Sniffing the Rigol's internal I2C bus

[Fred27]

Thanks for sharing the firmware link, Codemonkey. I've no idea why they don't just make this easily downloadable.

When you said they asked for your serial number I wondered whether the firmware would have to be compiled/configured for each individual scope. (Yes - that would be a daft way of doing it, but not implausible. I assume that max's and andrewwong200's scopes doesn't now have your serial number showing on screen.)

[Rigby]

They just verify that you actually have a scope.  The firmware is not coded to a particular serial number, just the model.

The links each show a page saying the files have been hosted there for 2 months.

[thn788]

For previous updates of DS1000Z firmwares I have been in e-mail contact with both my dealer and some actual Rigol-FAE (both located in Germany) and I asked both, why they provide new firmware only on request and why they need serial numbers for this. Both independently told me, they had problems with firmware updates not working properly on certain serial-number ranges.

Maybe they have different HW-revision "in the field" and some need special firmware or special update procedures?!

[mauroh]

Maybe they have different HW-revision "in the field" and some need special firmware or special update procedures?!

This is interesting, and could be possible, since i just got my 00.04.00 from Rigol official tech support and it not include the bootloader upgrade.

I did the upgrade and so far my enhanced features are still there.

This is the change log i received from Rigol:


Following is the issue fixed in new version 00.04.00.


      |  Switch the video standard, synchronized automatically                               |  M   
      |  changes all the lines, the trigger status error.                                            |     
------+---------------------------------------------------------------+-----
      |  When you open LA's D8-D15 channel, CH4 pattern can not be  configured.  |  M   
------+---------------------------------------------------------------+-----
      |  The waveform is wrong when the trigger type have two or more      |  M   
      |  trigger signal source.                                                                  |     
------+---------------------------------------------------------------+-----
      |  You can also continue to increase the limit REF channel      |  M   
      |  offset when prompt appears.                                  |     
------+---------------------------------------------------------------+-----
      |  When the LA probe Calibration finish, it should have prompt  |  M   
      |  an operation of next step.                                   |     
------+---------------------------------------------------------------+-----
      |  The LA pop-ups error message prompt when first opening the   |  M   
      |  LA after oscilloscope start.                                 |     
------+---------------------------------------------------------------+-----
      |  The LA time delay didn't work well when restoring factory    |  M   
      |  setting.                                                     |     
------+---------------------------------------------------------------+-----
      |  After the read channel arbitrary waveform switching to a     |  M   
      |  sinusoidal waveform, the amplitude of the first modification |     
      |  is invalid.                                                  |     
------+---------------------------------------------------------------+-----
      |   Sawtooth regulate slow response.                            |  M   
------+---------------------------------------------------------------+-----
      |  Add the remote command of read waveform data of the Logic    |  E   
      |  channel.                                                     |     
------+---------------------------------------------------------------+-----
      |  Add the remote command of measure of "MATH" function.        |  E   
------+---------------------------------------------------------------+-----
      |  Fixed unrecongnizable code bug in text box of update         |  M   
       |  function while the system language is traditioal Chinese.    |     
------+---------------------------------------------------------------+-----
      |  In scan mode and ZOOM on, switch trigger mode cause system   |  M   
      |  crash.                                                       |     
------+---------------------------------------------------------------+-----
      |  There is no help info of Horizontal offset key.              |  M   

[daemonix]

Anyone with a 1074z can confirm that the PNG screenshot have weird dates? 31 Dec 1979 23:03?? LOL

[sfiber]

I bought ds1074z and it came with version 04 and key generation work perfect.

[Turtle9er]

Just tried to get the new firmware, and says files are gone....guess Rigol didn't like ppl just downloading it. Anybody out there willing to share the files?

[max666]

Anyone with a 1074z can confirm that the PNG screenshot have weird dates? 31 Dec 1979 23:03?? LOL

Yes the dates are weird, but that doesn't surprise me, because I think the DS1000Z don't have any clock chip at all.

[max666]

Just tried to get the new firmware, and says files are gone....guess Rigol didn't like ppl just downloading it. Anybody out there willing to share the files?

Like Codemonkey said: "The following instructions apply, don't hold me responsible if you brick your scope etc etc..."

Links to download the two update files (Bootloader and Firmware update) -> 00.04.00
Be aware that after finishing the update no downgrading is possible.
 
Start with the Bootloader File and follow the instructions. After successfully finishing the bootloader update
do NOT reboot as instructed. Instead, continue with the Firmware update file.
 
