Author Topic: Hacking the Rigol DHO800/900 Scope  (Read 1596093 times)

Dimitrius76 and 27 Guests are viewing this topic.

Offline AceyTech

  • Regular Contributor
  • *
  • Posts: 194
  • Country: us
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1700 on: February 25, 2024, 08:04:30 am »
I remember seeing something about test keys in some android devices in about menu.
Can't check now, no Android phone and my scope is disassembled.
Take a look in android menu, settings, about, and maybe under software versions .
Also if they use AOSP maybe, worth a try with keys from AOSP version 7 if is Android 7 ?

Maybe I'm wrong, I have no knowledge on Android builds or apps.

It's Android 7.1.2 in these. 
The reference designs, BSP's and several SBC manufacturers chose it because it was a very stable OS & kernel, which is desirable for embedded applications.
« Last Edit: February 25, 2024, 08:39:51 am by AceyTech »
 

Offline Mechatrommer

  • Super Contributor
  • ***
  • Posts: 11700
  • Country: my
  • reassessing directives...
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1701 on: February 25, 2024, 11:31:24 am »
next test will be to download the LA data to PC to see if the dso is not lying. maybe tomorrow since i need to learn how to do it in SW... so far to probe LA offline on screen, we dont need the missing DDR3L RAM fwiw...
i tried sending command to dso to set digital channel as source (:WAV:SOUR D11 for example), and dso reported cmd error. so i still not success downloading digital data to PC. and GUI becomes extra slow (1-2fps) when LA GUI is activated, try and error using USB connectivity to PC last night causing the dso to hang/unresponsive or extra delay and lag several times that i have to switch it off and restart. today i tried downloading to USB stick, i managed to get screen and 1MPts memory data in CSV format. earlier i tried 25MPts but i got empty CSV files, so this is a bit inconsistent and confusing, see attached screenshots and zipped csv data.

maybe next time i video and snapshots probing more realistic stuffs on all 16 channels. fwiw cheers.
probing its own internal organ below. there some nasty jitter, not sure SW or HW bug, probably my diy probe's front end divider with extra ringing or overshoot too, not sure. but FW is reading all 16 channels on screen yay!

Nature: Evolution and the Illusion of Randomness (Stephen L. Talbott): Its now indisputable that... organisms “expertise” contextualizes its genome, and its nonsense to say that these powers are under the control of the genome being contextualized - Barbara McClintock
 
The following users thanked this post: AndyBig

Offline Aleksandr

  • Contributor
  • Posts: 48
  • Country: ru
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1702 on: February 25, 2024, 12:53:44 pm »
next test will be to download the LA data to PC to see if the dso is not lying. maybe tomorrow since i need to learn how to do it in SW... so far to probe LA offline on screen, we dont need the missing DDR3L RAM fwiw...
i tried sending command to dso to set digital channel as source (:WAV:SOUR D11 for example), and dso reported cmd error. so i still not success downloading digital data to PC. and GUI becomes extra slow (1-2fps) when LA GUI is activated, try and error using USB connectivity to PC last night causing the dso to hang/unresponsive or extra delay and lag several times that i have to switch it off and restart. today i tried downloading to USB stick, i managed to get screen and 1MPts memory data in CSV format. earlier i tried 25MPts but i got empty CSV files, so this is a bit inconsistent and confusing, see attached screenshots and zipped csv data.

maybe next time i video and snapshots probing more realistic stuffs on all 16 channels. fwiw cheers.
probing its own internal organ below. there some nasty jitter, not sure SW or HW bug, probably my diy probe's front end divider with extra ringing or overshoot too, not sure. but FW is reading all 16 channels on screen yay!


You are a genius!!!
 

Offline gabiz_ro

  • Regular Contributor
  • *
  • Posts: 114
  • Country: ro
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1703 on: February 25, 2024, 01:23:26 pm »
I try to solve rest of sdcard dump, what remain after extracting known 6 partition.
Maybe will be usefull somehow
Based on my dump:
Code: [Select]
                        start - end address
id block preloader 0x8000   - 0x37FFFF
preloader 0x8800 - 0x37FFFF
vendor storage 0x380000 - 0x3BFFFF DVKR
reserved space 0x3C0000 - 0x3EFFFF
reserved1 0x3F0000 - 0x3F7FFF SYSD DRMK
U-Boot Env 0x3F8000 - 0x3FFFFF boot parameters
reserved2 0x400000 - 0x7FFFFF PARM
loader 0x800000 - 0x8FFFFF LOADER all 4 are identical
loader 0x900000 - 0x9FFFFF LOADER
loader 0xA00000 - 0xAFFFFF LOADER
loader 0xB00000 - 0xBFFFFF LOADER
loader3 0xC00000 - 0xDFFFFF BL31 both BL31 are identical
BL31 0xC00800 ...
BL31 0xC34000 ...
BL31 0xC36000 ...
BL32 0xC3D000 - 0xC9AFFF
loader3 0xE00000 - 0xFFFFFF BL31
BL31 0xE00800 ...
BL31 0xE34000 ...
BL31 0xE36000 ...
BL32 0xE3D000 - 0xE9AFFF
Rockchip resource image 0x1400000 - 3 entries
0x1400800 - 0x1413E75 rk-kernel.dtb
0x1414000 - 0x1437208 Rigol logo
0x1437400 - 0x147E476 Rigol logo
KRNL 0x2400000
KRNL 0x3C00000
KRNL 0x5C00000
 
The following users thanked this post: norbert.kiszka

Offline Mechatrommer

  • Super Contributor
  • ***
  • Posts: 11700
  • Country: my
  • reassessing directives...
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1704 on: February 25, 2024, 01:54:02 pm »
You are a genius!!!
do not exagerate when making compliment ;D to be frank, i dont believe in genius, only hard work behind it... i'm no better than most of people here.. i worked bit by bit, with many mistakes... not in one night.. btw i managed to save the 25MPts digital + CH1 analog data into CSV file, the 700MB+ size deluded me, when checking with hex editor... it got CH1 data, but digital data is still empty, just header and commas... so no success yet... cheers.

edit: tried saving 10Mpts, same think empty digital data, but CH1 analog data present throughout the record, so this is not USB corruption issue, maybe dso needs 2x DDR3L RAM, or FW bug..

edit 2: made another try.. saving CSV 1Mpts, 10Mpts, 25Mpts consecutively after hit single trigger. 1Mpts (46MB) success! 10Mpts (312MB) failed! 25Mpts (1GB) success! hmmm  ??? inconsistent. it seems i managed to get non-empty digital data at 25Mpts yay!. maybe this inconsistency is SW bug.
« Last Edit: February 25, 2024, 02:38:40 pm by Mechatrommer »
Nature: Evolution and the Illusion of Randomness (Stephen L. Talbott): Its now indisputable that... organisms “expertise” contextualizes its genome, and its nonsense to say that these powers are under the control of the genome being contextualized - Barbara McClintock
 

Offline norbert.kiszka

  • Regular Contributor
  • *
  • Posts: 227
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1705 on: February 25, 2024, 02:25:38 pm »
I try to solve rest of sdcard dump, what remain after extracting known 6 partition.
Maybe will be usefull somehow
Based on my dump:
Code: [Select]
                        start - end address
id block preloader 0x8000   - 0x37FFFF
preloader 0x8800 - 0x37FFFF
vendor storage 0x380000 - 0x3BFFFF DVKR
reserved space 0x3C0000 - 0x3EFFFF
reserved1 0x3F0000 - 0x3F7FFF SYSD DRMK
U-Boot Env 0x3F8000 - 0x3FFFFF boot parameters
reserved2 0x400000 - 0x7FFFFF PARM
loader 0x800000 - 0x8FFFFF LOADER all 4 are identical
loader 0x900000 - 0x9FFFFF LOADER
loader 0xA00000 - 0xAFFFFF LOADER
loader 0xB00000 - 0xBFFFFF LOADER
loader3 0xC00000 - 0xDFFFFF BL31 both BL31 are identical
BL31 0xC00800 ...
BL31 0xC34000 ...
BL31 0xC36000 ...
BL32 0xC3D000 - 0xC9AFFF
loader3 0xE00000 - 0xFFFFFF BL31
BL31 0xE00800 ...
BL31 0xE34000 ...
BL31 0xE36000 ...
BL32 0xE3D000 - 0xE9AFFF
Rockchip resource image 0x1400000 - 3 entries
0x1400800 - 0x1413E75 rk-kernel.dtb
0x1414000 - 0x1437208 Rigol logo
0x1437400 - 0x147E476 Rigol logo
KRNL 0x2400000
KRNL 0x3C00000
KRNL 0x5C00000

https://www.eevblog.com/forum/blog/eevblog-1563-new-$389-12bit-rigol-dho800-scope-teardown/msg5046301/#msg5046301

I think there is no partition table. Just a bootloader and filesystem starting at some point (once I did a disk in PC in same way, but without any bootloader - naked FS without bootsector - even Linux automount probably will not detect this, unless its a usb stick or sd card). Still I didnt look at mine, but for 99% I will do it today.
« Last Edit: February 25, 2024, 02:28:31 pm by norbert.kiszka »
 

Online shapirus

  • Super Contributor
  • ***
  • Posts: 1603
  • Country: ua
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1706 on: February 25, 2024, 02:49:28 pm »
I think there is no partition table. Just a bootloader and filesystem starting at some point (once I did a disk in PC in same way, but without any bootloader - naked FS without bootsector - even Linux automount probably will not detect this, unless its a usb stick or sd card). Still I didnt look at mine, but for 99% I will do it today.
There might be no partition table as such -- the standard linux tools don't detect it -- but there are partitions that can be mounted and explored.

Try to use this tool on the image:

Code: [Select]
$ apt show testdisk
Package: testdisk
Version: 7.1-5+nmu1
Priority: optional
Section: admin

It will find the partitions (except root, for some reason) and restore the GPT record for them. And it also finds them very quickly, it's not doing a full scan, so there should be some kind of partition table that it uses. Maybe a backup copy of GPT?
 

Offline norbert.kiszka

  • Regular Contributor
  • *
  • Posts: 227
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1707 on: February 25, 2024, 02:58:40 pm »
but there are partitions that can be mounted and explored.

File system, not a partition.

It will find the partitions (except root, for some reason) and restore the GPT record for them. And it also finds them very quickly, it's not doing a full scan, so there should be some kind of partition table that it uses. Maybe a backup copy of GPT?

Why You need GPT for this? Anyway, If You have full FS deep into some data (in SD card and not in the beginning), You can extract this part to separate file and in Linux You cant mount any file as a file system - there is no need to be block file. In older systems You need to add loop option - in newest its added automatically.

Code: [Select]
mount /some/file /some/directory -o loop
Or if it cant detect file system type, You can type it:

Code: [Select]
mount -t fstype /some/file /some/directory -o loop

Online shapirus

  • Super Contributor
  • ***
  • Posts: 1603
  • Country: ua
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1708 on: February 25, 2024, 03:22:47 pm »
File system, not a partition.
There are several partitions with file systems (ext4) on the SD card all right.

Anyway, If You have full FS deep into some data (in SD card and not in the beginning), You can extract this part to separate file and in Linux You cant mount any file as a file system - there is no need to be block file.
Of course. The problem is that you can only do it if you know the start offset of the file system in the image file (or on the block device). And you don't know it unless you have a partition table (such as GPT) or a tool that can scan the image and detect file systems by looking for known headers.

Standard linux tools such as losetup or fdisk don't see any partitions on the sd card. Testdisk does.
 

Offline norbert.kiszka

  • Regular Contributor
  • *
  • Posts: 227
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1709 on: February 25, 2024, 03:36:31 pm »
And you don't know it unless you have a partition table (such as GPT) or a tool that can scan the image and detect file systems by looking for known headers.

If there is no partition table in this SD card, why You mentioning it? You want to add it or something? To play around, its good enough to extract and mount it.


Standard linux tools such as losetup or fdisk don't see any partitions on the sd card. Testdisk does.

That is what I told in this thread couple days ago.

Anyway, I was expecting ext4, because its fast and reliable filesystem. Not a fat or ntfs rubbish.

Offline Bud

  • Super Contributor
  • ***
  • Posts: 6988
  • Country: ca
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1710 on: February 25, 2024, 05:09:00 pm »
MTD partition layout is passed to kernel from Uboot. It then appears in the boot log. Is  this guys what you are debating?

Code: [Select]

[    1.402697]      uboot: 0x000400000 -- 0x000800000 (4 MB)
[    1.402715]      trust: 0x000800000 -- 0x000c00000 (4 MB)
[    1.402724]       misc: 0x000c00000 -- 0x001000000 (4 MB)
[    1.402733]   resource: 0x001000000 -- 0x002000000 (16 MB)
[    1.402746]     kernel: 0x002000000 -- 0x003800000 (24 MB)
[    1.402755]       boot: 0x003800000 -- 0x005800000 (32 MB)
[    1.402762]   recovery: 0x005800000 -- 0x009800000 (64 MB)
[    1.402770]     backup: 0x009800000 -- 0x010800000 (112 MB)
[    1.402778]      cache: 0x010800000 -- 0x018800000 (128 MB)
[    1.402786]     system: 0x018800000 -- 0x098800000 (2048 MB)
[    1.402793]   metadata: 0x098800000 -- 0x099800000 (16 MB)
[    1.402801] verity_mode: 0x099800000 -- 0x099808000 (0 MB)
[    1.402809] baseparamer: 0x099808000 -- 0x099c08000 (4 MB)
[    1.402816]        frp: 0x099c08000 -- 0x099c88000 (0 MB)
[    1.402823]      rigol: 0x099c88000 -- 0x0b9088000 (500 MB)
[    1.402831]   userdata: 0x0c0000000 -- 0x762600000 (27174 MB)
Facebook-free life and Rigol-free shack.
 
The following users thanked this post: AndyBig, AceyTech

Offline AndyBig

  • Frequent Contributor
  • **
  • Posts: 394
  • Country: ru
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1711 on: February 25, 2024, 07:03:11 pm »
How to modify the oscilloscope application.
This application is a standard application for Android, so all the methods of working with it are no different from the methods of working with any other application for Android. I will describe the process under Windows, but under Linux everything will be almost the same, all tools are available for Linux.

What programs will you need:
apktool - https://github.com/iBotPeaches/Apktool - a utility for unpacking and packing an .apk application. It unpacks the application into the individual files that make up the application. Requires Java (JRE) installed on the system.
zipalign - a utility included in Android build-tools (https://developer.android.com/tools). Aligns the contents of the .apk after it has been packaged. I didn’t find how to download build-tools separately, so I downloaded and installed the full Android Studio, which also includes build-tools.
keytool - a utility from the Java SDK (https://www.oracle.com/cis/java/technologies/downloads/) for creating a key storage with which you will sign the application.
jarsigner a utility from the Java SDK (https://www.oracle.com/cis/java/technologies/downloads/) for signing applications with keys from the key store, which was created by the keytool utility.
adb a utility included in the Android platform-tools (https://developer.android.com/tools/releases/platform-tools) for working with Android devices connected via a local network or USB.
jadx - https://github.com/skylot/jadx - a utility for decompiling an application into Java source codes. Select and download the "jadx-gui with bundled JRE" option.

apktool and jadx are downloaded from github, they do not need installation.
If you download and install Android Studio (https://developer.android.com/studio), then all other utilities (except apktool and jadx) will already be included. After downloading and installing, make sure that the path to Java is specified in the environment variables - try typing in the command line
Code: [Select]
javaand press Enter. You should see java help with a description of the parameters and commands.
In the same way, check the availability of keytool and jarsigner.

So, everything has been downloaded and installed, you can start unpacking the application.
Create a separate directory for working with the application. For example, the path would be the "SparrowWork" directory. Copy the application file (Sparrow.apk), apktool (apktool_2.9.3.jar in the current version), and zipalign (zipalign.exe from the Android SDK, it should be located in the Android SDK installation directory, in one of the subdirectories) to this directory ). It is better to rename the original application file, for example to Sparrow_orig.apk.
Go to this directory and open a command prompt in it.
First you need to create a key store, with which you will then sign the application after assembly. This is done only once before the first assembly; there is no need to repeat this in the future. The key store is created with the command:
Code: [Select]
keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000Here “my-release-key” is the name of the key store being created; you can substitute any other name, which you will then put in the signing command. "alias_name" is the name of the key, you can also replace it with any other, which you can then substitute in the signing command.
After launching, the program will ask you for various data - name, organization, city, etc. - you can write whatever you want. In addition, it will ask for a password for the vault, you will need to come up with it and remember it, it will be needed for the signing command.

Now extract the application into a separate directory using the command:
java -jar apktool_2.9.3.jar d Sparrow_orig.apk -o Sparrow_unpack
You should have a subdirectory "Sparrow_unpack" in your directory, which will contain all the contents of the application in its original form. In principle, here you can already start editing application files. For example, the "Sparrow_unpack/res" directory will contain all application resources - images, .xml files with texts, parameters, screen layout, etc. In the directory "Sparrow_unpack/smali" and "Sparrow_unpack/smali_classes2" there will be .smali files with source codes in the DALVIK language - this is something like an assembler for Java.
If you want to get source codes in Java, then run the downloaded and unpacked jadx utility (jadx-gui-1.4.7.exe for the current version). In it, open the application file Sparrow_orig.apk and wait until the analysis and decompilation is completed. Now you can view all source codes directly in this program - it has a fairly convenient source viewer. You can save the result as a project - File -> Save as gradle project in a separate subdirectory, then all source java files will be available at any time in this directory, you can open them in your favorite editor.
Warning: You will not be able to compile the application back from the decompiled java files, they are only intended to help you understand the contents of the .smali files. Each .java file will correspond to a .smali file with the same name and in the same subdirectory.
All changes are made to files in the directory into which the application was unpacked using the apktool utility. In the example, this is the Sparrow_unpack directory. The application will be built from this directory after all changes.

Okay, you've changed what you wanted, now you need to put the application back together.
The assembly is done with the command:
Code: [Select]
java -jar apktool_2.9.3.jar b -o Sparrow_unalign.apk Sparrow_unpakHere Sparrow_unalign.apk is the name of the application that will be created, Sparrow_unpack is the directory from which the files for the build are taken.
If no errors are found after the changes, the Sparrow_unalign.apk file will appear in the current directory. Now you need to align the contents of the application with the command:
Code: [Select]
zipalign.exe 4 Sparrow_unalign.apk Sparrow.apkAs a result, a Sparrow.apk file will be created, with all its contents aligned and almost ready for installation. All that remains is to sign it with the command:
Code: [Select]
jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore -storepass 123456 Sparrow.apk alias_nameHere you specify "my-release-key" - the name of the key store you created, "123456" - the password and "alias_name" - the password and key name that you specified when creating the key store.

That's it, now the Sparrow.apk application is completely ready for installation.

About the installation. From the factory, the oscilloscope application is installed as a system application, so simply replacing it with your own modified one will not work. You must first remove the original version. Don't worry - you can always install the original application back. You made a copy of it just in case, didn’t you? :)
If on your system the path to the directory with the adb utility is included in the environment variables and the adb command can be executed from anywhere, then you can continue working in the current directory. Otherwise, copy the resulting Sparrow.apk application to the directory with adb and launch the command line there.
On the command line, type the command:
Code: [Select]
adb connect 192.168.1.171:55555Where 192.168.1.171 replace with the IP address of your oscilloscope. The oscilloscope must be turned on and accessible via the local network.
After that, type the command:
Code: [Select]
adb uninstall com.rigol.scopeAfter a second or two, the application should disappear from the oscilloscope screen and the message “Success” will appear in the terminal.
Install your application:
Code: [Select]
adb install -g -r Sparrow.apkThe process takes quite a long time, almost a minute, so don't worry about everything getting stuck. When finished, a “Success” message should appear and within a few seconds the oscilloscope application should automatically launch.
If your modified application is already installed on the oscilloscope and you reinstall it after the next modification, then there is no need for a separate command to remove the old application. You can immediately issue the installation command:
Code: [Select]
adb install -g -r Sparrow.apk
That's it, your modified application is installed :)
There is only one point: your application cannot be a system one, because it is signed with the wrong key. One of the noticed negative consequences of this is the inability to take screenshots directly on the oscilloscope. But they can be done via web control. It is possible to make a modified application a system one, but there will be a separate post about this later.

P.S. I'm not a real Android app modder, and I've described here what I've learned and tried over the past few days, so there may be inaccuracies in my description. Maybe someone more experienced will correct me at some points :)
« Last Edit: February 25, 2024, 07:40:50 pm by AndyBig »
 
The following users thanked this post: Mechatrommer, thm_w, tv84, ebastler, F14V, antiquant, shapirus, ebourg, AceyTech, norbert.kiszka

Offline norbert.kiszka

  • Regular Contributor
  • *
  • Posts: 227
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1712 on: February 25, 2024, 07:30:38 pm »
From ADB Linux manual:

Code: [Select]
       • -l: Forward lock application.

       • -r: Replace existing application.

       • -t: Allow test packages.

       • -s: Install application on sdcard.

       • -d: Allow version code downgrade (debuggable packages only).

       • -p: Partial application install.

       • -g: Grant all runtime permissions.

Offline AndyBig

  • Frequent Contributor
  • **
  • Posts: 394
  • Country: ru
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1713 on: February 25, 2024, 07:34:14 pm »
From ADB Linux manual:

Code: [Select]
       • -l: Forward lock application.

       • -r: Replace existing application.

       • -t: Allow test packages.

       • -s: Install application on sdcard.

       • -d: Allow version code downgrade (debuggable packages only).

       • -p: Partial application install.

       • -g: Grant all runtime permissions.

In Windows adb the same keys :)
 

Offline norbert.kiszka

  • Regular Contributor
  • *
  • Posts: 227
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1714 on: February 25, 2024, 09:35:31 pm »
Tested on mine 924S.

List packages:

Code: [Select]
adb shell pm list packages
Acquire apk directory of package:

Code: [Select]
adb shell pm path com.rigol.scope
Pull apk into local directory:

Code: [Select]
adb pull /data/app/com.rigol.scope-1/base.apk
If somebody will need this for some strange reason, file size is 36840716 bytes (36.8 MB, 35.13 MiB).

Offline AndyBig

  • Frequent Contributor
  • **
  • Posts: 394
  • Country: ru
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1715 on: February 25, 2024, 09:56:05 pm »
Tested on mine 924S.

List packages:

Code: [Select]
adb shell pm list packages
Acquire apk directory of package:

Code: [Select]
adb shell pm path com.rigol.scope
Pull apk into local directory:

Code: [Select]
adb pull /data/app/com.rigol.scope-1/base.apk
If somebody will need this for some strange reason, file size is 36840716 bytes (36.8 MB, 35.13 MiB).
The .GEL update file contains, among other things, the original Sparrow.apk, which is installed in /data/app/com.rigol.scope-1/ :)
 

Offline AceyTech

  • Regular Contributor
  • *
  • Posts: 194
  • Country: us
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1716 on: February 25, 2024, 11:01:59 pm »
In case anyone is wondering about the DHO8/900 file structure, file system partitions, and SDCard speed/upgrades, here is a good starting point for your research:

Partition(s) information with offsets(from Sept/23)
https://www.eevblog.com/forum/testgear/rigols-new-dho800-oscilloscope-unbox-teardown/msg5048008/#msg5048008

Partition cloning including repairing partition table.(SDCard corrupt error)
--He also confirmed there was no apparent speed benefit to the upgrade to larger/faster card.
https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5240010/?topicseen#msg5240010

Step by step - Cloning to new/larger card by the great @Serg65536
https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5134359/?topicseen#msg5134359

Cheers!
 
The following users thanked this post: Obiwantje, norbert.kiszka

Offline norbert.kiszka

  • Regular Contributor
  • *
  • Posts: 227
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1717 on: February 25, 2024, 11:04:19 pm »
In Windows adb the same keys :)

But his were better, because they're from Linux.  :-DD

Stop trolling again.

I wrote instructions. I wrote clearly Linux manual. Im not using Windows and I cant check if everything is the same on Windows version. So You think Im worse because I dont have Windows or what?

Again, please stop trolling.

Offline norbert.kiszka

  • Regular Contributor
  • *
  • Posts: 227
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1718 on: February 25, 2024, 11:08:36 pm »
Partition(s) information with offsets(from Sept/23)

Every scope can have different offsets. Especially after upgrade.

Offline AndyBig

  • Frequent Contributor
  • **
  • Posts: 394
  • Country: ru
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1719 on: February 25, 2024, 11:15:11 pm »
Every scope can have different offsets. Especially after upgrade.
After the update - no, because only user applications are updated, the update does not enter the system. But from the factory - it is possible that in newer models Rigol may change something in the Android system. But in my opinion this is very unlikely.
 
The following users thanked this post: AceyTech

Offline AndyBig

  • Frequent Contributor
  • **
  • Posts: 394
  • Country: ru
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1720 on: February 25, 2024, 11:18:24 pm »
Interesting "tails" are hidden in the application. It turns out that not all existing settings items are displayed, some of them are simply disabled, but they are there. True, they don’t change anything, there are probably no handlers for them, but it’s still interesting :)
 
The following users thanked this post: Mechatrommer

Offline norbert.kiszka

  • Regular Contributor
  • *
  • Posts: 227
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1721 on: February 25, 2024, 11:24:50 pm »
After the update - no, because only user applications are updated, the update does not enter the system. But from the factory - it is possible that in newer models Rigol may change something in the Android system. But in my opinion this is very unlikely.

Process with uid (or with setuid) can do everything. Im not Android specialist, but thats the way on any Linux-based system.

Interesting "tails" are hidden in the application. It turns out that not all existing settings items are displayed, some of them are simply disabled, but they are there. True, they don’t change anything, there are probably no handlers for them, but it’s still interesting :)

With working WiFi I see correct date (NTP most likely), but time is wrong. Maybe its Chinese timezone :)

Offline AndyBig

  • Frequent Contributor
  • **
  • Posts: 394
  • Country: ru
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1722 on: February 25, 2024, 11:32:09 pm »
With working WiFi I see correct date (NTP most likely), but time is wrong. Maybe its Chinese timezone :)
Yes, the oscilloscope launch script start_rigol_app.sh sets the Asia/Shanghai time zone:
Code: [Select]
setprop persist.sys.timezone Asia/ShanghaiI changed it to my time zone and the time is displayed correctly.
 
The following users thanked this post: AceyTech

Offline AceyTech

  • Regular Contributor
  • *
  • Posts: 194
  • Country: us
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1723 on: February 25, 2024, 11:48:44 pm »
Interesting "tails" are hidden in the application. It turns out that not all existing settings items are displayed, some of them are simply disabled, but they are there. True, they don’t change anything, there are probably no handlers for them, but it’s still interesting :)

I would've loved to be "a fly on the wall" during that meeting..  I'm sure a Dev made a comment about how hard it was to implement something, and the PM said "Well, just cut it for now, we'll put it back in some day"  --Don't miss those meetings at all!

BTW, nice job on the scope app hacking guide, Andy.  Herculean effort!  :clap:
 

Online shapirus

  • Super Contributor
  • ***
  • Posts: 1603
  • Country: ua
Re: Hacking the Rigol DHO800/900 Scope
« Reply #1724 on: February 26, 2024, 12:04:58 am »
There is only one point: your application cannot be a system one, because it is signed with the wrong key.
Apparently there is a way. There are publicly available app signing keys that can be used for testing/developing apps to be installed as system apps. Check this: https://stackoverflow.com/questions/37586255/signing-my-android-application-as-system-app

If I understand it correctly, then signing the apk with one of those keys, instead of a self-signed key, should do the trick.

There are downsides (explained on stackoverflow), but they are hardly applicable in our case.
 
The following users thanked this post: AndyBig, AceyTech


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf