Upcoming Rigol DSG815/830

[tv84]

How to license DSG815/830 options

Insert the following parameters in the usual license generator :

Forever Options:
AAAB  (0x00001) - DSG800-PUM Pulse Modulation & Pulse Generator
AAAC  (0x00002) - DSG800-PUG Pulse Train Generator

Public Key:
6673BBC777EA4D  (Key taken from the current FW. Those interested will have to calculate the Private Key as homework.) 

As always, insert the licenses with SCPI command :SYSTem:LKEY.

Edit: Corrected the options' hex designations.

[tv84]

Rigol's Declassification Guide.

[JOHN LEE]

looks good!

[chicken]

I made a breakout board to explore the the OCXO option for the DSG-815 (option OCXO-B08).
https://beyondmeasure.rigoltech.com/acton/attachment/1579/f-0644/1/-/-/-/-/DSG800%20OCXO%20User%27s%20Guide.pdf



Pinout:
1: GND
2: Detect input
3: slot
4: slot
5: VCC
6: CLK input
7: VCC
8: VCC
9: GND
10: Detect output

VCC is 6.515 V when the signal generator is plugged into mains. This is higher than I expected as the OCXO-B08 datasheet specifies 5.00 V +/- 0.25 V. It didn't drop much with a 220 ohm resistor (~30 mA). Will have to find a bigger resistor to test at loads specified in datasheet (300-600 mA).

Detect output (pin 10) goes from 0 to 3.3 V when the signal generator is turned on. When I connect this pin to Detect input (pin 2) through a 1 K resistor Syst > Information > System Info reports the option OCXO-B08. Interestingly, there's no error message even though I don't feed an external clock signal yet.

CLK (pin 6) was the only pin left. Not tested yet.

The pitch of the pins on the edge-connector is 1mm, 10 positions with a key slot (which is counted as a position). A matching connector is Samtec 1mm Mini Edge Card Socket Vertical, part number MEC1-105-02-F-D-EM2 or MEC1-105-02-L-D-EM2.
https://www.samtec.com/products/mec1-105-02-f-d-em2
https://www.samtec.com/products/mec1-105-02-l-d-em2

The dimensions of my breakout PCB are 32 mm x 50 mm, 1.6 mm thickness. It turned out to be about 3 mm too long, so 32 x 47 mm would be the correct size.

The size of the original OCXO is likely 25.4 x 25.4 mm. There are no good images of the OCXO-B08 to be found, but OCXO options for the DSG3000 (OXCO-A08)  has similar specifications. Some images for that option show an OCXO from DAPU with part number O22B-G445. Unfortunately, that part number doesn't quite match with the numbering-scheme on DAPU's website:
https://www.dptel.com/Products/ProductLevel4/2899



Any thoughts about VCC being 6.5 V?

Any suggestions for a suitable OCXO for this application?

[tv84]

Using this information one can easily do a random mistake like this:

DSG815 -> DSG836

 

[chicken]

  the joys of shared hardware (and firmware)!

[AlexDavidson]

Thanks to chicken in reply #49 for posting details about how to enter FACTORY mode. A heads up for anyone wishing to try this (e.g. to make semi-random mistakes with the model number) the string you write to the USB drive needs to be written to logical sector 3, not physical sector 3.

[Darius121]

Thanks tv84,
I don't suppose you have any tips on extracting the key for a DSG815 owner? 

I tried running rigup search & scan on the file plus on the files extracted by binwalk but no luck

Thanks.

[tv84]

Thanks tv84,
I don't suppose you have any tips on extracting the key for a DSG815 owner? 

I tried running rigup search & scan on the file plus on the files extracted by binwalk but no luck

Thanks.

  The instructions are above.

[Darius121]

The instructions are above.

I guess I'm blind then 

Currently running 'break' on the public key but no idea how long it will take.

[Darius121]

Currently running 'break' on the public key but no idea how long it will take.

Turns out it seems to be broken on Linux and OSX but runs OK on Windows (last 4 digits are 23EF), although the resulting key does not produce something my sig gen likes.

[AlexDavidson]

Turns out it seems to be broken on Linux and OSX but runs OK on Windows (last 4 digits are 23EF), although the resulting key does not produce something my sig gen likes.

Not just broken on Linux & OSX, but Windows too. After waiting a week for a result from rigup-0.4.2-x86_64-win.exe break 6673BBC777EA4D, I gave up and tried running it on another machine. Instant success. 3521E2B968D60F.

[Darius121]

Not just broken on Linux & OSX, but Windows too. After waiting a week for a result from rigup-0.4.2-x86_64-win.exe break 6673BBC777EA4D, I gave up and tried running it on another machine. Instant success. 3521E2B968D60F.

Hah thanks!
I did find on some systems it will run and finish straight away but give you a different result each time which is obviously broken.

I also note you have to remove the -'s from the key before it will be accepted.

