Author Topic: Rigol DSXXXX .GEL firmware file format  (Read 64040 times)

0 Members and 2 Guests are viewing this topic.

Offline frozenfrogz

  • Frequent Contributor
  • **
  • Posts: 936
  • Country: de
  • Having fun with Arduino and Raspberry Pi
Re: Rigol DSXXXX .GEL firmware file format
« Reply #125 on: January 09, 2018, 03:04:16 am »
I know it is usually bad practice to play necromancer and resurrect an old thread, but since this has so much useful information I hope you don’t mind :)

First of all: Thanks for the OS X and Windows firmware unpacking tools!
I could find some entry points with IDA, but this is so much more convenient and I am glad I found this thread!

Can you tell me how to correctly uncompress the SparrowAPP.out file? I have been poking at it with 7zip under W7 as mentioned in this thread plus binutils under OS X.
7zip will unpack most of the file, but quits with unexpected EOF.
When using binutils
Code: [Select]
greadelf -S SparrowAPP.out it tells me: Error: Not an ELF file - it has the wrong magic bytes at the start

My uncompressed SparrowApp.out (00.04.04.03.02) header:
Code: [Select]
HEX: 7F454C46 01010100
ASCII: ELF

lzma -d does not recognize the compressed file and since the uncompressed file looks pretty sane, I thought it might be possible to just manually fix the header with the hex editor.
Any pointers are welcome, since I do not know much about how ELF works and what binutils expects to see in the header.

Kind regards,
Frederik
He’s like a trained ape. Without the training.
 

Offline ankerwolf

  • Regular Contributor
  • *
  • Posts: 58
  • Country: at
Re: Rigol DSXXXX .GEL firmware file format
« Reply #126 on: January 09, 2018, 11:40:52 am »
Hello Frederik,
two days ago I used unpack8.zip and got following output:
Code: [Select]
D:\#\#__Rigol\Batronix_SW&Doku\Tools\GEL_Unpack8>python unpack.py ds.gel
instrument series:      DS1000Z
firmware version:       00.04.04.03.02
updateType:     0x00070000
found 10 files

{'filename': '/sys/SparrowAPP.out', 'type': 1, 'start': 640, 'length': 1085971, 'crc': 2922331421, 'unknown': (0, 0, 0)}{'filename': '/sys/SparrowFPGA.hex', 'type': 5, 'start': 1086611, 'length': 803698, 'crc': 1737700535, 'unknown': (0, 0, 0)}
{'filename': '/sys/SparrowDGFPGA.hex', 'type': 6, 'start': 1890309, 'length': 290564, 'crc': 3841850537, 'unknown': (0, 0, 0)}
{'filename': '/sys/logo.hex', 'type': 10, 'start': 2180873, 'length': 768024, 'crc': 2888623556, 'unknown': (0, 0, 0)}
{'filename': '/sys/guiResData.hex', 'type': 12, 'start': 2948897, 'length': 748076, 'crc': 4026022475, 'unknown': (0, 0, 0)}
{'filename': '/sys/guiPicData.hex', 'type': 17, 'start': 3696973, 'length': 124607, 'crc': 3101109682, 'unknown': (0, 0, 0)}
{'filename': '/sys/SparrowConfig.hex', 'type': 16, 'start': 3821580, 'length': 768024, 'crc': 3134270256, 'unknown': (0, 0, 0)}
{'filename': '/sys/SparrowWaveTable.hex', 'type': 11, 'start': 4589604, 'length': 8424, 'crc': 2957269910, 'unknown': (0, 0, 0)}
{'filename': '/sys/SparrowCalFile.hex', 'type': 15, 'start': 4598028, 'length': 144028, 'crc': 4225940020, 'unknown': (0, 0, 0)}
{'filename': '', 'type': 50, 'start': 4742056, 'length': 280, 'crc': 0, 'unknown': (0, 0, 0)}
writing /header  (640 bytes)
writing /sys/SparrowAPP.out.header       (24 bytes)
writing /sys/SparrowAPP.out      (1085947 bytes)
writing /sys/SparrowAPP.out.decompressed         (3934197 bytes)
writing /sys/SparrowFPGA.hex.header      (24 bytes)
writing /sys/SparrowFPGA.hex     (803674 bytes)
writing /sys/SparrowDGFPGA.hex.header    (24 bytes)
writing /sys/SparrowDGFPGA.hex   (290540 bytes)
writing /sys/logo.hex.header     (24 bytes)
writing /sys/logo.hex    (768000 bytes)
writing /sys/guiResData.hex.header       (24 bytes)
writing /sys/guiResData.hex      (748052 bytes)
writing /sys/guiPicData.hex.header       (24 bytes)
writing /sys/guiPicData.hex      (124583 bytes)
writing /sys/guiPicData.hex.decompressed         (4031460 bytes)
writing /sys/SparrowConfig.hex.header    (24 bytes)
writing /sys/SparrowConfig.hex   (768000 bytes)
writing /sys/SparrowWaveTable.hex.header         (24 bytes)
writing /sys/SparrowWaveTable.hex        (8400 bytes)
writing /sys/SparrowCalFile.hex.header   (24 bytes)
writing /sys/SparrowCalFile.hex  (144004 bytes)
Corrupt input data
CRC mismatch: '' (0x00000000 vs 0x6ad11bae)
writing /footer  (280 bytes)

original filesize:      4742336
bytes processed:        4742336

There is SparrowAPP.out.decompressed ! It is a ELF-file.
But there are so many errors in the html- and css-files - I extracted - from this file.

From the Python script unpack.py file SparrowAPP.out.decompressed contains the Web-interface for the DS1000Z series. The html pages can be found, containing very many errors: there are incorrect characters -  unmotivated but in places with system. Also, one web page is 4 times slightly different included.  It is unclear where this error come from. From the GEL file probably not, because it is used to update. It may be but that the developers intentionally have infilled such errors to hide their work. After all of the html files including the .css were prepared so that they corresponded to the orignal of the Scope. Not found, where is the Access query for the Web Settings page. None of this is to find in the html files. (Microsoft Translator)

LG Wolfgang

« Last Edit: January 09, 2018, 11:51:44 am by ankerwolf »
 

Offline frozenfrogz

  • Frequent Contributor
  • **
  • Posts: 936
  • Country: de
  • Having fun with Arduino and Raspberry Pi
Re: Rigol DSXXXX .GEL firmware file format
« Reply #127 on: January 09, 2018, 12:18:54 pm »
Thanks for your quick answer Wolfgang,

curiously I am getting different results and no decompressed files.

Code: [Select]
python unpack.py DS1000ZUpdate.GEL
instrument series: DS1000Z
firmware version: 00.04.04.03.02
updateType: 0x00070000
found 10 files

{'start': 640, 'unknown': (0, 0, 0), 'filename': '/sys/SparrowAPP.out', 'crc': 2922331421, 'length': 1085971, 'type': 1}
{'start': 1086611, 'unknown': (0, 0, 0), 'filename': '/sys/SparrowFPGA.hex', 'crc': 1737700535, 'length': 803698, 'type': 5}
{'start': 1890309, 'unknown': (0, 0, 0), 'filename': '/sys/SparrowDGFPGA.hex', 'crc': 3841850537, 'length': 290564, 'type': 6}
{'start': 2180873, 'unknown': (0, 0, 0), 'filename': '/sys/logo.hex', 'crc': 2888623556, 'length': 768024, 'type': 10}
{'start': 2948897, 'unknown': (0, 0, 0), 'filename': '/sys/guiResData.hex', 'crc': 4026022475, 'length': 748076, 'type': 12}
{'start': 3696973, 'unknown': (0, 0, 0), 'filename': '/sys/guiPicData.hex', 'crc': 3101109682, 'length': 124607, 'type': 17}
{'start': 3821580, 'unknown': (0, 0, 0), 'filename': '/sys/SparrowConfig.hex', 'crc': 3134270256, 'length': 768024, 'type': 16}
{'start': 4589604, 'unknown': (0, 0, 0), 'filename': '/sys/SparrowWaveTable.hex', 'crc': 2957269910, 'length': 8424, 'type': 11}
{'start': 4598028, 'unknown': (0, 0, 0), 'filename': '/sys/SparrowCalFile.hex', 'crc': 4225940020, 'length': 144028, 'type': 15}
{'start': 4742056, 'unknown': (0, 0, 0), 'filename': '', 'crc': 0, 'length': 280, 'type': 50}
writing /header (640 bytes)
writing /sys/SparrowAPP.out.header (24 bytes)
writing /sys/SparrowAPP.out (1085947 bytes)
writing /sys/SparrowFPGA.hex.header (24 bytes)
writing /sys/SparrowFPGA.hex (803674 bytes)
writing /sys/SparrowDGFPGA.hex.header (24 bytes)
writing /sys/SparrowDGFPGA.hex (290540 bytes)
writing /sys/logo.hex.header (24 bytes)
writing /sys/logo.hex (768000 bytes)
writing /sys/guiResData.hex.header (24 bytes)
writing /sys/guiResData.hex (748052 bytes)
writing /sys/guiPicData.hex.header (24 bytes)
writing /sys/guiPicData.hex (124583 bytes)
writing /sys/SparrowConfig.hex.header (24 bytes)
writing /sys/SparrowConfig.hex (768000 bytes)
writing /sys/SparrowWaveTable.hex.header (24 bytes)
writing /sys/SparrowWaveTable.hex (8400 bytes)
writing /sys/SparrowCalFile.hex.header (24 bytes)
writing /sys/SparrowCalFile.hex (144004 bytes)
CRC mismatch: '' (0x00000000 vs 0x6ad11bae)
writing /footer (280 bytes)

original filesize: 4742336
bytes processed: 4742336

It throws a CRC mismatch every time that I did not notice before. I downloaded the firmware zip archives from both rigol sources again, but the CRC mismatch won’t resolve.

The .GEL files from the two different archives have the same checksum: MD5 (DS1000ZUpdate.GEL) = 367ae75bed8864bf168f3afd63de835c

Edit: This is with the script from unpack8.zip
He’s like a trained ape. Without the training.
 
The following users thanked this post: RoGeorge

Offline ankerwolf

  • Regular Contributor
  • *
  • Posts: 58
  • Country: at
Re: Rigol DSXXXX .GEL firmware file format
« Reply #128 on: January 09, 2018, 12:32:55 pm »
Hallo,
merkwürdig ist das schon ...

Here are the unpack.py I used and the corrected html and css files.
I used Python 3.6.1 !!!

Same SparrowAPP.out.decompressed by use of 7-Zip from the compressed SparrowAPP.out !

LG Wolfgang
« Last Edit: January 09, 2018, 12:39:33 pm by ankerwolf »
 
The following users thanked this post: RoGeorge

Offline frozenfrogz

  • Frequent Contributor
  • **
  • Posts: 936
  • Country: de
  • Having fun with Arduino and Raspberry Pi
Re: Rigol DSXXXX .GEL firmware file format
« Reply #129 on: January 09, 2018, 12:54:27 pm »
Well, well. I used Python 2.7.10 before.
Now using python 3.5.2 the unpack script gets me two additional decompressed files.

Thanks for pointing to that :-+
He’s like a trained ape. Without the training.
 

