[Chris] has been spending a lot of time in the wife’s sewing room lately, and things got pretty serious late last night as to unlock the 1104Z capabilities lurking within. The rumors are true, and ungoverning the software is as simple as looking up your serial number and knowing the right URL for generating a valid license. [Chris] ran into a dud site, but that’s the price of doing business in the shadowy parking garage basements of the interwebs. Once he knocked on the right door and uttered the secret word, however, he became the proud owner of 50MHz additional bandwidth, decoders for SPI, I²C, and RS-232, twice the storage depth, and all teh triggers that ship with the 1104Z. Stick around for [Chris]’s video walk-through. Can’t rationalize the purchase even at the ridiculously low price point?. You’ll laugh, you’ll cry, you’ll learn some French.

Posted in, Tagged,,,,, Post navigation. Looks like you have trouble finding the exact value of your age.

Use the DS1054Z, it is a nice oscilloscope at a great price. Then do the hack at (that is the hack that works, there is another one but it did not work for me) and use ONLY the DSFR code in the options, after you input your serial number. Forget about the privatekey field, you don’t need it AFAIK. Once done, you will have a 100mhz oscilloscope. THEN use one probe on your left index finger (Channel 1) and another probe on your right big toe (Channel 2).

Rigol did not use proper starting values, making the keys very weak. It was trivial (milliseconds of compute time) to figure out the private key. Interestingly, Rigol hasn’t fixed this since it was discovered on an earlier model. Rigol DS2000 / DS4000 / etc. Many of these files have been placed here without testing, verification or checking of any kind. Use at your own risk. Re: Spectrum Analyzer - Rigol DSA815 « Reply #138 on: December 21, 2012, 12:46:50 am » It's not continuously connected and living in a city, there is little chance of lightning strikes.

Wait 5 seconds and you will be able to read your correct age in Gigaherz. Do not invert finger / toe sides or you will be fried. Seriously, a great 100mhz (after modding it) oscilloscope for little money! He links in to the review Dave Jones did, and one of the things that Dave noted in that and a companion review where he maps the circuit is that the input bandwidth is limited by capacitors in the circuit that are controlled from the microcontroller.

There was some discussion in a previous thread about cloning Tektronix application modules (the one that sparked the DMCA takedown notice from Tektronix) about the ethics of software hacking like this, with some people saying that they think a hack like this is stealing. Now, Chris used a software hack to get the functionality, but by cutting and remapping the traces coming from the chip (that is, a hardware hack) you could achieve the same outcome, at least in terms of getting the higher bandwidth. As Chris says in the video, it seems that Rigol have made it at least somewhat hacker friendly to do these kinds of things. I’m kind of in the same boat as him – I’ve always thought that feature unlocking a cheaper scope is akin to overclocking a cheaper GPU or (perhaps more accurately) messing with the tune on a engine control unit in a car to get those extra horsepower they want to charge you more for. For those wondering, no, Rigol do not deliberately allow their scopes and other gear to be hacked in order to get more sales.

They don’t like it, but they know they can’t stop it, and it’s the calculated risk they take when they decided on software performance restrictions. The number of scopes sold due to hackability is small-fry. Mesa boogie serial number lookup. They software limit the scope to reduce production and inventory cost and gain price leverage in various market segments. The vast majority of customers do not know about the hack, nor would they care if they did.

I’d really like to see someone (Dave @eevblog?) do a full set of calibration tests on a hacked scope. I strongly suspect that the 50 & 70 MHz versions are a means of selling off the 100 MHz scopes that don’t pass the final QC tests. The front end is analog and parts tolerances are still an issue when you’re trying to keep the price down. The 70 MHz version being an attempt to squeeze a bit more out of the bottom line from units that are only slightly off spec.

Software features are an entirely different matter. I don’t see why any of the vendors charge as much as they do for those other than they can. Eventually one of them will go all in for market share and unlock everything. The DSER option unlocks all features EXCEPT the 500uV option which is / was buggy.

From Search for icaro600 Quote: —————————————————————————————————————————————————- icaro600: Re: Sniffing the Rigol’s internal I2C bus « Reply #3221 on: April 25, 2014, 04:33:31 AM » Use one of the On-Line Keygenerator (you want to use it for DS1000z) at* > RigLol keygen: Canadian mirror: UK mirror: Do NOT install 500uV Vertical Sensitivity, as it doesn’t work properly (buggy*). Therefore do NOT use ‘DSBA’ – 500uV Vertical, or ‘DSFR’ – all options. Type in your unit’s Serial Number.

Type in DSER* for all options without the 500µV. This Option may not be in the Keygen’s list, but it will work! Do NOT enter anything for ‘Privatekey’, it will be inserted automatically for you (based on the DS1000z). Press [GENERATE], and record the resulting Option Code. When you are done enter the Option Code manually in the DS1000z using a single string without using any ‘dash’ (-) using Rigol’s Procedure for activating the Trial Options in the D1000z. As I recall the procedure is available on Rigol’s Web Site under DS1000z.

———————————————————————————————————————————————————— Only the Canadian mirror: is working. I have been a bit disappointed for the RF interferences at 125MHz and more, also with the original 50MHz bandwidth. Uhmm It should be not so tricky avoiding a -40dBfs interference for an experienced company. I can not think they are not able to solve that problem. A cheap instrument can not be as good as more expensive instruments of the same company I wouldn’t be astonished if they made something to add noise, making the DS1000 series worse than more expensive series! It would be a few pF capacitor, or a wire protruding as an antenna or a tin drop:-). I was able to successfully apply the “fix” to my 2015 production 1054Z.

However, for some reason i wasn’t able to do it first time – i have restarted the device and regenerated the key (even though i have found out it is exactly the same like the first one, no mistakes) and this time i was able to unlock. I have stumbled on similar reports of people not being able to unlock with 1st try so if yours decides to throw away the coding the first time – just make sure you put all the numbers right, restart and retry. Most probably it is going to work. I finally got around (and the courage) to try this hackworked like a charm. I used the code DSER (all options but the 500uV).

I tested and saved.jpg files of a 5V 20MHz clock before and after the hack (using x10 probe). Before the hack, the risetime for the clock was measured by the ‘scope as 2.50ns; after the hack, the same clock was measured by the scope as 2.20ns so I know the physical bandwidth did increase and it’s not the ‘scope just reporting an increased bandwidth.

I then went on and update to the latest firmware and again, no problems. Tried this on my (new!) DS1054Z bought just a few weeks ago. Firmware version is 4.03.SP2. Had a couple of false starts either due to finger trouble or duff sites. The original site used by Chris has disappeared and the mirror didn’t seem to work but I found the original site on the internet archive at and it worked just fine using the DSER option. The scope now has all the options and reports itself as a DS1104Z. It came with all of the options licensed as ‘trial’ versions for a limited time evaluation but they are now licensed as ‘official’ with no time limit.

Great result. A DS1104Z-Plus would have cost more than double and I have no need for the upgradeability to logic analyser etc. Hanes t shirtmaker.

Capabilities (I use a Saleae). Delighted and relieved to confirm that this worked on my brand new (delivered today!) DS1054Z, software 00.04.04 SP1, board version 0.1.4 I downloaded the zip file from (see link and end of that page) and ran the Linux version found in the /bin/linux directory, using option code DSFR (everything), and didn’t provide the optional private key. Executable binaries for OSX and Windows are also provided. Entered the resulting code into the ‘scope and all options are now available, showing as “Official” with no “left-time”. The model number displayed on-screen is now DS1104Z. All options and model number are retained through a power-cycle. Had an unusual experience with a recent attempt to enter the keys.

A ds1054z owner was using the online key generator and that attempt was met with an error message about incorrect key, the 2nd attempt for a key generated from the app [turned out to be same key] was again met with error message. Then on 3rd attempt same error message but no lockout.

The individual checked the options list and it showed all options now active. Point of this long story always check options list even after an error flag cause that owner got 3 errors and options unlocked. Just received mine today. It already has everything unlocked except 100mhz. Think telectronic did a vendor update before shipping, I saw one other person who has this. Using riglol, I entered my SN and got a key for just the 100mhz. Trying to enter it, the key has 6 chars for the first block, BUT, my entry space takes 7 chars?