Hacking the Rigol MSO5000 series oscilloscopes

[BTO]

So to be clear
1. You're not even going to address anything
2. You're not even going to answer the questions that were asked
3. Nor consider what i asked you to consider

No

I'm not sure why you are stirring the pot.
tv84 clearly communicated the two licensing hack options to clear up some misinformation in your earlier posts.
You replied with a lot of long-winded nonsense that I doubt many will read in full (I didn't).

Also.... Quick question (and i'm not starting shit, i'm just asking a question)
You haven't been involved in this,   so .. why have you jumped in all of a sudden ?
What's your motivation to be here... I'm just curious

[dcac]

so... Do you have like a PTSD thing where things need to be kept brief ?  Because call me crazy, but i'm sensing a theme here.

I’m not the guy to report any posts. But can we please just keep comments like this out of this forum... you know... please!

[BTO]

so... Do you have like a PTSD thing where things need to be kept brief ?  Because call me crazy, but i'm sensing a theme here.

I’m not the guy to report any posts. But can we please just keep comments like this out of this forum... you know... please!

Sure, No problem.
this was just my way of asking him why he's wanting to censor me to a word limit,,   this also was not a rude comment.
i think part of the problem here is, that people are jumping to too many conclusions

i also want to get back on topic
i also want everyone to be fair
also notice how the last 2 people haven't responded and all i'm trying to do it fix it up, while getting accused that i did the wrong thing.

but yeah,  I'm happy to oblige your request,
Although understand let's get the other guy to also not censor people on what they want to say and how long it should be

FAIR ENOUGH ?
As i keep saying,   WE NEED TO RESPECT EACH OTHER,   Not try to dominate and control each other
and you don't need to say PLEASE,   Asking is enough,  and i can happily oblige

Now, it seems to me these guys aren't going to respond to my posts
SO.......... IF EVERYONE IS DONE WITH THIS B.S..... I'M HAPPY TO GET BACK ON TRACK WITH THE SUBJECT OF HACKING THE MSO5000


What say you all ?

[Kean]

Also.... Quick question (and i'm not starting shit, i'm just asking a question)
You haven't been involved in this,   so .. why have you jumped in all of a sudden ?
What's your motivation to be here... I'm just curious

Huh?  You are posting in a public forum with hundred if not thousands of people likely to read this.  My motivation was to hopefully make you aware that you were being disrespectful.

You keep on going on about respecting each other, but I didn't spot any significant disrespect from tv84.  I see repeated and clear disrespect in your postings with things like

YOU RESPONDED in a completely useless manner

I can respect your efforts in helping the community and the videos that you produced.  I don't have to respect your rants.

But I will stop there, as I do want us to all get back on track.  I'll wade through you prior posts and if I can answer on-topic questions I may reply further.

[Kean]

OK BTO, I went back and read through your last handful of posts and I didn't spot any clearly formulated on-topic questions.  Maybe I missed them.
While I am not at the skill level of tv84, I am honestly happy to help clear up any technical points that I do understand.

So feel free to re-ask them ... but maybe without the excessive off-topic text... 

[BTO]

Also.... Quick question (and i'm not starting shit, i'm just asking a question)
You haven't been involved in this,   so .. why have you jumped in all of a sudden ?
What's your motivation to be here... I'm just curious

Huh?  You are posting in a public forum with hundred if not thousands of people likely to read this.  My motivation was to hopefully make you aware that you were being disrespectful.

You keep on going on about respecting each other, but I didn't spot any significant disrespect from tv84.  I see repeated and clear disrespect in your postings with things like

YOU RESPONDED in a completely useless manner

I can respect your efforts in helping the community and the videos that you produced.  I don't have to respect your rants.

But I will stop there, as I do want us to all get back on track.  I'll wade through you prior posts and if I can answer on-topic questions I may reply further.

ok well, in the spirit of responding to that briefly , but also getting back on track

Mate.  I wasn't being rude, i said it was a useless comment because it was.
you say you didn't see any rude comments of his........ I DID

but let's put that aside,
Let's address this

"  I'll wade through you prior posts and if I can answer on-topic questions I may reply further."
NO NEED TO WADE
i only really had 2 points prior to all this

In Brief.....
TV84  was saying that the way i was upgrading was not actually licencing the scope but instead bypassing licencing.
My point to that was, .. since the scope said licenced, obviously i drew the conclusion (as anyone would that it was) I just asked for clarification on that


He then suggested that there was a method by another member (Can't remember his name off hand) that does permanently licence the scope.
Question 2 was...
I have a JTAGulator and Arduino boards,  the question was...  Can i use my JTAGULATOR board to execute the process required

and lastly...  My scope is currently unlocked (via patch) on version 1.3.3.0
now. if i wanted to do this process , Given that my scope is currently unlocked and up to current version, is it possible for me to do that
and if so , How (Briefly stated)

those were really the only 3 points i needed addressed

finally (in case it was missed)  he said i didn't bother to read what the other member put in as the process....
Mate, it's not a question of  DIDN'T BOTHER
it's a question of , i had 6 family members and friends recently pass, of them my dad and best friend ok,
so, have i NOT kept up ?   Yes i am guilty of that.
But i reckon i have a pretty good reason.   it's not like i didn't give a shit on purpose .

so, if you want to help,  it would be awesome if you could answer those 3 questions
thanks ahead of time

[BTO]

OK BTO, I went back and read through your last handful of posts and I didn't spot any clearly formulated on-topic questions.  Maybe I missed them.
While I am not at the skill level of tv84, I am honestly happy to help clear up any technical points that I do understand.

So feel free to re-ask them ... but maybe without the excessive off-topic text... 

already have, Read my latest post before this one

[Kean]

TV84  was saying that the way i was upgrading was not actually licencing the scope but instead bypassing licencing.
My point to that was, .. since the scope said licenced, obviously i drew the conclusion (as anyone would that it was) I just asked for clarification on that

He then suggested that there was a method by another member (Can't remember his name off hand) that does permanently licence the scope.

Question 2 was...
I have a JTAGulator and Arduino boards,  the question was...  Can i use my JTAGULATOR board to execute the process required

and lastly...  My scope is currently unlocked (via patch) on version 1.3.3.0
now. if i wanted to do this process , Given that my scope is currently unlocked and up to current version, is it possible for me to do that
and if so , How (Briefly stated)

those were really the only 3 points i needed addressed

OK, I think I can answer those in one hit as they are all related.

The "firmware hack" method of licensing the scope as mostly discussed here, and what I believe you include in your notes and videos modifies the firmware to just bypass certain license code checking and thus enables all licenses.  This means that is it not permanent in the sense that it only applies to the hacked firmware.  If new firmware is flashed via a restore or upgrade then the hack is lost and only saved & valid license keys are active.

The "FRAM hack" script by DrMefistO uses an extracted signing key to generate valid option keys for your MSO5000 serial number and saves them to the scope via direct FRAM access over a scripted SSH connection and also some SCPI commands.  I think I have that correct, but I may have some of the exact details wrong.  I haven't tried it myself.
This script is in post 2739 at https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg5372468/#msg5372468 (and possibly earlier posts)

The comment by tv84 was that it does this in a potentially unsafe way (direct FRAM access) and there is most likely some undocumented SCPI commands to do it more safely.

No need to play around with a JTAGULATOR or Arduino stuff, but if you are at all familiar with Python code then the script is in the above linked post and you are welcome to dive into how it works.

To wrap up, if you reflash or upgrade to stock firmware you will lose your current hack and have only the licensed original options.  You can then try the process by DrMefistO (if you dare) and potentially get permanent keys installed for all options that should continue through future firmware upgrades.  Please report back if you do this and succeed or fail.

already have, Read my latest post before this one

Yeah, you don't really need to respond to every post...

[BTO]

TV84  was saying that the way i was upgrading was not actually licencing the scope but instead bypassing licencing.
My point to that was, .. since the scope said licenced, obviously i drew the conclusion (as anyone would that it was) I just asked for clarification on that

He then suggested that there was a method by another member (Can't remember his name off hand) that does permanently licence the scope.

Question 2 was...
I have a JTAGulator and Arduino boards,  the question was...  Can i use my JTAGULATOR board to execute the process required

and lastly...  My scope is currently unlocked (via patch) on version 1.3.3.0
now. if i wanted to do this process , Given that my scope is currently unlocked and up to current version, is it possible for me to do that
and if so , How (Briefly stated)

those were really the only 3 points i needed addressed

OK, I think I can answer those in one hit as they are all related.

The "firmware hack" method of licensing the scope as mostly discussed here, and what I believe you include in your notes and videos modifies the firmware to just bypass certain license code checking and thus enables all licenses.  This means that is it not permanent in the sense that it only applies to the hacked firmware.  If new firmware is flashed via a restore or upgrade then the hack is lost and only saved & valid license keys are active.

The "FRAM hack" script by DrMefistO uses an extracted signing key (I think, may have the exact details wrong) to generate valid option keys for your MSO5000 serial number and saves them to the scope via direct FRAM access over a scripted SSH connection and also some SCPI commands.
This script is in post 2739 at https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg5372468/#msg5372468 (and possibly earlier posts)

The comment by tv84 was that it does this in a potentially unsafe way (direct FRAM access) and there is most likely some undocumented SCPI commands to do it more safely.

No need to play around with a JTAGULATOR or Arduino stuff, but if you are at all familiar with Python code then the script is in the above linked post and you are welcome to dive into how it works.

To wrap up, if you reflash or upgrade to stock firmware you will lose your current hack and have only the licensed original options.  You can then try the process by DrMefistO (if you dare) and potentially get permanent keys installed for all options that should continue through future firmware upgrades.  Please report back if you do this and success or fail.

already have, Read my latest post before this one

Yeah, you don't really need to respond to every post...

"OK, I think I can answer those in one hit as they are all related."
Cool, Thank you

"The "firmware hack" method of licensing the scope as mostly discussed here, and what I believe you include in your notes and videos modifies the firmware to just bypass certain license code checking and thus enables all licenses.  This means that is it not permanent in the sense that it only applies to the hacked firmware.  If new firmware is flashed via a restore or upgrade then the hack is lost and only saved & valid license keys are active."
OK You seem to be an I.T. Guy, as am i,  so its safe to say we both understand how firmware works when a new version is applied.
OK, so this is understood, Granted it was a bit misleading (of the scope, not the forum) when it said licenced... but ok, we understand each other.

"The "FRAM hack" script by DrMefistO "
That's him, thanks, i dropped his name

"The "FRAM hack" script by DrMefistO uses an extracted signing key (I think, may have the exact details wrong) to generate valid option keys for your MSO5000 serial number and saves them to the scope via direct FRAM access over a scripted SSH connection and also some SCPI commands.
This script is in post 2739 at https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-series-oscilloscopes/msg5372468/#msg5372468 (and possibly earlier posts)"
Right, .. this was the part where i was under the impression where i needed some manner of dev board to extract the key, which is why i brought up Arduino boards and JTAGulator

Also i was asking tV84 , since it's a somewhat unsafe method,    what was the success rate on it, approx.

"No need to play around with a JTAGULATOR or Arduino stuff, but if you are at all familiar with Python code then the script is in the above linked post and you are welcome to dive into how it works."
I'm a hardware guy,  but still. Yes, i'm familiar with Python

"To wrap up, if you reflash or upgrade to stock firmware you will lose your current hack and have only the licensed original options.  You can then try the process by DrMefistO (if you dare)"
Because THAT INSTILLS A LOT OF CONFIDENCE, HUH ?    LOL

" Please report back if you do this and success or fail."
OK,  i'll potentially blow up my scope and take one for the team and report back and let you guys know if i stuffed it  or got lucky,  No probs

Tell me something...
if you know

if i try this process and it doesn't work,  am i still able to revert to the upgrade and patch method if it doesn't work ?

[Kean]

OK You seem to be an I.T. Guy, as am i,  so its safe to say we both understand how firmware works when a new version is applied.

Yes, I'm an IT/embedded systems guy.  I spend about 50% of my time with hands-on electronics, and 50% on firmware or IT (coding/support/architecture/etc).

Also i was asking tV84 , since it's a somewhat unsafe method,    what was the success rate on it, approx.

Not sure if that is known.  At least one person seems to have used it with success if you read the posts following #2739 (user zauberpilz had problems at first in #2742 & 2744, then reported success in #2746)

if i try this process and it doesn't work,  am i still able to revert to the upgrade and patch method if it doesn't work ?

No idea, which is why I included some disclaimers.  I wasn't involved in the development of these, and I've only used the simple firmware hack on mine.

If I ever decide to try it, I would start by reading through the Python code to try my best to understand what it was doing.  I've only scanned the code quickly so far to get a high level overview.

I would also use an SSH session to the scope and make a backup of the FRAM via dd command to a USB drive.  I guess this could be done via direct hardware access to the FRAM chip, but that seems like it could cause more trouble.  There is already a pseudo device available in Linux to access the FRAM.

[Simon]

shall we calm down, don't try to police stuff yourselves because I am not going back pages and pages through what was said.

[thorstormlord]

I used the python way first and it just deleted my pischased add-ons and left the scope as it was originally. The "upgrades" way worked fine but I did dd my scope just to be safe,so I guess I can revert to previous state if something happens. If BTOs way is bypassing licencing then I guess the new firmware will.mwss up the licencing, since I haven't been involved in the process building I can't be sure though.
Will the new firmware go through licence checking when installed ?

[thm_w]

Will the new firmware go through licence checking when installed ?

As explained above, the commonly used hack here is a modification of the files on the scope. Any new firmware upgrade, or downgrade, will rewrite the application and bring the scope back to stock.

The chance of a new firmware release is very low, but its good to know if one is released, not to rush out and install it since you'll lose all your options.

[BTO]

OK You seem to be an I.T. Guy, as am i,  so its safe to say we both understand how firmware works when a new version is applied.

Yes, I'm an IT/embedded systems guy.  I spend about 50% of my time with hands-on electronics, and 50% on firmware or IT (coding/support/architecture/etc).

Also i was asking tV84 , since it's a somewhat unsafe method,    what was the success rate on it, approx.

Not sure if that is known.  At least one person seems to have used it with success if you read the posts following #2739 (user zauberpilz had problems at first in #2742 & 2744, then reported success in #2746)

if i try this process and it doesn't work,  am i still able to revert to the upgrade and patch method if it doesn't work ?

No idea, which is why I included some disclaimers.  I wasn't involved in the development of these, and I've only used the simple firmware hack on mine.

If I ever decide to try it, I would start by reading through the Python code to try my best to understand what it was doing.  I've only scanned the code quickly so far to get a high level overview.

I would also use an SSH session to the scope and make a backup of the FRAM via dd command to a USB drive.  I guess this could be done via direct hardware access to the FRAM chip, but that seems like it could cause more trouble.  There is already a pseudo device available in Linux to access the FRAM.

"Not sure if that is known.  At least one person seems to have used it with success if you read the posts following #2739 (user zauberpilz had problems at first in #2742 & 2744, then reported success in #2746)"

I plan to go through that, thanks

"No idea, which is why I included some disclaimers"

Understood,  Thanks

[BTO]

shall we calm down, don't try to police stuff yourselves because I am not going back pages and pages through what was said.

i believe everyone is calm, We've all moved forward, that topic is now over.
i was just asking for a bit of courtesy and respect, the others , it seems have ceased the conversation, and we have returned to the original
topic, so it's all cool

If you feel that you want to delete that part of the conversation for the sake of contiuity, (Speaking only for myself) You have my blessing
to do so, i'm cool with that.
In any case, that issue is no longer an issue. we've moved on

[BTO]

I used the python way first and it just deleted my pischased add-ons and left the scope as it was originally. The "upgrades" way worked fine but I did dd my scope just to be safe,so I guess I can revert to previous state if something happens. If BTOs way is bypassing licencing then I guess the new firmware will.mwss up the licencing, since I haven't been involved in the process building I can't be sure though.
Will the new firmware go through licence checking when installed ?

No.. From what i can gather, he is saying  or (they) are saying that when the new firmware comes out we'll have to patch it again.
They are saying that when new firmware is installed the patch won't be preserved and the current patch doesn't permanently licence the scope
but instead just applies a patch, sort of .. to trick the scope i suppose.

I'll have a read through the notes and see if i can get that SSH Method to work

i suppose this then makes me wonder, why is the MSO5000 process different to the DS2000A.
if i remember... With the DS1052E there was a pre shared key that we just had to enter
then with the DS2000A series that key had to be generated by using your serial number, Initially it was a manual process than a forum
contributor attached a piece of software that combined all the steps and made it easier, which basically installed the drivers
and did the process more or less automatically, so essentially A LEGITIMATE LICENCE WAS GENERATED AND STORED.

Now i was under the understand that Part of the job that the patch did was exactly that.
Step 1 is the back,,  that makes sense
Step 2 is the upgrade, that makese sense
Step 3 is the patch,    I guess we have now learned that the patch doesn't licence the stop but applies a temporary (Current version only)
licence and unlock.

Oh well, i guess i'll try the SSH road (perhaps) and see what happens.  However, i will first read through all the notes and examine the code
to see what's what

[BTO]

Will the new firmware go through licence checking when installed ?

The chance of a new firmware release is very low, but its good to know if one is released, not to rush out and install it since you'll lose all your options.

Not really. I can at least guarantee you 1 more future version as i'm talking to rigol at the moment on fixing a few things with the scope
that can only be fixed in firmware updates. and they have agreed they are taking these matters seriously, but have also stated they don't
know exactly when a new firmware version will be released, However they did say they do want to fix these things.
so.. there will be another coming at the least

[normi]

I think we ended up in this patch method of hacking the scope because there was a rush to unlock the scope and that was the first method that worked. I assume that there may be license key hacks out there which have not been released, not sure why the secrecy  but we need a permanent fix so that persons do not have to wait on someone to create a new patch each time a new firmware is released.

As it relates to Rigol and firmware, they are very slow with that so I would not expect anything soon.  I had an experience with support in the past where I complained about the X-Y feature which had a major flaw, and they offered me a firmware that fixed the issue. I thought a new firmware would soon be announced with the fix but it took 9 months before they released the fix, I had to create my own patch since the firmware I had was not released. You can asked them if they have any unreleased firmware which they can give customers.

[BTO]

I think we ended up in this patch method of hacking the scope because there was a rush to unlock the scope and that was the first method that worked. I assume that there may be license key hacks out there which have not been released, not sure why the secrecy  but we need a permanent fix so that persons do not have to wait on someone to create a new patch each time a new firmware is released.

As it relates to Rigol and firmware, they are very slow with that so I would not expect anything soon.  I had an experience with support in the past where I complained about the X-Y feature which had a major flaw, and they offered me a firmware that fixed the issue. I thought a new firmware would soon be announced with the fix but it took 9 months before they released the fix, I had to create my own patch since the firmware I had was not released. You can asked them if they have any unreleased firmware which they can give customers.

I think we ended up in this patch method of hacking the scope because there was a rush to unlock the scope and that was the first method that worked.

hmm i see

but we need a permanent fix so that persons do not have to wait on someone to create a new patch each time a new firmware is released.

This is true,  it does seem to be the case that the SSH method is the way to go, IT JUST DOESN'T SEEM TO BE HIGHLY RELIABLE. (at least going off what forum members are saying and how many DISCLAIMERS   LOL we seem to be getting from it .
but i agree, that the people doing is the favour of creating these fixes shouldn't be bothered EACH TIME a new firmware update comes out.
i mean we are no longer bothering with the DS1052E and the DS2000A as that's sorted and done.
Why should the MSO5000 be any different ?

As it relates to Rigol and firmware, they are very slow with that so I would not expect anything soon.

Hey.. I'm not expecting it tomorrow, But in truth, the problems are
- Bad Spelling errors in the SELF CHECK process
- Massive amounts of bad spelling and grammar in the HELP menu
(and truthfully i only encountered this because i went ahead and did those videos. the HELP menu in the DS2000A was easier to access, the
one in the MSO5000 was not obvious so i didn't pay it much mind, it wasn't until thorstormlord showed me how to access it that i became aware
of the mistakes, and at that time it was only a few mistakes, but then i actually took the time to read through it and discovered, wow..
there's like, quite a few)
Now a person may argue... who cares.
Well i reckon if we pay this much for the scope they should get it right. and Rigol has agreed that the team that do this part of the development
are in a non english speaking country. Who made that choice... god only knows.   Anyway, they are taking it seriously and have every intention
of rectifying it, and i going through the menu with a fine tooth comb and will send them a PDF of the errors.

There's also stupid crap in the menu like....
it'll say, THIS OPTION ONLY AVAILABLE IN MSO7000 
Well then... Why did you put that in a MSO5000 scope.   Kinda dumb isn't it ?

- Beyond that i've spoken to them about the slowness of COLOR GRADE  and to see if we can get that sped up so it's useful.

- As well as mentioning that if we have a timebase, that timebase should have enough memory to support a quick refresh rate.
Meaning, No one needs 1,000 sec/Div  . My suggestion was that 5 sec/Div was more than enough maybe 10 at the slowest, Who measures
those frequencies anyway ?

but yeah i expect it'll take some time before they release a new one

You can asked them if they have any unreleased firmware which they can give customers.

i could, but i think i'll let them get it out in their own time and properly test it

[mabl]

There's also stupid crap in the menu like....
it'll say, THIS OPTION ONLY AVAILABLE IN MSO7000 
Well then... Why did you put that in a MSO5000 scope.   Kinda dumb isn't it ?

If you are talking about stuff like the Eye Diagram (that also don't work), that is because you have patched the firmware. It does not show up on unpatched firmwares. The patch just short-wires the capability check to return "I can do this" on any feature check - included the ones that are normally gated by the MSO7k/5k difference.

[BTO]

There's also stupid crap in the menu like....
it'll say, THIS OPTION ONLY AVAILABLE IN MSO7000 
Well then... Why did you put that in a MSO5000 scope.   Kinda dumb isn't it ?

If you are talking about stuff like the Eye Diagram (that also don't work), that is because you have patched the firmware. It does not show up on unpatched firmwares. The patch just short-wires the capability check to return "I can do this" on any feature check - included the ones that are normally gated by the MSO7k/5k difference.

"If you are talking about stuff like the Eye Diagram"

No i actually wasn't even remotely referring to Eye diagram.

"(that also don't work), that is because you have patched the firmware."

Well, that's strange because i have patched firmware and i can use eye diagram

But what i actually was referring to (As 1 Example) see the attached photo

in the SAMPLING RATE section of the help menu it states that the Single channel Sampling rate is 10GSa/s but then says that it's
8GSa/s for the MSO5000  (this being.. in the help menu (Effectively the User Manual) of the MSO5000)
As i said, How stupid is that ?

What functional purpose is there to advising people with an MSO5000 that the bandwidth on another scope is 10GSa/s.
Even if it were written as 8GSa/s  but then in brackets (10GSa/s on the MSO7000)  at least you could argue that point to a degree because the 7000 was a subpoint to the main point.
but no here... the 10GSa/s is the main point

Clearly, they have loaded the Help menu for the MSO7000 into the MSO5000 (or are using 1 menu for both)
that also should not be the case.

so, that's what i was referring to (it happens in various places, but this is 1 example), But NO, nothing to do with eye diagram

but you raise an interesting point, that being that if the firmware is patched, some things may not work,  I'll keep an eye out for that.

SO FAR I HAVE ONLY FOUND 1 THING, But i'm not sure if it's a problem or intentionally not a feature in the scope.
that thing being.
I had a user ask me about the RECORD feature in the scope,  and.. it is there.  Unlike the DS2000A which had the record buttons on it
and this was simpler to get into . the MSO5000 does have a record feature , However the problem this user has is, he wants to save recorded data on USB for later use.
it seems to me that this should easily be possible. and i've found a video  on youtube where it's clearly seen that upon entering the Record feature there is indeed a SAVE Option.
My scope doesn't show that option.    so this may be something or it may not
but, i'll keep my eye out for other stuff,  so far, I've gone completely through the scope and have not found anything that prohibits the scope doing what it should do

[Expodermius]

Try to uninstall all options first, wait for reboot, then install with regen private key flag.

I tried as described, first uninstalled and after reboot I installed with regen private key. Tried it several times but the oscilloscope only replies with "remaining attempts" as described by zauberpilz, now only 2 attempts left. What am I doing wrong? Could you please help?

[BTO]

Try to uninstall all options first, wait for reboot, then install with regen private key flag.

I tried as described, first uninstalled and after reboot I installed with regen private key. Tried it several times but the oscilloscope only replies with "remaining attempts" as described by zauberpilz, now only 2 attempts left. What am I doing wrong? Could you please help?

OK, in light of all the conversations i've had recently,   I'll ask you this

WHAT ARE YOU TRYING TO ACHIEVE ?

if the answer is ... You want to unlock the full features of your MSO5000   then
My previous answer used to be , Go to this link
https://www.eevblog.com/forum/testgear/post-hacking-rigol-mso5000-post-hacking-tutorial-deep-dive/

Download the upgrade zip file and video 2,  and it'll happen without a problem, Absolutely everyone that has tried the method i'm doing
(which really is the method that the forum is doing, except i put it in folders to make it easy and made a video to show you how to do it)
it's not mine , Credit goes to those that unlocked it. Just to be clear.

Now...
IN SAYING THAT
I have recently been told the following
- The Method of doing that i just told you that works , Even though it says "FOREVER" and all options unlocked
  I have been told that this does not mean that it's properly licenced.
  Apparently this only becomes an issue when it comes to future updates .   but You will have all options unlocked and you will have no problems
  on the update that you're on and you will be updated to version 1.3.3.0

- The method you are doing as prescribed by DrMeFisto (that i have absolute respect for) has been told to me that it's touch and go.
  Just like you , many people have struggled to get it done, the Positive side of it is.... IF IT WORKS,  (This point keeps getting repeated apparently, ) is that your scope will be properly licenced and you won't ever have to worry about unlocking it again. you can just upgrade
as normal and the licenses will be preserved

but again, so.. what are you trying to achieve

JUST GET THE SCOPE ALL UNLOCKED
or
GET IT PROPERLY LICENCED SO YOU NEVER HAVE TO WORRY ABOUT PATCHING IT IN THE FUTURE ?

FYI - I do plan to try DrMeFisto's method,  although it probably won't happen for at least a month,
but even then... I have over 100 people that i have successfully updated through the method i presented.
even if my scope licenses correctly through DrMeFisto's method, i can't guarantee that that will mean that your one will, Considering
that so many people have no been able to do it .   

so there is a secure option of doing it that works well, But TECHNICALLY it doesn't "properly" licence the scope,  although you'll never notice the difference
and there is a method of doing it properly which is a lot harder

if you wish to choose the latter option then you'll have to wait till i try it and i'll make a video on it. 
My scope is currently all unlocked and it's my understanding that by DrMeFisto's method i can revert my scope to factory and then update it properly,   IF THAT'S THE CASE, i'll let everyone know

so ,WHAT WOULD YOU LIKE TO DO ?

[seppeltronics]

Hello,

I tried DrMehosto's Python script, command executed was: C:\Program Files\Python312>python C:\mPro\rigol_kg2.py 192.168.178.21

After fixing PRIV_PATH  it created the pem file, but it did not activate any additional options and I do not know what I have to do next.

Got outputs like:

Code: [Select]

Activating: 2RL [MSO5100-2RL@100F4569E72C445C93...]... unavailable.
Tanks a lot, best Regards, Seppeltronics

[seppeltronics]

It shows that I have 9 remaining attempts, I can not reinstall the old keys, maybe because I have overwritten the FRAM with the option -r, which was a huge mistake.

Can someone please help me please, I'm stuck and I really do not know what to do now.

Thanks a lot, Best Regards, Seppeltronics

P.S.

Code: [Select]


C:\Program Files\Python312>python C:\mPro\rigol_kg2.py 192.168.178.21
╒════════╤══════════╤═════════════════════════════════════════════════════╕
│ Code   │ Status   │ Description                                         │
╞════════╪══════════╪═════════════════════════════════════════════════════╡
│ BW1T2  │ ----     │ 100MHz to 200MHz Bandwidth Upgrade Option           │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ BW1T3  │ ----     │ 100MHz to 350MHz Bandwidth Upgrade Option           │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ 2RL    │ ----     │ 200Mpts Deep Memory Option                          │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ COMP   │ ----     │ Computer Serial Triggering and Analysis(RS232/UART) │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ EMBD   │ ----     │ Embedded Serial Triggering and Analysis(IIC, SPI)   │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AUTO   │ ----     │ Automotive Serial Triggering and Analysis(CAN/LIN)  │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ FLEX   │ ----     │ FlexRay Serial Triggering and Analysis              │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AUDIO  │ ----     │ Audio Serial Triggering and Analysis(I2S)           │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AERO   │ ----     │ MIL-STD 1553 Serial Triggering and Analysis         │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ DG     │ ----     │ Dual Channel WaveGen 25 MHz AWG                     │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ PWR    │ ----     │ Integrated Power Analysis                           │
╘════════╧══════════╧═════════════════════════════════════════════════════╛
Model: MSO5104
Serial: MS5Axxxxxxx
Version: 00.01.03.03.00
MAC: xxxxxxxxxxxx

/rigol/tools/fram is OK!