Offline janekiviTopic starter

  • Frequent Contributor
  • **
  • Posts: 368
  • Country: ee
Re: Rigol DSXXXX .GEL firmware file format
« Reply #130 on: January 09, 2018, 04:41:47 pm »
Good timing.
Since last week I tried to get some life to this project and got others interested too.
Right now we looking at SparrowBootloader.sb and think about procedures used
for making this and how scope decrypt the header and keys and footers there.
https://www.rockbox.org/wiki/SbFileFormat.
May not be related to our problem with footer, but interesting anyway.
 
The following users thanked this post: frozenfrogz

Online tv84

  • Super Contributor
  • ***
  • Posts: 3217
  • Country: pt
Re: Rigol DSXXXX .GEL firmware file format
« Reply #131 on: January 11, 2018, 10:59:19 pm »
Complementing janekivi and resuming all that has been done in this thread regarding the SparrowBootloader.sb, I include a verbosed parsing which may be clearer for all:

(I kept the offsets of the original .GEL file)

Code: [Select]
         ***  Header  ***
0020A36A          Header SHA-1: 2D5C14B81081FE5FEEE209EE7555FE80BB355044  [0020A37E-0020A3C9]  HASH OK
0020A37E           Signature 1: STMP  MAGIC OK
0020A382        Format Version: 1.1
0020A384                 Flags: 0x0000
0020A386        # Image Blocks: 19764 (16-byte blocks)
0020A38A   1st Boot Tag Offset: 0x0020A3FA
0020A38E   1st Boot section ID: 00000000 (always 0?)
0020A392     # Encryption Keys: 1
0020A394  Key Dictionary Start: 0x0020A3DA
0020A396           Header Size: 96 bytes
0020A398     # Section Headers: 1
0020A39A   Section Header Size: 16 bytes
0020A39C        Random Padding: 0x1C1A
0020A39E           Signature 2: sgtl  (Sigmatel??)
0020A3A2         Creation Time: 20-02-2014 12:54:39
0020A3AA       Product Version: 999.999.999
0020A3B6     Component Version: 999.999.999
0020A3C2             Drive Tag: 0x0000
0020A3C4        Random Padding: 0x288304AC14A7
         ***  Sections Table  ***
0020A3CA  Nam:        | Ofs: 0020A40A | Len: 0004D280 | Flg: 00000001 - ROM_SECTION_BOOTABLE
         ***  Key Dictionary  ***
0020A3DA  OTP Key0 Hash: 17D92922DDECBF7016BB6418BD05117B  CBC-MAC_AES OK
         ***  Session Key (decrypted)  ***
0020A3EA  Key: 9FE8304CBFD7B77CC666CD98DEBD6907  (using OTP Key0)
         ***  Sections (decrypted)  ***
0020A3FA  TAG  | 0001 | Section #0    | Len: 0004D280 | Flg: 00000001 - ROM_SECTION_BOOTABLE
0020A40A  LOAD | 0000 | Adr: 00000000 | Len: 0000003C | CRC: ADAACBC2  CRC OK
0020A45A  LOAD | 0000 | Adr: 00000400 | Len: 00003624 | CRC: F12B0754  CRC OK
0020DA9A  FILL | 0000 | Adr: 00018000 | Len: 00000960 | Ptn: 00000000
0020DAAA  LOAD | 0000 | Adr: 00008000 | Len: 00000020 | CRC: 1647D5F7  CRC OK
0020DADA  CALL | 0001 | Adr: 00008000 | Len: 00000000 | Arg: 00000000
0020DAEA  LOAD | 0000 | Adr: 00000000 | Len: 00000040 | CRC: 7C950527  CRC OK
0020DB3A  LOAD | 0000 | Adr: 41000000 | Len: 00049ACC | CRC: F8242826  CRC OK
0025761A  FILL | 0000 | Adr: 41300000 | Len: 00001900 | Ptn: 00000000
0025762A  FILL | 0000 | Adr: 41301900 | Len: 000031E4 | Ptn: 00000000
0025763A  FILL | 0000 | Adr: 41900000 | Len: 00300000 | Ptn: 00000000
0025764A  LOAD | 0000 | Adr: 00008000 | Len: 00000020 | CRC: 7EE0BD03  CRC OK
0025767A  JUMP | 0001 | Adr: 00008000 | Len: 00000000 | Arg: 00000000
         ***  File SHA-1 Hash (decrypted)  ***
0025768A  File SHA-1: FE615733935D9724A622BE3BAE285552F01297F1  [0020A36A-00257689]  HASH OK

« Last Edit: January 28, 2018, 03:24:58 pm by tv84 »
 

Online tv84

  • Super Contributor
  • ***
  • Posts: 3217
  • Country: pt
Re: Rigol DSXXXX .GEL firmware file format
« Reply #132 on: January 26, 2018, 05:37:40 pm »
Janekivi,

Here is a decoding of the last 128 bytes of the "footer" for the new bootloader. It's not a bullet-proof theory but...

Following the parsing of the files, there is the 280 (0x118) bytes of the footer 20+256+4. What is decoded (on the bottom of each file) is the 256-bytes zone.

Code: [Select]
F:\zscan\original\RIGOL\DS1000\DS1000Z-00_04_00_00_00\Sparrow(ARM)update_00.04.00.00.00\DS1000ZUpdate.GEL  /  CRC32: 35890A7B
00000000 - File Type: DS1000Z
00000010 - Version: 00.04.00.00.00
00000020 - Bitmask: 00000700
00000024 - # Sections: 7
Offset    Section Name                SectiSz   StartAdr  CRC32     Type
00000028  /sys/SparrowAPP.out         000FEEEC  000001CC  2B9CC8DC  00000001  [000001CC-000FF0B7]  CRC OK
00000064  /sys/SparrowFPGA.hex        000C4372  000FF0B8  E11B7BE0  00000005  [000FF0B8-001C3429]  CRC OK
000000A0  /sys/SparrowDGFPGA.hex      00046F04  001C342A  718FD66C  00000006  [001C342A-0020A32D]  CRC OK
000000DC  /sys/logo.hex               000BB818  0020A32E  ABE15C88  0000000A  [0020A32E-002C5B45]  CRC OK
00000118  /sys/guiResData.hex         0001A705  002C5B46  7656E54D  0000000C  [002C5B46-002E024A]  CRC OK
00000154  /sys/guiPicData.hex         0001CAB6  002E024B  D8202F6D  00000011  [002E024B-002FCD00]  CRC OK
00000190                              00000118  002FCD01  00000000  00000032  [002FCD01-002FCE18]
Offset    CRC32     Flags     Filesize  Endianes  Version     Rsvd
000001CC  EEAB61BE  00000003  000FEED4  AA5555AA  4000000     00000000  [000001E4-000FF0B7]  CRC OK
000FF0B8  841B75C9  00000000  000C435A  AA5555AA  4000000     00000000  [000FF0D0-001C3429]  CRC OK
001C342A  138E13B9  00000000  00046EEC  AA5555AA  4000000     00000000  [001C3442-0020A32D]  CRC OK
0020A32E  9B4EA177  00000000  000BB800  AA5555AA  4000000     00000000  [0020A346-002C5B45]  CRC OK
002C5B46  484AD786  00000001  0001A6ED  AA5555AA  4000000     00000000  [002C5B5E-002E024A]  CRC OK
002E024B  B81261EA  00000001  0001CA9E  AA5555AA  4000000     00000000  [002E0263-002FCD00]  CRC OK
  File Processed OK

 For studying the footer section:
80 00 00 00 01 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00
002FCD15
47 96 9C 97 E1 7D BF 48 80 6B 19 8C 07 75 B0 BE
F7 58 02 91 F6 25 96 E6 9A 6A C2 21 3E 30 63 36
EC 1E 85 82 46 E5 04 BE DF 68 E4 FC CC B4 D5 32
85 E6 4A 20 E1 6A 72 83 03 D0 76 43 27 2B 4A 94
3F AD E0 EE FD BC 7F 0B A9 E1 55 E8 90 EA 8D E5
2C 02 D9 3B A9 48 FB B9 56 D3 F6 89 F1 1C 5A 5C
62 DC C8 DB 20 25 9C AA CE F6 F2 55 A4 0D 78 E9
D7 38 C4 E5 C3 7B 03 2E 8A 78 88 75 D2 DE FA D7
79 8A 99 49 FE B2 67 1C D1 85 3A EF A3 58 0D C2
76 2B E0 94 49 FE B2 67 1C D1 85 3A EF A3 58 0D
C2 76 2B E0 94 49 FE B2 67 1C D1 85 3A EF A3 58
0D C2 76 2B E0 94 49 FE B2 67 1C D1 85 3A EF A3
48 4C 94 DF 2A 76 C1 0C 58 A3 EE 39 85 D0 1B 67
B2 FD 48 94 DF 2A 76 C1 0C 58 A3 EE 39 85 D0 1B
67 B2 FD 48 94 DF 2A 76 C1 0C 58 A3 EE 39 85 D0
1B 67 B2 FD 48 94 DF 2A 76 C1 0C 58 A3 EE 39 85
01 00 01 00
b = B4
2B C5 17 5D F2 DA 67 3B BE F5 EE AC 73 2C B2 0C
90 3C 31 0C BC 36 F3 8E 8D A8 4C F6 5E 9C 1A 38
3A B7 69 B1 C1 AB 15 1B 87 5B 22 86 A1 D4 41 E9
87 34 E3 04 10 E5 38 94 60 78 69 81 B1 00 6A 00
EF 12 FA BD 80 F4 6C AC FF EC 15 5C B9 C8 1F 2C
28 B2 3E 55 78 CB 33 A6 F7 29 01 49 65 45 38 EE
A9 D8 78 40 3A F4 1F E2 BB 97 48 60 64 81 A1 C7
69 7F C0 95 28 95 D2 B1 C2 65 29 CB DD 9E 6E 00
4E AA 05 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4B 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


