Rigol MSO1000Z Series Oscilloscope JTAG Hack

[SteveyG]

Here is a video hosted on YouTube to describe how to perform a memory dump on the Rigol MSO1000Z series oscilloscopes. This will allow you to use the key generators for unlocking all the options on the scope. Please note, you only need to do this on the MSO scopes. I think you can use the key generators directly on the DSO1000.

Hopefully this helps someone.  

http://www.youtube.com/watch?v=OvcGn_ScG5w

The links are in the video comment for the special tool for the MSO1000Z

[Xwing]

This procedure allows the hack of DSO Rigol 1000Z series 2000A series without using the JTAG.
Tested personally on my DS2102A, it should also work with the MSO series 1000Z.

(source of information EEVBLOG topic "Sniffing the Rigol's internal I2C bus")
**************
YET ANOTHER HACK SUMMARY

I had all options + 300 MHz on my DS2072A, then I upgraded to the latest firmware, and lost all the hacks. It took me some time to figure out how to get them back.

This is my summary (should work for a new out-of-the-box DS2072A as well):

1 - Download & unzip the latest "Rigol Bildschirmkopie LAN/USB" from http://peter.dreisiebner.at/rigol-bildschirmkopie-lan/

2 - Connect scope to LAN.

3 - Run the RigolBildschirmkopie.exe, click Device>Select>Search>Select.

4 - Do Device>SCPI-Command, then  Send & receive ":SYST:UTIL:READ? 1,33554432".
 
     Wait a long time (~5 to 10 min) for it to complete.
     
     Click Save, save it as "memoryDump.scpi" (save this file for future use!!)

5 - Download and unzip Rigup 0.4 (or later) from http://gotroot.ca/rigol/.

6 - Open a command window where you unzipped Rigup 0.4, copy memoryDump.scpi into the same folder.

7 - In the command window do: "rigup ds2072a memoryDump.scpi"

      This will produce an output something like:

rigup ds2072a - Version 0.4

Serial number: DSxxxxx

NSEH:  JPJQLFK-G3QNRLU-WFFFZMD-xxxxxxx    All options, no bandwidth upgrade
NSER:  8NXBL2U-JE2LZL7-9NEN5XK-xxxxxxx   All options, bandwidth 100 MHz
NSEQ:  R939MMG-NR63H25-9H993PX-xxxxxxx    All options, bandwidth 200 MHz
NS8H:  G2YRFYX-D589HNR-4K8YW3H-xxxxxxx    All options, bandwidth 300 MHz

8 - rigup scan MyKeys memoryDump.scpi

This will write your keys to the file "MyKeys".

9 - rigup license MyKeys NS8N

This produces an output something like:

5P89ZX7-LYMCTCS-P4PQ792-xxxxxxx   (NS8N = 0x1C0C3)

10 - Run RigolBildschirmkopie.exe again, click Device>Select>Search>Select (again).

11 - Click Device>SCPI-Command, then send & receive:
       :SYSTem:OPTion:INSTall <key to the right of NSEQ in step 7>

       The key (from step 7) MUST have the dashes removed.

       For example:
       :SYSTem:OPTion:INSTall R939MMGNR63H259H993PXxxxxxxx
       
At this point you should have all options + 200 MHz.

12 - Click Device>SCPI-Command, then send & receive:

       :SYSTem:OPTion:INSTall <key from step 9>

       Again, the key must have all dashes removed.

       For example:
       :SYSTem:OPTion:INSTall 5P89ZX7LYMCTCSP4PQ792xxxxxxx

That's it; you should have 300 MHz + all options now.

Maybe you can skip step 11 - I haven't tried it that way.

If you mess up, no problem. Just send ":SYSTem:OPTion:UNINSTall" and start over.

*****************

[SteveyG]

This procedure allows the hack of DSO Rigol 1000Z series 2000A series without using the JTAG.
Tested personally on my DS2102A, it should also work with the MSO series 1000Z.

Unfortunately it doesn't work with the MSO1000Z series, hence the linked video. You also have to use a hacked version of the riglol tool.

The above does work for the DS2000 series, and it's not required at all for the DSO1000Z series.

[Bamsalt]

Hi Xwing, is it necessary to update to the modified firmware before you hack the DS2072A ?

[SteveyG]

You can do the hack on the DS2072A on any firmware level. If you update your firmware, the keys will still be valid and the options will still be installed.