[Houseman]

How to license DSG815/830 options

Insert the following parameters in the usual license generator :

Forever Options:
AAAB  (0x00400) - DSG800-PUM Pulse Modulation & Pulse Generator
AAAC  (0x00800) - DSG800-PUG Pulse Train Generator

Public Key:
6673BBC777EA4D  (Key taken from the current FW. Those interested will have to calculate the Private Key as homework.) 

As always, insert the licenses with SCPI command :SYSTem:LKEY.

Hi TV84
Seems for my Rigol DSG815 with FW 00.01.07 does not work this method.
Generated lics starts with RAJ9JBB are invalid.
Trial installed are LS9FBxxxxx
Any help?
Best regards

[Houseman]

Here's how to enter FACTORY and MANAGER/REPAIR modes:

Prepare a USB stick:
1. Format as FAT32
3. Write the following string to disc sector 3 of the USB stick (I used HxD):
35O8O228OLO8LNMN9690217963MN2O9ON46O9P05975K0047

Plug USB stick into the RF generator

Now the following SCPI commands will work:
:PRIV:SOFT:MODE 0,FACTORYMODEENTRANCE
:PRIV:SOFT:MODE 0,REPAIRMODEENTRANCE
:PRIV:SOFT:MODE 0,MANAGERMODEENTRANCE

The first parameter (0) seems to be ignored.
MANAGER and REPAIR seem to be identical, but entering REPAIR doesn't require the USB stick.

The current mode can be verified with:
:PRIV:SOFT:MODE?

To return to USER mode, power cycle the device or use
:PRIV:SOFT:MODE 0,USERMODEENTRANCE
or
:PRIV:SOFT:MODE 0,EXITCURRENTMODE

Additional menus show up when in FACTORY/REPAIR/MANAGER mode:
Syst > Service
Syst > Service > Calibration
Syst > Service > RF DataSyn
Syst > License > Delete

I haven't dared to mess with settings in factory mode yet (like changing the model to DSG830). Don't blame me if you break your RF generator 

And a little mystery: When triggering the check of the disk sector, an empty file with the name "LqepdclquJ.txt" is created on the USB stick.

Hi.
Brand new DSG800.
Having problems with SCPI commands.
Resulting timeout error:
 * Error!!!
VISA:  (Hex 0xBFFF0015) Timeout expired before operation completed.

Some command accepted without error like IDN? or TIME, DATE ecc.
Other are partially accepted like:
:PRIV:SOFT:MODE 0,REPAIRMODEENTRANCE
Still gives me error timeout but
:PRIV:SOFT:MODE? gives me the change from USER to REPAIR MODE
but other complex one like dump or FACTORYMODEENTRANCE or serial license install mode gives me error.
Have reinstalled VISA driver, tried different OS (Mac, windows) different programs (nc, ultrasigma, Bildschirmkopie), tried append /n /r /r/n /n/r command extended timeout without effort.
Any info that Rigol stopped SCPI advanced access or is it only my fault?
Any help?
Thanks all

[chicken]

Brand new DSG800.
Having problems with SCPI commands.
Resulting timeout error:
 * Error!!!
VISA:  (Hex 0xBFFF0015) Timeout expired before operation completed.

Is that with the USB key?
What's your firmware version?

If I remember correctly, the SCPI implementation is quite picky and I also ran into plenty of timeouts while exploring the undocumented SCPI commands.

[Houseman]

Thank You chicken.

Brand new DSG800.
Having problems with SCPI commands.
Resulting timeout error:
 * Error!!!
VISA:  (Hex 0xBFFF0015) Timeout expired before operation completed.

Is that with the USB key?

Sorry what do You mean by that?
If it has a USB slot on the back?
Mine is just a DSG815 (no model A)
[/quote]
What's your firmware version?
[/quote]
-> *IDN?
<- (Return Count:50)
Rigol Technologies,DSG815,DSGxxxxxxx,00.01.07
Firmware version I think latest one available: 00.01.07
[/quote]
If I remember correctly, the SCPI implementation is quite picky and I also ran into plenty of timeouts while exploring the undocumented SCPI commands.
[/quote]

So what did you do to overcome this timeout? Did you manage get into factory mode?
Best regards and thanks

[chicken]

Sorry what do You mean by that?
If it has a USB slot on the back?

To enable factory mode you need to insert the USB key/drive prepared with the magic data as described in the original post. The firmware does look for this key when changing modes.

I didn't explore much further than enabling factory mode and seeing the extra menus. Most of my reverse engineering was done by analyzing the firmware files.  From my notes, it looks like I also only got timeouts for :SERVICE:READ:FLASH.

Timeouts probably indicate missing or invalid parameters, or that the SCPI client reads the data in the wrong way, or that the feature is not implemented or broken. Attached a spreadsheet with all SCPI commands I've found with some notes.

-> *IDN?
<- (Return Count:50)
Rigol Technologies,DSG815,DSGxxxxxxx,00.01.07
Firmware version I think latest one available: 00.01.07

I still have 01.06, so there may be differences.

[Houseman]

Thanks. Yep, the prepped key has been inserted but with all that timing error I do not know where the fault could be.
Do you know any limitation about USB pen size? I mean I have a 8Gb FAT32 format. Maybe it's too big?
By the way thank You for pointing out and helping me.
One last question: what kind of protocol/program did you use by sending commands to the DSG? Netcat? Ultra Sigma? thank You again

[tv84]

Change USB pendrive. These equipments are extremely picky regarding USB pendisks.

Big size isn't better... it forces extra timings recognizing/validating things and that may crash against the timings of the internal software.

[Houseman]

Change USB pendrive. These equipments are extremely picky regarding USB pendisks.

Big size isn't better... it forces extra timings recognizing/validating things and that may crash against the timings of the internal software.

Thank You TV84...
  "Big size isn't better... it forces extra timings recognizing/validating things and that may crash against the timings of the internal software."
Could be the new excuse .... maybe accepted whenever understood by partner..
Sorry by digressing  You made me laugh, thanks

[Houseman]

I made a breakout board to explore the the OCXO option for the DSG-815 (option OCXO-B08).
https://beyondmeasure.rigoltech.com/acton/attachment/1579/f-0644/1/-/-/-/-/DSG800%20OCXO%20User%27s%20Guide.pdf



Pinout:
1: GND
2: Detect input
3: slot
4: slot
5: VCC
6: CLK input
7: VCC
8: VCC
9: GND
10: Detect output

VCC is 6.515 V when the signal generator is plugged into mains. This is higher than I expected as the OCXO-B08 datasheet specifies 5.00 V +/- 0.25 V. It didn't drop much with a 220 ohm resistor (~30 mA). Will have to find a bigger resistor to test at loads specified in datasheet (300-600 mA).

Detect output (pin 10) goes from 0 to 3.3 V when the signal generator is turned on. When I connect this pin to Detect input (pin 2) through a 1 K resistor Syst > Information > System Info reports the option OCXO-B08. Interestingly, there's no error message even though I don't feed an external clock signal yet.

CLK (pin 6) was the only pin left. Not tested yet.

The pitch of the pins on the edge-connector is 1mm, 10 positions with a key slot (which is counted as a position). A matching connector is Samtec 1mm Mini Edge Card Socket Vertical, part number MEC1-105-02-F-D-EM2 or MEC1-105-02-L-D-EM2.
https://www.samtec.com/products/mec1-105-02-f-d-em2
https://www.samtec.com/products/mec1-105-02-l-d-em2

The dimensions of my breakout PCB are 32 mm x 50 mm, 1.6 mm thickness. It turned out to be about 3 mm too long, so 32 x 47 mm would be the correct size.

The size of the original OCXO is likely 25.4 x 25.4 mm. There are no good images of the OCXO-B08 to be found, but OCXO options for the DSG3000 (OXCO-A08)  has similar specifications. Some images for that option show an OCXO from DAPU with part number O22B-G445. Unfortunately, that part number doesn't quite match with the numbering-scheme on DAPU's website:
https://www.dptel.com/Products/ProductLevel4/2899



Any thoughts about VCC being 6.5 V?

Any suggestions for a suitable OCXO for this application?

Rigol officially claims that the OXCO module has to be inserted at factory by them even after  since after plugging the expansion in all RF gen needs to be whole recalibrated again...

[Houseman]

Sorry TV84
I am trying different usb sticks by your suggestion.
In order to break the problem in parts I wanted to test normal inserted USB keys. I hope that if seen by instruments it will also work for MOD.
Do you know by far if a normal USB key inserted will be shown in the System menu automatically? as i.e. using as print screen?
Is it like DS1054Z where inserted disk will be detected automatically by the instrument?
My system only shows D: internal drive.
No other USB disks.
Rebooting with normal USB not shown.
Best regards and thanks


Does

[chicken]

Do you know by far if a normal USB key inserted will be shown in the System menu automatically?

I get the E: drive and a small USB icon with the USB stick plugged in. I use a cheap Chinese uSD card adapter with an ancient uSD card, but it also should work with regular USB sticks.

One last question: what kind of protocol/program did you use by sending commands to the DSG? Netcat? Ultra Sigma? thank You again

I used Python with the vxi11 library for my experimentation. Looking at the code, I have just used the write(":PRIV:SOFT:MODE 0,FACTORYMODEENTRANCE") to set user mode, without expecting/reading a response. Then ask(":PRIV:SOFT:MODE?") to verify if it worked.

Rigol officially claims that the OXCO module has to be inserted at factory by them even after  since after plugging the expansion in all RF gen needs to be whole recalibrated again...

Dooh! 

[Houseman]

I used Python with the vxi11 library for my experimentation. Looking at the code, I have just used the write(":PRIV:SOFT:MODE 0,FACTORYMODEENTRANCE") to set user mode, without expecting/reading a response. Then ask(":PRIV:SOFT:MODE?") to verify if it worked.

What you just said has enlighten me.
You are right. Timeout connection occurs at response. So if I just send the command without asking anything maybe the system accept it even if at response it gives me timeout error.. will give it a try..
Thanks.

by the way no icon appears by inserting usb stick... maybe have a faulty unit.
best regards and thanks