Rigol DS1000Z series firmware downgrade is possible(early bootloader revs)

[TheSteve]

Was playing around with key sequences during power up with my Rigol DS1074Z-S (converted to a DS1104Z of course) and discovered how to force a firmware downgrade. So far I have gone back and forth between a few versions, the oldest being to 4.00.00.00. No side effects of any kind were noted so far. I am sure this work for the entire DS1000Z line including the ever popular DS1054Z.

If you follow my instructions you do so at your own risk, if your scope bricks or steals your TV remote I am not responsible!

*edit* - this appears to work only with very old boot loader versions such as 0.0.0.11 and 0.0.0.13

To downgrade do the following:

-Copy the .GEL file with the firmware version you want to a USB stick that you know is compatible with the DS1000Z series.
-With the scope powered OFF plug the USB stick into the scope.
-Power the scope on.
-When the splash screen with "Rigol" appears you should hear a quick beep which indicates it sees a USB device.
-As soon as you hear the beep press the "Help" button 3 times quickly.
-In a few seconds you should see the channel 1 LED blinking - this indicates it is flashing the firmware.
-Once done flashing the scope will boot as normal and tell you it found a firmware update with the same version it just flashed, you can press cancel.
-You can then verify the new detailed version info by pressing "menu menu force menu" quickly, then pressing "utility","system", "system info".
-I'd reboot at this point before using the scope just for good measure.

Being able to downgrade the DS1000Z series of scopes doesn't seem critically important at this point but there does seem to be a laggy version people may want to downgrade from.
For me the bigger picture is pondering what other devices this method might possibly work for - my mind instantly goes to the DSA815 spectrum analyzer. There is a slim chance those with the newest bootloader version could use this method to downgrade firmware so that Riglol works again, install all of the licensed options and then upgrade as normal to current firmware while retaining the options. I don't have a DSA815 anymore to try it, if someone does attempt I expect they will have sweaty palms.

Attached are before and after system info screen shots from my scope.

[Lightages]

Good work, and thanks!

[Mechatrommer]

Was playing around with key sequences during power up

how is that you dont remove the usb stick while the led is blinking, and brick your scope during the "playing around"? i smell jason chonko of north america is giving you a hint. anyway good info i've put the steps in my readme.txt of my rigol driver folder

[TheSteve]

Was playing around with key sequences during power up

how is that you dont remove the usb stick while the led is blinking, and brick your scope during the "playing around"? i smell jason chonko of north america is giving you a hint. anyway good info i've put the steps in my readme.txt of my rigol driver folder

Well your nose is busted and to be honest I resent your statement, I received no hints from anyone. The only info I had to go on was how the DG1022 is updated, from there it was experiment with button combos to see what happens.
btw - anytime you're messing around with trying to flash a firmware update the last thing you'd want to experiment with is pulling out the flash drive. I've also bricked many a device in the past experimenting in similar fashion(thankfully recovered nearly all just fine).

[nrxnrx]

00.04.03.02.03 (4.03SP2) here.

It almost worked! It blinks the CH1 led for a few seconds, but then it gives up and starts flashing all the leds at ~2Hz .  The first time I waited a few minutes, but I also tried seconds and it's safe to just restart at this point.

I guess the latest version adds even more unwanted "features". Maybe. I've tried several versions but only one stick. It works fine with the scope for anything else, but I'll try others when they decide to come out of hiding.

[TheSteve]

00.04.03.02.03 (4.03SP2) here.

It almost worked! It blinks the CH1 led for a few seconds, but then it gives up and starts flashing all the leds at ~.5Hz .  The first time I waited a few minutes, but I also tried seconds and it's safe to just restart at this point.

I guess the latest version adds even more unwanted "features". Maybe. I've tried several versions but only one stick. It works fine with the scope for anything else, but I'll try others when they decide to come out of hiding.

What version did you try to downgrade to, perhaps it makes a difference. It may also matter what boot version you have, mine is quite old.

[nrxnrx]

What version did you try to downgrade to, perhaps it makes a difference. It may also matter what boot version you have, mine is quite old.

4.3.0.1, 4.2.4.7 and 4.0.0.0 .
Boot 0.0.1.2

[TheSteve]

What version did you try to downgrade to, perhaps it makes a difference. It may also matter what boot version you have, mine is quite old.

4.3.0.1, 4.2.4.7 and 4.0.0.0 .
Boot 0.0.1.2

That is a shame. I used this file specifically - http://gotroot.ca/rigol/DS1000Z-04_00_00_00.7z
There are technically two updates in there, one supposedly for the bootloader and one for the firmware. I have done downgrades to both without an issue.

As a test put your current firmware on the flash drive and see if it will flash, if it does then I am thinking your boot version prevents downgrades, if it doesn't then it probably doesn't like your flash drive.

[nrxnrx]

That is a shame. I used this file specifically - http://gotroot.ca/rigol/DS1000Z-04_00_00_00.7z

I tried the two .GEL files in there as well. Nope.

As a test put your current firmware on the flash drive and see if it will flash, if it does then I am thinking your boot version prevents downgrades, if it doesn't then it probably doesn't like your flash drive.

It worked (both your method and the regular one). They do prevent downgrades. Now.
 

Perhaps the SA doesn't have this "feature" yet, though.

[alsetalokin4017]

Well... this is interesting.

So it did work with a genuine 1074z unlocked to 1104z, with Boot Version 0.0.0.11 ... but it did NOT work with a 1054z with Boot Version 0.0.1.2?  Is that right?

So has anyone gotten it to work with an actual 1054z, with any boot version?

[markone]

That is a shame. I used this file specifically - http://gotroot.ca/rigol/DS1000Z-04_00_00_00.7z
There are technically two updates in there, one supposedly for the bootloader and one for the firmware. I have done downgrades to both without an issue.

Which older FW  version do you suggest for best balance between bugfix & UI responsivity ?

I'm spotting to many knob miss here & there whith later versions and i wish to downgrade too.

[ebastler]

Well... this is interesting.

So it did work with a genuine 1074z unlocked to 1104z, with Boot Version 0.0.0.11 ... but it did NOT work with a 1054z with Boot Version 0.0.1.2?  Is that right?

So has anyone gotten it to work with an actual 1054z, with any boot version?

Hang on -- the difference might be due to the scope model or due to the bootloader version, as you suggest. But I understand that TheSteve and nrxnrx have also been downgrading from different firmware versions: According to the screenshot in the initial post, 4.3.1.05 seems to be the highest version TheSteve tried (successfully), while nrxnrx has not been able to downgrade from 4.3.2.03.

Hence, the "no downgrade" policy might also be caused by the later firmware. I'd rather not try, because I still have an earlier, more responsive firmare version on y hacked DS1054Z, and do not want to be stuck with the most recent, sluggish one.

[markone]

Hence, the "no downgrade" policy might also be caused by the later firmware. I'd rather not try, because I still have an earlier, more responsive firmare version on y hacked DS1054Z, and do not want to be stuck with the most recent, sluggish one.

Could you please specify which version and maybe suggest where it's possible to download ?

[nrxnrx]

Could you please specify which version and maybe suggest where it's possible to download ?

https://hamsterpower.org/f/rigolfw/4_03SP1.zip . Not sure atm about the exact version, but it's the second to last public one.

I'm not aware of an official link.

Edit: The .GEL file contains 00.04.03.01.05, so I guess that's the full version number.

[markone]

Could you please specify which version and maybe suggest where it's possible to download ?

https://hamsterpower.org/f/rigolfw/4_03SP1.zip . Not sure atm about the exact version, but it's the second to last public one.

I'm not aware of an official link.

Edit: The .GEL file contains 00.04.03.01.05, so I guess that's the full version number.

Thanks a lot.

I just gave a try on mine DS1074Z  but the procedure does not work, operating the help button after the beep results in stucked scope with all keys blinking, i had to recycle the power after a while fearing to have bricked the thing 

Luckily the scope still works, previous firmware anyway.

My booloader is 0.0.1.1, SW 00.04.03.02.03

[nrxnrx]

So it did work with a genuine 1074z unlocked to 1104z, with Boot Version 0.0.0.11 ... but it did NOT work with a 1054z with Boot Version 0.0.1.2?  Is that right?

Yes. It worked with the 1074z, but it did not with the 1054z (mine).

[ebastler]

Could you please specify which version and maybe suggest where it's possible to download ?

https://hamsterpower.org/f/rigolfw/4_03SP1.zip . Not sure atm about the exact version, but it's the second to last public one.

I'm not aware of an official link.

Edit: The .GEL file contains 00.04.03.01.05, so I guess that's the full version number.

Thanks nrxnrx, you beat me to the reply. Yes, that's the version I am also using. Does not have the "extended" FFT and pulse counting features yet, but according to various posts on the forum here is more responsive than the most recent published version. (I did not notice, or found any posts about, differences in responsiveness between the earlier versions; only the most recent one is more sluggish apparently.)

[Stupid Beard]

It did not work on my DS1054Z either with boot version 0.0.1.2. I tried going from SP2 to SP1; I don't have any other versions easily to hand.

Thanks for trying to find a solution.

[Fungus]

Was playing around with key sequences during power up with my Rigol DS1074Z-S (converted to a DS1104Z of course) and discovered how to force a firmware downgrade.
...

-As soon as you hear the beep press the "Help" button 3 times quickly.

And you just happened to notice that ... how? 

[ebastler]

I just gave a try on mine DS1074Z  but the procedure does not work, operating the help button after the beep results in stucked scope with all keys blinking, i had to recycle the power after a while fearing to have bricked the thing 
...
My booloader is 0.0.1.1, SW 00.04.03.02.03

So the fact that it does not allow the downgrade seems to be correlated with the 00.04.03.02.03 firmware, right? TheSteve's initial post mentioned success with the same scope model and bootloader version, but downgrading from an earlier firmware.

That's rather annoying, since the most recent firmware is probably the one which most people would like to downgrade from. 

[Marcos]

@TheSteve
Board version was downgraded too from 4.1.1. to 0.1.1. ?
Or maybe your scope is suffering for "random" board version syndrome as my(ex) 1054Z suffered with Boot Version 0.0.1.2 

[TheSteve]

@TheSteve
Board version was downgraded too from 4.1.1. to 0.1.1. ?
Or maybe your scope is suffering for "random" board version syndrome as my(ex) 1054Z suffered with Boot Version 0.0.1.2 

I suspect the 4 at the beginning indicates the "Source" module is present and wasn't displayed in earlier firmware versions but I don't really know.

I am sticking with version 4.3.1.05 as that seems to be a good balance of bugs/performance.

At this point it looks like the bootloader is responsible for preventing downgrades when in this mode, mine has got to be one of the earliest revs out there. I can't do a downgrade from the GUI but can from the help button mode.

I also tried doing to the bootloader update that is included with version 04.00.00.00 and while it says it was successful and updates the regular firmware I've never seen a change in my bootloader version.

[ebastler]

At this point it looks like the bootloader is responsible for preventing downgrades when in this mode, mine has got to be one of the earliest revs out there. I can't do a downgrade from the GUI but can from the help button mode.

I don't think so. See reply #14 by markone: He also used bootloader 0.0.1.1, but did not succeed in downgrading (from firmware version 00.04.03.02.03.)

TheSteve -- have you tried upgrading to firmware 00.04.03.02.03, and were you able to go back to an earlier version afterwards? Otherwise I would assume that it's this latest firmware which prevents the downgrade. (I don't mean to be obstinate about this, but think that it's important to find out, since quite a few people have been disappointed by the latest firmware release and might like to downgrade.)

[TheSteve]

At this point it looks like the bootloader is responsible for preventing downgrades when in this mode, mine has got to be one of the earliest revs out there. I can't do a downgrade from the GUI but can from the help button mode.

I don't think so. See reply #14 by markone: He also used bootloader 0.0.1.1, but did not succeed in downgrading (from firmware version 00.04.03.02.03.)

TheSteve -- have you tried upgrading to firmware 00.04.03.02.03, and were you able to go back to an earlier version afterwards? Otherwise I would assume that it's this latest firmware which prevents the downgrade. (I don't mean to be obstinate about this, but think that it's important to find out, since quite a few people have been disappointed by the latest firmware release and might like to downgrade.)

His bootloader is a higher rev then mine. I have 0.0.0.11 which is earlier then 0.0.1.1. I haven't yet tried the newest version of firmware as I've read nothing positive about it. I might just for fun though later tonight.

edit:

OK, loaded the newest firmware, then downgraded to the previous version without any problem. So the newest firmware changes nothing. I am sure it is all related to the bootloader version and sadly it probably only works for version 0.0.0.11 which is the earliest I have seen in the DS1000Z series. My startup counter also got reset with one of the updates.

[ebastler]

His bootloader is a higher rev then mine. I have 0.0.0.11 which is earlier then 0.0.1.1. I haven't yet tried the newest version of firmware as I've read nothing positive about it. I might just for fun though later tonight.

Ah, right -- I didn't pay attention to the decimal points. Never realized there was a 0.0.0.11 bootloader, in addition to 0.0.1.1... So the bootloader is indeed the most likely factor in deciding whether downgrades are supported or not. Nevertheless, think carefully whether you want to try the latest firmware; you don't want to be stuck with it 

[TheSteve]

His bootloader is a higher rev then mine. I have 0.0.0.11 which is earlier then 0.0.1.1. I haven't yet tried the newest version of firmware as I've read nothing positive about it. I might just for fun though later tonight.

Ah, right -- I didn't pay attention to the decimal points. Never realized there was a 0.0.0.11 bootloader, in addition to 0.0.1.1... So the bootloader is indeed the most likely factor in deciding whether downgrades are supported or not. Nevertheless, think carefully whether you want to try the latest firmware; you don't want to be stuck with it 

Edited my post above, it was no problem to downgrade so it must be in the bootloader. It does make me wonder if there could be an even more extreme recovery mode but it likely doesn't exist. I was thinking something that wouldn't drive the LCD at all, maybe simply flash a single LED to indicate it was doing something. I have never pulled the plug while it was flashing and don't plan to but perhaps the Rigol logo is stored in the bootloader and it could recover from a bad flash using the recovery I found.
It also makes me wonder why they prevent downgrades. I can only think it was because they planned to stop people from being able to hack the DS1000Z series but then realized the "hackability" put the scope on the map and gave them more sales then they ever imagined.

Over the years I have seen several cases of this - where a "hole" could have been easily patched yet it wasn't - clearly a business decision.

As to how I found the option. Anyone who has messed(and hacked/reverse engineered) with and helped design a lot of electronic devices tends to get a feel for how stuff is designed. In the case of the Rigol it beeps to say it detected a USB device when it starts booting - the first good sign something it possible. Pressing certain buttons gets the scope to beep - another good sign. The fact that Rigol published using the help button as a way to flash the DG1022 AWG is another hint. Companies rarely stray from designs and tend to keep things similar. So that was a great starting point. I tried different timing and number of button presses until it did something, watching the LEDs etc carefully each time. I think it may also be possible to get it do things slightly differently if you press the button more times but didn't continue to explore. I know there were two times it also reset the scope to full default with the language going back to chinese and resetting my boot counter. Last night I flashed the scope probably 40 times during testing.

and yes the scope still works perfect and passes the full self calibration.

[ebastler]

It also makes me wonder why they prevent downgrades. I can only think it was because they planned to stop people from being able to hack the DS1000Z series but then realized the "hackability" put the scope on the map and gave them more sales then they ever imagined.

Well, there can be valid reasons for preventing downgrades. If e.g. a newer firmware version changes/extends the way calibration data and user preferences are stored, the new firmware can contain code to automatically migrate the stored settings to the new format. But when going back to an older firmware, that one obviously can't know about the changes that were made in later versions, and might crash when confronted with the settings etc. that were "messed up" by the new firmware.

In general, testing firmware upgrade paths is messy enough if you want to properly test all "forward" paths, incuding skipping one or multiple versions. Since we all know how scrupulous Rigol is when it comes to software testing, I'm sure they just wanted to ensure that they can provide proper quality assurance for all firmware paths they support. 

[Fungus]

I'm thinking this feature might be really there to recover failed updates/bricked 'scopes.

Not for doing downgrades.

[Shock]

So the important question is, if you go back to version 0.4.0.0.0 what boot loader will you get if you try the boot loader GEL file that comes with that update?

[TheSteve]

So the important question is, if you go back to version 0.4.0.0.0 what boot loader will you get if you try the boot loader GEL file that comes with that update?

Exactly what I wondered. I tried both files in the 4.0.0.0 upgrade, my bootloader version has never changed.

[pa3bca]

Thanks!

I was able to 'downgrade' my firmware (only the version, not the usability  ). Had the dreadful latest 4.3. SP2 which made my DS1074Z really slow - especially when zeroing trigger level and vertical position levels (when pushing the level knobs).
Now running the previous version, 04.03.01.05 and most is well.
Next time I will wait a bit more before upgrading the FW.

[alsetalokin4017]

A 1074z with boot version 0.0.0.13.  Has anyone with an actual 1054z, with the current boot version 0.0.1.3, or the earlier 0.0.1.2, been able to downgrade firmware?

[TheSteve]

A 1074z with boot version 0.0.0.13.  Has anyone with an actual 1054z, with the current boot version 0.0.1.3, or the earlier 0.0.1.2, been able to downgrade firmware?

Perhaps no DS1054Z models were shipped with the really early firmware. I don't know the order they were released in but I believe the DS1054Z came after the DS1074Z. We need someone with a very early DS1054Z to see what boot version it has.

[pa3bca]

I don't know the order they were released in but I believe the DS1054Z came after the DS1074Z.

Yes that is correct. I remember being slightly annoyed when the 1054z came out, a few months after I bought my 1074z.
After hacking they are both exactly the same, but the 1054z was some EUR 150 cheaper than the 1074z
Well at least I can downgrade my FW. Don't know if this is worth EUR 150 though.

[markone]

A 1074z with boot version 0.0.0.13.  Has anyone with an actual 1054z, with the current boot version 0.0.1.3, or the earlier 0.0.1.2, been able to downgrade firmware?

My 1074Z with 0.0.1.1 boot version  failed, the help button sequence (after the boot beep) results in a status where almost all UI leds blink and nothing happens.

[TheSteve]

I don't know the order they were released in but I believe the DS1054Z came after the DS1074Z.

Yes that is correct. I remember being slightly annoyed when the 1054z came out, a few months after I bought my 1074z.
After hacking they are both exactly the same, but the 1054z was some EUR 150 cheaper than the 1074z
Well at least I can downgrade my FW. Don't know if this is worth EUR 150 though.

Yeah, probably not worth EUR 150. I bought a DS1054Z but sold it when I had a chance to buy a DS1074Z-S. The source is a pain to use but was still worth it, only paid a USD $70.00 difference to "upgrade". Having the ancient bootloader is just a random bonus I guess.

[pa3bca]

My 1074Z with 0.0.1.1 boot version  failed, the help button sequence (after the boot beep) results in a status where almost all UI leds blink and nothing happens.

Fascinating how all these FW versions work and react differently. One wonders if there is a design philosophy behind this (and if so, what is it?)

[RoGeorge]

This post is just to easily follow the subject.

[TheSteve]

This post is just to easily follow the subject.

You really need to find a way to follow the subject that doesn't include posting in all of them.

[Lightages]

This post is just to easily follow the subject.

Can you stop doing this? There is the option to follow a thread by clicking on the "Notify" button on the thread controls. You are just polluting threads and making people look at something when there is no new post.

[RoGeorge]

My apologize,

I had a notification setup for about 6-7 threads, and it didn't worked for me, so I replied to all of them the message that upset people. I saw a similar message somewhere in eevblog, and nobody complained about that one, so I thought it is OK to post in order to follow the subjects.

Is there is any way, link or button to be notified without using an e-mail, please?
Something like the "Show replies to your posts", but for notifications, would be great. For me, the "Notify" option sends e-mails, but this is not what I need.

Once again, sorry about that.

[janekivi]

Sorry for disturbing. As I needed firmware update by bootloader because our SparrowApp
hacking in "GEL firmware format" thread, I was searching all threads and info about it.

Actually this wasn't a secret when this thread was started as this PDF date is older:
http://int.rigol.com/File/ProductSoftWare/20151124/Firmware%20update%20instruction.pdf

In my case my usual flash drive didn't work with bootloader and all leds are flashing.
But older and small 1GB drive did flash his internal led differently and then scope
was listening my HELP button correctly. So, bootloader didn't saw the other USB disk.