Hacking the Rigol DHO800/900 Scope

[gabiz_ro]

You can't view them.
There is no partitions record.
I see how partition was extracted with some script (sorry can't remember who make it)
Then what addresses are passed to kernel and see that is an offset for what we know from script and that.
My scope is still on pieces.
If anyone can check with mount command if there are more.
It may be that at runtime others to be "mounted" but they are more or less just empty.

It may be possible to build partition table and Android doesn't upset.

[AndyBig]

That's interesting.  I was wondering if anyone put a 814 model number on their 802 scope to make a 3ch scope.  Good to know!  Thanks for sharing the pic of the DHO802 Ext/Ch4 AFE.  FYI: once you enable the testmodel option, you might be able to play with your 4th ch offsets  YMMV, standard disclaimers apply.

There was such an attempt. According to a post from someone who was trying to make a 924 out of his 812 by changing the model name in vendor.bin, the CH4 channel appeared and displayed a trace, but it was impossible to set a trigger on it.
Here is his explanation:

Made 812 into 924. The 4th channel is there (blue) but is not synchronized, the trigger does not work. I turn on the control of the CH4 trigger and the “T” cursor does not move, “SINGLE” also does not work.

When analyzing the situation, two places were found on the oscilloscope board that can determine the HW version and thus determine the behavior of the oscilloscope program. These are resistors near the input front end of channel 4, and resistors on the bottom side of the board in the processor area.

[norbert.kiszka]

You can't view them.
There is no partitions record.
I see how partition was extracted with some script (sorry can't remember who make it)
Then what addresses are passed to kernel and see that is an offset for what we know from script and that.
My scope is still on pieces.
If anyone can check with mount command if there are more.
It may be that at runtime others to be "mounted" but they are more or less just empty.

It may be possible to build partition table and Android doesn't upset.

You can mount them directly from a image or extract them to separate files via dd. Default block size in dd is 512 bytes and testdisk display offsets and sizes also with same block size - so You can do copy paste.

When analyzing the situation, two places were found on the oscilloscope board that can determine the HW version and thus determine the behavior of the oscilloscope program. These are resistors near the input front end of channel 4, and resistors on the bottom side of the board in the processor area.

Somebody did a measurement of its values?

Anyway, if somebody wants to make a some play with buttons...

Code: [Select]

rockchip-key {
compatible = "rockchip,key";
status = "okay";
io-channels = <0xc7 0x1>;

vol-up-key {
linux,code = <0x73>;
label = "volume up";
rockchip,adc_value = <0x1>;
};

vol-down-key {
linux,code = <0x72>;
label = "volume down";
rockchip,adc_value = <0xaa>;
};

power-key {
gpios = <0xc8 0x5 0x1>;
linux,code = <0x74>;
label = "power";
gpio-key,wakeup;
};

menu-key {
linux,code = <0x3b>;
label = "menu";
rockchip,adc_value = <0x2ea>;
};

home-key {
linux,code = <0x66>;
label = "home";
rockchip,adc_value = <0x163>;
};

back-key {
linux,code = <0x9e>;
label = "back";
rockchip,adc_value = <0x230>;
};

camera-key {
linux,code = <0xd4>;
label = "camera";
rockchip,adc_value = <0x1c2>;
};
};

[AceyTech]

That's interesting.  I was wondering if anyone put a 814 model number on their 802 scope to make a 3ch scope.  Good to know!  Thanks for sharing the pic of the DHO802 Ext/Ch4 AFE.  FYI: once you enable the testmodel option, you might be able to play with your 4th ch offsets  YMMV, standard disclaimers apply.

There was such an attempt. According to a post from someone who was trying to make a 924 out of his 812 by changing the model name in vendor.bin, the CH4 channel appeared and displayed a trace, but it was impossible to set a trigger on it.
Here is his explanation:

Made 812 into 924. The 4th channel is there (blue) but is not synchronized, the trigger does not work. I turn on the control of the CH4 trigger and the “T” cursor does not move, “SINGLE” also does not work.

When analyzing the situation, two places were found on the oscilloscope board that can determine the HW version and thus determine the behavior of the oscilloscope program. These are resistors near the input front end of channel 4, and resistors on the bottom side of the board in the processor area.

Thanks for the recap and the additional info..  I gathered that the stuff options were how they set the AFE config from Tor's post yesterday.     

Do you have a link to that 812 -> 924 post?  Maybe I'm not looking at the right thread.

[AndyBig]

Do you have a link to that 812 -> 924 post?  Maybe I'm not looking at the right thread.

This was discussed on another forum, starting with this post - https://4pda.to/forum/index.php?showtopic=1080959&view=findpost&p=128706710

[AndyBig]

Somebody did a measurement of its values?

As far as I know - no. At least I haven’t seen information about this I think that in the processor area these are just jumpers, zero resistance. They set the HW version, it seems to me. Just binary code.

[AceyTech]

You can't view them.
There is no partitions record.
I see how partition was extracted with some script (sorry can't remember who make it)
Then what addresses are passed to kernel and see that is an offset for what we know from script and that.
My scope is still on pieces.
If anyone can check with mount command if there are more.
It may be that at runtime others to be "mounted" but they are more or less just empty.

It may be possible to build partition table and Android doesn't upset.

Thanks.  I've been viewing & editing using Testdisk under Linux Ubuntu, but I could only see 15 partitions on my card. It's a copy of my original, so maybe I miscounted, or didn't see an un-allocated "partition".

[norbert.kiszka]

I lost incredible amount of time to modify kernel 5.x to make it work. But that made me possible for me to make 4.4.179 fully working as it should.

HDMI now works as a separate screen. Of course it can work as a mirror.

[AceyTech]

I lost incredible amount of time to modify kernel 5.x to make it work. But that made me possible for me to make 4.4.179 fully working as it should.

HDMI now works as a separate screen. Of course it can work as a mirror.

Good job!  Please clarify: Does HDMI only work as a mirror, or also as an extended workspace display? 

Curious: How is CPU usage and thermal performance? 
Oh, and does it play Tux Racer? 

[AceyTech]

Another drawback of the modified application was discovered - it is denied access to external storage, that is, to a USB flash drive. Because of this, the application gives an error when loading if the flash drive is plugged into USB. And you cannot save screenshots to a flash drive.
I looked at how the flash drive is mounted, the user root and group sdcard_rw are assigned to it.

It seems that moving the application to /system/priv-app does not solve all the issues. This gives access to the API, but does not give access to resources. I think that a possible solution could be the method suggested by @Randy222 - editing the platform.xml file.

@AndyBig;  Have you tried replacing the sparrow.apk in an update.GEL with your modified one, and apply it like a standard "update"?  I'm wondering if the system might not reject the modified app if applied like this vs. ADB install method.

[AndyBig]

@AndyBig;  Have you tried replacing the sparrow.apk in an update.GEL with your modified one, and apply it like a standard "update"?  I'm wondering if the system might not reject the modified app if applied like this vs. ADB install method.

No, I haven’t tried it, but there’s no point in it - the application from the update is installed with the same pm install command, so the result will be the same.

[Randy222]

A few of updates for the crowd:
1) I was able to script up two scripts, one to handle re-install of mod'd Sparrow APK, and another that will mod the platform.xml permissions using your template file. Scripts run well with checks, backups, and menus. I tested everything multiple times, but I need to do a final test before sharing it here.
2) After testing scripts work I went onto looking at how pm installs (reinstalls) APK's. Something went south while I was poking around. At first it would reboot until scope app started, would get a pid, and then it would die, and then retry that over and over. I could still get in via shh and use adb. But after poking around more on that issue, it now only reboots to a Rigol logo without Eth0 starting, so I suspect it's hung somewhere, possibly a corrupt sdcard, not sure yet.
3) I went in under the cover to get some measurements for my fans, and to investigate board under heatsink (AndyBig posted about a solder blob). I looked around using macro camera and did not find any solder issues, but I did find some crud that was kinda a flaky off-white residue all around all of the BNC input areas. I suspect dried washing solution, but that can't be too good for impedance. See attached pics. I used some rubbing alcohol on one of my SLR lens brushes to clean the input areas well, and then blown dry with bellows.
4) I am not big fan of thermal pads, so I added a ball of my heatsink paste above and below each pad. And not to worry, each ball is size properly for the size of the chip, there will be no leaking over the edges.
5) Two of the heatsink screws were not tight at all. They all went back in using some lightweight threadlocker.


Onto questions:
I took sdcard to my linux system, it will recoginze 16 disk slices as /dev block devices, but they will not mount and fdisk won't show anything. I never checked, but is the sdcard encrypted? Is anyone successfully mounting the slices on sdcard, and if so how are you doing that?

[Randy222]

I lost incredible amount of time to modify kernel 5.x to make it work. But that made me possible for me to make 4.4.179 fully working as it should.

HDMI now works as a separate screen. Of course it can work as a mirror.

Are you planning to port out all the Android stuff to native Linux OS? This would seem like a big to-do.

Another option is to compile Qemu for your dho linux, and then just run the whole dho android in that emulator. But I am not sure what the benefits would be because all the Rigol stuff would need to run through a vm layer to get to hardware, and vice-versa.

[AceyTech]

A few of updates for the crowd:
3)a flaky off-white residue all around all of the BNC input areas. I suspect dried washing solution, but that can't be too good for impedance.

Probably solder flux residue.  Happens with hand soldered thru-hole parts when they don't spot clean the area after assembly.  Even using "no-clean" flux.

4) I am not big fan of thermal pads, so I added a ball of my heatsink paste above and below each pad. And not to worry, each ball is size properly for the size of the chip, there will be no leaking over the edges.

You essentially ADDED additional thermal impedance by adding a layer of compound with the pad.  May help, may hinder. YMMV

5) Two of the heatsink screws were not tight at all. They all went back in using some lightweight threadlocker.

Threadlocker?  You're never going back in?  Well, clearly they didn't torque the screws during assembly.  Shame. 

Onto questions:
I took sdcard to my linux system, it will recoginze 16 disk slices as /dev block devices, but they will not mount and fdisk won't show anything. I never checked, but is the sdcard encrypted? Is anyone successfully mounting the slices on sdcard, and if so how are you doing that?

SDCard is not encrypted.  I've had good luck using "testdisk" on Ubuntu.  People talk about mounting using loopback, which I haven't tried.

FYI:  Here are a couple links from searching for "partition" (just the highlights)
Sept:
https://www.eevblog.com/forum/testgear/rigols-new-dho800-oscilloscope-unbox-teardown/msg5048008/#msg5048008
More:
https://www.eevblog.com/forum/testgear/rigols-new-dho800-oscilloscope-unbox-teardown/msg5046892/#msg5046892
Dec:
https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5240010/?topicseen#msg5240010
My post about SDCard partitions:
https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5356541/?topicseen#msg5356541
Most recent, from 3 days ago:
https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5374955/#msg5374955

[Randy222]

A few of updates for the crowd:
3)a flaky off-white residue all around all of the BNC input areas. I suspect dried washing solution, but that can't be too good for impedance.

Probably solder flux residue.  Happens with hand soldered thru-hole parts when they don't spot clean the area after assembly.  Even using "no-clean" flux.

4) I am not big fan of thermal pads, so I added a ball of my heatsink paste above and below each pad. And not to worry, each ball is size properly for the size of the chip, there will be no leaking over the edges.

