The Dark Side of the Rigol Hack -- Bricked Scope & How to Fix it... - Page 1
Forum section: electronics / general

author: drieg
author_rank: Regular Contributor
timestamp: September 28, 2010, 09:14:31 am
content: The purpose of this thread is to help/support people with their broken Rigol DS1052E scope.The most common problem is totally dead scope after unsuccessful firmware "downgrade/upgrade". The only way to recover it is to reprogramm the flash chip (Spansion S29GL064N90TFI04) either via BlackFins's JTAG interface or in external programmer. There is very important part inside the flash with the factory calibration data, which is unique to every unit. These data has to be preserved in a new flash image for proper operation.Second common issue is partially working scope, which doesn't shows signals correctly after a 100MHz patch (see story of shafri and others for details). These problems are caused by corrupted factory calibraion data which may get corrupted probably when patching via serial cable (especially if you accidentally hit the ENTER instead of sending correct <LF> char). This is the reason, why I strongly recommend:DO NOT USE SERIAL CABLE!Some people ask me about how to hack scope HW version "xy", FW version "xx.xx.xx". The fact is, that different firmware supports different HW version, so there isalways some riskwhen you are running the FW that doesn't support your HW version. Please don't ask me if it's safe to downgrade to FW 02.02, if you have HW version "57" or "58" - I don't knowHere's the table which FW supports which HW. Higher FW supports all older HW versions.HW versionFW version5800.02.04.01.005700.02.04.00.030700.02.02.02.00WARNING:Do not experiment with undocumented SCPI commands especially if you don't know the correct syntax. You can corrupt or lost some of imortant calibraion data!Repair historyrepair datemodel(nick)namedetails08/28/2010DS1052Elynx / SEbricked after unsuccessful FW upgrade10/08/2010DS1052Edimlow / UKcorrupted calibration data (same as shafri:problem description)10/08/2010DS1052Eshafri (Mechatrommer)corrupted calibration data (problem description)09/20/2010DS1052Ejasper / USbricked after unsuccessful FW upgrade09/26/2010DS1052EBen / AUbricked after unsuccessful FW upgrade10/26/2010DS1052EViktor / BYbricked after unsuccessful FW upgrade10/27/2010DS1052EGiovambattista / ITbricked after unsuccessful FW upgrade11/02/2010DS1052Emainer / ATbricked after unsuccessful FW upgrade11/03/2010DS1052ELarry / USbricked after unsuccessful FW upgrade11/22/2010DS1052EPeter / AUbricked after unsuccessful FW upgrade11/23/2010DS1052Eteixeluiscorrupted calibration data (problem description)01/03/2011DS1102EMohammad / IRbricked after unsuccessful FW upgrade02/02/2011DS1052EChris / USbricked after unsuccessful FW upgrade02/03/2011DS1052EMel / UKbricked after unsuccessful FW upgrade02/06/2011DS1102EMarlon / USbricked after unsuccessful FW upgrade02/11/2011DS1052Enasser32corrupted calibration data (same as shafri:problem description)02/21/2011DS1052EBrian/ USbricked after unsuccessful FW upgrade03/09/2011DS1052EDavid / AUbricked after unsuccessful FW upgrade04/28/2011DS1052EDenis / RUbricked after unsuccessful FW upgrade05/05/2011DS1052EHans / NLbricked after unsuccessful FW upgrade06/01/2011DS1052DRob / NLcorrupted calibration data06/29/2011DS1052EAndres / ESbricked after unsuccessful FW upgrade10/01/2011DS1052ERay / UKbricked after unsuccessful FW upgrade10/16/2011DS1052EJeremy / AUcorrupted calibration data10/17/2011DS1052EDoug / UScorrupted calibration data11/24/2011DS1052EAleksandr / RUbricked after unsuccessful FW upgrade04/10/2012DS1052ERob / UKcorrupted calibration data...02/11/2019DS1052EBruzzel / DEwrong firmware flashed02/17/2019DS1042CTaras / UAbricked after unsuccessful FW upgrade02/21/2019DS1302CAivi_yak / UAwrong firmware flashed

author: dimlow
author_rank: Frequent Contributor
timestamp: September 28, 2010, 11:10:17 am
content: Well Drieg has certainly got my hopes up, yesterday i required a scope, so i used my Uni-T UT81B, but it didn't quite meet my needs. Cant look at a 20Mhz signal with a 10Mhz Scope! BTW i love this little meter for when im poking about with micro controllers on a breadboard. I guess a should post my views of it in the UT81B thread.

author: nebarnix
author_rank: Newbie
timestamp: September 28, 2010, 02:11:30 pm
content: Drieg, you have really helped me out! I got the chip back yesterday and I think I soldered it back in record time. I couldn't wait to assemble to scope properly and left the power supply hanging off of the table. Guess what, the scope is alive again!! Thank you!!To everyone else. my scope was broken when I attempted to upgrade the firmware. I Upgraded, rebooted, and them bam... nothing. Blank. I will admit we had a few beers as an old friend was in town so I was sure that somehow I had put the wrong image on the flash drive. I checked and rechecked but all seemed in order. Its not even my scope so it was somewhat embarrassing to do this in front of a bunch of people including the owner of the scope and have to say "Oh sorry... guess you don't have a scope anymore!".After trying unsuccessfully for several months with a blackfin programmer and a half-built homebrew programmer in VHDL I met Drieg and I sent my poor blank spansion flash chip off to go see Europe and start a new life there. After becoming sufficiently cultured it crossed the Atlantic once more (I believe that it was quite homesick) and it is perfect working condition! Thanks so much Drieg! I am lucky that the factory calibration data was not erased-Nebarnix

author: Waifian
author_rank: Regular Contributor
timestamp: September 28, 2010, 03:04:38 pm
content: QuoteWould that include a square wave frome a function generator that appeared as a sine wave on the rigol scope. I didn't know what to think. I am still not sure if it was the function generator or the scope as the scope seems okay... I did run the recalibration tool a few times because I also had the issue of the vertical system being wierd at the 5volt per division mark. It was about a volt below ground with nothing connected and seemed to be the worst at the 5volt per division area. After recalibrating it again it seems okay.... I am not sure if my scope is shoddy now or not...

author: armandas
author_rank: Frequent Contributor
timestamp: September 28, 2010, 03:42:32 pm
content: Quote from: shafri on September 28, 2010, 03:00:48 pmWhat about all other threads in this forum, shafri?

author: NiHaoMike
author_rank: Super Contributor
timestamp: September 28, 2010, 11:02:55 pm
content: Maybe read the calibration data, keep a backup in a safe place, and just try randomly changing values to see what they do? Not much to lose if it's already unusable.

author: dimlow
author_rank: Frequent Contributor
timestamp: September 29, 2010, 12:20:32 pm
content: I Just thought id bump this tread as Drieg has updated his first post asking for help. He needs that data for my scope and id love to get it fixed, so please if you have one of the scopes get in contact.

author: yyao
author_rank: Contributor
timestamp: October 02, 2010, 03:55:13 pm
content: Like I said in the other thread (https://www.eevblog.com/forum/index.php?topic=553.msg18626#msg18626), this was the situation I was in:Came with firmware 2.04 SP1Has been downgraded to firmware 2.02 SP2 for changing the model numberExhibits repetitive noise at high sampling rates after self calibrationCannot be upgraded to 2.04 SP1 (because the firmware isn't available to the public yet)Although it doesn't provide you with an unusable scope, it is kind of annoying.

author: d0ss
author_rank: Contributor
timestamp: October 04, 2010, 01:57:52 pm
content: Quote from: yyao on October 02, 2010, 03:55:13 pmI've got the same issue as above, and would love to get it fixed. I've tried asking Rigol for the 2.04 SP1 firmware no reply as of yet. Serial starts with DS1ED123, I would appreciate any help given. Thanks

author: Polossatik
author_rank: Frequent Contributor
timestamp: October 04, 2010, 06:23:04 pm
content: I have aDS1ED121xxxxxxscope , if you ever need info from that serial range, let me know.

author: Zap
author_rank: Newbie
timestamp: October 07, 2010, 01:25:25 pm
content: Drieg has helped me endlessly in my quest to fix my CRO. We have not got there currently ( but that's totally through my lack of skills).I hope one day i get to buy him a beer and thank him in person because he has helped me so much with advice and personal time and effort. Its so nice to see that there is genuinely fantastic people out there.If i manage to get it working again i will name thee "Driegol 1053E enhanced"

author: dimlow
author_rank: Frequent Contributor
timestamp: October 07, 2010, 04:28:08 pm
content: Yep drieg is one of the good guys. Im hoping to have my scope sorted soon. Without him id be stuck with this dead scope for ever.

author: wolen
author_rank: Newbie
timestamp: October 08, 2010, 08:02:41 pm
content: Dear drieg at I too have spoiled Rigol DS1052E by attempt to change firmware with E on D.Write please in detail how to restore firmware by a simple way.At inclusion the white screen. Whether necessarily to take a microcircuit?Send if it is possible firmware for the chipI live in Russia, English I know poorly, excuse.wolend1@mail.ru

author: wolen
author_rank: Newbie
timestamp: October 09, 2010, 10:05:41 am
content: Dear drieg I have bought in China (mail) Rigol DS1052EHe well worked.I have read http: // embedders.org/content/kak-iz-rigol-ds10 52e-sdelat-rigol-ds1102e and has made it.It has turned out. He well worked. (large difference has not noticed except for 2 n?/d and DS1052E - DS1102E)Then I have tried to change firmware DS1052D in DS1052E through WINHEX and to stitch to her.It has turned out. He well worked. (nothing has changed except for DS1102E - DS1052D) (LA has not appeared:))Then I have tried to replace firmware from another (Not Rigol) I any more do not remember what, it seems and to stitch it(him).The size firmware was 6 mbytes (on Rigol 4 mbytes)Has failed.??? has passed, I have switched off?? and has switched on it(him) the simply light screen has appeared. There is no reaction to buttons.

author: dimlow
author_rank: Frequent Contributor
timestamp: October 09, 2010, 10:43:39 am
content: @ShafiYes. Drieg has sent me the fix for my scope, i have tested it and it seems to be working. I still need to test some more. I did start some further tests and i was going to test it against my 400Mhz HP54502A scope, but when i turned on my old reliable, she is no longer reliable. It popped up with Calibration Memory checksum error. So i spent quite a few hours trying to recalibrate it and failing, it seems that the old HP is dead nowAnyway one thing i noticed is that the rigol, when presented with the same waveform on each channel gives different voltage levels. They differ by about .2 Volts. Although the scope does seem to be working, i think accuracy has been lost in the vertical axis.Further tests and I will report back.

author: drieg
author_rank: Regular Contributor
timestamp: October 09, 2010, 08:57:47 pm
content: @wolenI can help you, but you have to desolder the flash chip and send it to me for reprogramming. If you don't have a good hot air rework station around or you are not skilled or brave enough to do it, you can also send me the whole mainboard. PM sent.

author: wolen
author_rank: Newbie
timestamp: October 10, 2010, 09:41:51 am
content: Large thanks Dear Drieg!I shall send by mail you mine mainboard.I hope that mine Rigol DS1052E will work.

author: Mechatrommer
author_rank: Super Contributor
timestamp: October 10, 2010, 10:28:35 am
content: my rigol is fixed now. the vertical offsets that i was report about?... its now gone! my rigol is working 100% fine right now. i'm glad that i have my scope back. Thanx Drieg!

author: xoom
author_rank: Regular Contributor
timestamp: October 10, 2010, 10:34:51 am
content: Nice to hear thatnow anyone can more freely breathe if they brick their scope

author: saturation
author_rank: Super Contributor
timestamp: October 10, 2010, 05:18:30 pm
content: Great! Thanks to Drieg, there is hope! A great start to a full recovery for bricked scopes.Why is this thread a thumbs down? Its probably the only published solution for a failed hack.

author: dimlow
author_rank: Frequent Contributor
timestamp: October 10, 2010, 06:20:45 pm
content: Big Thanks to Drieg, Im satisfied that my scope is now working within spec, Another great fix, Your the man,

author: Zap
author_rank: Newbie
timestamp: October 19, 2010, 04:01:45 pm
content: Thanks to Drieg i now (once again) have a scope.... not only a scope but a 100MHz scope.I totally bricked it, did a poor job of de-soldering the chip ( i thought i would give him a challenge) he fixed the chip however due to my pin abuse i did not managed to re-solder it.Drieg then went out of his way to re-program another chip for me and send it around the world to Aus and shazam it now works. The amount of effort and advice he has given me is amazing i will be forever in debt of his kindness, the Driegol 1052E enhanced now lives!Thank you so much!

author: suppersready
author_rank: Newbie
timestamp: October 20, 2010, 08:33:49 am
content: Like others, i have bricked my DS1052E trying to downgrade the firmware from 02.04.01.02 to 02.02.02What happens if i send back it to the seller for repairing, my scope is on warranty.If it's a bad idea i will send the board to you Drieg.(sorry for my english i am italian)Thanks drieg for the great job

author: Zero999
author_rank: Super Contributor
timestamp: October 20, 2010, 10:27:12 am
content: I would assume performing hacks like this will void any warranty so do it at your own risk and preferably after the warranty period has expired otherwise you have to take responsibility for repairing it.

author: Mechatrommer
author_rank: Super Contributor
timestamp: October 20, 2010, 03:02:24 pm
content: Quote from: Hero999 on October 20, 2010, 10:27:12 ami dont think sending legitimate RS232/USB command will void the warranty. for me, it shouldnt. even if we feed with random data, the scope should be well protected from that, as proven by Drieg sometime ago, RS232 comm is not so reliable, so meaning the Rigol design got flaw.

author: dimlow
author_rank: Frequent Contributor
timestamp: October 20, 2010, 04:06:58 pm
content: I wonder if someone should approach Rigol and just ask them how they stand on this. It would be interesting to see what they have to say about the hack/ undocumented feature. Its obvious that they know about it.

author: Mechatrommer
author_rank: Super Contributor
timestamp: October 20, 2010, 05:17:53 pm
content: Quote from: dimlow on October 20, 2010, 04:06:58 pmi bet they wont reply. thats their "pant". and they know we keep peeping it, and so they will be busy try covering it. they forgot... thats the thing that makes us interested at them.

author: drieg
author_rank: Regular Contributor
timestamp: October 20, 2010, 05:19:03 pm
content: @suppersreadyIf you purchased it from China, then sending the mainboard to me will be surely cheaper & faster solution (I'm from EU too). Drop me an email if you need my help...

author: Fraser
author_rank: Super Contributor
timestamp: October 20, 2010, 09:03:33 pm
content: In my experience manufacturers take a dim view of any attempted 'hack' of an equipments BIOS. They can probably see what was being attempted by the legacy corrupted data that remains in the memory chipThat is not to say that they will not repair it but in every case I have seen, the manufacturer has charged either an administration/handling fee or a 'calibration' fee. Neither is cheap and I have seen charges of between GBP50 and GBP400 quoted for such work. As soon as the OS memory area is corrupted by a user, the warranty is effectively invalidated as this is considered self inflicted unless proven otherwise. I agree that the user should not be able to accidentally damage the 1052E via RS232 but lets not kid ourselves..... Rigol knows that users are regularly attempting to hack the BIOS via this port so I doubt anyone would succeed in convincing them it was an accident.Many manufacturers refuse to issue firmware updates. I have asked some why this is and had a similar response in each case "we do not wish to handle fault calls from users who have corrupted their equipments firmware due to poor practice or procedure". Such companies will often suggest that a firmware upgrade is normally required only if a problem exists that a later FW version fixes and the equipment should be sent to them for update and calibration.... Credit Card number please......OT but relevant ...... I own an ICOM PCR1000 monitoring receiver that uses an unprotected EEPROM containing unique and very important calibration data. It was found that third party control software could and did corrupt the EEPROM data by accident and in an unpredictable fashion. ICOM never admitted any liability in the UK or USA and charged a hefty re-calibration fee. Their view was that the user shouldn't be messing with 3rd party software or the proprietary command set.Drieg is probabably the only person who can help with a bricked Rigol and we are fortunate indeed that he wishes to use his time to help others.

author: beerhunter
author_rank: Contributor
timestamp: October 20, 2010, 09:24:13 pm
content: Quote from: dimlow on October 20, 2010, 04:06:58 pmI actually asked the sales engineer at Rigolna about fixing a bricked scope and they said sure they can fix it but your warranty is shot and whats you credit card number? He also said they know all about the mod and told me to be very careful doing it as he knew what I was doing to it. He was very nice though.

author: sonicj
author_rank: Frequent Contributor
timestamp: October 21, 2010, 07:20:44 pm
content: manufacturers shouldn't take offense to customers trying to make better use of their products, they should take note! if the thing was perfect, people (most) wouldn't be dickin' around in the insides. "ohh, well apparently no-ones uses our product the way we thought they would and everyone thinks our user interface is garbage" etc.i got greedy with my spektrum dx7 transmitter. 20 hours of runtime between charges wasn't enough (first gen w/nicads was 4hr) so i replaced the lm317 with a recom 7803 switching regulator. everything went great! until.... i was measuring current consumption of the new regulator and instead of flipping the unit off with the switch, i pulled the probe off the contact. whammy! blew out the eprom. the switch hard cuts power to eprom where as pulling the probe (battery) lets voltage slowly sag over about 5 seconds which apparently kills the thing.im going for the good customer approach... im sending it back with 3 other genuine warranty claim items. hopefully they won't ream me a new one!-sj

author: Time
author_rank: Frequent Contributor
timestamp: October 21, 2010, 07:23:14 pm
content: PC LOAD LETTER!? WHAT THE ^&%* DOES THAT MEAN!?

author: sonicj
author_rank: Frequent Contributor
timestamp: October 22, 2010, 07:21:06 pm
content: Quote from: shafri on October 22, 2010, 06:16:21 pmyou haven't seenThe Best Movie Evaar?-sj

author: marianoapp
author_rank: Regular Contributor
timestamp: October 22, 2010, 10:23:40 pm
content: Quote from: sonicj on October 22, 2010, 07:21:06 pmthe company where I work is certifying theISO 9000standards for quality management systems, so I'm gonna be filling TPS-like reports in no time

author: drieg
author_rank: Regular Contributor
timestamp: October 23, 2010, 08:23:40 am
content: Please guys, no off-topic in here. I'd like to keep this thread useful and small as possible...Thanks

author: .o:0|O|0:o.
author_rank: Regular Contributor
timestamp: October 23, 2010, 05:12:13 pm
content: Quote from: Aurora on October 20, 2010, 09:03:33 pmThen again, if you consider how popular the DS1052E has become as a consequence of being (not-so-)easily upgradable, how many have been purchased, destroyed or repaired (and the business that follows), and how the Rigol name now fills the eBay columns, Internet pages and the wet dreams of nerds world wide, you might be forced to conclude that if the "weakness" were intentional, "it well worked" as a pretty successful marketing strategy!.o:0||0:o.

author: suppersready
author_rank: Newbie
timestamp: November 04, 2010, 10:04:41 pm
content: Hi all,Drieg revived my Rigol scope after an unsuccesfully firmware update.Thank you Drieg

author: Meiner
author_rank: Newbie
timestamp: November 06, 2010, 06:21:49 pm
content: Hi All,a while ago I reported about bricking my DS1052E while attempting to downgrade. I then had some tries of my own to fix it, but then I bought a second scope and lost track of the bricked one, because I was frustrated and busy with my project for which I use the scope.Thanks to Drieg it's today alive again. Another Driegol enhanced.... Thank you very much, Drieg!!!

author: tyblu
author_rank: Frequent Contributor
timestamp: November 07, 2010, 07:07:00 pm
content: Could someone of repute, one we can trust to transfer the funds, setup a Paypal donation account for Dreig?

author: watermeary2
author_rank: Newbie
timestamp: November 08, 2010, 03:55:59 am
content: The Dark Side of the Rigol Hack,it is very useful,thanks

author: Polossatik
author_rank: Frequent Contributor
timestamp: November 08, 2010, 11:50:08 am
content: Quote from: tyblu on November 07, 2010, 07:07:00 pmThe best person to do that is DriegIf you're in the Euro zone then simply ask him his IBAN account nr (do not post it somewhere) and transfer what you want.In contrast to Paypickpocket (for a $1 donation he will get only $0.67) it will mean that he get actually the amount you transfer and not amount minus 2.2% + $0.30 costs.

author: drieg
author_rank: Regular Contributor
timestamp: November 09, 2010, 12:15:31 pm
content: Quote from: polossatik on November 08, 2010, 11:50:08 amThanks guys for bringing up this topic.I don't charge anything for my help or repair service, only the postage is to pay (if sending a flash chip is necessary). Of course, there is some work behind it, so if someone whom I helped with his broken scope offers me a small donation, then cool, I gladly provide my paypal account info. I must say, usually people are nice in this regard and most of them already donated me after we managed to fix their problem. Anyway, this is something totally voluntary and of course I'll help to anyone who is in trouble regardless of that. However, anybody who will support my development will not regret

author: dimlow
author_rank: Frequent Contributor
timestamp: November 09, 2010, 05:36:01 pm
content: I have to admit i forgot to send him something, will be doing very soon.

author: webrider99
author_rank: Newbie
timestamp: November 10, 2010, 02:46:48 am
content: Looking forward to an unopened box brick fix. I am still awaiting my scope delivery and am hoping not to need this fix but will donate to help get this fix accomplished even if I never need it..

author: teixeluis
author_rank: Contributor
timestamp: November 17, 2010, 12:09:00 am
content: Hi Drieg,I have reported an issue I'm having, in this topic:https://www.eevblog.com/forum/index.php?topic=553.255I'm woundering if given the type of behaviour experienced, upgrading to FW 2.04 SP1 could be the solution in this case, considering that the HW version is unknown (it is blank after thehack), and that the factory FW version was 2.02 SP2.Is it possible to dump the full flash through JTAG? With a dump of the flash you could attempt a correction?Thank you.Regards,lteixeira

author: drieg
author_rank: Regular Contributor
timestamp: November 18, 2010, 11:47:47 am
content: Hi lteixeira,unfortunately you've corupted some of your factory calibration data (blame it on your fingers).Drop me and email and hopefully we will find some solution...

author: M84AB1
author_rank: Contributor
timestamp: November 19, 2010, 05:26:46 am
content: Quote from: yyao on October 02, 2010, 03:55:13 pmWould you be able to provide us with a picture so that we can see what is considered repetitive noise? The trace on my Rigol 1052E has always had some noise and it is never just a straight trace. I have seen the same with other people's Rigols on youtube. I have recently hacked my Rigol to 100Mhz and it behaves the same the way it did before the hack. I would therefore love to see a picture so that I can know if the noise I am talking about is the same one that you are talking about.Thanks in advance :-)

author: teixeluis
author_rank: Contributor
timestamp: November 25, 2010, 10:52:54 am
content: Thanks to Drieg the problem with my scope is now fixed. Hardware version and missing calibration parameters are now recovered/recreated.While 2.04 SP1 firmware fixed the noise at time base below 500 ns/div, other not so obvious issues were still present, and all deriving froma BW hack through the serial port. So, for those willing to attempt the BW increase, forget about the serial port method (don't get infected bythe enthusiasm expressed by Dave Jones's video). It's better go for more reliable methods such as USB, using the NI VISA tools.lteixeira

author: msh959
author_rank: Newbie
timestamp: December 11, 2010, 10:31:40 am
content: Hi, I have or it's better to say I had DS1102E.When I press "Yes" button to update it's firmware it went blank and after that when I restart it there wasn't anything to saw in screen except some colored line.How can I repair it?Is this only way to sent DS1102 motherboard to Drieg?

author: rudinietz
author_rank: Newbie
timestamp: December 11, 2010, 04:10:11 pm
content: Hi,I have a RIGOL DS1052D with LA-Module. After the hack to the DS1102 the noise (<200ns/Div) is very high.There can I find the original Firmware 00.02.04.01.00 for the HW58 DS1000D?Please help me!Thanks

author: drieg
author_rank: Regular Contributor
timestamp: December 11, 2010, 10:36:17 pm
content: @msh959If you have the possiblitily to read/write the flash, you can send me only the dump file, otherwise you have to send me the mainboard or the flash chip.@rudinietzTry to ask Rigol for the fresh FW file for your unit.

author: darrylp
author_rank: Regular Contributor
timestamp: December 14, 2010, 10:37:58 pm
content: so Drieg, do you have a copy of the 02.05 firmware yet ?can i ask how you are recovering most of the failed flash attempts ? does the JTAG connect to the flash chip ?

author: drieg
author_rank: Regular Contributor
timestamp: December 17, 2010, 08:57:55 am
content: No, I don't have 02.05 FW yet. If anyone has it, I'd be interesing to look at it...Check my 1st post in this thread for your question. Usually the flash desolder/read/write/solder cycle is needed. The JTAG connects to Blackfin only.

author: darrylp
author_rank: Regular Contributor
timestamp: December 17, 2010, 10:36:34 am
content: Quote from: drieg on December 17, 2010, 08:57:55 ami've got a circuit board with the 02.05.... i've not got the tools to de-solder the flash.... but would be willing to send the board to you, if you have the tools to do the job. ie. remove the flash, save copy, place a lower version, up the model number, and then return the 02.05 firmware ?of course i'd cover the postage both ways, but wouldn't want to send it until the new year ( as my country ( the UK ) is very back-logged on deliveries with the bad weather and the xmas rush )prehaps continue in email ?

author: Fraser
author_rank: Super Contributor
timestamp: December 17, 2010, 11:23:23 am
content: Quote from: darrylp on December 17, 2010, 10:36:34 amDarrylp,If Drieg is willing to do the work for you, I would recommend that you not return your scope to FW2.05 unless Drieg finds that the hardware requires it. As you have HW58 it is very likely that FW2.04SP1 will work perfectly with it and you will then have the ability to do further unofficial firmware updates in the future. FW2.05 would appear to be just a countermeasure release, hobbled to prevent unofficial firmware updates. From my understanding, Rigol were not intending to make any significant improvements to the 2.04 firmware. It's your decsion but given the opportunity I would prefer FW2.04SP1 to FW2.05.

author: darrylp
author_rank: Regular Contributor
timestamp: December 17, 2010, 01:27:24 pm
content: Quote from: Aurora on December 17, 2010, 11:23:23 amyes, i see what you are saying, but the calibration data, its location ( inferred by Drieg, to be easily corrupted and matched to hardware and firmware level ) would be wrong.... doing a replace of the 2.05 when done, means the scope will work.if Drieg has ( i'm sure he does ) a DS1052e, then he can use the board (my board ) with his screen / buttons whilst on a lower version of firmware .... even a calibration to see how it works, and if needed can be returned to the 'snapshot copy of the firmware before calibration'it's up to him, hopefully from it, we will have a binary firmware 2.05 ( which can be used to flash back onto 'scopes ) i'm guessing the newer firmware is looking for a new upgrade filename, and maybe some checksum ( once we have the file, we can see the CRC of it. and maybe a file version inside the firmware rather than just in the header 21 bytes.)either way, we move a step in the right direction to being able to 'unlock' the higher bandwidth in software of the DS1052e scopes.ps. this board in question 02.05 firmware is listed as H/W 58. so still no news of a newer hardware revision from the factory.

author: drieg
author_rank: Regular Contributor
timestamp: December 20, 2010, 10:05:11 am
content: Aurora is right, if you have HW58, you should be able to run 02.04 SP1 without problems (after Self-Cal).Unfortunately the flash dump and the firmware file are two (more or less) different things. Most probably they changed file header and/or implemented some kind of protection/encryption or maybe changed the file structure too. To be able to create working FW file from the flash dump, you have to exactly know how.I think the only way is to wait until somebody manages to get the oficial 2.05 FW file...

author: killerwhale
author_rank: Contributor
timestamp: December 24, 2010, 03:33:58 am
content: Hi, drieg. If we had a 2.05 FW dump file, would it not be possible by disassembling it to find out exactly how this firmware decides if the update is possible? Of course, if we could somehow find the entry point, init values, etc. Or am I missing something?

author: drieg
author_rank: Regular Contributor
timestamp: December 25, 2010, 07:24:33 pm
content: That would be definitely possible, as long as you have enough time, skills and tools to do so...

author: scrat
author_rank: Frequent Contributor
timestamp: December 25, 2010, 11:31:41 pm
content: Quote from: drieg on December 20, 2010, 10:05:11 amI don't have a clear view of the whole thing (memory inside the Rigol). Could you please explain more in detail?Are there two programmed memories, one inside the Blackfin and one on a flash chip? Where is (more probably) the calibration data contained? How did you guess that? Did you manage to extract the calibration data among all the memory?I know this could be part of your professional knowledge, but I'd spend some money to have your insight!Another reason why I'm asking is that, if it's like I figured it out, writing all data taken from a 2.04SP1 (or 2.X) scope onto a newer one will make the hack possible, maybe at the cost of desoldering/writing/soldering and loosing calibration data.Am I so wrong?Thanks,Sandro

author: Fraser
author_rank: Super Contributor
timestamp: December 27, 2010, 09:41:22 pm
content: FW 2.05 appears to be hackable :-)See here:https://www.eevblog.com/forum/index.php?topic=553.345Having just checked 'Killerwhales' firmware file, it appears that Rigol changed the header contents to something non ASCII except for the DS1000E identifier. I presume Killerwhale has cut the header from a copy of FW2.05 but know not where he got it from.

author: msh959
author_rank: Newbie
timestamp: January 16, 2011, 12:36:30 pm
content: Hi everyone,I have DS1102E.About one month ago I wanted to update the firmware.So I downloaded a firmware and when I tried to update my Rigol it crashed and it didn't show anything in the LCD, so I started to search and find a way to repair it and suddenly I found Drieg in this forum.I send an E-mail to him and I told him what happen to my oscilloscope.After some question I found that the best way is to send the main board to him because I don't have a device to demount the spansion IC. I live in Asia so it take 8 days to arrived.After that he sent a mail to me that he get the board and fix it.I think the best way is to send the main board to him. You can just send An E-mail to him and ask him to help.When it finish and he send it back to you, you pay him for his work.I'm really happy.I turn my Rigol on and saw the 2.05 version on the screen.

author: nasser32
author_rank: Newbie
timestamp: February 11, 2011, 09:45:11 pm
content: Hi everyone,Youuuuuuuuuuuuuuuuuuhooooooooooooooooooo!!!My RIGOL scope works fine again thanks to Mr. Drieg.One year ago, I bought a RIGOL DS1052 scope and it was a good companion until I tried to hack it to a 1102.I mistyped a character meanwhile and Yes, my scope ruined. It couldn't be used any more.I searched to find some way to repair it. but I found that I can't do anything by myself.when there was no hope, I found Mr. Drieg and emailed him. after some questions about my problem, he could find a way to repeir it.he did something for me that no one could do. he repair it "REMOTELY". he sent me a special manipulated firmware which could repair my scope even without openning its case.He is so tallent I believe.If you have a similar problem, ask him for help. I bet you'll never regret. this is the closest approach to repair your damaged scope.>>>> **** THANK YOU MR. DRIEG FOR YOUR GREAT HELP **** <<<<

author: tonva
author_rank: Newbie
timestamp: April 03, 2011, 07:05:46 pm
content: Quote from: drieg on December 25, 2010, 07:24:33 pmWell, as for me, time and skills enough (retired), just tools missing. May be some cooperation will be useful for all involved?

author: tonva
author_rank: Newbie
timestamp: April 03, 2011, 07:17:27 pm
content: Quote from: Aurora on December 27, 2010, 09:41:22 pmCurrent DS1052E's come with 02.05.02.00 firmware so the hack for 02.05.01 does not work.The only long-term solution I see is some "nondestructive" method of firmware downgrade not based on Rigol's update tools.(using JTAG or so). Has anyone some idea how it can be done?

author: d.giddy
author_rank: Newbie
timestamp: April 06, 2011, 10:30:27 am
content: Very pleased to report that Drieg has managed to get my dead DS1052 going again. Here's my story:- Purchased a DS1052E- "Upgraded" it to a DS1102E using the widely available USB firmware procedure - seemed to work fine.- Further updated the firmware to 02.04.03 to get the menus back - seemed to work fine.- Have since then had an intermittent problem where the scope didn't always boot. Often got to the splash screen and then went to a grey screen with a few wavy lines. Usually only a problem if it had been in use for a while and then was turned off and turned back on. Would fairly reliably start when it was cold, but rarely if it was hot.- Decided to downgrade back to the 02.02 firmware that I used for the initial patch in the hope of making the start more reliable. In the process the load seemed to fail about 80% through and after power cycling, I get a screen with wavy lines only - no splash screen.- I sent the main board to Drieg who's got it going now with firmware 02.05.Thanks Drieg!

author: DenisRU
author_rank: Newbie
timestamp: April 28, 2011, 12:59:25 pm
content: Sorry for my english.Hi everyone! I live in Russia. I wanted to tell you my story how I killed my Oscilloscope Rigol DS1052E. He came to me with firmware 00.02.05.02., At that time upgrate in DS1102E was impossible. Not long ago there was information about how to do it.https://www.eevblog.com/forum/index.php?topic=553.msg42404#msg42404.In short, I flashed it. ... .. After that it could not run. The mood has fallen. I will not tell you how I did it ...I turned to Drieg. He told me to read a dump from the chip Spansion S29GL064N90TFI04 and send it back to him. If you’re interested in programming, I had a Triton + V5.7Thttp://www.triton-prog.ru. I ordered an adapter for this chip. Not the first time but I managed to read the data correctly. Posted the dump to Drieg. Soon he sent me a corrected dump. I flashed the chip and soldered it in place. After that, my Rigol alive.I would like to express my deep gratitude to Drieg. Thanks very much to him! The world is not without good people. For more of these ...

author: saturation
author_rank: Super Contributor
timestamp: April 28, 2011, 01:49:53 pm
content: Great story. Drieg's icon is very well deserved, and this thread is a valuable part of the forum.Quote from: DenisRU on April 28, 2011, 12:59:25 pm

author: HB-1905
author_rank: Newbie
timestamp: May 11, 2011, 08:31:00 pm
content: Just another chapter in the bricked Rigol DS1052E story:- planning for the 1052 to 1102 hack- during the FW downgrade it all seems fine but the reboot prompt at the end did not appear- switched off/on (perhaps a retry would have been a better idea...)- ... the scope was not a scope anymoreLooking the internet for other victims and indeed, there were more! Also found Drieg's contact details on this blog. Amazing: being in trouble to find such a (possible) escape! Lucky me, he was able and especially willing to help me. Sent the mainboard since I lack the skills to do the repair on my own.After only one week the board was back again being sent from The Netherlands. I noticed he did the repair in about one hour! I know, he is professional but nevertheless. On the board there is no trace whatsoever of this repair. Even the numbered label on the chip is placed back very carefully. The (de)soldering? Simply perfect.So, Drieg did the repair, upgraded to FW 2.05 and did the hack for me. You might call this the safest way ... His skills and service are really remarkable. Also communicating to this guy is enjoyable. I would almost advice to brick your scope on purpose ...

author: Kitsyboy
author_rank: Newbie
timestamp: June 09, 2011, 08:22:20 pm
content: Same story here,I have a DS1052D which was running a very old firmware version (0105). I tried to hack the scope with the serial interface. Instead of ending the strings with a Linefeed character I accidentally typed CR. followed by some backspaces. After that the initial configuration data of the scope was gone. In the hardware info screen the Hardware version was messed up and the scope was 30% off spec.(a 10 Volt signal appeared to be 6 volt on the scope).Drieg has succesfully helped me to restore the initial data. He truly as an awful lot of knowledge about the inner workings of this scope.Thanks again Drieg for unbricking the scope, and to everyone I would say: Never use the serial method, use the USB method which is far more safe.

author: rf-loop
author_rank: Super Contributor
timestamp: June 26, 2011, 09:46:54 am
content: Quote from: dimlow on October 09, 2010, 10:43:39 amOff Topic. if need continue, then other thread.My opinion is that your HP54502A need only new NVRAM and then need do perfect recalibration just following exactly service manual.(54502A is very sensitive in calibration prosedure and it fails very easy. Sometimes it need some small adjustment before selfcal go ok but inside scope adjustments need special knowledge and instrumets - other way it only go more bad. Also you need good perfect set of calibration cables. )After NVRAM change it first need factory default and then do ALL steps exactly as service manual explain for calibrating - The manual does not contain any unnecessary words or sentences.If selfcal fails in any step --> stop and start totally beginning with full factory defaults (reset all selfcal data).If it fails all times in same step then need do service manual adjustments exactly with required instruments.If still fails there is HW problem. (mostly littlebit bad input attenuator module.)Selfcal cables need be perfect quality, many coaxial cables with cheap noname BNC connectors may cause problem becouse specially shield connectors are loose. Also old machine BNC connectors may be dirty. (use pure isopropyl alcohol or "dry" video cleaner. Front BNC' do not use whatever "contact spray", they may damage input attenuator module behind BNC)BTW 54502A is good scope specially for timing measurements. It is 6 bit adc but it is not problem if use this scope for purposes for what it have designed. (extremely nice is that it have real 50 ohm inputs for rf work. This can not solve using 50 ohm terminator in normal high imbedance input scopes)

author: dimlow
author_rank: Frequent Contributor
timestamp: June 26, 2011, 11:54:50 am
content: I have since fixed the scope, only needed some new NVRAM!

author: rf-loop
author_rank: Super Contributor
timestamp: June 26, 2011, 12:56:13 pm
content: Quote from: dimlow on June 26, 2011, 11:54:50 amOh and just I find this: "dimlow onOctober 09, 2010, 12:43:39 PM"So I have write comment to very old message what I accidentally find as I use some other "Search".But, for common info, these scopes are most common fails are repairable.(today there is no company who make this quality in production or specially if look littlebit more old HP's)EOOT (end of off topic)

author: dimlow
author_rank: Frequent Contributor
timestamp: June 26, 2011, 01:47:48 pm
content: I dont really see what your getting at, and im sure that last quote is not from me

author: gm0otb
author_rank: Contributor
timestamp: October 04, 2011, 12:59:52 pm
content: I would just like to say a big thank's to Drieg for unbricking my DS1052E after an unsuccessful firmware downgrade attempt.While attempting a downgrade (don't ask why!) I never received the "Updata successful" message, after turning the scope off, i was never to see life in the old Rigol again, well that's until Drieg breathed new life back in itThanks Drieg, for the excellent speedy service, It was with pleasure I made a small donation, you are a credit to the hobby!Ray.

author: Balaur
author_rank: Unknown
timestamp: October 05, 2011, 04:46:28 pm
content: Hello all,I will like to ask you a few questions. Sorry for barging in like that. I have tried to do my homework, but I'm still at loss with some issues and I'm kindly asking for your help. Much appreciated, thank you.I'm looking at buying an used Rigol on eBay. The seller modded the scope and it looks like the conversion was successful, in the sense that the model is identified as a DS1102E and the firmware version is 2.02 SP2.Q1: The other picture shows the scope displaying the internal calibration signal at an amplitude of 300 mV and with a frequency of 1.000KHz (or something like that - the picture is small). Is there any way to check whether the calibration data has been corrupted or not from this very limited info?Q2: I don't know the hardware revision. The scope seems to be an older version, with the UltraZoom label. Is the serial number useful? Does the HW rev matters?Q3: Is any useful stuff in later DS1052 firmware revisions that will not longer work on the modded scope? Are newer DS1102 firmwares usable?Thank you all,Dan

author: torch
author_rank: Frequent Contributor
timestamp: October 05, 2011, 09:23:48 pm
content: AFAIK, while later hardware versions cannot run early firmware, the opposite is not true: early hardware versions can run the later firmware. (2.04 SP1 is as late as you would want though -- after that, the firmware seems to be buggy).2.02 SP2 was the last firmware that allowed changing the model number (and hence, allowed the hack). In order to hack a later model, the firmware must first be downgraded to 2.02 SP2, model changed, then the firmware upgraded again before using the scope.There is a hidden screen that will reveal the hardware version. Press Utility, then advance to page 3 of 3, then System Info. Now, to reveal the hidden screen:Press Ch1 twicePress Ch2 twicePress Math onceNow the screen will show extra info, including the hardware version. H/W 58 is the later version that won't run properly on firmware 2.02. You could ask the seller to send you a picture of that screen.

author: Balaur
author_rank: Unknown
timestamp: October 06, 2011, 11:37:36 am
content: Quote from: torch on October 05, 2011, 09:23:48 pmGood suggestions. Thank you very much!

author: drieg
author_rank: Regular Contributor
timestamp: October 06, 2011, 02:17:56 pm
content: Q1: I'm afraid that a bit too little info. There is probably only wrong probe ratio selected (1:1 instead of 1:10), the amplitude of probe compensation output shoudl be about 3V. Try to ask if the hack was done vie serial or USB (USB is safe, while using serial cable there is a risk of corrupting calibration data).Q2: There is not much diffrerence bewen them. Early units didn't have LED backlight for example, PM me s/n if you have it (3-6 initial numbers are enough) and I can tell you more...Q3: No, hacked DS1052E scope is same as original DS1102E from the sw point of view. There is no way for the firmware to detect a modded unit (if the hack is done properly). All new firmwares works with older units.

author: dougsisco
author_rank: Newbie
timestamp: October 17, 2011, 01:54:09 pm
content: Thanks to Drieg for fixing my DS1052E! After attempting the notorious serial port Rigol hack and using the 'enter' key instead of ALT-0-0-0, the delayed-trigger was broken and the hardware revision was scrambled. Drieg created a special 'repair' firmware which fixed the problem; very cool!

author: jeremy
author_rank: Super Contributor
timestamp: October 19, 2011, 11:26:33 pm
content: Hey guys,Drieg just helped me out with his scope, sent me a repair firmware and it works perfectly now. Somebody give this guy a job!-jeremy

author: dixis
author_rank: Newbie
timestamp: January 23, 2012, 08:40:55 am
content: Hi to all,A week ago i have received my ds1052e. The same day i hacked him in 1102E. The original firmware was 2.0.6. It was downgraded to 2.0.2 SP2. Then i changed it`s serial number. He became 1102E. After that i upgrade him to 2.0.4 SP1. All was fine. After 30 minutes of playing i decided to upgrade it to it`s original 2.0.6 firmware. And then the problems started. Progress bar filled up only 70-80 percent and disappeared without "firmware is successful" or something like that message. Without a second thought, I rebooted it. After power up it shows nothing. Only keyboard back lights were randomly lighting after each power-up. I have successfully read the firmware of spansion flash-memory via JTAG. Now I can not do anything because I do not know how the 4MB firmware placed in memory map. Could anyone help me? The board has some inscriptions 94V-0 and DEMO8 and a date 2010-12-20. Here is the external link to my broken 2.0.6 firmware (sorry, but i don`t know how to attach files larger than 1MB)http://hotfile.com/dl/143324806/25ead70/broken_2.0.6.bin.zip.htmlRegards

author: drieg
author_rank: Regular Contributor
timestamp: January 25, 2012, 08:12:42 am
content: ...solved via PM/email.

author: wkb
author_rank: Super Contributor
timestamp: January 25, 2012, 07:41:42 pm
content: Quote from: drieg on January 25, 2012, 08:12:42 amAnother guy that owes you a couple of beers!Although my hack proved a smooth operation, knowing you were there in case it went south was what made me willing to take the risk!

author: kvitekp
author_rank: Newbie
timestamp: February 01, 2012, 02:14:28 am
content: Hello all! What a fascinated reading!Just got myself a brand new Rigol DS1052E with s/w 00.02.05. SP2 and h/w 58 and I'm considering a 100MHz hack. Just wanted to check if Drieg is still out there offering his lifesaving service?/Peter

author: jgbena
author_rank: Contributor
timestamp: February 03, 2012, 06:06:02 pm
content: Yeah I just bought one of these... still in the Shipping phase and now I'm scared to try hacking it!!!

author: drieg
author_rank: Regular Contributor
timestamp: February 05, 2012, 09:39:52 am
content: Yes, I'm still here, ready to help with broken Rigol units (not only DS1052E/D, but also others)

author: jbremnant
author_rank: Newbie
timestamp: February 06, 2012, 03:20:39 am
content: Wow, I wish I found this thread before I tried out the hack.I was on 2.05.02 firmware and tried to downgrade to 2.02.02.Didn't work, and now my DS1052E scope is bricked with blank screen.I am trying the warranty route since I got it only few days ago.If I don't have any luck, I hope our "superhero" Drieg can help me out.

author: Yakovlev
author_rank: Newbie
timestamp: April 11, 2012, 12:03:47 pm
content: Thanks again to Drieg for restoring corrupted calibration on my 3 year old HW03 box.Brgds, Rob

author: matthewell
author_rank: Newbie
timestamp: July 12, 2012, 03:40:23 pm
content: Hey has anyone got the jtag port working, i have been trying for a couple days and got only garbage from the TDO pin.Any help would be great, Matt.

author: dixis
author_rank: Newbie
timestamp: July 18, 2012, 11:25:24 am
content: Hi matthewell,could you post the connection schematic which you have used for jtag and what the software that handles this

author: sim
author_rank: Newbie
timestamp: November 13, 2012, 02:00:59 am
content: Hello! My DS1052E purchased in January, 2010 has always displayed a blank "HardVersion" in (extended) System Info. It reads:00.02.02.02.00DSP: 02.15FPGA:02.00HardVersion:I recently upgraded it to 2.06 to try to fix usbtmc timeouts (which turned out to be a host problem anyway). This seems to have introduced an ADC offset problem that causes about a half div noise at any voltage scaling, any channel. It is obvious with peak-detect at any sweep rate, or 200us or faster in normal mode. Calibration does not fix it, but reverting to 2.02sp2 makes it all good again. I'm thinking that the new software is defaulting to assuming a newer hardware rev if the field is blank, and breaking the ADC calibration. Any ideas on this? If it can be set, I wonder what it should be set to.

author: drieg
author_rank: Regular Contributor
timestamp: November 13, 2012, 09:58:54 pm
content: Hi sim,we have to find out the hardware version of your unit (from the serial number or better from PCB version) and then we can fix it. Please contact me via PM/email.

author: sim
author_rank: Newbie
timestamp: November 19, 2012, 08:31:11 pm
content: Quote from: drieg on November 13, 2012, 09:58:54 pmSo, we did this, and it fixed the problem! Restoring the "HardVersion" to 07 (my board was marked "DEM07") allowed me to upgrade to 2.06 without the ADC offset problem that was present before when the field was blank. It seems my assumptions about the software assuming a newer hardware version were correct. My realtrigdelay/equtrigdelay were also wiped to 0 and I decided to also calibrate those -- not sure what I did originally. Thanks, drieg!

author: matthewell
author_rank: Newbie
timestamp: November 22, 2012, 05:44:53 pm
content: Quote from: dixis on July 18, 2012, 11:25:24 amHey i am using the bus blaster jtag device with urjtag, have you had any luck?Thanks, Matt.

author: equinoxefr
author_rank: Newbie
timestamp: December 31, 2012, 07:13:10 pm
content: Hi Drieg,I upgraded my DS1052E today from 3.01 to 2x, hack to 1102E then upgrade to 4.0. Everything has worked but now i've a blank hardversion instead of 58. Is it a problem ?RegardsPierre

author: equinoxefr
author_rank: Newbie
timestamp: January 15, 2013, 08:45:28 pm
content: Little update of my previous post.Drieg helped me to fix my problem. I lost hw version but I also lost trigger delay calibration.With the help of Drieg, I try to set calibration data but without success. I can enter calibration data but it was lost upon power off. So I downgraded my scope from 4.0 version to 3.01 and try again to fix it. Now it work like a charm, I can input trigger delay and fix that annoying problem ;-)A great thanks to Drieg, our Rigol doctor ;-)

author: Blogs14
author_rank: Newbie
timestamp: January 21, 2013, 09:25:22 pm
content: Hi equinoxefr,I think I have the same problem as you did, but I can't seem to find 3.01 firmware file anywhere.Where did you find it? Do you think you can post a link?Thanks in advance.

author: equinoxefr
author_rank: Newbie
timestamp: January 22, 2013, 06:13:18 am
content: Quote from: Blogs14 on January 21, 2013, 09:25:22 pmHi,I found it on microcontroller.net a little Google search and you will find it. I ask me if you can't grab it.PierreEnvoyé depuis mon Nexus 7 avec Tapatalk

author: Blogs14
author_rank: Newbie
timestamp: January 23, 2013, 11:33:10 am
content: Well that's embarrassing, don't know how I missed that file when I was looking the first time.Anyway here's the link and checksum for anyone else:http://www.mikrocontroller.net/attachment/147456/DS1000EUpdate.zipMD5: eac4f449e60e2fe3cec561cbfa543bed(From:http://www.mikrocontroller.net/topic/261138)Problem is I still can't get the trigger delay calibration to save between power-ups. It doesn't seem to make a difference which firmware I try.I know this isn't very serious, but it annoys me that the scope isn't perfect.Any ideas?EDIT:I've managed to sort it out now. In the end I tried FW 4.00 again and set the trigger delay calibration. Then, without powering off, I ran auto calibration and now the settings have been saved. Although the auto calibration changed them slightly, they're pretty much perfect.

author: pomonabill221
author_rank: Frequent Contributor
timestamp: March 17, 2013, 02:28:53 am
content: Quote from: sim on November 19, 2012, 08:31:11 pmI, too have DEM07.I have performed the hack to a DS1102E and it worked, and applied FW version 2.04.00.03 but do not have a hardware version, just jumbled characters.When I did the serial update (I know, I know), I did accidently hit ENTER rather than ALT 000, but it seemed to take ok.Now I am wondering if my cal data is corrupt because of the missing HW version?How did you do it? I see all these posts saying they had success, but NO ONE has said HOW it was done, or is this being kept a guarded method so it won't be done for fun?

author: jamess
author_rank: Newbie
timestamp: January 22, 2014, 01:21:07 am
content: I've managed to brick my 1052e attempting a firmware downgradeDrieg, you you have a moment I've sent you a PM with the details, any help/advice is appreciated.--J

author: jamess
author_rank: Newbie
timestamp: February 01, 2014, 02:59:04 pm
content: My bricked DS1052e is all fixed up, huge thanks to drieg.

author: pomonabill221
author_rank: Frequent Contributor
timestamp: February 01, 2014, 05:42:18 pm
content: That's not fair!!! leaving us in the dark as to what you did to revive your scope!Did it involve using the JTAG connection?Good to hear you got your baby back!

author: drieg
author_rank: Regular Contributor
timestamp: February 02, 2014, 10:12:26 am
content: Quote from: pomonabill221 on February 01, 2014, 05:42:18 pmYes, if the unit doesn't start at all, you need to reprogramm the flash either in external programmer or via JTAG (as we did in this case).I'll update my first post with more details when I find the time...

author: pomonabill221
author_rank: Frequent Contributor
timestamp: February 02, 2014, 08:22:08 pm
content: Thanks for the info... kinda thought so but wanted to make sure.

author: szist
author_rank: Newbie
timestamp: March 16, 2014, 03:32:13 pm
content: I got the Rigol DS1052E after uploading the incorrect firmware . When you turn on the Oscilloscope , nothing is displayed only bright screen. USB does not work. Please help in the recovering the operation via JTAG or reprogramming the flash of chip.

author: szist
author_rank: Newbie
timestamp: April 03, 2014, 04:20:52 pm
content: I wanted to thank Drieg in repairing DS1052E. He sent repaired firmware, and I could upload it via JTAG and my oscilloscope alive. Direg is great and I am very grateful to him for taking the time. :

author: Alliyou David
author_rank: Newbie
timestamp: November 10, 2014, 03:32:09 am
content: Dear Drieg: Can you send the firmware mentioned in your blog to my E_Mail:David760190@hotmail.com?Thank you very much.

author: merseyless
author_rank: Contributor
timestamp: November 19, 2014, 12:53:48 am
content: Hi there, I have a ds1052e that has been bricked. What steps do I have to go through to fix it?

author: Zaq
author_rank: Newbie
timestamp: June 12, 2015, 05:57:25 pm
content: Can some one help me out to get my Rigol DS1052E working again?Did the 100MHz hack, that worked fine.Than i want to upgrade firmware and the scope is compleetdead.Only white screen, nothing else.Can you give me instructions what to do.I dont have a jtag op external programmer.With regards,

author: ENB
author_rank: Newbie
timestamp: March 01, 2016, 11:27:06 pm
content: Hi,Any news for unbrick our scopes?Thanks in advance

author: pantelei4
author_rank: Regular Contributor
timestamp: January 22, 2017, 07:07:53 am
content: Hi, who knows how to communicate withdrieg?I broke my Rigol 1052E, corrupted calibration data.Last time he was here November, 2016.I left him a message, unanswered ...

author: pantelei4
author_rank: Regular Contributor
timestamp: January 24, 2017, 10:01:40 am
content: Thank you, who responded. I restored my oscilloscope itself. After an unsuccessful upgrade was lost HW version=? Therefore, it is uncalibrated. The board has DE03 inscription means HW version=03. With the help of the serial interface and the command :INFO:HARDVERSION 03 value was restored.Then I set the FW version 00.02.04.01.00 and spent calibration. Everything works fine, it cost me a few days of nerves. I agree withdrieg, need to be very careful and neat, when you want something else to do.

author: dberdugo
author_rank: Newbie
timestamp: May 17, 2017, 08:36:13 pm
content: Hello, thanks all for share your experiences and information about our Rigol oscilloscopes.My case takes about a DS1052D wich I bought less than a year ago, finally I decided to upgrade to DS1102D and got an expensive brick.This is DS1052D, HW version 58, FW version 00.04.02 SP1, and the serial number is DS1EU175000xxxObviously serial commands to change serial and model didn't work.I tried downgrade directly using "DS1000DUpdate.RGL", the oscilloscope detected pendrive but didn't perform any flashing process.I tried to modify the header of the FW file to identify the same version as my unit and later, but nothing happens.Finally I decided to desolder the flash for myself, made a backup with an external programmer, and changes the serial letters (to DS1EA) and model name (DS1102D) at the binary image, but when solder again, the oscilloscope was deadI retried with many images extracted from official FW upgrade files, removing the header and concatenating the 4MB image of this file with the last 4MB of my original backup wich contains serial, model name and suposed calibration data, but the oscilloscope remained dead.Finally, I got scared and restores exactly the original backup and the oscilloscope breathed again, got back to live, but when enable any channel (analog or logic analyzer) it shows random garbage waveforms, does not matter if I connect the probes to an stable 5V, GND or test waveform pinI performed many times the autocalibration procedure, this makes many tick-tick sounds, complete the progress bars, but when finished, it shows the same behaviour.I think the factory calibration data is on flash, and I restored the original backup, so it must have this data intact.Anyone knows how is happening inside my oscilloscope?Thanks and greetings.Daniel

author: ivi_yak
author_rank: Regular Contributor
timestamp: July 20, 2017, 06:32:11 pm
content: hiI have a brick after firmware updating of DS1302CACould you post a manual for reflash or advice what to do?Please post any info about repairing of software bricked RIGOLs

author: ivi_yak
author_rank: Regular Contributor
timestamp: July 20, 2017, 06:46:06 pm
content: hi, could you share what king of programmer you use for reflash and it will be great for instructionsthanks!

author: Bruzzel
author_rank: Newbie
timestamp: January 18, 2019, 11:25:49 pm
content: Hello,I have flash a wrong firmware to my old DS1042C and now it is dead, nothing works.What can I do to fix my bricked scope?Where can I find information and correct Hex-data for reprogramming the Flash?The DS1042C board is very similar to the DS1042E Board but has only a S29GL032A flash(not a S29GL064 flash) and has no second front USB-Port near the serial EEPROM.The last firmware was 02.03.16.Can anybody help me?

author: jarek007
author_rank: Newbie
timestamp: January 19, 2019, 12:22:30 pm
content: Hello, When modifying DS1052E probably lost the calibration data - corrupted calibration data. Uploaded firmware 00.04.02 SP1. Interference occurs without a signal.Please help.Who knows how to communicate with DriegI apologize for the language, but I write from the translatorJarek

author: drieg
author_rank: Regular Contributor
timestamp: February 06, 2019, 10:17:34 am
content: Hello Jarek,drop me a PM, I will look at it.

author: drieg
author_rank: Regular Contributor
timestamp: February 06, 2019, 10:20:04 am
content: Quote from: Bruzzel on January 18, 2019, 11:25:49 pmCan you read the flash content? You can do it via JTAG, external programmer or send me the board for repair..

author: drieg
author_rank: Regular Contributor
timestamp: February 06, 2019, 10:21:36 am
content: Quote from: ivi_yak on July 20, 2017, 06:32:11 pmHello,sorry for late reply. Have you managed to fix your problem? If not, feel free to contact me..

author: ivi_yak
author_rank: Regular Contributor
timestamp: February 23, 2019, 11:24:59 am
content: Thanks Mr. Drieg he fix my dump and scope alive now,I have bricked Rigol ds1302CA after unsuccessfully fw update.Using XGecu TL866II Plushttp://www.xgecu.com/en/with TSSOP48 adaptor I got a memory dump of S29GL032A90TFIR40.Drieg fixed my dump at few days and my scope restored now.

author: Bruzzel
author_rank: Newbie
timestamp: February 23, 2019, 05:29:08 pm
content: I have fix my Rigol DS1042C.I have unsolder the flash and read it. I found the first part of the firmware file identical at the flash, only the first 20 byte was cut off and the last bytes were different.I suspect the following:The ds1000 firmware starts after 20 byte at the firmware USB file and ends at address 0x1FFFFF.The ds1000D/E firmware file starts after 21 bytes at the firmware USB file and have double length up to 0x3FFFFF.The DS1042C firmware update is a very stupid program. If it finds a file with the name “DS1000DUpdate.RGL” at the USB stick it cut off the first 20 bytes an write it 1:1 to the flash without any check.Only the bytes after address 0x1FFF00 are not changed because there are individual data about the scope (model, serial no. etc.) and after 0x200000 there are some other calibration data.The A21 = address input and WE# = Write Enable input are not connected at my Rigol DS1042C with flash S29GL032A.After cut off the first 20 bytes of the firmware file and program the bytes 0x000000 to 0x1FFF00 to the flash and solder it back to the board the rigol works correct.It is not easy to solder a TS048 device!I have made a firmware update to 3.7.1 and change it to a CA1102C 100Mhz model, see Andreas Schuler's homepage:http://codenaschen.de/tichyblog/index.php?action=blog&entry=17_Hacking%20Rigol%20DS1022C%20DS1042C%20DS1062C%20DS1102C]http://codenaschen.de/tichyblog/index.php?action=blog&entry=17_Hacking%20Rigol%20DS1022C%20DS1042C%20DS1062C%20DS1102CThank you drieg for help!

author: giov
author_rank: Newbie
timestamp: March 06, 2019, 01:46:04 pm
content: Hi,I was trying to upgrade my DS1102D to last firmware, and after few minutes stuck a 50% I decided to reboot it :bad ideaNow I only got white screen and random keyboard status after each reboot.I have no idea how to get it alive again : I have no programmer, and I don't know how to use JTAG interface.Can someone help me out ?

author: ivi_yak
author_rank: Regular Contributor
timestamp: March 06, 2019, 04:11:00 pm
content: Hi, in this case only reflash memory help

author: giov
author_rank: Newbie
timestamp: March 06, 2019, 04:24:58 pm
content: OK, How can I reflash ? Do I need a programmer of is it possible via jtag ?

author: ivi_yak
author_rank: Regular Contributor
timestamp: March 06, 2019, 05:03:28 pm
content: You need to build jtag chain, basically it's BlackFin and altera and using wiggler cable or j-link get your dump.

author: giov
author_rank: Newbie
timestamp: March 06, 2019, 09:07:23 pm
content: I have got a pirate's v3 card, and I installed openocd : can I reflash with it ?

author: reza chavoshi
author_rank: Newbie
timestamp: September 30, 2019, 11:47:43 am
content: Dear all,I have faced unsuccessful firmware upgrade (to version:00.04.02.01.00) issue with my rigol DS1052E (My oscilloscope display remains white after booting up and some keys lit up randomly)As I checked this topic it can be solved by reprogramming the flash IC (part no is: S29GL064N90TF104) with a copy of a healthy dump file.I have a universal programmer with TSOP48 socket and all I need now is the dump file (copy of hex file stored in the flash chip).I would be really thankful if any one can send me the file so that I can fix my oscilloscope.Many Thanks.

author: Dimas77
author_rank: Newbie
timestamp: October 21, 2019, 09:29:33 pm
content: Help me. My Rigol 1102E freezes after firmware upgrade (to version 00.04.02 sp1) and shows the shifted lines. I read the dump file, but cannot edit it.

author: Fungus
author_rank: Super Contributor
timestamp: October 22, 2019, 11:47:29 am
content: Quote from: Dimas77 on October 21, 2019, 09:29:33 pmRead the messages right above yours in this thread, especiallythis one.No, it's not good news.

author: Dimas77
author_rank: Newbie
timestamp: October 22, 2019, 01:14:47 pm
content: Today changed and rewritten a memory dump. From the official update, Rigol 4.02.01 cut off the beginning of x21, and copied from the address x000000 to x400000 + information about the serial number. The oscilloscope came to life, but shows overestimated values. did auto-calibration - thought it would help. restarted the oscilloscope, now it shows a white screen.

author: Dimas77
author_rank: Newbie
timestamp: October 26, 2019, 03:04:18 pm
content: Does anyone have a dump of S29GL064N90TF104 Rigol 1102/1052? Please share for me.

author: ur4mui
author_rank: Newbie
timestamp: November 05, 2019, 08:51:56 pm
content: have oscilloscope DS1052E how to connect WIGGLER cable .please draw.photo below.Thanks

author: ivi_yak
author_rank: Regular Contributor
timestamp: April 30, 2020, 10:24:03 pm
content: Hi every one if you need more details pls reply

author: adron
author_rank: Contributor
timestamp: May 11, 2020, 06:40:53 am
content: I managed to brick my DS1052E by trying to upgrade to the latest firmware,https://beyondmeasure.rigoltech.com/acton/attachment/1579/f-0724/1/-/-/-/-/DS1000EUpdate.zip?sid=TV2:Q2jKaGpUjand now I am trying to recover. What software are you using to dump/rewrite the flash through the jtag connection?

author: ivi_yak
author_rank: Regular Contributor
timestamp: May 13, 2020, 09:48:07 am
content: hxd hex editor

author: adron
author_rank: Contributor
timestamp: May 13, 2020, 10:52:56 am
content: Quote from: ivi_yak on May 13, 2020, 09:48:07 amI have hxd, for changing the flash file contents, what I meant was software for the actual communication through jtag. Are you perhaps using openocd or some custom software?

author: ivi_yak
author_rank: Regular Contributor
timestamp: May 13, 2020, 06:21:25 pm
content: topjtag

author: adron
author_rank: Contributor
timestamp: May 31, 2020, 08:45:15 pm
content: Quote from: ivi_yak on May 13, 2020, 06:21:25 pmThanks!I had some issues because I run 64-bit Windows 10 but finally managed to install topjtag flash programmer in a virtual machine. The JTAG chain seems to be working, and it detects the Analog Devices 627A50CBh and the Lattice Semi. 01281043h. Could you advise me on the right configuration to use to read and write the flash memory?

author: adron
author_rank: Contributor
timestamp: June 01, 2020, 10:59:00 am
content: I read the flash memory twice just to be sure it was not getting random errors, and I get some rather strange differences between the flash contents and the RGL file I tried to update the firmware with. Other posts in this thread indicated that there was configuration data at high offsets in the flash, but I have only FF at those locations, and I have several differences at lower offsets. At the lower offsets, all differences seem to be one bit that is set in the rgl and not set in flash, mask 0x04. And then at the higher offsets, areas of FF where the RGL has data. Any ideas for what to do?Diff at 00102F87 len 00000001 flash: A9 rgl:ADDiff at 00105787 len 00000001 flash: 49 rgl:4DDiff at 00107B87 len 00000001 flash: 08 rgl:0CDiff at 00107F87 len 00000001 flash: 69 rgl:6DDiff at 0010E787 len 00000001 flash: 08 rgl:0CDiff at 00114787 len 00000001 flash: CB rgl:CFDiff at 00118787 len 00000001 flash: E2 rgl:E6Diff at 0011D387 len 00000001 flash: 68 rgl:6CDiff at 00121B87 len 00000001 flash: C2 rgl:C6Diff at 00128387 len 00000001 flash: 29 rgl:2DDiff at 0012A387 len 00000001 flash: 50 rgl:54Diff at 0012EF87 len 00000001 flash: 01 rgl:05Diff at 00131F87 len 00000001 flash: B1 rgl:B5Diff at 00132387 len 00000001 flash: 28 rgl:2CDiff at 00132F87 len 00000001 flash: B0 rgl:B4Diff at 00133B87 len 00000001 flash: 62 rgl:66Diff at 00134F87 len 00000001 flash: C0 rgl:C4Diff at 00135387 len 00000001 flash: D1 rgl:D5Diff at 00137387 len 00000001 flash: 10 rgl:14Diff at 00137787 len 00000001 flash: 2A rgl:2EDiff at 00138F87 len 00000001 flash: 42 rgl:46Diff at 00144787 len 00000001 flash: 71 rgl:75Diff at 00145387 len 00000001 flash: 93 rgl:97Diff at 00148F87 len 00000001 flash: B9 rgl:BDDiff at 0014E787 len 00000001 flash: 5A rgl:5EDiff at 00152387 len 00000001 flash: 08 rgl:0CTurned out I was wrong about the rest of the diffs too, I had a small error in my comparison script that only showed the last of a range of errors. Anything after 0x1ff800 in the update file has not been written to flash at all.

author: adron
author_rank: Contributor
timestamp: June 05, 2020, 07:27:53 pm
content: I rewrote the single bit errors with data from the RGL file and the scope seems to be working again. I then tried running the firmware update from USB again, and got the exact same single bit errors once more. Something seems to be reproducibly wrong. However, I have now settled for fixing the single bit errors and hopefully that is all that is required. I am unsure why so much of the RGL file is not written to flash?

author: rezinj
author_rank: Newbie
timestamp: June 30, 2020, 10:41:04 am
content: hi. i need to know what kin of programer i need. which software have to use to program flash via jtag. and do you have the file that i have to program in my oscilloscope?

author: ivi_yak
author_rank: Regular Contributor
timestamp: July 01, 2020, 11:42:08 am
content: Quote from: adron on June 05, 2020, 07:27:53 pmif you have a working dump I'll recommend flash it via MiniPro XGecu TL866II Plus programmer to be sure all fine

author: ivi_yak
author_rank: Regular Contributor
timestamp: July 01, 2020, 11:45:02 am
content: Quote from: rezinj on June 30, 2020, 10:41:04 amdon't hesitate take a read 6 pages of this thread and you got all what you need to know

author: adron
author_rank: Contributor
timestamp: July 02, 2020, 01:05:33 pm
content: rezinj tried to contact me, but his/her inbox was full when I tried to reply. I connected everything to the jtag connections on the scope and used topjtag to read/write the flash memory. I used ahttps://www.segger.com/products/debug-probes/j-link/models/j-link-edu-mini/Segger J-Link Edu Mini interface, with a SWD to JTAG adapterhttps://www.electrokit.com/produkt/adapterkort-jtag-2x10-2-54mm-till-swd-2x5-1-27mm/and a bunch of wires and a resistor:

author: patty.o.furniture
author_rank: Newbie
timestamp: July 03, 2020, 09:12:11 pm
content: Quote from: adron on May 31, 2020, 08:45:15 pmHey adron, it seems you figured it out. Can you provide us the settings you used? I can properly scan the chain but only read 0xFF's from my flash.

author: adron
author_rank: Contributor
timestamp: July 06, 2020, 11:46:15 pm
content: Sorry about the late reply. These were the settings I used. Same?I'll also throw in the C# program that I used to compare the dump to the rigol firmware image and to extract sections of it as a .hex file for writing. I have not cleaned it up, so there are hard coded paths and firmware offsets, but perhaps it can be useful.Edit: I had some trouble dumping the flash sometimes, probably because of the state the hardware was in at the time that topflash started accessing it. I found that it was safest to always start by dumping the first 32 or so bytes from the flash before doing anything else, just to ensure that nothing else in the scope was using the data bus or address bus, and if those bytes came out wrong, I restarted before trying again.

author: rezinj
author_rank: Newbie
timestamp: July 17, 2020, 06:14:12 am
content: I used your setting file and started to read the dump file. i did it throuth xillinx prallel cable programmer and it took about 6 hours. once i used jlink programer the reading time was more(frequency should be very low_1khz). i read the dump file 2 times and each time it wase different. i have to say because my programer need power i turn on oscilloscope to source it throuth +3.3v pin.

author: adron
author_rank: Contributor
timestamp: July 17, 2020, 08:39:26 am
content: I used the segger programmer clocked at 1 MHz; I started at 500 kHz and it was stable so I tried increasing. At 1 MHz I had no errors that seemed to be due to the clock frequency. Dumping the entire flash took a little over one hour, but it is only relevant to dump the parts that are written by the rom, which was the first half in my case. I used 15 cm interconnection wires, it is good to keep them short. The scope has to be powered, the programmer does not power the circuitry. I had a few instances of different dump because the scope was in a bad state when the JTAG interface took control, which caused the first few hundred bytes of the dumps to come out different. Every other time the dumps were exactly the same. When there was a problem, the beginning of the dump was alternating 0x25 0x00 bytes.Compare your dumps: Do they differ in a few bits? Do they differ in many places but are same in some? Is there only a particular range that is different?Try dumping only the first kilobyte so you can test quickly?

author: rezinj
author_rank: Newbie
timestamp: July 17, 2020, 11:28:11 am
content: are you sure about the setting that you uploaded? i used your setting and read several time. each time some different datas.

author: adron
author_rank: Contributor
timestamp: July 17, 2020, 12:56:50 pm
content: Quote from: rezinj on July 17, 2020, 11:28:11 amI am fairly sure about it. At least it was the settings file that I used for reading out my dumps, and I reloaded it a few times. It is possible that your oscilloscope is a different hardware version and that it requires different parameters. I screenshotted all of the settings as well, do they match what you had set up?If most of the data that you read is the same but some differs, I would guess that you are clocking it too fast or that your adapter is malfunctioning. Are all your connections secure? Does detecting/validating the jtag chain work? Does detecting the flash type work?

author: patty.o.furniture
author_rank: Newbie
timestamp: July 18, 2020, 09:17:40 pm
content: Thanks for posting the settings @adron. I've been crazy busy lately.I can dump the ROM with your settings just fine at 4 MHz. Only a few bytes change here and there between power cycles, but it's the same one or two addresses. I went down to 1 MHz with the same behavior so I'm hoping it's normal.My dump starts to differ very early on, at address 0xFFEB, but I find long chains of bytes from the RGL data scattered throughout the dump. They tend to be on page boundaries. It's very odd to me.The other thing I noticed is that I can't seem to write to the low addresses. Probably need to change AWE_B to '0' for that to work.

author: rezinj
author_rank: Newbie
timestamp: July 19, 2020, 05:18:42 am
content: i agree with you. my hardware version is different than others. for example my flash ic is on the buttom layer. how can i found out i read the flash right? i'm sure aboaut reading the chain. should i use multimeter to check the pin connection of flash and other ICs?

author: rezinj
author_rank: Newbie
timestamp: September 01, 2020, 07:03:48 pm
content: any one know where Mr drieg is? i was in connect with him via Gmail. he told me send your dump file for me to repair it. i sent my dump file to him and now he dosen't answer me! any one know him? any one know how i can connect him? any thing bad happend to him?

author: darciopp
author_rank: Newbie
timestamp: September 04, 2020, 03:30:04 am
content: Hello FolksAnyone here would like to get my DS1052E board to bring it back to life, since it is bricked after an original rigol firmware "upgrade"?I can pay for that.Please, PM me!

author: MiguelAReis
author_rank: Newbie
timestamp: September 09, 2020, 09:24:59 am
content: Hello, I managed to dump my bricked DS1102E's Flash. Can someone fix it for me? I have no idea on how to do it.Thanks

author: darciopp
author_rank: Newbie
timestamp: September 09, 2020, 01:56:00 pm
content: Welcome to the Happy Rigol Bricks Owners Club.Maybe some units were counterfeit or "after hours" production from a third party manufacturer and Rigol decided that it was hurting its business.Maybe some genius thought "Lets brick them, just like FTDI made with the counterfeit USB-UART bridge chips" and voilá: a complete set of unusable products. Very clever!Do they have the right to do it? Sure, but this raised only anger from the community. I can't believe that there wasn't another way to get this around.

author: MiguelAReis
author_rank: Newbie
timestamp: September 11, 2020, 10:21:40 am
content: Well I managed to unbrick my DS1102E but now the serial number is gone and it says its mode is the DS1052E. If anyone could help, I would appreciate it.

author: tamamontu
author_rank: Newbie
timestamp: January 20, 2021, 06:07:42 am
content: Hi There,I tried to update firmware on my DS1052E and its got bricked. Original firmware was 00.02.01 SP3, i tried to upgrade to 00.04.02.01.00 firmware upgrade process went ok but after restarting the oscilloscope its not working any more, just see white screen.I read through the forum and trying to figure out how to read the flash. At the start of the forum it was mentioned to desolder the flash chip half way through the forum i saw a photo where in JTAG connector was connected to the pins on the board and didnt need any desoldering.https://www.eevblog.com/forum/blog/the-dark-side-of-the-rigol-hack-bricked-scope-how-to-fix-it/msg3115944/#msg3115944I got a Olimex ARM-USB-Tiny Jtag adapter board could that be used to read the flash contents.Would any one have a hex dump for firmware V 00.02.01 SP3 Pls.Thanks

author: darciopp
author_rank: Newbie
timestamp: January 20, 2021, 12:54:30 pm
content: Quote from: tamamontu on January 20, 2021, 06:07:42 amWelcome to the club!I'm trying to get mine back to life again with no success too

author: tamamontu
author_rank: Newbie
timestamp: January 21, 2021, 07:30:14 am
content: I got a older firmware version file .RGL for this scope. Could some one please explain how to program this to the flash would help a lot to recover the scope.thanks

author: eleknam
author_rank: Newbie
timestamp: January 23, 2021, 07:17:30 am
content: Hi help my DS1102CD. After update bricked DS1102 )). How to extract the dump from the DS1000EUpdate.RGL file.

author: danand
author_rank: Newbie
timestamp: January 24, 2021, 11:11:09 pm
content: Hi,when I bought my DS1052E, I did the 100mhz hack (over serial) and upgraded the firmware to 02.04. It went all well and good.Time flies and my first child was born, second child followed and all my electronics hobby dried up.Yesterday I built up my electronics workbench again and thought it would be a good idea to update the oscilloscope, since there have been a few firmware updates.Well, or not so well: the firmware update ran, the DS1052e restarted and after short flickering a black screen is the only thing which is coming up.I currently have no idea how to solve it on my own, and I am afraid to kill of the calibration data by tinkering around on my own.I sent Drieg a message, but I am not confident if he still fixes boards, since he started this 10 years ago ...

author: adron
author_rank: Contributor
timestamp: January 27, 2021, 09:53:31 am
content: Quote from: danand on January 24, 2021, 11:11:09 pmI did just about exactly the same thing: Back to electronics after having kids, then stupidly assuming that it would be a good idea to start off by updating the firmwares to the latest versions on all my equipment, and ending up with a bricked scope. But it can all be rescued with a couple hours of work if you have (or buy) a JTAG interface that works with the topflash jtag programmer, and hook that up to the scope.

author: danand
author_rank: Newbie
timestamp: January 31, 2021, 02:09:26 pm
content: Quote from: patty.o.furniture on July 18, 2020, 09:17:40 pmSame on my side:comparing with HxD the first different block starts are 0xFFEBThe output of Program.cs is somehow differnt from i.e. FlexHEX binary compare. I am currently in the situation that I don't want to overwrite important data inside the lower 4MB of the flash with the DS1000EUpdate.RGL file.However, Programming via Topjtag results in Erase Timeouts. I checked out the static pins, but I have no idea what else I could do to get past the write timeouts. :-(CheersDaniel

author: adron
author_rank: Contributor
timestamp: January 31, 2021, 03:02:02 pm
content: My Program.cs expects there to be a header on the RGL file. That might explain your differences if you removed the header.

author: danand
author_rank: Newbie
timestamp: January 31, 2021, 03:17:06 pm
content: Quote from: adron on January 31, 2021, 03:02:02 pmAha! That explains it.PS C:\Users\daniel\Downloads> .\Program.exeDiff at 0000FFEB len 00142E7EDiff at 00190000 len 00006670Diff at 00198000 len 00006775Diff at 0019FFEB len 00030000Diff at 001D2F03 len 0000000C flash: 13:20:04:00:60:15:20:02:00:C0:17:20 rgl:00:00:00:00:00:00:00:00:00:00:00:00Diff at 001D3000 len 0001CFEBDiff at 001F8000 len 00208000

author: danand
author_rank: Newbie
timestamp: January 31, 2021, 05:16:13 pm
content: I still struggle with programming the flash via TopJTAG. I always get Timeout while erasing 000000h to 001FFFh.All the rest of the flash can be erased without problems.Also reading works reliable at 1Mhz.Could anyone point me to a path what I could do to get around the timeouts?

author: danand
author_rank: Newbie
timestamp: February 01, 2021, 10:58:09 am
content: Somehow the flash worked so far. I have a mostly working screen again.Firmware is flashed to 00.04.02 SP1 , but I only have asian fonts in the side menu. At least I am a step forward.

author: danand
author_rank: Newbie
timestamp: February 01, 2021, 12:19:54 pm
content: I got it!I just created another USB Stick FAT32 formatted with the DS1000EUpdate.RGL File. Even without the right font, I did the update procedure again.Then after powering off and on, the DS1052E came back to life :-)So as long as you have the Segger J-Link-Mini, an adapter for 2.54 connector, a 1k Ohm resistore, a few jumpwires and a breadboard, you can revive the the Rigol DS1052E :-)Thanks for all the great support

author: eleknam
author_rank: Newbie
timestamp: February 02, 2021, 05:01:12 am
content: Good afternoon, you can bring the wiring diagram of the wiring JTAG DS1102CD

author: open loop
author_rank: Regular Contributor
timestamp: May 12, 2021, 10:14:51 pm
content: Just adding my expereince to this issue.I while ago I got a DS1052E cheap from eBay as it would not boot at all. It just gave a blank screen - it would not work at all!. Anyway I did the usual checks on the PSU and on board PSU test and I must thank Helene for his hardware studies on this device. Anyway after checking all of this I decided to look at the BlackFin BF532 proc and found it was set up by the BMODE pinns to read from I2C flash chip. Also checked the reset line and clock but I was confused about the zero activity on the I2C of this flash chip. Ithen got hold of a Jtag Tool (Jllink EDU) and wired as directed in previous posts - many thanks for the helpful posts on this thread for setting up Topjtag etc.From what I now know it seems that not only does the spansion flash chip hold the Firmware for the BF532 but also for the FPGA and possibly the Lattice LCMX0256C - which i think is configured as a memory controller. Anyway when look at the first few thousand bytes of firmware all I got was FF so I thought that the Jtag was not working! so then reomved the Spansion memory chip and then used my TL086 programmer wirh the TSOP 48 adapter to read the firmware. It seem that the Jtag tool was working fine! as all of the initial bytes were at FF up to chip memory address 4FFFF so it looks like that this device had failed in doing a FW update/downgrade.I then generated a new file joining the firmware from the Rigol forwmare update file (after removing the 21 bytes) and the 2nd half of my original Firmware downladed image. I resoldered the Spansion chi[p back onto the main board and all seemed to work (yippe). Noticed that when adjusting the V/div the trace would jump all over the place. I then re-calibrated the scope but after this it crashed in 2 mins and would not re-start. When it does re-start I was able to re-flash the firmware from USB. Anyway I think the firmware image I created was not quite right.One interesting point I found was that if I disabled it's data aquisition by presing the run stop to stop with the red LED showing. It seemed to boot more reliably? Anyway I have now reached the limit of what I can do with this repair and I need Dreig's help as he is the person who is able to perform the required magic to the broken firmware images. tried to PM him but I totaly understand that he has a life to lead and may not visit the forum for months on end.Just adding my 2 cents worth and hopeing that Dreig may be abe to help.DS1052EBoard has Demo 08 so it's HW version 58PCB version is 94V-0Runing version 04.02.01.00 of Firmware.

author: f7a7f7a7
author_rank: Newbie
timestamp: June 02, 2021, 05:57:08 am
content: Dear DriegI am a loser update my Rigol DS1052E to 100MGoogle lead me to this post when I near give up the DSO. I saw lights in dark.My DSO's HW version is 03 with firmware 01.02 sp2 originally. Now it's partially working on 04.02.01 and 02.02.02.Partially working meaning is boot up ok and can enter main menu, but no signal show on screen (no signal line for neither CH1/CH2)When I do auto-calibration on firmware 04.02.01, screen is blocking on CH1 calibration screen, no moving of progress bar.When I do auto-calibration on firmware 02.02.02, calibration will finish within 5 min, but still can't see signal line.I also send you a PM and hope you can help save my DSO.Thank in advance

author: f7a7f7a7
author_rank: Newbie
timestamp: June 04, 2021, 01:20:24 pm
content: Thanks for your sharing. Appreciate very much!Actually I already PM Drieg for long time. But ten years passed, not sure if he will go back to this blog, everybody has his own life!So I turn to man who may have the fixed firmware for help.Anyway, I will compare your firmware with offical one and my mem dump.Hopes the old DSO can back to life.

author: frankzam
author_rank: Newbie
timestamp: June 13, 2021, 02:52:58 pm
content: Good afternoon everyone, after connecting with dl ds1052e through jtag, according to the steps described in this blog, when internalizing, save the memory with the modified firmware 0.4 downloaded from pages back, at 1mhz, it records it, but when verifying it gives me verification error. Could someone with more experience advise me? Thank you so much

author: Mechatrommer
author_rank: Super Contributor
timestamp: February 14, 2022, 05:31:46 pm
content: while testing myBattery Powered PSU for Portable Rigol DS1000E/Zi got a unstable condition that the DSO stopped and crashed with random color on the screen. when i restart the DSO, the CH1 trace is missing, when doing recalibration, CH2 trace is missing, now both are missing even though countless self-cal and tinkering was done. i suspect it experiences another calibration data corruption as i've experienced about 11 years ago. Drieg helped me fixed my cal corruption before and i still keep the firmware ver 2.0.2, the problem is... i've upgraded the 1052E to ver 4.2.1 sometime ago, and now it refuses to downgrade back to 2.0.2 to do the calibration repair.but i think i will insist on downgrading to 2.0.2 because it was easier to repair in that version. so based on Drieg's OP post i have no other option than re-flashing the FW through JTAG. i've not found a way in the net to downgrade ver4 to ver2 using USB drive, i've spent many hours today try to read this thread, to recap where i was 11 years ago, and to blow the dust and setup my old knock off Segger J-Link for JTAG flashing. installed the TopJTAG and i have 20 days left to get all this done before it expires and ask for $100.our dear friend here indicated he used J-Link Edu, but i only have knock off J-Link laying around. based on Drieg's post, i only have to connect to Blackfin's JTAG interface to access Spansion flash, so i did the minimalist connection based onivi_yak's diagramsposted earlier,i skipped the resistor thing and connection to lattice JTAG thinking that it should be ok. turn the dso on, run the TopJTAG and try to detect the JTAG chain, unfortunately none is detected. so i'm out of trick this late night, i'm asking for help and idea on what i'm doing wrong. attached pictures are my setup.2nd night edit: i managed to get jlink to detect the blackfin device with the following edited attachment, next thing is to figure what is the flash address and static pins means in topjtag setting..hope to hear from you people thanks.

author: uoemx
author_rank: Contributor
timestamp: March 23, 2022, 04:24:59 am
content: Hi everyone I want to help everyone on this topic.I would remove the flash memory and do a full flash backup using an RT809H or TL899, or similar on my machine in normal useYou load into your Rigol DS1052E, the machine will use normally. All software version serial numbers will of course be mine.If you agree, I will back up my device and send it to you. Thread may end and this is the final solution and 100% working

author: uoemx
author_rank: Contributor
timestamp: March 23, 2022, 06:19:30 am
content: My machine can't adjust the trigger to make the signal stable, maybe hardware failure. Can someone tell me what to check?Status herehere full fLASH 8Mbhttps://www.mediafire.com/file/3x54qaymlws23mh/Rigol_1052E.zip/fileFirmware update 100Mhzhttps://www.mediafire.com/file/0gtsusastgtheyk/Rigol_1052E_hack_100Mhz_Tested.zip/file

author: malamig
author_rank: Newbie
timestamp: January 21, 2023, 08:29:52 am
content: Hello!I was able to restore my 1052E from the dump file gave by UOEMX.FW Version now is 00.04.02.01.00However, I cannot upgrade to 100Mhz. Maybe I need to downgrade the FW to 2.04.I tried both thru Serial command and USB FW but no luck.Anyway, for now I will just keep my scope running on 50Mhz. Thank you UOEMX!

author: uoemx
author_rank: Contributor
timestamp: January 23, 2023, 09:32:10 am
content: No problem malamig. I have finished fixing my oscilloscope. I have shared the diagram and the broken part, everyone can see the reference. The diagram is here:http://rigol.codenaschen.de/index.php/Schematics.Here's where I did it

author: prieten
author_rank: Newbie
timestamp: June 22, 2023, 10:54:23 am
content: Hello, my RIGOL DS1064B oscilloscope is not working properly after the update. Does anyone have the firmware in the Flah memory S29GL064N90TFI04 for hardware version DB 4.3. I mention that after the update the USB ports are no longer functional, the only solution is to rewrite the flah memory. Thank you in advance.

author: thanospap
author_rank: Newbie
timestamp: December 19, 2024, 10:32:05 am
content: Hi, unfortunately I have bricked my RIGOL DSA1012 spectrum analyzer.Do you have any info on how to bring it back to life?Thanks in advance,Thanos

author: thanospap
author_rank: Newbie
timestamp: December 19, 2024, 10:33:32 am
content: Hi, unfortunately I have bricked my RIGOL DSA1012 spectrum analyzer.Do you have any info on how to bring it back to life?Thanks in advance,Thanos

author: Shestock
author_rank: Newbie
timestamp: April 22, 2025, 09:03:02 am
content: Hello!Can you help me bring my Rigol DS1052E back to life?How to prepare a firmware file using calibration data from my device?

author: electronics_enjoyer
author_rank: Newbie
timestamp: October 13, 2025, 06:17:53 pm
content: I have a 1052E that is noisy <=200ns/div; drieg, are you still providing this repair service?edit:I sent drieg a PM but it seems he hasn't been around the thread in a while; New users have joined to fill some of the empty space.I found I have a XDS110 JTAG debugger on a TI launchpad module, however the debugging software options that work with the XDS110 are not compatible with BlackFin processors, and vice versa. I'm hesitant to buy a $60-$100 JTAG interface when there are modern scopes just a few hundred bucks more that are more capable than my 15yo Rigol. Unfortunately, neither of these options are viable for me at the moment.However, I still may hold out for a software solution... the scope capture appears as if there are two points swapped between the channels at horizontal scales less that 500ns/div (I'm regretting getting on the newest official version from Rigol). Alternately, if anyone figures out how to mangle a XDS110 probe into a BlackFin, do reach out...