Sonsivri
 
*
Welcome, Guest. Please login or register.
Did you miss your activation email?
October 03, 2024, 05:02:57 17:02


Login with username, password and session length


Pages: [1]
Print
Author Topic: Rigol MSO1000Z Series Oscilloscope JTAG Hack  (Read 14477 times)
0 Members and 1 Guest are viewing this topic.
SteveyG
Newbie
*
Offline Offline

Posts: 23

Thank You
-Given: 4
-Receive: 9


« on: March 30, 2015, 02:36:15 14:36 »

Here is a video hosted on YouTube to describe how to perform a memory dump on the Rigol MSO1000Z series oscilloscopes. This will allow you to use the key generators for unlocking all the options on the scope. Please note, you only need to do this on the MSO scopes. I think you can use the key generators directly on the DSO1000.

Hopefully this helps someone.  Cheesy

http://www.youtube.com/watch?v=OvcGn_ScG5w

The links are in the video comment for the special tool for the MSO1000Z
Logged
Xwing
Active Member
***
Offline Offline

Posts: 210

Thank You
-Given: 585
-Receive: 1530



« Reply #1 on: March 30, 2015, 05:32:16 17:32 »

This procedure allows the hack of DSO Rigol 1000Z series 2000A series without using the JTAG.
Tested personally on my DS2102A, it should also work with the MSO series 1000Z.

(source of information EEVBLOG topic "Sniffing the Rigol's internal I2C bus")
**************
YET ANOTHER HACK SUMMARY

I had all options + 300 MHz on my DS2072A, then I upgraded to the latest firmware, and lost all the hacks. It took me some time to figure out how to get them back.

This is my summary (should work for a new out-of-the-box DS2072A as well):

1 - Download & unzip the latest "Rigol Bildschirmkopie LAN/USB" from http://peter.dreisiebner.at/rigol-bildschirmkopie-lan/

2 - Connect scope to LAN.

3 - Run the RigolBildschirmkopie.exe, click Device>Select>Search>Select.

4 - Do Device>SCPI-Command, then  Send & receive ":SYST:UTIL:READ? 1,33554432".
 
     Wait a long time (~5 to 10 min) for it to complete.
     
     Click Save, save it as "memoryDump.scpi" (save this file for future use!!)

5 - Download and unzip Rigup 0.4 (or later) from http://gotroot.ca/rigol/.

6 - Open a command window where you unzipped Rigup 0.4, copy memoryDump.scpi into the same folder.

7 - In the command window do: "rigup ds2072a memoryDump.scpi"

      This will produce an output something like:

rigup ds2072a - Version 0.4

Serial number: DSxxxxx

NSEH:  JPJQLFK-G3QNRLU-WFFFZMD-xxxxxxx    All options, no bandwidth upgrade
NSER:  8NXBL2U-JE2LZL7-9NEN5XK-xxxxxxx   All options, bandwidth 100 MHz
NSEQ:  R939MMG-NR63H25-9H993PX-xxxxxxx    All options, bandwidth 200 MHz
NS8H:  G2YRFYX-D589HNR-4K8YW3H-xxxxxxx    All options, bandwidth 300 MHz

8 - rigup scan MyKeys memoryDump.scpi

This will write your keys to the file "MyKeys".

9 - rigup license MyKeys NS8N

This produces an output something like:

5P89ZX7-LYMCTCS-P4PQ792-xxxxxxx   (NS8N = 0x1C0C3)

10 - Run RigolBildschirmkopie.exe again, click Device>Select>Search>Select (again).

11 - Click Device>SCPI-Command, then send & receive:
       :SYSTem:OPTion:INSTall <key to the right of NSEQ in step 7>

       The key (from step 7) MUST have the dashes removed.

       For example:
       :SYSTem:OPTion:INSTall R939MMGNR63H259H993PXxxxxxxx
       
At this point you should have all options + 200 MHz.

12 - Click Device>SCPI-Command, then send & receive:

       :SYSTem:OPTion:INSTall <key from step 9>

       Again, the key must have all dashes removed.

       For example:
       :SYSTem:OPTion:INSTall 5P89ZX7LYMCTCSP4PQ792xxxxxxx

That's it; you should have 300 MHz + all options now.

Maybe you can skip step 11 - I haven't tried it that way.

If you mess up, no problem. Just send ":SYSTem:OPTion:UNINSTall" and start over.

*****************
Logged
SteveyG
Newbie
*
Offline Offline

Posts: 23

Thank You
-Given: 4
-Receive: 9


« Reply #2 on: March 30, 2015, 08:41:40 20:41 »

This procedure allows the hack of DSO Rigol 1000Z series 2000A series without using the JTAG.
Tested personally on my DS2102A, it should also work with the MSO series 1000Z.

Unfortunately it doesn't work with the MSO1000Z series, hence the linked video. You also have to use a hacked version of the riglol tool.

The above does work for the DS2000 series, and it's not required at all for the DSO1000Z series.
Logged
Bamsalt
Junior Member
**
Offline Offline

Posts: 98

Thank You
-Given: 359
-Receive: 330


« Reply #3 on: March 30, 2015, 11:46:25 23:46 »

Hi Xwing, is it necessary to update to the modified firmware before you hack the DS2072A ?
« Last Edit: March 31, 2015, 12:21:56 00:21 by Bamsalt » Logged
SteveyG
Newbie
*
Offline Offline

Posts: 23

Thank You
-Given: 4
-Receive: 9


« Reply #4 on: March 31, 2015, 07:17:51 07:17 »

You can do the hack on the DS2072A on any firmware level. If you update your firmware, the keys will still be valid and the options will still be installed.
Logged
Pages: [1]
Print
Jump to:  


DISCLAIMER
WE DONT HOST ANY ILLEGAL FILES ON THE SERVER
USE CONTACT US TO REPORT ILLEGAL FILES
ADMINISTRATORS CANNOT BE HELD RESPONSIBLE FOR USERS POSTS AND LINKS

... Copyright © 2003-2999 Sonsivri.to ...
Powered by SMF 1.1.18 | SMF © 2006-2009, Simple Machines LLC | HarzeM Dilber MC