Hacking the Rigol MSO5000 series oscilloscopes

[Retired2]

BTO Thanks for the suggested model numbers. What I will try is setting a baseline and store the screen images.
I will start with the highest model and work downward. I am not sure when all that will be completed but I will post results ASAP.

[tv84]

This thread has gone haywire...   

I said and repeat the scope can't do 500 MHz or else Rigol would have launched the 5504 as it's a model reference embedded in the FW. It almost reached the 500 MHz but fell short and, most probably, that's why only the 350 MHz model is their biggest model. You can manually (de)solder HW to improve the BW limit but you'll have other downsides. This has been done.

Besides that 5504 model, the app doesn't accept any other model as it wasn't considered by the developers.

Stop this 5504 BS as the 350MHz model  already allows BW up to near 500 MHz.

[BTO]

BTO Thanks for the suggested model numbers. What I will try is setting a baseline and store the screen images.
I will start with the highest model and work downward. I am not sure when all that will be completed but I will post results ASAP.

No problem, whenever you're ready

[BTO]

This thread has gone haywire...   

I said and repeat the scope can't do 500 MHz or else Rigol would have launched the 5504 as it's a model reference embedded in the FW. It almost reached the 500 MHz but fell short and, most probably, that's why only the 350 MHz model is their biggest model. You can manually (de)solder HW to improve the BW limit but you'll have other downsides. This has been done.

Besides that 5504 model, the app doesn't accept any other model as it wasn't considered by the developers.

Stop this 5504 BS as the 350MHz model  already allows BW up to near 500 MHz.

I said and repeat the scope can't do 500 MHz

Sure,... and yet people have posted screenshots that it can and i have confirmed that mine has gone to 470MHz,
which technically isn't 500MHz, but you get the point.

But you have to admit it is curious how some people who have not upgrade to the 500MHz option and have simply run the script to get to 350MHz
and even others that have bought the scope factory standard MSO5354  can go up to 500MHz

It almost reached the 500 MHz but fell short

and i can confirm that's the case with my scope.

But hey... What's the harm in trying it out , Worse case scenario is it doesn't work and we all end up with 350MHz or whatever we have now.
in my case, i have 470MHz, others have reported 510MHz and others up to 700MHz
the part i dont' get about all that is... Why isn't it a similar result across all out scopes ?  so let's say it was 700MHz ish
why wouldn't we all be around that mark.

in any case
Having 350Mhz is cool
and having it go up to 470Mhz is even cooler,   I'm happy even if there is no further progression.

[BTO]

This thread has gone haywire...   

I said and repeat the scope can't do 500 MHz or else Rigol would have launched the 5504 as it's a model reference embedded in the FW. It almost reached the 500 MHz but fell short and, most probably, that's why only the 350 MHz model is their biggest model. You can manually (de)solder HW to improve the BW limit but you'll have other downsides. This has been done.

Besides that 5504 model, the app doesn't accept any other model as it wasn't considered by the developers.

Stop this 5504 BS as the 350MHz model  already allows BW up to near 500 MHz.

Stop this 5504 BS as the 350MHz model  already allows BW up to near 500 MHz.

so... you're saying we shouldn't even try and experiment.

Mate, since the 1052e, through the DS2000A and so on up to now.
What have we been doing if not experimenting and trying things out ?

How many along the way have tried something only to realize it wasn't what they thought it was
or they tried something only to have it be a failed attempt ?
it's not B.S.   IT'S LEARNING and there is value in it .

[rpro]

This thread has gone haywire...   

I said and repeat the scope can't do 500 MHz

MSO5354 surely can do 680ps rise times. See attached.

[6SN7WGTB]

Rise time recorded on MSO5000 upgraded, attached.

Presumably BW limited as 0.35/RT = 525MHz in this case. See next post...

