Hacking the Rigol MSO5000 series oscilloscopes

[Fungus]

30A989AFC82C0A21139573591DE4E5FF37994F7D1506A9ACF2B5997005C2649F

Without any evidence of a hack, the people claiming it are losing face ( 丢脸 ) very quickly.   

Yes, it's been, what, a whole 12 hours now?

I agree that if you're not going to publish then just keep your mouth shut but they might just be in bed or something.

I dont' have a scope yet ( get it in Jan ), and when i do, i'll be keen to see how the hacks work, but if i use the features, i'll just be doign the boring thing and paying for it.  ( because thats the right thing to do ).

If you're going to spend that much you should probably buy the R&S, not Rigol. 

[TK]

did you notice what seemed to be the Build date of the firmware (top right of the screen)?  December 6... very strange... maybe it was someone from Rigol or a rogue employee

[tv84]

That's the current hour/date in the scope.

[timgiles]

Well anyone who has watched the latest episode of SouthPark can see there are some on this forum that have lost the ability to have patience - too much getting used to amazon next day ordering!

Let those working on it work. Rigol will do or not do - now and in the future. If they change their approach to all firmware, prehaps other workarounds will be found. Prehaps Rigol really is seeing this as a chance to capture several market slices - business with paid for licences and home hackers. We know it costs the same if it has a 200Mhz, 1Ghz (?) or 70Mhz label on it - so it can only be good for Riogl. Business, universities - are unlikely to hack.

Time will tell.

[TopLoser]

That's the current hour/date in the scope.

No, it said ‘Build date’ on the photo

[tv84]

That's the current hour/date in the scope.

No, it said ‘Build date’ on the photo

Good point.

But I went to "wayback machine" to have a look at the images from Dave's+chinese pics and they all have consecutives hours.

The "build" is the time when the "screen dump" was built.

[glenenglish]

If indeed Rigol pursue the market this way, and they monitor these forums, then in the interests of getting these sort of "Expandable" products, I suggest readers posting here to be nice with their comments.

I have  bought a 100 MHz version,  waiting on delivery. I'd like them and the local rep to make some decent margin on this scope, I think having an entry at the low price of the  70 MHz scope that is "Expandable" is canabalizing  their market, IMO they don't really have to go that cheap , unless they really have the cost right down to peanuts. In the west we might think 3x to 4x cost is about the minimum sell price for pro gear, but these guys often work on maybe 1.2 to 1.5x and it is just a numbers game.

Rigol's competition  are responsible for bringing high performance low cost scopes from all the A class manufacturers. It's the reason I support AMD with their Ryzen , and have all my systems here now Ryzen. (even though I can afford any processor I want) - they are responsible for holding Intel to account and providing some innovation in that market segment.
 

[Fungus]

If indeed Rigol pursue the market this way, and they monitor these forums...

They've been doing it that way for quite a while:

[Fungus]

One question: If this thing runs Linux and has a shell account then can it run batch files, etc?

What's installed in the system? Is there a C compiler?

Can you upload executable files and get it to do new things that way?

[nctnico]

One question: If this thing runs Linux and has a shell account then can it run batch files, etc?

What's installed in the system? Is there a C compiler?

Can you upload executable files and get it to do new things that way?

Forum member RHB is having a long term plan for something like that. A lot of scopes run on the Zync platform nowadays so except for the ADCs and display size many oscilloscopes are practically identical. Don't get excited yet because writing firmware for an oscilloscope is a massive task but once there is a core feature set then it shouldn't be hard to port it to different hardware platforms.

[mrpackethead]

So “hypothetically” if a hack existed that took a 70mhz model to 350 what would the preference here be?  Share it? Hide it? Wait six months?

Another party ( not the rgwan lot ) has claimed they have enabled 350 and has said it’s reasonably trivial. They are unsure of what to do.  It’s entirely for educational purposes only and if you need 350m then you should buy the license.  This is however a very interesting thing if you are interested in the security of embedded systems

[rgwan]

Well thats really strange. They said that it is trival. So, how about you to ask them for the reason why they dont choose to release it now?