Bootloader Update (new link):
https://www.dropbox.com/s/nteyndjz17dmcmi/DS1000Z%28Boot%29update.rar
 
Firmware Update (new link):
https://www.dropbox.com/s/w9x66ghdhagtsaj/DS1000Z%28ARM%29update.rar

[Wall-E]

Anyone with a 1074z can confirm that the PNG screenshot have weird dates? 31 Dec 1979 23:03?? LOL

Yes the dates are weird, but that doesn't surprise me, because I think the DS1000Z don't have any clock chip at all.

No, this date format is NOT weird at all, it is one of the standard date formats.  And the the DS1000z does NOT have a RTC (Real Time Clock) chip.

[Turtle9er]

Max666....thanks for that. I just update my 1074z-s and all is good. Not sure if people had this issue with the old firmware, but some times my trigger waveforms would not show up, even though it would say triggered....a quick test shows that this is now fixed....so very happy about that. Thanks again.

[max666]

No, this date format is NOT weird at all, it is one of the standard date formats.  And the the DS1000z does have a RTC (Real Time Clock) chip.

Fair enough! So where can I see the system time, where can I set it? huh? huh?   

[donkey77]

Hi,

After following this thread I was about to buy a DS2072A but came across a MSO2072A-S that looked interesting. Does anyone have any knowledge of these, it seems they are quite new. Hopefully the previous upgrades would work for these but I am reluctant to take the plunge without confirmation.

[AintBigAintClever]

Some people have unlocked DS2072A (and A-S) successfully, but a handful had issues. I've got a recent DS2072A-S that's still on the 2.x "non A keys" firmware as I was able to unlock features but not unlock the bandwidth.

If an MSO does the same then I doubt it would be able to revert to 2.x firmware without either losing all the MSO features or bricking, as someone recently mentioned that MSO support was added in 3.x.

[navzptc]

I think that maybe Rigol is restricting the updateability of their units which have just been built, even though the firmware version maybe the same as earlier units.

I could update my DS2202A with  'All Options', but not the 300Mhz bandwidth; also with my recent DG4102 - I could expand it to 160Mhz but not to 200Mhz that a lot of people have 

Make the most of what we can achieve now - I feel it will get more difficult in time!

[f1rmb]

Hi,

I think that maybe Rigol is restricting the updateability of their units which have just been built, even though the firmware version maybe the same as earlier units.

I could update my DS2202A with  'All Options', but not the 300Mhz bandwidth; also with my recent DG4102 - I could expand it to 160Mhz but not to 200Mhz that a lot of people have 

Make the most of what we can achieve now - I feel it will get more difficult in time!

Yesterday I received my DS2072A, and I didn't experienced any problems while "updating". Now I have a full featured, plus 300MHz.

BTW, many thanks to everyone involved in this hack, at any level (also thumbs up to reviewers, that was helpful to make my choice between all available "low cost" DSOs).


Cheers.

[Purevector]

I think that maybe Rigol is restricting the updateability of their units which have just been built, even though the firmware version maybe the same as earlier units.

I could update my DS2202A with  'All Options', but not the 300Mhz bandwidth; also with my recent DG4102 - I could expand it to 160Mhz but not to 200Mhz that a lot of people have 

Make the most of what we can achieve now - I feel it will get more difficult in time!

This is possible.  I just got a new DS2072A from TEquipment from their newest shipment from China.  Using the very easy-to-use Upgrade Utility I was able to unlock all option and 200MHz bandwidth, but not 300MHz.  This is not an user error issue.  Something is certainly going on here.  Maybe some models have been flagged somehow that their front end is not capable of 300MHz (components not to spec)?

[marmad]

I think that maybe Rigol is restricting the updateability of their units which have just been built, even though the firmware version maybe the same as earlier units.

I could update my DS2202A with  'All Options', but not the 300Mhz bandwidth; also with my recent DG4102 - I could expand it to 160Mhz but not to 200Mhz that a lot of people have 

Make the most of what we can achieve now - I feel it will get more difficult in time!

This is possible.  I just got a new DS2072A from TEquipment from their newest shipment from China.  Using the very easy-to-use Upgrade Utility I was able to unlock all option and 200MHz bandwidth, but not 300MHz.  This is not an user error issue.  Something is certainly going on here.  Maybe some models have been flagged somehow that their front end is not capable of 300MHz (components not to spec)?

I'm not sure how they would accomplish this unless the firmware was changed. Which version are you each using - v.2 or v.3?

[Purevector]

I'm not sure how they would accomplish this unless the firmware was changed. Which version are you each using - v.2 or v.3?

My unit came with 2.0.1.  Used the utility to upload hacked firmware to grab keys and update.  300MHz did not work, but 200 did.  Upgraded to 3.0.1 and tried again, same result (of course using key dump from hacked firmware).

