Is the Rigol MSO1074Z hackable?

[MattSR]

Hi all, apologies if this is covered elsewhere, but is the Rigol MSO1074Z hackable? I have searched here but found no real references to upgrading this model..

Cheers

[Howardlong]

As it currently stands, you will need an appropriate JTAG debugger.

Smgvbest has an excellent how-to here https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg569236/#msg569236 , far better than my attempt a few posts earlier which had been written some weeks after doing it (for reference here https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg566312/#msg566312 )

Smgvbest says that the debugger she used is no longer made. I used an Olimex ARM-USB-OCD-H which is still available.

[MattSR]

Hi Howard - that's fantastic info, it more than makes up for my lack of google-fu/search-fu!

I'll have a close read and figure out what I need to get to do this.

Thanks again,
Matt!

[aviphysics]

Hi,

would these hacks also apply to the MSO1074Z-S ?

Thanks in advance.

[fldutchman]

I just tried the keygen with the riglol option, and had no luck with an MSO1074Z SW 00.04.01.SP2, board 2.1.1. Guess it's JTAG time. I'll post a follow-up when I've had a chance to try the JTAG approach.

--fdm

[smgvbest]

MSO1074Z-S is hack-able.  there are several posts int he Rigol I2C thread and this but you must open the scope up and dump memory to get the keys. and you have to use a custom version of rigup to do it which is also posted in the thread.

My post is here https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg569236/#msg569236

[kripton2035]

use this excellent software to get the memorydump - dont void the warranty opening the scope or using jtag
http://peter.dreisiebner.at/rigol-bildschirmkopie-lan/#screenshot

[hammy]

use this excellent software to get the memorydump - dont void the warranty opening the scope or using jtag

... no, not possible with the MSO1000z. JTAG is the way to go.

[kripton2035]

has been tested with DS1104Z :

[Howardlong]

How do you use the tool to extract a memory dump? At present I am unaware of a SCPI command that works with the DS/MSO1000Z series to perform a memory dump.

[hammy]

has been tested with DS1104Z :

yes, this part is working ... but ... the last time the scpi command for the memory dump was not implemented in the DS/MSO1000z series.

This is now possible? With the new firmware?

[kripton2035]

I can't recall where, but there is a thread on eevblog where someone pointed me this tool and said it worked for his ds1054z
got the memory dump with a simple usb cable. it was in november or so
I dont have a rigol so I cannot say I personnaly did the hack with this tool.

[smgvbest]

I just did a search of eevblog for this website and the only link was in mention of the DS2000 not the DS1000

I just tried a :SYST:UTIL:READ? 15441920,13262848 using is and the same message on my MSO1074Z-S
There was an error when sending the SCPI command.

If someone can find the message mentioned that would be good but far as we know you can not dump memory thru SCPI on the DS1000Z series scopes.  Opening it and using JTAG is the only known way on these scopes

Also the OP is asking for the MSO1000Z series not the DS1000Z so maybe it does work on the DS1000Z I don't know I do not have one but that is not the OP's question

[Howardlong]

Unless it can be shown otherwise, as it currently stands I agree, you need to use JTAG to get the memory dump for the DS/MSO1000Z series as they don't have a RAM read SCPI function. For the avoidance of doubt, for the DS1000Z series, you don't need the dump anyway. But you do for the MSO1000Z series.

Sounds like there's been a bit of hearsay at play, and internet hearsay at that!

[MattSR]

For the avoidance of doubt, for the DS1000Z series, you don't need the dump anyway. But you do for the MSO1000Z series.

That lines up with all the research I have done on here.

[smgvbest]

Sounds like there's been a bit of hearsay at play, and internet hearsay at that!

Yes, and we know just how reliable the internet can be.
I remember a saying,  Trust but Verify

[aviphysics]

Unless it can be shown otherwise, as it currently stands I agree, you need to use JTAG to get the memory dump for the DS/MSO1000Z series as they don't have a RAM read SCPI function. For the avoidance of doubt, for the DS1000Z series, you don't need the dump anyway. But you do for the MSO1000Z series.

Sounds like there's been a bit of hearsay at play, and internet hearsay at that!

Why don't you need the dump for the DS?

Also, is there a possibility that someone will eventually be able to create a tool that can generate the codes from whatever number Rigol uses when you buy an upgrade?

[Howardlong]

Unless it can be shown otherwise, as it currently stands I agree, you need to use JTAG to get the memory dump for the DS/MSO1000Z series as they don't have a RAM read SCPI function. For the avoidance of doubt, for the DS1000Z series, you don't need the dump anyway. But you do for the MSO1000Z series.

Sounds like there's been a bit of hearsay at play, and internet hearsay at that!

Why don't you need the dump for the DS?

Also, is there a possibility that someone will eventually be able to create a tool that can generate the codes from whatever number Rigol uses when you buy an upgrade?

The way the keys are generated are fundamentally different between the DS1000Z and MSO1000Z. I don't pretend to know the details of it, but that's how it is.

[crispus]

Is the version -s of there MSO hackable (MSO1074Z-S)?

[Howardlong]

Is the version -s of there MSO hackable (MSO1074Z-S)?

Yes, or at least it was when I did mine.

[kripton2035]

did you need a jtag method to hack your mso1074z-s ?

[Howardlong]

did you need a jtag method to hack your mso1074z-s ?

Yes. The signal generator is just a bolted on daughter board, plus an extra button on the front panel. It makes no difference to the upgrade process. The thing that makes a difference is whether it's a DS1000Z, DS1000Z+ ot MSO1000Z: the first can be upgraded without the jtag procedure, the latter two need the jtag method as it stands. Recently there has also been some question as to whether newer plusses and MSOs are still all upgradeable. Certainly some are, but it's not clear yet whether those not successful are struggling with the procedure, or whether there's been a recent change preventing the method working.

[scuff]

Hi all,

I've just bought a brand new MSO1074Z-S, which I'm hoping to hack.  Can anyone confirm whether the hack mentioned here and in other linked threads is still working on the latest hardware and firmware?  My unit has:

Software version: 00.04.04.SP1
Board version: 6.1.4

Thanks in advance!

[mikehs]

Unless it can be shown otherwise, as it currently stands I agree, you need to use JTAG to get the memory dump for the DS/MSO1000Z series as they don't have a RAM read SCPI function. For the avoidance of doubt, for the DS1000Z series, you don't need the dump anyway. But you do for the MSO1000Z series.

Sounds like there's been a bit of hearsay at play, and internet hearsay at that!

Why don't you need the dump for the DS?

Also, is there a possibility that someone will eventually be able to create a tool that can generate the codes from whatever number Rigol uses when you buy an upgrade?

The way the keys are generated are fundamentally different between the DS1000Z and MSO1000Z. I don't pretend to know the details of it, but that's how it is.

I don't know if that is still the case.  I just got a new DS1054Z and tried the the Riglol1.03d keygen and got invalid.  I plan on playing a bit more with it before having to go the route of dumping.

[ebastler]

I just got a new DS1054Z and tried the the Riglol1.03d keygen and got invalid.  I plan on playing a bit more with it before having to go the route of dumping.

By all reports on this forum so far, the Riglol key generator still works for all regular DS1054Z scopes. (I.e. non-MSO and non Plus models.) Quite a few users have reported problems with the browser-based key generator, which could always be fixed by

• trying again,
• trying yet again,
• switching to a different browser, or
• using the offline version of the keygen program.

Please have a look at the DS1054Z monster thread, working your way backwards -- there were a few recent posts on this, I believe.