I dunno if making it a HDO1404 is a good idea or not.
The ideal hack would be a HDO1404 which turns on the 200MHz bandwidth limit when you enable more than 2 channels. Not impossible to do, but patching the binary would be quite a feat...
I think it would be easier to patch it to a HDO4404. If it would work or not, that another question.
With the MSO5000 implementation, I would try. With the way this one was implemented, for now, I'm a bit doubtful but I think that (with a previous FRAM dump) one can always have a go.
The reference HDO1404 doesn't exist so that "model" would always be a nightmare to enforce.
US$900 saving.
Some of the current Siglent promo savings are 3x that.
Are you saying that they were very overpriced before the promo?
US$900 saving.
Some of the current Siglent promo savings are 3x that.
Are you saying that they were very overpriced before the promo?
What do you care? You're not buying any of it, Siglent, Rigol whatever..
Here is the lic gen ... just needs the key file from the device to work ....
The device id being field 0 is just a guess as the code ignores that field anyways ...
Worked like a charm and couldn't possibly be easier
Tools used:
- Android SDK Platform Tools
- Go compiler
Usage [Windows]:
./adb.exe connect [scope-ip]:55555
./adb pull /rigol/data/Key.data
go run .\rgtool.go
insert generated codes via SCPI interface on scope-website
Here is the lic gen ... just needs the key file from the device to work ....
The device id being field 0 is just a guess as the code ignores that field anyways ...
Worked like a charm and couldn't possibly be easier
Nice. A job well done by AlphaRne!
Now, time for you to post some reports/snapshots in the main thread.
Now, time for you to post some reports/snapshots in the main thread.
Absolutely, there much to less "real" informations in it but lots of posts...
Someone with adb access to the device: Could you maybe please post the output of
adb shell getprop
? (also possible as "getprop" from uart console)
Thanks!
Here you go:
./adb.exe shell getprop
[UserVolumeLabel]: [RockChips]
[camera2.portability.force_api]: [1]
[crashlogd.processing.ongoing]: [0]
[crashlogd.token]: [1]
[dalvik.vm.appimageformat]: [lz4]
[dalvik.vm.boot-dex2oat-threads]: [2]
[dalvik.vm.dex2oat-Xms]: [64m]
[dalvik.vm.dex2oat-Xmx]: [512m]
[dalvik.vm.dex2oat-threads]: [2]
[dalvik.vm.heapgrowthlimit]: [192m]
[dalvik.vm.heapmaxfree]: [8m]
[dalvik.vm.heapminfree]: [512k]
[dalvik.vm.heapsize]: [512m]
[dalvik.vm.heapstartsize]: [16m]
[dalvik.vm.heaptargetutilization]: [0.75]
[dalvik.vm.image-dex2oat-Xms]: [64m]
[dalvik.vm.image-dex2oat-Xmx]: [64m]
[dalvik.vm.image-dex2oat-threads]: [2]
[dalvik.vm.isa.arm.features]: [default]
[dalvik.vm.isa.arm.variant]: [cortex-a53.a57]
[dalvik.vm.isa.arm64.features]: [default]
[dalvik.vm.isa.arm64.variant]: [cortex-a53]
[dalvik.vm.lockprof.threshold]: [500]
[dalvik.vm.stack-trace-file]: [/data/anr/traces.txt]
[dalvik.vm.usejit]: [true]
