Sniffing the Rigol's internal I2C bus

[DoMaLo]

Hello everybody. I have MSO1104z, board version: 2.1.4, SV: 00.04.04.SP1. I took a dump using JLink Ultra + in JLink Commander and OpenOCD. Rigup 0.4.1 (MSO1000z) and 0.4.2 print "No keys" for both of dumps. What's can i do for unlocking my oscilloscope?

[Gluk]

What do you think about resistors near 3k   near by FPGA and JTAG header in the  MSO1074z? May be is it  config divider?

[DoMaLo]

I think that these are resistors for pull-up and pull-down JTAG chain. Because I was working with Actel FPGA and typical JTAG chain
ProASIC3E Flash Family for FlashPro has resistors. Circuit that I used for my project in attachment.

[Gluk]

Friends, yes! resistors near JTAG header set the config. They has title "hardware version" and "sp version". Upper resistor line is pull-up, lower - is pull-down.

Do somebody want to play with this pull-up-down? $)

[Gluk]

the JTAG pullup/down resistors are there purely to enable robust JTAG data transfer.

This resistors not connected to the jtag pins!



It connected to the pins near JTAG. And it has title!

[ebastler]

This resistors not connected to the jtag pins!
It connected to the pins near JTAG. And it has title!

Yes, I realized that and pulled my earlier post in the meantime. But I am afraid the "version" resistors are there simply to let the software know about different historical board revisions, which may require slightly different software control. I don't think these will enable any options.

After all, one can buy software upgrade codes for the MSO scopes, right? As these upgrades do not require the user to re-solder any internal resistors, I believe that the options are enabled and disabled purely based on keys stored in EEPROM.

[ebastler]

On a more general note, I must admit that I have lost track of this thread. Is there a proven method for enabling options on the MSO1000Z and DS1000Z-plus scopes? If so, could someone post a summary or a link please? Many thanks!

[Gluk]

ebastler, Yes! Now I'm doing it. Some later I can post summary.
Or just see page #150, post by smgvbest

[ebastler]

ebastler, Yes! Now I'm doing it. Some later I can post summary.
Or just see page #150, post by smgvbest

Ahhh, that indeed looks like step-by-step instructions, and nicely illustrated too!
Wow, how did you find that post in the 174-page thread? 

Once you have confirmed that this works, maybe we can ask andyturk (who started this thread) to include a link in the first post.

[McBryce]

ebastler, Yes! Now I'm doing it. Some later I can post summary.
Or just see page #150, post by smgvbest

Ahhh, that indeed looks like step-by-step instructions, and nicely illustrated too!
Wow, how did you find that post in the 174-page thread? 

Once you have confirmed that this works, maybe we can ask andyturk (who started this thread) to include a link in the first post.

I used the method on page 150 from smgvbest to "liberate" my MSO1104z-s and can confirm that it works.

McBryce.

[edgelog]

I have the exact same version as DoMaLo (v00.04.04.SP1, board 2.1.4. Tried with Olimex, dumping the memory during the bootup logo and after at various intervals. All the dump files look good, as judged by all the strings in there looking reasonable (there's a lot of them, HTML pages, CSS files, a lot of help strings), but rigup 0.4.1 for MSO1000z says "no keys".

I also looked through the dump file for anything similar to the pattern given in rigup utils.c, in the ScanKeys function, and I can find nothing that matches the length of the keys or the hex prefix of the block.

It looks to me as if the keys simply aren't there anymore. 

[Gluk]

I have the exact same version as DoMaLo (v00.04.04.SP1, board 2.1.4. Tried with Olimex, dumping the memory during the bootup logo and after at various intervals. All the dump files look good, as judged by all the strings in there looking reasonable (there's a lot of them, HTML pages, CSS files, a lot of help strings), but rigup 0.4.1 for MSO1000z says "no keys".

Make dump after boot complete! Early dump don't has keys. I used rigup-0.4.2-x86_64-win and got keys, and hacked it complitely.

[edgelog]

Make dump after boot complete! Early dump don't has keys. I used rigup-0.4.2-x86_64-win and got keys, and hacked it complitely.

I have tried rigup-0.4.2-x86_64-win.exe with 6 different file dumps taken at varying points in time, all the way from during the logo to more than five minutes after the boot completed, and nothing but "no keys". What version of firmware do you have? Same as mine (00.04.04.SP1)?

[edgelog]

Ok, found the problem. Rigup was modified to work with the MSO1000z series by looking for a block of bytes beginning with the sequence 01 00 84 00 10 00, while the DS1000z (and other models?) use 02 00 84 00 10 00. By poking around with a hex editor in the dump files, I found that for my scope at least, that sequence is 02 00 84 00 10 00, which you're not supposed to see in an MSO. So not all MSOs are alike.

Just for clarity, this MSO1104Z with firmware 00.04.04.SP1 uses the sequence 0x02 0x00 0x84 0x00 0x10 0x00.

Fix: if you download the rigup-0.4.1-mso1000z.zip from gotroot.ca, open utils.c, in the function ScanKeys() uncomment the first static const and comment out the second, so it looks like this afterwards:

Code: [Select]

const unsigned int sequenceSize = 6 + 16 + 2 + 2*16 + 2 + 8 + 2 + 64;
static const uint8_t seq_1_ref[] = {0x02, 0x00, 0x84, 0x00, 0x10, 0x00};
//static const uint8_t seq_1_ref[] = {0x01, 0x00, 0x84, 0x00, 0x10, 0x00};

Then recompile:

Code: [Select]

make clean
make all

After this, I got all the keys, could generate all licenses, and all of them were accepted. Yay!

[Gluk]

edgelog, is it a joke from Rigol with latest firmware? 

[edgelog]

Maybe, but it did have me worried for a while.
I think  maybe the solution would be for rigup to accept 0x01 and 0x02 in that sequence. It's unique anyway.

[mightyzen]

doing that since about a week or so - but the discovered TWI functions so far a slave mode, not master mode - a lot of stuff is happening via DMA transfers to from the fpga (assumption). they use VDK and threads, which makes reversing a pain in the ass, 8k subs, thousands of pointers ... im slowly approaching the right subs. if anyone has ida with the blackfin cpu from rigol homebrew, im happy to share my custom GEL loader, and IDA DB.

Any one got that IDA DB (*.idb) from Cybernet back in 2013?

[Blisk]

Is there a list which oscilloscope is hackable and can be upgraded??

[lifeclock]

Just want to confirm the hack still works on the scope below with a raspberry pi as the JTAG probe.

DS1074z-Plus
Software Version: 00.04.04.SP1
Board Version: 6.1.4

The jtag connector was missing on my board so I had to solder a connector in.
Memory dump took 4-5 hours, but beats spend money and waiting on shipping for a proper jtag probe.

Steps Followed

• Setup a raspberry pi with RASPBIAN JESSIE LITE (https://www.raspberrypi.org/downloads/raspbian/). 
• Install OpenOCD on raspberry pi following adafruits tutorial (https://learn.adafruit.com/programming-microcontrollers-using-openocd-on-raspberry-pi/overview)
• Take apart the scope and add the jtag connector.
• Followed this info from user arobincaron in this post (https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/4325/?action=post;last_msg=1193447)
  

  To figure out how to connect the Raspberry Pi GPIO pins to the scope JTAG port I used info from the article above, the scope JTAG information in https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg720691/#msg720691, reviewed the sysfsgpio-raspberrypi.cfg interface file and http://pinout.xyz/pinout/uart.  Here's what I came up with:
  
  

  JTAG signal	Scope Header Pin	Pi GPIO Signal	Pi Header Pin
  TCK	1	11	23
  TMS	3	25	22
  TDI	5	10	19
  TDO	4	9	21
  TRST	7	11	26
  Gnd	8	Gnd	25

  
  I used very short cables (~6 inches) and quadrupled checked my connections as I was a bit paranoid about wrecking the scope processor. You should verify yours too 
  
