-
-
I know it is usually bad practice to play necromancer and resurrect an old thread, but since this has so much useful information I hope you don’t mind
First of all: Thanks for the OS X and Windows firmware unpacking tools!
I could find some entry points with IDA, but this is so much more convenient and I am glad I found this thread!
Can you tell me how to correctly uncompress the SparrowAPP.out file? I have been poking at it with 7zip under W7 as mentioned in this thread plus binutils under OS X.
7zip will unpack most of the file, but quits with unexpected EOF.
When using binutils
greadelf -S SparrowAPP.out
it tells me: Error: Not an ELF file - it has the wrong magic bytes at the start
My uncompressed SparrowApp.out (00.04.04.03.02) header:
HEX: 7F454C46 01010100
ASCII: ELF
lzma -d does not recognize the compressed file and since the uncompressed file looks pretty sane, I thought it might be possible to just manually fix the header with the hex editor.
Any pointers are welcome, since I do not know much about how ELF works and what binutils expects to see in the header.
Kind regards,
Frederik
-
#126 Reply
Posted by
ankerwolf
on 09 Jan, 2018 11:40
-
Hello Frederik,
two days ago I used unpack8.zip and got following output:
D:\#\#__Rigol\Batronix_SW&Doku\Tools\GEL_Unpack8>python unpack.py ds.gel
instrument series: DS1000Z
firmware version: 00.04.04.03.02
updateType: 0x00070000
found 10 files
{'filename': '/sys/SparrowAPP.out', 'type': 1, 'start': 640, 'length': 1085971, 'crc': 2922331421, 'unknown': (0, 0, 0)}{'filename': '/sys/SparrowFPGA.hex', 'type': 5, 'start': 1086611, 'length': 803698, 'crc': 1737700535, 'unknown': (0, 0, 0)}
{'filename': '/sys/SparrowDGFPGA.hex', 'type': 6, 'start': 1890309, 'length': 290564, 'crc': 3841850537, 'unknown': (0, 0, 0)}
{'filename': '/sys/logo.hex', 'type': 10, 'start': 2180873, 'length': 768024, 'crc': 2888623556, 'unknown': (0, 0, 0)}
{'filename': '/sys/guiResData.hex', 'type': 12, 'start': 2948897, 'length': 748076, 'crc': 4026022475, 'unknown': (0, 0, 0)}
{'filename': '/sys/guiPicData.hex', 'type': 17, 'start': 3696973, 'length': 124607, 'crc': 3101109682, 'unknown': (0, 0, 0)}
{'filename': '/sys/SparrowConfig.hex', 'type': 16, 'start': 3821580, 'length': 768024, 'crc': 3134270256, 'unknown': (0, 0, 0)}
{'filename': '/sys/SparrowWaveTable.hex', 'type': 11, 'start': 4589604, 'length': 8424, 'crc': 2957269910, 'unknown': (0, 0, 0)}
{'filename': '/sys/SparrowCalFile.hex', 'type': 15, 'start': 4598028, 'length': 144028, 'crc': 4225940020, 'unknown': (0, 0, 0)}
{'filename': '', 'type': 50, 'start': 4742056, 'length': 280, 'crc': 0, 'unknown': (0, 0, 0)}
writing /header (640 bytes)
writing /sys/SparrowAPP.out.header (24 bytes)
writing /sys/SparrowAPP.out (1085947 bytes)
writing /sys/SparrowAPP.out.decompressed (3934197 bytes)
writing /sys/SparrowFPGA.hex.header (24 bytes)
writing /sys/SparrowFPGA.hex (803674 bytes)
writing /sys/SparrowDGFPGA.hex.header (24 bytes)
writing /sys/SparrowDGFPGA.hex (290540 bytes)
writing /sys/logo.hex.header (24 bytes)
writing /sys/logo.hex (768000 bytes)
writing /sys/guiResData.hex.header (24 bytes)
writing /sys/guiResData.hex (748052 bytes)
writing /sys/guiPicData.hex.header (24 bytes)
writing /sys/guiPicData.hex (124583 bytes)
writing /sys/guiPicData.hex.decompressed (4031460 bytes)
writing /sys/SparrowConfig.hex.header (24 bytes)
writing /sys/SparrowConfig.hex (768000 bytes)
writing /sys/SparrowWaveTable.hex.header (24 bytes)
writing /sys/SparrowWaveTable.hex (8400 bytes)
writing /sys/SparrowCalFile.hex.header (24 bytes)
writing /sys/SparrowCalFile.hex (144004 bytes)
Corrupt input data
CRC mismatch: '' (0x00000000 vs 0x6ad11bae)
writing /footer (280 bytes)
original filesize: 4742336
bytes processed: 4742336
There is SparrowAPP.out.decompressed ! It is a ELF-file.
But there are so many errors in the html- and css-files - I extracted - from this file.
From the Python script unpack.py file SparrowAPP.out.decompressed contains the Web-interface for the DS1000Z series. The html pages can be found, containing very many errors: there are incorrect characters - unmotivated but in places with system. Also, one web page is 4 times slightly different included. It is unclear where this error come from. From the GEL file probably not, because it is used to update. It may be but that the developers intentionally have infilled such errors to hide their work. After all of the html files including the .css were prepared so that they corresponded to the orignal of the Scope. Not found, where is the Access query for the Web Settings page. None of this is to find in the html files. (Microsoft Translator)
LG Wolfgang
-
-
Thanks for your quick answer Wolfgang,
curiously I am getting different results and no decompressed files.
python unpack.py DS1000ZUpdate.GEL
instrument series: DS1000Z
firmware version: 00.04.04.03.02
updateType: 0x00070000
found 10 files
{'start': 640, 'unknown': (0, 0, 0), 'filename': '/sys/SparrowAPP.out', 'crc': 2922331421, 'length': 1085971, 'type': 1}
{'start': 1086611, 'unknown': (0, 0, 0), 'filename': '/sys/SparrowFPGA.hex', 'crc': 1737700535, 'length': 803698, 'type': 5}
{'start': 1890309, 'unknown': (0, 0, 0), 'filename': '/sys/SparrowDGFPGA.hex', 'crc': 3841850537, 'length': 290564, 'type': 6}
{'start': 2180873, 'unknown': (0, 0, 0), 'filename': '/sys/logo.hex', 'crc': 2888623556, 'length': 768024, 'type': 10}
{'start': 2948897, 'unknown': (0, 0, 0), 'filename': '/sys/guiResData.hex', 'crc': 4026022475, 'length': 748076, 'type': 12}
{'start': 3696973, 'unknown': (0, 0, 0), 'filename': '/sys/guiPicData.hex', 'crc': 3101109682, 'length': 124607, 'type': 17}
{'start': 3821580, 'unknown': (0, 0, 0), 'filename': '/sys/SparrowConfig.hex', 'crc': 3134270256, 'length': 768024, 'type': 16}
{'start': 4589604, 'unknown': (0, 0, 0), 'filename': '/sys/SparrowWaveTable.hex', 'crc': 2957269910, 'length': 8424, 'type': 11}
{'start': 4598028, 'unknown': (0, 0, 0), 'filename': '/sys/SparrowCalFile.hex', 'crc': 4225940020, 'length': 144028, 'type': 15}
{'start': 4742056, 'unknown': (0, 0, 0), 'filename': '', 'crc': 0, 'length': 280, 'type': 50}
writing /header (640 bytes)
writing /sys/SparrowAPP.out.header (24 bytes)
writing /sys/SparrowAPP.out (1085947 bytes)
writing /sys/SparrowFPGA.hex.header (24 bytes)
writing /sys/SparrowFPGA.hex (803674 bytes)
writing /sys/SparrowDGFPGA.hex.header (24 bytes)
writing /sys/SparrowDGFPGA.hex (290540 bytes)
writing /sys/logo.hex.header (24 bytes)
writing /sys/logo.hex (768000 bytes)
writing /sys/guiResData.hex.header (24 bytes)
writing /sys/guiResData.hex (748052 bytes)
writing /sys/guiPicData.hex.header (24 bytes)
writing /sys/guiPicData.hex (124583 bytes)
writing /sys/SparrowConfig.hex.header (24 bytes)
writing /sys/SparrowConfig.hex (768000 bytes)
writing /sys/SparrowWaveTable.hex.header (24 bytes)
writing /sys/SparrowWaveTable.hex (8400 bytes)
writing /sys/SparrowCalFile.hex.header (24 bytes)
writing /sys/SparrowCalFile.hex (144004 bytes)
CRC mismatch: '' (0x00000000 vs 0x6ad11bae)
writing /footer (280 bytes)
original filesize: 4742336
bytes processed: 4742336
It throws a CRC mismatch every time that I did not notice before. I downloaded the firmware zip archives from both rigol sources again, but the CRC mismatch won’t resolve.
The .GEL files from the two different archives have the same checksum: MD5 (DS1000ZUpdate.GEL) = 367ae75bed8864bf168f3afd63de835c
Edit: This is with the script from unpack8.zip
-
#128 Reply
Posted by
ankerwolf
on 09 Jan, 2018 12:32
-
Hallo,
merkwürdig ist das schon ...
Here are the unpack.py I used and the corrected html and css files.
I used Python 3.6.1 !!!
Same SparrowAPP.out.decompressed by use of
7-Zip from the compressed SparrowAPP.out !
LG Wolfgang
-
-
Well, well. I used Python 2.7.10 before.
Now using python 3.5.2 the unpack script gets me two additional decompressed files.
Thanks for pointing to that
-
#130 Reply
Posted by
janekivi
on 09 Jan, 2018 16:41
-
Good timing.
Since last week I tried to get some life to this project and got others interested too.
Right now we looking at SparrowBootloader.sb and think about procedures used
for making this and how scope decrypt the header and keys and footers there.
https://www.rockbox.org/wiki/SbFileFormat.May not be related to our problem with footer, but interesting anyway.
-
#131 Reply
Posted by
tv84
on 11 Jan, 2018 22:59
-
Complementing janekivi and resuming all that has been done in this thread regarding the SparrowBootloader.sb, I include a verbosed parsing which may be clearer for all:
(I kept the offsets of the original .GEL file)
*** Header ***
0020A36A Header SHA-1: 2D5C14B81081FE5FEEE209EE7555FE80BB355044 [0020A37E-0020A3C9] HASH OK
0020A37E Signature 1: STMP MAGIC OK
0020A382 Format Version: 1.1
0020A384 Flags: 0x0000
0020A386 # Image Blocks: 19764 (16-byte blocks)
0020A38A 1st Boot Tag Offset: 0x0020A3FA
0020A38E 1st Boot section ID: 00000000 (always 0?)
0020A392 # Encryption Keys: 1
0020A394 Key Dictionary Start: 0x0020A3DA
0020A396 Header Size: 96 bytes
0020A398 # Section Headers: 1
0020A39A Section Header Size: 16 bytes
0020A39C Random Padding: 0x1C1A
0020A39E Signature 2: sgtl (Sigmatel??)
0020A3A2 Creation Time: 20-02-2014 12:54:39
0020A3AA Product Version: 999.999.999
0020A3B6 Component Version: 999.999.999
0020A3C2 Drive Tag: 0x0000
0020A3C4 Random Padding: 0x288304AC14A7
*** Sections Table ***
0020A3CA Nam: | Ofs: 0020A40A | Len: 0004D280 | Flg: 00000001 - ROM_SECTION_BOOTABLE
*** Key Dictionary ***
0020A3DA OTP Key0 Hash: 17D92922DDECBF7016BB6418BD05117B CBC-MAC_AES OK
*** Session Key (decrypted) ***
0020A3EA Key: 9FE8304CBFD7B77CC666CD98DEBD6907 (using OTP Key0)
*** Sections (decrypted) ***
0020A3FA TAG | 0001 | Section #0 | Len: 0004D280 | Flg: 00000001 - ROM_SECTION_BOOTABLE
0020A40A LOAD | 0000 | Adr: 00000000 | Len: 0000003C | CRC: ADAACBC2 CRC OK
0020A45A LOAD | 0000 | Adr: 00000400 | Len: 00003624 | CRC: F12B0754 CRC OK
0020DA9A FILL | 0000 | Adr: 00018000 | Len: 00000960 | Ptn: 00000000
0020DAAA LOAD | 0000 | Adr: 00008000 | Len: 00000020 | CRC: 1647D5F7 CRC OK
0020DADA CALL | 0001 | Adr: 00008000 | Len: 00000000 | Arg: 00000000
0020DAEA LOAD | 0000 | Adr: 00000000 | Len: 00000040 | CRC: 7C950527 CRC OK
0020DB3A LOAD | 0000 | Adr: 41000000 | Len: 00049ACC | CRC: F8242826 CRC OK
0025761A FILL | 0000 | Adr: 41300000 | Len: 00001900 | Ptn: 00000000
0025762A FILL | 0000 | Adr: 41301900 | Len: 000031E4 | Ptn: 00000000
0025763A FILL | 0000 | Adr: 41900000 | Len: 00300000 | Ptn: 00000000
0025764A LOAD | 0000 | Adr: 00008000 | Len: 00000020 | CRC: 7EE0BD03 CRC OK
0025767A JUMP | 0001 | Adr: 00008000 | Len: 00000000 | Arg: 00000000
*** File SHA-1 Hash (decrypted) ***
0025768A File SHA-1: FE615733935D9724A622BE3BAE285552F01297F1 [0020A36A-00257689] HASH OK
-
#132 Reply
Posted by
tv84
on 26 Jan, 2018 17:37
-
Janekivi,
Here is a decoding of the last 128 bytes of the "footer" for the new bootloader. It's not a bullet-proof theory but...
Following the parsing of the files, there is the 280 (0x118) bytes of the footer 20+256+4. What is decoded (on the bottom of each file) is the 256-bytes zone.
F:\zscan\original\RIGOL\DS1000\DS1000Z-00_04_00_00_00\Sparrow(ARM)update_00.04.00.00.00\DS1000ZUpdate.GEL / CRC32: 35890A7B
00000000 - File Type: DS1000Z
00000010 - Version: 00.04.00.00.00
00000020 - Bitmask: 00000700
00000024 - # Sections: 7
Offset Section Name SectiSz StartAdr CRC32 Type
00000028 /sys/SparrowAPP.out 000FEEEC 000001CC 2B9CC8DC 00000001 [000001CC-000FF0B7] CRC OK
00000064 /sys/SparrowFPGA.hex 000C4372 000FF0B8 E11B7BE0 00000005 [000FF0B8-001C3429] CRC OK
000000A0 /sys/SparrowDGFPGA.hex 00046F04 001C342A 718FD66C 00000006 [001C342A-0020A32D] CRC OK
000000DC /sys/logo.hex 000BB818 0020A32E ABE15C88 0000000A [0020A32E-002C5B45] CRC OK
00000118 /sys/guiResData.hex 0001A705 002C5B46 7656E54D 0000000C [002C5B46-002E024A] CRC OK
00000154 /sys/guiPicData.hex 0001CAB6 002E024B D8202F6D 00000011 [002E024B-002FCD00] CRC OK
00000190 00000118 002FCD01 00000000 00000032 [002FCD01-002FCE18]
Offset CRC32 Flags Filesize Endianes Version Rsvd
000001CC EEAB61BE 00000003 000FEED4 AA5555AA 4000000 00000000 [000001E4-000FF0B7] CRC OK
000FF0B8 841B75C9 00000000 000C435A AA5555AA 4000000 00000000 [000FF0D0-001C3429] CRC OK
001C342A 138E13B9 00000000 00046EEC AA5555AA 4000000 00000000 [001C3442-0020A32D] CRC OK
0020A32E 9B4EA177 00000000 000BB800 AA5555AA 4000000 00000000 [0020A346-002C5B45] CRC OK
002C5B46 484AD786 00000001 0001A6ED AA5555AA 4000000 00000000 [002C5B5E-002E024A] CRC OK
002E024B B81261EA 00000001 0001CA9E AA5555AA 4000000 00000000 [002E0263-002FCD00] CRC OK
File Processed OK
For studying the footer section:
80 00 00 00 01 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00
002FCD15
47 96 9C 97 E1 7D BF 48 80 6B 19 8C 07 75 B0 BE
F7 58 02 91 F6 25 96 E6 9A 6A C2 21 3E 30 63 36
EC 1E 85 82 46 E5 04 BE DF 68 E4 FC CC B4 D5 32
85 E6 4A 20 E1 6A 72 83 03 D0 76 43 27 2B 4A 94
3F AD E0 EE FD BC 7F 0B A9 E1 55 E8 90 EA 8D E5
2C 02 D9 3B A9 48 FB B9 56 D3 F6 89 F1 1C 5A 5C
62 DC C8 DB 20 25 9C AA CE F6 F2 55 A4 0D 78 E9
D7 38 C4 E5 C3 7B 03 2E 8A 78 88 75 D2 DE FA D7
79 8A 99 49 FE B2 67 1C D1 85 3A EF A3 58 0D C2
76 2B E0 94 49 FE B2 67 1C D1 85 3A EF A3 58 0D
C2 76 2B E0 94 49 FE B2 67 1C D1 85 3A EF A3 58
0D C2 76 2B E0 94 49 FE B2 67 1C D1 85 3A EF A3
48 4C 94 DF 2A 76 C1 0C 58 A3 EE 39 85 D0 1B 67
B2 FD 48 94 DF 2A 76 C1 0C 58 A3 EE 39 85 D0 1B
67 B2 FD 48 94 DF 2A 76 C1 0C 58 A3 EE 39 85 D0
1B 67 B2 FD 48 94 DF 2A 76 C1 0C 58 A3 EE 39 85
01 00 01 00
b = B4
2B C5 17 5D F2 DA 67 3B BE F5 EE AC 73 2C B2 0C
90 3C 31 0C BC 36 F3 8E 8D A8 4C F6 5E 9C 1A 38
3A B7 69 B1 C1 AB 15 1B 87 5B 22 86 A1 D4 41 E9
87 34 E3 04 10 E5 38 94 60 78 69 81 B1 00 6A 00
EF 12 FA BD 80 F4 6C AC FF EC 15 5C B9 C8 1F 2C
28 B2 3E 55 78 CB 33 A6 F7 29 01 49 65 45 38 EE
A9 D8 78 40 3A F4 1F E2 BB 97 48 60 64 81 A1 C7
69 7F C0 95 28 95 D2 B1 C2 65 29 CB DD 9E 6E 00
4E AA 05 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4B 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
F:\zscan\original\RIGOL\DS1000\DS1000Z-00_04_00_00_00\Sparrow(Boot)update_00.04.00.00.00\DS1000ZUpdate.GEL / CRC32: ED3A19F6
00000000 - File Type: DS1000Z
00000010 - Version: 00.04.00.00.00
00000020 - Bitmask: 00000F00
00000024 - # Sections: 8
Offset Section Name SectiSz StartAdr CRC32 Type
00000028 /sys/SparrowAPP.out 000FEEEC 00000208 2B9CC8DC 00000001 [00000208-000FF0F3] CRC OK
00000064 /sys/SparrowFPGA.hex 000C4372 000FF0F4 E11B7BE0 00000005 [000FF0F4-001C3465] CRC OK
000000A0 /sys/SparrowDGFPGA.hex 00046F04 001C3466 718FD66C 00000006 [001C3466-0020A369] CRC OK
000000DC /sys/SparrowBootloader.sb 0004D340 0020A36A 36829BEE 00000008 [0020A36A-002576A9] CRC OK
00000118 /sys/logo.hex 000BB818 002576AA ABE15C88 0000000A [002576AA-00312EC1] CRC OK
00000154 /sys/guiResData.hex 0001A705 00312EC2 7656E54D 0000000C [00312EC2-0032D5C6] CRC OK
00000190 /sys/guiPicData.hex 0001CAB6 0032D5C7 D8202F6D 00000011 [0032D5C7-0034A07C] CRC OK
000001CC 00000118 0034A07D 00000000 00000032 [0034A07D-0034A194]
Offset CRC32 Flags Filesize Endianes Version Rsvd
00000208 EEAB61BE 00000003 000FEED4 AA5555AA 4000000 00000000 [00000220-000FF0F3] CRC OK
000FF0F4 841B75C9 00000000 000C435A AA5555AA 4000000 00000000 [000FF10C-001C3465] CRC OK
001C3466 138E13B9 00000000 00046EEC AA5555AA 4000000 00000000 [001C347E-0020A369] CRC OK
0020A36A -------- -------- -------- -------- ---------- -------- [0020A36A-002576A9]
*** Bootloader Header ***
0020A36A Header SHA-1: 2D5C14B81081FE5FEEE209EE7555FE80BB355044 [0020A37E-0020A3C9] HASH OK
0020A37E Signature 1: STMP MAGIC OK
0020A382 Format Version: 1.1
0020A384 Flags: 0x0000
0020A386 Image Size: 0004D340
0020A38A 1st Boot Tag Offset: 0020A3FA
0020A38E 1st Boot Section ID:
0020A392 # Encryption Keys: 1
0020A394 Key Dictionary Start: 0020A3DA
0020A396 Header Size: 00000060
0020A398 # Section Headers: 1
0020A39A Section Header Size: 16 bytes
0020A39C Random Padding: 0x1C1A
0020A39E Signature 2: sgtl (Sigmatel?)
0020A3A2 Creation Time: 20-02-2014 12:54:39
0020A3AA Product Version: 999.999.999
0020A3B6 Component Version: 999.999.999
0020A3C2 Drive Tag: 0x0000
0020A3C4 Random Padding: 0x288304AC14A7
*** Sections Table ***
0020A3CA ID: | Ofs: 0020A40A | Len: 0004D280 | Flg: 00000001 - ROM_SECTION_BOOTABLE
*** Key Dictionary ***
0020A3DA OTP Key0 Hash: 17D92922DDECBF7016BB6418BD05117B CBC-MAC_AES OK
*** Session Key (decrypted) ***
0020A3EA Key: 9FE8304CBFD7B77CC666CD98DEBD6907 (using OTP Key0)
*** Sections (decrypted) ***
0020A3FA TAG | 0001 | Sect ID: | Len: 0004D280 | Flg: 00000001 - ROM_SECTION_BOOTABLE
0020A40A LOAD | 0000 | Adr: 00000000 | Len: 0000003C | CRC: ADAACBC2 CRC OK
0020A45A LOAD | 0000 | Adr: 00000400 | Len: 00003624 | CRC: F12B0754 CRC OK
0020DA9A FILL | 0000 | Adr: 00018000 | Len: 00000960 | Ptn: 00000000
0020DAAA LOAD | 0000 | Adr: 00008000 | Len: 00000020 | CRC: 1647D5F7 CRC OK
0020DADA CALL | 0001 | Adr: 00008000 | Len: 00000000 | Arg: 00000000
0020DAEA LOAD | 0000 | Adr: 00000000 | Len: 00000040 | CRC: 7C950527 CRC OK
0020DB3A LOAD | 0000 | Adr: 41000000 | Len: 00049ACC | CRC: F8242826 CRC OK
0025761A FILL | 0000 | Adr: 41300000 | Len: 00001900 | Ptn: 00000000
0025762A FILL | 0000 | Adr: 41301900 | Len: 000031E4 | Ptn: 00000000
0025763A FILL | 0000 | Adr: 41900000 | Len: 00300000 | Ptn: 00000000
0025764A LOAD | 0000 | Adr: 00008000 | Len: 00000020 | CRC: 7EE0BD03 CRC OK
0025767A JUMP | 0001 | Adr: 00008000 | Len: 00000000 | Arg: 00000000
*** File SHA-1 Hash (decrypted) ***
0025768A File SHA-1: FE615733935D9724A622BE3BAE285552F01297F1 [0020A36A-00257689] HASH OK
Block Processed OK
002576AA 9B4EA177 00000000 000BB800 AA5555AA 4000000 00000000 [002576C2-00312EC1] CRC OK
00312EC2 484AD786 00000001 0001A6ED AA5555AA 4000000 00000000 [00312EDA-0032D5C6] CRC OK
0032D5C7 B81261EA 00000001 0001CA9E AA5555AA 4000000 00000000 [0032D5DF-0034A07C] CRC OK
File Processed OK
For studying the footer section:
80 00 00 00 01 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00
0034A091
20 C0 53 09 AB 46 A1 09 07 2C 63 98 19 95 88 78
E4 05 CF CD 70 91 FD 49 7D 72 6C 56 CA 14 03 7E
0E EC 06 1E BF 5B 14 72 66 7D F7 77 E1 73 BA F1
20 A7 CC 5D F9 D2 14 47 26 CE D9 70 67 E7 20 86
9A EB DC 40 7D 20 AD 6A A2 ED BC 49 2F 96 23 6B
5E CA 43 39 11 E6 44 4E 17 62 50 47 2E A1 B1 CB
45 2F E0 FB 3F 6D A8 6D 4A AA EA 11 25 16 51 9F
E6 A6 BD AE E3 B4 C4 73 90 7F 32 6C AD 4D BE 1A
91 67 A2 E8 2E 75 BB 01 48 8E D4 1A 61 A7 ED 33
7A C0 06 4D 93 D9 1F 66 AC F2 38 7F C5 0B 52 98
DE 24 6B B1 F7 3D 84 CA 10 57 9D E3 29 70 B6 FC
42 89 CF 15 5C A2 E8 2E 75 BB 01 48 8E D4 1A 61
5B AC 65 1F D9 92 4C 06 C0 79 33 ED A6 60 1A D4
8D 47 01 BB 74 2E E8 A1 5B 15 CF 88 42 FC B5 6F
29 E3 9C 56 10 CA 83 3D F7 B0 6A 24 DE 97 51 0B
C5 7E 38 F2 AB 65 1F D9 92 4C 06 C0 79 33 ED A6
01 00 01 00
b = 46
E6 3F 8C FC 57 AC C1 E3 9A 79 6A 59 93 C9 76 1F
45 20 A4 5B B8 93 B9 BE AC 5B 0E B2 E0 E4 8C C1
0B A2 76 48 A3 F8 6B 83 31 01 35 6F 92 DE DF D0
B8 F9 D8 23 78 0B 07 F3 8C EE B3 03 B4 EE E1 00
35 CC 03 AE 31 1A ED F1 6F 00 16 E9 15 C2 96 24
5D 0F CF 0B 29 45 E9 39 48 DA 0E 4B 79 32 88 E8
A9 D9 D0 31 BC 30 B1 BD E0 86 0C 7A D4 0B 8C 21
AE B4 12 49 C4 DB 32 27 8A BF B9 39 C0 A7 5E 00
7C 0B 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
69 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
F:\zscan\original\RIGOL\DS1000\DS1000Z-00_04_01_02_00\DS1000ZUpdate.00.04.01.02.00.GEL / CRC32: A75B1AAA
00000000 - File Type: DS1000Z
00000010 - Version: 00.04.01.02.00
00000020 - Bitmask: 00000700
00000024 - # Sections: 7
Offset Section Name SectiSz StartAdr CRC32 Type
00000028 /sys/SparrowAPP.out 0010239F 000001CC F06D803B 00000001 [000001CC-0010256A] CRC OK
00000064 /sys/SparrowFPGA.hex 000C4372 0010256B C1FDC842 00000005 [0010256B-001C68DC] CRC OK
000000A0 /sys/SparrowDGFPGA.hex 00046F04 001C68DD ED3B7B31 00000006 [001C68DD-0020D7E0] CRC OK
000000DC /sys/logo.hex 000BB818 0020D7E1 1E04D14A 0000000A [0020D7E1-002C8FF8] CRC OK
00000118 /sys/guiResData.hex 0001E475 002C8FF9 10AA5AE2 0000000C [002C8FF9-002E746D] CRC OK
00000154 /sys/guiPicData.hex 0001C782 002E746E B7C02498 00000011 [002E746E-00303BEF] CRC OK
00000190 00000118 00303BF0 00000000 00000032 [00303BF0-00303D07]
Offset CRC32 Flags Filesize Endianes Version Rsvd
000001CC C2B9DDD5 00000003 00102387 AA5555AA 4010200 00000000 [000001E4-0010256A] CRC OK
0010256B 841B75C9 00000000 000C435A AA5555AA 4010200 00000000 [00102583-001C68DC] CRC OK
001C68DD 138E13B9 00000000 00046EEC AA5555AA 4010200 00000000 [001C68F5-0020D7E0] CRC OK
0020D7E1 9B4EA177 00000000 000BB800 AA5555AA 4010200 00000000 [0020D7F9-002C8FF8] CRC OK
002C8FF9 7E7781CF 00000001 0001E45D AA5555AA 4010200 00000000 [002C9011-002E746D] CRC OK
002E746E 566E7022 00000001 0001C76A AA5555AA 4010200 00000000 [002E7486-00303BEF] CRC OK
File Processed OK
For studying the footer section:
80 00 00 00 01 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00
00303C04
3D C1 E9 75 76 7B CB 1C D9 4B 1D 03 9B 07 92 CA
55 0C 9B 09 07 42 8E 53 B3 6D E5 28 40 19 E1 62
6A 22 DD 67 57 BC 56 FA EC D9 BE 71 B2 6D E8 DF
12 54 CE 89 00 27 64 F5 FE E6 67 69 45 91 0B 70
81 D9 F4 29 79 14 87 35 28 3A 85 CC 31 0F 79 3B
67 7C AC 89 02 94 4E FA D8 E1 A1 F1 BF 75 CC A6
82 1E EA C5 1C 9B A4 31 CE 5A BF 81 34 D8 50 38
11 C5 C2 A5 0B 7D B0 E2 93 A9 26 A1 E1 A0 5D 07
A7 AA 06 06 06 06 06 06 06 06 06 06 06 06 06 06
06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06
06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06
06 C6 CE 5F F0 80 11 A2 32 C3 53 E4 74 05 96 26
B7 79 78 78 78 78 78 78 78 78 78 78 78 78 78 78
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78
78 78 E8 57 C7 36 A6 15 85 F4 63 D3 42 B2 21 91
01 00 01 00
b = 90
60 54 EB E7 57 CB 8B 4B 78 59 9B F0 F7 D3 CD 75
6F 96 94 71 DF 89 45 79 49 72 5A 0C 93 DC 13 04
7B A3 CD C6 26 FA 04 17 79 D5 29 4C FC 27 11 78
1A CC B5 DF C6 5C 09 09 82 D9 C9 3B 86 42 2B 00
E6 CF 7A 40 21 4C 50 8E 12 B4 90 68 5D CC C6 19
D5 7B 3B A9 B3 D5 20 5C CB 64 B5 96 F4 3B 22 8D
F9 26 83 EE D6 E5 7F 9C CA E6 DC 2F 72 A7 AF 28
91 D6 64 D7 CE D0 94 56 98 3F 4C 58 28 78 C5 00
14 87 52 C2 31 A1 10 80 EF 5E CE 3D AD 1C 8C FB
6A DA 49 B9 28 98 07 77 E6 55 C5 34 A4 13 83 F2
61 D1 40 B0 1F 8F FE 6D DD 4C BC 2B 9B 0A 7A E9
58 88 FF 00 00 00 00 00 00 00 00 00 00 00 00 00
93 E5 75 05 96 27 B7 48 D8 69 F9 8A 1B AB 3C CC
5D ED 7E 0F 9F 30 C0 51 E1 72 02 93 24 B4 45 D5
66 F6 87 18 A8 39 C9 5A EA 7B 0C 9C 2D BD 4E DE
6F FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00
F:\zscan\original\RIGOL\DS1000\DS1000Z-00_04_02_04_07\DS1000ZUpdate.GEL / CRC32: 34B5A5E1
00000000 - File Type: DS1000Z
00000010 - Version: 00.04.02.04.07
00000020 - Bitmask: 00000700
00000024 - # Sections: 7
Offset Section Name SectiSz StartAdr CRC32 Type
00000028 /sys/SparrowAPP.out 00103DB2 000001CC 055C830F 00000001 [000001CC-00103F7D] CRC OK
00000064 /sys/SparrowFPGA.hex 000C4372 00103F7E 028E2956 00000005 [00103F7E-001C82EF] CRC OK
000000A0 /sys/SparrowDGFPGA.hex 00046F04 001C82F0 C00B6623 00000006 [001C82F0-0020F1F3] CRC OK
000000DC /sys/logo.hex 000BB818 0020F1F4 329211E5 0000000A [0020F1F4-002CAA0B] CRC OK
00000118 /sys/guiResData.hex 0001E541 002CAA0C BF5BC175 0000000C [002CAA0C-002E8F4C] CRC OK
00000154 /sys/guiPicData.hex 0001DECB 002E8F4D ABE4D204 00000011 [002E8F4D-00306E17] CRC OK
00000190 00000118 00306E18 00000000 00000032 [00306E18-00306F2F]
Offset CRC32 Flags Filesize Endianes Version Rsvd
000001CC 966AA825 00000003 00103D9A AA5555AA 4020407 00000000 [000001E4-00103F7D] CRC OK
00103F7E C9AF5D56 00000000 000C435A AA5555AA 4020407 00000000 [00103F96-001C82EF] CRC OK
001C82F0 138E13B9 00000000 00046EEC AA5555AA 4020407 00000000 [001C8308-0020F1F3] CRC OK
0020F1F4 9B4EA177 00000000 000BB800 AA5555AA 4020407 00000000 [0020F20C-002CAA0B] CRC OK
002CAA0C 5A6C6418 00000001 0001E529 AA5555AA 4020407 00000000 [002CAA24-002E8F4C] CRC OK
002E8F4D 42893702 00000001 0001DEB3 AA5555AA 4020407 00000000 [002E8F65-00306E17] CRC OK
File Processed OK
For studying the footer section:
80 00 00 00 01 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00
00306E2C
0F B7 16 CC 80 18 B7 9C 91 FB 91 22 AF 28 2C 02
5E 03 D9 70 0A 1F 11 D6 B2 9D B6 89 0C F3 74 ED
2C 54 AB 89 CF DB 42 95 E8 BB 53 D8 A2 42 C7 41
61 0E 00 8E D5 BA F3 9F 4F 02 A4 07 7A 76 9D 3C
5A 87 DA 16 C8 DF E1 1C CC 4D 16 2A 8D 72 77 05
AC 2D DE 0A 8B E3 2D 04 B3 D3 C9 D8 74 3D EB DC
45 9E AD 58 85 8F FE 12 CE 06 C0 BE 6F D5 59 C9
8F 64 6C 65 CA 73 4D 34 EF 2D 6C 40 5A 6C A0 BC
01 1C 2A 79 C8 17 67 B6 05 55 A4 F3 42 92 E1 30
80 CF 1E 6E BD 0C 5C AB FA 49 99 E8 37 87 D6 25
75 C4 13 63 B2 01 51 A0 EF 3E 8E DD 2C 7C CB 1A
6A B9 08 58 A7 F6 45 95 E4 33 83 D2 21 71 C0 0F
66 C8 77 28 D9 89 3A EB 9B 4C FD AD 5E 0F C0 70
21 D2 82 33 E4 94 45 F6 A6 57 08 B9 69 1A CB 7B
2C DD 8D 3E EF 9F 50 01 B2 62 13 C4 74 25 D6 86
37 E8 98 49 FA AA 5B 0C BD 6D 1E CF 7F 30 E1 91
01 00 01 00
b = 4F
57 B0 BF 26 8B D4 23 B9 5F 79 C0 02 3F 69 1E A4
B1 07 8E D5 20 E6 88 FE 8B 26 F0 74 A7 3F 71 9A
8A 63 6B F9 F0 AD C4 C8 CC 4F 98 CE 48 99 CF FA
CA 28 CB 09 01 97 80 DD 3E A1 F4 08 2C D8 B0 00
1A 96 39 C4 C5 2B 7D 07 06 D7 EF 52 05 39 8D 6B
61 31 32 AD 7D 24 BE E4 E2 52 97 F5 E1 F9 F6 37
EF 97 F5 F0 6C C5 84 E7 F2 7A 83 D0 D1 86 59 19
2E 52 A9 F2 A6 9E C8 FE 08 96 24 47 B1 12 95 00
76 42 01 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
50 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
F:\zscan\original\RIGOL\DS1000\DS1000Z-00_04_03_00_01\DS1000ZUpdate.GEL / CRC32: 467EDE17
00000000 - File Type: DS1000Z
00000010 - Version: 00.04.03.00.01
00000020 - Bitmask: 00000700
00000024 - # Sections: 8
Offset Section Name SectiSz StartAdr CRC32 Type
00000028 /sys/SparrowAPP.out 00104803 00000208 89F833BF 00000001 [00000208-00104A0A] CRC OK
00000064 /sys/SparrowFPGA.hex 000C4372 00104A0B 89E2A45C 00000005 [00104A0B-001C8D7C] CRC OK
000000A0 /sys/SparrowDGFPGA.hex 00046F04 001C8D7D E81C63CB 00000006 [001C8D7D-0020FC80] CRC OK
000000DC /sys/logo.hex 000BB818 0020FC81 C59881AD 0000000A [0020FC81-002CB498] CRC OK
00000118 /sys/guiResData.hex 0001E697 002CB499 3571B927 0000000C [002CB499-002E9B2F] CRC OK
00000154 /sys/guiPicData.hex 0001DECB 002E9B30 D34315FD 00000011 [002E9B30-003079FA] CRC OK
00000190 /sys/SparrowConfig.hex 000BB818 003079FB D3654F59 00000010 [003079FB-003C3212] CRC OK
000001CC 00000118 003C3213 00000000 00000032 [003C3213-003C332A]
Offset CRC32 Flags Filesize Endianes Version Rsvd
00000208 68CFAD01 00000003 001047EB AA5555AA 4030001 00000000 [00000220-00104A0A] CRC OK
00104A0B C9AF5D56 00000000 000C435A AA5555AA 4030001 00000000 [00104A23-001C8D7C] CRC OK
001C8D7D 138E13B9 00000000 00046EEC AA5555AA 4030001 00000000 [001C8D95-0020FC80] CRC OK
0020FC81 9B4EA177 00000000 000BB800 AA5555AA 4030001 00000000 [0020FC99-002CB498] CRC OK
002CB499 2C75C357 00000001 0001E67F AA5555AA 4030001 00000000 [002CB4B1-002E9B2F] CRC OK
002E9B30 42893702 00000001 0001DEB3 AA5555AA 4030001 00000000 [002E9B48-003079FA] CRC OK
003079FB 5DEF7058 00000000 000BB800 AA5555AA 4030001 00000000 [00307A13-003C3212] CRC OK
File Processed OK
For studying the footer section:
80 00 00 00 01 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00
003C3227
4C CE F5 B1 EB 0C 61 85 16 F7 B7 2E 53 C6 CC D6
BA FE 11 77 7A C2 43 24 00 21 ED A1 00 9B 56 BA
B6 E2 E9 41 BF 1A 80 0D 45 D3 EF F8 65 7E D4 4E
6C BE 29 F8 21 D0 F6 40 83 82 00 15 31 78 AB 88
9F 6E 27 95 98 E2 58 25 41 AD 87 AD D5 C1 38 B1
CE CE CE D0 B1 19 17 D5 7C 44 B0 91 41 47 2F EE
78 8A 10 7E 7F E5 9F 3B 93 6C 76 69 8D 65 14 C0
52 5F 33 13 58 E1 E2 2A AA 5B FB 94 AB BA 75 4A
09 00 B0 35 BD 44 CC 53 DB 62 EA 71 F9 80 08 90
17 9F 26 AE 35 BD 44 CC 53 DB 62 EA 71 F9 80 08
90 17 9F 26 AE 35 BD 44 CC 53 DB 62 EA 71 F9 80
08 90 17 9F 26 AE 35 BD 44 CC 53 DB 62 EA 71 F9
8C 5D D3 4B C4 3C B5 2D A6 1E 97 0F 88 00 79 F1
69 E2 5A D3 4B C4 3C B5 2D A6 1E 97 0F 88 00 79
F1 69 E2 5A D3 4B C4 3C B5 2D A6 1E 97 0F 88 00
79 F1 69 E2 5A D3 4B C4 3C B5 2D A6 1E 97 0F 88
01 00 01 00
b = 87
1F 19 B9 ED A0 39 07 A3 AD 06 3F 2E CB B7 35 B8
14 D1 5C 3B B6 77 70 CA 1E B8 FC 29 00 13 47 23
98 3C BC 8C 83 56 35 3A EB F1 86 07 ED 7E 4C 3F
D5 A0 83 CB 6C 94 32 F5 B0 28 1E AC 40 00 AB 00
FA 51 91 87 11 E3 E1 35 D9 CC 2E DB 8B FE FD FD
A2 29 B1 3A A3 92 18 5E 8C DC CF 38 6F FD 6C B3
C4 5E 6B 61 E9 D7 18 3C 1C 7C 0E 88 34 93 CA FD
17 AB 07 6E 3B 4B D4 A3 AB E4 0B 2C CA 61 A3 00
6A DA 02 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
AA 03 00 00 00 00 00 00 00 00 00 00 00 00 01 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
F:\zscan\original\RIGOL\DS1000\DS1000Z-00_04_03_01_05\DS1000Z(ARM)Update_00.04.03.01.05\DS1000ZUpdate.GEL / CRC32: 27C20EF7
00000000 - File Type: DS1000Z
00000010 - Version: 00.04.03.01.05
00000020 - Bitmask: 00000700
00000024 - # Sections: 10
Offset Section Name SectiSz StartAdr CRC32 Type
00000028 /sys/SparrowAPP.out 0010DBA2 00000280 49EF88AB 00000001 [00000280-0010DE21] CRC OK
00000064 /sys/SparrowFPGA.hex 000C4372 0010DE22 EEA6ED8E 00000005 [0010DE22-001D2193] CRC OK
000000A0 /sys/SparrowDGFPGA.hex 00046F04 001D2194 122B4672 00000006 [001D2194-00219097] CRC OK
000000DC /sys/logo.hex 000BB818 00219098 FF0E53FF 0000000A [00219098-002D48AF] CRC OK
00000118 /sys/guiResData.hex 0001F5CE 002D48B0 7AC4FCE7 0000000C [002D48B0-002F3E7D] CRC OK
00000154 /sys/guiPicData.hex 0001E3E4 002F3E7E BD466AF3 00000011 [002F3E7E-00312261] CRC OK
00000190 /sys/SparrowConfig.hex 000BB818 00312262 E9F39D0B 00000010 [00312262-003CDA79] CRC OK
000001CC /sys/SparrowWaveTable.hex 000020E8 003CDA7A 140046C9 0000000B [003CDA7A-003CFB61] CRC OK
00000208 /sys/SparrowCalFile.hex 00022EFD 003CFB62 28D1126D 0000000F [003CFB62-003F2A5E] CRC OK
00000244 00000118 003F2A5F 00000000 00000032 [003F2A5F-003F2B76]
Offset CRC32 Flags Filesize Endianes Version Rsvd
00000280 162BBC30 00000003 0010DB8A AA5555AA 4030105 00000000 [00000298-0010DE21] CRC OK
0010DE22 C9AF5D56 00000000 000C435A AA5555AA 4030105 00000000 [0010DE3A-001D2193] CRC OK
001D2194 138E13B9 00000000 00046EEC AA5555AA 4030105 00000000 [001D21AC-00219097] CRC OK
00219098 9B4EA177 00000000 000BB800 AA5555AA 4030105 00000000 [002190B0-002D48AF] CRC OK
002D48B0 95909E61 00000001 0001F5B6 AA5555AA 4030105 00000000 [002D48C8-002F3E7D] CRC OK
002F3E7E E3D36C78 00000001 0001E3CC AA5555AA 4030105 00000000 [002F3E96-00312261] CRC OK
00312262 5DEF7058 00000000 000BB800 AA5555AA 4030105 00000000 [0031227A-003CDA79] CRC OK
003CDA7A 27F4C06F 00000000 000020D0 AA5555AA 4030105 00000000 [003CDA92-003CFB61] CRC OK
003CFB62 1E61A8F6 00000000 00022EE5 AA5555AA 4030105 00000000 [003CFB7A-003F2A5E] CRC OK
File Processed OK
For studying the footer section:
80 00 00 00 01 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00
003F2A73
8A E9 5F BF 27 BC 39 C4 58 84 80 AE 68 84 23 AC
FC 9D 3A 2D 12 DA 5C 0E 4B D2 54 2C 9D 47 C6 05
D8 5B F1 CA 76 4D 76 56 87 FA 47 69 4E 9A D4 DD
CC F1 E3 19 B2 ED C7 A9 2E DB 9A 3B BB 38 A7 82
AA 12 2F DA A8 CA 6E 62 80 3D B2 B0 E7 04 45 D2
24 42 7B 6D F2 68 80 F8 16 2B F6 49 A9 82 6E 52
5F 74 D2 E0 D9 F9 4A B4 BA B5 74 5F D4 5B 76 84
3C D0 92 9D 74 9D 52 96 55 E0 45 B9 BA 81 D3 3D
A3 30 20 2B 37 43 4F 5B 67 73 7F 8B 97 A3 AF BB
C7 D3 DF EB F7 03 10 1C 28 34 40 4C 58 64 70 7C
88 94 A0 AC B8 C4 D0 DC E8 F4 00 0D 19 25 31 3D
49 55 61 6D 79 85 91 9D A9 B5 C1 CD D9 E5 F1 FD
4F 79 6B 5F 53 47 3B 2F 23 17 0B FF F2 E6 DA CE
C2 B6 AA 9E 92 86 7A 6E 62 56 4A 3E 32 26 1A 0E
02 F6 E9 DD D1 C5 B9 AD A1 95 89 7D 71 65 59 4D
41 35 29 1D 11 05 F9 EC E0 D4 C8 BC B0 A4 98 8C
01 00 01 00
b = 0C
FF 52 BC 10 6C F5 66 E5 6D 8D 7D 9E 4C 5C EF 6C
B0 45 D6 BD 96 52 C8 6E 9F 1A 90 5C C1 5F D2 05
CB 42 CC 99 39 04 21 F5 1A 81 C2 D8 B1 F1 1F 1C
FF 18 FE 28 B5 E4 B1 87 00 A1 54 E9 5D CE 31 00
76 EA 13 CA A4 D2 83 83 AD 76 F7 01 44 6D BA 53
B1 DB 20 1E AF 31 55 D9 03 24 FB 5B C7 AC A4 94
AD CE 38 52 57 83 E0 56 68 6F 3A 31 B2 45 6C 86
4B EB B9 D0 B3 E8 A9 F9 C4 5B CC 4C 59 2C 8A 00
9D 1D 01 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
CC 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
F:\zscan\original\RIGOL\DS1000\DS1000Z-00_04_03_02_03\DS1000ZUpdate.GEL / CRC32: E9E67092
00000000 - File Type: DS1000Z
00000010 - Version: 00.04.03.02.03
00000020 - Bitmask: 00000700
00000024 - # Sections: 10
Offset Section Name SectiSz StartAdr CRC32 Type
00000028 /sys/SparrowAPP.out 0010A814 00000280 C8A599FA 00000001 [00000280-0010AA93] CRC OK
00000064 /sys/SparrowFPGA.hex 000C4372 0010AA94 EDBD3A3D 00000005 [0010AA94-001CEE05] CRC OK
000000A0 /sys/SparrowDGFPGA.hex 00046F04 001CEE06 BFF26E4F 00000006 [001CEE06-00215D09] CRC OK
000000DC /sys/logo.hex 000BB818 00215D0A 8F0DC137 0000000A [00215D0A-002D1521] CRC OK
00000118 /sys/guiResData.hex 000206A8 002D1522 5A77FD58 0000000C [002D1522-002F1BC9] CRC OK
00000154 /sys/guiPicData.hex 0001E6A4 002F1BCA 99FE002B 00000011 [002F1BCA-0031026D] CRC OK
00000190 /sys/SparrowConfig.hex 000BB818 0031026E 99F00FC3 00000010 [0031026E-003CBA85] CRC OK
000001CC /sys/SparrowWaveTable.hex 000020E8 003CBA86 724E92AA 0000000B [003CBA86-003CDB6D] CRC OK
00000208 /sys/SparrowCalFile.hex 00022EFD 003CDB6E E9F29192 0000000F [003CDB6E-003F0A6A] CRC OK
00000244 00000118 003F0A6B 00000000 00000032 [003F0A6B-003F0B82]
Offset CRC32 Flags Filesize Endianes Version Rsvd
00000280 96C1C31B 00000003 0010A7FC AA5555AA 4030203 00000000 [00000298-0010AA93] CRC OK
0010AA94 C9AF5D56 00000000 000C435A AA5555AA 4030203 00000000 [0010AAAC-001CEE05] CRC OK
001CEE06 138E13B9 00000000 00046EEC AA5555AA 4030203 00000000 [001CEE1E-00215D09] CRC OK
00215D0A 9B4EA177 00000000 000BB800 AA5555AA 4030203 00000000 [00215D22-002D1521] CRC OK
002D1522 60ECEBCB 00000001 00020690 AA5555AA 4030203 00000000 [002D153A-002F1BC9] CRC OK
002F1BCA 541C43A8 00000001 0001E68C AA5555AA 4030203 00000000 [002F1BE2-0031026D] CRC OK
0031026E 5DEF7058 00000000 000BB800 AA5555AA 4030203 00000000 [00310286-003CBA85] CRC OK
003CBA86 27F4C06F 00000000 000020D0 AA5555AA 4030203 00000000 [003CBA9E-003CDB6D] CRC OK
003CDB6E 1E61A8F6 00000000 00022EE5 AA5555AA 4030203 00000000 [003CDB86-003F0A6A] CRC OK
File Processed OK
For studying the footer section:
80 00 00 00 01 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00
003F0A7F
7C AB 7E 46 BB B8 D1 D3 A5 C9 F3 A7 82 8F 1F 25
47 10 9C 63 45 0A 76 CF AA 0D DD 7B 17 3F 7E A6
E6 BD 2A 5D FF 9B 34 A0 93 FB 45 83 8E CD 4E 03
9A FE BE 22 13 AE 7F B4 0D 61 90 A2 74 4F A9 DB
EE E4 1B 76 76 86 A0 77 C3 0F FB 0F FA 22 43 8F
A8 69 6A FB D3 94 93 19 84 BC 3A DC C7 11 7C 68
8D 20 13 24 AB 24 E8 43 41 F5 8C 7B 6D 70 F9 7C
EA 77 3C 93 33 39 60 DD 19 B2 0C F7 E6 E8 39 29
3B C1 5B FC 9E 41 E4 86 29 CC 6E 11 B4 56 F9 9B
3E E1 83 26 C9 6B 0E B1 53 F6 98 3B DE 80 23 C6
68 0B AE 50 F3 95 38 DB 7D 20 C3 65 08 AB 4D F0
92 35 D8 7A 1D C0 62 05 A8 4A ED 8F 32 D5 77 1A
A5 09 64 C1 1E 7C D9 36 94 F1 4E AC 09 67 C4 21
7F DC 39 97 F4 51 AF 0C 6A C7 24 82 DF 3C 9A F7
54 B2 0F 6D CA 27 85 E2 3F 9D FA 57 B5 12 70 CD
2A 88 E5 42 A0 FD 5A B8 15 73 D0 2D 8B E8 45 A3
01 00 01 00
b = A2
A7 34 64 89 5C B6 2C 8C BB 3D C4 D5 0E 78 65 C9
48 6F 58 7C BC DE A7 5E 96 56 84 7F 79 FE 9A 20
BD F1 BC 4C 4B 45 3B 05 55 1A C2 5D C5 62 40 52
47 08 26 E7 35 2E 5C EE A5 56 E2 52 81 BA 71 00
BF 57 31 2F D1 84 40 BA A9 97 26 DD 6A 35 F9 E7
A3 06 AA DE 58 BC 5E 86 94 6F 8F D4 61 4E 5C EA
B2 E8 7D 31 5B 76 DD DA 7B D2 0B 9D 32 D7 03 29
39 69 D0 CA 0D B5 7F 9F 7D B9 B6 43 D5 79 6D 00
27 0A 02 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
FC 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
F:\zscan\original\RIGOL\DS1000\DS1000Z-00_04_04_00_07\DS1000ZUpdate.GEL / CRC32: 4F68463D
00000000 - File Type: DS1000Z
00000010 - Version: 00.04.04.00.07
00000020 - Bitmask: 00000700
00000024 - # Sections: 10
Offset Section Name SectiSz StartAdr CRC32 Type
00000028 /sys/SparrowAPP.out 001097D0 00000280 1CCB275E 00000001 [00000280-00109A4F] CRC OK
00000064 /sys/SparrowFPGA.hex 000C4372 00109A50 041EA3FF 00000005 [00109A50-001CDDC1] CRC OK
000000A0 /sys/SparrowDGFPGA.hex 00046F04 001CDDC2 98BD1B9C 00000006 [001CDDC2-00214CC5] CRC OK
000000DC /sys/logo.hex 000BB818 00214CC6 046D5DC1 0000000A [00214CC6-002D04DD] CRC OK
00000118 /sys/guiResData.hex 000B6B34 002D04DE 9D96DD8E 0000000C [002D04DE-00387011] CRC OK
00000154 /sys/guiPicData.hex 0001E6BF 00387012 8B4B6D52 00000011 [00387012-003A56D0] CRC OK
00000190 /sys/SparrowConfig.hex 000BB818 003A56D1 12909335 00000010 [003A56D1-00460EE8] CRC OK
000001CC /sys/SparrowWaveTable.hex 000020E8 00460EE9 F5EC3227 0000000B [00460EE9-00462FD0] CRC OK
00000208 /sys/SparrowCalFile.hex 00022EFD 00462FD1 372075C9 0000000F [00462FD1-00485ECD] CRC OK
00000244 00000118 00485ECE 00000000 00000032 [00485ECE-00485FE5]
Offset CRC32 Flags Filesize Endianes Version Rsvd
00000280 E0469303 00000003 001097B8 AA5555AA 4040007 00000000 [00000298-00109A4F] CRC OK
00109A50 C9AF5D56 00000000 000C435A AA5555AA 4040007 00000000 [00109A68-001CDDC1] CRC OK
001CDDC2 138E13B9 00000000 00046EEC AA5555AA 4040007 00000000 [001CDDDA-00214CC5] CRC OK
00214CC6 9B4EA177 00000000 000BB800 AA5555AA 4040007 00000000 [00214CDE-002D04DD] CRC OK
002D04DE 271E3AB5 00000000 000B6B1C AA5555AA 4040007 00000000 [002D04F6-00387011] CRC OK
00387012 01873014 00000001 0001E6A7 AA5555AA 4040007 00000000 [0038702A-003A56D0] CRC OK
003A56D1 5DEF7058 00000000 000BB800 AA5555AA 4040007 00000000 [003A56E9-00460EE8] CRC OK
00460EE9 27F4C06F 00000000 000020D0 AA5555AA 4040007 00000000 [00460F01-00462FD0] CRC OK
00462FD1 1E61A8F6 00000000 00022EE5 AA5555AA 4040007 00000000 [00462FE9-00485ECD] CRC OK
File Processed OK
For studying the footer section:
80 00 00 00 01 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00
00485EE2
64 29 7F D9 1A C9 9B D5 74 5C 2B 8E A3 5E 57 7A
62 DF 99 D4 BA DC 33 FE F2 37 40 E8 78 71 12 E6
10 E9 B4 B4 B5 54 17 47 73 65 9D EB 5D 4F A1 10
3E CF 7E 43 35 A9 0B A8 28 1F A3 8D 26 F2 A4 0E
44 2B 67 F0 BE E1 A3 63 CA 9F 17 56 53 32 7A F4
F8 07 7F 8C 0D 91 A7 C9 8E 99 8B 22 A9 6D 4E 0D
BE 89 A2 56 A7 58 B6 C7 99 39 48 54 91 5A 11 39
F4 D6 0C D7 7D 99 26 24 7A 94 7C 52 1E B9 17 D0
A3 30 20 2B 37 43 4F 5B 67 73 7F 8B 97 A3 AF BB
C7 D3 DF EB F7 03 10 1C 28 34 40 4C 58 64 70 7C
88 94 A0 AC B8 C4 D0 DC E8 F4 00 0D 19 25 31 3D
49 55 61 6D 79 85 91 9D A9 B5 C1 CD D9 E5 F1 FD
4F 79 6B 5F 53 47 3B 2F 23 17 0B FF F2 E6 DA CE
C2 B6 AA 9E 92 86 7A 6E 62 56 4A 3E 32 26 1A 0E
02 F6 E9 DD D1 C5 B9 AD A1 95 89 7D 71 65 59 4D
41 35 29 1D 11 05 F9 EC E0 D4 C8 BC B0 A4 98 8C
01 00 01 00
b = 0C
4D 06 50 9E D3 76 3C 6A FD D9 9C F3 FC AB 98 AF
8B FC AA D9 B3 C8 13 D2 BA F3 F0 8C 10 FD 92 5A
78 45 04 F8 ED 80 37 5B 7B 61 8C CE 34 1A 60 C3
E5 6A 0D C6 AC 14 6A FB 6F 5A D2 B0 3D FD A3 00
7D 70 B8 4D 27 56 24 F0 63 44 C8 13 1C 07 5B E1
F1 0C 91 AA 37 C7 E9 17 E8 FF FD A0 33 03 F0 BB
78 4F 74 34 91 4E B8 D6 B4 60 7B 93 DC B1 74 A8
6F 5D 9F 76 28 50 E9 F3 55 7B 6F 51 29 D1 3B 00
9D 1D 01 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
CC 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
F:\zscan\original\RIGOL\DS1000\DS1000Z-00_04_04_01_01\DS1000ZUpdate.GEL / CRC32: A623D8BC
00000000 - File Type: DS1000Z
00000010 - Version: 00.04.04.01.01
00000020 - Bitmask: 00000700
00000024 - # Sections: 10
Offset Section Name SectiSz StartAdr CRC32 Type
00000028 /sys/SparrowAPP.out 00107791 00000280 865DD4FE 00000001 [00000280-00107A10] CRC OK
00000064 /sys/SparrowFPGA.hex 000C4372 00107A11 C72D7DD0 00000005 [00107A11-001CBD82] CRC OK
000000A0 /sys/SparrowDGFPGA.hex 00046F04 001CBD83 AD60366F 00000006 [001CBD83-00212C86] CRC OK
000000DC /sys/logo.hex 000BB818 00212C87 1F2E52B7 0000000A [00212C87-002CE49E] CRC OK
00000118 /sys/guiResData.hex 000B6B34 002CE49F 9C2E4FC0 0000000C [002CE49F-00384FD2] CRC OK
00000154 /sys/guiPicData.hex 0001E6BF 00384FD3 10D74A0D 00000011 [00384FD3-003A3691] CRC OK
00000190 /sys/SparrowConfig.hex 000BB818 003A3692 09D39C43 00000010 [003A3692-0045EEA9] CRC OK
000001CC /sys/SparrowWaveTable.hex 000020E8 0045EEAA B1CE7C07 0000000B [0045EEAA-00460F91] CRC OK
00000208 /sys/SparrowCalFile.hex 00022EFD 00460F92 91673CA7 0000000F [00460F92-00483E8E] CRC OK
00000244 00000118 00483E8F 00000000 00000032 [00483E8F-00483FA6]
Offset CRC32 Flags Filesize Endianes Version Rsvd
00000280 82AC1341 00000003 00107779 AA5555AA 4040101 00000000 [00000298-00107A10] CRC OK
00107A11 C9AF5D56 00000000 000C435A AA5555AA 4040101 00000000 [00107A29-001CBD82] CRC OK
001CBD83 138E13B9 00000000 00046EEC AA5555AA 4040101 00000000 [001CBD9B-00212C86] CRC OK
00212C87 9B4EA177 00000000 000BB800 AA5555AA 4040101 00000000 [00212C9F-002CE49E] CRC OK
002CE49F 271E3AB5 00000000 000B6B1C AA5555AA 4040101 00000000 [002CE4B7-00384FD2] CRC OK
00384FD3 01873014 00000001 0001E6A7 AA5555AA 4040101 00000000 [00384FEB-003A3691] CRC OK
003A3692 5DEF7058 00000000 000BB800 AA5555AA 4040101 00000000 [003A36AA-0045EEA9] CRC OK
0045EEAA 27F4C06F 00000000 000020D0 AA5555AA 4040101 00000000 [0045EEC2-00460F91] CRC OK
00460F92 1E61A8F6 00000000 00022EE5 AA5555AA 4040101 00000000 [00460FAA-00483E8E] CRC OK
File Processed OK
For studying the footer section:
80 00 00 00 01 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00
00483EA3
12 54 D6 19 55 24 20 80 04 13 9B 27 A6 0E E7 C7
95 91 CA 26 62 2D 1E 22 45 ED 67 A9 FA 27 00 83
6A 3E 80 E6 76 DE 0C 2F 76 84 EF 91 46 67 68 5D
B8 8E 13 EA 40 0B BD 4D EA 67 58 66 D0 25 EA 4B
11 D1 1D 3C 69 FC 5E E6 E6 03 BE 40 5D CC 0B C7
BE 31 30 B1 E0 15 9B 6A 39 3D 55 A6 CD 72 C8 81
61 AA A5 F3 46 D8 95 B1 E0 E2 0F DA CF 02 1F 80
94 C9 9C 18 CC 63 C7 08 25 B3 9A F3 51 27 AD C7
7B 17 24 6A B5 00 4C 97 E2 2D 79 C4 0F 5B A6 F1
3C 88 D3 1E 6A B5 00 4C 97 E2 2D 79 C4 0F 5B A6
F1 3C 88 D3 1E 6A B5 00 4C 97 E2 2D 79 C4 0F 5B
A6 F1 3C 88 D3 1E 6A B5 00 4C 97 E2 2D 79 C4 0F
75 C3 74 29 DE 92 47 FC B0 65 1A CF 83 38 ED A1
56 0B C0 74 29 DE 92 47 FC B0 65 1A CF 83 38 ED
A1 56 0B C0 74 29 DE 92 47 FC B0 65 1A CF 83 38
ED A1 56 0B C0 74 29 DE 92 47 FC B0 65 1A CF 83
01 00 01 00
b = 4B
4F 46 7C 74 65 E9 99 AE E7 AA E7 28 5C 78 06 9B
1D CE BC CC BD 3D E3 9B 73 D0 FE F5 FB DD 6A A2
3E C6 BD D8 1C 39 1C F4 EF B2 D2 28 92 68 1E C7
D7 62 9B 27 32 B1 18 5D AF E0 86 49 67 71 EB 00
C3 CE 65 D0 48 26 D4 A7 F2 5B 61 2E 96 51 DB E2
25 E3 2D F9 74 F4 C5 E0 FA 49 AD 49 BB AB 4D 51
7C 11 57 F0 8E 6C 74 DB 56 A3 1B 32 72 F0 58 05
64 E4 03 CA C9 AB 5B E7 4F 29 5B FF A9 CA 9B 00
F3 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
6A 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
F:\zscan\original\RIGOL\DS1000\DS1000Z-00_04_04_03_02\DS1000ZUpdate.GEL / CRC32: 22AD4A12
00000000 - File Type: DS1000Z
00000010 - Version: 00.04.04.03.02
00000020 - Bitmask: 00000700
00000024 - # Sections: 10
Offset Section Name SectiSz StartAdr CRC32 Type
00000028 /sys/SparrowAPP.out 00109213 00000280 AE2F3D1D 00000001 [00000280-00109492] CRC OK
00000064 /sys/SparrowFPGA.hex 000C4372 00109493 679334B7 00000005 [00109493-001CD804] CRC OK
000000A0 /sys/SparrowDGFPGA.hex 00046F04 001CD805 E4FDFCA9 00000006 [001CD805-00214708] CRC OK
000000DC /sys/logo.hex 000BB818 00214709 AC2CE5C4 0000000A [00214709-002CFF20] CRC OK
00000118 /sys/guiResData.hex 000B6A2C 002CFF21 EFF83A4B 0000000C [002CFF21-0038694C] CRC OK
00000154 /sys/guiPicData.hex 0001E6BF 0038694D B8D72DB2 00000011 [0038694D-003A500B] CRC OK
00000190 /sys/SparrowConfig.hex 000BB818 003A500C BAD12B30 00000010 [003A500C-00460823] CRC OK
000001CC /sys/SparrowWaveTable.hex 000020E8 00460824 B0445B96 0000000B [00460824-0046290B] CRC OK
00000208 /sys/SparrowCalFile.hex 0002329C 0046290C FBE2BA34 0000000F [0046290C-00485BA7] CRC OK
00000244 00000118 00485BA8 00000000 00000032 [00485BA8-00485CBF]
Offset CRC32 Flags Filesize Endianes Version Rsvd
00000280 A7E7BDB2 00000003 001091FB AA5555AA 4040302 00000000 [00000298-00109492] CRC OK
00109493 C9AF5D56 00000000 000C435A AA5555AA 4040302 00000000 [001094AB-001CD804] CRC OK
001CD805 138E13B9 00000000 00046EEC AA5555AA 4040302 00000000 [001CD81D-00214708] CRC OK
00214709 9B4EA177 00000000 000BB800 AA5555AA 4040302 00000000 [00214721-002CFF20] CRC OK
002CFF21 D7825E44 00000000 000B6A14 AA5555AA 4040302 00000000 [002CFF39-0038694C] CRC OK
0038694D 01873014 00000001 0001E6A7 AA5555AA 4040302 00000000 [00386965-003A500B] CRC OK
003A500C 5DEF7058 00000000 000BB800 AA5555AA 4040302 00000000 [003A5024-00460823] CRC OK
00460824 558BD392 00000000 000020D0 AA5555AA 4040302 00000000 [0046083C-0046290B] CRC OK
0046290C 7717C897 00000000 00023284 AA5555AA 4040302 00000000 [00462924-00485BA7] CRC OK
File Processed OK
For studying the footer section:
80 00 00 00 01 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00
00485BBC
69 61 C8 4B 81 93 48 87 AE DC 31 7B 04 1B 57 3C
45 71 96 FD B0 5A E8 5B 82 4F 3C C8 A9 D0 7C 84
26 05 55 DD 3B 95 A0 FF 1C C3 A7 A4 E0 56 6D 13
E9 E3 BC EB 2D 1F 61 3E E6 DA 53 DC A5 C6 60 D2
51 AC 46 EC F8 D0 29 35 7A 19 AE 53 F7 E1 A4 53
02 81 DE 43 CC D6 4D 3F B3 2E 47 43 8C E3 54 E5
A3 D9 7C CE 03 36 A6 96 14 A8 05 1D 89 8A 1B 91
A0 3E 03 5A 80 8E DE F6 19 A3 B7 4B D6 18 3F 1B
2B 8E F0 54 B9 1D 82 E6 4A AF 13 78 DC 40 A5 09
6E D2 36 9B FF 63 C8 2C 91 F5 59 BE 22 87 EB 4F
B4 18 7D E1 45 AA 0E 73 D7 3B A0 04 69 CD 31 96
FA 5E C3 27 8C F0 54 B9 1D 82 E6 4A AF 13 78 DC
63 DA 74 10 AC 47 E3 7E 1A B6 51 ED 88 24 C0 5B
F7 92 2E CA 65 01 9D 38 D4 6F 0B A7 42 DE 79 15
B1 4C E8 83 1F BB 56 F2 8D 29 C5 60 FC 97 33 CF
6A 06 A2 3D D9 74 10 AC 47 E3 7E 1A B6 51 ED 88
01 00 01 00
b = 64
4C DF E2 01 D2 80 D0 AB 6E 37 28 0D 32 E5 BC 3D
E2 A9 6A 6C BB 01 2A 39 FB 64 ED 14 91 53 9B 3F
7C F7 E2 06 00 F5 9C 96 4F 92 11 AA 82 93 46 87
F9 8F 03 CE AB 39 17 8F D3 62 77 9C 00 BD F2 00
81 41 3F 49 BA F6 B4 24 CD D1 CA D4 DC 2A 52 65
79 5C 1D E7 D4 43 1E 74 4D 2C A9 0A B7 73 48 3D
60 FA 02 B8 51 E9 BD 12 F4 EC AE 2A FB 60 55 30
A3 A6 CF 8A 15 87 3B B8 3F 2E A6 9E 8E 34 C0 00
04 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
26 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
The code that does this is:
i = start of the "last 128 bytes"
byte b = (byte)(((byte)(buffer[i + 110] - buffer[i + 111]) + (byte)(buffer[i + 109] - buffer[i + 110])) >> 1);
i = i + 127;
byte a = buffer[i];
for (int i0 = 0; i0 < 64; i0++, i--)
{
buffer[i] -= a;
a += b;
if (a >= 0x100 - b) a++;
}
a = buffer[i];
for (int i0 = 0; i0 < 64; i0++, i--)
{
buffer[i] -= a;
a -= b;
if (a <= b) a--;
}
I know that the main goal are the first 128 bytes but if you can see any of these decodes in memory dumps, that would help.
Resuming:
00.04.00.00.00 - decoded OK
00.04.00.00.00 (boot) - decoded OK
00.04.01.02.00 - has different pattern (investigating ATM...)
00.04.02.04.07 - decoded OK
00.04.03.00.01 - decoded OK (although has a few bytes = 01)
00.04.03.01.05 - decoded OK
00.04.03.02.03 - decoded OK
00.04.04.00.07 - decoded OK
00.04.04.01.01 - decoded OK
00.04.04.03.02 - decoded OK
If anyone has other FW versions please post them or pm me.
Edit1: Added 00.04.03.00.01 version
Edit2 (Apr 13th): The footer contains BOTH the software version and SparrowAPP.out CRC in a obfuscated way. All of my theories above were far from correct. I'll leave them as historical information.
-
#133 Reply
Posted by
ankerwolf
on 27 Jan, 2018 08:35
-
Hello tv84,
Would you post the final version of the program or a link, please?
The version I used is unpack8 in this thread here.
LG Wolfgang
-
#134 Reply
Posted by
tv84
on 27 Jan, 2018 09:36
-
Hi Wolfgang,
My prog is a work in progress (in C#) and it's not easy to fork a small unpacker. Have you got problems or doubts about the unpack8 that you refer?
I saw in the thread some probs about CRCs but the one used by Rigol here is the standard CRC-32 hash (IEEE 802.3; CRC-32).
And, you can used my parsings as a reference to check the output of other parsers/unpackers and compare sizes and CRCs. I try to maintain full offsets so that everyone can check things by themselves.
-
#135 Reply
Posted by
tv84
on 28 Jan, 2018 17:46
-
It throws a CRC mismatch every time that I did not notice before. I downloaded the firmware zip archives from both rigol sources again, but the CRC mismatch won’t resolve.
The reason it throws a CRC mismatch is because the "footer" (last "file" listed) has a CRC of 0x00000000 in every Rigol DS1000Z FW release. It's a feature, not a bug.
Curious fact: The CRC will be shown correct if you extract the FW package from a memory dump.
-
#136 Reply
Posted by
tv84
on 01 Feb, 2018 22:14
-
A bit of OT but, for the record, may be useful to others who want to verify Rigol CRC's:
The CRC-16 that Rigol uses in the DG5000 is a "customized" CRC-16 with the following parameters:
width=16 poly=0xA011 init=0x1008 refin=false refout=false xorout=0x0000 check=0xAC1A residue=0x0000 name="CRC-16/RIGOL 1" The CRC-16 that Rigol uses in the DG4000 is a "customized" CRC-16 with the following parameters:
width=16 poly=0xA011 init=0x0528 refin=false refout=false xorout=0x0000 check=0x147D residue=0x0000 name="CRC-16/RIGOL 3" The CRC-16 that Rigol uses in the DG1000 is a "customized" CRC-16 with the following parameters:
width=16 poly=0xA011 init=0xFFFF refin=false refout=false xorout=0x0000 check=0x5CC1 residue=0x0000 name="CRC-16/RIGOL 4" Many Rigol equipments use this variation:
width=16 poly=0x1021 init=0xEBCC refin=false refout=false xorout=0x0000 check=0x6809 residue=0x0000 name="CRC-16/RIGOL 2" And, other Rigol equipments (that include a CRC-16), use the more common:
width=16 poly=0x1021 init=0xFFFF refin=false refout=false xorout=0x0000 check=0x29b1 residue=0x0000 name="CRC-16/CCITT-FALSE"Edit1: Included a parsing of many Rigol file types (showing the CRCs).
Edit2: Added Rigol 2 CRC16 type.
Edit3: Added Rigol 3 and 4 CRC16 types.
-
#137 Reply
Posted by
janekivi
on 11 Feb, 2018 12:17
-
Inside DS1054Z was at one address
Copyright(C) Freescale Semiconductor, Inc. 2009. All rights reserved.
The somewhat disturbed crew - JC, TT, PZ, MJ, CR, CS, DM
No pygmies were harmed during testing..really...
N T L F J C M
-
#138 Reply
Posted by
janekivi
on 14 Feb, 2018 16:08
-
Another interesting thing happened to me...
In GEL header is update version like this:
DS1000Z 00.04.04.00.07
I changed this by one number to:
DS1000Z 00.04.04.00.08
Scope found a newer software version than my 00.04.04.00.07 and updated it successfully to... 00.04.04.00.07
(I have 00.04.04.00.07 with modified logo in my scope for all kind of hacks right now)
-
#139 Reply
Posted by
janekivi
on 17 Feb, 2018 11:46
-
So all the info for update messagebox is read from the header.
This info is not critical and you can write there what you like...
To get this "found update file file" box you actually don't need anything.
Empty file is good enough.
0 byte DS1000ZUpdate.GEL file is showing of course no info
-
#140 Reply
Posted by
smithnerd
on 18 Feb, 2018 02:20
-
I haven't looked at more recent firmwares, but on 4.3.2.3, I have that cluster of 3 DCP related functions marked as:
start_dcp_memcopy
start_dcp_memfill
start_dcp_blit
Janekivi,
Here is a code worth investigating (addr = 0x400CF3B0):
int __fastcall DCP_Operation1(int result, int a2, int a3, unsigned __int8 a4)
}
-
#141 Reply
Posted by
tv84
on 18 Feb, 2018 10:33
-
I haven't looked at more recent firmwares, but on 4.3.2.3, I have that cluster of 3 DCP related functions marked as:
start_dcp_memcopy
start_dcp_memfill
start_dcp_blit
Thankx, that's what I was about to compare. There are also 3 in 4.4.0.7 but, at first sight, I say the 2nd and 3rd may be a little different... investigating ATM...
Edit:
Hex-rays bug that shows me all the 3 Ops as the MEMCOPY...
But, going back to ASM, we can see the 3 different CTRL0 setups: 0x13, 0x10013, 0x83 (memcopy, memfill & memblit)
Now, back to the drawing board. The "footer" hashes/etc are not DCP-based...
-
#142 Reply
Posted by
janekivi
on 10 Mar, 2018 21:56
-
After long pause there I managed to get some good guys (better than me) interested
about this GEL file format and what is hidden inside footer. Now we know something.
They did the hard work for me and I did the... dirty work (better than nothing) and
thanks to
tv84 and
smithnerd and some more I finally got rid of those "Pluses".
-
#143 Reply
Posted by
tv84
on 10 Mar, 2018 22:15
-
After long pause there I managed to get some good guys (better than me) interested
about this GEL file format and what is hidden inside footer. Now we know something.
They did the hard work for me and I did the... dirty work (better than nothing) and
thanks to tv84 and smithnerd and some more I finally got rid of those "Pluses".
A good team effort. All essential! After a false positive, success.
-
-
After long pause there I managed to get some good guys (better than me) interested
about this GEL file format and what is hidden inside footer. Now we know something.
They did the hard work for me and I did the... dirty work (better than nothing) and
thanks to tv84 and smithnerd and some more I finally got rid of those "Pluses".
What kind of level of reverse engineering did you guys do? Is there assembly or source to look at?
-
#145 Reply
Posted by
janekivi
on 11 Mar, 2018 09:22
-
As we know only some things and can't make new correct firmware file, there is not much more to show.
For me this is schi-fi so they disassembled some functions and guided me what the scope checks. I made
all kind of changes in my already hacked GEL (my TV screen logo) and did hardware testings. I did try all
with notepad and calculator and using hex editor made 500mb worth of new files. Of course they didn't
work and scope was bricked many times. When they reached to the last crucial function, my last file did
work. So this is manually hacked together workaround to replace SparrowAPP and worked in those
special conditions I currently have.
They made good work even not having a scope and using my memory dumps and test results. But this
is not the end as I like to know more what there is going on. Like what is inside footer exactly and how
the firmware version is checked. If You like to help with disassembly, we can widen our team. There are
all kind of cryptic and complex functions and we don't know what they are doing too. Half of software is
running scope and second half is keeping us away...
One day we come up with something to show, I hope.
-
#146 Reply
Posted by
tv84
on 11 Mar, 2018 09:45
-
What kind of level of reverse engineering did you guys do? Is there assembly or source to look at?
This was never a task to be kept secret. Resuming, there are 2 .IDBs (a big one from the APP and another from bootloader) to play around.
They are somewhat commented in some critical areas but most of the things are unknown.
We focused on the primary goal but now many other things will be possible.
Once the footer processing got identified, things evolved very quickly. Then with a bit of luck and plenty of grit we discovered a workaround.
The footer
only does (as far as we understand it) a obfuscation of the CRC of the APP. It's not encryption, it's not hashing. The footer is processed in 3 blocks: 0x80 bytes + 0x80 bytes + 0x04 bytes (and the 20 bytes header indicates the number os bytes, etc of those blocks).
So you can't change the APP because you would have to change it's CRC and the footer validation prevents that. Unless you go around it...
The footer is processed by the function below. As you can see they went to great troubles to obfuscate the thing.
In order to understand the footer we need to reverse all those functions. Any help is more than welcome!
-
#147 Reply
Posted by
janekivi
on 11 Mar, 2018 10:40
-
I think exactly this "chinese" function I like to see translated to me, at least in "english".
-
#148 Reply
Posted by
janekivi
on 15 Mar, 2018 20:45
-
Any chance of finding a way to swap out the small font?
After many years I was thinking here... what font did you think back then?
All other stuff can't be resized, you need then bigger screen to fit them,
but for those there is font size to choose:
-
#149 Reply
Posted by
janekivi
on 03 Apr, 2018 18:24
-
Some time ago I just run sbtool source through compiler to get windows version
https://www.eevblog.com/forum/testgear/rigol-dsxxxx-gel-firmware-file-format/msg991398/#msg991398but this wasn't the brightest idea... If you redirect output to a file, this is not binary file any more
and windows is adding
0D everywhere before
0A. This is end of line for him.
How to solve this... I did add extra option for this.
-s filenameNow it is possible to save decrypted section output to a binary file:
sbtool -z -x 0 -s bootloader SparrowBootloader.sbsbtool - executable utility (sbtool.exe)
-z - zero key is used for decryption
-x - extract section
0 - section index
-s - save output to a binary file
bootloader - new output file name
SparrowBootloader.sb - file to be processed
Now the output seems to be correct...
C:\Sbtool>sbtool -z -x 0 -s output SparrowBootloader.sb
---- Boot image header ----
Signature 1: STMP
Signature 2: sgtl
Format version: 1.1
Flags: 0x0000
Image blocks: 19764
First boot tag block: 9
First boot section ID: 0x00000000
Key count: 1
Key dictionary block: 7
Header blocks: 6
Section count: 1
Section header size: 1
Timestamp: 446216079000000
Product version: 999.999.999
Component version: 999.999.999
Drive tag: 0x0000
SHA-1 digest of header:
0x00000000: 2d 5c 14 b8 10 81 fe 5f ee e2 09 ee 75 55 fe 80
0x00000010: bb 35 50 44
Header digest is correct.
---- Section table ----
Section 0:
Identifier: 0x0
Offset: 10 blocks (160 bytes)
Length: 19752 blocks (316032 bytes)
Flags: 0x00000001
0x1 = ROM_SECTION_BOOTABLE
---- Key dictionary ----
Default key was found in key dictionary.
Data encryption key:
0x00000000: 9f e8 30 4c bf d7 b7 7c c6 66 cd 98 de bd 69 07
---- SHA-1 digest of entire image ----
0x00000000: fe 61 57 33 93 5d 97 24 a6 22 be 3b ae 28 55 52
0x00000010: f0 12 97 f1
Image digest is correct.
---- Boot tags ----
0000: @ block 000009 | id=0x00000000 | length=019752 | flags=0x00000001
0x1 = ROM_SECTION_BOOTABLE
C:\Sbtool>sbtool -z -x 0 -s output1 SparrowBootloader1.sb
---- Boot image header ----
Signature 1: STMP
Signature 2: sgtl
Format version: 1.1
Flags: 0x0000
Image blocks: 20539
First boot tag block: 9
First boot section ID: 0x00000000
Key count: 1
Key dictionary block: 7
Header blocks: 6
Section count: 1
Section header size: 1
Timestamp: 483460119000000
Product version: 999.999.999
Component version: 999.999.999
Drive tag: 0x0000
SHA-1 digest of header:
0x00000000: 49 d6 c3 73 8f a6 fd 2a e9 05 aa f7 e0 90 e7 ef
0x00000010: 79 ba 54 63
Header digest is correct.
---- Section table ----
Section 0:
Identifier: 0x0
Offset: 10 blocks (160 bytes)
Length: 20527 blocks (328432 bytes)
Flags: 0x00000001
0x1 = ROM_SECTION_BOOTABLE
---- Key dictionary ----
Default key was found in key dictionary.
Data encryption key:
0x00000000: 46 a9 67 2a 46 19 03 68 62 22 30 9f 13 ed 63 02
---- SHA-1 digest of entire image ----
0x00000000: c0 27 4b 0b 57 c7 68 78 49 ab 8d 04 2f 3e 3c 23
0x00000010: 14 2d 9d 42
Image digest is correct.
---- Boot tags ----
0000: @ block 000009 | id=0x00000000 | length=020527 | flags=0x00000001
0x1 = ROM_SECTION_BOOTABLE