Is the Rigol MSO1074Z hackable? - Page 1
Forum section: electronics / testgear

author: MattSR
author_rank: Regular Contributor
timestamp: December 25, 2014, 11:37:42 am
content: Hi all, apologies if this is covered elsewhere, but is the Rigol MSO1074Z hackable? I have searched here but found no real references to upgrading this model..Cheers

author: Howardlong
author_rank: Super Contributor
timestamp: December 25, 2014, 11:55:39 am
content: As it currently stands, you will need an appropriate JTAG debugger.Smgvbest has an excellent how-to herehttps://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg569236/#msg569236, far better than my attempt a few posts earlier which had been written some weeks after doing it (for reference herehttps://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg566312/#msg566312)Smgvbest says that the debugger she used is no longer made. I used an Olimex ARM-USB-OCD-H which is still available.

author: MattSR
author_rank: Regular Contributor
timestamp: December 26, 2014, 06:18:52 am
content: Hi Howard - that's fantastic info, it more than makes up for my lack of google-fu/search-fu!I'll have a close read and figure out what I need to get to do this.Thanks again,Matt!

author: aviphysics
author_rank: Contributor
timestamp: January 05, 2015, 10:14:47 pm
content: Hi,would these hacks also apply to the MSO1074Z-S ?Thanks in advance.

author: fldutchman
author_rank: Newbie
timestamp: January 06, 2015, 04:32:55 am
content: I just tried the keygen with the riglol option, and had no luck with an MSO1074Z SW 00.04.01.SP2, board 2.1.1. Guess it's JTAG time. I'll post a follow-up when I've had a chance to try the JTAG approach.--fdm

author: smgvbest
author_rank: Unknown
timestamp: January 07, 2015, 07:09:13 am
content: MSO1074Z-S is hack-able. there are several posts int he Rigol I2C thread and this but you must open the scope up and dump memory to get the keys. and you have to use a custom version of rigup to do it which is also posted in the thread.My post is herehttps://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg569236/#msg569236

author: kripton2035
author_rank: Super Contributor
timestamp: January 07, 2015, 07:34:40 am
content: use this excellent software to get the memorydump - dont void the warranty opening the scope or using jtaghttp://peter.dreisiebner.at/rigol-bildschirmkopie-lan/#screenshot

author: hammy
author_rank: Unknown
timestamp: January 07, 2015, 11:29:37 am
content: Quote from: kripton2035 on January 07, 2015, 07:34:40 am... no, not possible with the MSO1000z. JTAG is the way to go.

author: kripton2035
author_rank: Super Contributor
timestamp: January 07, 2015, 02:15:51 pm
content: has been tested with DS1104Z :

author: Howardlong
author_rank: Super Contributor
timestamp: January 07, 2015, 02:40:29 pm
content: How do you use the tool to extract a memory dump? At present I am unaware of a SCPI command that works with the DS/MSO1000Z series to perform a memory dump.

author: hammy
author_rank: Unknown
timestamp: January 07, 2015, 02:43:51 pm
content: Quote from: kripton2035 on January 07, 2015, 02:15:51 pmyes, this part is working ... but ... the last time the scpi command for the memory dump was not implemented in the DS/MSO1000z series.This is now possible? With the new firmware?

author: kripton2035
author_rank: Super Contributor
timestamp: January 07, 2015, 04:04:35 pm
content: I can't recall where, but there is a thread on eevblog where someone pointed me this tool and said it worked for his ds1054zgot the memory dump with a simple usb cable. it was in november or soI dont have a rigol so I cannot say I personnaly did the hack with this tool.

author: smgvbest
author_rank: Unknown
timestamp: January 07, 2015, 11:22:31 pm
content: I just did a search of eevblog for this website and the only link was in mention of the DS2000 not the DS1000I just tried a :SYST:UTIL:READ? 15441920,13262848 using is and the same message on my MSO1074Z-SThere was an error when sending the SCPI command.If someone can find the message mentioned that would be good but far as we know you can not dump memory thru SCPI on the DS1000Z series scopes. Opening it and using JTAG is the only known way on these scopesAlso the OP is asking for the MSO1000Z series not the DS1000Z so maybe it does work on the DS1000Z I don't know I do not have one but that is not the OP's question

author: Howardlong
author_rank: Super Contributor
timestamp: January 08, 2015, 12:00:52 am
content: Unless it can be shown otherwise, as it currently stands I agree, you need to use JTAG to get the memory dump for the DS/MSO1000Z series as they don't have a RAM read SCPI function. For the avoidance of doubt, for the DS1000Z series, you don't need the dump anyway. But you do for the MSO1000Z series.Sounds like there's been a bit of hearsay at play, and internet hearsay at that!

author: MattSR
author_rank: Regular Contributor
timestamp: January 08, 2015, 01:06:52 am
content: Quote from: Howardlong on January 08, 2015, 12:00:52 amThat lines up with all the research I have done on here.

author: smgvbest
author_rank: Unknown
timestamp: January 08, 2015, 01:41:15 am
content: Quote from: Howardlong on January 08, 2015, 12:00:52 amYes, and we know just how reliable the internet can be.I remember a saying, Trust but Verify

author: aviphysics
author_rank: Contributor
timestamp: January 08, 2015, 04:20:35 am
content: Quote from: Howardlong on January 08, 2015, 12:00:52 amWhy don't you need the dump for the DS?Also, is there a possibility that someone will eventually be able to create a tool that can generate the codes from whatever number Rigol uses when you buy an upgrade?

author: Howardlong
author_rank: Super Contributor
timestamp: January 08, 2015, 09:20:04 am
content: Quote from: aviphysics on January 08, 2015, 04:20:35 amThe way the keys are generated are fundamentally different between the DS1000Z and MSO1000Z. I don't pretend to know the details of it, but that's how it is.

author: crispus
author_rank: Regular Contributor
timestamp: October 20, 2016, 01:33:32 pm
content: Is the version -s of there MSO hackable (MSO1074Z-S)?

author: Howardlong
author_rank: Super Contributor
timestamp: October 20, 2016, 11:08:39 pm
content: Quote from: crispus on October 20, 2016, 01:33:32 pmYes, or at least it was when I did mine.

author: kripton2035
author_rank: Super Contributor
timestamp: October 21, 2016, 06:40:11 am
content: did you need a jtag method to hack your mso1074z-s ?

author: Howardlong
author_rank: Super Contributor
timestamp: October 21, 2016, 07:34:49 am
content: Quote from: kripton2035 on October 21, 2016, 06:40:11 amYes. The signal generator is just a bolted on daughter board, plus an extra button on the front panel. It makes no difference to the upgrade process. The thing that makes a difference is whether it's a DS1000Z, DS1000Z+ ot MSO1000Z: the first can be upgraded without the jtag procedure, the latter two need the jtag method as it stands. Recently there has also been some question as to whether newer plusses and MSOs are still all upgradeable. Certainly some are, but it's not clear yet whether those not successful are struggling with the procedure, or whether there's been a recent change preventing the method working.

author: scuff
author_rank: Newbie
timestamp: January 25, 2017, 12:57:48 pm
content: Hi all,I've just bought a brand new MSO1074Z-S, which I'm hoping to hack. Can anyone confirm whether the hack mentioned here and in other linked threads is still working on the latest hardware and firmware? My unit has:Software version: 00.04.04.SP1Board version: 6.1.4Thanks in advance!

author: mikehs
author_rank: Newbie
timestamp: January 26, 2017, 03:29:22 pm
content: Quote from: Howardlong on January 08, 2015, 09:20:04 amI don't know if that is still the case. I just got a new DS1054Z and tried the the Riglol1.03d keygen and got invalid. I plan on playing a bit more with it before having to go the route of dumping.

author: ebastler
author_rank: Super Contributor
timestamp: January 26, 2017, 04:05:25 pm
content: Quote from: mikehs on January 26, 2017, 03:29:22 pmBy all reports on this forum so far, the Riglol key generator still works for all regular DS1054Z scopes. (I.e. non-MSO and non Plus models.) Quite a few users have reported problems with the browser-based key generator, which could always be fixed bytrying again,trying yet again,switching to a different browser, orusing the offline version of the keygen program.Please have a look at the DS1054Z monster thread, working your way backwards -- there were a few recent posts on this, I believe.

author: mikehs
author_rank: Newbie
timestamp: January 27, 2017, 12:03:01 am
content: Thank you for the help, it worked!All newbies like me, you must delete all the characters in the SN entry box before entering your SN. I deleted up to the 'D', but that apparently does not work.

author: typoknig
author_rank: Regular Contributor
timestamp: April 07, 2019, 05:19:42 am
content: Quote from: Howardlong on December 25, 2014, 11:55:39 amLooks like the link you posted isn't quite right any more. The apostrophe in "rigol's" breaks things. Here is the correct link:https://www.eevblog.com/forum/testgear/sniffing-the-rigol_s-internal-i2c-bus/msg569236/#msg569236