Hacking the Rigol DHO800/900 Scope

[Fungus]

Why the changes in the display?

I think the "persisted" part isn't stored anywhere. It's just in the frame buffer.

Is the last one just a view of last captured screen in buffer?

Yes.

[dmulligan]

with a bit of practise that is not too hard. Rigol did a good job on the icons, and if you add a measurement, you'll see the corresponding icon.

There's no way one can realistically tell these three apart from 60 cm, let alone remember which means what:

Rigol should make the icons bigger!

[Mechatrommer]

i finished my "barebone minimum functioning" of "full functionalities cloned" PLA2216 LA Probe for my DHO800.. and now is testing time! (last night) it can read all channels correctly now after fixing 2 unsoldered pins today, now i have 16 channels LA probe at 625MSps 25Mpts memory yes! next test will be to download the LA data to PC to see if the dso is not lying. maybe tomorrow since i need to learn how to do it in SW... so far to probe LA offline on screen, we dont need the missing DDR3L RAM fwiw...

ps: during calibration, if fpga detecting floating input (unsoldered pins or joints), it will deactivate that 8bit lane and floored the threshold (trigger level) to -20V. my mistake. please also note when operating the LA probe, i can disconnect it from dso, and dso will turn off LA GUI faithfully, when i connect it again, dso will say "LA Probe Connected" and we can activate LA GUI, so this means, we can disconnect and reconnect the probe during dso operation, at least FW/GUI supports it, unlike what the documentation said. maybe next time i video and snapshots probing more realistic stuffs on all 16 channels. fwiw cheers.

HQ thread: https://www.eevblog.com/forum/testgear/low-cost-compatible-rigol-pla2216-logic-probe-for-dho900-(and-hacked-dho800)/msg5352677/#msg5352677

[AndyBig]

Most of everything that's in the dho800-900 code comes from their "same level" DSO model.

But there are plenty of differences between these applications.

A better hack is to add some code that gives a slider switch "icons on/off".

This is much more difficult to do than just changing something existing

[Aleksandr]

i finished my "barebone minimum functioning" of "full functionalities cloned" PLA2216 LA Probe for my DHO800.. and now is testing time! (last night) it can read all channels correctly now after fixing 2 unsoldered pins today, now i have 16 channels LA probe at 625MSps 25Mpts memory yes! next test will be to download the LA data to PC to see if the dso is not lying. maybe tomorrow since i need to learn how to do it in SW... so far to probe LA offline on screen, we dont need the missing DDR3L RAM fwiw...

ps: during calibration, if fpga detecting floating input (unsoldered pins or joints), it will deactivate that 8bit lane and floored the threshold (trigger level) to -20V. my mistake. please also note when operating the LA probe, i can disconnect it from dso, and dso will turn off LA GUI faithfully, when i connect it again, dso will say "LA Probe Connected" and we can activate LA GUI, so this means, we can disconnect and reconnect the probe during dso operation, at least FW/GUI supports it, unlike what the documentation said. maybe next time i video and snapshots probing more realistic stuffs on all 16 channels. fwiw cheers.

HQ thread: https://www.eevblog.com/forum/testgear/low-cost-compatible-rigol-pla2216-logic-probe-for-dho900-(and-hacked-dho800)/msg5352677/#msg5352677

Super!!! Thanks for the work you've done! This is a wonderful result!!!! I think everything else will work as it should! We will now wait for the result on AFG. It’s just that you are the only one today who could and will be able to do this! Thank you again for your enormous contribution to this device!

[antiquant]

That's wonderful news! I miss Nikki Smith new posts, but Mechatrommer just nailed it!

I have PLA2216 and DHO804. So I want to try the LA probe with hacked DHO.
Mechatrommer, tell us, please, did you add any unpopulated (missed) components near the dedicated place for IDC 50M (2.54mm pitch) header connector? I mean, one piece of MPM3630 (the DC-DC buck converter with integrated MOSFET, inductor and two capacitors, made by MPS in QFN-20 package, https://eu.mouser.com/ProductDetail/Monolithic-Power-Systems-MPS/MPM3630GQV-Z  https://www.monolithicpower.com/media/document/MPM3630_r1.0.pdf https://www.monolithicpower.com/en/mpm3630.html ), two dual op amps (TP1282 in MSOP-8 package, TP1282L1-VR or equal substitute) and some bulky surface mounted diode above that two op amp ICs.