Btw, you have said that you re interested in embedded system security, why do you dont analyze firmware yourself? The process of analysing is more fun than the answer. So, dont hesitate to wait our answer anymore. Try to find your own! LOL

 

[maginnovision]

Well thats really strange. They said that it is trival. So, how about you to ask them for the reason why they dont choose to release it now?

Btw, you have said that you re interested in embedded system security, why do you dont analyze firmware yourself? The process of analysing is more fun than the answer. So, dont hesitate to wait our answer anymore. Try to find your own! LOL

They may have done something different than you from the sounds of it. No mention of unlocking the rest of the options just the bandwidth.

[Rerouter]

Walking through the firmware behind the devices can be an interesting way to spend a rainy afternoon, I never would have assumed my Siglent was full of unicorn's and pikachu's

[tv84]

The Christmas gift for all Rigol fans out here:

Go to /rigol/shell/start.sh

and add the "-fullopt" to the command line that executes appEntry (before the &).

PS: And it's not an hack. It's a feature!

[Fungus]

Do these things come with a text editor? Vim? 

[TopLoser]

The Christmas gift for all Rigol fans out here:

Go to /rigol/shell/start.sh

and add the "-fullopt" to the command line that executes appEntry (before the &).

PS: And it's not an hack. It's a feature!

How odd! That was remarkably easy to do...

No change to the 'Option list' but lots of options are now enabled...

Nice to have the 2 sig gens working, that's easy to test.
200M memory depth works
Power analysis is available

I'd be interested to know what the bandwidth was now... Off to find a decent signal generator under my desk...

[Fungus]

How odd! That was remarkably easy to do...

Disappointed? You wanted more of a fight...? 

If the bandwidth has changed to 350Mhz then nobody else is going to be selling oscilloscopes to hobbyists in the next few years.

[RobBarter]

Would be interested to find out if this also turns a 2 channel into 4 channel.  I assume the same technique would work on a MSO7000?

[commongrounder]

Would be interested to find out if this also turns a 2 channel into 4 channel.  I assume the same technique would work on a MSO7000?

Was also thinking the same thing, although, for the US$99.00 difference, you get the two additional 350 MHz probes. That’s assuming they perform well for the price.

[TopLoser]

Can’t say if it turns a 2 channel into a 4 channel, mine is the 5074. I paid the extra 90 euros for a 4 channel as that way I got warranty on all 4 channels and an extra couple of probes. I would imagine it enables 4 channels though, can’t see why it wouldn’t.

Anybody with  a 7000 series can give it a go, it’s a very simple process.

[commongrounder]

Can’t say if it turns a 2 channel into a 4 channel, mine is the 5074. I paid the extra 90 euros for a 4 channel as that way I got warranty on all 4 channels and an extra couple of probes. I would imagine it enables 4 channels though, can’t see why it wouldn’t.

Anybody with  a 7000 series can give it a go, it’s a very simple process.

I don’t think there are any two-channel 7000 series scopes. The base model is the 7014 four channel.

[TopLoser]

The software options were of more interest, and the AWGs. Plus the extra bandwidth of course.

[TopLoser]

Ok, all I can find is a crappy 160MHz generator.

Two screen captures attached, one before 'enhancement', one after.  Note that the fastest timebase has changed from 5ns/div to 1ns/div - that must be a clue something is going on! Signal voltage shows less attenuation after 'enhancement'.

Also note the appearance of the 2 sig gen buttons on the bottom of the screen.

[TK]

The Christmas gift for all Rigol fans out here:

Go to /rigol/shell/start.sh

and add the "-fullopt" to the command line that executes appEntry (before the &).

PS: And it's not an hack. It's a feature!

Does the license screen show the options as PERMANENT or maybe it is a 30-day demo activation?