MSO1104Z LAN Hack - Page 1
Forum section: electronics / testgear

author: spaceshipdev
author_rank: Newbie
timestamp: February 14, 2018, 09:44:12 pm
content: After much research I have pretty much given up on trying to acheive an unlocked MSO.I did go so far as to use the tips from the "How To Remove Warranty Void Security Stickers" (that works a treat by the way, in like Flynn, Errol that is) and actually open her up. Sure enough, no header pins and I'm fairly certain I'll really mess things up if I get my clog iron in there. Interesting thing I did note by the way. Did anyone notice an orange marker pen near every torx screw internally?I did checkout the link here :-http://peter.dreisiebner.at/rigol-forum.htm#mso1000zbut only get linked to the video that has the jtag pins on the board. My MSO1104z does not have these pins, well headers that is.I found hope in the idea that I might be able to dump the memory and gain access to a unlock key that way; though the SCPI commandsCode::SYST:UTIL:READ? 15441920,13262848is failing for me. I just get an error messageCode:"There was an error when sending the SCPI command."Bar any new ideas, and I'm fairly tuned to the fact that I don't think anyones managed to unlock an MSO1104 as yet, I reached out to Rigol for a real quote. Originally $510 today reduced to $300.Someone knock me out of my misery and tell me theres a way to get more goodies out of the hardware I already own. (that is without soldering my board ahem)Much appreciated

author: edgelog
author_rank: Regular Contributor
timestamp: February 15, 2018, 08:24:55 pm
content: Quote from: spaceshipdev on February 14, 2018, 09:44:12 pmWell, you didn't research enoughI certainly have an MSO1104Z that was unlocked using rigup. See:https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg1191044/#msg1191044In that same thread, earlier on, you'll find a number of tips on how to dump out the firmware. You don't need to solder pins to the main board, you can just jam in some pins and weight them down a bit.Don't despair.

author: spaceshipdev
author_rank: Newbie
timestamp: April 15, 2018, 01:09:34 am
content: Just noticed this response, many many sincere thanks. I will take a look at this link and give this another look. Not sure of the term 'jam in some pins' I'll be honest with you, I'm scared to death of bricking it, I should just pay the $300 but SO much money for something I have already; frustrating.

author: Daruosha
author_rank: Regular Contributor
timestamp: April 15, 2018, 01:20:49 am
content: Tonight i managed to unlock an MSO1104z even without tearing it apart. The method relies on a patched firmware developed by a bunch of brilliant guys in the forum. Follow this thread and you will find the solution. If you had any problem, let me know and I'll write a step-by-step guide.

author: spaceshipdev
author_rank: Newbie
timestamp: April 15, 2018, 02:47:48 am
content: I had hoped to achieve this without opening my unit, and if you have any instructions on how this could happen I would very much appreciate it. I already previously opened mine up; there is no place to plug in a JTAG, it's just solder pads with no headers. I also tried the LAN method but I continually got an error when trying to get a memory dump using the SCPI commands. The MSO1104Z seems particularly difficult so any and all help would be appreciated. While I understand the SCPI LAN method worked for others, I'm not sure I have seen much with regard to this model being a success.

author: Daruosha
author_rank: Regular Contributor
timestamp: April 15, 2018, 06:08:31 am
content: Quote from: spaceshipdev on April 15, 2018, 02:47:48 amI posted the guide into this thread:https://www.eevblog.com/forum/testgear/sniffing-the-rigol_s-internal-i2c-bus/msg1479265/#msg1479265take a look and I hope it helps.

author: spaceshipdev
author_rank: Newbie
timestamp: April 15, 2018, 04:19:59 pm
content: Thanks for this, though getting this initial memory dump is what I first came to the forum about in the first place. This is the step I am unable to complete. I am still yet to try edgelog's advice so will report back when I have results on this.I have to say, patched firmware with ignoring errors from Windows builds throws me right off and is not something I'd be happy with at all. I'd pay the fee and have done with it before running unknown unsigned firmware. Extracting keys and performing math on them is far more organic and less invasive and this is the route I'm after; if I could only get this initial memory dump (:I've had another look around and so far it seems I'm crap out of luck and the only option being to open this sucker up. All I see is that the MSO's are an exception to the SCPI rule, specifically serendipitys post: -Quote from: serendipity on October 07, 2015, 12:56:43 amIf anyone around Ontario wants to make a few bucks, I'd rather pay you than Rigol!

author: Daruosha
author_rank: Regular Contributor
timestamp: April 15, 2018, 06:22:39 pm
content: After extracting the keys, you can install the stock firmware and it will be as official as it gets.