Is that diode present on DHO900' PCB? Does anyone have a clear pictures (or scans) of DHO900 series PCB (DHO914(S), DHO924(S))?

Thanks to all contributors!

[axantas]

Is that diode present on DHO900' PCB? Does anyone have a clear pictures (or scans) of DHO900 series PCB (DHO914(S), DHO924(S))?

Thanks to all contributors!

If we are talking about this diode: No it is not populated on a 924S. Thas spot is visible even without opening. My first usecase for a Kensington slot. 

[AceyTech]

Does anyone have a clear pictures (or scans) of DHO900 series PCB (DHO914(S), DHO924(S))?

I reposted one of the main DHO900 PCBa a few pages back link here from early days when Mechatrommer was trying to identify components to do his upgrade.  This side is pretty much all you need AFAIK, then you can use the Flickr teardown photos for everything else in the 800/900s.  Best of luck to ya!

[Mechatrommer]

Mechatrommer, tell us, please,

already answered you in this post, i dont want to double post, cheers.
https://www.eevblog.com/forum/testgear/low-cost-compatible-rigol-pla2216-logic-probe-for-dho900-(and-hacked-dho800)/msg5353574/#msg5353574

[AndyBig]

Today I finally decided to record the image that I took from my original card immediately after receiving the oscilloscope onto a new SD. After I inserted a new card with a recorded image into the oscilloscope and turned it on, after about 40 seconds of loading, a window like the one in the screenshot appeared.
When I try to enter a password, a message appears, which I don’t remember verbatim, but its meaning is: “Although the correct password was entered, the data still could not be decrypted. It is necessary to reset the system to factory settings.” And the "Reset" button. Moreover, this appears when entering any password, I tried 1111, 1234, and 0000.
After I confirmed the reset and the reset process finished, everything worked fine after rebooting. But I was surprised by this behavior, because the image was read from a working card. In theory, the oscilloscope should have simply turned on and started working as with the original card...

[antiquant]

If we are talking about this diode: No it is not populated on a 924S. Thas spot is visible even without opening. My first usecase for a Kensington slot. 

OK, I see. Thank you, Mechatrommer and axantas !

AndyBig, are you talking about Lexar microSD (TransFlash) card? Do you remember what software utility you used to make an image of the original memory card? Anyway, can an image being made of bootable media with Linux-based OS (which Android is happen to be) be, like, "a bit-perfect copy" in all circumstances?
May this issue have something in common, something to do with "improperly unmounted volume with Linux file system" being back-up'ed to an image? Because I recently got similar warning message when was trying to make a back-up image of a bootable microSD from chinese portable video consoles (like Datafrog SF2000, Anbernic RG353V) via Norton Ghost utility.

[AndyBig]

AndyBig, are you talking about Lexar microSD (TransFlash) card? Do you remember what software utility you used to make an image of the original memory card? Anyway, can an image being made of bootable media with Linux-based OS (which Android is happen to be) be, like, "a bit-perfect copy" in all circumstances?
May this issue have something in common, something to do with "improperly unmounted volume with Linux file system" being back-up'ed to an image? Because I recently got similar warning message when was trying to make a back-up image of a bootable microSD from chinese portable video consoles (like Datafrog SF2000, Anbernic RG353V) via Norton Ghost utility.

Yes, about this card. Now I don’t remember exactly what program I used to read the image from it, either HDDRawCopy or Win32DiskImager. I recorded the image onto a new HDDRawCopy card.
I'm too new to Android and Linux to speculate, I just don't know why this could be But actually it looks strange to me.

[AndyBig]

I finally achieved what I wanted from the very beginning - to have the measurements occupy one line. I spent two days digging on the Internet, mastering the basics of element layout in Android applications, and in the end I understood enough to do it All that remains is to correct the drawing of the borders and background of these lines, but this is not difficult However, I had to slightly increase the width of the entire panel, but in my opinion this is not very critical.

[RAPo]

well done, I like it.

[norbert.kiszka]

AndyBig, are you talking about Lexar microSD (TransFlash) card? Do you remember what software utility you used to make an image of the original memory card? Anyway, can an image being made of bootable media with Linux-based OS (which Android is happen to be) be, like, "a bit-perfect copy" in all circumstances?
May this issue have something in common, something to do with "improperly unmounted volume with Linux file system" being back-up'ed to an image? Because I recently got similar warning message when was trying to make a back-up image of a bootable microSD from chinese portable video consoles (like Datafrog SF2000, Anbernic RG353V) via Norton Ghost utility.

In Linux, (almost) everything is a file, which You can read, write, etc. Right now Im writing on a laptop with Linux - both disk drives are files in /dev (/dev/sda and /dev/sdb) directory and having permission to read those files (usually only root id:0 and users in group disk) You can read every bit as it is. Same with SD cards and everything else (framebuffer for example). So You can make 1:1 copy. Im planning to do this (maybe today) and change SD card to decrease boot time and increase space for more files. Just copy this disk file into another file and back to another SD card.

Also Im planning to change this scope to run Linux instead of Android, as I said previously.

[norbert.kiszka]

I finally achieved what I wanted from the very beginning - to have the measurements occupy one line. I spent two days digging on the Internet, mastering the basics of element layout in Android applications, and in the end I understood enough to do it All that remains is to correct the drawing of the borders and background of these lines, but this is not difficult However, I had to slightly increase the width of the entire panel, but in my opinion this is not very critical.

Do You have instructions or ready file(s) to do the same by us?

[Aleksandr]

What program do you recommend to backup an oscilloscope system from an SD card?

[AndyBig]

AndyBig, are you talking about Lexar microSD (TransFlash) card? Do you remember what software utility you used to make an image of the original memory card? Anyway, can an image being made of bootable media with Linux-based OS (which Android is happen to be) be, like, "a bit-perfect copy" in all circumstances?
May this issue have something in common, something to do with "improperly unmounted volume with Linux file system" being back-up'ed to an image? Because I recently got similar warning message when was trying to make a back-up image of a bootable microSD from chinese portable video consoles (like Datafrog SF2000, Anbernic RG353V) via Norton Ghost utility.

In Linux, (almost) everything is a file, which You can read, write, etc. Right now Im writing on a laptop with Linux - both disk drives are files in /dev (/dev/sda and /dev/sdb) directory and having permission to read those files (usually only root id:0 and users in group disk) You can read every bit as it is. Same with SD cards and everything else (framebuffer for example). So You can make 1:1 copy. Im planning to do this (maybe today) and change SD card to decrease boot time and increase space for more files. Just copy this disk file into another file and back to another SD card.

Also Im planning to change this scope to run Linux instead of Android, as I said previously.

In this case, there are no readable files on the memory card. The file system is not recognized on it at all - both under Windows and Linux, as far as I understand from what I read on this forum. Therefore, copying data from this card is carried out by special programs that simply read all the bytes at a low level by sector.
If you are hoping to speed up loading by replacing the card with a faster one, this will not help. The read speed from the card is not a bottleneck for boot time, this has already been tested before, and I tested it too, installing a card with a stated read speed of up to 104 MB/sec

Do You have instructions or ready file(s) to do the same by us?

Everything here is actually quite simple. The .apk file is unpacked by the appktool utility, resulting in a directory with the complete contents of the application. This directory also contains the source codes of DALVIK in .smali files - a kind of assembler in the Java world. Changing the logic of the application is just possible by editing these sources. In addition, there are .xml files with descriptions of various properties, parameters, arrangement of elements in forms, etc. For example, in order to change the location and size of elements on the measurement panel, I just changed the layout description in one of the .xml files. But to change the process of drawing the border and background for these elements, I changed the source codes of the program in the .smali file.
To make it easier to navigate these Java assembler sources, you can decompile the .dex files obtained after the apktul into source codes in Java. They will not be able to compile back into the application, but they can better understand what is happening in .smali and what and how needs to be changed there to get the desired result.
After the changes have been made, the application is reassembled using the same appktool utility. After this, the resulting new application needs to be run through two more utilities - to align all internal resources of 4 bytes, and to sign the application. And you can install the resulting application on Android
I'll probably write more detailed instructions on all these steps later. In the meantime, I’m ready to answer questions if someone doesn’t succeed.