[dalvik.vm.usejitprofiles]: [true]
[debug.atrace.tags.enableflags]: [0]
[debug.force_rtl]: [0]
[debug.nfc.fw_download]: [false]
[debug.nfc.se]: [false]
[dev.bootcomplete]: [1]
[init.svc.adbd]: [running]
[init.svc.akmd]: [stopped]
[init.svc.ap_log_srv]: [stopped]
[init.svc.ap_logfs]: [stopped]
[init.svc.apk_logfs]: [running]
[init.svc.audioserver]: [running]
[init.svc.bootanim]: [stopped]
[init.svc.console]: [running]
[init.svc.crashlogd]: [running]
[init.svc.daemonssh]: [running]
[init.svc.debuggerd]: [running]
[init.svc.debuggerd64]: [running]
[init.svc.drm]: [running]
[init.svc.drmservice]: [stopped]
[init.svc.earlylogs]: [stopped]
[init.svc.gatekeeperd]: [running]
[init.svc.healthd]: [running]
[init.svc.installd]: [running]
[init.svc.keystore]: [running]
[init.svc.lmkd]: [running]
[init.svc.log-watch]: [running]
[init.svc.logd]: [running]
[init.svc.logd-reinit]: [stopped]
[init.svc.media]: [running]
[init.svc.mediacodec]: [running]
[init.svc.mediadrm]: [running]
[init.svc.mediaextractor]: [running]
[init.svc.netd]: [running]
[init.svc.perfprofd]: [running]
[init.svc.ril-daemon]: [stopped]
[init.svc.servicemanager]: [running]
[init.svc.startApp]: [stopped]
[init.svc.su_daemon]: [running]
[init.svc.surfaceflinger]: [running]
[init.svc.ueventd]: [running]
[init.svc.up_eth0]: [stopped]
[init.svc.vold]: [running]
[init.svc.zygote]: [running]
[init.svc.zygote_secondary]: [running]
[keyguard.no_require_sim]: [true]
[log.tag.WifiHAL]: [D]
[logd.logpersistd.enable]: [true]
[media.audio.slice]: [0]
[net.bt.name]: [Android]
[net.change]: [net.dns3]
[net.dns1]: [217.29.144.65]
[net.dns2]: [217.29.144.66]
[net.dns3]: [8.8.8.8]
[net.hostname]: [android-ba3a0508030c74dd]
[net.qtaguid_enabled]: [1]
[net.tcp.default_init_rwnd]: [60]
[persist.core.enabled]: [0]
[persist.crashlogd.root]: [/data/logs]
[persist.demo.hdmirotates]: [true]
[persist.intel.logger.rot_cnt]: [20]
[persist.intel.logger.rot_size]: [5000]
[persist.internet.adb.enable]: [1]
[persist.net.ethernet.mode]: [normal]
[persist.service.apklogfs.enable]: [1]
[persist.service.aplogfs.enable]: [0]
[persist.sys.alarm.fixed]: [300000]
[persist.sys.alarm.strategy]: [fixed2]
[persist.sys.color.main]: [RGB-8bit]
[persist.sys.dalvik.vm.lib.2]: [libart.so]
[persist.sys.first_booting]: [false]
[persist.sys.framebuffer.main]: [800x1280@60]
[persist.sys.hid]: []
[persist.sys.profiler_ms]: [0]
[persist.sys.root_access]: [1]
[persist.sys.rotation.efull]: [true]
[persist.sys.strictmode.visual]: [false]
[persist.sys.timezone]: [Asia/Shanghai]
[persist.sys.ui.hw]: [true]
[persist.sys.usb.config]: [mtp,adb]
[persist.sys.usbcamera.status]: []
[persist.sys.webview.vmsize]: [118564800]
[persist.tegra.nvmmlite]: [1]
[pm.dexopt.ab-ota]: [speed-profile]
[pm.dexopt.bg-dexopt]: [speed-profile]
[pm.dexopt.boot]: [verify-profile]
[pm.dexopt.core-app]: [speed]
[pm.dexopt.first-boot]: [interpret-only]
[pm.dexopt.forced-dexopt]: [speed]
[pm.dexopt.install]: [interpret-only]
[pm.dexopt.nsys-library]: [speed]
[pm.dexopt.shared-apk]: [speed]
[ril.function.dataonly]: [1]
[rild.libargs]: [-d /dev/ttyACM0]
[rild.libpath]: [/system/lib/libril-rk29-dataonly.so]
[ro.adb.secure]: [0]
[ro.allow.mock.location]: [0]
[ro.audio.monitorOrientation]: [true]
[ro.baseband]: [N/A]
[ro.board.platform]: [rk3399]
[ro.boot.baseband]: [N/A]
[ro.boot.console]: [ttyFIQ0]
[ro.boot.hardware]: [rk30board]
[ro.boot.mode]: [emmc]
[ro.boot.noril]: [true]
[ro.boot.oem_unlocked]: [0]
[ro.boot.selinux]: [disabled]
[ro.bootimage.build.date]: [Thu Sep 15 11:36:26 CST 2022]
[ro.bootimage.build.date.utc]: [1663212986]
[ro.bootimage.build.fingerprint]: [Android/rk3399_rigol/rk3399_rigol:7.1.2/NHG47K/adil09151136:userdebug/dev-keys]
[ro.bootloader]: [unknown]
[ro.bootmode]: [emmc]
[ro.bt.bdaddr_path]: [/data/misc/bluetooth/bdaddr]
[ro.build.characteristics]: [tablet]
[ro.build.date]: [Thu Sep 15 11:36:26 CST 2022]
[ro.build.date.utc]: [1663212986]
[ro.build.description]: [rk3399_rigol-userdebug 7.1.2 NHG47K eng.adil.20220915.113626 dev-keys]
[ro.build.display.id]: [rk3399_rigol-userdebug 7.1.2 NHG47K eng.adil.20220915.113626 dev-keys]
[ro.build.fingerprint]: [Android/rk3399_rigol/rk3399_rigol:7.1.2/NHG47K/adil09151136:userdebug/dev-keys]
[ro.build.flavor]: [rk3399_rigol-userdebug]
[ro.build.host]: [ubuntu]
[ro.build.id]: [NHG47K]
[ro.build.product]: [rk3399_rigol]
[ro.build.tags]: [dev-keys]
[ro.build.type]: [userdebug]
[ro.build.user]: [adil]
[ro.build.version.all_codenames]: [REL]
[ro.build.version.base_os]: []
[ro.build.version.codename]: [REL]
[ro.build.version.incremental]: [eng.adil.20220915.113626]
[ro.build.version.preview_sdk]: [0]
[ro.build.version.release]: [7.1.2]
[ro.build.version.sdk]: [25]
[ro.build.version.security_patch]: [2019-10-05]
[ro.carrier]: [unknown]
[ro.com.android.dataroaming]: [true]
[ro.config.alarm_alert]: [Alarm_Classic.ogg]
[ro.config.enable.remotecontrol]: [false]
[ro.config.notification_sound]: [pixiedust.ogg]
[ro.config.ringtone]: [Ring_Synth_04.ogg]
[ro.crypto.state]: [unencrypted]
[ro.dalvik.vm.native.bridge]: [0]
[ro.debuggable]: [1]
[ro.default.size]: [100]
[ro.device_owner]: [false]
[ro.enable_boot_charger_mode]: [0]
[ro.expect.recovery_id]: [0x1b8eb1375e718d1014b8074ecfc236b4a2b8f949000000000000000000000000]
[ro.factory.hasGPS]: [false]
[ro.factory.hasUMS]: [false]
[ro.factory.storage_suppntfs]: [true]
[ro.factory.tool]: [0]
[ro.factory.without_battery]: [false]
[ro.hardware]: [rk30board]
[ro.hwui.disable_scissor_opt]: [true]
[ro.hwui.drop_shadow_cache_size]: [6]
[ro.hwui.gradient_cache_size]: [1]
[ro.hwui.layer_cache_size]: [48]
[ro.hwui.path_cache_size]: [32]
[ro.hwui.r_buffer_cache_size]: [8]
[ro.hwui.text_large_cache_height]: [1024]
[ro.hwui.text_large_cache_width]: [2048]
[ro.hwui.text_small_cache_height]: [1024]
[ro.hwui.text_small_cache_width]: [1024]
[ro.hwui.texture_cache_flushrate]: [0.4]
[ro.hwui.texture_cache_size]: [72]
[ro.intel.logger]: [/system/vendor/bin/logcatext]
[ro.opengles.version]: [196610]
[ro.product.board]: [rk30sdk]
[ro.product.brand]: [Android]
[ro.product.cpu.abi]: [arm64-v8a]
[ro.product.cpu.abilist]: [arm64-v8a,armeabi-v7a,armeabi]
[ro.product.cpu.abilist32]: [armeabi-v7a,armeabi]
[ro.product.cpu.abilist64]: [arm64-v8a]
[ro.product.device]: [rk3399_rigol]
[ro.product.first_api_level]: [25]
[ro.product.locale]: [en-US]
[ro.product.manufacturer]: [Rigol ([url=http://www.rigol.com]www.rigol.com[/url])]
[ro.product.model]: [rk3399_rigol]
[ro.product.name]: [rk3399_rigol]
[ro.product.usbfactory]: [rockchip_usb]
[ro.radio.noril]: [true]
[ro.revision]: [0]
[ro.rigol.ota.build]: [0]
[ro.rigol.system.version]: [1.1.7]
[ro.ril.ecclist]: [112,911]
[ro.rk.LowBatteryBrightness]: [true]
[ro.rk.MassStorage]: [false]
[ro.rk.bt_enable]: [true]
[ro.rk.def_brightness]: [200]
[ro.rk.flash_enable]: [true]
[ro.rk.hdmi_enable]: [true]
[ro.rk.homepage_base]: [http://www.google.com/webhp?client={CID}&source=android-home]
[ro.rk.install_non_market_apps]: [false]
[ro.rk.screenoff_time]: [60000]
[ro.rk.screenshot_enable]: [true]
[ro.rk.soc]: [rk3399]
[ro.rk.systembar.tabletUI]: [false]
[ro.rk.systembar.voiceicon]: [true]
[ro.rksdk.version]: [RK30_ANDROID7.1.2-SDK-v1.00.00]
[ro.runtime.firstboot]: [1667837160702]
[ro.safemode.disabled]: [true]
[ro.secure]: [1]
[ro.serialno]: [X3EMYFG3NC]
[ro.service.default_logfs]: [apklogfs]
[ro.sf.fakerotation]: [false]
[ro.sf.hwrotation]: [270]
[ro.sf.lcd_density]: [228]
[ro.support.lossless.bitstream]: [true]
[ro.target.product]: [tablet]
[ro.tether.denied]: [false]
[ro.udisk.visible]: [true]
[ro.wifi.channels]: []
[ro.zygote]: [zygote64_32]
[security.perf_harden]: [1]
[selinux.reload_policy]: [1]
[service.adb.tcp.port]: [55555]
[service.bootanim.exit]: [1]
[sf.power.control]: [8847360]
[sys.boot_completed]: [1]
[sys.bootvideo.closed]: [1]
[sys.device_locked.status]: [0]
[sys.dropbox.max_size_kb]: [4096]
[sys.dump.binder_stats.anr]: [1]
[sys.dump.binder_stats.uiwdt]: [1]
[sys.ggralloc.commit]: [commit-id:1c1bd71]
[sys.ggralloc.version]: [1.0.6]
[sys.ghwc.commit]: [commit-id:3212866]
[sys.ghwc.version]: [0.66-rk3399-MID]
[sys.gmali.fbdc_target]: [0]
[sys.gmali.version]: [r18p0-01rel0-x-6@0]
[sys.gralloc.disable_afbc]: [1]
[sys.hwc.compose_policy]: [6]
[sys.hwc.device.aux]: []
[sys.hwc.device.main]: [DSI]
[sys.hwc.device.primary]: [DSI]
[sys.logbootcomplete]: [1]
[sys.resolution.changed]: [false]
[sys.rga.version]: [v1.0-20180420]
[sys.rkadb.root]: [0]
[sys.secureboot]: [false]
[sys.serialno]: [X3EMYFG3NC]
[sys.status.hidebar_enable]: [false]
[sys.sysctl.extra_free_kbytes]: [12000]
[sys.sysctl.tcp_def_init_rwnd]: [60]
[sys.usb.config]: [mtp,adb]
[sys.usb.configfs]: [1]
[sys.usb.controller]: [fe800000.dwc3]
[sys.wallpaper.rgb565]: [0]
[testing.mediascanner.skiplist]: [/mnt/shell/emulated/Android/]
[vold.has_adoptable]: [1]
[vold.post_fs_data_done]: [1]
[wifi.interface]: [wlan0]
[wifi.supplicant_scan_interval]: [15]
[wlan.driver.status]: [unloaded]
Thanks for providing the properties.
