Author Topic: Hacking the Rigol DHO800/900 Scope  (Read 1705302 times)

0 Members and 10 Guests are viewing this topic.

Offline janegil

  • Newbie
  • Posts: 8
  • Country: no
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2775 on: July 03, 2024, 10:39:42 am »
Hi. I upgraded my DHO804 to DHO814 with all options. Worked fine, and I did several measurements with it.
This morning, the unit does not boot. The buttons lights up and the fan starts, but the display is black.
I don't think this is related to the hack itself, but maybe the flash memory is somehow corrupted?
Anyhow. Is it possible to interface the unit without opening it? Can I access the bootloader somehow?
 

Online Fungus

  • Super Contributor
  • ***
  • Posts: 17229
  • Country: 00
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2776 on: July 03, 2024, 10:45:06 am »
Does ADB still work?

 

Offline janegil

  • Newbie
  • Posts: 8
  • Country: no
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2777 on: July 03, 2024, 10:57:26 am »
No, not over ethernet. There is activity at the port, but it does not request an IP address.
 

Offline janegil

  • Newbie
  • Posts: 8
  • Country: no
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2778 on: July 03, 2024, 04:35:03 pm »
I pulled the SD card. There are no partitions. I assume the card is corrupted.
Are there any procedures for recovering or reflashing the SD card?
 

Offline shapirus

  • Super Contributor
  • ***
  • Posts: 1625
  • Country: ua
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2779 on: July 03, 2024, 04:49:04 pm »
I pulled the SD card. There are no partitions. I assume the card is corrupted.
Are there any procedures for recovering or reflashing the SD card?
It's not necessarily corrupted. There's no partition table on the SD card itself, or at least standard tools like fdisk don't see it. But the actual partitions, or, rather, filesystems located each at its own offset, do exist.

You can use, for example, testdisk to scan the card (or better its image) for partitions/filesystems and then, knowing the offsets, mount them and see the data.

Regardless of what you do, now that you've pulled the SD card out, make a backup of its image (using dd, for example).
« Last Edit: July 03, 2024, 04:51:24 pm by shapirus »
 

Offline janegil

  • Newbie
  • Posts: 8
  • Country: no
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2780 on: July 03, 2024, 06:09:53 pm »
I pulled the SD card. There are no partitions. I assume the card is corrupted.
Are there any procedures for recovering or reflashing the SD card?
It's not necessarily corrupted. There's no partition table on the SD card itself, or at least standard tools like fdisk don't see it. But the actual partitions, or, rather, filesystems located each at its own offset, do exist.

You can use, for example, testdisk to scan the card (or better its image) for partitions/filesystems and then, knowing the offsets, mount them and see the data.

Regardless of what you do, now that you've pulled the SD card out, make a backup of its image (using dd, for example).

Thanks a lot! Actually I was just finished investigating and putting back the original vendor.bin on the SD card, before reading your comment.
However, I did exactly what you suggested. For anyone in the same situation, here is how I fixed the scope:
  • Made a backup of the SD card with dd
Code: [Select]
dd if=/dev/sdX of=sd_card_backup.img bs=1M
  • Used testdisk to find the GPT partitions and it's corresponding offset and size
Code: [Select]
testdisk sd_card_backup.img

Disk sd_card_backup.img - 31 GB / 29 GiB - CHS 3857 255 63
     Partition               Start        End    Size in sectors
 P Linux filesys. data       548864     811007     262144
 P Linux filesys. data       811008    5005311    4194304 [system]
 P Linux filesys. data      5005312    5038079      32768
>P Linux filesys. data      5047360    6071359    1024000 [rigol]
 P Linux filesys. data      6299648   61951999   55652352
  • Mounted the rigol partition
Code: [Select]
mount -t ext4 sd_card_backup.img /mnt/disk -o offset=2584248320,sizelimit=524288000
  • Replaced vendor.bin in /data/ with the original file
  • Reinserted the SD card and success!

I'm not quite sure what happened, as I successfully upgraded to DHO814 and used it for some time yesterday.
« Last Edit: July 03, 2024, 07:20:45 pm by janegil »
 
The following users thanked this post: egonotto

Offline tonywood

  • Contributor
  • Posts: 11
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2781 on: July 04, 2024, 01:52:45 am »
I hacked my 804 to a 924 and then ran self calibration. All seems fine and I get a -3 db of around 280mhz. This seems like a really good upgrade path. Thanks to all involved.
 
The following users thanked this post: Markus2801A, jasonquin

Offline Lathe26

  • Contributor
  • Posts: 31
  • Country: us
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2782 on: July 06, 2024, 04:57:26 am »
After researching things further, and getting pointed in the right direction by Fenstergucker and shapirus, here's an updated / corrected list of what network ports the DHO800/900 exposes over Ethernet.  Most folks here already know these but this compiled list could be useful for new folks.

