Author Topic: Siglent SDG1025 hack?  (Read 17808 times)

0 Members and 1 Guest are viewing this topic.

Offline echen1024Topic starter

  • Super Contributor
  • ***
  • Posts: 1660
  • Country: us
  • 15 yo Future EE
Siglent SDG1025 hack?
« on: September 08, 2013, 01:58:38 am »
Well, I'm still trying to decide between the Siglent SDG5082/1025, or the Rigol DS1022A/4062, and am wondering about the hackability of the Siglent models. Would it be possible to purchase a 5 MHz function gen, and hack it up to the 50Mhz, or buy a 5082, and take it up to 160MHz? Any help would be appreciated. I know that the Rigol DG4062 can be hacked into a DG4202, and that there is only one 1022 model.
I'm not saying we should kill all stupid people. I'm just saying that we should remove all product safety labels and let natural selection do its work.

https://www.youtube.com/user/echen1024
 

Offline rf-loop

  • Super Contributor
  • ***
  • Posts: 4064
  • Country: fi
  • Born in Finland with DLL21 in hand
Re: Siglent SDG1025 hack?
« Reply #1 on: September 08, 2013, 09:21:13 am »
I think Siglent do not use this designed hackability marketing method in narrow hobby segment of markets. ;)
« Last Edit: September 08, 2013, 09:24:19 am by rf-loop »
I drive a LEC (low el. consumption) BEV car. Smoke exhaust pipes - go to museum. In Finland quite all electric power is made using nuclear, wind, solar and water.

Wises must compel the mad barbarians to stop their crimes against humanity. Where have the wises gone?
 

Offline Macbeth

  • Super Contributor
  • ***
  • Posts: 2571
  • Country: gb
Re: Siglent SDG1025 hack?
« Reply #2 on: December 06, 2013, 07:54:32 pm »
I just got my Siglent SDG1025 today. :)

From what I know, the lower bandwidth Siglent models (SDG1005-SG1020) don't even come with a fan - which kind of says something about the hardware. I would go for the 1025, the extra $20 or so is worth it for piece of mind.

However, the Siglent SDG1050 is exactly the same in spec as the 1025, except for the Sine Wave function going up to 50MHz. All the rest are limited to 25MHz, 300kHz, etc.

So for the SDG1025, I actually do believe a simple software mod could be enough, perhaps?

Simarlarly, I have a Hantek MSO5102D (100 MHz). I could have got the 60MHz version, but the supplied probes don't make it worth it. I can software upgrade this to 200MHz (which I don't even think is offered in the MSO series anyway!).
 

Offline wilheldp

  • Regular Contributor
  • *
  • Posts: 223
  • Country: us
Re: Siglent SDG1025 hack?
« Reply #3 on: December 06, 2013, 08:22:57 pm »
I'd be interested if you figured out that software hack on the SDG1025 since I also recently bought one.
 

Offline 0xPIT

  • Regular Contributor
  • *
  • Posts: 65
Re: Siglent SDG1025 hack?
« Reply #4 on: September 06, 2015, 12:27:05 pm »
Oh, the most recent firmware (1.01.01.37R3) has a Bandwidth Update option (Utility -> 3/3 -> BW Update) that allows to enter a license key...
 

Online tautech

  • Super Contributor
  • ***
  • Posts: 28142
  • Country: nz
  • Taupaki Technologies Ltd. Siglent Distributor NZ.
    • Taupaki Technologies Ltd.
Re: Siglent SDG1025 hack?
« Reply #5 on: September 06, 2015, 07:21:32 pm »
Oh, the most recent firmware (1.01.01.37R3) has a Bandwidth Update option (Utility -> 3/3 -> BW Update) that allows to enter a license key...
Yes, but at this time Siglent have yet to offer BW upgrade pricing and until they do who knows when this will be enabled.  :-//
Avid Rabid Hobbyist
Siglent Youtube channel: https://www.youtube.com/@SiglentVideo/videos
 

Offline Macbeth

  • Super Contributor
  • ***
  • Posts: 2571
  • Country: gb
Re: Siglent SDG1025 hack?
« Reply #6 on: September 06, 2015, 08:00:00 pm »
It's taking far too long. Maybe they are leaving this out there for the community to derive their own hack, ala Riglol "Sniffing the rigol's internal i2c bus

I've got a copy of IDA, but a 25 to 50 MHz sine wave isn't really worth it to me.
 

Online tautech

  • Super Contributor
  • ***
  • Posts: 28142
  • Country: nz
  • Taupaki Technologies Ltd. Siglent Distributor NZ.
    • Taupaki Technologies Ltd.
Re: Siglent SDG1025 hack?
« Reply #7 on: September 06, 2015, 08:19:45 pm »
Maybe they are leaving this out there for the community to derive their own hack......
I've wondered this too, but so far nobody seems to have taken the bait.  :-DD

Avid Rabid Hobbyist
Siglent Youtube channel: https://www.youtube.com/@SiglentVideo/videos
 

Offline rf-loop

  • Super Contributor
  • ***
  • Posts: 4064
  • Country: fi
  • Born in Finland with DLL21 in hand
Re: Siglent SDG1025 hack?
« Reply #8 on: September 07, 2015, 06:17:03 am »
Also need remember that SDG1010 and 1025 can produce 50MHz sinewave. (Temporary occasional use, when some of the restrictions or the sine wave characteristics may be compromised.  When user know some limits and can accept these, it can use)


(EasyWave: open "new" with default property settings (-10 - +10V))

Draw -> Equation draw
New Equation
Write exactly:  10*(sin(10*x))
Ok
Store as 10SIN.CSV (name it as you want xxxxx.CSV) to USB  and move this 10SIN.CSV to your SDG.
Turn arb on and select this new 10SIN.CSV.
Set Arb freq 5MHz and there you have 50MHz sine out.
(set arb to wanted/10 frequency.)
Then user need know that there is 8ns system jitter with most frequencies due to system working principle - with all arb and pulse waveforms - as in specifications tell)

Also you can do other waveforms, example pulse with this method. But you need know how to write math functions for different waveforms. (if do not want hand draw waveform)
Something like this (and this is NOT Square math but in paractice you can try what it give out AND look real out with oscilloscope - theory and practice differ because we do not have right theory due to fact that real world and equipments  are not ideal)

Just for fun, all waveforms are sum of some sinewaves.
You can write for SDG1000:
10*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(10*x))))))))))))))))))))))))
With these harmonics and harmonic levels..... it is partially shit but if think square, you get idea how you can do
Change numbers and look how it change.. ;)
And look what scope show example if you set arb freq for 1kHz.

 caution:
It is also good to know that continuous run with maximal signal power and specially  to poor matched load impedance may lead to high thermal stress, even over stress, there in end amplifier(s) stage.
« Last Edit: September 07, 2015, 06:45:07 am by rf-loop »
I drive a LEC (low el. consumption) BEV car. Smoke exhaust pipes - go to museum. In Finland quite all electric power is made using nuclear, wind, solar and water.

Wises must compel the mad barbarians to stop their crimes against humanity. Where have the wises gone?
 
The following users thanked this post: Steps, Freedom

Offline Steps

  • Contributor
  • Posts: 23
  • Country: ru
Re: Siglent SDG1025 hack?
« Reply #9 on: April 13, 2016, 12:46:06 pm »
New Equation
Write exactly:  10*(sin(10*x))
Ok
Store as 10SIN.CSV (name it as you want xxxxx.CSV) to USB  and move this 10SIN.CSV to your SDG.
Turn arb on and select this new 10SIN.CSV.
Set Arb freq 5MHz and there you have 50MHz sine out.
(set arb to wanted/10 frequency.)
You can write for SDG1000:
10*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(10*x)))))))))))))))))))))))
Thank you for your effort. Useful information.
And how it is possible to obtain AM modulated signal (and with e.g. 70% modulation depth)?
(sin(x)(sin(1000*x)))  -  this is just AM modulated.
Sergey
 
The following users thanked this post: commongrounder

Offline Macbeth

  • Super Contributor
  • ***
  • Posts: 2571
  • Country: gb
Re: Siglent SDG1025 hack?
« Reply #10 on: May 28, 2018, 04:51:05 pm »
To force it into an SDG1050, maybe changing

E4F02 B8 E4 0D 00                       R0 = B[FP + 0xd] (Z);

to something like

E4F02 80 E1 05 00                       R0 = 0x5 (Z);

 :-//

 

Online nctnico

  • Super Contributor
  • ***
  • Posts: 26756
  • Country: nl
    • NCT Developments
Re: Siglent SDG1025 hack?
« Reply #11 on: May 28, 2018, 05:57:53 pm »
What would be interesting is to find out whether the model is set by an eeprom or jumpers on the board. The early 5MHz and 10MHz models don't have a fan so there may be more differences in the hardware.
There are small lies, big lies and then there is what is on the screen of your oscilloscope.
 

Offline janekivi

  • Frequent Contributor
  • **
  • Posts: 368
  • Country: ee
Re: Siglent SDG1025 hack?
« Reply #12 on: May 29, 2018, 02:38:38 pm »
I have something here. I desoldered flash once.
https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/msg1050089/#msg1050089
I did with him all kinds of other experiments too.
https://www.eevblog.com/forum/testgear/siglent-sdg1000-(aka-lecroy-wavestation)-firmware-updates/msg989932/#msg989932

But I was sending square wave to led matrix displays and somehow it won't work
correctly any more. Something is wrong with FPGA as manual say.  It don't have
square wave and output levels are messy. After that I got 2048X.
So now it is for experiments good enough.
 

Online tv84

  • Super Contributor
  • ***
  • Posts: 3212
  • Country: pt
Re: Siglent SDG1025 hack?
« Reply #13 on: May 29, 2018, 04:04:02 pm »
To force it into an SDG1050, maybe changing

E4F02 B8 E4 0D 00                       R0 = B[FP + 0xd] (Z);

to something like

E4F02 80 E1 05 00                       R0 = 0x5 (Z);

 :-//

That could be a 1st attempt or change inside the previous call... I'm gonna see with janekivi now that I know he has an experimental testbed. :)
 

Offline janekivi

  • Frequent Contributor
  • **
  • Posts: 368
  • Country: ee
Re: Siglent SDG1025 hack?
« Reply #14 on: May 29, 2018, 04:11:48 pm »
Oh, the most recent firmware (1.01.01.37R3) has a Bandwidth Update option (Utility -> 3/3 -> BW Update) that allows to enter a license key...

Oh, the most recent firmware (1.01.01.39R2) has a Bandwidth Update option (Utility -> 3/3 -> BW Update) removed, that doesn't allow to enter a license key...
-------------------------------
And the most recent firmware (1.01.01.39R5) too...
« Last Edit: May 29, 2018, 04:26:09 pm by janekivi »
 

Offline Macbeth

  • Super Contributor
  • ***
  • Posts: 2571
  • Country: gb
Re: Siglent SDG1025 hack?
« Reply #15 on: May 29, 2018, 05:52:48 pm »
That could be a 1st attempt or change inside the previous call... I'm gonna see with janekivi now that I know he has an experimental testbed. :)

Good on janekivi! I was a little reluctant to be the Guinea Pig  :-DD
 

Offline janekivi

  • Frequent Contributor
  • **
  • Posts: 368
  • Country: ee
Re: Siglent SDG1025 hack?
« Reply #16 on: June 04, 2018, 06:51:09 pm »
OooKey...
Did the experiments and there was no difference with this function change.
Quote
E4F02 B8 E4 0D 00                       R0 = B[FP + 0xd] (Z);

to something like

E4F02 80 E1 05 00                       R0 = 0x5 (Z);

Now I can make new files bit easyer and try other changes you suggest.
First edited ADS update file I made wit notepad (hex edit)...
 
The following users thanked this post: Macbeth

Offline toli

  • Frequent Contributor
  • **
  • Posts: 313
  • Country: il
Re: Siglent SDG1025 hack?
« Reply #17 on: June 09, 2018, 03:36:35 pm »
To force it into an SDG1050, maybe changing

E4F02 B8 E4 0D 00                       R0 = B[FP + 0xd] (Z);

to something like

E4F02 80 E1 05 00                       R0 = 0x5 (Z);

 :-//

The value its compared against is actually different, if you have a look, its:
ROM:E4F62 29 60                             R1 = 0x5 (X);           # R1=0x5
which is (X), not (Z). So its extended with sign, no zeros. I've looked at the BF manual, and its indeed different as its extending with '1's instead of '0's. I'm unsure of the actual instruction code to define R0 to be this value, no experience with the BF at all on my side. If you know the instruction structure and which bits state the register number, it would be great.
From the few instruction in the snippet of code above, I think its 2860 (similar to the 2960 for setting R1 to 0x5(X), with a single bit change to mark the register number), but I can't verify this.

One other way would be to try and set:
ROM:E4F68 01 E1 20 E9                       R1.L = 0xe920;          # R1=0xe920
instead of the different values set for the other models. As other than that the section seems practically identical for all models. Although its hard to say what happening at the subroutine in address "sub_575F2" which is being called there. Right before jumping into it, R0 is again set to the value of R7, so it is possible that  its used there again for defining the parameters, and therefore this change wont suffice. Chances are I'm just too pessimistic :)
My DIY blog (mostly electronics/stereo related):
http://tolisdiy.com/
 

Offline sleary78

  • Supporter
  • ****
  • Posts: 43
  • Country: gb
Re: Siglent SDG1025 hack?
« Reply #18 on: October 13, 2018, 08:37:44 am »
Any updates on this. Is there anything i can do to help? I have a SDG1025 and its im happy to test out firmwares. The IDA database is no longer available.
 

Offline azaaxx

  • Newbie
  • Posts: 2
  • Country: pl
Re: Siglent SDG1025 hack?
« Reply #19 on: February 14, 2024, 10:34:42 am »
Hi,
I`m also the owner of SDG1025.
There has been not much activity there since a lot of time.

I noticed that there is a way to "unlock" siglent scopes and awg by using license:
https://www.eevblog.com/forum/testgear/siglent-sds-sdg-hack-script
I also saw on other sites same procedure for spectrum analyzers.
I believe the procedure should be pretty much similar for this scope.
I have some experience in reverse engineering and also can do some stuff with device itself (if needed)
I would need to get decoded binaries / mem dump of scope.

Anyway, It is better to ask instead of reinventing the wheel.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf