Going back to the .sys file for updating the DSA815: this file appears to contain the updates for all board components, inclusing the FPGA's as well as the MCU. Perhaps this file is merely a container for individual firmwares?
I think that I have just discovered structure of this file. It doesn't contain full firmware, it's a patch for NOR flash containing only blocks of bytes that have been modified. The structure is as follows:
- NULL terminated signature 'DSA800'
- string '000000000' - could be internal version of patched firmware
- 4 bytes, maybe dword (= 0x00000001)
- dword containing numer of patching blocks (= 14)
- table of block descriptors (in this case there are 14 descriptors)
each block descriptor contains 3 dwords:
- position of patching block in the file
- length of patching block
- destination address of this block in NOR flash
position of each block in the file is aligned on 4-byte boundary
Does having a serial number and a licence key allow the encryption keys to be reverse engineered, assuming some of the keys/primes from the DS2000 are similar accross all Rigol lines?
I've sent you PM