Author Topic: Sniffing the Rigol's internal I2C bus  (Read 1885477 times)

0 Members and 6 Guests are viewing this topic.

Offline techydude

  • Supporter
  • ****
  • Posts: 45
  • Country: us
  • E.E. from .au in SF.
Re: Sniffing the Rigol's internal I2C bus
« Reply #1150 on: October 08, 2013, 04:45:12 pm »
fiiiiiine.
y'all owe me 4 hours sleep  :=\

ok, you owe me nothing, just don't bitch when i wake up in the morning grumpier than usual.

although despite 4 hours reading, i still haven't found a post describing the distinction between the DS1074Z (70MHz) & DS1104Z (100MHz) - different h/w (unlike the DS2072/2102/2202) ?
 

Offline Rory

  • Frequent Contributor
  • **
  • Posts: 410
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #1151 on: October 08, 2013, 05:17:57 pm »

It is an excellent read, of discovery and intrigue, with exploration first into the hardware and a small bug like hack on top of ROM, then the JTAG spying, and the many players from all around the world, and the success by Cybernet and the opening of many secrets starting on the DS2000, but moving on to the DG4000, the DS4000, the DSA815 and more,
A story that John Le Carré would write :-+ :-+

Yes, only in a fictional universe can one find folks as brilliant as Cybernet and the rest of the guys who contributed their efforts into this. I guess EEVBLOG Dave can be considered the Hugo Gernsback of this genre?
 

Offline van-c

  • Regular Contributor
  • *
  • Posts: 69
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #1152 on: October 09, 2013, 01:24:11 am »
It is definitely a good read.  One topic still in suspense, though, is the new "A" model scopes, which are now briefly mentioned on the TEquipment web pages.  Has anyone yet verified whether the techniques discussed here for the DS2000 work for the DS2000A?
 

Offline Niffler

  • Newbie
  • Posts: 4
  • Country: se
Model: DS2302
« Reply #1153 on: October 15, 2013, 08:33:11 pm »
Hi,

I just used the KeyGen (ver 2.0b1) to generate a license key.
Before doing so i made sure i had the latest firmware version 00.01.01.00.02

System information before using license key:

Model:   DS2072
Serial:  DS2A1515xxxxx
Software version:  00.01.01.00.02
Hardware version:  1.0.2.0.0
FPGA version:
                   SPU  03.01.05
                   WPU  00.06.05
                   CCU  12.29.00
                   MCU  00.05

The license key was generated using Option code: DSAZ (all options, DS2202, License Type: Official)
After restart the options page shows all options install and official with 200M BandWidth option.
I can now set horizontal scale down to 1nsec and bandwidth limit to 20M, 100M and 200M.
Se attached image.

It sems like my scope thinks it is a 300 MHz version  :-+  unfortunate i don't have anything to test its bandwidth with.
Have any body seen this before ?

PS, Thanks for all your hard work in this forum, great read.
 

Offline Fagear

  • Regular Contributor
  • *
  • Posts: 83
  • Country: ru
Re: Sniffing the Rigol's internal I2C bus
« Reply #1154 on: October 15, 2013, 08:55:38 pm »
SPU, WPU, CCU, MCU versions look the same. Not HW2.0. What is that? HW 1.0.2.0.0 ?..
That's exactly what the top of DS2000A series should be, not DS2000!
Congratulations, Niffler! :-+ Check maybe there is working 50 ohm option also?  :D
 

Offline AndreaEl

  • Contributor
  • Posts: 40
  • Country: it
Re: Sniffing the Rigol's internal I2C bus
« Reply #1155 on: October 15, 2013, 09:00:44 pm »
Hardware version is 1.0.2.0.0 because is in "advanced info". in "normal info" are 2.0

I have the same system info in a DS2072 recently bought. But 50ohm not available :(

My system info:

Model:   DS2072
Serial:  DS2A15320xxxx
Software version:  00.01.01.00.02
Hardware version:  1.0.2.0.0
FPGA version:
                   SPU  03.01.05
                   WPU  00.06.05
                   CCU  12.29.00
                   MCU  00.05

Calibration date: 15-Aug-2013


Probe: Rigol RP3300A - Fixed 10:1 Probe
My equipment:

Multimeter: HP 34401A, HP 3478A, HP 3466A, Fluke 115
Oscilloscope: Rigol DS2072 (DS2202)
Function generator: SRS DS335
Electronic load: Maynuo M9811
Power supply: TDK-Lambda ZUP 20-20, 2x Atten TPR3602A, Atten APR1505A, Atten APR12001A, Atten AT1001D
 

Offline Fagear

  • Regular Contributor
  • *
  • Posts: 83
  • Country: ru
Re: Sniffing the Rigol's internal I2C bus
« Reply #1156 on: October 15, 2013, 09:04:44 pm »
AndreaEl, oh, I see.
So, have you checked - does your device turn into DS2302 or DS2202? You have all verisons the same as Niffler.

Is it version-related or something else, that isn't? Or is it some sort of time-limit (crazy)? What devices can be turned into DS2302?..
« Last Edit: October 15, 2013, 09:08:00 pm by Fagear »
 

Offline AndreaEl

  • Contributor
  • Posts: 40
  • Country: it
Re: Sniffing the Rigol's internal I2C bus
« Reply #1157 on: October 15, 2013, 09:07:41 pm »
My device now are a DS2202 because i have install the key for 200M BW + All Option. Not DS2302
My equipment:

Multimeter: HP 34401A, HP 3478A, HP 3466A, Fluke 115
Oscilloscope: Rigol DS2072 (DS2202)
Function generator: SRS DS335
Electronic load: Maynuo M9811
Power supply: TDK-Lambda ZUP 20-20, 2x Atten TPR3602A, Atten APR1505A, Atten APR12001A, Atten AT1001D
 

Offline Fagear

  • Regular Contributor
  • *
  • Posts: 83
  • Country: ru
Re: Sniffing the Rigol's internal I2C bus
« Reply #1158 on: October 15, 2013, 09:10:59 pm »
And the same did Niffler. So this is not version related, that is something else! Did you tried to uninstall all options and install them again? Maybe it is current date related (must be crazy)?
 

Offline van-c

  • Regular Contributor
  • *
  • Posts: 69
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #1159 on: October 15, 2013, 09:13:11 pm »
Is CAN bus trigger and decode option present?
 

Offline AndreaEl

  • Contributor
  • Posts: 40
  • Country: it
Re: Sniffing the Rigol's internal I2C bus
« Reply #1160 on: October 15, 2013, 09:25:32 pm »
Sorry but now i can't do and check nothing with oscilloscope. Tomorrow i have to wake up early for university.  :=\

Maybe tomorrow i can return home 1-2 hour and i check for decode option and for reinstall option.
But with the key generator are only possible select 70M/100M/200M. i think that is impossible have a DS2302 (with a DS2072) with the key genrator that are available for now.
My equipment:

Multimeter: HP 34401A, HP 3478A, HP 3466A, Fluke 115
Oscilloscope: Rigol DS2072 (DS2202)
Function generator: SRS DS335
Electronic load: Maynuo M9811
Power supply: TDK-Lambda ZUP 20-20, 2x Atten TPR3602A, Atten APR1505A, Atten APR12001A, Atten AT1001D
 

Offline Fagear

  • Regular Contributor
  • *
  • Posts: 83
  • Country: ru
Re: Sniffing the Rigol's internal I2C bus
« Reply #1161 on: October 15, 2013, 09:28:32 pm »
Sorry but now i can't do and check nothing with oscilloscope.
...
But with the key generator are only possible select 70M/100M/200M. i think that is impossible have a DS2302 (with a DS2072) with the key genrator that are available for now.
No problem, we will wait you here. ;) But as you can see, Niffler used same keygen and set all the same options:
I just used the KeyGen (ver 2.0b1) to generate a license key.
...
The license key was generated using Option code: DSAZ (all options, DS2202, License Type: Official)
After restart the options page shows all options install and official with 200M BandWidth option.
I can now set horizontal scale down to 1nsec and bandwidth limit to 20M, 100M and 200M.
...
It sems like my scope thinks it is a 300 MHz version
 

Offline Niffler

  • Newbie
  • Posts: 4
  • Country: se
Re: Sniffing the Rigol's internal I2C bus
« Reply #1162 on: October 15, 2013, 09:47:19 pm »
I have no CAN bus trigger or decoder.
My installed options page shows the same as others with all options.
I did not have to update the firmware it came with the latest version.
The first time i tried to enter a generated key it was wrong (stupid mistake of not entering the private key).
I have never uninstalled anything on the scope and only entered one accepted key.

When i first discovered that it actually said DS2302 not DS2202 which i had expected i was afraid i had done something wrong and i had/would possibly lose the serial number as have append to others, but my serial number is not changed and everything seems to work perfect.
And it has stayed the same for many restart.
 

Offline JDubU

  • Frequent Contributor
  • **
  • Posts: 441
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #1163 on: October 15, 2013, 09:57:27 pm »
I have no CAN bus trigger or decoder.
My installed options page shows the same as others with all options.
I did not have to update the firmware it came with the latest version.
The first time i tried to enter a generated key it was wrong (stupid mistake of not entering the private key).
I have never uninstalled anything on the scope and only entered one accepted key.

When i first discovered that it actually said DS2302 not DS2202 which i had expected i was afraid i had done something wrong and i had/would possibly lose the serial number as have append to others, but my serial number is not changed and everything seems to work perfect.
And it has stayed the same for many restart.

Do you have the 50 ohm input option available on the menu?
 

Offline stormbr

  • Regular Contributor
  • *
  • Posts: 50
  • Country: br
Re: Sniffing the Rigol's internal I2C bus
« Reply #1164 on: October 15, 2013, 11:26:59 pm »
My ds2072 arrive here today and was unlocked with sucess.

before update / system info

Model: DS2072
Serial: DS2A15350XXXX
Software version: 00.01.01
Hardware version: 2.0

after update / system info

Model: DS2202
Serial: DS2A15350XXXX
Software version: 00.01.01
Hardware version: 2.0

Special thanks for cybernet and studio25.

Note:

I used the code DSAZ for enabled all options and DSAS to 200MHz.

But for me not show the option 200M on BW Limit into ch1 menu, only the options off, 20M and 100M.
« Last Edit: October 16, 2013, 12:04:23 am by stormbr »
 

Offline ahnuts72

  • Regular Contributor
  • *
  • Posts: 215
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #1165 on: October 16, 2013, 01:02:37 am »
I don't have one but I would assume off is 200 Mhz it wouldn't show 200 if that was the highest bandwidth.

Sent from my Nook HD

.
 

Offline stormbr

  • Regular Contributor
  • *
  • Posts: 50
  • Country: br
Re: Sniffing the Rigol's internal I2C bus
« Reply #1166 on: October 16, 2013, 01:25:54 am »
I think that this can mensure 200mhz, but the "bw limit" function (200M) not showed for me (ds2072a).

More info:

Horizontal scale:  2ns up to 1ks
Menu utility/options/installed: all enabled with official version (include 200MHz bandwidth option).
 

Offline staze

  • Frequent Contributor
  • **
  • Posts: 820
  • Country: us
  • I _might_ have a problem...
    • Everybody Staze...
Re: Sniffing the Rigol's internal I2C bus
« Reply #1167 on: October 16, 2013, 05:02:42 am »
My scope info looks pretty much the same, have the 200mhz hack installed. Obviously not seeing it as a 2302. Wonder if we found some kind of happy "bug" with the keygen? Received mine about a month ago, or so through tequipment.net.

“Give a man an answer, he’ll keep his job for a day. Teach a man to Google, and he’ll be employed for a lifetime”
 

Offline JDubU

  • Frequent Contributor
  • **
  • Posts: 441
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #1168 on: October 16, 2013, 05:19:54 am »
My scope info looks pretty much the same, have the 200mhz hack installed. Obviously not seeing it as a 2302. Wonder if we found some kind of happy "bug" with the keygen? Received mine about a month ago, or so through tequipment.net.

The curious thing is that Niffler's DS2072 looks to be an earlier release of HW v2.
His serial number begins with DS2A1515 which would have been manufactured the last week of April of 2013.
Your serial number (DS2A1534...) indicates a manufacturing date in mid August 2013.

I wonder if there might be some different non-volatile memory content or hardware jumper settings that make the difference in option availability.
« Last Edit: October 16, 2013, 05:25:44 am by JDubU »
 

Offline staze

  • Frequent Contributor
  • **
  • Posts: 820
  • Country: us
  • I _might_ have a problem...
    • Everybody Staze...
Re: Sniffing the Rigol's internal I2C bus
« Reply #1169 on: October 16, 2013, 05:46:35 am »

The curious thing is that Niffler's DS2072 looks to be an earlier release of HW v2.
His serial number begins with DS2A1515 which would have been manufactured the last week of April of 2013.
Your serial number (DS2A1534...) indicates a manufacturing date in mid August 2013.

I wonder if there might be some different non-volatile memory content or hardware jumper settings that make the difference in option availability.

Yeah, noticed that. Either it's as you said, or something about the specific seed that he used for his unlock code? I too used DSAZ with Rigen 2b1.
“Give a man an answer, he’ll keep his job for a day. Teach a man to Google, and he’ll be employed for a lifetime”
 

Offline JDubU

  • Frequent Contributor
  • **
  • Posts: 441
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #1170 on: October 16, 2013, 05:53:53 am »
Yeah, noticed that. Either it's as you said, or something about the specific seed that he used for his unlock code? I too used DSAZ with Rigen 2b1.


Good point.

Niffler:  Did you use a seed different than the default?

 

Offline staze

  • Frequent Contributor
  • **
  • Posts: 820
  • Country: us
  • I _might_ have a problem...
    • Everybody Staze...
Re: Sniffing the Rigol's internal I2C bus
« Reply #1171 on: October 16, 2013, 06:02:45 am »
Yeah, noticed that. Either it's as you said, or something about the specific seed that he used for his unlock code? I too used DSAZ with Rigen 2b1.


Good point.

Niffler:  Did you use a seed different than the default?

As a note, I used a different seed... I just hit the generate button a half dozen times before hand. =)
“Give a man an answer, he’ll keep his job for a day. Teach a man to Google, and he’ll be employed for a lifetime”
 

Offline Niffler

  • Newbie
  • Posts: 4
  • Country: se
Re: Sniffing the Rigol's internal I2C bus
« Reply #1172 on: October 16, 2013, 11:27:27 am »
I generated the license key with the default seed of 1, (having read that it would work with default).
No 50 ohm input option, at least not what i have found yet.
There may be some state that enables that.

I have had the scope for a while, i wanted to test it for a while before i "hacked" it in case there was some problem that popped up (it dying or some thing)
That why my scope is a bit earlier model, i was a bit of a coward for a while.

I will post a picture of the options page when i get home.
 

Offline gilbjd

  • Contributor
  • Posts: 14
  • Country: au
Re: Model: DS2302
« Reply #1173 on: October 16, 2013, 12:26:37 pm »
Hi,

I just used the KeyGen (ver 2.0b1) to generate a license key.
Before doing so i made sure i had the latest firmware version 00.01.01.00.02

System information before using license key:

Model:   DS2072
Serial:  DS2A1515xxxxx
Software version:  00.01.01.00.02
Hardware version:  1.0.2.0.0
FPGA version:
                   SPU  03.01.05
                   WPU  00.06.05
                   CCU  12.29.00
                   MCU  00.05

The license key was generated using Option code: DSAZ (all options, DS2202, License Type: Official)
After restart the options page shows all options install and official with 200M BandWidth option.
I can now set horizontal scale down to 1nsec and bandwidth limit to 20M, 100M and 200M.
Se attached image.

It sems like my scope thinks it is a 300 MHz version  :-+  unfortunate i don't have anything to test its bandwidth with.
Have any body seen this before ?

PS, Thanks for all your hard work in this forum, great read.


Interesting ... Niffler's DS2072 was manufactured in the 15th week of 2013 and has a Hardware version of 1.0.2.0.0

Mine was manufactured in the 20th week of 2013 yet it only has a Hardware version of 1.0.1.0.0
 

Offline JDubU

  • Frequent Contributor
  • **
  • Posts: 441
  • Country: us
Re: Sniffing the Rigol's internal I2C bus
« Reply #1174 on: October 16, 2013, 04:32:39 pm »
No 50 ohm input option, at least not what i have found yet.
There may be some state that enables that.

The 50 ohm input option is on the CH1/CH2 menu, fourth entry down, labelled "Input".
It normally shows a grayed out "1Mohm".  Does yours toggle to "50ohm"?
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf