Author Topic: Sniffing the Rigol's internal I2C bus  (Read 1825050 times)

0 Members and 2 Guests are viewing this topic.

Offline Howardlong

  • Super Contributor
  • ***
  • Posts: 5315
  • Country: gb
Re: Sniffing the Rigol's internal I2C bus
« Reply #3725 on: December 15, 2014, 11:43:07 am »
Not sure I've explained this very well.

As I understand it, this covers all options with trial time available. There is only one counter, each of the trial times will be a constant, each set when each trial license is installed, and set relative to the single counter (and possibly stored in the FRAM too somewhere). Only that single counter changes. There isn't one counter for each license as I understand it.
 

Offline hammy

  • Supporter
  • ****
  • Posts: 465
  • Country: 00
Re: Sniffing the Rigol's internal I2C bus
« Reply #3726 on: December 15, 2014, 06:33:49 pm »
Is there an extended system or version info for the ds1000z series?

Cheers
hammy
 

Offline alank2

  • Super Contributor
  • ***
  • Posts: 2183
Re: Sniffing the Rigol's internal I2C bus
« Reply #3727 on: December 15, 2014, 06:55:45 pm »
Is there an extended system or version info for the ds1000z series?

There is and there has been a picture to prove it, but he couldn't remember how he got into it and I don't think anyone knows how.  I tried a ton of different key sequences to see if I could get into it but none worked...
 

Offline hammy

  • Supporter
  • ****
  • Posts: 465
  • Country: 00
Re: Sniffing the Rigol's internal I2C bus
« Reply #3728 on: December 15, 2014, 07:35:48 pm »
I tried a ton of different key sequences to see if I could get into it but none worked...

The sequence with the "menu" button, right? Didn't worked for me either.  :-//
 

Online seronday

  • Regular Contributor
  • *
  • Posts: 93
  • Country: au
Re: Sniffing the Rigol's internal I2C bus
« Reply #3729 on: December 15, 2014, 10:45:08 pm »
You can get more detailed information from a saved Parameters Text File.
Press the Storage button, set Storage type to Param, Save to USB drive.
The start of the Parameters Txt file contains the additional info.
 

Offline smgvbest

  • Supporter
  • ****
  • Posts: 630
  • Country: us
    • Kilbourne Astronomics
Re: Sniffing the Rigol's internal I2C bus
« Reply #3730 on: December 16, 2014, 03:42:17 am »
Hi
I wanted to share my attempt at using rigup on my MSO1074Z-S with some images to go along
First my Thanks to all for getting this working and a special thanks to rmd79 for his help.  I'm a hobbyist so this was a major purchase and my nerves on end opening my scope up to dump the memory.    The quick of it is I had no problems doing this following the instructions.

I created a pin-out drawing to help me hook things up and is below.   maybe some others will find it helpful

I should have taken more dis-assembly photo's but forgot so the ones I have are after it was disassembled.
I used the tips on YouTube to cleanly remove the warranty sticker which works just as described.

All the screws are star screw and there was a bunch of them including the 4 for the outer case. 

I then hooked up my old Amontec JTAGKey-Tiny (FTDI Based).  I did have some problems with drivers for it under windows 7 but once I got the libusb drivers installed all went well

Connected my JTAG Device to the the scopes header.  I made mine by simply using 10 male to female jumper wires.  plugged them into my header on my JTAG Device and then shrink wrapped it together.
this is the Amontec device (now out of business)



and the cable


I powered on the scope then pluged in my JTAG device to the PC and Fired up OpenOCD for windows


Code: [Select]
C:\openocd-0.8.0>C:\openocd-0.8.0\bin-x64\openocd-x64-0.8.0.exe -d1 -f C:\openoc
d-0.8.0\scripts\interface\ftdi\jtagkey.cfg -f C:\openocd-0.8.0\scripts\target\im
x28.cfg
Open On-Chip Debugger 0.8.0 (2014-04-28-08:42)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.sourceforge.net/doc/doxygen/bugs.html
debug_level: 1
adapter speed: 6000 kHz
trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain connect_de
assert_srst
adapter_nsrst_delay: 100
jtag_ntrst_delay: 100
dcc downloads are enabled
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x20000013 pc: 0x40302764
MMU: enabled, D-Cache: enabled, I-Cache: enabled
dumped 67108863 bytes in 1642.825684s (39.892 KiB/s)

