Rigol's New DHO800 Oscilloscope unbox & teardown

[iMo]

You may print out the entire back of the enclosure new, optimized for 120mm fan and for improved air flow, with new vesa mount, etc.
For sensitive measurements in your lab you may use a linear psu, for example.
But there are switchers on the motherboard as well, afaik, how they affect the noise floor is a question too..

[Nikki Smith]

For use with the DHO900 (and hopefully the DHO800 after a few mods?) I've created a new v3.1 of the 16-channel LA clone board that is cheaper to make and easier to hand-solder:
https://climbers.net/sbc/clone-pla2216-logic-probe-analyzer/

Would there be any interest in a version that also clones the RPL1116 LA for DS1000Z Plus scopes? I think it is just the case of adding a 68-pin socket next to the 50-pin, so the same PCB could support either/both. I'd appreciate help in identifying the exact socket and cable.

Thanks

[Fungus]

FFT update speed is faster than MSO5K

FFT looks semi-decent, especially with multi-windowing.

[Fungus]

Aliexpress is out of stock of dho814. Where i can get now? Cant wait to experience 12bit..

We're all waiting in line. Go to the back of the queue. 

[Nikki Smith]

Aliexpress is out of stock of dho814. Where i can get now? Cant wait to experience 12bit..

We're all waiting in line. Go to the back of the queue. 

My 804 shipped on Monday  bit nervous about how much I'll get stung for once it hits UK customs.

[RAPo]

Not for me, but I can see the merits.
If I can bring in wishes, I would love a cheap replacement for the HO3508 probe.

Would there be any interest in a version that also clones the RPL1116 LA for DS1000Z Plus scopes? I think it is just the case of adding a 68-pin socket next to the 50-pin, so the same PCB could support either/both. I'd appreciate help in identifying the exact socket and cable.
Thanks

[Fungus]

My 804 shipped on Monday  bit nervous about how much I'll get stung for once it hits UK customs.

From China? Be sure to let us know how much... 

Do they charge sales tax in advance for UK?

Or does the UK have similar rules to Europe where anything over 150 Euros is dealt with by customs in the destination country.

[Fungus]

One question about the fan...

Does it blow air out the back or does it suck air in and blow it across the heat sink, guided by the fins?

[tv84]

One question about the fan...

Does it blow air out the back or does it suck air in and blow it across the heat sink, guided by the fins?

  Can't be blowing air out!

[Nikki Smith]

I  teardown DHO914S The point is on the AFG module, if it is possible to copy it and install it to DHO900 or DHO800?
AFG core chip is AD9744.

I'm probably a bit mad to attempt this, but I've started trying to reverse engineer the AFG module in KiCad (!) Just the component placements on the front+back sides of the PCB so far, schematic with resistor values (no routing) and a spreadsheet of the components I've identified, or my best guesses given the markings.

I've uploaded all my files to the new Hacking the Rigol DHO800/900 Scope thread:
https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5074783/#msg5074783

[asmi]

I'm probably a bit mad to attempt this, but I've started trying to reverse engineer the AFG module (!) Just the component placements on the front side of the PCB so far (no schematic or routing) and I've attached a spreadsheet of the components I've identified, or my best guesses given the markings.

Rectangular QFN with MPPX marking is a power module (DC-DC converter with integrated inductor) by MPS, this one: https://www.monolithicpower.com/en/mpm3630.html I've recently been working with a similar module, so I recognized the part immediately.

[Fungus]

One question about the fan...

Does it blow air out the back or does it suck air in and blow it across the heat sink, guided by the fins?

  Can't be blowing air out!

That's what I thought - it looks like there's a big gap between the fan and the back of the case which make no sense if it's blowing.

I just wanted somebody to confirm it one way or the other.

[Bicurico]

Out of curiosity I looked at the firmware update.

It is a *.GEL file that you can open with 7ZIP without problem.

The file within can then be extracted again with 7ZIP and you get the folder structure of the whole update file.

The update routine includes this folder with the update scripts:

Code: [Select]

Directory of DHO800_DHO900(Software)Update\Root\shell

13/09/2023  17:44    <DIR>          .
13/09/2023  17:08    <DIR>          ..
29/03/2023  09:37               512 bootApp.sh
29/03/2023  09:37               659 copy_logs_to_udisk.sh
20/06/2023  12:47             8,079 do_extract.sh
08/06/2023  03:46             1,798 do_update.sh
29/03/2023  09:37               645 force_update_gel.sh
29/03/2023  09:37             1,027 load_pcie.sh
20/06/2023  12:47             1,427 reload_fpga.sh
05/07/2023  08:16                97 restartScope.sh
20/06/2023  12:47             5,362 start_rigol_app.sh
              9 File(s)         19,606 bytes

The main app is the Sparow.apk. Looking at it with a HEX-Editor, I found this:

License file detected
License invalid. Remaining attempts: 1
License invalid. Remaining attempts: 2
License invalid. Remaining attempts: 3
License invalid. Remaining attempts: 4
License invalid. Remaining attempts: 5
License invalid. Remaining attempts: 6
License invalid. Remaining attempts: 7
License invalid. Remaining attempts: 8
License invalid. Remaining attempts: 9
...
This function requires the following license:
...

Also, it seems that the licenses are stored in "LICENSE.txt".

It should be possible to edit "copy_logs_to_udisk.sh":

Code: [Select]

#!/system/bin/bash

echo "...... ifconfig ......"
ifconfig

udisk_mount_dir=$(ls -d1 /mnt/media_rw/* 2> /dev/null | head -n 1)

if [[ x"${udisk_mount_dir}" == x"" || ! -d ${udisk_mount_dir} ]]; then
    echo "Does not exist U-Disk !"
    exit 2
fi

target_log_dir=${udisk_mount_dir}/$(date "+%Y.%m.%d_%H.%M.%S")

# target_log_dir=/data/UserData/logs_for_debug/$(date "+%Y.%m.%d_%H.%M.%S")

echo mkdir -p ${target_log_dir}
mkdir -p ${target_log_dir}

echo cp -r /data/logs/tools_log  ${target_log_dir}
cp -r /data/logs/tools_log  ${target_log_dir}

# chown -R system:system /data/UserData/logs_for_debug

rm -f ${udisk_mount_dir}/fetch_sparrow_logs.txt

sync

In order to add a line like

Code: [Select]

cp -r /data  ${target_log_dir}
The goal is to copy the whole data folder (and its sub-folders) to the attached USB disk. This might be the wrong folder, but with a bit of trial & error one should be able to get to see the LICENSE.txt file. I wonder if the options are in plain text...

Disclaimer: I don't own this device and I am not looking forward to buy one (I have the DS1054Z which is more than I will ever need). These are just my thoughts and ideas, they might break you brand new device.

[Fungus]

Also, it seems that the licenses are stored in "LICENSE.txt".

That's probably the "free" options, if your scope came with any.

I don't think there are any options for the DHO800 but the firmware is for all models and (eg.) the DHO4000 can have extra memory, power analysis and serial decoders. If the serial decoders are free then they'll put a license.txt on the SD card to enable them.

[Fungus]

I'll be happy if my DHO804 can be made into a DHO814 with 50MPts of memory.

I'm not sure I'd want to enable 250Mhz bandwidth with this sample rate.

(Not unless the scope can drop the sample rate if more than 2 channels are enabled. THAT would be a very sensible thing to do, and it should be perfectly possible. There's no mention of it in the manual though.)

[bushjavier]

I am a Java/Kotlin software developer and like some of the folks here my hobby is electronics, mainly microcontrollers stuff (pic18,pic24,pic32) and PCBs, also opened firmware update file and successfully decompiled the APKs, I have some experience with Android development so with that code and some effort you can compile your own modified APK and run it on the scope, I think everything is open in the scope to do that. Looking quickly at the code I think Sparrow.apk is all the GUI stuff, that should be communicating with the FPGA, is interesting to analyze the code because we can reverse engineer the communication between APK and FPGA so we can run custom apps on the scope.

In the screenshots, you can see some code to render the data on the screen, another thing to notice is that Rigol did not bother to obfuscate the code. 

[ataradov]

another thing to notice is that Rigol did not bother to obfuscate the code. 

There is no reason for them to obfuscate the code. You can have it, there is nothing useful you can do with it. In fact, it is in their best interest to have this code out there available for hacking. If someone comes up with better software that makes their hardware more popular, they only benefit from that.

Having custom ASICs gives you a lot of freedom to not care about copy protection.

[Warhawk]

I am not able to follow all the posts. Has it been already confirmed, that DHO800 offers only 1MPts with 4 channels and this is solely software crippling?

[nimish]

They can pretty trivially stop firmware flashing hacks dead with some mild implementation of HW enforced auth and such via a TPM equivalent. I'm pretty sure a Nintendo DS had more in depth hardware protection than an oscilloscope. It's just not worth the time to do.

[gslick]

I am not able to follow all the posts. Has it been already confirmed, that DHO800 offers only 1MPts with 4 channels and this is solely software crippling?

Scroll back to reply #305 in this thread:
https://www.eevblog.com/forum/testgear/rigols-new-dho800-oscilloscope-unbox-teardown/msg5046208/#msg5046208

But as I said before, we need someone to confirm only 1MPts in all channel mode. That first.

I just tested it. 4CH or 3CH mode is only 1M maximum. 2CH is 10M maximum. 1CH is 25M.

[mwb1100]

I am not able to follow all the posts. Has it been already confirmed, that DHO800 offers only 1MPts with 4 channels and this is solely software crippling?

Confirmed here: https://www.eevblog.com/forum/testgear/rigols-new-dho800-oscilloscope-unbox-teardown/msg5046208/?topicseen#msg5046208

[dmulligan]

The DHO800 and DHO900 are built on the same basic platform as the HDO1000 right?  This would mean that Rigol can use the same code base for all scopes on this new platform.  A common code base should mean fewer bugs for new products.  I am looking forward to seeing if this is the case.

[faveri97]

Found a hidden debug mode in the utility menu that can be enabled if you tap the About button several times. This unlocks more options in the Other and the SelfCal tabs and a new Debug tab. Not sure if it has other effects.

[Fungus]

I am not able to follow all the posts. Has it been already confirmed, that DHO800 offers only 1MPts with 4 channels and this is solely software crippling?

Yes.

But... there's no reason it can't be hacked to 5MPts/channel like the DHO900. The RAM inside is the same and people have loaded the HDO900 firmware on a DHO800 and enabled 50MPts memory.

I'm sure a hack will appear a few days after these start to be delivered at the end of the month.

[Fungus]

Found a hidden debug mode in the utility menu that can be enabled if you tap the About button several times. This unlocks more options in the Other and the SelfCal tabs and a new Debug tab. Not sure if it has other effects.

It might enable ADB control over USB - no need to open it up and use serial comms to hack it!