Is DS1054Z with firmware 00.04.02.04.07 hackable? - Page 1
Forum section: electronics / testgear

author: Rilker
author_rank: Newbie
timestamp: February 19, 2015, 10:54:05 am
content: Hi,I just bought the DS1054Z, and made the upgrade to the firmware version 00.04.02.04.07.Looks like the hack is not working anymore. I tried DSFR and DSER options. Both, shows as invalid key.Any thoughts or confirmation ? Anyway to downgrade to hackable version and then upgrade 00.04.02.04.07 (that fixes Timing / 5uv problem) ?Cheers!

author: Fungus
author_rank: Super Contributor
timestamp: February 19, 2015, 11:09:57 am
content: Quote from: Rilker on February 19, 2015, 10:54:05 amHave you tried individual items?

author: Solder_Junkie
author_rank: Frequent Contributor
timestamp: February 19, 2015, 05:03:05 pm
content: 4.02 firmware certainly worked, maybe you updated too quickly to a later version?Maybe Rigol have clamped down on the freeloaders and changed the encryption, that happened with the DSA-815 spectrum analyser.

author: Solder_Junkie
author_rank: Frequent Contributor
timestamp: February 19, 2015, 06:51:08 pm
content: If Rigol have stopped the keygen hack by changing the keys, it should still be straightforward to change the low pass filter switching in hardware to increase the bandwidth to that of the 1104Z. The memory depth and triggering is a tougher job though. Dave Jones reverse engineered much of the input circuitry and shows the offending filter in a YouTube video.

author: ebastler
author_rank: Super Contributor
timestamp: February 19, 2015, 07:17:46 pm
content: Quote from: Rilker on February 19, 2015, 10:54:05 amHate to spoil the fun of speculating -- but yes, the keygen still works fine with the latest firmware. (That's the version which identifies itself as 00.04.02 SP4 once installed on the scope, right?)As mentioned in the main 1054Z thread: Be sure to read the small print of the scope's serial number correctly, and try re-generating the key a couple of times on the web site, to make sure you get an updated and stable key.Cheers,Jürgen

author: Fungus
author_rank: Super Contributor
timestamp: February 19, 2015, 07:32:10 pm
content: Quote from: Solder_Junkie on February 19, 2015, 06:51:08 pmI don't know about 'straightforward'...But really that's almost the least interesting of the upgrade options IMHO. In practice the 100MHz won't make much real difference to performance of the scope, all the other options are worth more (extra triggers, extra RAM, serial decoders..., etc.)

author: Rilker
author_rank: Newbie
timestamp: February 20, 2015, 10:10:15 am
content: Quote from: Solder_Junkie on February 19, 2015, 05:03:05 pmYou are rightI had install the latest release (00.04.02.04.07) too soon on this unitUpdate FW Notes:Folder Name: DS1000Z(ARM)Update_00.04.02.04.07Filename: DS1000ZUpdate.GEL @ Dec, 26 2014.

author: Solder_Junkie
author_rank: Frequent Contributor
timestamp: February 20, 2015, 12:47:16 pm
content: Quote from: Rilker on February 20, 2015, 10:10:15 am

author: StevenTodd
author_rank: Newbie
timestamp: April 13, 2015, 06:19:15 pm
content: When I key in my serial number, and the desired code (DSFR or DSER) the private key doesnt populate and then when I press the Generate button, it gives and error: invalid private key lenght.how to solve?

author: StevenTodd
author_rank: Newbie
timestamp: April 13, 2015, 10:59:00 pm
content: i tried from a different pc, and it worked.

author: figo
author_rank: Contributor
timestamp: April 14, 2015, 12:57:03 am
content: Hello friendsI am also waiting for a DS1054Z and I have a doubt, which is the private key and where can I get?

author: lukaq
author_rank: Regular Contributor
timestamp: April 14, 2015, 05:52:43 am
content: As far as I know, you don't input it, just serial and what options you would like to have (everything but 500uV)this 500u will never work right, hardware limitation?

author: rezasurmar
author_rank: Newbie
timestamp: April 22, 2015, 12:01:33 pm
content: This code generatorhttp://gotroot.ca/rigol/riglol/works perfectly on the version 00.04.02.04.07

author: theDiver
author_rank: Newbie
timestamp: May 08, 2015, 05:10:10 pm
content: I can confirm it works on Firmware 00.04.02.SP4 on a scope i got yesterday ;-)

author: Mandarin47
author_rank: Contributor
timestamp: July 22, 2015, 10:52:27 pm
content: Has anyone tried it on the newest firmware 00.04.03.SP1?

author: Deathwish
author_rank: Unknown
timestamp: July 23, 2015, 12:51:26 am
content: If I could get through the confusion on doing it I will try, meantime I shouted beetlejuice three times and nope its the same DSO

author: elswi
author_rank: Newbie
timestamp: July 23, 2015, 07:43:54 am
content: Hello from Switzerland (not Sweden nor Swaziland)Yesterday I tried to unlock my new Rigol DS1054Z (SW Ver. 00.04.02.SP4 and Board Ver. 0.1.1) with the Option DSER (all but 0.5mV).Well, it worked very nice: the scope said something like "options installed successfully"! So I turned it off/on and now it shows Model "DS1104Z" and all the options are installed "official". So far so good...I tried to check if I really have now a 100MHz scope the way Dave did it on the DS1052E.... (#70: changing of the rise time and higher horizontal resolution: 5ns->2ns)But nothing changed! Maximum h-res is still 5ns and I have the exact same rise time on my square-wave signal…Has the unlock failed, or is that normal? If normal, where is the benefit of 100MHz? At least the h-res should be higher with 100MHz, or not?Is there another easy way to check if the unlock really worked?Thanks and cheers!

author: alsetalokin4017
author_rank: Super Contributor
timestamp: July 23, 2015, 03:55:41 pm
content: 1. The unlocking DOES work with the newest firmware. Be very careful about entering your numbers: Don't mistake "5" for "S" or "0" for "O" for example. The best/easiest way to get the key into the scope is to use something like telnet over a LAN connection to the scope. This way you can store your valid unlocking key, and the SCPI commands to install and uninstall, in a text file, from which you can then simply copy-paste the correct code and the SCPI commands into the telnet application.Code::SYSTem:OPTion:INSTall XXXXXXXXXXXXXXXXXXXXXXXXXXXXto install the 28-character key (4 groups of 7 chars but with no hyphens)Code::SYSTem:OPTion:UNINSTallto go back to stock 1054z with no options (or "trial options" if you haven't run out your trial period yet)If you make three mistakes in a row trying to install the code to your scope, you will be "locked out" and you must leave the scope turned on for 12 hours until the "penalty time" runs out before trying again.If the serial number of the scope is hard to read on the "System Info" screen, look at the sticker on the back of the scope, or in your original calibration document that came with the scope. Carefully copy the SN into a text file and save it, so that you can just copy-paste it when you need to use it in the future (like entering it into the keygen program.)2. The unlocking code DSER (all options except 500uV vertical) is not documented or listed in the keygen program for the DS1054Z, but it works anyway. Don't even try the 500uV/div Vertical feature, the hardware of the 1054z does not support it and it can cause problems. I suggest downloading the .zip file from the website and using the stand-alone applications that are in the zipfile. This way you will not be dependent on the website, you can run the keygen locally on your own computer. The zipfile includes a working Windows stand-alone executable, an HTML file version that will open in your browser, a Linux version that can be compiled and run on your linux distro, and an OSX version (I have not tested the OSX but I can confirm that the other three work properly.)3. The horizontal resolution does not change; the fastest timebase setting available will still be 5 ns/div after unlocking. The scope will report that it is now a DS1104Z when asked.4. The higher bandwidth means that you will get more accurate display of high-frequency signals. The right way to test this is to use properly terminated, proper impedance cable connections from your signal source to the scope (not the "150MHz" probes that come with the scope) and a signal generator that can actually produce a fast risetime square wave or a sine wave of known amplitude. Since the DS1054Z has only a fixed 1megohm input impedance, you may need a 50 ohm feedthrough terminator-adapter or a 50 ohm T plus a 50 ohm terminator at the scope end of the 50 ohm connecting BNC cable from your 50 ohm output impedance signal generator. Some people have tested the bandwidth (looking for the -3dB rolloff frequency of a known amplitude sine wave input) and have found that the scope actually exceeds the 50 MHz spec before, and exceeds the 100 MHz spec after, the unlocking.Be sure to let the scope warm up completely and run the Self Calibration routine after applying the unlock key.

author: Deathwish
author_rank: Unknown
timestamp: July 23, 2015, 04:06:03 pm
content: When you say "This way you can store your valid unlocking key" do you mean the one it came with or the one you generated , I find that confusing because it is hardly valid in the term my mind is reading what you are saying if you generated it

author: alsetalokin4017
author_rank: Super Contributor
timestamp: July 23, 2015, 04:15:17 pm
content: Quote from: Deathwish on July 23, 2015, 04:06:03 pmHuh? The scope doesn't come with any unlock keys unless you bought them from your vendor at the time of purchase.QuoteI find this confusing because I can't make any sense of it. Perhaps a translation problem?A "valid" unlock key is one that works. An "invalid" one doesn't work!

author: alsetalokin4017
author_rank: Super Contributor
timestamp: July 23, 2015, 04:20:19 pm
content: To get telnet working on your Windows computer:https://kb.ctera.com/article/how-to-open-a-telnet-session-on-windows-7-or-windows-8-os-16.htmlIf you are using any of the popular Linux distros you probably already have telnet installed and working.Use port 5555 to talk to the scope. Connect the scope to your LAN router and then in the Utility>IO Setting>LAN Conf. menu select "DHCP" and let the scope fetch an IP address from your router.Then at a command prompt start telnet:Code:telnet 192.168.1.105 5555(using your own scope's assigned IP address of course)

author: commie
author_rank: Frequent Contributor
timestamp: July 23, 2015, 05:09:34 pm
content: Quote from: elswi on July 23, 2015, 07:43:54 amI have an official unhacked DS1104Z and it's quickest horizontal time is 5ns, so that's okay.

author: Deathwish
author_rank: Unknown
timestamp: July 23, 2015, 11:40:51 pm
content: Quote from: alsetalokin4017 on July 23, 2015, 04:15:17 pmI was unsure if the scope came with a "basic" key or not and then had to be issued another to unlock the options.In my mind a valid key is one that is genuine from the supplier, as with some software that is cracked with a keygen and then reports home, or upon upgrades, it will pop up saying you have an "invalid" key and kill it.

author: elswi
author_rank: Newbie
timestamp: July 24, 2015, 06:17:38 am
content: Thanks alsetalokin4017 for your explanations!Could you say a bit more to 4.? How can I measure the bw that way?I have connected the trigger out to channel 2 while on ch 1 was a signal. I got a rise time of 2.6ns... does that help in any way?

author: alsetalokin4017
author_rank: Super Contributor
timestamp: July 24, 2015, 04:28:01 pm
content: I was unsure if the scope came with a "basic" key or not and then had to be issued another to unlock the options.Oh, I see. No, the scope doesn't come with any key, but is supplied with a time-limited trial period on all the options except 100MHz bandwidth. Once that trial period has run out I don't know any way to restore the time limited trial options. Installing the unlock key generated from the keygen makes all the options "Official". There probably is a way to restore/reset the time limited trial options but I don't know it; maybe someone else does.QuoteWell, that makes sense, but fortunately Rigol does not seem to work that way. Once a valid (my definition) key is used to make the options "Official" this isn't changed when firmware updates are installed (at least not so far; mine is on its third firmware update by now and I have uninstalled and reinstalled the options several times on each firmware revision). And these scopes never "phone home" over the internet. As far as I can tell, a valid key is the same, for each scope SN, whether it comes from an "authorized" source or not.I also don't know if they store some data that would tell a technician whether or not the scope's options have ever been enabled, after the "uninstall" SCPI command has been used to reset the scope back to stock 1054z with no options enabled. I am guessing that they probably don't.So when I talk about a "valid" key I just mean one that works when it is entered. An invalid key is one that doesn't work and would cause the scope to lock you out for the penalty 12 hours if you tried entering it three times.By the way all of the keys I have seen for DSER options on the 1054z start with the same 2 initial 7-character groups. Only the last 2 groups vary according to your serial number.

author: alsetalokin4017
author_rank: Super Contributor
timestamp: July 24, 2015, 04:41:48 pm
content: Quote from: elswi on July 24, 2015, 06:17:38 amThere is more information on measuring bandwidth in the original, very long, DS1054Z thread and probably in other threads on the forum too."Quick and Dirty" you will be looking for a 3dB reduction in the amplitude of a sine wave signal applied to the scope, as this is one definition of scope bandwidth. So you need a signal source that can actually put out a constant amplitude sine wave in the range of 50-150 MHz, connect it via proper cabling and terminations to the channel, and carefully monitor the amplitude displayed as you sweep the frequency of the generator. When the displayed amplitude has dropped 3dB from the known input value, you've found the 3dB rolloff frequency and then that is your "bandwidth" according to that definition.For a rough comparison you could supply a 100MHz signal to the scope, then use the SCPI commands to "uninstall" the unlock key, reboot, "install" the key, reboot and see if your displayed amplitude of the signal changes much.QuoteProbably not because you don't know whether the risetime and other waveform features are a result of the process generating the signal or the scope's response to it.Still, you could perform the comparison by uninstalling and reinstalling the unlock key and looking at the displayed signal for changes, as I noted above. You can store the waveform as a reference waveform and compare the waveforms before and after unlocking that way.I have not performed such comparisons myself -- yet. I've just been taking the word of those with better signal generators than I've got, who have reported the increased bandwidth after unlocking.(I do have an HP 8640B over in the corner buried under some other stuff; I suppose I should dig it out and fire it up to do some testing of my own, but the thing is huge and heavy, and it would mean cleaning up and rearranging my whole lab to be able to use it ...)

author: MysticForce
author_rank: Newbie
timestamp: July 31, 2015, 09:08:24 pm
content: Quote from: Rilker on February 19, 2015, 10:54:05 amI just got my ds1054z yesterday 7/30/2015 and I can't get the code to work because there is no 1 or zero on the keyboard/editor. Also no matter what option I choose I get the same serial number.

author: MysticForce
author_rank: Newbie
timestamp: July 31, 2015, 09:17:41 pm
content: Quote from: Rilker on February 19, 2015, 10:54:05 amI just got my ds1054z yesterday 7/30/2015 my software v. 00.04.03 and board v. 0.1.1 and I can't get the code to work because there is no 1 or zero on the keyboard/editor. Also no matter what option I choose I get the same serial number. Any help greatly appreciated.

author: dadler
author_rank: Unknown
timestamp: July 31, 2015, 09:31:46 pm
content: None of the keys I have ever generated have contained a 1, and I think is deliberate on Rigol's part (since a 1 is easily confused with I and L).Are you sure you are entering your serial and the DSER option code correctly in the web UI?

author: MysticForce
author_rank: Newbie
timestamp: July 31, 2015, 10:09:08 pm
content: I did it with another browser and everything worked right. Strange stuff. So it still does work with software 00.04.03 thanks everyone for your help.

author: CustomEngineerer
author_rank: Frequent Contributor
timestamp: October 06, 2015, 08:21:34 am
content: Quote from: VanitarNordic on October 06, 2015, 06:19:11 amIt should. It worked for my ds2072a-s.

author: Phili76
author_rank: Contributor
timestamp: October 06, 2015, 12:23:48 pm
content: Worked fine with my DS1104Z-S.