Shipping an Android product with userdebug SW clearly indicates that Security was not in focus. And indeed getting an Android user build running and shippable is much more work than just userdebug.
Yeah the closest ADC I found in 88 pad package is AD9691, but it's a 14bit one and wrong pinout. And costs more than the HDO1000 scope.
No off the shelf part will work here.
US$900 saving.
Some of the current Siglent promo savings are 3x that.
Are you saying that they were very overpriced before the promo?
What do you care? You're not buying any of it, Siglent, Rigol whatever..
Regardless, its quite irritating to have a salesman pop into various test equipment threads just to shill the brand. Most of his posts are great, the ones here are not.
"Hey guys, if you bought the current 1THz XXE+ $4999 promo thats like a $3000 savings! you'd be stupid NOT to buy".
Yeah the closest ADC I found in 88 pad package is AD9691, but it's a 14bit one and wrong pinout. And costs more than the HDO1000 scope.
No off the shelf part will work here.
US$900 saving.
Some of the current Siglent promo savings are 3x that.
Are you saying that they were very overpriced before the promo?
What do you care? You're not buying any of it, Siglent, Rigol whatever..
Regardless, its quite irritating to have a salesman pop into various test equipment threads just to shill the brand. Most of his posts are great, the ones here are not.
"Hey guys, if you bought the current 1THz XXE+ $4999 promo thats like a $3000 savings! you'd be stupid NOT to buy".
I agree Rob is sometimes enthusiastic. But instead of "please not here man" and off he stops, few members just like to convert it into saga. We all should avoid "off topic" except minor digressions that organically grow from discussion. And then go back to core theme.
Which is that Rigol obviously rushed this to market, software is unstable at the moment, a person here "dismantled" it very quickly, our poor tv84 didn't even have a chance to give it a try... And he says security is nonexistent in software, and that software looks amateurish...
I refuse to believe Rigol cannot hire good programers, so it was a rush job to meet timetables.
Now we wait for the fixes. If MSO5000 is a marker it's going to be long journey.
If MSO5000 is a marker it's going to be long journey.
With no ending...
Let´s hope for the rigol owners, this time they make it different.
Yeah the closest ADC I found in 88 pad package is AD9691, but it's a 14bit one and wrong pinout. And costs more than the HDO1000 scope.
No off the shelf part will work here.
US$900 saving.
Some of the current Siglent promo savings are 3x that.
Are you saying that they were very overpriced before the promo?
What do you care? You're not buying any of it, Siglent, Rigol whatever..
Regardless, its quite irritating to have a salesman pop into various test equipment threads just to shill the brand. Most of his posts are great, the ones here are not.
Ya think.
Dave makes a statement about a $ 900 saving with hacking, big fucking deal when you can get equipment nearly fully
officially optioned with savings far exceeding $ 900 and yes, for same class of instrument that this thread is about.
He could of instead said what I pointed out to him that savings are better with promotions from other brands but instead you point the bone at me for informing Dave of this fact.
silly question- do 2 channel scopes (HDO1072) come with all four channels in hw and can that be "unlocked"?
Maybe, if you want to cut out some spaces for additional knobs and bnc...
silly question- do 2 channel scopes (HDO1072) come with all four channels in hw and can that be "unlocked"?
Just go to Rigol.com and take a look.
They are missing BNCs..
Actually there are two types of enhancements avaible for the HDO1000.
Memory and bandwith, that´s all.
Does the HDO1000 have 500M memory on the PCB?
In my units, yes, you can see it in the teardown, chip number and qty is the same on both.
Here is the lic gen ... just needs the key file from the device to work ....
The device id being field 0 is just a guess as the code ignores that field anyways ...
Worked like a charm and couldn't possibly be easier
Tools used:
- Android SDK Platform Tools
- Go compiler
Usage [Windows]:
./adb.exe connect [scope-ip]:55555
./adb pull /rigol/data/Key.data
go run .\rgtool.go
insert generated codes via SCPI interface on scope-website
Woah, Power Analysis?
I don't see this option even available for sale, nor it on my HDO1000, it only shows 4 options.
Does this feature, and the others, actually work?
EDIT: Oops, you have the HDO4000.
Ya think.
Dave makes a statement about a $ 900 saving with hacking, big fucking deal when you can get equipment nearly fully officially optioned with savings far exceeding $ 900 and yes, for same class of instrument that this thread is about.
He could of instead said what I pointed out to him that savings are better with promotions from other brands but instead you point the bone at me for informing Dave of this fact.
Tautech, please bugger off from this thread, it's about hacking the Rigol scope.
Dave any chance for a HDO1072 teardown video?
Thanks for providing the properties.
Shipping an Android product with userdebug SW clearly indicates that Security was not in focus. And indeed getting an Android user build running and shippable is much more work than just userdebug.
I had to do a bit of work to make a userbuild for LineageOS for my OnePlus. Private key + AVB + full encryption, rollback protection etc. They would for sure have more work on their hands, keys management, updates management. I am curious of their update procedure.
I think the open Android system is also a plus in this case, might come useful in certain situations.
Dave any chance for a HDO1072 teardown video?
Also showing the backside of the PCB (front side of the panel). A bit more work but would show more possibly useful stuff for the 2ch version.
Although the frontends for the two missing channels are surely not populated. Since they use their custom chips in there as well then HDO1074 is the choice for 4ch. The difference seems to be about 300€ between 1072 and 1074.
I think it would be easier to patch it to a HDO4404. If it would work or not, that another question.
If you get two HDO1072 for 1400€ total AND patching to HDO4404 software config is possible then you'd have the hardware to build a HDO4404 (400MHz 4GSa/s) scope that's worth 3700€? Well apart for the active probe circuitry and the butt clenching soldering work.
I think it would be easier to patch it to a HDO4404. If it would work or not, that another question.
If you get two HDO1072 for 1400€ total AND patching to HDO4404 software config is possible then you'd have the hardware to build a HDO4404 (400MHz 4GSa/s) scope that's worth 3700€? Well apart for the active probe circuitry and the butt clenching soldering work.
Just to repeat what I said before: apart from the bragging rights, what do you think what are real benefits of HDO4000 over HDO1000 to hobby user?
Saying you get something worth 3700 USD is misleading, if you can't sell it for that. That means you do it because that "upgrade", despite already high cost (in EU 2000€ for those two. you have to get one 4 ch to have actual inputs) means either bragging right ("big hacker") or gives you proportional gain in significantly better scope abilities.
Since all software features could be unlocked regardless 1 ADC and smaller sample rate, only advantage of real HDO4000 is larger BW and active probe interface. With "Frankenstein" version only larger BW..
If you can write off the tax and get it at a sale, and two at once, might be even around 1000€ for both. You get all the parts to populate all 4 channels. Even the necessary extra buttons, tho marked differently. The front panel might already have the cutouts but have different sticker on front, so maybe only needed to cut that. You get the extra two full frontends including the connectors and extra ADC. 12bit 400MHz and 2GSa/s is pretty nice especially if you get them cheaper.
You're still left with a spare FPGA which is worth around 150$ presuming you have the gear to safely recover it. Plus a spare power supply and various parts like regulator chips. The display could also be sold/kept as spare. Sure this wouldn't be for your average hobbyist adventurist. But at least interesting as an option.
Also since the HDO4204 that Dave made a teardown off is software upgradeable to 800MHz, and the frontend chips are the same on the HDO1000 series then theoretically (if software allows) you could build a 12bit 800MHz 2GSa/s scope. But without the active probe stuff.
edit: sure it wouldn't be worth 4700€ as a new HDO4804 costs but still...pretty good bang for the buck, besides the work you put into it.