[marmad]

I'm not sure how they would accomplish this unless the firmware was changed. Which version are you each using - v.2 or v.3?

My unit came with 2.0.1.  Used the utility to upload hacked firmware to grab keys and update.  300MHz did not work, but 200 did.  Upgraded to 3.0.1 and tried again, same result (of course using key dump from hacked firmware).

Strange. Then I imagine it might just be a side-effect of the way the keys are generated in lots for the 2000A series. I doubt very much that it's anything specifically intentional by Rigol since, AFAIK, they don't even sell BW upgrades - so if they were going to try to quash illicit BW upgrades, why not all of them?

If it's FW checking a new hardware revision of the board, then they had to code it quite some time ago into the FW since we've been on FW v.2 since last December or January.

[Purevector]

Strange. Then I imagine it might just be a side-effect of the way the keys are generated in lots for the 2000A series. I doubt very much that it's anything specifically intentional by Rigol since, AFAIK, they don't even sell BW upgrades - so if they were going to try to quash illicit BW upgrades, why not all of them?

If it's FW checking a new hardware revision of the board, then they had to code it quite some time ago into the FW since we've been on FW v.2 since last December or January.

Depending on Rigol's business plan, blocking 300MHz may be a smart marketing move.  I am sure sales of Rigol scopes is greatly enhanced by their reputation of being hackable.  If they clamped down hard on that, I think may people would look elsewhere for budget scopes.  For most people 200MHz and all options is a great hack.  I know I am very happy with what I have.  However, if you are a person who knows they need 300MHz, then you're probably not simply a hobbyist or low-budget lab.  In that performance range, you probably have a budget, and Rigol would want a bite of that.  This way, they still retain the budget crowd, while cashing in on the higher end user.  Also, as I said before, maybe during testing they flag units that are not capable of 300MHz.  This is all conjecture as I am in no way affiliated with Rigol.

If there is some sort of bug with the cryptography, I would be happy to provide any help I can to try and fix it.

[marmad]

Depending on Rigol's business plan, blocking 300MHz may be a smart marketing move.  I am sure sales of Rigol scopes is greatly enhanced by their reputation of being hackable.  If they clamped down hard on that, I think may people would look elsewhere for budget scopes.  For most people 200MHz and all options is a great hack.  I know I am very happy with what I have.  However, if you are a person who knows they need 300MHz, then you're probably not simply a hobbyist or low-budget lab.  In that performance range, you probably have a budget, and Rigol would want a bite of that.  This way, they still retain the budget crowd, while cashing in on the higher end user.  Also, as I said before, maybe during testing they flag units that are not capable of 300MHz.  This is all conjecture as I am in no way affiliated with Rigol.

You have a point - but honestly, the DS2000 series would not be a great choice if you really need the full 300MHz while using both channels. As many have pointed out here before, trying to squeeze 300MHz out of a machine with only a 1GSa/s maximum sample rate (both channels on) is really pushing the bounds of the input filter and sin(x) interpolation.

[rmawatson]

Hello,

So I've just spent best part of £700 on a Rigol 2072A in the hope of being able to unlock it to 300mhz. Is there any way I can know if my unit is locked to 200mhz or will allow the full 300mhz. Is this defined by hardware, or is this something implemented in new firmware revisions ?

Sorry if this is answered, I haven't read all of the last 200 pages of posts.

Cheers

Rob.

[marmad]

So I've just spent best part of £700 on a Rigol 2072A in the hope of being able to unlock it to 300mhz. Is there any way I can know if my unit is locked to 200mhz or will allow the full 300mhz. Is this defined by hardware, or is this something implemented in new firmware revisions ?

It's unclear at this time whether it's FW/key related - or related to a new HW revision. Some new owners seem to be able to install the 300MHz option - while others can't.

[rmawatson]

Ok, well with luck it will turn up early next week. I'll report on here how it turns out with my scope and any version details I can to help others.

I was however wondering... Is it possible, like with flash/hard drives, that they units are tested prior to being labeled, and perhaps there is variation in the quality of the analog front ends of these scopes. Some work up to 300mhz within some set parameters, others don't perform to the same quality threshold, and they are catagorised as such?

This would make sense when looking at the cost of these scopes. As with most things, making it with tolerance is cheaper, especially if you can rebrand lower quality items as a lower end in the same product range.

This is from a point of view or ignorance on the internals of these scopes, so I have no idea if there are components that have this kind of band of quality, or if its a case of it they work at 300mhz as designed, or not at all?