New Rigol DS1054Z oscilloscope

[Fungus]

ie. Rigol has just given everybody the options for free. Anybody who installs this firmware will get them, even the oldest customers.

Was it Rigol? 

Rigol has two lines of 'scopes. Some that are really, really easy to hack and others that are really difficult.

It seems obvious to me that Rigol unofficially "allows" the hacking. They'd all be in the "really difficult" category otherwise.

It's not as if they don't know it happens.

[NEDM64]

ie. Rigol has just given everybody the options for free. Anybody who installs this firmware will get them, even the oldest customers.

Was it Rigol? 

Rigol has two lines of 'scopes. Some that are really, really easy to hack and others that are really difficult.

It seems obvious to me that Rigol unofficially "allows" the hacking. They'd all be in the "really difficult" category otherwise.

It's not as if they don't know it happens.

This.

However, the 100MHz option is not unlocked with the newest firmware, it's the one that matters me the most.

@ebastler if it works like asymmetric encryption, then it is asymmetric encryption independent on how good the implementation is. I read (some of) riglol's source code and the basis is that they have a private key, don't know who got the key (and/or wrote the program), and how they did they obtain the key, cracking the encryption scheme, brute-forcing or social engineering.

[frozenfrogz]

AFAIK EEVBlog user cybernet is the one that threw some stones at the Rigol firmware, then poked it with a stick and it soon became obvious, that the encryption must have been implemented by an unpaid intern - or something along that line.

Related: http://poke152.blogspot.com/2013/07/riglol.html

[Bicurico]

Once a keygen is released for a test equipment, it becomes very difficult for the manufacturer to close the door.

Unless the number of sold devices is reduced, so that the new FW can contain the serials and respective options of all devices, it is basically impossible to change the license mechanism without having all legitimate customers entering new keys.

The Riglol hack produces serials that are 100% identical to the official ones. How should a new FW invalidate illegitimatly activated options?

It is perfectly safe to install new DS1054Z FW releases and meanwhile it has been made public how to revert to older FW by use of a magic USB disk.

Regarding the other questions: I am not at home and I have not tested anything.

Regards,
Vitor

[Fungus]

The Riglol hack produces serials that are 100% identical to the official ones. How should a new FW invalidate illegitimatly activated options?

Easy: The key has a lot of digits. The first firmware could only check the first 10 digits are correct. The next firmware checks 12 digits. etc. Spread the firmware updates out over several years. and you create a constant cycle of disappearing options and new keygens.

It won't fix the problem because the new keygens will eventually appear, but it answers your question.

[NEDM64]

AFAIK EEVBlog user cybernet is the one that threw some stones at the Rigol firmware, then poked it with a stick and it soon became obvious, that the encryption must have been implemented by an unpaid intern - or something along that line.

Related: http://poke152.blogspot.com/2013/07/riglol.html

Nice, he seems to have reversed the firmware qnd it looks like it only has one public key in it.

Once a keygen is released for a test equipment, it becomes very difficult for the manufacturer to close the door.

Unless the number of sold devices is reduced, so that the new FW can contain the serials and respective options of all devices, it is basically impossible to change the license mechanism without having all legitimate customers entering new keys.

The Riglol hack produces serials that are 100% identical to the official ones. How should a new FW invalidate illegitimatly activated options?

It is perfectly safe to install new DS1054Z FW releases and meanwhile it has been made public how to revert to older FW by use of a magic USB disk.

Regarding the other questions: I am not at home and I have not tested anything.

Regards,
Vitor

Having multiple private keys and if one becomes compromised, deactivate one. Reissue activation codes to the legitimate costumers that have been issued activation codes with the compromised private key.

While it seems to not be the case, it's perfectly possible and if I were to engineer the product, that would be the way I would do, specially considering these multinational companies were they have offices overseas with just sales people and then there are the subversive employees. It's a 2-in-1: disable the hacks and find the responsible.

Also, it's not impossible. If Rigol wants to block past "illegitimate" software upgrades with a software update, they can.

They might have sold a lot of scopes, but these things don't sell in the numbers of PlayStations or iPhones, also most of them are bought for education and QA (running pass/fail tests), so the number of costumers that bought these scopes and upgraded must be really low, let's say 1 million.

If Rigol really wanted, they could include a whitelist in the new firmware, just 1MB would be good enough for 1 million 8bit hashes of the permitted machines. Then issue a second public/private key pair.

[Bicurico]

If you want to do it properly, you would include a whitelist with all serial numbers and respective legitimate options. While I accept that 8 bit might be enough to code all possible options of a DS1000Z series oscilloscope, the serial numbers will require much more bits. I would say you would need 8 bytes for serial + model and then another byte for the active options. Lets go with 8 bytes (aka 64 bits). For one million devices out on the market, you would require an extra 8MB flash space. I doubt that is feasiable on these device.

Also, the upgrade process would take quite a while: check the serial number against the white list, generate new keys for legitimate options listed in whitelist, replace private key with new one.

The next question is: how long would it take for a new keygen?

I am pretty sure that Rigol has more important R&D in course than improving this low-end device hack. I would even say that this hack was tolerated as it considerably increased sales and put Rigol on the map.

[Fungus]

I am pretty sure that Rigol has more important R&D in course than improving this low-end device hack. I would even say that this hack was tolerated as it considerably increased sales and put Rigol on the map.

It's over $1000 with all options. They'd have sold zero units at that price.

As it is they took almost the entire "hobby" market for a number of years and I doubt they lost money on any of them.

Right now they're doing the exact same thing with the MSO5000. There's no way they aren't allowing it as a sales tactic.

[nigelwright7557]

I just work with audio so a ebay cheapie does me very well.
Why spend hundreds when sub $30 does the job well ?

[NEDM64]

If you want to do it properly, you would include a whitelist with all serial numbers and respective legitimate options. While I accept that 8 bit might be enough to code all possible options of a DS1000Z series oscilloscope, the serial numbers will require much more bits. I would say you would need 8 bytes for serial + model and then another byte for the active options. Lets go with 8 bytes (aka 64 bits). For one million devices out on the market, you would require an extra 8MB flash space. I doubt that is feasiable on these device.

The S/N already includes the model info. You don't need to exactly store the S/Ns, a hash function would suffice for a high probability.

There's about 60 megs free on the flash memory.

Also, the upgrade process would take quite a while: check the serial number against the white list, generate new keys for legitimate options listed in whitelist, replace private key with new one.

A couple of µsecs.

The next question is: how long would it take for a new keygen?

I am pretty sure that Rigol has more important R&D in course than improving this low-end device hack. I would even say that this hack was tolerated as it considerably increased sales and put Rigol on the map.

That would be the case, also, with the current firmware, it's working properly for 99.9999% of users, so if they (we) see they will lose their riglols, they wouldn't upgrade.

[Adrian_Arg.]

Bicurico, did you test if the synchronization problem was corrected with captures at 24 megabits?

Hello Adrian,
the error still exists.

Peter

Thanks PeDre, it seems that it is an error without solution, since they have released several firmware and they have not solved it

[rob040]

Thanks PeDre, it seems that it is an error without solution, since they have released several firmware and they have not solved it

Is Rigol aware of this error? I'm asking because when I confronted the EU service rep years ago with the lack of solving the pulses/pluses error, he answered "We just heard of it" while it was already an issue on this forum for a long time.  Several months later it was fixed...

[Adrian_Arg.]

Thanks PeDre, it seems that it is an error without solution, since they have released several firmware and they have not solved it

Is Rigol aware of this error? I'm asking because when I confronted the EU service rep years ago with the lack of solving the pulses/pluses error, he answered "We just heard of it" while it was already an issue on this forum for a long time.  Several months later it was fixed...

I at the time sent the link where the error and own captures are discussed and he will answer that it was solved and it was not.

[Adrian_Arg.]

Friend RoGeorge how to use this file * Rigol_sign_disk.zip, which you posted. slds

[RoGeorge]

The instructions of how to use it are in the same place where Rigol_sign_disk.zip is attached, https://www.eevblog.com/forum/testgear/new-rigol-ds1054z-oscilloscope/msg3613778/#msg3613778

First, you extract the content from the zip.  You will get a file named "card_FAT32_w_SIGN_manually_added_103E00".  Then, you use either dd (in Linux) or Win32DiskImager (in Windows), as Miti tested in the next reply after the one linked.  Once you prepared the disk, you copy any firmware you want and then do the update procedure.

1. Why do you need the disk?
2. What exactly is not working on your oscilloscope?
3. What did you tried so far and what are the results?

[Adrian_Arg.]

The instructions of how to use it are in the same place where Rigol_sign_disk.zip is attached, https://www.eevblog.com/forum/testgear/new-rigol-ds1054z-oscilloscope/msg3613778/#msg3613778

First, you extract the content from the zip.  You will get a file named "card_FAT32_w_SIGN_manually_added_103E00".  Then, you use either dd (in Linux) or Win32DiskImager (in Windows), as Miti tested in the next reply after the one linked.  Once you prepared the disk, you copy any firmware you want and then do the update procedure.

1. Why do you need the disk?
2. What exactly is not working on your oscilloscope?
3. What did you tried so far and what are the results?

RoGeorge, I had installed the firmware 00.04.05.02.02, the traces did not align with the markers, when I tried to calibrate it failed several times, I had downloaded Rigol_sign_disk.zip, and I thought last grade with this method, but I began to reiterate calibrating After each refusal, it turned off and returned to calibrate, on the sixth attempt it calibrated and started working again. Thanks for your questions of what was the reason. slds



RoGeorge, yo habia instalado el firmware 00.04.05.02.02, los rastro no se aliniaban con los marcadores, cuando intente calibrar fallo varias veces, yo habia descargado  Rigol_sign_disk.zip, y pense de ultima degrado con este metodo, pero comenze a reitentar calibrar, tras cada negativa, apaga y regresaba a calibrar, al sexto intento calibro y volvio a funcionar. gracias por tus preguntas de cual era el motivo. slds

[SERJSOCHI]

Some people ask me to update SimpleUI firmware.

Updated SimpleUI for DS1054z based on 00.04.05.02.02 attached to post.

Also you can test my program to capture DS1054z's screen to PC via tree connect ways.

[TDQ7050]

Could somebody please provide me a link to the 00.04.05.02.02 firmware? The link including the Chinese characters doesn't work for me, I always receive an empty file.
Thanks!

[RoGeorge]

Could somebody please provide me a link to the 00.04.05.02.02 firmware? The link including the Chinese characters doesn't work for me, I always receive an empty file.
Thanks!

First link (listed 5 years ago at point 7.   <---   shameless plug  ) seems it's still working. 
No registration required and always the latest firmware, today: 04.05.02.02  (checked the DS1000ZUpdate.GEL file zipped inside DS1000ZUpdate.zip, and the .GEL file starts with "DS1000Z00.04.05.02.02").

The link with always the latest firmware and no stupid registration required:
http://beyondmeasure.rigoltech.com/acton/fs/blocks/showLandingPage/a/1579/p/p-0019/t/page/fm/0

[rob040]

It's now also available on the European website:

https://www.rigol.eu/SUPPORTS/software-firmware-download.html

[RoGeorge]

Hm, the EU website has the same firmware, but different! 
Same checksum for the .GEL file, but packed as .rar instead of .zip, and without the Release Notes file.

[TDQ7050]

Thanks for your help!
This is all a bit confusing: the European website shows both 00.04.05.02.02 and 00.04.04.04.03, the release note just mentions the 00.04.05.02.00...

The link http://beyondmeasure.rigoltech.com/acton/fs/blocks/showLandingPage/a/1579/p/p-0019/t/page/fm/0 still contains the old 00.04.04.04.03 version and a release memo of a version 00.04.03.02.03 of 2015...that's why I haven't tried that one.

Finally, the European file 00.04.05.02.02 worked for me (which wasn't yet available yesterday evening). And I've learned that the version number can be found in the first bytes...

[MarkF]

The general USA firmware site for all Rigol products is:

   https://www.rigolna.com/firmware/

Be sure NOT to mix up the DS1000Z and DS1000Z-E firmware.  They are NOT interchangable!

DS1000Z:
   


DS1000Z-E:
   

[oz2cpu]

feel free to see this, my tests, my upgrades, noise

https://webx.dk/rigol/

[Mechatrommer]

feel free to see this, my tests, my upgrades, noise
https://webx.dk/rigol/

testing dso at more than nyquist sampling rate (>= 500MHz), what you see is aliasing... btw upgraded to 4.5.2 thanks for update people but i need to recalibrate since the upgrade introduce voltage offset on unconnected input.. fwiw...