[6SN7WGTB]

Fed same 'scope with 100mV RMS from IFR2025, and -3dB point seemed to be:

[6SN7WGTB]

TWO ISSUES I do have:

1. I cannot log in via WebControl or VNC. It seems to reject UID/pw. These are still shown as admin/rigol(default) in the IO LAN screen. And I can certainly bring up the 'scope on a browser. (And I have never changed them).

EDIT: I have now gained access via realVNC Viewer which does NOT ask for a PW, but macOS Screen Sharing (which I thought was a VNC viewer) does.

2. The 'scope stalls at the end of boot up (progress bar a fraction off of complete) if I try to boot using 'Last' values when I have a Custom Setup. I have to Reboot, use Single-Single-Single and Restore Defaults. I can then reload the same setup without issue, so the 'stp' file clearly isn't completely invalid.

Any ideas please? I would REALLY like to get remote Screen/Control working again. It used to...

[BTO]

TWO ISSUES I do have:

1. I cannot log in via WebControl or VNC. It seems to reject UID/pw. These are still shown as admin/rigol(default) in the IO LAN screen. And I can certainly bring up the 'scope on a browser. (And I have never changed them).

EDIT: I have now gained access via realVNC Viewer which does NOT ask for a PW, but macOS Screen Sharing (which I thought was a VNC viewer) does.

2. The 'scope stalls at the end of boot up (progress bar a fraction off of complete) if I try to boot using 'Last' values when I have a Custom Setup. I have to Reboot, use Single-Single-Single and Restore Defaults. I can then reload the same setup without issue, so the 'stp' file clearly isn't completely invalid.

Any ideas please? I would REALLY like to get remote Screen/Control working again. It used to...

1. WebControl is largely crap compared to VNC Viewer
    Note that VNC Viewer starts to take effect ONLY from version 1.3.2.2 onwards .

2. The script has the ability for you to reset your WebControl password within the scope,   a few people have had this error as well, it's not hard to reset the password. although given that you can use VNC i can't see why you would.

3. Re the reload thing... Try dropping down a firmware version to 1.3.2.2 and then do a self cal and then upgrade to 1.3.3.0 and then do Self Cal again
    and see if it still happens, if it does, Contact Rigol and get them to give you a properly working scope.
   As for .stp files, i use them all the time,   i've had no problem with them

Does that help at all

[6SN7WGTB]

Always prefer to have things 'working' but I can live with VNCViewer.

When I get a moment I will try your suggestion re downgrade/upgrade. Or maybe I'll just delete the .stp and try again first before dicking about.

[BTO]

Always prefer to have things 'working' but I can live with VNCViewer.

When I get a moment I will try your suggestion re downgrade/upgrade. Or maybe I'll just delete the .stp and try again first before dicking about.

Always prefer to have things 'working' but I can live with VNCViewer.

I Absolutely understand. Personally i think VNC is the superior option. But if you also want webcontrol, Just use the script to Change the password within the scope.
Previously it was done with SSH Manually, the script can now do it for you.
and that's all there is to that.

Or maybe I'll just delete the .stp and try again first before dicking abou

Sure... So you think the setup file is corrupted ?
OK, but just remember this, Waveform files , Setup Files , Screensaver files.... These are all independent of the scope.
The .stp File is just a settings file so logically if some weird ass setting is causing weird problems you can just restore the scope to defaults.
if that's not working, Drop a firmware version and the try the setup file saving again, and if it works, get yourself back to the current version

As for Dicking around.   Considering it's just a firmware version drop,  You're not really dicking around,
At least no more than you did to get your scope unlocked.

and if you've defaulted the scope, dropped Firmware version, deleted the .stp and upgrade firmware and still no luck.
then you have a hardware fault and you need to return it to rigol for repairs

[6SN7WGTB]

I Absolutely understand. Personally i think VNC is the superior option. But if you also want webcontrol, Just use the script to Change the password within the scope.
Previously it was done with SSH Manually, the script can now do it for you.
and that's all there is to that.

I did look at the script, but as have little idea about Python, do not know what I need to do to edit the UID/PW?

[BTO]

I Absolutely understand. Personally i think VNC is the superior option. But if you also want webcontrol, Just use the script to Change the password within the scope.
Previously it was done with SSH Manually, the script can now do it for you.
and that's all there is to that.

I did look at the script, but as have little idea about Python, do not know what I need to do to edit the UID/PW?

OK no problems, i understand
let me get back to you with clear instructions, ok

so Just to confirm, All you're trying to do is get into Web Control, But you can't because you don't know the scope password for it.... is that correct ?

[BTO]

I Absolutely understand. Personally i think VNC is the superior option. But if you also want webcontrol, Just use the script to Change the password within the scope.
Previously it was done with SSH Manually, the script can now do it for you.
and that's all there is to that.

I did look at the script, but as have little idea about Python, do not know what I need to do to edit the UID/PW?

OK I GOT IT FOR YOU.....
In this forum subject...
Go to page 59  (it might be different depending on your settings)  In any case
Read from
Post # 2925 to
Post #2931

The Script you need is attached,  Everything is there in a step by step format and it has already worked.
Let me know if you need help through it.
Also if you are struggling, i'm happy to get on zoom or skype with you and get it sorted for you.

Let me know how you go

[BTO]

I Absolutely understand. Personally i think VNC is the superior option. But if you also want webcontrol, Just use the script to Change the password within the scope.
Previously it was done with SSH Manually, the script can now do it for you.
and that's all there is to that.

I did look at the script, but as have little idea about Python, do not know what I need to do to edit the UID/PW?

Just checking in....  How did you go with those last instructions

[6SN7WGTB]

Thanks for asking. Decided to leave as is, esp. as have VNC working fine.

[BTO]

I'm just gonna chime in with something here
MY SCOPE , MSO5074 , WAS UPGRADED TO 350MHz.
THEN.. UPGRADED TO 500MHz.

A few things were noticed

1. Timebase can now go as fast as 500ps  (After Upgrade to 500MHz)
2. Utility / System /About will show Model Number to be MSO5504 (Max Bandwidth 500M)  (After Upgrade to 500MHz)

Now, it was proposed that changing the model number is merely cosmetic and does not reflect a true support for 500Mhz.   ... Fair Enough
However others have provided screenshots that they do.

BUT NOW I NOTICED 2 MORE THINGS

3. When my scope was stock standard and i went to   Display / More / Color Grade = ON  .
Color Grade used to be Firetrucked !  it was slow as buggery and really not worth using and then even more so
when you go to the highest mem depth and Hi resolution acquisition mode

COLOR MODE NOW WORKS LIKE A CHAMP, Lowest Time Base, Highest Time base,  doesn't matter,
Crank up the Acquistion , Crank up the Mem Depth... Still works perfectly.
so, this is awesome

4. I accidentally stumbled upon this yesterday when teaching a mate to use his DS1054z .
I got myself into CH 1 / MORE / LABEL /
- DISPLAY (Turn it on)
- LABEL (Set to CH 1)
- INFO (Turn on BANDWIDTH)

Now i noticed (as per the photos attached)  the bandwidth is now saying 500M (500 MHz)
when i upgraded it , it was showing 350M

This setting reflects the Actual Bandwidth in use and it's saying 500MHz

TO TEST THIS
Go to CH1 / BW LIMIT
it's currently OFF
- Set it to 20M  and the Label will reflect 20MHz
- Set it to 200M and the Label will reflect 200MHz
- Now turn it off , and it will Reflect the current 500MHz

so yeah, i'm calling that confirmed.
and it also lines up with what others have said.

More pictures in next post

[BTO]

PICTURES CONTINUED HERE

[BTO]

Thanks for asking. Decided to leave as is, esp. as have VNC working fine.

No problem,
DO ME A FAVOUR if you could... in the interest of figuring this out.
In light of my recent post

I'm assuming your scope is still on 350MHz right and you didn't upgrade it to 500Mhz.

I'd like to see what your scope says.

1. Go to  UTILITY / SYSTEM ABOUT
What's the Model Number ?
What's the stated Bandwidth ?

2. Go to CH 1 / MORE / LABEL
- Turn Display ON
- Ensure Label says  CH 1
- Go to INFO and turn ON (BANDWIDTH)
Confirm that it's showing on the left of your trace line

What is the stated bandwidth ?  is it 350M ?

3. Go to CH 1 / BW LIMIT
it should be OFF

- Turn it on to 20M
Does the label on the trace line reflect 20M ?

- Turn it on to 200M , Does the trace line reflect 200M ?

- Now turn it OFF
Does the trace line reflect 350M or Higher ?

LAST ONE

Use your Gen 1, Turn on a Sine Wave ,
Frequency - 1MHz
Amplitude   - 1V

Go to Settings  at the bottom
Type - MODULATION  (Turn this on)
Type -  AM
Waveform - SINE
Frequency - 1KHz

Now, have a play with it and see how responsive it is when you start at 500ps or whatever is the faster that you have.
and then dial it down to around say 500ms

Now
go to ACQUIRE
Acquistion -  HIGH RESOLUTION
Mem Depth - 200

Do it again fastest to slow (500ms)
Do you notice a difference or no difference ?

Now i'd like to test color Grade
DISPLAY / MORE / COLOR GRADE - ON
Now do the same thing again and please let me know when you change the time base
from the fastest to 500ms  Are you seeing any noticeable difference ?

Because when i was on 350MHz , updated with the script, i noticed ANY TIME i turned on Color Grade on a slow time base and cranked up the High Resolution and Deep Memory.  it would drag it's bum, so i resolved to not using
color grade

Now that i upgraded to 500Mhz it's running like a champ.

Thanks ahead of time, i would absolutely love to know the results of this
Sorry to be a bother.

[BTO]

Forgot these 2 Pictures

[6SN7WGTB]

Thanks for asking. Decided to leave as is, esp. as have VNC working fine.

No problem,
DO ME A FAVOUR if you could... in the interest of figuring this out.
In light of my recent post

I'm assuming your scope is still on 350MHz right and you didn't upgrade it to 500Mhz.correct

I'd like to see what your scope says.

1. Go to  UTILITY / SYSTEM ABOUT
What's the Model Number ? MSO5104
What's the stated Bandwidth ? Max BW:350M




2. Go to CH 1 / MORE / LABEL
- Turn Display ON
- Ensure Label says  CH 1
- Go to INFO and turn ON (BANDWIDTH)
Confirm that it's showing on the left of your trace line

What is the stated bandwidth ?  is it 350M ? CH1BW:350M

3. Go to CH 1 / BW LIMIT
it should be OFF

- Turn it on to 20M
Does the label on the trace line reflect 20M ? Yes

- Turn it on to 200M , Does the trace line reflect 200M ? yes

- Now turn it OFF
Does the trace line reflect 350M or Higher ? 350M

LAST ONE

Use your Gen 1, Turn on a Sine Wave ,
Frequency - 1MHz
Amplitude   - 1V

Go to Settings  at the bottom
Type - MODULATION  (Turn this on)
Type -  AM
Waveform - SINE
Frequency - 1KHz

Now, have a play with it and see how responsive it is when you start at 500ps or whatever is the faster that you have.
and then dial it down to around say 500ms

Now
go to ACQUIRE
Acquistion -  HIGH RESOLUTION
Mem Depth - 200

Do it again fastest to slow (500ms)
Do you notice a difference or no difference ? not obvious, possibly slower with 200Mpts

Now i'd like to test color Grade
DISPLAY / MORE / COLOR GRADE - ON
Now do the same thing again and please let me know when you change the time base
from the fastest to 500ms  Are you seeing any noticeable difference ? no, could even be slightly more responsive

Because when i was on 350MHz , updated with the script, i noticed ANY TIME i turned on Color Grade on a slow time base and cranked up the High Resolution and Deep Memory.  it would drag it's bum, so i resolved to not using
color grade

Now that i upgraded to 500Mhz it's running like a champ.

