My 1054Z looks to have a bandwidth close to 100 MHz without hacking. Checking with a terminated RF signal generator the waveform drops by 25% at 98 MHz, not quite 100 MHz, but darn good for the money.
Given the reports of not being able to change the hacked scope's software model back to 1054, it might be worth leaving it alone until at least the warranty expires.
The hack doesn't add bandwidth to the analog section. I believe that it just increases the sampling frequency and gives extra (shorter) horizontal time bases. Limiting actual analog bandwidth by software would be quite a feat, requiring extra circuitry and cost; limiting the sample rate is a no-brainer.
Bandwidth of a system is usually determined by the -3 dB point. So it is the point where the voltage response is down to 70.7% of nominal. By this definition, your scope probably has a bandwidth slightly more than 100 MHz.
However, Oscilloscope bandwidth usually follows a Gaussian rolloff*, so the -3 dB point is not such a true indicator of bandwidth. The conventional way to define oscilloscope bandwidth is actually by the pulse response, specifically the rise time. We say that BW = 0.35/Tr. For example, with a 1.75 ns rise time, the calculated bandwidth is 200 MHz. To measure rise time, you need a flat-top pulse with a rise time significantly faster than the scope under test. So, for your ~100 MHz scope, you would want a 2 ns or faster pulse generator.
* the reason for the Gaussian response is that it gives no overshoot or ringing to a step input. This means that the only aberration that the scope lends to a step input is the limited rise time; it specifically does not add any ringing or overshoot (ideally). So if you see ringing, it should not be due to the high frequency roll-off in the scope input. If the response was tuned to be a maximally flat passband (like a butterworth filter), the -3 dB point would be quite a bit higher, but you would have terrible ringing in the step input.