Siglent SSA3000X and SSA3000X-Plus Spectrum Analyzers

[rf-loop]

There is bug in FW.

Trace freeze (View mode) do not work correct in this case.

[tautech]

New FW for the SSA3kX
http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA3000X-P08.01.rar
P08.01
7.2 Mb

From the changelog:
1. Add “PNG“ file type for screenshot.
2. Support TG in RBW less than 30 kHz.
3. Modify default TG output power, -20 dBm in spectrum analyzer mode and 0 dBm in reflection measure mode, and some other TG issues.
4. Updating the format of “LIM“ file. After this firmware , the old limit files will not be supported. You can re??? them through “EasySpectrum” free software easily.
5. After this firmware, do not support downgrade operation.

[Bicurico]

Warning: A quick check revealed to me that the root password has changed!

Because you cannot downgrade the firmware, you would be stuck at the moment!

Regards,
Vitor

[nugglix]

And the liberated options are also gone.

So BEWARE!

[janekivi]

My quick check shows exactly the same files in \passwd folder
so nothing changed there...

[Bicurico]

You are right. 

Both passwd and shadow are the same, at least for root.

I must have gotten stressed, as I was lecturing while doing the anlysis through RDP.

Sorry.

Regards,
Vitor

[Bicurico]

EDIT: Deleted attachment.

[Bicurico]

And the liberated options are also gone.

So BEWARE!

Have you tried activating them again through TELNET?

It kind of makes sense for Siglent to replace the edited license file with a new one, as offical customers will have the activation code to reactivate everything.

I wonder if they only reset the evaluation time settings or the actual activation settings: the hacks described in the other thread point to two different ways of doing the hack. One way is to change the eval period to infinite, the other consists in setting the option as activated.

Regards

[nugglix]

Have you tried activating them again through TELNET?

Yes.
Seems to be a completely different method now.

There is a new file w/ entered license keys.
The liberation method described above doesn't work anymore.

Cheers

[Bicurico]

Sorry to hear that.

Probably the application executable checks the signature of the authorised options. Without the key, nothing can be done, which is why they didn't even bother to replace the root password.

I would say that Siglent spectrum analyzers are locked again and probably for good.

Regard

[megafix]

Two things I noticed after upgrading from P07.07 (100.01.02.07.07) to P08.01 (01.02.08.01)

I had enabled all options and changed the model from SSA3021X to SSA3032X prior to the upgrade.
After the upgrade all options were lost but the model stayed with SSA3032X. In addition the newly created NSP_sn_bandwidth.xml has been appended with a license key for 3032.

Firmware downgrade is very simple. If you overwite ecomb (5054420 Bytes) with the previous ecomb (5007948 Bytes) from P07.07 all options are back.

ecomb is the main application located at /usr/bin/siglent. In order to replace ecomb you need to temporarily remount the rootfs as rw (read-write).

mount rootfs -o remount,rw
cd /usr/bin/siglent
cp /usr/bin/siglent/usr/mass_storage/U-disk0/ecomb . (in case the downgrade ecomb is located at USB stick)
sync
mount rootfs -o remount,ro
shutdown -r now

[Bicurico]

Thanks!

For all: The ecomb file can be accessed easily by converting the P07.07 ADS firmware file with the tool I attached a few posts before.

Open the resulting ZIP with 7Zip and extract ecomb.

So this is step 1: downgrade is possible again!

One thought:

If you can just copy ecomb from P07.07 and it works fine with all options back, how about writing a script for /etc to alternate between one ecomb and the other? Like you turn the SSA on and get P08.01. Turn it on again and you get P07.07 and so on. Even better would be some kind of boot menu...

*** These posts should really be moved to the "Hack of Sigllent spectrum analyzer ssa3021X?" @thread... Can some MOD do this, please? ***

Regards,
Vitor

[TurboTom]

Well, the situation isn't as hopeless as initially assumed: if you use peterdb's method of "liberating" the machine (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998095/#msg998095) and modify the license node in /usr/bin/siglent/firmdata0/NSP_system_info.xml to look like this:

<license><_3032>TRUE</_3032><_3021>FALSE</_3021><_TG>TRUE</_TG><_EMI>TRUE</_EMI><_Meas>TRUE</_Meas><_CAT>TRUE</_CAT></license></system_information>

and make sure all traces of previous hacking are eliminated -- don't forget to delete the "monster.txt " (not sure if all this is really necessary) and then apply the firmware update, a set of license codes will be generated automatically and the options will stay active (just tried it on my SSA*X).

The new firmware apparently doesn't support 1Hz and 3MHz RBW anymore. Operation with the tracking generator active has been improved, yet when operated in the area that normally is covered in FFT mode, it continues to sweep and gets unbelievably slow. I always thought the Rigol DSA was a dog but if you have to use the Siglent in this high-res TG modes, you'll get a new definition of "slow"! Yet, the results are better than before, the SSA hasn't got a problem to properly measure the parallel resonance of my high-accuracy 1MHz glass-tube crystal. But still, when zooming further into the spectrum, funny artefacts become visible, yet I'ld say the result is now completely usable as it is. Did I tell it's slow? 

So much for now, I may report back once I had more time to play with it.

Cheers,
Thomas

[Bicurico]

Hi,

Finally got some time...

I upgraded mine and had no problem. All options remain active.

As I thought:

I wonder if they only reset the evaluation time settings or the actual activation settings: the hacks described in the other thread point to two different ways of doing the hack. One way is to change the eval period to infinite, the other consists in setting the option as activated.

Those who actually activated the option instead of messing with the trial time will have those options with P08.01.

I confirm that the 3MHz RBW is gone. Maximum RBW is 1MHz.

I have not tested the 1Hz RBW, as I did not activate it.

So apparently, Siglent is not being too harsh. 

Regards

[Bicurico]

There is a new version of the EasySpectrum software, too:

ReleaseDate
2016/11/10 18:04:23
Version: P03.02

Note:
1. Support manually IP connection.
2. Support editing and exporting “Correction” file.
3. Support editing and exporting “Limit” file, and off-line editing.
4. Add scale line to “Spectrum Monitor” mode

Regards

[TurboTom]

...

So apparently, Siglent is not being too harsh. 

...

True but I guess for those who will purchase the machine with a firmware newer than 7.07, things may look different. Apparently, during the update 7.07 -> 8.01 the encrypted license codes will be generated if the corresponding files are correctly "prepared". During this update, the machine boots twice (at least mine) - would be interesting to know what it's doing there  .

And since a "proper" downgrade of the firmware is inhibited now (at least Siglent states this - I believe them and didn't test it), this "easy road" will be closed for future machines. There might be other options, for example if a set of files in the /usr/bin/siglent/firmdata0/ directory of a "liberated" machine gets leaked, it might run as well on a new machine, of course cloning the serial number of the "donor".

Cheers,
Thomas


P.S.  I modifed the attachment in my "patch instructions post" to be compatible with the firmware update (they have to be applied before the performing the update!) -- see here: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998366/#msg998366

[Bicurico]

As mentioned before, you can downgrade, copying the P07.07 ecomb file on top of the current one.

This would allow modifying the license file and then copying back the P08.01 ecomb file.

I have not tested this, though.

Regards

[rf-loop]

*** These posts should really be moved to the "Hack of Sigllent spectrum analyzer ssa3021X?" @thread... Can some MOD do this, please? ***

Regards,
Vitor

Lets hope all "how to try hack or how to hack" etc is important to move to this thread:

https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/

It looks like moderators are not interested about this.

The situation in which all messed up should be avoided.

Without MOD help it is possible also to other way. Some people can make one message where is quoted all this kind of messages. The chronology is also an important.

But, still I think that doing it now is better than later. After then there is small chronology mess with hack thread messages. But if do not it now, later it is perhaps more hard.

What is good point to start quote and copy to hack thread. I recommend that starting from first message about new 8.01FW.

I will do it starting from message 502 in this thread by tautech. Even when it confflict time order in hack thread.

I will do it but please do not send new messages to this or hack tread until done.
Later after done, please post all hack related messages to hack thread, only.   (use and test results wwith hacked or factory condition SSA of course to what ever thread.

So, please do not send  SSA "modifications - hack" message to this thread!

For mod-hack messages, this thread:
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/

[rf-loop]

Please, for avoid any mess and confusion,  please continue all modification and hack related "how to do" and hack study things to this "hack" thread:

https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg939720/#msg939720

There is now quoted in time order all messages from msg#502 in this thread. So there can continue these things.

For this thread all usual discussion, tests, bug reports, good things reports etc...just normal product discussion.

[bozidarms]

hi,
it is shame to lose something like that - hope in wisdom in this forum
- saga should be continued -

[Bicurico]

I think that 1Hz and 3MHz RBW is not within specification and can actually cause overload, which is probably why they removed it again.

I had an overload alarm once, when I was messing around trying out things on the SSA3021X with nothing more than an unamplified DVB-T antenna connected! I accidentally rotated the encoder while in RWB mode to 1Hz without noticing it and focused for some reason to the PC and only after a short period of time did I notice the overload alarm. Fortunaltly nothing broke, but it left me with an odd feeling about having the 1Hz option... So I disabled it myself, to prevent accidental setting.

What I am saying might be complete nonsense and the alarm may have been triggered by something else, but somehow I think one should not operate the filter out of specs.

Regards,
Vitor

[bozidarms]

I have done a lot of stuff with 1 RBW,  without any problem, but wit great experimenters enthusiasm.
Resolving power  of the instrument is simply extraordinary.

Maybe one question for analyzer experts:
SSA3000X is specified from 9kHz, but measurements is possible from 0Hz.
I have done some in audio range and have noticed that amplitude is attenuated,
everything else seemed to be fine.
Is it safe to measure so low frequencies ever, and when not why this is not blocked (in software?)?
Unfortunately, is not many stuff about that on the web?
Regards

[rf-loop]

I think that 1Hz and 3MHz RBW is not within specification and can actually cause overload, which is probably why they removed it again.

I had an overload alarm once, when I was messing around trying out things on the SSA3021X with nothing more than an unamplified DVB-T antenna connected! I accidentally rotated the encoder while in RWB mode to 1Hz without noticing it and focused for some reason to the PC and only after a short period of time did I notice the overload alarm. Fortunaltly nothing broke, but it left me with an odd feeling about having the 1Hz option... So I disabled it myself, to prevent accidental setting.

What I am saying might be complete nonsense and the alarm may have been triggered by something else, but somehow I think one should not operate the filter out of specs.

Regards,
Vitor

3MHz, 3Hz and 1Hz RBW, they are not specified in any place. It is fully possible they are for Siglent development department own use for study and develop these things. But this is just quess.

What I have looked, specially 1Hz, it looks that somehow Autoranging ADC system do not work ok with this RBW.

http://cp.literature.agilent.com/litweb/pdf/5952-0292.pdf

Look  chapter 3 and there figure 3-3.

Also with Siglent SSA there can find these noise floor level steps. But if no signal or very low signals only, and with 1Hz RBW you can see only straight line without noise floor. Then you start rise signal level carefully using 1Hz filter then these level steps can see. With some level there can see bottom line without even noise and then just near signal noise  start step up.... something like this agilent image. But something in automatic  leveling is not optimal with this unspecified filter.

[DL4RAJ]

I think that 1Hz and 3MHz RBW is not within specification and can actually cause overload, which is probably why they removed it again.

What I am saying might be complete nonsense and the alarm may have been triggered by something else, but somehow I think one should not operate the filter out of specs.

Regards,
Vitor

I didn't notice any overload but amplitude calbration get's lost with RBW of 3Hz and 1Hz at signal sevels at and below -130dBm
E.g. at -133dBm the indicated level is off by 4dB (low) and a -140dBm signal
isn't visible any more while a -143dBm signal at a RBW of 10Hz is clearly visible.
See my reply #115 at https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/100/
I cant't think of any useful application where one would need a RBW of 3MHz.

Regards

[rf-loop]

Is it safe to measure so low frequencies ever, and when not why this is not blocked (in software?)?
Unfortunately, is not many stuff about that on the web?
Regards

It is safe as long as you keep true input signal level inside specs. (because it attenuate highly low frequencies.) DO NOT rise signal level for better visibility and looking only what level SSA display.  Do not forget true level what is going to N connector.
Keep True level to input N connector inside specs and all is safe. From nearly zero. (zero frequency exist only in "simplified theory" books.

Also remember that max is defined for  20db or more attenuation and limited to max 3 minutes.

If some people want he can also modify his equipment (with his own risk) for starting 0Hz but I really do not recommend to jump over DC block. After then user need really know what he is doing and carefully. Also internal DC block capacitor can change with higher capacitance but it need understand how easy then some signal may cause damage.