Rigol DS1000Z series firmware downgrade is possible(early bootloader revs)

[TheSteve]

His bootloader is a higher rev then mine. I have 0.0.0.11 which is earlier then 0.0.1.1. I haven't yet tried the newest version of firmware as I've read nothing positive about it. I might just for fun though later tonight.

Ah, right -- I didn't pay attention to the decimal points. Never realized there was a 0.0.0.11 bootloader, in addition to 0.0.1.1... So the bootloader is indeed the most likely factor in deciding whether downgrades are supported or not. Nevertheless, think carefully whether you want to try the latest firmware; you don't want to be stuck with it 

Edited my post above, it was no problem to downgrade so it must be in the bootloader. It does make me wonder if there could be an even more extreme recovery mode but it likely doesn't exist. I was thinking something that wouldn't drive the LCD at all, maybe simply flash a single LED to indicate it was doing something. I have never pulled the plug while it was flashing and don't plan to but perhaps the Rigol logo is stored in the bootloader and it could recover from a bad flash using the recovery I found.
It also makes me wonder why they prevent downgrades. I can only think it was because they planned to stop people from being able to hack the DS1000Z series but then realized the "hackability" put the scope on the map and gave them more sales then they ever imagined.

Over the years I have seen several cases of this - where a "hole" could have been easily patched yet it wasn't - clearly a business decision.

As to how I found the option. Anyone who has messed(and hacked/reverse engineered) with and helped design a lot of electronic devices tends to get a feel for how stuff is designed. In the case of the Rigol it beeps to say it detected a USB device when it starts booting - the first good sign something it possible. Pressing certain buttons gets the scope to beep - another good sign. The fact that Rigol published using the help button as a way to flash the DG1022 AWG is another hint. Companies rarely stray from designs and tend to keep things similar. So that was a great starting point. I tried different timing and number of button presses until it did something, watching the LEDs etc carefully each time. I think it may also be possible to get it do things slightly differently if you press the button more times but didn't continue to explore. I know there were two times it also reset the scope to full default with the language going back to chinese and resetting my boot counter. Last night I flashed the scope probably 40 times during testing.

and yes the scope still works perfect and passes the full self calibration.

[ebastler]

It also makes me wonder why they prevent downgrades. I can only think it was because they planned to stop people from being able to hack the DS1000Z series but then realized the "hackability" put the scope on the map and gave them more sales then they ever imagined.

Well, there can be valid reasons for preventing downgrades. If e.g. a newer firmware version changes/extends the way calibration data and user preferences are stored, the new firmware can contain code to automatically migrate the stored settings to the new format. But when going back to an older firmware, that one obviously can't know about the changes that were made in later versions, and might crash when confronted with the settings etc. that were "messed up" by the new firmware.

In general, testing firmware upgrade paths is messy enough if you want to properly test all "forward" paths, incuding skipping one or multiple versions. Since we all know how scrupulous Rigol is when it comes to software testing, I'm sure they just wanted to ensure that they can provide proper quality assurance for all firmware paths they support. 

[Fungus]

I'm thinking this feature might be really there to recover failed updates/bricked 'scopes.

Not for doing downgrades.

[Shock]

So the important question is, if you go back to version 0.4.0.0.0 what boot loader will you get if you try the boot loader GEL file that comes with that update?

[TheSteve]

So the important question is, if you go back to version 0.4.0.0.0 what boot loader will you get if you try the boot loader GEL file that comes with that update?

Exactly what I wondered. I tried both files in the 4.0.0.0 upgrade, my bootloader version has never changed.

[pa3bca]

Thanks!

I was able to 'downgrade' my firmware (only the version, not the usability  ). Had the dreadful latest 4.3. SP2 which made my DS1074Z really slow - especially when zeroing trigger level and vertical position levels (when pushing the level knobs).
Now running the previous version, 04.03.01.05 and most is well.
Next time I will wait a bit more before upgrading the FW.

[alsetalokin4017]

A 1074z with boot version 0.0.0.13.  Has anyone with an actual 1054z, with the current boot version 0.0.1.3, or the earlier 0.0.1.2, been able to downgrade firmware?

[TheSteve]

A 1074z with boot version 0.0.0.13.  Has anyone with an actual 1054z, with the current boot version 0.0.1.3, or the earlier 0.0.1.2, been able to downgrade firmware?

Perhaps no DS1054Z models were shipped with the really early firmware. I don't know the order they were released in but I believe the DS1054Z came after the DS1074Z. We need someone with a very early DS1054Z to see what boot version it has.

[pa3bca]

I don't know the order they were released in but I believe the DS1054Z came after the DS1074Z.

Yes that is correct. I remember being slightly annoyed when the 1054z came out, a few months after I bought my 1074z.
After hacking they are both exactly the same, but the 1054z was some EUR 150 cheaper than the 1074z
Well at least I can downgrade my FW. Don't know if this is worth EUR 150 though.

[markone]

A 1074z with boot version 0.0.0.13.  Has anyone with an actual 1054z, with the current boot version 0.0.1.3, or the earlier 0.0.1.2, been able to downgrade firmware?

My 1074Z with 0.0.1.1 boot version  failed, the help button sequence (after the boot beep) results in a status where almost all UI leds blink and nothing happens.

[TheSteve]

I don't know the order they were released in but I believe the DS1054Z came after the DS1074Z.

Yes that is correct. I remember being slightly annoyed when the 1054z came out, a few months after I bought my 1074z.
After hacking they are both exactly the same, but the 1054z was some EUR 150 cheaper than the 1074z
Well at least I can downgrade my FW. Don't know if this is worth EUR 150 though.

Yeah, probably not worth EUR 150. I bought a DS1054Z but sold it when I had a chance to buy a DS1074Z-S. The source is a pain to use but was still worth it, only paid a USD $70.00 difference to "upgrade". Having the ancient bootloader is just a random bonus I guess.

[pa3bca]

My 1074Z with 0.0.1.1 boot version  failed, the help button sequence (after the boot beep) results in a status where almost all UI leds blink and nothing happens.

Fascinating how all these FW versions work and react differently. One wonders if there is a design philosophy behind this (and if so, what is it?)

[RoGeorge]

This post is just to easily follow the subject.

[TheSteve]

This post is just to easily follow the subject.

You really need to find a way to follow the subject that doesn't include posting in all of them.

[Lightages]

This post is just to easily follow the subject.

Can you stop doing this? There is the option to follow a thread by clicking on the "Notify" button on the thread controls. You are just polluting threads and making people look at something when there is no new post.

[RoGeorge]

My apologize,

I had a notification setup for about 6-7 threads, and it didn't worked for me, so I replied to all of them the message that upset people. I saw a similar message somewhere in eevblog, and nobody complained about that one, so I thought it is OK to post in order to follow the subjects.

Is there is any way, link or button to be notified without using an e-mail, please?
Something like the "Show replies to your posts", but for notifications, would be great. For me, the "Notify" option sends e-mails, but this is not what I need.

Once again, sorry about that.

[janekivi]

Sorry for disturbing. As I needed firmware update by bootloader because our SparrowApp
hacking in "GEL firmware format" thread, I was searching all threads and info about it.

Actually this wasn't a secret when this thread was started as this PDF date is older:
http://int.rigol.com/File/ProductSoftWare/20151124/Firmware%20update%20instruction.pdf

In my case my usual flash drive didn't work with bootloader and all leds are flashing.
But older and small 1GB drive did flash his internal led differently and then scope
was listening my HELP button correctly. So, bootloader didn't saw the other USB disk.