Hacking the HDO1k/HDO4k Rigol 12 bit scope - Page 1
Forum section: electronics / testgear

author: oliv3r
author_rank: Frequent Contributor
timestamp: October 04, 2022, 08:03:26 am
content: Just a starting placeholder post for now, but this is a thread on hacking/unlocking the HDO-series of scopes from rigol (https://www.rigolna.com/products/digital-oscilloscopes/hdo4000/andhttps://www.rigolna.com/products/digital-oscilloscopes/hdo1000/).For more information for now, seehttps://www.eevblog.com/forum/testgear/rigol-hdo1000-and-hdo4000-12bit-oscilloscopes-launched-in-china/msg4446910/#msg4446910We have nothing so far, we need at least some firmware, which is not yet available for download. I already requested the GPL source code for both these scopes.First concerrns, secure boot. These android devices tend to be locked down at the bootloader, and tend to use 'verified boot'. If this is the case, unless we can get signing keys for the bootloader, hacking won't be possible as we can't replace the code. There might still be exploits and we might still 'hack' the code at runtime, but it wouldn't be a permanent one. From the Serial logs however, we don't see anything enabled in that light, secure boot, trust zone, all seems to be disabled. Also no dm-verity seems to be used.Hardware hacking:The HDO4000 and HDO1000 seem to share the same PCB (different revisions though) and one major difference, seems to be that one of the ADC's (and its power supply) is not populated. While in theory, one could solder the missing parts and turn a HDO1000 into a HDO4000 one electrically, finding the parts is probably not even going to be possible, and salvaging things from other scopes makes the value proposition not very interesting. But hey, in _theory_ its possibleSoftware hacking:While the software platform is very similar to the MSO5000-series (FRAM to store stuff, encpryption, XXTEA etc).A tool to decrypt the vendor.bin and generate a license key can be found here:https://gitlab.com/riglol/rigolee/hdo-tools.To use the license generator, one must have ssh access to the scope, to extract the key file from it (or use usb-uart and extract it like that somehow). Best extract the key at least once, and back it up, before updating any firmware, who knows what gets locked down laterWarning a head, this will not be and is not intended to be, a 'support' thread. So please keep on topic and focus only on hacking/unlocking these scopes!Discussion thread about bugs:https://www.eevblog.com/forum/testgear/new-rigol-hdo1000-12-bit-dso-bugs/

author: EEVblog
author_rank: Unknown
timestamp: October 25, 2022, 04:54:31 am
content: Just did the HDO1000 teardown, andIt's EXACTLY the same PCB as the HDO4000, minus one ADC!Yes, that means full 800MHz front end with 50ohm even though the software doesn't support it.Absolutely minor production changes, but it's clear they intend to use idenitical boards and parts. The profit margin on the HDO4000 must be really something.So in theory you could get a 4CH 800MHz bandwidth 12bit 2GS/s scope for US$999

author: EEVblog
author_rank: Unknown
timestamp: October 25, 2022, 05:03:01 am
content: Both PCB photos cropped and aligned herehttps://www.flickr.com/photos/eevblog/albums/72177720303155959Some extras here:https://www.flickr.com/photos/eevblog/albums/72177720303155042

author: tv84
author_rank: Super Contributor
timestamp: October 25, 2022, 08:35:38 am
content: Dave, please try some log peeking.

author: EEVblog
author_rank: Unknown
timestamp: October 25, 2022, 10:13:35 am
content: Quote from: tv84 on October 25, 2022, 08:35:38 amBegan shooting that video before I left for home tonight. Will continue tomorrow.

author: Fungus
author_rank: Super Contributor
timestamp: October 25, 2022, 01:31:07 pm
content: Quote from: EEVblog on October 25, 2022, 04:54:31 amAll you need is that second custom Rigol ADC.PS: There's a lot of missing stuff at top-right. What's all that for?

author: mawyatt
author_rank: Super Contributor
timestamp: October 25, 2022, 02:09:59 pm
content: Quite interesting video indeed, thanks!!One thing about the 1000 that may be going on is the 1000 may get the fallout ADCs that can't be utilized in the 4000. For example, the 4000 may require the 2 ADCs to be matched within some range like thru-put timing skew.Also very interested in who. where and what process the ADCs came from.Best,

author: thm_w
author_rank: Super Contributor
timestamp: October 25, 2022, 10:04:50 pm
content: Quote from: Fungus on October 25, 2022, 01:31:07 pmThose were the supplies + sense leads for probe detection. Not used on the HDO1k.

author: EEVblog
author_rank: Unknown
timestamp: October 26, 2022, 02:11:37 am
content: Quote from: EEVblog on October 25, 2022, 10:13:35 amSorry, haven't got it yet. Used my new R&S MXO44 scope to probe and debug and it turned into an entire session where the scope locked upRendering video on that now for R&S to look at.

author: EEVblog
author_rank: Unknown
timestamp: October 26, 2022, 02:13:28 am
content: Quote from: mawyatt on October 25, 2022, 02:09:59 pmCould be.Someone in the comments noticed that the 2nd diff pair of resistor above the ASIC is missing.So the HDO400o uses two pairs form the front end ASIC and the HDO1000 uses only one pair.Maybe the extra pair is for a higher bandwidth path? Doesn't make much sense, but that's all I can think it. Going to have to measure them.

author: EEVblog
author_rank: Unknown
timestamp: October 26, 2022, 02:21:01 am
content: I'm not releasing it generally, but for those interested in the MXO44 lockup:6:40 is when the problem starts.

author: EEVblog
author_rank: Unknown
timestamp: October 26, 2022, 03:37:26 am
content: The serial output is 1.5Mbaud and my terminal cature programs can't handle that data rate.I was able to decode the text "Version" on my Keysight 3000 when manually set to 1.5Mbaud but I really need a PC capture to get the whole lot.Need another option, maybe one of my PC based scopes.

author: EEVblog
author_rank: Unknown
timestamp: October 26, 2022, 04:17:57 am
content: Data dump from the HDO1000. The Salaea logic did 1.5Mbps and has a data terminal window, very nice.The /0 data continues for the rest of the boot process and then nothing when power is shut down.Code:DDR Version 1.26 20210628Inchannel 0CS = 0MR0=0x98MR4=0x1MR5=0xFFMR8=0x10MR12=0x72MR14=0x72MR18=0x0MR19=0x0MR24=0x8MR25=0x0channel 1CS = 0MR0=0x98MR4=0x1MR5=0xFFMR8=0x10MR12=0x72MR14=0x72MR18=0x0MR19=0x0MR24=0x8MR25=0x0channel 0 training pass!channel 1 training pass!change freq to 416MHz 0,1Channel 0: LPDDR4,416MHzBus Width=32 Col=10 Bank=8 Row=16 CS=1 Die Bus-Width=16 Size=2048MBChannel 1: LPDDR4,416MHzBus Width=32 Col=10 Bank=8 Row=16 CS=1 Die Bus-Width=16 Size=2048MB256B stridechannel 0CS = 0MR0=0x98MR4=0x1MR5=0xFFMR8=0x10MR12=0x72MR14=0x72MR18=0x0MR19=0x0MR24=0x8MR25=0x0channel 1CS = 0MR0=0x98MR4=0x1MR5=0xFFMR8=0x10MR12=0x72MR14=0x72MR18=0x0MR19=0x0MR24=0x8MR25=0x0channel 0 training pass!channel 1 training pass!channel 0, cs 0, advanced training donechannel 1, cs 0, advanced training donechange freq to 856MHz 1,0ch 0 ddrconfig = 0x101, ddrsize = 0x40ch 1 ddrconfig = 0x101, ddrsize = 0x40pmugrf_os_reg = 0x32C1F2C1, stride = 0xDddr_set_rate to 328MHZddr_set_rate to 666MHZddr_set_rate to 416MHZ, ctl_index 0ddr_set_rate to 856MHZ, ctl_index 1support 416 856 328 666 MHz, current 856MHzOUTBoot1 Release Time: May 29 2020 17:36:36, version: 1.26CPUId = 0x0ChipType = 0x10, 351SdmmcInit=2 0BootCapSize=100000UserCapSize=7456MBFwPartOffset=2000 , 100000mmc0:cmd8,20mmc0:cmd5,20mmc0:cmd55,20mmc0:cmd1,20mmc0:cmd8,20mmc0:cmd5,20mmc0:cmd55,20mmc0:cmd1,20mmc0:cmd8,20mmc0:cmd5,20mmc0:cmd55,20mmc0:cmd1,20SdmmcInit=0 1StorageInit ok = 69537SecureMode = 0SecureInit read PBA: 0x4SecureInit read PBA: 0x404SecureInit read PBA: 0x804SecureInit read PBA: 0xc04SecureInit read PBA: 0x1004SecureInit read PBA: 0x1404SecureInit read PBA: 0x1804SecureInit read PBA: 0x1c04SecureInit ret = 0, SecureMode = 0atags_set_bootdev: ret:(0)GPT 0x3335db8 signature is wrongrecovery gpt...GPT 0x3335db8 signature is wrongrecovery gpt fail!Trust Addr:0x4000, 0x58334c42No find bl30.binLoad uboot, ReadLba = 2000Load OK, addr=0x200000, size=0x869bcRunBL31 0x40000 @ 97359 us\x01NOTICE: BL31: v1.3(release):845ee93NOTICE: BL31: Built : 15:51:11, Jul 22 2020NOTICE: BL31: Rockchip release version: v1.1INFO: GICv3 with legacy support detected. ARM GICV3 driver initialized in EL3INFO: Using opteed sec cpu_context!INFO: boot cpu mask: 0INFO: plat_rockchip_pmu_init(1196): pd status 3eINFO: BL31: Initializing runtime servicesINFO: BL31: Initializing BL32INF  TEE-CORE:init_primary_helper:337: Initializing (1.1.0-256-gebb61ff5 #4 Wed Apr 22 01:34:02 UTC 2020 aarch64)INF  TEE-CORE:init_primary_helper:338: Release version: 1.2INF  TEE-CORE:init_teecore:83: teecore inits doneINFO: BL31: Preparing for EL3 exit to normal worldINFO: Entry point address = 0x200000INFO: SPSR = 0x3c9\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0

author: 2N3055
author_rank: Super Contributor
timestamp: October 26, 2022, 09:20:01 am
content: Quote from: EEVblog on October 26, 2022, 02:21:01 amPicoscopes have auto Baud detection.. Works quite well. Very useful for nonstandard rates.Or confuse you when you program registers wrong and your baud rate is all funny...You look at the screen and all the messages are there, but it is not received on the other side. Ask me how I know...My Keysight has baud rate measurement. So you measure it and then type it in by hand.

author: 2N3055
author_rank: Super Contributor
timestamp: October 26, 2022, 09:26:25 am
content: Quote from: EEVblog on October 26, 2022, 03:37:26 amYes, Pico would handle it no problem.

author: hans
author_rank: Super Contributor
timestamp: October 26, 2022, 10:31:09 am
content: Quote from: EEVblog on October 25, 2022, 04:54:31 amAssuming of course.. the 800MHz "image" loaded onto the FPGA is going to ignore the missing 2nd ADC..Because although technically 800MHz and 2GS/s is not aliasing.. it's very close to and I think I'd rather keep the bandwidth at 400MHz to have less noise.I would place my bets at a 1700$ 4ch 800MHz 12-bit4GS/sscope. Get a 4ch 1000$ model and a 2ch 700$ model. Move the ADC from 2ch to the 4ch board with a bit of hot air. Hack the firmware into thinking it's a HDO4k 800MHz. That's 3k$ "saved".But in theory that sounds easy. As pointed out, maybe there is some analog path and digital bus de-skewing going on to have both ADCs sample properly for all channel configurations. If this is stored in some calibration ROM, that perhaps requires an intensive procedure to fix.Also hot air reflowing on 1700$ worth of gear doesn't sound too attractive.. But the potential may be there if indeed both boards are identically BOM-loaded (except ADC), and/or it's possible to figure out what to change.

author: hexpope
author_rank: Contributor
timestamp: October 26, 2022, 10:44:00 am
content: Ooh, I haven't been excited for this since the release of the DS1000Z series scopes a few years back.

author: insine
author_rank: Contributor
timestamp: October 26, 2022, 10:56:04 am
content: All those "\0\0\0\0\0\0\0\0" is probably when the second bootloader (u-boot) started and used a different baudrate. You may want to re-decode that part.

author: EEVblog
author_rank: Unknown
timestamp: October 26, 2022, 11:18:29 am
content: Quote from: insine on October 26, 2022, 10:56:04 amNever would have thought of that. It would really do that?

author: 2N3055
author_rank: Super Contributor
timestamp: October 26, 2022, 11:47:50 am
content: Quote from: hans on October 26, 2022, 10:31:09 amIf it is possible at all, I have no doubt someone will do it just to claim the fame. But that is way too expensive, risky and complicated for average user.DS1000Z was cheap to buy and then you generate license and voila. Beginners skill level for beginners that are buying that scope.This would be buying 2 scopes for 6x times more money, then voiding warranty and potentially destroying both. I personally would really hesitate to buy a used "frankensteined" HDO like that... While any software based tiknering really is safe...One more thing: in EU price for HDO1074 are 999€ without VAT. With VAT it is 1200€.So HDO1074 is not sub 1000€ for a private user in EU.2 ch one is 830€ with VAT. Hacker special combination would be a tad over 2000€ with VAT..I don't see this happening at any scale.

author: ulwur
author_rank: Newbie
timestamp: October 26, 2022, 12:48:13 pm
content: So what does the second ADC actually do? If the PCB's are the same, and all the four channels are connected to the one ADC, what's the purpose of the other ADC?

author: MegaVolt
author_rank: Frequent Contributor
timestamp: October 26, 2022, 12:56:07 pm
content: Quote from: ulwur on October 26, 2022, 12:48:13 pmInterleaving?

author: 2N3055
author_rank: Super Contributor
timestamp: October 26, 2022, 01:07:40 pm
content: Quote from: MegaVolt on October 26, 2022, 12:56:07 pmExactly..

author: Fungus
author_rank: Super Contributor
timestamp: October 26, 2022, 02:00:29 pm
content: Quote from: hans on October 26, 2022, 10:31:09 amThat's where the "hack" would come into it - tweak the firmware to create a Frankenscope.