Hacking the Rigol DHO800/900 Scope

[cbcb4cb@163.com]

I am also lucky, after upgrading to 01.02, the unlock tool will not work, can you help me?

[tv84]

I don't think I have ever seen anything beyond "00" for the top-level number;

One of the uses of that top-level is to distinguish between production and beta versions. 04 means Beta.

[Aleksandr]

Oooh this is very useful, please clarify is your model 924 with additional memory chips installed?  Or have you hacked vendor.bin?  Regarding the noise on LA channels, I also have it on some channels....

  It's true DHO924 without any mod. I didn't opened it, so cannot confirm memory installed.
  My DHO produce 150MHz noise on channel D0 and sometimes on D13. noise disappearing if cable connected to input (both + and-) even without any load - it's just not terminated digital input

You can look through the vents on the handle side. If there are seats on the board, then there are no microcircuits.

[axantas]

My brand new 914 just arrived here - that spot below the handle looks like that.


Not, that I would desperatly need it, but I was too curious.

Just discovered that nasty warranty-sticker Rigol places at the bottom of the scope. Probably need a hairdriyer for this...

[Aleksandr]

All 900 Series oscilloscopes have fully installed FPGA RAM.

[Fungus]

All 900 Series oscilloscopes have fully installed FPGA RAM.

But what's it used for?

Nobody knows...

[ebastler]

All 900 Series oscilloscopes have fully installed FPGA RAM.

But what's it used for?

Nobody knows...

Maybe that memory was originally meant to be dedicated to the digital channels' data, working in parallel with the standard RAM for the analog channels? I.e. the idea was to have twice the memory bandwidth in the DHO900 series vs. the 800 models, to support the additional digital channels without sacrificing analog sampling rate? And for whatever reason that did not work out and Rigol had to fall back, last minute, onto a solution with shared memory and compromised sampling rates?

That's speculation, of course. But it would be an explanation for the awkward sampling rate compromise, and also for the fact that Rigol forgot to mention it in the datasheet.

If it should be true, a hacked DHO800 might work as an MSO just as well (or not so well) as the DHO900. And on the other hand, maybe Rigol are still hoping to improve the DHO900 sampling rates, by tweaking the FPGA code and enabling that extra RAM? Or to come out with an upgraded "DHO900 deluxe" in the future?

[axantas]

Or come out with an upgraded "DHO900 deluxe" in the future?

DHO 900 Pro Max with Titanium enclosure 

[Randy222]

Or come out with an upgraded "DHO900 deluxe" in the future?

DHO 900 Pro Max with Titanium Magnesium enclosure 

[AndyBig]

Fashionable "aviation aluminum". Well, or at least carbon ))

[Randy222]

Fashionable "aviation aluminum". Well, or at least carbon ))

Has to be called "aerospace" or "NASA grade" aluminum, you know, the special stuff. 

Wouldn't good 'ol ABS case do the job though, bringing down physical costs, and the savings can be put back into better coders?

[S2084]

Я предполагаю что все намного прозаичнее, и они просто начнут продавать дополнительную глубину памяти в виде лицензионных ключей, ведь для моделей 900 и 924 пока не предлагалось лицензии на увеличение глубины памяти.... Они же так делают уже много лет...... И не только Rigol......

[Aleksandr]

Another option is that the points of a complex signal when generated by the generator are stored in an additional memory area. Draw function, load and generate complex waveform.Or when using the Bode plot function.

[AceyTech]

I wonder what URL I have to block to get rid of the red dot.

I would also like to know, for when the time comes to block mine..  Can you Wireshark it ?

[Fungus]

For the software hackers in the thread. I installed a very simple Android/Kotlin program on the scope to capture the "key" events when twiddling all the knobs and dials. Attached is an image of the key codes each generates.

Is it possible to remap one of them them to open up the Android info screen?

There's plenty of buttons on there that I'll never use...

[empeka]

I would also like to know, for when the time comes to block mine..  Can you Wireshark it ?

http://support.rigol.com/api/Support/ProductUpgradeFile?sn=<serialnumber>&hardware=1.0&behaviour=soft&software=00.01.01

[axantas]

Я предполагаю что все намного прозаичнее, и они просто начнут продавать дополнительную глубину памяти в виде лицензионных ключей, ведь для моделей 900 и 924 пока не предлагалось лицензии на увеличение глубины памяти.... Они же так делают уже много лет...... И не только Rigol......

...deepl
I assume that everything is much more prosaic, and they will just start selling additional memory depth in the form of licence keys, because for the 900 and 924 models they have not yet offered a licence to increase the memory depth..... They've been doing that for years...... And not just Rigol......

I wondered, why they do sell this new model just in different "flawours" without any additional license. There is also a separate fashionable bag, the box and packaging are not like the usual "unattractive" brown box, but a nice black or white box, which enables Youtubers to do some presentable unboxing videos. Are they up to a new market with this model - a bit more fashionable?

BTW: If you look in the box, on the left there is an empty spot, which looks like it could be populated by a mouse.

[AceyTech]

For the software hackers in the thread. I installed a very simple Android/Kotlin program on the scope to capture the "key" events when twiddling all the knobs and dials. Attached is an image of the key codes each generates.

Is it possible to remap one of them them to open up the Android info screen?

There's plenty of buttons on there that I'll never use...

Ooh!  Same here.  I'm also curious about the ARM controller that scans the buttons on the front panel.  -mainly, what kind of interface does it use to communicate with the mainboard/RK3399?  I'm thinking they might've implemented a USB HID keyboard, which if true, might be fairly easy to modify.
@0xACE Where does your program look for the "key codes"?

[Fungus]

Can you Wireshark it ?

http://support.rigol.com/api/Support/ProductUpgradeFile?sn=<serialnumber>&hardware=1.0&behaviour=soft&software=00.01.01

I figured it would be rigol.com. 

I don't really want to block that in my router but I assume Android has /etc/hosts.


Edit: Google says it does, so that's easy to block if there's ever a firmware that I don't want.

[RAPo]

Can we hack the colour of the traces?
I have a colour grade on channel 1 and a sync signal on channel 2, with a persitance of 1s they nearly look the same color.

And as a second wish, can we hack the trigger and channel indicators away?

[Pinkus]

I wish every scope would allow an individual color selection for each channel. Though, very few does unfortunately.

[Randy222]

With all the hacking stuff, I think I will try to P-V the dho804, then get that to load into vmware workstation.
Or, install the same droid OS in VMware, then copy over all the additional Rigol stuff from the dho into the guest droid OS.
Will make poking around much easier.

Has anyone booted the DHO from a bootable USB stick?

[S2084]

If you're going to poke around, add a watch with a date in the lower right corner, like in the 1000 series....

[0xACE]

This question/answer might be of use for key-remapping, though I've not looked into it.

From StackExchange: https://android.stackexchange.com/questions/249423/how-to-remap-keyboard-shortcut

I'll post the GitHub link to the KeyReporter program later this evening. Thought I already had it there, but apparently not.

I did not see the keyboard as a USB device (using `lsusb`) but I may not have interpreted it correctly.

I also played with controlling the LEDs by calling into the binary shared library (extracted from Sparrow.apk -- the "scope" program). Unfortunately, when calling the "Post" function the library seems to start up the FPGA or something else on the scope and kills the active program on me.

[0xACE]

Here is the GitHub Repo with the "Android-Keys" program I used to discover the keycodes.

https://github.com/stephenhouser/Android-Keys