Sniffing the Rigol's internal I2C bus

[farzadb82]

After factory reset (multipress left gray button #6 multiple during booting) and retry to enter generated keys...

Is there a secret 'reset' button like this for the DS1000Z ?

Unfortunately, there's nothing "officially" documented, that I was able to find. I attempted the procedure above, but had no success.

I tried the above and it reset all the options and went back to Chinese (seems just like "Storage->Default" but it resets the language as well).

Luckily it starts up in a state where it says "Language" on the menu...easy to go to a different language.

I tried the procedure on my MSO1000Z and ended up with a constant beeping noise (as if I'd pressed the button too many times), but no reset. It's possible that I did something incorrectly. I'll give it another shot tonight after work.

[alank2]

I tried the procedure on my MSO1000Z and ended up with a constant beeping noise (as if I'd pressed the button too many times), but no reset. It's possible that I did something incorrectly. I'll give it another shot tonight after work.

It is the 5th gray button on the left (not the bottom gray button).  When you press it during power on it will beep a couple of times until the Rigol screen comes up.  Keep pressing it.  You'll know it worked when you see Chinese!

[Gallymimus]

DS4000 series Bandwidth (model type) Option Codes.

For those who have an interest in the DS4000, I have found the option codes for selecting the bandwidth .
This also sets the model type.

For example the code FAB9 will select 500Mhz, (DS405x), with all Decoders enabled.

The attached file contains all the details.

There are also two un-documented, possibly future, options called "Power Analysis" and "MA".

The option codes have been tested with firmware ver 00.02.00.00.04 and ver 00.02.01.00.03.

This was tested and is confirmed working BTW.  You can eliminate the need for Mr Krabs modified firmware and stick with stock stock firmware.  Bandwidth was NOT tested, but time base and system info look correct for 500MHz

[cap4096]

DS4000 series Bandwidth (model type) Option Codes.

For those who have an interest in the DS4000, I have found the option codes for selecting the bandwidth .
This also sets the model type.

For example the code FAB9 will select 500Mhz, (DS405x), with all Decoders enabled.

The attached file contains all the details.

There are also two un-documented, possibly future, options called "Power Analysis" and "MA".

The option codes have been tested with firmware ver 00.02.00.00.04 and ver 00.02.01.00.03.

I have a question: Does this work on a Rigol MSO4014?

/Cap4096

[seronday]

If it is using one of the Firmware versions mentioned, then , Yes.

Try it and report back.

[cap4096]

If it is using one of the Firmware versions mentioned, then , Yes.

Try it and report back.

Well I have to order it before trying :-) I will probably do that on monday.

[ted572]

Ultra Power Analyzer software for the DS2000, DS4000, and MSO4000 series O'Scopes: https://www.eevblog.com/forum/testgear/first-impressions-and-review-of-the-rigol-ds2072-ds2000-series-dso/msg525924/#msg525924

[AndersAnd]

Ultra Power Analyzer software for the DS2000, DS4000, and MSO4000 series O'Scopes:

Yes the Software is available, and it looks like there may be a Key to enable it with the dso. Has anyone seen any codes in the firmware???

The "Power Analysis" option is listed in "DS4000 Option Codes.pdf" uploaded to this topic by seronday just a few days ago: https://www.eevblog.com/forum/testgear/sniffing-the-rigol%27s-internal-i2c-bus/msg523679/#msg523679

[Howardlong]

I tried the procedure on my MSO1000Z and ended up with a constant beeping noise (as if I'd pressed the button too many times), but no reset. It's possible that I did something incorrectly. I'll give it another shot tonight after work.

It is the 5th gray button on the left (not the bottom gray button).  When you press it during power on it will beep a couple of times until the Rigol screen comes up.  Keep pressing it.  You'll know it worked when you see Chinese!

I confirm that this works, but you need to start pressing the 5th grey button on the left within a few milliseconds after you switch on.

(To change language from Chinese, press the Utility button -> select Language).

[rmd79]

Hello,

Could someone please post a key file (without the serial number is fine) generated with "rigup scan ..." from a memory dump of a DS1000Z series scope?

I've tried searching the forum and with Google but haven't had any luck.

Thanks.

[rmd79]

Search within eevblog.
https://www.eevblog.com/forum/testgear/ds1000z-serie-unlocking/msg491026/#msg491026

The info I'm looking for doesn't seem to be there.

I'm looking for the DS1000Z equivalent of the key file, so the following info:

RC5KEY1:        ...
RC5KEY2:        ...
XXTEAKEY:       ...
PUBKEY:         ...
PRIVKEY:        ...

[rmd79]

Is this search it. maybe not private (scroll)
https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg362575/#msg362575

Thats basically what I'm looking for, except for the DS1000Z series (the code you linked to looks like its for the DS2000 series).

[sptm14a]

Here is a list of all 8 option codes for DS/MSO1000Z (firmware 00.04.01.SP2):

CSAR Triggers
CSAB Decoders
CSA3 Memory Depth
CSAJ Recorder
CSRA 500uV Vertical
CSAS ?
CSBA ?
CS3A ?

These are "official" options. "Trial" options start with "V", i.e. VSAR == Triggers trial

Plugging these into current versions of rigup/riglol won't work because Rigol slightly changed license validation/generation algorithm and character translation tables. I updated the algorithm to make it work for me, but but I'd rather not release it untested.

[farzadb82]

Here is a list of all 8 option codes for DS/MSO1000Z (firmware 00.04.01.SP2):

CSAR Triggers
CSAB Decoders
CSA3 Memory Depth
CSAJ Recorder
CSRA 500uV Vertical
CSAS ?
CSBA ?
CS3A ?

These are "official" options. "Trial" options start with "V", i.e. VSAR == Triggers trial

Plugging these into current versions of rigup/riglol won't work because Rigol slightly changed license validation/generation algorithm and character translation tables. I updated the algorithm to make it work for me, but but I'd rather not release it untested.

Thank you for passing along this info.

I have the MSO1000Z device and have been (unsuccessfully) trying to work out the new algorithm. I'd love to help test any changes that you may have or alternatively, if you could pass on more details on the algorithm changes, I'd be happy to integrate them into the keygen tools.

[NZST205]

Can anyone please help me by advising what format I should be saving the SCPI dump in, should it be ASCII, byte-8bit, byte-16bit or byte-32bit. As ASCII it creates a small (about 200Kb, the other formats create files 300-500+Mb, another is the 28-32 Mb range mentioned.

When I rigup any of the the file it says no keys. perhaps I need to hit the Advanced Tab in Current Return Value screen or something as not matter what file I save they are either 8 or 16 kb, not the 32 Mb file I am expecting. I have tried the scan with both 1,133554432 and 1544190,13262848.

Scope is a DS2072A with 03.01.00.04 and HW 1.02.0.2 Manufactured August 2014.

[Rigby]

There's only four choices.  Try them all. 

It might be mentioned somewhere... Have you read the entire thread?  I know it's very long, but there's like ts of knowledge in it for someone willing to take the time.

[NZST205]

Yep, been through it twice, and even downloaded this an other related threads and did a txt search but nothing that says what sort of format the file should be in or if the advanced tab is relevant.

[Helder22]

Ok, so I tried unlocking my new MSO2072A (3.00 SP1, HV 2.2, SN DS2F1629*****) using the DS2000A Upgrade Utility, but that did not work, So now I guess I'm gonna have to use the JTAG memory dump method. I really didn't want to because I'm afraid of messing something up permanently, but I as far as I've seen there are currently no alternatives.
I've already read most of this HUGE thread, and I guess I can say I understand the basic logic of it all, but the specifics are a bit over my head.
 
So now I have to order a JTAG adapter (and wait weeks for it to arrive). Is there any difference which one I get? I'm not really looking for the cheapest one, but one that would make the process simpler and therefore reducing the chances of me bricking my beloved new scope.

[navzptc]

Have a look at this forum, especially around message no. 189 

You may find something to your advantage!

https://www.eevblog.com/forum/testgear/rigol-mso2000-series-hacking/msg506553/#msg506553

[Helder22]

Oh my, I think it worked! Thanks navzptc (and everyone else)!
I have a 32,768KB scpi file now!

 

[Helder22]

Unlocked!
Thanks to everyone who did all the real work in order to make this possible!

[NZST205]

Have a look at this forum, especially around message no. 189 

You may find something to your advantage!

https://www.eevblog.com/forum/testgear/rigol-mso2000-series-hacking/msg506553/#msg506553

I can't seem to find what format to save the SCPI file in (of the 4 options). ASCII creates a 15kb file and the three byte formats saves files all over 200 MBs. Perhaps as I am running Windows 7 Ultimate un Parallels it may be mucking things up. Can anyone please provide me with some guidance ?

[AndersAnd]

Have a look at this forum, especially around message no. 189 

You may find something to your advantage!

https://www.eevblog.com/forum/testgear/rigol-mso2000-series-hacking/msg506553/#msg506553

I can't seem to find what format to save the SCPI file in (of the 4 options). ASCII creates a 15kb file and the three byte formats saves files all over 200 MBs. Perhaps as I am running Windows 7 Ultimate un Parallels it may be mucking things up. Can anyone please provide me with some guidance ?

Probably better to ask in the topic where SCPI memory dump is discussed in detail, to keep the information about this method in one place: https://www.eevblog.com/forum/testgear/rigol-mso2000-series-hacking/msg508898/#msg508898

[akisnas]

http://pastebin.com/ghYHnCfT
It would not have happened without:
The jtag firmware dump from DL5TOR
ecc help from some guy
Coding by Cybernet
Testing by Marc M.

I find it very selfless to release all your work for everyone to freely use. Good on all of you 

Very nice job guys, I'd like to ask you about this link http://pastebin.com/ghYHnCfT it's an old & not working, is there anybody can help to find the files, or to help to unlock the options & 10 Hz RBW for a DSA815TG?
Best Regards

[AndersAnd]

or to help to unlock the options & 10 Hz RBW for a DSA815TG?

Use the online Riglol keygen.

Original: http://riglol.3owl.com
Canadian mirror: http://gotroot.ca/rigol/riglol/
UK mirror: http://rigol.avotronics.co.uk/mirrors/riglol/