Here is an updated script that should work on
both 8000 and 8000A 5000,6000,7000 and 8000 series oscilloscopes
The script can be run with -h in order to print all the available command line options.
This script should also be able to unlock all options on MSO5000 oscilloscopes with "--pk-memloc 4512 -a" using "-k 1" or "-k 2"UPDATE 1 ( rigol_mso_util_2.02a.py ) 11-July-2024:
NO LONGER AVAILABLEI have updated the script and it should be able to activate both MSO5000, MSO6000, MSO7000 and MSO8000 (and it
could work with DS series) with all key sizes without any extra option.
Works with 5/6/7/8XXX OSC.
Added 2 more asserts
Fixed public key length on newer OSC
You can use -k 1 (default) or -k 2
First run the tool with -r, reboot scope, rerun the tool with -a
UPDATE 2 ( rigol_mso_util_2.03a.py ) 11-July-2024:
Updated the script to apply just the differences when writing to fram (this should make the script x 27 times faster on key regeneration)
Debugging now works
Added more comments in the script
UPDATE 3 ( rigol_mso_util_2.04a.py ) 11-July-2024:
Reading just first 2k of data instead of 8k (this will make running -a or -f x 4 times faster (rest of the data was not used anyway))
UPDATE 4 ( rigol_mso_util_2.05b.py ) 12-July-2024:
No need to run the script with -a.. it will do this automatically and reboot the scope as well
Small other changes
UPDATE 6 ( rigol_mso_util_2.06b.py ) 14-July-2024:
Fix diff update
Scope can be rebooted with --reboot option
UPDATE 7 ( rigol_mso_util_2.07b.py ) 15-July-2024:
in order to regenerate the key run it with -r -d (will be fixed in the next version)
Public key can be at any location in fram (thanks to Kyr for pointing that out)
Small cosmetic changes
UPDATE 8 ( rigol_mso_util_2.08b.py ) 16-July-2024:
FIX: -d no longer needed when running key regen. on 2.07b -d was needed with -r otherwise it would not find the public key
UPDATE 9 ( rigol_mso_util_2.09b.py ) 16-July-2024:
FIX: help showed first 16k of FRAM when we are actually getting just first 2k (thanks BTO for pointing it out)
UPDATE: Shows the Language, LoadLast and other info from fram
UPDATE 10 ( rigol_mso_util_2.10b.py ) 18-July-2024:
ADD: added --with-config param (can be used with -r -d or --save-fram in order to get 8k of data from the FRAM). this combined with -d will print all the configuration options (found the names in a dump posted by tv84)
ADD: added colors (you can use --no-color if you don't want that)
EXTRA: Code Cleanup
UPDATE 11 ( rigol_mso_util_2.11b.py ) 06-August-2024:
ADD: --save-sysvendor to save sysvendor.bin (debugging)
ADD: --sysvendor-key (with 2 parameters (--sysvendor-key-fast and --sysvendor-key-slow)) in order to try to find the device sysvendor.bin key
python3 rigol_mso_util_2.11b.py --sysvendor-key --sysvendor-key-fast 192.168.1.1
python3 rigol_mso_util_2.11b.py --sysvendor-key --sysvendor-key-slow 192.168.1.1
ADD: --use-activation-key in order to pass a different activation key. if default key does not work try to get your sysvendor.bin key and do a --regen --use-activation-key <with_your_device_sysvendor_key>
ADD: --reset-web-pwd resets your web username/password to admin:rigol
ADD: more colored output
**** FOR WINDOWS USERS: get this file https://getshared.com/jrAbBPOg (50.9 MB), unzip it and run rigol_mso_util_2.11b.exe (that way you don't need to install python or any modules anymore) ****UPDATE 12 ( rigol_mso_util_2.12b.py ) 07-August-2024:
ADD: sysvendor.bin parser
More cleanup
ADD: parser works in offline mode when the sysvendor key is passed as an arg
rigol_mso_util_2.12b.py --offline --sysvendor-file sysvendor.bin --use-sysvendor-key AAAAAAAABBBBBBBBCCCCCCCCDDDDDDDD)
**** FOR WINDOWS USERS: get this file https://getshared.com/1cVuFIxS (50.9 MB), unzip it and run rigol_mso_util_2.12b.exe (that way you don't need to install python or any modules anymore) ****TODO:
*
decrypt + parse/encrypt sysvendor.bin
* edit sysvendor.bin (serial, available options, model, ...) (MAYBE)
* get an actual Rigol MSO5000 or > to play with (without it decrypting the sysvendor.bin is not that easy as I need to ask people to run commands on their device)
* see if the same method works on RSA (have already tried to get /rigol app from (RSA5000) fw but it uses some modified version of CRAMFS)