Hack of Sigllent spectrum analyzer ssa3021X?

[sjb]

Hi All,

I have a SSA3021X which has been upgraded to v1.2.9.3a. I have created a USB and put a copy of ecomb from v1.2.8.1, basline nsp_data_b, a NSP_system_info.xml (with my serial and the license options set) and a copy of telnet_11202.ADS.

Do the 'upgrade' trick with telnet_11202.ADS and I can telnet in (port 23) no problem.

I then go through the Oct 4th post of 'myexige' ...

mount -o remount, rw /
cd /usr/bin/siglent
killall ecomb
cp /usr/bin/siglent/usr/mass_storage/U-disk0/ecomb8 ecomb8
mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
cd firmdata0
cp /usr/bin/siglent/usr/mass_storage/U-disk0/NSP_system_info.xml NSP_system_info.xml
cp /usr/bin/siglent/usr/mass_storage/U-disk0/nsp_data_b nsp_data_b
cd ..
./ecomb8

... and when I run ecomb8, all I get is ...

WARNING: Logging before InitGoogleLogging() is written to STDERR
E0111 10:41:10.170817   933 hw_access.cpp:86] >>>>>CHWAccess::spi2open failed!
E0111 10:41:10.179559   933 hw_access.cpp:109] >>>>>CHWAccess::gpmc open failed!
check_and_upgrade:starting...
mount_fs: rw,ubi1_0,/usr/bin/siglent/usr
ubi1_0attached
MOUNT_DIR_NAME = /usr/bin/siglent/usr
TEST_RESTURN =
is_fs_mounted 0 ---

At which point the Telnet session becomes unresponsive and nothing else happens!

So, my question is ... are the hw_access.cpp failures normal? Why does TEST_RESTURN = is_fs_mounted 0 --- ??

Is there some thing that I've missed (something else that needs mounting??) or extra that needs doing? does something else need killing? do I need to issue a sync?

If I unplug the USB stick and reboot the SSA runs as it used to (same Model, same Options status, serial number still ok)!

TIA, Simon.

[fact]

@sjb:
Make sure to use the nsp_data_b file from message 748 (october 12).

[sjb]

@fact, yep I'm already using that.

I went back in an renamed (appended the x) the files in /firmdata0 and /backup (to move them out the way in case they were posing a write issue) before adding the baseline nsp_data_b (from #748) and NSP_system_info.xml (with my serial number in it, from post #737) and I got the same results with respect to ./ecomb8. Also tried a 'sync' before running ecomb8 to ensure that the changes had been committed from cache to to disc.

However, I now have a SSA3032X (All Option) with XXXXXXX as the serial number, so the regen of the license files did not happen, but it does seem to have opened up the SSA!

Still would like to figure out what is wrong with regen of the license files and why ecomb8 hangs! Maybe @tv84 or @myexige might have some thoughts on it.

[tv84]

Still would like to figure out what is wrong with regen of the license files and why ecomb8 hangs!

Read this carefully and execute.

[sjb]

Thanks @tv84.

If you're refering to ... "So my solution was to restore telnetd by not using ADS, but by creating sym link S15telnetd in /etc/rc5.d pointing to /etc/init.d/telnetd. Then using telnetd startd by /sbin/init, myexig’s script works perfect!!"...

So, how do you go about this 'link' in novice (to linux) terms. i.e. is it a script, file, or what? Sorry, it may seem quite straight forward to you guys, but I'm only used to Windows OS and embedded RTOS systems (not linux), so please be gentle!

TIA.

[grizewald]

Thanks @tv84.

If you're refering to ... "So my solution was to restore telnetd by not using ADS, but by creating sym link S15telnetd in /etc/rc5.d pointing to /etc/init.d/telnetd. Then using telnetd startd by /sbin/init, myexig’s script works perfect!!"...

So, how do you go about this 'link' in novice (to linux) terms. i.e. is it a script, file, or what? Sorry, it may seem quite straight forward to you guys, but I'm only used to Windows OS and embedded RTOS systems (not linux), so please be gentle!

TIA.

ln -s /directory/sourcefile /directory/linkname

[sjb]

Thanks all,

logged in using telnet from the telnet_11201.ADS (upgrade) and then ran ...

mount -o remount, rw /
cd /etc/rc5.d
ls -al
ln -s ../init.d/telnetd S15telnetd
sync

Rebooted the SSA and logged in using the builtin telnet (still there from earlier firmware version), then did the license gen process again using ecomb8 ... and BINGO! 

SSA3032X, All option permanent, with my serial number on the System Info page.

Thanks all  ...

[qwerty]

Hi,

I just got a Siglent SSA3021X
It has Firmware version: 1.2.9.2.a
After reading almostbthe entire topic, i was getting really confused :-)
So i am asking rather before doing something wrong....

What is the best current way of “upgrade” for having all the options?

Thanks!

[TOWERSIGNALS]

TO TURBOTOM AND THE LINUX EXPERTS
Guys,
  My older SSA3021 came with HW 07.03.00 and SW1 is still 1.2.8.2 - no updates. I did get a key from Siglent when the TG option became free and installed that so my TG is now Valid and Permanent. The Refl, AMG & EMK are still only temporary though.   I was finally able to copy some back up files to a new formatted 32Gb thumbdrive. The 64Gb didn't work.
  My SSA3021 did not have the "NSP_system_info.xml file but something almost identical called "NSP_sn_bandwidth.xml". I compared both files in Notepad and they follow the same format.
  I was reluctant to try the final hack as directed in Post #71 because the file sizes and names were different. I attached my "NSP_sn_bandwidth.xml" file on this post to see if that should be modified. Or should I just rename your "NSP_system_info.xml" from (Post #71) with my serial number in it. In both files the serial number is 14 characters long. Also tried this: root@am335x-evm:~# ls /usr/bin/siglent/upgrade/  and it returned:      datafs.img  &   firmdata0.img - two rather large image files - unknown contents.

    Your advice would be most appreciated.
TowerSignals

[Hecke]

Hi,
i just bought a SSA3021X Plus. I read a lot in this thread and i was able to set it to set it to 3.2GHz and to activate some options with the rename x Trick. Now the serialnumber is XX and the device is still named a 3021. There were no xml files in the backup folder. Dont know if thats okay so far, but the reflected measurement is not activated and for some options i havent found any information (rcv,rta, cat). Before i try to update to 2.2.1.2.5 i want to be sure to have tried it with the current firmware.  Telnet was enabled in 2.2.1.2.3r.  Maybe someone with a 3021X+ can tell his experience.
Many thanks in advance, regads Hecke

[leo013]

Hello, everybody,

I have read this thread several times and I am not sure how to update my SSA3021X to the SSA3032X.
Unfortunately my english is not good.
My SSA3021X has the following version:
SW1 1.2.9.1
SW2 20180320-1
SW3 000000D1
HW 07.03.00

Can someone please help me to update ssa3032x step by step?
Thanks a lot.

Greetings Wolfgang

[ct1bxt]

Hello, everybody,

I have read this thread several times and I am not sure how to update my SSA3021X to the SSA3032X.
Unfortunately my english is not good.
My SSA3021X has the following version:
SW1 1.2.9.1
SW2 20180320-1
SW3 000000D1
HW 07.03.00
Can someone please help me to update ssa3032x step by step?
Thanks a lot.

Greetings Wolfgang

Hi Wolfgang,

i was able to modify mine following post #597 of this treat.

Regards
Rodrigo

[leo013]

Hello, Rodrigo,
thank you very much for the info, this was the right way! 

The extension to 3.2 GHz worked, all options are enabled 



One more question: Can I install the latest update 1.2.9.3a with the serial number xxxx ?

And has anyone already recalibrated the SSA?
The Spectrum goes up slightly above 2 GHz.



Thanks again to Rodrigo!

Many greetings

Wolfgang DD1WKS

[stefkpl]

Hi everybody,

I would like to know if the hack can be work with the last version of SSA3021X plus ?
I don't know witch last version of the firmeware is actualy.
And I would like also to know, if I can remove hack, if I must do repair It

Thanks 

[pievke]

Hello all,first thanks a lot for information from forum,  i have a brand new ssa3021x with  FW 1.2.9.3a (without telnet access).
I used telnet_11201.ads, it stopped at 60% and i went with telnet into system.
Done a backup with dumpnand and hacked with
 rename the NSP_sn_bandwidth.xml  in NSP_sn_bandwidthx.xml in firmwar0  and backup folder
sync
logout

power off/on
go in system ----pwr on/preset----- reset&clear  ----- a.s.o.
In system info  i saw al options valid permanent and ser.nr. only xxxxxxxx
All ok
After this, i decided to make the ser,nr. in system info

logged in using telnet from the telnet_11201.ADS  60% and then run telnet 192.168. …..

mount -o remount, rw /
cd /etc/rc5.d
ls -al
ln -s ../init.d/telnetd S15telnetd
sync
reboot
Power off/on
Now i have permanent telnet access.

New USB stick with 3 files  ecomb8 – NSP_system_info.xml – nsp_data_b
This files i got from ecomb FW 8.1, the other from this forum and i installed my ser.nr. in NSP_system file
telnet 192.168.  and so on
mount -o remount, rw /
cd /usr/bin/siglent
killall ecomb
cp /usr/bin/siglent/usr/mass_storage/U-disk0/ecomb8 ecomb8
mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
cd firmdata0
cp /usr/bin/siglent/usr/mass_storage/U-disk0/NSP_system_info.xml NSP_system_info.xml
cp /usr/bin/siglent/usr/mass_storage/U-disk0/nsp_data_b nsp_data_b
cd ..
./ecomb8
result is: all option are valid permanent and my ser.nr. is visible in system information.

But i have a problem
I dont know  if it is really valid permanent. I can see 3,2ghz and If  i press the
mode key i see spec analyser and reflection meas for selection. I have not checked if it works.
but if i press file key i see nothing no file i believe this is not correct, there i expect some files.file menu bar is away for working in optionvalid permanent mode
what is wrong in my system? Has anyone an idea? Was the hacking steps not correct?
What is with the entry in rc5.d  i have done S15telnetd, but is S10 correct?

Info from forum:
 „So my solution was to restore telnetd by not using ADS, but by creating sym link S15telnetd in /etc/rc5.d pointing to /etc/init.d/telnetd. Then using telnetd startd by /sbin/init, myexig’s script works perfect!!"...

The information i dont understand : Then using telnetd startd by /sbin/init
Is this info important for using telnet without stick FW 11201.ads?
i am not a linux operator, sorry
Regards
pievke

[techneut]

I just got my ssa3021X PLUS and did the change. If you want it to show ssa3032X plus you need to edit the file nsp_trends_info.xml. Just change the numbers by type 1 and type 2. See below

<?xml version="1.0" encoding="UTF-8"?>
<nsp_trends_info_root>
   <device>
      <language>english</language>
      <pid>0x1305</pid>
      <vid>0xf4ec</vid>
      <product_type_1>SSA3032X Plus</product_type_1>  change to SSA3021
      <product_type_2>SSA3021X Plus</product_type_2>  change to SSA3032
      <manufacturer>Siglent</manufacturer>
      <Support_Touch_Flag>1</Support_Touch_Flag>   
      <Support_VXI11_Flag>1</Support_VXI11_Flag>
      <file_prefix>CP_</file_prefix>
   </device>
</nsp_trends_info_root>

For the reflection option you need to upgrade to the newer firmware.

regards, techneut
















;

[dimky]

Hi Guys.

Is it possible to hack SSA3021X to SSA3032X with 1.3.9.5 software version? Thanks.

[Elasia]

Anyone know if 2.1 -> 7.5 is possible on the plus?

Just got mine and enabled all.. tried a few lazy hacks but nothing interesting returned, functions still capped at 3.2

Interestingly a 3075 tag also enabled 3.2 so i wouldnt say its completely invalid

I'll eventually clone it to a flash drive and look deeper but really all i am interested in was the emi module and already got it lol

[tv84]

Interestingly a 3075 tag also enabled 3.2 so i wouldnt say its completely invalid

That I find it hard to believe.

Did you tried after configure a "tag" for 2.1 or 3.2? Because what must have happened is: unaccepted and the last valid remained.

[Elasia]

Interestingly a 3075 tag also enabled 3.2 so i wouldnt say its completely invalid

That I find it hard to believe.

Did you tried after configure a "tag" for 2.1 or 3.2? Because what must have happened is: unaccepted and the last valid remained.

Ah your right, so where is it caching the last known valid?

[tv84]

Ah your right, so where is it caching the last known valid?

In some config file. The "tags" get translated to other places internally when correctly applied. But I've forgotten these inner works...

[Elasia]

After looking at this some more they really thinned down the places it could be lurking, most of the system is now using cram making a read only file system with only a handful of exceptions like the siglent directory.  So you can make onetime changes and recompile a cram image but would have to do it for each firmware release as they just reimage it with their new one that would then be unmodded.

Was mainly looking at seeing if ssh could be kicked on, they left evidence of having had dropbear on there at one time.  Thinking of making a custom cram image to perma enable telnet but this telnet script ads file works just as well to do whatever


/dev/root / cramfs ro,relatime 0 0
devtmpfs /dev devtmpfs rw,relatime,size=69852k,nr_inodes=17463,mode=755 0 0
none /proc proc rw,relatime 0 0
none /sys sysfs rw,relatime 0 0
none /tmp tmpfs rw,relatime 0 0
none /dev/pts devpts rw,relatime,gid=5,mode=620 0 0
ubi1_0 /usr/bin/siglent ubifs ro,relatime 0 0
ubi2_0 /usr/bin/siglent/firmdata0 ubifs ro,relatime 0 0
ubi3_0 /usr/bin/siglent/log ubifs rw,relatime 0 0
ubi0_0 /usr/bin/siglent/usr ubifs rw,relatime 0 0
none /sys/kernel/debug debugfs rw,relatime 0 0

[Bearded One]

First post!  Just want to thank all of you for the help you provide. Thanks to this forum I now have a hacked Rigol MSO5074 and now a hacked Siglent SSA 3021X!

Now I can really start to play with the analyzer, I've been keeping the play time down to a minimum because I didn't want to use up all the free time on the options.

 

[Houseman]

1Hz and 3MHz resolution bandwidth lost?

Hi all. After upgrading successfully to latest firmware 1.2.9.3a and hack my 3021X to fully serialized permanent options I have noticed that I lost the 1Hz and 3 MHz RBW and VBW in the Easy Spectrum latest version starting from 10Hz. up to 1Mhz.

In manual mode by the way RBW goes from 1Hz to 1MHz (loosing the 3Mhz) while VBW goes fully from 1Hz to 3MHz.
Is it correct or am I missing some useful info??
Regards and thanks for the great work and info.

Steve

[tubularnut]

1Hz and 3MHz resolution bandwidth lost?

Hi all. After upgrading successfully to latest firmware 1.2.9.3a and hack my 3021X to fully serialized permanent options I have noticed that I lost the 1Hz and 3 MHz RBW and VBW in the Easy Spectrum latest version starting from 10Hz. up to 1Mhz.

In manual mode by the way RBW goes from 1Hz to 1MHz (loosing the 3Mhz) while VBW goes fully from 1Hz to 3MHz.
Is it correct or am I missing some useful info??
Regards and thanks for the great work and info.

Steve

The specs for the SSA3021X only show 3MHz on VBW, and 1MHz on RBW, unless there was a firmware update to expand it?

I have a SSA3021X Plus (opened up), and it only goes to 1MHz on RBW and VBW which matches the specs. Think I'm losing out here 

I'll install Easy Spectrum and see if I lose the 1Hz.