  I started openocd using the following command line:
  
  openocd -d2 -f interface/sysfsgpio-raspberrypi.cfg -f target/imx28.cfg
  
  I installed telnet (sudo apt-get install telnet) and connected to openocd using:
  
  telnet localhost 4444
  
• Followed these instrutions from user smgvbest
  

  Once I had the console typed
  
  Code:
       halt
       dump_image mso1074zs.bin 0x40000000 0x3FFFFFF
  
• Get rigup on your raspberry pi from this post
  

  Hi all,
  I uploaded fixed rigup sources to https://www.dropbox.com/sh/1yrh8s90ityn90s/AAA6PXlJk9gGQwoDOwO6TDQua?dl=0, feel free to use.
  There are still some bugs as psysc0rpi0n was unable to unlock so far so use cautiously
  I did some investigation how licenses are stored and it looks like they just programmed to flash and never erased. On startup FW scans all of them to decide which one to use. As longs as rigup works no need to worry about trials.
  
• Follow this youtube video starting at 9:58 to build the rigup source code and generate license codes
  https://youtu.be/OvcGn_ScG5w?t=598
  

Good luck! And thanks to everyone that made this possible!

[kattyil]

Good day everyone,

my DSA-815TG runs with the current Firmware 1.18 under Hardware 0.04 and boot loader 1.03. Generating keys with RIGLOL and activating the same under 1.18 works perfectly fine, the 10Hz RBW option was accepted but obviously has no effect as this option is available per default these days. All other options except for the last one are active as expected.

The new option SSC-DSA is shown as inactive and has no trial license. Experimenting with code AAAG in Riglol has no effect.

Any thoughts? Where does the code sequence (AAAE or SAAE come from?)

Raj

[ted572]

Good day everyone,
My DSA-815TG runs with the current Firmware 1.18 under Hardware 0.04 and boot loader 1.03. Generating keys with RIGLOL and activating the same under 1.18 works perfectly fine, the 10Hz RBW option was accepted but obviously has no effect as this option is available per default these days. All other options except for the last one are active as expected.
Raj

Hello Raj: I understand from reading your post that you installed the Rigol Options with firmware 00.01.18 installed.
Although this is the first time that I have heard of anyone being able to use the Riglol Keygenerator for installing Option License Codes on the DSA815 with firmware 00.01.09 and above, on any hardware (old/new) version.
To follow this go to ->   https://www.eevblog.com/forum/testgear/spectrum-analyzer-rigol-dsa815/msg1203247/#msg1203247 

[smgvbest]

Good day everyone,
My DSA-815TG runs with the current Firmware 1.18 under Hardware 0.04 and boot loader 1.03. Generating keys with RIGLOL and activating the same under 1.18 works perfectly fine, the 10Hz RBW option was accepted but obviously has no effect as this option is available per default these days. All other options except for the last one are active as expected.
Raj

Hello Raj: I understand from reading your post that you installed the Rigol Options with firmware 00.01.18 installed.
Although this is the first time that I have heard of anyone being able to use the Riglol Keygenerator for installing Option License Codes on the DSA815 with firmware 00.01.09 and above, on any hardware (old/new) version.
To follow this go to ->   https://www.eevblog.com/forum/testgear/spectrum-analyzer-rigol-dsa815/msg1203247/#msg1203247

Ted,
I firmly believe the bootloader is the key here not the FW version or the combination of bootloader and firmware.   note his bootloader is

my DSA-815TG runs with the current Firmware 1.18 under Hardware 0.04 and boot loader 1.03

all having problems are using boot loader 1.04 such as myself.   I do not know what the interaction is with the boot loader but having followed this endless thread FOREVER it is more in common than anything else.

Has anyone looked at re-flashing bootloader 1.03 onto a DSA815?
does anyone know which bootloader they are using?

also note the new key format
old keys looked like
RUZ9H-5RUJKS-USSAW-23VUTY  (made up)
new look like
4f5RbEMlOl93wo5IOyoLWiYGR6jjUo (again made up)

and FWIW, those new keys don't work on Boot1.04, HW08,FW.18 even when supplied by rigol.  

[ted572]

Ted, I firmly believe the bootloader is the key here not the FW version or the combination of bootloader and firmware.   note his bootloader is

my DSA-815TG runs with the current Firmware 1.18 under Hardware 0.04 and boot loader 1.03

all having problems are using boot loader 1.04 such as myself.   I do not know what the interaction is with the boot loader but having followed this endless thread FOREVER it is more in common than anything else.

Has anyone looked at re-flashing bootloader 1.03 onto a DSA815?
does anyone know which bootloader they are using?

also note the new key format
old keys looked like
RUZ9H-5RUJKS-USSAW-23VUTY  (made up)
new look like
4f5RbEMlOl93wo5IOyoLWiYGR6jjUo (again made up)

and FWIW, those new keys don't work on Boot1.04, HW08,FW.18 even when supplied by rigol.

1. No one currently has been able to install or flash in a old/new/replacement/etc BootLoader.
2. I have a older DSA815 with Main Board 4 and BootLoader 3.  So I'm not having any issue here, just trying to aid others.
3. When Rigole released firmware (FW) 00.01.09 we all, with either the Older or the Newer DSA815 hardware were NO LONGER able to install previous/older FW.
4. Although, those of us with BootLoader 2 or 3 could/can still revert to the older/previous firmware and consequently activate the FW embedded Options using the RigLoL Keygenerator.  And it doesn't matter if the Trials are still there or not, the Options will be activated.  After all they are still there in the FW, and then we can re-install the newest FW update.  And all is still there.
5. Re. Your -> RUZ9H-5RUJKS-USSAW-23VUTY  (made up), where new look like -> 4f5RbEMlOl93wo5IOyoLWiYGR6jjUo (again made up).  This is not actually the case, you have to enter the code without any 'dashes' (hyphens) when you Activate a Option in either a Old or Newer DSA815.  This has always been true (no Change here what-so-ever).
6. I don't think that the version 4 BootLoader has anything to do with not being able to Activate the Option (hey, I could be wrong).
7. Although if you could get BootLoader 2 or 3 in your Newer DSA815, then you also would be able to downgrade to FW00.01.08, or earlier (with the FW Install Boot Method) and Activate the Options, and then install the very latest FW again.
8. If you are not familiar with the DSA815 'FW Install Boot Method' I posted it below (Reply #4355).

[ted572]

The DSA815 'FW Install Boot Method'

[smgvbest]

1. No one currently has been able to install or flash in a old/new/replacement/etc BootLoader.
understood, but I have seen no one try to flash (via jtag) a bootloader, and that is my comment
3. When Rigole released firmware (FW) 00.01.09 we all, with either the Older or the Newer DSA815 hardware were NO LONGER able to install previous/older FW.
again, understood
5. Re. Your -> RUZ9H-5RUJKS-USSAW-23VUTY  (made up), where new look like -> 4f5RbEMlOl93wo5IOyoLWiYGR6jjUo (again made up).  This is not actually the case, you have to enter the code without any 'dashes' (hyphens) when you Activate a Option in either a Old or Newer DSA815.  This has always been true (no Change here what-so-ever).
simply forgot the remove the dashes when I pasted it in from riglol
6. I don't think that the version 4 BootLoader has anything to do with not being able to Activate the Option (hey, I could be wrong).
my assertion is that the bootloader is an obstacle to being able to do this and finding a way to reflash to v1.03 may help
7. Although if you could get BootLoader 2 or 3 in your Newer DSA815, then you also would be able to downgrade to FW00.01.08, or earlier (with the FW Install Boot Method) and Activate the Options, and then install the very latest FW again.exactly
8. If you are not familiar with the DSA815 'FW Install Boot Method' I posted it below (Reply #4355).
one of the first things I tried when i got my DSA815

so as I understand the blackfin processor the boot loader exists at 0x20000000 (may have the number of 0's incorrect there)
if we have a dump (via jtag) of that area, from a 1.03 bootloader. we can try to flash that 1.03 version in and see if we can then revert back using the post you mention above.
once back, install the keys via riglol, then upgrade back to current version.
yes its risky,  but if it works we might have a path to applying keys on newer units.

the other comment on key format was to point out the very differ format of the keys between <FW1.09 and >FW1.09
and the fact that rigol can not generate a trial key that even works.   they broke thier own system.  that's a bug they should fix.
i for example can not trial the SSC-DSA even though they provided the key.  I would have to purchase it and hope it worked which they assure me the real keys work.   well if the real keys work, fix the trial keys.  since its obviously possible to do so.