Hacking the Rigol MSO8204 / MSO8000

[traxpalicaru]

Hi, I've been the happy owner of a Rigol MSO8204 2GHz 10GSa/ for a week now.  And of course, why not, we have to do tests on it.  More precisely, let's activate all the licenses.  I've seen it possible on earlier versions like the MSO5000.  As a result, with the help of user https://www.eevblog.com/forum/index.php?action=profile;u=94961BTO and a friend from Romania user https://www.eevblog.com/forum/profile/?u=92610 asp because I'm not as good at software as they are, I tried the script version for MSO5000.  At first my MSO8204 oscilloscope could not be accessed either via ADB or SSH.    But with his big brain asp managed to make a so-called update for opening port 22 for SSH.  After a few lost hours he also found the area in CFRAM where there should be Keys for licenses.  But at the moment the script is not right, the licenses do not activate.  I'm opening this topic more to thank them for trying to find a solution and because I want to post pictures of the inside of the oscilloscope because I couldn't find it on the web.  And maybe eventually someone will find the license solution.





Here is original photos https://drive.google.com/drive/folders/1jrgET-kSbf_1IEIezg8QdZ5eYb8Srk2g?usp=drive_link

Code: [Select]

KEY1 = b''.join(pack('<I', x) for x in [0x03920001, 0x08410841, 0x18C32104, 0x318639C7])
KEY2 = b''.join(pack('<I', x) for x in [0x478AA887, 0x99A85895, 0x1770078, 0x87888798])

Code: [Select]

Version: 00.01.01.01.06
MAC: 00-19-AF-7E-04-83

/rigol/tools/fram is OK!

Reading CFRAM...
100%|██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 8192/8192 [00:15<00:00, 536.29it/s]
Reading CFRAM done.

Applying new CFRAM...
100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 8192/8192 [02:52<00:00, 47.39it/s]
New CFRAM applied.

Key.data backup created.
New Key.data applied.
Activating: 2RL [MSO8000-2RL@47856CD43FD2E005B0441CACAE684909252D7D5205207CD880901F4BF4A110BA625290D47FC919E624E18A4BFECCA25E8B9E203BD026D0A3778B943992A59FA8]... unavailable.
Activating: 4CH [MSO8000-4CH@905C9C63AC9302632B5375648494D44B015BA182ED51E919FFF3EEDD936C34FB318AAF2A9B95F6E3B2F407136753DDAA174354764276BD610153207F66A636E4]... not activated.
Activating: 5RL [MSO8000-5RL@8368AF368E1197118F4BB459D4D5855373BBDD9945695CDD9A3080FEE1FBBFFEA76A90972696DF3E0C19B7870C8B3AA403467A566B63C827AC0B9CE35CD7CCBB]... unavailable.
Activating: AERO [MSO8000-AERO@16828851C599C3A0F708E23E25A4548A40B614999EC83BBFB0E83663230A74A37DA897A651756C372B15668E73FF41BFF600F3A38D05C6D300278C2F4703E5B1]... not activated.
Activating: ARINC [MSO8000-ARINC@5385B53858D80CC3AC57E502DB61FA6947666A9020B9FEFBA58BF49A66565528186BBBC5D5543B2C6ABFAB4A721F2CF3D6760C5109C55CEBB060257C84A0D14E]... not activated.
Activating: AUDIO [MSO8000-AUDIO@26319D5917E78275126F2CC06FFABBD789F35F819564EB39E4F2FCC2E7BBB441297C769F2C4DC92ED39028BB9F6C9A5D33792AAB81C0608411C9546467BA6B40]... not activated.
Activating: AUTO [MSO8000-AUTO@1592058F99EBE588E5F2B5A3CC7635E5D36FE665FDE99DF51DFF469E3C45CECBA67662F8A8CF3C50F7FCEDD420036226A916ABBDCFDE9AC8A786FE48A008EF14]... not activated.
Activating: BND [MSO8000-BND@3DC1F7E9C12EAE0AE0932E03268A59EC81EBD4EDAD2DB938588E58CBA0C0ADBB9DBCB4678B3D8924A3AACB293241D8AA72341F5512CE9A9EE27266B0BD71EF64]... not activated.
Activating: BW07T1 [MSO8000-BW07T1@04B9175FD0845ED677897B1651E7889350F3FCAF84DD639A05A3BEBE6950409F9641D05FC29FC25A2C5E1323B5F6F1E3FA2052B4C53620B1BC14B7387E43C9CB]... unavailable.
Activating: BW07T2 [MSO8000-BW07T2@0C64B0E801C667F5328AE52E49FFD65C30357F455A295D706947AAA7D4D6DD1402861FF59AC97B981904926DFE8B0BE7265DBB1AF131DEDE26310CB3AC318903]... unavailable.
Activating: BW07T3 [MSO8000-BW07T3@6D46F14DAF106162BB71C38C155ECBADD21DAF8CB4C99AEE35B7ACEE0B445D7E8EAEA7816A141C7D91A87D91C16B16E2809524347457F391C7FCC80FAF9A668C]... unavailable.
Activating: BW07T5 [MSO8000-BW07T5@25877F6476AE4BA5CDFD164507558D4973F99D710E5BEBB55C035495B16C5B7656CECA9868AA970BE2FB72B0612E9082E059BABE77517E9D5F1783800DE68D0A]... unavailable.
Activating: BW1T2 [MSO8000-BW1T2@498C14875DDF3BCA78ECDC57B51134F41D94B7F7B093126169448BE36BC3B1EB97029A0C7C0CF859B7B03CA0F43DFC771BD74B68502000DDA0488BDBE298E3CD]... unavailable.
Activating: BW1T3 [MSO8000-BW1T3@5C0F8FA801C8B57B35278E514CB958BA8811065C47D93ED0E7166BFAF1363A18384EC7AA539E5AB6C68BC418A314679B8B51FD2C4E22D36D15DB696648ED8B8E]... unavailable.
Activating: BW1T5 [MSO8000-BW1T5@34EC40171698848E32298AC096A0B118B19A85EDE2DB7E86EDC9AFAE6B6084916162C9FE1E057DB84FC68CE2AF28D874BAF36797C4709ED65F5D10B3261A6769]... unavailable.
Activating: BW2T3 [MSO8000-BW2T3@72E95D484D97813D1B485EBF1D9D57E73F1CBB6F8ACBE8E83A6BC4EA9844C5B61B0D2C9F5CF83B49B6A837EFCE4729DC9D9FC581066133B40844248E9EC8F46E]... unavailable.
Activating: BW2T5 [MSO8000-BW2T5@968B913A55E0C4A6F40B1973CC55D74ADA737D2151CBAA63C944D1088A8818474B27C132CBF5D8F58383AA20AA47E9AF76BE6888F9DB08F20A5A7DB225DF96E5]... unavailable.
Activating: BW3T5 [MSO8000-BW3T5@79A7866C6DE39DE65A1478D60DE4731E9D9B1D304E7B2D570D3987BE18413A5F3E6CBBE170EF3DCDFB905C933F3D923BD2EC732773D1897C937AABD404498DEE]... unavailable.
Activating: COMP [MSO8000-COMP@53DA985708CDCEABCA9275B3117E66C8FE37865AF2F3B7751C90903766DC1DD51FEF69BF292D2D71DA9DF0C96A517D5C6E93B776BB8DD14994A3763C6D41A84F]... not activated.
Activating: CTR [MSO8000-CTR@2DDD7593AEA4A149A7ED050CD784BAE90B0F3180625A1EAC1C776E0C26947FB13D02B2543970176D81B70B309CEEC78CD0631D63540195EFF9A8152F4CDEC61B]... not activated.
Activating: DG [MSO8000-DG@6E002F4E301B5E057277C6B9521639CDB7BB60FEA491DFF5E7AB7970ACD5C2301F13C6D662E5466BAF1C8AEE7608E99D57414B4454F1316B1D35D974D712D7CF]... unavailable.
Activating: DVM [MSO8000-DVM@742470E3648B8DD679D287372BE583A25F1271FE726C69F89D9F5AE3E49760932C099A70E870089FBFD8DDA102BDF9FEBD71D6E7F5C9797EFCE9DCC66DBACE6F]... not activated.
Activating: EDK [MSO8000-EDK@8B1EC10AF01540ACB2A9779A3B051265F24FF2DC173F7440ED1B88C741E28271A9D142F5C1170CDE51849A7AC2EB7D1CB919FCA17FBE9030C08EDE95AC51816F]... not activated.
Activating: EMBD [MSO8000-EMBD@89265A117FB207D90DFD9B6A1497886A19C15D5046E4C8FDF26E5843D4B7A2F4829A1C0C43CB1003EA4178EB1DCD2CC4AD774883217D6D9C8BB3A2219817BF9D]... not activated.
Activating: FLEX [MSO8000-FLEX@2533085AE17E12E90D3BD04C9F9D64E733DF33C973F5F2C362F24CB700D3A3BC2E5AFF8E57FFD593756DD5DFF44B06982A9FFE6F215B4EA0431CE39AD58FAC08]... not activated.
Activating: JITTER [MSO8000-JITTER@02A77C8546C24A0650389149A31ECEFB493B64087EE41DC9D6AB5570FECE33FF98FCB25F14B7975B2C20DDA84A1FC8B0418D2D6628528DA4FD3B36F222FBF28D]... not activated.
Activating: MASK [MSO8000-MASK@3A1C872E9380A6AC11D9962FD028CEE8F16A1EC241A7FB2120707846EF39E6E474446CC78576EBAF2F384E76FBD6F6C5F434563E82B7E99542FF23013DC2BE81]... not activated.
Activating: MSO [MSO8000-MSO@9D30022E019106CD4C32BD4D857B7D4C2AE66917A2C9B646DE1B6BCEE71CDC1335C27B96608F26B3BB343A7455DE64C9F51283B51915310D21D4E1DA96EF12A0]... activated.
Activating: PWR [MSO8000-PWR@7C4EBBBEE9429342F024AD06F8354495CD8B2804E6F8306E2F1F3CEC20829F3B7E5B5D1AB27065A5912338F5FB36F65DDB8D1D7DD705A378F68EEE6121BA03D5]... not activated.
Activating: SENSOR [MSO8000-SENSOR@A62ACB08A95B38BC3563FCFA5AA334F514C624E3673522DCC2105D8F2C5C05C257BCC7BA0E19ED038F40FAE90DDAE13098AFF20C81D89EE450DF8BA18CB59D3F]... not activated.
╒════════╤══════════╤═════════════════════════════════════════════════════╕
│ Code   │ Status   │ Description                                         │
╞════════╪══════════╪═════════════════════════════════════════════════════╡
│ COMP   │ ----     │ Computer Serial Triggering and Analysis(RS232/UART) │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ EMBD   │ ----     │ Embedded Serial Triggering and Analysis(IIC, SPI)   │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AUTO   │ ----     │ Automotive Serial Triggering and Analysis(CAN/LIN)  │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ FLEX   │ ----     │ FlexRay Serial Triggering and Analysis              │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AUDIO  │ ----     │ Audio Serial Triggering and Analysis(I2S)           │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AERO   │ ----     │ MIL-STD 1553 Serial Triggering and Analysis         │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ DG     │ ----     │ Dual Channel WaveGen 25 MHz AWG                     │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ JITTER │ ----     │ Jitter and Real Time Eye Diagram Analysis           │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ PWR    │ ----     │ Integrated Power Analysis                           │
╘════════╧══════════╧═════════════════════════════════════════════════════╛

[asp]

UPDATE:
Check this post for the latest version:
https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso8204-mso8000/msg5556207/#msg5556207

After a bit of , we did manage to activate all the licenses on the MSO8204. None of this would be possible without the help of BTO and DrMefistO.

I am not sure it will work on 8000A's but the script can be modified to accommodate that. I will try to update the script in the near future in order to upgrade the bandwidth as well (e.g. from MSO8064 to MSO8204)

In order to activate the MSO8000 you need to create a temp dir, download the attached script to the temp dir and than cd to temp dir.

1. python rigol_mso8000_kg.py -r <mso8000_ip>
    # this will generate a .priv file. do not delete it
2. reboot scope (REALLY IMPORTANT) -> wait for the scope to be up and running again
3. python rigol_mso8000_kg.py <mso8000_ip>
4. done

##notice the second time you need to run it without -r

[traxpalicaru]

Officially RIGOL MSO8204 is hacked after 2 white nights   After the update, the licenses remain active

Thanks and rate to  asp   BTO   DrMefistO. 
 





Now we are going to sleep (4:54am Romania) 

[BTO]

Hi, I've been the happy owner of a Rigol MSO8204 2GHz 10GSa/ for a week now.  And of course, why not, we have to do tests on it.  More precisely, let's activate all the licenses.  I've seen it possible on earlier versions like the MSO5000.  As a result, with the help of user https://www.eevblog.com/forum/index.php?action=profile;u=94961BTO and a friend from Romania user https://www.eevblog.com/forum/profile/?u=92610 asp because I'm not as good at software as they are, I tried the script version for MSO5000.  At first my MSO8204 oscilloscope could not be accessed either via ADB or SSH.    But with his big brain asp managed to make a so-called update for opening port 22 for SSH.  After a few lost hours he also found the area in CFRAM where there should be Keys for licenses.  But at the moment the script is not right, the licenses do not activate.  I'm opening this topic more to thank them for trying to find a solution and because I want to post pictures of the inside of the oscilloscope because I couldn't find it on the web.  And maybe eventually someone will find the license solution.

I'm opening this topic more to thank them for trying to find a solution

You're Welcome mate, No problem, it was fun.

And maybe eventually someone will find the license solution.

Oh yess...  Eventually, Eon's from now a race of superintelligent human beings will figure out the solution to this problem that has plagued
mankind for eon's

MEANWHILE.............
AND.... THE VERY NEXT DAY
- A SOLUTION WAS FOUND
- AND WE OURSELVES FOUND THE SOLUTION
 

[BTO]

After a bit of , we did manage to activate all the licenses on the MSO8204. None of this would be possible without the help of BTO and DrMefistO.

I am not sure it will work on 8000A's but the script can be modified to accommodate that. I will try to update the script in the near future in order to upgrade the bandwidth as well (e.g. from MSO8064 to MSO8204)

In order to activate the MSO8000 you need to create a temp dir, download the attached script to the temp dir and than cd to temp dir.

1. python rigol_mso8000_kg.py -r <mso8000_ip>
    # this will generate a .priv file. do not delete it
2. reboot scope (REALLY IMPORTANT) -> wait for the scope to be up and running again
3. python rigol_mso8000_kg.py <mso8000_ip>
4. done

##notice the second time you need to run it without -r

I am not sure it will work on 8000A's but the script can be modified to accommodate that.

So.. What are your thoughts on the MSO7000 Series ? 
i think it should be possible..Right ?

I will try to update the script in the near future in order to upgrade the bandwidth as well (e.g. from MSO8064 to MSO8204)

Didn't you already get it on 2GHz though ?

[BTO]

I have posted notification of this update on the MSO5000 forums as well.
as well this one MSO8000 which was just hanging around doing nothing

https://www.eevblog.com/forum/testgear/rigol-mso8000-series-hack/new/#new

[BTO]

Officially RIGOL MSO8204 is hacked after 2 white nights   After the update, the licenses remain active

Thanks and rate to  asp   BTO   DrMefistO. 
 
(Attachment Link)




Now we are going to sleep (4:54am Romania) 

I'm curious, where is the option BW1T2  that takes you from 1GHz to 2GHz ?

[traxpalicaru]

Well, mine already has 2GHz.  The only valid option for him from that group of "BW" would be upgrade from 2GHz to 3GHz with license "BW20T30" valid only for MSO8204 or MSO8204A.  The problem is that it appears unavailable for me and we don't understand why.  Anyway, 2GHz is enough, so there is no point in investigating the problem.  Maybe someone will find a solution.  You have images with firmware update and log below. Licence is still availabe after update. 


MSO8000-BW10T20
Bandwidth Upgrade from 1 GHz to 2 GHz.
(Option only works with MSO8104)

MSO8000-BW6T10
Bandwidth Upgrade from 600 MHz to 1 GHz
(Option only works with MSO8064)

MSO8000-BW6T20
Bandwidth Upgrade from 600 MHz to 2 GHz. 2 GHz Bandwidth only available with 1 or 2 channels active.
(Option only works with MSO8064)

MSO8000A-BW20T30
2GHz to 3GHz Bandwidth upgrade option
(Option only works with MSO8204 and MSO8204A)

MSO8000A-BW7T15
750MHz to 1.5GHz Bandwidth upgrade option
(Option only works with MSO8074A)

MSO8000A-BW7T20
MSO8074A
750 MHz to 2 GHz Bandwidth upgrade option
(Option only works with MSO8074A)

Code: [Select]

C:\Users\traxp>python rigol_mso8000_kg.py 192.168.1.229
╒════════╤══════════╤═════════════════════════════════════════════════════╕
│ Code   │ Status   │ Description                                         │
╞════════╪══════════╪═════════════════════════════════════════════════════╡
│ COMP   │ Forever  │ Computer Serial Triggering and Analysis(RS232/UART) │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ EMBD   │ Forever  │ Embedded Serial Triggering and Analysis(IIC, SPI)   │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AUTO   │ Forever  │ Automotive Serial Triggering and Analysis(CAN/LIN)  │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ FLEX   │ Forever  │ FlexRay Serial Triggering and Analysis              │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AUDIO  │ Forever  │ Audio Serial Triggering and Analysis(I2S)           │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AERO   │ Forever  │ MIL-STD 1553 Serial Triggering and Analysis         │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ DG     │ Forever  │ Dual Channel WaveGen 25 MHz AWG                     │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ JITTER │ Forever  │ Jitter and Real Time Eye Diagram Analysis           │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ PWR    │ Forever  │ Integrated Power Analysis                           │
╘════════╧══════════╧═════════════════════════════════════════════════════╛
Model: MSO8204
Serial: DS8A23#######
Version: 00.02.02
MAC: 00-##-##-##-##-##

/rigol/tools/fram is OK!

Activating: 2RL [MSO8000-2RL@2E3C89027701330B209992BBD6A1E1FFF9113A453317C16F3E74D2683F979CCB44925B6295718FAE17978BD083821D86FBA4C8B176B54B2431B912D828B454F1]... unavailable.
Activating: 4CH [MSO8000-4CH@0BDD43D56BBC5C2F208A830939E4AE4CD2674E609D02121EE02DEFDFF0097B1699184DA97B7B9E72468C2CC5CACEB9915841F1830F1CFC5805105A99C3BE9568]... not activated.
Activating: 5RL [MSO8000-5RL@15847162E0968096DBAD50C4C11ECDC689308AEB193C07428467715DEF14BE8B8F6EF67CB1B368DFEC7E6F320B670590F61071AD857BB1AD99145A8E6DA323F8]... unavailable.
Activating: ARINC [MSO8000-ARINC@9A7E2917918857D46661FA2BB0DC1B9EE37B9FB156AD8606D5E76AC11D3DDEC64ED35BC808F76F7A0304028F445F91CA6D7E59BFAAA43D14F38F56CB1A8C234A]... activated.
Activating: BND [MSO8000-BND@6365D3C32E340A045F7ACC770F89A81AB11F2AF0418240A64C2F0D5A50CE710405632C04D1AF5D077792208AF9DE0B3715EF77CD38665815E96F0BB34ECD86C4]... activated.
Activating: BW07T1 [MSO8000-BW07T1@8E96B183F45C59684FFA692744436D7A9EED22AF6F081051E1E1F834C15EE26192C3C751F3AC70692866E80EA8618FACECE6A57A5BAF047FE72F3EB48D2897C6]... unavailable.
Activating: BW07T2 [MSO8000-BW07T2@7C4A8D124E97912F9252F41450F8C58455891459392EE85909D7E5EACF460EFC156D32CCA009AE5A206D3140FB1BB012A8889CA5BFD1ACED1A4474EDFDC2F119]... unavailable.
Activating: BW07T3 [MSO8000-BW07T3@62B19E30CDEE2F0385A390C994F77A62D30DB7E4140E5D4B04C54D9EF7CBDDA73C69FB74F614FE38F44F1A23131AFD43C1660C4FFF03025D6C1CD1EE94E80D60]... unavailable.
Activating: BW07T5 [MSO8000-BW07T5@73533F3F5B6D791B051DC814ECD22C5BB610F1714162021061D51DFC4ADAC1BF8C1B5C67F9ED554797148969FDEE3BC5A0B034D0B655836654135E059E9AD02B]... unavailable.
Activating: BW10T20 [MSO8000-BW10T20@1DA329DDE88FBEE4E3C22AA3DF8FBF232D064E91BAFCABC9A951159D94E132E85B94E9CA7AD4B42C5A7BE7BF06C70D56A1C1BCA3AB1A271883F778B4188134CF]... unavailable.
Activating: BW10T30 [MSO8000-BW10T30@888A08F67DB06D19E0646379A8CBF670664F68ED99688D4A6B268130940C57204A5C475EC8825631CA6A100F5EB35F8D919A5128133E9297C552C721A085EA0A]... unavailable.
Activating: BW15T25 [MSO8000-BW15T25@13137BFA4F08103996CFBEA2CD3A829FA7165954DF3420EA98FE6DE5DD50D776939CC09119CBB69C0F86E29E8D4E549A95208B8B1D26017263B370D1BFD138B9]... unavailable.
Activating: BW15T35 [MSO8000-BW15T35@749762C37A418E84A26EBDA4EC76141E2C46FF1F12F73A4337783251809D430E0FD5FF6A93460F16E33F92B6F74B6A6FA46880161ACCA974BF74B57C40990CFD]... unavailable.
Activating: BW1T2 [MSO8000-BW1T2@8B0A796DF5BA8D275BA3EB99DB9663EE6E273362C0E19F4589EBC7F4733A9AD970E5014361282BB5223B43997652F24DE2C7D6D80FF16637297900CA2D7246FF]... unavailable.
Activating: BW1T3 [MSO8000-BW1T3@A1714BA7D7D711644A1693F1D860843DAE39BFD4EB2A02027B1F6678A7DE50CDA7EE90DE2E098AD58932844FBB9C49BB0CB251362DA568BEA07D1AF95BCC3814]... unavailable.
Activating: BW1T5 [MSO8000-BW1T5@238AEDA42E48F793DA66B4CC1364ED2558E7439F9201A3DEAE91D6C983B4D762A594F725A52D2B25C0D813FBC48AED13E293686472E6C3267756599919B52649]... unavailable.
Activating: BW20T30 [MSO8000-BW20T30@9EDD330BDD848CA1F28A5483AF4EF043A0F1099E32BF47B0DA5A05F424D88BC54FC95E89404FBDB8C62716D3A8648D0FE6FC58C40121C0B988D2AD97082F4D52]... unavailable.
Activating: BW25T35 [MSO8000-BW25T35@97CE038C3D67282AB8A6E62D439F9C24EB6E0740601BF27FC7309FBAA9E53416084C04CCD53AB372C99B6534E95A1A4873245B74C938CDC1975EA28534F6394D]... unavailable.
Activating: BW2T3 [MSO8000-BW2T3@352048B962756020673704A0102BC86C8EACDACAB13757BCCD0BEF9569F1B35C5F13569DC32AC9BC124AB074D79C096CAFBD2E84B1A4217002B2749B5515EBF5]... unavailable.
Activating: BW2T5 [MSO8000-BW2T5@4C6CC0D08BC5362C88D0A7763595E5A5A121C19BAEC67D7C6F07AA6A4D05C98E7EEFF495BA3584B6653FC362BBACCC1B85D1BB165324525934A04CA844BBE1BD]... unavailable.
Activating: BW3T5 [MSO8000-BW3T5@1E9CF4F13815D21A8DDC33974A978CFDEBEA4829FA01AF8135B2517A40C30EE314DB195F556A4822BB899A500328ED96AE0DBE35A79197268159571213E15BD8]... unavailable.
Activating: BW6T10 [MSO8000-BW6T10@4CCAB6D9598CBE5D5425A72157194FFF37991E3270F4067D73B76E5611DBEC94436E14ADD8A046A5E1FF5198079D4B849EBC0EB974017A513A75244034DC2E7A]... unavailable.
Activating: BW6T20 [MSO8000-BW6T20@52B7853197325D29AD05BB92BC2165D2BE0347B98852E92C2A813AD835906DFA65552E61B6E30158C96AE32B8CF21C7B76C0FE4083B0558F431112E2DB20C90B]... unavailable.
Activating: BW6T30 [MSO8000-BW6T30@6BE27C37CB114F852B83D0982FEF82B9AFD07D2E2B63AB99B912ADE9C647F6C87368B158148B96A1CEFB7A1AEECEE4A4FB35610EF21D351A829F3599A406CAFA]... unavailable.
Activating: CTR [MSO8000-CTR@5F5124D84203C225D297A0C9C16B275DD4BD5054F6DBA814F1D62F76AC8576542781776FAA6CF0DF378F466E998F423DF07A59BD8BB80777561F08BACCB87A40]... activated.
Activating: DVM [MSO8000-DVM@747DA83CC301F406E2BC8B2489000B8940FD53F71D859785F61C6DCA0D6B40D276EB4A436B7395D754FDF255DB1A84FC6494CF1B751AFEBF56A4393C92279CB5]... activated.
Activating: MASK [MSO8000-MASK@9C8D3A0BB741659B7D861B3DE308202DA73BD53845DB17F94F27D5F2CD04281E77A6D640015A65D4DAD8B27A5E60402D92F300DDADEAEE599F250BF8A460A72B]... activated.
Activating: MSO [MSO8000-MSO@7CAD05825E25E73EBF094FAC76D524F9389E2010558AC2DBBBF8FB5543E252A984874D62959361E2D193C63324C31F942EB43AB549D5E66A8685C6EBC86BC2DC]... activated.
Activating: SENSOR [MSO8000-SENSOR@3558638CE289EAF00B3038A73357C90769244D161F17BB514D46C2AB30DC3EAE8C26CE468832E6C83C081E613F09A60F8EAF947D820915202FA79AE10EECD4D5]... activated.
╒════════╤══════════╤═════════════════════════════════════════════════════╕
│ Code   │ Status   │ Description                                         │
╞════════╪══════════╪═════════════════════════════════════════════════════╡
│ COMP   │ Forever  │ Computer Serial Triggering and Analysis(RS232/UART) │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ EMBD   │ Forever  │ Embedded Serial Triggering and Analysis(IIC, SPI)   │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AUTO   │ Forever  │ Automotive Serial Triggering and Analysis(CAN/LIN)  │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ FLEX   │ Forever  │ FlexRay Serial Triggering and Analysis              │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AUDIO  │ Forever  │ Audio Serial Triggering and Analysis(I2S)           │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ AERO   │ Forever  │ MIL-STD 1553 Serial Triggering and Analysis         │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ DG     │ Forever  │ Dual Channel WaveGen 25 MHz AWG                     │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ JITTER │ Forever  │ Jitter and Real Time Eye Diagram Analysis           │
├────────┼──────────┼─────────────────────────────────────────────────────┤
│ PWR    │ Forever  │ Integrated Power Analysis                           │
╘════════╧══════════╧═════════════════════════════════════════════════════╛

[asp]

Here is an updated script that should work on both 8000 and 8000A 5000,6000,7000 and 8000 series oscilloscopes

The script can be run with -h in order to print all the available command line options.
This script should also be able to unlock all options on MSO5000 oscilloscopes with "--pk-memloc 4512 -a" using "-k 1" or "-k 2"

UPDATE 1 ( rigol_mso_util_2.02a.py ) 11-July-2024: NO LONGER AVAILABLE
I have updated the script and it should be able to activate both MSO5000, MSO6000, MSO7000 and MSO8000 (and it could work with DS series) with all key sizes without any extra option.
Works with 5/6/7/8XXX OSC.
Added 2 more asserts
Fixed public key length on newer OSC
You can use -k 1 (default) or -k 2
First run the tool with -r, reboot scope, rerun the tool with -a

UPDATE 2 ( rigol_mso_util_2.03a.py ) 11-July-2024:
Updated the script to apply just the differences when writing to fram (this should make the script x 27 times faster on key regeneration)
Debugging now works
Added more comments in the script

UPDATE 3 ( rigol_mso_util_2.04a.py ) 11-July-2024:
Reading just first 2k of data instead of 8k (this will make running -a or -f x 4 times faster (rest of the data was not used anyway))

UPDATE 4 ( rigol_mso_util_2.05b.py ) 12-July-2024:
No need to run the script with -a.. it will do this automatically and reboot the scope as well
Small other changes

UPDATE 6 ( rigol_mso_util_2.06b.py ) 14-July-2024:
Fix diff update
Scope can be rebooted with --reboot option

UPDATE 7 ( rigol_mso_util_2.07b.py ) 15-July-2024:
in order to regenerate the key run it with -r -d (will be fixed in the next version)
Public key can be at any location in fram (thanks to Kyr for pointing that out)
Small cosmetic changes

UPDATE 8 ( rigol_mso_util_2.08b.py ) 16-July-2024:
FIX: -d no longer needed when running key regen. on 2.07b -d was needed with -r otherwise it would not find the public key

UPDATE 9 ( rigol_mso_util_2.09b.py ) 16-July-2024:
FIX: help showed first 16k of FRAM when we are actually getting just first 2k (thanks BTO for pointing it out)
UPDATE: Shows the Language, LoadLast and other info from fram

UPDATE 10 ( rigol_mso_util_2.10b.py ) 18-July-2024:
ADD: added --with-config param (can be used with -r -d or --save-fram in order to get 8k of data from the FRAM). this combined with -d will print all the configuration options (found the names in a dump posted by tv84)
ADD: added colors (you can use --no-color if you don't want that)
EXTRA: Code Cleanup

UPDATE 11 ( rigol_mso_util_2.11b.py ) 06-August-2024:
ADD: --save-sysvendor to save sysvendor.bin (debugging)
ADD: --sysvendor-key (with 2 parameters (--sysvendor-key-fast and --sysvendor-key-slow)) in order to try to find the device sysvendor.bin key

Code: [Select]

python3 rigol_mso_util_2.11b.py --sysvendor-key --sysvendor-key-fast 192.168.1.1
python3 rigol_mso_util_2.11b.py --sysvendor-key --sysvendor-key-slow 192.168.1.1
ADD: --use-activation-key in order to pass a different activation key. if default key does not work try to get your sysvendor.bin key and do a --regen --use-activation-key <with_your_device_sysvendor_key>
ADD: --reset-web-pwd resets your web username/password to admin:rigol
ADD: more colored output

**** FOR WINDOWS USERS: get this file https://getshared.com/jrAbBPOg (50.9 MB), unzip it and run rigol_mso_util_2.11b.exe (that way you don't need to install python or any modules anymore) ****

UPDATE 12 ( rigol_mso_util_2.12b.py ) 07-August-2024:
ADD: sysvendor.bin parser
More cleanup
ADD: parser works in offline mode when the sysvendor key is passed as an arg

Code: [Select]

rigol_mso_util_2.12b.py --offline --sysvendor-file sysvendor.bin --use-sysvendor-key AAAAAAAABBBBBBBBCCCCCCCCDDDDDDDD)

**** FOR WINDOWS USERS: get this file https://getshared.com/1cVuFIxS (50.9 MB), unzip it and run rigol_mso_util_2.12b.exe (that way you don't need to install python or any modules anymore) ****


TODO:
   * decrypt + parse/encrypt sysvendor.bin
   * edit sysvendor.bin (serial, available options, model, ...) (MAYBE)
   * get an actual Rigol MSO5000 or > to play with (without it decrypting the sysvendor.bin is not that easy as I need to ask people to run commands on their device)
   * see if the same method works on RSA (have already tried to get /rigol app from (RSA5000) fw but it uses some modified version of CRAMFS)

[tv84]

I have some doubts about what you all say "keys with different sizes"...

I haven't touched this for some years but, from memory, the system was created based on ECC Brainpool curves which have different (but fixed) sizes. So, you shouldn't be confused with different sizes. If you are, then you have not fully understood what is at play. The key size of a specific ECC Brainpool curve key is always the same!

Another TODO: you can also expand the keygen to address Rigol's RSA devices... 

[asp]

They have changed the appended 00 chars lately (from 2 * 00 to two hundred and something * 00) before doing the XXTEA encrypt on the key (used have 148 bytes and now there are scopes with 388 bytes). They key is the same since otherwise the old licenses would not work on newer firmware

In Regards to RSA series I would need somebody with a RSA to send me a dump of the filesystem (most notably /rigol)

[tv84]

They have changed the appended 00 chars lately (from 2 * 00 to two hundred and something * 00) before doing the XXTEA encrypt on the key (used have 148 bytes and now there are scopes with 388 bytes). They key is the same since otherwise the old licenses would not work on newer firmware

Oh, OK. Probably they are preparing the room for changing the ECC Curve.

But, then just accommodate a bigger BIGNUM in the code and all is good. 

[BTO]

I have some doubts about what you all say "keys with different sizes"...

Different LENGTHS Actually

it would seem that the pattern was, since you and DrMefisto released rigol_kg2.py that there were basically 2 Options
At the bottom (Can't remember the line) there was the option of -2 00 or change it to -3 000

Now.. I observed that
MSO5074 (70MHz) Models with no BND Options Activated without issue on -2  00
MSO5100 (100MHz) Models Activated by using -3 000  but could not by using the above.
this method also held true for MSO5074 WITH BND Options

The Key Length across all these models were identical (I have them recorded but can't remember the length off hand)

Then around 6 to 8 weeks ago i noticed a trend, that being that even MSO5074 didn't activate with the script you provided.
They got an Assertion Error which was triggered by the Assertion pertaining to  "len"
and it all went from there

upon examinatin of the key,  the key was approx 3x the length of the one's that didn't get assertion error
so yes.. it's a Length thing,  to my knowledge.  Happy to be proven incorrect though.

If you are, then you have not fully understood what is at play. The key size of a specific ECC Brainpool curve key is always the same!

OK, I'll look into that

Another TODO: you can also expand the keygen to address Rigol's RSA devices... 

LOL, Ironically i was wondering the exact same thing and suspected that i could do exactly that.
i also had a guy contact me about the RSA series, so that's next on my TODO List

[BTO]

They have changed the appended 00 chars lately (from 2 * 00 to two hundred and something * 00) before doing the XXTEA encrypt on the key (used have 148 bytes and now there are scopes with 388 bytes). They key is the same since otherwise the old licenses would not work on newer firmware

In Regards to RSA series I would need somebody with a RSA to send me a dump of the filesystem (most notably /rigol)

(used have 148 bytes and now there are scopes with 388 bytes)

i have also seen 276 bytes as well as 148 and 388

In Regards to RSA series I would need somebody with a RSA to send me a dump of the filesystem (most notably /rigol)

I MAY BE ABLE TO HELP WITH THIS
I'll reach out to the person who approached me with the RSA Model and ask them to supply the dump,  I don't imagine they'll put up resistance as they were extremely keen
to get it activated
I'll Keep you updated

[BTO]

They have changed the appended 00 chars lately (from 2 * 00 to two hundred and something * 00) before doing the XXTEA encrypt on the key (used have 148 bytes and now there are scopes with 388 bytes). They key is the same since otherwise the old licenses would not work on newer firmware

Oh, OK. Probably they are preparing the room for changing the ECC Curve.

But, then just accommodate a bigger BIGNUM in the code and all is good. 

something to that effect.... Was my suspicion and it only started, Up to.. 2 Months ago

[tv84]

Oh, OK. Probably they are preparing the room for changing the ECC Curve.

But, then just accommodate a bigger BIGNUM in the code and all is good. 

something to that effect.... Was my suspicion and it only started, Up to.. 2 Months ago

This should not be rocket science since the method was there from the beginning. So, if one implements the code correctly by reading the ECC Curve type inside the Key.data, one can make the keygen future proof.

[BTO]

Oh, OK. Probably they are preparing the room for changing the ECC Curve.

But, then just accommodate a bigger BIGNUM in the code and all is good. 

something to that effect.... Was my suspicion and it only started, Up to.. 2 Months ago

This should not be rocket science since the method was there from the beginning. So, if one implements the code correctly by reading the ECC Curve type inside the Key.data, one can make the keygen future proof.

Understood,However consider (for me personally) When we say "Beginning" i assume we mean DS1052E.  I'm not aware of an earlier point where we
unlocked Rigol Scopes

Now.. at this time i understood what we were doing , to a degree,  i remember madcrow and a few others working on the SSH of it
then later a Utility was put together, etc etc
But.. did i understand the cryptography to it's fullest ?  NO, i did not

so... For you it's fundamental ,  For me, i'm reading up on this now,
and what also through me was , i took E.C.C. to mean Error Correction  ERROR CORRECTING CODE.

I now understand it's not that but instead ELIPTIC CURVE CRPYTOGRAPHY.
This now puts a new spin on it for me

I gotta say , I've read about 10 pages of it so far, and even though i understood it as Assym Crypto , the detail of it is pretty cool.
I do now understand what you mean when you say they just change the curve, or they can change the position of the curve so long as the algorithm
satisfies to points on the curve to produce a specific result, but.... the result can remain the same and they can choose to use
different points on the curve but in choosing different points it alters the length of the Priv Key.
Have i understood that correctly.
Needless to say...... Pretty cool stuff

anyway my brain is tired now, i'm off to be,  I'm going to spend at least the next month researching this
if you have any good resources or doco's you can recommend , it would be appreciated

i'm then going to rego through the script and reread it to understand what ecdsa was doing and what exactly brainpool is doing and what protocol
it is using
again.. I understood it for what it was, i understood it was a protocol and an Assym Crypto,   i didn't , however understand the protocol itself
or what it was actually doing

so.. that's where i'm at

[BTO]

Oh, OK. Probably they are preparing the room for changing the ECC Curve.

But, then just accommodate a bigger BIGNUM in the code and all is good. 

something to that effect.... Was my suspicion and it only started, Up to.. 2 Months ago

This should not be rocket science since the method was there from the beginning. So, if one implements the code correctly by reading the ECC Curve type inside the Key.data, one can make the keygen future proof.

So, if one implements the code correctly by reading the ECC Curve type inside the Key.data, one can make the keygen future proof.

Also, thanks for this,  I WILL look into this as i read more about and look to make the changes.

Quick Question,  Do you think this script can help the people over on the Rigol DHO Series 12bit scope side of things.
Could they benefit by looking at the script we have thus far, so they can get activated quicker ?

I imagine not, but.. Am i wrong ?

[tv84]

Quick Question,  Do you think this script can help the people over on the Rigol DHO Series 12bit scope side of things.
Could they benefit by looking at the script we have thus far, so they can get activated quicker ?

As I've indicated from the start, the method is/was meant to be the same (most probably). But as their Android programmers appear to be very poor at ECC, what was implemented (at least on day one) was an aberration based on the MSO5000 scheme! They used asym keys to do sym crypto... 

For that fact I excluded myself from that scene and gave way to all the guys that were patching the stuff, and because the solution was very easy to implement.

If Rigol has corrected the scheme or if they do that in the near future, it's almost certain that the scheme will be the same.

[BTO]

Quick Question,  Do you think this script can help the people over on the Rigol DHO Series 12bit scope side of things.
Could they benefit by looking at the script we have thus far, so they can get activated quicker ?

As I've indicated from the start, the method is/was meant to be the same (most probably). But as their Android programmers appear to be very poor at ECC, what was implemented (at least on day one) was an aberration based on the MSO5000 scheme! They used asym keys to do sym crypto... 

For that fact I excluded myself from that scene and gave way to all the guys that were patching the stuff, and because the solution was very easy to implement.

If Rigol has corrected the scheme or if they do that in the near future, it's almost certain that the scheme will be the same.

OK, Interesting, Understood, Thank you

[BTO]

Here is an updated script that should work on both 8000 and 8000A 5000,6000,7000 and 8000 series oscilloscopes

UPDATE 9 ( rigol_mso_util_2.09b.py ) 16-July-2024:
FIX: help showed first 16k of FRAM when we are actually getting just first 2k (thanks BTO for pointing it out)
UPDATE: Shows the Language, LoadLast and other info from fram


TODO:
   * try decrypt/encrypt sysvendor.bin (I think sysvendor.bin uses it's own key for each scope)
   * edit sysvendor.bin (serial, available options, model, ...)
   * get an actual Rigol MSO5000 or > to play with (without it decrypting the sysvendor.bin is not that easy as I need to ask people to run commands on their device)
   * see if the same method works on RSA (have already tried to get /rigol app from (RSA5000) fw but it uses some modified version of CRAMFS)

1. I've tested the latest script , 2.09b.py..... WORKS PERFECTLY

* get an actual Rigol MSO5000 or > to play with

2. Happy to help out

[BTO]

NOTE : I've tested rigol_mso_util_2.10b.py
WORKS WITHOUT A PROBLEM, I also like the new additions

[MegaVolt]

Tell me, is it possible to unlock the MSO8154A model to 3 GHz? Or only MSO8204A?

[BTO]

Tell me, is it possible to unlock the MSO8154A model to 3 GHz? Or only MSO8204A?

Where did you get 3GHz from ?
On the rigol site the highest model is MSO 8204A which is 2GHz so using this script you will unlock it to 2GHz

We are actually working on seeing if we can get more out of it and if you could provide a dump of your scope that'd be very helpful

I can give you clear instructions on how to do it and what we need , if you're ok with that
but for now, Stock standard, You can go up to 2GHz

But where did you get the idea that it would be 3GHz ?

[asp]

Actually MSO8204A has MSO8000A-BW20T30 so that might enable it. I know on the rigolna.com it lists that option available for MSO8204 as well but it does not work (or I could not get it to work). I do not have a MSO8204A available to test if it unlocks this option but if you want you can drop a message and we'll see