I followed that by connecting via putty to 127.0.0.1 4444. Once I had the console typed

Code: [Select]
halt
dump_image mso1074zs.bin 0x40000000 0x3FFFFFF

I probably could have run my Amontec device faster as it's the same chip as the Olimex one is but I choose to run it a 6Mhz which took about 21 minutes to dump

I then ran rigup on the output file on a VM Linux instance
Code: [Select]
./rigup scan mso1074zs.bin > mso1074zs.txt[/td]
then generated all licenses with
Code: [Select]
for code in 0x1C001 0x1C002 0x1C004 0x1C008 0x1C010 0x1C020 0x1C040 0x1C080 0x1C0FF
do
echo "Generating $code License"
./rigup license mso1074zs.txt $code
done > mylicenses.txt

Everything else was by the book to apply the codes

Here are all the images I took.  Hope you do not mind the long post

JTAG Header with Pinout.  I hope this one helps some others in the future doing this



Showing Upgraded to MSO1104Z-S



All Licenses Applied



Checking out the Rise Time



Source Generator BNC Connectors (these are the ones Dave was wondering how they added the Source Generator)



Source Generator Daughter Board (and here's the Answer, It's a daughter board way on the other side of the PCB)



Main Board



Quote
EDIT:  I added the openocd console output,  thought some might like to see it
« Last Edit: December 16, 2014, 06:16:27 am by smgvbest »
Sandra
(Yes, I am a Woman :p )
 
The following users thanked this post: psysc0rpi0n, carl_lab, KK1L

Offline Mark_O

  • Frequent Contributor
  • **
  • Posts: 939
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #3731 on: December 16, 2014, 06:43:12 am »
Thanks, smgvbest.  That was nicely done.   :-+  Pictures are always welcome, so don't fret about the length.
 

Offline JBR48

  • Newbie
  • Posts: 5
Re: Sniffing the Rigol's internal I2C bus
« Reply #3732 on: December 16, 2014, 07:58:27 am »
A very clear exposition of all the steps. Very helpful!
Thank you smgvbest.


 

Online msraya

  • Supporter
  • ****
  • Posts: 107
  • Country: es
  • EA7EE
Re: Sniffing the Rigol's internal I2C bus
« Reply #3733 on: December 16, 2014, 08:16:06 am »
My Hat's Off to You Mr Smgvbest!!  :clap:

I am afraid of break the sticker, but now I will go!!  :-DD
You makes the process look simple and self-explained.

Thank You!
Manuel
« Last Edit: December 16, 2014, 08:17:43 am by msraya »
 

Offline smgvbest

  • Supporter
  • ****
  • Posts: 630
  • Country: us
    • Kilbourne Astronomics
Re: Sniffing the Rigol's internal I2C bus
« Reply #3734 on: December 16, 2014, 08:23:34 am »
Actually is Ms. 

Sandra   
Sandra
(Yes, I am a Woman :p )
 

Online msraya

  • Supporter
  • ****
  • Posts: 107
  • Country: es
  • EA7EE
Re: Sniffing the Rigol's internal I2C bus
« Reply #3735 on: December 16, 2014, 01:39:10 pm »
Oh! I'm sorry Sandra  :palm:

The rate of women/men EEngineering students at my University, here in Spain is very bad indeed.
So I suppose the wrong.

I will try to use the JTAG with my oscilloscope and will update when it succeeds.
Regards
Manuel
 

Offline Rigby

  • Super Contributor
  • ***
  • Posts: 1476
  • Country: us
  • Learning, very new at this. Righteous Asshole, too
Re: Sniffing the Rigol's internal I2C bus
« Reply #3736 on: December 16, 2014, 01:43:12 pm »
Actually is Ms. 

Sandra

Awesome!

I hate that folks here are always assumed to be men.  I have four daughters who all show promise in being engineers of one type or another.
 

Offline smgvbest

  • Supporter
  • ****
  • Posts: 630
  • Country: us
    • Kilbourne Astronomics
Re: Sniffing the Rigol's internal I2C bus
« Reply #3737 on: December 16, 2014, 02:24:58 pm »
I actually wanted to be a computer engineer specially designing CPU's but just could not pull of the finances so ended up going the electronics technician route right when they were a dine a dozen in Calif so ended up of all things a mainframe system programmer but have kept my electronics training alive as my hobby.  but still have allot to learn
Sandra
(Yes, I am a Woman :p )
 

Offline Howardlong

  • Super Contributor
  • ***
  • Posts: 5315
  • Country: gb
Re: Sniffing the Rigol's internal I2C bus
« Reply #3738 on: December 16, 2014, 02:46:32 pm »
My Hat's Off to You Mr Smgvbest!!  :clap:

I am afraid of break the sticker, but now I will go!!  :-DD
You makes the process look simple and self-explained.

