Rigol DS1000Z series firmware downgrade is possible(early bootloader revs) - Page 1
Forum section: electronics / testgear

author: TheSteve
author_rank: Unknown
timestamp: February 14, 2016, 05:31:57 am
content: Was playing around with key sequences during power up with my Rigol DS1074Z-S (converted to a DS1104Z of course) and discovered how to force a firmware downgrade. So far I have gone back and forth between a few versions, the oldest being to 4.00.00.00. No side effects of any kind were noted so far. I am sure this work for the entire DS1000Z line including the ever popular DS1054Z.If you follow my instructions you do so at your own risk, if your scope bricks or steals your TV remote I am not responsible!*edit* - this appears to work only with very old boot loader versions such as 0.0.0.11 and 0.0.0.13To downgrade do the following:-Copy the .GEL file with the firmware version you want to a USB stick that you know is compatible with the DS1000Z series.-With the scope powered OFF plug the USB stick into the scope.-Power the scope on.-When the splash screen with "Rigol" appears you should hear a quick beep which indicates it sees a USB device.-As soon as you hear the beep press the "Help" button 3 times quickly.-In a few seconds you should see the channel 1 LED blinking - this indicates it is flashing the firmware.-Once done flashing the scope will boot as normal and tell you it found a firmware update with the same version it just flashed, you can press cancel.-You can then verify the new detailed version info by pressing "menu menu force menu" quickly, then pressing "utility","system", "system info".-I'd reboot at this point before using the scope just for good measure.Being able to downgrade the DS1000Z series of scopes doesn't seem critically important at this point but there does seem to be a laggy version people may want to downgrade from.For me the bigger picture is pondering what other devices this method might possibly work for - my mind instantly goes to the DSA815 spectrum analyzer. There is a slim chance those with the newest bootloader version could use this method to downgrade firmware so that Riglol works again, install all of the licensed options and then upgrade as normal to current firmware while retaining the options. I don't have a DSA815 anymore to try it, if someone does attempt I expect they will have sweaty palms.Attached are before and after system info screen shots from my scope.

author: Lightages
author_rank: Unknown
timestamp: February 14, 2016, 06:00:26 am
content: Good work, and thanks!

author: Mechatrommer
author_rank: Super Contributor
timestamp: February 14, 2016, 06:42:15 am
content: Quote from: TheSteve on February 14, 2016, 05:31:57 amhow is that you dont remove the usb stick while the led is blinking, and brick your scope during the "playing around"? i smell jason chonko of north america is giving you a hint. anyway good info i've put the steps in my readme.txt of my rigol driver folder

author: TheSteve
author_rank: Unknown
timestamp: February 14, 2016, 06:52:15 am
content: Quote from: Mechatrommer on February 14, 2016, 06:42:15 amWell your nose is busted and to be honest I resent your statement, I received no hints from anyone. The only info I had to go on was how the DG1022 is updated, from there it was experiment with button combos to see what happens.btw - anytime you're messing around with trying to flash a firmware update the last thing you'd want to experiment with is pulling out the flash drive. I've also bricked many a device in the past experimenting in similar fashion(thankfully recovered nearly all just fine).

author: nrxnrx
author_rank: Unknown
timestamp: February 14, 2016, 06:58:28 am
content: 00.04.03.02.03 (4.03SP2) here.It almost worked! It blinks the CH1 led for a few seconds, but then it gives up and starts flashing all the leds at ~2Hz . The first time I waited a few minutes, but I also tried seconds and it's safe to just restart at this point.I guess the latest version adds even more unwanted "features". Maybe. I've tried several versions but only one stick. It works fine with the scope for anything else, but I'll try others when they decide to come out of hiding.

author: TheSteve
author_rank: Unknown
timestamp: February 14, 2016, 07:04:48 am
content: Quote from: nrxnrx on February 14, 2016, 06:58:28 amWhat version did you try to downgrade to, perhaps it makes a difference. It may also matter what boot version you have, mine is quite old.

author: nrxnrx
author_rank: Unknown
timestamp: February 14, 2016, 07:21:21 am
content: Quote from: TheSteve on February 14, 2016, 07:04:48 am4.3.0.1, 4.2.4.7 and 4.0.0.0 .Boot 0.0.1.2

author: TheSteve
author_rank: Unknown
timestamp: February 14, 2016, 07:24:45 am
content: Quote from: nrxnrx on February 14, 2016, 07:21:21 amThat is a shame. I used this file specifically -http://gotroot.ca/rigol/DS1000Z-04_00_00_00.7zThere are technically two updates in there, one supposedly for the bootloader and one for the firmware. I have done downgrades to both without an issue.As a test put your current firmware on the flash drive and see if it will flash, if it does then I am thinking your boot version prevents downgrades, if it doesn't then it probably doesn't like your flash drive.

author: nrxnrx
author_rank: Unknown
timestamp: February 14, 2016, 07:32:50 am
content: Quote from: TheSteve on February 14, 2016, 07:24:45 amI tried the two .GEL files in there as well. Nope.Quote from: TheSteve on February 14, 2016, 07:24:45 amIt worked (both your method and the regular one). They do prevent downgrades. Now.Perhaps the SA doesn't have this "feature" yet, though.

author: alsetalokin4017
author_rank: Super Contributor
timestamp: February 14, 2016, 11:33:18 am
content: Well... this is interesting.So it did work with a genuine 1074z unlocked to 1104z, with Boot Version 0.0.0.11 ... but it did NOT work with a 1054z with Boot Version 0.0.1.2? Is that right?So has anyone gotten it to work with an actual 1054z, with any boot version?

author: markone
author_rank: Frequent Contributor
timestamp: February 14, 2016, 12:16:43 pm
content: Quote from: TheSteve on February 14, 2016, 07:24:45 amWhich older FW version do you suggest for best balance between bugfix & UI responsivity ?I'm spotting to many knob miss here & there whith later versions and i wish to downgrade too.

author: ebastler
author_rank: Super Contributor
timestamp: February 14, 2016, 12:51:00 pm
content: Quote from: alsetalokin4017 on February 14, 2016, 11:33:18 amHang on -- the differencemightbe due to the scope model or due to the bootloader version, as you suggest. But I understand that TheSteve and nrxnrx have also been downgrading from differentfirmwareversions: According to the screenshot in the initial post, 4.3.1.05 seems to be the highest version TheSteve tried (successfully), while nrxnrx has not been able to downgrade from 4.3.2.03.Hence, the "no downgrade" policy might also be caused by the later firmware. I'd rather not try, because I still have an earlier, more responsive firmare version on y hacked DS1054Z, and do not want to be stuck with the most recent, sluggish one.

author: markone
author_rank: Frequent Contributor
timestamp: February 14, 2016, 12:56:22 pm
content: Quote from: ebastler on February 14, 2016, 12:51:00 pmCould you please specify which version and maybe suggest where it's possible to download ?

author: nrxnrx
author_rank: Unknown
timestamp: February 14, 2016, 01:45:18 pm
content: Quote from: markone on February 14, 2016, 12:56:22 pmhttps://hamsterpower.org/f/rigolfw/4_03SP1.zip. Not sure atm about the exact version, but it's the second to last public one.I'm not aware of an official link.Edit: The .GEL file contains 00.04.03.01.05, so I guess that's the full version number.

author: markone
author_rank: Frequent Contributor
timestamp: February 14, 2016, 03:14:26 pm
content: Quote from: nrxnrx on February 14, 2016, 01:45:18 pmThanks a lot.I just gave a try on mine DS1074Z but the procedure does not work, operating the help button after the beep results in stucked scope with all keys blinking, i had to recycle the power after a while fearing to have bricked the thingLuckily the scope still works, previous firmware anyway.My booloader is 0.0.1.1, SW 00.04.03.02.03

author: nrxnrx
author_rank: Unknown
timestamp: February 14, 2016, 03:16:12 pm
content: Quote from: alsetalokin4017 on February 14, 2016, 11:33:18 amYes. It worked with the 1074z, but it did not with the 1054z (mine).

author: ebastler
author_rank: Super Contributor
timestamp: February 14, 2016, 03:44:47 pm
content: Quote from: nrxnrx on February 14, 2016, 01:45:18 pmThanks nrxnrx, you beat me to the reply. Yes, that's the version I am also using. Does not have the "extended" FFT and pulse counting features yet, but according to various posts on the forum here is more responsive than the most recent published version. (I did not notice, or found any posts about, differences in responsiveness between the earlier versions; only the most recent one is more sluggish apparently.)

author: Stupid Beard
author_rank: Regular Contributor
timestamp: February 14, 2016, 04:53:26 pm
content: It did not work on my DS1054Z either with boot version 0.0.1.2. I tried going from SP2 to SP1; I don't have any other versions easily to hand.Thanks for trying to find a solution.

author: Fungus
author_rank: Super Contributor
timestamp: February 14, 2016, 07:05:02 pm
content: Quote from: TheSteve on February 14, 2016, 05:31:57 amAnd you just happened to notice that ... how?

author: ebastler
author_rank: Super Contributor
timestamp: February 14, 2016, 07:07:21 pm
content: Quote from: markone on February 14, 2016, 03:14:26 pmSo the fact that it does not allow the downgrade seems to be correlated with the 00.04.03.02.03 firmware, right? TheSteve's initial post mentioned success with the same scope model and bootloader version, but downgrading from an earlier firmware.That's rather annoying, since the most recent firmware is probably the one which most people would like to downgrade from.

author: Marcos
author_rank: Contributor
timestamp: February 14, 2016, 10:38:10 pm
content: @TheSteveBoard version was downgraded too from 4.1.1. to 0.1.1. ?Or maybe your scope is suffering for "random" board version syndrome as my(ex) 1054Z suffered with Boot Version 0.0.1.2

author: TheSteve
author_rank: Unknown
timestamp: February 14, 2016, 11:02:25 pm
content: Quote from: Marcos on February 14, 2016, 10:38:10 pmI suspect the 4 at the beginning indicates the "Source" module is present and wasn't displayed in earlier firmware versions but I don't really know.I am sticking with version 4.3.1.05 as that seems to be a good balance of bugs/performance.At this point it looks like the bootloader is responsible for preventing downgrades when in this mode, mine has got to be one of the earliest revs out there. I can't do a downgrade from the GUI but can from the help button mode.I also tried doing to the bootloader update that is included with version 04.00.00.00 and while it says it was successful and updates the regular firmware I've never seen a change in my bootloader version.

author: ebastler
author_rank: Super Contributor
timestamp: February 15, 2016, 05:03:35 am
content: Quote from: TheSteve on February 14, 2016, 11:02:25 pmI don't think so. See reply #14 by markone: He also used bootloader 0.0.1.1, but did not succeed in downgrading (from firmware version 00.04.03.02.03.)TheSteve -- have you tried upgrading to firmware 00.04.03.02.03, and were you able to go back to an earlier version afterwards? Otherwise I would assume that it's this latest firmware which prevents the downgrade. (I don't mean to be obstinate about this, but think that it's important to find out, since quite a few people have been disappointed by the latest firmware release and might like to downgrade.)

author: TheSteve
author_rank: Unknown
timestamp: February 15, 2016, 05:18:34 am
content: Quote from: ebastler on February 15, 2016, 05:03:35 amHis bootloader is a higher rev then mine. I have 0.0.0.11 which is earlier then 0.0.1.1. I haven't yet tried the newest version of firmware as I've read nothing positive about it. I might just for fun though later tonight.edit:OK, loaded the newest firmware, then downgraded to the previous version without any problem. So the newest firmware changes nothing. I am sure it is all related to the bootloader version and sadly it probably only works for version 0.0.0.11 which is the earliest I have seen in the DS1000Z series. My startup counter also got reset with one of the updates.

author: ebastler
author_rank: Super Contributor
timestamp: February 15, 2016, 05:39:53 am
content: Quote from: TheSteve on February 15, 2016, 05:18:34 amAh, right -- I didn't pay attention to the decimal points. Never realized there was a 0.0.0.11 bootloader, in addition to 0.0.1.1... So the bootloader is indeed the most likely factor in deciding whether downgrades are supported or not. Nevertheless, think carefully whether you want to try the latest firmware; you don't want to be stuck with it

author: TheSteve
author_rank: Unknown
timestamp: February 15, 2016, 06:01:10 am
content: Quote from: ebastler on February 15, 2016, 05:39:53 amEdited my post above, it was no problem to downgrade so it must be in the bootloader. It does make me wonder if there could be an even more extreme recovery mode but it likely doesn't exist. I was thinking something that wouldn't drive the LCD at all, maybe simply flash a single LED to indicate it was doing something. I have never pulled the plug while it was flashing and don't plan to but perhaps the Rigol logo is stored in the bootloader and it could recover from a bad flash using the recovery I found.It also makes me wonder why they prevent downgrades. I can only think it was because they planned to stop people from being able to hack the DS1000Z series but then realized the "hackability" put the scope on the map and gave them more sales then they ever imagined.Over the years I have seen several cases of this - where a "hole" could have been easily patched yet it wasn't - clearly a business decision.As to how I found the option. Anyone who has messed(and hacked/reverse engineered) with and helped design a lot of electronic devices tends to get a feel for how stuff is designed. In the case of the Rigol it beeps to say it detected a USB device when it starts booting - the first good sign something it possible. Pressing certain buttons gets the scope to beep - another good sign. The fact that Rigol published using the help button as a way to flash the DG1022 AWG is another hint. Companies rarely stray from designs and tend to keep things similar. So that was a great starting point. I tried different timing and number of button presses until it did something, watching the LEDs etc carefully each time. I think it may also be possible to get it do things slightly differently if you press the button more times but didn't continue to explore. I know there were two times it also reset the scope to full default with the language going back to chinese and resetting my boot counter. Last night I flashed the scope probably 40 times during testing.and yes the scope still works perfect and passes the full self calibration.

author: ebastler
author_rank: Super Contributor
timestamp: February 15, 2016, 07:07:05 am
content: Quote from: TheSteve on February 15, 2016, 06:01:10 amWell, there can be valid reasons for preventing downgrades. If e.g. a newer firmware version changes/extends the way calibration data and user preferences are stored, the new firmware can contain code to automatically migrate the stored settings to the new format. But when going back to an older firmware, that one obviously can't know about the changes that were made in later versions, and might crash when confronted with the settings etc. that were "messed up" by the new firmware.In general, testing firmware upgrade paths is messy enough if you want to properly test all "forward" paths, incuding skipping one or multiple versions. Since we all know how scrupulous Rigol is when it comes to software testing, I'm sure they just wanted to ensure that they can provide proper quality assurance for all firmware paths they support.

author: Fungus
author_rank: Super Contributor
timestamp: February 15, 2016, 07:34:42 am
content: I'm thinking this feature might be really there to recover failed updates/bricked 'scopes.Not for doing downgrades.

author: Shock
author_rank: Super Contributor
timestamp: February 22, 2016, 02:58:22 pm
content: So the important question is, if you go back to version 0.4.0.0.0 what boot loader will you get if you try the boot loader GEL file that comes with that update?

author: TheSteve
author_rank: Unknown
timestamp: February 22, 2016, 05:37:43 pm
content: Quote from: Shock on February 22, 2016, 02:58:22 pmExactly what I wondered. I tried both files in the 4.0.0.0 upgrade, my bootloader version has never changed.

author: pa3bca
author_rank: Regular Contributor
timestamp: February 23, 2016, 04:54:04 pm
content: Thanks!I was able to 'downgrade' my firmware (only the version, not the usability). Had the dreadful latest 4.3. SP2 which made my DS1074Z really slow - especially when zeroing trigger level and vertical position levels (when pushing the level knobs).Now running the previous version, 04.03.01.05 and most is well.Next time I will wait a bit more before upgrading the FW.

author: alsetalokin4017
author_rank: Super Contributor
timestamp: February 23, 2016, 06:56:22 pm
content: A 1074z with boot version 0.0.0.13. Has anyone with an actual 1054z, with the current boot version 0.0.1.3, or the earlier 0.0.1.2, been able to downgrade firmware?

author: TheSteve
author_rank: Unknown
timestamp: February 23, 2016, 08:26:42 pm
content: Quote from: alsetalokin4017 on February 23, 2016, 06:56:22 pmPerhaps no DS1054Z models were shipped with the really early firmware. I don't know the order they were released in but I believe the DS1054Z came after the DS1074Z. We need someone with a very early DS1054Z to see what boot version it has.

author: pa3bca
author_rank: Regular Contributor
timestamp: February 23, 2016, 09:29:22 pm
content: Quote from: TheSteve on February 23, 2016, 08:26:42 pmYes that is correct. I remember beingslightlyannoyed when the 1054z came out, a few months after I bought my 1074z.After hacking they are both exactly the same, but the 1054z was some EUR 150 cheaper than the 1074zWell at least I can downgrade my FW. Don't know if this is worth EUR 150 though.

author: markone
author_rank: Frequent Contributor
timestamp: February 23, 2016, 10:46:55 pm
content: Quote from: alsetalokin4017 on February 23, 2016, 06:56:22 pmMy 1074Z with 0.0.1.1 boot version failed, the help button sequence (after the boot beep) results in a status where almost all UI leds blink and nothing happens.

author: TheSteve
author_rank: Unknown
timestamp: February 23, 2016, 10:51:45 pm
content: Quote from: pa3bca on February 23, 2016, 09:29:22 pmYeah, probably not worth EUR 150. I bought a DS1054Z but sold it when I had a chance to buy a DS1074Z-S. The source is a pain to use but was still worth it, only paid a USD $70.00 difference to "upgrade". Having the ancient bootloader is just a random bonus I guess.

author: pa3bca
author_rank: Regular Contributor
timestamp: February 24, 2016, 08:12:04 am
content: Quote from: markone on February 23, 2016, 10:46:55 pmFascinating how all these FW versions work and react differently. One wonders if there is a design philosophy behind this (and if so, what is it?)

author: RoGeorge
author_rank: Super Contributor
timestamp: October 20, 2016, 05:20:08 pm
content: This post is just to easily follow the subject.

author: TheSteve
author_rank: Unknown
timestamp: October 20, 2016, 06:03:18 pm
content: Quote from: RoGeorge on October 20, 2016, 05:20:08 pmYou really need to find a way to follow the subject that doesn't include posting in all of them.

author: Lightages
author_rank: Unknown
timestamp: October 20, 2016, 06:04:43 pm
content: Quote from: RoGeorge on October 20, 2016, 05:20:08 pmCan you stop doing this? There is the option to follow a thread by clicking on the "Notify" button on the thread controls. You are just polluting threads and making people look at something when there is no new post.

author: RoGeorge
author_rank: Super Contributor
timestamp: October 20, 2016, 07:50:31 pm
content: My apologize,I had a notification setup for about 6-7 threads, and it didn't worked for me, so I replied to all of them the message that upset people. I saw a similar message somewhere in eevblog, and nobody complained about that one, so I thought it is OK to post in order to follow the subjects.Is there is any way, link or button to be notified without using an e-mail, please?Something like the "Show replies to your posts", but for notifications, would be great. For me, the "Notify" option sends e-mails, but this is not what I need.Once again, sorry about that.

author: janekivi
author_rank: Frequent Contributor
timestamp: March 12, 2018, 08:53:00 pm
content: Sorry for disturbing. As I needed firmware update by bootloader because our SparrowApphacking in "GEL firmware format" thread, I was searching all threads and info about it.Actually this wasn't a secret when this thread was started as this PDF date is older:http://int.rigol.com/File/ProductSoftWare/20151124/Firmware%20update%20instruction.pdfIn my case my usual flash drive didn't work with bootloader and all leds are flashing.But older and small 1GB drive did flash his internal led differently and then scopewas listening my HELP button correctly. So, bootloader didn't saw the other USB disk.