EEVblog Electronics Community Forum

Products => Test Equipment => Topic started by: papousek on May 13, 2016, 07:15:26 am

Title: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: papousek on May 13, 2016, 07:15:26 am
I been waiting for reviews and being really interested to buy one since i saw the hack of  ssa3021X from the post: (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/100/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/100/)) .

it seems the SSA3021X (Original 2.1G and options closed) are upgraded to 3.2G, full options opened.  :-+ :-+
it's impossible for me to judge if the hack really works since i dont have one,,,,anyone who got one at hand can do me a favor to review or to try the hack?

anyway,, 1600 bucks are not a easy budget for me.
Tks in advance
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on May 13, 2016, 07:44:02 am
It seems to me you'd want to grab the current FW update just in case it gets pulled.  :-\
Not sure if it has opened the hole to allow the upgrade but just in case it has here's the link:

http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA-firmware-0705.rar (http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA-firmware-0705.rar)
~7.5 Mb
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on May 13, 2016, 08:31:59 am
FYI it was reply #106
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg938261/#msg938261 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg938261/#msg938261)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Deuze on May 17, 2016, 01:27:21 am
Hi Papousek,
Here is some info you may want to know. In order to investigate whether it is a accident event.  I install the old FW again and find out the 'hack' was gone. But when I upgrade to FW07.05 again and do the same thing to it. The 'hack' appeared again! So I think it means people can really hack it with these steps.   ;) Wunderbar
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: drieg on June 20, 2016, 02:07:22 pm
Latest SSA3021X and SSA3032X units are hardware identical and SSA3021X is also calibrated up to 3.2GHz, so yes, SSA3021X is "upgradable" to SSA3032X  ;)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nctnico on June 20, 2016, 02:19:02 pm
Hi Papousek,
Here is some info you may want to know. In order to investigate whether it is a accident event.  I install the old FW again and find out the 'hack' was gone. But when I upgrade to FW07.05 again and do the same thing to it. The 'hack' appeared again! So I think it means people can really hack it with these steps.   ;) Wunderbar
The biggest question is whether a future firmware upgrade undoes the 'hack'.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on June 20, 2016, 02:47:13 pm
Hi Papousek,
Here is some info you may want to know. In order to investigate whether it is a accident event.  I install the old FW again and find out the 'hack' was gone. But when I upgrade to FW07.05 again and do the same thing to it. The 'hack' appeared again! So I think it means people can really hack it with these steps.   ;) Wunderbar
The biggest question is whether a future firmware upgrade undoes the 'hack'.

With Rigol this afraid and question have been many years, starting from old times DS1052E. ;)
(I  remember well these RS232 and terminal things what also I have done... and eevery next FW update we afraid if this all have gone... )
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nctnico on June 20, 2016, 05:02:53 pm
Hi Papousek,
Here is some info you may want to know. In order to investigate whether it is a accident event.  I install the old FW again and find out the 'hack' was gone. But when I upgrade to FW07.05 again and do the same thing to it. The 'hack' appeared again! So I think it means people can really hack it with these steps.   ;) Wunderbar
The biggest question is whether a future firmware upgrade undoes the 'hack'.
With Rigol this afraid and question have been many years, starting from old times DS1052E. ;)
(I  remember well these RS232 and terminal things what also I have done... and eevery next FW update we afraid if this all have gone... )
That may be but if downgrading undoes the 'hack' in the SSA3000 then upgrading is likely to do the same because appearantly the hack doesn't update the memory where the enabled options are stored. If the options where enabled permanently by the hack then they would remain after downgrading.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: continuo on June 20, 2016, 06:53:23 pm
I don't understand, what exactly is the hack on this one? Just an upgrade with the official firmware or is there something else to do? And will this hack enable the Tracking Gen as well?  :-//
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on June 20, 2016, 07:52:47 pm
I don't understand, what exactly is the hack on this one? Just an upgrade with the official firmware or is there something else to do? And will this hack enable the Tracking Gen as well?  :-//
First mentioned here:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg938261/#msg938261 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg938261/#msg938261)

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nctnico on June 20, 2016, 07:56:02 pm
I don't understand, what exactly is the hack on this one? Just an upgrade with the official firmware or is there something else to do? And will this hack enable the Tracking Gen as well?  :-//
First mentioned here:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg938261/#msg938261 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg938261/#msg938261)
We still need confirmation the options stay enabled in future firmware updates otherwise it isn't a hack but a bug. It would be sad when people make their purchase based on the availability of the full-featured SA for the base price only to find out they can only use an old firmware version which doesn't have the latest features.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: drieg on June 20, 2016, 08:12:52 pm
I don't understand, what exactly is the hack on this one? Just an upgrade with the official firmware or is there something else to do? And will this hack enable the Tracking Gen as well?  :-//
First mentioned here:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg938261/#msg938261 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg938261/#msg938261)
It is possible to turn SSA3021X into SSA3032X and enable all the options unofficially in a different (permanent) way as well ;)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: PsychoBoy on June 20, 2016, 08:17:42 pm
We still need confirmation the options stay enabled in future firmware updates otherwise it isn't a hack but a bug. It would be sad when people make their purchase based on the availability of the full-featured SA for the base price only to find out they can only use an old firmware version which doesn't have the latest features.
I would hardly call it hack since, man - you don't have to do anything, just upgrade FW, wtf :D? It's certainly a bug.
To me what is more important is to test it now if it really is capable of 3.2GHz span on 2.1GHz model and do all these enabled options work as well, because once you know the technical capabilities are the same then we can do hacks on software. Also if it works it's great base to start working on real hack - I mean for example you could dump memory from EEPROM when you had old FW and then dump once again when upgraded to new one, and see what's changed (maybe nothing unfortunately if it's related to real software bug like IDK wrong date checking?). By the way if it is possible to get trial versions for 48h, isn't it possible to manually adjust RTC clock and find and replace date in memory, I know it's pain in ass solution, but anyway.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: drieg on June 20, 2016, 08:37:02 pm
..
To me what is more important is to test it now if it really is capable of 3.2GHz span on 2.1GHz model and do all these enabled options work as well, ..
The answer to both your questions is yes.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: PsychoBoy on June 20, 2016, 08:43:24 pm
It is possible to turn SSA3021X into SSA3032X and enable all the options unofficially in a different (permanent) way as well ;)
Great info, would you mind to share your method?
The answer to both your questions is yes.
Then this is really nice. All Rigol hackers please take a look at this one!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: drieg on June 20, 2016, 09:32:03 pm
I actually can't because I'm a distributor of Siglent (and Rigol) test gear. Sorry for that.
But  don't worry, there are many talented guys who will figure out soon. My guess is, that these units will quickly become very popular due its hackability (like Rigol units).

Small hint: read tinhead's thread;)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on June 20, 2016, 09:58:08 pm
I actually can't because I'm a distributor of Siglent (and Rigol) test gear. Sorry for that.
But  don't worry, there are many talented guys who will figure out soon. My guess is, that these units will quickly become very popular due its hackability (like Rigol units).

Small hint: read tinhead's thread;)
Thanks for the hint drieg.
Looking at his threads:
https://www.eevblog.com/forum/profile/?area=showposts;sa=topics;u=2790 (https://www.eevblog.com/forum/profile/?area=showposts;sa=topics;u=2790)

Would I be correct the clues are in this one?
https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/ (https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Pinkus on June 21, 2016, 10:24:30 am
I actually can't because I'm a distributor of Siglent (and Rigol) test gear. Sorry for that.
I only can recommend Drieg as a distributor/reseller for Rigol and Siglent devices. I know him for years now. He is always very helpful (even months or years after the purchase!) and can help you whenever EVERY other reseller can't. So if you want to purchase such stuff, ask him for a quote.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: janekivi on June 24, 2016, 08:28:38 pm
Does it have telnet?

You know what I'm thinking here... ;)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on June 24, 2016, 09:43:21 pm
Does it have telnet?

You know what I'm thinking here... ;)
Early in Daves teardown and his only cursory inspection of the processor PCB he identifies a header that he calls as a Jtag and then another for programming.  :-\
https://www.eevblog.com/forum/blog/eevblog-892-siglent-ssa3021x-spectrum-analyser-teardown/ (https://www.eevblog.com/forum/blog/eevblog-892-siglent-ssa3021x-spectrum-analyser-teardown/)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: janekivi on June 24, 2016, 09:51:16 pm
Some kind of telnet prompt from LAN port? In shadow may be DES / crypt(3) root password.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Pinkus on June 24, 2016, 10:55:01 pm
Some kind of telnet prompt from LAN port? In shadow may be DES / crypt(3) root password.
Yes, telnet deamon is active - see screenshot.
But I do not know how to proceed from here.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nctnico on June 24, 2016, 11:47:58 pm
They didn't remove the banner? Maybe they kept the default Arago password as well: root
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Pinkus on June 25, 2016, 10:02:48 am
They didn't remove the banner? Maybe they kept the default Arago password as well: root
I am not a hacker, but  of course I already tried this (and some other) most obvious password without success.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: janekivi on June 25, 2016, 11:53:41 am
You can try crack this from SSA3000X_D07P03.ADS
xE062W/htPFyU
UNIX descrypt
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nowlan on June 25, 2016, 02:34:07 pm
does it need a salt?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: janekivi on June 25, 2016, 02:49:34 pm
I think it is DES / crypt(3) and 2 first byte is salt and for
https://hashcat.net/oclhashcat/
it is -m 1500
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on July 02, 2016, 11:41:24 am
I also got myself one of these SA's and more or less directly hooked a USB-serial converter to the internal UART port (after I checked the signals with a scope). Serial port settings are 115200, n, 8, 1, no handshake. I labeled the UART lines in one of Dave's photos. It is easy to connect to the three required lines with a 2.54mm header with the pins slightly deformed and pushed into the holes so they make contact with the pads / hole plating of the PCB. It's not even necessary to remove the metal shielding from the back of the instrument to access this port and no soldering required whatsoever.

I attached a bootlog of the analyzer but since I'm not too much into hacking or programming, I'm also not too sure what to do next... Arago Project standard login doesn't work as well as anything I thought of (as Pinkus already reported). Yet, U-Boot is working and I can stop the bootup process and enter the U-Boot menu. I'm not sure if this helps to make some progress.

It seems in order to force the analyzer into the "Werewolf Mode"  ;) (see the other thread), it's only necessary to change the date to 1st January 1970. If the date is reset to correct parameters, the analyzer will become a "Sheep" again... That's with firmware 07.05.

Cheers,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nctnico on July 02, 2016, 03:30:57 pm
You might be able to access the Linux filesystem through U-boot and overwrite the password file from there but it will take some carefull experimenting because you could brick the SA.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: cio74 on July 02, 2016, 06:38:08 pm
What is this hacking process supposed to do?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on July 02, 2016, 06:59:01 pm
What hack? As I interpret the situation, there is no "Hack" for the analyzer available so far. Changing the date to the first possible setting in the unix (Linux) operating system apparently puts the SA in a (intended or unintended by the manufacturer) "special" mode which removes the software limits. If this will still work after the evaluation period (48 hours) has passed and if a 2.1GHz device is calibrated over the full 3.2GHz is so far also unknown. As far as I can tell, the tracking generator hasn't stellar performance in the 2.1GHz range (though my device is from the new batch with the supposedly improved TG) and between 2.3 and 3.2 GHz there are excursions down to -5dB and up to +2dB. I would say, it isn't calibrated above 2.1GHz or Siglent configures especially selected versions for 3.2GHz that perform better in the upper frequency range. What's also not too amusing is that RBW is limited to 30kHz and above when the TG is active. For what reason? Seems like the TG performance really needs some improvement (hopefully possible in software). So far this "peeking around" in the booting process and file system focuses on a better understanding how the analyzer works.

Cheers,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kmike on July 02, 2016, 07:15:48 pm
I also got myself one of these SA's and more or less directly hooked a USB-serial converter to the internal UART port (after I checked the signals with a scope). Serial port settings are 115200, n, 8, 1, no handshake. I labeled the UART lines in one of Dave's photos. It is easy to connect to the three required lines with a 2.54mm header with the pins slightly deformed and pushed into the holes so they make contact with the pads / hole plating of the PCB. It's not even necessary to remove the metal shielding from the back of the instrument to access this port and no soldering required whatsoever.

I attached a bootlog of the analyzer but since I'm not too much into hacking or programming, I'm also not too sure what to do next... Arago Project standard login doesn't work as well as anything I thought of (as Pinkus already reported). Yet, U-Boot is working and I can stop the bootup process and enter the U-Boot menu. I'm not sure if this helps to make some progress.

It seems in order to force the analyzer into the "Werewolf Mode"  ;) (see the other thread), it's only necessary to change the date to 1st January 1970. If the date is reset to correct parameters, the analyzer will become a "Sheep" again... That's with firmware 07.05.

Cheers,
Thomas

Looking at the log:
- one would have to stop U-Boot
- add init=/bin/sh to the bootargs
- check how the filesystem is mounted, if mounted read-only then remount rw
- change the root password

Be careful if You want to try this method!

br,
mike
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nugglix on July 02, 2016, 07:19:36 pm
What's also not too amusing is that RBW is limited to 30kHz and above when the TG is active.

Any details and sources for that?
Would like to know before I buy that thing.

Cheers
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: cio74 on July 02, 2016, 08:01:33 pm
Thanks Thomas, I think most are after the TG software option? This is 160 EUR + VAT on the Siglent.eu wesbsite.

Or is it more and I am missing it...
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on July 02, 2016, 08:47:43 pm
What hack? As I interpret the situation, there is no "Hack" for the analyzer available so far......

If this will still work after the evaluation period (48 hours) has passed and if a 2.1GHz device is calibrated over the full 3.2GHz is so far also unknown. As far as I can tell, the tracking generator hasn't stellar performance in the 2.1GHz range (though my device is from the new batch with the supposedly improved TG) and between 2.3 and 3.2 GHz there are excursions down to -5dB and up to +2dB. I would say, it isn't calibrated above 2.1GHz or Siglent configures especially selected versions for 3.2GHz that perform better in the upper frequency range.
Will activation of the self cal improve what you are reporting?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on July 02, 2016, 09:02:13 pm
Thanks Thomas, I think most are after the TG software option? This is 160 EUR + VAT on the Siglent.eu wesbsite.

Or is it more and I am missing it...
Lots more, some of the options are many 100's in whatever currency.

EMI-SSA3000X    EMI Measurement Kit (Software)
AMK-SSA3000X   Advanced Measurement Kit (Software)
Refl-SSA3000X   Reflect Measurement Kit (Software)
TG-SSA3000X   Tracking Generator Kit (Software)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: cio74 on July 02, 2016, 10:18:25 pm
So you're saying they are poor and can't afford it. Basically that's the root of the issue, not enough income to support the purchase.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on July 02, 2016, 10:27:42 pm
So you're saying they are poor and can't afford it. Basically that's the root of the issue, not enough income to support the purchase.
NO.

Everybody wants something for free, don't you?

However just as the HW is one cost, accessories to enable complex measurement/s to be made are another and just like scopes a good set of accessories with cost just as much as the base unit, or more.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on July 02, 2016, 10:44:05 pm
Here's a screenshot of the message I get if I try to reduce the resolution bandwidth below 30kHz while the tracking generator is turned on. Since the message only appears for a relatively short time, and it isn't possible to save the screen with the message directly on USB-Stick, the photo with my cell phone didn't turn out too well. Anyway, it's readable. Yet, I don't understand why there's the lower limit for RBW with the TG open. Rigol's DSA800TG series hasn't got this shortcoming.

Cheers,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: cio74 on July 02, 2016, 10:47:50 pm
Sorry, it does not make much sense, you will have to pay for those probes and accessories if you want/need them, regardless of their cost.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on July 02, 2016, 11:16:24 pm
Yet, I don't understand why there's the lower limit for RBW with the TG open. Rigol's DSA800TG series hasn't got this shortcoming.
I've had a scan through the https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/)
thread for answers but maybe I missed it.

rf-loop may have some comment.....
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on July 02, 2016, 11:20:46 pm
I just did a quick scan of the manual http://www.siglentamerica.com/USA_website_2014/Documents/UserManual/SSA3000X_User%20Manual_UM0703X_E02A.pdf (http://www.siglentamerica.com/USA_website_2014/Documents/UserManual/SSA3000X_User%20Manual_UM0703X_E02A.pdf) and neither I found any information regarding this behavior -- strange! I guess I'll have to hook up another analyzer to the TG output of the SSA3000X and see if I'll find anything "strange"...
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on July 03, 2016, 04:33:58 am
Here's a screenshot of the message I get if I try to reduce the resolution bandwidth below 30kHz while the tracking generator is turned on. Since the message only appears for a relatively short time, and it isn't possible to save the screen with the message directly on USB-Stick, the photo with my cell phone didn't turn out too well. Anyway, it's readable. Yet, I don't understand why there's the lower limit for RBW with the TG open. Rigol's DSA800TG series hasn't got this shortcoming.

Cheers,
Thomas

With TG minimum RBW is 30kHz. (this is also most narrow filter what can not go to FFT mode)
What is problem with it?  Do it have too fast response or what?

Here is one small example, Nominal center frequency 21.953MHz, width ~3.5kHz Band Pass filter.  (in this example filter under test have problem)
With RBW30 also used Span is 30kHz!   (note also used VBW)
With TG  there is some DUT between TG output and SA input. This is your "filter" and it have most relevance, not SA RBW filter.
Of course this 30kHz Span is not limit. If narrow filter under test there  can use more narrow Span.

(http://i181.photobucket.com/albums/x2/aghp55/SSA3000X/SSA3k-esku/SSA3000X-21-TG-filter-work.png)


As sidenote here is limits with different RBW widths.

Sweep Span limits using FFT or Sweep (SWP) mode

Spectrum analyzer. (TG Off)
10Hz, FFT 33.83MHz, SWP ---

30Hz, FFT 106.6MHz, SWP 330kHz
100Hz, FFT 318MHz, SWP 3.7MHz
300Hz, FFT 793.6MHz, SWP 33,3MHz
1kHz, FFT 2.1GHz, SWP 371MHz

3kHz, FFT, SWP 2.1GHz
10kHz, FFT, SWP 2.1GHz

Spectrum analyzer + TG in use.
30kHz, FFT ---, SWP 2.1GHz
100kHz, FFT ---, SWP 2.1GHz
300kHz, FFT ---, SWP 2.1GHz
1000kHz, FFT ---, SWP 2.1GHz
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: MasterTech on July 03, 2016, 06:04:28 am
So the effective rbw is much less than 30khz although the displayed one is 30khz... weird but it works
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: KE5FX on July 03, 2016, 06:17:34 am
At lower bandwidths (presumably < 30 kHz), the sweep generator is not sweeping continuously.  It takes discrete steps in both frequency and time, captures a block of samples, and converts them to the frequency domain all at once. 

In other words, if the analyzer uses an FFT to implement its 100 Hz RBW, there is no moment in time when (e.g.) a signal of 10.000100 MHz is in the passband but a signal of 10.000500 MHz isn't.  So there's nothing to "track."
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nugglix on July 03, 2016, 07:46:23 am
Also went through the manual and didn't find any hint.

Thanks for the clarification!

Cheers
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on July 03, 2016, 07:52:35 am
So the effective rbw is much less than 30khz although the displayed one is 30khz... weird but it works


Effective filter is DUT between TG out and SA in!

(I do not know what happend to my last message with more deep explanations but it is gone... and just now not time to write it all agen)



If TG is used for narrow and/or  steep shape filters user need be careful with SWEEP speed adjustment! In this case SA's defaults are not at all good for use.
RBW30kHz sweep speed default is very far too fast. User need understand basic fundamentals about theory and/or have practical experience enough for understand how to adjust system for acceptable result.  It need know how fast frequency can change! (DUT response time)
Look my previous image where is 21.9MHz 3.5kHz filter example. With 30kHz RBW SA can sweep much much more fast but why I have reduced Sweep time. Of course. Effective filter is between TG out and SA in and adjustments need do in this case for it, not for RBW30kHz gaussian type  filter in SA.
In some cases RBW30kHz step response speed is limiting factor but in other case filter under test give limits and user need take care about this.


Just for information
Here attached  SA  RBW30kHz filter top shape.  Think filter "speed" - simplified, if you go too fast or level change too fast  it do not have time to reach top.

-0.1dB BW 5.6kHz
-1.0dB BW 17.3kHz
-3.0dB BW 29.9kHz
-6.0dB BW 42.3kHz

(Filter shape factor -3dB / -60dB is around 1:4.5)

(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=237482;image)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on July 03, 2016, 02:23:52 pm
Okay, I did some more in-depth testing of the TG behavior of the SSA3000X and got some interesting results. Especially considering the information provided in the last few posts made me want to understand how the SSA is scanning the frequency range and if the TG is outputting a discrete set of frequencies or if it is "really" sweeping through. Since a test with another SA didn't turn out conclusive (both scanning at arbitrary frequencies/speeds), I decided to hook up the TG output to my scope. The SSA was configured at a center frequency of 10MHz and a span of 3MHz, sweep time 5 seconds. And that's a clip of what i got: http://www.turbinemuseum.de/files/HF_Wobble.3gp (http://www.turbinemuseum.de/files/HF_Wobble.3gp) It's obvious that upon the sweep itself, there's a kind of frequency wobble superimposed, maybe to provide the bandwidth within one of the 30kHz "slots" that are (supposedly) analyzed at a time. But it's also well possible that the "wobble" is just an artefact of the PLL when it locks onto the new frequency during the sweep.

I then checked the TG at zero span to find out if the center frequency has "macroscopic" increments or if it's more or less continuously adjustable -- I found the latter to be the case.

After that, I wanted to understand if the TG frequency at a slow-rate sweep moves in increments (besides the wobble) and I decided to look at the signal with a delay of 30µs after the trigger. Once again, settings were 10MHz center frequency, 3MHz span but this time 1000 seconds sweep time. It appears that the "average" frequency sweeps continuously, see here: http://www.turbinemuseum.de/files/Smooth_Sweep.3gp (http://www.turbinemuseum.de/files/Smooth_Sweep.3gp)

I did the same tests with the Rigol SA for comparison. This instrument sweeps the selected frequency range at increments that match the span divided by the number of horizontal pixels available on the display. This means, provided the "wobble" of the Siglent SA TG is intentional, the siglent will detect a very narrow BW "event" when it's within an "increment" whereas it's pure coincidence on the Rigol if the TG at larger increments "hits" the specific frequency that a DUT characteristic changes significantly. I.e. the Siglent TG is better at "finding" resonances and the like at wide spans while the Rigol TG is better suited for analyzing devices at narrow spans.

If considering these findings, it also becomes obvious that initially Siglent planned to implement more analog bandwidth settings (by means of the two four-point switches in the last IF section and the unpopulated filter circuitry in between) but finally decided to go the digital route. Yet, it should be possible to implement digital filtering as well without the FFT function and then the RBW would probably permit lower values with the TG running.

For comparison I tested a high accuracy crystal (first photo) on the Siglent (the best I could get  with RBW 30kHz, VBW 10Hz and span 10kHz), the same settings on a Rigol DSA815TG and finally on the same instrument with RBW 100Hz and VBW 10Hz. Only in the last configuration, both series- and parallel resonance are clearly visible while the first parameter set on the rigol is completely useless. The Siglent at least detects the series resonance fairly accurately while the parallel resonance is covered with artefacts (why?). Maybe I made some mistake with my settings? At least as yet to me it seems the 30kHz RBW limit with the TG active is a major shortcoming on the SSA3000X.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on July 03, 2016, 05:56:06 pm
Just as simple as can and also xtal loading really rotten but this is not problem because this is not xtal test but just for example about display.

Btw...(Sunday evening puzzle ;) )  in old times we have done thousands of sweep using logamp, detector,  sweep gen and just oscilloscope. Where is RBW filter? Just as wide as scope response is. ;)


(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=237606;image)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on July 04, 2016, 08:15:47 pm
root password is "ding1234"  8)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: MasterTech on July 04, 2016, 08:47:02 pm
root password is "ding1234"  8)
Kudos to you!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on July 05, 2016, 06:21:37 am
root password is "ding1234"  8)
Kudos to you!

Actually I don't deserve the merits but rather janekivi who provided the relavant information in this post: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg969909/#msg969909 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg969909/#msg969909)

Cheers,
Tom
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on July 05, 2016, 07:31:59 pm
Today I had a little time to play around in the files system of the analyzer, but so far I wasn't able to identify the file that configures the device as a 3021 or a 3032.

Yet, there's an interesting directory "/usr/bin/siglent/firmdata0/" that contains a file "fun_opt_valid_config.xml". This file defines the evaluation period of the add-on options. They can easily be adjusted to higher values (first the corresponding partition has to be re-mounted read-write, then the file can be edited). Deleting the file will cause a new one to be generated during the next bootup with the standard 48 hours test period reenabled.

There's one more funny file in this directory which (almost...) caused me some headaches, named "monster.txt ". This file is seven bytes long and just contains the phrase "hack!!!" The file only appears after the analyzer date had been set to 1st January 1970 and hence the software restriction circumvented. It's important to notice that there's a space behind the extension "txt" and so the name cannot be entered on the console. Wildcards etc. have to be used to access it. If an analyzer that had been used in "Werewolf Mode"  ;) has to be returned for repair and the file system is still accessible, it's probably a good idea to delete this file (after resetting the date to something "reasonable" of course).

There's another "monster.txt" that just contains the phrase "NULL" in "/usr/bin/siglent/usr" but this doesn't appear to be an indicator of any "tampering" it seems. It also doesn't have the added "space" behind the file name, so it's accessible without any tricks.

It's quite funny that during bootup, regardless of the device model, always calibration data for the whole 3.2GHz range are loaded.

Anybody else poking around in the analyzer?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: cio74 on July 05, 2016, 07:51:47 pm
I know you'll be surprised but some of us are actually considering buying the options we need.


Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nctnico on July 05, 2016, 08:35:44 pm
There's one more funny file in this directory which (almost...) caused me some headaches, named "monster.txt ". This file is seven bytes long and just contains the phrase "hack!!!" The file only appears after the analyzer date had been set to 1st January 1970 and hence the software restriction circumvented. It's important to notice that there's a space behind the extension "txt" and so the name cannot be entered on the console.
You can enter the name on the console by putting the filename between "".
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: phs on July 30, 2016, 01:36:23 am
FYI:

Recently received SSA 3021X -w- TG option
SW1    100.01.02.07.06
HW     07.03.00
Cal date: early July

Can telnet/log in as root via LAN.  Tried changing date/time:

# date -u 010100001970

Date/time is successfully updated, and it can be verified on the unit LCD.  System Info/Option: All options stay the same, showing just TG Permanent.

Power-cycle unit (did reboot from CLI) and date reverts to current date, options not changed.

Change date successfully to epoch via System/Data & Time on unit keypad.  All options stay the same.  Reboot.  Date stays @ epoch, options still unchanged.

That was all with firmware that was originally installed on the unit when received, v6.  Installed the v5 firmware Tautech linked to, and repeated all of the above.  Still no werewolf to be found, boo hoo...

Conclusion:  The version 6 firmware, or having an option pre-installed, like the TG, operator error, or some other issue prevents this unit from entering "werewolf mode".

Or, maybe they changed the v5 firmware?  I noticed in one of the pics from the post from Deuze that the firmware version was "100.01.02.07.05.h".  My version 5 shows "100.01.02.07.05".  Deuze's HW version is also different than this one, but all else looks the same.

Anyway, just wanted to let folks know, in case this may affect their purchase decision, or these additional data points are helpful in general.

Unfortunately, I'm just a low-life lurker who has way more projects than I can handle right now.  However, if I discover anything more interesting, I will absolutely let you folks know.  Love the characters on these forums, by the way, and best of luck to all!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on July 30, 2016, 01:40:53 am
Can we have an update as to which FW versions have been used to enable "werewolf" (3.2 GHz) mode?

Anybody want to write an upgrading  "For Dummies" guide?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: MasterTech on July 30, 2016, 05:46:05 am
phs, what about editing the fun_opt_valid_config file that TurboTom mentioned above?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: phs on July 30, 2016, 01:43:59 pm
Hi MasterTech,

At this point I trust that editing fun_opt_valid_config.xml works, but I'm hoping there is a better solution.

Edit to clarify sentence...
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: peterdb on August 05, 2016, 11:04:17 am
Can we have an update as to which FW versions have been used to enable "werewolf" (3.2 GHz) mode?

Anybody want to write an upgrading  "For Dummies" guide?

Hacking the SSA3021x for experienced dummies.

Login to the machine using telnet or a direct serial connection all described earlier in this thread.

Optionally plugin an USB stick in the system for securing backups from the system.
It will be automatically mounted at /usr/bin/siglent/usr/mass_storage/U-disk0

the “mount” command shows you what’s mounted where and if it’s in rw or ro mode.

make a backup of the relevant folders in the /usr/bin/siglant folder in case you break anything.
example:
cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SSA3021x_backup
cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SSA3021x_firmdata0

If you feel comfortable it’s time to start hacking.

Stop your analyser with this command.
killall ecomb
Your spectrum analyser display will go into freeze and stop operating, but don't worry it’s computer is still running.

Killing is necessary because the spectrum analyser is monitoring the /usr/bin/siglent/firmdata0 folder and we want to play with the contents of this folder, and it’s using almost all the cpu time, so your console becomes more responsive as a bonus.

now remount the firmdata0 folder in rw mode with this command.

mount -o remount,rw /usr/bin/siglent/firmdata0

now edit the system info file with “vi”
vi /usr/bin/siglent/firmdata0/NSP_system_info.xml

change the licence node into this:

<license><_3032>TRUE</_3032><_3030>FALSE</_3030><_3021>FALSE</_3021><_tTG>TRUE</_tTG><_tEMI>TRUE</_tEMI><_tMeas>TRUE</_tMeas><_tCAT>TRUE</_tCAT><_TG>TRUE</_TG><_EMI>TRUE</_EMI><_Meas>TRUE</_Meas><_CAT>TRUE</_CAT></license></system_information>

Notice that temporally licences have a lower case “t” in front of them.
To make them permanent just add them at the end without the “t” as shown above.

now use the “sync” command to write all data to disk.

now remount the firmdata0 folder in ro mode with this command.

mount -o remount,ro /usr/bin/siglent/firmdata0

It’s now time to start the analyser again with this command:
/usr/bin/siglent/ecomb &

The analyser starts logging to the console.
The hack is complete and all options should be permanent and you have 3.2 GHz bandwidth.

you should now give the "reboot" command to reboot the machine.
There is still one little thing you need to take care of.
Wipe the user data because it was stored when the machine thought is was a SSA3021x where it’s now a 3022x, and this results in errors in the logs because the XML isn’t compatible.
Goto: System —> Pwr On/Preset —> Reset & Clear to remove all previously local stored user data.

That was easy, actually a little bit to easy as I might say.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kado on August 05, 2016, 02:33:43 pm
@peterdb
thanks a lot for your guide.
Since i am not very familiar with linux, vi and telnet i have some questions:

what fw version have you edited? 7.05 or 7.07
is the "sync" a vi command or linux? Type in sync on linux promt without any parameter?
what does sync do?

In vi after editing is finished i have to :wq! for write and quit is that correct?

Thanks for help
Karsten
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nctnico on August 05, 2016, 02:51:01 pm
sync is a Linux command and it doesn't need parameters. When it comes to vi you better read a tutorial first: http://www.howtogeek.com/102468/a-beginners-guide-to-editing-text-files-with-vi/ (http://www.howtogeek.com/102468/a-beginners-guide-to-editing-text-files-with-vi/)
I have used vi in the past but had a skilled operator sitting behind the keyboard and I told him the changes I wanted. He insisted we should use vi for a complex text editing job ^-^
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: peterdb on August 05, 2016, 02:53:04 pm
@Kado

I used fw version 7.07 but it would surprise me if this doesn’t work with 7.05

sync is a linux command that writes all data that is currently somewhere in the cache to disk so you can remount the volume without loosing data, but not using the command will probably work as well.

sync works without any parameters.

vi is ended with the :wq! command, and if your lost somewhere jou can always abort with :q!
No data will be saved and you can try to edit again.

Once your in vi you can navigate to the part you want to edit with your cursors and then press i to enter edit mode.
pressing escape leaves the edit mode.

If you want to delete a character move your cursor over it and press x when not in edit mode of course.

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kado on August 05, 2016, 03:01:25 pm
@nico and peter

thank you both for your advice.
Will read the vi tutorial first, then give it a try on my machine.
Karsten
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: peterdb on August 05, 2016, 03:09:46 pm
If you want to practice on a similar OS as the spectrum analyser try the virtual BusyBox
https://busybox.net/live_bbox/live_bbox.html

The spectrum analyser OS is based on this BusyBox distribution, so you can practice al your commands.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kado on August 05, 2016, 05:23:38 pm
@ all

peters guide is working !!! Could upgrade with success, but lost SN  :-\

BTW: if you are gone in FW 07.05 into "Werewolf Mode" you should remove the file "monster.txt " which TurboTom mentioned in this thread because if this file is present the actual FW showed in SYS Info has an .h appended. (h = hack !?)

So now have 3.2 GHz and all Options Sta: ON and Valid: Permanent, but SN now 0123456789 !!!

Karsten
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: peterdb on August 05, 2016, 05:39:39 pm
Strange, I did not loose my SN during the procedure.

But no worries, the SN is stored in the same file you had to edit to get it working, so just repeat the procedure, but now re-enter the original serial number.

You made a backup I hope to retrieve the original serial?

Peter
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kado on August 05, 2016, 05:51:20 pm
Ohh O.K. you dont lost your SN, let see what i have made wrong!?

FYI: i also lost the original Host ID, so have to put in a new IP-Adress after reboot! (DHCP active)
I have edited the file with the vi, not copy anything from your text. Maybe any typos...
I will try to edit the SN in the NSP_system_info.xml file.

Again thanks for your help
Karsten
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kado on August 05, 2016, 06:11:59 pm
think anything is going wrong:

after reboot and new telnet session the file dont contend the lincence node i has edited and has only 237 bytes:
-rw-r--r--    1 root     root           237 Aug  5 19:04 NSP_system_info.xml

root@am335x-evm:/usr/bin/siglent/firmdata0# cat NSP_system_info.xml
<?xml version="1.0" encoding="UTF-8"?>
<nsp_system_info_root>
  <device>
    <system_information>
      <serial_number>
        <chip>0123456789</chip>
      </serial_number>
    </system_information>
  </device>
</nsp_system_info_root>
This is looking without mounting filesystem to rw.
Karsten
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: peterdb on August 05, 2016, 06:33:17 pm
this is what the file should look like:

<?xml version="1.0" encoding="UTF-8"?>
<nsp_system_info_root>
  <device>
    <system_information>
      <serial_number>
        <chip>0000000000000</chip>
      </serial_number>
    <license><_3032>TRUE</_3032><_3030>FALSE</_3030><_3021>FALSE</_3021><_tTG>TRUE</_tTG><_tEMI>TRUE</_tEMI><_tMeas>TRUE</_tMeas><_tCAT>TRUE</_tCAT><_TG>TRUE</_TG><_EMI>TRUE</_EMI><_Meas>TRUE</_Meas><_CAT>TRUE</_CAT></license></system_information>
  </device>
</nsp_system_info_root>

I made my <chip>00000000000</chip> zero only for the post.

Are you sure you stopped the analyser with the “killall ecomb” command prior to mounting the filesystem in rw mode.

Did the analyser go into freeze?
The analyser must be stopped before you continue with remounting the file system.
the ecomb process is also the process that makes the monster.txt file and acts as a watchdog, so it may not run during editing.

after you edited the file make sure you remount the system in ro mode
check with the mount command that firmdata0 is really in read-only mode
before you start the analyser with the /usr/bin/siglent/ecomb & command.

dont forget the & sign.
It runs the analyser in the background.

Once the analyser is running give the reboot command, and then it will make a backup of the system_info file in a regular way.

also make sure there are no other files in the firmdata0 folder then these:
NSP_system_info.xml
NSP_trends_config_info.xml
calib
fun_opt_valid_config.xml
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: peterdb on August 05, 2016, 06:47:31 pm
another way of fixing this is to edit the NSP_system_info.xml in the backup folder in here:

/usr/bin/siglent/usr/backup

then delete the NSP_system_info.xml in the firmdata0 folder bij the procedure where you stop the analyser with the kill command and remount the firmdata0 in rw mode.
after the file is deleted and you gave the sync command unplug the power.

After powering up the earlier edited backup file will be restored.

But only use this as a last resort.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on August 05, 2016, 06:55:05 pm
Okay, since it's now public anyway, please see the attached method that I figured out. The good news is that also the 1HZ RBW is now working even though it's quite slow (but for obvious reasons).

Cheers,
Thomas

P.S.: I found out that in order to make the instrument more responsive during the telnet session, it's not necessary to kill any application but to just open the "System -> System Info" screen.


Edit: Updated Attachment -- This modified version of the patch instructions will work up to firmware 7.07, will not activate the 1Hz and 3MHz RBW options but is compatible with the firmware update to the new 8.01 version without losing the "liberated" options. Apply it before updating the firmware, even if you used the "old" patch before!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: peterdb on August 05, 2016, 07:28:29 pm
Compliments Thomas,

This is defiantly a more safer way of doing it and it could also help Karsten to fix his problem.
Consider implementing my hack for obtaining a permanent licence this could be a winner.

Cheers,

Peter
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kado on August 05, 2016, 07:31:48 pm
@peter and tom

i have edited the NSP_system_info.xml fully new by hand with vi! After mount ro and start ecomb & and reboot i got my SN back  :-+
All Options stay ON  :-+

Should i test anything before power off / on 230V again?

Greetings
Karsten
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kado on August 05, 2016, 07:33:44 pm
@tom

where are the differences between your guide and peters ?
should i make it again by your guide?

Karsten
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: peterdb on August 05, 2016, 07:39:40 pm
@Karsten

This is really good news!! :)

The differences between Thomas method and mine are the way the permanent licences are obtained, and the way the hack is distributed.

So if everything works, no need to change anything.

Cheers,

Peter

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kado on August 05, 2016, 07:43:20 pm
thanks peter for info!

Is there realy a 1 Hz RBW ? I could get only 10 Hz RBW until now.

Karsten
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on August 05, 2016, 07:52:31 pm
Karsten -

yes there is a 1Hz RBW mode that had been activated in the "Werewolf Mode" of the 07.05 firmware. So it had to be possible to enable this "officially" as well, which is done by including the definition <_t1HZ>TRUE</_t1HZ> and/or <_1HZ>TRUE</_1HZ> in the options definition line. I found that editing the fun_opt_valid_config.xml with the <tEffect> parameter set to -1 for the desired options also enables them permanently. So there are several methods to achieve the desired goal.

Cheers,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kado on August 05, 2016, 08:12:17 pm
@tom and peter

O.K. got it.
I tried toms method via USB stick and it works! Also now the 1Hz RBW  :-+
Thank you both for your "online" help, so now i can go to bed without headage...

Karsten
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on August 05, 2016, 09:20:01 pm
I'm sure if Siglent doesn't lock this door, this SA will become the favorite instrument among the hobby users and they will sell huge quantities (relatively speaking). On the other hand, Rigol will probably notice a painful drop in sales of their DSA800 series (up to the DSA832) since the "improved" Siglent offers so much more for the money. The SSA3021X may become what the DS1000Z is among the oscilloscopes or the FLIR E4 among the thermal imagers...

Cheers,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on August 05, 2016, 10:52:50 pm
Karsten -

yes there is a 1Hz RBW mode that had been activated in the "Werewolf Mode" of the 07.05 firmware.
I wasn't sure of that from a few weeks back so I hunted back through the threads and AFAIKT 7.07 had been released for a short while so I find it hard to believe rf-loop would keep using 7.05. He may chime in and confirm just which FW he used at the time.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on August 06, 2016, 06:31:45 am
Karsten -

yes there is a 1Hz RBW mode that had been activated in the "Werewolf Mode" of the 07.05 firmware.
I wasn't sure of that from a few weeks back so I hunted back through the threads and AFAIKT 7.07 had been released for a short while so I find it hard to believe rf-loop would keep using 7.05. He may chime in and confirm just which FW he used at the time.

Every single test, image, data, etc  what I  have published in this EEVblog forum have used  100.01.02.07.05h only.

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: peterdb on August 08, 2016, 07:46:17 am
Karsten -

yes there is a 1Hz RBW mode that had been activated in the "Werewolf Mode" of the 07.05 firmware. So it had to be possible to enable this "officially" as well, which is done by including the definition <_t1HZ>TRUE</_t1HZ> and/or <_1HZ>TRUE</_1HZ> in the options definition line. I found that editing the fun_opt_valid_config.xml with the <tEffect> parameter set to -1 for the desired options also enables them permanently. So there are several methods to achieve the desired goal.

Cheers,
Thomas

In the fun_opt_valid_config.xml you also find a <t3M> option besides the <t1HZ> option.
Enabling the <t3M> option extends the range of the Resolution Bandwidth (RBW) filter to 3 MHz, where it’s now limited to 1MHz

Cheers,
Peter
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: brucer37 on August 19, 2016, 11:45:51 am
There is still one little thing you need to take care of.
Wipe the user data because it was stored when the machine thought is was a SSA3021x where it’s now a 3022x, and this results in errors in the logs because the XML isn’t compatible.
Goto: System —> Pwr On/Preset —> Reset & Clear to remove all previously local stored user data.

My SSA3021X came with 07.06 firmware. This version does not have a Reset & Clear. I presume earlier firmware versions also do not. I have since upgraded to 07.07.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on August 19, 2016, 12:32:26 pm
There is still one little thing you need to take care of.
Wipe the user data because it was stored when the machine thought is was a SSA3021x where it’s now a 3022x, and this results in errors in the logs because the XML isn’t compatible.
Goto: System —> Pwr On/Preset —> Reset & Clear to remove all previously local stored user data.

My SSA3021X came with 07.06 firmware. This version does not have a Reset & Clear. I presume earlier firmware versions also do not. I have since upgraded to 07.07.

7.07 is first version where is Reset&Clear.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: peterdb on August 19, 2016, 04:09:48 pm
Correct the 7.07 firmware has the reset & clear.

The reset & clear is necessary to prevent errors in the logs while reading the user preferences configuration xml’s during boot time once it’s changed into a SSA3022x.
You'll find the config xml’s here:
/usr/bin/siglent/usr/config

you find the logs here:
/usr/bin/siglent/usr/log

The “New.ERROR” log always points to the latest error log
If after a reboot of the analyser this log does not show XML read errors the reset & clear is not necessary.

In the PwrOn/Preset menu you can store your own preset, and this will probably also fix it because it overwrites the previous configuration.

As far as I’m aware your SA will also work fine even with the errors in the log.
I presume the errors will automatically disappear over time due to normal use.

Now you know where everything can be found, you can check for yourself if any action is needed.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dk5ya on August 27, 2016, 04:46:43 pm
Gentleman,

kind regards to Tom and the group. Got my 3021X today, unpacking, checking for Ser. N°, 10 minutes later it became a 3032X  :)
Sold my old HP 8592B instead few days ago since I'm no longer active beyond 3 gigs.
Ah, what a brand new world having a rather sharp and coulered screen in front instead of the old ray tubes.

Udo

(http://www.dk5ya.de/img/p1090506.jpg)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: pascal_sweden on August 27, 2016, 05:21:34 pm
Nice upgrade from a dinosaur to a state of the art full color spectrum analyzer :)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on August 27, 2016, 07:27:57 pm
Gentleman,

kind regards to Tom and the group. Got my 3021X today, unpacking, checking for Ser. N°, 10 minutes later it became a 3032X  :)

And with FW 7.07.  8) I wasn't sure if that was possible, thanks for the confirmation.

Welcome to the forum dk5ya
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: MF-jockey on August 30, 2016, 07:38:29 pm
Dear tinkerers,

I also have a 3021X patched to 3032X since some days, many thanks to Tom for the easy USB-Stick method.

Today I want to enter the EMI mode, but it wasn't present at the menue. What must I do to get the EMI function?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dk5ya on August 30, 2016, 09:11:19 pm
Today I want to enter the EMI mode, but it wasn't present at the menue. What must I do to get the EMI function?
Pity, same here. No way to load EMI mode via mode select. Not part of the menu.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dk5ya on August 30, 2016, 10:13:41 pm
Anybody out there with a patched 3021 and FW 7.07 who could try a series of reflection measurements? Ain't working here for whatever reason.  :-\ Just a lot of BS on the screen, no phase angles, just nasty noise.

Edit: Checked several 1/2" cellflex jumpers with my VNA and with the Siglent. While the VNA shows reflection perfectly the Siglent is just producing a bunch of BS.

U.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on August 30, 2016, 10:59:45 pm
Hi,

I have the Siglent SSA3021X.

Look at the two pictures. I think you are looking for "EMI" at the wrong place! It is an optional filter setting in the BW menu (picture 1)

The second pictures shows the reflection measurement.

Perhaps I missunderstood you guys or previous firmware releases (which I didn't install), had different menus.

EDIT: Didn't understand what you meant with reflection measurement not working - apparently you did enter the option, but you are not seing the expected signal. Did you configure the Amplitude, RWB and sweep accordingly to your signal? This software option actually comes as a kit with a reflection bridge. You don't need to use that one in particular. See here: http://www.siglent.eu/rbssa3x20.html (http://www.siglent.eu/rbssa3x20.html)

Regards
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on August 30, 2016, 11:10:07 pm
FYI a very recent SSA3032X that I've got from the factory and sold to a forum member had the latest (7.07) FW installed ex factory.
Gentleman,

kind regards to Tom and the group. Got my 3021X today, unpacking, checking for Ser. N°, 10 minutes later it became a 3032X  :)
dk5ya's post a few day back shows the  :-/O can be done with latest FW and all options showing as enabled.

We can only ask if dk5ya bought his 3021X with any options installed. He did not make this clear.  :-//
Or were they all enabled with  :-/O
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on August 30, 2016, 11:11:56 pm
The plain SSA3021X without any options and shipped FW 07.07 can be hacked and all options activated through telnet.

Regards
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: pherdie on August 30, 2016, 11:48:31 pm
I'm using a MiniCircuits directional coupler with the reflection function. Appears to be working fine for me. Measured values are approximately those expected for the displayed image.


Anybody out there with a patched 3021 and FW 7.07 who could try a series of reflection measurements? Ain't working here for whatever reason.  :-\ Just a lot of BS on the screen, no phase angles, just nasty noise.

Edit: Checked several 1/2" cellflex jumpers with my VNA and with the Siglent. While the VNA shows reflection perfectly the Siglent is just producing a bunch of BS.

U.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on August 31, 2016, 06:16:48 am
Dear tinkerers,

I also have a 3021X patched to 3032X since some days, many thanks to Tom for the easy USB-Stick method.

Today I want to enter the EMI mode, but it wasn't present at the menue. What must I do to get the EMI function?

EMI-SSA3000X /EMI Measurement Kit (Software)

You can select  EMI filters in BW menu. (200Hz, 9kHz, 120kHz (-6dB))
QUASI peak in Detector menu.
Also you can adjust Dwell time from 0 to 10s

AMK-SSA3000X /Advanced measurement Software

You see these measurements in measurement menu:
Channel power,
Adjacent channel power ratio,
Time domain power,
Occupied bandwidth,
Third-order intercept,


Refl-SSA3000X /Reflect Measurement Kit (Software)

Push MODE button
There you see:
Spectrum Analyzer
Reflection Meas

(Without this Refl Option, in MODE menu only Spectrum analyzer)

TG-SSA3000X /Tracking Generator Kit (Software)
TG can use.


I have used  Mini-Circuits directional coupler ZFDC-20-5  (N)  With tracking gen.
(If need better directivity etc then can use what ever better Return Loss Bridge (RLB) .)
This can use also of course with Reflection Meas Option. (Also same measurements can do without this option. Just need TG, Bridge and slide rule)

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: MF-jockey on August 31, 2016, 07:15:47 am

EMI-SSA3000X /EMI Measurement Kit (Software)

You can select  EMI filters in BW menu. (200Hz, 9kHz, 120kHz (-6dB))


Thanks rf-loop, yes I can select it  :)

But I'm a little confused about mode menu description at Manual, there is called a switch to EMI also.

Do you know, how to load the EMI limit value lines?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dk5ya on August 31, 2016, 07:27:23 am
We can only ask if dk5ya bought his 3021X with any options installed. He did not make this clear.  :-//
Or were they all enabled with  :-/O
No I didn't, it was just a plain 3021X. Meanwhile the suspect was caught, poor reflection measurement was caused by a rather ancient directional coupler out of my junk box with a sma jack that was loose  |O. Don't try reflection measurement in the middle of the night  :-[.

EMI mode: the manual is somewhat unclear saying EMI mode has to be selected in MENU mode but BW mode is the right one.

Everything working fine now here.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on August 31, 2016, 07:57:55 am
@MF-jockey

I think you have old User Manual, version UM0703X-E01A.

Current version is:

UM0703X-E02A

There:

"Mode| Selects the Spec Analyzer\Reflection Meas"

But also this current version is not like real User Manual  including all detailed information,  it is more like "Quick Start Manual"

SSA3000X documents:

http://siglenteu.com/prodcut-wd.aspx?id=1252&tid=18&T=2 (http://siglenteu.com/prodcut-wd.aspx?id=1252&tid=18&T=2)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on August 31, 2016, 09:46:19 am

Do you know, how to load the EMI limit value lines?

I think you can make what kind of limit lines what you want. (there is many sources for limit values)

Here is just example. (this limit line is not EMI limits, it is just free hand edited some kind of limit line.)
There is 2 limit lines what can show on the screen and both can include max 100 points.

Attached image.

Attached .lim file.  (limit line) (do not touch inside file, just edit file name, only remove last .txt)
Attached .STA file  (SSA settings) (do not touch inside file, just edit file name, only remove last .txt)

If you want try, reset SSA to all defaults.

Load .STA  (settings) 
Load .lim   (limit line as in image)

After loading .STA spectrum go to EMI RBW 9kHz, Start 100kHz, Stop 30MHz, horizontal scale log. Level show dBuV
(I'm not sure if this .STA works in your unit with different FW etc so it perhaps do not set all settings right)

If settings works ok and after loading also .lim (limit curve) then your display looks like this image.
If not, try first BW EMI off and back on and select 9kHz EMI RBW.
If can not get this working with these files then these are not compatible due to different version.

Note that limit lines are based to x-freq, y-level coordinate points so if you change level settings or frequency settings, limit line stay as defined.

(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=252137:image)




Before use these in SSA:
Attached .lim file.  (limit line) (do not touch inside file, just edit file name, only remove last .txt)
Attached .STA file  (SSA settings) (do not touch inside file, just edit file name, only remove last .txt)
Title: Siglent Tracking Generator Kit (Software) for spectrum analyzer SSA3021X/SSA3032
Post by: ebclr on September 17, 2016, 11:39:08 am
Is this Tracking Generator also hackable or need any kind of board to work  not included on the basic unit ??

Title: Re: Siglent Tracking Generator Kit (Software) for spectrum analyzer SSA3021X/SSA3032
Post by: rf-loop on September 17, 2016, 12:40:29 pm
Is this Tracking Generator also hackable or need any kind of board to work  not included on the basic unit ??

Every SSA3000X (sold outside China *) )  have full TG hardware.
It need only activate by licence key what you can buy. Official price in europe 169.00 eur (VAT 0 price).

For other things in your question you need only carefully read this topic and you find (nice) answer.
Specially starting from this. (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998095/#msg998095) and continue reading and soon you find also @TurboTom message including attachedt zip file. Inside there is .txt file. Read it.

*) Inside  China there is available more SSA3000X models. (these can see only Siglent China domestic  chinese language sides)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ebclr on September 17, 2016, 02:45:48 pm
Another question where in US have the best deal for this instrument List price 1595 USD, anybody know promotions or better price in USA
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on September 17, 2016, 03:30:00 pm
Another question where in US have the best deal for this instrument List price 1595 USD, anybody know promotions or better price in USA

You can try Saelig EEVblog member discount. Perhaps ypu can ask using PM from EEVblog member "rickv14623"
http://www.saelig.com/category/siglent-spectrum-analyzers.htm (http://www.saelig.com/category/siglent-spectrum-analyzers.htm)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ebclr on September 17, 2016, 03:45:47 pm
Thanks coupon didn't work I asked one let's wait for Saelig reply
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Jester on September 17, 2016, 04:38:22 pm
I purchased one from Saelig, I requested the EEVBOG discount and they provided a quote with the discount. Great value.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on September 17, 2016, 07:55:11 pm
Thanks coupon didn't work I asked one let's wait for Saelig reply
Check your PM's and email.  ;)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on September 22, 2016, 10:30:26 am
Some times need look signal what is low and near much higher level signal.

This image perhaps give some idea how it works.

Here is 0dBm 4MHz AM modulated signal. Modulation % is quite low but generator setting is not very accurate for this (8644B).

There is also weak  signal from other signal generator. Only  5Hz off from 0dBm signal and level ~ -71dBm



(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=257650;image)

(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=257652;image)

It is clear that in this case using RBW 10Hz can not do anything but measure power level what is  inside this filter.
Trace 1 is using 1Hz RBW
Trace 2 with 10Hz RBW and also measured shape factor. (-3dB level width is checked also and it is 10Hz)


Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: bozidarms on September 30, 2016, 08:03:57 am
Hi to the group,
can, please somebody help / i have try  Telnet login to SSA3021x / login " root" , and next password, but than i cannot tip any character for password "ding1234"|O
Thanks

Supplement - someway have login - but what now :-// sorry for my behavior but i am not pc expert att all :palm:
Supplement1 - SUCCESS - :clap: :-+ :-+ :-+ apology to the group
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on September 30, 2016, 08:43:41 am
1) It is "root", not " root".
2) Telnet can be slow, especially if you do not open the SETTINGS/SYSTEM INFO screen.

What hardware revision/firmware version are you running?

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Pinkus on September 30, 2016, 08:50:32 am
OK, I understand (added 'supplement' at 06:40) that you already got the login now.
Given this I just can say:

C'mon. It is all in this thread. And this thread has currently only 5 pages.
I would understand if somebody cannot find an information in a 50 or 100 page thread. But I think it can be expected that you will find the "hack for dummies" instructions in a 5 page thread.

Hint 1: look right in the middle
Hint 2: it might be also helpful to learn the commands of a unix/linux editor. You will find plenty of helpful pages with Google.


Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: bozidarms on September 30, 2016, 08:55:07 am
Thanks for quick responses - have succeeded :-+
Regards
Vitor -
 SW1   100.01.02.07.07.
 SW2   20160606-2
 SW3   000000D1
 HW     07.03.00
Tnx

SPECIAL THANKS - besonderer Dank -  to Turbo Tom  :-+ :-+ :-+
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on September 30, 2016, 10:39:21 am
So what was the problem preventing the login? Would be nice to know!

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: bozidarms on September 30, 2016, 11:15:02 am
Unfortunately i was - that was my very first time(Telnet and other software stuff...) :palm:
Regards
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: DL4RAJ on November 06, 2016, 03:45:59 pm
Hi all,

I have my SSA3021X since two weeks now.
and want to thank all smart contributors about the firmware.
Sort of collective intelligence.-:/
Now follow a few measurements of the SA which I've performed.

Sideband noise.
I've used an ultra clean 10MHz OCXO from Wenzel (Streamline) with a spec'ed
phase noise of -165dBc/Hz @ 1kHz (or greater) offset.
The SA showed a sideband noise of -112dBm/Hz on 10MHz at 10kHz offset.
This translates to -98.36dBc/Hz when referred to peak carrier.
For comparison:A HP70200C is spec'd with -108dBc/Hz under the same conditions.

TG
The restriction of the minimum RBW to 30kHz limits the dynamic range of S21 measurements
to 70dB due to the raised DANL.
This may or may be not an issue depending on the DUT.
E.g. a high quality crystal filter on 5.645MHz was measured once with the Siglent and once with a low cost
VNA,see http://w5big.com/vna2180.htm. (http://w5big.com/vna2180.htm.)
The SSA cannot show the full ultimate stopband attenuation down to -110dB while the VNA can.
For a simple HF LP-filter 70dB dynamic range is adequate.

3Hz and 1Hz RBW
These two non-factory "options" are of limited use.
They work down to signal levels of about -130dBm.
Below this level amplitude accuracy drops dramatically.
E.g. at -133dBm the indicated level is off by 4dB (low) and a -140dBm signal
isn't visible any more while a -143dBm signal at a RBW of 10Hz is clearly visible

TG Addendum
I'have hooked up the TG to a SDR,see the screenshots.
One can see the discrete frequency hops and in the zoomed-in capture
there seem very small continous frequency sweeps visible.
That fits with what was reported earlier in this thread.

Regards

Clemens

 
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: videobruce on November 06, 2016, 04:07:07 pm
Quote
I'have hooked up the TG to a SDR
What is this Persues??  ???
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: painting on November 06, 2016, 04:12:31 pm
What is this Persues??  ???

Looks to be this:
http://microtelecom.it/perseus/



Sent from my iPhone using Tapatalk
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: videobruce on November 06, 2016, 08:01:37 pm
Like I'm suppose to know what that is.   :-//
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on November 10, 2016, 12:19:03 pm
Just a note:

A new firmware was released, which apparently disables activated options and is not downgradable.

Extraction of the firmware revealed that the password is unchanged.

No further information exists regarding the possibility of reactivating the options.

Current advise is to NOT upgrade and wait for people with P08.01 to tell if TELNET access and activation hack is possible.

Regards
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: videobruce on November 10, 2016, 01:48:34 pm
Probably why the update took longer.  :--

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: janekivi on November 10, 2016, 07:56:44 pm
I look into update scripts and before there was only NSP_system_info.xml
and now it needs nsp_data_b too, which is NSP binary data, I think...
This is the new file in firmware. 128 bytes = 16 x 8, probably crypted.
And somehow is suitable for everyone...

But this can't be difficult. You need to increase sales... for cristmas time. What you do...
There is needed little shaking but not earthquake. You make this upgrade and this must
be solvable in suitable time. So every potential buyer-hobbyist who was not sure before
but like this toy, might lose his opportunity and like buy it now before they lock it with next
radical update. Next upgrade of course has the same effect. But only if this showstopper
is being solved. Otherwise you lost all who buy them with counted money or for toy.
Normal professionals don't use and can't use hacked tools anyway.
(Why not, we can. No, you can't provide service with tool, which tomorrow don't have
needed bandwidth or options.)
(Counted money - you count every cent and think weeks before spending anything)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nctnico on November 10, 2016, 09:04:15 pm
For small companies using a piece of hacked equipment doesn't need to be a problem especially with cheap Chinese gear which probably never sees the inside of the manufacturer's calibration department anyway. However losing the options (3.2GHz) with each firmware update and no guarantee they come back makes the SSA3000 series very uninteresting compared to a used spectrum analyser. I was very tempted to buy a SSA3021X but with Siglent plugging the holes I'm happy I went for a used on instead.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on November 10, 2016, 09:21:28 pm
I bought mine way ahead of the actual date I had planed to buy one, to make sure I get a hackable unit.

I was then surprised that the hole was not fixed over the period of several months. I was wondering "Could it be that they want to mimic what Rigol did?".

Now that the hole is fixed, I am glad I have mine: I would never get this amount of functionality (not just the extra frequency range, but especially the advanced measurments, too) for 1449 Euro.

Buying a second hand SSA is not that easy an alternative!

Believe me, I have purchased lots of measuring equipment second hand and for years I look at spectrum analysers, especially on German eBay. It seems they have some magic with them, making them more expensive, the older they get. I just did a quick search: you literally get nothing for less than 4.000 Euro and those are all pretty old (actually there is one, that seems moderatly interesting - http://www.ebay.de/itm/Advantest-U3641N-Spectrum-Analyzer-9kHz-3GHz-/262392475296 (http://www.ebay.de/itm/Advantest-U3641N-Spectrum-Analyzer-9kHz-3GHz-/262392475296)).But what if you buy a second hand unit and it comes broken, uncalibrated, develops a fault within days or weeks, etc.? And any SSA with more than 5-10 years is probably outdated when it comes to processing power.

Unless you need some huge frequency range, where a new unit would literally cost a 5 digit number and you could get a second hand one for a 4 digit number, I would steer away from them. Too complex, too difficult to repair, too difficult to get spare parts.

In my opinion, the Siglent SSA3021X is great value and let's be honest: even without hacking it, it is a spectacular device for its price range. Siglent does not need to push it through pseudo-hacking.

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nctnico on November 10, 2016, 09:42:12 pm
You forget that your current firmware version still may have flaws and you won't have future enhancements Siglent may add IF you want to continue to use the liberated options.

BTW Used test equipment in Europe is usually very expensive so most of mine comes from overseas.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on November 10, 2016, 09:47:14 pm
I know that, but when I purchased mine, I did my research and concluded that the current state of the firmware was good enough for me. I don't really care about PNG file format and I prefer to use a noise source over the TG for my applications.

Also, I doubt you get new FW for older units and they certainly have bugs, too.

But of course you are right: I might end up in a situation where I have to decide between keeping the hacked options or getting the new options from a newer FW. However, in that case I still have the option to purchase the missing keys, like the one for advanced measurements.

Also, knowing that the hardware is there and it is just software-locked gives the hope one might end up hacking it again... Still better, than having different hardware between models.

And I guess my unit just got more valuable over night! lol

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: bozidarms on November 11, 2016, 02:04:51 pm
Hi to all,

despite the momentary situation, SSA3000X is and stay one marvelous instrument,
with price (and given possibilities for that price) unattainable from every other manufacturer.

I hope that Siglent is wise enough,  to make right decision. :D

Regards
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: videobruce on November 11, 2016, 03:40:44 pm
I contacted a dealer via e-mail if he had existing stock and received this reply;
Quote
Thank you for your interest in our unit.
Currently, we sold all our stock. The new stock will be available as of next Friday Nov 18th.
We are currently running a 5% discount on Siglent units, if you are interested in moving ahead with this analyzer, please send us your email and we will forward the update price.
I called another dealer and was told (not surprisingly) that they don't 'stock' these, they come from Siglent (which seems very typical for all of these T&M dealers).

Interesting about the date of availability.  ;)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on November 11, 2016, 04:28:32 pm
That was the same with me. When I purchased the device it said "IN STOCK", yet the device had to come from China to EU first and only then was shipped to me.

The truth is, that it kind of makes sense. A SSA is not a mass consumer product and I imagine there are not that many being sold. So it would not make much sense for a small to medium distributor to actually stock them, when the retail price is almost 1500 Euro!

If you place yourself in the distributor role, you would do exactly the same or close business very quickly.

And again: Even without any hack - the Siglent SSA3021X is a fantastic product at this price and there is no other option in this class. You get a full 9kHz to 2.1GHz sweep spectrum analyzer at 1449 Euro. End of story.

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: DL4RAJ on November 11, 2016, 05:04:47 pm
(actually there is one, that seems moderatly interesting - http://www.ebay.de/itm/Advantest-U3641N-Spectrum-Analyzer-9kHz-3GHz-/262392475296 (http://www.ebay.de/itm/Advantest-U3641N-Spectrum-Analyzer-9kHz-3GHz-/262392475296)).
Regards,
Vitor

Moderately interesting,that's true.
It has a 75Ohm input and no TG.

Unless you need some huge frequency range, where a new unit would literally cost a 5 digit number and you could get a second hand one for a 4 digit number, I would steer away from them. Too complex, too difficult to repair, too difficult to get spare parts.

In my opinion, the Siglent SSA3021X is great value and let's be honest: even without hacking it, it is a spectacular device for its price range

I agree with you on this.

Regards
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on November 11, 2016, 05:41:18 pm
Unexpectedly found some short review image (https://app.box.com/s/ckqknbcbtdyyobum8ena11e4pw9ahyrv).
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: janekivi on November 11, 2016, 06:51:27 pm
You already had funeral ceremony ... ?
OK, but christmas already here, I'm back from work and had time to sit down.
After scrolling this file up and down quickly and slowly, my eyes... did start shutting down.
But in some state I saw this code in this nsp_data_b file.
Code: [Select]
<?xml version="1.0" encoding="UTF-8"?>?<sn_backup_root>?  <factory>TRUE</factory>?  <pro_mode>TRUE</pro_mode>?</sn_backup_root>?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on November 11, 2016, 06:55:13 pm
No funeral ceremony!

The games have just started!  :)

Regards
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: DL4RAJ on November 11, 2016, 09:04:18 pm
The new firmware offers some appealing features (except #5):
1. Add “PNG“ file type for screenshot.
2. Support TG in RBW less than 30 kHz.
3. Modify default TG output power, -20 dBm in spectrum analyzer mode and 0 dBm in reflection measure mode, and some other TG issues.
4. Updating the format of “LIM“ file. After this firmware , the old limit files will not be supported. You can re?????? them through “EasySpectrum” free software easily.
5. After this firmware, do not support downgrade operation.

Particularly #2 seems most interesting because it lowers the noise floor when using TG and thus
extends dynamic range of measurements of highly selective filters,see
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=268127;image (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=268127;image)

Regards
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on November 11, 2016, 09:20:45 pm
Another remaining and very concerning issue with P08.01 FW is that the remaining Option trial times vanish.  :rant:  :wtf:

I have just sent a stern email to Siglent about this.

My advice is DO NOT install P08.01 FW at this time.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on November 12, 2016, 08:31:50 am
I contacted a dealer via e-mail if he had existing stock and received this reply;
Quote
Thank you for your interest in our unit.
Currently, we sold all our stock. The new stock will be available as of next Friday Nov 18th.
We are currently running a 5% discount on Siglent units, if you are interested in moving ahead with this analyzer, please send us your email and we will forward the update price.
I called another dealer and was told (not surprisingly) that they don't 'stock' these, they come from Siglent (which seems very typical for all of these T&M dealers).

Interesting about the date of availability.  ;)
AFAIK all USA stock is held in Ohio at the Siglent US subsidiary and if they're out of stock then only "on hand" dealer stock will be available.
Did you try Saelig ?
https://www.eevblog.com/forum/testgear/equipment-discounts-from-saelig/ (https://www.eevblog.com/forum/testgear/equipment-discounts-from-saelig/)

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on November 13, 2016, 08:18:45 am
This quoted is last message (now) in SSA3000X thread. (I will quote all after last FW 8.01 things from there to here. This thread is right place for SSA mods....

So please wait

from https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/)
Quote from: SSA3000 thread


*** These posts should really be moved to the "Hack of Sigllent spectrum analyzer ssa3021X?" @thread... Can some MOD do this, please? ***

Regards,
Vitor

Lets hope all "how to try hack or how to hack" etc is important to move to this thread:

https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/ (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/)

It looks like moderators are not interested about this.

The situation in which all messed up should be avoided.

Without MOD help it is possible also to other way. Some people can make one message where is quoted all this kind of messages. The chronology is also an important.

But, still I think that doing it now is better than later. After then there is small chronology mess with hack thread messages. But if do not it now, later it is perhaps more hard.

What is good point to start quote and copy to hack thread. I recommend that starting from first message about new 8.01FW.

I will do it starting from message 502 in this thread by tautech. Even when it confflict time order in hack thread.

I will do it but please do not send new messages to this or hack tread until done.
Later after done, please post all hack related messages to hack thread, only.   (use and test results wwith hacked or factory condition SSA of course to what ever thread.

So, please do not send new message until done!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on November 13, 2016, 09:24:39 am
New FW for the SSA3kX
http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA3000X-P08.01.rar (http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA3000X-P08.01.rar)
P08.01
7.2 Mb

From the changelog:
1. Add “PNG“ file type for screenshot.
2. Support TG in RBW less than 30 kHz.
3. Modify default TG output power, -20 dBm in spectrum analyzer mode and 0 dBm in reflection measure mode, and some other TG issues.
4. Updating the format of “LIM“ file. After this firmware , the old limit files will not be supported. You can re?????? them through “EasySpectrum” free software easily.
5. After this firmware, do not support downgrade operation.

Warning: A quick check revealed to me that the root password has changed!

Because you cannot downgrade the firmware, you would be stuck at the moment!

Regards,
Vitor

And the liberated options are also gone.

So BEWARE!

My quick check shows exactly the same files in \passwd folder
so nothing changed there...


You are right.  :palm:

Both passwd and shadow are the same, at least for root.

I must have gotten stressed, as I was lecturing while doing the anlysis through RDP.

Sorry.

Regards,
Vitor


To make up for my mistake, here is a Windows tool that will convert an *.ADS file into a *.ZIP file.

It will open with 7Zip, but the resulting ZIP is not free of errors. Most can be extracted, though.

All credits go to janekivi for his brilliant insights, which he shared.

Have fun.

Regards


https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/?action=dlattach;attach=269048 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/?action=dlattach;attach=269048)


And the liberated options are also gone.

So BEWARE!

Have you tried activating them again through TELNET?

It kind of makes sense for Siglent to replace the edited license file with a new one, as offical customers will have the activation code to reactivate everything.

I wonder if they only reset the evaluation time settings or the actual activation settings: the hacks described in the other thread point to two different ways of doing the hack. One way is to change the eval period to infinite, the other consists in setting the option as activated.

Regards


Have you tried activating them again through TELNET?

Yes.
Seems to be a completely different method now.

There is a new file w/ entered license keys.
The liberation method described above doesn't work anymore.

Cheers


Sorry to hear that.

Probably the application executable checks the signature of the authorised options. Without the key, nothing can be done, which is why they didn't even bother to replace the root password.

I would say that Siglent spectrum analyzers are locked again and probably for good.

Regard


Two things I noticed after upgrading from P07.07 (100.01.02.07.07) to P08.01 (01.02.08.01)

I had enabled all options and changed the model from SSA3021X to SSA3032X prior to the upgrade.
After the upgrade all options were lost but the model stayed with SSA3032X. In addition the newly created NSP_sn_bandwidth.xml has been appended with a license key for 3032.

Firmware downgrade is very simple. If you overwite ecomb (5054420 Bytes) with the previous ecomb (5007948 Bytes) from P07.07 all options are back.

ecomb is the main application located at /usr/bin/siglent. In order to replace ecomb you need to temporarily remount the rootfs as rw (read-write).

mount rootfs -o remount,rw
cd /usr/bin/siglent
cp /usr/bin/siglent/usr/mass_storage/U-disk0/ecomb . (in case the downgrade ecomb is located at USB stick)
sync
mount rootfs -o remount,ro
shutdown -r now


Thanks!

For all: The ecomb file can be accessed easily by converting the P07.07 ADS firmware file with the tool I attached a few posts before.

Open the resulting ZIP with 7Zip and extract ecomb.

So this is step 1: downgrade is possible again!

One thought:

If you can just copy ecomb from P07.07 and it works fine with all options back, how about writing a script for /etc to alternate between one ecomb and the other? Like you turn the SSA on and get P08.01. Turn it on again and you get P07.07 and so on. Even better would be some kind of boot menu...

*** These posts should really be moved to the "Hack of Sigllent spectrum analyzer ssa3021X?" @thread... Can some MOD do this, please? ***

Regards,
Vitor


Well, the situation isn't as hopeless as initially assumed: if you use peterdb's method of "liberating" the machine (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998095/#msg998095 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998095/#msg998095)) and modify the license node in /usr/bin/siglent/firmdata0/NSP_system_info.xml to look like this:

<license><_3032>TRUE</_3032><_3021>FALSE</_3021><_TG>TRUE</_TG><_EMI>TRUE</_EMI><_Meas>TRUE</_Meas><_CAT>TRUE</_CAT></license></system_information>

and make sure all traces of previous hacking are eliminated -- don't forget to delete the "monster.txt " (not sure if all this is really necessary) and then apply the firmware update, a set of license codes will be generated automatically and the options will stay active (just tried it on my SSA*X).

The new firmware apparently doesn't support 1Hz and 3MHz RBW anymore. Operation with the tracking generator active has been improved, yet when operated in the area that normally is covered in FFT mode, it continues to sweep and gets unbelievably slow. I always thought the Rigol DSA was a dog but if you have to use the Siglent in this high-res TG modes, you'll get a new definition of "slow"! Yet, the results are better than before, the SSA hasn't got a problem to properly measure the parallel resonance of my high-accuracy 1MHz glass-tube crystal. But still, when zooming further into the spectrum, funny artefacts become visible, yet I'ld say the result is now completely usable as it is. Did I tell it's slow?  ;)

So much for now, I may report back once I had more time to play with it.

Cheers,
Thomas


Hi,

Finally got some time...

I upgraded mine and had no problem. All options remain active.

As I thought:

Quote
I wonder if they only reset the evaluation time settings or the actual activation settings: the hacks described in the other thread point to two different ways of doing the hack. One way is to change the eval period to infinite, the other consists in setting the option as activated.

Those who actually activated the option instead of messing with the trial time will have those options with P08.01.

I confirm that the 3MHz RBW is gone. Maximum RBW is 1MHz.

I have not tested the 1Hz RBW, as I did not activate it.

So apparently, Siglent is not being too harsh.  :-+

Regards


There is a new version of the EasySpectrum software, too:

ReleaseDate
2016/11/10 18:04:23
Version: P03.02

Note:
1. Support manually IP connection.
2. Support editing and exporting “Correction” file.
3. Support editing and exporting “Limit” file, and off-line editing.
4. Add scale line to “Spectrum Monitor” mode

Regards



...

So apparently, Siglent is not being too harsh.  :-+

...

True but I guess for those who will purchase the machine with a firmware newer than 7.07, things may look different. Apparently, during the update 7.07 -> 8.01 the encrypted license codes will be generated if the corresponding files are correctly "prepared". During this update, the machine boots twice (at least mine) - would be interesting to know what it's doing there  ;).

And since a "proper" downgrade of the firmware is inhibited now (at least Siglent states this - I believe them and didn't test it), this "easy road" will be closed for future machines. There might be other options, for example if a set of files in the /usr/bin/siglent/firmdata0/ directory of a "liberated" machine gets leaked, it might run as well on a new machine, of course cloning the serial number of the "donor".

Cheers,
Thomas


P.S.  I modifed the attachment in my "patch instructions post" to be compatible with the firmware update (they have to be applied before the performing the update!) -- see here: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998366/#msg998366 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998366/#msg998366)


As mentioned before, you can downgrade, copying the P07.07 ecomb file on top of the current one.

This would allow modifying the license file and then copying back the P08.01 ecomb file.

I have not tested this, though.

Regards


These are copy (quote) from SSA3000X thread. All msg including and after tautech message #502.

Please continue all SSA3000X modification messages here. If you guote from these quoted msg do not forget include original member name from quote.

Keep these introductions, test and other discussion in SSA3000X thread.

All modifications related instructions and study to this "hack" thread for avoid mess.



Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on November 13, 2016, 09:58:33 am
Please continue in this thread  all SSA3000X "modifications - hack" and hack study messages to this thread.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on November 13, 2016, 12:37:16 pm
Thanks @rf-loop for relocating the recent SSA "improvement" posts to the proper thread.

Today I had a good laugh - Siglent made "liberating" the machine after the update even easier for us: Just delete all files (but not! the "calib" directory) from the directories /usr/bin/siglent/firmdata0/ and /usr/bin/siglent/usr/backup/ (of course after backing up to USB pen drive). If you reboot the SSA after this, the serial number will be displayed as "xxxxxxxx" but all options will be enabled along with 1Hz and 3MHz RBW, so nothing lost against firmware 7.07. In case the machine needs to be sold / repaired, the deleted contents can be copied back and everything returns to normal. Probably upon the next F/W update, Siglent will close this hole for good reason, so enjoy it as long as it's available  8).

Cheers,
Thomas

P.S. I also attached a screenshot of a TG scan of my "difficult" crystal that the SSA had problems to analyze with the 7.07 F/W.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nugglix on November 13, 2016, 01:52:26 pm
Confirmed the joke     :-DD

Thanks for finding that out.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: bozidarms on November 13, 2016, 07:54:22 pm
Turbo Tom -  :-+ :-+ :-+
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: xenonfire on November 16, 2016, 06:44:34 pm
I'm planning to order a new SSA3021X.
Do you guys think that I could hack my machine and get all options ?  :popcorn:
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on November 16, 2016, 07:42:04 pm
@xenonfire:

for the 8.01 firmware yes, what the future will bring, noone knows.

Cheers,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: DL4RAJ on November 20, 2016, 03:02:40 pm
Confirmed the joke     :-DD

Ditto! :-DD
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: DL4RAJ on November 20, 2016, 07:17:45 pm
To make up for my mistake, here is a Windows tool that will convert an *.ADS file into a *.ZIP file.
It will open with 7Zip, but the resulting ZIP is not free of errors. Most can be extracted, though.
Regards

Here the tool did not work on a W7/64 machine.
The resulting ***ADS.zip file could not be opened or extracted at all with 7Zip .
The error message says just this "...could not be opened as archive..."
What might be the reason?

Regards
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on November 20, 2016, 07:35:06 pm
The ZIP will be still corrupted, but everything essential is extractable. Check if you are using a recent 7zip version.

Also, this tool only works for firmware files of the SSA3921X.

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: DL4RAJ on November 20, 2016, 10:18:02 pm
Check if you are using a recent 7zip version.

Thanks,that did the trick.
I had v9.2,now it's v16.04 and it works.

BTW:Is there a difference between the *genuine* files
NSP_system_info.xml
and
fun_opt_valid_config.xml
of FW 7.07 and FW 8.1?

Regards
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: jobber on November 29, 2016, 09:21:32 pm
Hey!

Thank you for the awesome hack and instructions. I just successfully unlocked all the features on my SSA with sw 7.07.

Now I wanted to upgradeto firmware v8.01 but it doesn't seem to be working - there is no progress bar and it nothing is happening for almost 20min now. How long should the upgrade process take? Have anyone experienced similar problem?

Edit: I turned off and on the device and tried again. Immediately after pressing upgrade "System upgrade failed" message is displayed and nothing happens.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: jobber on November 30, 2016, 07:28:41 am
I tried to upgrade once again with version 7.07 and after 40% device restarted and never came back from boot screen.  :-[ I see green light flashing inside the housing but nothing is happening. Is there a way to restore it back or will I have to send it back for service?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on November 30, 2016, 07:43:56 am
Can you still telnet to the device?
How did you restart the second flash attempt?
It shouldn't be possible to downgrade.
Either you did something wrong with the hack or you might have a bad flash.
Consider restoring to unpacked version and then open a support case.

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: jobber on November 30, 2016, 08:02:12 am
Hi.

Thank you for your reply!

No, I think network is not up during boot screen.

I tried to upgrade to 8.01 but without success (device stayed operational on v 7.07). Then I tried to upload v7.07 firmware to see if this is working. It went to 40%, rebooted and stayed in boot screen.

For the hack I followed @TurboTom instruction and they worked. Before that made a backup firmdata0 folder and also tried to make a backup of ecomb file but I coudn't because it was in use. Maybe that was the source of the problem at the first place.

I is possible to access console with USB?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on November 30, 2016, 08:04:07 am
I tried to upgrade once again with version 7.07 and after 40% device restarted and never came back from boot screen.  :-[ I see green light flashing inside the housing but nothing is happening. Is there a way to restore it back or will I have to send it back for service?

It is very clearly said in every place. After 8.01 can NOT downgrade. 

In first place.

And all times when do what ever FW update it need do using USB stick what really works reliable with equipment and it need be true proofed with tests BEFORE any attempt to FW update. This is so clear thing that this do not need write instructions.

Also, least with every other Siglent equipment. USB need be in native FAT32 format. It must have single partition. Its connection to USB bus need be as reliable as also power to oscilloscope. During whole update process, do not touch USB (for avoid any possible contact fail)

Also after stored .ADS file to USB stick it is very good practice to check it match with original unzipped file.

During FW update from 7 to 8 version SSA do several self restarts (boots) before it is ready.

It do not really take 20min.  So in first place something have gone wrong.
I have updated more than one SSA (and whole load of other Siglent equipments and never meet any problem)  and update works just rock solid when do it exactly as instructions and out from instructions of course first be sure that USB is sure ok and update .ADS file is exactly ok in root of USB.

What was idea for update 7.07 after failed 8.01 update.Why?  Just for fun or with some knowleedge what to do. Is it better first study and after then think what to do.
 
Now, do NOT ANYTHING more before you know exatly what is safe to do next.

One question.

You say you have modified 7.07 before you start update FW update for 8.01
Who told you this can do and is it possible there have been some exeption when you have done it - example accidentally. There is several possible modifications and methods in FW 7 versions. It need know exactly what can do and what can not do, except if you can yourself analyze what can and what not.
Do you remmeber if there was perhaps h letter after FW version number last time before this all.. 

I "can not"  give any instructions how to continue.
 
But two questions and depending your answer perhaps some peoples here can try kindly help you.

But at this time my recommendation is:  do not try update any more or change anything before there is real knowledge what to do next for avoid possible more deep problems.

Q 1.: Do you have reliable copy of original some files (before any first change in system).
Q 2.: Do you have now normal access to SSA system (via LAN) with PC  or what ever telnet terminal? Or is SSA now as "dead"?


Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: jobber on November 30, 2016, 08:53:48 am
Hey.

Upgrade to 8.01 never finished. Immediately after starting the upgrade error message "System upgrade failed" message appeared and SSA stayed on version 7.07 (I think there was no h letter at the end). I thought that restoring to the same version (7.07) would clean the system so I could then upgrade to later version. Yes, it was an unproven method but I did't expect any problems, an error message at most. It is clear now that I was wrong.

The USB stick was almost new, in fat32 and I didn't touch it during the process.

The modification I made was to switch original "NSP_system_info" with the one provided in the one of the previous posts but with edited serial number.

Q 1.: Do you have reliable copy of original some files (before any first change in system).
I have a copy of "firmdata0" directory (calibration, NSPfiles, fun_opt file), nothing more.

Q 2.: Do you have now normal access to SSA system (via LAN) with PC  or what ever telnet terminal? Or is SSA now as "dead"?
Not via LAN. I have not tried any other options because I am not familiar with them.

I will definitely wait now before doing any further actions but I am afraid there is really not much to be done.

Thank you for your help and support. Much appreciated indeed!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on November 30, 2016, 09:31:17 am
Hey.

Upgrade to 8.01 never finished. Immediately after starting the upgrade error message "System upgrade failed" message appeared and SSA stayed on version 7.07 (I think there was no h letter at the end). I thought that restoring to the same version (7.07) would clean the system so I could then upgrade to later version. Yes, it was an unproven method but I did't expect any problems, an error message at most. It is clear now that I was wrong.

The USB stick was almost new, in fat32 and I didn't touch it during the process.

The modification I made was to switch original "NSP_system_info" with the one provided in the one of the previous posts but with edited serial number.

Q 1.: Do you have reliable copy of original some files (before any first change in system).
I have a copy of "firmdata0" directory (calibration, NSPfiles, fun_opt file), nothing more.

Q 2.: Do you have now normal access to SSA system (via LAN) with PC  or what ever telnet terminal? Or is SSA now as "dead"?
Not via LAN. I have not tried any other options because I am not familiar with them.

I will definitely wait now before doing any further actions but I am afraid there is really not much to be done.

Thank you for your help and support. Much appreciated indeed!

One more.

When you now turn on it. What all signs about its life you get before you now touch anything but powewr on. Perhaps you can take some picture.
Screen, some leds on etc.
Can you share this knowledge to peoples who perhaps may know things and may perhaps try give some help before hands up.

After documeenting this state perhaps then (well documented) if you can get any response from some buttons. (do any button give any sign about  life ..)

You can also try:
(these are just from my random tests and not based to any official knowledge)

Power on and immediately start  continuously and fastly "firing" button "Mode" whole boot time.
Perhaps nothing happen?? Shut off.  (perhaps mistake in my test "records")

Power on and immediately start  continuously and fast "firing" button "System" whole boot time. (works some times)
Perhaps nothing?  If nothing...

 If nothing...

Boot again and push "System" and keep  when  power up and keep it continuously pushed down until SSA boot. (Perhaps this is most right...)

You can try these some more than just once.

With these 2 last, I can  get my SSA to weak up  and surprising something is really reset or something... as 1GHz model SSA3010X  !!  (if boot after this just normally, it is back normal model again)
If still nothing...lets hope some one have some other things...

If you get it wake up somehow in this or some other special model... do not turn off. After then is time to talk with SSA.

But, I afraid your's can not wake up with some button trick.
But, it do not cost anything...
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on November 30, 2016, 09:49:32 am
Here is result from boot with "button trick" with my individual SSA

Note that before this it works normally and all official options valid permanent.

Now it is 1GHz model and without any licenses (and other way it works as normal 1GHz model.

If I now shut off it and power up normally, it is again all what was before... normal model and valid official licenses etc.

Just after "button trick" boot...
(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=274706)

Note also that is in some kind of factory reset state because normally it keep user set display image mode after example Preset and Reset.  Now it is returned back to "Inverse" mode.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on November 30, 2016, 10:42:38 am
@jobber

sorry to hear about your problem with the firmware update and the now bricked machine. I assume you applied the latest patch ("NSP_system_info" change only). This shouldn't have caused any difficulties with the update on an otherwise "clean" system. How long did you own the SA and did you use the "werewolf mode" with F/W 7.05? If you did, a file "Monster.txt" will have been generated that just contains the phrase "hacked!" or the like, of which I don't know if it changes the situation or not. On my machine, I deleted all the evidence of previous tampering before applying the latest update. I also experimented recently with possible up- or downgrade options after the update to 8.01 without any succes so far (but also without any collateral damage...). I recommend trying rf-loop's instructions to revive the instrument and possibly get telnet access again.

If all this fails, and depending on how skilled you are with Linux, you may open the machine and access the TTL level serial port inside. This port is up directly after switch-on and the bootup console is mapped to it. At least this will tell you where the bootup process fails and if it gets far enough, you may interrupt the bootup to enter the UBOOT tool. This would allow you to load a new system image to your SA, provided one of us can generate one -- but I guess this should be possible. Since you've got a backup of your SA's calibration data, restoring the device to proper working condition isn't an issue after that.

Cheers,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: jobber on November 30, 2016, 11:46:34 am
Thanks for your quick responses and ideas!

When press the the power button this is what happens:
- short beep,
- Mode and TG buttons lid on,
- after few seconds LCD screens turns on with Siglent logo on it (splash screen),
and that is it.

I moved it around a bit and noticed that green LED on LAN port is turned on and I can se a green led flashing inside on the PCB the through the vent holes (on same side as USB and LAN ports are). I don't know if this flashing LED is normal but I think it could be an error indicator.

There is no response when pressing buttons and I can only turn it off by holding power button for few seconds. I have tried pressing and holding system and mode buttons after power on but nothing happened - I will try a couple more times later today.

I also connected it with USB cable to se if this is working and I get the "USB device not recognized" message but I didn't have any drivers installed at that time.


@TurboTom, yes, I used patch that you mentioned. The device was one day old and almost unused. I also checked if there was any "Monster" file but I could not see any. For now I would like to avoid opening the device but a boot message from debug console would definitely give some answers.

Would it possible to get some access UBOOT via USB device port on the back?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on November 30, 2016, 01:18:55 pm
Comment about LED's
Normally when booting front panel TG and Mode button leds on.
Normally when it is powered empty LAN connector green LED is on.
Green LED inside, continuously blinking, is normal.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on November 30, 2016, 07:07:21 pm
....
The device was one day old and almost unused.

....

Would it possible to get some access UBOOT via USB device port on the back?

It's always risky to modify a brand-new device that had not undergone an appropriate "shake-down period". The "infant mortality" is someting that always needs to be considered. So the problem that you're facing now may well be the result of a flaw in the SA that was there right from the start, and even without the hack or even without your attempt to update the firmware, it may have failed. Of course it's difficult to prove now.

As far as I know, the only way to access the UBOOT menu is via a terminal connected to the UART interface inside the instrument. It's only necessary to remove the outer (plastic) rear cover, the pads of the UART interface can be accessed through an opening in the metal shield. A three-pin header (2.54 spacing) with slightly deformed pins can be inserted so it makes contact to the pad hole plating and routed outside via three wires. I used my SSA like this with this wire secured to the casing with some adhesive tape while I was initially experimenting with it (before the login data was discovered and telnet access became possible).

But honestly, with an instrument that's maybe a week in my possession and fails like you report, I would actually switch to "dumb mode" and try to have it replaced under warranty. I think there's a good chance nobody will notice that you tampered with it.

Cheers,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nctnico on November 30, 2016, 07:36:46 pm
I second that: just return it and state the firmware update didn't work. Make sure to take pictures and note the serial number of the unit you are sending back so you can check whether it got damaged and you got the same unit back or a different one.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on November 30, 2016, 08:29:45 pm
@jobber
Sorry to hear of your misfortune but the sad fact is if you f**k around with hacks these are the risks you take. Expensive brick.  :palm:
For your sake I do hope it is a rare product failure and not something you've done.  :scared:
Good luck.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: jobber on November 30, 2016, 09:03:47 pm
Thank you guys for all the support!

I did some experimenting with buttons but with no luck. I think that file system or some essential files got corrupt and it doesn't pass UBOOT.  I will contact support and ask if there is any recovery that could be used in events when upgrade fails. I will let you know what they will have to say.

It would be nice to know what exactly caused the device to fail so we could at least learn something.

@TurboTom do you think it would really be possible to recover it with cloned image file and UBOOT?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on November 30, 2016, 10:20:48 pm
Provided there isn't any further (hardware) damage that caused the instrument to fail, I'm pretty sure it should be possible to recover the machine. I once had a similar problem with a Hantek HDG2002B arbitrary function generator (I know the Siglent is another league...), and I was able to recover it from a (reported) NAND FLASH error by rewriting a file system image, albeit it was one that I've backed up from exactly the same machine some time before. Things may become awkward if bad blocks in memory are present in your machine since these locations won't be mapped correctly if uploading a foreign image.

All the best,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Tobey on December 03, 2016, 06:53:16 pm
Received my new SSA 3021X yesterday and trying to upgrade through Telnet but I cannot login using "root" and password "ding1234".  I am using Putty and
typing "root" for login but when I try to enter a password it will not take one and the screen will time out.  I have tried this many times and used other Telnet
programs without any luck.  I am stuck.  Have they changed the login name? It seems everyone else is able to login, but not me.  My machine info is:

SW1   100.01.02.07.07
SW2   20160606-2
SW3   000000D1
HW    07.03.00

Calibration date  2016-10-26

Amy help will be much appreciated.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: DL4RAJ on December 03, 2016, 07:11:30 pm
... Have they changed the login name? It seems everyone else is able to login, but not me. 

After having started Telnet you have to connect to your SSA
using its IP address which you find when you go into System -> LAN.
You can freely assign any appropriate IP address to your SSA.
Type into the command line 'o 192.168.xx.xx' (without the ' ).
After having established connection you'll be able to log in.

regards
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Tobey on December 03, 2016, 08:27:32 pm
Yes I did connect with the SSA through the IP address, no trouble.  It returned the Arago Project screen with   "am335x-evm login:"   as the login with a cursor
to enter the login name.  I used "root" and when I hit enter the  "Password"  was displayed on the next line also with a cursor.  However, when I try to enter
"ding1234"  as the password I get no response; it will not accept any input at the cursor from the keyboard.  It is acting like the login could have changed and not
accepting the password.  I do not know what to do at this point to gain access through Telnet.
Thank you for your help!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on December 03, 2016, 08:30:57 pm
Hi,
Telnet access is sometimes slow. I mean really slow. Open the setup - about screen on the Siglent. This will speed the telnet access up.
Basically, just wait a minute for the login to happen.

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Tobey on December 03, 2016, 11:00:22 pm
Thanks Bicurico and DL4RAJ for the input, but still cannot login to Telnet.  Every thing seems to be working as it should but just no response.  Bicurico, I do not see a setup screen on SSA except for the System>Interface>Lan.
Is there something I am missing?
Thanks.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on December 04, 2016, 01:05:07 am
@Tobey
I don't believe in F/W 7.07 the login was changed, regardless of the purchase date of the SSA. Please also keep in mind that the Linux login is case sensitive. All the letters have to be lower case. The Info page mentioned is accessed on my machine (currently F/W 8.01 "improved") by pressing "System" -> "System Info" after full boot-up. While this screen is displayed, the sweep engine (ecomb) is halted and the O/S background activity isn't affected by it. Please try again exactly as described and report your results.

If you've still got 7.07 running, you may consider updating to 8.81 since this firmware version has the "standard" login configured (unless in between Siglent has applied some changes -- you may try to use an "older" download).

Whatsoever, I hope you'll be able to "liberate" your SSA.

All the best,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Tobey on December 04, 2016, 01:42:12 am
Thanks for the reply Thomas.
I tried to login as you suggested while in "System" -> "System Info", no caps lock on, all lower case.  Still no luck.  The response time in Telnet seems very good while inputing the login "root" and the responding of the Password request, as good as most other programs I've used.  But as before, no response to the input of the password "ding1234".  I guess
I will need to try updating to a different sw version as you suggest.  I'll play around some more and use a different computer and LAN connection before I do that.  Maybe others have the same problem and will give some feedback.
Thanks so much for the help, it is greatly appreciated.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: DL4RAJ on December 04, 2016, 10:12:32 am
... But as before, no response to the input of the password "ding1234". 

You did not happen to press backspace before entering "ding1234" ?
I guess you know that there has to be one 'space' between password prompt
and the password itself.

When you type in the password nothing happens on the screen,
i.e. the cursor is staying on the same position as before!


Just enter "ding1234" and then press the enter key.

regards
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: DL4RAJ on December 04, 2016, 10:37:23 am
@Tobey

If you've still got 7.07 running, you may consider updating to 8.81 since this firmware version has the "standard" login configured (unless in between Siglent has applied some changes -- you may try to use an "older" download).

Whatsoever, I hope you'll be able to "liberate" your SSA.

All the best,
Thomas

Tom

I wonder if an *unmodified* 7.07 FW version which has been upgraded to 8.01
can be liberated.
When a *modified* 7.07 has been upgraded to 8.01 the 'liberation" is done as per your suggestion:
"Just delete all files (but not! the "calib" directory) from the directories /usr/bin/siglent/firmdata0/ and /usr/bin/siglent/usr/backup/ (of course after backing up to USB pen drive)."
Now,after this action which brings back all options, the SSA still remembers the added non-factory
1Hz and 3MHz RBWs which where contained in the *modified* NSP_system_info.xml file of FW7.07.
So my guess is that this info must have been stored somewhere else in the SSA's file System,
not only in the /firmdata0 and /backup directories.
How else should the SSA with FW8.01 "know" these BWs?
The same might be true for the other "liberation" mods.

regards
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on December 04, 2016, 12:53:15 pm
I think the 3.2GHz / 1HZ / 3MHz parameters along with the extended measurement options are just the design limits of the SSA3000X. It appears that as long as the instrument is not "personalized" (i.e. S/N assigned and other limits defined), the "ecomb" application (that's the main SA program) runs with all options enabled, for example for production testing / calibration. So the SA doesn't need to "remember" a previous (hacked) configuration, it just activates all the functions it has. At least this appears to be a reasonable explanation.

Cheers,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Tobey on December 04, 2016, 04:05:15 pm
DL4RAJ thanks for the response.
Yes you are correct:
When you type in the password nothing happens on the screen,
i.e. the cursor is staying on the same position as before!

I tried what you suggested, pressed backspace, nothing happens.  I even tried a new computer and a new LAN connection; I did change the IP address
on the new Lan connection, by the way.  I have no problem getting in to the SSA and opening the Araco Project screen and the prompt for the login.  The machine takes my login"root" and it advances
to the next line "Password" with the cursor.  However, the input to the cursor has no response from the keyboard.  It is acting, in my opinion, like the login word is wrong and giving no response at the
password prompt.  I saw where Bozidarms at Reply#112 had the same SSA setup info on his machine as I do, yet he was able to get in to SSA!  Is it possible that they have changed the login and password?
I have made sure that I am using all lower case and no extra spaces before the login "root".  I have tried everything suggested in this thread and still no luck!  Are there any other logins other than "root" and "ding1234" that anyone is aware of?  I am at a brick wall.
Thanks for all the help.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on December 04, 2016, 04:16:05 pm
Do not flash P08.01. It will limit your future choices.
But do try to flash a stock P07.07.
It could be that your root password was changed in factory. This would indeed close the loop hole, especially if future FW versions do not contain the passwd file,  or leave the existing one intact.
I am not sure if reflashing P07.07 will restore your password to default,  but it is worth a try.

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: DL4RAJ on December 04, 2016, 04:22:09 pm
DL4RAJ thanks for the response.
Yes you are correct:
When you type in the password nothing happens on the screen,
i.e. the cursor is staying on the same position as before!

I tried what you suggested, pressed backspace,

Despite there is nothing happening ON THE SCREEN the password is gettting into the system
while you are typing .Don't press 'Backspace' after entering but 'Enter' !

regards
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Tobey on December 04, 2016, 05:19:30 pm
I did a sw update to 07.03 and still the same problem, I cannot get past the "Password" prompt.  Re-updated again to 07.07, still no go.  I am a little hesitant to upgrade to
08.01 at this time because I cannot login to the SSA in the older update versions.  I would have tried other sw versions but that was all I could find at Siglent.  Hoping someone knows how to get into the SSA that will work!
Thanks everybody!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on December 04, 2016, 05:44:20 pm
Don't dispair, nor do anything in a rush.

IMHO, there are the following possibilities:

a) Your device has been edited in factory to carry a different root password - I don't really believe that
b) Your device has a fault
c) Your network has a fault
d) Your computer(s) has/have a fault when it comes to telnet

Try this:

a) Use PuTTYinstead of telnet
b) Here is how it looks on my side:
Code: [Select]
_____                    _____           _         _
|  _  |___ ___ ___ ___   |  _  |___ ___  |_|___ ___| |_
|     |  _| .'| . | . |  |   __|  _| . | | | -_|  _|  _|
|__|__|_| |__,|_  |___|  |__|  |_| |___|_| |___|___|_|
              |___|                    |___|

Arago Project http://arago-project.org am335x-evm

Arago 2013.05 am335x-evm


am335x-evm login: root
Password:
Login incorrect

am335x-evm login: root
Password:
root@am335x-evm:~#

Note that in the first attempt, I entered a wrong password!

c) Try downloading and flashing this firmware, which does use the known root password (checked with CRC32 code = 8470CDE0): http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA3000X-P07.07.rar (http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA3000X-P07.07.rar)

d) This HAS to work, if not, something is wrong (defective device, network or computer).

Good luck.

Regards,
Vitor


Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Tobey on December 04, 2016, 06:00:09 pm
Success at last!  After reloading sw P07.07 I tried to enter SSA again and got in.  It must have been my fault.  When trying to enter the password, the cursor was having no response as if
nothing was being typed, and I assumed it was not taking the pw.  So, I entered "ding1234", even though there was no response at the cursor, and pressed Enter.  I was in.  I feel foolish that
I assumed there was no response from the machine.  I am do not use Linux very much.  Is this the way password entry works on the SSA?  I will now try to "liberate" the SSA.
Thanks all of you for your help, I am very appreciative!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on December 04, 2016, 06:03:39 pm
What you experienced is the Windows telnet, which does sometimes lack feedback. This is why I recommended PuTTY.
With the Rigol DS1054Z it is even worse, no response at all, unless you issue a propper command.

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: DL4RAJ on December 04, 2016, 06:17:44 pm
When trying to enter the password, the cursor was having no response as if
nothing was being typed, and I assumed it was not taking the pw.  So, I entered "ding1234", even though there was no response at the cursor, and pressed Enter.  I was in. 


You may want to re-read what I had decribed in my previous posts.
Exactly THIS:
"Despite there is nothing happening ON THE SCREEN the password is gettting into the System while you are typing .
Don't press 'Backspace' after entering but 'Enter' !"


regards




Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Tobey on December 04, 2016, 07:01:49 pm
Thanks DL4RAJ.

I did read your post about nothing happening on the screen and that is what caused me to rethink how
the password was entering the system.  Your help was taken to heart and worked!  I thank you very much
for your input and the help of everyone.  I'll try to "liberate" the SSA within the next few hours.

Again, thank you.

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Tobey on December 05, 2016, 05:21:19 am
Liberated my SSA 3021X tonight!  Now a 3032X with all options permanent.  I am going to leave the firmware at P07.07 for the
time being.

Many thanks for the help everyone. It was much appreciated.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: jobber on December 10, 2016, 09:19:29 pm
Hey! I decided to connect to the debug port to see what is going on during boot. I looks like the kernel can not start but the UBOOT is working. I have attached the log for you to see and comment.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on December 10, 2016, 10:54:47 pm
@jobber:

Seems like there went something wrong with the defect management in your nand flash chip, i.e. defective blocks haven't been mapped out properly or have developed after the SSA has been installed. This can be just the result of repeated firmware updates even though it  definitely shouldn't be. I'm almost certain that this problem isn't related the your hacking attempts at all and would have occured even if you had updated the firmware on an otherwise "clean" machine. Have you got a chance to have the SSA replaced under warranty or is this option not available (for whatever reason)? In the first case, I strongly recommend to go for it. If not, things become more difficult but not impossible. I can provide images of all the partitions but the way to go would be to prepare a micro SD memory card with a bootable operating system (there's a slot on the digital PCB close to the USB device connector) and get the machine running from this, run a new defect scan (don't know if this is even possible) and install the system on an otherwise blank, freshly re-partitioned hardware. This would be a lot of work and require considerable skills but if this job is successful, it means that with this sd card, any failed system can be re-installed. I guess that's the way the SSA3000X machines are installed at the Siglent factory.

Please find attached a boot log of my machine (must have been a 7.05 firmware I guess).

All the best,
Thomas
Title: Text attachment of modifications
Post by: videobruce on December 11, 2016, 07:27:19 pm
I attached a .doc file of all the related posts starting Nov 9th regarding modifications up to the above post.
The username is in bold with the date following (no time) at the beginning of every entry. I did not included any quotes with any of the posts since that replay usually responded to the previous post. Comments such as "regards" or thanks were not included to keep the document as short as possible. A few posts were combined into one when one followed the other from the same poster.

Hope this helps as it's not easy to follow this, considering that document is 10 pages long (nor was it easy to C&P all of those posts, then remove all the unnecessary text.)   :o
(v2 corrected some missed bold text for username's)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on December 17, 2016, 11:15:44 pm
That is about 5MHz, not 5GHz!

The signal of your GPS antenna is probably so faint, that your SSA3021X picked up something at 2.493333MHz.

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: videobruce on December 18, 2016, 01:04:25 pm
Wrong thread
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: B1nary on December 20, 2016, 07:19:26 pm
New SSA3021X just arrived with 8.01 installed. It cannot be rolled back to an older FW - I tried 7.03 and 7.07. Snooping around I didn't see a file anywhere called NSP_system_info.xml. The files I found are NSP_sn_bandwidth.xml, NSP_trends_config_info.xml, calib, fun_opt_valid_config.xml and nsp_data-b. It seems the upgrade path may have been closed after the 7.07 FW. Has anyone been successful after the 8.01 update?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: bozidarms on December 21, 2016, 12:26:54 am
Hi,
yes upgrade is still possible  ;)- read in the thread before.
Regards
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on December 21, 2016, 12:34:55 am
Hi,
yes upgrade is still possible  ;)- red in thread before.
Regards
Might a new guide for dummies be required ?

I'm one and I'd have no idea where to start.  :scared:
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: bozidarms on December 21, 2016, 12:57:54 am
Unfortunately, i am not a right man for software at all.
I have done that, but i have had more luck than knowledge :palm:.
Just read more times a  whole thread and try to understand
what is all about.
Good luck!
 
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: videobruce on December 21, 2016, 12:15:14 pm
Might a new guide for dummies be required ?
I'm one and I'd have no idea where to start.  :scared:
There isn't enough in this thread to do it properly except for the 1% that are at the software 'code writing' level.   :-//
Too many assumptions that everyone else is (or should be) at that level.  :--
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: BlauerElefant on December 29, 2016, 04:58:36 pm
I could go back to 7.07 with the ecomb copy-trick. Thanks for the help!

Can I ask you a few things?
a) If I had that monster.txt file - where would it be?

b) I had 08.01 on my machine, copied the 07.07 ecomb back on the machine. Then I deleted the "new" files in the firmdata0.
Now I have
NSP_system_info.xml
NSP_trends_config_info.xml
fun_opt_valid_config.xml
and the calib folder in there

Is this right?

c) When I try to update again with the "peter" method now the machine says "Update could not be cpmpleted" (yes, with typo...) - I guess because of downgrading...
In my /usr/bin/siglent/upgrade folder I have two files with 0 bytes each
datafs.img
and
firmdata0.img

Is this normal? Could this be the reason why I cannot update anymore? Should/Can I remove them? Do you have them on a proper 08.01 installation?
Or could there be somewhere else files that are a problem for the update? Any suggestion?

Thanks for your help... :)

Edit: I attached the three small Error / Warning / Info-files that are generated when I try to upgrade... I'm not good enough into Linux to know what it is the real issue. To me is looks like a mounting thing? Or a owner / chmod thing? Maybe there is a good Linux guy here that can help me?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kr5j on December 31, 2016, 08:54:00 pm
It was mentioned in one of the comments that a 50-75 ohms capability was added in a FW update.
I have I think the latest FW 1.2.8.1 and cannot find a choice of 50 or 75 ohms on any of the screens.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on December 31, 2016, 10:39:43 pm
It was mentioned in one of the comments that a 50-75 ohms capability was added in a FW update.
I have I think the latest FW 1.2.8.1 and cannot find a choice of 50 or 75 ohms on any of the screens.
Welcome to the forum.

You are quite right, it was FW version 7.07.

2.   Add “input impedance switching function between 50? and 75?”


I'm running the latest FW but I'll have a check if it's there for you.  :popcorn:
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on December 31, 2016, 11:01:37 pm
It was mentioned in one of the comments that a 50-75 ohms capability was added in a FW update.
I have I think the latest FW 1.2.8.1 and cannot find a choice of 50 or 75 ohms on any of the screens.
Welcome to the forum.

You are quite right, it was FW version 7.07.

2.   Add “input impedance switching function between 50? and 75?”

To Find the 50 or 75 \$\Omega\$ selection:

Amplitude> Corrections> RF: 50 or 75 \$\Omega\$


Edit
Reply linked here too:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: B1nary on January 03, 2017, 03:47:55 am
Hi,
yes upgrade is still possible  ;)- red in thread before.
Regards
Might a new guide for dummies be required ?

I'm one and I'd have no idea where to start.  :scared:
I've read this forum several times and as is started in this post we, yes me as well, need a upgrade for dummies step by step guide. It's confusing to read to replace ecomb from 8 with the one from 7 and then what?? You can now roll back upgrades? That's great if I read that correctly but chances are high I didn't. There are some pretty incredibly talented users in this form and if one or a few could help those of us who need the upgrades for dummies methods I think we and everyone else who is trying to do the upgrade and failing or just afraid to try would be very grateful.

Does please and thank you work?  :-+

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on January 03, 2017, 04:15:36 am
Hi,
yes upgrade is still possible  ;)- red in thread before.
Regards
Might a new guide for dummies be required ?

I'm one and I'd have no idea where to start.  :scared:
I've read this forum several times and as is started in this post we, yes me as well, need a upgrade for dummies step by step guide. It's confusing to read to replace ecomb from 8 with the one from 7 and then what?? You can now roll back upgrades? That's great if I read that correctly but chances are high I didn't. There are some pretty incredibly talented users in this form and if one or a few could help those of us who need the upgrades for dummies methods I think we and everyone else who is trying to do the upgrade and failing or just afraid to try would be very grateful.

Does please and thank you work?  :-+
I feel your frustration too and I believe the reason that nobody's offered a guide is they think it will get reported to Siglent and the chance to improve them will cease as the holes will be closed. Fact is these are flying out the door almost faster than they're being produced and are at least their #2 best seller.

If the members here think Siglent is unaware of this thread and its contents, well............you're joking, right ?
Are they frustrated by this ? I guess they might be but they've never expressed such to me.

I say: go for it and IF holes get closed I'm quite sure there's enough smart guys here to find a way in again.  ;)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on January 03, 2017, 09:41:15 am
Hi,
yes upgrade is still possible  ;)- red in thread before.
Regards
Might a new guide for dummies be required ?

I'm one and I'd have no idea where to start.  :scared:
I've read this forum several times and as is started in this post we, yes me as well, need a upgrade for dummies step by step guide. It's confusing to read to replace ecomb from 8 with the one from 7 and then what?? You can now roll back upgrades? That's great if I read that correctly but chances are high I didn't. There are some pretty incredibly talented users in this form and if one or a few could help those of us who need the upgrades for dummies methods I think we and everyone else who is trying to do the upgrade and failing or just afraid to try would be very grateful.

Does please and thank you work?  :-+

You have not read.
This message is mandatory to read:

https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1069844/#msg1069844 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1069844/#msg1069844)

self-censorship: <deleted funny paragraph>
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on January 03, 2017, 09:57:38 am
As far as I know, so far nobody has been able to run a "proper" update after the manual "downgrade" from F/W 8.01 to 7.07 by just exchanging the "ecomb" application file. Since most (all??) of those who contributed to the "DIY improvements" of the instrument so far own older machines that initially had FW 7.0x installed and thus have the options and full bandwidth active allready, there won't be much motivation for them for further experimentation.

To "properly" hack a machine that came with F/W 8.01, the script of the 7.07 -> 8.01 update would have to be analyzed and checked if all the steps that are executed in there could be reversed. Only if this is possible, a downgrade to 7.0x would be an option that permits that application of the "old" hack and re-update to 8.01 with the standard update file.

I showed a method to enable the "test mode" with all the options, full frequency range and even 3MHz and 1Hz RBW active. I'm pretty sure that Siglent will lock this hole with the next F/W update. This modification and also the reverse functionality could be easily put in a script. But I also think that those who tamper with their machines should be knowing what they are doing. There's always a risk of bricking the instrument when messing with it in such a way and in my opinion (others may have a different one...), some basic knowledge of the operating system and what's going on internally will be the best insurance from fatal (to the instrument that is) errors. And I guess the information found in this thread makes it almost as easy as it gets to apply the improvements. It's all within the last four pages of the thread.

Just noticed, rf-loop made it even easier for the newbies... So be sure to cut&paste and save a copy of his post before he deletes it again (as he told he will -- sorry, too late...).

Cheers,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on January 03, 2017, 10:34:09 am
TurboTom is correct:

Onwers of devices shipped with FW prior to P08.01 have had the opportunity to hack their device and ENABLE the missing options. These stay enabled after the P08.01 upgrade, except 3MHz and 1Hz RBW.

On top of that, by removing/renaming the already mentioned files, the P08.01 firmware will assume that it is in manufacturer mode, where ALL OPTIONS are enabled for an unknown serial number.

Conclusion:

1) The hack is permanent for older devices (if done correctly).
2) The hack is temporary for all devices (including new devices shipped with P08.01) on FW P08.01.
3) Next FW will probably invalidate the easy P08.01 hack.

History of hacks:

1) A "werewolf mode" FW appeared by accident on SIGLENT.COM, that enabled all options (P05)
2) The Telnet login/password was discovered
3) It was discovered that the timed options could be made permanent by putting silly values in them (this would lead to a non-permanent hack upon P08.01 upgrade)
4) It was discovered that all options could be autorised by changing missing options status to TRUE
5) Siglent ceased using a simple file listing TRUE/FALSE on options and instead uses the corresponding activation keys starting with P08.01
6) It was discovered that deleting/renaming 4 files, all options get authorised by default - as the device behaves as a stock device without serial number

Conclusion:

1) Everyone right now can enable all options
2) If a newer FW is released, do not upgrade, if you want maintain the hacked status
3) Existing users with hacked device are not that keen to do experiments, as the machine costs 1500 Euro (+VAT) and can be damaged by doing so
4) Siglent may not be "hunting" the hackers but are certainly closing the doors enabling the hacks
5) Did the hack increase sales? I would say yes (at least that was a big motivation for me to get the device, as it made it much more attractive). Will Siglent be permissive because of that? Nobody knows!
6) If you cannot be bothered to read a thread with JUST 9 PAGES, then you are not in a position to demand anything!  ;)

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: lz1pro on January 03, 2017, 07:30:55 pm
Hello to all and Happy New Year!

I'm new in this forum. So I broke my new SSA3000X whit fw 08.01 .

After attempt to downgrade  to 7.07 whit copy file ecomb broke my NAND rootfs. The problem is on the screen I only see the Siglent logo and nothing happens after that.
I still have access via UART interface and U-boot.
Please, can anybody help to restore my NAND?

I have a backup copy of firmdata0 and /usr/bin/siglent/usr/backup/.

Regards
Yanko
 
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on January 03, 2017, 08:25:52 pm
How did you break the NAND rootfs? Please give as much info as possible.

@all: Somewhere (can't remember) I uploaded a tool that extracts the firmware contents to an almost regular ZIP archive. You can then uncompress most of it.

Doing so will show you 2-3 shell batchfiles (*.sh), one is called "siglentlib.sh". It kind of shows what is done during the upgrade.

Since you can decompress any firmware version, you can i.e. compare the differences between the P07.07 and the P08.01 upgrade.

Hope this helps.

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on January 03, 2017, 11:22:56 pm
@lz1pro

Could Siglent have a real problem here? Your failure mode appears very much similar to Jobber's: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1088378/#msg1088378  (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1088378/#msg1088378).
Yet, he reported that this happened on his instrument during the attempt to update from native 7.07 to 8.01. We should really keep an eye on this. Could it be possible that Siglent got hold of a series of faulty or counterfeit NAND flash chips? The error message is a clear indication of a faulty block in the NAND that should have been mapped out.
If your SSA is still in the warranty period, I would consider to have it replaced. It shouldn't be possible to trace your hacking attempts easily with this kind of error.

Good luck,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on January 03, 2017, 11:32:44 pm
@lz1pro

Could Siglent have a real problem here? Your failure mode appears very much similar to Jobber's: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1088378/#msg1088378  (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1088378/#msg1088378).
Yet, he reported that this happened on his instrument during the attempt to update from native 7.07 to 8.01. We should really keep an eye on this. Could it be possible that Siglent got hold of a series of faulty or counterfeit NAND flash chips? The error message is a clear indication of a faulty block in the NAND that should have been mapped out.
If your SSA is still in the warranty period, I would consider to have it replaced. It shouldn't be possible to trace your hacking attempts easily with this kind of error.

Good luck,
Thomas
Sadly this may not be the case, check the changelog for Version: P08.01:

5. After this firmware, do not support downgrade operation

http://www.siglentamerica.com/gjjrj-xq.aspx?id=4973&tid=15 (http://www.siglentamerica.com/gjjrj-xq.aspx?id=4973&tid=15)

This may be something we all need take note of.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: lz1pro on January 04, 2017, 07:02:06 am
How did you break the NAND rootfs? Please give as much info as possible.

@all: Somewhere (can't remember) I uploaded a tool that extracts the firmware contents to an almost regular ZIP archive. You can then uncompress most of it.

Doing so will show you 2-3 shell batchfiles (*.sh), one is called "siglentlib.sh". It kind of shows what is done during the upgrade.

Since you can decompress any firmware version, you can i.e. compare the differences between the P07.07 and the P08.01 upgrade.

Hope this helps.

Regards,
Vitor

It's a good idea to start play with "siglentlib.sh", but first I need to boot from an SD card to can access shell. I trying to find image to boot from SD card, but without success.
Any suggestion will be fine.

Regards,
Yanko
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: KeBeNe on January 04, 2017, 05:23:14 pm

Hello,

I have the same problem as lz1pro with the hack, device was delivered with 8.01.

regards
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on January 04, 2017, 05:59:34 pm
Neither of you describe what you guys did that led to breaking the root filesystem!

Please explain step by step what you did and when your device broke.

It won't be easy to recover, as I at least have no idea how to boot, flash or install a new rootfs.

I think the answer is somewhere in the siglentlib.sh file. But I guess you need a working fs to start with.

In worst case scenario you need to JTAG the flash, but for that you need a flash dump. This again needs someone with a good device to open it (losing warranty ans risking damage), in order to dump the flash contents.

Perhaps there is an easier way, but I guess nobody knows how to do that.

Is there anything you can do from the serial shell?

Also, I agree with TurboTom: just request a repair under warranty claiming that this happens during a firmware upgrade...

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: lz1pro on January 04, 2017, 06:11:50 pm
@KeBeNe
Hello here,
can you tell  when is done, after attempt to mount the rootfs or command like this "mount -o remount,rw /"?
It is will be helpful for another user that  tray to downgrade.
Hire is the link whit same problem on another device: http://linux-mtd.infradead.narkive.com/aO9xNZvZ/temporarily-remounting-rootfs-as-rw-leads-to-kernel-panic-on-reboot (http://linux-mtd.infradead.narkive.com/aO9xNZvZ/temporarily-remounting-rootfs-as-rw-leads-to-kernel-panic-on-reboot)

Regards,
Yanko
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nctnico on January 04, 2017, 06:29:55 pm
It is very important to use the 'sync' command before cycling power because otherwise data may not be written to the filesystem yet which leads to incomplete or missing files.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: janekivi on January 04, 2017, 06:36:12 pm
Somewhere I posted 08.01 in zip format and decoded nsp_data_b too.
In img files I look with ubidump, maybe there is better utility for this.

08.01.zip firmware (http://s000.tinyupload.com/index.php?file_id=26898752874871167305)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: KeBeNe on January 05, 2017, 03:54:40 am
Hello,

I've done,

-FW 7.07 (Siglent FW-tool + 7zip)
-ecomb from FW7.07 to usb stick
-SSA3021X connected via Telnet (Putty)
-Login: root, PW: ding1234 - all ok
- first, backup "cp -R /usr/bin/siglent /usr/bin/siglent/usr/mass_storage/U-disk0/SSA3021x_backup" -ok
- then "mount rootfs -o remount, rw" -ok
- "cd/usr/bin/siglent" -ok
- "cp/usr/bin/siglent/usr/mass_storage/U-disk0/ecomb" -ok
- "sync" -ok
- "mount rootfs -o remount, ro" -ok
- "shutdown -r" -ok
As far as everything ok, device makes a reboot, downgrade to 7.07 but still not possible.

I thought, I switch times and again, so a complete reboot, then the device stopped at "Siglent", no more start


regards René
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ExplodingLemur on January 05, 2017, 04:12:20 am
Does anyone have the 7.07 firmware image converted to a zip file?  I want to compare the upgrade scripts.  I think an 8.01 device can be reverted to 7.07 with some manual file copies.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ExplodingLemur on January 05, 2017, 04:14:47 am
KeBeNe, at this point can you still get a shell on the device?  If so I'll try to get you a set of instructions.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on January 05, 2017, 08:00:19 am
I think when messing around with ecomb, it is mandatory to first stop this process since that's the main application that's running in background.

Type "ps [enter]" to show the processes that are currently running on the system. Note the process number of ecomb, let's assume it's 374.
To terminate the process, type "kill 374 [enter]". After this, repeat the "ps" command to make sure ecomb is no longer running.

After this, it should be less risky to copy / replace it but anyway, my own experiments with this didn't show any substantial use of it, at least as long as the "firmdata0 hack" is available. Actually, I would recommend to just leave the root FS mounted read-only and don't mess with it anymore (of course this wouldn't help those who already have a broken machine).

All the best,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on January 05, 2017, 11:12:43 am
@janekivi What utility do you use to convert the ADS-file to a fully extractable zip?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: lz1pro on January 05, 2017, 02:30:12 pm
Hi to all,

My SSA3000X is back to living. :)
So I want  to say BIG Thanks to TurboTom for help and support.
Thank you very much Thomas!

Regards,
Yanko
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on January 05, 2017, 02:43:02 pm
Hi to all,

My SSA3000X is back to living. :)
So I want  to say BIG Thanks to TurboTom for help and support.
Thank you very much Thomas!

Regards,
Yanko
Nice.  :-+

It would be polite to further thank Tom, use the button.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on January 05, 2017, 04:03:47 pm
Experimenting with a 'clean" TI SD-card image gave this output:

Code: [Select]
P
U-Boot SPL 2013.01.01 (Jan 11 2016 - 14:14:06)
Start buzzer++
Stop buzzer--nand_init+++++
nand_init-----
>>spl_load_lcd_fpga++
LCD init()++
Lcd_Init()++
SetUpLCD()++
SetUpLCD()--
len=1228852, height=600, width=1024
Logo from nandflash: base=0x81000000; end=0x8112c01f; end-base=0x12c01f; rwsize=0x12c020; r=0x0
Lcd_Init()--
>>spl_load_lcd_fpga--


U-Boot 2013.01.01 (Jan 11 2016 - 14:14:06)

I2C:   ready
DRAM:  128 MiB
NAND:  256 MiB
MMC:   OMAP SD/MMC: 0, OMAP SD/MMC: 1
Using default environment

set_default_env::4309
Net:   <ethaddr> not set. Validating first E-fuse MAC
cpsw
Hit any key to stop autoboot
mmc0 is current device
SD/MMC found on device 0
reading uEnv.txt
** Unable to read file uEnv.txt **
reading uImage
** Unable to read file uImage **
** File not found /boot/uImage **
Could not find uImage
U-Boot#

So adding a valid uEnv.txt and uImage might do the trick.....
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: KeBeNe on January 05, 2017, 04:52:06 pm
@janekivi What utility do you use to convert the ADS-file to a fully extractable zip?

--> https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/?action=dlattach;attach=269048 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/?action=dlattach;attach=269048) + 7zip 16.4
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: KeBeNe on January 05, 2017, 05:01:20 pm
KeBeNe, at this point can you still get a shell on the device?  If so I'll try to get you a set of instructions.

Thanks for the offer, I have returned my device and get a new one, I would not want to destroy the guarantee seal.

Perhaps lz1pro can briefly describe how he has made it to bring his device back to life.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: lz1pro on January 05, 2017, 05:52:49 pm
In my way to restore need to access SD card slot and UART interface. So there is no possibility to access them, without manipulate the warranty sticker.
Regards,
Yanko
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on January 05, 2017, 07:02:07 pm
You could always drill a hole in the side for access. The sticker remains undamaged that way.  :)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on January 05, 2017, 07:15:32 pm
@KeBeNe
The tool transforms the ADS in a crippled zip where some files have invalid CRC's making it impossible to extract these files.
I'm looking for a way to get all files from the ADS like janekivi's zip file allows.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: janekivi on January 05, 2017, 07:20:37 pm
You could always drill a hole in the side for access. The sticker remains undamaged that way.  :)
Once video card broke in desktop computer. After removing side grill for cpu fan and
unscrewing psu 4 screws I managed to get it out without scratch on sticker...

Edit -> Sorry, was wrong url before:
Here is older firmware V100.01.02.07.07.zip firmware (http://s000.tinyupload.com/index.php?file_id=90163784571599561684)
--------------------------------------------------------

About those things we talk here:
https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/ (https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on January 05, 2017, 07:49:36 pm
The link in your last post also points to 8.01.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: lz1pro on January 06, 2017, 03:45:17 pm
Hi,
Is there anyone in the forum with firmware 7.07?

Regards,
Yanko
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on January 06, 2017, 06:33:19 pm
Hi,
Is there anyone in the forum with firmware 7.07?

Regards,
Yanko
http://www.siglentamerica.com/gjjrj.aspx?id=15&page=1 (http://www.siglentamerica.com/gjjrj.aspx?id=15&page=1)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on January 06, 2017, 06:47:51 pm
@tautech: Lz1pro is of course looking for someone with P07.07 installed, so that a flash dump can be made.

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Johncanfield on January 06, 2017, 09:41:22 pm
Just received my 3021X yesterday  :-+. Saelig just received a shipment about a week ago and they put one on the truck for me the same day. This one is pretty fresh - just calibrated 13 December.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: bozidarms on January 07, 2017, 08:53:03 am
Welcome to the club, Johncanfield.
Have a pleasant time, with this wonderful instrument.
Regards
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ebclr on January 07, 2017, 09:05:11 am
Found on amazing terminal

http://mobaxterm.mobatek.net/ (http://mobaxterm.mobatek.net/)

Another SSA3021X upgraded sucessfull
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on January 07, 2017, 07:08:10 pm
Found on amazing terminal

http://mobaxterm.mobatek.net/ (http://mobaxterm.mobatek.net/)

Another SSA3021X upgraded sucessfull
Firmware version ?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ebclr on January 08, 2017, 01:37:12 am
07.03.00
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on January 08, 2017, 02:10:49 am
07.03.00
Thanks, that's quite an early one. The later ones are here:
http://www.siglentamerica.com/gjjrj.aspx?id=15&page=1 (http://www.siglentamerica.com/gjjrj.aspx?id=15&page=1)
8.01 is the version that attempts to restrict FW downgrade and improvements.
Check the "More Information" tabs and info in this thread before you select a version that you'd consider installing.

Enjoy.  ;)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ExplodingLemur on January 08, 2017, 02:37:30 am
I've got 8.01 installed on mine (just arrived today), and I've been looking at the 8.01 upgrade image scripts to see what I'd need to do to back this out to a prior version.  However I'm unable to mount the root filesystem as RW:
Code: [Select]
root@am335x-evm:/usr/bin/siglent# mount rootfs -o remount,rw
mount: mounting rootfs on / failed: Bad message

/proc/mounts shows:
Code: [Select]
rootfs / rootfs rw 0 0
ubi0:rootfs / ubifs ro,relatime 0 0

I'm guessing there's a u-boot option that flags the root partition as read-only?
Aha, looks like that's set at boot, with
Code: [Select]
console=ttyO0,115200n8 quiet root=ubi0:rootfs ro ubi.mtd=7,2048 rootfstype=ubifs rootwait=1t ip=none (visible in /proc/cmdline)

So, I'm not too familiar with u-boot, and even less so with UBIFS on top of UBI on top of MTD.  I've just tried attaching another UBI device to the U-Boot and U-Boot Env MTD devices with no luck.
Code: [Select]
root@am335x-evm:/etc# ubiattach -p /dev/mtd4ro -d 3
ubiattach: error!: cannot attach "/dev/mtd4ro"
           error 22 (Invalid argument)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on January 08, 2017, 09:01:01 am
I've got 8.01 installed on mine (just arrived today), and I've been looking at the 8.01 upgrade image scripts to see what I'd need to do to back this out to a prior version.

Why?????

Why you do not just use original genuine FW8.01 in "super mode"?
Much less any risk.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: DL4RAJ on January 08, 2017, 10:30:23 am
I've got 8.01 installed on mine (just arrived today), and I've been looking at the 8.01 upgrade image scripts to see what I'd need to do to back this out to a prior version.

Why?????

Why you do not just use original genuine FW8.01 in "super mode"?
Much less any risk.

That's exactly what I'm asking myself since a while.
Why are people with FW8.01 messing around with downgrade efforts braking possibly the OS of the SSA
instead of make use of the super simple and safe modification into "super mode"
which Turbo Tom has provided in this thread??
Nothing could be easier and it is easily reversible.

Regards

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on January 08, 2017, 11:42:25 am
Hi,


(1) Flash backup

@ebclr: Would you be willing to do a backup of your three partitions (ubi0_0, ubi1_0 and ubi2_0, which correspond to rootfs, usr and firmware0)?

All you need to do is:

1) telnet to your SSA
2) insert a USB disk
3) execute these three commands:
dd if=/dev/ubi0_0 of=/usr/bin/siglent/usr/mass_storage/U-disk0/ubi0_0-P0703.img
dd if=/dev/ubi1_0 of=/usr/bin/siglent/usr/mass_storage/U-disk0/ubi1_0-P0703.img
dd if=/dev/ubi2_0 of=/usr/bin/siglent/usr/mass_storage/U-disk0/ubi2_0-P0703.img

@all: It would be great to have these backups for P07.07, so please, if anyone has P07.07 installed, can you do such backup?

(2) Flash

@all: The filesystems used by the SSA reside on a flash memory chip. There are three partitions: the rootfs partition with the OS, the usr partition with the ecomb file amongst other and the firmware0 partition.

My guess to why some SSA broke was this:

a) The user replaced ecomb from P08.08 with ecomb from P07.07.
b) The user run the P07.07 upgrade, because this ecomb will accept the firmware update script of P07.07 - before P0.08 there was no downgrade check.
c) The SSA got broke. Why? Because the P07.07 just assumed that the partition size for UBI1_0 and UBI2_0 were correct (they never changed before). So, without resizing the rootfs (UBI0_0) partition, the usr and firmware0 partition are flashed starting from the WRONG flash memory address, thus effectively overwriting part of the rootfs!

Stupid but easy mistake...

(3)

@ExplodingLemur:

You are heading on fast lane to brick your SSA!

I think that the only way to downgrade to P07.07 is by writing a modified upgrade script, which uses the flash memory address of P07.07 to make sure, all partitions are correctly resized. The problem is, that I am not sure if the correct flash address is known/written in former upgrade batch files, because apparently it used to be the same. This is all guesses I am doing.

So, first of all, we need to figure out the memory organisation of the flash file to then edit the siglent.sh and edit the memory addresses.

Also, we need a copy of the P07.xx rootfs partition, which seems to be missing in the P07.xx fimrware upgrade - or - we need to disable the check that verifies if that partition needs upgrade.

(4)

@all: The question is: but WHY? Why do people want to downgrade, if there is a fully working hack for P08.01?

Answer: the next firmware might have all holes closed and be not hackable - would be nice to have a plan B then!

And then, this thread is about hacking: hacking is fun and insteresting and there might be no other reason...

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on January 08, 2017, 01:46:42 pm
As it appears, the /dev/ubi?_? devices are not the raw file systems, moreover they are not the complete contents of the NAND. I rather recommend to make 13 images of the /dev/mtdblock0 ... /dev/mtdblock12 devices in order to have a backup of the complete NAND with (from the O/S) hidden partitions and such.

Usage / Purpose of the NAND Flash Partitions in Siglent SSA3000X F/W 8.01

Device No.    | Size kByte  | Usage
----------------+---------------+------------------------------------------------------------------------
mtdblock0    | 128             | MLO (Memory Locator, X-Loader -- first file to be accessed during boot)
mtdblock1    | 128             | 1st copy of MLO
mtdblock2    | 128             | 2nd copy of MLO
mtdblock3    | 128             | 3rd copy of MLO
mtdblock4    | 1920           | U-Boot image
mtdblock5    | 128             | U-Boot environment / not used currently
mtdblock6    | 3072           | Siglent boot logo
mtdblock7    | 44032         | root F/S (ubi0_0)
mtdblock8    | 6144           | Linux Kernel Image
mtdblock9    | 6144           | ???FPGA Configuration???
mtdblock10  | 51200         | FIRMDATA0 (ubi2_0 -- /usr/bin/siglent/firmdata0 )
mtdblock11  | 51200         | FIRMDATA1 / not used currently
mtdblock12  | 97792         | DATAFS (ubi1_0 -- /usr/bin/siglent/usr )


So to modify Bicurico's first paragraph, please let me suggest to do the following steps:

_________

1) telnet to your SSA
2) insert a USB disk
3) execute these commands (sorry, more than three...):
ps
  - now look for the process number of ecomb (it's the first number in the line that ends with ./ecomb, say it's 723)
kill 723 (or whichever process number your ecomb instance had assigned)

dd if=/dev/mtdblock0 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock0-P0703.img
dd if=/dev/mtdblock1 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock1-P0703.img
dd if=/dev/mtdblock2 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock2-P0703.img
dd if=/dev/mtdblock3 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock3-P0703.img
dd if=/dev/mtdblock4 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock4-P0703.img
dd if=/dev/mtdblock5 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock5-P0703.img
dd if=/dev/mtdblock6 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock6-P0703.img
dd if=/dev/mtdblock7 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock7-P0703.img
dd if=/dev/mtdblock8 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock8-P0703.img
dd if=/dev/mtdblock9 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock9-P0703.img
dd if=/dev/mtdblock10 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock10-P0703.img
dd if=/dev/mtdblock11 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock11-P0703.img
dd if=/dev/mtdblock12 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock12-P0703.img

sync

shutdown -r now

_________

The advantage of having the mtdblock images is that they can be directly re-written to the NAND from the U-Boot shell in case a file system is really messed up. I'm not sure if this is directly possible with the ubi images.
I hope this makes sense...

Cheers,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on January 08, 2017, 02:07:20 pm
Thanks TurboTom.

Indeed I am not that literate when it comes to filesystems...
...and their backup by means of dd.

It would be great to find a way to reflash this backup without having to open the SSA, hence avoiding any warranty loss.

I am not sure if that is possible: how to access the U-boot shell through ethernet? Is there any secret key-combination on power-up?

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on January 08, 2017, 03:03:24 pm
I don't think it would be possible to interrupt U-Boot without opening the SSA's enclosure. That is, unless Siglent utilized the unused contacts of the RJ45 100 base T interface (which are four) to route the UART interface outside (on some Hantek gear it is arranged that way). But anyway, in order to make a file system image available to U-Boot, the box has to be opened since U-Boot doesn't provide a driver for a USB disk. This is only possible via the internal Micro SD card slot (or the UART interface, but that's less comfortable and takes ages).

There are instructions in many threads how to remove a warranty void sticker without breaking it, i may add that application of a moderate amount of heat (hair dryer or the like) can make a big difference.

So in my opinion, opening the box is a real no-brainer, and an individual, before tampering with these instruments, always has the choice to pay for the added functionality without risking warranty (okay 1Hz and 3MHz RBW cannot be licensed from Siglent). Whenever I'm playing around with one of my "gadgets", I'm completely aware of the small risk of bricking it and if it happens, it's in my own responsibility and nobody else's. So if the warranty void sticker gets damaged, then losing the warranty is simply the price you have to pay for hacking... A fair deal I would say.

Cheers,
Thomas

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on January 08, 2017, 03:10:31 pm
For people suffering a bricked 8.01 SSA (like me), it would be nice to have these mtdblock images too for 8.01.
So if anyone is up to it.......
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Johncanfield on January 08, 2017, 03:21:42 pm
Just received my 3021X yesterday  :-+. Saelig just received a shipment about a week ago and they put one on the truck for me the same day. This one is pretty fresh - just calibrated 13 December.
I'm surprised mine left the factory with 7.03 firmware. I suppose I should not upgrade in case I get brave enough to hack it.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Emo on January 08, 2017, 04:25:17 pm
Johncanfield,

Are you sure you have FW 7.03 and not HW 7.03? in the image in your earlier post it says SW 1.2.8.1 = FW 8.01
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on January 08, 2017, 06:21:08 pm
Johncanfield,

Are you sure you have FW 7.03 and not HW 7.03? in the image in your earlier post it says SW 1.2.8.1 = FW 8.01
Quite correct Emo, it's an easy mistake to make. John's is indeed loaded with 8.1.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Johncanfield on January 08, 2017, 07:48:48 pm
Ah-so. I originally thought HW meant hardware so I was correct.  Oh well.  :palm:
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: jobber on January 09, 2017, 08:29:49 pm
Hey all!

Let me just quickly recap my story about bricked SSA. I have sent it back for repair (under warranty) and received it upgraded to the latest version and fully unlocked! ;D It looks like they only flashed the faulty partition and left the user data intact. I am not sure if they didn't notice the modifications or they just let me go with it.  I would recommend anyone with bricked device that is still under warranty to try and send it back. It could be the easiest solution.

Successful hacking in 2017!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on January 09, 2017, 09:14:18 pm
Hey all!

Let me just quickly recap my story about bricked SSA. I have sent it back for repair (under warranty) and received it upgraded to the latest version and fully unlocked! ;D It looks like they only flashed the faulty partition and left the user data intact. I am not sure if they didn't notice the modifications or they just let me go with it.  I would recommend anyone with bricked device that is still under warranty to try and send it back. It could be the easiest solution.

Successful hacking in 2017!
We ask who is "they" ?  :-//
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ebclr on January 09, 2017, 10:58:36 pm
Flash dump 100.0..02.07.07

http://www.luximetro.com/SSA3021X.rar (http://www.luximetro.com/SSA3021X.rar)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: jobber on January 14, 2017, 10:23:17 pm
Hey all!

Let me just quickly recap my story about bricked SSA. I have sent it back for repair (under warranty) and received it upgraded to the latest version and fully unlocked! ;D It looks like they only flashed the faulty partition and left the user data intact. I am not sure if they didn't notice the modifications or they just let me go with it.  I would recommend anyone with bricked device that is still under warranty to try and send it back. It could be the easiest solution.

Successful hacking in 2017!
We ask who is "they" ?  :-//

Technicians at Siglent repair center  ;)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: cesarpaz on January 15, 2017, 12:04:09 am
Hello everyone.
After reading and deciding which spectrum analyzer I buy, I am thinking of buying a Siglent SSA3021X and then converting it into a Siglent SSA3032X. I would like to know what is the opinion of the final result to the users who have made this conversion, is it worth? Give some problems Thank you very much.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ebclr on January 16, 2017, 07:10:32 am
Until firmware 7.07 flawless, and easy
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: bozidarms on January 16, 2017, 08:25:15 am
Till now, everything OK / marvelous piece of equipment!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: radiotech9409 on January 16, 2017, 03:04:00 pm
i got my SSA3021x a couple days ago.  It came with sw 1.2.8.1.  I performed the patch_instruction_new provided by TurboTom.  However, it appears that the latest firmware hides/places the file NSP_system_info.xml somewhere else.  When i performed the back up step for the NSP_system_info, telnet gave a message:  file was not found.  i created one based on turboTom's instruction and wrote it in the system.  However, it seems that the file does not do anything.  Any help is appreciated.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on January 16, 2017, 03:11:04 pm
Hi,

I would suggest:

1) Do a full backup using the dd command as described earlier in this thread. In worst case scenario, this will allow you to fully restore the flash contents.
2) Do a second backup using the cp command and copy all relevant files/folder, which has been explained, too. This is required to restore the device prior to RMA or firmware upgrade.
3) Take your time to navigate in the telnet shell through all folder, to get yourself familiar with file structure. This is required to avoid problems/worst case scenario.
4) The hack involves renaming three files to dummy names. Once you figure it out, it takes you 1 minute. Then all the hacking fun is gone. Unless you REALLY need the enhanced frequency range, take your time.
5) Learn how to use the instrument before hacking it - that will allow you to check if it is working correctly.

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: radiotech9409 on January 17, 2017, 02:55:50 am
it seems that you referred to TurboTom's post that pointed to:"Just noticed, rf-loop made it even easier for the newbies... So be sure to cut&paste and save a copy of his post before he deletes it again (as he told he will -- sorry, too late...).  I came a bit late, so I didn't have the chance to read rf-loop's instruction.  I wonder if anyone got a hold of the rf-loop's instruction?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: radiotech9409 on January 17, 2017, 03:44:58 am
Thanks so much.  Got your instructions.  I will post my progress later.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: steverino on January 18, 2017, 02:12:11 am
Thanks so much.  Got your instructions.  I will post my progress later.
Curiosity has me wondering if I missed something in the referenced rf-loop instructions.  Could someone please forward these instructions to me.

Thanks, Steve
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: pe1oxp on January 18, 2017, 07:04:49 am
it seems that you referred to TurboTom's post that pointed to:"Just noticed, rf-loop made it even easier for the newbies... So be sure to cut&paste and save a copy of his post before he deletes it again (as he told he will -- sorry, too late...).  I came a bit late, so I didn't have the chance to read rf-loop's instruction.  I wonder if anyone got a hold of the rf-loop's instruction?

That's why I couldn't find the instructions also? I'm also interrested in upgrading my SSA3021x
Can someone help me with these instructions, I have read the thread but not so familiar with Telnet and the used file system
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ebclr on January 18, 2017, 01:15:54 pm
1st step install mobaxterm

Connect the instrument to your router

turn the instrument, and see if they get a IP from your router by dhcp

Use that ip to connect to the instrument

user root
pasword ding1234

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on January 20, 2017, 11:29:19 am

<deleted: error>
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: sq6emm on January 20, 2017, 11:39:28 am
Just for your information.

Ordered SSA3021X on 2016/01/10 in Poland. Distributor said it will be with 1.2.8.1 firmware  :(

Today 2016/01/20 SSA arrived. Unboxed, turned on and...

Voila! 100.01.02.07.07 !

10 minutes later, with NSP...xml file hack and reboot I have SSA3022X with ALL OPTIONS Sta: ON Vaild: Permanent!

Thank you so much EEVBLOG CONTRIBUTORS!:)

Regards,

Dawid SQ6EMM
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: pe1oxp on January 20, 2017, 04:53:57 pm
Quote
Is it possible that some kind people who have this mysterious file can  share it here as message attachment?

Unfortunately I only have a printout of it to read it on my way home in the bus, thought I could save it when I came home from work.
Maybe someone saved the file?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ExplodingLemur on January 20, 2017, 05:41:42 pm
Unfortunately I only have a printout of it to read it on my way home in the bus, thought I could save it when I came home from work.
Maybe someone saved the file?

Can you snap a photo or scan it and put it up on imgur?  We could transcribe it from that.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: pe1oxp on January 20, 2017, 05:51:03 pm
Unfortunately I only have a printout of it to read it on my way home in the bus, thought I could save it when I came home from work.
Maybe someone saved the file?

Can you snap a photo or scan it and put it up on imgur?  We could transcribe it from that.

A scan will be possible when there is nobody else who has saved it.
I was just thinking and must have saved it on my computer at work. Otherwise it must be in the Temp-directory. I will have a look on Monday.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kloetpatra on January 20, 2017, 06:28:19 pm
Am I correct, that only Firmware versions till 1.02.07.07 can be unlocked so far?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on January 20, 2017, 06:31:22 pm
Am I correct, that only Firmware versions till 1.02.07.07 can be unlocked so far?

No. Please read this thread more carefully. ;)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: pe1oxp on January 20, 2017, 11:00:54 pm
A scan will be possible when there is nobody else who has saved it.
I was just thinking and must have saved it on my computer at work. Otherwise it must be in the Temp-directory. I will have a look on Monday.


I did a quick search and found the information.
MD5 is: f2c4867771222a38f23ebb64d4420d5a
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: 3s1d on January 21, 2017, 12:16:37 am
Hi everybody,

I read through the whole thread (11pages, took me forever)... It started out great but the end is a bit frustrating.
I'd really like to buy and permanently unlock this device but it will most probably ship with 8.01  :--

As I understand it, nobody who has an unlock device, has had a look into the nsp_data_b file? Its supposed to be a XML file inside an UBI image? Maybe the the options are hidden there?

Greetinx
Juergen
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on January 21, 2017, 09:26:23 am
A scan will be possible when there is nobody else who has saved it.
I was just thinking and must have saved it on my computer at work. Otherwise it must be in the Temp-directory. I will have a look on Monday.


I did a quick search and found the information.
MD5 is: f2c4867771222a38f23ebb64d4420d5a
And who would have thought the Chinese author of the .txt file you attached wrote such very good and easy to understand English.  :clap:  ;)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: pe1oxp on January 22, 2017, 06:55:22 pm
My source, the Chinese author forgot some lines in the description, he warned me to be careful

Do not use CHAPTER 2   Or  "full FLASH backup to USB" part in Chapter 8.
ERROR: Missing command lines.  Corrected version is under work.


Please be patient!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: papousek on January 31, 2017, 02:29:24 am
 :) :)
Thanks guys.
i got my SSA3021X for a few months, "UPGRADED" it to 3.2G with full options.
very nice SA, as well as my SDG2042X.  (@cesarpaz, yes, it worth the money
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kr5j on January 31, 2017, 09:11:33 pm
Finally was able to view the GPS L1 signal with the SSA3021X. Settings were:

Frequency: 1575.42 MHz
Span: 70 MHz
Amplitude: -97.80 dBm, Pre-Amp On, Atten = 0 dB, Scale: 1 dB/Division
Trace: Max Hold
BW: RBW = VBW = 100 kHz

See screen save.
Title: Re: GPS Signal viewwed on a SSA3021X
Post by: kr5j on January 31, 2017, 09:32:33 pm
I forgot to add the signal was from an amplified GPS antenna (looks like a small puck) by using a BNC T adapter so that the DC power could be connected to the antenna.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: KE5FX on January 31, 2017, 10:00:41 pm
GPS signals are usually below the thermal floor.  Can you turn the antenna upside down or otherwise block it to verify that's what you're seeing?   You may be looking at the excess noise of the preamp, viewed through a SAW filter that's also inside the active antenna.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kr5j on February 01, 2017, 03:46:43 am
I will try that tomorrow and get a screen save. I have another spectrum analyzer which shows the same waveform but it is an Agilent unit and has a much lower noise floor than the Siglent so the amplitude is more pronounced. We'll see if the scan looks the same or is flat when I flip the antenna over. Thanks for the idea.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nugglix on February 01, 2017, 07:58:10 am
Looks like this is not the right thread.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kr5j on February 01, 2017, 10:18:03 pm
Yep its just noise through a filter!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: KE5FX on February 01, 2017, 10:20:50 pm
Yep its just noise through a filter!

Look on the bright side, you've "hacked" your spectrum analyzer to turn it into a noise figure meter! :)  It's on-topic after all.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on February 02, 2017, 08:30:55 am
Yep its just noise through a filter!

Look on the bright side, you've "hacked" your spectrum analyzer to turn it into a noise figure meter! :)  It's on-topic after all.

Technically this have nothing to do with hack - nothing. Exept that he used hacked SA. Without hack result is exactly same in this case.  Hack do not change any single thing what is affecting in this case AFAIK. If you have "alternative truth" in this matter I am happy if I hear it.
;)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nugglix on February 02, 2017, 10:57:18 pm
What feedback?
It's all described above.

And yes, it's solely your decision, you can't hold the "community" responsible is case of failure.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: videobruce on February 04, 2017, 06:09:36 pm
Until firmware 7.07 flawless, and easy
"Easy"????
Easy for who, a VERY select few?  ???
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on February 04, 2017, 06:14:51 pm
@videobruce: What do you need?

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: videobruce on February 04, 2017, 07:35:52 pm
WE don't need more u-boob videos.  What, no one reads anymore?

Ever try to highlight videos??   :--
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Kitt on February 08, 2017, 04:53:50 am
Hi everyone - My 3021 arrived 2 days ago and is still in the box.  No time to even open and check it.  I ordered it with TG.  As soon as I get chance I will take a look and see what its firmware is.  I suspect it is 8.01, so will be back with questions once I am ready to try and liberate it.

Cheers.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on February 08, 2017, 06:21:45 am
Hi everyone - My 3021 arrived 2 days ago and is still in the box.  No time to even open and check it.  I ordered it with TG.  As soon as I get chance I will take a look and see what its firmware is.  I suspect it is 8.01, so will be back with questions once I am ready to try and liberate it.

Cheers.
Welcome to the forum.

I think it will be 8.01, the last unit I got from the factory was 8.01.
Evidently it's not a problem, just do your homework and don't be in a hurry.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: pe1oxp on February 09, 2017, 08:55:19 pm
Our Chinese friend did some good work again, a new version of his Instructions to modify the SSA3021x is ready.
This Instructions replaces V0.3!
Thanks!

File MD5 sum: 007bc1ae20eb6835f993cbdd9ce64bd5
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: videobruce on February 09, 2017, 09:56:42 pm
He sure knows how to spread things out..................
Too bad none are available 'till March 1 here.  :--
Quote
we checked with the warehouse in SOLON OHIO, and they have been experiencing delays due to the Asian holidays.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on February 09, 2017, 10:31:16 pm
Our Chinese friend did some good work again, a new version of his Instructions to modify the SSA3021x is ready.
This Instructions replaces V0.3!
Thanks!

File MD5 sum: 007bc1ae20eb6835f993cbdd9ce64bd5
Don't you mean HER ?  ;)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: sq6emm on February 15, 2017, 01:47:54 pm
Anyone knows "magic keys" that will allow to enter calibration menu in SSA? Something similar to magic keys on Rigol DSA?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Mark11 on February 19, 2017, 07:12:13 pm
I want to backup all the files from my SSA3021X, just in case.  ;)

I have installed MobaXterm and can telnet to SSA but I have not any experience with telnet.

Could someone give me ''for dummies'' instructions how to copy directories with all the files from SSA to USB.

Thanks.
Martin
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on February 19, 2017, 07:27:18 pm
Please get familiar with Telnet/Busybox/Linux (in reverse order), first.

It is easy to cause damage through a simply typo - remember that you are logged in as root!

The command you need is "mv", but you may need to use options like "-r" for recursive. But: you cannot just copy the relevant folders of the Siglent software, as the USB disk is mounted inside the application folder and hence it would be a catch-22.

Get the document everyon is talking about in the last few pages of this thread and read it carefully: it explaines everything in detail, even for people less experienced.

Cheers,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kcbrown on February 19, 2017, 08:39:42 pm
The command you need is "mv", but you may need to use options like "-r" for recursive. But: you cannot just copy the relevant folders of the Siglent software, as the USB disk is mounted inside the application folder and hence it would be a catch-22.

If it's got anything close to a recent command set, then "cp" should have a "-x" option that will prevent it from traversing across filesystems.  With that option (hence, "cp -rx ..." instead of "cp -r ..."), you should be able to copy the relevant folders of the Siglent software to the USB drive.

Do a "cp --help" to see the options it supports before trying the above, just to be sure.  If it's actually using BusyBox then it probably won't support the "-x" option.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on February 19, 2017, 08:44:24 pm
Please allow me to correct myself. For a backup you obviously want to do a cp and not a mv.

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Mark11 on February 20, 2017, 07:54:18 am
Thanks Vitor and kcbrown.
I am going to read.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on February 20, 2017, 08:12:26 am
Mark11 -

the "cp" command lets you only access those partitions that are mounted in the file system. Moreover, the files to be copied must not be access restricted. But it's well worth to have a file copy of the calibration directory and the original configuration / license files of your machine. For a complete safety backup, it's prudent to use the "dd" command like I explained here: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1109033/#msg1109033 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1109033/#msg1109033). You won't be able to access individual files easily but it's possible to revive a machine with a broken file system.

I join in with Bicurico's recommendation to make yourself familiar with Linux (and especially the console commands) at least a little since it's quite easy to break something... On the other hand, almost everything can be fixed as well, that is if you know how it's done  ;).

Cheers,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dpenev on February 20, 2017, 11:04:55 pm
Hello,

I have decide to make a backup of my Analyzer, just in case.
All mtd partitions copies OK except the rootfs

It is on 100.01.02.07.07

root@am335x-evm:~# dd if=/dev/mtdblock7 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock7-P0707.img
dd: /dev/mtdblock7: Input/output error 

the ubi device copies without issue.

dd if=/dev/ubi0_0 of=/usr/bin/siglent/usr/mass_storage/U-disk0/backup/ubi0_0-P0703.img

I have tried with and without ecomb  and still the same issue.
With ecomb killed I can read more data from the rootfs.
I have tried several times (without ecomb) and the Input/output error appears on the same place (I get each time the same 37760KB file)

In the boot log I don't see issue with the ubi mounting

[    0.310511] UBI: attaching mtd7 to ubi0
[    0.310530] UBI: physical eraseblock size:   131072 bytes (128 KiB)
[    0.310541] UBI: logical eraseblock size:    126976 bytes
[    0.310550] UBI: smallest flash I/O unit:    2048
[    0.310560] UBI: VID header offset:          2048 (aligned 2048)
[    0.310570] UBI: data offset:                4096
[    0.721635] UBI: max. sequence number:       4
[    0.736210] UBI: attached mtd7 to ubi0
[    0.736223] UBI: MTD device name:            "File System"
[    0.736233] UBI: MTD device size:            43 MiB
[    0.736242] UBI: number of good PEBs:        344
[    0.736250] UBI: number of bad PEBs:         0
[    0.736258] UBI: number of corrupted PEBs:   0
[    0.736266] UBI: max. allowed volumes:       128
[    0.736274] UBI: wear-leveling threshold:    4096
[    0.736282] UBI: number of internal volumes: 1
[    0.736291] UBI: number of user volumes:     1
[    0.736298] UBI: available PEBs:             0
[    0.736307] UBI: total number of reserved PEBs: 344
[    0.736316] UBI: number of PEBs reserved for bad PEB handling: 9
[    0.736326] UBI: max/mean erase counter: 1/0
[    0.736334] UBI: image sequence number:  447755961
[    0.736445] UBI: background thread "ubi_bgt0d" started, PID 479

So all this is strange. Anyone observing something similar?

I am afraid I may have a nand flash issue which may reveal on the firmware update.   

Thanks
Dimitar
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on February 21, 2017, 08:40:14 am
Dimitar,

this may be an indication for a bad block in your NAND FLASH. That's actually not uncommon, the same as you (almost) won't find hard disks without bad blocks, yet they are automatically remapped inthe HDs. The OS should hide the bad blocks in NAND memory as well, yet, since "dd" accesses the raw data of the chip, errors may appear. To read the partition, you may try the command

Code: [Select]
dd conv=noerror,sync if=/dev/mtdblock7 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock7-P0707.img
I'm not sure if this switch works on the DD version implemented in the SSA3000X since I haven't got a machine with bad blocks to test. In case you need to restore your machine, you should be fine as long as you write back the original file as "dd'ed".

Cheers,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on February 21, 2017, 10:47:18 am
Dimitar,

this may be an indication for a bad block in your NAND FLASH. That's actually not uncommon, the same as you (almost) won't find hard disks without bad blocks, yet they are automatically remapped inthe HDs. The OS should hide the bad blocks in NAND memory as well, yet, since "dd" accesses the raw data of the chip, errors may appear. To read the partition, you may try the command

Code: [Select]
dd conv=noerror,sync if=/dev/mtdblock7 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock7-P0707.img
I'm not sure if this switch works on the DD version implemented in the SSA3000X since I haven't got a machine with bad blocks to test. In case you need to restore your machine, you should be fine as long as you write back the original file as "dd'ed".

Cheers,
Thomas

dd conv=noerror

 is not implemented in this "busybox".
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dpenev on February 21, 2017, 01:29:41 pm
Hi Gents,

OK, so in case of bad blocks we don't have a way to backup at the mtd level.
Has anyone managed to reflash some MTD partition from uboot?
Has anyone managed to reflash an UBI volume from uboot?
Do you know what nand flash chip the Analyzer is using (if I have to replace it)
Are only those two directories unique as per instrument
   /usr/bin/siglent/firmdata0
   /usr/bin/siglent/usr/backup
Do we know where the update script is located for 7.07?
I want to check what it does so eventually get some idea what can happen.

I hope I will not need all this info but knowing me I will update to 8.01 soon :)

Sorry for the long questions list and thank you in advance!
Dimitar 
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Dima on February 21, 2017, 08:24:38 pm
Hi Dimitar,
I guess the flash chip is the Micron-MT29F2G08ABAEAWP.
You can see it on Dave's tear down video. Datasheet is easy to find, just google.
The chip you get for a few bugs at digikey.
Reading and writing to the flash you will find many projects on the web. A cheap method would be
to use the FT 2232h -56Q mini module via usb. Best buy also a TSOP 48 socket adaptor, so contacting  the chip will get no pain.
But i am afraid you will need some good soldering skills and have to open the analyzer.
Anyway, this is great idea.

Cheers
Dima
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: steverino on February 22, 2017, 12:55:32 am
...
The chip you get for a few bugs at digikey.
...
Any particular species of bug?  :)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on February 22, 2017, 07:47:45 am
Hi Gents,

OK, so in case of bad blocks we don't have a way to backup at the mtd level.
Has anyone managed to reflash some MTD partition from uboot?
Has anyone managed to reflash an UBI volume from uboot?
Do you know what nand flash chip the Analyzer is using (if I have to replace it)
Are only those two directories unique as per instrument
   /usr/bin/siglent/firmdata0
   /usr/bin/siglent/usr/backup
Do we know where the update script is located for 7.07?
I want to check what it does so eventually get some idea what can happen.

I hope I will not need all this info but knowing me I will update to 8.01 soon :)

Sorry for the long questions list and thank you in advance!
Dimitar

What is problem?

If normal FW update fails due to flash problem, your SSA have 3 year factory warranty (if not expanded to 4 or 5 year warranty) . If it fails just call Siglent for repair.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dpenev on February 22, 2017, 08:45:48 am
Hi rf-loop,

Yes you are perfectly right. I am just such a kind of person who tries so solve his problem himself if possible. (often it is better for the nature)
Keep also in mind that if I have to send the instrument back for repairmen it means 1 month without it right?
Take into account we already have MT29F2G08ABAEAWP in stock and we have facility to replace it if necessary.
If I know that reflashing wouldn't take me much time I will go to this option for sure.
But as far as i understand no one has done it yet?
 
In addition I thought talking about my Analyzer here may be interesting for somebody else.

But once again I still don't have issue, probably just some small possibility for an issue in the future.

Additional note. nand flashes often goes in two flavors. Free and not free (less expensive) of bad blocks.
Our experience with the version having bad blocks is that it is often problematic later in the product life.
It is bad that Siglent has used nand flash chips having bad blocks. They use read only file systems but still ...

Thanks
Dimitar 

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on February 22, 2017, 09:11:54 am
Hi rf-loop,

Yes you are perfectly right. I am just such a kind of person who tries so solve his problem himself if possible. (often it is better for the nature)
Keep also in mind that if I have to send the instrument back for repairmen it means 1 month without it right?
Take into account we already have MT29F2G08ABAEAWP in stock and we have facility to replace it if necessary.
If I know that reflashing wouldn't take me much time I will go to this option for sure.
But as far as i understand no one has done it yet?
Maybe not, but to do so would ruin any chance of a future warranty claim if needed.
 
Quote
In addition I thought talking about my Analyzer here may be interesting for somebody else.
It is, but not at the cost of possibly losing your warranty.

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dpenev on February 22, 2017, 10:27:34 am
Indeed!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on February 22, 2017, 10:38:37 am
It is OK to discuss hardware-modifications and repairs. The SSA3021X is still a fairly new device and probably all units are still covered by maintenance.

However, in 2 years time, many will be without warranty and I expect to see some being sold in the second hand market.

People will start hacking them and sooner or later the need of flash repair will arise. So why not discuss it now?

I am by no means an expert in flash memory IC's, but there is something very positive about the SSA3021X: the serial number is stored in a regular file within the file system contained in the flash. Some manufacturers chose to store some special data like serial numbers in READ/WRITE protected memory banks of flash IC's. In these cases, exchanging such IC is difficult!

With the SSA3021X I would expect it to be fairly doable: desolder the flash IC, get a replacement flash IC, program it externally (at least up to U-Boot), solder it and use the U-Boot console to flash the reamining firmware.

But I agree with tautech and rf-loop: nobody tried to do that, because it wasn't necessary to do so up to now and because all devices are covered by warranty - if the flash fails, including the hacked ones!

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on February 22, 2017, 10:48:05 am
Hi Gents,

OK, so in case of bad blocks we don't have a way to backup at the mtd level.
Has anyone managed to reflash some MTD partition from uboot?
Has anyone managed to reflash an UBI volume from uboot?
....

I can confirm that some individuals successfully re-flashed their kernel / root partitions from U-Boot. I'm not sure if they had bad blocks in their FLASH chips but I doubt it, at least not in the corresponding partitions.

The easy road (and the only that I know of) is via the internal Micro SD card socket since U-Boot checks for presence of a memory card during boot-up. It may well be possible to run the whole SA via a properly configured FS on a Micro SD - that's probably the way initial installation is accomplished at the factory. To gain access to the Micro SD card slot, the instrument needs to be disassembled (case opened / IIRC rear shielding removed). It's probably also possible to back-up the NAND partitions (with proper defect management) via U-Boot to Micro SD. But all this can be considered high-risk activity since a mistake may ruin your day... (read: your SA).

Anyway, we've got complete NAND images of F/W 7.03 and 8.01 in the "community" so what's really important is to back up the configuration and calibration of your machine (on a FS base) since this is individual to each SA. If you need other images that are common to all machines, there will be a way to help.

All the best,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on February 22, 2017, 11:47:05 am


Anyway, we've got complete NAND images of F/W 7.03 and 8.01 in the "community" so what's really important is to back up the configuration and calibration of your machine (on a FS base) since this is individual to each SA. If you need other images that are common to all machines, there will be a way to help.

All the best,
Thomas

And this is important to do.  In FW 7 least calibration data because this can not copy from any other maachine.
And if FW 8  cal data but now there is  also other extremely important things what can not copy from other unit. There is example individual product model license. Without it, it is SSA3010X.

Also all other technical things are intersting and and also for possible some future needs it is good to have more and more valid information and knowledge collected.  All this is good and finally it may even rise product value for users and including also users after 3 year or  after >10 years.


Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dpenev on February 22, 2017, 12:03:29 pm
I agree, the calibration is important.
In this respect can someone confirm(or share some thoughts) that those two directories contain all the unique data for a given Analyzer?
    /usr/bin/siglent/firmdata0
   /usr/bin/siglent/usr/backup

As per the update I did a quick check and the update is happening calling functions from /usr/lib/siglentlib.sh
Probably "check_and_upgrade()"
So basically they just do "nandwrite mtdN image" from linux. In theory nandwrite is bad block aware, so I and other having bad blocks should be OK.
But I will cross fingers when I do my update :(



   

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on February 22, 2017, 12:52:09 pm
I agree, the calibration is important.
In this respect can someone confirm(or share some thoughts) that those two directories contain all the unique data for a given Analyzer?
    /usr/bin/siglent/firmdata0
   /usr/bin/siglent/usr/backup

As per the update I did a quick check and the update is happening calling functions from /usr/lib/siglentlib.sh
Probably "check_and_upgrade()"
So basically they just do "nandwrite mtdN image" from linux. In theory nandwrite is bad block aware, so I and other having bad blocks should be OK.
But I will cross fingers when I do my update :(

   

I can not true confirm these two directories but I can confirm with disclaimer: as far as I know.
As also can find in someone made instruction text V05 what can find in this thread.

Quote
bad block.
I have updated equipment what have this situation  and in this case not any problem.

Quote
calibration is important.

Yes, and also very important model license key. (it is in one .xml file in these folders if SSA have FW 8.
In FW 7  update process to FW 8 system generate this license key for model what it is currently when it have FW 7.  Later it can not generate (exept factory) (1).  FW 7 update to FW 8 is big upgrade. It also make big improvement for TG.

(1) exept: roll back to FW 7 and  again to FW 8  but this need - know how to do.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dpenev on February 22, 2017, 01:50:21 pm
Quote
Quote
bad block.
I have updated equipment what have this situation  and in this case not any problem.

Oh rf-loop, this is  very relaxing!
How do you know you have bad blocks, partition dump from using dd command?
Was your bad blocks on the mtdblock7/rootfs?

Thanks
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on February 22, 2017, 02:34:21 pm
Quote
Quote
bad block.
I have updated equipment what have this situation  and in this case not any problem.

Oh rf-loop, this is  very relaxing!
How do you know you have bad blocks, partition dump from using dd command?
Was your bad blocks on the mtdblock7/rootfs?

Thanks

Yes in block7 (after around 10M...err, others all ok. )
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dpenev on February 22, 2017, 02:35:49 pm
good! I will update later on today.
Thanks
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Mark11 on February 22, 2017, 07:12:53 pm
Thanks Vitor, kcbrown and Thomas for pointing me to the right direction.
As you have suggested I started with Linux.
I bought a book Just Enough Linux by Malcolm Maclean two months ago.
My intention was to start playing with Raspberry Pi but now it has
proved to be best spent two dollars (yes 2 US$). It was not necessary
to learn a lot about Linux. Just a few basic commands to navigate file
system in the terminal and some commands as /, cd, ls, cp, pwd, mkdir,
rm, mv ... and I finaly understood what I have to do. I installed Ubuntu,
opened terminal and practised until I got the basic idea how it all works.
Then I read Mr. Li Xiu Ying's instruction again.
The rest is history.  ;)

Thans guys. You are the best!

Martin
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dpenev on February 23, 2017, 04:37:14 pm
Hi All,

I have updated my Analyzer to V01.02.08.01.
Even thought I seems to have some bad blocks (dd dump reports input/output error) on the mtdblock7 the update went OK
I got few reboots during the update and now I am on V01.02.08.01.

Thank you all for the help!
Dimitar
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: arturfra on February 23, 2017, 07:43:51 pm
Hi guys, I've a SSA3021X with 7.07 fw hacked with all options permanent enabled and until 3.2Ghz, just now I've upgraded to fw 8.01 and now it remains with 3.2Ghz feature but with all option OFF (only TG on because I've a valid licence key), Is it possible to activate all the options as before I made without loosing the serial number and then without delete the famous files ??

thanks in advance
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: videobruce on February 23, 2017, 11:20:56 pm
V 1.2.8.2 is out. Who will be the 1st to try???  ;D

http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA3000X-Firmware-Update.rar (http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA3000X-Firmware-Update.rar)

Quote
1. This firmware must be upgraded from V1.2.8.1 or later. If your SSA3000X has an earlier version, please to V1.2.8.1 first and then proceed to uplate to the latest version.
 2. Add socket/telnet-scpi, you can operate remote control through LAN port without NI-VISA installed. Please check SSA3000X Programming Guide for more details.
 3. Change two limit lines in different colours.
 4. When quit from TG, stay in“Auto”sweep.
 5. Lower some spurs when FFT.
 6. Improve the stability.


(Link updated to a direct link for download)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nugglix on February 24, 2017, 07:40:33 am
V 1.2.8.2 is out. Who will be the 1st to try???  ;D

http://siglentamerica.com/prodcut-gjjrj.aspx?id=5113&tid=227&T=2 (http://siglentamerica.com/prodcut-gjjrj.aspx?id=5113&tid=227&T=2)

Thanks for the info!

Download doesn't work atm, so I can't!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on February 24, 2017, 07:53:56 am
V 1.2.8.2 is out. Who will be the 1st to try???  ;D

http://siglentamerica.com/prodcut-gjjrj.aspx?id=5113&tid=227&T=2 (http://siglentamerica.com/prodcut-gjjrj.aspx?id=5113&tid=227&T=2)

Thanks for the info!

Download doesn't work atm, so I can't!
This one does,(the Download button) just clicked on it to get a copy for my archives.
http://www.siglentamerica.com/gjjrj-xq.aspx?id=5128&tid=15 (http://www.siglentamerica.com/gjjrj-xq.aspx?id=5128&tid=15)

7.36 Mb .rar
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nugglix on February 24, 2017, 08:09:56 am
Tried that already.
There is something seriously broken atm.
Transfer stops after a few kB, if you pause/resume it works for another few kB.
Transfer rate is around 5kB/s, which I consider a bit on the low side...

Will have a look at it from time to time.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on February 24, 2017, 08:12:35 am
Strange.

I could download the file without problems and did so a few times, just to check.

I downloaded the new EasySpectrum and Programming Manual, with no issues either.

I guess your ISP must be having some issues.

Try this link: https://mediacdn.eu/m/media/wysiwyg/siglent/Downloads/Firmware/SSA3000X-Firmware-Update.rar (https://mediacdn.eu/m/media/wysiwyg/siglent/Downloads/Firmware/SSA3000X-Firmware-Update.rar)

It is from http://www.siglent.eu/Downloads (http://www.siglent.eu/Downloads)

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on February 24, 2017, 08:37:05 am
Update:

I unpacked the FW file with my tool (linked somewhere in this thread).

The contents have changed a little, as there is no passwd folder anymore. Some files are the same (see CRC).

My guess is that this FW update is a "small" update, mainly exchanging the ecomb executable, which would explain why you need to install P08.01 before installing P08.02. Telnet probably works as before, with same root login and known password.

However, I did not try the update, yet, so the risk is on you.

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on February 24, 2017, 09:21:08 am
DO NOT try update directly to 8.02 from any FW7.x version!
(I do not know if there is security check for prevent to do it accidentally)

Only FW7.x to 8.01 update procedure can generate product model license key (etc)  what FW 7.x did not use at all.


One test. It works least with my individual unit.

There was 8.01 in my unit and  mod (as in instructions) and with this mod also no serial number. 
First I removed mod following these instructions.

Instructions:   https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1132969/#msg1132969 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1132969/#msg1132969)

Then  restart and look all ok. Now there is also original serial number (if someone worry it)

Update to 8.02
(also it rebooting during update)

noted that all works ok.

mod again with instructions.

result. Ok.

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on February 24, 2017, 09:39:30 am
Thank you for the test!  :-+

This new FW is actually the answer of Siglent to a request I made (they didn't do it for me, of course - at least I wouldn't think so):

It allows SCPI commands through a regular telnet connection. This opens doors to people like me to program custom applications that use the SSA3021X remotely.

Without any promise, imagine this: a software similar to my "VMA Simple Spectrum Analyser" (made for the cheap ADF4350, ADF4351, MAX2870 range of devices, like the NWT4000 - discussed in a different thread) in a special version for the SSA3021X, offering all the "advanced" measurements, but based on measurements of a propper spectrum analyser!

Thumbs up for Siglent!

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nugglix on February 24, 2017, 09:53:51 am
Strange.

I could download the file without problems and did so a few times, just to check.

I downloaded the new EasySpectrum and Programming Manual, with no issues either.

I guess your ISP must be having some issues.

Try this link: https://mediacdn.eu/m/media/wysiwyg/siglent/Downloads/Firmware/SSA3000X-Firmware-Update.rar (https://mediacdn.eu/m/media/wysiwyg/siglent/Downloads/Firmware/SSA3000X-Firmware-Update.rar)

It is from http://www.siglent.eu/Downloads (http://www.siglent.eu/Downloads)

Regards,
Vitor

This link works fine, downloaded in a few seconds.
Guess it's something between europe and the americas.

Thanks for the link!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on February 24, 2017, 10:21:24 am

This link works fine, downloaded in a few seconds.
Guess it's something between europe and the americas.

Thanks for the link!

There is trumbles between europe and america.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nugglix on February 24, 2017, 11:01:27 am
There is trumbles between europe and america.

Thanks for trump-eting that out    ::)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: videobruce on February 24, 2017, 02:09:43 pm
I corrected the link in my post for the file. It's a direct link now,  ;)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: BlauerElefant on February 26, 2017, 11:38:01 am
Did the update to 1.2.8.2 as rf-loop stated. First backuped files, then removed mods, then updated (my device rebooted twice), then backuped files, then reapplied mod, then backuped files.
Worked without any problem.

Thanks rf-loop!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: michael2 on February 26, 2017, 04:33:34 pm
Have gone from unhacked 7.03 with purchased TG to 7.07, activated all options (w/o 1Hz and 3MHz RBW), made a "clear and reboot", updated to 8.1, worked fine, updated to 8.2, works still fine. Never done the "werewolf" trick.

Have made some tar-archives of the whole filesystems at different state.

Thank you for your informations!  8)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: arturfra on February 27, 2017, 01:37:15 pm
@michael2

Do u want to say that you've a 8.02 with all option ON with the original serial number? I've updraded to 8.02 as well and i've a regular TG licence, but i can't activate the remains options without loosing the serial... Do u've an advise for me?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: DL4RAJ on February 27, 2017, 02:32:10 pm
Have gone from unhacked 7.03 with purchased TG to 7.07, activated all options (w/o 1Hz and 3MHz RBW), made a "clear and reboot", updated to 8.1, worked fine, updated to 8.2, works still fine. Never done the "werewolf" trick.

Have made some tar-archives of the whole filesystems at different state.

Thank you for your informations!  8)

Hi Michael2

Please read the PM I've sent you.

Regards
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: lz1pro on March 03, 2017, 07:05:26 pm
Hello,

v8.01 is still upgradable to 3032 whit serial and all option without need to open the machine. All you need to do is remove contains firmdata0 and backup without calib dir and edit NSP_system_info.xml whit wanted serial and copy all files from arhive to firmdata0 and backup folder.

Good luck,
Yanko
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: xenonfire on March 04, 2017, 11:12:08 pm
Did you get 3MHz BWD on your 8.01 machine?

/Daniel
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on March 04, 2017, 11:18:30 pm
Did you get 3MHz BWD on your 8.01 machine?

/Daniel
See replies #326 and 333.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Dima on March 05, 2017, 09:06:45 pm
It looks like RBW is 10 Hz to 1 Mhz!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: arturfra on March 06, 2017, 07:33:26 pm
@lz1pro

and the 8.02 ??

thanks in advance for reply
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: bozidarms on March 06, 2017, 07:54:11 pm
Hi,
with 8.02 definitely is possible to get all options enabled.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: arturfra on March 06, 2017, 08:10:18 pm
hi,

I wanted to say "activate all option" in 8.02 without loosing the serial number as the previous firmware version 7.03 / 8.01

thanks for help
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: giorgiofox on March 11, 2017, 02:20:23 pm
Hi,
I have a full option SSA 3021X with 100.01.02.07.07, and I want to "upgrade" it to 3.2 Ghz: what is the best way?
Upgrade it to 8.02 and then do the hack or do the hack and then upgrade?
Thank in advance for the info

Giorgio
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: KeBeNe on March 13, 2017, 09:26:20 am
first hack, then upgrade
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Andy Granis on March 14, 2017, 12:43:36 pm
Hi,

Tried mod on my 8.2 upgraded SSA, but no luck, exactly the same after reboot. What did I do wrong?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on March 14, 2017, 01:28:05 pm
Hi,

Tried Mr Li's mod on my 8.2 upgraded SSA, but no luck, exactly the same after reboot. What did I do wrong?

"Mr" ? 

"What did I do wrong?" 
If here is some clairvoyant maybe he can try but for most peoples better is first know what you have done before it can even try answer.

Do you have putty (or what ever telnet client you use) log record what you have done?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Andy Granis on March 14, 2017, 02:56:43 pm
Tried the V05 mod again, and now it worked :),  All options and up to 3.2 GHz  :)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: B1nary on March 17, 2017, 08:53:10 pm
Already have the 3032 - surprise gift from the wife - came with 7.07 - yes really! Used Telnet to take a look at the NSP_info file under Firmdata0. The current file is identical to the one currently there and suggested for updating with all options. The SSA is still operating under the 48 hour window for all options and as of now the options are enabled. How would replacing the NSP_info file change options that are enabled currently to being enabled permanently - I see others have done this swap with within just a few minutes of opening their SSA and it seems to work. Swapping out the NSP_info file seems easy enough to do but I am curious how replacing one file with an identical file causes all options to become permanent; and yes I do have a backup.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Pinkus on March 18, 2017, 11:06:14 am
Already have the 3032 - surprise gift from the wife -
you lucky b*st*rd. Maybe I should show this to my wife ("THIS is true love" etc. etc.  -you all know this).
...
but wait, before this is being used against me - let me first ask you, what  suprises are YOU presenting to your wife  ;D
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: B1nary on March 18, 2017, 03:15:39 pm
Sometimes the imagination is far better than the truth - even if the truth is pretty nice ... :-DD
We treat each other fairly well - imagination runs wild, B1nary leaves rest unsaid.[/i]
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Joel_l on March 30, 2017, 09:32:39 pm
I just ordered one of these. Backordered until April 7th. Hope nothing has changed. Anxious to see how it all works.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: lollokara on April 06, 2017, 12:22:47 pm
Hi Guys, I'm new in this forum, i just bought the ssa3021X it will arrive soon, anyone of you know anything on how to downgrade the bad boy in case it comes with the 8.something ? Any help would be really appreciated  :P :P
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on April 06, 2017, 12:57:36 pm
how to downgrade the bad boy in case it comes with the 8.something ?

Why?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Joel_l on April 07, 2017, 12:40:26 pm
My guess is in case Siglent closed the hack hole on later updates.

I'm still waiting for mine. Supposedly back in stock to ship today.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on April 07, 2017, 07:22:25 pm
Hi Guys, I'm new in this forum, i just bought the ssa3021X it will arrive soon, anyone of you know anything on how to downgrade the bad boy in case it comes with the 8.something ? Any help would be really appreciated  :P :P
Welcome to the forum.

Read again reply #326  ;)

My guess is in case Siglent closed the hack hole on later updates.

I'm still waiting for mine. Supposedly back in stock to ship today.
As above.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Joel_l on April 07, 2017, 09:00:10 pm
Just checked on my SA order. Apparently the batch going to Siglent has been sitting in LA customs for two weeks and are still there. Maybe will be on their way tomorrow. So unless ordered from someone who actually had them in stock, we are stuck.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Sparky on April 08, 2017, 07:44:17 pm
Just checked on my SA order. Apparently the batch going to Siglent has been sitting in LA customs for two weeks and are still there. Maybe will be on their way tomorrow. So unless ordered from someone who actually had them in stock, we are stuck.

Apologies for a little off-topic, but many recent posts are about ordering/shipping of SSA3021X, so I thought okay to ask where people are ordering the unit from?  I'm in USA so thinking my best option is Saelig.

I noticed some distributors claiming it is discontinued with no stock (http://www.tequipment.net/Siglent/SSA3021X/Spectrum-Analyzers/)?  That doesn't make sense -- it seems the unit is in demand and only recently (few months before end of 2016) becoming more readily available...
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on April 08, 2017, 07:56:06 pm
Apologies for a little off-topic, but many recent posts are about ordering/shipping of SSA3021X, so I thought okay to ask where people are ordering the unit from?  I'm in USA so thinking my best option is Saelig.
:-+
Ask of EEVblog member discount here:
https://www.eevblog.com/forum/testgear/equipment-discounts-from-saelig/ (https://www.eevblog.com/forum/testgear/equipment-discounts-from-saelig/)

Yep, a bit OT and should be in the main thread:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/)

Quote
I noticed some distributors claiming it is discontinued with no stock (http://www.tequipment.net/Siglent/SSA3021X/Spectrum-Analyzers/)?  That doesn't make sense -- it seems the unit is in demand and only recently (few months before end of 2016) becoming more readily available...
TE are no longer authorised distributors and it makes no sense that they should still have a page for SSA3000X.  :-//
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Joel_l on April 08, 2017, 08:12:47 pm
They are only saying it is discontinued from their catalog, not a discontinued product.

The update to my order ( USA ) was that Siglent is waiting for their next batch.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: lollokara on April 10, 2017, 01:09:47 pm
Thanks, i haven't got it while reading that post that the new version is still hackable. Thanks a lot
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: NikWing on April 10, 2017, 06:38:44 pm
I've ordered a 3021x on Friday, should arrive soon :)
really curious now :)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: NikWing on April 11, 2017, 04:07:39 pm
Device came with fw 8.2
mod works like a charm (the fun_opt file is missing though and backup of mtdblock7 returns an input/output error, so can't be backup'd)

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Kitsyboy on April 15, 2017, 12:36:55 am
I received my unit this week. It came with firmware 1.2.8.2
I did several experiments with the described mod and found out that it is ALL in the file NSP_sn_bandwith in the firmdata0 directory. so the procedure can be even simpler, just rename this file and the factory mode is operational
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Kitsyboy on April 15, 2017, 12:43:18 am
sorry for the type error: file name must be NSP_sn_bandwidth of course
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Kitt on April 15, 2017, 12:16:46 pm
I have not done the mod yet.  I am on firmware 8.1.  Are you saying all that is required is to rename NSP_SN_BANDWIDTH file in the firmdata0 directory will enable the features.?

Sent from my SM-T357T using Tapatalk

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: videobruce on April 15, 2017, 12:39:43 pm
Quote
TE are no longer authorized distributors and it makes no sense that they should still have a page for SSA3000X.
I inquired about why that line wasn't carried anymore, but only got a 'canned' (meaningless) response. AFAIC, their agreement with Rigol is the reason.  ;)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: pascal_sweden on April 15, 2017, 12:58:05 pm
Batronix in Europe carries both Rigol and Siglent, so there is no exclusivity agreement there.

But of course it can be so with TEquipment.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Kitsyboy on April 17, 2017, 08:33:00 pm
Hello Kitt, basically the answer is yes. I used the guide from answer 289 as starting point. This excellent guide shows all the steps to enable the factory mode of the analyser ( no serial number all options enabled). The guide tells you to backup several files in the firmdata directory and the backup directory. After having followed the guide I felt confident to experiment a little. I wanted to make as little changes as possible to the original files so I restored each of them individually and tried to see the result. Here I found out that the NSP_sn_bandwidth was the only file which really made the difference. It is a xml file in which each option is enabled by a special hex code. This hex code is computed from the name option and the serial number. ( a real challenge will be to find the algorithm for this calculation. A good starting point would be to take the 8.1 firmware. This version has the possibility to calculate these numbers because previous firmwares did not use this protection scheme. I think that people with some knowledge of ARM processors mus be able to decompile/disassemble this version which might reveal its secrets.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Joel_l on April 17, 2017, 09:18:03 pm
I got word that my SA is shipping out today. Must mean that Siglent in the US has them back in stock. I'll update with FW and other findings.

Joel
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dotto on May 16, 2017, 02:59:09 pm
I bought SSA3021x but my version is 1.2.8.2 (20170214-3)....
I tried to follow instructions v05 but I couldn't find fun_opt_valid_config.xml file...
I renamed the other filenames as described in instruction but after reboot nothing happened...

See files in firmdata0:

root@am335x-evm:/usr/bin/siglent/usr/backup# cd /usr/bin/siglent/firmdata0
root@am335x-evm:/usr/bin/siglent/firmdata0# ls -l
-rw-r--r--    1 root     root           448 May 16 22:33 NSP_sn_bandwidth.xml
-rw-r--r--    1 root     root           448 May 16 22:23 NSP_sn_bandwidthx.xml
-rw-r--r--    1 root     root           150 May 16 22:35 NSP_trends_config_info.xml
-rw-rw-r--    1 1000     1000           606 Dec 28  2015 NSP_trends_config_infox.xml
drwxrwxr-x    2 1000     1000          4240 Apr 20 19:16 calib
-rw-r--r--    1 root     root           504 May 16 22:33 nsp_data_b
-rw-r--r--    1 root     root           504 May 16 22:23 nsp_data_bx

see backup files:

root@am335x-evm:/# cd /usr/bin/siglent/usr/backup
root@am335x-evm:/usr/bin/siglent/usr/backup# ls -l
-rw-r--r--    1 root     root           448 May 16 22:55 NSP_sn_bandwidth.xml
-rw-r--r--    1 root     root           448 May 16 22:23 NSP_sn_bandwidthx.xml
-rw-r--r--    1 root     root           606 Jan  1  2000 NSP_trends_config_infox.xml
drwxr-xr-x    2 root     root          4240 Apr 20 19:16 calib
-rw-r--r--    1 root     root           504 May 16 22:55 nsp_data_b
-rw-r--r--    1 root     root           504 May 16 22:23 nsp_data_bx


I can see new files but it works without hack.

Anyone can help me?  |O

Thanks,

Dotto.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on May 16, 2017, 03:19:22 pm


See files in firmdata0:

root@am335x-evm:/usr/bin/siglent/usr/backup# cd /usr/bin/siglent/firmdata0
root@am335x-evm:/usr/bin/siglent/firmdata0# ls -l
-rw-r--r--    1 root     root           448 May 16 22:33 NSP_sn_bandwidth.xml
-rw-r--r--    1 root     root           448 May 16 22:23 NSP_sn_bandwidthx.xml
-rw-r--r--    1 root     root           150 May 16 22:35 NSP_trends_config_info.xml
-rw-rw-r--    1 1000     1000           606 Dec 28  2015 NSP_trends_config_infox.xml
drwxrwxr-x    2 1000     1000          4240 Apr 20 19:16 calib
-rw-r--r--    1 root     root           504 May 16 22:33 nsp_data_b
-rw-r--r--    1 root     root           504 May 16 22:23 nsp_data_bx

see backup files:

root@am335x-evm:/# cd /usr/bin/siglent/usr/backup
root@am335x-evm:/usr/bin/siglent/usr/backup# ls -l
-rw-r--r--    1 root     root           448 May 16 22:55 NSP_sn_bandwidth.xml
-rw-r--r--    1 root     root           448 May 16 22:23 NSP_sn_bandwidthx.xml
-rw-r--r--    1 root     root           606 Jan  1  2000 NSP_trends_config_infox.xml
drwxr-xr-x    2 root     root          4240 Apr 20 19:16 calib
-rw-r--r--    1 root     root           504 May 16 22:55 nsp_data_b
-rw-r--r--    1 root     root           504 May 16 22:23 nsp_data_bx



How you have done this mess...
now there is original and renamed files together.  Why?
You have perhaps made things with your own methods instead of some instructions. Things need do exactly and not just nearly exactly.|O



Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dotto on May 16, 2017, 03:34:45 pm
Hi rf-loop!
Thanks for your reply.

I followed the exact instruction v05.

Yes, the analyzer created new files.... before restart I just had files with "namex.xml" but now the system recreated new files.... including backup folder.

before restart:

NSP_sn_bandwidthx.xml
NSP_trends_config_infox.xml
calib - I didn't change it....
nsp_data_bx.xml


after restart: new xml files....
 
 |O
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Joel_l on May 16, 2017, 03:38:22 pm
Restore your sa back to new. Then just rename the file mentioned in post 363/364. Works fine.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dotto on May 16, 2017, 04:29:05 pm
Joel_l,
Thanks for your answer...

I restored the sa....

See original files:

root@am335x-evm:/# cd /usr/bin/siglent/firmdata0
root@am335x-evm:/usr/bin/siglent/firmdata0# ls -l
-rw-r--r--    1 root     root           448 May 16 12:56 NSP_sn_bandwidth.xml
-rw-rw-r--    1 1000     1000           606 Dec 28  2015 NSP_trends_config_info.xml
drwxrwxr-x    2 1000     1000          4240 Apr 20 19:16 calib
-rw-r--r--    1 root     root           504 May 16 12:56 nsp_data_b

root@am335x-evm:/usr/bin/siglent/firmdata0# cd /usr/bin/siglent/usr/backup
root@am335x-evm:/usr/bin/siglent/usr/backup# ls -l
-rw-r--r--    1 root     root           448 May 16  2017 NSP_sn_bandwidth.xml
-rw-r--r--    1 root     root           606 Jan  1  2000 NSP_trends_config_info.xml
drwxr-xr-x    2 root     root          4240 Apr 20 19:16 calib
-rw-r--r--    1 root     root           504 May 16  2017 nsp_data_b


As described in post 363/364, I changed just NSP_sn_bandwidth.xml to NSP_sn_bandwidthx.xml

See below:
root@am335x-evm:/usr/bin/siglent/usr/backup# ls -l
-rw-r--r--    1 root     root           448 May 16  2017 NSP_sn_bandwidthx.xml
-rw-r--r--    1 root     root           606 Jan  1  2000 NSP_trends_config_info.xml
drwxr-xr-x    2 root     root          4240 Apr 20 19:16 calib
-rw-r--r--    1 root     root           504 May 16  2017 nsp_data_b

root@am335x-evm:/usr/bin/siglent/firmdata0# ls -l
-rw-r--r--    1 root     root           448 May 16 12:56 NSP_sn_bandwidthx.xml
-rw-rw-r--    1 1000     1000           606 Dec 28  2015 NSP_trends_config_info.xml
drwxrwxr-x    2 1000     1000          4240 Apr 20 19:16 calib
-rw-r--r--    1 root     root           504 May 16 12:56 nsp_data_b

After sync command, I tried ls -l, and the bandwidth file show again....  >:D

root@am335x-evm:/usr/bin/siglent/firmdata0# ls -l
-rw-r--r--    1 root     root           448 May 16 13:12 NSP_sn_bandwidth.xml
-rw-r--r--    1 root     root           448 May 16 12:56 NSP_sn_bandwidthx.xml
-rw-rw-r--    1 1000     1000           606 Dec 28  2015 NSP_trends_config_info.xml
drwxrwxr-x    2 1000     1000          4240 Apr 20 19:16 calib
-rw-r--r--    1 root     root           504 May 16 13:12 nsp_data_b

I didn't restart at this moment!  |O
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on May 16, 2017, 04:35:29 pm
Hi rf-loop!
Thanks for your reply.

I followed the exact instruction v05.

Yes, the analyzer created new files.... before restart I just had files with "namex.xml" but now the system recreated new files.... including backup folder.

before restart:

NSP_sn_bandwidthx.xml
NSP_trends_config_infox.xml
calib - I didn't change it....
nsp_data_bx.xml


after restart: new xml files....
 
 |O

Please do you have terminal communications log. If you have,  analyzing this log may show where something have gone wrong. (because something have gone wrong)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dotto on May 16, 2017, 04:37:46 pm
Hi rf-loop!
Thanks for your reply.

I followed the exact instruction v05.

Yes, the analyzer created new files.... before restart I just had files with "namex.xml" but now the system recreated new files.... including backup folder.

before restart:

NSP_sn_bandwidthx.xml
NSP_trends_config_infox.xml
calib - I didn't change it....
nsp_data_bx.xml


after restart: new xml files....
 
 |O

Please do you have terminal communications log. If you have,  analyzing this log may show where something have gone wrong. (because something have gone wrong)

ok. sorry.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dotto on May 16, 2017, 04:55:39 pm
It is working here!
In my case, I entered in system informations before change the file and quickly sent the sync command and reboot.
I don't know but if I wait long time to reboot the file is save again by the system...

Thank you for your help!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: IgorAVR on June 03, 2017, 02:39:35 pm
It is working here!
In my case, I entered in system informations before change the file and quickly sent the sync command and reboot.
I don't know but if I wait long time to reboot the file is save again by the system...

Have you done hack with FW 8.2 version?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dotto on June 03, 2017, 02:53:24 pm
It is working here!
In my case, I entered in system informations before change the file and quickly sent the sync command and reboot.
I don't know but if I wait long time to reboot the file is save again by the system...

Have you done hack with FW 8.2 version?

Yes! Everything ok here!


Enviado do meu iPhone usando Tapatalk
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Safar on June 04, 2017, 12:01:29 am

Have you done hack with FW 8.2 version?

Yes! Everything ok here!

Enviado do meu iPhone usando Tapatalk

Agree, but for a strange reason, I was able to rename files in second time only
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: IgorAVR on June 04, 2017, 04:56:00 pm
Thank you for yours answers! I will buy this nice device!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Joel_l on June 04, 2017, 11:03:18 pm
So, there is the rename one file method that gets you unlocked and 3.2GHz but no serial number with new FW. It seems that several FWs ago, you could mess with the features file ( seems to no longer be used ) and get all the apps, 3.2GHz, and keep the serial number. I think this survived upgrades from that point. Anyone take a new unit, downgrade the FW, then bring it back to current FW?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: arturfra on June 26, 2017, 10:50:17 pm
New firmware 8.3 available

http://www.siglent.com/ENs/gjjrj.aspx?id=15 (http://www.siglent.com/ENs/gjjrj.aspx?id=15)

http://www.siglent.com/Uploadfile/image/20170626/SSA3000X-V1.2.8.3.png (http://www.siglent.com/Uploadfile/image/20170626/SSA3000X-V1.2.8.3.png)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on June 27, 2017, 02:24:24 am
So, there is the rename one file method that gets you unlocked and 3.2GHz but no serial number with new FW. It seems that several FWs ago, you could mess with the features file ( seems to no longer be used ) and get all the apps, 3.2GHz, and keep the serial number. I think this survived upgrades from that point. Anyone take a new unit, downgrade the FW, then bring it back to current FW?

For what measurement purpose there need serial number?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on June 27, 2017, 10:57:37 am
So, there is the rename one file method that gets you unlocked and 3.2GHz but no serial number with new FW. It seems that several FWs ago, you could mess with the features file ( seems to no longer be used ) and get all the apps, 3.2GHz, and keep the serial number. I think this survived upgrades from that point. Anyone take a new unit, downgrade the FW, then bring it back to current FW?

You cannot just dongrade the FW, as this requires a complete reflash of the flash IC. This can be done on the bootloader, but you will lose warranty to access it.
Also, you need a flash dump of the older firmware (does exist with some forum members if required).
But the main issue is that the flash IC can have faulty pages. This is apparently within specs/tolerance. However, if you flash back a good backup of an IC without faulty pages on an IC with faulty pages, the firmware will not work. You need to partition and write the firmware in a propper way that avoids writing to erroneous flash IC's.

I hope to have explained it in a comprehensive way, certainly it could be explained at more detail and without errors. But I guess this makes it clear why a downgrade has risks (lost warranty, problem with faulty flash pages, etc.).

As mentioned by rf-loop, there is no real issue in not having the serial number displayed.

Regards,
vma
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Joel_l on June 27, 2017, 06:19:56 pm
That does actually make sense. The FW update is not a full install of the SA software. You are right, the missing serial number is not a big deal.

Thanks

Joel

So, there is the rename one file method that gets you unlocked and 3.2GHz but no serial number with new FW. It seems that several FWs ago, you could mess with the features file ( seems to no longer be used ) and get all the apps, 3.2GHz, and keep the serial number. I think this survived upgrades from that point. Anyone take a new unit, downgrade the FW, then bring it back to current FW?

You cannot just dongrade the FW, as this requires a complete reflash of the flash IC. This can be done on the bootloader, but you will lose warranty to access it.
Also, you need a flash dump of the older firmware (does exist with some forum members if required).
But the main issue is that the flash IC can have faulty pages. This is apparently within specs/tolerance. However, if you flash back a good backup of an IC without faulty pages on an IC with faulty pages, the firmware will not work. You need to partition and write the firmware in a propper way that avoids writing to erroneous flash IC's.

I hope to have explained it in a comprehensive way, certainly it could be explained at more detail and without errors. But I guess this makes it clear why a downgrade has risks (lost warranty, problem with faulty flash pages, etc.).

As mentioned by rf-loop, there is no real issue in not having the serial number displayed.

Regards,
vma
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Joel_l on June 27, 2017, 06:21:30 pm
Has anyone tried 8.3, is the hack in tact? Or do you just need to redo it?

Joel
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on June 27, 2017, 06:42:02 pm
Hi,

The new firmware seems safe to flash. The telnet access is still there with the usual root account and apparently nothing changed.

I did it and have no issues, but I am not using the file delete hack. Should work, though, as before.

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Joel_l on June 27, 2017, 09:15:09 pm
I also just did the 8.3 update, no issues, didn't have to change anything. Mine was the single file rename/delete method.

Joel
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: arturfra on June 27, 2017, 09:31:21 pm
So did I, everything has gone in the right way
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: MilkmanCDN on June 29, 2017, 09:04:30 pm
Hello,

Got my SSA-3021x about a month ago and it has been sitting on my bench unused since.  FW8.2 (1.2.8.2) installed on it.   I plan to 'upgrade' it using the instructions contained in post #289.   Couple of questions:

1. Should I upgrade to firmware 8.3 before performing this?
2. Is there anyway to retain the serial number?

Thanks.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on June 29, 2017, 09:51:17 pm
1. Doesn't matter.
2.
Quote
As mentioned by rf-loop, there is no real issue in not having the serial number displayed.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Joel_l on June 29, 2017, 09:52:54 pm
Look at post 363/364. That's all you have to do. Use the original instruction to log into and get to where you can rename files, but deleting/renaming ( rename would be recommended ) the one file is it. Do not know of a method that preserve SN.

Hello,

Got my SSA-3021x about a month ago and it has been sitting on my bench unused since.  FW8.2 (1.2.8.2) installed on it.   I plan to 'upgrade' it using the instructions contained in post #289.   Couple of questions:

1. Should I upgrade to firmware 8.3 before performing this?
2. Is there anyway to retain the serial number?

Thanks.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on June 30, 2017, 08:47:35 am
Has anyone been able to create a SD-image to boot from in case the update fails?
I experienced a failure while updating to 8.2 and would like to be able to fix the problem myself without having to send the SA in for repair.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: videobruce on July 07, 2017, 12:40:05 pm
I received my unit this week. It came with firmware 1.2.8.2
I did several experiments with the described mod and found out that it is ALL in the file NSP_sn_bandwith in the firmdata0 directory. so the procedure can be even simpler, just rename this file and the factory mode is operational
sorry for the type error: file name must be NSP_sn_bandwidth of course

You rename that file first, then just flash from 8.2 to 8.3 without restoring first?  ???
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: cesarpaz on July 07, 2017, 03:42:38 pm
Hi everybody.

I need litle help, My SSA3021X come with 1.2.8.2 firmware, I was update to 1.2.8.3 but it´s imposible get old firmware versions 7.5, 8.1 etc. How Can I do make for hack to 3.2 Ghz? Thanks so much. ::)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Joel_l on July 08, 2017, 02:20:15 am
A bit earlier in the thread I think someone mentioned that 8.3 still lets you log in, so you could do the hack after going to 8.3
You do not need to undo the file rename to upgrade from 8.2 to 8.3.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: videobruce on July 08, 2017, 02:31:28 am
So that so called "chapter 5" (restore back to initial state) isn't necessary, one just does the modification (chapter 3)?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: etienne51 on July 08, 2017, 12:55:07 pm
Hi guys, new owner of the Siglent SSA3021X here. It was delivered just yesterday.

I checked the firmware version, and I have 8.1! So I thought I would try this mod see how things goes. Thanks to the V0.5 tutorial (from post #289 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1132969/#msg1132969)) things went pretty smoothly, and I have all features unlocked and 3.2GHz bandwidth as of now.

I just wanted to point something out though. When I was renaming the files, the filesystem apparently was remounted automatically, and went back to read only mode. It seems like the original files were rewritten as well, so I had to remove the _x previously moved files, and rename the newly created files again, after remounting the filesystem in rw mode. See below.

Code: [Select]

 _____                    _____           _         _
|  _  |___ ___ ___ ___   |  _  |___ ___  |_|___ ___| |_
|     |  _| .'| . | . |  |   __|  _| . | | | -_|  _|  _|
|__|__|_| |__,|_  |___|  |__|  |_| |___|_| |___|___|_|
              |___|                    |___|

Arago Project http://arago-project.org am335x-evm

Arago 2013.05 am335x-evm


am335x-evm login: root
Password:

root@am335x-evm:~# cd /usr/bin/siglent/firmdata0

root@am335x-evm:/usr/bin/siglent/firmdata0# ls -l
-rwxr-xr-x    1 root     root           471 Jul  8 --:-- NSP_sn_bandwidth.xml
-rwxr-xr-x    1 root     root           606 --- -- --:-- NSP_trends_config_info.xml
drwxrwxr-x    2 1000     1000          4240 Jan  1  2000 calib
-rwxr-xr-x    1 root     root           544 Jul  8 --:-- nsp_data_b

root@am335x-evm:/usr/bin/siglent/firmdata0# cd /usr/bin/siglent/usr/backup

root@am335x-evm:/usr/bin/siglent/usr/backup# ls -l
-rwxr-xr-x    1 root     root           471 Jul  8 --:-- NSP_sn_bandwidth.xml
-rwxr-xr-x    1 root     root           606 --- -- --:-- NSP_trends_config_info.xml
drwxr-xr-x    2 root     root          4240 --- -- --:-- calib
-rwxr-xr-x    1 root     root           544 Jul  8 --:-- nsp_data_b

root@am335x-evm:/usr/bin/siglent/usr/backup# cd /

root@am335x-evm:/# cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
root@am335x-evm:/# cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0

root@am335x-evm:/# cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
root@am335x-evm:/# cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0

root@am335x-evm:/# mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0

root@am335x-evm:/# cd /usr/bin/siglent/firmdata0

root@am335x-evm:/usr/bin/siglent/firmdata0# mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
root@am335x-evm:/usr/bin/siglent/firmdata0# mv NSP_trends_config_info.xml NSP_trends_config_infox.xml
root@am335x-evm:/usr/bin/siglent/firmdata0# mv nsp_data_b nsp_data_bx
mv: can't rename 'nsp_data_b': Read-only file system

root@am335x-evm:/usr/bin/siglent/firmdata0# ls -l
-rw-r--r--    1 root     root           471 Jul  8 --:-- NSP_sn_bandwidth.xml
-rw-r--r--    1 root     root           471 Jul  8 --:-- NSP_sn_bandwidthx.xml
-rwxr-xr-x    1 root     root           606 --- -- --:-- NSP_trends_config_infox.xml
drwxrwxr-x    2 1000     1000          4240 Jan  1  2000 calib
-rwxr-xr-x    1 root     root           544 Jul  8 --:-- nsp_data_b

root@am335x-evm:/usr/bin/siglent/firmdata0# cd /

root@am335x-evm:/# mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0

root@am335x-evm:/# cd /usr/bin/siglent/firmdata0

root@am335x-evm:/usr/bin/siglent/firmdata0# rm NSP_sn_bandwidthx.xml
root@am335x-evm:/usr/bin/siglent/firmdata0# mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
root@am335x-evm:/usr/bin/siglent/firmdata0# mv nsp_data_b nsp_data_bx

root@am335x-evm:/usr/bin/siglent/firmdata0# cd /usr/bin/siglent/usr/backup

root@am335x-evm:/usr/bin/siglent/firmdata0# mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
root@am335x-evm:/usr/bin/siglent/firmdata0# mv NSP_trends_config_info.xml NSP_trends_config_infox.xml
root@am335x-evm:/usr/bin/siglent/firmdata0# mv nsp_data_b nsp_data_bx

root@am335x-evm:/usr/bin/siglent/firmdata0# cd /

root@am335x-evm:/# sync

root@am335x-evm:/# logout

This is exactly what I have in both folders after the mod.

Code: [Select]
root@am335x-evm:/# ls -l /usr/bin/siglent/firmdata0
-rw-r--r--    1 root     root           471 Jul  8 15:52 NSP_sn_bandwidthx.xml
-rw-r--r--    1 root     root           150 Jul  8 15:55 NSP_trends_config_info.xml
-rwxr-xr-x    1 root     root           606 --- -- --:-- NSP_trends_config_infox.xml
drwxrwxr-x    2 1000     1000          4240 Jan  1  2000 calib
-rwxr-xr-x    1 root     root           544 Jul  8 15:52 nsp_data_bx

root@am335x-evm:/# ls -l /usr/bin/siglent/usr/backup
-rwxr-xr-x    1 root     root           471 Jul  8 15:42 NSP_sn_bandwidthx.xml
-rwxr-xr-x    1 root     root           606 --- -- --:-- NSP_trends_config_infox.xml
drwxr-xr-x    2 root     root          4240 --- -- --:-- calib
-rwxr-xr-x    1 root     root           544 Jul  8 15:52 nsp_data_bx

(The dates are masked for most files since I lost my logs, and I have no record of the original dates during the operation, I chose to mask them. I rewrote these commands to give you guys an idea of what happened.)

Anyway, my spectrum analyser is unlocked, I have XXXXXXXXXX serial number and "Permanent" validity on all options, so I assume everything is fine.

Now, I'm still on 1.2.8.1 firmware, and as far as I understand, I need to:
1. Revert the mod (CHAPTER 5)
2. Run the upgrade 1.2.8.1 -> 1.2.8.3
3. Do the mod again (CHAPTER 3)

Am I right?

As far as I heard, the latest firmware is still compatible with the mod, so it is safe to upgrade?

Thank you guys!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on July 08, 2017, 02:38:42 pm
It is safe to upgrade. No need to revert the mod. Telnet access remains the same.

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: videobruce on July 09, 2017, 12:29:08 pm

2. Run the upgrade 1.2.8.1 -> 1.2.8.3
3. Do the mod again (CHAPTER 3)

The above is correct?? Flash to 8.3 first with no S/N,  then the mod?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Radio on July 13, 2017, 05:56:03 pm
What's the best update route to 8.1+ for a unit on 7.7 with all options enabled via method in post #59 (not 1HZ or 3MHz though) and model number changed to 3032x? Need to change model number back to 3021x first?

Any real benefit in updating to 8.x series?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on July 14, 2017, 07:32:52 am
Just do the upgrade as documented by Siglent, making sure you edited the options files to activate all options and have your original serial number active.

Upgrading to v8.x will actually generate the activation codes for the active options and you can then read them out through telnet and ftp.

This is a one time chance, so absolutely make sure you are not upgrading with the relevant files deleted or renamed!

This won't give you the 1Hz and 3MHz RBW options, but after the upgrade you can rename the files as instructed in this thread again, with the benefit of owning the activation keys, aka permanent hack for all future updates.

Regarding the benefits, don't be lazy. Read the change log from Siglent and the sister thread about the SSA3021X in this forum. Then decide for yourself.

For me it was definitely worth it, as v8.x allowed me to program my SSA Simple Spectrum Analyzer software.

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Radio on July 14, 2017, 02:27:31 pm
Thanks for advice. Options file has everything set as TRUE and serial number remains on system info screen. So it's ok to leave model number changed to 3032x?

When you mention relevant file deleted or renamed, which do you mean? The only file edited via the method in post 59 was NSP_system_info.xml and nothing touched since.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: electronus on July 18, 2017, 02:32:42 pm
Got my unit from China today. FW 8.3 installed.
Do someone have fullflash dump v.7.03?
Thanks
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on July 18, 2017, 02:37:02 pm
Are you aware of the risks:

- warranty will be voided, as you need to open the case
- if you have an error on the flash, which is normal, you won't be able to simply flash the backup, as the flash layout would have to be different
- you could try to dump your flash first to see if there is any flash error, but that is not 100% safe

On the other hand, the current hack of renaming ONE file (or is it two, not sure by now), will give you ALL options at no risk. So why bother?

Regards,
Vitor
 
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: videobruce on July 18, 2017, 03:38:42 pm

2. Run the upgrade 1.2.8.1 -> 1.2.8.3
3. Do the mod again (CHAPTER 3)

The above is correct?? Flash to 8.3 first with no S/N,  then the mod?
Anyone??
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: electronus on July 18, 2017, 04:08:53 pm
Bicurico,
I gonna check it for a while with 8.3 just to be sure it is not going to die as the new HW like to do. Yes, I will copy all data using cp and u-boot.
For a long term I'd like to desolder flash, solder in cradle for it and gonna grab some chips from Digikey, just to be sure I have a different backups.
Also with a cradle it would be possible to boot u-boot and replace flash live for programming purposes.
I'm pretty sure they going to close hack in future FWs for those who didn't passed 7 to 8 FW transition, so it would be beneficial to find a way to do a proper downgrade at some point.

 

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: markus_jlrb on July 19, 2017, 12:10:34 pm
He guys,

could confirm that 8.3 is still friendly for modifications to the fw.

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on July 19, 2017, 12:31:26 pm
Electronus,
I am investigating the possibility to create a bootable SD-card allowing to boot from a downgraded OS. Next thing would be to update the SD-card giving the new license that could be copied over to NAND.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: xenonfire on July 20, 2017, 12:55:29 am
I did my one today.
It came with v8.1 and I first upgraded to v8.3, then I did the hack in message #289.
- Backup first and then renamed the files.

Works fine!!!   :-+

Thanks for all help!   :clap: :clap:
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: bozidarms on July 20, 2017, 10:05:18 am
Hi to all,
another successfully upgraded SSA(without revert the mod first) to v8.3,
everything works fine :-+
Tnx and regards
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: analogRF on July 20, 2017, 07:24:14 pm
Hi
New to this wonderful forum! I have pretty much convinced myself that SSA3021X is the thing I have to have now and I am gonna order it in a couple of days.
However, I have a few questions about unlocking the features:

I understand that this device contains pretty much the same hardware as 3032X and by unlocking it, it can go to 3.2GHz plus the other stuff. But still something bothers me (or amazes me, I should say) about this and that is the accuracy, calibration, DANL and phase noise at those higher frequencies (above 2.1GHz). The price of a basic 3032X is more than twice of a basic 3021X and their difference is just the 3.2GHz vs 2.1GHz. So, is it reasonable that we can get a 3032X (not to mention all the other options which cost almost $1600) just by deleting or renaming a file on the system and that's it?
With regard to the optional stuff I have no doubt because they are just software features and it is reasonable to assume they can be unlocked and their MSRP is ridiculously high. Nobody should pay $400+ for just a codeword or something like that. But as for the higher frequency (or getting 1Hz/3MHz RBW), are we sure that the 3021x is fully calibrated up to 3.2GH and performs exactly as a 3032X when we unlock it?
can anyone confirm the specs (DANL, PN, amplitude accuracy, etc) on an unlocked 3021 is indeed the same as a 3032? Or can anyone do some measurements above 2.1GHz and compare with a trusted spectrum analyzer?

EDIT: I think what I am trying to say is that unlocking software features is one thing but is the hardware (for example the front end) really calibrated for those higher freqs? Isn't that the reason why 3032 costs so much more than 3021? I hope my doubts are totally unfounded!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: bozidarms on July 21, 2017, 03:36:37 pm
Hi and welcome to the forum.

Just as you tell in your last sentence - your doubts are totally unfounded!
I have done measurements on 3GHz(the highest freq. that my sig. gen. have) and can confirm - work like a charm!
SSA3021X is a milestone on test equipment market in the last 10 years(or maybe ever) - a real game changer,
you won't be disappointed :-+ :-+ :-+!

Regards
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: worsthorse on July 21, 2017, 10:52:36 pm
After much hemming and hawing, and a lot of looking at used SAs, I ordered the 3021X today and will have it Wednesday.  While I wait, I am digging through the seventeen pages of this thread, trying to figure out the latest version of the upgrade hack. It is, well, rather a lot. I would be most grateful if one of the folks who has done the upgrade recently could point out where to start reading, assuming I will get a unit with the latest firmware and no upgrades installed.  Today, by the way, is my birthday, which is how I tipped myself over into finally buying one.  ^-^

Thanks in advance! 
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: cesarpaz on July 22, 2017, 08:07:15 pm
Electronus,
I am investigating the possibility to create a bootable SD-card allowing to boot from a downgraded OS. Next thing would be to update the SD-card giving the new license that could be copied over to NAND.



Hello. Can you be so kind as to explain the steps in steps to be able to hack it with version 8.3? We are very grateful, if you want you can contact me by private. Thank you.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: markus_jlrb on July 24, 2017, 11:16:25 am
First of all make a Backup of your current system.
Hopefully you are familiar with Linux shell commands.

telnet <SSA3021X-IP-Adr>

Login as root
root password is ding1234

root@am335x-evm:~#

My FW Version was 1.2.8.2

Do Update of all relevant Files:
For this purpose use a FAT32-USB-Stick with more then 200MB free space.
Insert the Stick in the front USB connector at left lower corner near the
power off button. A blue USB-Symbol in the right upper corner above the
spectrum grid should appear after few seconds.

check if usb stick is mounted with the mount command at shell level


root@am335x-evm:~# mount

You should see a line containing the path "/usr/bin/siglent/usr/mass_storage/U-disk0"

If this is the case you could check if the content of the Stick is the one you expect.

ls -l  /usr/bin/siglent/usr/mass_storage/U-disk0

change to the stick location

cd /usr/bin/siglent/usr/mass_storage/U-disk0/

create a backup location on the stick FW_SSA3021X_BCK

mkdir FW_SSA3021X_BCK

switch to this location

cd FW_SSA3021X_BCK

pwd should now show you the full path:

/usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK

create according to your firmware a backup dir with the current
FW number (im my case 1.2.8.2)

mkdir FW-1.2.8.2

use the both cp commnds listed below to save all relevant files

cp -R /usr/bin/siglent/usr/backup  /usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK/FW-1.2.8.2/SSA3021x_backup

cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK/FW-1.2.8.2/SSA3021x_firmdata0

Then save all FLASH memory partitions to your stick by the command listed below:
Some dd partitions transfers throw an IO-Error, but the file is transfered properly.
Do not worry about this.

root@am335x-evm: for i in `seq 0 1 12`; do echo $i; dd if=/dev/mtdblock${i} of=/usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK/FW-1.2.8.2/mtdblock${i}-1.2.8.2.img; sleep 1; done

The above command copies the /dev/mtdblock0 ... /dev/mtdblock12 Flash content
to files named mtdblock0-1.2.8.2.img ... mtdblock12-1.2.8.2.img in the
/usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK/FW-1.2.8.2/ Directory.

Output from the above command is:

0
256+0 records in
256+0 records out
1
256+0 records in
256+0 records out
2
256+0 records in
256+0 records out
3
256+0 records in
256+0 records out
4
3840+0 records in
3840+0 records out
5
256+0 records in
256+0 records out
6
6144+0 records in
6144+0 records out
7
dd: /dev/mtdblock7: Input/output error
8
12288+0 records in
12288+0 records out
9
12288+0 records in
12288+0 records out
10
102400+0 records in
102400+0 records out
11
102400+0 records in
102400+0 records out
12
dd: /dev/mtdblock12: Input/output error

After this was done, check if the files exist with the ls -l command

Now you could update the firmware to the newest one, in my case to 1.2.8.3.

To do this you have to download from Siglent web site from the support menu
the last FW update. This is a .rar file in my case named SSA3000X-P08.03.rar

Unpack this file and save the .ADS file (V01.02.08.03.ADS) on the usb stick.
To Do this you first have to remove the stick from your Siglent device.

To do this seafly do the commands on the CLI (comand line interface) inside
the terminal as listed below:


root@am335x-evm: sync
root@am335x-evm: sync
root@am335x-evm: cd
root@am335x-evm: umount /usr/bin/siglent/usr/mass_storage/U-disk0
Now you could remove the stick from the usb connector.

Copy the file V01.02.08.03.ADS to the stick (top level dir, as it is better to
find the file inside the Siglint SSA3021X display)

Do a seve unmount on your computer bofor you remove the usb stick with the new firmware,
to be sure the file is written correctly befor you remove the stick and put him again into
the SSA3021X usb front connector.


Go to the File menu, by pressing the File button, after you see the stick mounted again
inside the SSA3021X display. Navigate to your stick (right column on the display)
switch from Dir Menu to File Menu (left upper corner at the screen) and navigate to the
new FW file V01.02.08.03.ADS. Now press the load button beside the screen menu.

Wait patiently until the FW is updated (The SSA3221X will reboot thre or four times)
Do not switch off the power until you not see again the spectrum grid on teh screen !!!

Check via System button / info which FW is now displayed - should be 1.2.8.3

now you have to login again to the device via telnet as listed obove as the reboot
during the FW update terminated the telnet connection.
(If you run in problems to connect, check via ping command fro your PC if the SSA3021X
is still responding to the same IP address. Perhaps your router has configured a new
IP address - increas/decrease the last octed from the prior ip address.)

When you are loged in succesfully, do the backup of all relevant files for the new
FW version 1.2.8.3 to be on the secure side.


ls -l  /usr/bin/siglent/usr/mass_storage/U-disk0 (exist this location ?)

cd /usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK
 
cd FW_SSA3021X_BCK

pwd should now show you the full path:

/usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK

create according to your firmware a backup dir with the current
FW number (im my case 1.2.8.3)

mkdir FW-1.2.8.3


use the both cp commnds listed below to save all relevant files

cp -R /usr/bin/siglent/usr/backup  /usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK/FW-1.2.8.3/SSA3021x_backup

cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK/FW-1.2.8.3/SSA3021x_firmdata0

Then save all FLASH memory partitions to your stick by the command listed below:
Some dd partitions transfers throw an IO-Error, but the file is transfered properly.
Do not worry about this.

root@am335x-evm: for i in `seq 0 1 12`; do echo $i; dd if=/dev/mtdblock${i} of=/usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK/FW-1.2.8.3/mtdblock${i}-1.2.8.2.img; sleep 1; done

The above command copies the /dev/mtdblock0 ... /dev/mtdblock12 Flash content
to files named mtdblock0-1.2.8.3.img ... mtdblock12-1.2.8.3.img in the
/usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK/FW-1.2.8.3/ Directory.

================================================================================
Now you are ready to switch your SSA3021X device to a SSA3032X with all Options
================================================================================

umount the stick

root@am335x-evm: sync
root@am335x-evm: sync
root@am335x-evm: cd
root@am335x-evm: umount /usr/bin/siglent/usr/mass_storage/U-disk0

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Be sure you has write down your original Serial Number from the System button menu
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

In my case two files have to be renamed to reach the full option state:

See forum which they are ;-)

root@am335x-evm: cd /usr/bin/siglent/usr/backup
root@am335x-evm:/usr/bin/siglent/usr/backup# mv X.xml X.xml.org
root@am335x-evm:/usr/bin/siglent/usr/backup# mv Y.xml Y.xml.org

This files could be renamed easy as this partition has read/write property enabled.
But you has to rename the files listed above inside the /usr/bin/siglent/firmdata0 directory too
but this partition is write protected. To do this use the mount command

root@am335x-evm: mount -o remount -o rw ubi2_0

Then you could rename the both files:

root@am335x-evm: cd /usr/bin/siglent/firmdata0

root@am335x-evm:/usr/bin/siglent/firmdata0# mv X.xml X.xml.org
root@am335x-evm:/usr/bin/siglent/firmdata0# mv Y.xml Y.xml.org

Mount the firmdata0 partition again ro (read only)

root@am335x-evm: mount -o remount -o ro ubi2_0

Sync the Flash Filesystem to be sure all changes are stored properly.

root@am335x-evm: sync

root@am335x-evm: logout


Powerdown your device and start it again - enjoy your SSA3032X device alias SSA3021X

;-)



Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: cesarpaz on July 24, 2017, 05:00:22 pm
THANKS SO MUCH.

 I'll try it as soon as I get back from a week's vacation.

Very grateful markus_jlrb, you have been very cordial and kind fellow of the forum. :-+ :-+
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: worsthorse on July 25, 2017, 03:20:36 am
Thank you! I will give it a try at the end of this week. I appreciate not having to dig through pages and pages of the thread...
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Noob68 on July 25, 2017, 04:33:09 pm
Hi all

I got my SSA3021X on october 2016, with software version 7.07, i hacked it and it worked well until now.

When booting, it shows the Siglent Logo, then it draws the grid and menus, and freeze. The keys are no more reactives, the trace is not showing.
I have tried to log in with telnet, but it does not work, i even can't see the ip adress on the dhcp lease list on my router. :(

Any idea of what is happenig and what to do ?

Does anyone know if it is possible to fully reset the SSA3021X whith a key combination while booting or another way of reseting ?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on July 25, 2017, 05:21:02 pm
@Noob68

you may try to connect to the UART, see here: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg974784/#msg974784 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg974784/#msg974784) -- this will output O/S messages right from power-up. With this information, you may be able to find out what's causing the problem. If the "ecomb" application gets started (what the graticule display should prove), the system definitely gets far beyond the UBOOT shell. Via the UART, you can interrupt the bootup sequence, enter UBOOT and write back a file system image (I hope you've got one of your machine). This should revive your SSA unless there's a hardware problem.

Good luck and all the best,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Noob68 on July 26, 2017, 08:00:01 am
@TurboTom,

Thank you for your advice.... I saved the files before hacking, so i could perhaps restore them, but it is not sure the ssa will work again, so i don't want to void warranty by opening the unit.
I think i should ask my seller if they can service the unit, but they probably will see it was hacked... and they'll probably update the firmware.
So, I am still hesitating.

5 august 2017 : Finally, after thousands of tries, my ssa3021X went alive, again. I don't know what happened.  When it finally booted, i was powering while pressing the system key... Not sure that it booted because of that.
Now, i made the 8.01 then 8.03 upgrades and it works like a charm.
All options remains actives.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dpenev on July 26, 2017, 09:23:59 am
Hello,

I am observing a bug with latest firmware V1.2.8.3

I have connected the analyzer to a stable signal.
In the log span I measure using trace A, Then I make A to be 'View' and enable trace B same settings.
At the very low frequency region I see a spike on trace B which is constantly redrawn.
Plot attached   

On another issue, sometimes when I save a plot into a flash the png is created but it is blank.
So it seems something with flushing the content to the flash pen? Anyone having the same?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: sdouble on July 27, 2017, 09:18:57 pm
I also have a strange bug :
I get different values switching for x-lin to x-log scales.
about 10% difference in the MHz range.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Noob68 on August 05, 2017, 04:07:27 pm
Hi,

I see the same pike in the same conditions as seen in your screenshot.
But, only with VBW less or equal 300Hz (and RBW leass or equal 3Khz, not tested each case).
On any trace, go to trace menu, push View, then Clear write and the pike is there.
With 100Hz VWB, you can see a little pike before making the trace view/clear write operation.


Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: cesarpaz on August 11, 2017, 07:30:48 am
Hi, everybody.


Please, anyone who has hacked in 8.3 firmware can show me the exact contents of the finished file and working NSP_sn_bandwidth.xml ?

I have discrepancies between the content of the versions prior to now.

My attached results in images

<license> <_ 3032> TRUE </ _ 3032> <_ 3030> FALSE </ _ 3030> <

_3021> FALSE </ _ 3021> <_ tTG> TRUE </ _ tTG> <_ TEMI> TRUE </ _ TEMI> <_ tMeas> TRUE </ _ tMeas> <_ tCAT> TRUE < TRUE </ _ EMI> <_ Meas> TRUE </ _ Meas> <_ CAT> TRUE </ _ CAT> </ license> </ system_information>

Thanks so much.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: eduy2k on September 07, 2017, 08:33:53 pm
Hello my name is Eduardo and I have a new arrival 3021 with firmware V-8.3, perform the steps of post 417 without doing the first backup and firmware update since my factory version is already V-8.3
The second backup step for 8.3 is done correctly but when I get to the steps to modify it does not find the files

root@am335x-evm: cd /usr/bin/siglent/usr/backup
root@am335x-evm:/usr/bin/siglent/usr/backup# mv X.xml X.xml.org
root@am335x-evm:/usr/bin/siglent/usr/backup# mv Y.xml Y.xml.org

In the backup folder I have

Calib folder
NSP_sn_bandwidth.xm
NSP_sn_bandwidthx.xml 
NSP_trends_config_infox.xml 
nsp_data_b
nsp_data_bx 

In the firmdata0 folder I have

Calib folder
Firmdata0 folder
NSP_sn_bandwidth.xml
NSP_sn_bandwidthx.xml 
NSP_trends_config_info.xml
NSP_trends_config_infox.xml 
nsp_data_b
nsp_data_bx 

I'm a little lost can help me

Thank you very much for the hard work to be able to carry out this post

Eduardo

Ready problem solved
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: gonzo_the_great on September 10, 2017, 10:03:17 pm
On a unit, brought last week, with rev 8.3 firmware, we used the following script:


plug in FAT32 formatted USB memory stick (to take a backup).
telnet to SSA30xxX
root/ding1234

cd /   
cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup 
cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0 
mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
cd /usr/bin/siglent/firmdata0 
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml 
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml   
mv nsp_data_b nsp_data_bx   
cd /usr/bin/siglent/usr/backup   
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml 
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml 
mv nsp_data_b nsp_data_bx 
cd /
sync   
logout

reboot



Works fine. All options enabled, including bandwidth extension, permenant licences.
I'm happy!

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: arturfra on September 14, 2017, 12:04:00 pm
New firmware on the siglent site
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on September 14, 2017, 04:57:03 pm
Look here: https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg1300942/#msg1300942 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg1300942/#msg1300942)

Also, the firmware is safe to upgrade, at least telnet access is still there with the usual root password.

Note that the firmware release from yesterday has just been replaced with the correct file today!

Regards,
Vitor

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: arturfra on September 14, 2017, 06:08:54 pm
thanks
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: analogRF on September 19, 2017, 01:58:22 pm
Hi
I am finally ready to buy an SSA3021X.
Could someone confirm that the latest firmware is still possible to hack with same procedure?
thanks
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: sdouble on September 19, 2017, 08:35:33 pm
read 3 post up, and you'll know.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on September 19, 2017, 08:41:06 pm
read 3 post up, and you'll know.
Yes. it's very very likely that sellers holding stock with have 8.3 FW installed as 8.5 was only released a few days ago.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Joel_l on September 19, 2017, 09:20:33 pm
Also note that there is a much shorter way to "hack" the scope that only requires renaming one file.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: analogRF on September 19, 2017, 09:21:10 pm
read 3 post up, and you'll know.

I did but it only says: " ... at least telnet access is still there with the usual root password..."
doesn't mean Bicurico has actually implemented the hack
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Joel_l on September 19, 2017, 09:24:15 pm
That was kind of incomplete. It has already been verified that the hack works on 8.5. and that message verified that you can still log in.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on September 19, 2017, 09:51:11 pm
read 3 post up, and you'll know.

I did but it only says: " ... at least telnet access is still there with the usual root password..."
doesn't mean Bicurico has actually implemented the hack
Read what gonzo wrote.....root/ding1234  ;)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Joel_l on September 19, 2017, 11:50:27 pm
Gonzo was on 8.3, the OP asked if anyone actually tried it on 8.5. The answers are fragmented, one says the telnet is still there but did not try the hack, another that 8.5 still works with the hack but unclear if it was already hacked previously and just stuck through the upgrade ( this was also my case and it worked fine ).

From the bits and pieces it seems that yes, you can take an unhacked unit on 8.5 and apply the hack.

I'm still curious why most are still doing the long hack and not just renaming the one pertinent file and being done with it.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: analogRF on September 20, 2017, 12:58:54 pm
Gonzo was on 8.3, the OP asked if anyone actually tried it on 8.5. The answers are fragmented, one says the telnet is still there but did not try the hack, another that 8.5 still works with the hack but unclear if it was already hacked previously and just stuck through the upgrade ( this was also my case and it worked fine ).

From the bits and pieces it seems that yes, you can take an unhacked unit on 8.5 and apply the hack.

I'm still curious why most are still doing the long hack and not just renaming the one pertinent file and being done with it.

Thanks for confirmation.

Would you be kind enough to let me know how does "one file renaming" hack work? All I have found suggest renaming 3 files in "firmdata0" directory and their copies in "usr\backup" directory.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: analogRF on September 20, 2017, 01:01:19 pm
I also have another question. Apparently the units that are being shipped now have their tracking generators enabled as a gift (promotional offer for limited time). Is that gonna affect the hack procedure? Can I still use the same method and get the same result?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Joel_l on September 20, 2017, 01:23:56 pm
For the short version, see post 363/364
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: analogRF on September 20, 2017, 01:59:38 pm
For the short version, see post 363/364

thanks, man. I don't know why I missed that one :-[
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: analogRF on September 22, 2017, 03:22:07 pm
I also have another question. Apparently the units that are being shipped now have their tracking generators enabled as a gift (promotional offer for limited time). Is that gonna affect the hack procedure? Can I still use the same method and get the same result?

any thought on this?
mine is coming with TG enabled but I still need to do the mod for 3.2GHz and reflection meas.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: cpuerror on September 24, 2017, 12:27:53 am
My unit came with the TG enabled even though I didn't order it. I upgraded from unhacked 8.1 to 8.5a, then did the hack just by renaming the NSP_sp_bandwidth file. Hack still works fine as before.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on September 24, 2017, 07:06:33 am
My unit came with the TG enabled even though I didn't order it.

You did not know this:
http://siglentamerica.com/qyxwxx.aspx?id=6420&sid=216 (http://siglentamerica.com/qyxwxx.aspx?id=6420&sid=216)

TG is free! (limited time offer from Siglent)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: cpuerror on September 24, 2017, 01:05:51 pm
Actually I bought mine ~6 months ago and it came with the TG
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: analogRF on September 24, 2017, 01:33:13 pm
My unit came with the TG enabled even though I didn't order it. I upgraded from unhacked 8.1 to 8.5a, then did the hack just by renaming the NSP_sp_bandwidth file. Hack still works fine as before.

excellent!
thanks!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Kitsyboy on September 30, 2017, 06:00:06 pm

Since some people have questions about the hack-ability of the analyzer when they have options installed, I will try to explain how
the whole option mechanism works:


The NSP_edsn_bandwidth.xml has the following structure (I have changed the real data in example data and added comments)
 

<?xml version="1.0" encoding="UTF-8"?>
<sn_bw_root>
  <serial_number>
    <chip>SSA_SERIALNUMBER</chip> (here is the serial number of the unit)
  </serial_number>
   <license>
      <_3021>
         <lic>aaaaaaaaaaaaaaaa</lic> (here is the general key to indicate that this is a 3021 model)
      </_3021>
      <_tTG>
         <lic>bbbbbbbbbbbbbbbb</lic> (here is the license key for the tracking generator option)
         <remain>2690</remain>       (here is the remaining demo time in minutes if you have a temporary key)
      </_tTG>
      <_tEMI>
         <lic>cccccccccccccccc</lic> (here is the license key for the EMI option)
         <remain>2690</remain>       (here is the remaining demo time in minutes if you have a temporary key)
      </_tEMI>
      <_tMeas>
         <lic>dddddddddddddddd</lic> (here is the license key for the Advanced Measuring AMK option)
         <remain>2690</remain>       (here is the remaining demo time in minutes if you have a temporary key)
      </_tMeas>
      <_tCAT>
         <lic>eeeeeeeeeeeeeeee</lic> (here is the license key for the Reflection option)
         <remain>2690</remain>       (here is the remaining demo time in minutes if you have a temporary key)
      </_tCAT>
   </license>
</sn_bw_root>



If the unit does not find the file NSP_edsn_bandwidth.xml or does not find a serial number in the <chip> node it will enter the
factory test mode with all options enabled and full bandwidth (This is our hacked mode)
however if the unit finds any serialnumber in the <chip> node it will calculate a check number for each of the license options

here is where the aaaaaaaaa,bbbbbbbb,ccccccccc etc come to play, these correspond to the licensenumbers you get when you legally buy the options.

If your unit is shipped with options already enabled then you will see a valid code for your unit on the corresponding location.

The <remain> nodes will 'remember' the remaining time for residual license options, this number will count down to zero but you can always set them back to 2880 which will restore the residual time to the 48 hours you got when your unit was brand new...
   



Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on September 30, 2017, 06:10:10 pm
This is the reason why for now (as long as Siglent does not implement a major change in the FW structure), the only really important information for every new FW upgrade is: "Does the telnet access still work?"

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: cv_pacifier on October 19, 2017, 03:22:16 am
Hi guys. I am a newbie with limited experience with putty. Just got  new ssa 3021x. Connected LAN from PC to instrument. software version 1.2.8.5. ran putty in telenet mode after setting the IP address under static on the SSA. Will not communicate. No response from instrument. Any ideas?
thanks
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Ghislain on October 19, 2017, 12:38:11 pm
Hi guys. I am a newbie with limited experience with putty. Just got  new ssa 3021x. Connected LAN from PC to instrument. software version 1.2.8.5. ran putty in telenet mode after setting the IP address under static on the SSA. Will not communicate. No response from instrument. Any ideas?
thanks

I guess you have already checked the basics (did the SA retain the user configured ip address after power off/on, is the subnetmask correct, is the ethernet cable used ok ...)?
When you write you have connected the LAN from PC to instrument, do you mean you have a NIC with multiple ports in your PC?
Usually you would connect the SA directly into a port of your LAN switch.

Can you ping the SA from your pc? If so, the PUTTY configuration is wrong....
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: cv_pacifier on October 21, 2017, 02:16:44 am
hello thanks for the help. I have the LAN connection can ping through the command window to the device and get a response. have verified pc will hook by the same lan cable to my modem. Have set the ip address on the built in network adaptor and used a similar address on the instrument  different by one digit. submask appears to be correct. After much trying started to work. not sure why. Appreciate your help. Assume can still hack  with this firmware 1.2.8.5?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: cv_pacifier on October 21, 2017, 05:10:16 am
hello everyone.. as a newbie had trouble getting pc to communicate to ssa3021x. FW 1.2.8.5. tried gonzo's script but when rebooted came back up as 3021x.  Firmdata0 directory was showing that the NSP ... file was being renamed to the "x" version but the original file was still there preventing it coming up as a 3032x.  got message stating read only file system cannot delete. Went back to Gonzo's command for mounting firmdata0 and tried it again and this time file (original) was removed. rebooted and it came up as 3032x. Thank you all for this forum and the great contributors.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: homestea on October 24, 2017, 09:07:09 pm
I just bought a SSA3021X from Saelig and it came with 1.2.8.3 firmware.  I updated it to 1.2.8.5a and followed the commands on gonzo's post 429 and everything worked just fine! now enjoying my SSA3032x!   Thanks to everyone for figuring this out.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: trevwhite on October 24, 2017, 09:35:36 pm
I just bought a SSA3021X from Saelig and it came with 1.2.8.3 firmware.  I updated it to 1.2.8.5a and followed the commands on gonzo's post 429 and everything worked just fine! now enjoying my SSA3032x!   Thanks to everyone for figuring this out.
Is it worth updating the firmware from 1.2.8.3? Have held back until now as it's working  nicely.

Thanks

Trev

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: homestea on October 25, 2017, 02:56:47 pm
I think there was some significant bugs fixed when going from 1.2.8.3 to 1.2.8.5 as well as some enhancements to RBW.  I believe there was only very minor fixes between going from 8.5 to 8.5a.  I even saw a few people complaining that 8.5a was causing hangs and freezes,  however I have not had any issues at all with 8.5a so far. 


Sent from my iPhone using Tapatalk
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: trevwhite on October 25, 2017, 03:16:06 pm
I think there was some significant bugs fixed when going from 1.2.8.3 to 1.2.8.5 as well as some enhancements to RBW.  I believe there was only very minor fixes between going from 8.5 to 8.5a.  I even saw a few people complaining that 8.5a was causing hangs and freezes,  however I have not had any issues at all with 8.5a so far. 


Sent from my iPhone using Tapatalk
Is there a chsngelog anywhere?

Thanks

Trev

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: homestea on October 25, 2017, 03:47:05 pm
Yes a pdf of the change log is included in the firmware zip file when you download it from siglent. 


Sent from my iPhone using Tapatalk
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: grumpy3000 on November 06, 2017, 06:52:53 pm
Thanks to Gonzo_the_great. I followed his text in #428 exactly and now have a full unlocked SSA3021X

My procedure, Analyser delivered SW1= 1.2.8.3, SW2= 2017-05-12-1, SW3=000000D1, HW=07.03.00

1) Download firmware update from siglent v 8.5a, quick format a FAT32 usb stick San Cruzer 8gb, unzip update and copy .ADS file onto mem stick.
2) Insert into SSA3021X and boot.
3) system> system info> firmware update> update (system reboots a few times etc. reboot and confirm update is correct 1.2.8.5a
4) putty, telnet>login etc.
*i tried to update and mod the files here but after backup of 2 folders and mv (rename) was tried said filesystem was read only.
5)need to power off/reboot after firmware update first.

6)follow the instructions from Gonzo.

On a unit, brought last week, with rev 8.3 firmware, we used the following script:


plug in FAT32 formatted USB memory stick (to take a backup).
telnet to SSA30xxX
root/ding1234

cd /   
cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
cd /usr/bin/siglent/firmdata0
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml   
mv nsp_data_b nsp_data_bx   
cd /usr/bin/siglent/usr/backup   
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml
mv nsp_data_b nsp_data_bx
cd /
sync   
logout

reboot



Works fine. All options enabled, including bandwidth extension, permenant licences. :popcorn: :clap: :clap: :clap: :clap: :clap:
I'm happy!

Thanks again Gonzo_the_great.

Grump.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: omegat on December 01, 2017, 04:43:42 pm
...and another successful hack.
Thank you guys, you are awesome!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fanman on December 03, 2017, 02:26:29 am
Thanks Gonzo_the_great.

So if we update the firmware in future to a new version does that reverse the upgrade?

Thanks

Fanman
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Ghislain on December 04, 2017, 10:52:30 am
^^^^ Going from 1.2.8.3 to 1.2.8.5a retained all settings  :-+
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on December 09, 2017, 08:57:57 pm
Contents of a decrypted nsp_data_b:

<?xml version="1.0" encoding="UTF-8"?>
<sn_backup_root>
  <factory>TRUE</factory>
  <pro_mode>FALSE</pro_mode>
   <transit>TRUE</transit>
   <serial_number>
      <chip>SSA3XXXXXXXXXX</chip>
   </serial_number>
   <license>
      <_3032>
         <lic>XXXXXXXXXXXXXXXX</lic>
      </_3032>
      <_Meas>
         <lic>XXXXXXXXXXXXXXXX</lic>
      </_Meas>
      <_EMI>
         <lic>XXXXXXXXXXXXXXXX</lic>
      </_EMI>
      <_TG>
         <lic>XXXXXXXXXXXXXXXX</lic>
      </_TG>
      <_CAT>
         <lic>XXXXXXXXXXXXXXXX</lic>
      </_CAT>
   </license>
</sn_backup_root>

Anyone knows what is the PRO_MODE?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kerrsmith on December 17, 2017, 11:31:08 pm
My SSA3021X currently has firmware version 8.2 and also has the hack as detailed in post #428. I am looking to upgrade to the latest firmware which is currently version 8.5a as my version looks like it is now quite out of date.

Is it possible to just apply this new firmware without un-doing the hack first? I have seen a few people have gone from version 8.3 to 8.5a without un-doing the hack but I have not seen anyone mention going from 8.2 to 8.5a...

Before doing the update I just wanted to check if I can do it without making any file changes?

Thanks in advance for the help.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on December 18, 2017, 12:03:34 am
My SSA3021X currently has firmware version 8.2 and also has the hack as detailed in post #428. I am looking to upgrade to the latest firmware which is currently version 8.5a as my version looks like it is now quite out of date.

Is it possible to just apply this new firmware without un-doing the hack first? I have seen a few people have gone from version 8.3 to 8.5a without un-doing the hack but I have not seen anyone mention going from 8.2 to 8.5a...

Before doing the update I just wanted to check if I can do it without making any file changes?

Thanks in advance for the help.
There's nothing stopping you doing the FW updates in steps.
8.3 can be found here:
http://www.siglenteu.com/gjjrj-xq.aspx?id=3918&tid=15 (http://www.siglenteu.com/gjjrj-xq.aspx?id=3918&tid=15)
And 8.5a on the first page of the FW list.
http://www.siglenteu.com/gjjrj.aspx?id=15 (http://www.siglenteu.com/gjjrj.aspx?id=15)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kerrsmith on December 18, 2017, 09:20:31 am
Thanks tautech - I will do it the way you suggest in two updates.

I just wanted to check as:

message #400 said 8.1 to 8.3 did not need any mod reverting
message #439 appeared to say 8.3 to 8.5 was also ok without a revert (but I was slightly unclear on this one)
message #464 said 8.3 to 8.5a retained all settings

I just wanted to double check that I was reading everything correctly.

Thanks again.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ironcurtain on December 19, 2017, 06:10:54 am
Any hacks to expand bandwidth and options for the SDS2104X? I'm probably going to grab the offer from Batronix before it expires, so I'm rushed to figure out which 4 channel DSO allows me to upgrade decoders and bandwidth to at least 200 MHz (300MHz even better) from either Rigol or Siglent. I'm a complete novice in the thread and just skimmed through.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on December 19, 2017, 06:30:13 am
Any hacks to expand bandwidth and options for the SDS2104X? I'm probably going to grab the offer from Batronix before it expires, so I'm rushed to figure out which 4 channel DSO allows me to upgrade decoders and bandwidth to at least 200 MHz (300MHz even better) from either Rigol or Siglent. I'm a complete novice in the thread and just skimmed through.
Really this is the wrong thread to go looking at DSO's.
I guess the SDS2000X series can be tweaked but I've not heard of anyone that's achieved it.
Jump into another thread to further your search.
https://www.eevblog.com/forum/testgear/siglent's-new-product-sds2000x-series/ (https://www.eevblog.com/forum/testgear/siglent's-new-product-sds2000x-series/)
If you need 2Gsa/s then the 2000X models are your only option otherwise there's the new SDS1000X-E series with 4 channels and BW's to 200 MHz.
https://www.eevblog.com/forum/testgear/siglent-sds1204x-e-released-for-domestic-markets-in-china/ (https://www.eevblog.com/forum/testgear/siglent-sds1204x-e-released-for-domestic-markets-in-china/)
https://www.eevblog.com/forum/testgear/siglent-sds1104x-e-in-depth-review/ (https://www.eevblog.com/forum/testgear/siglent-sds1104x-e-in-depth-review/)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rfspezi on January 01, 2018, 11:57:30 pm
Hi,
am i right, that when i buy a SSA3021X (TG option already enabled) today, i will be able to hack it to 3.2 GHz?
Since even the plain SSA3021X version is hardly affordable for me, i would be glad if somebody could confirm the hackability of the actually shipped versions.
Thanks
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on January 02, 2018, 10:24:48 am
@rfspezi
Have you even bothered to look at the previous posts?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rfspezi on January 02, 2018, 10:42:15 am
@rfspezi
Have you even bothered to look at the previous posts?

Yes, however it's not clear to me if a "fresh" unit containing the latest firmware (not updated from a previouse, hacked version) can be hacked aswell.
That's why i was asking.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on January 02, 2018, 10:48:07 am
You can do the hack.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: AlphaBob on January 13, 2018, 08:10:20 pm
I"ve read pretty much every post in the last 19 pages...

I have a unmodified 3021 with licensed TG that I purchased back in 2016.  It came with 7.07 firmware.  All the trial options have timed out and I've done no modifications to it.

Do I understand correctly that if I modify the version 7.07 file that had the lower case "t" enables to get all the options enabled in 7.07, THEN upgrade to 8.01, that I will be able to read the hex keys for all the options, something that I can do one time only. Are those hex keys the same ones that you would use to enter in via the UI for the  System Info Load Option ?

Thanks!  AlphaBob
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on January 13, 2018, 09:36:55 pm
Yes to all your questions.

Mind you that the relevant file is NSP_system_info.xml and all options are to be set to TRUE.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: antoniojsq on February 01, 2018, 03:39:16 pm

how are you friend I have a problem and is that these files do not have I have

mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml

that's why when I put the commands to put them on I do not like the rights as I do there because I do not understand that part
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on February 07, 2018, 08:53:31 pm
There might be a slight chance that I did not fully understood your message but I will give it a try.
The command is used to rename the two existing files. As you are logged in as root, there will be no issues with access rights.
If you get an error, it might be that the original files no longer exist. Use the 'ls' command to see which files exist in the directory.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: swixo on March 03, 2018, 04:45:27 pm
Followed grumpy's in 460 on a new machine just received.  Worked perfectly.  All licenses permanent.
(Serial number changes to xxx)

Thanks mates!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: chipss on March 03, 2018, 07:40:12 pm
I love this forum, I hate this forum  :scared: $$$
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: swixo on March 04, 2018, 03:08:59 am
Yeah - that'll happen.

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: luc-on7kz on March 09, 2018, 07:32:50 am
Perhaps a stupid question,
after the hack, can you go back to the original configuration??
perhaps for selling after a time as original or if there is a problem into the warranty period??
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on March 09, 2018, 09:49:45 am
Yes,

Just put the files back or rename them to their original name.

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on March 09, 2018, 02:24:42 pm
After a failed firmware update I had a problem with the Dutch distributor. I was accused of hacking the analyser but there was absolutely no need to do so as I still had plenty of time in the trial licenses. They were so "generous" to fix the problem but my warranty was withdrawn. Assholes!!

It gave me the opportunity to open the analyser and unsolder the NAND and make a copy. So whoever needs a binary dump (firmware 8.3), let me know.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on March 09, 2018, 07:26:13 pm
After a failed firmware update I had a problem with the Dutch distributor. I was accused of hacking the analyser but there was absolutely no need to do so as I still had plenty of time in the trial licenses. They were so "generous" to fix the problem but my warranty was withdrawn. Assholes!!

It gave me the opportunity to open the analyser and unsolder the NAND and make a copy. So whoever needs a binary dump (firmware 8.3), let me know.
OK so you have 8.3, which version were you trying to upgrade to ?

Throughout the firmware releases there have been versions that one must update to first before proceeding to the next. Did you miss one of these steps to have a failed update ?
If so your distributor should have known about that and just installed FW in the proper steps.
Certainly no reason to withdraw warranty.  :-//

Is there more info you can give us ?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on March 10, 2018, 07:06:52 pm
The analyser came with 8.1 and, after using it for some time with no problems, I tried updating to 8.2. The update failed with the screen remaining blank, no Siglent screen, after rebooting.
The analyser came back from the Siglent distributor with 8.3 installed as this version was available in the meantime. I then opened the machine since the warranty was gone anyway and copied the NAND. Then burned a fresh NAND and to test my copy re-soldered the freshly burned NAND. Worked fine and let itself upgrade to 8.5a. Happy for now.

Somewhere in the future I will probably try to go back to 7.7 to create a future proof upgrade path and investigate the upgrade steps to 8,x and see what license re-calculations take place.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: lz1pro on March 11, 2018, 07:49:42 am
The only need to go back to version 8.1 and replace license files form 7.7. Reboot and system  will generate new license files whit serial numbers for all options.
Good luck.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: onesty on March 12, 2018, 09:09:50 pm
File not found.  :(. Anyone have an archive copy?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Pinkus on March 16, 2018, 05:23:16 pm
I read the whole thread but I am not really sure about the following (you all know these large threads where, at the end, you never can be sure). So I would like you for some guidance before I make a mistake.

I have a SSA3000x with firmware 1.2.7.7
It was hacked 1.5 years ago by changing the NSP_system_info.xml  :-+
Now I would like to upgrade to the latest firmware which is 1.2.8.5

Can I just upgrade from 7.7 to 8.5?
Will my (hacked) options stay and also my serial number?

Thank you!

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on March 16, 2018, 07:49:50 pm
Can I just upgrade from 7.7 to 8.5?
No.
There's some mandatory steps to get to the latest firmware.
This give guidance on them all:
https://www.siglentamerica.com/wp-content/uploads/dlm_uploads/2018/02/SSA3000X-Firmware-Revise-History.pdf (https://www.siglentamerica.com/wp-content/uploads/dlm_uploads/2018/02/SSA3000X-Firmware-Revise-History.pdf)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on March 16, 2018, 08:04:08 pm
I read the whole thread but I am not really sure about the following (you all know these large threads where, at the end, you never can be sure). So I would like you for some guidance before I make a mistake.

I have a SSA3000x with firmware 1.2.7.7
It was hacked 1.5 years ago by changing the NSP_system_info.xml  :-+
Now I would like to upgrade to the latest firmware which is 1.2.8.5

Can I just upgrade from 7.7 to 8.5?
Will my (hacked) options stay and also my serial number?

Thank you!

From 7.7 (modified or not) can not upgrade directly to 8.5.
There is only one FW version what can do update from old 7.7.  This version is 1.2.8.1
This version can produce licenses and model keys what are used in 8.x versions (this  system was not at all in 7.x versions.)
After 1.2.8.1 update succesfull then can update later 8.x versions.

Look carefully how 7.7 is modified before update to 8.1. so that it can produce all license keys for options and model what are currently in use when it is running 7.7 version. Look if your model (system info screen) read 3032X and all options are listed as "permanent".
After 8.1 can not go back to 7.7 version (or yes can using some special method what I do not recommend for avoid possible problems)
After all is ok take copy to usb these important files what include these license keys etc. Only siglent can do these if you loose them. Of course in 8.x versions there is other method for modify, but 7.7 to 8.1 step can produce these official keys. So do not loose this possibility because you have it due to fact that you are still in 7.7 ;)

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Pinkus on March 16, 2018, 10:49:54 pm
Thank you for the advise.
I attached a screenshot of my system screen.
What I see there is serial number, all options permanent, and SSA3032x.
If I understand you correctly I know shall
1) do an update to 1.2.8.1
2) make a backup
3) update to 1.2.8.5a

I will try this tomorrow.

P.S.
My NSP_system_info does not contains all the False entries anymore (e.g. <_3018>FALSE</_3018>). Is this a problem? The current XML is shown below.

Code: [Select]
<?xml version="1.0" encoding="UTF-8"?>
<nsp_system_info_root>
  <device>
    <system_information>
      <serial_number>
        <chip>SSA3XHA1234567</chip>
      </serial_number>
    <license><_3032>TRUE</_3032><_tTG>TRUE</_tTG><_tEMI>TRUE</_tEMI><_tMeas>TRUE</_tMeas><_tCAT>TRUE</_tCAT><_t1HZ>TRUE</_t1HZ><_t3M>TRUE</_t3M></license></system_information>
  </device>
</nsp_system_info_root>
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Pinkus on March 17, 2018, 01:24:40 pm
one last question before I start. I also used the werewolf mode (setting the system date back) before the hack was known. I removed the monster file back then. Am I right, there is nothing more to do?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on March 17, 2018, 01:51:04 pm
Pinkus -

please make sure the lower case "t" in the license line are removed. This designates the test / temporary licenses and won't enable the permanent ones. The line should rather look like this:

    <license><_3032>TRUE</_3032><_3021>FALSE</_3021><_TG>TRUE</_TG><_EMI>TRUE</_EMI><_Meas>TRUE</_Meas><_CAT>TRUE</_CAT></license></system_information>

Otherwise, the hack should work like this.

Good luck,
Thomas
 
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Pinkus on March 17, 2018, 01:59:54 pm
uh uh - what a trap.
I am glad you saved me from some trouble Thomas!
Thanks!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on March 17, 2018, 04:19:32 pm
Pinkus -

please make sure the lower case "t" in the license line are removed. This designates the test / temporary licenses and won't enable the permanent ones. The line should rather look like this:

    <license><_3032>TRUE</_3032><_3021>FALSE</_3021><_TG>TRUE</_TG><_EMI>TRUE</_EMI><_Meas>TRUE</_Meas><_CAT>TRUE</_CAT></license></system_information>

Otherwise, the hack should work like this.

Good luck,
Thomas


This is the case when the forum has experts and accurate eyes.
It was a very good and careful accurate observation - worth a thousand points!

 :-+ :clap:
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Pinkus on March 17, 2018, 04:30:21 pm
Just to reassure:
What I now see in Thomas license code, that the entries for 1 Hz and 3 Mhz RBW which were working in 7.07 are gone. In 7.07 there was <_1HZ>TRUE</_1HZ><_3M>TRUE</_3M>
I read in this thread, that 1 Hz and 3 Mhz RBW are not available anymore starting from FW 8.1 so I just should delete this now before updating? Would it hurt to keep it?
From FW 8.5 the 1 Hz will be back anyway, am I correct?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on March 17, 2018, 04:33:37 pm
Doesn't matter if you keep them or not. But they will not be producing extra serial numbers.

Also, with the "t" options: you can keep them, as long as you have the non-"t" options, too.

Here is the complete string I used and that gives you the maximum licenses, available:

Code: [Select]
<?xml version="1.0" encoding="UTF-8"?>
<nsp_system_info_root>
  <device>
    <system_information>
      <serial_number>
        <chip>SSA3Xxxxxxxxxx</chip>
      </serial_number>
    <license><_3032>TRUE</_3032><_3021>FALSE</_3021><_tTG>TRUE</_tTG><_tEMI>TRUE</_tEMI><_tMeas>TRUE</_tMeas><_tCAT>TRUE</_tCAT><_t1HZ>TRUE</_t1HZ><_TG>TRUE</_TG><_EMI>TRUE</_EMI><_Meas>TRUE</_Meas><_CAT>TRUE</_CAT><_1HZ>TRUE</_1HZ><_3M>TRUE</_3M></license></system_information>
  </device>
</nsp_system_info_root>
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on March 17, 2018, 05:45:28 pm
Just to reassure:
What I now see in Thomas license code, that the entries for 1 Hz and 3 Mhz RBW which were working in 7.07 are gone. In 7.07 there was <_1HZ>TRUE</_1HZ><_3M>TRUE</_3M>
I read in this thread, that 1 Hz and 3 Mhz RBW are not available anymore starting from FW 8.1 so I just should delete this now before updating? Would it hurt to keep it?
From FW 8.5 the 1 Hz will be back anyway, am I correct?

Yes. Siglent activated 3 and 1Hz  8.5. But not 3MHz

Of course after you have made this all right way and system have generated all official license keys you can after then use also other (possible in FW 8.x) modification what do not care anything your model and option licenses and you get same 3.2GHz and all options functional + 3MHz unspecified experimental grade RBW available

So, if you make it right way you can then when ever turn it back to "official" mode and you have there official options license keys and official 3.2GHz model license,  only what is different to official is front panel label.
But also now in this case, you do not have  2.1GHz version license. If you want (some reason, example sending it to Siglent service) turn it to official mode, matching also with front panel label 3021X you can not -  due to lack of 3021X model license! (so think what license/product key you want - you can get only one.)

At this point when you still are with FW7.7 you can carefully think what license you want and is wise but also it need think that some day Siglent may change system and mods dop not work. If you have official 3032X license there... you know future FW also keep it as 3032X. If you have there 3021X license future FW sure keep it as 3021X and here you can run it with super mode mod and it works like 3032X as long as Siglent do not destroy this (and markets) in some future FW.

You can now in 7.7 select which one you want and is more wise for you. Later in FW 8.x (least with FW8.5a what is most new at this time) you can modify it so that it do not care these licenses at all and it works like 3.2G and all options on and including also experimental RBW 3MHz. But as told this "feature" Siglent can stop in some future FW if they want. But if you have all official licenses for all options and product key for 3032X it stay. Only situation when these are generated is process what is running once when system is updating from 7.x to 8.1.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on March 17, 2018, 06:30:11 pm
Just to reassure:
What I now see in Thomas license code, that the entries for 1 Hz and 3 Mhz RBW which were working in 7.07 are gone. In 7.07 there was <_1HZ>TRUE</_1HZ><_3M>TRUE</_3M>
I read in this thread, that 1 Hz and 3 Mhz RBW are not available anymore starting from FW 8.1 so I just should delete this now before updating? Would it hurt to keep it?
From FW 8.5 the 1 Hz will be back anyway, am I correct?

Yes because after 7.7 to 8.1 you do not now have (yet) modified it to "super mode" what opens all RBW's including also experimental 3MHz.


Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Pinkus on March 17, 2018, 06:40:48 pm
Thank you all!
The unit was successful updated from 7.7 to 8.1 and then to 8.5a.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bandit327 on April 06, 2018, 06:02:55 pm
Hello to all ,
received SSA3021X few days ago, came with 1.2.8.5a . date 3/17/2018  on system files. iv looked over this thread and don't know if iv overlooked something or I have found something.  on unit itself if you go to file system keep hitting back then switch to Dir. and keep hitting open/load until complete file system of unit is shown. was able to copy and past most relevant files needed for hacking to 3032X.  I continued to back up everything as instructions say. but when it came to renaming files I was able to do so on unit GUI , not on putty/telnet.   I noticed that depending on the sequence of opening firmdat0 it was in rw mode, allowing me to change following files structure to include an (x).   even with all this I still synced it through putty . I was able to run side/byside and preform needed changes. is this something new or did I miss something in this thread.

anyways ,much thanks for contributors of this thread. I'm in no way a seasoned shell command user but was able to follow instructions :phew: 
here are some screen shots.   
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: swanawood on April 13, 2018, 09:23:42 am
Hi,
I have the last firmware installed: 1.2.8.5a and I wanted to backup all the MTD partitions prior to play with the unit :-)
As many of you, I suffered the MTD7 read error using the previously posted "DD" procedure.
Well, today I succeded dumping the MTD7 using the nanddump command:

root@am335x-evm:~# nanddump -f /usr/bin/siglent/usr/mass_storage/U-disk0/mtd7 /dev/mtd7
ECC failed: 0
ECC corrected: 1
Number of bad blocks: 0
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x02b00000...
ECC: 1 corrected bitflip(s) at offset 0x01fe0000

the file size then is :

root@am335x-evm:~# ls -l /usr/bin/siglent/usr/mass_storage/U-disk0/

-rwxr-xr-x    1 root     root      45088768 Apr 13 11:04 mtd7

and this is the list of partitions... just in case....

root@am335x-evm:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00020000 00020000 "SPL"
mtd1: 00020000 00020000 "SPL.backup1"
mtd2: 00020000 00020000 "SPL.backup2"
mtd3: 00020000 00020000 "SPL.backup3"
mtd4: 001e0000 00020000 "U-Boot"
mtd5: 00020000 00020000 "U-Boot Env"
mtd6: 00300000 00020000 "Manufacturedata"
mtd7: 02b00000 00020000 "File System"
mtd8: 00600000 00020000 "kerneldata"
mtd9: 00600000 00020000 "fpgadata"
mtd10: 03200000 00020000 "firmdata0"
mtd11: 03200000 00020000 "firmdata1"
mtd12: 05f80000 00020000 "datafs"



Hope this could help .
Cheers
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: MF-jockey on April 16, 2018, 01:51:48 pm
Dear all,

I need your help because I'm not an expert of linux.
What is the correct syntax for login to SSA3021X (with PuTTYPortable).
I get no response, but I can check the connection by "*IDN?" - there is a response and also I'm able to reboot over LAN.
I have done the last update to firmware SSA3000X_1.2.8.5a_EN (date 180312) :palm:. Unfortunately I have not the possibility like Bandit327, the Back-key is blocked.

Has somebody an idea, ore must I go over the internal serial-port?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on April 16, 2018, 09:33:48 pm
Dear all,

I need your help because I'm not an expert of linux.
What is the correct syntax for login to SSA3021X (with PuTTYPortable).
I get no response, but I can check the connection by "*IDN?" - there is a response and also I'm able to reboot over LAN.
I have done the last update to firmware SSA3000X_1.2.8.5a_EN (date 180312) :palm:. Unfortunately I have not the possibility like Bandit327, the Back-key is blocked.

Has somebody an idea, ore must I go over the internal serial-port?

You need use TELNET!
But please if you do not know what you are doing then study before you do anything. When you have root then with mistakes you can mess whole SA.

PuTTYtel client you can find here
https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html (https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html)
And there you download 32 or 64 bit version (a Telnet-only client)
32-bit: puttytel.exe
64-bit: puttytel.exe

(and for tracking some possible mistakes turn also log on so that it log all your work to log file.)
Also keep care you follow right instructions and not all fake informations here and there.
Remember, if you are not sure what you do then do not. Golden rule: First brain - then muscle.

This is how SSA3000X answer when it see your terminal. If you do not see this kind of terminal screen (coming from SA) when you connect  terminal then you are doing wrong or something is  wrong. (Terminal..what terminal...you have sopme kind of PC, you do not have real terminal (exept if you have), you have Windows PC or Kylin PC or whatever OS PC somehow emulating real terminal)
Connection protocol is Telnet and telnet port is 23 (PuTTYtel default) and IP address is how you set in SA and then also in PuTTY settings correspondingly.


Code: [Select]

 _____                    _____           _         _
|  _  |___ ___ ___ ___   |  _  |___ ___  |_|___ ___| |_
|     |  _| .'| . | . |  |   __|  _| . | | | -_|  _|  _|
|__|__|_| |__,|_  |___|  |__|  |_| |___|_| |___|___|_|
              |___|                    |___|

Arago Project http://arago-project.org am335x-evm

Arago 2013.05 am335x-evm


am335x-evm login:


Read carefully this msg
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1251608/#msg1251608 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1251608/#msg1251608)
and all what you can find here (including links) and if you find some instructions then adjust some parts of instructions with this message (because something have bit changed after V05 instructions.)

And remember that right use of copypaste is your friend for avoid any typing errors in command lines. Worst case some mistake/error may be fatal.

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: MF-jockey on April 16, 2018, 11:12:47 pm
Thank you rf-loop  :clap:,
 the important information was port 23.
My mistake was port 5025 (I found at a Siglent information)

Now I get the response and was able to to solve my problems (thanks to gonzo_the_great).

Many thanks for the fast support, rf-loop!  :-+
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on April 22, 2018, 09:27:55 am
Something happened to my SSA3032X today  :scared:
I got it with TG but.....

(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=414693)

Thanks Roger for your help.  :)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kado on April 25, 2018, 02:43:52 pm
Something happened to my SSA3032X today  :scared:
I got it with TG but.....

(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=414693)

Thanks Roger for your help.  :)
Hi tautech, could you please explain the miracle?
Thanks Karsten


Gesendet von meinem STH100-2 mit Tapatalk

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: BillB on April 25, 2018, 04:41:40 pm
I'm jonesing for one of these soooo badly, but I just can't justify it.  While I do work with SDR/wireless technology at work, I don't do much at home as I haven't been a ham since I was a kid.

If anyone outgrows theirs, please let me know! 
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on April 25, 2018, 07:34:32 pm
Something happened to my SSA3032X today  :scared:
I got it with TG but.....

(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=414693)

Thanks Roger for your help.  :)
Hi tautech, could you please explain the miracle?
Thanks Karsten


Gesendet von meinem STH100-2 mit Tapatalk
See reply #504 and follow all links.
Read, study and understand........lots !

If you are PuTTY or TELNET illiterate .......then totally forget the hack or get 'trusted' and 'capable' help. < This I stress strongly.
We used LAN cable between W7 laptop and SSA and for the hack,TELNET as my helper (EEVblog member)was very proficient in its use.

 
I only needed the remaining 3 options for my demo SSA3032X and there probably is a neater way to get them without loosing the SN#.  :(
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: mv on April 26, 2018, 08:08:49 am
Hi,

version 1.2.9.1 is out. Is this hack still valid?

/m
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on April 26, 2018, 08:37:52 am
Hi,

version 1.2.9.1 is out. Is this hack still valid?

/m
Well, it doesn't affect it.  :)

(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=417625)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: mv on April 26, 2018, 09:43:26 am
Hi,

version 1.2.9.1 is out. Is this hack still valid?

/m
Well, it doesn't affect it.  :)

Thanks. Will try it later today ...
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kado on April 28, 2018, 02:53:35 pm
after update to 1.2.9.1 information of last 'Calibration date' is lost .. ?
Karsten
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: charliedelta on April 28, 2018, 10:16:09 pm
If Siglent was smart it would sell and release all its spectrum analyzers with all  firmware upgrade options. They would sell thousands more units and would certainly make them more money  than selling firmware licenses. Them trying to emulate Keysight with Option 1 to 99999999999 is really not smart  in today's business model.

If they announced this policy tomorrow, they would at least get 1000 more sales tomorrow!

Oh well opportunity lost.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on April 28, 2018, 10:41:32 pm
If Siglent was smart it would sell and release all its spectrum analyzers with all  firmware upgrade options. They would sell thousands more units and would certainly make them more money  than selling firmware licenses. Them trying to emulate Keysight with Option 1 to 99999999999 is really not smart  in today's business model.

If they announced this policy tomorrow, they would at least get 1000 more sales tomorrow!

Oh well opportunity lost.
You can test what options you really need after purchase as all are active for a trial period.
Presently TG that was previously $237 is now free and that move by Siglent alone reflects the popularity of these models.
And the current lead times.............. :(
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: perchri on April 29, 2018, 09:00:43 am
hello.

I update from 1.2.8.5a  to 1.2.9.1  and lost the Calibration date to.??  Bugs?   Never tried to hack the SSA3021.
Get it few days ago incl TG .

Someone tried to only activate the the options on this last firmware? It was delivered with TG
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on April 29, 2018, 09:41:33 am
hello.

I update from 1.2.8.5a  to 1.2.9.1  and lost the service info to.??  Bugs?   Never tried to hack the SSA3021.
Get it few days ago.
Welcome to the forum.

I'll send an email to Siglent about this update after I apply it to a new unit I have in stock. I have ~18hrs until they are at work.

Quote
Someone tried to only activate the the options on this last firmware? It was delivered with TG
They all come with TG free now.
In my invoices from Siglent TG option is listed separately and at $0.00.  :)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: perchri on May 05, 2018, 12:49:02 pm
Was ist los.?  After the last upgrade 1.2.9.1  it was very quiet. Was going on? What happens?

Per O
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on May 05, 2018, 12:56:45 pm
Was ist los.?  After the last upgrade 1.2.9.1  it was very quiet. Was going on? What happens?

Per O
I got no reply from Siglent and when I installed 9.1 into a new 3021X before sale I saw no changes so I presume it just affects hacked units but I'm not entirely sure. Needs more feedback from others.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: perchri on May 05, 2018, 03:40:43 pm
Thanks.   I get a feedback from the seller here in Norway, today. He told siglent new FW had make a change in the UI . I make a png of the page, and hi told me the same happens on 2 hiof new equipments.  Nor more.  I thinl it is no importent fault anyway.  A another thing. Some times I could not shut down the analyzer, and get to move the 220v connector.  Nobody of this happens with the FW 1.2.8.5a originally installed.  Maybe I want to cansel the bay. I am tired of all data bugs around me. They do not doing things right. My car to, must upgrade against bygs in the FW. have a nice weekend all.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dazz1 on May 05, 2018, 09:06:12 pm
If Siglent was smart it would sell and release all its spectrum analyzers with all  firmware upgrade options. They would sell thousands more units and would certainly make them more money  than selling firmware licenses. Them trying to emulate Keysight with Option 1 to 99999999999 is really not smart  in today's business model.

If they announced this policy tomorrow, they would at least get 1000 more sales tomorrow!

Oh well opportunity lost.

Then they would charge more $$ and people would complain that they were paying extra for features they don't want/use.  So they would most likely sell fewer units.
A base $$ price plus $$ options allows people to start with a basic SA that they might not otherwise afford.  They can then expand capability without buying a new SA.   Base plus options is a smart model.  The automotive industry has been doing it for decades.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ahff1 on May 11, 2018, 02:13:24 pm
Hello everyone im new and new to Sigllent spectrum analyzers just got a ssa3021x and was looking for hacks to open it up.
i been getting lost in the posts on how to do it my unit is new and made in 4/2018
any help/info would be nice
thanks everyone
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on May 11, 2018, 09:00:52 pm
Hello everyone im new and new to Sigllent spectrum analyzers just got a ssa3021x and was looking for hacks to open it up.
i been getting lost in the posts on how to do it my unit is new and made in 4/2018
any help/info would be nice
thanks everyone
Welcome to the forum.

See reply #509 and follow links but before you venture down that path I strongly recommend you use most of the free trial time available and become familiar and confident with the UI. TELNET or PuTTY it doesn't matter BUT you really need to know what you're doing ! I didn't and enlisted trusted and highly competent assistance.
One trick that can be overlooked is removing the power entirely as the last step. 
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ahff1 on May 11, 2018, 10:26:49 pm
ok thank you
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: GaelC on May 12, 2018, 08:39:32 pm
Hello,

I'm trying to push this hack a little further... :-)

Has anybody already tested the effect of the "pro_mode" (should take TRUE or FALSE values)  and "reset_times" xml nodes ?

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dazz1 on May 30, 2018, 11:42:29 am
Hi

Just working through some instructions I found.
The instructions include a mv command.  For non-Linux readers, this is a move (source) (destination) command.
In the instructions I found, the source/destination are reversed.  These errors are corrected in post 428.

Code: [Select]

*Make sure your USB stick is inserted.  This command saves a backup to a USB stick.
nanddump -f /usr/bin/siglent/usr/mass_storage/U-disk0/mtd7 /dev/mtd7

* change to the root directory.
cd /

*this command puts the storage into read/write mode.
mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0 

cd /usr/bin/siglent/firmdata0

* make sure your USB stick is inserted.  This copies files and the directory to the USB stick as a backup
cp -r * /usr/bin/siglent/usr/mass_storage/U-disk0/


* the mv command renames files by adding a x to the file name.  Note only 3 files.
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml 
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml 
mv nsp_data_b nsp_data_bx 

cd /usr/bin/siglent/usr/backup 

mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml 
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml 
mv nsp_data_b nsp_data_bx 

cd /

sync   

exit
* then switch off/on

If you get an error that looks like this:
Code: [Select]
can't rename 'NSP_sn_bandwidth.xml': Read-only file system
Just rerun the mount... command.

I decided to back out of this and I didn't get to the last part because I am wondering if there is an alternative way of doing this.

What about writing a small bash script saved in /etc/init.d that resets the timers on the options???
This would run each time the analyser was switched on and set the timer to 48h.
Normally such a script would go in rc.local, but thats not there.
Ideally the script would be rerun every 47hours but crontab is not installed.
This would preserve all of the factory settings.  It wouldn't expand the bandwidth though.

Just a thought.







Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: grants225 on June 22, 2018, 09:24:19 am
Hi everyone,

while I managed to update/unlock some other devices (router, TV box etc)  :-+, my scripting knowledge is close to zero  :--. This definitely will not stop me from trying to upgrade SSA3k I am awaiting to be delivered, but some help/advise would be very helpful, especially after reading some warning posts.

I has read all current thred and still have questions:
1) if I understand Gonzo_the_grate script on #428, it makes backup to usb stick and makes copies of xml files adding 'x'-es in firmdata0 and backup?

Code: [Select]
plug in FAT32 formatted USB memory stick (to take a backup).
telnet to SSA30xxX
root/ding1234

cd /   
cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup 
cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0 
mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
cd /usr/bin/siglent/firmdata0 
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml 
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml   
mv nsp_data_b nsp_data_bx   
cd /usr/bin/siglent/usr/backup   
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml 
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml 
mv nsp_data_b nsp_data_bx 
cd /
sync   
logout

reboot


2) where should be added this licence line? Is it xml file should be edited manually?:

Code: [Select]
<?xml version="1.0" encoding="UTF-8"?>
<nsp_system_info_root>
  <device>
    <system_information>
      <serial_number>
        <chip>SSA3XHAxxxxxxxxxxx</chip>
      </serial_number>
    <license><_3032>TRUE</_3032><_tTG>TRUE</_tTG><_tEMI>TRUE</_tEMI><_tMeas>TRUE</_tMeas><_tCAT>TRUE</_tCAT><_t1HZ>TRUE</_t1HZ><_t3M>TRUE</_t3M></license></system_information>
  </device>
</nsp_system_info_root>
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: markus_jlrb on June 22, 2018, 11:17:28 am
Do not forget to dump all mtdX partitions on the external stick with sufficient space.

X in range [0..12] according to output of cat on /proc/mtd:

root@am335x-evm:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00020000 00020000 "SPL"
mtd1: 00020000 00020000 "SPL.backup1"
mtd2: 00020000 00020000 "SPL.backup2"
mtd3: 00020000 00020000 "SPL.backup3"
mtd4: 001e0000 00020000 "U-Boot"
mtd5: 00020000 00020000 "U-Boot Env"
mtd6: 00300000 00020000 "Manufacturedata"
mtd7: 02b00000 00020000 "File System"
mtd8: 00600000 00020000 "kerneldata"
mtd9: 00600000 00020000 "fpgadata"
mtd10: 03200000 00020000 "firmdata0"
mtd11: 03200000 00020000 "firmdata1"
mtd12: 05f80000 00020000 "datafs"

Dump command to use:

nanddump -f /usr/bin/siglent/usr/mass_storage/U-disk0/mtdX /dev/mtdX


Markus

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: hendorog on June 23, 2018, 02:45:40 am
Hi

Just working through some instructions I found.
The instructions include a mv command.  For non-Linux readers, this is a move (source) (destination) command.
In the instructions I found, the source/destination are reversed.  These errors are corrected in post 428.

Code: [Select]

*Make sure your USB stick is inserted.  This command saves a backup to a USB stick.
nanddump -f /usr/bin/siglent/usr/mass_storage/U-disk0/mtd7 /dev/mtd7

* change to the root directory.
cd /

*this command puts the storage into read/write mode.
mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0 

cd /usr/bin/siglent/firmdata0

* make sure your USB stick is inserted.  This copies files and the directory to the USB stick as a backup
cp -r * /usr/bin/siglent/usr/mass_storage/U-disk0/


* the mv command renames files by adding a x to the file name.  Note only 3 files.
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml 
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml 
mv nsp_data_b nsp_data_bx 

cd /usr/bin/siglent/usr/backup 

mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml 
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml 
mv nsp_data_b nsp_data_bx 

cd /

sync   

exit
* then switch off/on

If you get an error that looks like this:
Code: [Select]
can't rename 'NSP_sn_bandwidth.xml': Read-only file system
Just rerun the mount... command.

I decided to back out of this and I didn't get to the last part because I am wondering if there is an alternative way of doing this.

What about writing a small bash script saved in /etc/init.d that resets the timers on the options???
This would run each time the analyser was switched on and set the timer to 48h.
Normally such a script would go in rc.local, but thats not there.
Ideally the script would be rerun every 47hours but crontab is not installed.
This would preserve all of the factory settings.  It wouldn't expand the bandwidth though.

Just a thought.

Another idea - make the .xml files readonly and see if you can prevent the OS from counting down the timeouts on the demo options?

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dazz1 on June 23, 2018, 05:34:41 am
Another idea - make the .xml files readonly and see if you can prevent the OS from counting down the timeouts on the demo options?

I like that idea.

Dazz
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dazz1 on June 24, 2018, 04:23:19 am
Hi
Currently exploring my SSA30xx. 
I saved some files of scans in the local:/ folder.  Copying these to a USB stick is painful.

Is there a simple way of transferring these by Telnet session or other means?
Where is the local:/ folder?

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on June 24, 2018, 07:34:30 am
Hi
Currently exploring my SSA30xx. 
I saved some files of scans in the local:/ folder.  Copying these to a USB stick is painful.

Is there a simple way of transferring these by Telnet session or other means?
Where is the local:/ folder?
Actually its real easy to transfer files from the local drive to USB.

From the File menu browse to the local drive and select File browse mode, then use the Copy key.
Change back to Dir browse mode to select USB stick then select File browse again, then Operate key to get into another menu where you can Paste the Copy'ed file into the USB root or a folder.

Once you've done it a couple of times it becomes pretty straightforward.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dazz1 on June 24, 2018, 11:20:42 am
Hi
I tried that and quickly got frustrated. 
I did find that if I have a USB stick in the port, it automatically saves to the USB.    That is a better option.
It would still be useful to be able to remotely manage files.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on June 24, 2018, 11:23:16 am
Hi
I tried that and quickly got frustrated. 
I did find that if I have a USB stick in the port, it automatically saves to the USB.    That is a better option.
It would still be useful to be able to remotely manage files.
OK, we will look for a solution for you.

Anybody have a quick one for Dazz ?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: riccardo.pittini on July 02, 2018, 01:21:33 pm
 Just for information of all ;)

Patch works also on SSA3021X 1.2.9.1 (patch applied AFTER firmware upgrade)

if you are interested:
I looked into the xml files before the trial licenses expire. File: NSP_sn_bandwidth.xml For each trial license there is a field: <remain>1040</remain> where the "1040" is the remaining demo time.
I had still 18h of demo and the counter was 1080, then with 17h and 40min of demo the counter was 1060 (if I recall right by heart).
So this seems also another available path.

Cheers to everyone / Hope it helped!!!
 :popcorn:
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ironcurtain on July 13, 2018, 10:02:45 am
Is this applicable to new units bought recently? I might snatch one off Batronix....
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: BillB on July 13, 2018, 12:28:09 pm
Is this applicable to new units bought recently? I might snatch one off Batronix....

They are back-ordered for us in the US until August.   :(
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kerouanton on July 14, 2018, 07:28:22 pm
Hi
Currently exploring my SSA30xx. 
I saved some files of scans in the local:/ folder.  Copying these to a USB stick is painful.

Is there a simple way of transferring these by Telnet session or other means?
Where is the local:/ folder?
Actually its real easy to transfer files from the local drive to USB.

From the File menu browse to the local drive and select File browse mode, then use the Copy key.
Change back to Dir browse mode to select USB stick then select File browse again, then Operate key to get into another menu where you can Paste the Copy'ed file into the USB root or a folder.

Once you've done it a couple of times it becomes pretty straightforward.

I've been doing this today... really painful if you have over 10 files.
I just HOPE Siglent will add a "select all" or something similar option for the move/copy function.

Btw, as I now have the full range of Siglent hardware, I'm very surprised to see that no 2 systems are similar in terms of UI. They must have separate teams that don't talk to each other... and they probably don't do ergonomic testing of their interfaces to see if in the field it is really usable. For example, this "copy file to USB" is just poorly implemented. And another example that really frustrates me is the SDG6022X. Great hardware, poor UI : Having to press up to 8 keys to select a waveform is just not practical, it could have been done much easier:
- Pressing "waveform" button twice to switch from page to page, instead of having to select "waveform" then "page 2".
- Leaving the waveform menubar to the current settings, instead to going back to the main menubar after a waveform selection.

In short: good hardware, UI can be improved. But that is quite common on most electronics companies, for reasons I still don't fully understand !
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: colorado.rob on July 14, 2018, 09:45:05 pm
Btw, as I now have the full range of Siglent hardware, I'm very surprised to see that no 2 systems are similar in terms of UI. They must have separate teams that don't talk to each other... and they probably don't do ergonomic testing of their interfaces to see if in the field it is really usable.
Similar problems exist with their SCPI command set.  Very different command languages for their products.  Even things like the AWG built into the SDS2000X has a different SCPI command set from the SDG2000X.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on July 14, 2018, 10:24:11 pm
Hi
Currently exploring my SSA30xx. 
I saved some files of scans in the local:/ folder.  Copying these to a USB stick is painful.

Is there a simple way of transferring these by Telnet session or other means?
Where is the local:/ folder?
Actually its real easy to transfer files from the local drive to USB.

From the File menu browse to the local drive and select File browse mode, then use the Copy key.
Change back to Dir browse mode to select USB stick then select File browse again, then Operate key to get into another menu where you can Paste the Copy'ed file into the USB root or a folder.

Once you've done it a couple of times it becomes pretty straightforward.

I've been doing this today... really painful if you have over 10 files.
I just HOPE Siglent will add a "select all" or something similar option for the move/copy function.
Unfortunately at this time there is no simple solution to this.
We'll ask Siglent to implement UI changes and/or SCPI commands.

Quote
Btw, as I now have the full range of Siglent hardware, I'm very surprised to see that no 2 systems are similar in terms of UI. They must have separate teams that don't talk to each other... and they probably don't do ergonomic testing of their interfaces to see if in the field it is really usable. For example, this "copy file to USB" is just poorly implemented. And another example that really frustrates me is the SDG6022X. Great hardware, poor UI : Having to press up to 8 keys to select a waveform is just not practical, it could have been done much easier:
- Pressing "waveform" button twice to switch from page to page, instead of having to select "waveform" then "page 2".
- Leaving the waveform menubar to the current settings, instead to going back to the main menubar after a waveform selection.

In short: good hardware, UI can be improved. But that is quite common on most electronics companies, for reasons I still don't fully understand !
Thanks, good feedback.  :-+

Really this should be in the SSA main thread not the one about hacks.
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: alexvg on July 27, 2018, 08:57:59 am
Hi,

I’m recently bought a SSA3021X-TG (for free actually) for personnal and professionnal use.
But after using TG intensely, it does not work at all.
I looking for this problem and see the TG was in demo mode.
But there’s not any serial number in the package for the TG.

I was send multiple emails to Siglent via the web form without any response !!! It’s a mistake !

I’ve found the hack of the device and applying with success.*

My device is :
SW1 1.2.9.1
FW 07.03

I’ve corrected the procedure :

Part 1 - Backup files
1. Insert USB stick
2. Go in System => System info
3. Establish a telnet session with root/ding1234
4. "cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup"
5. "cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0"
6. "sync"
7. "cd /usr/bin/siglent/usr/backup" and "ls –l" (do a screen pic with a phone)
8. "cd /usr/bin/siglent/firmdata0" and "ls –l" (do a screen pic with a phone)
9. "logout"

Part 2 - Hack the device
1. Go in System => System info
2. Establish a telnet session with root/ding1234
3. "mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0"
4. "cd /usr/bin/siglent/firmdata0"
5. "mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml"
6. "mv NSP_trends_config_info.xml NSP_trends_config_infox.xml"
7. "mv nsp_data_b nsp_data_bx"
8. "cd /usr/bin/siglent/usr/backup"
9. "mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml"
10. "mv NSP_trends_config_info.xml NSP_trends_config_infox.xml"
11. "mv nsp_data_b nsp_data_bx"
12. "sync"
13. "logout"
14. Soft power cycle (power off and power on with button "power")
15. Go in System => Pwr On/Preset => Reset & Clear => Enter
16. Soft power cycle (power off and power on with button "power")

My device works now with TG.


I’m really sad to use this kind of method in order to work… I had to hack my own Adobe licenses to use them properly.


Anybody know how to disable 3MHz RBW ?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dazz1 on July 27, 2018, 10:14:01 am
Hi,

I’m recently bought a SSA3021X-TG (for free actually) for personnal and professionnal use.
But after using TG intensely, it does not work at all.
You don't say how old the SA was before it was given to you.
Siglent probably expect you to buy a TG license.


I’ve corrected the procedure :
What did you correct??

Anybody know how to disable 3MHz RBW ?
Select another range of RBW.   There is no point in crippling your SA.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on July 27, 2018, 10:29:25 am
Hi,

I’m recently bought a SSA3021X-TG (for free actually) for personnal and professionnal use.
But after using TG intensely, it does not work at all.
You don't say how old the SA was before it was given to you.
Siglent probably expect you to buy a TG license.
It will have been old stock as they now come with the TG option for $0.

Dazz, for your one TG was included free.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: alexvg on July 27, 2018, 12:16:14 pm
Quote from: dazz1
You don't say how old the SA was before it was given to you.
Siglent probably expect you to buy a TG license.
The SSA3021X was delivered 10 days ago (and ordered 2 weeks ago with marked "FREE TG LICENSE").


Quote from: dazz1
What did you correct??
I've added "reset & clear" and an additionnal power cycle.
Without doing these 2 interactions, the device does not work properly.

Quote from: dazz1
Quote from: alexvg
Anybody know how to disable 3MHz RBW ?
Select another range of RBW.   There is no point in crippling your SA.
In Auto mode, the 3MHz RBW is automatically selected (you always think about it...), I prefer max 1MHz RBW (like before the hack - but I always waiting for any Siglent answer to unhack the SSA...).
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on July 27, 2018, 01:49:09 pm
In Auto mode, the 3MHz RBW is automatically selected (you always think about it...), I prefer max 1MHz RBW (like before the hack - but I always waiting for any Siglent answer to unhack the SSA...).

So that all understand:

The hack that is advertised here activates the PRO_MODE in the SSA. The PRO_MODE overrides all the licensing that the equipment has and activates all its features.

It's not possible to have PRO_MODE active and some features disabled!

If you don't want 3MHz, undo the hack. It's as simple as that!

I’m recently bought a SSA3021X-TG (for free actually) for personnal and professionnal use.
But after using TG intensely, it does not work at all.
I looking for this problem and see the TG was in demo mode.
But there’s not any serial number in the package for the TG.

Go to the old file NSP_sn_bandwidth.xml and see what TG licenses you have there.

Do you have any _TG or _tTG ?
If you have only a _tTG then you never had a permanent license, and you only have an expired temporary license.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on July 27, 2018, 03:21:55 pm
Quote from: dazz1
You don't say how old the SA was before it was given to you.
Siglent probably expect you to buy a TG license.
The SSA3021X was delivered 10 days ago (and ordered 2 weeks ago with marked "FREE TG LICENSE").

If seller did not already give "authorized" code you need contact this Siglent seller/distributor where did you buy it!
If still not,  then contact Siglent for get it.

After then you get TG Licence here (http://service.siglenteu.com/easyweb/), this is automatic system for get licence codes for options. Only now is suprice that seller did not deliver this authorization code to you. This is seller error!:

For automatic licence key generation using authorization code and SSA serial number:
http://service.siglenteu.com/easyweb/ (http://service.siglenteu.com/easyweb/)

If this all fails you sure get license code also from Siglent. You need your serial number and copy from purchase receipt.  Are you sure seller did not include authorization code for get license, example printed in receipt or package list etc.
There in activation side you can also get instructions sheet (pdf)  and there you find contacts: I think it is best you use Headquarter contact emal.
Just write subject: SSA3000X missing TG option license code
And then tell your serial number and tell that you did not get license for TG as Siglent offer is.
So there is hope that it go to right people for hadle it.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ironcurtain on July 27, 2018, 06:19:53 pm
I just upgraded my new out of the box unit to the latest FW, and noticed that the Spectrum Monitor is not available in the 3021X.
Can it be enabled through the hack or it is impossible to have it in this model? I assumed the hardware was the same between the two.

Where can I find the exact post with the latest confirmed procedure to do the hack?

EDIT: Unlocked the rig. This forum is awesome :)

Any caveat emptors?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: alexvg on August 05, 2018, 07:31:45 pm
Hi,

I haven't got any licence paper... but 1560€ (incl VAT) from Siglent...

After sending new messages to Siglent, I still have no answer.
Where is the support? It does not seem to exist at Siglent! It's not professional.
That's enough ! I'm giving up. I will continue to use the hacked version.

Edit:
I've just received my TG licence after sending a complaint to the intermediary expeditor (this takes 4 hours !!!).
Thanks for all.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: analogRF on August 06, 2018, 03:24:48 am
I just upgraded my new out of the box unit to the latest FW, and noticed that the Spectrum Monitor is not available in the 3021X.
Can it be enabled through the hack or it is impossible to have it in this model? I assumed the hardware was the same between the two.

Where can I find the exact post with the latest confirmed procedure to do the hack?

EDIT: Unlocked the rig. This forum is awesome :)

Any caveat emptors?

did you use the gonzo_the_great script in post #428?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: analogRF on August 06, 2018, 08:31:51 pm
Successfully modded on FW 1.2.9.1 with no issues. Follow post # 428 (or # 460 which is the same...)
However, there are a couple of things which I hope this is the right thread to discuss it

How does your 1Hz/3Hz RBW look like? I mean how do they behave?
Look at the attached photos I got for 100MHz CF and Span of 1KHz.
Clearly these RBWs are just digital filters (not actual bandpass filters like those old agilent SA which didn't go below 1KHz or so)

So it seems 1Hz and 3Hz RWB are just "heavy" averaging methods. But the noise floor is just a flat line. Is this the right behavior?

Also note that the flat noise floor is a couple of dB HIGHER for 1Hz RBW than 3Hz?!

Can someone confirm this? I have tried other center frequencies and it is the same

of course your span should be very small otherwise it will not accept 1Hz or 3Hz (sweep time will be out of range)

another issue is a small bug I guess, at power up, at the bottom line it shows center frequency (left) and stop frequency (right)! instead of showing the span (I use a USER defined power up state with CF and span)
can someone also try this?

thanks

EDIT: If I choose "Last" state as the power up state, again after turn on it shows center frequency and stop frequency rather than span. I think it should be fixed in the next firmware

EDIT: dug around a bit more and found the answer (kind of) in other threads. according to Siglent this is normal. you need to have input signal at those RBWs and then you will see the correct (somewhat) behavior. But the small bug (showing CF and stop freq together) remains
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: markus_jlrb on August 07, 2018, 08:41:56 am
I have posted this observation few months ago in the Siglent support
thread in this forum.

No one seems to care about this realy.

Markus
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: michael152 on August 10, 2018, 06:33:40 pm
Received today my SSA3021X and it has the SW1 version 1.2.8.5a with HW version 07.03.00.
By going thru the topic it seems it can be upgraded without too much of a hassle.
But that is for the IT expert of course....

Would there be any of those experts willing to remotely assist with this upgrade?

Tnx!

Michael
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rfspezi on August 11, 2018, 11:41:06 am
I can crash my SSA3021x when entering e.g. "868"+"Enter" immediately after it has booted. ::)
After that it does not resond to any key anymore and the display stops updating.
The only way to get it working again is to powercycle it.

Is that bug a result of hacking it or is this "normal"?
SA is running 1.2.8.5a FW version.

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on August 11, 2018, 11:55:24 am
I can crash my SSA3021x when entering e.g. "868"+"Enter" immediately after it has booted. ::)
After that it does not resond to any key anymore and the display stops updating.
The only way to get it working again is to powercycle it.

Is that bug a result of hacking it or is this "normal"?
SA is running 1.2.8.5a FW version.
Please see this thread for remedy:
https://www.eevblog.com/forum/testgear/siglent-ssa3021x-user-interface-bug/ (https://www.eevblog.com/forum/testgear/siglent-ssa3021x-user-interface-bug/)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: michael152 on August 13, 2018, 09:45:43 am
I managed to do the SW upgrade to 1.2.9.1 without problems.
Furthermore I tried to get the hack done following #428 and #541.
The result is that the SA is still showing the original version with only the (already free) TG active.

When looking at the folders I see:
SA backup
nsp_data_b
NSP_sn_bandwidth.xml
nsp_data_bx
NSP_sn_bandwidthx.xml
NSP_trends_config_infox.xml

SA-firmdata0
nsp_data_b
NSP_sn_bandwidth.xml
nsp_data_bx
NSP_sn_bandwidthx.xml
NSP_trends_config_infox.xml

I assume because the original files without the "x", the hack didn't take place yet.
How can I remove the original files in both folders.
nsp_data_b
NSP_sn_bandwidth.xml

Thanks for advice!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: michael152 on August 13, 2018, 05:56:01 pm
My Telnet adventure worked out well in the end....phew  :o
I managed to remove the files without the "x" on the end by means of the rm command.
After reboot the SA came back with all options permanently active.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: cnkz on September 05, 2018, 06:44:39 am
I am wondering if i should change the root password of the device? After all it is a public know password.

Of course my LA is not accessible from the I-Net (protected by firewall) and it is not an interesting target for a hack (as most of the time off).

But you never know. Has anybody tried changing the root-password already? Using the passwd command?

P.S:
I got my unit yesterday and flashing latest FW and applying the hack was straight forward - thank you!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on September 05, 2018, 07:13:33 am
My Telnet adventure worked out well in the end....phew  :o
I managed to remove the files without the "x" on the end by means of the rm command.
After reboot the SA came back with all options permanently active.

 |O
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on September 05, 2018, 10:19:51 am
But you never know. Has anybody tried changing the root-password already? Using the passwd command?

You'll be able to change it for that session BUT, once you reboot, you'll get the original as the CRAMFS is RO. (If I remember correctly.)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: MilkmanCDN on September 05, 2018, 06:16:44 pm
Folks,

I have a SSA3021x w/ v1.2.8.5a firmware (HW 7.03).   It's already modified.    If I want to upgrade to 1.2.9.1, do I need to reverse the modification process before applying the upgrade?    Or can I just update the firmware with the patch already in place.    I've read the the last two pages of posts but it's not entirely clear.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on September 05, 2018, 08:05:15 pm
Folks,

I have a SSA3021x w/ v1.2.8.5a firmware (HW 7.03).   It's already modified.    If I want to upgrade to 1.2.9.1, do I need to reverse the modification process before applying the upgrade?    Or can I just update the firmware with the patch already in place.    I've read the the last two pages of posts but it's not entirely clear.
It is, just one page further back in reply #490.
Title: Help ! SSA3021 bricked ?
Post by: chnbr on September 23, 2018, 03:02:16 pm
Hi,

I have a SSA3021X which I upgraded to 1.2.9.1 and then modified to get all options. I did this in beginning of July and it worked very well (with all options enabled) until today. Now when I switch it on, both TG and Mode key are lit, then it shows the Siglent Logo, then after some seconds TG and MODE are switched off and ... that's it, i.e. Siglent Logo stays on screen, no measurement screen occurs.

Of course I did try to login via network, however the device does not request an IP from my DHCP. So it is NOT reachable via network too.

Any suggestions on what to try ? Are there any undocumented key combinations which allow to reset, get a console, or something ?

Please help, I'm stuck. The device seems to be bricked...

Thanks
Chris
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on September 23, 2018, 06:03:31 pm
You can connect the serial port (console) and investigate the boot process.
From your description it could be a NAND-memory error. I had similar symptoms on my analyser after a firmware update.

A restore/flash of a NAND partition would be possible.

- Harald.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: janekivi on September 23, 2018, 06:58:02 pm
Now you need to navigate on page 9 and try the same steps

https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1106559/#msg1106559 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1106559/#msg1106559)

I did rebuild once my SDG2000X using sdcard repair...
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: baobui on October 01, 2018, 03:45:14 am
Hello all,

Thanks for your help in advance.
I just bought a SSA3021X, the software is 1.2.8.5a. When i telnet, it say connection refused.
Does any one have the same problem and how can i login the machine?

Thanks
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on October 01, 2018, 04:30:55 am
Hello all,

Thanks for your help in advance.
I just bought a SSA3021X, the software is 1.2.8.5a. When i telnet, it say connection refused.
Does any one have the same problem and how can i login the machine?

Thanks

Read.
First this:
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1480492/#msg1480492 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1480492/#msg1480492)

and there follow msg links and read more, all what you find.
There is not free lounges. It need work. It is, as usually, first brain (read, study, try understand), then muscle (connect to machine and make what needed).  If you just start "try this and that and test if you have just good luck" only you get is big hassle or even "bricked" SSA..
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: baobui on October 01, 2018, 06:09:56 am
Hi, thank you very much.
By some reason, my putty put the port of 22. Now all working fine
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: pri on November 25, 2018, 06:27:46 pm
Hi,
Sorry for my newbie question, but it's the first time I connect a device to pc through the Ethernet port.
I have an SSA3021X with the following config:
SW1: 1.2.8.5a
SW2: 20170512-1
SW3: 000000D1
HW  : 07.03.00

Unfortunately it doesn't seem to connect to my laptop (I have Win10).
The procedure I followed:
connected the SSA ethernet port directly to my laptop Ethernet port through the cable,
the SSA static IP address is 10.11.13.220
Submask: 255.255.0.0 (same as my laptop ethernet card)

Control panel shows "unidentified network",
If I try to ping 10.11.13.220 from CMD I get:
connection timed out,
4 packets sent, 4 packets lost (100% lost)
same thing with PuTTY.

On the rear of the instrument both LEDs are lit (green and orange)

What am I doing wrong?  ???
thnx
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on November 25, 2018, 06:35:25 pm
Hi,
Sorry for my newbie question, but it's the first time I connect a device to pc through the Ethernet port.
I have an SSA3021X with the following config:
SW1: 1.2.8.5a
SW2: 20170512-1
SW3: 000000D1
HW  : 07.03.00

What am I doing wrong?  ???
thnx
Welcome to the forum.

I strongly suggest that you get your firmware up to date to the current version: V1.2.9.2a
All the later FW versions are here:
https://www.siglenteu.com/service-and-support/firmware-software/spectrum-analyzers/#ssa3000x-series (https://www.siglenteu.com/service-and-support/firmware-software/spectrum-analyzers/#ssa3000x-series)

Each version comes with a changelog file and installation instructions.

Hopefully that will fix any connectivity issues you have.

BTW, this is the main thread for these spectrum analyzers:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on November 25, 2018, 06:44:16 pm
The procedure I followed:
connected the SSA ethernet port directly to my laptop Ethernet port through the cable,
the SSA static IP address is 10.11.13.220
Submask: 255.255.0.0 (same as my laptop ethernet card)

Connecting the PC directly to the DSO through ether requires a crossover cable. Are you using one?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on November 26, 2018, 06:18:58 am
The procedure I followed:
connected the SSA ethernet port directly to my laptop Ethernet port through the cable,
the SSA static IP address is 10.11.13.220
Submask: 255.255.0.0 (same as my laptop ethernet card)

Connecting the PC directly to the DSO through ether requires a crossover cable. Are you using one?

I have never seen this level modern laptop what accept win10 and still need crossover cable. Mostly today these have AutoCrossOver. AutoCrossOver have been available 20 years and today most machines have it.
But yes of course all is possible.

Your subnet mask... do you really need network for up to 65534 IP's when your whole network is one PC and one SSA.

I think class C network is well enough for 2 machines private "network". (direct cable between laptop and SSA)
Subnet mask 255.255.255.0   (this accept one octet of addresses for hosts because last 8 bits in mask are zero)
And it is private network so is it quite common to use example 192.168.0.x
and x  between 1 - 254  (address 0 and 255 do not use)

In some cases also firewall may have role with problems.


http://www.subnet-calculator.com/ (http://www.subnet-calculator.com/)

If your laptop really do not have AutoCrossOver LAN then you need cross over cable. If it have AutoCrossOver then both cables can use.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on November 26, 2018, 11:50:49 am
My crossover suggestion was based on the " both LEDs are lit (green and orange)". I assumed solid lit.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on November 26, 2018, 02:18:35 pm
My crossover suggestion was based on the " both LEDs are lit (green and orange)". I assumed solid lit.

There is so many kind of lights..  example my PC redorange is constant and yelloworange is blinking when trafic and SSA green continuously and yelloworange blinking when trafic. There is not tight standards for these lights. In some cases led color also tell speed... 10/100 or 1000

But how ever I will recommend class C network in this case.
Class C IP addresses range from 192.0.0.x to 223.255.255.x.
Default subnet mask for Class C is 255.255.255.x

@pri:

One example:

Download puttytel.exe  (select right version for you) here https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html (https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html)

It do not need any kind of installation, just run

But first:
This is only for direct connection so that PC LAN port --- cable --- SSA LAN port

Set your PC LAN and SSA as in images and run puttytel.exe and enter address as in image and open it and you see puttytel console as in image. If not then your LAN do not work.  Check that your PC do not restrict this communication or if your cable is ok. Sidenote, in this case this default gateway is just dummy... but some systems are happy if there is something and also in some other cases subnet IP address range bottom is nice to use for this.

Images do not need explanation and perhaps if these are clear for you still they may help some other peoples.
(of course there can use more common 192.168..etc what are many equipments "default" but example my system have some other things also so 222 sure do not make collision...

Just like 1, 2, 3, 4,....  and then enter what need...

(you can set puttytel (telnet client) so that it do not forget every time all and also good practice is set it so that it keep log about all what have done with console so that if something goes wrong you can inspect log.... or show log to some other people if need some help)



Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: pri on November 26, 2018, 08:24:52 pm
Hi,
Sorry for my newbie question, but it's the first time I connect a device to pc through the Ethernet port.
I have an SSA3021X with the following config:
SW1: 1.2.8.5a
SW2: 20170512-1
SW3: 000000D1
HW  : 07.03.00

What am I doing wrong?  ???
thnx
Welcome to the forum.

I strongly suggest that you get your firmware up to date to the current version: V1.2.9.2a
All the later FW versions are here:
https://www.siglenteu.com/service-and-support/firmware-software/spectrum-analyzers/#ssa3000x-series (https://www.siglenteu.com/service-and-support/firmware-software/spectrum-analyzers/#ssa3000x-series)

Each version comes with a changelog file and installation instructions.

Hopefully that will fix any connectivity issues you have.

BTW, this is the main thread for these spectrum analyzers:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/)

Thanks, it was easy to upgrade to the latest version.

My crossover suggestion was based on the " both LEDs are lit (green and orange)". I assumed solid lit.

There is so many kind of lights..  example my PC redorange is constant and yelloworange is blinking when trafic and SSA green continuously and yelloworange blinking when trafic. There is not tight standards for these lights. In some cases led color also tell speed... 10/100 or 1000

But how ever I will recommend class C network in this case.
Class C IP addresses range from 192.0.0.x to 223.255.255.x.
Default subnet mask for Class C is 255.255.255.x

@pri:

One example:

Download puttytel.exe  (select right version for you) here https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html (https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html)

It do not need any kind of installation, just run

But first:
This is only for direct connection so that PC LAN port --- cable --- SSA LAN port

Set your PC LAN and SSA as in images and run puttytel.exe and enter address as in image and open it and you see puttytel console as in image. If not then your LAN do not work.  Check that your PC do not restrict this communication or if your cable is ok. Sidenote, in this case this default gateway is just dummy... but some systems are happy if there is something and also in some other cases subnet IP address range bottom is nice to use for this.

Images do not need explanation and perhaps if these are clear for you still they may help some other peoples.
(of course there can use more common 192.168..etc what are many equipments "default" but example my system have some other things also so 222 sure do not make collision...

Just like 1, 2, 3, 4,....  and then enter what need...

(you can set puttytel (telnet client) so that it do not forget every time all and also good practice is set it so that it keep log about all what have done with console so that if something goes wrong you can inspect log.... or show log to some other people if need some help)

rf-loop NUMBER ONE!!!
kudos to you!!
It worked as you suggested!

Is this message still valid to upgrade vers. HW 7.03 ?
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998366/#msg998366 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998366/#msg998366)
Any hint?

Thanks!  :-+
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on November 26, 2018, 09:09:08 pm
Is this message still valid to upgrade vers. HW 7.03 ?
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998366/#msg998366 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998366/#msg998366)
Any hint?

Be careful!

You have HW 7.03 but that msg refers to FW 7.07.  You now have what we could call FW 9.02a. Study the rest of the thread.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on November 26, 2018, 09:43:44 pm
Hi,
Sorry for my newbie question, but it's the first time I connect a device to pc through the Ethernet port.
I have an SSA3021X with the following config:
SW1: 1.2.8.5a
SW2: 20170512-1
SW3: 000000D1
HW  : 07.03.00

What am I doing wrong?  ???
thnx
Welcome to the forum.

I strongly suggest that you get your firmware up to date to the current version: V1.2.9.2a
All the later FW versions are here:
https://www.siglenteu.com/service-and-support/firmware-software/spectrum-analyzers/#ssa3000x-series (https://www.siglenteu.com/service-and-support/firmware-software/spectrum-analyzers/#ssa3000x-series)

Each version comes with a changelog file and installation instructions.

Hopefully that will fix any connectivity issues you have.

BTW, this is the main thread for these spectrum analyzers:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/)

Thanks, it was easy to upgrade to the latest version.

My crossover suggestion was based on the " both LEDs are lit (green and orange)". I assumed solid lit.

There is so many kind of lights..  example my PC redorange is constant and yelloworange is blinking when trafic and SSA green continuously and yelloworange blinking when trafic. There is not tight standards for these lights. In some cases led color also tell speed... 10/100 or 1000

But how ever I will recommend class C network in this case.
Class C IP addresses range from 192.0.0.x to 223.255.255.x.
Default subnet mask for Class C is 255.255.255.x

@pri:

One example:

Download puttytel.exe  (select right version for you) here https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html (https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html)

It do not need any kind of installation, just run

But first:
This is only for direct connection so that PC LAN port --- cable --- SSA LAN port

Set your PC LAN and SSA as in images and run puttytel.exe and enter address as in image and open it and you see puttytel console as in image. If not then your LAN do not work.  Check that your PC do not restrict this communication or if your cable is ok. Sidenote, in this case this default gateway is just dummy... but some systems are happy if there is something and also in some other cases subnet IP address range bottom is nice to use for this.

Images do not need explanation and perhaps if these are clear for you still they may help some other peoples.
(of course there can use more common 192.168..etc what are many equipments "default" but example my system have some other things also so 222 sure do not make collision...

Just like 1, 2, 3, 4,....  and then enter what need...

(you can set puttytel (telnet client) so that it do not forget every time all and also good practice is set it so that it keep log about all what have done with console so that if something goes wrong you can inspect log.... or show log to some other people if need some help)

rf-loop NUMBER ONE!!!
kudos to you!!
It worked as you suggested!

Is this message still valid to upgrade vers. HW 7.03 ?
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998366/#msg998366 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998366/#msg998366)
Any hint?

Thanks!  :-+

This info  is old!  ETA: (now I can see also @tv84 msg   ;)  )

You have lot of more new FW. Use more fresh info.
 
Example this https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1132969/#msg1132969 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1132969/#msg1132969)  look  "attached instructions"
But also after then later in thread you may find some bit more fresh info. (but still you can use this V05 as some kind of basic info.
Your SSA is much more new and there have not been installed older very different FW so there is perhaps not all files what are displayed in instrictions V05. They are perhaps some residues from older generation FW.

But, this instruction v05  is overall roughly ok  if you can detect what tiny differences there is (some obsolete files what are not there anymore when you look using ls command in your SSA. One reason is that  today all new SSA's have never updated from very old totally obsolete "generation 7 FW". All are generation 8 FW or later.  (also older SSA's are mostly HW version 07.03.00 and this 7 have nothing to do with this) So if there is some files what your system do not have, then just do not care these files.  Soon you find what is idea...
For commands, copypaste is your friend...


Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: miceuz on December 13, 2018, 02:07:22 pm
Hi all,

I have got my new SSA3021X. Unfortunately it's a new firmware that has not been referenced anywhere before in hacking threads.

SW1: 1.2.9.a
SW2: 20180708-1
SW3: 000000E1
HW:  0C.03.00

It has a different from previous versions file set:

-rw-r--r--    1 root     root           425 Dec 13 21:53 NSP_sn_bandwidth.xml
-rw-rw-rw-    1 1000     1000           606 Aug  9 06:17 NSP_trends_config_info.xml
drwxrwxrwx    2 1000     1000          4392 Oct 17 15:07 calib
-rw-r--r--    1 root     root           480 Dec 13 21:53 nsp_data_b


Contents of NSP_sn_bandwidth.xml:

<?xml version="1.0" encoding="UTF-8"?>
<sn_bw_root>
  <serial_number>
    <chip>SSA3XLBD2R1093</chip>
  </serial_number>
<license><_3021><lic>qp3jq3tm8hmyv4p2</lic></_3021><_TG><lic>zvj63iatp4enm6pn</lic></_TG><_tEMI><lic>gymq7rs258awp984</lic><remain>2810</remain></_tEMI><_tMeas><lic>st6ef9vw9q34pv6p</lic><r
emain>2810</remain></_tMeas><_tCAT><lic>cm2b22hhmi7kpui7</lic><remain>2810</remain></_tCAT></license></sn_bw_root>


contents of NSP_trends_config_info.xml:


<?xml version="1.0" encoding="UTF-8"?>
<nsp_trends_info_root>
      <device>
              <language>english</language>
              <pid>0x1300</pid>
              <vid>0xf4ec</vid>
              <product_type_1>SSA3032X</product_type_1>
              <product_type_2>SSA3030X</product_type_2>
              <product_type_3>SSA3021X</product_type_3>
              <product_type_4>SSA3018X</product_type_4>
              <product_type_5>SSA3015X</product_type_5>
              <product_type_6>SSA3010X</product_type_6>
              <manufacturer>Siglent</manufacturer>
              <Support_Touch_Flag>0</Support_Touch_Flag>     
              <Support_VXI11_Flag>1</Support_VXI11_Flag>
              <file_prefix>SSA_</file_prefix>
      </device>
</nsp_trends_info_root>


Does anyone have experience with this version? Can I mock around with these files and avoid bricking the device?

I have found one suggestion referencing file NSP_sn_bandwidth.xml: http://www.sonsivri.to/forum/index.php?PHPSESSID=k4bq3evsktigvsbiljac9r6ni2&topic=58738.msg189056#msg189056 (http://www.sonsivri.to/forum/index.php?PHPSESSID=k4bq3evsktigvsbiljac9r6ni2&topic=58738.msg189056#msg189056)

Basically it says to rename the files.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: miceuz on December 13, 2018, 04:18:17 pm
Sorry for the noise in the old thread, I can confirm that hack renaming files works on FW 1.2.9.a
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Dread on December 28, 2018, 01:41:01 am
I just ordered a 3021X and I am wading waist deep through this thread while waiting for it to arrive :scared:
I see a reference in the previous post to renaming the files for FW 1.2.9a and it works.  Can someone point me to that post as I have not seen it yet and has it worked for other people?

Also is the serial number issue been fixed or does it still disappear?

Thanks for any help.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: colorado.rob on December 28, 2018, 04:17:51 am
I finally got around to "upgrading" my SSA3021X today.  FW version 1.2.9.2a.  Everything went well.

I then attached an antenna to the RF input, plugged in my headphones, hit the "Demod" button, and used my very expensive FM radio to listen to the NPR newscast (US national public radio).  8)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: pri on December 30, 2018, 09:40:20 am
This info  is old!  ETA: (now I can see also @tv84 msg   ;)  )

You have lot of more new FW. Use more fresh info.
 
Example this https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1132969/#msg1132969 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1132969/#msg1132969)  look  "attached instructions"
But also after then later in thread you may find some bit more fresh info. (but still you can use this V05 as some kind of basic info.
Your SSA is much more new and there have not been installed older very different FW so there is perhaps not all files what are displayed in instrictions V05. They are perhaps some residues from older generation FW.

But, this instruction v05  is overall roughly ok  if you can detect what tiny differences there is (some obsolete files what are not there anymore when you look using ls command in your SSA. One reason is that  today all new SSA's have never updated from very old totally obsolete "generation 7 FW". All are generation 8 FW or later.  (also older SSA's are mostly HW version 07.03.00 and this 7 have nothing to do with this) So if there is some files what your system do not have, then just do not care these files.  Soon you find what is idea...
For commands, copypaste is your friend...

Finally I could do the hack following V05.
Now it's a 3.2GHz unit, no serial, options ALL permanent.
No 1Hz RBW though, my limit is still 10Hz.

Was anyone able to add the 1Hz on the new 1.2.9.2a firmware?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rfspezi on December 31, 2018, 10:29:12 am
Quote
Was anyone able to add the 1Hz on the new 1.2.9.2a firmware?

I am on 1.2.9.1 and don't get a valid measurement at 1Hz RBW either.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: analogRF on December 31, 2018, 02:14:11 pm
Quote
Was anyone able to add the 1Hz on the new 1.2.9.2a firmware?

I am on 1.2.9.1 and don't get a valid measurement at 1Hz RBW either.

I am also on 1.2.9.1 but at 1Hz RBW the unit is very very slow and the noise floor becomes a flat line
and the measurement is not reliable either. Even before the hack when it did have the official promotional licence for a while (before it expired)
the 1Hz RBW was the same, useless. Even the 3Hz is not working properly. Basically I can only use >=10Hz so you are not missing anything!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on December 31, 2018, 03:28:01 pm
Quote
Was anyone able to add the 1Hz on the new 1.2.9.2a firmware?

I am on 1.2.9.1 and don't get a valid measurement at 1Hz RBW either.

I am also on 1.2.9.1 but at 1Hz RBW the unit is very very slow and the noise floor becomes a flat line
and the measurement is not reliable either. Even before the hack when it did have the official promotional licence for a while (before it expired)
the 1Hz RBW was the same, useless. Even the 3Hz is not working properly. Basically I can only use >=10Hz so you are not missing anything!

Slow, yes it is. Here can find math.
https://www.siglenteu.com/application-note/spectrum-analyzer-basics-bandwidth/ (https://www.siglenteu.com/application-note/spectrum-analyzer-basics-bandwidth/)

Also if it helps there is available HP/Agilent/Keysight AN-150 for further readings.
http://literature.cdn.keysight.com/litweb/pdf/5952-0292.pdf (http://literature.cdn.keysight.com/litweb/pdf/5952-0292.pdf)

It is true that specially 1Hz RBW in Siglent this model have some limits and these are not specified. Originally there was not at all 1Hz and 3Hz RBW.  Some time later they give these free to all users for use. But there is some things based to hardware. (Imho, there are not enough "bits" in ADC and perhaps  ADC autoranging have some limiting factors in HW??. I suspect it have something to do with this. So, it can not "pull up" if there is not enough signal level. Some tiny possible indirect tip in Keysight AN-150 page 38 figure 3-3  )

Is it useless... no it is not. But user need understand some limits.

Here tiny examples SSA3021X (mod32X). Yes and FW is 1.2.9.2a   

Who can say it is useless when look these images. Carrier 118.7MHz, -30dBm, AM mod with 20Hz sine and modulation depth 2% (LSB and USB  -40dBc)

1Hz RBW and for compare same with 10Hz RBW 
(span 600Hz (2x minimum block, it is hopping 300Hz blocks in this case))

(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=609589;image)
RBW10Hz

(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=609595;image)
RBW 1Hz
Useless, really?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: analogRF on December 31, 2018, 05:47:51 pm
Quote
Was anyone able to add the 1Hz on the new 1.2.9.2a firmware?

I am on 1.2.9.1 and don't get a valid measurement at 1Hz RBW either.

I am also on 1.2.9.1 but at 1Hz RBW the unit is very very slow and the noise floor becomes a flat line
and the measurement is not reliable either. Even before the hack when it did have the official promotional licence for a while (before it expired)
the 1Hz RBW was the same, useless. Even the 3Hz is not working properly. Basically I can only use >=10Hz so you are not missing anything!

Slow, yes it is. Here can find math.
https://www.siglenteu.com/application-note/spectrum-analyzer-basics-bandwidth/ (https://www.siglenteu.com/application-note/spectrum-analyzer-basics-bandwidth/)

Also if it helps there is available HP/Agilent/Keysight AN-150 for further readings.
http://literature.cdn.keysight.com/litweb/pdf/5952-0292.pdf (http://literature.cdn.keysight.com/litweb/pdf/5952-0292.pdf)

It is true that specially 1Hz RBW in Siglent this model have some limits and these are not specified. Originally there was not at all 1Hz and 3Hz RBW.  Some time later they give these free to all users for use. But there is some things based to hardware. (Imho, there are not enough "bits" in ADC and perhaps  ADC autoranging have some limiting factors in HW??. I suspect it have something to do with this. So, it can not "pull up" if there is not enough signal level. Some tiny possible indirect tip in Keysight AN-150 page 38 figure 3-3  )

Is it useless... no it is not. But user need understand some limits.

Here tiny examples SSA3021X (mod32X). Yes and FW is 1.2.9.2a   

Who can say it is useless when look these images. Carrier 118.7MHz, -30dBm, AM mod with 20Hz sine and modulation depth 2% (LSB and USB  -40dBc)

1Hz RBW and for compare same with 10Hz RBW 
(span 600Hz (2x minimum block, it is hopping 300Hz blocks in this case))

(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=609589;image)
RBW10Hz

(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=609595;image)
RBW 1Hz
Useless, really?

very nice example. I just replicated it with my Anritsu MG3633A. The Siglent really struggles but it comes through  :-+
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: pe1oxp on January 04, 2019, 01:15:22 pm
Today I tried to upgrade the firmware of my SSA3021X to the newest version V1.2.9.2a.
After automatically rebooting there happens nothing, only the Siglent logo on the screen and the TG and Mode buttons are lighted.
I waited for about a hour but nothing happens. Probably the install went wrong?

Is there a way to restore?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: vt100 on January 04, 2019, 02:08:53 pm
Try the upgrade process again. I had the same issue. I powered off my scope, re-created my USB stick, and inserted it prior to powering up the scope. I then powered up the scope and it upgraded successfully the second time.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: pe1oxp on January 04, 2019, 02:20:16 pm
Try the upgrade process again. I had the same issue. I powered off my scope, re-created my USB stick, and inserted it prior to powering up the scope. I then powered up the scope and it upgraded successfully the second time.

I tried but still nothing happens.
Also no possibility to connect via LAN
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on January 05, 2019, 02:16:57 pm
Same thing happened to me.
Reflashing the root file system solved the issue. NAND flash is the problem.
To get rid of possible future problems I unsoldered the NAND chip, burnt a fresh one and soldered it back in. I experienced no problems in subsequent firmware updates.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: pe1oxp on January 05, 2019, 04:28:19 pm
Same thing happened to me.
Reflashing the root file system solved the issue. NAND flash is the problem.
To get rid of possible future problems I unsoldered the NAND chip, burnt a fresh one and soldered it back in. I experienced no problems in subsequent firmware updates.

Unfortunately no way to reflash, no connection possible.
According my supplier warranty, so I shipped it to them and will wait.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on January 05, 2019, 06:14:35 pm
Serial connection always works, and reflash in U-Boot.

Before doing all the things I mentioned before, also sent my device in for service under warranty. Jerks in Eindhoven accused me of having hacked my analyzer which, at the time, I had not done. They revoked my warranty. That's when I could blissfully remove the sticker and fire up the hot-air station and soldering iron.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Dread on January 12, 2019, 06:04:01 pm
Just got my SSA3021X and Wow am I happy with it  :-+
Best bang for the buck piece of test equipment I have ever bought.

Unfortunately I also seem to have a hardware revision and the latest software.

SW1: 1.2.9.a
SW2: 20180708-1
SW3: 000000E1
HW:  0C.03.00

So I am not sure any of these previous hacks will work.  If anybody tries it on the HW version please let me know.

Thanks
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: yo4hfu on January 13, 2019, 11:39:22 am
Unit just been hacked by renaming only "NSP_sn_bandwidth.xml" files located inside of "firmdata0" and "backup" folders.
 :) 3,2GHz and all options are enabled forever.

SW1: 1.2.9.a
SW2: 20180708-1
SW3: 000000E1
HW:  0C.03.00

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Dread on January 19, 2019, 08:44:51 am
Unit just been hacked by renaming only "NSP_sn_bandwidth.xml" files located inside of "firmdata0" and "backup" folders.
 :) 3,2GHz and all options are enabled forever.

SW1: 1.2.9.a
SW2: 20180708-1
SW3: 000000E1
HW:  0C.03.00

Interesting, has anyone else done it this way?

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: yo4hfu on January 19, 2019, 06:49:35 pm
Unit just been hacked by renaming only "NSP_sn_bandwidth.xml" files located inside of "firmdata0" and "backup" folders.
 :) 3,2GHz and all options are enabled forever.

SW1: 1.2.9.a
SW2: 20180708-1
SW3: 000000E1
HW:  0C.03.00

Interesting, has anyone else done it this way?




Yes, i can confirm that. Few days ago other ham radio from EA7 succeed to hack same SSA version using above procedure.

EA7 feedback: "Already done it. Have all options with valid permanent, spans to 3.2 GHz, and RWB shows on narrow spans minimum 1 Hz, super!"

Please contact me if you have any doubt. Robert, yo4hfu
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Dread on January 21, 2019, 08:35:38 pm
Unit just been hacked by renaming only "NSP_sn_bandwidth.xml" files located inside of "firmdata0" and "backup" folders.
 :) 3,2GHz and all options are enabled forever.

SW1: 1.2.9.a
SW2: 20180708-1
SW3: 000000E1
HW:  0C.03.00

Interesting, has anyone else done it this way?




Yes, i can confirm that. Few days ago other ham radio from EA7 succeed to hack same SSA version using above procedure.

EA7 feedback: "Already done it. Have all options with valid permanent, spans to 3.2 GHz, and RWB shows on narrow spans minimum 1 Hz, super!"

Please contact me if you have any doubt. Robert, yo4hfu

Hey Robert I sent you an email to your Yahoo account.  Thanks for getting back to me with that information.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: yo4hfu on January 21, 2019, 10:31:29 pm
Good luck! Ask if you have something unclear.

This is my procedure (Microsoft Word .docx file). Nothing new inside, all instructions are according Eevblog forum. It is not my contribution.

73 de Robert

LE 24.01.2019
READ V05 TXT FILE BEFORE ANY HACKING ATTEMPT! Use my docx file only if you are very familiar with linux language.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Johncanfield on January 22, 2019, 02:08:45 am
Today I tried to upgrade the firmware of my SSA3021X to the newest version V1.2.9.2a.
After automatically rebooting there happens nothing, only the Siglent logo on the screen and the TG and Mode buttons are lighted.
I waited for about a hour but nothing happens. Probably the install went wrong?

Is there a way to restore?
The exact thing happened when I tried to upgrade a couple of months ago. Fortunately my unit is under warranty and Siglent America reflashed it.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Dread on January 23, 2019, 12:03:09 am
Good luck! Ask if you have something unclear.

This is my procedure (Microsoft Word .docx file). Nothing new inside, all instructions are according Eevblog forum. It is not my contribution.

73 de Robert

Robert Thanks so much for the great document. It explains it in a way that makes it very easy.
I emailed you because I think that there is one problem.  It does not seem to remove the NSP_np_Bandwidth.xml file.  It just makes a copy with the x added to the end of the name and I end up with the two files in the directory.  This means that nothing changes, the unit operates as it did before the attempt.   The backup folder just has only the X copy in it.

73s
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: yo4hfu on January 23, 2019, 05:52:08 am
Good luck! Ask if you have something unclear.

This is my procedure (Microsoft Word .docx file). Nothing new inside, all instructions are according Eevblog forum. It is not my contribution.

73 de Robert

Robert Thanks so much for the great document. It explains it in a way that makes it very easy.
I emailed you because I think that there is one problem.  It does not seem to remove the NSP_np_Bandwidth.xml file.  It just makes a copy with the x added to the end of the name and I end up with the two files in the directory.  This means that nothing changes, the unit operates as it did before the attempt.   The backup folder just has only the X copy in it.

73s

Indeed, you still have old bandwidth file inside of firmdata0 and i don't why... I'm quite sure, similar issue was reported in the past by other eevblog user (LE: #370...#377).
Please check my email reply. There you have the instruction for how to delete "NSP_sn_Bandwidth.xml" located inside of "Firmdata0".


Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on January 23, 2019, 06:41:14 am
Good luck! Ask if you have something unclear.

This is my procedure (Microsoft Word .docx file). Nothing new inside, all instructions are according Eevblog forum. It is not my contribution.

73 de Robert

Robert Thanks so much for the great document. It explains it in a way that makes it very easy.
I emailed you because I think that there is one problem.  It does not seem to remove the NSP_np_Bandwidth.xml file.  It just makes a copy with the x added to the end of the name and I end up with the two files in the directory.  This means that nothing changes, the unit operates as it did before the attempt.   The backup folder just has only the X copy in it.

73s


If you see there
NSP_np_Bandwidth.xml   then something have gone totally wrong,  b and B are not same in real operating systems.


------------

(I give also warning about this microsoft total junk crap story writing program Word.  Who is programmer who even think to use this kind of total junk. There is text handling programs what do not mess anything, like example notepad++  and of course also others. Even windows Notepad is better than this total junk Word for programs (and other things where we need plain text without hidden control character and other messy things what is more like made for artists than programmers.)

Example if I wrongly open this docx  and take copy (copypaste) from this docx  and then paste it here,  after then it is NSP_sn_Bandwidth.xml.

It is also explained original but very old V05 (1) instructions what can find somewhere (even when it have some residues from older times but today we do not meet anymore new SSA's what have been pre installed generation 7 FW and then changed to 8 etc... )


(1) I mean this V05 (clip from start of it):
Quote
* Some experimental instructions for SSA30??X
*
* This is ONLY FOR SSA30??X running original FW 1.2.8.1  ( P08.01 )
*
* IF YOUR SYSTEM IS NOT THIS VERSION - EXIT NOW
*
*********************************************************************************
*********************************************************************************
*
*
* Status: Preliminary V0.5
* Author: Li Xiu Ying
* Date:   1888-08-08
*
* This document is best read using fixed spacing fonts, example: Consolas or FixedSys
* If you use Windows, please open this document using example windows Notepad, WordWrap turned OFF.
*
*
* IF you are familiar with UNIX, Kylin, NeoKylin or Linux systems no need read all. You can now jump
* directly to CHAPTER 8. There all is compressed without any boring comments.
*
* After V0.3
*
* V0.4    Removed Chapter 2.
*
* V0.5    Add instructions and notes what to do with some file names
*         which are possibly missing in some SSA's

<clip>


Let's hope some day we get next revised and updated edition!



Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: yo4hfu on January 23, 2019, 07:05:08 am
I'm quite sure it's just a typing mistake here on forum thread.
Dread sent me next snapshot of his SSA Firmdata0 content and both files seem to be OK. He made a new backup in order to check the files...
Of course is more better to check the files using telnet and V05 instructions!

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on January 23, 2019, 09:31:48 am
And what happen with
NSP_trends_config_info.xml

is it now original or system self made dummy version as it goes in older times.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Dread on January 23, 2019, 09:49:05 pm
And what happen with
NSP_trends_config_info.xml

is it now original or system self made dummy version as it goes in older times.

Man you guys are making me nervous.   I have always kind of stayed away from Linux which was a mistake but anyway I know very little about Linux.  I did some reading and was able to navigate to the directory and try to remove the "NSP_sn_bandwidth.xml" located inside of "Firmdata0 using the "rm" command and I got back a message saying it's read only and cannot be deleted.  So I guess it has something to do with the mounting of the file or the directory.  I am not sure how to proceed so I am waiting to see if anyone can help.

Thanks
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Dread on January 23, 2019, 10:10:46 pm
OK I got it working :phew:  I am now at 3.2GHZ with all Lic options now permanent.
I looked back on page 22 of this thread and saw the command for mounting the directory in RW mode.

"mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0"

So now I was able to remove the file.

Should I leave it in R/W mode or should I revert it back to read only?
Also for future users does anybody have any idea why this did not work right the first time and it left behind the file?

Thanks again for all the help guys.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on January 23, 2019, 10:28:22 pm
And what happen with
NSP_trends_config_info.xml

is it now original or system self made dummy version as it goes in older times.

Man you guys are making me nervous.   I have always kind of stayed away from Linux which was a mistake but anyway I know very little about Linux.  I did some reading and was able to navigate to the directory and try to remove the "NSP_sn_bandwidth.xml" located inside of "Firmdata0 using the "rm" command and I got back a message saying it's read only and cannot be deleted.  So I guess it has something to do with the mounting of the file or the directory.  I am not sure how to proceed so I am waiting to see if anyone can help.

Thanks

Quote
I did some reading and was able to navigate to the directory and try to remove the "NSP_sn_bandwidth.xml" located inside of "Firmdata0 using the "rm" command and I got back a message saying it's read only and cannot be deleted.

I will recommend Nintendo. If you guess wrong you can always start a new game without losing anything but perhaps most valued thing what exist - time.
Playing inside  SSA  system is as elephant is in porcelain store.  Nice thing is that system is least even somehow protected.
 ;)

EDit:

Oh now I can see, removed. Why removed? What a heck is idea to remove something.
Rename is your 1st friend.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Dread on January 24, 2019, 12:50:29 am
I will recommend Nintendo. If you guess wrong you can always start a new game without losing anything but perhaps most valued thing what exist - time.
Playing inside  SSA  system is as elephant is in porcelain store.  Nice thing is that system is least even somehow protected.
 ;)

EDit:

Oh now I can see, removed. Why removed? What a heck is idea to remove something.
Rename is your 1st friend.

I had it backed onto the USB stick and now my NAS drives so I think I am safe removing the file.
When I said remove BTW I meant the original and just leave the one that ended with X.

YO4HFU was really a great help with this, he actually had sent me an email to fix the issue but for some reason the email system stripped the attachment.  I found it after I had already fixed the problem.

Your right about playing with Nintendos rather than a SA for the first time out.  I typically proceed very cautiously when I am using a programming languages or OS I am not versed in.  Even if I see a solution by one person I look up the command to make sure the syntax and application are correct before using it.

As for the Analyzer, I am loving it now even more than before.  There is just something about being able to play around with it and not have those dam timers ticking down!  I really wish that companies would start the timer when you are actually using that feature and only on that feature.  It would be better to give me 10 hours of real usage time then 48 hours that starts the moment I power the machine.  Anyway it's great to feel like a bird set free !

Thanks to all that helped, especially YO4HFU and you rf-loop.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: yo4hfu on January 24, 2019, 09:08:20 am
Well done Dread!

Something was wrong during your first attempt. Maybe "mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0"  operation was not correctly done and one more file has born by renaming of "NSP_sn_Bandwidth". The solution was to delete "NSP_sn_Bandwidth" and to keep "NSP_sn_Bandwidthx".

Conclusion:
- SSA3021x [SW1: 1.2.9.a; SW2: 20180708-1; SW3: 000000E1; HW:  0C.03.00] can be hacked be renaming only the "NSP_sn_Bandwidth" files.
- Read "V05" txt file in order to be familiar with Linux commands.

Regards,
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: nomadd on January 24, 2019, 08:02:56 pm
Rename is your 1st friend.

Actually..

"cp" is your first friend.
"mv" is your second friend.
"tar" is your best friend.

And "rename"? Crazy foreign talk. :)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: creas002 on January 30, 2019, 12:00:56 am
Hi all
  This thread has gotten pretty long over the last 2 years. I read 20ish pages of the 25 and received my new SSA3021 yesterday and profiled a couple of bandpass filters to get familiar with options and functionality/use.

I thought I was ready to mod and familiar with many OS's, so I set out to perform the mod and now telnet connections are refused. Thought I would try telnet/ssl, ssh1 and ssh2 thinking they may have locked down telnet and running an ssh daemon, but no luck.

My device is :

Model SSA3021X

SW1 1.2.9.2.a
SW2 20180708-1
SW3 000000E1
HW  0C.03.00

EMI, AMK and Refl are temporarily enabled for 44 hours remaining and TG permanently enabled

I intended to perform the following:

Part 1 - Backup files

1. Insert USB stick
2. Go in System => System info
3. Establish a telnet session with root/ding1234
4. cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
5. cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
8. sync
9. logout

Part 2 - Perform hack
 
1. Establish a telnet session with root/ding1234
2. mv /usr/bin/siglent/firmdata0/NSP_sn_bandwidth.xml /usr/bin/siglent/firmdata0/NSP_sn_bandwidthx.xml
3. mv /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup/NSP_sn_bandwidth.xml  /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup/NSP_sn_bandwidthx.xml
4. sync
5. logout
6. Soft power cycle (power off and power on with button "power")
7. Go in System => Pwr On/Preset => Reset & Clear => Enter
8. Soft power cycle (power off and power on with button "power")

But I mistaking performed the following instead:

Part 1 - Backup files

1. Insert USB stick
2. Go in System => System info
3. Establish a telnet session with root/ding1234
4. cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
5. cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
8. sync
9. Soft power cycle (power off and power on with button "power")  <--  |O
10. Go in System => Pwr On/Preset => Reset & Clear => Enter  <--  |O
11. Soft power cycle (power off and power on with button "power") <--  |O
12. logout

Part 2 - Perform hack
 
1. Establish a telnet session with root/ding1234   <-- Now refusing connections   :--

Please advise if there is anyway I can undo the damage as I'm not able to telnet in anymore. I wonder if performing a factory reset would resolve issue or trash my license and halt all operations.

SSA is still fully functioning, I’m just unable to telnet in and rename the bandwidth files to perform the mod.

Thank you
Rich
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: kahuna0k on January 30, 2019, 01:26:09 am
What you did couldn't break anything, make sure that the SSA network connection is enabled and the IP address is still the same .
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: creas002 on January 30, 2019, 01:45:34 am
I checked the IP address and it had change do a different subnet, so I assigned a static IP as I do everything and verified it worked. The refused connection is from the SSA. So it is responding and never prompts for a username.  In my experience with rebooting servers this message it normal when all the services for that run level are still starting and the daemon does not accept new connections until some other dependency is meet. Normally it is another service at that run level that is still starting.

Good idea, but IP address, netmask and gateway are not the cause of the refused connection in my case.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: analogRF on January 30, 2019, 02:05:29 am
I checked the IP address and it had change do a different subnet, so I assigned a static IP as I do everything and verified it worked. The refused connection is from the SSA. So it is responding and never prompts for a username.  In my experience with rebooting servers this message it normal when all the services for that run level are still starting and the daemon does not accept new connections until some other dependency is meet. Normally it is another service at that run level that is still starting.

Good idea, but IP address, netmask and gateway are not the cause of the refused connection in my case.

I also don't think you have damaged anything and the reason must be something else. I just didn't figure out how you did "logout" in step 12 after two power cycles?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: creas002 on January 30, 2019, 02:10:37 am
Good catch, logout was done before 2 power cycles.  I copied intended instructions down and merge the unintended power cycle steps before the logout and should have been pasted after it.

My fear is that the reset/clear removed some key data or file that is needed for all the services to start and allow the telnet to start accepting connections.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: BillB on January 30, 2019, 02:11:34 am
I checked the IP address and it had change do a different subnet, so I assigned a static IP as I do everything and verified it worked. The refused connection is from the SSA.
So, the SSA does respond to a ping at the static address you expect?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: creas002 on January 30, 2019, 02:13:04 am
Yes, it pings instantly
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: analogRF on January 30, 2019, 02:13:46 am
I checked the IP address and it had change do a different subnet, so I assigned a static IP as I do everything and verified it worked. The refused connection is from the SSA.
So, the SSA does respond to a ping at the static address you expect?

I was just going to ask exactly the same thing!
and does the SA work normally (except the telnet issue)?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: creas002 on January 30, 2019, 02:16:13 am
Yes, the SSA seems to be in perfect health otherwise. Thank goodness.

Telnet session to SSA gets a response of -->  "The remote system refused the connection."

I’ve scared myself at this point and afraid to try resetting to factory settings

** Update - I decided to try Pwr On/Present/Factory Reset and the only change I can tell is it went back to static IP with a dot 10 class IP assignment. I switched back to DHCP and pings promptly and same telnet "The remote system refused the connection." message.  I did 3 Pwr On/Present/Factory Reset with a power cycle between each thinking it may implement some sort of poor mans registry and swap previous setting back in. Nada, problem has not changed.

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: BillB on January 30, 2019, 02:23:54 am
Which telnet application?  OS?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: creas002 on January 30, 2019, 02:31:25 am
Windows 10
SecureCRT 6.7
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: MavMitchell on January 30, 2019, 04:18:08 am
Use a port scanner to see if the telnet port has changed!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on January 30, 2019, 07:58:42 am
Just use putty or even Windows own telnet command.
100% sure you are doing something wrong as you could not have changed root password by mistake.

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: creas002 on January 30, 2019, 08:40:21 am
Hi Vitor
  Its the little stuff that can get you. I have putty but was so confident in SecureCRT as I've used it for  ~25 years that I thought there is no way. Well guess what, yes way!

Putty worked like a charm and I performed the mod and all options are permanently and it now reports as a SSA3032x with X's for a serial number.

Here is the updated steps:

Model SSA3021X

SW1 1.2.9.2.a
SW2 20180708-1
SW3 000000E1
HW  0C.03.00

Part 1 - Backup files

1. Insert USB stick
2. Go in System => System info
3. Establish a telnet session with root/ding1234
4. cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
5. cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
8. sync
9. logout

Part 2 - Perform hack
 
1. Establish a telnet session with root/ding1234
2. mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
2. mv /usr/bin/siglent/firmdata0/NSP_sn_bandwidth.xml /usr/bin/siglent/firmdata0/NSP_sn_bandwidthx.xml
3. mv /usr/bin/siglent/usr/backup/NSP_sn_bandwidth.xml  /usr/bin/siglent/usr/backup/NSP_sn_bandwidthx.xml
4. sync
5. logout
6. Soft power cycle (power off and power on with button "power")
7. Go in System => Pwr On/Preset => Reset & Clear => Enter  # Wait for SSA to complete the erase and it will reboot on its on
8. Soft power cycle (power off and power on with button "power")

Regards to all and all the suggestions were very much appreciated

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: gorillamotors on February 16, 2019, 10:32:26 pm
I just ordered a Siglent SSA3021X with 2.1 tracking generator for $948 brand new with free shipping from Amazon. I had to triple check everything to make sure but yes.

Here is the link https://www.amazon.com/Siglent-SSA3021X-Spectrum-Analyzer-9KHz-2-1GHz/dp/B01N6M4UNQ/ref=sr_1_fkmrnull_9?hvadid=316076274941&hvdev=c&hvlocphy=9012068&hvnetw=g&hvpos=1t3&hvqmt=e&hvrand=16359178291538897281&hvtargid=kwd-316747328064&keywords=siglent+ssa3021x&qid=1550356053&s=gateway&sr=8-9-fkmrnull&tag=googhydr-20 (https://www.amazon.com/Siglent-SSA3021X-Spectrum-Analyzer-9KHz-2-1GHz/dp/B01N6M4UNQ/ref=sr_1_fkmrnull_9?hvadid=316076274941&hvdev=c&hvlocphy=9012068&hvnetw=g&hvpos=1t3&hvqmt=e&hvrand=16359178291538897281&hvtargid=kwd-316747328064&keywords=siglent+ssa3021x&qid=1550356053&s=gateway&sr=8-9-fkmrnull&tag=googhydr-20)

Let me know if I screwed up on this.

Jim
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: BillB on February 16, 2019, 11:15:15 pm
I just ordered a Siglent SSA3021X with 2.1 tracking generator for $948 brand new with free shipping from Amazon. I had to triple check everything to make sure but yes.

Let me know if I screwed up on this.

Jim

Hey Jim, that seems like a great price.  The description indicates that the TG function is optional, but I believe it is included for free now (as it says in the title of the Item page you linked), as well as the lower RBW.  Might just be old marketing copy, as they are just software changes.  As long as the seller is legit, looks like you got a nice deal (especially if you plan to "upgrade" it).

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: gorillamotors on February 17, 2019, 08:48:13 am
I thought it was too good to be true. Amazon just cancelled it. I assume it was an old ad.

Jim
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Dread on February 23, 2019, 09:09:50 am
I thought it was too good to be true. Amazon just cancelled it. I assume it was an old ad.

Jim

You got lucky, it was more likely an unscrupulous third party seller and Amazon cut them off.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: videobruce on February 23, 2019, 01:44:12 pm
I would also add, it probably won't be covered under Siglents warranty.  ;)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: luc-on7kz on March 06, 2019, 08:25:05 am
Hello,
a time ago my SSA3021 was not starting up, just the screen from siglent and stopped. Entry via telnet was still possible
I have placed a few file's back from a backup that I have make before the hack of the SSA3021 and all worked fine again.
now 6 monds later again the same problem.
who can give me the list with files/sub. that are into
/usr/bin/siglent/usr/backup
/usr/bin/siglent/firmdata0
via the telnet must it be possible to readout these list "ls -al"
if some one have a new not hacked SSA3021 it will be interesting me to see what is in there
thanks into advance,
Greetings Luc, ON7KZ
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Jester on March 11, 2019, 08:36:52 pm
Hi,

I have an early  (2016) vintage SSA3021X. It was "upgraded" as per this thread in 2016; EMI, AMK, TG, Refl all display as Permanent

I see there is now 25 pages of updates, and I'm not sure if it's "safe" to attempt to load the latest firmware from Siglent without risking either bricking it or loosing the previous enhancements?

SW1 100.01.02.07.07
SW2 20160606-2
SW3 000000D1
HW 07.03.00

Is it safe to upgrade or should I leave it as is?

If it's safe where can I find the latest procedure?

Thanks
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on March 11, 2019, 08:42:47 pm
Hi,

I have an early  (2016) vintage SSA3021X. It was "upgraded" as per this thread in 2016; EMI, AMK, TG, Refl all display as Permanent

I see there is now 25 pages of updates, and I'm not sure if it's "safe" to attempt to load the latest firmware from Siglent without risking either bricking it or loosing the previous enhancements?

SW1 100.01.02.07.07
SW2 20160606-2
SW3 000000D1
HW 07.03.00

Is it safe to upgrade or should I leave it as is?

If it's safe where can I find the latest procedure?

Thanks
Let the FW release notes give you some guidance on what has been changed and what you might be missing out on.
You can read them here:
https://www.siglentamerica.com/wp-content/uploads/2019/02/SSA3000X-Firmware-Revise-History-Update-Instructions_V2.pdf (https://www.siglentamerica.com/wp-content/uploads/2019/02/SSA3000X-Firmware-Revise-History-Update-Instructions_V2.pdf)

TG is now free with new units and should've been activated in one of the FW releases.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: cracklincrotch on March 14, 2019, 07:20:53 pm
Hi Vitor
  Its the little stuff that can get you. I have putty but was so confident in SecureCRT as I've used it for  ~25 years that I thought there is no way. Well guess what, yes way!

Putty worked like a charm and I performed the mod and all options are permanently and it now reports as a SSA3032x with X's for a serial number.

Here is the updated steps:

Model SSA3021X

SW1 1.2.9.2.a
SW2 20180708-1
SW3 000000E1
HW  0C.03.00

Part 1 - Backup files

1. Insert USB stick
2. Go in System => System info
3. Establish a telnet session with root/ding1234
4. cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
5. cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
8. sync
9. logout

Part 2 - Perform hack
 
1. Establish a telnet session with root/ding1234
2. mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
2. mv /usr/bin/siglent/firmdata0/NSP_sn_bandwidth.xml /usr/bin/siglent/firmdata0/NSP_sn_bandwidthx.xml
3. mv /usr/bin/siglent/usr/backup/NSP_sn_bandwidth.xml  /usr/bin/siglent/usr/backup/NSP_sn_bandwidthx.xml
4. sync
5. logout
6. Soft power cycle (power off and power on with button "power")
7. Go in System => Pwr On/Preset => Reset & Clear => Enter  # Wait for SSA to complete the erase and it will reboot on its on
8. Soft power cycle (power off and power on with button "power")

Regards to all and all the suggestions were very much appreciated

Worked flawlessly here!  Thank you!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: KenGaler on March 18, 2019, 07:15:08 pm
Hi Vitor
  Its the little stuff that can get you. I have putty but was so confident in SecureCRT as I've used it for  ~25 years that I thought there is no way. Well guess what, yes way!

Putty worked like a charm and I performed the mod and all options are permanently and it now reports as a SSA3032x with X's for a serial number.

Here is the updated steps:

Model SSA3021X

SW1 1.2.9.2.a
SW2 20180708-1
SW3 000000E1
HW  0C.03.00

Part 1 - Backup files

1. Insert USB stick
2. Go in System => System info
3. Establish a telnet session with root/ding1234
4. cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
5. cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
8. sync
9. logout

Part 2 - Perform hack
 
1. Establish a telnet session with root/ding1234
2. mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
2. mv /usr/bin/siglent/firmdata0/NSP_sn_bandwidth.xml /usr/bin/siglent/firmdata0/NSP_sn_bandwidthx.xml
3. mv /usr/bin/siglent/usr/backup/NSP_sn_bandwidth.xml  /usr/bin/siglent/usr/backup/NSP_sn_bandwidthx.xml
4. sync
5. logout
6. Soft power cycle (power off and power on with button "power")
7. Go in System => Pwr On/Preset => Reset & Clear => Enter  # Wait for SSA to complete the erase and it will reboot on its on
8. Soft power cycle (power off and power on with button "power")

Regards to all and all the suggestions were very much appreciated


This worked for me also. !! 
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: NickNacl on April 04, 2019, 09:36:10 pm
Anyone know if these hack are working with 0F.03.00 ?
SW1 Version 1.2.9.2.a

I have just got one of these and would like the feature also.
regards

Nick
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TOWERSIGNALS on April 09, 2019, 03:10:59 pm
I have an SSA3021 that I would like to "open up" but have no Linux experience and worry I might turn it into an expensive brick.
I've got a couple of tutorials on Linux and PuTTY but I'm proceeding cautiously. I know what format C: does for Windows....
Is there anyone in the Little Rock, Arkansas or the Springfield, Missouri area that could help me with this ?
Thanks.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Dread on April 11, 2019, 05:16:18 am
I have very little Linux experience and it worked for me.  If you follow the steps that have been outlined it's pretty easy.  I doubt you will brick the unit but if your really that worried maybe somebody on the forum might be able to use teamviewer and do it remotely.

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TOWERSIGNALS on April 11, 2019, 05:57:04 pm
Well that's good to hear. I'll practice some more with PuTTY and Telnet on a little Windows notebook and then see if I can work up my nerve. I suppose the really big item is to copy the original files in case of a problem. I have the latest firmware (I think) SSA3000X_v1.2.9.2a_V2.zip as well as the earlier versions going back a couple of years. Did you install all the updates before the Telnet session and do you still have the 10Hz resolution ?
    When they came out with the free TG option I called them and they did give me a code to make that option permanent. I have yet to try that install but suppose it would be a good place to start. The menu is not very intuitive but will work through it....
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: NickNacl on April 12, 2019, 11:01:42 pm
Any info on the OF hardware and if this works.?

I can telnet into the system into root OK.

I just don't want to change anything that may upset anything in it.

so some help would be totally appreciated if possible.

Thank in advance.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: NickNacl on April 13, 2019, 08:10:46 am

Anyone modified this version?
Can it be done, it's the new Hardware Version 0F.
Screen shot if anyone can help
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: NickNacl on April 13, 2019, 12:01:19 pm
Or does it actually matter about the HW Version, and it's just the SW version thats involved ?

Maybe this is why I am being ignored, because it's so simple.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: NickNacl on April 13, 2019, 12:51:12 pm
Many thanks for all the help and replies>

Just for the record, and to help anyone else out there who is effectively "ON THEIR OWN"

It does work.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dirtcooker on April 16, 2019, 10:37:21 pm
Yes, that worked for me. I have
SW1: 1.2.9.a
SW2: 20180708-1
SW3: 000000E1
HW:  0F.03.00

However, if I do a System => Pwr On/Preset => Reset & Clear => Enter, the machine resets itself to an SSA3021X and options are temporary (except for TG which is permanent)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: NickNacl on April 17, 2019, 03:36:29 pm
doesnt with mine, I do it regularly as I twiddle with things and the only way to get them back is with a reset/clear
I'll just go test now, to see if it is still ok
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: NickNacl on April 17, 2019, 03:45:24 pm
Yep, just tried it, it's still there. I video'd it but it was too big to upload.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TOWERSIGNALS on April 18, 2019, 01:06:04 pm
I have yet to "open up" mine which is an earlier 2017 version and I have not updated any of the firmware. Does your display still show the serial number as xxxxxx's or does the original number reload? I'm wondering if it can be restored to the factory shipped condition if the original files are reloaded. That way if it needed to be returned for repairs the factory should accept it.  Thanks.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on April 18, 2019, 03:40:48 pm
@TOWERSIGNALS - if your F/W is 7.07 or earlier, please make sure to follow the "improvement" instructions attached to this post (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998366/#msg998366) before updating the firmware. Upon update to 8.xx, this will generate "official" keys and your serial number will survive and the "hack" cannot be removed by future firmware updates. If your firmware is >= 8.xx, just go ahead and modify the instrument as described in the more recent instructions.
Good luck and all the best,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TOWERSIGNALS on April 19, 2019, 02:01:32 pm
Thanks Thomas. I downloaded your zip file and saved it to my laptop SSA3021 folder. My SSA 3021 serial number has a letter preceding just four numbers at the end. Not five numbers - maybe that is normal.  It's an SSA3021 model from 2017 so I'm sure I do not have the FW 8.xx version. Most all my work is below 1 GHz so it's the added features that are more valuable right now than the extra bandwidth.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: arturfra on April 29, 2019, 12:13:44 pm
My ssa3021 had 7.07 fw but i upgraded to v8 and hacked so i lost the serial number, is there a procedure to return to 7.0.7 and apply the new hack procedure described by Thomas? If yes what is the correct path step to step, thanks in advance
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on April 29, 2019, 03:21:56 pm
My ssa3021 had 7.07 fw but i upgraded to v8 and hacked so i lost the serial number, is there a procedure to return to 7.0.7 and apply the new hack procedure described by Thomas? If yes what is the correct path step to step, thanks in advance

There's no (easy way for) going back. It's just not worthy it! You would have to repartition the NAND, etc, etc

If you want to recover the S/N, remove the hack. It's simple.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ShaneEEV on May 01, 2019, 04:24:03 am
TV84,

How does one "remove the hack"? ( I can see logging-in and copying the backed-up files back to the operating files. Perhaps you meant that?

I performed the upgrade on my new SSA3021X, but I see my SN has been 'X'd out.

Any way to get the feature set and retain the proper serial number?

Thanks, in advance!

Shane
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on May 01, 2019, 11:08:06 am
You can reinsert the S/N via SCPI.

Try something like

:SRLN <serial_num>

(I don't remember if this is the right command for the SSA but should be here in the forum...)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ShaneEEV on May 02, 2019, 04:03:38 am
Thank you, TV84. I don't seem to.be able to get an http session with the SA at this time.

I found a manual on the SCPI commands for the SA, but I don't see any command that allows configuring the S/N for the SA.

Best Regards,
Shane
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on May 02, 2019, 05:39:43 am
Thank you, TV84. I don't seem to.be able to get an http session with the SA at this time.

I found a manual on the SCPI commands for the SA, but I don't see any command that allows configuring the S/N for the SA.

Best Regards,
Shane
Of course, it's a hidden undocumented command.

From P7 of the programming manual:
https://www.siglentamerica.com/wp-content/uploads/dlm_uploads/2017/10/SSA3000X_ProgrammingGuide_PG0703X_E04A.pdf (https://www.siglentamerica.com/wp-content/uploads/dlm_uploads/2017/10/SSA3000X_ProgrammingGuide_PG0703X_E04A.pdf)
Telnet mode. The telnet SCPI service is available on port 5024.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TTH on May 05, 2019, 12:32:40 pm
TV84 is correct:

:SRLN <serial_num>

... is the correct SCPI command to set the serial number (note the space after :SRLN)

Thanks to TV84 :)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ShaneEEV on May 06, 2019, 12:57:29 am
Thank you TauTech and TTH!

I have successfully logged-in as you suggested, but I'm having difficulty getting the SN set.

I have tried:

:SLRN SSA3XABC1t2682

:SYST:SLRN SSA3XABC1t2682

:SYSTCONF:SYST:SLRN SSA3XABC1t2682 (Number changed to protect the innocent)

Nothing seems to set the serial number... Should I enter some sort of save command to fix the change into the SSA???

I skimmed through the manual- perhaps I missed the details???

Your hints are very helpful!

Thank you, again!
Shane
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on May 06, 2019, 01:18:00 am
I have successfully logged-in as you suggested, but I'm having difficulty getting the SN set.
Sanity check *IDN?
Does this return the correct answer ?

For SCPI it's always a good idea to prove you have a valid connection first.....especially if you're a programming novice like me.  :-[
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ShaneEEV on May 06, 2019, 02:38:50 am
Hi TauTech,

Yes, *IDN? returns the scope model and SNXXXXXXXXXX, 1.2.9.2.a
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on May 06, 2019, 02:58:32 am
Hi TauTech,

Yes, *IDN? returns the scope model and SNXXXXXXXXXX, 1.2.9.2.a
See the little 't' in your SN# ? That doesn't look right to me. Double triple check it belongs there.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ShaneEEV on May 06, 2019, 03:43:52 am
That's not the real SN of my SSA. When I do the *IDN? I get all X's for the SN.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on May 06, 2019, 04:00:06 am
That's not the real SN of my SSA.
Yes I know but it should be SSA3X***#R####
Quote
When I do the *IDN? I get all X's for the SN.
Yes, when they are hacked XXX...... is the SN#.

Someone here will pop by and rescue you.  :)
They go just fine without a SN# so no need to worry unduly.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: ShaneEEV on May 06, 2019, 04:05:38 am
Tautech-

Thank you- my SSA has the SN of this form:
SSA3X***2R####

I hope to be rescued! Ha ha! It would be good to put the SN right, even though it doesn't affect the function of the analyzer.

I appreciate your kind replies!

Best Regards,
Shane
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Emo on May 06, 2019, 06:26:22 am
Thank you TauTech and TTH!

I have successfully logged-in as you suggested, but I'm having difficulty getting the SN set.

I have tried:

:SLRN SSA3XABC1t2682

:SYST:SLRN SSA3XABC1t2682

:SYSTCONF:SYST:SLRN SSA3XABC1t2682 (Number changed to protect the innocent)

Nothing seems to set the serial number... Should I enter some sort of save command to fix the change into the SSA???

I skimmed through the manual- perhaps I missed the details???

Your hints are very helpful!

Thank you, again!
Shane

Just for the record and for others that might want to use this method.
In your SCPI commands you seem to have made a typo; :SLRN, should be :SRLN
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rf-loop on May 06, 2019, 06:58:47 am
Thank you TauTech and TTH!

I have successfully logged-in as you suggested, but I'm having difficulty getting the SN set.

I have tried:

:SLRN SSA3XABC1t2682

:SYST:SLRN SSA3XABC1t2682

:SYSTCONF:SYST:SLRN SSA3XABC1t2682 (Number changed to protect the innocent)

Nothing seems to set the serial number... Should I enter some sort of save command to fix the change into the SSA???

I skimmed through the manual- perhaps I missed the details???

Your hints are very helpful!

Thank you, again!
Shane

Just for the record and for others that might want to use this method.
In your SCPI commands you seem to have made a typo; :SLRN, should be :SRLN

Also, regardless of whether it worked or not. Until today, I have not seen Siglent serial numbers what include other than capital letters and numbers.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on May 06, 2019, 08:54:53 am
It's been a long time but I think when you force the S/N to be the one you want with the SCPI command, you automatically disable the hack that most people use.

After activated, if I remember correctly, the hack works by checking if the S/N is XXXXXXXXX.

But I could be wrong...
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TTH on May 07, 2019, 02:38:46 pm
TV84 is correct:
The SCPI command
:SRLN SSA3X*********
... changes the serial number
... but results in the creation of a new NSP_sn_bandwidth.xml file (and backup)
... populated with  the serial number - but no option licence keys : (
It does appear that you have to live with the XXX serial number if you want all the options.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on May 07, 2019, 05:49:22 pm
TV84 is correct:
The SCPI command
:SRLN SSA3X*********
... changes the serial number
... but results in the creation of a new NSP_sn_bandwidth.xml file (and backup)
... populated with  the serial number - but no option licence keys : (
It does appear that you have to live with the XXX serial number if you want all the options.

It looks like Alzheimer hasn't catch me yet...  I had this idea from what I saw in my code analysis although I didn't asked nobody to test. Now it's confirmed!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Pinkus on May 08, 2019, 07:54:36 am
However, there is one drawback: AFAIR, Siglents software EasySpectrum will not work without the serial number. If you would like to use the analyzer for doing pre-compliance measurements, the software saves a lot of time and makes things much easier.
However: I cannot test/confirm this, as my unit does have serial number and all options. Maybe somebody can double check this.
But I am pretty sure that EasySpectrum was very sensitive about the connected analyzer.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TTH on May 29, 2019, 08:08:51 pm
Easy Spectrum functionality works (both Monitor and EMI) with Serial XXXXXXXXXX
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: electronic_eel on May 29, 2019, 10:26:13 pm
There is a new firmware 1.2.9.3a out.

This one seems to block telnet access to the device. It is not available on the regular port 23, and also not on 10101 (which some other Siglent products use).

Downgrading to 1.2.9.2a is possible, but does not bring telnet access back!

So I wouldn't recommend to install this update for now.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: BillB on May 29, 2019, 11:10:11 pm
Seems like Siglent is starting to secure their product line.  :(
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on May 31, 2019, 05:37:04 pm
The new FW SSA3000X_v1.2.9.3a has 2 interesting files, besides new versions of the common ones.

See attached.

And, of course, SHELLCMD was removed from the main app.  ;)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: markus_jlrb on May 31, 2019, 06:07:57 pm
@tv,

how to mod the lines from

rm -f to echo rm -f
or  from         
rm -f to # rm -f

Any ide?

Markus
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: electronic_eel on May 31, 2019, 06:50:24 pm
how to mod the lines from
You'd have to package a modified ADS update file. The format is obfuscated and sometimes also encrypted. You can find some info here: https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/ (https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/). But while the descriptions there are probably enough to get someone determined on the right track, they are not simple recipes you can just follow along. tv84 seems to have mastered this though.

Just an idea: if someone creates a modified ads file, wouldn't it be better to create one that just re-enables the telnet service and doesn't do anything else, like replacing ecomb? This way you could just install the regular update and install the re-enabler.ads afterwards. When Siglent releases the next update, it will most probably disable telnet again, so you could use the same re-enabler again and wouldn't have to do modifications again.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on May 31, 2019, 06:56:04 pm
rm -f to echo rm -f

Test at your own risk. (http://s000.tinyupload.com/?file_id=32864100176686764352)

This is the official ADS with additional.sh "slightly" modded.

If you already installed the official update, you already had telnetd deleted, so in that case this won't work.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on May 31, 2019, 06:59:09 pm
Just an idea: if someone creates a modified ads file, wouldn't it be better to create one that just re-enables the telnet service and doesn't do anything else, like replacing ecomb?

Next time we go that way.   :popcorn:
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: electronic_eel on May 31, 2019, 07:01:50 pm
Next time we go that way.   :popcorn:
I can't - I installed the unmodified update so I don't have telnet anymore.

Would my idea work? I mean must an update always contain ecomb and so on to work or could you really just re-add telnet and be done?

It would be nice if you could try to create such an update.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on May 31, 2019, 07:08:05 pm
An .ADS can contain whatever we desire. No restrictions.

"Give me a telnetd, and I shall move the earth."

BTW, telnetd is only a link to busybox telnetd. So we just need to recreate the links.

Can anyone provide the script to recreate the links?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: electronic_eel on May 31, 2019, 07:38:50 pm
An .ADS can contain whatever we desire. No restrictions.
that's what I wanted to hear.

BTW, telnetd is only a link to busybox telnetd. So we just need to recreate the links.
was just going to mention this, but cross checked with my ubi dumps to be sure.

To me it seems like they deleted just the links to the initscripts that start and stop telnetd. The actual telnetd link is not touched in the additional.sh you posted before.

Can anyone provide the script to recreate the links?

how about the attached script?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on May 31, 2019, 07:45:57 pm
how about the attached script?

Do you want me to pack it for you?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: electronic_eel on May 31, 2019, 07:48:18 pm
Do you want me to pack it for you?
That would be nice.

You'd probably have to rename it to .sh (had to rename because of the forum limits). And maybe add some .ads magic that is needed to have it actually executed.

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on May 31, 2019, 07:52:24 pm
Maybe it's no so simple. Isn't there the problem of the FS RO ?

Why do they use that fstab change in the official script?


These are the other scripts in the official .ADS.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: electronic_eel on May 31, 2019, 08:23:51 pm
Maybe it's no so simple. Isn't there the problem of the FS RO ?
When the additional.sh is run as intended by Siglent the fs is rw, otherwise the regular update can't remove these symlinks.

Why do they use that fstab change in the official script?
I just diffed the new fstab against one from my ubi dump. They just add the line where they mount /tmp with tmpfs. So before /tmp was probably mounted to the root fs and that caused problems so they fixed it. I don't think this change has something to do with closing down access, I think it is just regular bugfixing.

These are the other scripts in the official .ADS.

Thanks, that gives me a lot more context to work with. I'll have to look through this code to determine how to get the update system into the right state, but without overwriting ecomb or other important stuff.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: electronic_eel on May 31, 2019, 08:41:10 pm
Here is your script:
After I began reading the stuff in siglentlib.sh I don't think they intended an .ads to not contain ecomb and some other stuff. The additional.sh is only run through upgrade_app(), which overwrites ecomb and so on. I think I need some more time to understand what is exactly going on when an update is running and what is the best way to inject a script without causing negative side effects.

So I don't think this simple way is going to work. I'll post some updated scripts when I have finished my investigation.

I'm not sure if ../init/ is the best path option because I think this script runs in /usr/bin/siglent/usr/usr/upgrade/
ln stores exactly the string you give as parameter into the symlink. The relative path is resolved when you later access the file. This relative symlink is exactly what was in there before, I checked that with my ubi dump.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: electronic_eel on May 31, 2019, 09:02:24 pm
In that case, you can run the ADS.

Of course, my ADS contains only the upgrade.sh with the contents that I wrote above. Because the ecomb doesn't recognize anything else.

No additional.sh sh*t and the rest. Well, I included the fstab but, as you said, it's harmless now.
hmm. have a look at check_and_upgrade() in the siglentlib.sh. If there are update files there (is_need_upgrade), then it directly begins overwriting stuff (upgrade_uboot, upgrade_uimage). It then calls upgrade_app which in turn first overwrites ecomb, ui_data,... then only the additional.sh is called. We absolutely don't want to run that part of the script as it would overwrite uboot and the kernel image.

What I haven't figured out yet is how upgrade.sh is called and how it interacts with the other stuff in siglentlib.sh.

My current guess is that upgrade.sh is called directly when the .ads is installed, before the first reboot. After the reboot, some startup script calls check_and_upgrade() and executes the calls in there.

If that is indeed what is happening, then we'd need to do the rw-remount in upgrade.sh and also remove /usr/bin/siglent/usr/usr/upgrade/upgrade.sh afterwards so that is_need_upgrade() doesn't trigger.

Do you concur?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on May 31, 2019, 09:08:03 pm
Read my previous msg as I re-edited.

I'm not using any of that stuff because all we want is the symlink creation.

When you go for an update, in the SSA, the app knows it has to search for an upgrade.sh in the .ADS. This is an upgrade feature! No need to investigate.

But, of course our simplistic script won't work as needed because we are not doing the FS RW. As I said, investigate that part sequence and don't worry with partitions/directories updates/replaces/reformats as we won't be doing any of those.

Edit: The .ADS isn't "installed" as you say. The .ADS is decrypted and decompressed into the /upgrade/ dir and then the upgrade.sh is immediately exceuted. It then takes care of the rest.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: electronic_eel on May 31, 2019, 09:24:49 pm
I'm not using any of that stuff because all we want is the symlink creation.
What means "using"? I think it gets automatically "used" if a upgrade.sh script is existing at the right place on bootup.

When you go for an update, in the SSA, the app knows it has to search for an upgrade.sh in the .ADS. This is an upgrade feature! No need to investigate.

Edit: The .ADS isn't "installed" as you say. The .ADS is decrypted and decompressed into the /upgrade/ dir and then the upgrade.sh is immediately exceuted. It then takes care of the rest.
ok, the .ads is unpacked and upgrade.sh executed, directly and before rebooting. A regular upgrade.sh will then trigger the reboot.

You posted a upgrade.sh from Siglent. It doesn't replace ecomb, but we know that it is replaced somehow. So how does this happen?
I think after the reboot the ecomb program will call check_and_upgrade(). That will then overwrite some stuff, remove upgrade.sh and then do a reboot. That is the second reboot you always experience when doing an update on the SSA. On the next reboot no upgrade.sh is there anymore, so the system boots into the regular program.

But, of course our simplistic script won't work as needed because we are not doing the FS RW. As I said, investigate that part sequence and don't worry with partitions/directories updates/replaces/reformats as we won't be doing any of those.
I think you have to activetly prevent the replacement of this stuff, because if you leave upgrade.sh in place it will automatically take place.

Another idea: can't we just directly start telnetd from upgrade.sh and then remove upgrade.sh? That way don't have to take care of file system modifications and so on.

Do you know if upgrade.sh is called as root or as another user?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: electronic_eel on May 31, 2019, 09:36:32 pm
Could you please build me an .ADS with just the attached upgrade.sh?

That should open up telnet just once and only during this session. Deleting the upgrade.sh will make sure there are no surprises at the next reboot.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on May 31, 2019, 09:45:12 pm
Another idea: can't we just directly start telnetd from upgrade.sh and then remove upgrade.sh?

The attached .ADS should activate telnetd for the current SSA session. Login as usual.     :popcorn:

The script inside is electronic_eel's creation. I just applied the external paint.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: electronic_eel on May 31, 2019, 09:51:11 pm
This script works! (after tv84 and I did some back and forth to figure out what was going on)

When you install it as update you get instant telnet access. But for this session only, so after a reboot everything is unchanged and as before.

The SSA shows a small progress bar when installing, it halts at 60%. This is normal and means you can now telnet in. The password is unchanged. The ui becomes unresponsive, it says you should wait for the update to complete. So just call "reboot" in your telnet session when you are done.

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: arturfra on June 02, 2019, 07:29:32 am
Ok thanks for trying and create it, but what’s the exact procedure to install new update with all options enabled?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: electronic_eel on June 02, 2019, 11:21:48 am
Ok thanks for trying and create it, but what’s the exact procedure to install new update with all options enabled?
you install the original update from Siglent website. Now telnet access is closed.

Then you install the telnet_SSA3000X update as posted by tv84 above. That gets you telnet access back for the current session, but doesn't change or update anything of the system. Now you use telnet to do the regular procedure to extend your bw/options as posted previously in this thread. done.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: arturfra on June 02, 2019, 10:10:36 pm
Nice, could i recuperate my s/n with that procedure or it’s the same as before?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: NikWing on June 05, 2019, 03:28:19 pm
hey all :)

after reading the thread (all new posts since I was here last time) I'm a little bit puzzled if I should upgrade the fw or not.
I currently have fw 1.2.8.2 (HW 07.03.00) which I applied months ago after I got the device.

Can I safely upgrade to the newest fw like I see it in post #633 without losing anything?
1.2.9.1 is on the siglent download page and here you talk about v1.2.9.3a.
Which would be better?

Thanks for unpuzzling me ;D
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on June 05, 2019, 03:31:41 pm
You can upgrade peacefully (to 1.2.9.3a since it's the latest).
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: NikWing on June 05, 2019, 03:43:35 pm
oh wow, quick reply

thanks, tv84, so I just apply the new fw and all options will stay :)

edit: yay, done :)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Steen on June 10, 2019, 06:26:52 pm
Hi,
Is it possible to upgrade the SSA3021X, SW1 1.2.9.3a, SW220180708-1, HW 0F.03.00 ?

Anyone!  -is it possible to to upgrade SSA3021X that comes with SW1 1.2.9.3a??
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TTH on June 14, 2019, 09:51:12 am
You can enable all options using the previously documented procedure - after running telnet_11201.ads for the session.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Deepblue on June 18, 2019, 01:55:09 pm
Hi everybody,
I have been reading this thread and decided to order a Siglent SSA3021. It came with the tracking generator license and the 1.2.9.2.a firmware installed.
I managed to get all the options enable, using knowledge from this thread  ;D everything looks fine, apart from the license number which is XXXXXXX as I knew it would be when hacking it.

My question is; have anybody tried the TekBox EMCView pre-compliance software (Link (https://www.tekbox.com/product/emcview-pc-software-emc-compliance-testing/)) with a hacked Siglent? They state the software will be locked to the SSA's serial number, but wil this work with a hacked unit?
I have the original S/N, but I suppose the unit reports "XXXXXXXX" back to the software?!?

Hope someone can help me out here.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on June 18, 2019, 02:12:38 pm
For that case, maybe you can use a hexeditor and change the app file to SCPI report your S/N in the place where it has the XXXXXXXXX. Leave all the other files as they are.

But you would have to do that patch in every update...

Poor's man solution.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Deepblue on June 18, 2019, 03:09:10 pm
hmmm, how would I go about that?
where do I find the SCPI app file?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on June 18, 2019, 03:21:27 pm
hmmm, how would I go about that?
where do I find the SCPI app file?

I meant the SA main app (that runs in the equipment)! It's the main app that answers to the SCPI requests.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Deepblue on June 18, 2019, 03:35:04 pm
oh ok, any clues to where I should look for this app?
Any ideas where to find the serial, or can I just search for the XXXXXXX thingy?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on June 18, 2019, 03:51:28 pm
Search the thingy.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Deepblue on June 18, 2019, 03:57:22 pm
I get it :)
but where is the app located?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on June 18, 2019, 04:05:26 pm
Deep blue is just a disguise, right?  :)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: electronic_eel on June 18, 2019, 04:24:19 pm
but where is the app located?
The program is called "ecomb" and can be found below /usr/bin/siglent
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Deepblue on June 18, 2019, 04:48:25 pm
Thanks, I found the app.
searched it and found two places where XXXXXXXX. the first one is at addr. 001052E8 (FW 1.2.9.2.a) the second is at addr. 00130D44.
At the first addr. it states "XXXXXXXX  Changed".
It would be nice to have the original non-hacked ecomb file to compare with. anyone have this for this firmware?

I guess I should change it both placed?

When I have the modified file, how do I shutdown the process to be able to copy it? I guess I need to remount the drive RW also ?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: electronic_eel on June 18, 2019, 04:57:40 pm
It would be nice to have the original non-hacked ecomb file to compare with. anyone have this for this firmware?
Why do you have a hacked or modified ecomb binary? Opening the telnet port or renaming the license files does not patch your binary, it just changes how the binary behaves.

When I have the modified file, how do I shutdown the process to be able to copy it? I guess I need to remount the drive RW also ?
use the kill command (see first few pages of this thread), then remount rw and copy.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Deepblue on June 18, 2019, 05:00:28 pm
It would be nice to have the original non-hacked ecomb file to compare with. anyone have this for this firmware?
Why do you have a hacked or modified ecomb binary? Opening the telnet port or renaming the license files does not patch your binary, it just changes how the binary behaves.

When I have the modified file, how do I shutdown the process to be able to copy it? I guess I need to remount the drive RW also ?
use the kill command (see first few pages of this thread), then remount rw and copy.

Thanks, I just thought the binary was changed as it states the dummy serial with a "Changed" text behind it? This cannot be correct in a non-hacked unit, can it?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on June 18, 2019, 07:59:41 pm
Hi everybody,
I have been reading this thread and decided to order a Siglent SSA3021. It came with the tracking generator license and the 1.2.9.2.a firmware installed.
I managed to get all the options enable, using knowledge from this thread  ;D everything looks fine, apart from the license number which is XXXXXXX as I knew it would be when hacking it.

My question is; have anybody tried the TekBox EMCView pre-compliance software (Link (https://www.tekbox.com/product/emcview-pc-software-emc-compliance-testing/)) with a hacked Siglent? They state the software will be locked to the SSA's serial number, but wil this work with a hacked unit?
I have the original S/N, but I suppose the unit reports "XXXXXXXX" back to the software?!?

Hope someone can help me out here.

Hi,

Perhaps you would like to test my software? Much cheaper, can be tested for free and doesn't care for your serial number...

Click the link on my signature.

Regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Deepblue on June 19, 2019, 04:55:40 am

Hi,

Perhaps you would like to test my software? Much cheaper, can be tested for free and doesn't care for your serial number...

Click the link on my signature.

Regards,
Vitor

Hi Victor, thank you for notifying me on your software. I am definitely in the market for alternative software.
It seems like your software is not offering EMI pre-compliance tools :( at least I'm unable to find any info on it.

I'm looking for some software to do pre-compliance with corrections factors for the system setup ie. cables, antennas, CDN's etc.
It must do avg. and quasi-peak measurements according to CISPR-16.

maybe the Siglent EasySpectrum software can be used? anybody tried this out in a pre-comliance setup?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on June 20, 2019, 08:54:51 am
I am not literate in EMI.
But I think that I could add missing functionality if someone guides me to what is required.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: hfleming on June 26, 2019, 04:25:51 pm
Proud owner of a brand new SSA3021 spectrum analyzer that I received today. Thank you, community, for the unlock. Latest firmware, with the telnet script and rename of the file works.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: benjamin73 on July 18, 2019, 07:43:19 am
Hello everybody. I tried to "upgrade" my SSA3021 this morning, but the file fun_opt_valid_config.xml does not seem to be on my unit.

The only 4 files in the directory are:
NSP_sn_bandwidth.xml
NSP_trends_config_info.xml
nsp_data_b
calib

Does it matter? I would not appreciate to crash everything and I am not an expert in this kind of command lines...

Ben
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Pinkus on July 18, 2019, 08:45:40 am
Hi everybody,
I have been reading this thread and decided to order a Siglent SSA3021. It came with the tracking generator license and the 1.2.9.2.a firmware installed.
I managed to get all the options enable, using knowledge from this thread  ;D everything looks fine, apart from the license number which is XXXXXXX as I knew it would be when hacking it.

My question is; have anybody tried the TekBox EMCView pre-compliance software (Link (https://www.tekbox.com/product/emcview-pc-software-emc-compliance-testing/)) with a hacked Siglent? They state the software will be locked to the SSA's serial number, but wil this work with a hacked unit?
I have the original S/N, but I suppose the unit reports "XXXXXXXX" back to the software?!?

Hope someone can help me out here.
The Tekbox Software is bound to your analyzer. You will have to provide your SA serial number at the purchase. They are then creating a license file you need to run the software and it will not work with different analyzer (though in case of a defective unit, where you have to exchange the hardware, they ensured me, that they will create a new license file). Thus it all comes down to the question, if the real serial number will be available through the SCPI command *IDN?
If you only get "xxxxxxx", then the software would not work.......... mmmmh - idea: you may try to purchase the Tekbox software by providing them the serial # "xxxxxxx" ;D

This Tekbox software is a very useful tool. I recently made a pre compliance check with one of my customers hardware with one of Texbox' TEM Cells. Report of this one measurement is attached (printed from EMCView).
These Tekbox TEM cells and also their software are worth every cent. They are paying themselves at the first usage (though the customer will have to pay for a pre-compliance check of his hardware).
Btw: I am doing another group-buy at Tekbox shortly - this will save you money! So if you are interested in some discount of the Tekbox LISN / TEM Cell / software, just drop me a PM.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: vtwin@cox.net on July 21, 2019, 01:13:09 am
The Tekbox Software is bound to your analyzer. You will have to provide your SA serial number at the purchase. They are then creating a license file you need to run the software and it will not work with different analyzer (though in case of a defective unit, where you have to exchange the hardware, they ensured me, that they will create a new license file). Thus it all comes down to the question, if the real serial number will be available through the SCPI command *IDN?
If you only get "xxxxxxx", then the software would not work.......... mmmmh - idea: you may try to purchase the Tekbox software by providing them the serial # "xxxxxxx" ;D

Shouldn't be all that difficult to bypass. I imagine someone could create a proxy (Serial/USB/Ethernet) which intercepts the IDN? SCPI command and returns your actual serial number, and passes through all other SCPI commands unmodified.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Deepblue on July 21, 2019, 06:13:32 am
Shouldn't be all that difficult to bypass. I imagine someone could create a proxy (Serial/USB/Ethernet) which intercepts the IDN? SCPI command and returns your actual serial number, and passes through all other SCPI commands unmodified.

Hmm sounds like a great idea. I would be able to do this in hardware on Serial and maybe on USB, but Ethernet is out of bounds for me :(
Would be great if someone could write a software tool to implement this. I wonder if it could be done with Wire Shark??
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on July 21, 2019, 11:16:47 am
idea: you may try to purchase the Tekbox software by providing them the serial # "xxxxxxx" ;D

That would be the ultimate group buy!   :-DD
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: willie on July 31, 2019, 07:22:16 pm
Have followed the forum/thread for years ... Great work everyone. !!

I have an unmodified SSA3021X with a few purchased options, but now need to access the WiFI band.
Have FW version 1.2.8.5a installed.  Read all of the threads ( multiple times) but here is my question :
Can the udpated ZIP file posted by Tom #71 still be used to obtain the options.  This adds the NSP_system_info.XML folder into the firmdata0 SA folder after you edit it with your SA serial number. Advantage is that you retain your S/N OR

Do I use the latest method that just renames files in the firmdata0 and backup folder and loose my S/N

Thanks for the info,
Hank

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on July 31, 2019, 10:16:46 pm
Willie -

since oyur SSA is already on Firmware 8.5, the "old" way to improve the instrument isn't an option for you anymore. You've got to use the new method with renaming / moving the corresponding XML files. I guess you've got to apply the more recent hack (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg2162218/#msg2162218) that unfortunately results in your SSA's S/N to be displayed as "XXXXXXXX". I don't know if there's a work-around for that meanwhile since I was lucky to be one of the "early adopters" with the result of the hack having become permanent with a valid S/N. Anyway, you can always revert back from the hack with the result of losing the improved specs but getting back your S/N. I'ld know what I prefer  ;).

Cheers,
Thomas

P.S. I only now noticed that you also tried to contact me by PN, sorry for not replying to that before...
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: willie on July 31, 2019, 11:20:20 pm
Tom
Thanks for your reply.  Guess my only concern is if I need to use the additional analysis SW that requires a valid license.  Since It appears that the telnet port is closing  in V 1.2.9.3 , now I guess is the time.
I plan to backup the files and just rename the single file NSP_sn_bandwidth.xml in both the firmdata0 and backup folders.
Thanks,
Hank
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: hfleming on August 02, 2019, 08:11:02 pm
Hi all. I successfully  hacked my SSA3021 with firmware 1.9.2.3a month or so ago, and it worked as it supposed to. Today i was busy controlling it over USB when my PC crashed. To make a long story short, when I next switched the spectrum analyzer on, it remained stuck on the boot screen. I think when my PC crashed, it must have sent some garbage to the analyzer. Has anybody experienced something similar, or does anybody know how to get it into a mode so that one can reload its firmware?

Hendrik
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on August 02, 2019, 08:17:25 pm
Hi all. I successfully  hacked my SSA3021 with firmware 1.9.2.3a month or so ago, and it worked as it supposed to. Today i was busy controlling it over USB when my PC crashed. To make a long story short, when I next switched the spectrum analyzer on, it remained stuck on the boot screen. I think when my PC crashed, it must have sent some garbage to the analyzer. Has anybody experienced something similar, or does anybody know how to get it into a mode so that one can reload its firmware?

Hendrik
Using what SW can I ask ?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: electronic_eel on August 02, 2019, 08:21:43 pm
Today i was busy controlling it over USB when my PC crashed. To make a long story short, when I next switched the spectrum analyzer on, it remained stuck on the boot screen. I think when my PC crashed, it must have sent some garbage to the analyzer.
Are you sure it was some data that bricked your ssa? Couldn't it be some electrical thing, like overvoltage or overcurrent, that crashed your pc and at the same time damaged your ssa?

Did you have any devices connected to the ports of the ssa when the crash happened? Could they have caused overvoltage or overcurrent through the ssa?

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: hfleming on August 02, 2019, 08:50:36 pm
quite sure there was no overload. Spectrum Analyzer was connected via a 20dB pad to my signal generator and was reading -30dBm. The software is my own, talking to the SPA over USB.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on August 02, 2019, 09:05:22 pm
quite sure there was no overload. Spectrum Analyzer was connected via a 20dB pad to my signal generator and was reading -30dBm. The software is my own, talking to the SPA over USB.
OK, I’ll see what the factory can give us to help you.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: hfleming on August 02, 2019, 09:27:45 pm
I guess it could have been just coincidence too that the SPA broke just after the PC crash. Murphy was really on the loose in my workshop today. 1 step forward, and 100 steps back. Guess I’ll give it some time to see if a solution can be found on EEVBlog, else will have to contact the seller and see what they say. The unit is only 2 months old.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: TurboTom on August 02, 2019, 09:39:27 pm
Did you make a backup of the flash partitions when you were in there doing the hack? Several individuals managed to fix their SSAs via the UBOOT console by flashing back partition images. UBOOT can be accesses by the UART terminals at the lower right corner of the logic PCB (as viewed from behind). I think you'll find some more information on that "emergency" access port on the first few pages of this thread.

Good luck,
Thomas
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on August 02, 2019, 09:52:14 pm
Script to dump the NAND. I had it here laying around. If anyone needs it...

Always good idea to have a NAND backup.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: hfleming on August 02, 2019, 11:36:44 pm
hey guys, Spectrum Analyzer is now fixed!!!!  :-DD :-DD :-DD
Read through the fist couple of pages, and there was a comment about keeping the “System” button pressed whilst booting. Did it, and the unit came back to life!!!! Will check it out fully later (02:15 over here, and I don’t want to push my luck any further. Maybe that trick should be written up somewhere. Guess it is sort of a hard-reset.

Thanks for all the advice, was thinking of opening the unit up and hook into its serial port, but that seems not necessary. Will do the NAND dump later when I feel brave enough to open the unit.

Come to think of it, I have set my unit to start in the same state as when I switch it off, so maybe the the “system” button whilst booting forces it to start up in default state.

Hendrik

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on August 03, 2019, 08:16:05 am
Will do the NAND dump later when I feel brave enough to open the unit.

You don't need to open the unit. You just need to have telnet access to the SSA and run the script. Maybe I'll release a .ADS that does that...
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: linuxwanted on August 29, 2019, 10:15:23 pm
the hack seems to stop working with SSA3000X_1.2.9.3a.ADS (if you update). Telnet is deactivated with this version, if you update. Tried to get access on the serial port -> works. Root password unchanged. But if i remove the serialno XMLs the user interface freezes. Serial access works, so i can go back. Now back to 2.1 GHz ... Easy come, easy go. On a factory new Analyzer with 1.2.9.3a telnet works and also the hack.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: maartenva on September 17, 2019, 12:35:23 pm
the hack seems to stop working with SSA3000X_1.2.9.3a.ADS (if you update). Telnet is deactivated with this version, if you update. Tried to get access on the serial port -> works. Root password unchanged. But if i remove the serialno XMLs the user interface freezes. Serial access works, so i can go back. Now back to 2.1 GHz ... Easy come, easy go. On a factory new Analyzer with 1.2.9.3a telnet works and also the hack.

I just downgraded mine from 1.2.9.2.a to 1.2.8.3 and was able to do the firmware hack.

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: jemangedeslolos on September 25, 2019, 10:07:20 am
Hello,

Do you know if this hack works on the SSA3000...Plus ?

Thank you :)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: LPS on September 28, 2019, 04:27:03 pm
Hello,

I have made all the options permanent on my recently purchased SSA3021X using the method outlined in this thread.  The serial number has become XXXXX. . . as expected.  Current System Information Version is as follows :

SW1   1.2.9.2.a
SW2   20180708-1
SW3   000000E1
HW           0F.03.00

Can someone please advise if i upgrade my Firmware to the latest 1.2.9.3a, will all the options remain permanent as they are now ?  I would like the Peak Table Sort By Frequency / Amplitude feature, this is a good idea.

Thanks

Len
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on September 28, 2019, 04:36:44 pm
... will all the options remain permanent as they are now ?

Yes.
Title: SSA3021X - the final hack?
Post by: myexige on October 04, 2019, 07:23:07 pm
Today i hacked my SSA3021X and turned it into a SSA3032X with ALL options permanent AND KEPT MY SERIAL NUMBER, therefore (hopefully) future proofing it against any firmware updates  ;D

When i received the unit the installed firmware was 1.2.9.2a which (thankfully) still had telnet access.

Whilst waiting for delivery i read this whole thread 3 or 4 times to get as much information as i could and it has been invaluable, thanks to all who contributed  :)


Ok, so we know if the "NSP_system_info.xml" from version 7 was edited so that the license info was TRUE that this would open it up on that firmware series.

Hint....Create one now and make sure it has YOUR serial number ..

Code: [Select]
<?xml version="1.0" encoding="UTF-8"?>
<nsp_system_info_root>
  <device>
    <system_information>
      <serial_number>
        <chip>SSA3xxxxxxxxxx</chip>
      </serial_number>
    <license><_3032>TRUE</_3032><_3021>FALSE</_3021><_TG>TRUE</_TG><_EMI>TRUE</_EMI><_Meas>TRUE</_Meas><_CAT>TRUE</_CAT></license></system_information>
  </device>
</nsp_system_info_root>

Copy it to a blank USB stick.

Next step is to obtain a copy of the V8.01 firmware (1.2.8.1) and using the "converter tool", make a zip file and extract it with 7-Zip (details are on this thread).

In the extracted folder you will find a copy of the main application file "ecomb", copy this to the USB stick and rename it "ecomb8".

Place the USB stick into the SSA and open a telnet session.

Here is what i did, i'm not a linux user but there is plenty of info here and on the web to get some basics.
Remember, dont enter the " marks, just the text between them.

Enter "mount -o remount, rw /"
Enter "cd /usr/bin/siglent"
Enter "ps"
You will get a list like this...
Code: [Select]
  PID USER       VSZ STAT COMMAND
    1 root      1320 S    init [5]
    2 root         0 SW   [kthreadd]
    3 root         0 SW   [ksoftirqd/0]
    4 root         0 SW   [kworker/0:0]
    5 root         0 SW   [kworker/u:0]
    6 root         0 SW<  [khelper]
    7 root         0 SW<  [netns]
    8 root         0 SW   [kworker/u:1]
  154 root         0 SW   [sync_supers]
  156 root         0 SW   [bdi-default]
  158 root         0 SW<  [kblockd]
  168 root         0 SW<  [omap2_mcspi]
  179 root         0 SW   [khubd]
  286 root         0 SW<  [musb-hdrc.0]
  291 root         0 SW<  [musb-hdrc.1]
  293 root         0 SW<  [rpciod]
  295 root         0 SW   [kworker/0:1]
  305 root         0 SW   [kswapd0]
  306 root         0 SW   [fsnotify_mark]
  307 root         0 SW<  [nfsiod]
  308 root         0 SW<  [crypto]
  324 root         0 SW<  [OMAP UART0]
  326 root         0 SW<  [OMAP UART1]
  328 root         0 SW<  [OMAP UART2]
  330 root         0 SW<  [OMAP UART3]
  332 root         0 SW<  [OMAP UART4]
  334 root         0 SW<  [OMAP UART5]
  411 root         0 SW   [mtdblock0]
  416 root         0 SW   [mtdblock1]
  421 root         0 SW   [mtdblock2]
  426 root         0 SW   [mtdblock3]
  431 root         0 SW   [mtdblock4]
  436 root         0 SW   [mtdblock5]
  441 root         0 SW   [mtdblock6]
  446 root         0 SW   [mtdblock7]
  451 root         0 SW   [mtdblock8]
  456 root         0 SW   [mtdblock9]
  461 root         0 SW   [mtdblock10]
  466 root         0 SW   [mtdblock11]
  471 root         0 SW   [mtdblock12]
  479 root         0 SW   [ubi_bgt0d]
  495 root         0 SW   [irq/172-ads7846]
  540 root      1776 S <  /sbin/udevd -d
  719 root      2112 S    /usr/sbin/telnetd
  726 root      152m S    ./ecomb
  727 root      1572 S    /sbin/getty 115200 ttyO0
  728 daemon    1456 S    portmap
  745 root         0 SW   [ubi_bgt1d]
  750 root         0 SW   [ubifs_bgt1_0]
  767 root         0 SW   [ubi_bgt2d]
  834 root      1772 S <  /sbin/udevd -d
  873 root      2588 S    -sh
 2530 root         0 SW   [ubifs_bgt0_0]
 2651 root         0 SW   [flush-ubifs_0_0]
 2652 root         0 SW   [flush-ubifs_1_0]
 2656 root         0 SW   [flush-ubifs_2_0]
 2704 root         0 SW   [scsi_eh_0]
 2705 root         0 SW   [usb-storage]
 2708 root         0 SW   [kworker/u:2]
 2711 root      1772 S <  /sbin/udevd -d
 2720 root      2112 R    ps

in YOUR list find "./ecomb" and get the "PID" number, in my case above, it was "726"

Enter "kill -9 726" - not sure if the "-9" is needed but it certainly killed the process.
Enter "ps" again and make sure "./ecomb" is NOT shown

Enter "cp /usr/bin/siglent/usr/mass_storage/U-disk0/ecomb8 ecomb8" - This copies "ecomb8" from the USB stick to the "/usr/bin/siglent" directory.
Enter "ls -l" - and make sure it is there.
Enter "mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0"
Enter "cd firmdata0"
Enter "cp /usr/bin/siglent/usr/mass_storage/U-disk0/NSP_system_info.xml NSP_system_info.xml" - this copies the "NSP_system_info.xml" file you created above to "/usr/bin/siglent/firmdata0"
Enter "ls -l" and make sure it is there.
Enter "cd .." to drop back one level to the "/usr/bin/siglent" directory.

NOW FOR THE FUN PART

Enter "./ecomb8" - Loads of text will appear on the telnet screen, the application will start and will read the "NSP_system_info.xml" file and will automatically create a fully licensed "NSP_sn_bandwidth.xml" file, the application will start up on the SSA and using "System info" you will see that your SSA3021X is now a SSA3032X with all options permanent and with the correct serial number.

Power off the SSA, remove the USB and power it back on, all options will remain and it will be running the correct version of "ecomb"

Dont forget to backup to USB stick your new "NSP_sn_bandwidth.xml" file (details are in this thread).

Hope this helps and thanks again to those you have provided the tools and knowledge that has enabled me to do this, now i dont care if telnet has been removed as i can carry out firmware updates knowing it is safe.  ;D


P.S. One thing to note was i did have both the original "NSP_sn_bandwidth" files in place, the process just added all the licenses to it.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on October 04, 2019, 08:06:15 pm
Cool!
Title: Re: SSA3021X - the final hack?
Post by: tv84 on October 04, 2019, 09:20:23 pm
Today i hacked my SSA3021X and turned it into a SSA3032X with ALL options permanent AND KEPT MY SERIAL NUMBER, therefore (hopefully) future proofing it against any firmware updates  ;D

Not the "final hack" but very well done!   :clap:
Title: Re: SSA3021X - the final hack?
Post by: todac on October 11, 2019, 07:25:40 am
Good news
Can you tell more about "

Next step is to obtain a copy of the V8.01 firmware (1.2.8.1) and using the "converter tool", make a zip file and extract it with 7-Zip (details are on this thread).

In the extracted folder you will find a copy of the main application file "ecomb", copy this to the USB stick and rename it "ecomb8".


My English was very  poor and when i search "converter tool" or "1.2.8.1" i find only you're post.

In advance, thank you for your answer.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on October 11, 2019, 08:26:47 am
Find the tool at:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/?action=dlattach;attach=269048 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/?action=dlattach;attach=269048)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on October 11, 2019, 09:15:15 am
BEWARE: That tool is unable to extract a full working zip. But it should be OK to extract the ecomb app most of the times.

So, while you may get errors opening the zip, ensure that you don't get an error when unzipping the ecomb file!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: dennis788 on October 11, 2019, 01:28:13 pm
Script to dump the NAND. I had it here laying around. If anyone needs it...

Always good idea to have a NAND backup.

Hi,

I'm not familiar with linux and telnet. Can you, if you have time,  in short steps explain how to use this script?

Best regards

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on October 11, 2019, 04:14:24 pm
You could start reading here to get an idea of telnet access to the analyzer:
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1480492/?topicseen#msg1480492 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1480492/?topicseen#msg1480492)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: BillB on October 11, 2019, 04:33:10 pm
Script to dump the NAND. I had it here laying around. If anyone needs it...

Always good idea to have a NAND backup.

Hi,

I'm not familiar with linux and telnet. Can you, if you have time,  in short steps explain how to use this script?

Best regards

Hi Dennis,

I wouldn't recommend an expensive spectrum analyzer as your first vehicle into the land of linux and telnet.  You may want to come up to speed on something else; there are tons of tiny little linux based devices that have a telnet console.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on October 11, 2019, 04:45:51 pm
You could try telnetting to a Raspberry Pi and honing your Linux skills on that platform. When you break something on the RPi, just start fresh with a new Raspbian image. You'll never end with an expensive paper weight.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on October 12, 2019, 12:19:38 pm
@myexige
Tried your step by step instructions, but my SSA (also running 1.2.9.2.a) remains a SSA3021X and I see no changes in the NSP_sn _bandwidth.xml after executing the 1.2.8.1 ecomb executable. After ecomb1281 starts, In system info I see SW1 as 1.2.8.1 but the Model remains a SSA3021X and the trial licenses are what is shown under Option.
Is there anything you might have forgotten to mention? What was the exact contents of your backup and firmdata0 directories?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: myexige on October 12, 2019, 07:30:47 pm
@myexige
Tried your step by step instructions, but my SSA (also running 1.2.9.2.a) remains a SSA3021X and I see no changes in the NSP_sn _bandwidth.xml after executing the 1.2.8.1 ecomb executable. After ecomb1281 starts, In system info I see SW1 as 1.2.8.1 but the Model remains a SSA3021X and the trial licenses are what is shown under Option.
Is there anything you might have forgotten to mention? What was the exact contents of your backup and firmdata0 directories?

I tried putting it all back to a 3021 with only the TG enabled and then ran through my previous instructions and it didn't work this time ???!!!

Ok so i have found the problem, you also need to rollback the "nsp_data_b" file in firmdata0 after the process has been killed, i have attached the file i used.

I have tried this numerous times now and each time it works, no changes to the original procedure.

n.b. when you save the file remove the .txt extension




Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on October 13, 2019, 09:26:19 am
@myexige
Tried your step by step instructions, but my SSA (also running 1.2.9.2.a) remains a SSA3021X and I see no changes in the NSP_sn _bandwidth.xml after executing the 1.2.8.1 ecomb executable. After ecomb1281 starts, In system info I see SW1 as 1.2.8.1 but the Model remains a SSA3021X and the trial licenses are what is shown under Option.
Is there anything you might have forgotten to mention? What was the exact contents of your backup and firmdata0 directories?

I tried putting it all back to a 3021 with only the TG enabled and then ran through my previous instructions and it didn't work this time ???!!!

Ok so i have found the problem, you also need to rollback the "nsp_data_b" file in firmdata0 after the process has been killed, i have attached the file i used.

I have tried this numerous times now and each time it works, no changes to the original procedure.

n.b. when you save the file remove the .txt extension

I can confirm that, with the "original" nsp_data_b in place (kindly provided by myexige), the method works flawlessly.

@myexige
Thanks for sorting out the problem I had.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: myexige on October 13, 2019, 10:40:46 am
@fact - Thanks for confirming, thought i was going mad when i returned it back to normal and it didn't work.

Unfortunately the "tool" for un-encrypting the nsp_data_b file is not available, it was just by chance i noticed that it had grown in size when comparing the backups i had made.



Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on October 13, 2019, 01:54:52 pm
Unfortunately the "tool" for un-encrypting the nsp_data_b file is not available, it was just by chance i noticed that it had grown in size when comparing the backups i had made.

The tool is available but it's not public domain. Siglent's 3DES decryption of your "original" file is attached (raw).

<?xml version="1.0" encoding="UTF-8"?>
<sn_backup_root>
  <factory>TRUE</factory>
  <pro_mode>TRUE</pro_mode>
</sn_backup_root>


A typical nsp_data_b contents can be seen here (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1370553/#msg1370553).
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on October 13, 2019, 06:00:59 pm
Easy way to overcome losing telnet before updating to 1.2.9.3a is to create your own symbolic links for the telnet deamon.
e.g.
Enter "mount -o remount,rw /"
Enter "cd /etc/rc0.d"
Enter "ls -al"
Examine the telnet symbolic link, K10telnetd in this case and create your own with a different number, 15 in this example.
Enter "ln -s ../init.d/telnetd K15telnetd"
Enter "sync"
Replicate this for the other rc directories .
Restart the analyzer.
After this, you can safely update to 1.2.9.3a while preserving telnet access.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: swanawood on October 14, 2019, 07:45:58 am
Easy way to overcome losing telnet when updating to 1.2.9.3a is to create your own symbolic links for the telnet deamon.
e.g.
Enter "mount -o remount,rw /"
Enter "cd /etc/rc0.d"
Enter "ls -al"
Examine the telnet symbolic link, K10telnetd in this case and create your own with a different number, 15 in this example.
Enter "ln -s ../init.d/telnetd K15telnetd"
Enter "sync"
Replicate this for the other rc directories .
Restart the analyzer.
After this, you can safely update to 1.2.9.3a while preserving telnet access.

Hi
it does not work for me...

Rather it is ok to name it  S15telnetd not K15telnetd
K<something> is called in *nix when the runlevel is "exiting" (aka shutdown);
S<something> is called when the runlevel starts (whent the SA is booting up in our case)


In my case I used the script at previous post #752 after the upgrade to latest fw (and the telnet was disabled) , then I manually created S10telnetd symlink in rc5.d (only) and the telnet now is on...

Hope this help
Bye

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on October 14, 2019, 11:01:59 am
@swanawood
In all but rc5.d the original entries are K10telnetd, only in rc5.d the telnet deamon is started with S10telnetd.
That's exaclty why I suggested examining the outcome of the ls -al command before creating the symbolic link.
So if you want to stick to what was originally in the analyzer, that's the way to do it.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: swanawood on October 14, 2019, 12:04:15 pm
@swanawood
In all but rc5.d the original entries are K10telnetd, only in rc5.d the telnet deamon is started with S10telnetd.
That's exaclty why I suggested examining the outcome of the ls -al command before creating the symbolic link.
So if you want to stick to what was originally in the analyzer, that's the way to do it.

I followed exactly your suggestion and the telnetd did not survive fw to upgrade....

The goal here is to have the telnetd starting with the proper runlevel (5) through the Stelnetd script.
How one would achieve this,  is relatively relevant ....
Anyway, could be both ways are valid for someone else.


Bye
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: myexige on October 18, 2019, 12:38:15 pm
Unfortunately the "tool" for un-encrypting the nsp_data_b file is not available, it was just by chance i noticed that it had grown in size when comparing the backups i had made.

The tool is available but it's not public domain. Siglent's 3DES decryption of your "original" file is attached (raw).

<?xml version="1.0" encoding="UTF-8"?>
<sn_backup_root>
  <factory>TRUE</factory>
  <pro_mode>TRUE</pro_mode>
</sn_backup_root>


A typical nsp_data_b contents can be seen here (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1370553/#msg1370553).

Thanks for that, it took awhile but after a bit of research i have extracted both the 3DES keys they use and decrypted the nsp_data_b file using the one that begins with 0x4E

Cheers
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tommy on October 19, 2019, 02:33:30 am
I tried myexige’s hack with my newly bought SSA3021X. This came with 1.2.9.3a. After reading this thread, I could temporally enabled telnetd and successfully logged in.

I followed step by step instruction by myexige. I also used nsp_data_b provided by myexige.
Then, after the last step of starting ./ecomb8, I had the following messages, and the telnet session freezed.

-----
root@am335x-evm:/usr/bin/siglent# ./ecomb8
WARNING: Logging before InitGoogleLogging() is written to STDERR
E1019 10:16:11.091491   983 hw_access.cpp:86] >>>>>CHWAccess::spi2open failed!
E1019 10:16:11.099678   983 hw_access.cpp:109] >>>>>CHWAccess::gpmc open failed!
check_and_upgrade:starting...
mount_fs: rw,ubi1_0,/usr/bin/siglent/usr
ubi1_0attached
MOUNT_DIR_NAME = /usr/bin/siglent/usr
TEST_RESTURN = ubi1_0 /usr/bin/siglent/usr ubifs rw,relatime 0 0 /dev/sda1 /usr/bin/siglent/usr/mass_storage/U-disk0 vfat rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
is_fs_mounted 1 --- ubi1_0 /usr/bin/siglent/usr ubifs rw,relatime 0 0 /dev/sda1 /usr/bin/siglent/usr/mass_storage/U-disk0 vfat rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
mount: mounting ubi1_0 on /usr/bin/siglent/usr failed: Device or resource busy
mount_fs: mounted
is_need_upgrade
is_need_upgrade:not need upgrade
check_and_upgrade:end...
++mount_check_copy_appdata: starting
mount_fs: ro,ubi2_0,/usr/bin/siglent/firmdata0
ubi2_0attached
MOUNT_DIR_NAME = /usr/bin/siglent/firmdata0
TEST_RESTURN = ubi2_0 /usr/bin/siglent/firmdata0 ubifs rw,relatime 0 0
is_fs_mounted 1 --- ubi2_0 /usr/bin/siglent/firmdata0 ubifs rw,relatime 0 0
mount: mounting ubi2_0 on /usr/bin/siglent/firmdata0 failed: Device or resource busy
mount_fs: mounted
--mount_check_copy_appdata: ending
-----

I shutdown with power button, power on again, found no change.
I telnet again and found NSP_sn_bandwidth.xml is as before.
I killed ./ecomb, then tried to start ./ecomb8 again.

This time, I saw the following message.
Does anyone advise me what was wrong?

-----
root@am335x-evm:/usr/bin/siglent# ./ecomb8
WARNING: Logging before InitGoogleLogging() is written to STDERR
E1019 10:21:46.518117   883 hw_access.cpp:86] >>>>>CHWAccess::spi2open failed!
E1019 10:21:46.526294   883 hw_access.cpp:109] >>>>>CHWAccess::gpmc open failed!
Segmentation fault
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: myexige on October 19, 2019, 08:53:11 am
The segmentation fault normally occurs when a another instance of ecomb is running.

Is
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tommy on October 20, 2019, 10:33:38 am
Thanks myexige for your comment. I’m pretty sure that the ‘./ecomb’ process was killed. I have all the operation log in hand and I did check ‘ps’ before and after the ‘kill’ command, and confirmed the ‘./ecomb’ was killed.

My guess is as follows. As I said, my bland new SSA3021X came already with 1.2.9.3a, so I used telnet_11201.ads to restore telnetd. The ecomb loads telnet_11201.ads and start telnetd, then using this telnetd, I killed ecomb. Probably some processes won’t be killed by just killing ‘./ecomb’. This is possibly why there were error messages saying ‘Device or resource busy’ or ‘Segmentation fault’.

So my solution was to restore telnetd by not using ADS, but by creating sym link S15telnetd in /etc/rc5.d pointing to /etc/init.d/telnetd. Then using telnetd startd by /sbin/init, myexig’s script works perfect!!

Now I can play with 3032X. Thanks.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: myexige on October 20, 2019, 01:41:29 pm
Not sure what happened to the rest of my previous post, there was a lot more than that  :-DD

Just glad you got it sorted  :clap:
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: Bicurico on October 21, 2019, 02:04:36 pm
Hi,

I would like to try to enter the club, but I do lack basic knowledge. I don't "need" to enter the club, but I would like to learn something new, hence my interest and motivation.

I ask help for this:

1) What is the importance of being able to decrypt the "nsp_data_b" file? Is it only important to verify that the correct 3DES key has been found?
2) How is the key calculated based on the serial number? Is it something like name_of_option+serial_number encrypted with the 3DES key or is it a whole lot more complicated?
3) Is the ecomb using a plain 3DES algorithm? Should I be able to use a website like this to test the key: http://tripledes.online-domain-tools.com/ (http://tripledes.online-domain-tools.com/)
3) Did you guys find this out just by looking at ecomb with a HEX Editor or did you actually decompile ecomb?
4) If you did decompile it, could you enlighten me on the process? What decompiler, etc.
5) Can I have the second byte of the key (4E xx)?

Just by looking at the HEX file I found a passage that seems to check if there is a DEVELOPER license? Has anyone checked that out? There is also something that looks like a huge key/password.

Kind regards,
Vitor
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: myexige on October 21, 2019, 06:18:56 pm
Hi,

I would like to try to enter the club, but I do lack basic knowledge. I don't "need" to enter the club, but I would like to learn something new, hence my interest and motivation.

I ask help for this:

1) What is the importance of being able to decrypt the "nsp_data_b" file? Is it only important to verify that the correct 3DES key has been found?
2) How is the key calculated based on the serial number? Is it something like name_of_option+serial_number encrypted with the 3DES key or is it a whole lot more complicated?
3) Is the ecomb using a plain 3DES algorithm? Should I be able to use a website like this to test the key: http://tripledes.online-domain-tools.com/ (http://tripledes.online-domain-tools.com/)
3) Did you guys find this out just by looking at ecomb with a HEX Editor or did you actually decompile ecomb?
4) If you did decompile it, could you enlighten me on the process? What decompiler, etc.
5) Can I have the second byte of the key (4E xx)?

Just by looking at the HEX file I found a passage that seems to check if there is a DEVELOPER license? Has anyone checked that out? There is also something that looks like a huge key/password.

Kind regards,
Vitor



1) - For me, none, it was a challenge to exercise my old brain and of course i was interested to see "my" file after the "hack".
2) - Having played around with serial numbers and genuine license files the key is NOT based on serial number alone but what is unique to each SSA is the Host ID so i expect that both values are used as well as the option identifier.
3) - Siglent use a modified version of 3DES and you will find a python script on this thread (or maybe on the ADS format one) which works.
4) - I used IDA Pro V7.2 and Ghidra to disassemble it and then compared the 2 as i'm not clever enough to know if it was correct or not!
5) - Even if i gave you the second byte there are many many occurrences in the file, What i did was to find where in the listing the file was loaded and copied into memory and then decrypted because before decryption the key has to be loaded ;)

Read up on DES and search for the permutaion tables etc, the disassembled list will give xrefs to functions that use them so its a case of following the flow!

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on October 21, 2019, 08:06:41 pm
@Vitor,

The 3DES keys that myexige found have nothing to do with "licenses". The keys are used only in decrypting the .ADS files (or nsp_data_b, etc).

You can see them in ecomb with a hex editor. So, finding/using them is a good admission test to the club (1st grade).
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: vtwin@cox.net on October 22, 2019, 11:59:00 am
So, finding/using them is a good admission test to the club (1st grade).

I'm still in pre-school :-DD
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: lmwilco1 on October 25, 2019, 06:36:19 pm
Hello,

   I have a SSA 3021X that I was trying to unlock using the steps in post "Reply #504" of this thread. I did not receive any errors as I followed the steps until I started ecomb8, the output of which is below. When I got to the System Info screen it shows I am running 1.2.8.3 but I still have the SSA3021X model and the licenses are still temporary. When I restart the analyzer it comes back up in the 1.2.9.2.a version with the temporary licenses.

    I do see an error in the log below where it tied to mount the firmdata0 folder and failed but I am not sure if this is the cause of the issue or not.

Any help would be appreciated.

Louis

root@am335x-evm:/usr/bin/siglent# ./ecomb8
check_and_upgrade:starting...
mount_fs: rw,ubi1_0,/usr/bin/siglent/usr
ubi1_0attached
MOUNT_DIR_NAME = /usr/bin/siglent/usr
TEST_RESTURN = ubi1_0 /usr/bin/siglent/usr ubifs rw,relatime 0 0 /dev/sda1 /usr/bin/siglent/usr/mass_storage/U-disk0 vfat rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
is_fs_mounted 1 --- ubi1_0 /usr/bin/siglent/usr ubifs rw,relatime 0 0 /dev/sda1 /usr/bin/siglent/usr/mass_storage/U-disk0 vfat rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
mount: mounting ubi1_0 on /usr/bin/siglent/usr failed: Device or resource busy
mount_fs: mounted
is_need_upgrade
is_need_upgrade:not need upgrade
check_and_upgrade:end...
++mount_check_copy_appdata: starting
mount_fs: ro,ubi2_0,/usr/bin/siglent/firmdata0
ubi2_0attached
MOUNT_DIR_NAME = /usr/bin/siglent/firmdata0
TEST_RESTURN = ubi2_0 /usr/bin/siglent/firmdata0 ubifs rw,relatime 0 0
is_fs_mounted 1 --- ubi2_0 /usr/bin/siglent/firmdata0 ubifs rw,relatime 0 0
mount: mounting ubi2_0 on /usr/bin/siglent/firmdata0 failed: Device or resource busy
mount_fs: mounted
--mount_check_copy_appdata: ending

                                                       $Task start:: SCPI

                                                       $Task start:: USBTMC
route: SIOCADDRT: Invalid argument

                                                       $Task start:: Devce
 vxi11_main = 799413
Error[module:ui_task func:ui_if_display_wm line:00177]::  hwin is 0

                                                       $Task start:: Udisk&Lan
 offse == 0, pos == 6, freq1 == 9300.0, g_caliTg[offset].freq1 = 9300000.000000
offse == 0, pos == 8, freq2 == 589300.0,g_caliTg[offset].freq2 = 589300000.000000
offse == 0, pos == 1, att == 3 ,g_caliTg[offset].att == 3
offse == 1, pos == 8, freq1 == 589300.0, g_caliTg[offset].freq1 = 589300000.000000
offse == 1, pos == 9, freq2 == 1249300.0,g_caliTg[offset].freq2 = 1249300000.000000
offse == 1, pos == 1, att == 4 ,g_caliTg[offset].att == 4
offse == 2, pos == 9, freq1 == 1249300.0, g_caliTg[offset].freq1 = 1249300000.000000
offse == 2, pos == 9, freq2 == 1439300.0,g_caliTg[offset].freq2 = 1439300000.000000
offse == 2, pos == 1, att == 4 ,g_caliTg[offset].att == 4
offse == 3, pos == 9, freq1 == 1439300.0, g_caliTg[offset].freq1 = 1439300000.000000
offse == 3, pos == 9, freq2 == 1569300.0,g_caliTg[offset].freq2 = 1569300000.000000
offse == 3, pos == 1, att == 5 ,g_caliTg[offset].att == 5
offse == 4, pos == 9, freq1 == 1569300.0, g_caliTg[offset].freq1 = 1569300000.000000
offse == 4, pos == 9, freq2 == 2349300.0,g_caliTg[offset].freq2 = 2349300000.000000
offse == 4, pos == 1, att == 4 ,g_caliTg[offset].att == 4
offse == 5, pos == 9, freq1 == 2349300.0, g_caliTg[offset].freq1 = 2349300000.000000
offse == 5, pos == 9, freq2 == 2889300.0,g_caliTg[offset].freq2 = 2889300000.000000
offse == 5, pos == 1, att == 3 ,g_caliTg[offset].att == 3
offse == 6, pos == 9, freq1 == 2889300.0, g_caliTg[offset].freq1 = 2889300000.000000
offse == 6, pos == 9, freq2 == 2969300.0,g_caliTg[offset].freq2 = 2969300000.000000
offse == 6, pos == 1, att == 3 ,g_caliTg[offset].att == 3
offse == 7, pos == 9, freq1 == 2969300.0, g_caliTg[offset].freq1 = 2969300000.000000
offse == 7, pos == 9, freq2 == 3199300.0,g_caliTg[offset].freq2 = 3199300000.000000
offse == 7, pos == -1, att == 3 ,g_caliTg[offset].att == 3
 LoadTgCaliRamData == 3success  !!!!!
 LoadTgCaliRamData == 4success  !!!!!
 LoadTgCaliRamData == 4success  !!!!!
 LoadTgCaliRamData == 5success  !!!!!
 LoadTgCaliRamData == 4success  !!!!!
 LoadTgCaliRamData == 3success  !!!!!
 LoadTgCaliRamData == 3success  !!!!!
 LoadTgCaliRamData == 3success  !!!!!

                                                       $Task start:: Buzzer
 Error[module:ui_task func:ui_text_tr_set_info line:00299]::  num = 0 not found, parent_hwnd == 468
Error[module:ui_task func:ui_get_menu_info_get_option line:00226]::  the last option is not option num, last option = 0, option num = 3, lang_id = 0, menu hwnd = 104, button id = 3
Error[module:ui_task func:ui_get_menu_info_menu_check line:00358]::  not found menu node, lang_id = 0, hwnd = 110, key_word = math_type
Error[module:ui_task func:ui_get_help_get_button_help line:00460]::  not found button node, lang_id = 0, hwnd = 276, button_id = 4, key_word = button5
Error[module:ui_task func:ui_get_help_get_button_help line:00460]::  not found button node, lang_id = 0, hwnd = 276, button_id = 5, key_word = button6
Error[module:ui_task func:ui_get_text_info_check line:00583]::  not found text node, lang_id = 0, hwnd = 1871, key_word = harmo_dist_thd
Error[module:ui_task func:ui_text_tr_set_info line:00299]::  num = 0 not found, parent_hwnd == 1871
Error[module:ui_task func:ui_get_text_info_check line:00583]::  not found text node, lang_id = 0, hwnd = 1877, key_word = harmo_dist_num
Error[module:ui_task func:ui_text_tr_set_info line:00299]::  num = 0 not found, parent_hwnd == 1877
Error[module:ui_task func:ui_get_text_info_check line:00583]::  not found text node, lang_id = 0, hwnd = 1882, key_word = thd_num
Error[module:ui_task func:ui_text_tr_set_info line:00299]::  num = 0 not found, parent_hwnd == 1882
Error[module:ui_task func:ui_get_text_info_check line:00583]::  not found text node, lang_id = 0, hwnd = 1885, key_word = thd_freq
Error[module:ui_task func:ui_text_tr_set_info line:00299]::  num = 0 not found, parent_hwnd == 1885
Error[module:ui_task func:ui_get_text_info_check line:00583]::  not found text node, lang_id = 0, hwnd = 1888, key_word = thd_ampt
Error[module:ui_task func:ui_text_tr_set_info line:00299]::  num = 0 not found, parent_hwnd == 1888
Error[module:ui_task func:ui_text_tr_set_info line:00299]::  num = 0 not found, parent_hwnd == 1871
Error[module:ui_task func:ui_text_tr_set_info line:00299]::  num = 0 not found, parent_hwnd == 1877
Error[module:ui_task func:ui_text_tr_set_info line:00299]::  num = 0 not found, parent_hwnd == 1882
Error[module:ui_task func:ui_text_tr_set_info line:00299]::  num = 0 not found, parent_hwnd == 1885
Error[module:ui_task func:ui_text_tr_set_info line:00299]::  num = 0 not found, parent_hwnd == 1888
Error: could not insert module /usr/bin/siglent/drivers/cfbcopyarea.ko: File exists
Error: could not insert module /usr/bin/siglent/drivers/cfbfillrect.ko: File exists
Error: could not insert module /usr/bin/siglent/drivers/cfbimgblt.ko: File exists
Error: could not insert module /usr/bin/siglent/drivers/da8xx-fb.ko: File exists
xres=1024,yres=600,bits_per_pixel=16
init_lcd_driver OK g_lcdsize=1228800

                                                       $Task start:: UI
  LoadTgCaliRefLevelData == 20success  !!!!!
Error[module:ui_task func:ui_if_show_wm line:00328]::  hwin is 0
Error[module:ui_task func:ui_if_bring_under_wm_to_top line:00199]::  hwin is 0
^
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: fact on October 25, 2019, 08:55:32 pm
Have you copied the "clean" nsp_data_b as provided by myexige to firmdata0?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: lmwilco1 on October 25, 2019, 10:44:16 pm
Originally I did not as I had not made any changes to the analyzer. I did download and copy over the file that you mentioned and I got the same result. The firmdata0 directory listings are below. Any other suggestions?

Thanks,
Louis


Before start of ecomb8:
root@am335x-evm:/usr/bin/siglent# ls -lart firmdata0/
-rw-rw-rw-    1 1000     1000           606 Aug  9  2018 NSP_trends_config_info.xml
drwxrwxrwx    2 1000     1000          4392 Oct 29  2018 calib
drwxrwxrwx    8 1000     1000           680 Oct 26 02:06 ..
-rw-r--r--    1 root     root           425 Oct 26 03:35 NSP_sn_bandwidth.xml
-rwxr-xr-x    1 root     root           367 Oct 26 06:38 NSP_system_info.xml
-rwxr-xr-x    1 root     root           128 Oct 26 06:38 nsp_data_b
drwxrwxrwx    3 1000     1000           544 Oct 26 06:38 .


After ecomb8 is running:
root@am335x-evm:/usr/bin/siglent/firmdata0# ls -lart
-rw-rw-rw-    1 1000     1000           606 Aug  9  2018 NSP_trends_config_info.xml
drwxrwxrwx    2 1000     1000          4392 Oct 29  2018 calib
drwxrwxrwx    8 1000     1000           680 Oct 26 02:06 ..
-rw-rw-rw-    1 1000     1000           425 Oct 26 03:35 NSP_sn_bandwidth.xml
-rw-rw-rw-    1 1000     1000           367 Oct 26 06:38 NSP_system_info.xml
-rw-rw-rw-    1 1000     1000           128 Oct 26 06:38 nsp_data_b
drwxrwxrwx    3 1000     1000           544 Oct 26 06:38 .


Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: myexige on October 26, 2019, 12:01:19 am
it shows I am running 1.2.8.3

Firmware 1.2.8.3 will not work, it HAS to be 1.2.8.1 as this is the only version that creates the license file.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: lmwilco1 on October 26, 2019, 04:35:27 pm
Thanks, I am all good now. Moving forward I can install the latest firmware and updated with no issues?

Thanks,
Louis
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: 65roadster on December 01, 2019, 08:18:41 pm
Does anyone know if this hack works on the SSA3021X Plus version or just the non-Plus?

Thanks all
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: rulleeeee on December 05, 2019, 03:57:28 pm
Does anyone know if this hack works on the SSA3021X Plus version or just the non-Plus?

Thanks all

From what I've seen it is so far not possible to hack the Plus version, just the older model. I would be very happy to be proven wrong though as I'm trying to decide between models currently!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: 65roadster on December 05, 2019, 06:42:32 pm
... I'm trying to decide between models currently!

I am also trying to decide between models and this would probably swing me one way or the other.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on December 05, 2019, 08:26:30 pm
While no one buys it, we'll never know...

But with 200€ difference, I would say it's a no-brainer!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tubularnut on December 05, 2019, 08:28:09 pm
I’ve brought a Plus.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: 65roadster on December 06, 2019, 03:27:11 pm
Have you been able to determine if it's hack-friendly?
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tubularnut on December 07, 2019, 07:33:43 am
Have you been able to determine if it's hack-friendly?

Investigation in progress, but looking promising, I will post screenshots later  :)

BTW, I brought the unit in a Black Friday sale, so got it around the same price as normal unit. That was before someone posted it was not possible to hack the Plus versions, doh!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tv84 on December 07, 2019, 09:08:14 am
Try this script to open telnet port 10101.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tubularnut on December 07, 2019, 09:58:38 am
Try this script to open telnet port 10101.

Thank you, will give this a go later today.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tubularnut on December 07, 2019, 07:26:39 pm
Before and after screenshot of EMI and AMK unlocked. Will post proper photo of bandwidth mod once complete.

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tubularnut on December 07, 2019, 08:48:13 pm
Update with all options unlocked and 3.2 GHz

Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: 65roadster on December 08, 2019, 04:07:51 am
That is most excellent. I wish I had seen the Black Friday sale you're referring to!
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tubularnut on December 08, 2019, 07:34:48 am
That is most excellent. I wish I had seen the Black Friday sale you're referring to!

Obviously I could have brought the normal version cheaper too, but very pleased with the end result.
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tautech on December 08, 2019, 06:14:47 pm
Obviously I could have brought the normal version cheaper too,........
Yeah but for a couple of hundred bucks extra the SSA3kX Plus models now have touch display, mouse and keyboard support, webserver and Modulation Analysis, any of them are worthy of the increased price IMHO.
These improvements brings SSA3kX into line with the later SVA1kX SA/VNA models that already have all these features.

Enjoy your SSA3032X+ !  :)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: tubularnut on December 08, 2019, 06:17:45 pm
Obviously I could have brought the normal version cheaper too,........
Yeah but for a couple of hundred bucks extra the SSA3kX Plus models now have touch display, mouse and keyboard support, webserver and Modulation Analysis, any of them are worthy of the increased price IMHO.
These improvements brings SSA3kX into line with the later SVA1kX SA/VNA models that already have all these features.

Enjoy your SSA3032X+ !  :)

Indeed, exactly my reasoning  :)
Title: Re: Hack of Sigllent spectrum analyzer ssa3021X?
Post by: sjoukes on December 13, 2019, 03:48:30 pm
Great to hear that it's possible to do the same with the SSA3021X+, got one here.