Activating: 2RL [MSO5100-2RL@3E4A0AE42A4EBA87D0D2386EA52097B212B7B4241795F2E5FAE1B334D71125ED8483193F74962BF5239CB535F4A0E8C52B10CB8D78E3DE0DDB4829E00BE3E5FB]... unavailable.
Activating: 4CH [MSO5100-4CH@465DEAE53206FBAF54DE5529965053803D26BCDCE28A4F7300F3ABB08D0ECAE05FC91B7079D36AD9BA9B75F1FE43A8F8D3E072E66BFF829FB1D3ECD80A4EDADF]... not activated.
Activating: 5RL [MSO5100-5RL@07C63D3537E61E79F37B1AF921DA1E3F702F7CFD62BD7D4DE6744126C91B3B499CCE294FF6EE91266C7AF39508C422B4547A5128771F1B3EEA676EC526BAB968]... unavailable.
Activating: AERO [MSO5100-AERO@9A5BF1A593BB6641706BF4B4FE2EACF1D674A40E9AB5A051ECABA90CBDB449B4750ACC9EF39948F82ABF09F3623E8B2F477C658409FF9BA9EED6CDA09DED5681]... not activated.
Activating: ARINC [MSO5100-ARINC@4C4625134642B3F7F6CF25A931B626127A2C4F90FBDF5C0BFE50929AED48A66418DE536513E6D118C302162CB6D9935F2E97834326D2A35DE4A501C6D6F77B56]... not activated.
Activating: AUDIO [MSO5100-AUDIO@84941C0FB778ED1E49DEDEB6845C248EE2C0A78E204C2476737313F63E2698239217282C87029FB861D4362D2CB2812D2F722F795D8C48A583CCCB92F7145083]... not activated.
Activating: AUTO [MSO5100-AUTO@40B474039C7FD62F354C1DF7485AAC4520DF35BB692736D9D9A6E17D88C8EB391422059BD47E5FBE2E54D1CFFABB44B6E8D1C75B48D3D078821F08CF20AD2A6C]... not activated.
Activating: BND [MSO5100-BND@A3E981CE398B12B619091A018179A056880A62EC0B79E51CA77A2BA1FF71FFB270C99FB9DCA45A5CB4578AB8956D3FDDC833DF299332EE4A7633EF00849D1428]... not activated.
Activating: BW07T1 [MSO5100-BW07T1@861318EBA3D06E768236C4CC79DAC8E2578500FB692CFDCF5C4B58CDD8C0D680040BFF722AB67E9AA28CB2E60BF854FB3BBF8B3C72CA9C5294A29A02D7640C66]... unavailable.
Activating: BW07T2 [MSO5100-BW07T2@67A3F6DAB880B352AAB321ED08517773A36AEB8655F96F7A89D324E240346B0297D23332D4BD529C30A8C9878460D526AC8B169CD910C6C68161400F364ABEB8]... unavailable.
Activating: BW07T3 [MSO5100-BW07T3@841055F4B6F3B08F8A1CC8DF8F103BA13AA6334577D0A72FABDB0FC4E9A1564BA7DC077A83E3A19BD48E666F9C86618AB36BD0EAEAEB73F1F7C3FDB9C34B8CE5]... unavailable.
Activating: BW07T5 [MSO5100-BW07T5@7FC62088BBAE6FB7BEF24D5F9ACDF15A993171D4BB18C869E2A83971444B7EFD2B755E1BCCF4803F6F8D32C82809B64F2BAD5BDA2A4C6AE97536E688C5AF8061]... unavailable.
Activating: BW1T2 [MSO5100-BW1T2@30C8C051F2A5C5122479DB1A9237F3FB18CE7EC9CAC0474A9F405BDA27DBC4AD324CDBB888450CAB134E49ABA1BA51ABF611A5AE6539F8F6AEB9C7475DFD4FC5]... unavailable.
Activating: BW1T3 [MSO5100-BW1T3@9B39541513B135B0E36D63C88D920A1DEB2800C63A67D2BB0C45A56837DDF71B40D270BACE358EB33BEF49D03C7A0293F881509E2369CCE9E4C5276A62D151B8]... unavailable.
Activating: BW1T5 [MSO5100-BW1T5@14A80CA48B6399A2FD0259B668962B743EE83B24C2EECA9EC23864426A514EA9A003F34E7437506D187B3B573A339A1BC3FFD15FE8C2F1CDDBC46AB774984A13]... unavailable.
Activating: BW2T3 [MSO5100-BW2T3@A163523E816C85AC70197B68FC20C7811A358ED28965D9EF286B53C3184AB9443D27C803DC4D022259F45BD0187277224292443BDAF5C9006E8683851E3BA46A]... unavailable.
Activating: BW2T5 [MSO5100-BW2T5@325FE82B891D35567A0164B596F7B84B2CED2E85D640927932140BDBA24958C32073B268EEC9449ABEFBF68A05B58C9FE9A51BCAB10E8D8E4309986D65C31CE0]... unavailable.
Activating: BW3T5 [MSO5100-BW3T5@5971AE3EF0B6EBC19B025FF2DC37A7365EA3647B33E4C38ADDEC90FA2AA6AC8A8A3B178984F93FF4C8B91479CD1006B50837B99808BC40DF532C55E96C87B8F5]... unavailable.
Activating: COMP [MSO5100-COMP@939B60C9F5D8FBAF0C680782B6DF68630F54E9ACCA3A466FD76B88244001EF3B03A0E0CE1A4A2A08D082E1647E193A0E8B4F27C600A468301578CC1B386B943B]... not activated.
Activating: CTR [MSO5100-CTR@4D6B30EA86BCA834FF0F75B5F5AF1DC6762D3B3DD8EE072B1361EDD1F337D53E7F33866FD216EC06C5E963B787912936DC1FFFE1ACECFE34BA45709E15724534]... not activated.
Activating: DG [MSO5100-DG@21147A692BFC955C514E37C4ABF2FD02FA4A73EA6AE87D9AABAD2E213D985B162B3E86A4870CB12A32235C941A034243C17E1D8B5496BD64EB0273AD32FD8CDA]... unavailable.
Activating: DVM [MSO5100-DVM@88FF659CF14AB6CC7B9585DAD2B79E2F7470770A7BF0A8D4A58DC26EDD55BBE6024A63B1EBFB28282783790779B67897A6AE55C380ED2DB264D42870F2D880A5]... not activated.
Activating: EDK [MSO5100-EDK@952C31F126219EA1391F76F60D1978EE01E863D60644A3F1158B69DEEFA7DB70A075527F54FC28227B782D196A4BA0D9FEDB95361705B54028814FB6A511ECBA]... not activated.
Activating: EMBD [MSO5100-EMBD@66C79B675A739484D2F1AE25931E57D743DB0FC6D785369129F07A47B0DF531C05BFF41E826023872F46062E5D39F7DB7564FCB062E7636ABDFDAD877FA51D67]... not activated.
Activating: FLEX [MSO5100-FLEX@A259D940749CFAE8B96DDA399D458C5AA644CC1B48BAF3A017E97E794ABB4CD34BD6F518F092C8218B249A34DF6849B2BF9350BFDAA3D131D46106A681862B3C]... not activated.
Activating: JITTER [MSO5100-JITTER@45AA3452E542DA21A3C81DB164CF35F8AB4E4E80893DCEDA674D41D1555315513BF82C21F3BBA501B3EF412AC354B87A616F9AF5C6A4E0C24D320F8A93E58EA4]... not activated.
Activating: MASK [MSO5100-MASK@390F7931353BEEABC4BF1425831F8612D86434BAF1A4E10D3DDEE918D0BD5F351F405EEF53FE29E94C8626786EE574A4FE7E59881B8BFCEBCF28B107DCFDDC22]... not activated.
Activating: MSO [MSO5100-MSO@193ED0D231141DFCB71C33A87270041321C73F0EFE0F1952ACE67C1AD73EB6332EAC4E061625B0D8F98AA55612D69133BA083BE8AED736692A896A96AB61E30B]... activated.
Activating: PWR [MSO5100-PWR@2A27DA3963D0C599C5CF9B25F819A8E90EE374C9BAE04D6316FBD56C53AAACC41E649376B6D7C5FB7A0099244929475914A9867E874E6E1EB3F381F37D8193F6]... not activated.
Activating: SENSOR [MSO5100-SENSOR@0622D1C5DF405041F4292641D9965F9CC0626EE6179150AD13A1762715462F61301B178B556C1F1A49D3755F8FB8E2DB3154AB0F14BDC510591DAB78638F0D54]... not activated.
╒════════╤══════════╤═════════════════════════════════════════════════════╕
│ Code   │ Status   │ Description                                         │
╞════════╪══════════╪═════════════════════════════════════════════════════╡
│ BW1T2  │ ----     │ 100MHz to 200MHz Bandwidth Upgrade Option           │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ BW1T3  │ ----     │ 100MHz to 350MHz Bandwidth Upgrade Option           │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ 2RL    │ ----     │ 200Mpts Deep Memory Option                          │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ COMP   │ ----     │ Computer Serial Triggering and Analysis(RS232/UART) │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ EMBD   │ ----     │ Embedded Serial Triggering and Analysis(IIC, SPI)   │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AUTO   │ ----     │ Automotive Serial Triggering and Analysis(CAN/LIN)  │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ FLEX   │ ----     │ FlexRay Serial Triggering and Analysis              │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AUDIO  │ ----     │ Audio Serial Triggering and Analysis(I2S)           │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AERO   │ ----     │ MIL-STD 1553 Serial Triggering and Analysis         │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ DG     │ ----     │ Dual Channel WaveGen 25 MHz AWG                     │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ PWR    │ ----     │ Integrated Power Analysis                           │
╘════════╧══════════╧═════════════════════════════════════════════════════╛