F:\zscan\original\RIGOL\DS1000\DS1000Z-00_04_00_00_00\Sparrow(Boot)update_00.04.00.00.00\DS1000ZUpdate.GEL  /  CRC32: ED3A19F6
00000000 - File Type: DS1000Z
00000010 - Version: 00.04.00.00.00
00000020 - Bitmask: 00000F00
00000024 - # Sections: 8
Offset    Section Name                SectiSz   StartAdr  CRC32     Type
00000028  /sys/SparrowAPP.out         000FEEEC  00000208  2B9CC8DC  00000001  [00000208-000FF0F3]  CRC OK
00000064  /sys/SparrowFPGA.hex        000C4372  000FF0F4  E11B7BE0  00000005  [000FF0F4-001C3465]  CRC OK
000000A0  /sys/SparrowDGFPGA.hex      00046F04  001C3466  718FD66C  00000006  [001C3466-0020A369]  CRC OK
000000DC  /sys/SparrowBootloader.sb   0004D340  0020A36A  36829BEE  00000008  [0020A36A-002576A9]  CRC OK
00000118  /sys/logo.hex               000BB818  002576AA  ABE15C88  0000000A  [002576AA-00312EC1]  CRC OK
00000154  /sys/guiResData.hex         0001A705  00312EC2  7656E54D  0000000C  [00312EC2-0032D5C6]  CRC OK
00000190  /sys/guiPicData.hex         0001CAB6  0032D5C7  D8202F6D  00000011  [0032D5C7-0034A07C]  CRC OK
000001CC                              00000118  0034A07D  00000000  00000032  [0034A07D-0034A194]
Offset    CRC32     Flags     Filesize  Endianes  Version     Rsvd
00000208  EEAB61BE  00000003  000FEED4  AA5555AA  4000000     00000000  [00000220-000FF0F3]  CRC OK
000FF0F4  841B75C9  00000000  000C435A  AA5555AA  4000000     00000000  [000FF10C-001C3465]  CRC OK
001C3466  138E13B9  00000000  00046EEC  AA5555AA  4000000     00000000  [001C347E-0020A369]  CRC OK
0020A36A  --------  --------  --------  --------  ----------  --------  [0020A36A-002576A9]
         ***  Bootloader Header  ***
0020A36A          Header SHA-1: 2D5C14B81081FE5FEEE209EE7555FE80BB355044  [0020A37E-0020A3C9]  HASH OK
0020A37E           Signature 1: STMP  MAGIC OK
0020A382        Format Version: 1.1
0020A384                 Flags: 0x0000
0020A386            Image Size: 0004D340
0020A38A   1st Boot Tag Offset: 0020A3FA
0020A38E   1st Boot Section ID:
0020A392     # Encryption Keys: 1
0020A394  Key Dictionary Start: 0020A3DA
0020A396           Header Size: 00000060
0020A398     # Section Headers: 1
0020A39A   Section Header Size: 16 bytes
0020A39C        Random Padding: 0x1C1A
0020A39E           Signature 2: sgtl  (Sigmatel?)
0020A3A2         Creation Time: 20-02-2014 12:54:39
0020A3AA       Product Version: 999.999.999
0020A3B6     Component Version: 999.999.999
0020A3C2             Drive Tag: 0x0000
0020A3C4        Random Padding: 0x288304AC14A7
         ***  Sections Table  ***
0020A3CA   ID:      | Ofs: 0020A40A | Len: 0004D280 | Flg: 00000001 - ROM_SECTION_BOOTABLE
         ***  Key Dictionary  ***
0020A3DA  OTP Key0 Hash: 17D92922DDECBF7016BB6418BD05117B  CBC-MAC_AES OK
         ***  Session Key (decrypted)  ***
0020A3EA  Key: 9FE8304CBFD7B77CC666CD98DEBD6907  (using OTP Key0)
         ***  Sections (decrypted)  ***
0020A3FA  TAG  | 0001 | Sect ID:      | Len: 0004D280 | Flg: 00000001 - ROM_SECTION_BOOTABLE
0020A40A  LOAD | 0000 | Adr: 00000000 | Len: 0000003C | CRC: ADAACBC2  CRC OK
0020A45A  LOAD | 0000 | Adr: 00000400 | Len: 00003624 | CRC: F12B0754  CRC OK
0020DA9A  FILL | 0000 | Adr: 00018000 | Len: 00000960 | Ptn: 00000000
0020DAAA  LOAD | 0000 | Adr: 00008000 | Len: 00000020 | CRC: 1647D5F7  CRC OK
0020DADA  CALL | 0001 | Adr: 00008000 | Len: 00000000 | Arg: 00000000
0020DAEA  LOAD | 0000 | Adr: 00000000 | Len: 00000040 | CRC: 7C950527  CRC OK
0020DB3A  LOAD | 0000 | Adr: 41000000 | Len: 00049ACC | CRC: F8242826  CRC OK
0025761A  FILL | 0000 | Adr: 41300000 | Len: 00001900 | Ptn: 00000000
0025762A  FILL | 0000 | Adr: 41301900 | Len: 000031E4 | Ptn: 00000000
0025763A  FILL | 0000 | Adr: 41900000 | Len: 00300000 | Ptn: 00000000
0025764A  LOAD | 0000 | Adr: 00008000 | Len: 00000020 | CRC: 7EE0BD03  CRC OK
0025767A  JUMP | 0001 | Adr: 00008000 | Len: 00000000 | Arg: 00000000
         ***  File SHA-1 Hash (decrypted)  ***
0025768A  File SHA-1: FE615733935D9724A622BE3BAE285552F01297F1  [0020A36A-00257689]  HASH OK
  Block Processed OK
002576AA  9B4EA177  00000000  000BB800  AA5555AA  4000000     00000000  [002576C2-00312EC1]  CRC OK
00312EC2  484AD786  00000001  0001A6ED  AA5555AA  4000000     00000000  [00312EDA-0032D5C6]  CRC OK
0032D5C7  B81261EA  00000001  0001CA9E  AA5555AA  4000000     00000000  [0032D5DF-0034A07C]  CRC OK
  File Processed OK

 For studying the footer section:
80 00 00 00 01 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00
0034A091
20 C0 53 09 AB 46 A1 09 07 2C 63 98 19 95 88 78
E4 05 CF CD 70 91 FD 49 7D 72 6C 56 CA 14 03 7E
0E EC 06 1E BF 5B 14 72 66 7D F7 77 E1 73 BA F1
20 A7 CC 5D F9 D2 14 47 26 CE D9 70 67 E7 20 86
9A EB DC 40 7D 20 AD 6A A2 ED BC 49 2F 96 23 6B
5E CA 43 39 11 E6 44 4E 17 62 50 47 2E A1 B1 CB
45 2F E0 FB 3F 6D A8 6D 4A AA EA 11 25 16 51 9F
E6 A6 BD AE E3 B4 C4 73 90 7F 32 6C AD 4D BE 1A
91 67 A2 E8 2E 75 BB 01 48 8E D4 1A 61 A7 ED 33
7A C0 06 4D 93 D9 1F 66 AC F2 38 7F C5 0B 52 98
DE 24 6B B1 F7 3D 84 CA 10 57 9D E3 29 70 B6 FC
42 89 CF 15 5C A2 E8 2E 75 BB 01 48 8E D4 1A 61
5B AC 65 1F D9 92 4C 06 C0 79 33 ED A6 60 1A D4
8D 47 01 BB 74 2E E8 A1 5B 15 CF 88 42 FC B5 6F
29 E3 9C 56 10 CA 83 3D F7 B0 6A 24 DE 97 51 0B
C5 7E 38 F2 AB 65 1F D9 92 4C 06 C0 79 33 ED A6
01 00 01 00
b = 46
E6 3F 8C FC 57 AC C1 E3 9A 79 6A 59 93 C9 76 1F
45 20 A4 5B B8 93 B9 BE AC 5B 0E B2 E0 E4 8C C1
0B A2 76 48 A3 F8 6B 83 31 01 35 6F 92 DE DF D0
B8 F9 D8 23 78 0B 07 F3 8C EE B3 03 B4 EE E1 00
35 CC 03 AE 31 1A ED F1 6F 00 16 E9 15 C2 96 24
5D 0F CF 0B 29 45 E9 39 48 DA 0E 4B 79 32 88 E8
A9 D9 D0 31 BC 30 B1 BD E0 86 0C 7A D4 0B 8C 21
AE B4 12 49 C4 DB 32 27 8A BF B9 39 C0 A7 5E 00
7C 0B 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
69 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


F:\zscan\original\RIGOL\DS1000\DS1000Z-00_04_01_02_00\DS1000ZUpdate.00.04.01.02.00.GEL  /  CRC32: A75B1AAA
00000000 - File Type: DS1000Z
00000010 - Version: 00.04.01.02.00
00000020 - Bitmask: 00000700
00000024 - # Sections: 7
Offset    Section Name                SectiSz   StartAdr  CRC32     Type
00000028  /sys/SparrowAPP.out         0010239F  000001CC  F06D803B  00000001  [000001CC-0010256A]  CRC OK
00000064  /sys/SparrowFPGA.hex        000C4372  0010256B  C1FDC842  00000005  [0010256B-001C68DC]  CRC OK
000000A0  /sys/SparrowDGFPGA.hex      00046F04  001C68DD  ED3B7B31  00000006  [001C68DD-0020D7E0]  CRC OK
000000DC  /sys/logo.hex               000BB818  0020D7E1  1E04D14A  0000000A  [0020D7E1-002C8FF8]  CRC OK
00000118  /sys/guiResData.hex         0001E475  002C8FF9  10AA5AE2  0000000C  [002C8FF9-002E746D]  CRC OK
00000154  /sys/guiPicData.hex         0001C782  002E746E  B7C02498  00000011  [002E746E-00303BEF]  CRC OK
00000190                              00000118  00303BF0  00000000  00000032  [00303BF0-00303D07]
Offset    CRC32     Flags     Filesize  Endianes  Version     Rsvd
000001CC  C2B9DDD5  00000003  00102387  AA5555AA  4010200     00000000  [000001E4-0010256A]  CRC OK
0010256B  841B75C9  00000000  000C435A  AA5555AA  4010200     00000000  [00102583-001C68DC]  CRC OK
001C68DD  138E13B9  00000000  00046EEC  AA5555AA  4010200     00000000  [001C68F5-0020D7E0]  CRC OK
0020D7E1  9B4EA177  00000000  000BB800  AA5555AA  4010200     00000000  [0020D7F9-002C8FF8]  CRC OK
002C8FF9  7E7781CF  00000001  0001E45D  AA5555AA  4010200     00000000  [002C9011-002E746D]  CRC OK
002E746E  566E7022  00000001  0001C76A  AA5555AA  4010200     00000000  [002E7486-00303BEF]  CRC OK
  File Processed OK

 For studying the footer section:
80 00 00 00 01 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00
00303C04
3D C1 E9 75 76 7B CB 1C D9 4B 1D 03 9B 07 92 CA
55 0C 9B 09 07 42 8E 53 B3 6D E5 28 40 19 E1 62
6A 22 DD 67 57 BC 56 FA EC D9 BE 71 B2 6D E8 DF
12 54 CE 89 00 27 64 F5 FE E6 67 69 45 91 0B 70
81 D9 F4 29 79 14 87 35 28 3A 85 CC 31 0F 79 3B
67 7C AC 89 02 94 4E FA D8 E1 A1 F1 BF 75 CC A6
82 1E EA C5 1C 9B A4 31 CE 5A BF 81 34 D8 50 38
11 C5 C2 A5 0B 7D B0 E2 93 A9 26 A1 E1 A0 5D 07
A7 AA 06 06 06 06 06 06 06 06 06 06 06 06 06 06
06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06
06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06
06 C6 CE 5F F0 80 11 A2 32 C3 53 E4 74 05 96 26
B7 79 78 78 78 78 78 78 78 78 78 78 78 78 78 78
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78
78 78 E8 57 C7 36 A6 15 85 F4 63 D3 42 B2 21 91
01 00 01 00
b = 90
60 54 EB E7 57 CB 8B 4B 78 59 9B F0 F7 D3 CD 75
6F 96 94 71 DF 89 45 79 49 72 5A 0C 93 DC 13 04
7B A3 CD C6 26 FA 04 17 79 D5 29 4C FC 27 11 78
1A CC B5 DF C6 5C 09 09 82 D9 C9 3B 86 42 2B 00
E6 CF 7A 40 21 4C 50 8E 12 B4 90 68 5D CC C6 19
D5 7B 3B A9 B3 D5 20 5C CB 64 B5 96 F4 3B 22 8D
F9 26 83 EE D6 E5 7F 9C CA E6 DC 2F 72 A7 AF 28
91 D6 64 D7 CE D0 94 56 98 3F 4C 58 28 78 C5 00
14 87 52 C2 31 A1 10 80 EF 5E CE 3D AD 1C 8C FB
6A DA 49 B9 28 98 07 77 E6 55 C5 34 A4 13 83 F2
61 D1 40 B0 1F 8F FE 6D DD 4C BC 2B 9B 0A 7A E9
58 88 FF 00 00 00 00 00 00 00 00 00 00 00 00 00
93 E5 75 05 96 27 B7 48 D8 69 F9 8A 1B AB 3C CC
5D ED 7E 0F 9F 30 C0 51 E1 72 02 93 24 B4 45 D5
66 F6 87 18 A8 39 C9 5A EA 7B 0C 9C 2D BD 4E DE
6F FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00


F:\zscan\original\RIGOL\DS1000\DS1000Z-00_04_02_04_07\DS1000ZUpdate.GEL  /  CRC32: 34B5A5E1
00000000 - File Type: DS1000Z
00000010 - Version: 00.04.02.04.07
00000020 - Bitmask: 00000700
00000024 - # Sections: 7
Offset    Section Name                SectiSz   StartAdr  CRC32     Type
00000028  /sys/SparrowAPP.out         00103DB2  000001CC  055C830F  00000001  [000001CC-00103F7D]  CRC OK
00000064  /sys/SparrowFPGA.hex        000C4372  00103F7E  028E2956  00000005  [00103F7E-001C82EF]  CRC OK
000000A0  /sys/SparrowDGFPGA.hex      00046F04  001C82F0  C00B6623  00000006  [001C82F0-0020F1F3]  CRC OK
000000DC  /sys/logo.hex               000BB818  0020F1F4  329211E5  0000000A  [0020F1F4-002CAA0B]  CRC OK
00000118  /sys/guiResData.hex         0001E541  002CAA0C  BF5BC175  0000000C  [002CAA0C-002E8F4C]  CRC OK
00000154  /sys/guiPicData.hex         0001DECB  002E8F4D  ABE4D204  00000011  [002E8F4D-00306E17]  CRC OK
00000190                              00000118  00306E18  00000000  00000032  [00306E18-00306F2F]
Offset    CRC32     Flags     Filesize  Endianes  Version     Rsvd
000001CC  966AA825  00000003  00103D9A  AA5555AA  4020407     00000000  [000001E4-00103F7D]  CRC OK
00103F7E  C9AF5D56  00000000  000C435A  AA5555AA  4020407     00000000  [00103F96-001C82EF]  CRC OK
001C82F0  138E13B9  00000000  00046EEC  AA5555AA  4020407     00000000  [001C8308-0020F1F3]  CRC OK
0020F1F4  9B4EA177  00000000  000BB800  AA5555AA  4020407     00000000  [0020F20C-002CAA0B]  CRC OK
002CAA0C  5A6C6418  00000001  0001E529  AA5555AA  4020407     00000000  [002CAA24-002E8F4C]  CRC OK
002E8F4D  42893702  00000001  0001DEB3  AA5555AA  4020407     00000000  [002E8F65-00306E17]  CRC OK
  File Processed OK

 For studying the footer section:
80 00 00 00 01 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00
00306E2C
0F B7 16 CC 80 18 B7 9C 91 FB 91 22 AF 28 2C 02
5E 03 D9 70 0A 1F 11 D6 B2 9D B6 89 0C F3 74 ED
2C 54 AB 89 CF DB 42 95 E8 BB 53 D8 A2 42 C7 41
61 0E 00 8E D5 BA F3 9F 4F 02 A4 07 7A 76 9D 3C
5A 87 DA 16 C8 DF E1 1C CC 4D 16 2A 8D 72 77 05
AC 2D DE 0A 8B E3 2D 04 B3 D3 C9 D8 74 3D EB DC
45 9E AD 58 85 8F FE 12 CE 06 C0 BE 6F D5 59 C9
8F 64 6C 65 CA 73 4D 34 EF 2D 6C 40 5A 6C A0 BC
01 1C 2A 79 C8 17 67 B6 05 55 A4 F3 42 92 E1 30
80 CF 1E 6E BD 0C 5C AB FA 49 99 E8 37 87 D6 25
75 C4 13 63 B2 01 51 A0 EF 3E 8E DD 2C 7C CB 1A
6A B9 08 58 A7 F6 45 95 E4 33 83 D2 21 71 C0 0F
66 C8 77 28 D9 89 3A EB 9B 4C FD AD 5E 0F C0 70
21 D2 82 33 E4 94 45 F6 A6 57 08 B9 69 1A CB 7B
2C DD 8D 3E EF 9F 50 01 B2 62 13 C4 74 25 D6 86
37 E8 98 49 FA AA 5B 0C BD 6D 1E CF 7F 30 E1 91
01 00 01 00
b = 4F
57 B0 BF 26 8B D4 23 B9 5F 79 C0 02 3F 69 1E A4
B1 07 8E D5 20 E6 88 FE 8B 26 F0 74 A7 3F 71 9A
8A 63 6B F9 F0 AD C4 C8 CC 4F 98 CE 48 99 CF FA
CA 28 CB 09 01 97 80 DD 3E A1 F4 08 2C D8 B0 00
1A 96 39 C4 C5 2B 7D 07 06 D7 EF 52 05 39 8D 6B
61 31 32 AD 7D 24 BE E4 E2 52 97 F5 E1 F9 F6 37
EF 97 F5 F0 6C C5 84 E7 F2 7A 83 D0 D1 86 59 19
2E 52 A9 F2 A6 9E C8 FE 08 96 24 47 B1 12 95 00
76 42 01 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
50 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


F:\zscan\original\RIGOL\DS1000\DS1000Z-00_04_03_00_01\DS1000ZUpdate.GEL  /  CRC32: 467EDE17
00000000 - File Type: DS1000Z
00000010 - Version: 00.04.03.00.01
00000020 - Bitmask: 00000700
00000024 - # Sections: 8
Offset    Section Name                SectiSz   StartAdr  CRC32     Type
00000028  /sys/SparrowAPP.out         00104803  00000208  89F833BF  00000001  [00000208-00104A0A]  CRC OK
00000064  /sys/SparrowFPGA.hex        000C4372  00104A0B  89E2A45C  00000005  [00104A0B-001C8D7C]  CRC OK
000000A0  /sys/SparrowDGFPGA.hex      00046F04  001C8D7D  E81C63CB  00000006  [001C8D7D-0020FC80]  CRC OK
000000DC  /sys/logo.hex               000BB818  0020FC81  C59881AD  0000000A  [0020FC81-002CB498]  CRC OK
00000118  /sys/guiResData.hex         0001E697  002CB499  3571B927  0000000C  [002CB499-002E9B2F]  CRC OK
00000154  /sys/guiPicData.hex         0001DECB  002E9B30  D34315FD  00000011  [002E9B30-003079FA]  CRC OK
00000190  /sys/SparrowConfig.hex      000BB818  003079FB  D3654F59  00000010  [003079FB-003C3212]  CRC OK
000001CC                              00000118  003C3213  00000000  00000032  [003C3213-003C332A]
Offset    CRC32     Flags     Filesize  Endianes  Version     Rsvd
00000208  68CFAD01  00000003  001047EB  AA5555AA  4030001     00000000  [00000220-00104A0A]  CRC OK
00104A0B  C9AF5D56  00000000  000C435A  AA5555AA  4030001     00000000  [00104A23-001C8D7C]  CRC OK
001C8D7D  138E13B9  00000000  00046EEC  AA5555AA  4030001     00000000  [001C8D95-0020FC80]  CRC OK
0020FC81  9B4EA177  00000000  000BB800  AA5555AA  4030001     00000000  [0020FC99-002CB498]  CRC OK
002CB499  2C75C357  00000001  0001E67F  AA5555AA  4030001     00000000  [002CB4B1-002E9B2F]  CRC OK
002E9B30  42893702  00000001  0001DEB3  AA5555AA  4030001     00000000  [002E9B48-003079FA]  CRC OK
003079FB  5DEF7058  00000000  000BB800  AA5555AA  4030001     00000000  [00307A13-003C3212]  CRC OK
  File Processed OK

 For studying the footer section:
80 00 00 00 01 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00
003C3227
4C CE F5 B1 EB 0C 61 85 16 F7 B7 2E 53 C6 CC D6
BA FE 11 77 7A C2 43 24 00 21 ED A1 00 9B 56 BA
B6 E2 E9 41 BF 1A 80 0D 45 D3 EF F8 65 7E D4 4E
6C BE 29 F8 21 D0 F6 40 83 82 00 15 31 78 AB 88
9F 6E 27 95 98 E2 58 25 41 AD 87 AD D5 C1 38 B1
CE CE CE D0 B1 19 17 D5 7C 44 B0 91 41 47 2F EE
78 8A 10 7E 7F E5 9F 3B 93 6C 76 69 8D 65 14 C0
52 5F 33 13 58 E1 E2 2A AA 5B FB 94 AB BA 75 4A
09 00 B0 35 BD 44 CC 53 DB 62 EA 71 F9 80 08 90
17 9F 26 AE 35 BD 44 CC 53 DB 62 EA 71 F9 80 08
90 17 9F 26 AE 35 BD 44 CC 53 DB 62 EA 71 F9 80
08 90 17 9F 26 AE 35 BD 44 CC 53 DB 62 EA 71 F9
8C 5D D3 4B C4 3C B5 2D A6 1E 97 0F 88 00 79 F1
69 E2 5A D3 4B C4 3C B5 2D A6 1E 97 0F 88 00 79
F1 69 E2 5A D3 4B C4 3C B5 2D A6 1E 97 0F 88 00
79 F1 69 E2 5A D3 4B C4 3C B5 2D A6 1E 97 0F 88
01 00 01 00
b = 87
1F 19 B9 ED A0 39 07 A3 AD 06 3F 2E CB B7 35 B8
14 D1 5C 3B B6 77 70 CA 1E B8 FC 29 00 13 47 23
98 3C BC 8C 83 56 35 3A EB F1 86 07 ED 7E 4C 3F
D5 A0 83 CB 6C 94 32 F5 B0 28 1E AC 40 00 AB 00
FA 51 91 87 11 E3 E1 35 D9 CC 2E DB 8B FE FD FD
A2 29 B1 3A A3 92 18 5E 8C DC CF 38 6F FD 6C B3
C4 5E 6B 61 E9 D7 18 3C 1C 7C 0E 88 34 93 CA FD
17 AB 07 6E 3B 4B D4 A3 AB E4 0B 2C CA 61 A3 00
6A DA 02 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
AA 03 00 00 00 00 00 00 00 00 00 00 00 00 01 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


F:\zscan\original\RIGOL\DS1000\DS1000Z-00_04_03_01_05\DS1000Z(ARM)Update_00.04.03.01.05\DS1000ZUpdate.GEL  /  CRC32: 27C20EF7
00000000 - File Type: DS1000Z
00000010 - Version: 00.04.03.01.05
00000020 - Bitmask: 00000700
00000024 - # Sections: 10
Offset    Section Name                SectiSz   StartAdr  CRC32     Type
00000028  /sys/SparrowAPP.out         0010DBA2  00000280  49EF88AB  00000001  [00000280-0010DE21]  CRC OK
00000064  /sys/SparrowFPGA.hex        000C4372  0010DE22  EEA6ED8E  00000005  [0010DE22-001D2193]  CRC OK
000000A0  /sys/SparrowDGFPGA.hex      00046F04  001D2194  122B4672  00000006  [001D2194-00219097]  CRC OK
000000DC  /sys/logo.hex               000BB818  00219098  FF0E53FF  0000000A  [00219098-002D48AF]  CRC OK
00000118  /sys/guiResData.hex         0001F5CE  002D48B0  7AC4FCE7  0000000C  [002D48B0-002F3E7D]  CRC OK
00000154  /sys/guiPicData.hex         0001E3E4  002F3E7E  BD466AF3  00000011  [002F3E7E-00312261]  CRC OK
00000190  /sys/SparrowConfig.hex      000BB818  00312262  E9F39D0B  00000010  [00312262-003CDA79]  CRC OK
000001CC  /sys/SparrowWaveTable.hex   000020E8  003CDA7A  140046C9  0000000B  [003CDA7A-003CFB61]  CRC OK
00000208  /sys/SparrowCalFile.hex     00022EFD  003CFB62  28D1126D  0000000F  [003CFB62-003F2A5E]  CRC OK
00000244                              00000118  003F2A5F  00000000  00000032  [003F2A5F-003F2B76]
Offset    CRC32     Flags     Filesize  Endianes  Version     Rsvd
00000280  162BBC30  00000003  0010DB8A  AA5555AA  4030105     00000000  [00000298-0010DE21]  CRC OK
0010DE22  C9AF5D56  00000000  000C435A  AA5555AA  4030105     00000000  [0010DE3A-001D2193]  CRC OK
001D2194  138E13B9  00000000  00046EEC  AA5555AA  4030105     00000000  [001D21AC-00219097]  CRC OK
00219098  9B4EA177  00000000  000BB800  AA5555AA  4030105     00000000  [002190B0-002D48AF]  CRC OK
002D48B0  95909E61  00000001  0001F5B6  AA5555AA  4030105     00000000  [002D48C8-002F3E7D]  CRC OK
002F3E7E  E3D36C78  00000001  0001E3CC  AA5555AA  4030105     00000000  [002F3E96-00312261]  CRC OK
00312262  5DEF7058  00000000  000BB800  AA5555AA  4030105     00000000  [0031227A-003CDA79]  CRC OK
003CDA7A  27F4C06F  00000000  000020D0  AA5555AA  4030105     00000000  [003CDA92-003CFB61]  CRC OK
003CFB62  1E61A8F6  00000000  00022EE5  AA5555AA  4030105     00000000  [003CFB7A-003F2A5E]  CRC OK
  File Processed OK

 For studying the footer section:
80 00 00 00 01 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00
003F2A73
8A E9 5F BF 27 BC 39 C4 58 84 80 AE 68 84 23 AC
FC 9D 3A 2D 12 DA 5C 0E 4B D2 54 2C 9D 47 C6 05
D8 5B F1 CA 76 4D 76 56 87 FA 47 69 4E 9A D4 DD
CC F1 E3 19 B2 ED C7 A9 2E DB 9A 3B BB 38 A7 82
AA 12 2F DA A8 CA 6E 62 80 3D B2 B0 E7 04 45 D2
24 42 7B 6D F2 68 80 F8 16 2B F6 49 A9 82 6E 52
5F 74 D2 E0 D9 F9 4A B4 BA B5 74 5F D4 5B 76 84
3C D0 92 9D 74 9D 52 96 55 E0 45 B9 BA 81 D3 3D
A3 30 20 2B 37 43 4F 5B 67 73 7F 8B 97 A3 AF BB
C7 D3 DF EB F7 03 10 1C 28 34 40 4C 58 64 70 7C
88 94 A0 AC B8 C4 D0 DC E8 F4 00 0D 19 25 31 3D
49 55 61 6D 79 85 91 9D A9 B5 C1 CD D9 E5 F1 FD
4F 79 6B 5F 53 47 3B 2F 23 17 0B FF F2 E6 DA CE
C2 B6 AA 9E 92 86 7A 6E 62 56 4A 3E 32 26 1A 0E
02 F6 E9 DD D1 C5 B9 AD A1 95 89 7D 71 65 59 4D
41 35 29 1D 11 05 F9 EC E0 D4 C8 BC B0 A4 98 8C
01 00 01 00
b = 0C
FF 52 BC 10 6C F5 66 E5 6D 8D 7D 9E 4C 5C EF 6C
B0 45 D6 BD 96 52 C8 6E 9F 1A 90 5C C1 5F D2 05
CB 42 CC 99 39 04 21 F5 1A 81 C2 D8 B1 F1 1F 1C
FF 18 FE 28 B5 E4 B1 87 00 A1 54 E9 5D CE 31 00
76 EA 13 CA A4 D2 83 83 AD 76 F7 01 44 6D BA 53
B1 DB 20 1E AF 31 55 D9 03 24 FB 5B C7 AC A4 94
AD CE 38 52 57 83 E0 56 68 6F 3A 31 B2 45 6C 86
4B EB B9 D0 B3 E8 A9 F9 C4 5B CC 4C 59 2C 8A 00
9D 1D 01 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
CC 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


F:\zscan\original\RIGOL\DS1000\DS1000Z-00_04_03_02_03\DS1000ZUpdate.GEL  /  CRC32: E9E67092
00000000 - File Type: DS1000Z
00000010 - Version: 00.04.03.02.03
00000020 - Bitmask: 00000700
00000024 - # Sections: 10
Offset    Section Name                SectiSz   StartAdr  CRC32     Type
00000028  /sys/SparrowAPP.out         0010A814  00000280  C8A599FA  00000001  [00000280-0010AA93]  CRC OK
00000064  /sys/SparrowFPGA.hex        000C4372  0010AA94  EDBD3A3D  00000005  [0010AA94-001CEE05]  CRC OK
000000A0  /sys/SparrowDGFPGA.hex      00046F04  001CEE06  BFF26E4F  00000006  [001CEE06-00215D09]  CRC OK
000000DC  /sys/logo.hex               000BB818  00215D0A  8F0DC137  0000000A  [00215D0A-002D1521]  CRC OK
00000118  /sys/guiResData.hex         000206A8  002D1522  5A77FD58  0000000C  [002D1522-002F1BC9]  CRC OK
00000154  /sys/guiPicData.hex         0001E6A4  002F1BCA  99FE002B  00000011  [002F1BCA-0031026D]  CRC OK
00000190  /sys/SparrowConfig.hex      000BB818  0031026E  99F00FC3  00000010  [0031026E-003CBA85]  CRC OK
000001CC  /sys/SparrowWaveTable.hex   000020E8  003CBA86  724E92AA  0000000B  [003CBA86-003CDB6D]  CRC OK
00000208  /sys/SparrowCalFile.hex     00022EFD  003CDB6E  E9F29192  0000000F  [003CDB6E-003F0A6A]  CRC OK
00000244                              00000118  003F0A6B  00000000  00000032  [003F0A6B-003F0B82]
Offset    CRC32     Flags     Filesize  Endianes  Version     Rsvd
00000280  96C1C31B  00000003  0010A7FC  AA5555AA  4030203     00000000  [00000298-0010AA93]  CRC OK
0010AA94  C9AF5D56  00000000  000C435A  AA5555AA  4030203     00000000  [0010AAAC-001CEE05]  CRC OK
001CEE06  138E13B9  00000000  00046EEC  AA5555AA  4030203     00000000  [001CEE1E-00215D09]  CRC OK
00215D0A  9B4EA177  00000000  000BB800  AA5555AA  4030203     00000000  [00215D22-002D1521]  CRC OK
002D1522  60ECEBCB  00000001  00020690  AA5555AA  4030203     00000000  [002D153A-002F1BC9]  CRC OK
002F1BCA  541C43A8  00000001  0001E68C  AA5555AA  4030203     00000000  [002F1BE2-0031026D]  CRC OK
0031026E  5DEF7058  00000000  000BB800  AA5555AA  4030203     00000000  [00310286-003CBA85]  CRC OK
003CBA86  27F4C06F  00000000  000020D0  AA5555AA  4030203     00000000  [003CBA9E-003CDB6D]  CRC OK
003CDB6E  1E61A8F6  00000000  00022EE5  AA5555AA  4030203     00000000  [003CDB86-003F0A6A]  CRC OK
  File Processed OK

 For studying the footer section:
80 00 00 00 01 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00
003F0A7F
7C AB 7E 46 BB B8 D1 D3 A5 C9 F3 A7 82 8F 1F 25
47 10 9C 63 45 0A 76 CF AA 0D DD 7B 17 3F 7E A6
E6 BD 2A 5D FF 9B 34 A0 93 FB 45 83 8E CD 4E 03
9A FE BE 22 13 AE 7F B4 0D 61 90 A2 74 4F A9 DB
EE E4 1B 76 76 86 A0 77 C3 0F FB 0F FA 22 43 8F
A8 69 6A FB D3 94 93 19 84 BC 3A DC C7 11 7C 68
8D 20 13 24 AB 24 E8 43 41 F5 8C 7B 6D 70 F9 7C
EA 77 3C 93 33 39 60 DD 19 B2 0C F7 E6 E8 39 29
3B C1 5B FC 9E 41 E4 86 29 CC 6E 11 B4 56 F9 9B
3E E1 83 26 C9 6B 0E B1 53 F6 98 3B DE 80 23 C6
68 0B AE 50 F3 95 38 DB 7D 20 C3 65 08 AB 4D F0
92 35 D8 7A 1D C0 62 05 A8 4A ED 8F 32 D5 77 1A
A5 09 64 C1 1E 7C D9 36 94 F1 4E AC 09 67 C4 21
7F DC 39 97 F4 51 AF 0C 6A C7 24 82 DF 3C 9A F7
54 B2 0F 6D CA 27 85 E2 3F 9D FA 57 B5 12 70 CD
2A 88 E5 42 A0 FD 5A B8 15 73 D0 2D 8B E8 45 A3
01 00 01 00
b = A2
A7 34 64 89 5C B6 2C 8C BB 3D C4 D5 0E 78 65 C9
48 6F 58 7C BC DE A7 5E 96 56 84 7F 79 FE 9A 20
BD F1 BC 4C 4B 45 3B 05 55 1A C2 5D C5 62 40 52
47 08 26 E7 35 2E 5C EE A5 56 E2 52 81 BA 71 00
BF 57 31 2F D1 84 40 BA A9 97 26 DD 6A 35 F9 E7
A3 06 AA DE 58 BC 5E 86 94 6F 8F D4 61 4E 5C EA
B2 E8 7D 31 5B 76 DD DA 7B D2 0B 9D 32 D7 03 29
39 69 D0 CA 0D B5 7F 9F 7D B9 B6 43 D5 79 6D 00
27 0A 02 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
FC 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


F:\zscan\original\RIGOL\DS1000\DS1000Z-00_04_04_00_07\DS1000ZUpdate.GEL  /  CRC32: 4F68463D
00000000 - File Type: DS1000Z
00000010 - Version: 00.04.04.00.07
00000020 - Bitmask: 00000700
00000024 - # Sections: 10
Offset    Section Name                SectiSz   StartAdr  CRC32     Type
00000028  /sys/SparrowAPP.out         001097D0  00000280  1CCB275E  00000001  [00000280-00109A4F]  CRC OK
00000064  /sys/SparrowFPGA.hex        000C4372  00109A50  041EA3FF  00000005  [00109A50-001CDDC1]  CRC OK
000000A0  /sys/SparrowDGFPGA.hex      00046F04  001CDDC2  98BD1B9C  00000006  [001CDDC2-00214CC5]  CRC OK
000000DC  /sys/logo.hex               000BB818  00214CC6  046D5DC1  0000000A  [00214CC6-002D04DD]  CRC OK
00000118  /sys/guiResData.hex         000B6B34  002D04DE  9D96DD8E  0000000C  [002D04DE-00387011]  CRC OK
00000154  /sys/guiPicData.hex         0001E6BF  00387012  8B4B6D52  00000011  [00387012-003A56D0]  CRC OK
00000190  /sys/SparrowConfig.hex      000BB818  003A56D1  12909335  00000010  [003A56D1-00460EE8]  CRC OK
000001CC  /sys/SparrowWaveTable.hex   000020E8  00460EE9  F5EC3227  0000000B  [00460EE9-00462FD0]  CRC OK
00000208  /sys/SparrowCalFile.hex     00022EFD  00462FD1  372075C9  0000000F  [00462FD1-00485ECD]  CRC OK
00000244                              00000118  00485ECE  00000000  00000032  [00485ECE-00485FE5]
Offset    CRC32     Flags     Filesize  Endianes  Version     Rsvd
00000280  E0469303  00000003  001097B8  AA5555AA  4040007     00000000  [00000298-00109A4F]  CRC OK
00109A50  C9AF5D56  00000000  000C435A  AA5555AA  4040007     00000000  [00109A68-001CDDC1]  CRC OK
001CDDC2  138E13B9  00000000  00046EEC  AA5555AA  4040007     00000000  [001CDDDA-00214CC5]  CRC OK
00214CC6  9B4EA177  00000000  000BB800  AA5555AA  4040007     00000000  [00214CDE-002D04DD]  CRC OK
002D04DE  271E3AB5  00000000  000B6B1C  AA5555AA  4040007     00000000  [002D04F6-00387011]  CRC OK
00387012  01873014  00000001  0001E6A7  AA5555AA  4040007     00000000  [0038702A-003A56D0]  CRC OK
003A56D1  5DEF7058  00000000  000BB800  AA5555AA  4040007     00000000  [003A56E9-00460EE8]  CRC OK
00460EE9  27F4C06F  00000000  000020D0  AA5555AA  4040007     00000000  [00460F01-00462FD0]  CRC OK
00462FD1  1E61A8F6  00000000  00022EE5  AA5555AA  4040007     00000000  [00462FE9-00485ECD]  CRC OK
  File Processed OK

 For studying the footer section:
80 00 00 00 01 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00
00485EE2
64 29 7F D9 1A C9 9B D5 74 5C 2B 8E A3 5E 57 7A
62 DF 99 D4 BA DC 33 FE F2 37 40 E8 78 71 12 E6
10 E9 B4 B4 B5 54 17 47 73 65 9D EB 5D 4F A1 10
3E CF 7E 43 35 A9 0B A8 28 1F A3 8D 26 F2 A4 0E
44 2B 67 F0 BE E1 A3 63 CA 9F 17 56 53 32 7A F4
F8 07 7F 8C 0D 91 A7 C9 8E 99 8B 22 A9 6D 4E 0D
BE 89 A2 56 A7 58 B6 C7 99 39 48 54 91 5A 11 39
F4 D6 0C D7 7D 99 26 24 7A 94 7C 52 1E B9 17 D0
A3 30 20 2B 37 43 4F 5B 67 73 7F 8B 97 A3 AF BB
C7 D3 DF EB F7 03 10 1C 28 34 40 4C 58 64 70 7C
88 94 A0 AC B8 C4 D0 DC E8 F4 00 0D 19 25 31 3D
49 55 61 6D 79 85 91 9D A9 B5 C1 CD D9 E5 F1 FD
4F 79 6B 5F 53 47 3B 2F 23 17 0B FF F2 E6 DA CE
C2 B6 AA 9E 92 86 7A 6E 62 56 4A 3E 32 26 1A 0E
02 F6 E9 DD D1 C5 B9 AD A1 95 89 7D 71 65 59 4D
41 35 29 1D 11 05 F9 EC E0 D4 C8 BC B0 A4 98 8C
01 00 01 00
b = 0C
4D 06 50 9E D3 76 3C 6A FD D9 9C F3 FC AB 98 AF
8B FC AA D9 B3 C8 13 D2 BA F3 F0 8C 10 FD 92 5A
78 45 04 F8 ED 80 37 5B 7B 61 8C CE 34 1A 60 C3
E5 6A 0D C6 AC 14 6A FB 6F 5A D2 B0 3D FD A3 00
7D 70 B8 4D 27 56 24 F0 63 44 C8 13 1C 07 5B E1
F1 0C 91 AA 37 C7 E9 17 E8 FF FD A0 33 03 F0 BB
78 4F 74 34 91 4E B8 D6 B4 60 7B 93 DC B1 74 A8
6F 5D 9F 76 28 50 E9 F3 55 7B 6F 51 29 D1 3B 00
9D 1D 01 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
CC 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


F:\zscan\original\RIGOL\DS1000\DS1000Z-00_04_04_01_01\DS1000ZUpdate.GEL  /  CRC32: A623D8BC
00000000 - File Type: DS1000Z
00000010 - Version: 00.04.04.01.01
00000020 - Bitmask: 00000700
00000024 - # Sections: 10
Offset    Section Name                SectiSz   StartAdr  CRC32     Type
00000028  /sys/SparrowAPP.out         00107791  00000280  865DD4FE  00000001  [00000280-00107A10]  CRC OK
00000064  /sys/SparrowFPGA.hex        000C4372  00107A11  C72D7DD0  00000005  [00107A11-001CBD82]  CRC OK
000000A0  /sys/SparrowDGFPGA.hex      00046F04  001CBD83  AD60366F  00000006  [001CBD83-00212C86]  CRC OK
000000DC  /sys/logo.hex               000BB818  00212C87  1F2E52B7  0000000A  [00212C87-002CE49E]  CRC OK
00000118  /sys/guiResData.hex         000B6B34  002CE49F  9C2E4FC0  0000000C  [002CE49F-00384FD2]  CRC OK
00000154  /sys/guiPicData.hex         0001E6BF  00384FD3  10D74A0D  00000011  [00384FD3-003A3691]  CRC OK
00000190  /sys/SparrowConfig.hex      000BB818  003A3692  09D39C43  00000010  [003A3692-0045EEA9]  CRC OK
000001CC  /sys/SparrowWaveTable.hex   000020E8  0045EEAA  B1CE7C07  0000000B  [0045EEAA-00460F91]  CRC OK
00000208  /sys/SparrowCalFile.hex     00022EFD  00460F92  91673CA7  0000000F  [00460F92-00483E8E]  CRC OK
00000244                              00000118  00483E8F  00000000  00000032  [00483E8F-00483FA6]
Offset    CRC32     Flags     Filesize  Endianes  Version     Rsvd
00000280  82AC1341  00000003  00107779  AA5555AA  4040101     00000000  [00000298-00107A10]  CRC OK
00107A11  C9AF5D56  00000000  000C435A  AA5555AA  4040101     00000000  [00107A29-001CBD82]  CRC OK
001CBD83  138E13B9  00000000  00046EEC  AA5555AA  4040101     00000000  [001CBD9B-00212C86]  CRC OK
00212C87  9B4EA177  00000000  000BB800  AA5555AA  4040101     00000000  [00212C9F-002CE49E]  CRC OK
002CE49F  271E3AB5  00000000  000B6B1C  AA5555AA  4040101     00000000  [002CE4B7-00384FD2]  CRC OK
00384FD3  01873014  00000001  0001E6A7  AA5555AA  4040101     00000000  [00384FEB-003A3691]  CRC OK
003A3692  5DEF7058  00000000  000BB800  AA5555AA  4040101     00000000  [003A36AA-0045EEA9]  CRC OK
0045EEAA  27F4C06F  00000000  000020D0  AA5555AA  4040101     00000000  [0045EEC2-00460F91]  CRC OK
00460F92  1E61A8F6  00000000  00022EE5  AA5555AA  4040101     00000000  [00460FAA-00483E8E]  CRC OK
  File Processed OK

 For studying the footer section:
80 00 00 00 01 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00
00483EA3
12 54 D6 19 55 24 20 80 04 13 9B 27 A6 0E E7 C7
95 91 CA 26 62 2D 1E 22 45 ED 67 A9 FA 27 00 83
6A 3E 80 E6 76 DE 0C 2F 76 84 EF 91 46 67 68 5D
B8 8E 13 EA 40 0B BD 4D EA 67 58 66 D0 25 EA 4B
11 D1 1D 3C 69 FC 5E E6 E6 03 BE 40 5D CC 0B C7
BE 31 30 B1 E0 15 9B 6A 39 3D 55 A6 CD 72 C8 81
61 AA A5 F3 46 D8 95 B1 E0 E2 0F DA CF 02 1F 80
94 C9 9C 18 CC 63 C7 08 25 B3 9A F3 51 27 AD C7
7B 17 24 6A B5 00 4C 97 E2 2D 79 C4 0F 5B A6 F1
3C 88 D3 1E 6A B5 00 4C 97 E2 2D 79 C4 0F 5B A6
F1 3C 88 D3 1E 6A B5 00 4C 97 E2 2D 79 C4 0F 5B
A6 F1 3C 88 D3 1E 6A B5 00 4C 97 E2 2D 79 C4 0F
75 C3 74 29 DE 92 47 FC B0 65 1A CF 83 38 ED A1
56 0B C0 74 29 DE 92 47 FC B0 65 1A CF 83 38 ED
A1 56 0B C0 74 29 DE 92 47 FC B0 65 1A CF 83 38
ED A1 56 0B C0 74 29 DE 92 47 FC B0 65 1A CF 83
01 00 01 00
b = 4B
4F 46 7C 74 65 E9 99 AE E7 AA E7 28 5C 78 06 9B
1D CE BC CC BD 3D E3 9B 73 D0 FE F5 FB DD 6A A2
3E C6 BD D8 1C 39 1C F4 EF B2 D2 28 92 68 1E C7
D7 62 9B 27 32 B1 18 5D AF E0 86 49 67 71 EB 00
C3 CE 65 D0 48 26 D4 A7 F2 5B 61 2E 96 51 DB E2
25 E3 2D F9 74 F4 C5 E0 FA 49 AD 49 BB AB 4D 51
7C 11 57 F0 8E 6C 74 DB 56 A3 1B 32 72 F0 58 05
64 E4 03 CA C9 AB 5B E7 4F 29 5B FF A9 CA 9B 00
F3 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
6A 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


F:\zscan\original\RIGOL\DS1000\DS1000Z-00_04_04_03_02\DS1000ZUpdate.GEL  /  CRC32: 22AD4A12
00000000 - File Type: DS1000Z
00000010 - Version: 00.04.04.03.02
00000020 - Bitmask: 00000700
00000024 - # Sections: 10
Offset    Section Name                SectiSz   StartAdr  CRC32     Type
00000028  /sys/SparrowAPP.out         00109213  00000280  AE2F3D1D  00000001  [00000280-00109492]  CRC OK
00000064  /sys/SparrowFPGA.hex        000C4372  00109493  679334B7  00000005  [00109493-001CD804]  CRC OK
000000A0  /sys/SparrowDGFPGA.hex      00046F04  001CD805  E4FDFCA9  00000006  [001CD805-00214708]  CRC OK
000000DC  /sys/logo.hex               000BB818  00214709  AC2CE5C4  0000000A  [00214709-002CFF20]  CRC OK
00000118  /sys/guiResData.hex         000B6A2C  002CFF21  EFF83A4B  0000000C  [002CFF21-0038694C]  CRC OK
00000154  /sys/guiPicData.hex         0001E6BF  0038694D  B8D72DB2  00000011  [0038694D-003A500B]  CRC OK
00000190  /sys/SparrowConfig.hex      000BB818  003A500C  BAD12B30  00000010  [003A500C-00460823]  CRC OK
000001CC  /sys/SparrowWaveTable.hex   000020E8  00460824  B0445B96  0000000B  [00460824-0046290B]  CRC OK
00000208  /sys/SparrowCalFile.hex     0002329C  0046290C  FBE2BA34  0000000F  [0046290C-00485BA7]  CRC OK
00000244                              00000118  00485BA8  00000000  00000032  [00485BA8-00485CBF]
Offset    CRC32     Flags     Filesize  Endianes  Version     Rsvd
00000280  A7E7BDB2  00000003  001091FB  AA5555AA  4040302     00000000  [00000298-00109492]  CRC OK
00109493  C9AF5D56  00000000  000C435A  AA5555AA  4040302     00000000  [001094AB-001CD804]  CRC OK
001CD805  138E13B9  00000000  00046EEC  AA5555AA  4040302     00000000  [001CD81D-00214708]  CRC OK
00214709  9B4EA177  00000000  000BB800  AA5555AA  4040302     00000000  [00214721-002CFF20]  CRC OK
002CFF21  D7825E44  00000000  000B6A14  AA5555AA  4040302     00000000  [002CFF39-0038694C]  CRC OK
0038694D  01873014  00000001  0001E6A7  AA5555AA  4040302     00000000  [00386965-003A500B]  CRC OK
003A500C  5DEF7058  00000000  000BB800  AA5555AA  4040302     00000000  [003A5024-00460823]  CRC OK
00460824  558BD392  00000000  000020D0  AA5555AA  4040302     00000000  [0046083C-0046290B]  CRC OK
0046290C  7717C897  00000000  00023284  AA5555AA  4040302     00000000  [00462924-00485BA7]  CRC OK
  File Processed OK

 For studying the footer section:
80 00 00 00 01 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00
00485BBC
69 61 C8 4B 81 93 48 87 AE DC 31 7B 04 1B 57 3C
45 71 96 FD B0 5A E8 5B 82 4F 3C C8 A9 D0 7C 84
26 05 55 DD 3B 95 A0 FF 1C C3 A7 A4 E0 56 6D 13
E9 E3 BC EB 2D 1F 61 3E E6 DA 53 DC A5 C6 60 D2
51 AC 46 EC F8 D0 29 35 7A 19 AE 53 F7 E1 A4 53
02 81 DE 43 CC D6 4D 3F B3 2E 47 43 8C E3 54 E5
A3 D9 7C CE 03 36 A6 96 14 A8 05 1D 89 8A 1B 91
A0 3E 03 5A 80 8E DE F6 19 A3 B7 4B D6 18 3F 1B
2B 8E F0 54 B9 1D 82 E6 4A AF 13 78 DC 40 A5 09
6E D2 36 9B FF 63 C8 2C 91 F5 59 BE 22 87 EB 4F
B4 18 7D E1 45 AA 0E 73 D7 3B A0 04 69 CD 31 96
FA 5E C3 27 8C F0 54 B9 1D 82 E6 4A AF 13 78 DC
63 DA 74 10 AC 47 E3 7E 1A B6 51 ED 88 24 C0 5B
F7 92 2E CA 65 01 9D 38 D4 6F 0B A7 42 DE 79 15
B1 4C E8 83 1F BB 56 F2 8D 29 C5 60 FC 97 33 CF
6A 06 A2 3D D9 74 10 AC 47 E3 7E 1A B6 51 ED 88
01 00 01 00
b = 64
4C DF E2 01 D2 80 D0 AB 6E 37 28 0D 32 E5 BC 3D
E2 A9 6A 6C BB 01 2A 39 FB 64 ED 14 91 53 9B 3F
7C F7 E2 06 00 F5 9C 96 4F 92 11 AA 82 93 46 87
F9 8F 03 CE AB 39 17 8F D3 62 77 9C 00 BD F2 00
81 41 3F 49 BA F6 B4 24 CD D1 CA D4 DC 2A 52 65
79 5C 1D E7 D4 43 1E 74 4D 2C A9 0A B7 73 48 3D
60 FA 02 B8 51 E9 BD 12 F4 EC AE 2A FB 60 55 30
A3 A6 CF 8A 15 87 3B B8 3F 2E A6 9E 8E 34 C0 00
04 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
26 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

The code that does this is:

Code: [Select]
                i = start of the "last 128 bytes"

                byte b = (byte)(((byte)(buffer[i + 110] - buffer[i + 111]) + (byte)(buffer[i + 109] - buffer[i + 110])) >> 1);
                i = i + 127;

                byte a = buffer[i];
                for (int i0 = 0; i0 < 64; i0++, i--)
                {
                    buffer[i] -= a;
                    a += b;
                    if (a >= 0x100 - b) a++;
                }

                a = buffer[i];
                for (int i0 = 0; i0 < 64; i0++, i--)
                {
                    buffer[i] -= a;
                    a -= b;
                    if (a <= b) a--;
                }

I know that the main goal are the first 128 bytes but if you can see any of these decodes in memory dumps, that would help.

Resuming:

00.04.00.00.00 - decoded OK
00.04.00.00.00 (boot) - decoded OK
00.04.01.02.00 - has different pattern (investigating ATM...)
00.04.02.04.07 - decoded OK
00.04.03.00.01 - decoded OK  (although has a few bytes = 01)
00.04.03.01.05 - decoded OK
00.04.03.02.03 - decoded OK
00.04.04.00.07 - decoded OK
00.04.04.01.01 - decoded OK
00.04.04.03.02 - decoded OK

If anyone has other FW versions please post them or pm me.

Edit1: Added 00.04.03.00.01 version

Edit2 (Apr 13th): The footer contains BOTH the software version and SparrowAPP.out CRC in a obfuscated way. All of my theories above were far from correct. I'll leave them as historical information.
« Last Edit: April 13, 2018, 04:59:42 pm by tv84 »
 
The following users thanked this post: frozenfrogz

Offline ankerwolf

  • Regular Contributor
  • *
  • Posts: 58
  • Country: at
Re: Rigol DSXXXX .GEL firmware file format
« Reply #133 on: January 27, 2018, 08:35:43 am »
Hello tv84,
Would you post the final version of the program or a link, please?
The version I used is unpack8 in this thread here.

LG Wolfgang
 

Online tv84

  • Super Contributor
  • ***
  • Posts: 3217
  • Country: pt
Re: Rigol DSXXXX .GEL firmware file format
« Reply #134 on: January 27, 2018, 09:36:56 am »
Hi Wolfgang,

My prog is a work in progress (in C#) and it's not easy to fork a small unpacker. Have you got problems or doubts about the unpack8 that you refer?

I saw in the thread some probs about CRCs but the one used by Rigol here is the standard CRC-32 hash (IEEE 802.3; CRC-32).

And, you can used my parsings as a reference to check the output of other parsers/unpackers and compare sizes and CRCs. I try to maintain full offsets so that everyone can check things by themselves.

 

Online tv84

  • Super Contributor
  • ***
  • Posts: 3217
  • Country: pt
Re: Rigol DSXXXX .GEL firmware file format
« Reply #135 on: January 28, 2018, 05:46:32 pm »
It throws a CRC mismatch every time that I did not notice before. I downloaded the firmware zip archives from both rigol sources again, but the CRC mismatch won’t resolve.

The reason it throws a CRC mismatch is because the "footer" (last "file" listed) has a CRC of 0x00000000 in every Rigol DS1000Z FW release. It's a feature, not a bug.

Curious fact: The CRC will be shown correct if you extract the FW package from a memory dump.
 

Online tv84

  • Super Contributor
  • ***
  • Posts: 3217
  • Country: pt
Re: Rigol DSXXXX .GEL firmware file format
« Reply #136 on: February 01, 2018, 10:14:36 pm »
A bit of OT but, for the record, may be useful to others who want to verify Rigol CRC's:

The CRC-16 that Rigol uses in the DG5000 is a "customized" CRC-16 with the following parameters:

width=16 poly=0xA011 init=0x1008 refin=false refout=false xorout=0x0000 check=0xAC1A residue=0x0000 name="CRC-16/RIGOL 1"

The CRC-16 that Rigol uses in the DG4000 is a "customized" CRC-16 with the following parameters:

width=16 poly=0xA011 init=0x0528 refin=false refout=false xorout=0x0000 check=0x147D residue=0x0000 name="CRC-16/RIGOL 3"

The CRC-16 that Rigol uses in the DG1000 is a "customized" CRC-16 with the following parameters:

width=16 poly=0xA011 init=0xFFFF refin=false refout=false xorout=0x0000 check=0x5CC1 residue=0x0000 name="CRC-16/RIGOL 4"

Many Rigol equipments use this variation:

width=16 poly=0x1021 init=0xEBCC refin=false refout=false xorout=0x0000 check=0x6809 residue=0x0000 name="CRC-16/RIGOL 2"

And, other Rigol equipments (that include a CRC-16), use the more common:

width=16 poly=0x1021 init=0xFFFF refin=false refout=false xorout=0x0000 check=0x29b1 residue=0x0000 name="CRC-16/CCITT-FALSE"


Edit1: Included a parsing of many Rigol file types (showing the CRCs).
Edit2: Added Rigol 2 CRC16 type.
Edit3: Added Rigol 3 and 4 CRC16 types.
« Last Edit: August 11, 2021, 08:54:02 am by tv84 »
 

Offline janekiviTopic starter

  • Frequent Contributor
  • **
  • Posts: 368
  • Country: ee
Re: Rigol DSXXXX .GEL firmware file format
« Reply #137 on: February 11, 2018, 12:17:36 pm »
Inside DS1054Z was at one address
Code: [Select]
Copyright(C) Freescale Semiconductor, Inc. 2009. All rights reserved.
The somewhat disturbed crew - JC, TT, PZ, MJ, CR, CS, DM
No pygmies were harmed during testing..really...
N T L F J C M
 

Offline janekiviTopic starter

  • Frequent Contributor
  • **
  • Posts: 368
  • Country: ee
Re: Rigol DSXXXX .GEL firmware file format
« Reply #138 on: February 14, 2018, 04:08:39 pm »
Another interesting thing happened to me...
In GEL header is update version like this:
DS1000Z         00.04.04.00.07
I changed this by one number to:
DS1000Z         00.04.04.00.08
Scope found a newer software version than my 00.04.04.00.07 and updated it successfully to... 00.04.04.00.07


(I have 00.04.04.00.07 with modified logo in my scope for all kind of hacks right now)
 
The following users thanked this post: Marcos

Offline janekiviTopic starter

  • Frequent Contributor
  • **
  • Posts: 368
  • Country: ee
Re: Rigol DSXXXX .GEL firmware file format
« Reply #139 on: February 17, 2018, 11:46:08 am »
So all the info for update messagebox is read from the header.
This info is not critical and you can write there what you like...
To get this "found update file file" box you actually don't need anything.
Empty file is good enough.
0 byte DS1000ZUpdate.GEL file is showing of course no info
 

Offline smithnerd

  • Regular Contributor
  • *
  • Posts: 120
  • Country: gb
Re: Rigol DSXXXX .GEL firmware file format
« Reply #140 on: February 18, 2018, 02:20:45 am »
I haven't looked at more recent firmwares, but on 4.3.2.3, I have that cluster of 3 DCP related functions marked as:

start_dcp_memcopy
start_dcp_memfill
start_dcp_blit

Janekivi,

Here is a code worth investigating  (addr = 0x400CF3B0):

Code: [Select]
int __fastcall DCP_Operation1(int result, int a2, int a3, unsigned __int8 a4)
}

 
The following users thanked this post: tv84

Online tv84

  • Super Contributor
  • ***
  • Posts: 3217
  • Country: pt
Re: Rigol DSXXXX .GEL firmware file format
« Reply #141 on: February 18, 2018, 10:33:26 am »
I haven't looked at more recent firmwares, but on 4.3.2.3, I have that cluster of 3 DCP related functions marked as:

start_dcp_memcopy
start_dcp_memfill
start_dcp_blit

Thankx, that's what I was about to compare. There are also 3 in 4.4.0.7 but, at first sight, I say the 2nd and 3rd may be a little different... investigating ATM...

Edit:

Hex-rays bug that shows me all the 3 Ops as the MEMCOPY...  >:(  But, going back to ASM, we can see the 3 different CTRL0 setups: 0x13, 0x10013, 0x83 (memcopy, memfill & memblit)  :)

Now, back to the drawing board. The "footer" hashes/etc are not DCP-based...
« Last Edit: February 18, 2018, 05:01:25 pm by tv84 »
 

Offline janekiviTopic starter

  • Frequent Contributor
  • **
  • Posts: 368
  • Country: ee
Re: Rigol DSXXXX .GEL firmware file format
« Reply #142 on: March 10, 2018, 09:56:50 pm »
After long pause there I managed to get some good guys (better than me) interested
about this GEL file format and what is hidden inside footer. Now we know something.
They did the hard work for me and I did the... dirty work (better than nothing) and
thanks to tv84 and smithnerd and some more I finally got rid of those "Pluses".
 
The following users thanked this post: bitwelder, tv84, smithnerd, Marcos, Daruosha

Online tv84

  • Super Contributor
  • ***
  • Posts: 3217
  • Country: pt
Re: Rigol DSXXXX .GEL firmware file format
« Reply #143 on: March 10, 2018, 10:15:54 pm »
After long pause there I managed to get some good guys (better than me) interested
about this GEL file format and what is hidden inside footer. Now we know something.
They did the hard work for me and I did the... dirty work (better than nothing) and
thanks to tv84 and smithnerd and some more I finally got rid of those "Pluses".

A good team effort. All essential! After a false positive, success.  :)
 

Offline technogeeky

  • Frequent Contributor
  • **
  • Posts: 555
  • Country: us
  • Older New "New Player" Player Playa'
Re: Rigol DSXXXX .GEL firmware file format
« Reply #144 on: March 11, 2018, 06:12:07 am »
After long pause there I managed to get some good guys (better than me) interested
about this GEL file format and what is hidden inside footer. Now we know something.
They did the hard work for me and I did the... dirty work (better than nothing) and
thanks to tv84 and smithnerd and some more I finally got rid of those "Pluses".

What kind of level of reverse engineering did you guys do? Is there assembly or source to look at?
 

Offline janekiviTopic starter

  • Frequent Contributor
  • **
  • Posts: 368
  • Country: ee
Re: Rigol DSXXXX .GEL firmware file format
« Reply #145 on: March 11, 2018, 09:22:20 am »
 As we know only some things and can't make new correct firmware file, there is not much more to show.
For me this is schi-fi so they disassembled some functions and guided me what the scope checks. I made
all kind of changes in my already hacked GEL (my TV screen logo) and did hardware testings. I did try all
with notepad and calculator and using hex editor made 500mb worth of new files. Of course they didn't
work and scope was bricked many times. When they reached to the last crucial function, my last file did
work. So this is manually hacked together workaround to replace SparrowAPP and worked in those
special conditions I currently have.

 They made good work even not having a scope and using my memory dumps and test results. But this
is not the end as I like to know more what there is going on. Like what is inside footer exactly and how
the firmware version is checked. If You like to help with disassembly, we can widen our team. There are
all kind of cryptic and complex functions and we don't know what they are doing too. Half of software is
running scope and second half is keeping us away...
 One day we come up with something to show, I hope.
 

Online tv84

  • Super Contributor
  • ***
  • Posts: 3217
  • Country: pt
Re: Rigol DSXXXX .GEL firmware file format
« Reply #146 on: March 11, 2018, 09:45:59 am »
What kind of level of reverse engineering did you guys do? Is there assembly or source to look at?

This was never a task to be kept secret. Resuming, there are 2 .IDBs (a big one from the APP and another from bootloader) to play around.

They are somewhat commented in some critical areas but most of the things are unknown.

We focused on the primary goal but now many other things will be possible.

Once the footer processing got identified, things evolved very quickly. Then with a bit of luck and plenty of grit we discovered a workaround.

The footer only does (as far as we understand it) a obfuscation of the CRC of the APP. It's not encryption, it's not hashing. The footer is processed in 3 blocks: 0x80 bytes + 0x80 bytes + 0x04 bytes (and the 20 bytes header indicates the number os bytes, etc of those blocks).

So you can't change the APP because you would have to change it's CRC and the footer validation prevents that. Unless you go around it...  ;)

The footer is processed by the function below. As you can see they went to great troubles to obfuscate the thing.

In order to understand the footer we need to reverse all those functions. Any help is more than welcome!
 

Offline janekiviTopic starter

  • Frequent Contributor
  • **
  • Posts: 368
  • Country: ee
Re: Rigol DSXXXX .GEL firmware file format
« Reply #147 on: March 11, 2018, 10:40:40 am »
I think exactly this "chinese" function I like to see translated to me, at least in "english".
 

Offline janekiviTopic starter

  • Frequent Contributor
  • **
  • Posts: 368
  • Country: ee
Re: Rigol DSXXXX .GEL firmware file format
« Reply #148 on: March 15, 2018, 08:45:32 pm »
Any chance of finding a way to swap out the small font?
After many years I was thinking here... what font did you think back then?
All other stuff can't be resized, you need then bigger screen to fit them,
but for those there is font size to choose:
 

Offline janekiviTopic starter

  • Frequent Contributor
  • **
  • Posts: 368
  • Country: ee
Re: Rigol DSXXXX .GEL firmware file format
« Reply #149 on: April 03, 2018, 06:24:19 pm »
Some time ago I just run sbtool source through compiler to get windows version
https://www.eevblog.com/forum/testgear/rigol-dsxxxx-gel-firmware-file-format/msg991398/#msg991398
but this wasn't the brightest idea... If you redirect output to a file, this is not binary file any more
and windows is adding 0D everywhere before 0A. This is end of line for him.
How to solve this... I did add extra option for this.
-s filename
Now it is possible to save decrypted section output to a binary file:

sbtool -z -x 0 -s bootloader SparrowBootloader.sb

sbtool - executable utility (sbtool.exe)
-z        - zero key is used for decryption
-x        - extract section
0         - section index
-s        - save output to a binary file
bootloader - new output file name
SparrowBootloader.sb - file to be processed

Now the output seems to be correct...

Code: [Select]
C:\Sbtool>sbtool -z -x 0 -s output SparrowBootloader.sb
---- Boot image header ----
Signature 1:           STMP
Signature 2:           sgtl
Format version:        1.1
Flags:                 0x0000
Image blocks:          19764
First boot tag block:  9
First boot section ID: 0x00000000
Key count:             1
Key dictionary block:  7
Header blocks:         6
Section count:         1
Section header size:   1
Timestamp:             446216079000000
Product version:       999.999.999
Component version:     999.999.999
Drive tag:             0x0000
SHA-1 digest of header:
    0x00000000: 2d 5c 14 b8 10 81 fe 5f ee e2 09 ee 75 55 fe 80
    0x00000010: bb 35 50 44
Header digest is correct.

---- Section table ----
Section 0:
    Identifier: 0x0
    Offset:     10 blocks (160 bytes)
    Length:     19752 blocks (316032 bytes)
    Flags:      0x00000001
                0x1 = ROM_SECTION_BOOTABLE

---- Key dictionary ----

Default key was found in key dictionary.

Data encryption key:
    0x00000000: 9f e8 30 4c bf d7 b7 7c c6 66 cd 98 de bd 69 07

---- SHA-1 digest of entire image ----
    0x00000000: fe 61 57 33 93 5d 97 24 a6 22 be 3b ae 28 55 52
    0x00000010: f0 12 97 f1
Image digest is correct.

---- Boot tags ----
0000: @ block 000009 | id=0x00000000 | length=019752 | flags=0x00000001
        0x1 = ROM_SECTION_BOOTABLE

C:\Sbtool>sbtool -z -x 0 -s output1 SparrowBootloader1.sb
---- Boot image header ----
Signature 1:           STMP
Signature 2:           sgtl
Format version:        1.1
Flags:                 0x0000
Image blocks:          20539
First boot tag block:  9
First boot section ID: 0x00000000
Key count:             1
Key dictionary block:  7
Header blocks:         6
Section count:         1
Section header size:   1
Timestamp:             483460119000000
Product version:       999.999.999
Component version:     999.999.999
Drive tag:             0x0000
SHA-1 digest of header:
    0x00000000: 49 d6 c3 73 8f a6 fd 2a e9 05 aa f7 e0 90 e7 ef
    0x00000010: 79 ba 54 63
Header digest is correct.

---- Section table ----
Section 0:
    Identifier: 0x0
    Offset:     10 blocks (160 bytes)
    Length:     20527 blocks (328432 bytes)
    Flags:      0x00000001
                0x1 = ROM_SECTION_BOOTABLE

---- Key dictionary ----

Default key was found in key dictionary.

Data encryption key:
    0x00000000: 46 a9 67 2a 46 19 03 68 62 22 30 9f 13 ed 63 02

---- SHA-1 digest of entire image ----
    0x00000000: c0 27 4b 0b 57 c7 68 78 49 ab 8d 04 2f 3e 3c 23
    0x00000010: 14 2d 9d 42
Image digest is correct.

---- Boot tags ----
0000: @ block 000009 | id=0x00000000 | length=020527 | flags=0x00000001
        0x1 = ROM_SECTION_BOOTABLE
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf