Hacking the Rigol MSO8204 / MSO8000 - Page 1
Forum section: electronics / testgear

author: traxpalicaru
author_rank: Newbie
timestamp: June 26, 2024, 10:58:24 pm
content: Hi, I've been the happy owner of a Rigol MSO8204 2GHz 10GSa/ for a week now. And of course, why not, we have to do tests on it. More precisely, let's activate all the licenses. I've seen it possible on earlier versions like the MSO5000. As a result, with the help of userhttps://www.eevblog.com/forum/index.php?action=profile;u=94961BTO and a friend from Romania userhttps://www.eevblog.com/forum/profile/?u=92610asp because I'm not as good at software as they are, I tried the script version for MSO5000. At first my MSO8204 oscilloscope could not be accessed either via ADB or SSH.But with his big brain asp managed to make a so-called update for opening port 22 for SSH. After a few lost hours he also found the area in CFRAM where there should be Keys for licenses. But at the moment the script is not right, the licenses do not activate. I'm opening this topic more to thank them for trying to find a solution and because I want to post pictures of the inside of the oscilloscope because I couldn't find it on the web. And maybe eventually someone will find the license solution.Here is original photoshttps://drive.google.com/drive/folders/1jrgET-kSbf_1IEIezg8QdZ5eYb8Srk2g?usp=drive_linkCode:KEY1 = b''.join(pack('<I', x) for x in [0x03920001, 0x08410841, 0x18C32104, 0x318639C7])KEY2 = b''.join(pack('<I', x) for x in [0x478AA887, 0x99A85895, 0x1770078, 0x87888798])Code:Version: 00.01.01.01.06MAC: 00-19-AF-7E-04-83/rigol/tools/fram is OK!Reading CFRAM...100%|██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 8192/8192 [00:15<00:00, 536.29it/s]Reading CFRAM done.Applying new CFRAM...100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 8192/8192 [02:52<00:00, 47.39it/s]New CFRAM applied.Key.data backup created.New Key.data applied.Activating: 2RL [MSO8000-2RL@47856CD43FD2E005B0441CACAE684909252D7D5205207CD880901F4BF4A110BA625290D47FC919E624E18A4BFECCA25E8B9E203BD026D0A3778B943992A59FA8]... unavailable.Activating: 4CH [MSO8000-4CH@905C9C63AC9302632B5375648494D44B015BA182ED51E919FFF3EEDD936C34FB318AAF2A9B95F6E3B2F407136753DDAA174354764276BD610153207F66A636E4]... not activated.Activating: 5RL [MSO8000-5RL@8368AF368E1197118F4BB459D4D5855373BBDD9945695CDD9A3080FEE1FBBFFEA76A90972696DF3E0C19B7870C8B3AA403467A566B63C827AC0B9CE35CD7CCBB]... unavailable.Activating: AERO [MSO8000-AERO@16828851C599C3A0F708E23E25A4548A40B614999EC83BBFB0E83663230A74A37DA897A651756C372B15668E73FF41BFF600F3A38D05C6D300278C2F4703E5B1]... not activated.Activating: ARINC [MSO8000-ARINC@5385B53858D80CC3AC57E502DB61FA6947666A9020B9FEFBA58BF49A66565528186BBBC5D5543B2C6ABFAB4A721F2CF3D6760C5109C55CEBB060257C84A0D14E]... not activated.Activating: AUDIO [MSO8000-AUDIO@26319D5917E78275126F2CC06FFABBD789F35F819564EB39E4F2FCC2E7BBB441297C769F2C4DC92ED39028BB9F6C9A5D33792AAB81C0608411C9546467BA6B40]... not activated.Activating: AUTO [MSO8000-AUTO@1592058F99EBE588E5F2B5A3CC7635E5D36FE665FDE99DF51DFF469E3C45CECBA67662F8A8CF3C50F7FCEDD420036226A916ABBDCFDE9AC8A786FE48A008EF14]... not activated.Activating: BND [MSO8000-BND@3DC1F7E9C12EAE0AE0932E03268A59EC81EBD4EDAD2DB938588E58CBA0C0ADBB9DBCB4678B3D8924A3AACB293241D8AA72341F5512CE9A9EE27266B0BD71EF64]... not activated.Activating: BW07T1 [MSO8000-BW07T1@04B9175FD0845ED677897B1651E7889350F3FCAF84DD639A05A3BEBE6950409F9641D05FC29FC25A2C5E1323B5F6F1E3FA2052B4C53620B1BC14B7387E43C9CB]... unavailable.Activating: BW07T2 [MSO8000-BW07T2@0C64B0E801C667F5328AE52E49FFD65C30357F455A295D706947AAA7D4D6DD1402861FF59AC97B981904926DFE8B0BE7265DBB1AF131DEDE26310CB3AC318903]... unavailable.Activating: BW07T3 [MSO8000-BW07T3@6D46F14DAF106162BB71C38C155ECBADD21DAF8CB4C99AEE35B7ACEE0B445D7E8EAEA7816A141C7D91A87D91C16B16E2809524347457F391C7FCC80FAF9A668C]... unavailable.Activating: BW07T5 [MSO8000-BW07T5@25877F6476AE4BA5CDFD164507558D4973F99D710E5BEBB55C035495B16C5B7656CECA9868AA970BE2FB72B0612E9082E059BABE77517E9D5F1783800DE68D0A]... unavailable.Activating: BW1T2 [MSO8000-BW1T2@498C14875DDF3BCA78ECDC57B51134F41D94B7F7B093126169448BE36BC3B1EB97029A0C7C0CF859B7B03CA0F43DFC771BD74B68502000DDA0488BDBE298E3CD]... unavailable.Activating: BW1T3 [MSO8000-BW1T3@5C0F8FA801C8B57B35278E514CB958BA8811065C47D93ED0E7166BFAF1363A18384EC7AA539E5AB6C68BC418A314679B8B51FD2C4E22D36D15DB696648ED8B8E]... unavailable.Activating: BW1T5 [MSO8000-BW1T5@34EC40171698848E32298AC096A0B118B19A85EDE2DB7E86EDC9AFAE6B6084916162C9FE1E057DB84FC68CE2AF28D874BAF36797C4709ED65F5D10B3261A6769]... unavailable.Activating: BW2T3 [MSO8000-BW2T3@72E95D484D97813D1B485EBF1D9D57E73F1CBB6F8ACBE8E83A6BC4EA9844C5B61B0D2C9F5CF83B49B6A837EFCE4729DC9D9FC581066133B40844248E9EC8F46E]... unavailable.Activating: BW2T5 [MSO8000-BW2T5@968B913A55E0C4A6F40B1973CC55D74ADA737D2151CBAA63C944D1088A8818474B27C132CBF5D8F58383AA20AA47E9AF76BE6888F9DB08F20A5A7DB225DF96E5]... unavailable.Activating: BW3T5 [MSO8000-BW3T5@79A7866C6DE39DE65A1478D60DE4731E9D9B1D304E7B2D570D3987BE18413A5F3E6CBBE170EF3DCDFB905C933F3D923BD2EC732773D1897C937AABD404498DEE]... unavailable.Activating: COMP [MSO8000-COMP@53DA985708CDCEABCA9275B3117E66C8FE37865AF2F3B7751C90903766DC1DD51FEF69BF292D2D71DA9DF0C96A517D5C6E93B776BB8DD14994A3763C6D41A84F]... not activated.Activating: CTR [MSO8000-CTR@2DDD7593AEA4A149A7ED050CD784BAE90B0F3180625A1EAC1C776E0C26947FB13D02B2543970176D81B70B309CEEC78CD0631D63540195EFF9A8152F4CDEC61B]... not activated.Activating: DG [MSO8000-DG@6E002F4E301B5E057277C6B9521639CDB7BB60FEA491DFF5E7AB7970ACD5C2301F13C6D662E5466BAF1C8AEE7608E99D57414B4454F1316B1D35D974D712D7CF]... unavailable.Activating: DVM [MSO8000-DVM@742470E3648B8DD679D287372BE583A25F1271FE726C69F89D9F5AE3E49760932C099A70E870089FBFD8DDA102BDF9FEBD71D6E7F5C9797EFCE9DCC66DBACE6F]... not activated.Activating: EDK [MSO8000-EDK@8B1EC10AF01540ACB2A9779A3B051265F24FF2DC173F7440ED1B88C741E28271A9D142F5C1170CDE51849A7AC2EB7D1CB919FCA17FBE9030C08EDE95AC51816F]... not activated.Activating: EMBD [MSO8000-EMBD@89265A117FB207D90DFD9B6A1497886A19C15D5046E4C8FDF26E5843D4B7A2F4829A1C0C43CB1003EA4178EB1DCD2CC4AD774883217D6D9C8BB3A2219817BF9D]... not activated.Activating: FLEX [MSO8000-FLEX@2533085AE17E12E90D3BD04C9F9D64E733DF33C973F5F2C362F24CB700D3A3BC2E5AFF8E57FFD593756DD5DFF44B06982A9FFE6F215B4EA0431CE39AD58FAC08]... not activated.Activating: JITTER [MSO8000-JITTER@02A77C8546C24A0650389149A31ECEFB493B64087EE41DC9D6AB5570FECE33FF98FCB25F14B7975B2C20DDA84A1FC8B0418D2D6628528DA4FD3B36F222FBF28D]... not activated.Activating: MASK [MSO8000-MASK@3A1C872E9380A6AC11D9962FD028CEE8F16A1EC241A7FB2120707846EF39E6E474446CC78576EBAF2F384E76FBD6F6C5F434563E82B7E99542FF23013DC2BE81]... not activated.Activating: MSO [MSO8000-MSO@9D30022E019106CD4C32BD4D857B7D4C2AE66917A2C9B646DE1B6BCEE71CDC1335C27B96608F26B3BB343A7455DE64C9F51283B51915310D21D4E1DA96EF12A0]... activated.Activating: PWR [MSO8000-PWR@7C4EBBBEE9429342F024AD06F8354495CD8B2804E6F8306E2F1F3CEC20829F3B7E5B5D1AB27065A5912338F5FB36F65DDB8D1D7DD705A378F68EEE6121BA03D5]... not activated.Activating: SENSOR [MSO8000-SENSOR@A62ACB08A95B38BC3563FCFA5AA334F514C624E3673522DCC2105D8F2C5C05C257BCC7BA0E19ED038F40FAE90DDAE13098AFF20C81D89EE450DF8BA18CB59D3F]... not activated.╒════════╤══════════╤═════════════════════════════════════════════════════╕│ Code │ Status │ Description │╞════════╪══════════╪═════════════════════════════════════════════════════╡│ COMP │ ---- │ Computer Serial Triggering and Analysis(RS232/UART) │├────────┼──────────┼─────────────────────────────────────────────────────┤│ EMBD │ ---- │ Embedded Serial Triggering and Analysis(IIC, SPI) │├────────┼──────────┼─────────────────────────────────────────────────────┤│ AUTO │ ---- │ Automotive Serial Triggering and Analysis(CAN/LIN) │├────────┼──────────┼─────────────────────────────────────────────────────┤│ FLEX │ ---- │ FlexRay Serial Triggering and Analysis │├────────┼──────────┼─────────────────────────────────────────────────────┤│ AUDIO │ ---- │ Audio Serial Triggering and Analysis(I2S) │├────────┼──────────┼─────────────────────────────────────────────────────┤│ AERO │ ---- │ MIL-STD 1553 Serial Triggering and Analysis │├────────┼──────────┼─────────────────────────────────────────────────────┤│ DG │ ---- │ Dual Channel WaveGen 25 MHz AWG │├────────┼──────────┼─────────────────────────────────────────────────────┤│ JITTER │ ---- │ Jitter and Real Time Eye Diagram Analysis │├────────┼──────────┼─────────────────────────────────────────────────────┤│ PWR │ ---- │ Integrated Power Analysis │╘════════╧══════════╧═════════════════════════════════════════════════════╛

author: asp
author_rank: Regular Contributor
timestamp: June 27, 2024, 01:24:21 am
content: UPDATE:Check this post for the latest version:https://www.eevblog.com/forum/testgear/hacking-the-rigol-mso8204-mso8000/msg5556207/#msg5556207After a bit of, we did manage to activate all the licenses on the MSO8204. None of this would be possible without the help ofBTOandDrMefistO.I am not sure it will work on 8000A's but the script can be modified to accommodate that. I will try to update the script in the near future in order to upgrade the bandwidth as well (e.g. from MSO8064 to MSO8204)In order to activate the MSO8000 you need to create a temp dir, download the attached script to the temp dir and than cd to temp dir.1. python rigol_mso8000_kg.py -r <mso8000_ip># this will generate a .priv file. do not delete it2. reboot scope (REALLY IMPORTANT) -> wait for the scope to be up and running again3. python rigol_mso8000_kg.py <mso8000_ip>4. done##notice the second time you need to run it without -r

author: traxpalicaru
author_rank: Newbie
timestamp: June 27, 2024, 01:57:00 am
content: Officially RIGOL MSO8204 is hacked after 2 white nightsAfter the update, the licenses remain activeThanks and rate toasp BTO DrMefistO.Now we are going to sleep (4:54am Romania)

author: BTO
author_rank: Frequent Contributor
timestamp: June 27, 2024, 02:21:44 am
content: Quote from: traxpalicaru on June 26, 2024, 10:58:24 pmQuoteYou're Welcome mate, No problem, it was fun.QuoteOh yess... Eventually, Eon's from now a race of superintelligent human beings will figure out the solution to this problem that has plaguedmankind for eon'sMEANWHILE.............AND.... THE VERY NEXT DAY- A SOLUTION WAS FOUND- AND WE OURSELVES FOUND THE SOLUTION

author: BTO
author_rank: Frequent Contributor
timestamp: June 27, 2024, 02:35:16 am
content: Quote from: asp on June 27, 2024, 01:24:21 amQuoteSo.. What are your thoughts on the MSO7000 Series ?i think it should be possible..Right ?QuoteDidn't you already get it on 2GHz though ?

author: BTO
author_rank: Frequent Contributor
timestamp: June 27, 2024, 02:36:37 am
content: I have posted notification of this update on the MSO5000 forums as well.as well this one MSO8000 which was just hanging around doing nothinghttps://www.eevblog.com/forum/testgear/rigol-mso8000-series-hack/new/#new

author: BTO
author_rank: Frequent Contributor
timestamp: June 27, 2024, 02:40:18 am
content: Quote from: traxpalicaru on June 27, 2024, 01:57:00 amI'm curious, where is the option BW1T2 that takes you from 1GHz to 2GHz ?

author: traxpalicaru
author_rank: Newbie
timestamp: June 27, 2024, 06:53:29 pm
content: Well, mine already has 2GHz. The only valid option for him from that group of "BW" would be upgrade from 2GHz to 3GHz with license "BW20T30" valid only for MSO8204 or MSO8204A. The problem is that it appears unavailable for me and we don't understand why. Anyway, 2GHz is enough, so there is no point in investigating the problem. Maybe someone will find a solution. You have images with firmware update and log below. Licence is still availabe after update.MSO8000-BW10T20Bandwidth Upgrade from 1 GHz to 2 GHz.(Option only works with MSO8104)MSO8000-BW6T10Bandwidth Upgrade from 600 MHz to 1 GHz(Option only works with MSO8064)MSO8000-BW6T20Bandwidth Upgrade from 600 MHz to 2 GHz. 2 GHz Bandwidth only available with 1 or 2 channels active.(Option only works with MSO8064)MSO8000A-BW20T302GHz to 3GHz Bandwidth upgrade option(Option only works with MSO8204 and MSO8204A)MSO8000A-BW7T15750MHz to 1.5GHz Bandwidth upgrade option(Option only works with MSO8074A)MSO8000A-BW7T20MSO8074A750 MHz to 2 GHz Bandwidth upgrade option(Option only works with MSO8074A)Code:C:\Users\traxp>python rigol_mso8000_kg.py 192.168.1.229╒════════╤══════════╤═════════════════════════════════════════════════════╕│ Code │ Status │ Description │╞════════╪══════════╪═════════════════════════════════════════════════════╡│ COMP │ Forever │ Computer Serial Triggering and Analysis(RS232/UART) │├────────┼──────────┼─────────────────────────────────────────────────────┤│ EMBD │ Forever │ Embedded Serial Triggering and Analysis(IIC, SPI) │├────────┼──────────┼─────────────────────────────────────────────────────┤│ AUTO │ Forever │ Automotive Serial Triggering and Analysis(CAN/LIN) │├────────┼──────────┼─────────────────────────────────────────────────────┤│ FLEX │ Forever │ FlexRay Serial Triggering and Analysis │├────────┼──────────┼─────────────────────────────────────────────────────┤│ AUDIO │ Forever │ Audio Serial Triggering and Analysis(I2S) │├────────┼──────────┼─────────────────────────────────────────────────────┤│ AERO │ Forever │ MIL-STD 1553 Serial Triggering and Analysis │├────────┼──────────┼─────────────────────────────────────────────────────┤│ DG │ Forever │ Dual Channel WaveGen 25 MHz AWG │├────────┼──────────┼─────────────────────────────────────────────────────┤│ JITTER │ Forever │ Jitter and Real Time Eye Diagram Analysis │├────────┼──────────┼─────────────────────────────────────────────────────┤│ PWR │ Forever │ Integrated Power Analysis │╘════════╧══════════╧═════════════════════════════════════════════════════╛Model: MSO8204Serial: DS8A23#######Version: 00.02.02MAC: 00-##-##-##-##-##/rigol/tools/fram is OK!Activating: 2RL [MSO8000-2RL@2E3C89027701330B209992BBD6A1E1FFF9113A453317C16F3E74D2683F979CCB44925B6295718FAE17978BD083821D86FBA4C8B176B54B2431B912D828B454F1]... unavailable.Activating: 4CH [MSO8000-4CH@0BDD43D56BBC5C2F208A830939E4AE4CD2674E609D02121EE02DEFDFF0097B1699184DA97B7B9E72468C2CC5CACEB9915841F1830F1CFC5805105A99C3BE9568]... not activated.Activating: 5RL [MSO8000-5RL@15847162E0968096DBAD50C4C11ECDC689308AEB193C07428467715DEF14BE8B8F6EF67CB1B368DFEC7E6F320B670590F61071AD857BB1AD99145A8E6DA323F8]... unavailable.Activating: ARINC [MSO8000-ARINC@9A7E2917918857D46661FA2BB0DC1B9EE37B9FB156AD8606D5E76AC11D3DDEC64ED35BC808F76F7A0304028F445F91CA6D7E59BFAAA43D14F38F56CB1A8C234A]... activated.Activating: BND [MSO8000-BND@6365D3C32E340A045F7ACC770F89A81AB11F2AF0418240A64C2F0D5A50CE710405632C04D1AF5D077792208AF9DE0B3715EF77CD38665815E96F0BB34ECD86C4]... activated.Activating: BW07T1 [MSO8000-BW07T1@8E96B183F45C59684FFA692744436D7A9EED22AF6F081051E1E1F834C15EE26192C3C751F3AC70692866E80EA8618FACECE6A57A5BAF047FE72F3EB48D2897C6]... unavailable.Activating: BW07T2 [MSO8000-BW07T2@7C4A8D124E97912F9252F41450F8C58455891459392EE85909D7E5EACF460EFC156D32CCA009AE5A206D3140FB1BB012A8889CA5BFD1ACED1A4474EDFDC2F119]... unavailable.Activating: BW07T3 [MSO8000-BW07T3@62B19E30CDEE2F0385A390C994F77A62D30DB7E4140E5D4B04C54D9EF7CBDDA73C69FB74F614FE38F44F1A23131AFD43C1660C4FFF03025D6C1CD1EE94E80D60]... unavailable.Activating: BW07T5 [MSO8000-BW07T5@73533F3F5B6D791B051DC814ECD22C5BB610F1714162021061D51DFC4ADAC1BF8C1B5C67F9ED554797148969FDEE3BC5A0B034D0B655836654135E059E9AD02B]... unavailable.Activating: BW10T20 [MSO8000-BW10T20@1DA329DDE88FBEE4E3C22AA3DF8FBF232D064E91BAFCABC9A951159D94E132E85B94E9CA7AD4B42C5A7BE7BF06C70D56A1C1BCA3AB1A271883F778B4188134CF]... unavailable.Activating: BW10T30 [MSO8000-BW10T30@888A08F67DB06D19E0646379A8CBF670664F68ED99688D4A6B268130940C57204A5C475EC8825631CA6A100F5EB35F8D919A5128133E9297C552C721A085EA0A]... unavailable.Activating: BW15T25 [MSO8000-BW15T25@13137BFA4F08103996CFBEA2CD3A829FA7165954DF3420EA98FE6DE5DD50D776939CC09119CBB69C0F86E29E8D4E549A95208B8B1D26017263B370D1BFD138B9]... unavailable.Activating: BW15T35 [MSO8000-BW15T35@749762C37A418E84A26EBDA4EC76141E2C46FF1F12F73A4337783251809D430E0FD5FF6A93460F16E33F92B6F74B6A6FA46880161ACCA974BF74B57C40990CFD]... unavailable.Activating: BW1T2 [MSO8000-BW1T2@8B0A796DF5BA8D275BA3EB99DB9663EE6E273362C0E19F4589EBC7F4733A9AD970E5014361282BB5223B43997652F24DE2C7D6D80FF16637297900CA2D7246FF]... unavailable.Activating: BW1T3 [MSO8000-BW1T3@A1714BA7D7D711644A1693F1D860843DAE39BFD4EB2A02027B1F6678A7DE50CDA7EE90DE2E098AD58932844FBB9C49BB0CB251362DA568BEA07D1AF95BCC3814]... unavailable.Activating: BW1T5 [MSO8000-BW1T5@238AEDA42E48F793DA66B4CC1364ED2558E7439F9201A3DEAE91D6C983B4D762A594F725A52D2B25C0D813FBC48AED13E293686472E6C3267756599919B52649]... unavailable.Activating: BW20T30 [MSO8000-BW20T30@9EDD330BDD848CA1F28A5483AF4EF043A0F1099E32BF47B0DA5A05F424D88BC54FC95E89404FBDB8C62716D3A8648D0FE6FC58C40121C0B988D2AD97082F4D52]... unavailable.Activating: BW25T35 [MSO8000-BW25T35@97CE038C3D67282AB8A6E62D439F9C24EB6E0740601BF27FC7309FBAA9E53416084C04CCD53AB372C99B6534E95A1A4873245B74C938CDC1975EA28534F6394D]... unavailable.Activating: BW2T3 [MSO8000-BW2T3@352048B962756020673704A0102BC86C8EACDACAB13757BCCD0BEF9569F1B35C5F13569DC32AC9BC124AB074D79C096CAFBD2E84B1A4217002B2749B5515EBF5]... unavailable.Activating: BW2T5 [MSO8000-BW2T5@4C6CC0D08BC5362C88D0A7763595E5A5A121C19BAEC67D7C6F07AA6A4D05C98E7EEFF495BA3584B6653FC362BBACCC1B85D1BB165324525934A04CA844BBE1BD]... unavailable.Activating: BW3T5 [MSO8000-BW3T5@1E9CF4F13815D21A8DDC33974A978CFDEBEA4829FA01AF8135B2517A40C30EE314DB195F556A4822BB899A500328ED96AE0DBE35A79197268159571213E15BD8]... unavailable.Activating: BW6T10 [MSO8000-BW6T10@4CCAB6D9598CBE5D5425A72157194FFF37991E3270F4067D73B76E5611DBEC94436E14ADD8A046A5E1FF5198079D4B849EBC0EB974017A513A75244034DC2E7A]... unavailable.Activating: BW6T20 [MSO8000-BW6T20@52B7853197325D29AD05BB92BC2165D2BE0347B98852E92C2A813AD835906DFA65552E61B6E30158C96AE32B8CF21C7B76C0FE4083B0558F431112E2DB20C90B]... unavailable.Activating: BW6T30 [MSO8000-BW6T30@6BE27C37CB114F852B83D0982FEF82B9AFD07D2E2B63AB99B912ADE9C647F6C87368B158148B96A1CEFB7A1AEECEE4A4FB35610EF21D351A829F3599A406CAFA]... unavailable.Activating: CTR [MSO8000-CTR@5F5124D84203C225D297A0C9C16B275DD4BD5054F6DBA814F1D62F76AC8576542781776FAA6CF0DF378F466E998F423DF07A59BD8BB80777561F08BACCB87A40]... activated.Activating: DVM [MSO8000-DVM@747DA83CC301F406E2BC8B2489000B8940FD53F71D859785F61C6DCA0D6B40D276EB4A436B7395D754FDF255DB1A84FC6494CF1B751AFEBF56A4393C92279CB5]... activated.Activating: MASK [MSO8000-MASK@9C8D3A0BB741659B7D861B3DE308202DA73BD53845DB17F94F27D5F2CD04281E77A6D640015A65D4DAD8B27A5E60402D92F300DDADEAEE599F250BF8A460A72B]... activated.Activating: MSO [MSO8000-MSO@7CAD05825E25E73EBF094FAC76D524F9389E2010558AC2DBBBF8FB5543E252A984874D62959361E2D193C63324C31F942EB43AB549D5E66A8685C6EBC86BC2DC]... activated.Activating: SENSOR [MSO8000-SENSOR@3558638CE289EAF00B3038A73357C90769244D161F17BB514D46C2AB30DC3EAE8C26CE468832E6C83C081E613F09A60F8EAF947D820915202FA79AE10EECD4D5]... activated.╒════════╤══════════╤═════════════════════════════════════════════════════╕│ Code │ Status │ Description │╞════════╪══════════╪═════════════════════════════════════════════════════╡│ COMP │ Forever │ Computer Serial Triggering and Analysis(RS232/UART) │├────────┼──────────┼─────────────────────────────────────────────────────┤│ EMBD │ Forever │ Embedded Serial Triggering and Analysis(IIC, SPI) │├────────┼──────────┼─────────────────────────────────────────────────────┤│ AUTO │ Forever │ Automotive Serial Triggering and Analysis(CAN/LIN) │├────────┼──────────┼─────────────────────────────────────────────────────┤│ FLEX │ Forever │ FlexRay Serial Triggering and Analysis │├────────┼──────────┼─────────────────────────────────────────────────────┤│ AUDIO │ Forever │ Audio Serial Triggering and Analysis(I2S) │├────────┼──────────┼─────────────────────────────────────────────────────┤│ AERO │ Forever │ MIL-STD 1553 Serial Triggering and Analysis │├────────┼──────────┼─────────────────────────────────────────────────────┤│ DG │ Forever │ Dual Channel WaveGen 25 MHz AWG │├────────┼──────────┼─────────────────────────────────────────────────────┤│ JITTER │ Forever │ Jitter and Real Time Eye Diagram Analysis │├────────┼──────────┼─────────────────────────────────────────────────────┤│ PWR │ Forever │ Integrated Power Analysis │╘════════╧══════════╧═════════════════════════════════════════════════════╛

author: asp
author_rank: Regular Contributor
timestamp: June 27, 2024, 08:05:58 pm
content: Here is an updated script that should work onboth 8000 and 8000A5000,6000,7000 and 8000 series oscilloscopesThe script can be run with -h in order to print all the available command line options.This tool might brick your device so use it on your own risk!UPDATE 1( rigol_mso_util_2.02a.py ) 11-July-2024:NO LONGER AVAILABLEI have updated the script and it should be able to activate both MSO5000, MSO6000, MSO7000 and MSO8000 (and itcouldwork with DS series) with all key sizes without any extra option.Works with 5/6/7/8XXX OSC.Added 2 more assertsFixed public key length on newer OSCYou can use -k 1 (default) or -k 2First run the tool with -r, reboot scope, rerun the tool with -aUPDATE 2( rigol_mso_util_2.03a.py ) 11-July-2024:NO LONGER AVAILABLEUpdated the script to apply just the differences when writing to fram (this should make the script x 27 times faster on key regeneration)Debugging now worksAdded more comments in the scriptUPDATE 3( rigol_mso_util_2.04a.py ) 11-July-2024:Reading just first 2k of data instead of 8k (this will make running -a or -f x 4 times faster (rest of the data was not used anyway))UPDATE 4( rigol_mso_util_2.05b.py ) 12-July-2024:No need to run the script with -a.. it will do this automatically and reboot the scope as wellSmall other changesUPDATE 6( rigol_mso_util_2.06b.py ) 14-July-2024:Fix diff updateScope can be rebooted with --reboot optionUPDATE 7( rigol_mso_util_2.07b.py ) 15-July-2024:in order to regenerate the key run it with -r -d (will be fixed in the next version)Public key can be at any location in fram (thanks to Kyr for pointing that out)Small cosmetic changesUPDATE 8( rigol_mso_util_2.08b.py ) 16-July-2024:FIX: -d no longer needed when running key regen. on 2.07b -d was needed with -r otherwise it would not find the public keyUPDATE 9( rigol_mso_util_2.09b.py ) 16-July-2024:FIX: help showed first 16k of FRAM when we are actually getting just first 2k (thanks BTO for pointing it out)UPDATE: Shows the Language, LoadLast and other info from framUPDATE 10( rigol_mso_util_2.10b.py ) 18-July-2024:ADD: added --with-config param (can be used with -r -d or --save-fram in order to get 8k of data from the FRAM). this combined with -d will print all the configuration options (found the names in a dump posted by tv84)ADD: added colors (you can use --no-color if you don't want that)EXTRA: Code CleanupUPDATE 11( rigol_mso_util_2.11b.py ) 06-August-2024:ADD: --save-sysvendor to save sysvendor.bin (debugging)ADD: --sysvendor-key (with 2 parameters (--sysvendor-key-fast and --sysvendor-key-slow)) in order to try to find the device sysvendor.bin keyCode:python3 rigol_mso_util_2.11b.py --sysvendor-key --sysvendor-key-fast 192.168.1.1python3 rigol_mso_util_2.11b.py --sysvendor-key --sysvendor-key-slow 192.168.1.1ADD: --use-activation-key in order to pass a different activation key. if default key does not work try to get your sysvendor.bin key and do a --regen --use-activation-key <with_your_device_sysvendor_key>ADD: --reset-web-pwd resets your web username/password to admin:rigolADD: more colored outputUPDATE 12( rigol_mso_util_2.12b.py ) 07-August-2024:ADD: sysvendor.bin parserMore cleanupADD: parser works in offline mode when the sysvendor key is passed as an argCode:rigol_mso_util_2.12b.py --offline --sysvendor-file sysvendor.bin --use-sysvendor-key AAAAAAAABBBBBBBBCCCCCCCCDDDDDDDD)UPDATE 13( rigol_mso_util_2.13b.py ) 18-August-2024:ADD: can enable ssh on bootCode:#Just in case you brick your scope add sshd at boot so you can log in via sshpython3 rigol_mso_util_2.13b.py --ssh --start-ssh-on-boot <rigol_ip_address>ADD: sysvendor.bin full decoder/encoderCode:# if this fails at any step don't go further as it will brick your device# before you start make sure you add sshd at boot, so you can still access the device via ssh if something goes wrong#1 -> save current sysvendorpython3 rigol_mso_util_2.13b.py --save-sysvendor <rigol_ip_address>#2 -> find the device xxtea key (2 versions)python3 rigol_mso_util_2.13b.py --sysvendor-key --sysvendor-key-slow <rigol_ip_address>orpython3 rigol_mso_util_2.13b.py --sysvendor-key --sysvendor-key-fast <rigol_ip_address>#3 -> change sysvendor model in sysvendor file (can also be used on --mac and --serial)python3 rigol_mso_util_2.13b.py --offline --sysvendor-file <file_saved_at_step_1> --use-sysvendor-key <key_from_step_2> --model <your_desired_model>#4 -> write modified sysvendor to devicepython3 rigol_mso_util_2.13b.py --write-sysvendor --write-sysvendor-file <file_from_step_3> <rigol_ip_address>#5 -> reactivate licensespython3 rigol_mso_util_2.13b.py --regen <rigol_ip_address>ADD: device xxtea key finderCode:#using version 1python3 rigol_mso_util_2.13b.py --sysvendor-key --sysvendor-key-slow <rigol_ip_address>#using version 2python3 rigol_mso_util_2.13b.py --sysvendor-key --sysvendor-key-fast <rigol_ip_address>ADD: write new sysvendor.bin to device (memory + file)Code:python3 rigol_mso_util_2.13b.py --write-sysvendor --write-sysvendor-file <file_from_step_3> <rigol_ip_address>**** FOR WINDOWS USERS: get this filehttps://getshared.com/VltdmZKu(8.7 MB), run rigol_mso_util_2.13b.exe (that way (I hope) you don't need to install python or any modules anymore) ****TODO:* see if there is any way to activate other options (e.g. JITTER)* get an actual Rigol MSO5000 or > to play with* see if the same method works on RSA (have already tried to get /rigol app from (RSA5000) fw but it uses some modified version of CRAMFS)

author: tv84
author_rank: Super Contributor
timestamp: July 12, 2024, 09:15:03 am
content: I have some doubts about what you all say "keys with different sizes"...I haven't touched this for some years but, from memory, the system was created based on ECC Brainpool curves which have different (but fixed) sizes. So, you shouldn't be confused with different sizes. If you are, then you have not fully understood what is at play. The key size of a specific ECC Brainpool curve key is always the same!Another TODO: you can also expand the keygen to address Rigol's RSA devices...

author: asp
author_rank: Regular Contributor
timestamp: July 12, 2024, 09:41:44 am
content: They have changed the appended 00 chars lately (from 2 * 00 to two hundred and something * 00) before doing the XXTEA encrypt on the key (used have 148 bytes and now there are scopes with 388 bytes). They key is the same since otherwise the old licenses would not work on newer firmwareIn Regards to RSA series I would need somebody with a RSA to send me a dump of the filesystem (most notably /rigol)

author: tv84
author_rank: Super Contributor
timestamp: July 12, 2024, 09:46:59 am
content: Quote from: asp on July 12, 2024, 09:41:44 amOh, OK. Probably they are preparing the room for changing the ECC Curve.But, then just accommodate a bigger BIGNUM in the code and all is good.

author: BTO
author_rank: Frequent Contributor
timestamp: July 12, 2024, 01:51:37 pm
content: QuoteDifferent LENGTHS Actuallyit would seem that the pattern was, since you and DrMefisto released rigol_kg2.py that there were basically 2 OptionsAt the bottom (Can't remember the line) there was the option of -2 00 or change it to -3 000Now.. I observed thatMSO5074 (70MHz) Models with no BND Options Activated without issue on -2 00MSO5100 (100MHz) Models Activated by using -3 000 but could not by using the above.this method also held true for MSO5074 WITH BND OptionsThe Key Length across all these models were identical (I have them recorded but can't remember the length off hand)Then around 6 to 8 weeks ago i noticed a trend, that being that even MSO5074 didn't activate with the script you provided.They got an Assertion Error which was triggered by the Assertion pertaining to "len"and it all went from thereupon examinatin of the key, the key was approx 3x the length of the one's that didn't get assertion errorso yes.. it's a Length thing, to my knowledge. Happy to be proven incorrect though.QuoteOK, I'll look into thatQuoteLOL, Ironically i was wondering the exact same thing and suspected that i could do exactly that.i also had a guy contact me about the RSA series, so that's next on my TODO List

author: BTO
author_rank: Frequent Contributor
timestamp: July 12, 2024, 01:57:46 pm
content: Quote from: asp on July 12, 2024, 09:41:44 amQuotei have also seen 276 bytes as well as 148 and 388QuoteI MAY BE ABLE TO HELP WITH THISI'll reach out to the person who approached me with the RSA Model and ask them to supply the dump, I don't imagine they'll put up resistance as they were extremely keento get it activatedI'll Keep you updated

author: BTO
author_rank: Frequent Contributor
timestamp: July 12, 2024, 01:59:02 pm
content: Quote from: tv84 on July 12, 2024, 09:46:59 amsomething to that effect.... Was my suspicion and it only started, Up to.. 2 Months ago

author: tv84
author_rank: Super Contributor
timestamp: July 12, 2024, 02:14:49 pm
content: Quote from: BTO on July 12, 2024, 01:59:02 pmThis should not be rocket science since the method was there from the beginning. So, if one implements the code correctly by reading the ECC Curve type inside the Key.data, one can make the keygen future proof.

author: BTO
author_rank: Frequent Contributor
timestamp: July 12, 2024, 03:00:39 pm
content: Quote from: tv84 on July 12, 2024, 02:14:49 pmUnderstood,However consider (for me personally) When we say "Beginning" i assume we mean DS1052E. I'm not aware of an earlier point where weunlocked Rigol ScopesNow.. at this time i understood what we were doing , to a degree, i remember madcrow and a few others working on the SSH of itthen later a Utility was put together, etc etcBut.. did i understand the cryptography to it's fullest ? NO, i did notso... For you it's fundamental , For me, i'm reading up on this now,and what also through me was , i took E.C.C. to mean Error Correction ERROR CORRECTING CODE.I now understand it's not that but instead ELIPTIC CURVE CRPYTOGRAPHY.This now puts a new spin on it for meI gotta say , I've read about 10 pages of it so far, and even though i understood it as Assym Crypto , the detail of it is pretty cool.I do now understand what you mean when you say they just change the curve, or they can change the position of the curve so long as the algorithmsatisfies to points on the curve to produce a specific result, but.... the result can remain the same and they can choose to usedifferent points on the curve but in choosing different points it alters the length of the Priv Key.Have i understood that correctly.Needless to say...... Pretty cool stuffanyway my brain is tired now, i'm off to be, I'm going to spend at least the next month researching thisif you have any good resources or doco's you can recommend , it would be appreciatedi'm then going to rego through the script and reread it to understand what ecdsa was doing and what exactly brainpool is doing and what protocolit is usingagain.. I understood it for what it was, i understood it was a protocol and an Assym Crypto, i didn't , however understand the protocol itselfor what it was actually doingso.. that's where i'm at

author: BTO
author_rank: Frequent Contributor
timestamp: July 12, 2024, 03:03:15 pm
content: Quote from: tv84 on July 12, 2024, 02:14:49 pmQuoteAlso, thanks for this, I WILL look into this as i read more about and look to make the changes.Quick Question, Do you think this script can help the people over on the Rigol DHO Series 12bit scope side of things.Could they benefit by looking at the script we have thus far, so they can get activated quicker ?I imagine not, but.. Am i wrong ?

author: tv84
author_rank: Super Contributor
timestamp: July 12, 2024, 03:34:27 pm
content: Quote from: BTO on July 12, 2024, 03:03:15 pmAs I've indicated from the start, the methodis/was meant to bethe same (most probably). But as their Android programmers appear to be very poor at ECC, what was implemented (at least on day one) was an aberration based on the MSO5000 scheme! They used asym keys to do sym crypto...For that fact I excluded myself from that scene and gave way to all the guys that were patching the stuff, and because the solution was very easy to implement.If Rigol has corrected the scheme or if they do that in the near future, it's almost certain that the scheme will be the same.

author: BTO
author_rank: Frequent Contributor
timestamp: July 13, 2024, 12:37:57 am
content: Quote from: tv84 on July 12, 2024, 03:34:27 pmOK, Interesting, Understood, Thank you

author: BTO
author_rank: Frequent Contributor
timestamp: July 16, 2024, 05:24:40 pm
content: Quote from: asp on June 27, 2024, 08:05:58 pm1. I've tested the latest script , 2.09b.py..... WORKS PERFECTLYQuote2. Happy to help out

author: BTO
author_rank: Frequent Contributor
timestamp: July 21, 2024, 01:29:30 pm
content: NOTE : I've tested rigol_mso_util_2.10b.pyWORKS WITHOUT A PROBLEM, I also like the new additions

author: MegaVolt
author_rank: Frequent Contributor
timestamp: July 31, 2024, 04:36:49 pm
content: Tell me, is it possible to unlock the MSO8154A model to 3 GHz? Or only MSO8204A?

author: BTO
author_rank: Frequent Contributor
timestamp: August 01, 2024, 02:02:40 am
content: Quote from: MegaVolt on July 31, 2024, 04:36:49 pmWhere did you get 3GHz from ?On the rigol site the highest model is MSO 8204A which is 2GHz so using this script you will unlock it to 2GHzWe are actually working on seeing if we can get more out of it and if you could provide a dump of your scope that'd be very helpfulI can give you clear instructions on how to do it and what we need , if you're ok with thatbut for now, Stock standard, You can go up to 2GHzBut where did you get the idea that it would be 3GHz ?

author: asp
author_rank: Regular Contributor
timestamp: August 06, 2024, 12:00:35 am
content: Actually MSO8204A has MSO8000A-BW20T30 so that might enable it. I know on the rigolna.com it lists that option available for MSO8204 as well but it does not work (or I could not get it to work). I do not have a MSO8204A available to test if it unlocks this option but if you want you can drop a message and we'll see

author: BTO
author_rank: Frequent Contributor
timestamp: August 06, 2024, 03:40:15 am
content: Quote from: asp on August 06, 2024, 12:00:35 amOK, i'll keep my eyes and ears open. although as you know we don't get many who have MSO8000 SeriesBut i guess if the need arises someone will poke their head up and say "can we do this"

author: gao415517
author_rank: Newbie
timestamp: August 06, 2024, 03:17:18 pm
content: 8204 can be cracked to 3G bandwidth I am using 2.10b machine to upgrade mso8000A firmware file name to be changed to mso8000 after going to upgrade after the crack

author: BTO
author_rank: Frequent Contributor
timestamp: August 06, 2024, 04:22:08 pm
content: Quote from: gao415517 on August 06, 2024, 03:17:18 pmThats great to hear.Now.. the problem you're going to have is how to get that red texta mark of the screen

author: tv84
author_rank: Super Contributor
timestamp: August 19, 2024, 02:06:15 pm
content: Quote from: asp on August 06, 2024, 12:00:35 am@asp,This is from 2019. Now it should be somewhat old but, for sure, serves as a reference:Code:1180 - BW1T2 RIGOL DS7000-BW1T2 BANDWIDTH UPGRADE LICENCE (100MHZ TO 200MHZ) RIGOL MSO5000-BW1T2 BANDWIDTH UPGRADE LICENSE1181 - BW1T3 RIGOL DS7000-BW1T3 BANDWIDTH UPGRADE LICENCE (100MHZ TO 350MHZ) RIGOL MSO5000-BW1T3 BANDWIDTH UPGRADE LICENSE1182 - BW1T5 RIGOL DS7000-BW1T5 BANDWIDTH UPGRADE LICENCE (100MHZ TO 500MHZ)1183 - BW2T3 RIGOL DS7000-BW2T3 BANDWIDTH UPGRADE LICENCE (200MHZ TO 350MHZ) RIGOL MSO5000-BW2T3 BANDWIDTH UPGRADE LICENSE1184 - BW2T5 RIGOL DS7000-BW2T5 BANDWIDTH UPGRADE LICENCE (200MHZ TO 500MHZ)1185 - BW3T5 RIGOL DS7000-BW3T5 BANDWIDTH UPGRADE LICENCE (300MHZ TO 500MHZ)1186 - MSO1187 - 2RL RIGOL MSO5000-2RL MEMORY DEPTH UPGRADE LICENCE (200MPTS MAX.)1188 - 5RL RIGOL DS7000-5RL MEMORY DEPTH UPGRADE LICENCE (500MPTS MAX.)1189 - BND <- (*)118A - COMP * RIGOL MSO5000-COMP PC SERIAL BUS TRIGGER & ANALYSIS (RS232/UART) LICENCE118B - EMBD * RIGOL MSO5000-EMBD I2C/SPI BUS TRIGGER & ANALYSIS LICENCE118C - AUTO * RIGOL MSO5000-AUTO CAN/LIN BUS TRIGGER & ANALYSIS LICENCE118D - FLEX * RIGOL MSO5000-FLEX FLEXRAY BUS TRIGGER & ANALYSIS LICENCE118E - AUDIO * RIGOL MSO5000-AUDIO I2S BUS TRIGGER & ANALYSIS LICENCE118F - SENSOR1190 - AERO * RIGOL MSO5000-AERO MIL-STD-1553 BUS TRIGGER & ANALYSIS LICENCE1191 - ARINC1192 - DG RIGOL MSO5000-AWG DUAL-CHANNEL UPGRADE LICENCE1193 - JITTER1194 - MASK1195 - PWR RIGOL MSO5000-PWR POWER ANALYSIS LICENCE1196 - DVM1197 - CTR1198 - EDK1199 - 4CH RIGOL MSO5000-4CH ANALOG CHANNEL UPGRADE LICENSE119A119B - Key.data MSO7000119C - BW07T1 (?) RIGOL MSO5000-BW0T1 BANDWIDTH UPGRADE LICENSE119D - BW07T2 (?) RIGOL MSO5000-BW0T2 BANDWIDTH UPGRADE LICENSE119E - BW07T3 (?) RIGOL MSO5000-BW0T3 BANDWIDTH UPGRADE LICENSE119F - BW07T5 (?)11A0 - Key.data MSO5000Fill the voids as needed.

author: SpacedCowboy
author_rank: Frequent Contributor
timestamp: September 05, 2024, 03:55:23 am
content: So I have an 8104, thought I'd try the latest instructions.Downloading and running on the Mac didn't seem to work though - I got:Code:% python3 rigol_mso_util_2.13b.py -hTraceback (most recent call last):File "./rigol_mso_util_2.13b.py", line 11, in <module>import requestsModuleNotFoundError: No module named 'requests'This is with thehomebrewversion of python3.For any other Mac users, this is how I got it to at least run the script...Trying to pip3 install requests failed withCode:error: externally-managed-environmentTrying to install 'requests' via homebrew told me that homebrew had disabled itTrying to 'brew edit' the config didn't seem to work. Apparently the proper technique is to use scary options to pip3...Code:% pip3 install --break-system-packages requests% pip3 install --break-system-packages tqdm% pip3 install --break-system-packages tabulate% pip3 install --break-system-packages xxtea% pip3 install --break-system-packages ecdsa... and then finally "python3 rigol_mso_util_2.13b.py -h" works... It's late so I'll try the actual script tomorrow...

author: strahd_von_zarovich
author_rank: Contributor
timestamp: September 05, 2024, 11:46:02 am
content: Hello everyone,I finally got back to the office after a long journey.Congrats to everyone who helped in this process and thank you.@BTO , Dear BTO, I am really sorry for not being able to answer.I have read all the posts, but I have little knowledge on this subject. So can you guide me on this matter? I already have all the options except bandwidth. So, I want to upgrade it from 600MHz to 2GHz only.Here is my device option list and firmware information if it matters.As far as I understand I should do the following, correct if me I was wrong1- Download and install Python. (I have an installed version - Python - 3.10.8 )2- Download rigol_mso_util_2.13b.py python file. (I downloaded it)3- Connect computer to the oscilloscope via ethernet cable. (I connected it and I can reach the web control interface)4- Run the codes at "UPDATE 13" which isQuoteI have to run all the codes right including the sections "ADD: device xxtea key finder" and "ADD: write new sysvendor.bin to device (memory + file)" .If there will be a firmware update , can we update it without an issue?Thanks in advance.

author: BTO
author_rank: Frequent Contributor
timestamp: September 05, 2024, 02:56:23 pm
content: Quote from: SpacedCowboy on September 05, 2024, 03:55:23 amCorrect, When it says ModuleNotFoundErrorwhatever module it states at the end, That's the module that needs to be installedYou've now installed them that means the script will work.just run it first with the -i command to ensure you have good communicationthen run the -r to generate the Priv.pem , Activation will happen Automatically after that so will restarts.Just don't forget to do backups before and after and to update to the latest firmwarethenSelf CalSelf Test

author: BTO
author_rank: Frequent Contributor
timestamp: September 05, 2024, 03:04:47 pm
content: Quote from: strahd_von_zarovich on September 05, 2024, 11:46:02 amQuote- Ohh i reckon i can forgive you THIS ONE TIMEQuoteSure, no problem, it's easyGo to this linkhttps://www.eevblog.com/forum/testgear/hacking-the-rigol-mso5000-dr-mefisto-licensing-method/that link will have information , but you then go to this cloud location (this has everything)https://mega.nz/folder/A8cEgQRI#5FSoMrCurJi71T7VkRPgYQdownload the PDFdownload the SCRIPTdownload the GEL FILE (Actually in your case) Since that link location has GEL Files for MSO5000,FIRST, GET THE LATEST FIRMWARE UPDATE GEL FILE FROM THE MANUFACTURERHere is the linkhttps://www.rigolna.com/products/digital-oscilloscopes/MSO8000/Update your scope to the latest, then Follow the PDFit's pretty straight forward, if you have any issues let me know.The process is now much much easier and quicker than it was when all this started. Don't even worry about it

author: BTO
author_rank: Frequent Contributor
timestamp: September 05, 2024, 03:07:27 pm
content: Quote from: strahd_von_zarovich on September 05, 2024, 11:46:02 amTO ANSWER YOUR LAST QUESTION (Sorry i forgot)Yes, After your scope is properly licensed, You will be able to upgrade legitimately without a problem and never have to worry about patching or licensing again.it'll just be a matter of .. Go to the site, Download the firmware, Upgrade as normal.IF NEEDEDThe script has provision for you to uninstall options should you need to take the scope back to rigol.Anyway... Yes, you can upgrade the firmware , moving forward, without a problemEDIT :it seems like your current firmware is 2.0.0.12THE CURRENT FIRMWARE IS ACTUALLY 2.2.0.0So i say.. Yes definitely upgrade the firmware before running the script (although, you can do it before or after, it doesn't matter)I have included the Current firmware in the attachment

author: strahd_von_zarovich
author_rank: Contributor
timestamp: September 05, 2024, 03:25:23 pm
content: I couldn't wait for the answerI managed to do it somehow following the steps.I think it is done successfully since I don't remember that I can set the time scale to 200ps.Thanks again.

author: BTO
author_rank: Frequent Contributor
timestamp: September 05, 2024, 03:29:49 pm
content: Quote from: strahd_von_zarovich on September 05, 2024, 03:25:23 pmthat's great, it looks like it worked, However that Web Control list seems somewhat limited, i would go to the scope and check it directlyAlso, You still need to upgrade the firmware, But.. yeah it looks like you've done it, Congratulationsalso, I told you it was easy

author: SpacedCowboy
author_rank: Frequent Contributor
timestamp: September 06, 2024, 02:35:14 am
content: Well, thank you very muchI now seem to have a much improved 'scope...Code:╒══════════╤═══════════════╤═══════════╤═══════════════════╤═════════════╕│ Model │ Serial │ Version │ MAC │ Lic Model │╞══════════╪═══════════════╪═══════════╪═══════════════════╪═════════════╡│ MSO8204A │ DS8Axxxxxxxxx │ 00.02.02 │ 00-1A-AE-52-44-D4 │ MSO8000 │╘══════════╧═══════════════╧═══════════╧═══════════════════╧═════════════╛╒═════════╤══════════╤═════════════════════════════════════════════════════╕│ Code │ Status │ Description │╞═════════╪══════════╪═════════════════════════════════════════════════════╡│ BW20T30 │ Forever │ 2GHz to 3GHz Bandwidth Upgrade Option │├─────────┼──────────┼─────────────────────────────────────────────────────┤│ COMP │ Forever │ Computer Serial Triggering and Analysis(RS232/UART) │├─────────┼──────────┼─────────────────────────────────────────────────────┤│ EMBD │ Forever │ Embedded Serial Triggering and Analysis(IIC, SPI) │├─────────┼──────────┼─────────────────────────────────────────────────────┤│ AUTO │ Forever │ Automotive Serial Triggering and Analysis(CAN/LIN) │├─────────┼──────────┼─────────────────────────────────────────────────────┤│ FLEX │ Forever │ FlexRay Serial Triggering and Analysis │├─────────┼──────────┼─────────────────────────────────────────────────────┤│ AUDIO │ Forever │ Audio Serial Triggering and Analysis(I2S) │├─────────┼──────────┼─────────────────────────────────────────────────────┤│ AERO │ Forever │ MIL-STD 1553 Serial Triggering and Analysis │├─────────┼──────────┼─────────────────────────────────────────────────────┤│ DG │ Forever │ Dual Channel WaveGen 25 MHz AWG │├─────────┼──────────┼─────────────────────────────────────────────────────┤│ JITTER │ Forever │ Jitter and Real Time Eye Diagram Analysis │├─────────┼──────────┼─────────────────────────────────────────────────────┤│ PWR │ Forever │ Integrated Power Analysis │╘═════════╧══════════╧═════════════════════════════════════════════════════╛... being able to turn the timebase down to 100ps is pretty unrealThanks again!

author: strahd_von_zarovich
author_rank: Contributor
timestamp: September 06, 2024, 09:36:15 am
content: Am I not the only one who can not use the bode plot feature right?How come the MSO5000 series has the Bode plotting feature while the MSO8000 series does not?

author: BTO
author_rank: Frequent Contributor
timestamp: September 06, 2024, 12:19:54 pm
content: Quote from: SpacedCowboy on September 06, 2024, 02:35:14 amQuote- Well, Thank you Kindly, Much obliged spaced CowboyQuoteI mean.. ARE WE ALLOWED TO SWEAR HEREWhat.. in the What what what?I mean, I have an MSO5000 and last i looked it was going down to 10nsI just checked again, i can go down to 500psMy God !!Thanks for drawing that to my attentionand Enjoy your New and Improved scope

author: BTO
author_rank: Frequent Contributor
timestamp: September 06, 2024, 12:22:36 pm
content: Quote from: strahd_von_zarovich on September 06, 2024, 09:36:15 amI have an MSO5000 and i have the following under MEAUSRE/ANALYZE- Counter- DVM- POWER ANALYZER- HISTOGRAM- ZONE TRIGGERBode and Eye Analysis1. Only show up if you have the PATCHED VERSION, but they don't actually work2. They are supposed to work in the MSO8000 and even 7000 i thinkBut 5000, ... No it's not an option in the 5000

author: rpro
author_rank: Regular Contributor
timestamp: September 06, 2024, 04:44:12 pm
content: Quote from: BTO on September 06, 2024, 12:22:36 pmBode works fine with the MSO5000 for me (since its release as a new standard feature, several firmware versions ago). Eye Analysis does not.

author: BTO
author_rank: Frequent Contributor
timestamp: September 07, 2024, 12:37:55 am
content: Quote from: rpro on September 06, 2024, 04:44:12 pmhmmm, Interesting that i don't have Bode Analysis then

author: skander36
author_rank: Frequent Contributor
timestamp: October 14, 2024, 09:39:20 am
content: Bode plot can be found only in the icons menu(left) not in the measure menu.

author: MrSheep
author_rank: Frequent Contributor
timestamp: March 19, 2025, 02:35:01 am
content: @BTO so with this upgrade can the MSO8064 be upgraded to 3GHz? It looks like @SpacedCowboy was able to go to 3GHz from a MSO8104

author: bendzo
author_rank: Newbie
timestamp: July 18, 2025, 07:42:14 pm
content: Gentlemen,Would be someone be able to advise on how to do a memory-dump backup (FRAM & NAND) on MSO8000 please?Should I just rename the "DS5000Update.GEL" files from the Mega repo (that contains files and instructions for MSO5000s) to "DS8000Update.GEL" and run them as per instructions??I own (second-hand) MSO8204 only for a few hours, so would like to avoid bricking it before I actually use it...Thanks!

author: BTO
author_rank: Frequent Contributor
timestamp: July 18, 2025, 10:59:57 pm
content: Quote from: bendzo on July 18, 2025, 07:42:14 pmFor the MSO8000 you can just use the .GEL files from the official rigol site and replace them with the MSO5000 .GEL files.I wouldn't rename the 5000's to 8000's though.However the script for the 5000 series does work on 7000 and 8000 as well

author: bendzo
author_rank: Newbie
timestamp: July 19, 2025, 08:27:03 am
content: Thanks for the quick response and the info BTOThe thing is that the .GEL memory-backup files from your Mega repo (steps 1a. and 1b.) are just a simple scripts, the file size is ~2k so obviously different from the full FW update .GEL files from Rigol??To be honest I'm very close to just running the script without a backup