[norbert.kiszka]

What program do you recommend to backup an oscilloscope system from an SD card?

Personally Im using cp (copy) in the Linux terminal emulator. However most people recommend using dd instead of cp. Graphical software is doing the same job as cp, but BTW often its slower - especially when You have many small files.

Code: [Select]

cp /dev/sdb /home/userName/someFolderName/anyFileNameYouWant
ls to list files. dmesg | less to see log (something was connected and new disk file was created) and eventually some disk tools to make sure of what is what, like a (g)parted, fdisk, cfdisk, etc.

[AndyBig]

What program do you recommend to backup an oscilloscope system from an SD card?

For example - https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5074423/?topicseen#msg5074423

[norbert.kiszka]

In this case, there are no readable files on the memory card. The file system is not recognized on it at all - both under Windows and Linux, as far as I understand from what I read on this forum. Therefore, copying data from this card is carried out by special programs that simply read all the bytes at a low level by sector.

In Linux as I said before, You dont need to install and use "special programs", because of philosophy "everything is a file" - even I can manage fan speed in my laptop with reading and writing to a text file in a system directory - If I want, I can make simple script program to make anything with that. Same with block devices - accessible at low level just by reading/writing (or copying) file - contents are 1:1 of what is on the SD card. This is one of many reasons, why I dont have Windows.

The file system is not recognized on it at all

Maybe Im not a expert in file systems (BTW. best world expert in it, currently is in jail, because his wife is dead), but I have little bit of experience (mostly with *nix and fat) file systems and recovering files from damaged fs, so I will try to do a hex dump or some tools to see if there is a any fs hided deep inside - I expect some heder before. Eventually this is hardware encrypted - in that case it will be difficult to do anything.

If you are hoping to speed up loading by replacing the card with a faster one, this will not help. The read speed from the card is not a bottleneck for boot time, this has already been tested before, and I tested it too, installing a card with a stated read speed of up to 104 MB/sec

When I was copying (somewhere here I put a video if it) files to install a game on this scope, it was incredibly slow for some reason. I will check this later also.

[AndyBig]

so I will try to do a hex dump

Well, I’m not a Linux expert at all, and not even a user, so I won’t say with confidence, but it seems that this issue was discussed in this or in a neighboring topic and it was said that simple copying doesn’t work, you need to do a low-level dump. But I could be wrong

[norbert.kiszka]

so I will try to do a hex dump

Well, I’m not a Linux expert at all, and not even a user, so I won’t say with confidence, but it seems that this issue was discussed in this or in a neighboring topic and it was said that simple copying doesn’t work, you need to do a low-level dump. But I could be wrong

Please read my previous couple posts with proper understanding. Im not a Windows user. Not at all. You can make a binary copy of raw contents of any disk by just copying file from a system directory, because "everything is a file". Its no matter what is in it, You will make a (dump) copy 1:1 without any "fancy special programs". After that I can use any software capable to read file(s) - including hex/ascii view or file recovery software which is looking for any file system hided in a file. File being a raw copy of SD contents

One very simple command to copy raw binary data from a serial block device - including SD cards:

Code: [Select]

cp /dev/sdb /home/userHomeDirectory/rawBinaryImageOfFancySDcardFromScope.fancyLongFileExtension
To be less fancy, I can use any graphical file manager in Linux to make exactly same thing.

[AndyBig]

You can make a binary copy of raw contents of any disk by just copying file from a system directory, because "everything is a file". Its no matter what is in it, You will make a (dump) copy 1:1 without any "fancy special programs".

Thank you, now it becomes clearer to me. So I was wrong

[norbert.kiszka]

PS. Please be aware of possible many disk files. With additional number at the end, this is a raw contents of a partition/volume from same disk without number.

Once, I did a mistake and destroyed contents in a SD card with photos from a phone.