRIVKEY:        009zipitydoda8D0
SERIAL:         DS1ZD21xxxxxxx

Okay, so great. Now I have the key file. The bummer is no mater how I generate a license code it will not unlock 100MHz on my DS1074Z-S Plus.
I tried rigup with options DSEA (DS version) and 0x1c080 (MSO version). I tried riglol for grins with the extracted private code. I tried substituting the 16 nibble sequences I found in the memory dump binary just before the serial number into the private key and trying the above again. All no joy.

When I first purchased the scope on clearance from Rigol they gave me the code to unlock the options, and I asked about paying for an upgrade to 100MHz. The rep told me it could not me upgraded. Maybe he really meant it.

I was going to modify the rigup code to work for the DS Plus version, but since the keys don't work anyway it would be pointless. If someone has a clue for me to I will give it a shot.

DS1074Z plus
00.04.04.SP4
00.04.04.04.03
Board: 6.1.4

Board markings look suspiciously like BS...
Hardware Version: [654][32].[10]
SP Version [987]


P.S. At least I am loving my encoder knob upgrade :) !
KK1L:
Ok folks with help and some hints from a friendly PM from tv84 the issue is sorted.

The bottom line is the rigup versions from gotroot.ca do not work. I tried all of them (windows exe). The one below does. Funky output for the "search" option when including the dump file, but shows the "ok." for the known good license in my memory dump. It creates the correct unlock code!

http://i-hobby.org/blog/Electronics/60.html

Be sure of the option code used. 0x1C0DF is what I used to open all up except 500uV.

(CSAR = 0x1C001) Triggers
(CSAB = 0x1C002) Decoders
(CSA3 = 0x1C004) Mem-depth
(CSAJ = 0x1C008) Recorder
(CSAS = 0x1C010) DG
(CSRA = 0x1C020) 500uV
(CSBA = 0x1C040) Power Ana.
(CS3A = 0x1C080) Bandwidth (100MHz)
(CSHY = 0x1C0FF) All
(CSGY = 0x1C0DF) All except 500uV

I should have noticed it before, but there is a bit set for each option. You should be able to mix and match. I did an :uninst, then :inst 0x1C0DF and got all but 500uV. Sweet.

RoGeorge:
Why not enabling the 500uV/div, too?

It won't hurt the scope.  After enabling all the options run a self calibration (from the oscilloscope's menu Utility -> Self-Cal).  And if you decide you don't like the 500uV option, all the options can be removed with the SCPI command ":SYSTem:OPTion:UNINSTall", then re-installed with only the options you like as many times as you want. (the codes doesn't change, you can use the SCPI command ":SYSTem:OPTion:INSTall <license>")

Just FYI, the 500uV/div works very well in my former DS1054Z.
Some are saying in their DS1000Z the trace is out of screen after Self-Cal, or something, therefore religiously advocate that no one should ever dare to enable the 500uV, because "problems", and "useless".   :-//

I found the 500uV/div range very useful when using the oscilloscope as a synchronous detector or as a lock-in amplifier, to measure very small synchronous and repetitive signals, with the oscilloscope's Acquire mode set to (trace) Average mode.

Any internal noise of the DS1054Z (and DS1000Z it is very noisy indeed in its analog front end) doesn't matter when the scope is in Average mode.  Noise averages to zero, so any asynchronous noise(either from the internals of the DS1000Z or from the device under test) will fade out and only the measured signal will remain, with a crisp clean trace on the display.
Navigation
Message Index
Next page
Previous page
There was an error while thanking
Thanking...

Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod