Rigol DS1000Z series buglist continued (latest: 00.04.04.04.03, 2019-05-30)

[metrologist]

Tempting. Somebody needs to test this. Where did you come from?

[konnor]

Tempting. Somebody needs to test this. Where did you come from?

i don't change version, 00.04.04.03.02

[Fungus]

Is it possible to 'downgrade' to standard firmware after installing this, or install newer versions?

(ie. has your firmware's version check been disabled?)

This should maybe have its own thread.

[ebastler]

i don't change version, 00.04.04.03.02

OK, thanks. I assume you have tested that one can upgrade to the same version number multiple times, and can go back and forth between the regular firmware and your modfied version?

[konnor]

Where did you come from?

The city is listed in the profile. 
I have no relationship to Rigol.

[konnor]

can go back and forth between the regular firmware and your modfied version?

Yes.

Actually, downgrde is also not a problem, it's enough to write a special signature on a flash drive. But very different firmware may have compatibility problems of the settings.

[Fungus]

Actually, downgrde is also not a problem, it's enough to write a special signature on a flash drive.

This should definitely have its own thread with more info. People have been trying to do that for ages.

Keep the first post in the thread up to date with the latest version, installation info, etc.

[konnor]

I did not know that this was a big problem. It is more difficult to find the algorithm for generating keys at times.
The only problem with the distribution of this signature is that it opens other additional functions that make it easy to kill an oscilloscope. And it is not tied to either the serial number or the firmware version.

[metrologist]

Where did you come from?

The city is listed in the profile. 
I have no relationship to Rigol.

Yes, well there is more to that...

Actually, downgrde is also not a problem, it's enough to write a special signature on a flash drive.

This should definitely have its own thread with more info. People have been trying to do that for ages.

Keep the first post in the thread up to date with the latest version, installation info, etc.

Ages, yes. And this out of the blue, it falls from the sky, like candy.

I agree, new thread, or added to the other one (whatever it was called, the FW hacking rewrite uber thread that has been going on since the beginning of time...)

[rob040]

Thanks Konnor for sharing this firmware.
I am not able to unzip both files into one .GEL file. Get an error. Anyone else tried it?

[RoGeorge]

I publish my attempt to correct some errors on DS1000Z firmware (2017).
The archive in this message contains the modified firmware.
In the next post is attached an archive with a library and tools for
make&load plugins. Two simple examples are included.

changes on firmware:
1) Ext port 6000 funcs - read/write/call (see rigolif programm)
2) pluses -> pulses
3) rnage -> range (decoder:conf:range)
4) Changed USB Buffer Size (40->200) - test, please. I don't use USB IF
5) Disabled set bandwidth to license maximum on start (BW20 fix)

directory in plugin archive:
rigolif           sample programm for 6000/UDP
add_info          mixed info
libb              plugin library       
patch             port 6000/UDP patch sources
plugin_simple     sample of simple plugin (single LED cycle and exit)
plugin_thread     plugin with thread (permanent LED cycle)

!!!WARNING!!!
This is Beta version. Tested only in my Rigol
AS IS, AS IS, AS IS.....

P.S. The archive is divided into two parts, because I can not attach a file more than a megabyte.

Thank you very much, this is quite a nice surprise.
Can you please upload again the attachments DS1000ZUpdate.zip and DS1000ZUpdate.01.zip?

They can not be opened as zip archives. I tried to unzip them in both Win10 and Debian8. Also concatenate then unzip in Deb8, still doesn't work.

[Daruosha]

I publish my attempt to correct some errors on DS1000Z firmware (2017).
The archive in this message contains the modified firmware.
In the next post is attached an archive with a library and tools for
make&load plugins. Two simple examples are included.

changes on firmware:
1) Ext port 6000 funcs - read/write/call (see rigolif programm)
2) pluses -> pulses
3) rnage -> range (decoder:conf:range)
4) Changed USB Buffer Size (40->200) - test, please. I don't use USB IF
5) Disabled set bandwidth to license maximum on start (BW20 fix)

directory in plugin archive:
rigolif           sample programm for 6000/UDP
add_info          mixed info
libb              plugin library       
patch             port 6000/UDP patch sources
plugin_simple     sample of simple plugin (single LED cycle and exit)
plugin_thread     plugin with thread (permanent LED cycle)

!!!WARNING!!!
This is Beta version. Tested only in my Rigol
AS IS, AS IS, AS IS.....

P.S. The archive is divided into two parts, because I can not attach a file more than a megabyte.

Thank you very much, this is quite a nice surprise.
Can you please upload again the attachments DS1000ZUpdate.zip and DS1000ZUpdate.01.zip?

They can not be opened as zip archives. I tried to unzip them in both Win10 and Debian8. Also concatenate then unzip in Deb8, still doesn't work.

Same here, I couldn't unzip the files.

[Fungus]

I agree, new thread, or added to the other one (whatever it was called, the FW hacking rewrite uber thread that has been going on since the beginning of time...)

It really needs to be a thread where konnor can edit the first post and keep it updated.

ie. A completely new thread.

[TurboTom]

I've been able to extract the GEL file with the unZIP tool integrated with "Total Commander". Flashed it and found it to be "very beta"... Pallette got messed up so the screen looks somewhat funny now, see attached screenshot. Since it's quite late already over here, I didn't do any serious testing - this will have to wait until tomorrow. But I can confirm the "Pluses" spelling error is corrected. Kudos to @konnor for all the effort -- I guess this might be the starting point for some serious improvements! Thanks a lot.

Cheers,
Thomas

[RoGeorge]

I've been able to extract the GEL file with the unZIP tool integrated with "Total Commander". Flashed it and found it to be "very beta"...

I've extracted a GEL, too, but it seems to be a corrupt file. When I try to unpack it, I get this output (Corrupt input data):

Code: [Select]

python-3.6.1-embed-amd64\python.exe" unpack.py DS1000ZUpdate.GEL
instrument series:      DS1000Z
firmware version:       00.04.04.03.02
updateType:     0x00070000
found 10 files

{'filename': '/sys/SparrowAPP.out', 'type': 1, 'start': 640, 'length': 1066438, 'crc': 1846034540, 'unknown': (0, 0, 0)}
{'filename': '/sys/SparrowFPGA.hex', 'type': 5, 'start': 1067078, 'length': 803698, 'crc': 1737700535, 'unknown': (0, 0, 0)}
{'filename': '/sys/SparrowDGFPGA.hex', 'type': 6, 'start': 1870776, 'length': 290564, 'crc': 3841850537, 'unknown': (0, 0, 0)}
{'filename': '/sys/logo.hex', 'type': 10, 'start': 2161340, 'length': 768024, 'crc': 1763548407, 'unknown': (0, 0, 0)}
{'filename': '/sys/guiResData.hex', 'type': 12, 'start': 2929364, 'length': 748076, 'crc': 4026022475, 'unknown': (0, 0, 0)}
{'filename': '/sys/guiPicData.hex', 'type': 17, 'start': 3677440, 'length': 124855, 'crc': 2240924515, 'unknown': (0, 0, 0)}
{'filename': '/sys/SparrowConfig.hex', 'type': 16, 'start': 3802295, 'length': 768024, 'crc': 2145407491, 'unknown': (0, 0, 0)}
{'filename': '/sys/SparrowWaveTable.hex', 'type': 11, 'start': 4570319, 'length': 8424, 'crc': 2957269910, 'unknown': (0, 0, 0)}
{'filename': '/sys/SparrowCalFile.hex', 'type': 15, 'start': 4578743, 'length': 144028, 'crc': 4225940020, 'unknown': (0, 0, 0)}
{'filename': '', 'type': 50, 'start': 4722771, 'length': 280, 'crc': 1792089006, 'unknown': (0, 0, 0)}
writing /header  (640 bytes)
writing /sys/SparrowAPP.out.header       (24 bytes)
writing /sys/SparrowAPP.out      (1066414 bytes)
writing /sys/SparrowAPP.out.decompressed         (3934200 bytes)
writing /sys/SparrowFPGA.hex.header      (24 bytes)
writing /sys/SparrowFPGA.hex     (803674 bytes)
writing /sys/SparrowDGFPGA.hex.header    (24 bytes)
writing /sys/SparrowDGFPGA.hex   (290540 bytes)
writing /sys/logo.hex.header     (24 bytes)
writing /sys/logo.hex    (768000 bytes)
writing /sys/guiResData.hex.header       (24 bytes)
writing /sys/guiResData.hex      (748052 bytes)
writing /sys/guiPicData.hex.header       (24 bytes)
writing /sys/guiPicData.hex      (124831 bytes)
writing /sys/guiPicData.hex.decompressed         (4031460 bytes)
writing /sys/SparrowConfig.hex.header    (24 bytes)
writing /sys/SparrowConfig.hex   (768000 bytes)
writing /sys/SparrowWaveTable.hex.header         (24 bytes)
writing /sys/SparrowWaveTable.hex        (8400 bytes)
writing /sys/SparrowCalFile.hex.header   (24 bytes)
writing /sys/SparrowCalFile.hex  (144004 bytes)
Corrupt input data
Traceback (most recent call last):
  File "unpack.py", line 160, in checkCreateDir
    os.makedirs(os.path.dirname(filename))
  File "os.py", line 220, in makedirs
FileNotFoundError: [WinError 3] The system cannot find the path specified: ''

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "unpack.py", line 173, in <module>
    main()
  File "unpack.py", line 109, in main
    save(h["filename"],bFile)
  File "unpack.py", line 166, in save
    checkCreateDir(prefix + filename) #create missing directories
  File "unpack.py", line 162, in checkCreateDir
    if exc.errno != errno.EEXIST:
NameError: name 'errno' is not defined
Did you tested the checksum for the GEL file you extracted with Total Commander?

[Adrian_Arg.]

You could do an update of only the correction of the word pluses by pulses, which is the only thing that bothers me

[konnor]

Pallette got messed up so the screen looks somewhat funny now, see attached screenshot.

Thanks, I somehow did not notice this. I will correct. Most likely the error is not in the palette. Probably in my converter pic <-> bmp (16bit / 24bit) is not quite correctly converted. This error should not influence the operation of the device.

[DC1MC]

Quick naive question @konnor, is this firmware suitable for the MSO1000Z series ?

 Thanks,
 DC1MC

[ebastler]

Probably in my converter pic <-> bmp (16bit / 24bit) is not quite correctly converted.

So you seem to have gone deeper into the firmware than just patching bytes in the binary, right? I would love to learn a bit more about your approach. Could you open a new thread and describe how you did this, please?

(Also, as others have mentioned above, being able to "trick" the scope into accepting any firmware versions, including downgrades to older versions, would be a feat of its own. And you mentioned something about generating keys independent from serial numbers, which I'm sure would also interest quite a few people here...)

Thank you for the work you have done, and for sharing the results with us. And thank you in advance for sharing some of the background! 

[Wirehead]

Awesome work being done 

[janekivi]

You could do an update of only the correction of the word pluses by pulses, which is the only thing that bothers me

You definitely haven't seen our thread...
https://www.eevblog.com/forum/testgear/rigol-dsxxxx-gel-firmware-file-format/msg1453156/#msg1453156

[Adrian_Arg.]

my English is not good, so I understand you have to do it yourself, but I do not understand that, that's why I asked Konnor if he did not have the latest firmware version of the rigol ds1054z with the correction of the word pulses

[konnor]

I did not engage in the reverce-engineering of those 8 kilobytes of operations with long integers. I use the original firmware signature and adjust the firmware so that the codes match. The current firmware is laid out in a separate thread.

[janekivi]

We did it exactly the same way but finally we like to make new footer and test more
before we release something reliable.

[ankerwolf]

Simply rename the .01.zip to .z01 and open the .zip with any packer (WinRAR, 7zip, ...).