Looked over the code Auklet.apk file - it looks like many features can be unlocked by patching it (would assume it is likely that checks are only in scope UI).
The apk can be decompiled/compiled back, after patching, using Apktool(
https://github.com/iBotPeaches/Apktool)
Also, to get it in a bit more readable format while figuring out what to patch - JADX(
https://github.com/skylot/jadx) can be useful, allowing decompiling most of the code to Java.
Found hidden "Test Mode" feature in Utility window: if to click "About" item 3 times - "Test Mode" will be activated, displaying some additional items and settings.
Found a bunch of checks for product series, disabling features(version 00.02.12):
50Ω input:
diff --git a/apps/Auklet/smali/com/rigol/scope/adapters/UtilityCalibrationAdapter.smali b/apps/Auklet/smali/com/rigol/scope/adapters/UtilityCalibrationAdapter.smali
index f882a229..8a755fec 100644
--- a/apps/Auklet/smali/com/rigol/scope/adapters/UtilityCalibrationAdapter.smali
+++ b/apps/Auklet/smali/com/rigol/scope/adapters/UtilityCalibrationAdapter.smali
@@ -300,7 +300,9 @@
const/16 v0, 0x9
- if-ne p0, v0, :cond_2
+ # if-ne p0, v0, :cond_2
+ # do not disable 50Ω in calibration menu
+ goto :cond_2
return v1
diff --git a/apps/Auklet/smali/com/rigol/scope/adapters/VerticalViewPagerAdapter.smali b/apps/Auklet/smali/com/rigol/scope/adapters/VerticalViewPagerAdapt
er.smali
index 4028b35a..dbd9f4d4 100644
--- a/apps/Auklet/smali/com/rigol/scope/adapters/VerticalViewPagerAdapter.smali
+++ b/apps/Auklet/smali/com/rigol/scope/adapters/VerticalViewPagerAdapter.smali
@@ -1212,7 +1212,8 @@
iget v0, v0, Lcom/rigol/scope/cil/ServiceEnum$ProductSeries;->value1:I
- if-eq p1, v0, :cond_21
+ # do not ignore click on 50Ω image view
+ # if-eq p1, v0, :cond_21
.line 385
iget-object p1, p0, Lcom/rigol/scope/adapters/VerticalViewPagerAdapter;->param:Lcom/rigol/scope/data/VerticalParam;
@@ -1292,7 +1293,8 @@
iget v0, v0, Lcom/rigol/scope/cil/ServiceEnum$ProductSeries;->value1:I
- if-eq p1, v0, :cond_21
+ # do not ignore click on 50Ω image view
+ # if-eq p1, v0, :cond_21
.line 397
iget-object p1, p0, Lcom/rigol/scope/adapters/VerticalViewPagerAdapter;->param:Lcom/rigol/scope/data/VerticalParam;
diff --git a/apps/Auklet/smali_classes2/com/rigol/scope/databinding/AdapterItemPopupviewVerticalBindingImpl.smali b/apps/Auklet/smali_classes2/com/rigol/scope/databinding/AdapterItemPopupviewVerticalBindingImpl.smali
index ca3529f8..96fd143f 100644
--- a/apps/Auklet/smali_classes2/com/rigol/scope/databinding/AdapterItemPopupviewVerticalBindingImpl.smali
+++ b/apps/Auklet/smali_classes2/com/rigol/scope/databinding/AdapterItemPopupviewVerticalBindingImpl.smali
@@ -2282,7 +2282,9 @@
iget v14, v14, Lcom/rigol/scope/cil/ServiceEnum$ProductSeries;->value1:I
- if-ne v13, v14, :cond_0
+ # do not hide impedance switch
+ # if-ne v13, v14, :cond_0
+ goto :cond_0
move v13, v11
SPI trigger on "When timeout" (weirdly, while it is disabled - the user guide for DHO1000 says it should be available, explaining how to use that)
diff --git a/apps/Auklet/smali_classes2/com/rigol/scope/databinding/AdapterTriggerSpiBindingImpl.smali b/apps/Auklet/smali_classes2/com/rigol/scope/databinding/AdapterTriggerSpiBindingImpl.smali
index 8e510be8..e87b0946 100644
--- a/apps/Auklet/smali_classes2/com/rigol/scope/databinding/AdapterTriggerSpiBindingImpl.smali
+++ b/apps/Auklet/smali_classes2/com/rigol/scope/databinding/AdapterTriggerSpiBindingImpl.smali
@@ -1945,7 +1945,8 @@
iget v15, v15, Lcom/rigol/scope/cil/ServiceEnum$ProductSeries;->value1:I
- if-eq v14, v15, :cond_0
+ # do not disable SPI trigger "when timeout"
+ # if-eq v14, v15, :cond_0
const/4 v14, 0x1
Power analysis (UPA item in navigation menus)
diff --git a/apps/Auklet/smali_classes2/com/rigol/scope/views/analyse/AnalysePopupView.smali b/apps/Auklet/smali_classes2/com/rigol/scope/views/analyse/AnalysePopupView.smali
index 5c09a3b2..a159d702 100644
--- a/apps/Auklet/smali_classes2/com/rigol/scope/views/analyse/AnalysePopupView.smali
+++ b/apps/Auklet/smali_classes2/com/rigol/scope/views/analyse/AnalysePopupView.smali
@@ -84,10 +84,12 @@
if-le v2, v3, :cond_0
.line 67
- invoke-interface {v1, v3}, Ljava/util/List;->remove(I)Ljava/lang/Object;
+ # do not remove UPA menu item
+ #invoke-interface {v1, v3}, Ljava/util/List;->remove(I)Ljava/lang/Object;
.line 68
- invoke-interface {v0, v3}, Ljava/util/List;->remove(I)Ljava/lang/Object;
+ # do not remove UPA menu item
+ #invoke-interface {v0, v3}, Ljava/util/List;->remove(I)Ljava/lang/Object;
.line 71
:cond_0
diff --git a/apps/Auklet/smali_classes2/com/rigol/scope/views/startMenu/StartMenuPopupView.smali b/apps/Auklet/smali_classes2/com/rigol/scope/views/startMenu/StartMenuPopupView.smali
index 767e1da2..09c09d2a 100644
--- a/apps/Auklet/smali_classes2/com/rigol/scope/views/startMenu/StartMenuPopupView.smali
+++ b/apps/Auklet/smali_classes2/com/rigol/scope/views/startMenu/StartMenuPopupView.smali
@@ -99,7 +99,8 @@
const/16 v2, 0x9
.line 83
- invoke-interface {v1, v2}, Ljava/util/List;->remove(I)Ljava/lang/Object;
+ # do not remove UPA menu item
+ # invoke-interface {v1, v2}, Ljava/util/List;->remove(I)Ljava/lang/Object;
.line 86
:cond_1
Also, there is similar logic around Memory depth in "com/rigol/scope/utilities/ViewUtil" -- might be possible to expand it up 500M:
if (UI_QueryInt322 == ServiceEnum.ProductSeries.SERIES_1000.value1) {
i3 = ServiceEnum.AcquireDepth.Acquire_Depth_100M.value1;
if (UI_QueryInt323 == ServiceEnum.SampleMode.DUAL_SAMPLE_MODE.value1) {
i3 = ServiceEnum.AcquireDepth.Acquire_Depth_50M.value1;
} else if (UI_QueryInt323 == ServiceEnum.SampleMode.QUAD_SAMPLE_MODE.value1) {
i3 = ServiceEnum.AcquireDepth.Acquire_Depth_25M.value1;
}
} else if (UI_QueryInt322 == ServiceEnum.ProductSeries.SERIES_2000.value1) {
i3 = ServiceEnum.AcquireDepth.Acquire_Depth_200M.value1;
if (UI_QueryInt323 == ServiceEnum.SampleMode.DUAL_SAMPLE_MODE.value1) {
i3 = ServiceEnum.AcquireDepth.Acquire_Depth_100M.value1;
} else if (UI_QueryInt323 == ServiceEnum.SampleMode.QUAD_SAMPLE_MODE.value1) {
i3 = ServiceEnum.AcquireDepth.Acquire_Depth_50M.value1;
}
} else if (UI_QueryInt322 == ServiceEnum.ProductSeries.SERIES_4000.value1) {
i3 = ServiceEnum.AcquireDepth.Acquire_Depth_500M.value1;
if (UI_QueryInt323 == ServiceEnum.SampleMode.DUAL_SAMPLE_MODE.value1) {
i3 = ServiceEnum.AcquireDepth.Acquire_Depth_250M.value1;
} else if (UI_QueryInt323 == ServiceEnum.SampleMode.QUAD_SAMPLE_MODE.value1) {
i3 = ServiceEnum.AcquireDepth.Acquire_Depth_125M.value1;
}
}
I was not patching this one (it might take some time to figure out all the parts in smali file) - but should be not hard as well.
---
However, I have not tested any of these, because of the mentioned signature checks…
Could someone help me find out how to safely replace the Auklet.apk with a patched version? It's simple to make an apk with the said hacks (and I have one already). But I'm not familiar with Android internals and can't get it to install and replace the original version (and also dare not bricking the scope as I don't know how to recover from it if somehow the adb connection can be lost).
My problem is when doing pm uninstall com.rigol.scope, either with or without --user 0, either with or without remounting /system as rw, I always get DELETE_FAILED_INTERNAL_ERROR, but somehow something got deleted. And then I get the signature conflict when pushing the patched apk as apparently the uninstall is not successful.
Not sure about a safe way to make that would work.
Btw the moment you log in as a root in adb - it is already pretty unsafe.
About options possible to try:
- apktool apparently also allows repackaging the app using a different package name - with some modifications to the app manifest XML (shared user, exposed services, etc), it might be possible to install the patched app separately -- this should be very safe, if that works
- disabling signature check - with the root that also should be possible, and there are tools for that, however, never used any of them
- in adb root shell it might be possible to remove the system scope application (the one that can not easily be uninstalled) -- but, I am not sure if this safe, likely not