  • TCP port 21 = FTP (internal storage only, no USB stick support).  Handled by tcpsvcd.
  • TCP port 22 = SSH for shell access (and related technologies like scp should also work).  Handled by sshd.
  • TCP port 80 = HTTP.  Handled by WebControl.apk.
  • TCP and UDP port 111 = Port Mapper (use by LXI/VXI clients to find the LXI/VXI port).  Handled by pmapService.
  • TCP port 5555 = Raw SCPI.  Handled by Sparrow.apk.
  • TCP port 8080 = HTTPS.  Handled by WebControl.apk.
  • TCP ports 9001-9004 = WebSocket support for SCPI?  Handled by WebControl.apk.
  • TCP and UDP port 20712 = LXI / VXI remote proceedure call (RPC).  This supports prognums for VXI Core, Async, and Interrupt interfaces (prognums 0x0607AF thru 0x0607B1).  Handled by Sparrow.apk.
  • TCP port 55555 = adb (Android Debug Bridge) for shell access, keystroke injection, pull/push files from/to the scope, etc.  Handled by adbd.

FTP comments:
As mentioned, FTP only provides access to the internal storage location where users can save/load files (i.e., the "C:" drive).  The FTP daemon is launched by /rigol/shell/start_rigol_app.sh via one script line of tcpsvd 0:21 ftpd ftpd -w /data/UserData/ &.  It looks like it would be easy to run a 2nd FTP daemon on a non-standard TCP port to offer access to a USB drive.  The only wrinkle would be putting it in a script that 1) first checks whether the USB is present and 2) uses the correct path since it varies from USB drive to USB drive (specifically, it varies by the USB VID and PID IDs of the drive).

pmapService comments:
pmapService (a.k.a. port mapper service) appears to be a simpler implementation of the typical port mapper.  Rigol ships this program in its FW update file.  It's so cut down that it doesn't list what programs are registered with it (i.e. DUMP command to prognum 100000 fails).  It does support finding the LXI/VXI port (i.e. GETPORT returns port 20712) but it doesn't bother even checking what program number is being requested.  You want the LXI/VXI Core program?  It replies with port 20712.  You want the grandma-recipes program?  It also replies with port 20712.  Hmmm.  It's not a server-grade implementation... but then again it doesn't need to be and it gets the job done.

Raw SCPI comments:
Raw connections work best, such as Putty's Raw socket feature (or whatever client you prefer on your OS).  Telnet clients can be used as a backup, but avoid binary transfers since the telnet client might misinterpret or mangle the data.

ADB comments:
The ADB client is a "Swiss Army knife" of tools.  For example, if you want to use the scope's physical USB port for a USB drive instead of a USB keyboard and don't have a USB hub, you can run adb input keyevent <keycode> to inject keystrokes into the scope's Android UI, including special keys.  One example is adb shell input keyevent KEYCODE_APP_SWITCH which will let you switch from one Android app to another.  By default, Sparrow.apk is the only running app, but you can launch a WWW browser using adb shell input keyevent KEYCODE_EXPLORER and then use KEYCODE_APP_SWITCH to switch back and forth.  There is a great adb cheatsheet at https://gist.github.com/Pulimet/5013acf2cd5b28e55036c82c91bd56d8#file-adbcommands

Misc comments:
Looks like there is NsdServiceInfo (mDNS?) filled out for _http._tcp., _lxi._tcp., _scpi-raw._tcp., and _vxi-11._tcp. setup on port 80.  I didn't investigate deeply on these.
« Last Edit: July 06, 2024, 11:11:46 pm by Lathe26 »
 
The following users thanked this post: Fungus, F14V, cte

Offline Lathe26

  • Contributor
  • Posts: 31
  • Country: us
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2783 on: July 06, 2024, 05:05:48 am »
Separate topic from above: Bluetooth support.

Logcat lists several line that make it appear that Bluetooth is running.  For example, the line BluetoothManagerService: Stored bluetooth Name=rk3399,Address=22:22:xx:xx:xx:xx (the xx's are to obscure my MAC address).  Because Bluetooth is not exposed to typical users of the scope, my assumption is that either:
  • Rigol did not fully populate the Bluetooth hardware but there was at least a controller in the hardware or...
  • Android's Bluetooth daemon was run and made up a fake MAC address since it didn't find real hardware.  This comes from that the 2nd lowest bit of the 1st MAC address is set which means the MAC address was "locally" assigned and not "universal" (i.e. this MAC address was not part of a HW vendor's assigned range).

Thoughts on this?

Update:
After using adb shell, then using cmd statusbar expand-notifications to get access to Android's Setting, it looks like there is no Bluetooth functionality.  This isn't surprising.
« Last Edit: July 06, 2024, 11:31:08 pm by Lathe26 »
 

Offline g0mgx

  • Regular Contributor
  • *
  • Posts: 79
  • Country: gb
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2784 on: July 08, 2024, 06:06:59 am »
Morning All

I have a DHO804 FW version is 00.01.02.00.02

Trying to follow the latest video:

https://youtu.be/oBfuWxMFSsI?si=oKTufL6XjIHCgyOs

when I connect via ADB I get:

Code: [Select]
adb server version (39) doesn't match this client (41); killing...
* daemon started successfully
connected to 192.168.1.164:55555

Should I continue??

 

Offline MattSR

  • Regular Contributor
  • *
  • Posts: 96
  • Country: au
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2785 on: July 09, 2024, 12:43:16 am »
Is it possible to hack the two channel DHO-xx2 into an 4 channel DHO-xx4?
 

Online Fungus

  • Super Contributor
  • ***
  • Posts: 17229
  • Country: 00
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2786 on: July 09, 2024, 06:13:06 am »
Is it possible to hack the two channel DHO-xx2 into an 4 channel DHO-xx4?

Not easily.

The price difference is only 60 bucks, it's certainly not worth doing except as a challenge.
 

Offline RogerG

  • Contributor
  • Posts: 46
  • Country: de
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2787 on: July 09, 2024, 01:27:32 pm »
Hi,

I have a DHO 804 FW version 00.01.02.00.02 and with your explanations I was successful enabling the additional BW (100M), AUTO serial bus (just CAN, no LIN) and the memory extension 25 to 50MPts. Thx !

Just one question... the extended 50MPts option does only work on single CH1, correct?
Because if CH 2, 3 or 4 are working each in single channel mode the menu just shows 25MPts...

Regards
Roger

 

Offline AndyBig

  • Frequent Contributor
  • **
  • Posts: 400
  • Country: ru
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2788 on: July 09, 2024, 01:54:03 pm »
Hi,

I have a DHO 804 FW version 00.01.02.00.02 and with your explanations I was successful enabling the additional BW (100M), AUTO serial bus (just CAN, no LIN) and the memory extension 25 to 50MPts. Thx !

Just one question... the extended 50MPts option does only work on single CH1, correct?
Because if CH 2, 3 or 4 are working each in single channel mode the menu just shows 25MPts...

Regards
Roger

If the trigger remains on channel 1, then it eats up memory and sampling frequency as a full-fledged channel. In fact, channel 1 in this case remains fully turned on, it is simply not displayed.
 
The following users thanked this post: RogerG

Offline RogerG

  • Contributor
  • Posts: 46
  • Country: de
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2789 on: July 09, 2024, 02:25:37 pm »
Thx, AndyBig.
Of course, that's the reason for cutting the memory  :palm:.

And thank you very much for your perfect summary in Reply #1507.
This was really a big help for a noob like me  :-+

You and the other cracks here, keep up with your good work  :clap: !
 

Offline DerekA

  • Contributor
  • Posts: 12
  • Country: gb
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2790 on: July 09, 2024, 03:09:30 pm »
Hi all. I've just ugraded from my old Modded Hantek (thanks EEV blog) to a DHO814. I was looking forward to some better display etc on my PC monitor so looked at adding the WiFi dongle (TP Link TL-WN725N Ver:3.0) as described on TheRetroChannel YouTube. However it seems Rigol may have blocked this method. When I open up the Android settings on the scope all i get in the WiFi section is a "Disabled" label with a switch next to it. The system won't let me turn it on though, it just flicks it's self back to off again.

It appears I'm on the latest version of the Firmware: v01.02.00.02.

Am I missing something? Has anyone else found this to be the case? Anyone have a solution?


Thanks in advance all.
« Last Edit: July 09, 2024, 03:26:19 pm by DerekA »
Thanks Y'all.
 

Offline shapirus

  • Super Contributor
  • ***
  • Posts: 1625
  • Country: ua
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2791 on: July 09, 2024, 03:15:36 pm »
Hi all. I've just ugraded from my old Modded Hantek (thanks EEV blog) to a DHO814. I was looking forward to some better display etc on my PC monitor so looked at adding the WiFi dongle (TP Link TL-WN725N) as described on YouTube. However it seems Rigol may have blocked this method. When I open up the Android settings on the scope all i get in the WiFi section is a "Disabled" label with a switch next to it. The system won't let me turn it on though, it just flicks it's self back to off again.

It appears I'm on the latest version of the Firmware: v01.02.00.02.

Am I missing something? Has anyone else found this to be the case? Anyone have a solution?

Thanks in advance all.
What's the hardware revision of your specific wifi dongle? It's specified somewhere on the box. There were some known not to work (due to a different wifi chip).

