It's simulation, not demo. DEMOSCOPE enables the option mask feature and has nothing to do with simulated outputs.
Simulation mode is used for development so that the programmers can develop and debug features on their PCs without having to track down real hardware and remote-debug on it. It's not meant to be entered normally and it allows for X-Stream software to simulate any of the scope families through a registry setting.
When X-Stream boots up the first thing it does is attempt to open the Windows kernel driver and query the scope id. If this fails you get the "No hardware detected. Not authorized to run on this system" message box. If this succeeds, however, then X-Stream makes another call to the driver to scan hardware and determine what family of scope it is talking to. If the acquisition board is completely disconnected from the interface card then you may still receive the "No hardware detected" error. If, on the other hand, hardware is detected on the other end but it fails to be identified properly, then X-Stream may fall back to simulation mode.
I can only speculate why this happens. It's possible that LeCroy software developers install a custom PCI interface card to their workstations for firmware development and a broken scope looks just enough like the dev card to fool X-Stream into booting up in SIM mode. It's also possible it's just an accident: a default case in a logic branch that was thought not to even be reachable. Or maybe there is some other purpose for this behavior that I haven't though of and I'm completely full of crap.
My point is that the model number is not stored in the options, and neither is the SIM mode. There is a SIM option but it is more semantic than functional and it is not related to booting up in simulation mode. Whether an instrument is simulated or not is determined before licenses are enumerated and in fact simulated instruments store licenses in a text file rather than in hardware. So there is a chicken and egg problem and please believe me that the determination of simulation mode is made very early in the boot process before most hardware has been talked to. My yet unconfirmed hypothesis is that it is a JTAG scan of the front end which determines which family the instrument is. The only time the options come into play for determining the model is when accounting for the bandwidth or certain model suffixes such as -M, -A, -B, etc. But it's the hardware that will determine, for example, that your instrument is a WP7KA or a WR6KA. If the card can't talk to the hardware then X-Stream defaults to the WaveMaster family.