Hacking the Rigol DHO800/900 Scope

[sonic]

Can you please elaborate on how you built the driver for the target platform? What toolchain you used, etc.

I put down some notes at
https://sven.killig.de/android/DHO
Also some AOSP apks

[Aleksandr]

I certainly understand that this would be the most correct thing.... But unfortunately I do not have this adapter.  All I can do is indirectly confirm or refute the operation of the installed memory chips by looking at the presence of activity on the data exchange lines with another oscilloscope....And I will do this, as I wrote above.

Have you tried looking at oscilloscopes for DDR activity at the pins of empty spaces when initializing DDR calibration or when turning it on DHO?

[S2084]

that would definitely make sense.  Maybe I'll try it (but it's unlikely).  And I won’t poke at the empty points because there are pull-up resistors there, that’s where I’ll check the activity.

[calabr]

I certainly understand that this would be the most correct thing.... But unfortunately I do not have this adapter. 

  If you already made external connector for LA - you can just carefully use logic pins for testing.
  I own DHO924 and with LA -detect pins connected I see some random noise pickup on several channels, it's reacting to the fingers, touching the pin.
  Even with 1 pin connected from diff input it's show's some signals.
  It's also splitting resources to serve LA
  CH1               1.250GSa/s  50M
  LA                  625MSa/s  25M
  LA+CH1 -       625MSa/s 25M
  LA+CH1,CH2   312MSa/s 10M
  LA+4xCH        156MSa/s 1M

 Probable additional memory need for trigger function with LA, but I cannot check it.
 Don't think it's related to bus decode or bus trigger - at-least it's no any difference with selecting analog channel or LA as trigger or decode source

[calabr]

Hello!
  Want to ask peoples with Android skills - is it possible to hack screen resolution and DPI settings?
  For example set the screen size 1100x640 and center image, so useless gray frame will become out of screen?
  or set DPI screen information as for 10'' display on DHO1000 - it's very probable the screen layout is the same, but different DPI cause to select different fonts and window frames in order to get more readable interface, like 1-string results layout and less space for window captions.
  It's very annoying, but obviously RIGOL will not try to optimize it.

[sonic]

  or set DPI screen information as for 10'' display on DHO1000 - it's very probable the screen layout is the same, but different DPI cause to select different fonts and window frames in order to get more readable interface, like 1-string results layout and less space for window captions.

Code: [Select]

rk3399_rigol:/ # wm density
Physical density: 228
Override density: 114
doesn't seem to have any effect on the scope app.

[calabr]

Code: [Select]

rk3399_rigol:/ # wm density
Physical density: 228
Override density: 114
doesn't seem to have any effect on the scope app.

  after some playing with screen size and DPI -
setting density higher than 228 - results font become bigger, but not all strings where changed
setting screen size 1280x750 - scope app adopts online, but after reboot it's revert previous size, with virtual resolution 1280x750
  in any case results still 2 strings per value  , no any improvement in screen allocation
  I can set black unused frame  with wm overscan, but no way to crop image and hide outer frame. 

[flaotte]

hi,
I am a bit alien to the discussion, forgive it to me.
So I am newbie, looking to get my first scope. After considering/stretching budget few times, I settled down to 804 model. Possibility to hack it sounds like a good bonus.

• Is 804 an optimal choice here? (4 channels + unlockable frequency?)
  
• Does software hacking void warranty permanently, or is it possible to restore it if something breaks down the way and ship it for repairs?
  
• I must have missed this one - is it difficult soldering task to retrofit LA into 800?

[S2084]

I certainly understand that this would be the most correct thing.... But unfortunately I do not have this adapter. 

  If you already made external connector for LA - you can just carefully use logic pins for testing.
  I own DHO924 and with LA -detect pins connected I see some random noise pickup on several channels, it's reacting to the fingers, touching the pin.
  Even with 1 pin connected from diff input it's show's some signals.
  It's also splitting resources to serve LA
  CH1               1.250GSa/s  50M
  LA                  625MSa/s  25M
  LA+CH1 -       625MSa/s 25M
  LA+CH1,CH2   312MSa/s 10M
  LA+4xCH        156MSa/s 1M

 Probable additional memory need for trigger function with LA, but I cannot check it.
 Don't think it's related to bus decode or bus trigger - at-least it's no any difference with selecting analog channel or LA as trigger or decode source

Oooh this is very useful, please clarify is your model 924 with additional memory chips installed?  Or have you hacked vendor.bin?  Regarding the noise on LA channels, I also have it on some channels....

[Fungus]

Is 804 an optimal choice here? (4 channels + unlockable frequency?)

Yes. You can have everything from just the base model.

Does software hacking void warranty permanently, or is it possible to restore it if something breaks down the way and ship it for repairs?

It's easy to reverse and leave no trace.

I must have missed this one - is it difficult soldering task to retrofit LA into 800?

Probably more difficult to cut the hole in the case. Read the threads carefully before trying it though and you might not need it. Protocol decoding works fine with just the analog channels.

[ebastler]

I must have missed this one - is it difficult soldering task to retrofit LA into 800?

I have seen three users here who have soldered the probe connector onto the board, but none of them has also populated the extra RAM chip which the DHO900 has. (And which is much more difficult to obtain and to solder, since it comes in a BGA package.)

Unfortunately none of those three has a logic probe yet, so they have not tested the logic analyser in earnest. It is still unknown what the extra RAM is actually doing, and whether the logic analyser can be used (with limitations?) without it. 

[ebastler]

Does software hacking void warranty permanently, or is it possible to restore it if something breaks down the way and ship it for repairs?

It's easy to reverse and leave no trace.

As long as the scope is still functional enough to let you reconnect and remove the hack, of course.

But since you are based in Europe, I think it would be an uphill battle for Rigol to claim that the hack has voided your warranty. Depending on the specific national implementation of the rules and the time of failure, they might have to prove that the hack has actually caused the problem. (At least as far as the obligatory consumer warranty is concerned -- anything beyond that is at Rigol's discretion.)

[Fungus]

I got the online upgrade thing today:

[ebastler]

And are you going to take the plunge? Looks like your scope is still an 814, so you would need to switch to the vendor.bin upgrade instead?

[Fungus]

I said "yes" and I got firmware 01.02.00.00.

It says I still have my 100MHz upgrade (haven't tested it) but the 50M memory has vanished.

[Fungus]

So that's annoying...

I have to either go to DHO914 and put up with extra junk on screen and higher bandwidth than ideal, or stick with 1.01 and have a pesky red dot on the menu.

I wonder what URL I have to block to get rid of the red dot.

[shapirus]

So that's annoying...

I have to either go to DHO914 and put up with extra junk on screen and higher bandwidth than ideal, or stick with 1.01 and have a pesky red dot on the menu.

But the 914 is 100 MHz bandwidth, isn't it?
(correction: actually 125 -- but still ok with 1.25 Gsa/s?)
Extra junk on the screen yes, but it doesn't cover an otherwise used area, it will just appear where black background currently is, so while annoying, it's probably not so big deal.

[Fungus]

But the 914 is 100 MHz bandwidth, isn't it?

It says "125Mhz" on the sticker but it's 225MHz measured.

The "100MHz" DHO814 is 200Mhz measured, slightly better for the limited sampling rates when multiple channels are on.

I'm sure it won't make much difference in practice, but it's annoying.

[AndyBig]

I said "yes" and I got firmware 01.02.00.00.

It says I still have my 100MHz upgrade (haven't tested it) but the 50M memory has vanished.

Version 01.02.00.00 does not override the generated options, this happens since version 01.02.00.02. The 50M memory, as I remember, stops being displayed in the information, but in reality remains accessible.

[ebastler]

Version 01.02.00.00 does not override the generated options, this happens since version 01.02.00.02.

You mean version 00.01.02.00.00 vs. 00.01.02.00.02? 

Why, oh why, does Rigol need five double-digits to count versions? I don't think I have ever seen anything beyond "00" for the top-level number; and there is no rhyme or reason to how they use the other four. At least it seems that the DHO series displays the version numbers in the same way in its system info dialog as they are shown on the various websites. The DS1000Z shows "SP something" instead of the last (?) two digits, adding to the numbering confusion...

[AndyBig]

You mean version 00.01.02.00.00 vs. 00.01.02.00.02? 

Yes exactly. It’s easy to get confused in this mass of zeros, and I share your confusion about Rigol’s version numbering.

[Fungus]

Version 01.02.00.00 does not override the generated options, this happens since version 01.02.00.02.

Ah, OK... my RLU.lic file was messed up. I think I was trying to generate a key for version 01.02.00.02 using RKey.data

I copied a good RLU.lic to the 'scope and it's all working now. 

Now let me warm it up and do a self-cal.

[calabr]

Oooh this is very useful, please clarify is your model 924 with additional memory chips installed?  Or have you hacked vendor.bin?  Regarding the noise on LA channels, I also have it on some channels....

  It's true DHO924 without any mod. I didn't opened it, so cannot confirm memory installed.
  My DHO produce 150MHz noise on channel D0 and sometimes on D13. noise disappearing if cable connected to input (both + and-) even without any load - it's just not terminated digital input 

[calabr]

Just posted LA behavior in bug thread
https://www.eevblog.com/forum/testgear/rigol-dho800900-oscilloscope-bug-reports-firmware/msg5296438/#msg5296438
 Based on it - LA need 48MB of memory to store 25Mpts (16 bit per point) and transfer rate more than 1.25GB/s what is the size and speed of memory,
not soldered in DHO800 ? is it capable to handle this data?
  And the same calculation for main acquisition memory
  96MB and more than 2.5GB/s
 
single chip can handle lower transfer rate, but memory controller can access it in parallel with 2 or 4 channels.
 In theory, any DDR2 should deliver this speed, but oscilloscope require very stable access rate, so probable twice the maximum transfer rate required.

[0xACE]

For the software hackers in the thread. I installed a very simple Android/Kotlin program on the scope to capture the "key" events when twiddling all the knobs and dials. Attached is an image of the key codes each generates.

Useful if you want to write some side-loaded software that uses the scope's controls.

These were all captured and tested on a 924S even though the image shows an 814. Hopefully you can see where I added key codes for the missing buttons.

NOTE: Each of the key codes shown is added to 0x40000000, so the Run/Stop button produces key code 0x4000000C.