Hey Fumitti,
I also just bought a 1074 from Amazon, thanks to everyone for sharing information about this deal.
My unit has not yet arrived, I am curious to attempt the 1074 to 4204 4408 4804 mod (in addition to the license unlock mods on the standard 1074).
The unit has not arrived yet so I am still a little unsure about some things, but I am curious to better understand.
I am guessing the vendor.bin is in the partition accessible either via ADB or by the serial console header ?
Also does one need to modify values associated with E_CFG_MODEL_RAW and also E_CFG_SN_RAW (are both necessary?) as shown in
https://www.eevblog.com/forum/testgear/hacking-the-hdo1khdo4k-rigol-12-bit-scope/msg4501150/#msg4501150)
Also what about the CRC32? I don't think I saw anything here discussing how to compute a new CRC32 and no one has shared working values.
Lastly I saw you said in another comment that only channel one was working for you now, but you believed the UI was saying you had full 800mhz bandwidth.
In many other comments people were speculating that the ADC's were being time multiplexed to get the 4 Msps on a single channel, but your experience seems to indicate they may not be being time multiplexed, but split between channels. You even speculated that on the 1074, perhaps only channels 1 and 3 will work.
Am I correct to understand that you did not see any weird aliasing artifacts when running at 800Mhz, that might result from time multiplexing with a missing ADC if every other sample was incorrect?
This is good news I think, as perhaps it may mean that the front end is not strapped in hardware to multiplex the signal between the two ADC's, but rather the FPGA or MCU is telling the front end which ADC to send data too.
I doubt it would ever happen but it gives some hope towards a Frankenscope with 1 channel 800Mhz support on the 1074
It does make one wonder if on the 4804 they really do indeed have 4 Msps for a single channel or if that is just a marketing claim for when 2 channels are used each getting 2Msps.
If they aren't multiplexing the ADC's (which your success seems to indicate) I don't see how they could every actually get 4Msps on a single channel on the 4804.
I also bought it from that JP Amazon deal.
Key.data or similar data stored in fRAM is required to generate the optional installation code.
However, it is not required to change the model.
Looking into the software, it seems that if key.data or vendor.bin exists, it refers to it first, and if not, it reads the value from fRAM.
So, there should be no bricking if you make a mistake in rewriting these files.
The structure of vendor.bin and fRAM has been explained by a pioneer, so it is omitted.
We also have a nice set of tools.
This is the contents of a vendor.bin decrypted.
And the contents of the decompiled dts file.
Refreshing the FRAM dump...
Hi,
here is my tool to dump the FRAM ... it contains the system setup, the private mem file data (license stuff like install tries and the key data once more) and the binary device config.
I also made a license key generator to pretty much enable any option .... no idea if its ok to post that code here though ...
And here is my tool to decode key and vendor file.