Ben's Blog

No description yet.

  • Home
    Home This is where you can find all the blog posts throughout the site.
  • Categories
    Categories Displays a list of categories from this blog.
  • Tags
    Tags Displays a list of tags that have been used in the blog.
  • Archives
    Archives Contains a list of blog posts that were created previously.
  • Login
    Login Login form

First Impression (2) - The DS1074Z 4-Channel Oscilloscope, A Freeloader's Perspective

Posted by on in First Impressions
  • Font size: Larger Smaller

The Rigol DS1074Z 4-channel oscilloscope has become popular in hobbyist circles for a variety of reasons, good and better! Firstly, and probably most importantly, because of the price bracket Rigol have managed to fit this oscilloscope into. Secondly, because  hobbyists being hobbyist have discovered a flaw in the Elliptic Curve Cryptography (ECC) algorithm used to encode the scope's optional functionality. This has allowed them to add hundreds of pounds of additional functionality to the basic version of the scope for nothing.

 However, before I discuss what hobbyist should not do to enable the optional  additional functionality, let's see what the basic oscilloscope has to offer.


The Rigol DS1074Z is a 4-channel oscilloscope that offers a maximum analog bandwidth of 70MHz, as opposed to the DS1104Z version, seen above, which has a maximum bandwidth of 100MHz. However, both oscilloscopes are functionally the same and actually consist of the same and identical hardware, but more on this later. Quite smartly, with this oscilloscope Rigol have filled a vacuum of affordability in the 4-channel oscilloscope market space, which their competitors are yet to follow.

Hence, this reasonably priced scope has a bright 7.0" WVGA, TFT-LCD display that has a resolution of 800 x 480 pixels. Also, expectedly, it has four analog input channels coupled with a large shared sample memory, which ranges from 12 to 24 million sample points. 

Almost everyone will make a good first impressions, but only a few will make a good lasting impression.

Apart from the normal functionality one would expect from an oscilloscope of this quality, which will be comprehensively reviewed in a future article, it also includes a USB slave port at the front of the oscilloscope, which is used amongst other things, for saving waveform timing images in the same resolution of the display at 800 x 480 pixels. Provided also is a USB device host port that allows one to connect it to a PC to print waveform data or control the oscilloscope itself. However, how this is done and which software is used to do it is not described, as far as I could tell, in the documentation.

Interestingly, there is also a Local Area Network (LAN) interface that allows the oscilloscope to conform to the LXI-C class instrument standard. Now I am not quite sure what that standard is or means, but it sounds useful and is something worth investigating. The four channels are initialised by connecting a probe to the signal and ground terminals that output a 1Hz signal, as can be seen in the image below. The terminal's voltage output is 30V peak-to-peak.


This is an example screenshot taken, when initialising channel 1, by simply inserting a USB stick into the USB port at the front  and pressing the print button. It is as easy as that. This particular image was saved as a.png file format at 800 x 480 pixels, then scaled to a 480 x  288 pixel image for this blog post.


Figure: The functional layout of the DS1000z family of oscilloscopes.

First Impressions

 So what are my first impressions of this oscilloscope? Well, I quite like this oscilloscope, infact I quite like it a lot. Even though I've barely used it. (That's why it's called first impressions! Doh! - Ed). The knobs and buttons have a good feel about them and the plastic casing looks strong and robust, as if it could survive an accidental knock or two suffered during use in the lab.

The four 100MHz probes, supplied with this version of the kit, look good and the signal quality acquired using one of them is crisp and clear. Also, as mentioned previously, the 7" display is big and bright and the menu layout, seen in the image above, is easy to understand, with menu items being easy to find and use.

However, the noise from the fan, which may be just bearable to some may leave others quite distraught. If your lab has a boom box or something similar to accompany you on those long and boring hardware debug night shifts, then the fan noise should be quickly forgotten. 

 A comprehensive manual is supplied on a CD-ROM, which is great  if your laptop, tablet or Macbook Air has one. Otherwise, you may need to find a way of copying the .pdf manual onto a USB stick, like I had to.  All in all, the manual is not too badly written, with examples being easy to read and understand, by what seems to be a none native English speaker.  So the review so far has described the good part, now for the better part.

Elliptic Curve Cryptography (ECC) Hack

 Quite by coincidence, while browsing for review articles on the DS1074Z oscilloscope, I came across a few websites that discussed hacking the DS1074Z's  Printed Circuit Board (PCB). Apparently, these hacks work by unlocking optional functionality, including advanced triggering, 24 million sample memory and i2c, SPI and RS232 decoders. Reading about it was so fascinating that I forgot about the saying curiosity killed the cat and decided to investigate further.


Firstly, one can determine the oscilloscope's serial number and other vital statistics by navigating to the utility menu item and from there to the system sub-menu item, then on to the system information, like so Utility->System->System Info. This information can be seen in the image above and provides one with all the information one needs to understand the flaws in the oscilloscope's ECC cryptography on the EEV Blog forum. In fact the discussion was so advanced that there is no need to open the oscilloscope, all the hard work seems to have been done for you.


After purchasing and when one powers up the oscilloscope this optional functionality, presumably, is available as a trial, as can be seen in the image above. On my newly purchased one I have just under thirty-four hours left to experiment with these optional extras, before deciding to purchase them. Now, according to the EEV Blog's forum on the subject the ECC algorithm used to implement the scope's firmware protection has been broken. Apparently, due to a bad interpretation of the ECC library used to protect the oscilloscope's firmware  only 212, rather than 256, iterations are required in a brute force attack on the code.

The folk on the EEV Blog forum have, apparently, released a set of instructions to unlock these optional features and  because the hardware of the DS1074Z and the DS1104Z are identical, the 74MHz version of the scope is upgraded to the 100Mhz version at the same time. 


If you are into product design and want to avoid the same pitfalls as Rigol have made with this oscilloscope you should head over to the EEV Blog website and have a look. 

Last modified on