Thanks ahead of time, i would absolutely love to know the results of this
Sorry to be a bother.

[6SN7WGTB]

Assume you have 50Ω output set, given your amplitude is half?

[BTO]

Thanks for asking. Decided to leave as is, esp. as have VNC working fine.

No problem,
DO ME A FAVOUR if you could... in the interest of figuring this out.
In light of my recent post

I'm assuming your scope is still on 350MHz right and you didn't upgrade it to 500Mhz.correct

I'd like to see what your scope says.

1. Go to  UTILITY / SYSTEM ABOUT
What's the Model Number ? MSO5104
What's the stated Bandwidth ? Max BW:350M




2. Go to CH 1 / MORE / LABEL
- Turn Display ON
- Ensure Label says  CH 1
- Go to INFO and turn ON (BANDWIDTH)
Confirm that it's showing on the left of your trace line

What is the stated bandwidth ?  is it 350M ? CH1BW:350M

3. Go to CH 1 / BW LIMIT
it should be OFF

- Turn it on to 20M
Does the label on the trace line reflect 20M ? Yes

- Turn it on to 200M , Does the trace line reflect 200M ? yes

- Now turn it OFF
Does the trace line reflect 350M or Higher ? 350M

LAST ONE

Use your Gen 1, Turn on a Sine Wave ,
Frequency - 1MHz
Amplitude   - 1V

Go to Settings  at the bottom
Type - MODULATION  (Turn this on)
Type -  AM
Waveform - SINE
Frequency - 1KHz

Now, have a play with it and see how responsive it is when you start at 500ps or whatever is the faster that you have.
and then dial it down to around say 500ms

Now
go to ACQUIRE
Acquistion -  HIGH RESOLUTION
Mem Depth - 200

Do it again fastest to slow (500ms)
Do you notice a difference or no difference ? not obvious, possibly slower with 200Mpts

Now i'd like to test color Grade
DISPLAY / MORE / COLOR GRADE - ON
Now do the same thing again and please let me know when you change the time base
from the fastest to 500ms  Are you seeing any noticeable difference ? no, could even be slightly more responsive

Because when i was on 350MHz , updated with the script, i noticed ANY TIME i turned on Color Grade on a slow time base and cranked up the High Resolution and Deep Memory.  it would drag it's bum, so i resolved to not using
color grade

Now that i upgraded to 500Mhz it's running like a champ.

Thanks ahead of time, i would absolutely love to know the results of this
Sorry to be a bother.

Thanks for that, That's interesting...
So as i suspected you've got 350MHz
and when selecting High Res and 200Mpts  IT DOES SLOW DOWN (that's what happened to me as well on 350MHz)
However you're saying that you're not getting any lag when Color Grade is on, ... That's weird.
My scope slowed down to a painful crawl 

Oh well, thanks for that, i'm gonna ask around a little and see how many others on 350MHz are experiencing
what results.

Anyway, Enjoy your scope mate
thanks for the information

[exider]

Hi
I've upgraded to 500Mhz (changed model to 5504) but I got a problem.

The scope is MSO5074. It came with everything unlocked (got the bundle).
I upgraded to 350Mhz and everything worked fine.
After the model change (5504), the time base goes down to 500ps but the SigGen 1 and 2 stopped working.  Also traces on channels 3 and 4 are missing.