Thank You!
Manuel

Manuel, if you follow Mike's instructions here http://youtu.be/KGcNS5g9ygg you won't break the sticker. The trick is to be patient, it might take five or ten minutes. I then also protect the loose end and its adhesive with some of the sticker backing paper and a little DIY paper envelope taped to the enclosure.
 

Offline smgvbest

  • Supporter
  • ****
  • Posts: 630
  • Country: us
    • Kilbourne Astronomics
Re: Sniffing the Rigol's internal I2C bus
« Reply #3739 on: December 16, 2014, 04:10:36 pm »
My Hat's Off to You Mr Smgvbest!!  :clap:

I am afraid of break the sticker, but now I will go!!  :-DD
You makes the process look simple and self-explained.

Thank You!
Manuel

Manuel, if you follow Mike's instructions here http://youtu.be/KGcNS5g9ygg you won't break the sticker. The trick is to be patient, it might take five or ten minutes. I then also protect the loose end and its adhesive with some of the sticker backing paper and a little DIY paper envelope taped to the enclosure.

That's the one I followed and it works fine.   Thanks for posting the link
Patients is definitely the key to removing it intact.  It took me closer to 10 minutes to remove mine.
Sandra
(Yes, I am a Woman :p )
 

Offline Rigby

  • Super Contributor
  • ***
  • Posts: 1476
  • Country: us
  • Learning, very new at this. Righteous Asshole, too
Re: Sniffing the Rigol's internal I2C bus
« Reply #3740 on: December 16, 2014, 04:21:09 pm »
I actually wanted to be a computer engineer specially designing CPU's but just could not pull of the finances so ended up going the electronics technician route right when they were a dine a dozen in Calif so ended up of all things a mainframe system programmer but have kept my electronics training alive as my hobby.  but still have allot to learn

get into FPGAs.  you can design CPUs all day long, and FPGAs are how CPUs are designed & prototyped nowadays.
 

Offline hammy

  • Supporter
  • ****
  • Posts: 465
  • Country: 00
Re: Sniffing the Rigol's internal I2C bus
« Reply #3741 on: December 16, 2014, 07:11:29 pm »
0,35 / (2,450s x 10^-9) = 142,85 MHz

 :-+
 

Offline smgvbest

  • Supporter
  • ****
  • Posts: 630
  • Country: us
    • Kilbourne Astronomics
Re: Sniffing the Rigol's internal I2C bus
« Reply #3742 on: December 16, 2014, 10:19:05 pm »
I actually wanted to be a computer engineer specially designing CPU's but just could not pull of the finances so ended up going the electronics technician route right when they were a dine a dozen in Calif so ended up of all things a mainframe system programmer but have kept my electronics training alive as my hobby.  but still have allot to learn

get into FPGAs.  you can design CPUs all day long, and FPGAs are how CPUs are designed & prototyped nowadays.

I had thought about that.   IBM has been designing mainframes that way since the late 90's early 2K's I believe.   When In poughkeepsie where IBM does hardware development I got to see the next gen mainframe at that time and they basically said the entire box was nothing but a programmable array. 
Sandra
(Yes, I am a Woman :p )
 

Offline Carrington

  • Super Contributor
  • ***
  • Posts: 1202
  • Country: es
Re: Sniffing the Rigol's internal I2C bus
« Reply #3743 on: December 16, 2014, 10:44:02 pm »
...

I hate that folks here are always assumed to be men.
Well, but clearly is not very common, unfortunately.
« Last Edit: December 16, 2014, 10:45:41 pm by Carrington »
My English can be pretty bad, so suggestions are welcome. ;)
Space Weather.
Lightning & Thunderstorms in Real Time.
 

Offline smgvbest

  • Supporter
  • ****
  • Posts: 630
  • Country: us
    • Kilbourne Astronomics
Re: Sniffing the Rigol's internal I2C bus
« Reply #3744 on: December 17, 2014, 12:58:01 am »
...

I hate that folks here are always assumed to be men.
Well, but clearly is not very common, unfortunately.

I'm sure if guys where called Ms all the time they'd see it differently  ;)
I will say this.  back in 1985 when I was in tech school (AS degree in electronics, far as i was able to get) in my graduation class of about 97 students,  about 30 where women it's not have but its not a small amount either

I edited this slightly to help people understand my comment was meant in fun. i.e. the wink
« Last Edit: December 18, 2014, 05:00:03 am by smgvbest »
Sandra
(Yes, I am a Woman :p )
 

Offline Leiothrix

  • Regular Contributor
  • *
  • Posts: 104
  • Country: au
Re: Sniffing the Rigol's internal I2C bus
« Reply #3745 on: December 17, 2014, 03:20:24 am »
I'm sure if guys where called Ms all the time they'd see it differently

I'm a guy and I don't particularly care.

It just depends on the gender balance of where you are (whether IRL or online), it doesn't mean anything.  Depending on the maturity level of the place it's probably better to be lumped in with the majority by assumption.

If you want to avoid (most) wrongly gendered pronouns you can pick a strongly gendered name.  That has it's own problems in some places, but I don't think this board is one of them where gender matters.
« Last Edit: December 17, 2014, 03:22:55 am by Leiothrix »
 

Offline Howardlong

  • Super Contributor
  • ***
  • Posts: 5315
  • Country: gb
Re: Sniffing the Rigol's internal I2C bus
« Reply #3746 on: December 21, 2014, 05:23:50 pm »
Here are some further notes regarding the DSA815 with bootloader 1.04 and firmware 1.09.

If the WP on the FRAM is disabled, I understand that the network parameters and startup parameters can't be changed.

The WP does not connect to anything, it has a weak pull down internally, so it would appear that just shorting pins 7 & 8 (WP & VDD) would stop the FRAM being updated with the time-on-since-new every 10 seconds, suggesting that there is no need to lift pin 7.

Furthermore, although the I2C SCL line is held low, there is a short period at power up time, about 400ms, when the SCL line is pulled high to VDD with a standard I2C pullup. Both SCL and SDA are open drain high at this point.

By performing a re-write of the time-on-since-new within this 400ms timeframe apparently it is possible to reset the time without disabling the updating of non-volatile parameters.



« Last Edit: December 21, 2014, 05:30:51 pm by Howardlong »
 

Offline kwass

  • Frequent Contributor
  • **
  • Posts: 347
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #3747 on: December 21, 2014, 05:35:44 pm »
That's the one I followed and it works fine.   Thanks for posting the link
Patients is definitely the key to removing it intact.  It took me closer to 10 minutes to remove mine.

Sandra,

I used a heat gun from a few inches away and the sticker peeled away in seconds, then stuck back on like new.  I just went inside this machine to change the noisy fan to something I could tolerate, nothing so elaborate as you did.  Nice work!

-Katie

(p.s.  I too had a lot of women in my computer science graduate school class of 1985, but it's gotten really bad since then.)
-katie
 

Offline phersus

  • Newbie
  • Posts: 9
Re: Sniffing the Rigol's internal I2C bus
« Reply #3748 on: December 21, 2014, 07:20:00 pm »
Hello Guys,

Incredible and fantastic job, congrats to all who participated directly or indirectly to this success.  :clap:

I am, as many here, a hobbyist. I also have an MSO1074z and want to go through the unlocking process.
After many tries under mac OS X all of them unsuccessful (openocdb works but the Olimex Jtag adapater not being recognised) I decided to try it under Windows.

Under Windows I could go a little farther, however still stuck and want to ask the ones who have been playing with this if when plugging the Jtag adapter to the PC the target device needs to be connected as well. The reason I'm asking is that I've not yet opened the oscilloscope; I wanted to test that openocd and the Olimex Jtag adapter are working first.

Any guidance would be really appreciated.

Thanks a lot,
Gus
 

Offline hammy

  • Supporter
  • ****
  • Posts: 465
  • Country: 00
Re: Sniffing the Rigol's internal I2C bus
« Reply #3749 on: December 21, 2014, 07:31:35 pm »
Hi,

yes, the device needs to be connected to the ARM-USB-OCD-H jtag port first. Then you can plug it into the pc and start openocd and it will open the device. If nothing is connected some message like "open device failed" shows up.

Cheers
hammy
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf