You can't unlock a MSO1000Z series scope without a memory dump and other lessons - Page 1
Forum section: electronics / testgear

author: serendipity
author_rank: Newbie
timestamp: October 07, 2015, 12:56:43 am
content: So, having done a lot of research and made my fair share of mistakes, I would like to add to the collective wisdom / noise on this forum.After I:spent a great deal of time wondering why my MSO1074Z doesn't like riglol keys, even with the MSO1000Z patchescompletely botched my warranty void stickerspent 42 hours (sic) on a JTAG memory dumpgot locked out of my scope for entering the wrong option keys (12 hours at a time) for more than I can countlist of mistakes keeps going. I am a terrible hacker.I finally unlocked the options on my MSO1074Z. I've decided to document my mistakes and hope no one else makes them.So, here we go:riglol does not generate correct keys, even when patched with the MSO1000Z_private_keyFrom comparing,this postand my own experiences, I've come to the conclusion that, RC5KEY1, RC5KEY2 and XXTEAKEY are different for each scope. The public and private keys for all Rigol MSO1000Z scopes are the same. I've generated keys with Riglol (with MSO1000Z private key patch) and they don't work. rigup works, but it actually uses the RC5 and xxtea keys. The riglol tool doesn't know about this and can't possibly generate the correct codes.:SYSTem:OPTion:INSTall does not take dashes:SYSTem:OPTion:INSTall HBHBHBH-BHBHBHB-HBHBHBH-BHBHBHBis incorrect.:SYSTem:OPTion:INSTall HBHBHBHBHBHBHBHBHBHBHBHBHBHBis correct.While we are at it, this Python code works:import vxi11i = vxi11.Instrument('192.168.0.100')i.ask('*IDN?')#No dashes in activation numberi.write(':SYSTem:OPTion:INSTall HBHBHBHBHBHBHBHBHBHBHBHBHBHB')Just remember to installpython-vxi11Get yourself a FTDI based JTAG programmer before doing a memory dump.I must have the cheapest Altera USB Blaster clone that money could buy. It look me me nearly 2 days to complete the memory dump. I am not kidding:> dump_image mso1074z.bin 0x40000000 0x3FFFFFFdumped 67108863 bytes in 153915.625000s (0.426 KiB/s)Yes, that's 426B/s. Uh... thats like 10% of what I got over a dialup connection. Don't do what I andthis fellowdid. Had I read his post before this, I would have borrowed the faster JTAG programmer from work before I left on Friday. Proportedly, OpenOCD works better with FTDI based JTAG cables.You don't need to wait for the memory dump to finish to run rigupI was able to extract all the keys that I needed about 28MB into the memory dump. I thought I would finish the memory dump for good measure, but it surely wasn't necessary.You don't need to modify rigup if you have a serial number beginning with DS1ZCLooking at the source code of the patched rigup tool (rigup-0.4.1-mso1000z.zip), I thought it only worked for oscilloscopes with serial numbers beginning with DS1ZD. In utils.c, there's this following line:if ( serialNumber!='D' && serialNumber!='Z' && serialNumber!='1' && serialNumber!='S' && serialNumber!='D' )This got me concerned as my scope's serial number began with DS1ZC. Turns out this if statement never evaluates true (set a breakpoint, never hit during debug).Don't link rigup with-Wl,-dead_stripAsthis fellow saidat the end of his post, remove the-Wl,-dead_stripfrom the LDFLAGS parameter of the Makefile for rigup. Don't know why it seg faults on my computer, but it does. So, remove it and you'll be fine.There's a lot of great information on this forum. The only problem is, its really hard to find it. It would be better organized as a Wiki. But who am I to complain... I am too lazy and penny pinching to start one myself!EDITS: minor typos

author: pickle9000
author_rank: Super Contributor
timestamp: October 07, 2015, 02:21:39 am
content: That's a winner, nice job.I have watched a fair number of your vids. You do an excellent job.

author: pascal_sweden
author_rank: Super Contributor
timestamp: October 07, 2015, 08:30:56 am
content: Can't you do a memory dump without opening the scope?There is an undocumented SCPI/LXI command to perform a memory dump through network interface.No need to open up your scope, mess around and void your warranty.Why make things more difficult than they are?

author: Orange
author_rank: Frequent Contributor
timestamp: October 07, 2015, 08:41:30 am
content: Quote from: pascal_sweden on October 07, 2015, 08:30:56 amWhat is this 'undocumented command' then look like ??

author: Luddi
author_rank: Newbie
timestamp: October 07, 2015, 10:56:53 pm
content: https://www.eevblog.com/forum/testgear/rigol-mso2000-series-hacking/msg745473/#msg745473don't know if it works with the 1000z too.

author: Howardlong
author_rank: Super Contributor
timestamp: October 07, 2015, 11:02:59 pm
content: Quote from: Luddi on October 07, 2015, 10:56:53 pmDoes not work on an MSO1000Z I'm afraid.

author: serendipity
author_rank: Newbie
timestamp: October 08, 2015, 12:23:34 am
content: Quote from: pickle9000 on October 07, 2015, 02:21:39 amI didn't do those videos. I am just quoting someone else' work.Quote from: Orange on October 07, 2015, 08:41:30 amI think you are referring to the :SYST:UTIL:READ? command. I tried it on my MSO1074Z running firmware 4.00 and 4.03. The command didn't work with either firmware.

author: Howardlong
author_rank: Super Contributor
timestamp: October 08, 2015, 06:29:45 am
content: There is a thread specifically on the MSO1074Z hacking herehttps://www.eevblog.com/forum/testgear/is-the-rigol-mso1074z-hackable/which has links to the specific posts.It seems as though the serial numbers have since been modified slightly.My core dump took about 15 minutes, there's an adapter_khz setting for some JTAG adapters.I agree that a wiki would be good... I think more than enough people have gone through the pages to justify that, are you offering? :-)Sandra's post here in particular is probably a good one toohttps://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg569236/#msg569236

author: NutuElectronist
author_rank: Contributor
timestamp: January 26, 2024, 09:52:17 am
content: Hi all. I have RIGOL1074Z with red screen dead and i try all methods but no success . I try update with last update downloading from RIGOL site but no success . When plug USB stick with update file in front socket and after power up press HELP button i thing go to update because CH1 blinking and led from my usb stick but after few seconds all leds from front panel blinking .Please can help me with solutions to give another life for my RIGOL ?Thank you.

author: wasedadoc
author_rank: Super Contributor
timestamp: January 26, 2024, 01:17:17 pm
content: Quote from: NutuElectronist on January 26, 2024, 09:52:17 am1. Your post is not related to this topic.2. You already asked the same question less than 24 hours ago athttps://www.eevblog.com/forum/testgear/rigol-red-screen-of-death/msg5296009/#msg5296009.