I used rigol_mso_util_2.13b.py. I've tried twice and got same errors at the end of the procedure:

Code: [Select]

python3 rigol_mso_util_2.13b.py --regen 192.168.1.8
╒═════════╤═══════════════╤════════════════╤═══════════════════╤═════════════╕
│ Model   │ Serial        │ Version        │ MAC               │ Lic Model   │
╞═════════╪═══════════════╪════════════════╪═══════════════════╪═════════════╡
│ MSO5504 │ XXXXXXXXX │ 00.01.03.03.00 │ 00-19-XXXXXXXX │ MSO5000     │
╘═════════╧═══════════════╧════════════════╧═══════════════════╧═════════════╛
╒════════╤══════════╤═════════════════════════════════════════════════════╕
│ Code   │ Status   │ Description                                         │
╞════════╪══════════╪═════════════════════════════════════════════════════╡
│ 2RL    │ Forever  │ 200Mpts Deep Memory Option                          │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ COMP   │ Forever  │ Computer Serial Triggering and Analysis(RS232/UART) │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ EMBD   │ Forever  │ Embedded Serial Triggering and Analysis(IIC, SPI)   │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AUTO   │ Forever  │ Automotive Serial Triggering and Analysis(CAN/LIN)  │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ FLEX   │ Forever  │ FlexRay Serial Triggering and Analysis              │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AUDIO  │ Forever  │ Audio Serial Triggering and Analysis(I2S)           │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AERO   │ Forever  │ MIL-STD 1553 Serial Triggering and Analysis         │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ DG     │ Forever  │ Dual Channel WaveGen 25 MHz AWG                     │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ PWR    │ Forever  │ Integrated Power Analysis                           │
╘════════╧══════════╧═════════════════════════════════════════════════════╛
checking /rigol/tools/fram ...done!
Saved priv.pem to 'priv.pem'
Reading FRAM data ...done!
System Setup                                                                                                                                                   
  Language: E
  LoadLast: 0
  PowerStatus: 1
  Cycle count: 98
  Keep Imp: 1
  IPmode: 0
Activation XXTEA key [039200010841084118C3210431XXXXXX]
Patching FRAM binary....done!
Rebooting device...Waiting for device to be back online.....................................................................done!                               
Activating 4CH...failed!
Activating 5RL...failed!
Activating ARINC...failed!
Activating AWG...failed!
Activating BND...failed!
Activating BW07T1...failed!
Activating BW07T2...failed!
Activating BW07T3...failed!
Activating BW07T5...failed!
Activating BW10T20...failed!
Activating BW10T30...failed!
Activating BW15T25...failed!
Activating BW15T35...failed!
Activating BW1T2...failed!
Activating BW1T3...failed!
Activating BW1T5...failed!
Activating BW20T30...failed!
Activating BW25T35...failed!
Activating BW2T3...failed!
Activating BW2T5...failed!
Activating BW3T5...failed!
Activating BW6T10...failed!
Activating BW6T20...failed!
Activating BW6T30...failed!
Activating CTR...failed!
Activating DVM...failed!
Activating JITTER...failed!
Activating MASK...failed!
Activating MSO...failed!
Activating SENSOR...failed!
╒════════╤══════════╤═════════════════════════════════════════════════════╕
│ Code   │ Status   │ Description                                         │
╞════════╪══════════╪═════════════════════════════════════════════════════╡
│ 2RL    │ Forever  │ 200Mpts Deep Memory Option                          │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ COMP   │ Forever  │ Computer Serial Triggering and Analysis(RS232/UART) │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ EMBD   │ Forever  │ Embedded Serial Triggering and Analysis(IIC, SPI)   │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AUTO   │ Forever  │ Automotive Serial Triggering and Analysis(CAN/LIN)  │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ FLEX   │ Forever  │ FlexRay Serial Triggering and Analysis              │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AUDIO  │ Forever  │ Audio Serial Triggering and Analysis(I2S)           │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AERO   │ Forever  │ MIL-STD 1553 Serial Triggering and Analysis         │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ DG     │ Forever  │ Dual Channel WaveGen 25 MHz AWG                     │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ PWR    │ Forever  │ Integrated Power Analysis                           │
╘════════╧══════════╧═════════════════════════════════════════════════════╛
[/size]

Should I try to revert the model to 5354?
Would appreciate any help.

P.S. Tried again, recalibrated again, and it seems the issues disappeared. Will have to check the rest of the scope functions, but for now the SigGen is back.