Rigol DG2052 making a screenshot and possible firmware hack  - Page 1
Forum section: electronics / testgear

author: JimKnopf
author_rank: Frequent Contributor
timestamp: August 02, 2021, 07:39:22 pm
content: Hello,i messed up my old Rigol DG1022 function generator by trying to update the device.Anyway, today arrived a brand new Rigol DG2052 function generator. I like the possibility to make screenshots an a device.Thats working great on the DG2052 in default function generator mode with a touch button in the lower right corner.But when switching to "(Frequency) Counter" mode , the "Print" touch button to take screenshots disapears.There is no option to take screenshots in frequency counter mode.When pressing the "Home" button with active "Counter" button, the display switches from "Counter" mode to default mode and the frequency is shown in a single line on the bottom and one can make a screenshot in this default mode using the "Print" touch button.I updated to the latest firmware 00.02.06.00.01. Still the same.The DG2052 has a LXI interface. I never used this before on any device. I found out, that i can capture screenshots from my laptop remote using the LXI interface and this command:echo ":DISP:DATA? 1" | nc -w1 192.168.10.54 5555 | dd bs=1 skip=11 of=image.pngWith this command, i can capture a screenshot in "Counter" mode. But after taking the screenshot, the display on the device switches from "Counter" mode to default Mode and the display is locked. I have to manually unlock it using the hardware button.1. Is there a trick to do a screenshot using one ore more hardware buttons (like on my Keithley DMM6500, i have to press Home+Enter to take a screenshot) in "Counter" mode?2. Is there a SCPI command i can add to prevent the screen lock when using LXI/SCPI?3. Can i unlock the device to full DG2102 mode (like on my DS1054Z or other DG series)?I attached some screenshots i took with the SCPI command.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: August 03, 2021, 01:54:36 pm
content: I added some pictures from inside the DG2052.Looks solid to me.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: August 03, 2021, 01:56:03 pm
content: And some more pictures.

author: TurboTom
author_rank: Super Contributor
timestamp: August 03, 2021, 02:04:30 pm
content: Compare this to the DG800 / 900 PCB -- Different but still the same...Jim -- may I ask you to identify U603, the QFN24 next to the PLL? It's got to be some DAC but since on mine it's lasered blank, I haven't been able to figure out what it is exactly (audio codec??). Yours appears to have all the inscriptions still intact, so this shouldn't be too difficut. In your photos, I cannot identify the inscription. It's just something to satisfy my curiosity...Btw, great photos and thanks for posting them -- this proves what we already suspected.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: August 03, 2021, 02:20:45 pm
content: Has anyone here tried a full memory dump via jtag from DG800/900/2000 series??Do i only need the bdsl file for Spartan 6?

author: JimKnopf
author_rank: Frequent Contributor
timestamp: August 03, 2021, 02:48:07 pm
content: @TurboTomU403 is a ADF 4360-7 #2006 31598 andU603 is a 77A77DU L7322SO

author: TurboTom
author_rank: Super Contributor
timestamp: August 03, 2021, 03:46:06 pm
content: Wow, that was fast. Thanks so much! So I was completely wrong with my assumption that this chip has got to be a DAC (for generating the offset voltages and housekeeping stuff) -- there is actually a DAC very nearby on the PCB but I didn't have it on my "radar" - you know, when you're convinced it's got to be a certain way and you're not looking left and right...This chip is actually an LMH7322SQE high speed dual comparator, and it's used to digitize the rising and falling edges of the frequency counter input signals and feeds them differentially to the FPGA. Rigol actually put quite some effort into the frequency counter section, both hardware- and software-wise. If they only wouldn't have forgotten to put a screen copy function there. Whatsoever, a good reason to request another firmware update...

author: JimKnopf
author_rank: Frequent Contributor
timestamp: August 03, 2021, 08:18:20 pm
content: I'm trying to figure out the settings for TopJTAG to dump the memory. On the mainboard i can see one 2GB Micron BGA NAND (128x16) next to the Spartan 6. On the daughter board is also the same chip and another 4GB ISSI TSOP-48 NAND.In TopJTAG i have to set the high/low level for signal pins.I can see the Spartan 6 with TopJTAG and TopProbe. I got the BDSL file for the Spartan 6.Can someone guide me how to setup the level for the signal pins? There is a guide for the DG1022. Don't know how @Igor_k figured out the pin mapping. Can i just use the level that TopProbe show me as waveform? One can see if the active level is low or high.I attached some more images.By the way, in TopJTAG i can't see the processor on the daughter board. It show me only the Spartan 6.

author: TurboTom
author_rank: Super Contributor
timestamp: August 03, 2021, 10:10:46 pm
content: I'm not really into software engineering and hacking stuff, so I may not quite understand what your intention is about accessing the FPGA JTAG.If you want to access the disc partitions, there's a hack or a firmware version (IIRC) that enables the telnet client in the instrument's O/S. If you need more direct access, you can use J2 on the processor board that provides a TTL UART. You should be able to interrupt Uboot (at least on my DG8xx this was possible) and use the shell to access all the instrument's partitions, including the FPGA configuration. Copy the stuff you need to a USB thumb drive and you're ready to go.You may want to check theDG800 / 900 thread, there's a wealth of information hidden in there.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: August 04, 2021, 05:59:30 am
content: The goal i try is, to have a full memory dump that i can move over when things mess up again like on my DG1022.I started to read the thread for the DG800/900 devices partly (started from the beginning and from the end) but missed the important part (sum up on page 25). I guess serial port access will work as long as there is a working system. The update on my DG1022 failed and there was no system at all.I just want to prevent this situation by grabbing a full memory dump.After that, i want to switch from modell number 2052 to 2102. I don't know if the steps that work on the DG800/900 series will work on DG2000 series. Because the first firmware version for DG2000 was 2.02. Don't know if 1.08 will work on it to switch the modell number.

author: TurboTom
author_rank: Super Contributor
timestamp: August 04, 2021, 09:50:51 am
content: Okay, now I get your point. But I'm pretty sure that the FPGA JTAG is only meant for debugging. There isn't any non-volatile information that stored inside the generator accessible from there. All the information that make the instrument tick is stored inside the Flash chip located on the CPU plug-in module. J1 (that's only used as an "alignment key" to insert the CPU module the proper way round) may contain a JTAG interface to access the Flash chip when it's still blank (when the module comes fresh from production).Your best bet (i.e. lowest level of access to the module) with reasonable effort would be via the UART interface to interrupt the Uboot bootloader. There are four copies (partitions) of the bootloader in the Flash so the probability of all of them failing at the same time is basically only the occurance of a massive hardware fault. In which case the instrument would be rendered unusable anyway. Enter Uboot, take images of all the partitions on the flash (to a thumb drive) and you're as safe as you can be.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: August 04, 2021, 05:46:34 pm
content: @TurboTom Seems you're right. I figured out the pinmapping for TopProbe/TopJTAG and let it read nearly 7 hours for 128MB of empty memory.I hooked up my Eprom programmer and read out the W25X40CLNIG Eprom. Seems my fear is baseless. The uboot system is on this Eprom. From there i can restore if needed the system. I connected my CP2102 UART serial adapter only to find out that it's either faulty or incompatible for some reasons. Used a cheap CJMCU-232H instead and tried to login.I did not stopped the boot process. After the system was running i tried to login without entering a name/password and after that failed, i tried root/sardine_uboot combination. But did also not work.To my surprise, the welcome screen had a funny surprise: Welcome to Rigol DG800 systemIt's still a DG2052.

author: Sonicsx
author_rank: Newbie
timestamp: November 27, 2022, 06:25:15 pm
content: Hi there,Nice job!! I got a question. Did you manage to hack the DG2052 to unlock 100 MHz (sine wave) and 25 MHz (square wave)? The hardware of DG2000 and DG800/900 series are almost the same:https://www.eevblog.com/forum/testgear/new-rigol-16-bit-function-generators-dg800900-series/msg2420391/#msg2420391Thank you!

author: JimKnopf
author_rank: Frequent Contributor
timestamp: November 27, 2022, 06:50:09 pm
content: @Sonicsx I tried to flash the DG900 image provided by TV84. The hardware is a bit different. It didn't work. I wasn't able to connect via network to the device. I had a hard time getting it back to work.

author: ToThePub
author_rank: Contributor
timestamp: December 02, 2022, 12:01:02 am
content: Have you tried using the DG800 USB stick process and just trying to change the model number with the SCPI :PROJ:MODE DG2102 method?So, no flashing firmware, just make the usb stick, send the SCPI command to see if the model changes.Thanks..*Edit: Some quick research and firmware between the 800/900/2000 is exactly the same (as you kind of saw in the login message!). So hopefully the USB key process might work?

author: elimenohpee
author_rank: Contributor
timestamp: January 25, 2023, 04:45:16 pm
content: Quote from: ToThePub on December 02, 2022, 12:01:02 amInterested in this as well!

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 26, 2023, 09:42:49 pm
content: @TothePub@elimenohpeeToday i gave it a try. But i only get an error.What i did was:1. I grabed a 16GB USB Stick with a 2 GB FAT32 partition on it.2. I created a file DG800_sardinha.bin (touch DG800_sardinha.bin) and open it with with Bless Hex Editor to enter the content "0B0A3B2E5F4CECBE"3. I checked the file: xxd DG800_sardinha.binresult: 00000000: 0b0a 3b2e 5f4c ecbe ..;._L..4. I placed the content to the USB Stick with: dd if=DG800_sardinha.bin of=/dev/sdb1 bs=512 seek=20000005. I checked the USB Stick: dd if=/dev/sdb1 of=block.bin skip=2000000 count=1cat block.binresult: ;._L�Cg>uM��\�%��9�fxl�x����Nn����Q��lJ?�86. I put the Stick into the DG2052 and enter this commands:echo ":PROJ:MODE DG2102" | nc -w1 192.168.10.54 5555and after it failedecho ":PROJ:MODE DG992" | nc -w1 192.168.10.54 5555I only got an error msg. The model number is still the same. Nothing changed.I grabed an image from Info screen with this commands:echo ":HCOP:SDUM:DATA:Format PNG" | nc -w1 192.168.10.54 5555echo ":DISP:DATA? 1" | nc -w1 192.168.10.54 5555 | dd bs=1 skip=11 of=image_2.pngAn image of the error msg is attached.Edit:To create such a USB Stick, it's easier to do it like this:mount /dev/sdb1mkfs.vfat -F 32 /dev/sdb1echo -n -e \\x0B\\x0A\\x3B\\x2E\\x5F\\x4C\\xEC\\xBE | dd of=/dev/sdb1 bs=512 seek=2000000Check with:dd if=/dev/sdb1 skip=2000000 count=1|xxd -l8output is: 1+0 Datensätze ein1+0 Datensätze aus00000000: 0b0a 3b2e 5f4c ecbe ..;._L..512 Bytes kopiert, 5,6097e-05 s, 9,1 MB/s

author: ToThePub
author_rank: Contributor
timestamp: January 26, 2023, 11:31:37 pm
content: Humm... Dam it... Many thanks for trying. Didn't think it would work as that method changed in the latest firmware which its running, but worth a try.Will need a different method it seems.

author: elimenohpee
author_rank: Contributor
timestamp: January 27, 2023, 01:09:59 pm
content: Quote from: JimKnopf on January 26, 2023, 09:42:49 pmbummer, thanks for trying. I was just about to start this but you saved me the effort.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 28, 2023, 05:33:23 pm
content: @TurboTomHow can i write to usb device in uboot?Steps are not well documented and rarely used in this forum.I already grabbed the content from SPI eprom. In this eprom-content is the uboot password in plain text "sardine_uboot".Now i want (just for exercise) read the sardine_uboot.img from nand and write it to a USB Stick.I plugged in a USB Stick, logged into uboot, and did:usb startprintenvfat_uboot_file=sardine-uboot.imgfdtaddr=0x88000000filesize=ae0000nand read 0x88000000 0x0 0xae0000NAND read: device 0 offset 0x0, size 0xae000011403264 bytes read: OKsave usb 0:1 0x88000000 sardine-uboot.img 0xae0000But i only get an error msg: ** Unable to write file sardine-uboot.img ** and fatls usb 0:1 show me an empty USB Stick "0 file(s), 0 dir(s)"I read in some other threads that newer devices are able to use tftp to send files. The DG2052 only has tftpboot to grab files from a server.How can i save the nand content and maybe the SPI eprom content to a usb device using UART/uboot?

author: tv84
author_rank: Super Contributor
timestamp: January 28, 2023, 07:51:06 pm
content: Quote from: JimKnopf on January 28, 2023, 05:33:23 pmThat depends on the uboot implementation. It's not a generic thing.Have you looked at all the commands available in uboot?Alternatively, you can always dump your mem contents to screen (in hex form, for example) and log it in your terminal client. Then, in the PC, you just parse the output and create a bin file. I've done it dozens of times.Many times uboot USB can't see the partitions and you only see the device. In that case, you must consider writing/reading to the direct raw sectors of the USB device.

author: Njk
author_rank: Frequent Contributor
timestamp: May 26, 2023, 07:14:18 pm
content: The instrument integrates the frequency counter. Similar to that in DG800/900 series, it has the two input couplings, DC and AC. There is at least one confirmed report in the sister thread about the AC coupling issue. When coupling is set to "AC", the center pin of the BNC input connector of the counter is internally tied to -5.3 V voltage level by a high ohm resistorhttps://www.eevblog.com/forum/testgear/new-rigol-16-bit-function-generators-dg800900-series/msg3591372/#msg3591372. That seems unusual and I wonder if DG2000 is also affected.According to Rigol, both DG2000 and DG900 series uses essentially similar HW. But let's look at the frequency counter areas of the DG2000 and DG800 PCBs (attached). The difference is not only in the layouts. In both the designs, the input signal from the connector is first routed to the clamping diode array (a SOT-23 part with JY marking, likely BAV199). Concerning the DC path, the signal is then passes through the resistor of 88 (or 66) Ohm. Then there is a switch that is likely related to the AC/DC coupling. That's where the difference is.In the DG800, the switch is made of the two SOT-23 parts (with 61U and 6K markings, likely old Fairchild JFETs MMBF5461 and MMBF4392 respectively. Perhaps -5.3 V is a bias voltage for the JFETs, so user must bring his own cap for AC coupling). While in the DG2000, the switch is made of single big part, the marking of which is difficult to read. So the analog front ends are apparently different, and the reason is not clear.Perhaps it's a minor change because of the parts availability. DG2000 was designed later, and in 2019-2020 both MMBF5461 and MMBF4392 were declared obsolete by OnSemi. While MMBF4392 was replaced with MMBF4392L, no substitution was offered for MMBF5461, so Rigol was forced to change the design. The chances are a later DG800/900 HW revisions were also updated accordingly (pure speculation). That's why it's interesting if the AC coupling issue is related only to the old design or not.All in all, there is a lot of components in the counter PCB area. Dozens of discrete components and 8 op-amps in total. No idea if every the op-amp is related to the frequency counter, but there is also one 1P8T analog switch (HC4051) the purpose of which is not clear. There is only one that part so it's unlikely it's used elsewhere (as the generator has two channels). It's quite complex electrical arrangement for the frequency counter of unspecified accuracy. Moreover, there is a dedicated 16-bit DAC and two fast comparators. With one more DAC, it could be possible to implement two independent triggers, like in more serious counters, allowing to measure e.g. a pulse edge time. But it seems there are too many stoppers in the SW department.P.S. JimKnopf, thanks for the hi-res PCB images. Hope you're doing well.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: May 29, 2023, 09:49:09 am
content: @NjKI just tested the counter voltage in DC and AC coupling mode.I didn't measure negative voltage like -5,x V on center pin. There is no difference between DC and AC coupling.The AC measurement showing me some normal fluctuating voltage.I grabbed some scrrenshots from linux terminal usingecho ":HCOP:SDUM:DATA:FORM PNG" | nc -w1 192.168.10.54 5555echo ":DISP:DATA? 1" | nc -w1 192.168.10.54 5555 | dd bs=1 skip=11 of=counter_1.png (or whatever name you want)I'm running Software Version 00.02.06.00.01 on my DG2052.Activating the counter disables Output 2 (normal behavior, i remember that i read something in the manual about that).The Counter button LED is flashing when activated instead of the permanent glow like Output 1 and 2 button.

author: TurboTom
author_rank: Super Contributor
timestamp: May 29, 2023, 10:46:34 am
content: The signal path of the counter circuitry is basically only rounted through discretes (except for final digitization that is). There's a jfet input and some level shifting taking place. @Njk is correct -- the AC/DC switching is arranged diffenetly in the two models, a look at Rigol's most inexpensive oscilloscopes helps here: The SO4 component used in the DG2000 circuitry is a Cosmo solid state (PhotoMOS) relay, used to short out the coupling cap. Since apparently a perfect galvanic isolation from control to signal paths isn't required (which may affect signal fidelity), the older circuitry utilizes here a cheaper, discrete approach.The TL072 that's apparently routed in the counter's signal path is most likely processing the DC/LF channel of the input amplifier and maybe providing some bias voltages. The signal is then routed through the relay (later more on that) to the LMH7322 comparator (QFN24 with the markings lasered off in the DG800 version) that finally digitizes the counter input signal and feeds it differentially to the FPGA.The small TSOP8 (DAC8560), the TL072 and TL074 opamps and the 4051 analog multiplexer (sample&hold) are just used to provide several high-resolution (16 bit) analog control voltages to the rest of the circuitry (channel offsets, trigger levels and who knows what). This circuitry block can be found in many Rigol and Siglent AWGs with almost exactly the same components, and even DSOs feature this circuitry.One detail that's most peculiar and not 100% clear to me is why the AWG pre-driver outputs are routed back to the analog comparator'inputs (via 499R - 68A marking) and (probably) 10kR pullups/grounding resistors. This feedback signal is multiplexed via the relay with the counter input channel, and that's the reason the DG800/900/2000 series of AWGs unfortunately loses one of its AWG channels whenever the counter is enabled. The additionally required fast comparator fell victim to the "bean counters" in these economy AWGs... Maybe the AWG signal feedback is somewhat related to propagation delay compensation/deskew of the channels?

author: Njk
author_rank: Frequent Contributor
timestamp: May 30, 2023, 02:23:34 pm
content: Quote from: JimKnopf on May 29, 2023, 09:49:09 amSo another HW difference between DG2000 and DG800/900 is finally revealed. BTW, it seems in DG800 the negative bias produces the two effects. First, it can be measured on the center pin. Second, it affects the comparator. Looks like with AC coupling, the virtual zero level is also biased down to at least -2.5 V and the counter shows nothing unless the trigger level is set to -2.5 V. Even after that, the sensitivity is much worse than with DC coupling, suggesting the virtual ground is actually biased to a deeper minus level, to -5V. Looks like AC coupling is implemented just to check the box. It must be better in DG2000, I presume.

author: Njk
author_rank: Frequent Contributor
timestamp: May 30, 2023, 04:08:11 pm
content: Quote from: TurboTom on May 29, 2023, 10:46:34 amYes, sample and hold. This was also my suspicion. To share the DAC in that way. As for bean counting, that simple business is known from the ancient times, similar to sex working. But in that case I've a doubt the DAC price itself could make a difference. It's not a performance DAC as an ADC in the scopes. It's a commodity. On the other hand, a sample and hold circuit also requires additional HW parts, a branded capacitors, etc. This also comes with the cost, not discussing the added man hours at the design time.But phase locking the channels in a pure programmatic way is proved next to impossible. After all, the machine word is of 32 bits and even floating point ops does not offer unlimited accuracy. So there is a give up flag on the front panel in the form of Align button, and we hardly can see a cheap generator with no such button. It sounds very plausible they're using the fast comparator for channel synchronization. BTW if that's the case, we can estimate the real synchronization accuracy from the comparator delay time. Anyway a fast comparator part can cost more than a slow DAC so it seems they'd simply decided to don't complicate the counter with more and more dedicated parts.BTW, when counter is enabled, the limitation is not only in the reduced channel number. The generator can use the two methods of waveform rendering, the DDS and "true AWG", "Advanced" or something like that (the difference is well explained in the educational papers from Tek and HP). Perhaps the "true" method requires more computations, and because of that the Advanced waveforms can't be generated when the counter is enabled.