You essentially ADDED additional thermal impedance by adding a layer of compound with the pad.  May help, may hinder. YMMV

5) Two of the heatsink screws were not tight at all. They all went back in using some lightweight threadlocker.

Threadlocker?  You're never going back in?  Well, clearly they didn't torque the screws during assembly.  Shame. 

Onto questions:
I took sdcard to my linux system, it will recoginze 16 disk slices as /dev block devices, but they will not mount and fdisk won't show anything. I never checked, but is the sdcard encrypted? Is anyone successfully mounting the slices on sdcard, and if so how are you doing that?

SDCard is not encrypted.  I've had good luck using "testdisk" on Ubuntu.  People talk about mounting using loopback, which I haven't tried.

FYI:  Here are a couple links from searching for "partition" (just the highlights)
Sept:
https://www.eevblog.com/forum/testgear/rigols-new-dho800-oscilloscope-unbox-teardown/msg5048008/#msg5048008
More:
https://www.eevblog.com/forum/testgear/rigols-new-dho800-oscilloscope-unbox-teardown/msg5046892/#msg5046892
Dec:
https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5240010/?topicseen#msg5240010
My post about SDCard partitions:
https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5356541/?topicseen#msg5356541
Most recent, from 3 days ago:
https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5374955/#msg5374955

The solder job on the BNC connector pins looks really good, but the area right around the pins look really clean, and I doubt they brush or use liquid flux, probably just pop in the connector and solder. So I guessing it's from the solder. Also a bit odd it's in a crescent shape around the 3 pins. Whatever it was, it's gone now, for the better.

Adding thermal paste, good stuff, can help more heat move through.  There's no way to remove the pads, the heatsink is not precision machined and it spans 7 chips.

The threadlocker is weak stuff for small screws, they break lose easily with a driver. I not sure if the loose screws undid themselves or not, but the screw material is not the same as the insert, so maybe (maybe) thermal expansion creep.

I'll checkout the links for mounting this card.

[Mechatrommer]

I'm having trouble getting RigolTool working.
But If I start the app, the initial screen appears, then shuts down after 2 seconds.
I tried running as admin...
I am using Windows 10.
I'm using adb commands, but its a pain.

i'm experiencing the same issue. but last time it was working i can view and download some files with ease, i think i updated Windows 10 with something that made its not working. any new version of RigolTool?
ref: https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5132049/#msg5132049

[AceyTech]

The solder job on the BNC connector pins looks really good, but the area right around the pins look really clean, and I doubt they brush or use liquid flux, probably just pop in the connector and solder. So I guessing it's from the solder. Also a bit odd it's in a crescent shape around the 3 pins. Whatever it was, it's gone now, for the better.

Here's something funny: This pic from HubertYoung's teardown last July, even has flux on the BNC connector


@Randy222
So, did your thermal mods lower your scope temperatures?

[AceyTech]

I'm having trouble getting RigolTool working.
But If I start the app, the initial screen appears, then shuts down after 2 seconds.
I tried running as admin...
I am using Windows 10.
I'm using adb commands, but its a pain.

i'm experiencing the same issue. but last time it was working i can view and download some files with ease, i think i updated Windows 10 with something that made its not working. any new version of RigolTool?
ref: https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/175/

RigolTool?  I think most people have moved on to the Vendor Bin tool by @zelea2 for upgrading their scope.

BTW: the link that you posted doesn't seem to point to any specific problem.

[norbert.kiszka]

I never checked, but is the sdcard encrypted? Is anyone successfully mounting the slices on sdcard, and if so how are you doing that?

Its not encrypted. At the beginning there is no GPT table but only bootloader (U-boot). Kernel and file systems are little bit later and Linux kernel takes MTD offsets, sizes and names of those filesystems from cmd boot args. That is visible from early kernel messages to uart:

Code: [Select]

[    0.000000] Kernel command line: earlycon=uart8250,mmio32,0xff1a0000 swiotlb=1 coherent_pool=1m cma=257M androidboot.baseband=N/A androidboot.selinux=disabled androidboot.hardware=rk30board androidboot.console=ttyFIQ0 init=/init mtdparts=rk29xxnand:0x00002000@0x00002000(uboot),0x00002000@0x00004000(trust),0x00002000@0x00006000(misc),0x00008000@0x00008000(resource),0x0000C000@0x00010000(kernel),0x00010000@0x0001C000(boot),0x00020000@0x0002C000(recovery),0x00038000@0x0004C000(backup),0x00040000@0x00084000(cache),0x00400000@0x000C4000(system),0x00008000@0x004C4000(metadata),0x00000040@0x004CC000(verity_mode),0x00002000@0x004CC040(baseparamer),0x00000400@0x004CE040(frp),0x000FA000@0x004CE440(rigol),-@0x00600000(userdata) storagemedia=sd androidboot.oem_unlocked=0 uboot_logo=0x02000000@0xf5c00000 loader.timestamp=2023-08-23_11:38:38 SecureBootCheckOk=0
If You have binary image file of sdcard, then You can examine it with some software like testdisk or binwalk. Testdisk gives offsets and sizes in 512 B. blocks, so eventually You need to multiply those values with this number.

You can extract those FS with dd to another file or mount them directly:

Code: [Select]

mount -t ext4 sdcard_dho924s.bin /some/empty/directory -o offset=3225419776,sizelimit=28494004224
Its easier to mount them from separate files or You can make scripts or just put it into fstab.

BTW. Some time ago... Two people asked for 924S SD card image, so here it is: 924S SD image. User: dho924s. Password is the same.

Are you planning to port out all the Android stuff to native Linux OS? This would seem like a big to-do.

Another option is to compile Qemu for your dho linux, and then just run the whole dho android in that emulator. But I am not sure what the benefits would be because all the Rigol stuff would need to run through a vm layer to get to hardware, and vice-versa.

Qemu is not any system emulator or API layer. Its just for other CPU architectures emulation. What is the point to emulate ARM64 inside ARM64?

There is something like Wine, but for Android apps. Exactly "anbox". If this works as a Linux container, then it will work almost like a on Android - maybe 1% slower. Currently Im using couple Linux containers for many years - this even can work on KVM and XEN without losing efficiency. So most probably there is no need to run another system as a guest in any way. If anbox will fail, then I will try to make real Android inside container without anbox.

Beside of Rigol app, running Linux on this scope gives opportunity to run other scope software - both for Linux and for Android. Maybe me or somebody else will find a way to get data from FPGA to give it to another existing app in real time. But now Im going to make stable system and some changes in build scripts - after that, I will make a new github repo with it and next step will be to run this app. BTW some of communication and managing FPGA is done via kernel modules compiled by Rigol - and that gives some very nice opportunities - even without decompiling it.

Right now everything works very stable with one small exception - Xorg sometimes crashes because of problems with one library - probably because of old kernel. Currently Im investigating it - I like very short error messages which tells almost nothing. I dont want to use original kernel from Rigol, but maybe I will.

BTW. Currently staff like mp4 decoding or OpenGL works like it should. Here is a little proof:

I am using Windows 10.
I'm using adb commands, but its a pain.

I didnt have any problems with adb on Debian 11 and Debian 12. Im not using Windows since XP SP2 beacuse it was always pain in the ass - especially one bug which caused to destroy all file systems on all connected disks (not only in my case)... One of my machines currently has uptime of 280 days - only one problem was temporary no free space on disk because of lack of system monitoring software (lazy me).

[antiquant]

S2084, I watched your one-hour video on YT about DIY upgraded cooling system of your DHO. You did a good job! Moreover, the writings is much more readable now, after changing the system Android fonts. Though "AUTO" now is splitted in two lines and "D" (LA tab), "G" (AFG tab) letters now are cut down below and "M" (Math windows tab) letter is shifted down a little.
How do you think, do users of these DHO really need to look at two zeroes after decimal point for vertical scale ranges in V/ (in channel tabs)? Maybe, respected AndyBig will remove them in his modded Sparrow.apk (as he did it for added by him divider ratios) if he'd like?
Because, as I think, the probe's divider ratios visible on CH tabs is must have, but when it is done for the price of font's size — it's pity.
Either do users need the dot waveform mode as an alternative to the vector waveform mode in these DHOs — and will Rigol ever implement (or, should I say, unlock) it?

BTW, did you already try to use LA probe on your hacked (either in HW and SW) DHO? Did you change the places where the jumpers are soldered on the other side of the main PCB under the Rockchip SoC/MCU to change the actual HW version marker?

[Mechatrommer]

I'm having trouble getting RigolTool working.
But If I start the app, the initial screen appears, then shuts down after 2 seconds.
I tried running as admin...
I am using Windows 10.
I'm using adb commands, but its a pain.

i'm experiencing the same issue. but last time it was working i can view and download some files with ease, i think i updated Windows 10 with something that made its not working. any new version of RigolTool?
ref: https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/175/

RigolTool?  I think most people have moved on to the Vendor Bin tool by @zelea2 for upgrading their scope.
BTW: the link that you posted doesn't seem to point to any specific problem.

zelea tool is for upgrading and editing vendor bin, rigoltool is a gui tool, like windows (linux/android) file explorer i can see file structure and directory much quickly. adb is like command prompts, difficult to navigate large amount of files.. RigolTool automate that.. i used this tool last time to map similarities and differences between dho800 and dho900 firmware (file structure). thats my post in the link earlier, i link again for my own reference (sorry i just noticed i linked to the wrong page, thats not what i intended to link... now its corrected thanks)

ps: i want to see again FW differences since my upgrade path (dho804 fw v1.0.0 -> dho924s hacked fw v1.2.2) created bugs thats not exist in legit path (dho924s fw 1.14 -> dho924s fw 1.2.2) as in earlier link, there are files in dho924s dont exist in dho804 such as ...

files in DHO924 dont exist in DHO804:
\data\cal_ext.hex
\FPGA\SPU_H12S1.bit

this is raised due to my report and howardlong's reply:
https://www.eevblog.com/forum/testgear/rigol-dho800900-oscilloscope-bug-reports-firmware/msg5379389/#msg5379389
https://www.eevblog.com/forum/testgear/rigol-dho800900-oscilloscope-bug-reports-firmware/msg5380205/#msg5380205
https://www.eevblog.com/forum/testgear/rigol-dho800900-oscilloscope-bug-reports-firmware/msg5380262/#msg5380262

[AndyBig]

How do you think, do users of these DHO really need to look at two zeroes after decimal point for vertical scale ranges in V/ (in channel tabs)? Maybe, respected AndyBig will remove them in his modded Sparrow.apk (as he did it for added by him divider ratios) if he'd like?

Are you talking about these values that are yellow and white? I think numbers after the decimal point are still needed

[AceyTech]

ps: i want to see again FW differences since my upgrade path (dho804 fw v1.0.0 -> dho924s hacked fw v1.2.2) created bugs thats not exist in legit path (dho924s fw 1.14 -> dho924s fw 1.2.2) as in earlier link, there are files in dho924s dont exist in dho804 such as ...

Were you able to use RigolTool since the license key change in early January?  key.data is now rKey.data, and there are some cal differences since then., IIRC.

BTW: The newest RigolTool version I have is 1.0.2  if you need it.

[Mechatrommer]

BTW: The newest RigolTool version I have is 1.0.2  if you need it.

yes i need it, can you provide the link..? thanks

[bulba99]

BTW: The newest RigolTool version I have is 1.0.2  if you need it.

yes i need it, can you provide the link..? thanks

https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5077957/#msg5077957