Rigol DS1052E, new firmware - Page 1
Forum section: electronics / general

author: MikeK
author_rank: Super Contributor
timestamp: September 07, 2011, 05:31:34 pm
content: Rigol just emailed me the latest firmware, version 2.06. Has anyone used this? Will it be compatible with the bandwidth hack?

author: A Hellene
author_rank: Frequent Contributor
timestamp: September 07, 2011, 07:33:26 pm
content: Well, you can post it and I will be happy to try to hack this too,as I did with 2.05 SP2 (2.05.02.00), as soon as I reassemblemy dismantled unit.-George

author: saturation
author_rank: Super Contributor
timestamp: September 07, 2011, 08:30:56 pm
content: Thanks! Did they provide release notes as to what's new in 2.6? 2.5 wasn't exactly as bug free as 2.4.If you do have the release notes can you post here?

author: MikeK
author_rank: Super Contributor
timestamp: September 07, 2011, 09:46:16 pm
content: No release notes. Just the instructions and the firmware file. They said it's in production since last week.

author: Zero999
author_rank: Super Contributor
timestamp: September 07, 2011, 10:48:12 pm
content: Someone needs to upload the hacked firmware to a file sharing service.

author: A Hellene
author_rank: Frequent Contributor
timestamp: September 07, 2011, 11:37:51 pm
content: Hero, the v2.06 firmware has not been hackedyet.But, yes, it would be nice if we could lay our hands on it; and this little detail above will no longer be a problem!I am already setting up the hot air station to reball the Cyclone III BGA chip that I have desoldered from the DS1052 mainboard in order to reverse the digital section too --a task that has been accomplished by 85%-90%, since spare time seems to be a luxury for me these days...-George

author: MikeK
author_rank: Super Contributor
timestamp: September 08, 2011, 01:00:15 am
content: George, I sent you a PM. Send me your email.Mike

author: Lightages
author_rank: Unknown
timestamp: September 08, 2011, 03:45:24 am
content: I can host legal files relating to Rigol DS0152E hacking. Please PM me if people want them hosted, for free of course.

author: Unknown
author_rank: Unknown
timestamp: September 08, 2011, 09:24:33 am
content: Quote from: Lightages on September 08, 2011, 03:45:24 amHow can a firmware file with copyrights owned by Rigol be legal to distribute unless Rigol grants permission, even without modification?

author: A Hellene
author_rank: Frequent Contributor
timestamp: September 08, 2011, 03:17:11 pm
content: Quote from: MikeK on September 08, 2011, 01:00:15 amMike, thank you!I appreciate it.I am sorry though for the delayed response. I had to go to anemergency stop modeafter having successfully reballed the FPGA (that took me almost half an hour of intensive focus, placing manually 256 individual solder balls on an FBGA chip pads before baking it with hot air), since Morpheus (the god of dreams) made me an offer I could not refuse at that time!Well, I have also had in mind Alm's thoughts about making public a piece of firmware distributed in a selective manner by its IP owner.The good part is that the created hacked files can be made publicfor educational/testing purposes; the original firmware files cannot be made public without the consent of their legal owner. On the other hand, when something is released in the open, no one can be held account for "finding" it online, even though "internet anonymity" is yet another myth... So, "leaking" is a possible answer to the current problem, since I expect that people will also ask for the original new firmware to test it along with the hacked one; I know I would, as I have already done, above.Anyway, all I will need from the new firmware file in order to hack it is a few specific bytes only! But, in order to test the hack properly, I will have to have access to a working unit loaded with the new firmware. At this time this does not seem to be possible for me because my DS1052 remains unbootable until I finish reversing its mainboard and solder the FPGA back in its place; and the FPGA is not on a socket in order to be removed at will. But I will be glad to try having the latest firmware hacked, since I think I know exactly what it takes to do it.-George

author: Zero999
author_rank: Super Contributor
timestamp: September 08, 2011, 04:15:40 pm
content: Quote from: alm on September 08, 2011, 09:24:33 amHe didn't say anything about actually hosting copyrighted material, read it again.

author: Lightages
author_rank: Unknown
timestamp: September 08, 2011, 06:24:05 pm
content: Exactly, I am willing to host files on my server as long as they are not going to cause me to have a shutdown due to copyright issues. I know this doesn't help with many files but at least I can ensure a reliable and long term free host for things we might want to share that would otherwise cost someone money to host. or the other mess, big file hosters that require membership and advertising to deal with.If people don't want a place to put files for free access, no problem.

author: drieg
author_rank: Regular Contributor
timestamp: September 11, 2011, 10:37:22 am
content: Quote from: MikeK on September 07, 2011, 05:31:34 pmQuote from: A Hellene on September 07, 2011, 07:33:26 pmQuote from: A Hellene on September 07, 2011, 11:37:51 pmI wouldn't be so sure this time. Rigol has changed the firmware header again and you won't be able to hack it just by "guessing" and "playing" with CRC32Nevertheless, using the FW header from version above sill remains an option. But you'll have to wait...

author: A Hellene
author_rank: Frequent Contributor
timestamp: September 11, 2011, 02:53:39 pm
content: Yes, Drieg, I've realised that Rigol has changed the header format once more.Even the <Std. header> field has been changed:Code:---------------------------------------------------------------------------HEX Address: 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14---------------------------------------------------------------------------Fields: |<------ Std. header -------->|<-FW rev.->|<-?->|<- CRC32 ->|??|---------------------------------------------------------------------------v2.05.01.00: 44 53 31 30 30 30 45 20 20 20 82 85 84 88 C3 7B 47 92 39 C8 7Ev2.05.01.02: 44 53 31 30 30 30 45 20 20 20 82 85 84 82 8B B8 96 41 63 FF 33v2.05.02.00: 44 53 31 30 30 30 45 20 20 20 82 85 82 88 C0 7E D7 6A 15 B6 B6v2.06.00.01: 4A E3 3E 5E 1C EA 8D 39 9A 23 82 86 88 84 02 8C E9 A6 50 D0 BC---------------------------------------------------------------------------My suggestion to those who want to upgrade to the new firmware (v2.06 SP0) would also be to wait until a safe downgrade solution is found.-George

author: drieg
author_rank: Regular Contributor
timestamp: September 11, 2011, 06:47:59 pm
content: Quote from: A Hellene on September 11, 2011, 02:53:39 pmWell, the first 10 bytes, that you call a <Std. header> for whatever reason, are quite easy to guess (hints: CRC32, start with encoded FW version, +2B each iteration).Unfortunately to complete the hack you also need to find the answers to your quesion marksWho first will find it, will get a nice present from me for his Rigol scope

author: A Hellene
author_rank: Frequent Contributor
timestamp: September 12, 2011, 09:08:51 am
content: Thank you for the hints, Drieg.I'll look into it when I find some time.By the way, I called the first 10 bytes "Standard Header" because, as far as I know, they had always been the ASCII representation of the string 'DS1000E ' for the "E" models prior to the latest firmware revision.-George

author: drieg
author_rank: Regular Contributor
timestamp: September 12, 2011, 08:18:40 pm
content: ...don't waste your time, seems that Rigol made a stupid mistake and forgot to prevent a FW "upgrade" to the same versionBesides that, I didn't notice any difference between v2.5 and v2.6, at least the menu is very same.

author: A Hellene
author_rank: Frequent Contributor
timestamp: September 12, 2011, 10:20:55 pm
content: Hehe!Thanks, Drieg!-George

author: Flavour Flave
author_rank: Regular Contributor
timestamp: September 12, 2011, 10:44:22 pm
content: Quote from: drieg on September 12, 2011, 08:18:40 pmHi there, Iv'e got a hacked Rigol its 00.02.04 SP1 can I just upgrade it to new firmware? Thanks

author: gmdavies
author_rank: Newbie
timestamp: October 31, 2011, 09:20:48 am
content: Hi Drieg. I have some 1052E v2.06 scopes to upgrade. Can you give me a clue as to how to convince the scope to upgrade to an earlier version of firmware so I can run the hack? I have been doing this with 2.05 for a while, but now all the scopes come with 2,06 which doesn't give me the firmware upgrade option when I insert the memory stick. I have modified header or earlier firmware to be same as you show above for 2.06, but scope still doesn't give an upgrade option. All help much appreciated.

author: vtl
author_rank: Regular Contributor
timestamp: October 31, 2011, 10:11:27 am
content: Does the screen still have that stupid flicker? Not a big deal but no point in upgrading if it doesn't fix anything.

author: gmdavies
author_rank: Newbie
timestamp: October 31, 2011, 11:49:54 am
content: Quote from: vtl on October 31, 2011, 10:11:27 amYes, they appear to have fixed the screen flicker problem in 2.06. Certainly I haven't seen it flicker yet when it did it once a minute or so on 2.05 scopes.

author: gmdavies
author_rank: Newbie
timestamp: November 01, 2011, 09:00:13 am
content: Quote from: gmdavies on October 31, 2011, 09:20:48 amI obviously had my stupid head on yesterday. Have now successfully upgraded a 2.06 scope to 100MHz spec.For anyone as daft as I was yesterday, here is what I did:Take a standard 2.02 SP2 firmware file (from the original upgrading Rigols for Dummies thread) - MD5 Hash: 272086b2037231c62446617436544a77Change the first 21 bytes to be same as v2.06 as shown above [4A E3 3E 5E 1C EA 8D 39 9A 23 82 86 88 84 02 8C E9 A6 50 D0 BC]. I used HxD Hex Editor fromhttp://mh-nexus.de/en/hxd/for thisNow the file has MD5 hash: 19eb82ab1fa4fe57cc9410f2074e9e67Put this file on memory stick, check the MD5 hash and use to downgrade to 2.02 SP2Continue to follow the instructions in the original postThanks for everyone's patience with a newbie!

author: Storeinfinity
author_rank: Contributor
timestamp: November 02, 2011, 06:32:38 am
content: Quote from: drieg on September 12, 2011, 08:18:40 pmGreat job on the coolest 1052E firmware, I saw the short video. Awesome!

author: plasma
author_rank: Newbie
timestamp: April 14, 2012, 06:27:08 am
content: Hi,Where can I download the Rigol 2.02 SP2 firmware that is english? I downloaded 2.02 from Rigol and it was in Chinese. So now my scope shows all menus in chinese. Thank you.

author: TerminalJack505
author_rank: Super Contributor
timestamp: April 14, 2012, 07:39:50 am
content: Quote from: plasma on April 14, 2012, 06:27:08 amTry clicking the Menu button to bring up the Utilities menu and then hit the next-to-bottom menu option (right above the downward pointing arrow) to change language.

author: Mechatrommer
author_rank: Super Contributor
timestamp: April 14, 2012, 10:09:32 am
content: be careful 2.02 FW might not work with your latest pcb revision. iirc i read about it somewhere.