Hack of Sigllent spectrum analyzer ssa3021X?

• #300 Reply
  Posted by TurboTom on 21 Feb, 2017 08:40
• Dimitar,
  
  this may be an indication for a bad block in your NAND FLASH. That's actually not uncommon, the same as you (almost) won't find hard disks without bad blocks, yet they are automatically remapped inthe HDs. The OS should hide the bad blocks in NAND memory as well, yet, since "dd" accesses the raw data of the chip, errors may appear. To read the partition, you may try the command
  
  

  Code: [Select]

  dd conv=noerror,sync if=/dev/mtdblock7 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock7-P0707.img
  I'm not sure if this switch works on the DD version implemented in the SSA3000X since I haven't got a machine with bad blocks to test. In case you need to restore your machine, you should be fine as long as you write back the original file as "dd'ed".
  
  Cheers,
  Thomas
• #301 Reply
  Posted by rf-loop on 21 Feb, 2017 10:47
• Quote from: TurboTom on 21 Feb, 2017 08:40

  Dimitar,
  
  this may be an indication for a bad block in your NAND FLASH. That's actually not uncommon, the same as you (almost) won't find hard disks without bad blocks, yet they are automatically remapped inthe HDs. The OS should hide the bad blocks in NAND memory as well, yet, since "dd" accesses the raw data of the chip, errors may appear. To read the partition, you may try the command
  
  

  Code: [Select]

  dd conv=noerror,sync if=/dev/mtdblock7 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock7-P0707.img
  I'm not sure if this switch works on the DD version implemented in the SSA3000X since I haven't got a machine with bad blocks to test. In case you need to restore your machine, you should be fine as long as you write back the original file as "dd'ed".
  
  Cheers,
  Thomas
  

  
  dd conv=noerror
  
   is not implemented in this "busybox".
• #302 Reply
  Posted by dpenev on 21 Feb, 2017 13:29
• Hi Gents,
  
  OK, so in case of bad blocks we don't have a way to backup at the mtd level.
  Has anyone managed to reflash some MTD partition from uboot?
  Has anyone managed to reflash an UBI volume from uboot?
  Do you know what nand flash chip the Analyzer is using (if I have to replace it)
  Are only those two directories unique as per instrument
     /usr/bin/siglent/firmdata0
     /usr/bin/siglent/usr/backup
  Do we know where the update script is located for 7.07?
  I want to check what it does so eventually get some idea what can happen.
  
  I hope I will not need all this info but knowing me I will update to 8.01 soon
  
  Sorry for the long questions list and thank you in advance!
  Dimitar 
• #303 Reply
  Posted by Dima on 21 Feb, 2017 20:24
• Hi Dimitar,
  I guess the flash chip is the Micron-MT29F2G08ABAEAWP.
  You can see it on Dave's tear down video. Datasheet is easy to find, just google.
  The chip you get for a few bugs at digikey.
  Reading and writing to the flash you will find many projects on the web. A cheap method would be
  to use the FT 2232h -56Q mini module via usb. Best buy also a TSOP 48 socket adaptor, so contacting  the chip will get no pain.
  But i am afraid you will need some good soldering skills and have to open the analyzer.
  Anyway, this is great idea.
  
  Cheers
  Dima
• #304 Reply
  Posted by steverino on 22 Feb, 2017 00:55
• Quote from: Dima on 21 Feb, 2017 20:24

  ...
  The chip you get for a few bugs at digikey.
  ...
  

  Any particular species of bug? 
• #305 Reply
  Posted by rf-loop on 22 Feb, 2017 07:47
• Quote from: dpenev on 21 Feb, 2017 13:29

  Hi Gents,
  
  OK, so in case of bad blocks we don't have a way to backup at the mtd level.
  Has anyone managed to reflash some MTD partition from uboot?
  Has anyone managed to reflash an UBI volume from uboot?
  Do you know what nand flash chip the Analyzer is using (if I have to replace it)
  Are only those two directories unique as per instrument
     /usr/bin/siglent/firmdata0
     /usr/bin/siglent/usr/backup
  Do we know where the update script is located for 7.07?
  I want to check what it does so eventually get some idea what can happen.
  
  I hope I will not need all this info but knowing me I will update to 8.01 soon
  
  Sorry for the long questions list and thank you in advance!
  Dimitar
  

  
  What is problem?
  
  If normal FW update fails due to flash problem, your SSA have 3 year factory warranty (if not expanded to 4 or 5 year warranty) . If it fails just call Siglent for repair.
  
• #306 Reply
  Posted by dpenev on 22 Feb, 2017 08:45
• Hi rf-loop,
  
  Yes you are perfectly right. I am just such a kind of person who tries so solve his problem himself if possible. (often it is better for the nature)
  Keep also in mind that if I have to send the instrument back for repairmen it means 1 month without it right?
  Take into account we already have MT29F2G08ABAEAWP in stock and we have facility to replace it if necessary.
  If I know that reflashing wouldn't take me much time I will go to this option for sure.
  But as far as i understand no one has done it yet?
   
  In addition I thought talking about my Analyzer here may be interesting for somebody else.
  
  But once again I still don't have issue, probably just some small possibility for an issue in the future.
  
  Additional note. nand flashes often goes in two flavors. Free and not free (less expensive) of bad blocks.
  Our experience with the version having bad blocks is that it is often problematic later in the product life.
  It is bad that Siglent has used nand flash chips having bad blocks. They use read only file systems but still ...
  
  Thanks
  Dimitar 
  
  
• #307 Reply
  Posted by tautech on 22 Feb, 2017 09:11
• Quote from: dpenev on 22 Feb, 2017 08:45

  Hi rf-loop,
  
  Yes you are perfectly right. I am just such a kind of person who tries so solve his problem himself if possible. (often it is better for the nature)
  Keep also in mind that if I have to send the instrument back for repairmen it means 1 month without it right?
  Take into account we already have MT29F2G08ABAEAWP in stock and we have facility to replace it if necessary.
  If I know that reflashing wouldn't take me much time I will go to this option for sure.
  But as far as i understand no one has done it yet?

  Maybe not, but to do so would ruin any chance of a future warranty claim if needed.
   
  

  Quote

  In addition I thought talking about my Analyzer here may be interesting for somebody else.

  It is, but not at the cost of possibly losing your warranty.
  
  
• #308 Reply
  Posted by dpenev on 22 Feb, 2017 10:27
• Indeed!
  
• #309 Reply
  Posted by Bicurico on 22 Feb, 2017 10:38
• It is OK to discuss hardware-modifications and repairs. The SSA3021X is still a fairly new device and probably all units are still covered by maintenance.
  
  However, in 2 years time, many will be without warranty and I expect to see some being sold in the second hand market.
  
  People will start hacking them and sooner or later the need of flash repair will arise. So why not discuss it now?
  
  I am by no means an expert in flash memory IC's, but there is something very positive about the SSA3021X: the serial number is stored in a regular file within the file system contained in the flash. Some manufacturers chose to store some special data like serial numbers in READ/WRITE protected memory banks of flash IC's. In these cases, exchanging such IC is difficult!
  
  With the SSA3021X I would expect it to be fairly doable: desolder the flash IC, get a replacement flash IC, program it externally (at least up to U-Boot), solder it and use the U-Boot console to flash the reamining firmware.
  
  But I agree with tautech and rf-loop: nobody tried to do that, because it wasn't necessary to do so up to now and because all devices are covered by warranty - if the flash fails, including the hacked ones!
  
  Regards,
  Vitor
  
• #310 Reply
  Posted by TurboTom on 22 Feb, 2017 10:48
• Quote from: dpenev on 21 Feb, 2017 13:29

  Hi Gents,
  
  OK, so in case of bad blocks we don't have a way to backup at the mtd level.
  Has anyone managed to reflash some MTD partition from uboot?
  Has anyone managed to reflash an UBI volume from uboot?
  ....
  

  
  I can confirm that some individuals successfully re-flashed their kernel / root partitions from U-Boot. I'm not sure if they had bad blocks in their FLASH chips but I doubt it, at least not in the corresponding partitions.
  
  The easy road (and the only that I know of) is via the internal Micro SD card socket since U-Boot checks for presence of a memory card during boot-up. It may well be possible to run the whole SA via a properly configured FS on a Micro SD - that's probably the way initial installation is accomplished at the factory. To gain access to the Micro SD card slot, the instrument needs to be disassembled (case opened / IIRC rear shielding removed). It's probably also possible to back-up the NAND partitions (with proper defect management) via U-Boot to Micro SD. But all this can be considered high-risk activity since a mistake may ruin your day... (read: your SA).
  
  Anyway, we've got complete NAND images of F/W 7.03 and 8.01 in the "community" so what's really important is to back up the configuration and calibration of your machine (on a FS base) since this is individual to each SA. If you need other images that are common to all machines, there will be a way to help.
  
  All the best,
  Thomas
• #311 Reply
  Posted by rf-loop on 22 Feb, 2017 11:47
• Quote from: TurboTom on 22 Feb, 2017 10:48

  
  
  Anyway, we've got complete NAND images of F/W 7.03 and 8.01 in the "community" so what's really important is to back up the configuration and calibration of your machine (on a FS base) since this is individual to each SA. If you need other images that are common to all machines, there will be a way to help.
  
  All the best,
  Thomas
  

  
  And this is important to do.  In FW 7 least calibration data because this can not copy from any other maachine.
  And if FW 8  cal data but now there is  also other extremely important things what can not copy from other unit. There is example individual product model license. Without it, it is SSA3010X.
  
  Also all other technical things are intersting and and also for possible some future needs it is good to have more and more valid information and knowledge collected.  All this is good and finally it may even rise product value for users and including also users after 3 year or  after >10 years.
  
  
  
• #312 Reply
  Posted by dpenev on 22 Feb, 2017 12:03
• I agree, the calibration is important.
  In this respect can someone confirm(or share some thoughts) that those two directories contain all the unique data for a given Analyzer?
      /usr/bin/siglent/firmdata0
     /usr/bin/siglent/usr/backup
  
  As per the update I did a quick check and the update is happening calling functions from /usr/lib/siglentlib.sh
  Probably "check_and_upgrade()"
  So basically they just do "nandwrite mtdN image" from linux. In theory nandwrite is bad block aware, so I and other having bad blocks should be OK.
  But I will cross fingers when I do my update
  
  
  
     
  
  
• #313 Reply
  Posted by rf-loop on 22 Feb, 2017 12:52
• Quote from: dpenev on 22 Feb, 2017 12:03

  I agree, the calibration is important.
  In this respect can someone confirm(or share some thoughts) that those two directories contain all the unique data for a given Analyzer?
      /usr/bin/siglent/firmdata0
     /usr/bin/siglent/usr/backup
  
  As per the update I did a quick check and the update is happening calling functions from /usr/lib/siglentlib.sh
  Probably "check_and_upgrade()"
  So basically they just do "nandwrite mtdN image" from linux. In theory nandwrite is bad block aware, so I and other having bad blocks should be OK.
  But I will cross fingers when I do my update
  
     
  

  
  I can not true confirm these two directories but I can confirm with disclaimer: as far as I know.
  As also can find in someone made instruction text V05 what can find in this thread.
  
  

  Quote

  bad block.

  I have updated equipment what have this situation  and in this case not any problem.
  
  

  Quote

  calibration is important.

  
  Yes, and also very important model license key. (it is in one .xml file in these folders if SSA have FW 8.
  In FW 7  update process to FW 8 system generate this license key for model what it is currently when it have FW 7.  Later it can not generate (exept factory) (1).  FW 7 update to FW 8 is big upgrade. It also make big improvement for TG.
  
  (1) exept: roll back to FW 7 and  again to FW 8  but this need - know how to do.
• #314 Reply
  Posted by dpenev on 22 Feb, 2017 13:50
• Quote

  Quote
  bad block.
  I have updated equipment what have this situation  and in this case not any problem.
  

  
  Oh rf-loop, this is  very relaxing!
  How do you know you have bad blocks, partition dump from using dd command?
  Was your bad blocks on the mtdblock7/rootfs?
  
  Thanks
• #315 Reply
  Posted by rf-loop on 22 Feb, 2017 14:34
• Quote from: dpenev on 22 Feb, 2017 13:50

  Quote

  Quote
  bad block.
  I have updated equipment what have this situation  and in this case not any problem.
  

  
  Oh rf-loop, this is  very relaxing!
  How do you know you have bad blocks, partition dump from using dd command?
  Was your bad blocks on the mtdblock7/rootfs?
  
  Thanks
  

  
  Yes in block7 (after around 10M...err, others all ok. )
• #316 Reply
  Posted by dpenev on 22 Feb, 2017 14:35
• good! I will update later on today.
  Thanks
• #317 Reply
  Posted by Mark11 on 22 Feb, 2017 19:12
• Thanks Vitor, kcbrown and Thomas for pointing me to the right direction.
  As you have suggested I started with Linux.
  I bought a book Just Enough Linux by Malcolm Maclean two months ago.
  My intention was to start playing with Raspberry Pi but now it has
  proved to be best spent two dollars (yes 2 US$). It was not necessary
  to learn a lot about Linux. Just a few basic commands to navigate file
  system in the terminal and some commands as /, cd, ls, cp, pwd, mkdir,
  rm, mv ... and I finaly understood what I have to do. I installed Ubuntu,
  opened terminal and practised until I got the basic idea how it all works.
  Then I read Mr. Li Xiu Ying's instruction again.
  The rest is history. 
  
  Thans guys. You are the best!
  
  Martin
• #318 Reply
  Posted by dpenev on 23 Feb, 2017 16:37
• Hi All,
  
  I have updated my Analyzer to V01.02.08.01.
  Even thought I seems to have some bad blocks (dd dump reports input/output error) on the mtdblock7 the update went OK
  I got few reboots during the update and now I am on V01.02.08.01.
  
  Thank you all for the help!
  Dimitar
• #319 Reply
  Posted by arturfra on 23 Feb, 2017 19:43
• Hi guys, I've a SSA3021X with 7.07 fw hacked with all options permanent enabled and until 3.2Ghz, just now I've upgraded to fw 8.01 and now it remains with 3.2Ghz feature but with all option OFF (only TG on because I've a valid licence key), Is it possible to activate all the options as before I made without loosing the serial number and then without delete the famous files ??
  
  thanks in advance
• #320 Reply
  Posted by videobruce on 23 Feb, 2017 23:20
• V 1.2.8.2 is out. Who will be the 1st to try??? 
  
  http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA3000X-Firmware-Update.rar
  
  

  Quote

  1. This firmware must be upgraded from V1.2.8.1 or later. If your SSA3000X has an earlier version, please to V1.2.8.1 first and then proceed to uplate to the latest version.
   2. Add socket/telnet-scpi, you can operate remote control through LAN port without NI-VISA installed. Please check SSA3000X Programming Guide for more details.
   3. Change two limit lines in different colours.
   4. When quit from TG, stay in“Auto”sweep.
   5. Lower some spurs when FFT.
   6. Improve the stability.

  
  
  (Link updated to a direct link for download)
• #321 Reply
  Posted by nugglix on 24 Feb, 2017 07:40
• Quote from: videobruce on 23 Feb, 2017 23:20

  V 1.2.8.2 is out. Who will be the 1st to try??? 
  
  http://siglentamerica.com/prodcut-gjjrj.aspx?id=5113&tid=227&T=2
  

  
  Thanks for the info!
  
  Download doesn't work atm, so I can't!
  
• #322 Reply
  Posted by tautech on 24 Feb, 2017 07:53
• Quote from: nugglix on 24 Feb, 2017 07:40

  Quote from: videobruce on 23 Feb, 2017 23:20

  V 1.2.8.2 is out. Who will be the 1st to try??? 
  
  http://siglentamerica.com/prodcut-gjjrj.aspx?id=5113&tid=227&T=2
  

  
  Thanks for the info!
  
  Download doesn't work atm, so I can't!
  

  This one does,(the Download button) just clicked on it to get a copy for my archives.
  http://www.siglentamerica.com/gjjrj-xq.aspx?id=5128&tid=15
  
  7.36 Mb .rar
• #323 Reply
  Posted by nugglix on 24 Feb, 2017 08:09
• Tried that already.
  There is something seriously broken atm.
  Transfer stops after a few kB, if you pause/resume it works for another few kB.
  Transfer rate is around 5kB/s, which I consider a bit on the low side...
  
  Will have a look at it from time to time.
  
• #324 Reply
  Posted by Bicurico on 24 Feb, 2017 08:12
• Strange.
  
  I could download the file without problems and did so a few times, just to check.
  
  I downloaded the new EasySpectrum and Programming Manual, with no issues either.
  
  I guess your ISP must be having some issues.
  
  Try this link: https://mediacdn.eu/m/media/wysiwyg/siglent/Downloads/Firmware/SSA3000X-Firmware-Update.rar
  
  It is from http://www.siglent.eu/Downloads
  
  Regards,
  Vitor