SDG #04 Unlocking Rigol MSO1074Z Options

The Rigol MSO1074Z sits in an awkward spot for anyone familiar with the well documented DS1000Z and DS2000 option unlocks. Those scopes give up their serial and private key data through the usual front panel or web interface route, so a key generator alone is enough. The MSO1074Z does not cooperate that easily, and this walkthrough shows why: the scope has to come apart so its i.MX28 processor can be reached over JTAG, and the option data has to be pulled out of RAM as a raw memory dump before any license string can be produced.

The practical takeaway for owners is that this is a hardware level job, not a five minute keygen exercise. You need a JTAG adapter that OpenOCD supports, the correct interface and i.MX28 target configuration files, and enough patience to dump a large block of memory starting at 0x40000000. Once that binary exists, the rigup utility scans it for candidate option keys and writes them to a text file, and a second pass against the specific option code produces the license string that gets typed into the scope. Doing the rigup side under Linux is the path of least resistance, with basic build tools installed first.

Worth noting that the memory dump reflects the scope’s current state, so what you extract depends on the firmware and serial in front of you. Anyone considering an MSO1074Z purely because unlocked bandwidth and options are theoretically available should weigh the disassembly risk, the extra hardware cost, and the fact that this is a hobbyist process with no vendor support behind it.