The usb vendor id / product id pair might also be different. A known working one is shown by lsusb as:

Code: [Select]
Bus 001 Device 009: ID 0bda:8179 Realtek Semiconductor Corp. RTL8188EUS 802.11n Wireless Network Adapter

Kernel module: rtl8xxxu. You can check if it gets loaded using lsmod.
 

Offline RogerG

  • Contributor
  • Posts: 46
  • Country: de
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2792 on: July 09, 2024, 03:23:09 pm »
Revision 2.0 and 3.0 both US and EU should work perfectly.
 
The following users thanked this post: DerekA

Offline DerekA

  • Contributor
  • Posts: 12
  • Country: gb
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2793 on: July 09, 2024, 03:28:59 pm »
Hi all. I've just ugraded from my old Modded Hantek (thanks EEV blog) to a DHO814. I was looking forward to some better display etc on my PC monitor so looked at adding the WiFi dongle (TP Link TL-WN725N) as described on YouTube. However it seems Rigol may have blocked this method. When I open up the Android settings on the scope all i get in the WiFi section is a "Disabled" label with a switch next to it. The system won't let me turn it on though, it just flicks it's self back to off again.

It appears I'm on the latest version of the Firmware: v01.02.00.02.

Am I missing something? Has anyone else found this to be the case? Anyone have a solution?

Thanks in advance all.
What's the hardware revision of your specific wifi dongle? It's specified somewhere on the box. There were some known not to work (due to a different wifi chip).

The usb vendor id / product id pair might also be different. A known working one is shown by lsusb as:

Code: [Select]
Bus 001 Device 009: ID 0bda:8179 Realtek Semiconductor Corp. RTL8188EUS 802.11n Wireless Network Adapter

Kernel module: rtl8xxxu. You can check if it gets loaded using lsmod.

I have the Version 3.0. which checks out to be RTL8188EU 802.11n in Device Manager on the PC.

Brand new to this scope so have no clue what you are refering to in the code line you gave. What's lsmod?

Thanks
« Last Edit: July 09, 2024, 03:31:30 pm by DerekA »
Thanks Y'all.
 

Online Fungus

  • Super Contributor
  • ***
  • Posts: 17229
  • Country: 00
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2794 on: July 09, 2024, 03:38:48 pm »
What's lsmod?

It's a Linux command.

https://en.wikipedia.org/wiki/Lsmod

do

Code: [Select]
adb shell lsmod
also

Code: [Select]
adb shell lsusb
to see your usb devices
 

Offline DerekA

  • Contributor
  • Posts: 12
  • Country: gb
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2795 on: July 09, 2024, 03:50:38 pm »
What's lsmod?

It's a Linux command.

https://en.wikipedia.org/wiki/Lsmod

do

Code: [Select]
adb shell lsmod
also

Code: [Select]
adb shell lsusb
to see your usb devices

Hi again. I have no clue on using adb as yet, not had time to look into it.

Am I correct that this is what I need? https://developer.android.com/tools/releases/platform-tools

Or do I have to install the whole Android Studio suite? And can you point me in the right direction for info on how to use it to connect to the scope. I', guessing I may find this on TheRetroChannel...

Thanks for the pointers!
Thanks Y'all.
 

Online Fungus

  • Super Contributor
  • ***
  • Posts: 17229
  • Country: 00
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2796 on: July 09, 2024, 04:05:20 pm »
Hi again. I have no clue on using adb as yet, not had time to look into it.

Am I correct that this is what I need? https://developer.android.com/tools/releases/platform-tools

Yes.

Or do I have to install the whole Android Studio suite?

No.

And can you point me in the right direction for info on how to use it to connect to the scope. I', guessing I may find this on TheRetroChannel...

Maybe EEVBLOG forums...?

eg. This entire thread is about people hacking their 'scopes with ADB.
 

Offline DerekA

  • Contributor
  • Posts: 12
  • Country: gb
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2797 on: July 09, 2024, 04:10:38 pm »
Maybe EEVBLOG forums...?

eg. This entire thread is about people hacking their 'scopes with ADB.

LOL. Message recieved. I'll do some research over the next few days and get back with my results.

Thank you.
Thanks Y'all.
 

Offline Vovas

  • Newbie
  • Posts: 5
  • Country: ru
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2798 on: July 10, 2024, 06:30:25 pm »
Where can I get a generator board for our oscilloscope?
« Last Edit: July 10, 2024, 06:32:37 pm by Vovas »
 

Online Fungus

  • Super Contributor
  • ***
  • Posts: 17229
  • Country: 00
Re: Hacking the Rigol DHO800/900 Scope
« Reply #2799 on: July 10, 2024, 10:50:22 pm »
Where can I get a generator board for our oscilloscope?

What do you want to generate?
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf