EEVblog Electronics Community Forum
Products => Test Equipment => Topic started by: papousek on May 13, 2016, 07:15:26 am
-
I been waiting for reviews and being really interested to buy one since i saw the hack of ssa3021X from the post: (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/100/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/100/)) .
it seems the SSA3021X (Original 2.1G and options closed) are upgraded to 3.2G, full options opened. :-+ :-+
it's impossible for me to judge if the hack really works since i dont have one,,,,anyone who got one at hand can do me a favor to review or to try the hack?
anyway,, 1600 bucks are not a easy budget for me.
Tks in advance
-
It seems to me you'd want to grab the current FW update just in case it gets pulled. :-\
Not sure if it has opened the hole to allow the upgrade but just in case it has here's the link:
http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA-firmware-0705.rar (http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA-firmware-0705.rar)
~7.5 Mb
-
FYI it was reply #106
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg938261/#msg938261 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg938261/#msg938261)
-
Hi Papousek,
Here is some info you may want to know. In order to investigate whether it is a accident event. I install the old FW again and find out the 'hack' was gone. But when I upgrade to FW07.05 again and do the same thing to it. The 'hack' appeared again! So I think it means people can really hack it with these steps. ;) Wunderbar
-
Latest SSA3021X and SSA3032X units are hardware identical and SSA3021X is also calibrated up to 3.2GHz, so yes, SSA3021X is "upgradable" to SSA3032X ;)
-
Hi Papousek,
Here is some info you may want to know. In order to investigate whether it is a accident event. I install the old FW again and find out the 'hack' was gone. But when I upgrade to FW07.05 again and do the same thing to it. The 'hack' appeared again! So I think it means people can really hack it with these steps. ;) Wunderbar
The biggest question is whether a future firmware upgrade undoes the 'hack'.
-
Hi Papousek,
Here is some info you may want to know. In order to investigate whether it is a accident event. I install the old FW again and find out the 'hack' was gone. But when I upgrade to FW07.05 again and do the same thing to it. The 'hack' appeared again! So I think it means people can really hack it with these steps. ;) Wunderbar
The biggest question is whether a future firmware upgrade undoes the 'hack'.
With Rigol this afraid and question have been many years, starting from old times DS1052E. ;)
(I remember well these RS232 and terminal things what also I have done... and eevery next FW update we afraid if this all have gone... )
-
Hi Papousek,
Here is some info you may want to know. In order to investigate whether it is a accident event. I install the old FW again and find out the 'hack' was gone. But when I upgrade to FW07.05 again and do the same thing to it. The 'hack' appeared again! So I think it means people can really hack it with these steps. ;) Wunderbar
The biggest question is whether a future firmware upgrade undoes the 'hack'.
With Rigol this afraid and question have been many years, starting from old times DS1052E. ;)
(I remember well these RS232 and terminal things what also I have done... and eevery next FW update we afraid if this all have gone... )
That may be but if downgrading undoes the 'hack' in the SSA3000 then upgrading is likely to do the same because appearantly the hack doesn't update the memory where the enabled options are stored. If the options where enabled permanently by the hack then they would remain after downgrading.
-
I don't understand, what exactly is the hack on this one? Just an upgrade with the official firmware or is there something else to do? And will this hack enable the Tracking Gen as well? :-//
-
I don't understand, what exactly is the hack on this one? Just an upgrade with the official firmware or is there something else to do? And will this hack enable the Tracking Gen as well? :-//
First mentioned here:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg938261/#msg938261 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg938261/#msg938261)
-
I don't understand, what exactly is the hack on this one? Just an upgrade with the official firmware or is there something else to do? And will this hack enable the Tracking Gen as well? :-//
First mentioned here:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg938261/#msg938261 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg938261/#msg938261)
We still need confirmation the options stay enabled in future firmware updates otherwise it isn't a hack but a bug. It would be sad when people make their purchase based on the availability of the full-featured SA for the base price only to find out they can only use an old firmware version which doesn't have the latest features.
-
I don't understand, what exactly is the hack on this one? Just an upgrade with the official firmware or is there something else to do? And will this hack enable the Tracking Gen as well? :-//
First mentioned here:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg938261/#msg938261 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg938261/#msg938261)
It is possible to turn SSA3021X into SSA3032X and enable all the options unofficially in a different (permanent) way as well ;)
-
We still need confirmation the options stay enabled in future firmware updates otherwise it isn't a hack but a bug. It would be sad when people make their purchase based on the availability of the full-featured SA for the base price only to find out they can only use an old firmware version which doesn't have the latest features.
I would hardly call it hack since, man - you don't have to do anything, just upgrade FW, wtf :D? It's certainly a bug.
To me what is more important is to test it now if it really is capable of 3.2GHz span on 2.1GHz model and do all these enabled options work as well, because once you know the technical capabilities are the same then we can do hacks on software. Also if it works it's great base to start working on real hack - I mean for example you could dump memory from EEPROM when you had old FW and then dump once again when upgraded to new one, and see what's changed (maybe nothing unfortunately if it's related to real software bug like IDK wrong date checking?). By the way if it is possible to get trial versions for 48h, isn't it possible to manually adjust RTC clock and find and replace date in memory, I know it's pain in ass solution, but anyway.
-
..
To me what is more important is to test it now if it really is capable of 3.2GHz span on 2.1GHz model and do all these enabled options work as well, ..
The answer to both your questions is yes.
-
It is possible to turn SSA3021X into SSA3032X and enable all the options unofficially in a different (permanent) way as well ;)
Great info, would you mind to share your method?
The answer to both your questions is yes.
Then this is really nice. All Rigol hackers please take a look at this one!
-
I actually can't because I'm a distributor of Siglent (and Rigol) test gear. Sorry for that.
But don't worry, there are many talented guys who will figure out soon. My guess is, that these units will quickly become very popular due its hackability (like Rigol units).
Small hint: read tinhead's thread;)
-
I actually can't because I'm a distributor of Siglent (and Rigol) test gear. Sorry for that.
But don't worry, there are many talented guys who will figure out soon. My guess is, that these units will quickly become very popular due its hackability (like Rigol units).
Small hint: read tinhead's thread;)
Thanks for the hint drieg.
Looking at his threads:
https://www.eevblog.com/forum/profile/?area=showposts;sa=topics;u=2790 (https://www.eevblog.com/forum/profile/?area=showposts;sa=topics;u=2790)
Would I be correct the clues are in this one?
https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/ (https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/)
-
I actually can't because I'm a distributor of Siglent (and Rigol) test gear. Sorry for that.
I only can recommend Drieg as a distributor/reseller for Rigol and Siglent devices. I know him for years now. He is always very helpful (even months or years after the purchase!) and can help you whenever EVERY other reseller can't. So if you want to purchase such stuff, ask him for a quote.
-
Does it have telnet?
You know what I'm thinking here... ;)
-
Does it have telnet?
You know what I'm thinking here... ;)
Early in Daves teardown and his only cursory inspection of the processor PCB he identifies a header that he calls as a Jtag and then another for programming. :-\
https://www.eevblog.com/forum/blog/eevblog-892-siglent-ssa3021x-spectrum-analyser-teardown/ (https://www.eevblog.com/forum/blog/eevblog-892-siglent-ssa3021x-spectrum-analyser-teardown/)
-
Some kind of telnet prompt from LAN port? In shadow may be DES / crypt(3) root password.
-
Some kind of telnet prompt from LAN port? In shadow may be DES / crypt(3) root password.
Yes, telnet deamon is active - see screenshot.
But I do not know how to proceed from here.
-
They didn't remove the banner? Maybe they kept the default Arago password as well: root
-
They didn't remove the banner? Maybe they kept the default Arago password as well: root
I am not a hacker, but of course I already tried this (and some other) most obvious password without success.
-
You can try crack this from SSA3000X_D07P03.ADS
xE062W/htPFyU
UNIX descrypt
-
does it need a salt?
-
I think it is DES / crypt(3) and 2 first byte is salt and for
https://hashcat.net/oclhashcat/
it is -m 1500
-
I also got myself one of these SA's and more or less directly hooked a USB-serial converter to the internal UART port (after I checked the signals with a scope). Serial port settings are 115200, n, 8, 1, no handshake. I labeled the UART lines in one of Dave's photos. It is easy to connect to the three required lines with a 2.54mm header with the pins slightly deformed and pushed into the holes so they make contact with the pads / hole plating of the PCB. It's not even necessary to remove the metal shielding from the back of the instrument to access this port and no soldering required whatsoever.
I attached a bootlog of the analyzer but since I'm not too much into hacking or programming, I'm also not too sure what to do next... Arago Project standard login doesn't work as well as anything I thought of (as Pinkus already reported). Yet, U-Boot is working and I can stop the bootup process and enter the U-Boot menu. I'm not sure if this helps to make some progress.
It seems in order to force the analyzer into the "Werewolf Mode" ;) (see the other thread), it's only necessary to change the date to 1st January 1970. If the date is reset to correct parameters, the analyzer will become a "Sheep" again... That's with firmware 07.05.
Cheers,
Thomas
-
You might be able to access the Linux filesystem through U-boot and overwrite the password file from there but it will take some carefull experimenting because you could brick the SA.
-
What is this hacking process supposed to do?
-
What hack? As I interpret the situation, there is no "Hack" for the analyzer available so far. Changing the date to the first possible setting in the unix (Linux) operating system apparently puts the SA in a (intended or unintended by the manufacturer) "special" mode which removes the software limits. If this will still work after the evaluation period (48 hours) has passed and if a 2.1GHz device is calibrated over the full 3.2GHz is so far also unknown. As far as I can tell, the tracking generator hasn't stellar performance in the 2.1GHz range (though my device is from the new batch with the supposedly improved TG) and between 2.3 and 3.2 GHz there are excursions down to -5dB and up to +2dB. I would say, it isn't calibrated above 2.1GHz or Siglent configures especially selected versions for 3.2GHz that perform better in the upper frequency range. What's also not too amusing is that RBW is limited to 30kHz and above when the TG is active. For what reason? Seems like the TG performance really needs some improvement (hopefully possible in software). So far this "peeking around" in the booting process and file system focuses on a better understanding how the analyzer works.
Cheers,
Thomas
-
I also got myself one of these SA's and more or less directly hooked a USB-serial converter to the internal UART port (after I checked the signals with a scope). Serial port settings are 115200, n, 8, 1, no handshake. I labeled the UART lines in one of Dave's photos. It is easy to connect to the three required lines with a 2.54mm header with the pins slightly deformed and pushed into the holes so they make contact with the pads / hole plating of the PCB. It's not even necessary to remove the metal shielding from the back of the instrument to access this port and no soldering required whatsoever.
I attached a bootlog of the analyzer but since I'm not too much into hacking or programming, I'm also not too sure what to do next... Arago Project standard login doesn't work as well as anything I thought of (as Pinkus already reported). Yet, U-Boot is working and I can stop the bootup process and enter the U-Boot menu. I'm not sure if this helps to make some progress.
It seems in order to force the analyzer into the "Werewolf Mode" ;) (see the other thread), it's only necessary to change the date to 1st January 1970. If the date is reset to correct parameters, the analyzer will become a "Sheep" again... That's with firmware 07.05.
Cheers,
Thomas
Looking at the log:
- one would have to stop U-Boot
- add init=/bin/sh to the bootargs
- check how the filesystem is mounted, if mounted read-only then remount rw
- change the root password
Be careful if You want to try this method!
br,
mike
-
What's also not too amusing is that RBW is limited to 30kHz and above when the TG is active.
Any details and sources for that?
Would like to know before I buy that thing.
Cheers
-
Thanks Thomas, I think most are after the TG software option? This is 160 EUR + VAT on the Siglent.eu wesbsite.
Or is it more and I am missing it...
-
What hack? As I interpret the situation, there is no "Hack" for the analyzer available so far......
If this will still work after the evaluation period (48 hours) has passed and if a 2.1GHz device is calibrated over the full 3.2GHz is so far also unknown. As far as I can tell, the tracking generator hasn't stellar performance in the 2.1GHz range (though my device is from the new batch with the supposedly improved TG) and between 2.3 and 3.2 GHz there are excursions down to -5dB and up to +2dB. I would say, it isn't calibrated above 2.1GHz or Siglent configures especially selected versions for 3.2GHz that perform better in the upper frequency range.
Will activation of the self cal improve what you are reporting?
-
Thanks Thomas, I think most are after the TG software option? This is 160 EUR + VAT on the Siglent.eu wesbsite.
Or is it more and I am missing it...
Lots more, some of the options are many 100's in whatever currency.
EMI-SSA3000X EMI Measurement Kit (Software)
AMK-SSA3000X Advanced Measurement Kit (Software)
Refl-SSA3000X Reflect Measurement Kit (Software)
TG-SSA3000X Tracking Generator Kit (Software)
-
So you're saying they are poor and can't afford it. Basically that's the root of the issue, not enough income to support the purchase.
-
So you're saying they are poor and can't afford it. Basically that's the root of the issue, not enough income to support the purchase.
NO.
Everybody wants something for free, don't you?
However just as the HW is one cost, accessories to enable complex measurement/s to be made are another and just like scopes a good set of accessories with cost just as much as the base unit, or more.
-
Here's a screenshot of the message I get if I try to reduce the resolution bandwidth below 30kHz while the tracking generator is turned on. Since the message only appears for a relatively short time, and it isn't possible to save the screen with the message directly on USB-Stick, the photo with my cell phone didn't turn out too well. Anyway, it's readable. Yet, I don't understand why there's the lower limit for RBW with the TG open. Rigol's DSA800TG series hasn't got this shortcoming.
Cheers,
Thomas
-
Sorry, it does not make much sense, you will have to pay for those probes and accessories if you want/need them, regardless of their cost.
-
Yet, I don't understand why there's the lower limit for RBW with the TG open. Rigol's DSA800TG series hasn't got this shortcoming.
I've had a scan through the https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/)
thread for answers but maybe I missed it.
rf-loop may have some comment.....
-
I just did a quick scan of the manual http://www.siglentamerica.com/USA_website_2014/Documents/UserManual/SSA3000X_User%20Manual_UM0703X_E02A.pdf (http://www.siglentamerica.com/USA_website_2014/Documents/UserManual/SSA3000X_User%20Manual_UM0703X_E02A.pdf) and neither I found any information regarding this behavior -- strange! I guess I'll have to hook up another analyzer to the TG output of the SSA3000X and see if I'll find anything "strange"...
-
Here's a screenshot of the message I get if I try to reduce the resolution bandwidth below 30kHz while the tracking generator is turned on. Since the message only appears for a relatively short time, and it isn't possible to save the screen with the message directly on USB-Stick, the photo with my cell phone didn't turn out too well. Anyway, it's readable. Yet, I don't understand why there's the lower limit for RBW with the TG open. Rigol's DSA800TG series hasn't got this shortcoming.
Cheers,
Thomas
With TG minimum RBW is 30kHz. (this is also most narrow filter what can not go to FFT mode)
What is problem with it? Do it have too fast response or what?
Here is one small example, Nominal center frequency 21.953MHz, width ~3.5kHz Band Pass filter. (in this example filter under test have problem)
With RBW30 also used Span is 30kHz! (note also used VBW)
With TG there is some DUT between TG output and SA input. This is your "filter" and it have most relevance, not SA RBW filter.
Of course this 30kHz Span is not limit. If narrow filter under test there can use more narrow Span.
(http://i181.photobucket.com/albums/x2/aghp55/SSA3000X/SSA3k-esku/SSA3000X-21-TG-filter-work.png)
As sidenote here is limits with different RBW widths.
Sweep Span limits using FFT or Sweep (SWP) mode
Spectrum analyzer. (TG Off)
10Hz, FFT 33.83MHz, SWP ---
30Hz, FFT 106.6MHz, SWP 330kHz
100Hz, FFT 318MHz, SWP 3.7MHz
300Hz, FFT 793.6MHz, SWP 33,3MHz
1kHz, FFT 2.1GHz, SWP 371MHz
3kHz, FFT, SWP 2.1GHz
10kHz, FFT, SWP 2.1GHz
Spectrum analyzer + TG in use.
30kHz, FFT ---, SWP 2.1GHz
100kHz, FFT ---, SWP 2.1GHz
300kHz, FFT ---, SWP 2.1GHz
1000kHz, FFT ---, SWP 2.1GHz
-
So the effective rbw is much less than 30khz although the displayed one is 30khz... weird but it works
-
At lower bandwidths (presumably < 30 kHz), the sweep generator is not sweeping continuously. It takes discrete steps in both frequency and time, captures a block of samples, and converts them to the frequency domain all at once.
In other words, if the analyzer uses an FFT to implement its 100 Hz RBW, there is no moment in time when (e.g.) a signal of 10.000100 MHz is in the passband but a signal of 10.000500 MHz isn't. So there's nothing to "track."
-
Also went through the manual and didn't find any hint.
Thanks for the clarification!
Cheers
-
So the effective rbw is much less than 30khz although the displayed one is 30khz... weird but it works
Effective filter is DUT between TG out and SA in!
(I do not know what happend to my last message with more deep explanations but it is gone... and just now not time to write it all agen)
If TG is used for narrow and/or steep shape filters user need be careful with SWEEP speed adjustment! In this case SA's defaults are not at all good for use.
RBW30kHz sweep speed default is very far too fast. User need understand basic fundamentals about theory and/or have practical experience enough for understand how to adjust system for acceptable result. It need know how fast frequency can change! (DUT response time)
Look my previous image where is 21.9MHz 3.5kHz filter example. With 30kHz RBW SA can sweep much much more fast but why I have reduced Sweep time. Of course. Effective filter is between TG out and SA in and adjustments need do in this case for it, not for RBW30kHz gaussian type filter in SA.
In some cases RBW30kHz step response speed is limiting factor but in other case filter under test give limits and user need take care about this.
Just for information
Here attached SA RBW30kHz filter top shape. Think filter "speed" - simplified, if you go too fast or level change too fast it do not have time to reach top.
-0.1dB BW 5.6kHz
-1.0dB BW 17.3kHz
-3.0dB BW 29.9kHz
-6.0dB BW 42.3kHz
(Filter shape factor -3dB / -60dB is around 1:4.5)
(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=237482;image)
-
Okay, I did some more in-depth testing of the TG behavior of the SSA3000X and got some interesting results. Especially considering the information provided in the last few posts made me want to understand how the SSA is scanning the frequency range and if the TG is outputting a discrete set of frequencies or if it is "really" sweeping through. Since a test with another SA didn't turn out conclusive (both scanning at arbitrary frequencies/speeds), I decided to hook up the TG output to my scope. The SSA was configured at a center frequency of 10MHz and a span of 3MHz, sweep time 5 seconds. And that's a clip of what i got: http://www.turbinemuseum.de/files/HF_Wobble.3gp (http://www.turbinemuseum.de/files/HF_Wobble.3gp) It's obvious that upon the sweep itself, there's a kind of frequency wobble superimposed, maybe to provide the bandwidth within one of the 30kHz "slots" that are (supposedly) analyzed at a time. But it's also well possible that the "wobble" is just an artefact of the PLL when it locks onto the new frequency during the sweep.
I then checked the TG at zero span to find out if the center frequency has "macroscopic" increments or if it's more or less continuously adjustable -- I found the latter to be the case.
After that, I wanted to understand if the TG frequency at a slow-rate sweep moves in increments (besides the wobble) and I decided to look at the signal with a delay of 30µs after the trigger. Once again, settings were 10MHz center frequency, 3MHz span but this time 1000 seconds sweep time. It appears that the "average" frequency sweeps continuously, see here: http://www.turbinemuseum.de/files/Smooth_Sweep.3gp (http://www.turbinemuseum.de/files/Smooth_Sweep.3gp)
I did the same tests with the Rigol SA for comparison. This instrument sweeps the selected frequency range at increments that match the span divided by the number of horizontal pixels available on the display. This means, provided the "wobble" of the Siglent SA TG is intentional, the siglent will detect a very narrow BW "event" when it's within an "increment" whereas it's pure coincidence on the Rigol if the TG at larger increments "hits" the specific frequency that a DUT characteristic changes significantly. I.e. the Siglent TG is better at "finding" resonances and the like at wide spans while the Rigol TG is better suited for analyzing devices at narrow spans.
If considering these findings, it also becomes obvious that initially Siglent planned to implement more analog bandwidth settings (by means of the two four-point switches in the last IF section and the unpopulated filter circuitry in between) but finally decided to go the digital route. Yet, it should be possible to implement digital filtering as well without the FFT function and then the RBW would probably permit lower values with the TG running.
For comparison I tested a high accuracy crystal (first photo) on the Siglent (the best I could get with RBW 30kHz, VBW 10Hz and span 10kHz), the same settings on a Rigol DSA815TG and finally on the same instrument with RBW 100Hz and VBW 10Hz. Only in the last configuration, both series- and parallel resonance are clearly visible while the first parameter set on the rigol is completely useless. The Siglent at least detects the series resonance fairly accurately while the parallel resonance is covered with artefacts (why?). Maybe I made some mistake with my settings? At least as yet to me it seems the 30kHz RBW limit with the TG active is a major shortcoming on the SSA3000X.
-
Just as simple as can and also xtal loading really rotten but this is not problem because this is not xtal test but just for example about display.
Btw...(Sunday evening puzzle ;) ) in old times we have done thousands of sweep using logamp, detector, sweep gen and just oscilloscope. Where is RBW filter? Just as wide as scope response is. ;)
(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=237606;image)
-
root password is "ding1234" 8)
-
root password is "ding1234" 8)
Kudos to you!
-
root password is "ding1234" 8)
Kudos to you!
Actually I don't deserve the merits but rather janekivi who provided the relavant information in this post: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg969909/#msg969909 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg969909/#msg969909)
Cheers,
Tom
-
Today I had a little time to play around in the files system of the analyzer, but so far I wasn't able to identify the file that configures the device as a 3021 or a 3032.
Yet, there's an interesting directory "/usr/bin/siglent/firmdata0/" that contains a file "fun_opt_valid_config.xml". This file defines the evaluation period of the add-on options. They can easily be adjusted to higher values (first the corresponding partition has to be re-mounted read-write, then the file can be edited). Deleting the file will cause a new one to be generated during the next bootup with the standard 48 hours test period reenabled.
There's one more funny file in this directory which (almost...) caused me some headaches, named "monster.txt ". This file is seven bytes long and just contains the phrase "hack!!!" The file only appears after the analyzer date had been set to 1st January 1970 and hence the software restriction circumvented. It's important to notice that there's a space behind the extension "txt" and so the name cannot be entered on the console. Wildcards etc. have to be used to access it. If an analyzer that had been used in "Werewolf Mode" ;) has to be returned for repair and the file system is still accessible, it's probably a good idea to delete this file (after resetting the date to something "reasonable" of course).
There's another "monster.txt" that just contains the phrase "NULL" in "/usr/bin/siglent/usr" but this doesn't appear to be an indicator of any "tampering" it seems. It also doesn't have the added "space" behind the file name, so it's accessible without any tricks.
It's quite funny that during bootup, regardless of the device model, always calibration data for the whole 3.2GHz range are loaded.
Anybody else poking around in the analyzer?
-
I know you'll be surprised but some of us are actually considering buying the options we need.
-
There's one more funny file in this directory which (almost...) caused me some headaches, named "monster.txt ". This file is seven bytes long and just contains the phrase "hack!!!" The file only appears after the analyzer date had been set to 1st January 1970 and hence the software restriction circumvented. It's important to notice that there's a space behind the extension "txt" and so the name cannot be entered on the console.
You can enter the name on the console by putting the filename between "".
-
FYI:
Recently received SSA 3021X -w- TG option
SW1 100.01.02.07.06
HW 07.03.00
Cal date: early July
Can telnet/log in as root via LAN. Tried changing date/time:
# date -u 010100001970
Date/time is successfully updated, and it can be verified on the unit LCD. System Info/Option: All options stay the same, showing just TG Permanent.
Power-cycle unit (did reboot from CLI) and date reverts to current date, options not changed.
Change date successfully to epoch via System/Data & Time on unit keypad. All options stay the same. Reboot. Date stays @ epoch, options still unchanged.
That was all with firmware that was originally installed on the unit when received, v6. Installed the v5 firmware Tautech linked to, and repeated all of the above. Still no werewolf to be found, boo hoo...
Conclusion: The version 6 firmware, or having an option pre-installed, like the TG, operator error, or some other issue prevents this unit from entering "werewolf mode".
Or, maybe they changed the v5 firmware? I noticed in one of the pics from the post from Deuze that the firmware version was "100.01.02.07.05.h". My version 5 shows "100.01.02.07.05". Deuze's HW version is also different than this one, but all else looks the same.
Anyway, just wanted to let folks know, in case this may affect their purchase decision, or these additional data points are helpful in general.
Unfortunately, I'm just a low-life lurker who has way more projects than I can handle right now. However, if I discover anything more interesting, I will absolutely let you folks know. Love the characters on these forums, by the way, and best of luck to all!
-
Can we have an update as to which FW versions have been used to enable "werewolf" (3.2 GHz) mode?
Anybody want to write an upgrading "For Dummies" guide?
-
phs, what about editing the fun_opt_valid_config file that TurboTom mentioned above?
-
Hi MasterTech,
At this point I trust that editing fun_opt_valid_config.xml works, but I'm hoping there is a better solution.
Edit to clarify sentence...
-
Can we have an update as to which FW versions have been used to enable "werewolf" (3.2 GHz) mode?
Anybody want to write an upgrading "For Dummies" guide?
Hacking the SSA3021x for experienced dummies.
Login to the machine using telnet or a direct serial connection all described earlier in this thread.
Optionally plugin an USB stick in the system for securing backups from the system.
It will be automatically mounted at /usr/bin/siglent/usr/mass_storage/U-disk0
the “mount” command shows you what’s mounted where and if it’s in rw or ro mode.
make a backup of the relevant folders in the /usr/bin/siglant folder in case you break anything.
example:
cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SSA3021x_backup
cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SSA3021x_firmdata0
If you feel comfortable it’s time to start hacking.
Stop your analyser with this command.
killall ecomb
Your spectrum analyser display will go into freeze and stop operating, but don't worry it’s computer is still running.
Killing is necessary because the spectrum analyser is monitoring the /usr/bin/siglent/firmdata0 folder and we want to play with the contents of this folder, and it’s using almost all the cpu time, so your console becomes more responsive as a bonus.
now remount the firmdata0 folder in rw mode with this command.
mount -o remount,rw /usr/bin/siglent/firmdata0
now edit the system info file with “vi”
vi /usr/bin/siglent/firmdata0/NSP_system_info.xml
change the licence node into this:
<license><_3032>TRUE</_3032><_3030>FALSE</_3030><_3021>FALSE</_3021><_tTG>TRUE</_tTG><_tEMI>TRUE</_tEMI><_tMeas>TRUE</_tMeas><_tCAT>TRUE</_tCAT><_TG>TRUE</_TG><_EMI>TRUE</_EMI><_Meas>TRUE</_Meas><_CAT>TRUE</_CAT></license></system_information>
Notice that temporally licences have a lower case “t” in front of them.
To make them permanent just add them at the end without the “t” as shown above.
now use the “sync” command to write all data to disk.
now remount the firmdata0 folder in ro mode with this command.
mount -o remount,ro /usr/bin/siglent/firmdata0
It’s now time to start the analyser again with this command:
/usr/bin/siglent/ecomb &
The analyser starts logging to the console.
The hack is complete and all options should be permanent and you have 3.2 GHz bandwidth.
you should now give the "reboot" command to reboot the machine.
There is still one little thing you need to take care of.
Wipe the user data because it was stored when the machine thought is was a SSA3021x where it’s now a 3022x, and this results in errors in the logs because the XML isn’t compatible.
Goto: System —> Pwr On/Preset —> Reset & Clear to remove all previously local stored user data.
That was easy, actually a little bit to easy as I might say.
-
@peterdb
thanks a lot for your guide.
Since i am not very familiar with linux, vi and telnet i have some questions:
what fw version have you edited? 7.05 or 7.07
is the "sync" a vi command or linux? Type in sync on linux promt without any parameter?
what does sync do?
In vi after editing is finished i have to :wq! for write and quit is that correct?
Thanks for help
Karsten
-
sync is a Linux command and it doesn't need parameters. When it comes to vi you better read a tutorial first: http://www.howtogeek.com/102468/a-beginners-guide-to-editing-text-files-with-vi/ (http://www.howtogeek.com/102468/a-beginners-guide-to-editing-text-files-with-vi/)
I have used vi in the past but had a skilled operator sitting behind the keyboard and I told him the changes I wanted. He insisted we should use vi for a complex text editing job ^-^
-
@Kado
I used fw version 7.07 but it would surprise me if this doesn’t work with 7.05
sync is a linux command that writes all data that is currently somewhere in the cache to disk so you can remount the volume without loosing data, but not using the command will probably work as well.
sync works without any parameters.
vi is ended with the :wq! command, and if your lost somewhere jou can always abort with :q!
No data will be saved and you can try to edit again.
Once your in vi you can navigate to the part you want to edit with your cursors and then press i to enter edit mode.
pressing escape leaves the edit mode.
If you want to delete a character move your cursor over it and press x when not in edit mode of course.
-
@nico and peter
thank you both for your advice.
Will read the vi tutorial first, then give it a try on my machine.
Karsten
-
If you want to practice on a similar OS as the spectrum analyser try the virtual BusyBox
https://busybox.net/live_bbox/live_bbox.html
The spectrum analyser OS is based on this BusyBox distribution, so you can practice al your commands.
-
@ all
peters guide is working !!! Could upgrade with success, but lost SN :-\
BTW: if you are gone in FW 07.05 into "Werewolf Mode" you should remove the file "monster.txt " which TurboTom mentioned in this thread because if this file is present the actual FW showed in SYS Info has an .h appended. (h = hack !?)
So now have 3.2 GHz and all Options Sta: ON and Valid: Permanent, but SN now 0123456789 !!!
Karsten
-
Strange, I did not loose my SN during the procedure.
But no worries, the SN is stored in the same file you had to edit to get it working, so just repeat the procedure, but now re-enter the original serial number.
You made a backup I hope to retrieve the original serial?
Peter
-
Ohh O.K. you dont lost your SN, let see what i have made wrong!?
FYI: i also lost the original Host ID, so have to put in a new IP-Adress after reboot! (DHCP active)
I have edited the file with the vi, not copy anything from your text. Maybe any typos...
I will try to edit the SN in the NSP_system_info.xml file.
Again thanks for your help
Karsten
-
think anything is going wrong:
after reboot and new telnet session the file dont contend the lincence node i has edited and has only 237 bytes:
-rw-r--r-- 1 root root 237 Aug 5 19:04 NSP_system_info.xml
root@am335x-evm:/usr/bin/siglent/firmdata0# cat NSP_system_info.xml
<?xml version="1.0" encoding="UTF-8"?>
<nsp_system_info_root>
<device>
<system_information>
<serial_number>
<chip>0123456789</chip>
</serial_number>
</system_information>
</device>
</nsp_system_info_root>
This is looking without mounting filesystem to rw.
Karsten
-
this is what the file should look like:
<?xml version="1.0" encoding="UTF-8"?>
<nsp_system_info_root>
<device>
<system_information>
<serial_number>
<chip>0000000000000</chip>
</serial_number>
<license><_3032>TRUE</_3032><_3030>FALSE</_3030><_3021>FALSE</_3021><_tTG>TRUE</_tTG><_tEMI>TRUE</_tEMI><_tMeas>TRUE</_tMeas><_tCAT>TRUE</_tCAT><_TG>TRUE</_TG><_EMI>TRUE</_EMI><_Meas>TRUE</_Meas><_CAT>TRUE</_CAT></license></system_information>
</device>
</nsp_system_info_root>
I made my <chip>00000000000</chip> zero only for the post.
Are you sure you stopped the analyser with the “killall ecomb” command prior to mounting the filesystem in rw mode.
Did the analyser go into freeze?
The analyser must be stopped before you continue with remounting the file system.
the ecomb process is also the process that makes the monster.txt file and acts as a watchdog, so it may not run during editing.
after you edited the file make sure you remount the system in ro mode
check with the mount command that firmdata0 is really in read-only mode
before you start the analyser with the /usr/bin/siglent/ecomb & command.
dont forget the & sign.
It runs the analyser in the background.
Once the analyser is running give the reboot command, and then it will make a backup of the system_info file in a regular way.
also make sure there are no other files in the firmdata0 folder then these:
NSP_system_info.xml
NSP_trends_config_info.xml
calib
fun_opt_valid_config.xml
-
another way of fixing this is to edit the NSP_system_info.xml in the backup folder in here:
/usr/bin/siglent/usr/backup
then delete the NSP_system_info.xml in the firmdata0 folder bij the procedure where you stop the analyser with the kill command and remount the firmdata0 in rw mode.
after the file is deleted and you gave the sync command unplug the power.
After powering up the earlier edited backup file will be restored.
But only use this as a last resort.
-
Okay, since it's now public anyway, please see the attached method that I figured out. The good news is that also the 1HZ RBW is now working even though it's quite slow (but for obvious reasons).
Cheers,
Thomas
P.S.: I found out that in order to make the instrument more responsive during the telnet session, it's not necessary to kill any application but to just open the "System -> System Info" screen.
Edit: Updated Attachment -- This modified version of the patch instructions will work up to firmware 7.07, will not activate the 1Hz and 3MHz RBW options but is compatible with the firmware update to the new 8.01 version without losing the "liberated" options. Apply it before updating the firmware, even if you used the "old" patch before!
-
Compliments Thomas,
This is defiantly a more safer way of doing it and it could also help Karsten to fix his problem.
Consider implementing my hack for obtaining a permanent licence this could be a winner.
Cheers,
Peter
-
@peter and tom
i have edited the NSP_system_info.xml fully new by hand with vi! After mount ro and start ecomb & and reboot i got my SN back :-+
All Options stay ON :-+
Should i test anything before power off / on 230V again?
Greetings
Karsten
-
@tom
where are the differences between your guide and peters ?
should i make it again by your guide?
Karsten
-
@Karsten
This is really good news!! :)
The differences between Thomas method and mine are the way the permanent licences are obtained, and the way the hack is distributed.
So if everything works, no need to change anything.
Cheers,
Peter
-
thanks peter for info!
Is there realy a 1 Hz RBW ? I could get only 10 Hz RBW until now.
Karsten
-
Karsten -
yes there is a 1Hz RBW mode that had been activated in the "Werewolf Mode" of the 07.05 firmware. So it had to be possible to enable this "officially" as well, which is done by including the definition <_t1HZ>TRUE</_t1HZ> and/or <_1HZ>TRUE</_1HZ> in the options definition line. I found that editing the fun_opt_valid_config.xml with the <tEffect> parameter set to -1 for the desired options also enables them permanently. So there are several methods to achieve the desired goal.
Cheers,
Thomas
-
@tom and peter
O.K. got it.
I tried toms method via USB stick and it works! Also now the 1Hz RBW :-+
Thank you both for your "online" help, so now i can go to bed without headage...
Karsten
-
I'm sure if Siglent doesn't lock this door, this SA will become the favorite instrument among the hobby users and they will sell huge quantities (relatively speaking). On the other hand, Rigol will probably notice a painful drop in sales of their DSA800 series (up to the DSA832) since the "improved" Siglent offers so much more for the money. The SSA3021X may become what the DS1000Z is among the oscilloscopes or the FLIR E4 among the thermal imagers...
Cheers,
Thomas
-
Karsten -
yes there is a 1Hz RBW mode that had been activated in the "Werewolf Mode" of the 07.05 firmware.
I wasn't sure of that from a few weeks back so I hunted back through the threads and AFAIKT 7.07 had been released for a short while so I find it hard to believe rf-loop would keep using 7.05. He may chime in and confirm just which FW he used at the time.
-
Karsten -
yes there is a 1Hz RBW mode that had been activated in the "Werewolf Mode" of the 07.05 firmware.
I wasn't sure of that from a few weeks back so I hunted back through the threads and AFAIKT 7.07 had been released for a short while so I find it hard to believe rf-loop would keep using 7.05. He may chime in and confirm just which FW he used at the time.
Every single test, image, data, etc what I have published in this EEVblog forum have used 100.01.02.07.05h only.
-
Karsten -
yes there is a 1Hz RBW mode that had been activated in the "Werewolf Mode" of the 07.05 firmware. So it had to be possible to enable this "officially" as well, which is done by including the definition <_t1HZ>TRUE</_t1HZ> and/or <_1HZ>TRUE</_1HZ> in the options definition line. I found that editing the fun_opt_valid_config.xml with the <tEffect> parameter set to -1 for the desired options also enables them permanently. So there are several methods to achieve the desired goal.
Cheers,
Thomas
In the fun_opt_valid_config.xml you also find a <t3M> option besides the <t1HZ> option.
Enabling the <t3M> option extends the range of the Resolution Bandwidth (RBW) filter to 3 MHz, where it’s now limited to 1MHz
Cheers,
Peter
-
There is still one little thing you need to take care of.
Wipe the user data because it was stored when the machine thought is was a SSA3021x where it’s now a 3022x, and this results in errors in the logs because the XML isn’t compatible.
Goto: System —> Pwr On/Preset —> Reset & Clear to remove all previously local stored user data.
My SSA3021X came with 07.06 firmware. This version does not have a Reset & Clear. I presume earlier firmware versions also do not. I have since upgraded to 07.07.
-
There is still one little thing you need to take care of.
Wipe the user data because it was stored when the machine thought is was a SSA3021x where it’s now a 3022x, and this results in errors in the logs because the XML isn’t compatible.
Goto: System —> Pwr On/Preset —> Reset & Clear to remove all previously local stored user data.
My SSA3021X came with 07.06 firmware. This version does not have a Reset & Clear. I presume earlier firmware versions also do not. I have since upgraded to 07.07.
7.07 is first version where is Reset&Clear.
-
Correct the 7.07 firmware has the reset & clear.
The reset & clear is necessary to prevent errors in the logs while reading the user preferences configuration xml’s during boot time once it’s changed into a SSA3022x.
You'll find the config xml’s here:
/usr/bin/siglent/usr/config
you find the logs here:
/usr/bin/siglent/usr/log
The “New.ERROR” log always points to the latest error log
If after a reboot of the analyser this log does not show XML read errors the reset & clear is not necessary.
In the PwrOn/Preset menu you can store your own preset, and this will probably also fix it because it overwrites the previous configuration.
As far as I’m aware your SA will also work fine even with the errors in the log.
I presume the errors will automatically disappear over time due to normal use.
Now you know where everything can be found, you can check for yourself if any action is needed.
-
Gentleman,
kind regards to Tom and the group. Got my 3021X today, unpacking, checking for Ser. N°, 10 minutes later it became a 3032X :)
Sold my old HP 8592B instead few days ago since I'm no longer active beyond 3 gigs.
Ah, what a brand new world having a rather sharp and coulered screen in front instead of the old ray tubes.
Udo
(http://www.dk5ya.de/img/p1090506.jpg)
-
Nice upgrade from a dinosaur to a state of the art full color spectrum analyzer :)
-
Gentleman,
kind regards to Tom and the group. Got my 3021X today, unpacking, checking for Ser. N°, 10 minutes later it became a 3032X :)
And with FW 7.07. 8) I wasn't sure if that was possible, thanks for the confirmation.
Welcome to the forum dk5ya
-
Dear tinkerers,
I also have a 3021X patched to 3032X since some days, many thanks to Tom for the easy USB-Stick method.
Today I want to enter the EMI mode, but it wasn't present at the menue. What must I do to get the EMI function?
-
Today I want to enter the EMI mode, but it wasn't present at the menue. What must I do to get the EMI function?
Pity, same here. No way to load EMI mode via mode select. Not part of the menu.
-
Anybody out there with a patched 3021 and FW 7.07 who could try a series of reflection measurements? Ain't working here for whatever reason. :-\ Just a lot of BS on the screen, no phase angles, just nasty noise.
Edit: Checked several 1/2" cellflex jumpers with my VNA and with the Siglent. While the VNA shows reflection perfectly the Siglent is just producing a bunch of BS.
U.
-
Hi,
I have the Siglent SSA3021X.
Look at the two pictures. I think you are looking for "EMI" at the wrong place! It is an optional filter setting in the BW menu (picture 1)
The second pictures shows the reflection measurement.
Perhaps I missunderstood you guys or previous firmware releases (which I didn't install), had different menus.
EDIT: Didn't understand what you meant with reflection measurement not working - apparently you did enter the option, but you are not seing the expected signal. Did you configure the Amplitude, RWB and sweep accordingly to your signal? This software option actually comes as a kit with a reflection bridge. You don't need to use that one in particular. See here: http://www.siglent.eu/rbssa3x20.html (http://www.siglent.eu/rbssa3x20.html)
Regards
-
FYI a very recent SSA3032X that I've got from the factory and sold to a forum member had the latest (7.07) FW installed ex factory.
Gentleman,
kind regards to Tom and the group. Got my 3021X today, unpacking, checking for Ser. N°, 10 minutes later it became a 3032X :)
dk5ya's post a few day back shows the :-/O can be done with latest FW and all options showing as enabled.
We can only ask if dk5ya bought his 3021X with any options installed. He did not make this clear. :-//
Or were they all enabled with :-/O
-
The plain SSA3021X without any options and shipped FW 07.07 can be hacked and all options activated through telnet.
Regards
-
I'm using a MiniCircuits directional coupler with the reflection function. Appears to be working fine for me. Measured values are approximately those expected for the displayed image.
Anybody out there with a patched 3021 and FW 7.07 who could try a series of reflection measurements? Ain't working here for whatever reason. :-\ Just a lot of BS on the screen, no phase angles, just nasty noise.
Edit: Checked several 1/2" cellflex jumpers with my VNA and with the Siglent. While the VNA shows reflection perfectly the Siglent is just producing a bunch of BS.
U.
-
Dear tinkerers,
I also have a 3021X patched to 3032X since some days, many thanks to Tom for the easy USB-Stick method.
Today I want to enter the EMI mode, but it wasn't present at the menue. What must I do to get the EMI function?
EMI-SSA3000X /EMI Measurement Kit (Software)
You can select EMI filters in BW menu. (200Hz, 9kHz, 120kHz (-6dB))
QUASI peak in Detector menu.
Also you can adjust Dwell time from 0 to 10s
AMK-SSA3000X /Advanced measurement Software
You see these measurements in measurement menu:
Channel power,
Adjacent channel power ratio,
Time domain power,
Occupied bandwidth,
Third-order intercept,
Refl-SSA3000X /Reflect Measurement Kit (Software)
Push MODE button
There you see:
Spectrum Analyzer
Reflection Meas
(Without this Refl Option, in MODE menu only Spectrum analyzer)
TG-SSA3000X /Tracking Generator Kit (Software)
TG can use.
I have used Mini-Circuits directional coupler ZFDC-20-5 (N) With tracking gen.
(If need better directivity etc then can use what ever better Return Loss Bridge (RLB) .)
This can use also of course with Reflection Meas Option. (Also same measurements can do without this option. Just need TG, Bridge and slide rule)
-
EMI-SSA3000X /EMI Measurement Kit (Software)
You can select EMI filters in BW menu. (200Hz, 9kHz, 120kHz (-6dB))
Thanks rf-loop, yes I can select it :)
But I'm a little confused about mode menu description at Manual, there is called a switch to EMI also.
Do you know, how to load the EMI limit value lines?
-
We can only ask if dk5ya bought his 3021X with any options installed. He did not make this clear. :-//
Or were they all enabled with :-/O
No I didn't, it was just a plain 3021X. Meanwhile the suspect was caught, poor reflection measurement was caused by a rather ancient directional coupler out of my junk box with a sma jack that was loose |O. Don't try reflection measurement in the middle of the night :-[.
EMI mode: the manual is somewhat unclear saying EMI mode has to be selected in MENU mode but BW mode is the right one.
Everything working fine now here.
-
@MF-jockey
I think you have old User Manual, version UM0703X-E01A.
Current version is:
UM0703X-E02A
There:
"Mode| Selects the Spec Analyzer\Reflection Meas"
But also this current version is not like real User Manual including all detailed information, it is more like "Quick Start Manual"
SSA3000X documents:
http://siglenteu.com/prodcut-wd.aspx?id=1252&tid=18&T=2 (http://siglenteu.com/prodcut-wd.aspx?id=1252&tid=18&T=2)
-
Do you know, how to load the EMI limit value lines?
I think you can make what kind of limit lines what you want. (there is many sources for limit values)
Here is just example. (this limit line is not EMI limits, it is just free hand edited some kind of limit line.)
There is 2 limit lines what can show on the screen and both can include max 100 points.
Attached image.
Attached .lim file. (limit line) (do not touch inside file, just edit file name, only remove last .txt)
Attached .STA file (SSA settings) (do not touch inside file, just edit file name, only remove last .txt)
If you want try, reset SSA to all defaults.
Load .STA (settings)
Load .lim (limit line as in image)
After loading .STA spectrum go to EMI RBW 9kHz, Start 100kHz, Stop 30MHz, horizontal scale log. Level show dBuV
(I'm not sure if this .STA works in your unit with different FW etc so it perhaps do not set all settings right)
If settings works ok and after loading also .lim (limit curve) then your display looks like this image.
If not, try first BW EMI off and back on and select 9kHz EMI RBW.
If can not get this working with these files then these are not compatible due to different version.
Note that limit lines are based to x-freq, y-level coordinate points so if you change level settings or frequency settings, limit line stay as defined.
(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=252137:image)
Before use these in SSA:
Attached .lim file. (limit line) (do not touch inside file, just edit file name, only remove last .txt)
Attached .STA file (SSA settings) (do not touch inside file, just edit file name, only remove last .txt)
-
Is this Tracking Generator also hackable or need any kind of board to work not included on the basic unit ??
-
Is this Tracking Generator also hackable or need any kind of board to work not included on the basic unit ??
Every SSA3000X (sold outside China *) ) have full TG hardware.
It need only activate by licence key what you can buy. Official price in europe 169.00 eur (VAT 0 price).
For other things in your question you need only carefully read this topic and you find (nice) answer.
Specially starting from this. (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998095/#msg998095) and continue reading and soon you find also @TurboTom message including attachedt zip file. Inside there is .txt file. Read it.
*) Inside China there is available more SSA3000X models. (these can see only Siglent China domestic chinese language sides)
-
Another question where in US have the best deal for this instrument List price 1595 USD, anybody know promotions or better price in USA
-
Another question where in US have the best deal for this instrument List price 1595 USD, anybody know promotions or better price in USA
You can try Saelig EEVblog member discount. Perhaps ypu can ask using PM from EEVblog member "rickv14623"
http://www.saelig.com/category/siglent-spectrum-analyzers.htm (http://www.saelig.com/category/siglent-spectrum-analyzers.htm)
-
Thanks coupon didn't work I asked one let's wait for Saelig reply
-
I purchased one from Saelig, I requested the EEVBOG discount and they provided a quote with the discount. Great value.
-
Thanks coupon didn't work I asked one let's wait for Saelig reply
Check your PM's and email. ;)
-
Some times need look signal what is low and near much higher level signal.
This image perhaps give some idea how it works.
Here is 0dBm 4MHz AM modulated signal. Modulation % is quite low but generator setting is not very accurate for this (8644B).
There is also weak signal from other signal generator. Only 5Hz off from 0dBm signal and level ~ -71dBm
(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=257650;image)
(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=257652;image)
It is clear that in this case using RBW 10Hz can not do anything but measure power level what is inside this filter.
Trace 1 is using 1Hz RBW
Trace 2 with 10Hz RBW and also measured shape factor. (-3dB level width is checked also and it is 10Hz)
-
Hi to the group,
can, please somebody help / i have try Telnet login to SSA3021x / login " root" , and next password, but than i cannot tip any character for password "ding1234"|O
Thanks
Supplement - someway have login - but what now :-// sorry for my behavior but i am not pc expert att all :palm:
Supplement1 - SUCCESS - :clap: :-+ :-+ :-+ apology to the group
-
1) It is "root", not " root".
2) Telnet can be slow, especially if you do not open the SETTINGS/SYSTEM INFO screen.
What hardware revision/firmware version are you running?
Regards,
Vitor
-
OK, I understand (added 'supplement' at 06:40) that you already got the login now.
Given this I just can say:
C'mon. It is all in this thread. And this thread has currently only 5 pages.
I would understand if somebody cannot find an information in a 50 or 100 page thread. But I think it can be expected that you will find the "hack for dummies" instructions in a 5 page thread.
Hint 1: look right in the middle
Hint 2: it might be also helpful to learn the commands of a unix/linux editor. You will find plenty of helpful pages with Google.
-
Thanks for quick responses - have succeeded :-+
Regards
Vitor -
SW1 100.01.02.07.07.
SW2 20160606-2
SW3 000000D1
HW 07.03.00
Tnx
SPECIAL THANKS - besonderer Dank - to Turbo Tom :-+ :-+ :-+
-
So what was the problem preventing the login? Would be nice to know!
Regards,
Vitor
-
Unfortunately i was - that was my very first time(Telnet and other software stuff...) :palm:
Regards
-
Hi all,
I have my SSA3021X since two weeks now.
and want to thank all smart contributors about the firmware.
Sort of collective intelligence.-:/
Now follow a few measurements of the SA which I've performed.
Sideband noise.
I've used an ultra clean 10MHz OCXO from Wenzel (Streamline) with a spec'ed
phase noise of -165dBc/Hz @ 1kHz (or greater) offset.
The SA showed a sideband noise of -112dBm/Hz on 10MHz at 10kHz offset.
This translates to -98.36dBc/Hz when referred to peak carrier.
For comparison:A HP70200C is spec'd with -108dBc/Hz under the same conditions.
TG
The restriction of the minimum RBW to 30kHz limits the dynamic range of S21 measurements
to 70dB due to the raised DANL.
This may or may be not an issue depending on the DUT.
E.g. a high quality crystal filter on 5.645MHz was measured once with the Siglent and once with a low cost
VNA,see http://w5big.com/vna2180.htm. (http://w5big.com/vna2180.htm.)
The SSA cannot show the full ultimate stopband attenuation down to -110dB while the VNA can.
For a simple HF LP-filter 70dB dynamic range is adequate.
3Hz and 1Hz RBW
These two non-factory "options" are of limited use.
They work down to signal levels of about -130dBm.
Below this level amplitude accuracy drops dramatically.
E.g. at -133dBm the indicated level is off by 4dB (low) and a -140dBm signal
isn't visible any more while a -143dBm signal at a RBW of 10Hz is clearly visible
TG Addendum
I'have hooked up the TG to a SDR,see the screenshots.
One can see the discrete frequency hops and in the zoomed-in capture
there seem very small continous frequency sweeps visible.
That fits with what was reported earlier in this thread.
Regards
Clemens
-
I'have hooked up the TG to a SDR
What is this Persues?? ???
-
What is this Persues?? ???
Looks to be this:
http://microtelecom.it/perseus/
Sent from my iPhone using Tapatalk
-
Like I'm suppose to know what that is. :-//
-
Just a note:
A new firmware was released, which apparently disables activated options and is not downgradable.
Extraction of the firmware revealed that the password is unchanged.
No further information exists regarding the possibility of reactivating the options.
Current advise is to NOT upgrade and wait for people with P08.01 to tell if TELNET access and activation hack is possible.
Regards
-
Probably why the update took longer. :--
-
I look into update scripts and before there was only NSP_system_info.xml
and now it needs nsp_data_b too, which is NSP binary data, I think...
This is the new file in firmware. 128 bytes = 16 x 8, probably crypted.
And somehow is suitable for everyone...
But this can't be difficult. You need to increase sales... for cristmas time. What you do...
There is needed little shaking but not earthquake. You make this upgrade and this must
be solvable in suitable time. So every potential buyer-hobbyist who was not sure before
but like this toy, might lose his opportunity and like buy it now before they lock it with next
radical update. Next upgrade of course has the same effect. But only if this showstopper
is being solved. Otherwise you lost all who buy them with counted money or for toy.
Normal professionals don't use and can't use hacked tools anyway.
(Why not, we can. No, you can't provide service with tool, which tomorrow don't have
needed bandwidth or options.)
(Counted money - you count every cent and think weeks before spending anything)
-
For small companies using a piece of hacked equipment doesn't need to be a problem especially with cheap Chinese gear which probably never sees the inside of the manufacturer's calibration department anyway. However losing the options (3.2GHz) with each firmware update and no guarantee they come back makes the SSA3000 series very uninteresting compared to a used spectrum analyser. I was very tempted to buy a SSA3021X but with Siglent plugging the holes I'm happy I went for a used on instead.
-
I bought mine way ahead of the actual date I had planed to buy one, to make sure I get a hackable unit.
I was then surprised that the hole was not fixed over the period of several months. I was wondering "Could it be that they want to mimic what Rigol did?".
Now that the hole is fixed, I am glad I have mine: I would never get this amount of functionality (not just the extra frequency range, but especially the advanced measurments, too) for 1449 Euro.
Buying a second hand SSA is not that easy an alternative!
Believe me, I have purchased lots of measuring equipment second hand and for years I look at spectrum analysers, especially on German eBay. It seems they have some magic with them, making them more expensive, the older they get. I just did a quick search: you literally get nothing for less than 4.000 Euro and those are all pretty old (actually there is one, that seems moderatly interesting - http://www.ebay.de/itm/Advantest-U3641N-Spectrum-Analyzer-9kHz-3GHz-/262392475296 (http://www.ebay.de/itm/Advantest-U3641N-Spectrum-Analyzer-9kHz-3GHz-/262392475296)).But what if you buy a second hand unit and it comes broken, uncalibrated, develops a fault within days or weeks, etc.? And any SSA with more than 5-10 years is probably outdated when it comes to processing power.
Unless you need some huge frequency range, where a new unit would literally cost a 5 digit number and you could get a second hand one for a 4 digit number, I would steer away from them. Too complex, too difficult to repair, too difficult to get spare parts.
In my opinion, the Siglent SSA3021X is great value and let's be honest: even without hacking it, it is a spectacular device for its price range. Siglent does not need to push it through pseudo-hacking.
Regards,
Vitor
-
You forget that your current firmware version still may have flaws and you won't have future enhancements Siglent may add IF you want to continue to use the liberated options.
BTW Used test equipment in Europe is usually very expensive so most of mine comes from overseas.
-
I know that, but when I purchased mine, I did my research and concluded that the current state of the firmware was good enough for me. I don't really care about PNG file format and I prefer to use a noise source over the TG for my applications.
Also, I doubt you get new FW for older units and they certainly have bugs, too.
But of course you are right: I might end up in a situation where I have to decide between keeping the hacked options or getting the new options from a newer FW. However, in that case I still have the option to purchase the missing keys, like the one for advanced measurements.
Also, knowing that the hardware is there and it is just software-locked gives the hope one might end up hacking it again... Still better, than having different hardware between models.
And I guess my unit just got more valuable over night! lol
Regards,
Vitor
-
Hi to all,
despite the momentary situation, SSA3000X is and stay one marvelous instrument,
with price (and given possibilities for that price) unattainable from every other manufacturer.
I hope that Siglent is wise enough, to make right decision. :D
Regards
-
I contacted a dealer via e-mail if he had existing stock and received this reply;
Thank you for your interest in our unit.
Currently, we sold all our stock. The new stock will be available as of next Friday Nov 18th.
We are currently running a 5% discount on Siglent units, if you are interested in moving ahead with this analyzer, please send us your email and we will forward the update price.
I called another dealer and was told (not surprisingly) that they don't 'stock' these, they come from Siglent (which seems very typical for all of these T&M dealers).
Interesting about the date of availability. ;)
-
That was the same with me. When I purchased the device it said "IN STOCK", yet the device had to come from China to EU first and only then was shipped to me.
The truth is, that it kind of makes sense. A SSA is not a mass consumer product and I imagine there are not that many being sold. So it would not make much sense for a small to medium distributor to actually stock them, when the retail price is almost 1500 Euro!
If you place yourself in the distributor role, you would do exactly the same or close business very quickly.
And again: Even without any hack - the Siglent SSA3021X is a fantastic product at this price and there is no other option in this class. You get a full 9kHz to 2.1GHz sweep spectrum analyzer at 1449 Euro. End of story.
Regards,
Vitor
-
(actually there is one, that seems moderatly interesting - http://www.ebay.de/itm/Advantest-U3641N-Spectrum-Analyzer-9kHz-3GHz-/262392475296 (http://www.ebay.de/itm/Advantest-U3641N-Spectrum-Analyzer-9kHz-3GHz-/262392475296)).
Regards,
Vitor
Moderately interesting,that's true.
It has a 75Ohm input and no TG.
Unless you need some huge frequency range, where a new unit would literally cost a 5 digit number and you could get a second hand one for a 4 digit number, I would steer away from them. Too complex, too difficult to repair, too difficult to get spare parts.
In my opinion, the Siglent SSA3021X is great value and let's be honest: even without hacking it, it is a spectacular device for its price range
I agree with you on this.
Regards
-
Unexpectedly found some short review image (https://app.box.com/s/ckqknbcbtdyyobum8ena11e4pw9ahyrv).
-
You already had funeral ceremony ... ?
OK, but christmas already here, I'm back from work and had time to sit down.
After scrolling this file up and down quickly and slowly, my eyes... did start shutting down.
But in some state I saw this code in this nsp_data_b file.
<?xml version="1.0" encoding="UTF-8"?>?<sn_backup_root>? <factory>TRUE</factory>? <pro_mode>TRUE</pro_mode>?</sn_backup_root>?
-
No funeral ceremony!
The games have just started! :)
Regards
-
The new firmware offers some appealing features (except #5):
1. Add “PNG“ file type for screenshot.
2. Support TG in RBW less than 30 kHz.
3. Modify default TG output power, -20 dBm in spectrum analyzer mode and 0 dBm in reflection measure mode, and some other TG issues.
4. Updating the format of “LIM“ file. After this firmware , the old limit files will not be supported. You can re?????? them through “EasySpectrum” free software easily.
5. After this firmware, do not support downgrade operation.
Particularly #2 seems most interesting because it lowers the noise floor when using TG and thus
extends dynamic range of measurements of highly selective filters,see
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=268127;image (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=268127;image)
Regards
-
Another remaining and very concerning issue with P08.01 FW is that the remaining Option trial times vanish. :rant: :wtf:
I have just sent a stern email to Siglent about this.
My advice is DO NOT install P08.01 FW at this time.
-
I contacted a dealer via e-mail if he had existing stock and received this reply;
Thank you for your interest in our unit.
Currently, we sold all our stock. The new stock will be available as of next Friday Nov 18th.
We are currently running a 5% discount on Siglent units, if you are interested in moving ahead with this analyzer, please send us your email and we will forward the update price.
I called another dealer and was told (not surprisingly) that they don't 'stock' these, they come from Siglent (which seems very typical for all of these T&M dealers).
Interesting about the date of availability. ;)
AFAIK all USA stock is held in Ohio at the Siglent US subsidiary and if they're out of stock then only "on hand" dealer stock will be available.
Did you try Saelig ?
https://www.eevblog.com/forum/testgear/equipment-discounts-from-saelig/ (https://www.eevblog.com/forum/testgear/equipment-discounts-from-saelig/)
-
This quoted is last message (now) in SSA3000X thread. (I will quote all after last FW 8.01 things from there to here. This thread is right place for SSA mods....
So please wait
from https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/)
*** These posts should really be moved to the "Hack of Sigllent spectrum analyzer ssa3021X?" @thread... Can some MOD do this, please? ***
Regards,
Vitor
Lets hope all "how to try hack or how to hack" etc is important to move to this thread:
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/ (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/)
It looks like moderators are not interested about this.
The situation in which all messed up should be avoided.
Without MOD help it is possible also to other way. Some people can make one message where is quoted all this kind of messages. The chronology is also an important.
But, still I think that doing it now is better than later. After then there is small chronology mess with hack thread messages. But if do not it now, later it is perhaps more hard.
What is good point to start quote and copy to hack thread. I recommend that starting from first message about new 8.01FW.
I will do it starting from message 502 in this thread by tautech. Even when it confflict time order in hack thread.
I will do it but please do not send new messages to this or hack tread until done.
Later after done, please post all hack related messages to hack thread, only. (use and test results wwith hacked or factory condition SSA of course to what ever thread.
So, please do not send new message until done!
-
New FW for the SSA3kX
http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA3000X-P08.01.rar (http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA3000X-P08.01.rar)
P08.01
7.2 Mb
From the changelog:
1. Add “PNG“ file type for screenshot.
2. Support TG in RBW less than 30 kHz.
3. Modify default TG output power, -20 dBm in spectrum analyzer mode and 0 dBm in reflection measure mode, and some other TG issues.
4. Updating the format of “LIM“ file. After this firmware , the old limit files will not be supported. You can re?????? them through “EasySpectrum” free software easily.
5. After this firmware, do not support downgrade operation.
Warning: A quick check revealed to me that the root password has changed!
Because you cannot downgrade the firmware, you would be stuck at the moment!
Regards,
Vitor
And the liberated options are also gone.
So BEWARE!
My quick check shows exactly the same files in \passwd folder
so nothing changed there...
You are right. :palm:
Both passwd and shadow are the same, at least for root.
I must have gotten stressed, as I was lecturing while doing the anlysis through RDP.
Sorry.
Regards,
Vitor
To make up for my mistake, here is a Windows tool that will convert an *.ADS file into a *.ZIP file.
It will open with 7Zip, but the resulting ZIP is not free of errors. Most can be extracted, though.
All credits go to janekivi for his brilliant insights, which he shared.
Have fun.
Regards
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/?action=dlattach;attach=269048 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/?action=dlattach;attach=269048)
And the liberated options are also gone.
So BEWARE!
Have you tried activating them again through TELNET?
It kind of makes sense for Siglent to replace the edited license file with a new one, as offical customers will have the activation code to reactivate everything.
I wonder if they only reset the evaluation time settings or the actual activation settings: the hacks described in the other thread point to two different ways of doing the hack. One way is to change the eval period to infinite, the other consists in setting the option as activated.
Regards
Have you tried activating them again through TELNET?
Yes.
Seems to be a completely different method now.
There is a new file w/ entered license keys.
The liberation method described above doesn't work anymore.
Cheers
Sorry to hear that.
Probably the application executable checks the signature of the authorised options. Without the key, nothing can be done, which is why they didn't even bother to replace the root password.
I would say that Siglent spectrum analyzers are locked again and probably for good.
Regard
Two things I noticed after upgrading from P07.07 (100.01.02.07.07) to P08.01 (01.02.08.01)
I had enabled all options and changed the model from SSA3021X to SSA3032X prior to the upgrade.
After the upgrade all options were lost but the model stayed with SSA3032X. In addition the newly created NSP_sn_bandwidth.xml has been appended with a license key for 3032.
Firmware downgrade is very simple. If you overwite ecomb (5054420 Bytes) with the previous ecomb (5007948 Bytes) from P07.07 all options are back.
ecomb is the main application located at /usr/bin/siglent. In order to replace ecomb you need to temporarily remount the rootfs as rw (read-write).
mount rootfs -o remount,rw
cd /usr/bin/siglent
cp /usr/bin/siglent/usr/mass_storage/U-disk0/ecomb . (in case the downgrade ecomb is located at USB stick)
sync
mount rootfs -o remount,ro
shutdown -r now
Thanks!
For all: The ecomb file can be accessed easily by converting the P07.07 ADS firmware file with the tool I attached a few posts before.
Open the resulting ZIP with 7Zip and extract ecomb.
So this is step 1: downgrade is possible again!
One thought:
If you can just copy ecomb from P07.07 and it works fine with all options back, how about writing a script for /etc to alternate between one ecomb and the other? Like you turn the SSA on and get P08.01. Turn it on again and you get P07.07 and so on. Even better would be some kind of boot menu...
*** These posts should really be moved to the "Hack of Sigllent spectrum analyzer ssa3021X?" @thread... Can some MOD do this, please? ***
Regards,
Vitor
Well, the situation isn't as hopeless as initially assumed: if you use peterdb's method of "liberating" the machine (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998095/#msg998095 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998095/#msg998095)) and modify the license node in /usr/bin/siglent/firmdata0/NSP_system_info.xml to look like this:
<license><_3032>TRUE</_3032><_3021>FALSE</_3021><_TG>TRUE</_TG><_EMI>TRUE</_EMI><_Meas>TRUE</_Meas><_CAT>TRUE</_CAT></license></system_information>
and make sure all traces of previous hacking are eliminated -- don't forget to delete the "monster.txt " (not sure if all this is really necessary) and then apply the firmware update, a set of license codes will be generated automatically and the options will stay active (just tried it on my SSA*X).
The new firmware apparently doesn't support 1Hz and 3MHz RBW anymore. Operation with the tracking generator active has been improved, yet when operated in the area that normally is covered in FFT mode, it continues to sweep and gets unbelievably slow. I always thought the Rigol DSA was a dog but if you have to use the Siglent in this high-res TG modes, you'll get a new definition of "slow"! Yet, the results are better than before, the SSA hasn't got a problem to properly measure the parallel resonance of my high-accuracy 1MHz glass-tube crystal. But still, when zooming further into the spectrum, funny artefacts become visible, yet I'ld say the result is now completely usable as it is. Did I tell it's slow? ;)
So much for now, I may report back once I had more time to play with it.
Cheers,
Thomas
Hi,
Finally got some time...
I upgraded mine and had no problem. All options remain active.
As I thought:
I wonder if they only reset the evaluation time settings or the actual activation settings: the hacks described in the other thread point to two different ways of doing the hack. One way is to change the eval period to infinite, the other consists in setting the option as activated.
Those who actually activated the option instead of messing with the trial time will have those options with P08.01.
I confirm that the 3MHz RBW is gone. Maximum RBW is 1MHz.
I have not tested the 1Hz RBW, as I did not activate it.
So apparently, Siglent is not being too harsh. :-+
Regards
There is a new version of the EasySpectrum software, too:
ReleaseDate
2016/11/10 18:04:23
Version: P03.02
Note:
1. Support manually IP connection.
2. Support editing and exporting “Correction” file.
3. Support editing and exporting “Limit” file, and off-line editing.
4. Add scale line to “Spectrum Monitor” mode
Regards
...
So apparently, Siglent is not being too harsh. :-+
...
True but I guess for those who will purchase the machine with a firmware newer than 7.07, things may look different. Apparently, during the update 7.07 -> 8.01 the encrypted license codes will be generated if the corresponding files are correctly "prepared". During this update, the machine boots twice (at least mine) - would be interesting to know what it's doing there ;).
And since a "proper" downgrade of the firmware is inhibited now (at least Siglent states this - I believe them and didn't test it), this "easy road" will be closed for future machines. There might be other options, for example if a set of files in the /usr/bin/siglent/firmdata0/ directory of a "liberated" machine gets leaked, it might run as well on a new machine, of course cloning the serial number of the "donor".
Cheers,
Thomas
P.S. I modifed the attachment in my "patch instructions post" to be compatible with the firmware update (they have to be applied before the performing the update!) -- see here: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998366/#msg998366 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998366/#msg998366)
As mentioned before, you can downgrade, copying the P07.07 ecomb file on top of the current one.
This would allow modifying the license file and then copying back the P08.01 ecomb file.
I have not tested this, though.
Regards
These are copy (quote) from SSA3000X thread. All msg including and after tautech message #502.
Please continue all SSA3000X modification messages here. If you guote from these quoted msg do not forget include original member name from quote.
Keep these introductions, test and other discussion in SSA3000X thread.
All modifications related instructions and study to this "hack" thread for avoid mess.
-
Please continue in this thread all SSA3000X "modifications - hack" and hack study messages to this thread.
-
Thanks @rf-loop for relocating the recent SSA "improvement" posts to the proper thread.
Today I had a good laugh - Siglent made "liberating" the machine after the update even easier for us: Just delete all files (but not! the "calib" directory) from the directories /usr/bin/siglent/firmdata0/ and /usr/bin/siglent/usr/backup/ (of course after backing up to USB pen drive). If you reboot the SSA after this, the serial number will be displayed as "xxxxxxxx" but all options will be enabled along with 1Hz and 3MHz RBW, so nothing lost against firmware 7.07. In case the machine needs to be sold / repaired, the deleted contents can be copied back and everything returns to normal. Probably upon the next F/W update, Siglent will close this hole for good reason, so enjoy it as long as it's available 8).
Cheers,
Thomas
P.S. I also attached a screenshot of a TG scan of my "difficult" crystal that the SSA had problems to analyze with the 7.07 F/W.
-
Confirmed the joke :-DD
Thanks for finding that out.
-
Turbo Tom - :-+ :-+ :-+
-
I'm planning to order a new SSA3021X.
Do you guys think that I could hack my machine and get all options ? :popcorn:
-
@xenonfire:
for the 8.01 firmware yes, what the future will bring, noone knows.
Cheers,
Thomas
-
Confirmed the joke :-DD
Ditto! :-DD
-
To make up for my mistake, here is a Windows tool that will convert an *.ADS file into a *.ZIP file.
It will open with 7Zip, but the resulting ZIP is not free of errors. Most can be extracted, though.
Regards
Here the tool did not work on a W7/64 machine.
The resulting ***ADS.zip file could not be opened or extracted at all with 7Zip .
The error message says just this "...could not be opened as archive..."
What might be the reason?
Regards
-
The ZIP will be still corrupted, but everything essential is extractable. Check if you are using a recent 7zip version.
Also, this tool only works for firmware files of the SSA3921X.
Regards,
Vitor
-
Check if you are using a recent 7zip version.
Thanks,that did the trick.
I had v9.2,now it's v16.04 and it works.
BTW:Is there a difference between the *genuine* files
NSP_system_info.xml
and
fun_opt_valid_config.xml
of FW 7.07 and FW 8.1?
Regards
-
Hey!
Thank you for the awesome hack and instructions. I just successfully unlocked all the features on my SSA with sw 7.07.
Now I wanted to upgradeto firmware v8.01 but it doesn't seem to be working - there is no progress bar and it nothing is happening for almost 20min now. How long should the upgrade process take? Have anyone experienced similar problem?
Edit: I turned off and on the device and tried again. Immediately after pressing upgrade "System upgrade failed" message is displayed and nothing happens.
-
I tried to upgrade once again with version 7.07 and after 40% device restarted and never came back from boot screen. :-[ I see green light flashing inside the housing but nothing is happening. Is there a way to restore it back or will I have to send it back for service?
-
Can you still telnet to the device?
How did you restart the second flash attempt?
It shouldn't be possible to downgrade.
Either you did something wrong with the hack or you might have a bad flash.
Consider restoring to unpacked version and then open a support case.
Regards,
Vitor
-
Hi.
Thank you for your reply!
No, I think network is not up during boot screen.
I tried to upgrade to 8.01 but without success (device stayed operational on v 7.07). Then I tried to upload v7.07 firmware to see if this is working. It went to 40%, rebooted and stayed in boot screen.
For the hack I followed @TurboTom instruction and they worked. Before that made a backup firmdata0 folder and also tried to make a backup of ecomb file but I coudn't because it was in use. Maybe that was the source of the problem at the first place.
I is possible to access console with USB?
-
I tried to upgrade once again with version 7.07 and after 40% device restarted and never came back from boot screen. :-[ I see green light flashing inside the housing but nothing is happening. Is there a way to restore it back or will I have to send it back for service?
It is very clearly said in every place. After 8.01 can NOT downgrade.
In first place.
And all times when do what ever FW update it need do using USB stick what really works reliable with equipment and it need be true proofed with tests BEFORE any attempt to FW update. This is so clear thing that this do not need write instructions.
Also, least with every other Siglent equipment. USB need be in native FAT32 format. It must have single partition. Its connection to USB bus need be as reliable as also power to oscilloscope. During whole update process, do not touch USB (for avoid any possible contact fail)
Also after stored .ADS file to USB stick it is very good practice to check it match with original unzipped file.
During FW update from 7 to 8 version SSA do several self restarts (boots) before it is ready.
It do not really take 20min. So in first place something have gone wrong.
I have updated more than one SSA (and whole load of other Siglent equipments and never meet any problem) and update works just rock solid when do it exactly as instructions and out from instructions of course first be sure that USB is sure ok and update .ADS file is exactly ok in root of USB.
What was idea for update 7.07 after failed 8.01 update.Why? Just for fun or with some knowleedge what to do. Is it better first study and after then think what to do.
Now, do NOT ANYTHING more before you know exatly what is safe to do next.
One question.
You say you have modified 7.07 before you start update FW update for 8.01
Who told you this can do and is it possible there have been some exeption when you have done it - example accidentally. There is several possible modifications and methods in FW 7 versions. It need know exactly what can do and what can not do, except if you can yourself analyze what can and what not.
Do you remmeber if there was perhaps h letter after FW version number last time before this all..
I "can not" give any instructions how to continue.
But two questions and depending your answer perhaps some peoples here can try kindly help you.
But at this time my recommendation is: do not try update any more or change anything before there is real knowledge what to do next for avoid possible more deep problems.
Q 1.: Do you have reliable copy of original some files (before any first change in system).
Q 2.: Do you have now normal access to SSA system (via LAN) with PC or what ever telnet terminal? Or is SSA now as "dead"?
-
Hey.
Upgrade to 8.01 never finished. Immediately after starting the upgrade error message "System upgrade failed" message appeared and SSA stayed on version 7.07 (I think there was no h letter at the end). I thought that restoring to the same version (7.07) would clean the system so I could then upgrade to later version. Yes, it was an unproven method but I did't expect any problems, an error message at most. It is clear now that I was wrong.
The USB stick was almost new, in fat32 and I didn't touch it during the process.
The modification I made was to switch original "NSP_system_info" with the one provided in the one of the previous posts but with edited serial number.
Q 1.: Do you have reliable copy of original some files (before any first change in system).
I have a copy of "firmdata0" directory (calibration, NSPfiles, fun_opt file), nothing more.
Q 2.: Do you have now normal access to SSA system (via LAN) with PC or what ever telnet terminal? Or is SSA now as "dead"?
Not via LAN. I have not tried any other options because I am not familiar with them.
I will definitely wait now before doing any further actions but I am afraid there is really not much to be done.
Thank you for your help and support. Much appreciated indeed!
-
Hey.
Upgrade to 8.01 never finished. Immediately after starting the upgrade error message "System upgrade failed" message appeared and SSA stayed on version 7.07 (I think there was no h letter at the end). I thought that restoring to the same version (7.07) would clean the system so I could then upgrade to later version. Yes, it was an unproven method but I did't expect any problems, an error message at most. It is clear now that I was wrong.
The USB stick was almost new, in fat32 and I didn't touch it during the process.
The modification I made was to switch original "NSP_system_info" with the one provided in the one of the previous posts but with edited serial number.
Q 1.: Do you have reliable copy of original some files (before any first change in system).
I have a copy of "firmdata0" directory (calibration, NSPfiles, fun_opt file), nothing more.
Q 2.: Do you have now normal access to SSA system (via LAN) with PC or what ever telnet terminal? Or is SSA now as "dead"?
Not via LAN. I have not tried any other options because I am not familiar with them.
I will definitely wait now before doing any further actions but I am afraid there is really not much to be done.
Thank you for your help and support. Much appreciated indeed!
One more.
When you now turn on it. What all signs about its life you get before you now touch anything but powewr on. Perhaps you can take some picture.
Screen, some leds on etc.
Can you share this knowledge to peoples who perhaps may know things and may perhaps try give some help before hands up.
After documeenting this state perhaps then (well documented) if you can get any response from some buttons. (do any button give any sign about life ..)
You can also try:
(these are just from my random tests and not based to any official knowledge)
Power on and immediately start continuously and fastly "firing" button "Mode" whole boot time.
Perhaps nothing happen?? Shut off. (perhaps mistake in my test "records")
Power on and immediately start continuously and fast "firing" button "System" whole boot time. (works some times)
Perhaps nothing? If nothing...
If nothing...
Boot again and push "System" and keep when power up and keep it continuously pushed down until SSA boot. (Perhaps this is most right...)
You can try these some more than just once.
With these 2 last, I can get my SSA to weak up and surprising something is really reset or something... as 1GHz model SSA3010X !! (if boot after this just normally, it is back normal model again)
If still nothing...lets hope some one have some other things...
If you get it wake up somehow in this or some other special model... do not turn off. After then is time to talk with SSA.
But, I afraid your's can not wake up with some button trick.
But, it do not cost anything...
-
Here is result from boot with "button trick" with my individual SSA
Note that before this it works normally and all official options valid permanent.
Now it is 1GHz model and without any licenses (and other way it works as normal 1GHz model.
If I now shut off it and power up normally, it is again all what was before... normal model and valid official licenses etc.
Just after "button trick" boot...
(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=274706)
Note also that is in some kind of factory reset state because normally it keep user set display image mode after example Preset and Reset. Now it is returned back to "Inverse" mode.
-
@jobber
sorry to hear about your problem with the firmware update and the now bricked machine. I assume you applied the latest patch ("NSP_system_info" change only). This shouldn't have caused any difficulties with the update on an otherwise "clean" system. How long did you own the SA and did you use the "werewolf mode" with F/W 7.05? If you did, a file "Monster.txt" will have been generated that just contains the phrase "hacked!" or the like, of which I don't know if it changes the situation or not. On my machine, I deleted all the evidence of previous tampering before applying the latest update. I also experimented recently with possible up- or downgrade options after the update to 8.01 without any succes so far (but also without any collateral damage...). I recommend trying rf-loop's instructions to revive the instrument and possibly get telnet access again.
If all this fails, and depending on how skilled you are with Linux, you may open the machine and access the TTL level serial port inside. This port is up directly after switch-on and the bootup console is mapped to it. At least this will tell you where the bootup process fails and if it gets far enough, you may interrupt the bootup to enter the UBOOT tool. This would allow you to load a new system image to your SA, provided one of us can generate one -- but I guess this should be possible. Since you've got a backup of your SA's calibration data, restoring the device to proper working condition isn't an issue after that.
Cheers,
Thomas
-
Thanks for your quick responses and ideas!
When press the the power button this is what happens:
- short beep,
- Mode and TG buttons lid on,
- after few seconds LCD screens turns on with Siglent logo on it (splash screen),
and that is it.
I moved it around a bit and noticed that green LED on LAN port is turned on and I can se a green led flashing inside on the PCB the through the vent holes (on same side as USB and LAN ports are). I don't know if this flashing LED is normal but I think it could be an error indicator.
There is no response when pressing buttons and I can only turn it off by holding power button for few seconds. I have tried pressing and holding system and mode buttons after power on but nothing happened - I will try a couple more times later today.
I also connected it with USB cable to se if this is working and I get the "USB device not recognized" message but I didn't have any drivers installed at that time.
@TurboTom, yes, I used patch that you mentioned. The device was one day old and almost unused. I also checked if there was any "Monster" file but I could not see any. For now I would like to avoid opening the device but a boot message from debug console would definitely give some answers.
Would it possible to get some access UBOOT via USB device port on the back?
-
Comment about LED's
Normally when booting front panel TG and Mode button leds on.
Normally when it is powered empty LAN connector green LED is on.
Green LED inside, continuously blinking, is normal.
-
....
The device was one day old and almost unused.
....
Would it possible to get some access UBOOT via USB device port on the back?
It's always risky to modify a brand-new device that had not undergone an appropriate "shake-down period". The "infant mortality" is someting that always needs to be considered. So the problem that you're facing now may well be the result of a flaw in the SA that was there right from the start, and even without the hack or even without your attempt to update the firmware, it may have failed. Of course it's difficult to prove now.
As far as I know, the only way to access the UBOOT menu is via a terminal connected to the UART interface inside the instrument. It's only necessary to remove the outer (plastic) rear cover, the pads of the UART interface can be accessed through an opening in the metal shield. A three-pin header (2.54 spacing) with slightly deformed pins can be inserted so it makes contact to the pad hole plating and routed outside via three wires. I used my SSA like this with this wire secured to the casing with some adhesive tape while I was initially experimenting with it (before the login data was discovered and telnet access became possible).
But honestly, with an instrument that's maybe a week in my possession and fails like you report, I would actually switch to "dumb mode" and try to have it replaced under warranty. I think there's a good chance nobody will notice that you tampered with it.
Cheers,
Thomas
-
I second that: just return it and state the firmware update didn't work. Make sure to take pictures and note the serial number of the unit you are sending back so you can check whether it got damaged and you got the same unit back or a different one.
-
@jobber
Sorry to hear of your misfortune but the sad fact is if you f**k around with hacks these are the risks you take. Expensive brick. :palm:
For your sake I do hope it is a rare product failure and not something you've done. :scared:
Good luck.
-
Thank you guys for all the support!
I did some experimenting with buttons but with no luck. I think that file system or some essential files got corrupt and it doesn't pass UBOOT. I will contact support and ask if there is any recovery that could be used in events when upgrade fails. I will let you know what they will have to say.
It would be nice to know what exactly caused the device to fail so we could at least learn something.
@TurboTom do you think it would really be possible to recover it with cloned image file and UBOOT?
-
Provided there isn't any further (hardware) damage that caused the instrument to fail, I'm pretty sure it should be possible to recover the machine. I once had a similar problem with a Hantek HDG2002B arbitrary function generator (I know the Siglent is another league...), and I was able to recover it from a (reported) NAND FLASH error by rewriting a file system image, albeit it was one that I've backed up from exactly the same machine some time before. Things may become awkward if bad blocks in memory are present in your machine since these locations won't be mapped correctly if uploading a foreign image.
All the best,
Thomas
-
Received my new SSA 3021X yesterday and trying to upgrade through Telnet but I cannot login using "root" and password "ding1234". I am using Putty and
typing "root" for login but when I try to enter a password it will not take one and the screen will time out. I have tried this many times and used other Telnet
programs without any luck. I am stuck. Have they changed the login name? It seems everyone else is able to login, but not me. My machine info is:
SW1 100.01.02.07.07
SW2 20160606-2
SW3 000000D1
HW 07.03.00
Calibration date 2016-10-26
Amy help will be much appreciated.
-
... Have they changed the login name? It seems everyone else is able to login, but not me.
After having started Telnet you have to connect to your SSA
using its IP address which you find when you go into System -> LAN.
You can freely assign any appropriate IP address to your SSA.
Type into the command line 'o 192.168.xx.xx' (without the ' ).
After having established connection you'll be able to log in.
regards
-
Yes I did connect with the SSA through the IP address, no trouble. It returned the Arago Project screen with "am335x-evm login:" as the login with a cursor
to enter the login name. I used "root" and when I hit enter the "Password" was displayed on the next line also with a cursor. However, when I try to enter
"ding1234" as the password I get no response; it will not accept any input at the cursor from the keyboard. It is acting like the login could have changed and not
accepting the password. I do not know what to do at this point to gain access through Telnet.
Thank you for your help!
-
Hi,
Telnet access is sometimes slow. I mean really slow. Open the setup - about screen on the Siglent. This will speed the telnet access up.
Basically, just wait a minute for the login to happen.
Regards,
Vitor
-
Thanks Bicurico and DL4RAJ for the input, but still cannot login to Telnet. Every thing seems to be working as it should but just no response. Bicurico, I do not see a setup screen on SSA except for the System>Interface>Lan.
Is there something I am missing?
Thanks.
-
@Tobey
I don't believe in F/W 7.07 the login was changed, regardless of the purchase date of the SSA. Please also keep in mind that the Linux login is case sensitive. All the letters have to be lower case. The Info page mentioned is accessed on my machine (currently F/W 8.01 "improved") by pressing "System" -> "System Info" after full boot-up. While this screen is displayed, the sweep engine (ecomb) is halted and the O/S background activity isn't affected by it. Please try again exactly as described and report your results.
If you've still got 7.07 running, you may consider updating to 8.81 since this firmware version has the "standard" login configured (unless in between Siglent has applied some changes -- you may try to use an "older" download).
Whatsoever, I hope you'll be able to "liberate" your SSA.
All the best,
Thomas
-
Thanks for the reply Thomas.
I tried to login as you suggested while in "System" -> "System Info", no caps lock on, all lower case. Still no luck. The response time in Telnet seems very good while inputing the login "root" and the responding of the Password request, as good as most other programs I've used. But as before, no response to the input of the password "ding1234". I guess
I will need to try updating to a different sw version as you suggest. I'll play around some more and use a different computer and LAN connection before I do that. Maybe others have the same problem and will give some feedback.
Thanks so much for the help, it is greatly appreciated.
-
... But as before, no response to the input of the password "ding1234".
You did not happen to press backspace before entering "ding1234" ?
I guess you know that there has to be one 'space' between password prompt
and the password itself.
When you type in the password nothing happens on the screen,
i.e. the cursor is staying on the same position as before!
Just enter "ding1234" and then press the enter key.
regards
-
@Tobey
If you've still got 7.07 running, you may consider updating to 8.81 since this firmware version has the "standard" login configured (unless in between Siglent has applied some changes -- you may try to use an "older" download).
Whatsoever, I hope you'll be able to "liberate" your SSA.
All the best,
Thomas
Tom
I wonder if an *unmodified* 7.07 FW version which has been upgraded to 8.01
can be liberated.
When a *modified* 7.07 has been upgraded to 8.01 the 'liberation" is done as per your suggestion:
"Just delete all files (but not! the "calib" directory) from the directories /usr/bin/siglent/firmdata0/ and /usr/bin/siglent/usr/backup/ (of course after backing up to USB pen drive)."
Now,after this action which brings back all options, the SSA still remembers the added non-factory
1Hz and 3MHz RBWs which where contained in the *modified* NSP_system_info.xml file of FW7.07.
So my guess is that this info must have been stored somewhere else in the SSA's file System,
not only in the /firmdata0 and /backup directories.
How else should the SSA with FW8.01 "know" these BWs?
The same might be true for the other "liberation" mods.
regards
-
I think the 3.2GHz / 1HZ / 3MHz parameters along with the extended measurement options are just the design limits of the SSA3000X. It appears that as long as the instrument is not "personalized" (i.e. S/N assigned and other limits defined), the "ecomb" application (that's the main SA program) runs with all options enabled, for example for production testing / calibration. So the SA doesn't need to "remember" a previous (hacked) configuration, it just activates all the functions it has. At least this appears to be a reasonable explanation.
Cheers,
Thomas
-
DL4RAJ thanks for the response.
Yes you are correct:
When you type in the password nothing happens on the screen,
i.e. the cursor is staying on the same position as before!
I tried what you suggested, pressed backspace, nothing happens. I even tried a new computer and a new LAN connection; I did change the IP address
on the new Lan connection, by the way. I have no problem getting in to the SSA and opening the Araco Project screen and the prompt for the login. The machine takes my login"root" and it advances
to the next line "Password" with the cursor. However, the input to the cursor has no response from the keyboard. It is acting, in my opinion, like the login word is wrong and giving no response at the
password prompt. I saw where Bozidarms at Reply#112 had the same SSA setup info on his machine as I do, yet he was able to get in to SSA! Is it possible that they have changed the login and password?
I have made sure that I am using all lower case and no extra spaces before the login "root". I have tried everything suggested in this thread and still no luck! Are there any other logins other than "root" and "ding1234" that anyone is aware of? I am at a brick wall.
Thanks for all the help.
-
Do not flash P08.01. It will limit your future choices.
But do try to flash a stock P07.07.
It could be that your root password was changed in factory. This would indeed close the loop hole, especially if future FW versions do not contain the passwd file, or leave the existing one intact.
I am not sure if reflashing P07.07 will restore your password to default, but it is worth a try.
Regards,
Vitor
-
DL4RAJ thanks for the response.
Yes you are correct:
When you type in the password nothing happens on the screen,
i.e. the cursor is staying on the same position as before!
I tried what you suggested, pressed backspace,
Despite there is nothing happening ON THE SCREEN the password is gettting into the system
while you are typing .Don't press 'Backspace' after entering but 'Enter' !
regards
-
I did a sw update to 07.03 and still the same problem, I cannot get past the "Password" prompt. Re-updated again to 07.07, still no go. I am a little hesitant to upgrade to
08.01 at this time because I cannot login to the SSA in the older update versions. I would have tried other sw versions but that was all I could find at Siglent. Hoping someone knows how to get into the SSA that will work!
Thanks everybody!
-
Don't dispair, nor do anything in a rush.
IMHO, there are the following possibilities:
a) Your device has been edited in factory to carry a different root password - I don't really believe that
b) Your device has a fault
c) Your network has a fault
d) Your computer(s) has/have a fault when it comes to telnet
Try this:
a) Use PuTTYinstead of telnet
b) Here is how it looks on my side:
_____ _____ _ _
| _ |___ ___ ___ ___ | _ |___ ___ |_|___ ___| |_
| | _| .'| . | . | | __| _| . | | | -_| _| _|
|__|__|_| |__,|_ |___| |__| |_| |___|_| |___|___|_|
|___| |___|
Arago Project http://arago-project.org am335x-evm
Arago 2013.05 am335x-evm
am335x-evm login: root
Password:
Login incorrect
am335x-evm login: root
Password:
root@am335x-evm:~#
Note that in the first attempt, I entered a wrong password!
c) Try downloading and flashing this firmware, which does use the known root password (checked with CRC32 code = 8470CDE0): http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA3000X-P07.07.rar (http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA3000X-P07.07.rar)
d) This HAS to work, if not, something is wrong (defective device, network or computer).
Good luck.
Regards,
Vitor
-
Success at last! After reloading sw P07.07 I tried to enter SSA again and got in. It must have been my fault. When trying to enter the password, the cursor was having no response as if
nothing was being typed, and I assumed it was not taking the pw. So, I entered "ding1234", even though there was no response at the cursor, and pressed Enter. I was in. I feel foolish that
I assumed there was no response from the machine. I am do not use Linux very much. Is this the way password entry works on the SSA? I will now try to "liberate" the SSA.
Thanks all of you for your help, I am very appreciative!
-
What you experienced is the Windows telnet, which does sometimes lack feedback. This is why I recommended PuTTY.
With the Rigol DS1054Z it is even worse, no response at all, unless you issue a propper command.
Regards,
Vitor
-
When trying to enter the password, the cursor was having no response as if
nothing was being typed, and I assumed it was not taking the pw. So, I entered "ding1234", even though there was no response at the cursor, and pressed Enter. I was in.
You may want to re-read what I had decribed in my previous posts.
Exactly THIS:
"Despite there is nothing happening ON THE SCREEN the password is gettting into the System while you are typing .
Don't press 'Backspace' after entering but 'Enter' !"
regards
-
Thanks DL4RAJ.
I did read your post about nothing happening on the screen and that is what caused me to rethink how
the password was entering the system. Your help was taken to heart and worked! I thank you very much
for your input and the help of everyone. I'll try to "liberate" the SSA within the next few hours.
Again, thank you.
-
Liberated my SSA 3021X tonight! Now a 3032X with all options permanent. I am going to leave the firmware at P07.07 for the
time being.
Many thanks for the help everyone. It was much appreciated.
-
Hey! I decided to connect to the debug port to see what is going on during boot. I looks like the kernel can not start but the UBOOT is working. I have attached the log for you to see and comment.
-
@jobber:
Seems like there went something wrong with the defect management in your nand flash chip, i.e. defective blocks haven't been mapped out properly or have developed after the SSA has been installed. This can be just the result of repeated firmware updates even though it definitely shouldn't be. I'm almost certain that this problem isn't related the your hacking attempts at all and would have occured even if you had updated the firmware on an otherwise "clean" machine. Have you got a chance to have the SSA replaced under warranty or is this option not available (for whatever reason)? In the first case, I strongly recommend to go for it. If not, things become more difficult but not impossible. I can provide images of all the partitions but the way to go would be to prepare a micro SD memory card with a bootable operating system (there's a slot on the digital PCB close to the USB device connector) and get the machine running from this, run a new defect scan (don't know if this is even possible) and install the system on an otherwise blank, freshly re-partitioned hardware. This would be a lot of work and require considerable skills but if this job is successful, it means that with this sd card, any failed system can be re-installed. I guess that's the way the SSA3000X machines are installed at the Siglent factory.
Please find attached a boot log of my machine (must have been a 7.05 firmware I guess).
All the best,
Thomas
-
I attached a .doc file of all the related posts starting Nov 9th regarding modifications up to the above post.
The username is in bold with the date following (no time) at the beginning of every entry. I did not included any quotes with any of the posts since that replay usually responded to the previous post. Comments such as "regards" or thanks were not included to keep the document as short as possible. A few posts were combined into one when one followed the other from the same poster.
Hope this helps as it's not easy to follow this, considering that document is 10 pages long (nor was it easy to C&P all of those posts, then remove all the unnecessary text.) :o
(v2 corrected some missed bold text for username's)
-
That is about 5MHz, not 5GHz!
The signal of your GPS antenna is probably so faint, that your SSA3021X picked up something at 2.493333MHz.
Regards,
Vitor
-
Wrong thread
-
New SSA3021X just arrived with 8.01 installed. It cannot be rolled back to an older FW - I tried 7.03 and 7.07. Snooping around I didn't see a file anywhere called NSP_system_info.xml. The files I found are NSP_sn_bandwidth.xml, NSP_trends_config_info.xml, calib, fun_opt_valid_config.xml and nsp_data-b. It seems the upgrade path may have been closed after the 7.07 FW. Has anyone been successful after the 8.01 update?
-
Hi,
yes upgrade is still possible ;)- read in the thread before.
Regards
-
Hi,
yes upgrade is still possible ;)- red in thread before.
Regards
Might a new guide for dummies be required ?
I'm one and I'd have no idea where to start. :scared:
-
Unfortunately, i am not a right man for software at all.
I have done that, but i have had more luck than knowledge :palm:.
Just read more times a whole thread and try to understand
what is all about.
Good luck!
-
Might a new guide for dummies be required ?
I'm one and I'd have no idea where to start. :scared:
There isn't enough in this thread to do it properly except for the 1% that are at the software 'code writing' level. :-//
Too many assumptions that everyone else is (or should be) at that level. :--
-
I could go back to 7.07 with the ecomb copy-trick. Thanks for the help!
Can I ask you a few things?
a) If I had that monster.txt file - where would it be?
b) I had 08.01 on my machine, copied the 07.07 ecomb back on the machine. Then I deleted the "new" files in the firmdata0.
Now I have
NSP_system_info.xml
NSP_trends_config_info.xml
fun_opt_valid_config.xml
and the calib folder in there
Is this right?
c) When I try to update again with the "peter" method now the machine says "Update could not be cpmpleted" (yes, with typo...) - I guess because of downgrading...
In my /usr/bin/siglent/upgrade folder I have two files with 0 bytes each
datafs.img
and
firmdata0.img
Is this normal? Could this be the reason why I cannot update anymore? Should/Can I remove them? Do you have them on a proper 08.01 installation?
Or could there be somewhere else files that are a problem for the update? Any suggestion?
Thanks for your help... :)
Edit: I attached the three small Error / Warning / Info-files that are generated when I try to upgrade... I'm not good enough into Linux to know what it is the real issue. To me is looks like a mounting thing? Or a owner / chmod thing? Maybe there is a good Linux guy here that can help me?
-
It was mentioned in one of the comments that a 50-75 ohms capability was added in a FW update.
I have I think the latest FW 1.2.8.1 and cannot find a choice of 50 or 75 ohms on any of the screens.
-
It was mentioned in one of the comments that a 50-75 ohms capability was added in a FW update.
I have I think the latest FW 1.2.8.1 and cannot find a choice of 50 or 75 ohms on any of the screens.
Welcome to the forum.
You are quite right, it was FW version 7.07.
2. Add “input impedance switching function between 50? and 75?”
I'm running the latest FW but I'll have a check if it's there for you. :popcorn:
-
It was mentioned in one of the comments that a 50-75 ohms capability was added in a FW update.
I have I think the latest FW 1.2.8.1 and cannot find a choice of 50 or 75 ohms on any of the screens.
Welcome to the forum.
You are quite right, it was FW version 7.07.
2. Add “input impedance switching function between 50? and 75?”
To Find the 50 or 75 \$\Omega\$ selection:
Amplitude> Corrections> RF: 50 or 75 \$\Omega\$
Edit
Reply linked here too:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/)
-
Hi,
yes upgrade is still possible ;)- red in thread before.
Regards
Might a new guide for dummies be required ?
I'm one and I'd have no idea where to start. :scared:
I've read this forum several times and as is started in this post we, yes me as well, need a upgrade for dummies step by step guide. It's confusing to read to replace ecomb from 8 with the one from 7 and then what?? You can now roll back upgrades? That's great if I read that correctly but chances are high I didn't. There are some pretty incredibly talented users in this form and if one or a few could help those of us who need the upgrades for dummies methods I think we and everyone else who is trying to do the upgrade and failing or just afraid to try would be very grateful.
Does please and thank you work? :-+
-
Hi,
yes upgrade is still possible ;)- red in thread before.
Regards
Might a new guide for dummies be required ?
I'm one and I'd have no idea where to start. :scared:
I've read this forum several times and as is started in this post we, yes me as well, need a upgrade for dummies step by step guide. It's confusing to read to replace ecomb from 8 with the one from 7 and then what?? You can now roll back upgrades? That's great if I read that correctly but chances are high I didn't. There are some pretty incredibly talented users in this form and if one or a few could help those of us who need the upgrades for dummies methods I think we and everyone else who is trying to do the upgrade and failing or just afraid to try would be very grateful.
Does please and thank you work? :-+
I feel your frustration too and I believe the reason that nobody's offered a guide is they think it will get reported to Siglent and the chance to improve them will cease as the holes will be closed. Fact is these are flying out the door almost faster than they're being produced and are at least their #2 best seller.
If the members here think Siglent is unaware of this thread and its contents, well............you're joking, right ?
Are they frustrated by this ? I guess they might be but they've never expressed such to me.
I say: go for it and IF holes get closed I'm quite sure there's enough smart guys here to find a way in again. ;)
-
Hi,
yes upgrade is still possible ;)- red in thread before.
Regards
Might a new guide for dummies be required ?
I'm one and I'd have no idea where to start. :scared:
I've read this forum several times and as is started in this post we, yes me as well, need a upgrade for dummies step by step guide. It's confusing to read to replace ecomb from 8 with the one from 7 and then what?? You can now roll back upgrades? That's great if I read that correctly but chances are high I didn't. There are some pretty incredibly talented users in this form and if one or a few could help those of us who need the upgrades for dummies methods I think we and everyone else who is trying to do the upgrade and failing or just afraid to try would be very grateful.
Does please and thank you work? :-+
You have not read.
This message is mandatory to read:
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1069844/#msg1069844 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1069844/#msg1069844)
self-censorship: <deleted funny paragraph>
-
As far as I know, so far nobody has been able to run a "proper" update after the manual "downgrade" from F/W 8.01 to 7.07 by just exchanging the "ecomb" application file. Since most (all??) of those who contributed to the "DIY improvements" of the instrument so far own older machines that initially had FW 7.0x installed and thus have the options and full bandwidth active allready, there won't be much motivation for them for further experimentation.
To "properly" hack a machine that came with F/W 8.01, the script of the 7.07 -> 8.01 update would have to be analyzed and checked if all the steps that are executed in there could be reversed. Only if this is possible, a downgrade to 7.0x would be an option that permits that application of the "old" hack and re-update to 8.01 with the standard update file.
I showed a method to enable the "test mode" with all the options, full frequency range and even 3MHz and 1Hz RBW active. I'm pretty sure that Siglent will lock this hole with the next F/W update. This modification and also the reverse functionality could be easily put in a script. But I also think that those who tamper with their machines should be knowing what they are doing. There's always a risk of bricking the instrument when messing with it in such a way and in my opinion (others may have a different one...), some basic knowledge of the operating system and what's going on internally will be the best insurance from fatal (to the instrument that is) errors. And I guess the information found in this thread makes it almost as easy as it gets to apply the improvements. It's all within the last four pages of the thread.
Just noticed, rf-loop made it even easier for the newbies... So be sure to cut&paste and save a copy of his post before he deletes it again (as he told he will -- sorry, too late...).
Cheers,
Thomas
-
TurboTom is correct:
Onwers of devices shipped with FW prior to P08.01 have had the opportunity to hack their device and ENABLE the missing options. These stay enabled after the P08.01 upgrade, except 3MHz and 1Hz RBW.
On top of that, by removing/renaming the already mentioned files, the P08.01 firmware will assume that it is in manufacturer mode, where ALL OPTIONS are enabled for an unknown serial number.
Conclusion:
1) The hack is permanent for older devices (if done correctly).
2) The hack is temporary for all devices (including new devices shipped with P08.01) on FW P08.01.
3) Next FW will probably invalidate the easy P08.01 hack.
History of hacks:
1) A "werewolf mode" FW appeared by accident on SIGLENT.COM, that enabled all options (P05)
2) The Telnet login/password was discovered
3) It was discovered that the timed options could be made permanent by putting silly values in them (this would lead to a non-permanent hack upon P08.01 upgrade)
4) It was discovered that all options could be autorised by changing missing options status to TRUE
5) Siglent ceased using a simple file listing TRUE/FALSE on options and instead uses the corresponding activation keys starting with P08.01
6) It was discovered that deleting/renaming 4 files, all options get authorised by default - as the device behaves as a stock device without serial number
Conclusion:
1) Everyone right now can enable all options
2) If a newer FW is released, do not upgrade, if you want maintain the hacked status
3) Existing users with hacked device are not that keen to do experiments, as the machine costs 1500 Euro (+VAT) and can be damaged by doing so
4) Siglent may not be "hunting" the hackers but are certainly closing the doors enabling the hacks
5) Did the hack increase sales? I would say yes (at least that was a big motivation for me to get the device, as it made it much more attractive). Will Siglent be permissive because of that? Nobody knows!
6) If you cannot be bothered to read a thread with JUST 9 PAGES, then you are not in a position to demand anything! ;)
Regards,
Vitor
-
Hello to all and Happy New Year!
I'm new in this forum. So I broke my new SSA3000X whit fw 08.01 .
After attempt to downgrade to 7.07 whit copy file ecomb broke my NAND rootfs. The problem is on the screen I only see the Siglent logo and nothing happens after that.
I still have access via UART interface and U-boot.
Please, can anybody help to restore my NAND?
I have a backup copy of firmdata0 and /usr/bin/siglent/usr/backup/.
Regards
Yanko
-
How did you break the NAND rootfs? Please give as much info as possible.
@all: Somewhere (can't remember) I uploaded a tool that extracts the firmware contents to an almost regular ZIP archive. You can then uncompress most of it.
Doing so will show you 2-3 shell batchfiles (*.sh), one is called "siglentlib.sh". It kind of shows what is done during the upgrade.
Since you can decompress any firmware version, you can i.e. compare the differences between the P07.07 and the P08.01 upgrade.
Hope this helps.
Regards,
Vitor
-
@lz1pro
Could Siglent have a real problem here? Your failure mode appears very much similar to Jobber's: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1088378/#msg1088378 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1088378/#msg1088378).
Yet, he reported that this happened on his instrument during the attempt to update from native 7.07 to 8.01. We should really keep an eye on this. Could it be possible that Siglent got hold of a series of faulty or counterfeit NAND flash chips? The error message is a clear indication of a faulty block in the NAND that should have been mapped out.
If your SSA is still in the warranty period, I would consider to have it replaced. It shouldn't be possible to trace your hacking attempts easily with this kind of error.
Good luck,
Thomas
-
@lz1pro
Could Siglent have a real problem here? Your failure mode appears very much similar to Jobber's: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1088378/#msg1088378 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1088378/#msg1088378).
Yet, he reported that this happened on his instrument during the attempt to update from native 7.07 to 8.01. We should really keep an eye on this. Could it be possible that Siglent got hold of a series of faulty or counterfeit NAND flash chips? The error message is a clear indication of a faulty block in the NAND that should have been mapped out.
If your SSA is still in the warranty period, I would consider to have it replaced. It shouldn't be possible to trace your hacking attempts easily with this kind of error.
Good luck,
Thomas
Sadly this may not be the case, check the changelog for Version: P08.01:
5. After this firmware, do not support downgrade operation
http://www.siglentamerica.com/gjjrj-xq.aspx?id=4973&tid=15 (http://www.siglentamerica.com/gjjrj-xq.aspx?id=4973&tid=15)
This may be something we all need take note of.
-
How did you break the NAND rootfs? Please give as much info as possible.
@all: Somewhere (can't remember) I uploaded a tool that extracts the firmware contents to an almost regular ZIP archive. You can then uncompress most of it.
Doing so will show you 2-3 shell batchfiles (*.sh), one is called "siglentlib.sh". It kind of shows what is done during the upgrade.
Since you can decompress any firmware version, you can i.e. compare the differences between the P07.07 and the P08.01 upgrade.
Hope this helps.
Regards,
Vitor
It's a good idea to start play with "siglentlib.sh", but first I need to boot from an SD card to can access shell. I trying to find image to boot from SD card, but without success.
Any suggestion will be fine.
Regards,
Yanko
-
Hello,
I have the same problem as lz1pro with the hack, device was delivered with 8.01.
regards
-
Neither of you describe what you guys did that led to breaking the root filesystem!
Please explain step by step what you did and when your device broke.
It won't be easy to recover, as I at least have no idea how to boot, flash or install a new rootfs.
I think the answer is somewhere in the siglentlib.sh file. But I guess you need a working fs to start with.
In worst case scenario you need to JTAG the flash, but for that you need a flash dump. This again needs someone with a good device to open it (losing warranty ans risking damage), in order to dump the flash contents.
Perhaps there is an easier way, but I guess nobody knows how to do that.
Is there anything you can do from the serial shell?
Also, I agree with TurboTom: just request a repair under warranty claiming that this happens during a firmware upgrade...
Regards,
Vitor
-
@KeBeNe
Hello here,
can you tell when is done, after attempt to mount the rootfs or command like this "mount -o remount,rw /"?
It is will be helpful for another user that tray to downgrade.
Hire is the link whit same problem on another device: http://linux-mtd.infradead.narkive.com/aO9xNZvZ/temporarily-remounting-rootfs-as-rw-leads-to-kernel-panic-on-reboot (http://linux-mtd.infradead.narkive.com/aO9xNZvZ/temporarily-remounting-rootfs-as-rw-leads-to-kernel-panic-on-reboot)
Regards,
Yanko
-
It is very important to use the 'sync' command before cycling power because otherwise data may not be written to the filesystem yet which leads to incomplete or missing files.
-
Somewhere I posted 08.01 in zip format and decoded nsp_data_b too.
In img files I look with ubidump, maybe there is better utility for this.
08.01.zip firmware (http://s000.tinyupload.com/index.php?file_id=26898752874871167305)
-
Hello,
I've done,
-FW 7.07 (Siglent FW-tool + 7zip)
-ecomb from FW7.07 to usb stick
-SSA3021X connected via Telnet (Putty)
-Login: root, PW: ding1234 - all ok
- first, backup "cp -R /usr/bin/siglent /usr/bin/siglent/usr/mass_storage/U-disk0/SSA3021x_backup" -ok
- then "mount rootfs -o remount, rw" -ok
- "cd/usr/bin/siglent" -ok
- "cp/usr/bin/siglent/usr/mass_storage/U-disk0/ecomb" -ok
- "sync" -ok
- "mount rootfs -o remount, ro" -ok
- "shutdown -r" -ok
As far as everything ok, device makes a reboot, downgrade to 7.07 but still not possible.
I thought, I switch times and again, so a complete reboot, then the device stopped at "Siglent", no more start
regards René
-
Does anyone have the 7.07 firmware image converted to a zip file? I want to compare the upgrade scripts. I think an 8.01 device can be reverted to 7.07 with some manual file copies.
-
KeBeNe, at this point can you still get a shell on the device? If so I'll try to get you a set of instructions.
-
I think when messing around with ecomb, it is mandatory to first stop this process since that's the main application that's running in background.
Type "ps [enter]" to show the processes that are currently running on the system. Note the process number of ecomb, let's assume it's 374.
To terminate the process, type "kill 374 [enter]". After this, repeat the "ps" command to make sure ecomb is no longer running.
After this, it should be less risky to copy / replace it but anyway, my own experiments with this didn't show any substantial use of it, at least as long as the "firmdata0 hack" is available. Actually, I would recommend to just leave the root FS mounted read-only and don't mess with it anymore (of course this wouldn't help those who already have a broken machine).
All the best,
Thomas
-
@janekivi What utility do you use to convert the ADS-file to a fully extractable zip?
-
Hi to all,
My SSA3000X is back to living. :)
So I want to say BIG Thanks to TurboTom for help and support.
Thank you very much Thomas!
Regards,
Yanko
-
Hi to all,
My SSA3000X is back to living. :)
So I want to say BIG Thanks to TurboTom for help and support.
Thank you very much Thomas!
Regards,
Yanko
Nice. :-+
It would be polite to further thank Tom, use the button.
-
Experimenting with a 'clean" TI SD-card image gave this output:
P
U-Boot SPL 2013.01.01 (Jan 11 2016 - 14:14:06)
Start buzzer++
Stop buzzer--nand_init+++++
nand_init-----
>>spl_load_lcd_fpga++
LCD init()++
Lcd_Init()++
SetUpLCD()++
SetUpLCD()--
len=1228852, height=600, width=1024
Logo from nandflash: base=0x81000000; end=0x8112c01f; end-base=0x12c01f; rwsize=0x12c020; r=0x0
Lcd_Init()--
>>spl_load_lcd_fpga--
U-Boot 2013.01.01 (Jan 11 2016 - 14:14:06)
I2C: ready
DRAM: 128 MiB
NAND: 256 MiB
MMC: OMAP SD/MMC: 0, OMAP SD/MMC: 1
Using default environment
set_default_env::4309
Net: <ethaddr> not set. Validating first E-fuse MAC
cpsw
Hit any key to stop autoboot
mmc0 is current device
SD/MMC found on device 0
reading uEnv.txt
** Unable to read file uEnv.txt **
reading uImage
** Unable to read file uImage **
** File not found /boot/uImage **
Could not find uImage
U-Boot#
So adding a valid uEnv.txt and uImage might do the trick.....
-
@janekivi What utility do you use to convert the ADS-file to a fully extractable zip?
--> https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/?action=dlattach;attach=269048 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/?action=dlattach;attach=269048) + 7zip 16.4
-
KeBeNe, at this point can you still get a shell on the device? If so I'll try to get you a set of instructions.
Thanks for the offer, I have returned my device and get a new one, I would not want to destroy the guarantee seal.
Perhaps lz1pro can briefly describe how he has made it to bring his device back to life.
-
In my way to restore need to access SD card slot and UART interface. So there is no possibility to access them, without manipulate the warranty sticker.
Regards,
Yanko
-
You could always drill a hole in the side for access. The sticker remains undamaged that way. :)
-
@KeBeNe
The tool transforms the ADS in a crippled zip where some files have invalid CRC's making it impossible to extract these files.
I'm looking for a way to get all files from the ADS like janekivi's zip file allows.
-
You could always drill a hole in the side for access. The sticker remains undamaged that way. :)
Once video card broke in desktop computer. After removing side grill for cpu fan and
unscrewing psu 4 screws I managed to get it out without scratch on sticker...
Edit -> Sorry, was wrong url before:
Here is older firmware V100.01.02.07.07.zip firmware (http://s000.tinyupload.com/index.php?file_id=90163784571599561684)
--------------------------------------------------------
About those things we talk here:
https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/ (https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/)
-
The link in your last post also points to 8.01.
-
Hi,
Is there anyone in the forum with firmware 7.07?
Regards,
Yanko
-
Hi,
Is there anyone in the forum with firmware 7.07?
Regards,
Yanko
http://www.siglentamerica.com/gjjrj.aspx?id=15&page=1 (http://www.siglentamerica.com/gjjrj.aspx?id=15&page=1)
-
@tautech: Lz1pro is of course looking for someone with P07.07 installed, so that a flash dump can be made.
Regards,
Vitor
-
Just received my 3021X yesterday :-+. Saelig just received a shipment about a week ago and they put one on the truck for me the same day. This one is pretty fresh - just calibrated 13 December.
-
Welcome to the club, Johncanfield.
Have a pleasant time, with this wonderful instrument.
Regards
-
Found on amazing terminal
http://mobaxterm.mobatek.net/ (http://mobaxterm.mobatek.net/)
Another SSA3021X upgraded sucessfull
-
Found on amazing terminal
http://mobaxterm.mobatek.net/ (http://mobaxterm.mobatek.net/)
Another SSA3021X upgraded sucessfull
Firmware version ?
-
07.03.00
-
07.03.00
Thanks, that's quite an early one. The later ones are here:
http://www.siglentamerica.com/gjjrj.aspx?id=15&page=1 (http://www.siglentamerica.com/gjjrj.aspx?id=15&page=1)
8.01 is the version that attempts to restrict FW downgrade and improvements.
Check the "More Information" tabs and info in this thread before you select a version that you'd consider installing.
Enjoy. ;)
-
I've got 8.01 installed on mine (just arrived today), and I've been looking at the 8.01 upgrade image scripts to see what I'd need to do to back this out to a prior version. However I'm unable to mount the root filesystem as RW:
root@am335x-evm:/usr/bin/siglent# mount rootfs -o remount,rw
mount: mounting rootfs on / failed: Bad message
/proc/mounts shows:
rootfs / rootfs rw 0 0
ubi0:rootfs / ubifs ro,relatime 0 0
I'm guessing there's a u-boot option that flags the root partition as read-only?
Aha, looks like that's set at boot, with console=ttyO0,115200n8 quiet root=ubi0:rootfs ro ubi.mtd=7,2048 rootfstype=ubifs rootwait=1t ip=none (visible in /proc/cmdline)
So, I'm not too familiar with u-boot, and even less so with UBIFS on top of UBI on top of MTD. I've just tried attaching another UBI device to the U-Boot and U-Boot Env MTD devices with no luck.
root@am335x-evm:/etc# ubiattach -p /dev/mtd4ro -d 3
ubiattach: error!: cannot attach "/dev/mtd4ro"
error 22 (Invalid argument)
-
I've got 8.01 installed on mine (just arrived today), and I've been looking at the 8.01 upgrade image scripts to see what I'd need to do to back this out to a prior version.
Why?????
Why you do not just use original genuine FW8.01 in "super mode"?
Much less any risk.
-
I've got 8.01 installed on mine (just arrived today), and I've been looking at the 8.01 upgrade image scripts to see what I'd need to do to back this out to a prior version.
Why?????
Why you do not just use original genuine FW8.01 in "super mode"?
Much less any risk.
That's exactly what I'm asking myself since a while.
Why are people with FW8.01 messing around with downgrade efforts braking possibly the OS of the SSA
instead of make use of the super simple and safe modification into "super mode"
which Turbo Tom has provided in this thread??
Nothing could be easier and it is easily reversible.
Regards
-
Hi,
(1) Flash backup
@ebclr: Would you be willing to do a backup of your three partitions (ubi0_0, ubi1_0 and ubi2_0, which correspond to rootfs, usr and firmware0)?
All you need to do is:
1) telnet to your SSA
2) insert a USB disk
3) execute these three commands:
dd if=/dev/ubi0_0 of=/usr/bin/siglent/usr/mass_storage/U-disk0/ubi0_0-P0703.img
dd if=/dev/ubi1_0 of=/usr/bin/siglent/usr/mass_storage/U-disk0/ubi1_0-P0703.img
dd if=/dev/ubi2_0 of=/usr/bin/siglent/usr/mass_storage/U-disk0/ubi2_0-P0703.img
@all: It would be great to have these backups for P07.07, so please, if anyone has P07.07 installed, can you do such backup?
(2) Flash
@all: The filesystems used by the SSA reside on a flash memory chip. There are three partitions: the rootfs partition with the OS, the usr partition with the ecomb file amongst other and the firmware0 partition.
My guess to why some SSA broke was this:
a) The user replaced ecomb from P08.08 with ecomb from P07.07.
b) The user run the P07.07 upgrade, because this ecomb will accept the firmware update script of P07.07 - before P0.08 there was no downgrade check.
c) The SSA got broke. Why? Because the P07.07 just assumed that the partition size for UBI1_0 and UBI2_0 were correct (they never changed before). So, without resizing the rootfs (UBI0_0) partition, the usr and firmware0 partition are flashed starting from the WRONG flash memory address, thus effectively overwriting part of the rootfs!
Stupid but easy mistake...
(3)
@ExplodingLemur:
You are heading on fast lane to brick your SSA!
I think that the only way to downgrade to P07.07 is by writing a modified upgrade script, which uses the flash memory address of P07.07 to make sure, all partitions are correctly resized. The problem is, that I am not sure if the correct flash address is known/written in former upgrade batch files, because apparently it used to be the same. This is all guesses I am doing.
So, first of all, we need to figure out the memory organisation of the flash file to then edit the siglent.sh and edit the memory addresses.
Also, we need a copy of the P07.xx rootfs partition, which seems to be missing in the P07.xx fimrware upgrade - or - we need to disable the check that verifies if that partition needs upgrade.
(4)
@all: The question is: but WHY? Why do people want to downgrade, if there is a fully working hack for P08.01?
Answer: the next firmware might have all holes closed and be not hackable - would be nice to have a plan B then!
And then, this thread is about hacking: hacking is fun and insteresting and there might be no other reason...
Regards,
Vitor
-
As it appears, the /dev/ubi?_? devices are not the raw file systems, moreover they are not the complete contents of the NAND. I rather recommend to make 13 images of the /dev/mtdblock0 ... /dev/mtdblock12 devices in order to have a backup of the complete NAND with (from the O/S) hidden partitions and such.
Usage / Purpose of the NAND Flash Partitions in Siglent SSA3000X F/W 8.01
Device No. | Size kByte | Usage
----------------+---------------+------------------------------------------------------------------------
mtdblock0 | 128 | MLO (Memory Locator, X-Loader -- first file to be accessed during boot)
mtdblock1 | 128 | 1st copy of MLO
mtdblock2 | 128 | 2nd copy of MLO
mtdblock3 | 128 | 3rd copy of MLO
mtdblock4 | 1920 | U-Boot image
mtdblock5 | 128 | U-Boot environment / not used currently
mtdblock6 | 3072 | Siglent boot logo
mtdblock7 | 44032 | root F/S (ubi0_0)
mtdblock8 | 6144 | Linux Kernel Image
mtdblock9 | 6144 | ???FPGA Configuration???
mtdblock10 | 51200 | FIRMDATA0 (ubi2_0 -- /usr/bin/siglent/firmdata0 )
mtdblock11 | 51200 | FIRMDATA1 / not used currently
mtdblock12 | 97792 | DATAFS (ubi1_0 -- /usr/bin/siglent/usr )
So to modify Bicurico's first paragraph, please let me suggest to do the following steps:
_________
1) telnet to your SSA
2) insert a USB disk
3) execute these commands (sorry, more than three...):
ps
- now look for the process number of ecomb (it's the first number in the line that ends with ./ecomb, say it's 723)
kill 723 (or whichever process number your ecomb instance had assigned)
dd if=/dev/mtdblock0 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock0-P0703.img
dd if=/dev/mtdblock1 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock1-P0703.img
dd if=/dev/mtdblock2 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock2-P0703.img
dd if=/dev/mtdblock3 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock3-P0703.img
dd if=/dev/mtdblock4 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock4-P0703.img
dd if=/dev/mtdblock5 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock5-P0703.img
dd if=/dev/mtdblock6 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock6-P0703.img
dd if=/dev/mtdblock7 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock7-P0703.img
dd if=/dev/mtdblock8 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock8-P0703.img
dd if=/dev/mtdblock9 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock9-P0703.img
dd if=/dev/mtdblock10 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock10-P0703.img
dd if=/dev/mtdblock11 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock11-P0703.img
dd if=/dev/mtdblock12 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock12-P0703.img
sync
shutdown -r now
_________
The advantage of having the mtdblock images is that they can be directly re-written to the NAND from the U-Boot shell in case a file system is really messed up. I'm not sure if this is directly possible with the ubi images.
I hope this makes sense...
Cheers,
Thomas
-
Thanks TurboTom.
Indeed I am not that literate when it comes to filesystems...
...and their backup by means of dd.
It would be great to find a way to reflash this backup without having to open the SSA, hence avoiding any warranty loss.
I am not sure if that is possible: how to access the U-boot shell through ethernet? Is there any secret key-combination on power-up?
Regards,
Vitor
-
I don't think it would be possible to interrupt U-Boot without opening the SSA's enclosure. That is, unless Siglent utilized the unused contacts of the RJ45 100 base T interface (which are four) to route the UART interface outside (on some Hantek gear it is arranged that way). But anyway, in order to make a file system image available to U-Boot, the box has to be opened since U-Boot doesn't provide a driver for a USB disk. This is only possible via the internal Micro SD card slot (or the UART interface, but that's less comfortable and takes ages).
There are instructions in many threads how to remove a warranty void sticker without breaking it, i may add that application of a moderate amount of heat (hair dryer or the like) can make a big difference.
So in my opinion, opening the box is a real no-brainer, and an individual, before tampering with these instruments, always has the choice to pay for the added functionality without risking warranty (okay 1Hz and 3MHz RBW cannot be licensed from Siglent). Whenever I'm playing around with one of my "gadgets", I'm completely aware of the small risk of bricking it and if it happens, it's in my own responsibility and nobody else's. So if the warranty void sticker gets damaged, then losing the warranty is simply the price you have to pay for hacking... A fair deal I would say.
Cheers,
Thomas
-
For people suffering a bricked 8.01 SSA (like me), it would be nice to have these mtdblock images too for 8.01.
So if anyone is up to it.......
-
Just received my 3021X yesterday :-+. Saelig just received a shipment about a week ago and they put one on the truck for me the same day. This one is pretty fresh - just calibrated 13 December.
I'm surprised mine left the factory with 7.03 firmware. I suppose I should not upgrade in case I get brave enough to hack it.
-
Johncanfield,
Are you sure you have FW 7.03 and not HW 7.03? in the image in your earlier post it says SW 1.2.8.1 = FW 8.01
-
Johncanfield,
Are you sure you have FW 7.03 and not HW 7.03? in the image in your earlier post it says SW 1.2.8.1 = FW 8.01
Quite correct Emo, it's an easy mistake to make. John's is indeed loaded with 8.1.
-
Ah-so. I originally thought HW meant hardware so I was correct. Oh well. :palm:
-
Hey all!
Let me just quickly recap my story about bricked SSA. I have sent it back for repair (under warranty) and received it upgraded to the latest version and fully unlocked! ;D It looks like they only flashed the faulty partition and left the user data intact. I am not sure if they didn't notice the modifications or they just let me go with it. I would recommend anyone with bricked device that is still under warranty to try and send it back. It could be the easiest solution.
Successful hacking in 2017!
-
Hey all!
Let me just quickly recap my story about bricked SSA. I have sent it back for repair (under warranty) and received it upgraded to the latest version and fully unlocked! ;D It looks like they only flashed the faulty partition and left the user data intact. I am not sure if they didn't notice the modifications or they just let me go with it. I would recommend anyone with bricked device that is still under warranty to try and send it back. It could be the easiest solution.
Successful hacking in 2017!
We ask who is "they" ? :-//
-
Flash dump 100.0..02.07.07
http://www.luximetro.com/SSA3021X.rar (http://www.luximetro.com/SSA3021X.rar)
-
Hey all!
Let me just quickly recap my story about bricked SSA. I have sent it back for repair (under warranty) and received it upgraded to the latest version and fully unlocked! ;D It looks like they only flashed the faulty partition and left the user data intact. I am not sure if they didn't notice the modifications or they just let me go with it. I would recommend anyone with bricked device that is still under warranty to try and send it back. It could be the easiest solution.
Successful hacking in 2017!
We ask who is "they" ? :-//
Technicians at Siglent repair center ;)
-
Hello everyone.
After reading and deciding which spectrum analyzer I buy, I am thinking of buying a Siglent SSA3021X and then converting it into a Siglent SSA3032X. I would like to know what is the opinion of the final result to the users who have made this conversion, is it worth? Give some problems Thank you very much.
-
Until firmware 7.07 flawless, and easy
-
Till now, everything OK / marvelous piece of equipment!
-
i got my SSA3021x a couple days ago. It came with sw 1.2.8.1. I performed the patch_instruction_new provided by TurboTom. However, it appears that the latest firmware hides/places the file NSP_system_info.xml somewhere else. When i performed the back up step for the NSP_system_info, telnet gave a message: file was not found. i created one based on turboTom's instruction and wrote it in the system. However, it seems that the file does not do anything. Any help is appreciated.
-
Hi,
I would suggest:
1) Do a full backup using the dd command as described earlier in this thread. In worst case scenario, this will allow you to fully restore the flash contents.
2) Do a second backup using the cp command and copy all relevant files/folder, which has been explained, too. This is required to restore the device prior to RMA or firmware upgrade.
3) Take your time to navigate in the telnet shell through all folder, to get yourself familiar with file structure. This is required to avoid problems/worst case scenario.
4) The hack involves renaming three files to dummy names. Once you figure it out, it takes you 1 minute. Then all the hacking fun is gone. Unless you REALLY need the enhanced frequency range, take your time.
5) Learn how to use the instrument before hacking it - that will allow you to check if it is working correctly.
Regards,
Vitor
-
it seems that you referred to TurboTom's post that pointed to:"Just noticed, rf-loop made it even easier for the newbies... So be sure to cut&paste and save a copy of his post before he deletes it again (as he told he will -- sorry, too late...). I came a bit late, so I didn't have the chance to read rf-loop's instruction. I wonder if anyone got a hold of the rf-loop's instruction?
-
Thanks so much. Got your instructions. I will post my progress later.
-
Thanks so much. Got your instructions. I will post my progress later.
Curiosity has me wondering if I missed something in the referenced rf-loop instructions. Could someone please forward these instructions to me.
Thanks, Steve
-
it seems that you referred to TurboTom's post that pointed to:"Just noticed, rf-loop made it even easier for the newbies... So be sure to cut&paste and save a copy of his post before he deletes it again (as he told he will -- sorry, too late...). I came a bit late, so I didn't have the chance to read rf-loop's instruction. I wonder if anyone got a hold of the rf-loop's instruction?
That's why I couldn't find the instructions also? I'm also interrested in upgrading my SSA3021x
Can someone help me with these instructions, I have read the thread but not so familiar with Telnet and the used file system
-
1st step install mobaxterm
Connect the instrument to your router
turn the instrument, and see if they get a IP from your router by dhcp
Use that ip to connect to the instrument
user root
pasword ding1234
-
<deleted: error>
-
Just for your information.
Ordered SSA3021X on 2016/01/10 in Poland. Distributor said it will be with 1.2.8.1 firmware :(
Today 2016/01/20 SSA arrived. Unboxed, turned on and...
Voila! 100.01.02.07.07 !
10 minutes later, with NSP...xml file hack and reboot I have SSA3022X with ALL OPTIONS Sta: ON Vaild: Permanent!
Thank you so much EEVBLOG CONTRIBUTORS!:)
Regards,
Dawid SQ6EMM
-
Is it possible that some kind people who have this mysterious file can share it here as message attachment?
Unfortunately I only have a printout of it to read it on my way home in the bus, thought I could save it when I came home from work.
Maybe someone saved the file?
-
Unfortunately I only have a printout of it to read it on my way home in the bus, thought I could save it when I came home from work.
Maybe someone saved the file?
Can you snap a photo or scan it and put it up on imgur? We could transcribe it from that.
-
Unfortunately I only have a printout of it to read it on my way home in the bus, thought I could save it when I came home from work.
Maybe someone saved the file?
Can you snap a photo or scan it and put it up on imgur? We could transcribe it from that.
A scan will be possible when there is nobody else who has saved it.
I was just thinking and must have saved it on my computer at work. Otherwise it must be in the Temp-directory. I will have a look on Monday.
-
Am I correct, that only Firmware versions till 1.02.07.07 can be unlocked so far?
-
Am I correct, that only Firmware versions till 1.02.07.07 can be unlocked so far?
No. Please read this thread more carefully. ;)
-
A scan will be possible when there is nobody else who has saved it.
I was just thinking and must have saved it on my computer at work. Otherwise it must be in the Temp-directory. I will have a look on Monday.
I did a quick search and found the information.
MD5 is: f2c4867771222a38f23ebb64d4420d5a
-
Hi everybody,
I read through the whole thread (11pages, took me forever)... It started out great but the end is a bit frustrating.
I'd really like to buy and permanently unlock this device but it will most probably ship with 8.01 :--
As I understand it, nobody who has an unlock device, has had a look into the nsp_data_b file? Its supposed to be a XML file inside an UBI image? Maybe the the options are hidden there?
Greetinx
Juergen
-
A scan will be possible when there is nobody else who has saved it.
I was just thinking and must have saved it on my computer at work. Otherwise it must be in the Temp-directory. I will have a look on Monday.
I did a quick search and found the information.
MD5 is: f2c4867771222a38f23ebb64d4420d5a
And who would have thought the Chinese author of the .txt file you attached wrote such very good and easy to understand English. :clap: ;)
-
My source, the Chinese author forgot some lines in the description, he warned me to be careful
Do not use CHAPTER 2 Or "full FLASH backup to USB" part in Chapter 8.
ERROR: Missing command lines. Corrected version is under work.
Please be patient!
-
:) :)
Thanks guys.
i got my SSA3021X for a few months, "UPGRADED" it to 3.2G with full options.
very nice SA, as well as my SDG2042X. (@cesarpaz, yes, it worth the money
-
Finally was able to view the GPS L1 signal with the SSA3021X. Settings were:
Frequency: 1575.42 MHz
Span: 70 MHz
Amplitude: -97.80 dBm, Pre-Amp On, Atten = 0 dB, Scale: 1 dB/Division
Trace: Max Hold
BW: RBW = VBW = 100 kHz
See screen save.
-
I forgot to add the signal was from an amplified GPS antenna (looks like a small puck) by using a BNC T adapter so that the DC power could be connected to the antenna.
-
GPS signals are usually below the thermal floor. Can you turn the antenna upside down or otherwise block it to verify that's what you're seeing? You may be looking at the excess noise of the preamp, viewed through a SAW filter that's also inside the active antenna.
-
I will try that tomorrow and get a screen save. I have another spectrum analyzer which shows the same waveform but it is an Agilent unit and has a much lower noise floor than the Siglent so the amplitude is more pronounced. We'll see if the scan looks the same or is flat when I flip the antenna over. Thanks for the idea.
-
Looks like this is not the right thread.
-
Yep its just noise through a filter!
-
Yep its just noise through a filter!
Look on the bright side, you've "hacked" your spectrum analyzer to turn it into a noise figure meter! :) It's on-topic after all.
-
Yep its just noise through a filter!
Look on the bright side, you've "hacked" your spectrum analyzer to turn it into a noise figure meter! :) It's on-topic after all.
Technically this have nothing to do with hack - nothing. Exept that he used hacked SA. Without hack result is exactly same in this case. Hack do not change any single thing what is affecting in this case AFAIK. If you have "alternative truth" in this matter I am happy if I hear it.
;)
-
What feedback?
It's all described above.
And yes, it's solely your decision, you can't hold the "community" responsible is case of failure.
-
Until firmware 7.07 flawless, and easy
"Easy"????
Easy for who, a VERY select few? ???
-
@videobruce: What do you need?
Regards,
Vitor
-
WE don't need more u-boob videos. What, no one reads anymore?
Ever try to highlight videos?? :--
-
Hi everyone - My 3021 arrived 2 days ago and is still in the box. No time to even open and check it. I ordered it with TG. As soon as I get chance I will take a look and see what its firmware is. I suspect it is 8.01, so will be back with questions once I am ready to try and liberate it.
Cheers.
-
Hi everyone - My 3021 arrived 2 days ago and is still in the box. No time to even open and check it. I ordered it with TG. As soon as I get chance I will take a look and see what its firmware is. I suspect it is 8.01, so will be back with questions once I am ready to try and liberate it.
Cheers.
Welcome to the forum.
I think it will be 8.01, the last unit I got from the factory was 8.01.
Evidently it's not a problem, just do your homework and don't be in a hurry.
-
Our Chinese friend did some good work again, a new version of his Instructions to modify the SSA3021x is ready.
This Instructions replaces V0.3!
Thanks!
File MD5 sum: 007bc1ae20eb6835f993cbdd9ce64bd5
-
He sure knows how to spread things out..................
Too bad none are available 'till March 1 here. :--
we checked with the warehouse in SOLON OHIO, and they have been experiencing delays due to the Asian holidays.
-
Our Chinese friend did some good work again, a new version of his Instructions to modify the SSA3021x is ready.
This Instructions replaces V0.3!
Thanks!
File MD5 sum: 007bc1ae20eb6835f993cbdd9ce64bd5
Don't you mean HER ? ;)
-
Anyone knows "magic keys" that will allow to enter calibration menu in SSA? Something similar to magic keys on Rigol DSA?
-
I want to backup all the files from my SSA3021X, just in case. ;)
I have installed MobaXterm and can telnet to SSA but I have not any experience with telnet.
Could someone give me ''for dummies'' instructions how to copy directories with all the files from SSA to USB.
Thanks.
Martin
-
Please get familiar with Telnet/Busybox/Linux (in reverse order), first.
It is easy to cause damage through a simply typo - remember that you are logged in as root!
The command you need is "mv", but you may need to use options like "-r" for recursive. But: you cannot just copy the relevant folders of the Siglent software, as the USB disk is mounted inside the application folder and hence it would be a catch-22.
Get the document everyon is talking about in the last few pages of this thread and read it carefully: it explaines everything in detail, even for people less experienced.
Cheers,
Vitor
-
The command you need is "mv", but you may need to use options like "-r" for recursive. But: you cannot just copy the relevant folders of the Siglent software, as the USB disk is mounted inside the application folder and hence it would be a catch-22.
If it's got anything close to a recent command set, then "cp" should have a "-x" option that will prevent it from traversing across filesystems. With that option (hence, "cp -rx ..." instead of "cp -r ..."), you should be able to copy the relevant folders of the Siglent software to the USB drive.
Do a "cp --help" to see the options it supports before trying the above, just to be sure. If it's actually using BusyBox then it probably won't support the "-x" option.
-
Please allow me to correct myself. For a backup you obviously want to do a cp and not a mv.
-
Thanks Vitor and kcbrown.
I am going to read.
-
Mark11 -
the "cp" command lets you only access those partitions that are mounted in the file system. Moreover, the files to be copied must not be access restricted. But it's well worth to have a file copy of the calibration directory and the original configuration / license files of your machine. For a complete safety backup, it's prudent to use the "dd" command like I explained here: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1109033/#msg1109033 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1109033/#msg1109033). You won't be able to access individual files easily but it's possible to revive a machine with a broken file system.
I join in with Bicurico's recommendation to make yourself familiar with Linux (and especially the console commands) at least a little since it's quite easy to break something... On the other hand, almost everything can be fixed as well, that is if you know how it's done ;).
Cheers,
Thomas
-
Hello,
I have decide to make a backup of my Analyzer, just in case.
All mtd partitions copies OK except the rootfs
It is on 100.01.02.07.07
root@am335x-evm:~# dd if=/dev/mtdblock7 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock7-P0707.img
dd: /dev/mtdblock7: Input/output error
the ubi device copies without issue.
dd if=/dev/ubi0_0 of=/usr/bin/siglent/usr/mass_storage/U-disk0/backup/ubi0_0-P0703.img
I have tried with and without ecomb and still the same issue.
With ecomb killed I can read more data from the rootfs.
I have tried several times (without ecomb) and the Input/output error appears on the same place (I get each time the same 37760KB file)
In the boot log I don't see issue with the ubi mounting
[ 0.310511] UBI: attaching mtd7 to ubi0
[ 0.310530] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 0.310541] UBI: logical eraseblock size: 126976 bytes
[ 0.310550] UBI: smallest flash I/O unit: 2048
[ 0.310560] UBI: VID header offset: 2048 (aligned 2048)
[ 0.310570] UBI: data offset: 4096
[ 0.721635] UBI: max. sequence number: 4
[ 0.736210] UBI: attached mtd7 to ubi0
[ 0.736223] UBI: MTD device name: "File System"
[ 0.736233] UBI: MTD device size: 43 MiB
[ 0.736242] UBI: number of good PEBs: 344
[ 0.736250] UBI: number of bad PEBs: 0
[ 0.736258] UBI: number of corrupted PEBs: 0
[ 0.736266] UBI: max. allowed volumes: 128
[ 0.736274] UBI: wear-leveling threshold: 4096
[ 0.736282] UBI: number of internal volumes: 1
[ 0.736291] UBI: number of user volumes: 1
[ 0.736298] UBI: available PEBs: 0
[ 0.736307] UBI: total number of reserved PEBs: 344
[ 0.736316] UBI: number of PEBs reserved for bad PEB handling: 9
[ 0.736326] UBI: max/mean erase counter: 1/0
[ 0.736334] UBI: image sequence number: 447755961
[ 0.736445] UBI: background thread "ubi_bgt0d" started, PID 479
So all this is strange. Anyone observing something similar?
I am afraid I may have a nand flash issue which may reveal on the firmware update.
Thanks
Dimitar
-
Dimitar,
this may be an indication for a bad block in your NAND FLASH. That's actually not uncommon, the same as you (almost) won't find hard disks without bad blocks, yet they are automatically remapped inthe HDs. The OS should hide the bad blocks in NAND memory as well, yet, since "dd" accesses the raw data of the chip, errors may appear. To read the partition, you may try the command
dd conv=noerror,sync if=/dev/mtdblock7 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock7-P0707.img
I'm not sure if this switch works on the DD version implemented in the SSA3000X since I haven't got a machine with bad blocks to test. In case you need to restore your machine, you should be fine as long as you write back the original file as "dd'ed".
Cheers,
Thomas
-
Dimitar,
this may be an indication for a bad block in your NAND FLASH. That's actually not uncommon, the same as you (almost) won't find hard disks without bad blocks, yet they are automatically remapped inthe HDs. The OS should hide the bad blocks in NAND memory as well, yet, since "dd" accesses the raw data of the chip, errors may appear. To read the partition, you may try the command
dd conv=noerror,sync if=/dev/mtdblock7 of=/usr/bin/siglent/usr/mass_storage/U-disk0/mtdblock7-P0707.img
I'm not sure if this switch works on the DD version implemented in the SSA3000X since I haven't got a machine with bad blocks to test. In case you need to restore your machine, you should be fine as long as you write back the original file as "dd'ed".
Cheers,
Thomas
dd conv=noerror
is not implemented in this "busybox".
-
Hi Gents,
OK, so in case of bad blocks we don't have a way to backup at the mtd level.
Has anyone managed to reflash some MTD partition from uboot?
Has anyone managed to reflash an UBI volume from uboot?
Do you know what nand flash chip the Analyzer is using (if I have to replace it)
Are only those two directories unique as per instrument
/usr/bin/siglent/firmdata0
/usr/bin/siglent/usr/backup
Do we know where the update script is located for 7.07?
I want to check what it does so eventually get some idea what can happen.
I hope I will not need all this info but knowing me I will update to 8.01 soon :)
Sorry for the long questions list and thank you in advance!
Dimitar
-
Hi Dimitar,
I guess the flash chip is the Micron-MT29F2G08ABAEAWP.
You can see it on Dave's tear down video. Datasheet is easy to find, just google.
The chip you get for a few bugs at digikey.
Reading and writing to the flash you will find many projects on the web. A cheap method would be
to use the FT 2232h -56Q mini module via usb. Best buy also a TSOP 48 socket adaptor, so contacting the chip will get no pain.
But i am afraid you will need some good soldering skills and have to open the analyzer.
Anyway, this is great idea.
Cheers
Dima
-
...
The chip you get for a few bugs at digikey.
...
Any particular species of bug? :)
-
Hi Gents,
OK, so in case of bad blocks we don't have a way to backup at the mtd level.
Has anyone managed to reflash some MTD partition from uboot?
Has anyone managed to reflash an UBI volume from uboot?
Do you know what nand flash chip the Analyzer is using (if I have to replace it)
Are only those two directories unique as per instrument
/usr/bin/siglent/firmdata0
/usr/bin/siglent/usr/backup
Do we know where the update script is located for 7.07?
I want to check what it does so eventually get some idea what can happen.
I hope I will not need all this info but knowing me I will update to 8.01 soon :)
Sorry for the long questions list and thank you in advance!
Dimitar
What is problem?
If normal FW update fails due to flash problem, your SSA have 3 year factory warranty (if not expanded to 4 or 5 year warranty) . If it fails just call Siglent for repair.
-
Hi rf-loop,
Yes you are perfectly right. I am just such a kind of person who tries so solve his problem himself if possible. (often it is better for the nature)
Keep also in mind that if I have to send the instrument back for repairmen it means 1 month without it right?
Take into account we already have MT29F2G08ABAEAWP in stock and we have facility to replace it if necessary.
If I know that reflashing wouldn't take me much time I will go to this option for sure.
But as far as i understand no one has done it yet?
In addition I thought talking about my Analyzer here may be interesting for somebody else.
But once again I still don't have issue, probably just some small possibility for an issue in the future.
Additional note. nand flashes often goes in two flavors. Free and not free (less expensive) of bad blocks.
Our experience with the version having bad blocks is that it is often problematic later in the product life.
It is bad that Siglent has used nand flash chips having bad blocks. They use read only file systems but still ...
Thanks
Dimitar
-
Hi rf-loop,
Yes you are perfectly right. I am just such a kind of person who tries so solve his problem himself if possible. (often it is better for the nature)
Keep also in mind that if I have to send the instrument back for repairmen it means 1 month without it right?
Take into account we already have MT29F2G08ABAEAWP in stock and we have facility to replace it if necessary.
If I know that reflashing wouldn't take me much time I will go to this option for sure.
But as far as i understand no one has done it yet?
Maybe not, but to do so would ruin any chance of a future warranty claim if needed.
In addition I thought talking about my Analyzer here may be interesting for somebody else.
It is, but not at the cost of possibly losing your warranty.
-
Indeed!
-
It is OK to discuss hardware-modifications and repairs. The SSA3021X is still a fairly new device and probably all units are still covered by maintenance.
However, in 2 years time, many will be without warranty and I expect to see some being sold in the second hand market.
People will start hacking them and sooner or later the need of flash repair will arise. So why not discuss it now?
I am by no means an expert in flash memory IC's, but there is something very positive about the SSA3021X: the serial number is stored in a regular file within the file system contained in the flash. Some manufacturers chose to store some special data like serial numbers in READ/WRITE protected memory banks of flash IC's. In these cases, exchanging such IC is difficult!
With the SSA3021X I would expect it to be fairly doable: desolder the flash IC, get a replacement flash IC, program it externally (at least up to U-Boot), solder it and use the U-Boot console to flash the reamining firmware.
But I agree with tautech and rf-loop: nobody tried to do that, because it wasn't necessary to do so up to now and because all devices are covered by warranty - if the flash fails, including the hacked ones!
Regards,
Vitor
-
Hi Gents,
OK, so in case of bad blocks we don't have a way to backup at the mtd level.
Has anyone managed to reflash some MTD partition from uboot?
Has anyone managed to reflash an UBI volume from uboot?
....
I can confirm that some individuals successfully re-flashed their kernel / root partitions from U-Boot. I'm not sure if they had bad blocks in their FLASH chips but I doubt it, at least not in the corresponding partitions.
The easy road (and the only that I know of) is via the internal Micro SD card socket since U-Boot checks for presence of a memory card during boot-up. It may well be possible to run the whole SA via a properly configured FS on a Micro SD - that's probably the way initial installation is accomplished at the factory. To gain access to the Micro SD card slot, the instrument needs to be disassembled (case opened / IIRC rear shielding removed). It's probably also possible to back-up the NAND partitions (with proper defect management) via U-Boot to Micro SD. But all this can be considered high-risk activity since a mistake may ruin your day... (read: your SA).
Anyway, we've got complete NAND images of F/W 7.03 and 8.01 in the "community" so what's really important is to back up the configuration and calibration of your machine (on a FS base) since this is individual to each SA. If you need other images that are common to all machines, there will be a way to help.
All the best,
Thomas
-
Anyway, we've got complete NAND images of F/W 7.03 and 8.01 in the "community" so what's really important is to back up the configuration and calibration of your machine (on a FS base) since this is individual to each SA. If you need other images that are common to all machines, there will be a way to help.
All the best,
Thomas
And this is important to do. In FW 7 least calibration data because this can not copy from any other maachine.
And if FW 8 cal data but now there is also other extremely important things what can not copy from other unit. There is example individual product model license. Without it, it is SSA3010X.
Also all other technical things are intersting and and also for possible some future needs it is good to have more and more valid information and knowledge collected. All this is good and finally it may even rise product value for users and including also users after 3 year or after >10 years.
-
I agree, the calibration is important.
In this respect can someone confirm(or share some thoughts) that those two directories contain all the unique data for a given Analyzer?
/usr/bin/siglent/firmdata0
/usr/bin/siglent/usr/backup
As per the update I did a quick check and the update is happening calling functions from /usr/lib/siglentlib.sh
Probably "check_and_upgrade()"
So basically they just do "nandwrite mtdN image" from linux. In theory nandwrite is bad block aware, so I and other having bad blocks should be OK.
But I will cross fingers when I do my update :(
-
I agree, the calibration is important.
In this respect can someone confirm(or share some thoughts) that those two directories contain all the unique data for a given Analyzer?
/usr/bin/siglent/firmdata0
/usr/bin/siglent/usr/backup
As per the update I did a quick check and the update is happening calling functions from /usr/lib/siglentlib.sh
Probably "check_and_upgrade()"
So basically they just do "nandwrite mtdN image" from linux. In theory nandwrite is bad block aware, so I and other having bad blocks should be OK.
But I will cross fingers when I do my update :(
I can not true confirm these two directories but I can confirm with disclaimer: as far as I know.
As also can find in someone made instruction text V05 what can find in this thread.
bad block.
I have updated equipment what have this situation and in this case not any problem.
calibration is important.
Yes, and also very important model license key. (it is in one .xml file in these folders if SSA have FW 8.
In FW 7 update process to FW 8 system generate this license key for model what it is currently when it have FW 7. Later it can not generate (exept factory) (1). FW 7 update to FW 8 is big upgrade. It also make big improvement for TG.
(1) exept: roll back to FW 7 and again to FW 8 but this need - know how to do.
-
Quote
bad block.
I have updated equipment what have this situation and in this case not any problem.
Oh rf-loop, this is very relaxing!
How do you know you have bad blocks, partition dump from using dd command?
Was your bad blocks on the mtdblock7/rootfs?
Thanks
-
Quote
bad block.
I have updated equipment what have this situation and in this case not any problem.
Oh rf-loop, this is very relaxing!
How do you know you have bad blocks, partition dump from using dd command?
Was your bad blocks on the mtdblock7/rootfs?
Thanks
Yes in block7 (after around 10M...err, others all ok. )
-
good! I will update later on today.
Thanks
-
Thanks Vitor, kcbrown and Thomas for pointing me to the right direction.
As you have suggested I started with Linux.
I bought a book Just Enough Linux by Malcolm Maclean two months ago.
My intention was to start playing with Raspberry Pi but now it has
proved to be best spent two dollars (yes 2 US$). It was not necessary
to learn a lot about Linux. Just a few basic commands to navigate file
system in the terminal and some commands as /, cd, ls, cp, pwd, mkdir,
rm, mv ... and I finaly understood what I have to do. I installed Ubuntu,
opened terminal and practised until I got the basic idea how it all works.
Then I read Mr. Li Xiu Ying's instruction again.
The rest is history. ;)
Thans guys. You are the best!
Martin
-
Hi All,
I have updated my Analyzer to V01.02.08.01.
Even thought I seems to have some bad blocks (dd dump reports input/output error) on the mtdblock7 the update went OK
I got few reboots during the update and now I am on V01.02.08.01.
Thank you all for the help!
Dimitar
-
Hi guys, I've a SSA3021X with 7.07 fw hacked with all options permanent enabled and until 3.2Ghz, just now I've upgraded to fw 8.01 and now it remains with 3.2Ghz feature but with all option OFF (only TG on because I've a valid licence key), Is it possible to activate all the options as before I made without loosing the serial number and then without delete the famous files ??
thanks in advance
-
V 1.2.8.2 is out. Who will be the 1st to try??? ;D
http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA3000X-Firmware-Update.rar (http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA3000X-Firmware-Update.rar)
1. This firmware must be upgraded from V1.2.8.1 or later. If your SSA3000X has an earlier version, please to V1.2.8.1 first and then proceed to uplate to the latest version.
2. Add socket/telnet-scpi, you can operate remote control through LAN port without NI-VISA installed. Please check SSA3000X Programming Guide for more details.
3. Change two limit lines in different colours.
4. When quit from TG, stay in“Auto”sweep.
5. Lower some spurs when FFT.
6. Improve the stability.
(Link updated to a direct link for download)
-
V 1.2.8.2 is out. Who will be the 1st to try??? ;D
http://siglentamerica.com/prodcut-gjjrj.aspx?id=5113&tid=227&T=2 (http://siglentamerica.com/prodcut-gjjrj.aspx?id=5113&tid=227&T=2)
Thanks for the info!
Download doesn't work atm, so I can't!
-
V 1.2.8.2 is out. Who will be the 1st to try??? ;D
http://siglentamerica.com/prodcut-gjjrj.aspx?id=5113&tid=227&T=2 (http://siglentamerica.com/prodcut-gjjrj.aspx?id=5113&tid=227&T=2)
Thanks for the info!
Download doesn't work atm, so I can't!
This one does,(the Download button) just clicked on it to get a copy for my archives.
http://www.siglentamerica.com/gjjrj-xq.aspx?id=5128&tid=15 (http://www.siglentamerica.com/gjjrj-xq.aspx?id=5128&tid=15)
7.36 Mb .rar
-
Tried that already.
There is something seriously broken atm.
Transfer stops after a few kB, if you pause/resume it works for another few kB.
Transfer rate is around 5kB/s, which I consider a bit on the low side...
Will have a look at it from time to time.
-
Strange.
I could download the file without problems and did so a few times, just to check.
I downloaded the new EasySpectrum and Programming Manual, with no issues either.
I guess your ISP must be having some issues.
Try this link: https://mediacdn.eu/m/media/wysiwyg/siglent/Downloads/Firmware/SSA3000X-Firmware-Update.rar (https://mediacdn.eu/m/media/wysiwyg/siglent/Downloads/Firmware/SSA3000X-Firmware-Update.rar)
It is from http://www.siglent.eu/Downloads (http://www.siglent.eu/Downloads)
Regards,
Vitor
-
Update:
I unpacked the FW file with my tool (linked somewhere in this thread).
The contents have changed a little, as there is no passwd folder anymore. Some files are the same (see CRC).
My guess is that this FW update is a "small" update, mainly exchanging the ecomb executable, which would explain why you need to install P08.01 before installing P08.02. Telnet probably works as before, with same root login and known password.
However, I did not try the update, yet, so the risk is on you.
Regards,
Vitor
-
DO NOT try update directly to 8.02 from any FW7.x version!
(I do not know if there is security check for prevent to do it accidentally)
Only FW7.x to 8.01 update procedure can generate product model license key (etc) what FW 7.x did not use at all.
One test. It works least with my individual unit.
There was 8.01 in my unit and mod (as in instructions) and with this mod also no serial number.
First I removed mod following these instructions.
Instructions: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1132969/#msg1132969 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1132969/#msg1132969)
Then restart and look all ok. Now there is also original serial number (if someone worry it)
Update to 8.02
(also it rebooting during update)
noted that all works ok.
mod again with instructions.
result. Ok.
-
Thank you for the test! :-+
This new FW is actually the answer of Siglent to a request I made (they didn't do it for me, of course - at least I wouldn't think so):
It allows SCPI commands through a regular telnet connection. This opens doors to people like me to program custom applications that use the SSA3021X remotely.
Without any promise, imagine this: a software similar to my "VMA Simple Spectrum Analyser" (made for the cheap ADF4350, ADF4351, MAX2870 range of devices, like the NWT4000 - discussed in a different thread) in a special version for the SSA3021X, offering all the "advanced" measurements, but based on measurements of a propper spectrum analyser!
Thumbs up for Siglent!
Regards,
Vitor
-
Strange.
I could download the file without problems and did so a few times, just to check.
I downloaded the new EasySpectrum and Programming Manual, with no issues either.
I guess your ISP must be having some issues.
Try this link: https://mediacdn.eu/m/media/wysiwyg/siglent/Downloads/Firmware/SSA3000X-Firmware-Update.rar (https://mediacdn.eu/m/media/wysiwyg/siglent/Downloads/Firmware/SSA3000X-Firmware-Update.rar)
It is from http://www.siglent.eu/Downloads (http://www.siglent.eu/Downloads)
Regards,
Vitor
This link works fine, downloaded in a few seconds.
Guess it's something between europe and the americas.
Thanks for the link!
-
This link works fine, downloaded in a few seconds.
Guess it's something between europe and the americas.
Thanks for the link!
There is trumbles between europe and america.
-
There is trumbles between europe and america.
Thanks for trump-eting that out ::)
-
I corrected the link in my post for the file. It's a direct link now, ;)
-
Did the update to 1.2.8.2 as rf-loop stated. First backuped files, then removed mods, then updated (my device rebooted twice), then backuped files, then reapplied mod, then backuped files.
Worked without any problem.
Thanks rf-loop!
-
Have gone from unhacked 7.03 with purchased TG to 7.07, activated all options (w/o 1Hz and 3MHz RBW), made a "clear and reboot", updated to 8.1, worked fine, updated to 8.2, works still fine. Never done the "werewolf" trick.
Have made some tar-archives of the whole filesystems at different state.
Thank you for your informations! 8)
-
@michael2
Do u want to say that you've a 8.02 with all option ON with the original serial number? I've updraded to 8.02 as well and i've a regular TG licence, but i can't activate the remains options without loosing the serial... Do u've an advise for me?
-
Have gone from unhacked 7.03 with purchased TG to 7.07, activated all options (w/o 1Hz and 3MHz RBW), made a "clear and reboot", updated to 8.1, worked fine, updated to 8.2, works still fine. Never done the "werewolf" trick.
Have made some tar-archives of the whole filesystems at different state.
Thank you for your informations! 8)
Hi Michael2
Please read the PM I've sent you.
Regards
-
Hello,
v8.01 is still upgradable to 3032 whit serial and all option without need to open the machine. All you need to do is remove contains firmdata0 and backup without calib dir and edit NSP_system_info.xml whit wanted serial and copy all files from arhive to firmdata0 and backup folder.
Good luck,
Yanko
-
Did you get 3MHz BWD on your 8.01 machine?
/Daniel
-
Did you get 3MHz BWD on your 8.01 machine?
/Daniel
See replies #326 and 333.
-
It looks like RBW is 10 Hz to 1 Mhz!
-
@lz1pro
and the 8.02 ??
thanks in advance for reply
-
Hi,
with 8.02 definitely is possible to get all options enabled.
-
hi,
I wanted to say "activate all option" in 8.02 without loosing the serial number as the previous firmware version 7.03 / 8.01
thanks for help
-
Hi,
I have a full option SSA 3021X with 100.01.02.07.07, and I want to "upgrade" it to 3.2 Ghz: what is the best way?
Upgrade it to 8.02 and then do the hack or do the hack and then upgrade?
Thank in advance for the info
Giorgio
-
first hack, then upgrade
-
Hi,
Tried mod on my 8.2 upgraded SSA, but no luck, exactly the same after reboot. What did I do wrong?
-
Hi,
Tried Mr Li's mod on my 8.2 upgraded SSA, but no luck, exactly the same after reboot. What did I do wrong?
"Mr" ?
"What did I do wrong?"
If here is some clairvoyant maybe he can try but for most peoples better is first know what you have done before it can even try answer.
Do you have putty (or what ever telnet client you use) log record what you have done?
-
Tried the V05 mod again, and now it worked :), All options and up to 3.2 GHz :)
-
Already have the 3032 - surprise gift from the wife - came with 7.07 - yes really! Used Telnet to take a look at the NSP_info file under Firmdata0. The current file is identical to the one currently there and suggested for updating with all options. The SSA is still operating under the 48 hour window for all options and as of now the options are enabled. How would replacing the NSP_info file change options that are enabled currently to being enabled permanently - I see others have done this swap with within just a few minutes of opening their SSA and it seems to work. Swapping out the NSP_info file seems easy enough to do but I am curious how replacing one file with an identical file causes all options to become permanent; and yes I do have a backup.
-
Already have the 3032 - surprise gift from the wife -
you lucky b*st*rd. Maybe I should show this to my wife ("THIS is true love" etc. etc. -you all know this).
...
but wait, before this is being used against me - let me first ask you, what suprises are YOU presenting to your wife ;D
-
Sometimes the imagination is far better than the truth - even if the truth is pretty nice ... :-DD
We treat each other fairly well - imagination runs wild, B1nary leaves rest unsaid.[/i]
-
I just ordered one of these. Backordered until April 7th. Hope nothing has changed. Anxious to see how it all works.
-
Hi Guys, I'm new in this forum, i just bought the ssa3021X it will arrive soon, anyone of you know anything on how to downgrade the bad boy in case it comes with the 8.something ? Any help would be really appreciated :P :P
-
how to downgrade the bad boy in case it comes with the 8.something ?
Why?
-
My guess is in case Siglent closed the hack hole on later updates.
I'm still waiting for mine. Supposedly back in stock to ship today.
-
Hi Guys, I'm new in this forum, i just bought the ssa3021X it will arrive soon, anyone of you know anything on how to downgrade the bad boy in case it comes with the 8.something ? Any help would be really appreciated :P :P
Welcome to the forum.
Read again reply #326 ;)
My guess is in case Siglent closed the hack hole on later updates.
I'm still waiting for mine. Supposedly back in stock to ship today.
As above.
-
Just checked on my SA order. Apparently the batch going to Siglent has been sitting in LA customs for two weeks and are still there. Maybe will be on their way tomorrow. So unless ordered from someone who actually had them in stock, we are stuck.
-
Just checked on my SA order. Apparently the batch going to Siglent has been sitting in LA customs for two weeks and are still there. Maybe will be on their way tomorrow. So unless ordered from someone who actually had them in stock, we are stuck.
Apologies for a little off-topic, but many recent posts are about ordering/shipping of SSA3021X, so I thought okay to ask where people are ordering the unit from? I'm in USA so thinking my best option is Saelig.
I noticed some distributors claiming it is discontinued with no stock (http://www.tequipment.net/Siglent/SSA3021X/Spectrum-Analyzers/)? That doesn't make sense -- it seems the unit is in demand and only recently (few months before end of 2016) becoming more readily available...
-
Apologies for a little off-topic, but many recent posts are about ordering/shipping of SSA3021X, so I thought okay to ask where people are ordering the unit from? I'm in USA so thinking my best option is Saelig.
:-+
Ask of EEVblog member discount here:
https://www.eevblog.com/forum/testgear/equipment-discounts-from-saelig/ (https://www.eevblog.com/forum/testgear/equipment-discounts-from-saelig/)
Yep, a bit OT and should be in the main thread:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/)
I noticed some distributors claiming it is discontinued with no stock (http://www.tequipment.net/Siglent/SSA3021X/Spectrum-Analyzers/)? That doesn't make sense -- it seems the unit is in demand and only recently (few months before end of 2016) becoming more readily available...
TE are no longer authorised distributors and it makes no sense that they should still have a page for SSA3000X. :-//
-
They are only saying it is discontinued from their catalog, not a discontinued product.
The update to my order ( USA ) was that Siglent is waiting for their next batch.
-
Thanks, i haven't got it while reading that post that the new version is still hackable. Thanks a lot
-
I've ordered a 3021x on Friday, should arrive soon :)
really curious now :)
-
Device came with fw 8.2
mod works like a charm (the fun_opt file is missing though and backup of mtdblock7 returns an input/output error, so can't be backup'd)
-
I received my unit this week. It came with firmware 1.2.8.2
I did several experiments with the described mod and found out that it is ALL in the file NSP_sn_bandwith in the firmdata0 directory. so the procedure can be even simpler, just rename this file and the factory mode is operational
-
sorry for the type error: file name must be NSP_sn_bandwidth of course
-
I have not done the mod yet. I am on firmware 8.1. Are you saying all that is required is to rename NSP_SN_BANDWIDTH file in the firmdata0 directory will enable the features.?
Sent from my SM-T357T using Tapatalk
-
TE are no longer authorized distributors and it makes no sense that they should still have a page for SSA3000X.
I inquired about why that line wasn't carried anymore, but only got a 'canned' (meaningless) response. AFAIC, their agreement with Rigol is the reason. ;)
-
Batronix in Europe carries both Rigol and Siglent, so there is no exclusivity agreement there.
But of course it can be so with TEquipment.
-
Hello Kitt, basically the answer is yes. I used the guide from answer 289 as starting point. This excellent guide shows all the steps to enable the factory mode of the analyser ( no serial number all options enabled). The guide tells you to backup several files in the firmdata directory and the backup directory. After having followed the guide I felt confident to experiment a little. I wanted to make as little changes as possible to the original files so I restored each of them individually and tried to see the result. Here I found out that the NSP_sn_bandwidth was the only file which really made the difference. It is a xml file in which each option is enabled by a special hex code. This hex code is computed from the name option and the serial number. ( a real challenge will be to find the algorithm for this calculation. A good starting point would be to take the 8.1 firmware. This version has the possibility to calculate these numbers because previous firmwares did not use this protection scheme. I think that people with some knowledge of ARM processors mus be able to decompile/disassemble this version which might reveal its secrets.
-
I got word that my SA is shipping out today. Must mean that Siglent in the US has them back in stock. I'll update with FW and other findings.
Joel
-
I bought SSA3021x but my version is 1.2.8.2 (20170214-3)....
I tried to follow instructions v05 but I couldn't find fun_opt_valid_config.xml file...
I renamed the other filenames as described in instruction but after reboot nothing happened...
See files in firmdata0:
root@am335x-evm:/usr/bin/siglent/usr/backup# cd /usr/bin/siglent/firmdata0
root@am335x-evm:/usr/bin/siglent/firmdata0# ls -l
-rw-r--r-- 1 root root 448 May 16 22:33 NSP_sn_bandwidth.xml
-rw-r--r-- 1 root root 448 May 16 22:23 NSP_sn_bandwidthx.xml
-rw-r--r-- 1 root root 150 May 16 22:35 NSP_trends_config_info.xml
-rw-rw-r-- 1 1000 1000 606 Dec 28 2015 NSP_trends_config_infox.xml
drwxrwxr-x 2 1000 1000 4240 Apr 20 19:16 calib
-rw-r--r-- 1 root root 504 May 16 22:33 nsp_data_b
-rw-r--r-- 1 root root 504 May 16 22:23 nsp_data_bx
see backup files:
root@am335x-evm:/# cd /usr/bin/siglent/usr/backup
root@am335x-evm:/usr/bin/siglent/usr/backup# ls -l
-rw-r--r-- 1 root root 448 May 16 22:55 NSP_sn_bandwidth.xml
-rw-r--r-- 1 root root 448 May 16 22:23 NSP_sn_bandwidthx.xml
-rw-r--r-- 1 root root 606 Jan 1 2000 NSP_trends_config_infox.xml
drwxr-xr-x 2 root root 4240 Apr 20 19:16 calib
-rw-r--r-- 1 root root 504 May 16 22:55 nsp_data_b
-rw-r--r-- 1 root root 504 May 16 22:23 nsp_data_bx
I can see new files but it works without hack.
Anyone can help me? |O
Thanks,
Dotto.
-
See files in firmdata0:
root@am335x-evm:/usr/bin/siglent/usr/backup# cd /usr/bin/siglent/firmdata0
root@am335x-evm:/usr/bin/siglent/firmdata0# ls -l
-rw-r--r-- 1 root root 448 May 16 22:33 NSP_sn_bandwidth.xml
-rw-r--r-- 1 root root 448 May 16 22:23 NSP_sn_bandwidthx.xml
-rw-r--r-- 1 root root 150 May 16 22:35 NSP_trends_config_info.xml
-rw-rw-r-- 1 1000 1000 606 Dec 28 2015 NSP_trends_config_infox.xml
drwxrwxr-x 2 1000 1000 4240 Apr 20 19:16 calib
-rw-r--r-- 1 root root 504 May 16 22:33 nsp_data_b
-rw-r--r-- 1 root root 504 May 16 22:23 nsp_data_bx
see backup files:
root@am335x-evm:/# cd /usr/bin/siglent/usr/backup
root@am335x-evm:/usr/bin/siglent/usr/backup# ls -l
-rw-r--r-- 1 root root 448 May 16 22:55 NSP_sn_bandwidth.xml
-rw-r--r-- 1 root root 448 May 16 22:23 NSP_sn_bandwidthx.xml
-rw-r--r-- 1 root root 606 Jan 1 2000 NSP_trends_config_infox.xml
drwxr-xr-x 2 root root 4240 Apr 20 19:16 calib
-rw-r--r-- 1 root root 504 May 16 22:55 nsp_data_b
-rw-r--r-- 1 root root 504 May 16 22:23 nsp_data_bx
How you have done this mess...
now there is original and renamed files together. Why?
You have perhaps made things with your own methods instead of some instructions. Things need do exactly and not just nearly exactly.|O
-
Hi rf-loop!
Thanks for your reply.
I followed the exact instruction v05.
Yes, the analyzer created new files.... before restart I just had files with "namex.xml" but now the system recreated new files.... including backup folder.
before restart:
NSP_sn_bandwidthx.xml
NSP_trends_config_infox.xml
calib - I didn't change it....
nsp_data_bx.xml
after restart: new xml files....
|O
-
Restore your sa back to new. Then just rename the file mentioned in post 363/364. Works fine.
-
Joel_l,
Thanks for your answer...
I restored the sa....
See original files:
root@am335x-evm:/# cd /usr/bin/siglent/firmdata0
root@am335x-evm:/usr/bin/siglent/firmdata0# ls -l
-rw-r--r-- 1 root root 448 May 16 12:56 NSP_sn_bandwidth.xml
-rw-rw-r-- 1 1000 1000 606 Dec 28 2015 NSP_trends_config_info.xml
drwxrwxr-x 2 1000 1000 4240 Apr 20 19:16 calib
-rw-r--r-- 1 root root 504 May 16 12:56 nsp_data_b
root@am335x-evm:/usr/bin/siglent/firmdata0# cd /usr/bin/siglent/usr/backup
root@am335x-evm:/usr/bin/siglent/usr/backup# ls -l
-rw-r--r-- 1 root root 448 May 16 2017 NSP_sn_bandwidth.xml
-rw-r--r-- 1 root root 606 Jan 1 2000 NSP_trends_config_info.xml
drwxr-xr-x 2 root root 4240 Apr 20 19:16 calib
-rw-r--r-- 1 root root 504 May 16 2017 nsp_data_b
As described in post 363/364, I changed just NSP_sn_bandwidth.xml to NSP_sn_bandwidthx.xml
See below:
root@am335x-evm:/usr/bin/siglent/usr/backup# ls -l
-rw-r--r-- 1 root root 448 May 16 2017 NSP_sn_bandwidthx.xml
-rw-r--r-- 1 root root 606 Jan 1 2000 NSP_trends_config_info.xml
drwxr-xr-x 2 root root 4240 Apr 20 19:16 calib
-rw-r--r-- 1 root root 504 May 16 2017 nsp_data_b
root@am335x-evm:/usr/bin/siglent/firmdata0# ls -l
-rw-r--r-- 1 root root 448 May 16 12:56 NSP_sn_bandwidthx.xml
-rw-rw-r-- 1 1000 1000 606 Dec 28 2015 NSP_trends_config_info.xml
drwxrwxr-x 2 1000 1000 4240 Apr 20 19:16 calib
-rw-r--r-- 1 root root 504 May 16 12:56 nsp_data_b
After sync command, I tried ls -l, and the bandwidth file show again.... >:D
root@am335x-evm:/usr/bin/siglent/firmdata0# ls -l
-rw-r--r-- 1 root root 448 May 16 13:12 NSP_sn_bandwidth.xml
-rw-r--r-- 1 root root 448 May 16 12:56 NSP_sn_bandwidthx.xml
-rw-rw-r-- 1 1000 1000 606 Dec 28 2015 NSP_trends_config_info.xml
drwxrwxr-x 2 1000 1000 4240 Apr 20 19:16 calib
-rw-r--r-- 1 root root 504 May 16 13:12 nsp_data_b
I didn't restart at this moment! |O
-
Hi rf-loop!
Thanks for your reply.
I followed the exact instruction v05.
Yes, the analyzer created new files.... before restart I just had files with "namex.xml" but now the system recreated new files.... including backup folder.
before restart:
NSP_sn_bandwidthx.xml
NSP_trends_config_infox.xml
calib - I didn't change it....
nsp_data_bx.xml
after restart: new xml files....
|O
Please do you have terminal communications log. If you have, analyzing this log may show where something have gone wrong. (because something have gone wrong)
-
Hi rf-loop!
Thanks for your reply.
I followed the exact instruction v05.
Yes, the analyzer created new files.... before restart I just had files with "namex.xml" but now the system recreated new files.... including backup folder.
before restart:
NSP_sn_bandwidthx.xml
NSP_trends_config_infox.xml
calib - I didn't change it....
nsp_data_bx.xml
after restart: new xml files....
|O
Please do you have terminal communications log. If you have, analyzing this log may show where something have gone wrong. (because something have gone wrong)
ok. sorry.
-
It is working here!
In my case, I entered in system informations before change the file and quickly sent the sync command and reboot.
I don't know but if I wait long time to reboot the file is save again by the system...
Thank you for your help!
-
It is working here!
In my case, I entered in system informations before change the file and quickly sent the sync command and reboot.
I don't know but if I wait long time to reboot the file is save again by the system...
Have you done hack with FW 8.2 version?
-
It is working here!
In my case, I entered in system informations before change the file and quickly sent the sync command and reboot.
I don't know but if I wait long time to reboot the file is save again by the system...
Have you done hack with FW 8.2 version?
Yes! Everything ok here!
Enviado do meu iPhone usando Tapatalk
-
Have you done hack with FW 8.2 version?
Yes! Everything ok here!
Enviado do meu iPhone usando Tapatalk
Agree, but for a strange reason, I was able to rename files in second time only
-
Thank you for yours answers! I will buy this nice device!
-
So, there is the rename one file method that gets you unlocked and 3.2GHz but no serial number with new FW. It seems that several FWs ago, you could mess with the features file ( seems to no longer be used ) and get all the apps, 3.2GHz, and keep the serial number. I think this survived upgrades from that point. Anyone take a new unit, downgrade the FW, then bring it back to current FW?
-
New firmware 8.3 available
http://www.siglent.com/ENs/gjjrj.aspx?id=15 (http://www.siglent.com/ENs/gjjrj.aspx?id=15)
http://www.siglent.com/Uploadfile/image/20170626/SSA3000X-V1.2.8.3.png (http://www.siglent.com/Uploadfile/image/20170626/SSA3000X-V1.2.8.3.png)
-
So, there is the rename one file method that gets you unlocked and 3.2GHz but no serial number with new FW. It seems that several FWs ago, you could mess with the features file ( seems to no longer be used ) and get all the apps, 3.2GHz, and keep the serial number. I think this survived upgrades from that point. Anyone take a new unit, downgrade the FW, then bring it back to current FW?
For what measurement purpose there need serial number?
-
So, there is the rename one file method that gets you unlocked and 3.2GHz but no serial number with new FW. It seems that several FWs ago, you could mess with the features file ( seems to no longer be used ) and get all the apps, 3.2GHz, and keep the serial number. I think this survived upgrades from that point. Anyone take a new unit, downgrade the FW, then bring it back to current FW?
You cannot just dongrade the FW, as this requires a complete reflash of the flash IC. This can be done on the bootloader, but you will lose warranty to access it.
Also, you need a flash dump of the older firmware (does exist with some forum members if required).
But the main issue is that the flash IC can have faulty pages. This is apparently within specs/tolerance. However, if you flash back a good backup of an IC without faulty pages on an IC with faulty pages, the firmware will not work. You need to partition and write the firmware in a propper way that avoids writing to erroneous flash IC's.
I hope to have explained it in a comprehensive way, certainly it could be explained at more detail and without errors. But I guess this makes it clear why a downgrade has risks (lost warranty, problem with faulty flash pages, etc.).
As mentioned by rf-loop, there is no real issue in not having the serial number displayed.
Regards,
vma
-
That does actually make sense. The FW update is not a full install of the SA software. You are right, the missing serial number is not a big deal.
Thanks
Joel
So, there is the rename one file method that gets you unlocked and 3.2GHz but no serial number with new FW. It seems that several FWs ago, you could mess with the features file ( seems to no longer be used ) and get all the apps, 3.2GHz, and keep the serial number. I think this survived upgrades from that point. Anyone take a new unit, downgrade the FW, then bring it back to current FW?
You cannot just dongrade the FW, as this requires a complete reflash of the flash IC. This can be done on the bootloader, but you will lose warranty to access it.
Also, you need a flash dump of the older firmware (does exist with some forum members if required).
But the main issue is that the flash IC can have faulty pages. This is apparently within specs/tolerance. However, if you flash back a good backup of an IC without faulty pages on an IC with faulty pages, the firmware will not work. You need to partition and write the firmware in a propper way that avoids writing to erroneous flash IC's.
I hope to have explained it in a comprehensive way, certainly it could be explained at more detail and without errors. But I guess this makes it clear why a downgrade has risks (lost warranty, problem with faulty flash pages, etc.).
As mentioned by rf-loop, there is no real issue in not having the serial number displayed.
Regards,
vma
-
Has anyone tried 8.3, is the hack in tact? Or do you just need to redo it?
Joel
-
Hi,
The new firmware seems safe to flash. The telnet access is still there with the usual root account and apparently nothing changed.
I did it and have no issues, but I am not using the file delete hack. Should work, though, as before.
Regards,
Vitor
-
I also just did the 8.3 update, no issues, didn't have to change anything. Mine was the single file rename/delete method.
Joel
-
So did I, everything has gone in the right way
-
Hello,
Got my SSA-3021x about a month ago and it has been sitting on my bench unused since. FW8.2 (1.2.8.2) installed on it. I plan to 'upgrade' it using the instructions contained in post #289. Couple of questions:
1. Should I upgrade to firmware 8.3 before performing this?
2. Is there anyway to retain the serial number?
Thanks.
-
1. Doesn't matter.
2. As mentioned by rf-loop, there is no real issue in not having the serial number displayed.
-
Look at post 363/364. That's all you have to do. Use the original instruction to log into and get to where you can rename files, but deleting/renaming ( rename would be recommended ) the one file is it. Do not know of a method that preserve SN.
Hello,
Got my SSA-3021x about a month ago and it has been sitting on my bench unused since. FW8.2 (1.2.8.2) installed on it. I plan to 'upgrade' it using the instructions contained in post #289. Couple of questions:
1. Should I upgrade to firmware 8.3 before performing this?
2. Is there anyway to retain the serial number?
Thanks.
-
Has anyone been able to create a SD-image to boot from in case the update fails?
I experienced a failure while updating to 8.2 and would like to be able to fix the problem myself without having to send the SA in for repair.
-
I received my unit this week. It came with firmware 1.2.8.2
I did several experiments with the described mod and found out that it is ALL in the file NSP_sn_bandwith in the firmdata0 directory. so the procedure can be even simpler, just rename this file and the factory mode is operational
sorry for the type error: file name must be NSP_sn_bandwidth of course
You rename that file first, then just flash from 8.2 to 8.3 without restoring first? ???
-
Hi everybody.
I need litle help, My SSA3021X come with 1.2.8.2 firmware, I was update to 1.2.8.3 but it´s imposible get old firmware versions 7.5, 8.1 etc. How Can I do make for hack to 3.2 Ghz? Thanks so much. ::)
-
A bit earlier in the thread I think someone mentioned that 8.3 still lets you log in, so you could do the hack after going to 8.3
You do not need to undo the file rename to upgrade from 8.2 to 8.3.
-
So that so called "chapter 5" (restore back to initial state) isn't necessary, one just does the modification (chapter 3)?
-
Hi guys, new owner of the Siglent SSA3021X here. It was delivered just yesterday.
I checked the firmware version, and I have 8.1! So I thought I would try this mod see how things goes. Thanks to the V0.5 tutorial (from post #289 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1132969/#msg1132969)) things went pretty smoothly, and I have all features unlocked and 3.2GHz bandwidth as of now.
I just wanted to point something out though. When I was renaming the files, the filesystem apparently was remounted automatically, and went back to read only mode. It seems like the original files were rewritten as well, so I had to remove the _x previously moved files, and rename the newly created files again, after remounting the filesystem in rw mode. See below.
_____ _____ _ _
| _ |___ ___ ___ ___ | _ |___ ___ |_|___ ___| |_
| | _| .'| . | . | | __| _| . | | | -_| _| _|
|__|__|_| |__,|_ |___| |__| |_| |___|_| |___|___|_|
|___| |___|
Arago Project http://arago-project.org am335x-evm
Arago 2013.05 am335x-evm
am335x-evm login: root
Password:
root@am335x-evm:~# cd /usr/bin/siglent/firmdata0
root@am335x-evm:/usr/bin/siglent/firmdata0# ls -l
-rwxr-xr-x 1 root root 471 Jul 8 --:-- NSP_sn_bandwidth.xml
-rwxr-xr-x 1 root root 606 --- -- --:-- NSP_trends_config_info.xml
drwxrwxr-x 2 1000 1000 4240 Jan 1 2000 calib
-rwxr-xr-x 1 root root 544 Jul 8 --:-- nsp_data_b
root@am335x-evm:/usr/bin/siglent/firmdata0# cd /usr/bin/siglent/usr/backup
root@am335x-evm:/usr/bin/siglent/usr/backup# ls -l
-rwxr-xr-x 1 root root 471 Jul 8 --:-- NSP_sn_bandwidth.xml
-rwxr-xr-x 1 root root 606 --- -- --:-- NSP_trends_config_info.xml
drwxr-xr-x 2 root root 4240 --- -- --:-- calib
-rwxr-xr-x 1 root root 544 Jul 8 --:-- nsp_data_b
root@am335x-evm:/usr/bin/siglent/usr/backup# cd /
root@am335x-evm:/# cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
root@am335x-evm:/# cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
root@am335x-evm:/# cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
root@am335x-evm:/# cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
root@am335x-evm:/# mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
root@am335x-evm:/# cd /usr/bin/siglent/firmdata0
root@am335x-evm:/usr/bin/siglent/firmdata0# mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
root@am335x-evm:/usr/bin/siglent/firmdata0# mv NSP_trends_config_info.xml NSP_trends_config_infox.xml
root@am335x-evm:/usr/bin/siglent/firmdata0# mv nsp_data_b nsp_data_bx
mv: can't rename 'nsp_data_b': Read-only file system
root@am335x-evm:/usr/bin/siglent/firmdata0# ls -l
-rw-r--r-- 1 root root 471 Jul 8 --:-- NSP_sn_bandwidth.xml
-rw-r--r-- 1 root root 471 Jul 8 --:-- NSP_sn_bandwidthx.xml
-rwxr-xr-x 1 root root 606 --- -- --:-- NSP_trends_config_infox.xml
drwxrwxr-x 2 1000 1000 4240 Jan 1 2000 calib
-rwxr-xr-x 1 root root 544 Jul 8 --:-- nsp_data_b
root@am335x-evm:/usr/bin/siglent/firmdata0# cd /
root@am335x-evm:/# mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
root@am335x-evm:/# cd /usr/bin/siglent/firmdata0
root@am335x-evm:/usr/bin/siglent/firmdata0# rm NSP_sn_bandwidthx.xml
root@am335x-evm:/usr/bin/siglent/firmdata0# mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
root@am335x-evm:/usr/bin/siglent/firmdata0# mv nsp_data_b nsp_data_bx
root@am335x-evm:/usr/bin/siglent/firmdata0# cd /usr/bin/siglent/usr/backup
root@am335x-evm:/usr/bin/siglent/firmdata0# mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
root@am335x-evm:/usr/bin/siglent/firmdata0# mv NSP_trends_config_info.xml NSP_trends_config_infox.xml
root@am335x-evm:/usr/bin/siglent/firmdata0# mv nsp_data_b nsp_data_bx
root@am335x-evm:/usr/bin/siglent/firmdata0# cd /
root@am335x-evm:/# sync
root@am335x-evm:/# logout
This is exactly what I have in both folders after the mod.
root@am335x-evm:/# ls -l /usr/bin/siglent/firmdata0
-rw-r--r-- 1 root root 471 Jul 8 15:52 NSP_sn_bandwidthx.xml
-rw-r--r-- 1 root root 150 Jul 8 15:55 NSP_trends_config_info.xml
-rwxr-xr-x 1 root root 606 --- -- --:-- NSP_trends_config_infox.xml
drwxrwxr-x 2 1000 1000 4240 Jan 1 2000 calib
-rwxr-xr-x 1 root root 544 Jul 8 15:52 nsp_data_bx
root@am335x-evm:/# ls -l /usr/bin/siglent/usr/backup
-rwxr-xr-x 1 root root 471 Jul 8 15:42 NSP_sn_bandwidthx.xml
-rwxr-xr-x 1 root root 606 --- -- --:-- NSP_trends_config_infox.xml
drwxr-xr-x 2 root root 4240 --- -- --:-- calib
-rwxr-xr-x 1 root root 544 Jul 8 15:52 nsp_data_bx
(The dates are masked for most files since I lost my logs, and I have no record of the original dates during the operation, I chose to mask them. I rewrote these commands to give you guys an idea of what happened.)
Anyway, my spectrum analyser is unlocked, I have XXXXXXXXXX serial number and "Permanent" validity on all options, so I assume everything is fine.
Now, I'm still on 1.2.8.1 firmware, and as far as I understand, I need to:
1. Revert the mod (CHAPTER 5)
2. Run the upgrade 1.2.8.1 -> 1.2.8.3
3. Do the mod again (CHAPTER 3)
Am I right?
As far as I heard, the latest firmware is still compatible with the mod, so it is safe to upgrade?
Thank you guys!
-
It is safe to upgrade. No need to revert the mod. Telnet access remains the same.
Regards,
Vitor
-
2. Run the upgrade 1.2.8.1 -> 1.2.8.3
3. Do the mod again (CHAPTER 3)
The above is correct?? Flash to 8.3 first with no S/N, then the mod?
-
What's the best update route to 8.1+ for a unit on 7.7 with all options enabled via method in post #59 (not 1HZ or 3MHz though) and model number changed to 3032x? Need to change model number back to 3021x first?
Any real benefit in updating to 8.x series?
-
Just do the upgrade as documented by Siglent, making sure you edited the options files to activate all options and have your original serial number active.
Upgrading to v8.x will actually generate the activation codes for the active options and you can then read them out through telnet and ftp.
This is a one time chance, so absolutely make sure you are not upgrading with the relevant files deleted or renamed!
This won't give you the 1Hz and 3MHz RBW options, but after the upgrade you can rename the files as instructed in this thread again, with the benefit of owning the activation keys, aka permanent hack for all future updates.
Regarding the benefits, don't be lazy. Read the change log from Siglent and the sister thread about the SSA3021X in this forum. Then decide for yourself.
For me it was definitely worth it, as v8.x allowed me to program my SSA Simple Spectrum Analyzer software.
Regards,
Vitor
-
Thanks for advice. Options file has everything set as TRUE and serial number remains on system info screen. So it's ok to leave model number changed to 3032x?
When you mention relevant file deleted or renamed, which do you mean? The only file edited via the method in post 59 was NSP_system_info.xml and nothing touched since.
-
Got my unit from China today. FW 8.3 installed.
Do someone have fullflash dump v.7.03?
Thanks
-
Are you aware of the risks:
- warranty will be voided, as you need to open the case
- if you have an error on the flash, which is normal, you won't be able to simply flash the backup, as the flash layout would have to be different
- you could try to dump your flash first to see if there is any flash error, but that is not 100% safe
On the other hand, the current hack of renaming ONE file (or is it two, not sure by now), will give you ALL options at no risk. So why bother?
Regards,
Vitor
-
2. Run the upgrade 1.2.8.1 -> 1.2.8.3
3. Do the mod again (CHAPTER 3)
The above is correct?? Flash to 8.3 first with no S/N, then the mod?
Anyone??
-
Bicurico,
I gonna check it for a while with 8.3 just to be sure it is not going to die as the new HW like to do. Yes, I will copy all data using cp and u-boot.
For a long term I'd like to desolder flash, solder in cradle for it and gonna grab some chips from Digikey, just to be sure I have a different backups.
Also with a cradle it would be possible to boot u-boot and replace flash live for programming purposes.
I'm pretty sure they going to close hack in future FWs for those who didn't passed 7 to 8 FW transition, so it would be beneficial to find a way to do a proper downgrade at some point.
-
He guys,
could confirm that 8.3 is still friendly for modifications to the fw.
-
Electronus,
I am investigating the possibility to create a bootable SD-card allowing to boot from a downgraded OS. Next thing would be to update the SD-card giving the new license that could be copied over to NAND.
-
I did my one today.
It came with v8.1 and I first upgraded to v8.3, then I did the hack in message #289.
- Backup first and then renamed the files.
Works fine!!! :-+
Thanks for all help! :clap: :clap:
-
Hi to all,
another successfully upgraded SSA(without revert the mod first) to v8.3,
everything works fine :-+
Tnx and regards
-
Hi
New to this wonderful forum! I have pretty much convinced myself that SSA3021X is the thing I have to have now and I am gonna order it in a couple of days.
However, I have a few questions about unlocking the features:
I understand that this device contains pretty much the same hardware as 3032X and by unlocking it, it can go to 3.2GHz plus the other stuff. But still something bothers me (or amazes me, I should say) about this and that is the accuracy, calibration, DANL and phase noise at those higher frequencies (above 2.1GHz). The price of a basic 3032X is more than twice of a basic 3021X and their difference is just the 3.2GHz vs 2.1GHz. So, is it reasonable that we can get a 3032X (not to mention all the other options which cost almost $1600) just by deleting or renaming a file on the system and that's it?
With regard to the optional stuff I have no doubt because they are just software features and it is reasonable to assume they can be unlocked and their MSRP is ridiculously high. Nobody should pay $400+ for just a codeword or something like that. But as for the higher frequency (or getting 1Hz/3MHz RBW), are we sure that the 3021x is fully calibrated up to 3.2GH and performs exactly as a 3032X when we unlock it?
can anyone confirm the specs (DANL, PN, amplitude accuracy, etc) on an unlocked 3021 is indeed the same as a 3032? Or can anyone do some measurements above 2.1GHz and compare with a trusted spectrum analyzer?
EDIT: I think what I am trying to say is that unlocking software features is one thing but is the hardware (for example the front end) really calibrated for those higher freqs? Isn't that the reason why 3032 costs so much more than 3021? I hope my doubts are totally unfounded!
-
Hi and welcome to the forum.
Just as you tell in your last sentence - your doubts are totally unfounded!
I have done measurements on 3GHz(the highest freq. that my sig. gen. have) and can confirm - work like a charm!
SSA3021X is a milestone on test equipment market in the last 10 years(or maybe ever) - a real game changer,
you won't be disappointed :-+ :-+ :-+!
Regards
-
After much hemming and hawing, and a lot of looking at used SAs, I ordered the 3021X today and will have it Wednesday. While I wait, I am digging through the seventeen pages of this thread, trying to figure out the latest version of the upgrade hack. It is, well, rather a lot. I would be most grateful if one of the folks who has done the upgrade recently could point out where to start reading, assuming I will get a unit with the latest firmware and no upgrades installed. Today, by the way, is my birthday, which is how I tipped myself over into finally buying one. ^-^
Thanks in advance!
-
Electronus,
I am investigating the possibility to create a bootable SD-card allowing to boot from a downgraded OS. Next thing would be to update the SD-card giving the new license that could be copied over to NAND.
Hello. Can you be so kind as to explain the steps in steps to be able to hack it with version 8.3? We are very grateful, if you want you can contact me by private. Thank you.
-
First of all make a Backup of your current system.
Hopefully you are familiar with Linux shell commands.
telnet <SSA3021X-IP-Adr>
Login as root
root password is ding1234
root@am335x-evm:~#
My FW Version was 1.2.8.2
Do Update of all relevant Files:
For this purpose use a FAT32-USB-Stick with more then 200MB free space.
Insert the Stick in the front USB connector at left lower corner near the
power off button. A blue USB-Symbol in the right upper corner above the
spectrum grid should appear after few seconds.
check if usb stick is mounted with the mount command at shell level
root@am335x-evm:~# mount
You should see a line containing the path "/usr/bin/siglent/usr/mass_storage/U-disk0"
If this is the case you could check if the content of the Stick is the one you expect.
ls -l /usr/bin/siglent/usr/mass_storage/U-disk0
change to the stick location
cd /usr/bin/siglent/usr/mass_storage/U-disk0/
create a backup location on the stick FW_SSA3021X_BCK
mkdir FW_SSA3021X_BCK
switch to this location
cd FW_SSA3021X_BCK
pwd should now show you the full path:
/usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK
create according to your firmware a backup dir with the current
FW number (im my case 1.2.8.2)
mkdir FW-1.2.8.2
use the both cp commnds listed below to save all relevant files
cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK/FW-1.2.8.2/SSA3021x_backup
cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK/FW-1.2.8.2/SSA3021x_firmdata0
Then save all FLASH memory partitions to your stick by the command listed below:
Some dd partitions transfers throw an IO-Error, but the file is transfered properly.
Do not worry about this.
root@am335x-evm: for i in `seq 0 1 12`; do echo $i; dd if=/dev/mtdblock${i} of=/usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK/FW-1.2.8.2/mtdblock${i}-1.2.8.2.img; sleep 1; done
The above command copies the /dev/mtdblock0 ... /dev/mtdblock12 Flash content
to files named mtdblock0-1.2.8.2.img ... mtdblock12-1.2.8.2.img in the
/usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK/FW-1.2.8.2/ Directory.
Output from the above command is:
0
256+0 records in
256+0 records out
1
256+0 records in
256+0 records out
2
256+0 records in
256+0 records out
3
256+0 records in
256+0 records out
4
3840+0 records in
3840+0 records out
5
256+0 records in
256+0 records out
6
6144+0 records in
6144+0 records out
7
dd: /dev/mtdblock7: Input/output error
8
12288+0 records in
12288+0 records out
9
12288+0 records in
12288+0 records out
10
102400+0 records in
102400+0 records out
11
102400+0 records in
102400+0 records out
12
dd: /dev/mtdblock12: Input/output error
After this was done, check if the files exist with the ls -l command
Now you could update the firmware to the newest one, in my case to 1.2.8.3.
To do this you have to download from Siglent web site from the support menu
the last FW update. This is a .rar file in my case named SSA3000X-P08.03.rar
Unpack this file and save the .ADS file (V01.02.08.03.ADS) on the usb stick.
To Do this you first have to remove the stick from your Siglent device.
To do this seafly do the commands on the CLI (comand line interface) inside
the terminal as listed below:
root@am335x-evm: sync
root@am335x-evm: sync
root@am335x-evm: cd
root@am335x-evm: umount /usr/bin/siglent/usr/mass_storage/U-disk0
Now you could remove the stick from the usb connector.
Copy the file V01.02.08.03.ADS to the stick (top level dir, as it is better to
find the file inside the Siglint SSA3021X display)
Do a seve unmount on your computer bofor you remove the usb stick with the new firmware,
to be sure the file is written correctly befor you remove the stick and put him again into
the SSA3021X usb front connector.
Go to the File menu, by pressing the File button, after you see the stick mounted again
inside the SSA3021X display. Navigate to your stick (right column on the display)
switch from Dir Menu to File Menu (left upper corner at the screen) and navigate to the
new FW file V01.02.08.03.ADS. Now press the load button beside the screen menu.
Wait patiently until the FW is updated (The SSA3221X will reboot thre or four times)
Do not switch off the power until you not see again the spectrum grid on teh screen !!!
Check via System button / info which FW is now displayed - should be 1.2.8.3
now you have to login again to the device via telnet as listed obove as the reboot
during the FW update terminated the telnet connection.
(If you run in problems to connect, check via ping command fro your PC if the SSA3021X
is still responding to the same IP address. Perhaps your router has configured a new
IP address - increas/decrease the last octed from the prior ip address.)
When you are loged in succesfully, do the backup of all relevant files for the new
FW version 1.2.8.3 to be on the secure side.
ls -l /usr/bin/siglent/usr/mass_storage/U-disk0 (exist this location ?)
cd /usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK
cd FW_SSA3021X_BCK
pwd should now show you the full path:
/usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK
create according to your firmware a backup dir with the current
FW number (im my case 1.2.8.3)
mkdir FW-1.2.8.3
use the both cp commnds listed below to save all relevant files
cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK/FW-1.2.8.3/SSA3021x_backup
cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK/FW-1.2.8.3/SSA3021x_firmdata0
Then save all FLASH memory partitions to your stick by the command listed below:
Some dd partitions transfers throw an IO-Error, but the file is transfered properly.
Do not worry about this.
root@am335x-evm: for i in `seq 0 1 12`; do echo $i; dd if=/dev/mtdblock${i} of=/usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK/FW-1.2.8.3/mtdblock${i}-1.2.8.2.img; sleep 1; done
The above command copies the /dev/mtdblock0 ... /dev/mtdblock12 Flash content
to files named mtdblock0-1.2.8.3.img ... mtdblock12-1.2.8.3.img in the
/usr/bin/siglent/usr/mass_storage/U-disk0/FW_SSA3021X_BCK/FW-1.2.8.3/ Directory.
================================================================================
Now you are ready to switch your SSA3021X device to a SSA3032X with all Options
================================================================================
umount the stick
root@am335x-evm: sync
root@am335x-evm: sync
root@am335x-evm: cd
root@am335x-evm: umount /usr/bin/siglent/usr/mass_storage/U-disk0
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Be sure you has write down your original Serial Number from the System button menu
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
In my case two files have to be renamed to reach the full option state:
See forum which they are ;-)
root@am335x-evm: cd /usr/bin/siglent/usr/backup
root@am335x-evm:/usr/bin/siglent/usr/backup# mv X.xml X.xml.org
root@am335x-evm:/usr/bin/siglent/usr/backup# mv Y.xml Y.xml.org
This files could be renamed easy as this partition has read/write property enabled.
But you has to rename the files listed above inside the /usr/bin/siglent/firmdata0 directory too
but this partition is write protected. To do this use the mount command
root@am335x-evm: mount -o remount -o rw ubi2_0
Then you could rename the both files:
root@am335x-evm: cd /usr/bin/siglent/firmdata0
root@am335x-evm:/usr/bin/siglent/firmdata0# mv X.xml X.xml.org
root@am335x-evm:/usr/bin/siglent/firmdata0# mv Y.xml Y.xml.org
Mount the firmdata0 partition again ro (read only)
root@am335x-evm: mount -o remount -o ro ubi2_0
Sync the Flash Filesystem to be sure all changes are stored properly.
root@am335x-evm: sync
root@am335x-evm: logout
Powerdown your device and start it again - enjoy your SSA3032X device alias SSA3021X
;-)
-
THANKS SO MUCH.
I'll try it as soon as I get back from a week's vacation.
Very grateful markus_jlrb, you have been very cordial and kind fellow of the forum. :-+ :-+
-
Thank you! I will give it a try at the end of this week. I appreciate not having to dig through pages and pages of the thread...
-
Hi all
I got my SSA3021X on october 2016, with software version 7.07, i hacked it and it worked well until now.
When booting, it shows the Siglent Logo, then it draws the grid and menus, and freeze. The keys are no more reactives, the trace is not showing.
I have tried to log in with telnet, but it does not work, i even can't see the ip adress on the dhcp lease list on my router. :(
Any idea of what is happenig and what to do ?
Does anyone know if it is possible to fully reset the SSA3021X whith a key combination while booting or another way of reseting ?
-
@Noob68
you may try to connect to the UART, see here: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg974784/#msg974784 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg974784/#msg974784) -- this will output O/S messages right from power-up. With this information, you may be able to find out what's causing the problem. If the "ecomb" application gets started (what the graticule display should prove), the system definitely gets far beyond the UBOOT shell. Via the UART, you can interrupt the bootup sequence, enter UBOOT and write back a file system image (I hope you've got one of your machine). This should revive your SSA unless there's a hardware problem.
Good luck and all the best,
Thomas
-
@TurboTom,
Thank you for your advice.... I saved the files before hacking, so i could perhaps restore them, but it is not sure the ssa will work again, so i don't want to void warranty by opening the unit.
I think i should ask my seller if they can service the unit, but they probably will see it was hacked... and they'll probably update the firmware.
So, I am still hesitating.
5 august 2017 : Finally, after thousands of tries, my ssa3021X went alive, again. I don't know what happened. When it finally booted, i was powering while pressing the system key... Not sure that it booted because of that.
Now, i made the 8.01 then 8.03 upgrades and it works like a charm.
All options remains actives.
-
Hello,
I am observing a bug with latest firmware V1.2.8.3
I have connected the analyzer to a stable signal.
In the log span I measure using trace A, Then I make A to be 'View' and enable trace B same settings.
At the very low frequency region I see a spike on trace B which is constantly redrawn.
Plot attached
On another issue, sometimes when I save a plot into a flash the png is created but it is blank.
So it seems something with flushing the content to the flash pen? Anyone having the same?
-
I also have a strange bug :
I get different values switching for x-lin to x-log scales.
about 10% difference in the MHz range.
-
Hi,
I see the same pike in the same conditions as seen in your screenshot.
But, only with VBW less or equal 300Hz (and RBW leass or equal 3Khz, not tested each case).
On any trace, go to trace menu, push View, then Clear write and the pike is there.
With 100Hz VWB, you can see a little pike before making the trace view/clear write operation.
-
Hi, everybody.
Please, anyone who has hacked in 8.3 firmware can show me the exact contents of the finished file and working NSP_sn_bandwidth.xml ?
I have discrepancies between the content of the versions prior to now.
My attached results in images
<license> <_ 3032> TRUE </ _ 3032> <_ 3030> FALSE </ _ 3030> <
_3021> FALSE </ _ 3021> <_ tTG> TRUE </ _ tTG> <_ TEMI> TRUE </ _ TEMI> <_ tMeas> TRUE </ _ tMeas> <_ tCAT> TRUE < TRUE </ _ EMI> <_ Meas> TRUE </ _ Meas> <_ CAT> TRUE </ _ CAT> </ license> </ system_information>
Thanks so much.
-
Hello my name is Eduardo and I have a new arrival 3021 with firmware V-8.3, perform the steps of post 417 without doing the first backup and firmware update since my factory version is already V-8.3
The second backup step for 8.3 is done correctly but when I get to the steps to modify it does not find the files
root@am335x-evm: cd /usr/bin/siglent/usr/backup
root@am335x-evm:/usr/bin/siglent/usr/backup# mv X.xml X.xml.org
root@am335x-evm:/usr/bin/siglent/usr/backup# mv Y.xml Y.xml.org
In the backup folder I have
Calib folder
NSP_sn_bandwidth.xm
NSP_sn_bandwidthx.xml
NSP_trends_config_infox.xml
nsp_data_b
nsp_data_bx
In the firmdata0 folder I have
Calib folder
Firmdata0 folder
NSP_sn_bandwidth.xml
NSP_sn_bandwidthx.xml
NSP_trends_config_info.xml
NSP_trends_config_infox.xml
nsp_data_b
nsp_data_bx
I'm a little lost can help me
Thank you very much for the hard work to be able to carry out this post
Eduardo
Ready problem solved
-
On a unit, brought last week, with rev 8.3 firmware, we used the following script:
plug in FAT32 formatted USB memory stick (to take a backup).
telnet to SSA30xxX
root/ding1234
cd /
cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
cd /usr/bin/siglent/firmdata0
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml
mv nsp_data_b nsp_data_bx
cd /usr/bin/siglent/usr/backup
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml
mv nsp_data_b nsp_data_bx
cd /
sync
logout
reboot
Works fine. All options enabled, including bandwidth extension, permenant licences.
I'm happy!
-
New firmware on the siglent site
-
Look here: https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg1300942/#msg1300942 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg1300942/#msg1300942)
Also, the firmware is safe to upgrade, at least telnet access is still there with the usual root password.
Note that the firmware release from yesterday has just been replaced with the correct file today!
Regards,
Vitor
-
thanks
-
Hi
I am finally ready to buy an SSA3021X.
Could someone confirm that the latest firmware is still possible to hack with same procedure?
thanks
-
read 3 post up, and you'll know.
-
read 3 post up, and you'll know.
Yes. it's very very likely that sellers holding stock with have 8.3 FW installed as 8.5 was only released a few days ago.
-
Also note that there is a much shorter way to "hack" the scope that only requires renaming one file.
-
read 3 post up, and you'll know.
I did but it only says: " ... at least telnet access is still there with the usual root password..."
doesn't mean Bicurico has actually implemented the hack
-
That was kind of incomplete. It has already been verified that the hack works on 8.5. and that message verified that you can still log in.
-
read 3 post up, and you'll know.
I did but it only says: " ... at least telnet access is still there with the usual root password..."
doesn't mean Bicurico has actually implemented the hack
Read what gonzo wrote.....root/ding1234 ;)
-
Gonzo was on 8.3, the OP asked if anyone actually tried it on 8.5. The answers are fragmented, one says the telnet is still there but did not try the hack, another that 8.5 still works with the hack but unclear if it was already hacked previously and just stuck through the upgrade ( this was also my case and it worked fine ).
From the bits and pieces it seems that yes, you can take an unhacked unit on 8.5 and apply the hack.
I'm still curious why most are still doing the long hack and not just renaming the one pertinent file and being done with it.
-
Gonzo was on 8.3, the OP asked if anyone actually tried it on 8.5. The answers are fragmented, one says the telnet is still there but did not try the hack, another that 8.5 still works with the hack but unclear if it was already hacked previously and just stuck through the upgrade ( this was also my case and it worked fine ).
From the bits and pieces it seems that yes, you can take an unhacked unit on 8.5 and apply the hack.
I'm still curious why most are still doing the long hack and not just renaming the one pertinent file and being done with it.
Thanks for confirmation.
Would you be kind enough to let me know how does "one file renaming" hack work? All I have found suggest renaming 3 files in "firmdata0" directory and their copies in "usr\backup" directory.
-
I also have another question. Apparently the units that are being shipped now have their tracking generators enabled as a gift (promotional offer for limited time). Is that gonna affect the hack procedure? Can I still use the same method and get the same result?
-
For the short version, see post 363/364
-
For the short version, see post 363/364
thanks, man. I don't know why I missed that one :-[
-
I also have another question. Apparently the units that are being shipped now have their tracking generators enabled as a gift (promotional offer for limited time). Is that gonna affect the hack procedure? Can I still use the same method and get the same result?
any thought on this?
mine is coming with TG enabled but I still need to do the mod for 3.2GHz and reflection meas.
-
My unit came with the TG enabled even though I didn't order it. I upgraded from unhacked 8.1 to 8.5a, then did the hack just by renaming the NSP_sp_bandwidth file. Hack still works fine as before.
-
My unit came with the TG enabled even though I didn't order it.
You did not know this:
http://siglentamerica.com/qyxwxx.aspx?id=6420&sid=216 (http://siglentamerica.com/qyxwxx.aspx?id=6420&sid=216)
TG is free! (limited time offer from Siglent)
-
Actually I bought mine ~6 months ago and it came with the TG
-
My unit came with the TG enabled even though I didn't order it. I upgraded from unhacked 8.1 to 8.5a, then did the hack just by renaming the NSP_sp_bandwidth file. Hack still works fine as before.
excellent!
thanks!
-
Since some people have questions about the hack-ability of the analyzer when they have options installed, I will try to explain how
the whole option mechanism works:
The NSP_edsn_bandwidth.xml has the following structure (I have changed the real data in example data and added comments)
<?xml version="1.0" encoding="UTF-8"?>
<sn_bw_root>
<serial_number>
<chip>SSA_SERIALNUMBER</chip> (here is the serial number of the unit)
</serial_number>
<license>
<_3021>
<lic>aaaaaaaaaaaaaaaa</lic> (here is the general key to indicate that this is a 3021 model)
</_3021>
<_tTG>
<lic>bbbbbbbbbbbbbbbb</lic> (here is the license key for the tracking generator option)
<remain>2690</remain> (here is the remaining demo time in minutes if you have a temporary key)
</_tTG>
<_tEMI>
<lic>cccccccccccccccc</lic> (here is the license key for the EMI option)
<remain>2690</remain> (here is the remaining demo time in minutes if you have a temporary key)
</_tEMI>
<_tMeas>
<lic>dddddddddddddddd</lic> (here is the license key for the Advanced Measuring AMK option)
<remain>2690</remain> (here is the remaining demo time in minutes if you have a temporary key)
</_tMeas>
<_tCAT>
<lic>eeeeeeeeeeeeeeee</lic> (here is the license key for the Reflection option)
<remain>2690</remain> (here is the remaining demo time in minutes if you have a temporary key)
</_tCAT>
</license>
</sn_bw_root>
If the unit does not find the file NSP_edsn_bandwidth.xml or does not find a serial number in the <chip> node it will enter the
factory test mode with all options enabled and full bandwidth (This is our hacked mode)
however if the unit finds any serialnumber in the <chip> node it will calculate a check number for each of the license options
here is where the aaaaaaaaa,bbbbbbbb,ccccccccc etc come to play, these correspond to the licensenumbers you get when you legally buy the options.
If your unit is shipped with options already enabled then you will see a valid code for your unit on the corresponding location.
The <remain> nodes will 'remember' the remaining time for residual license options, this number will count down to zero but you can always set them back to 2880 which will restore the residual time to the 48 hours you got when your unit was brand new...
-
This is the reason why for now (as long as Siglent does not implement a major change in the FW structure), the only really important information for every new FW upgrade is: "Does the telnet access still work?"
Regards,
Vitor
-
Hi guys. I am a newbie with limited experience with putty. Just got new ssa 3021x. Connected LAN from PC to instrument. software version 1.2.8.5. ran putty in telenet mode after setting the IP address under static on the SSA. Will not communicate. No response from instrument. Any ideas?
thanks
-
Hi guys. I am a newbie with limited experience with putty. Just got new ssa 3021x. Connected LAN from PC to instrument. software version 1.2.8.5. ran putty in telenet mode after setting the IP address under static on the SSA. Will not communicate. No response from instrument. Any ideas?
thanks
I guess you have already checked the basics (did the SA retain the user configured ip address after power off/on, is the subnetmask correct, is the ethernet cable used ok ...)?
When you write you have connected the LAN from PC to instrument, do you mean you have a NIC with multiple ports in your PC?
Usually you would connect the SA directly into a port of your LAN switch.
Can you ping the SA from your pc? If so, the PUTTY configuration is wrong....
-
hello thanks for the help. I have the LAN connection can ping through the command window to the device and get a response. have verified pc will hook by the same lan cable to my modem. Have set the ip address on the built in network adaptor and used a similar address on the instrument different by one digit. submask appears to be correct. After much trying started to work. not sure why. Appreciate your help. Assume can still hack with this firmware 1.2.8.5?
-
hello everyone.. as a newbie had trouble getting pc to communicate to ssa3021x. FW 1.2.8.5. tried gonzo's script but when rebooted came back up as 3021x. Firmdata0 directory was showing that the NSP ... file was being renamed to the "x" version but the original file was still there preventing it coming up as a 3032x. got message stating read only file system cannot delete. Went back to Gonzo's command for mounting firmdata0 and tried it again and this time file (original) was removed. rebooted and it came up as 3032x. Thank you all for this forum and the great contributors.
-
I just bought a SSA3021X from Saelig and it came with 1.2.8.3 firmware. I updated it to 1.2.8.5a and followed the commands on gonzo's post 429 and everything worked just fine! now enjoying my SSA3032x! Thanks to everyone for figuring this out.
-
I just bought a SSA3021X from Saelig and it came with 1.2.8.3 firmware. I updated it to 1.2.8.5a and followed the commands on gonzo's post 429 and everything worked just fine! now enjoying my SSA3032x! Thanks to everyone for figuring this out.
Is it worth updating the firmware from 1.2.8.3? Have held back until now as it's working nicely.
Thanks
Trev
-
I think there was some significant bugs fixed when going from 1.2.8.3 to 1.2.8.5 as well as some enhancements to RBW. I believe there was only very minor fixes between going from 8.5 to 8.5a. I even saw a few people complaining that 8.5a was causing hangs and freezes, however I have not had any issues at all with 8.5a so far.
Sent from my iPhone using Tapatalk
-
I think there was some significant bugs fixed when going from 1.2.8.3 to 1.2.8.5 as well as some enhancements to RBW. I believe there was only very minor fixes between going from 8.5 to 8.5a. I even saw a few people complaining that 8.5a was causing hangs and freezes, however I have not had any issues at all with 8.5a so far.
Sent from my iPhone using Tapatalk
Is there a chsngelog anywhere?
Thanks
Trev
-
Yes a pdf of the change log is included in the firmware zip file when you download it from siglent.
Sent from my iPhone using Tapatalk
-
Thanks to Gonzo_the_great. I followed his text in #428 exactly and now have a full unlocked SSA3021X
My procedure, Analyser delivered SW1= 1.2.8.3, SW2= 2017-05-12-1, SW3=000000D1, HW=07.03.00
1) Download firmware update from siglent v 8.5a, quick format a FAT32 usb stick San Cruzer 8gb, unzip update and copy .ADS file onto mem stick.
2) Insert into SSA3021X and boot.
3) system> system info> firmware update> update (system reboots a few times etc. reboot and confirm update is correct 1.2.8.5a
4) putty, telnet>login etc.
*i tried to update and mod the files here but after backup of 2 folders and mv (rename) was tried said filesystem was read only.
5)need to power off/reboot after firmware update first.
6)follow the instructions from Gonzo.
On a unit, brought last week, with rev 8.3 firmware, we used the following script:
plug in FAT32 formatted USB memory stick (to take a backup).
telnet to SSA30xxX
root/ding1234
cd /
cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
cd /usr/bin/siglent/firmdata0
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml
mv nsp_data_b nsp_data_bx
cd /usr/bin/siglent/usr/backup
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml
mv nsp_data_b nsp_data_bx
cd /
sync
logout
reboot
Works fine. All options enabled, including bandwidth extension, permenant licences. :popcorn: :clap: :clap: :clap: :clap: :clap:
I'm happy!
Thanks again Gonzo_the_great.
Grump.
-
...and another successful hack.
Thank you guys, you are awesome!
-
Thanks Gonzo_the_great.
So if we update the firmware in future to a new version does that reverse the upgrade?
Thanks
Fanman
-
^^^^ Going from 1.2.8.3 to 1.2.8.5a retained all settings :-+
-
Contents of a decrypted nsp_data_b:
<?xml version="1.0" encoding="UTF-8"?>
<sn_backup_root>
<factory>TRUE</factory>
<pro_mode>FALSE</pro_mode>
<transit>TRUE</transit>
<serial_number>
<chip>SSA3XXXXXXXXXX</chip>
</serial_number>
<license>
<_3032>
<lic>XXXXXXXXXXXXXXXX</lic>
</_3032>
<_Meas>
<lic>XXXXXXXXXXXXXXXX</lic>
</_Meas>
<_EMI>
<lic>XXXXXXXXXXXXXXXX</lic>
</_EMI>
<_TG>
<lic>XXXXXXXXXXXXXXXX</lic>
</_TG>
<_CAT>
<lic>XXXXXXXXXXXXXXXX</lic>
</_CAT>
</license>
</sn_backup_root>
Anyone knows what is the PRO_MODE?
-
My SSA3021X currently has firmware version 8.2 and also has the hack as detailed in post #428. I am looking to upgrade to the latest firmware which is currently version 8.5a as my version looks like it is now quite out of date.
Is it possible to just apply this new firmware without un-doing the hack first? I have seen a few people have gone from version 8.3 to 8.5a without un-doing the hack but I have not seen anyone mention going from 8.2 to 8.5a...
Before doing the update I just wanted to check if I can do it without making any file changes?
Thanks in advance for the help.
-
My SSA3021X currently has firmware version 8.2 and also has the hack as detailed in post #428. I am looking to upgrade to the latest firmware which is currently version 8.5a as my version looks like it is now quite out of date.
Is it possible to just apply this new firmware without un-doing the hack first? I have seen a few people have gone from version 8.3 to 8.5a without un-doing the hack but I have not seen anyone mention going from 8.2 to 8.5a...
Before doing the update I just wanted to check if I can do it without making any file changes?
Thanks in advance for the help.
There's nothing stopping you doing the FW updates in steps.
8.3 can be found here:
http://www.siglenteu.com/gjjrj-xq.aspx?id=3918&tid=15 (http://www.siglenteu.com/gjjrj-xq.aspx?id=3918&tid=15)
And 8.5a on the first page of the FW list.
http://www.siglenteu.com/gjjrj.aspx?id=15 (http://www.siglenteu.com/gjjrj.aspx?id=15)
-
Thanks tautech - I will do it the way you suggest in two updates.
I just wanted to check as:
message #400 said 8.1 to 8.3 did not need any mod reverting
message #439 appeared to say 8.3 to 8.5 was also ok without a revert (but I was slightly unclear on this one)
message #464 said 8.3 to 8.5a retained all settings
I just wanted to double check that I was reading everything correctly.
Thanks again.
-
Any hacks to expand bandwidth and options for the SDS2104X? I'm probably going to grab the offer from Batronix before it expires, so I'm rushed to figure out which 4 channel DSO allows me to upgrade decoders and bandwidth to at least 200 MHz (300MHz even better) from either Rigol or Siglent. I'm a complete novice in the thread and just skimmed through.
-
Any hacks to expand bandwidth and options for the SDS2104X? I'm probably going to grab the offer from Batronix before it expires, so I'm rushed to figure out which 4 channel DSO allows me to upgrade decoders and bandwidth to at least 200 MHz (300MHz even better) from either Rigol or Siglent. I'm a complete novice in the thread and just skimmed through.
Really this is the wrong thread to go looking at DSO's.
I guess the SDS2000X series can be tweaked but I've not heard of anyone that's achieved it.
Jump into another thread to further your search.
https://www.eevblog.com/forum/testgear/siglent's-new-product-sds2000x-series/ (https://www.eevblog.com/forum/testgear/siglent's-new-product-sds2000x-series/)
If you need 2Gsa/s then the 2000X models are your only option otherwise there's the new SDS1000X-E series with 4 channels and BW's to 200 MHz.
https://www.eevblog.com/forum/testgear/siglent-sds1204x-e-released-for-domestic-markets-in-china/ (https://www.eevblog.com/forum/testgear/siglent-sds1204x-e-released-for-domestic-markets-in-china/)
https://www.eevblog.com/forum/testgear/siglent-sds1104x-e-in-depth-review/ (https://www.eevblog.com/forum/testgear/siglent-sds1104x-e-in-depth-review/)
-
Hi,
am i right, that when i buy a SSA3021X (TG option already enabled) today, i will be able to hack it to 3.2 GHz?
Since even the plain SSA3021X version is hardly affordable for me, i would be glad if somebody could confirm the hackability of the actually shipped versions.
Thanks
-
@rfspezi
Have you even bothered to look at the previous posts?
-
@rfspezi
Have you even bothered to look at the previous posts?
Yes, however it's not clear to me if a "fresh" unit containing the latest firmware (not updated from a previouse, hacked version) can be hacked aswell.
That's why i was asking.
-
You can do the hack.
-
I"ve read pretty much every post in the last 19 pages...
I have a unmodified 3021 with licensed TG that I purchased back in 2016. It came with 7.07 firmware. All the trial options have timed out and I've done no modifications to it.
Do I understand correctly that if I modify the version 7.07 file that had the lower case "t" enables to get all the options enabled in 7.07, THEN upgrade to 8.01, that I will be able to read the hex keys for all the options, something that I can do one time only. Are those hex keys the same ones that you would use to enter in via the UI for the System Info Load Option ?
Thanks! AlphaBob
-
Yes to all your questions.
Mind you that the relevant file is NSP_system_info.xml and all options are to be set to TRUE.
-
how are you friend I have a problem and is that these files do not have I have
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml
that's why when I put the commands to put them on I do not like the rights as I do there because I do not understand that part
-
There might be a slight chance that I did not fully understood your message but I will give it a try.
The command is used to rename the two existing files. As you are logged in as root, there will be no issues with access rights.
If you get an error, it might be that the original files no longer exist. Use the 'ls' command to see which files exist in the directory.
-
Followed grumpy's in 460 on a new machine just received. Worked perfectly. All licenses permanent.
(Serial number changes to xxx)
Thanks mates!
-
I love this forum, I hate this forum :scared: $$$
-
Yeah - that'll happen.
-
Perhaps a stupid question,
after the hack, can you go back to the original configuration??
perhaps for selling after a time as original or if there is a problem into the warranty period??
-
Yes,
Just put the files back or rename them to their original name.
Regards,
Vitor
-
After a failed firmware update I had a problem with the Dutch distributor. I was accused of hacking the analyser but there was absolutely no need to do so as I still had plenty of time in the trial licenses. They were so "generous" to fix the problem but my warranty was withdrawn. Assholes!!
It gave me the opportunity to open the analyser and unsolder the NAND and make a copy. So whoever needs a binary dump (firmware 8.3), let me know.
-
After a failed firmware update I had a problem with the Dutch distributor. I was accused of hacking the analyser but there was absolutely no need to do so as I still had plenty of time in the trial licenses. They were so "generous" to fix the problem but my warranty was withdrawn. Assholes!!
It gave me the opportunity to open the analyser and unsolder the NAND and make a copy. So whoever needs a binary dump (firmware 8.3), let me know.
OK so you have 8.3, which version were you trying to upgrade to ?
Throughout the firmware releases there have been versions that one must update to first before proceeding to the next. Did you miss one of these steps to have a failed update ?
If so your distributor should have known about that and just installed FW in the proper steps.
Certainly no reason to withdraw warranty. :-//
Is there more info you can give us ?
-
The analyser came with 8.1 and, after using it for some time with no problems, I tried updating to 8.2. The update failed with the screen remaining blank, no Siglent screen, after rebooting.
The analyser came back from the Siglent distributor with 8.3 installed as this version was available in the meantime. I then opened the machine since the warranty was gone anyway and copied the NAND. Then burned a fresh NAND and to test my copy re-soldered the freshly burned NAND. Worked fine and let itself upgrade to 8.5a. Happy for now.
Somewhere in the future I will probably try to go back to 7.7 to create a future proof upgrade path and investigate the upgrade steps to 8,x and see what license re-calculations take place.
-
The only need to go back to version 8.1 and replace license files form 7.7. Reboot and system will generate new license files whit serial numbers for all options.
Good luck.
-
File not found. :(. Anyone have an archive copy?
-
I read the whole thread but I am not really sure about the following (you all know these large threads where, at the end, you never can be sure). So I would like you for some guidance before I make a mistake.
I have a SSA3000x with firmware 1.2.7.7
It was hacked 1.5 years ago by changing the NSP_system_info.xml :-+
Now I would like to upgrade to the latest firmware which is 1.2.8.5
Can I just upgrade from 7.7 to 8.5?
Will my (hacked) options stay and also my serial number?
Thank you!
-
Can I just upgrade from 7.7 to 8.5?
No.
There's some mandatory steps to get to the latest firmware.
This give guidance on them all:
https://www.siglentamerica.com/wp-content/uploads/dlm_uploads/2018/02/SSA3000X-Firmware-Revise-History.pdf (https://www.siglentamerica.com/wp-content/uploads/dlm_uploads/2018/02/SSA3000X-Firmware-Revise-History.pdf)
-
I read the whole thread but I am not really sure about the following (you all know these large threads where, at the end, you never can be sure). So I would like you for some guidance before I make a mistake.
I have a SSA3000x with firmware 1.2.7.7
It was hacked 1.5 years ago by changing the NSP_system_info.xml :-+
Now I would like to upgrade to the latest firmware which is 1.2.8.5
Can I just upgrade from 7.7 to 8.5?
Will my (hacked) options stay and also my serial number?
Thank you!
From 7.7 (modified or not) can not upgrade directly to 8.5.
There is only one FW version what can do update from old 7.7. This version is 1.2.8.1
This version can produce licenses and model keys what are used in 8.x versions (this system was not at all in 7.x versions.)
After 1.2.8.1 update succesfull then can update later 8.x versions.
Look carefully how 7.7 is modified before update to 8.1. so that it can produce all license keys for options and model what are currently in use when it is running 7.7 version. Look if your model (system info screen) read 3032X and all options are listed as "permanent".
After 8.1 can not go back to 7.7 version (or yes can using some special method what I do not recommend for avoid possible problems)
After all is ok take copy to usb these important files what include these license keys etc. Only siglent can do these if you loose them. Of course in 8.x versions there is other method for modify, but 7.7 to 8.1 step can produce these official keys. So do not loose this possibility because you have it due to fact that you are still in 7.7 ;)
-
Thank you for the advise.
I attached a screenshot of my system screen.
What I see there is serial number, all options permanent, and SSA3032x.
If I understand you correctly I know shall
1) do an update to 1.2.8.1
2) make a backup
3) update to 1.2.8.5a
I will try this tomorrow.
P.S.
My NSP_system_info does not contains all the False entries anymore (e.g. <_3018>FALSE</_3018>). Is this a problem? The current XML is shown below.
<?xml version="1.0" encoding="UTF-8"?>
<nsp_system_info_root>
<device>
<system_information>
<serial_number>
<chip>SSA3XHA1234567</chip>
</serial_number>
<license><_3032>TRUE</_3032><_tTG>TRUE</_tTG><_tEMI>TRUE</_tEMI><_tMeas>TRUE</_tMeas><_tCAT>TRUE</_tCAT><_t1HZ>TRUE</_t1HZ><_t3M>TRUE</_t3M></license></system_information>
</device>
</nsp_system_info_root>
-
one last question before I start. I also used the werewolf mode (setting the system date back) before the hack was known. I removed the monster file back then. Am I right, there is nothing more to do?
-
Pinkus -
please make sure the lower case "t" in the license line are removed. This designates the test / temporary licenses and won't enable the permanent ones. The line should rather look like this:
<license><_3032>TRUE</_3032><_3021>FALSE</_3021><_TG>TRUE</_TG><_EMI>TRUE</_EMI><_Meas>TRUE</_Meas><_CAT>TRUE</_CAT></license></system_information>
Otherwise, the hack should work like this.
Good luck,
Thomas
-
uh uh - what a trap.
I am glad you saved me from some trouble Thomas!
Thanks!
-
Pinkus -
please make sure the lower case "t" in the license line are removed. This designates the test / temporary licenses and won't enable the permanent ones. The line should rather look like this:
<license><_3032>TRUE</_3032><_3021>FALSE</_3021><_TG>TRUE</_TG><_EMI>TRUE</_EMI><_Meas>TRUE</_Meas><_CAT>TRUE</_CAT></license></system_information>
Otherwise, the hack should work like this.
Good luck,
Thomas
This is the case when the forum has experts and accurate eyes.
It was a very good and careful accurate observation - worth a thousand points!
:-+ :clap:
-
Just to reassure:
What I now see in Thomas license code, that the entries for 1 Hz and 3 Mhz RBW which were working in 7.07 are gone. In 7.07 there was <_1HZ>TRUE</_1HZ><_3M>TRUE</_3M>
I read in this thread, that 1 Hz and 3 Mhz RBW are not available anymore starting from FW 8.1 so I just should delete this now before updating? Would it hurt to keep it?
From FW 8.5 the 1 Hz will be back anyway, am I correct?
-
Doesn't matter if you keep them or not. But they will not be producing extra serial numbers.
Also, with the "t" options: you can keep them, as long as you have the non-"t" options, too.
Here is the complete string I used and that gives you the maximum licenses, available:
<?xml version="1.0" encoding="UTF-8"?>
<nsp_system_info_root>
<device>
<system_information>
<serial_number>
<chip>SSA3Xxxxxxxxxx</chip>
</serial_number>
<license><_3032>TRUE</_3032><_3021>FALSE</_3021><_tTG>TRUE</_tTG><_tEMI>TRUE</_tEMI><_tMeas>TRUE</_tMeas><_tCAT>TRUE</_tCAT><_t1HZ>TRUE</_t1HZ><_TG>TRUE</_TG><_EMI>TRUE</_EMI><_Meas>TRUE</_Meas><_CAT>TRUE</_CAT><_1HZ>TRUE</_1HZ><_3M>TRUE</_3M></license></system_information>
</device>
</nsp_system_info_root>
-
Just to reassure:
What I now see in Thomas license code, that the entries for 1 Hz and 3 Mhz RBW which were working in 7.07 are gone. In 7.07 there was <_1HZ>TRUE</_1HZ><_3M>TRUE</_3M>
I read in this thread, that 1 Hz and 3 Mhz RBW are not available anymore starting from FW 8.1 so I just should delete this now before updating? Would it hurt to keep it?
From FW 8.5 the 1 Hz will be back anyway, am I correct?
Yes. Siglent activated 3 and 1Hz 8.5. But not 3MHz
Of course after you have made this all right way and system have generated all official license keys you can after then use also other (possible in FW 8.x) modification what do not care anything your model and option licenses and you get same 3.2GHz and all options functional + 3MHz unspecified experimental grade RBW available
So, if you make it right way you can then when ever turn it back to "official" mode and you have there official options license keys and official 3.2GHz model license, only what is different to official is front panel label.
But also now in this case, you do not have 2.1GHz version license. If you want (some reason, example sending it to Siglent service) turn it to official mode, matching also with front panel label 3021X you can not - due to lack of 3021X model license! (so think what license/product key you want - you can get only one.)
At this point when you still are with FW7.7 you can carefully think what license you want and is wise but also it need think that some day Siglent may change system and mods dop not work. If you have official 3032X license there... you know future FW also keep it as 3032X. If you have there 3021X license future FW sure keep it as 3021X and here you can run it with super mode mod and it works like 3032X as long as Siglent do not destroy this (and markets) in some future FW.
You can now in 7.7 select which one you want and is more wise for you. Later in FW 8.x (least with FW8.5a what is most new at this time) you can modify it so that it do not care these licenses at all and it works like 3.2G and all options on and including also experimental RBW 3MHz. But as told this "feature" Siglent can stop in some future FW if they want. But if you have all official licenses for all options and product key for 3032X it stay. Only situation when these are generated is process what is running once when system is updating from 7.x to 8.1.
-
Just to reassure:
What I now see in Thomas license code, that the entries for 1 Hz and 3 Mhz RBW which were working in 7.07 are gone. In 7.07 there was <_1HZ>TRUE</_1HZ><_3M>TRUE</_3M>
I read in this thread, that 1 Hz and 3 Mhz RBW are not available anymore starting from FW 8.1 so I just should delete this now before updating? Would it hurt to keep it?
From FW 8.5 the 1 Hz will be back anyway, am I correct?
Yes because after 7.7 to 8.1 you do not now have (yet) modified it to "super mode" what opens all RBW's including also experimental 3MHz.
-
Thank you all!
The unit was successful updated from 7.7 to 8.1 and then to 8.5a.
-
Hello to all ,
received SSA3021X few days ago, came with 1.2.8.5a . date 3/17/2018 on system files. iv looked over this thread and don't know if iv overlooked something or I have found something. on unit itself if you go to file system keep hitting back then switch to Dir. and keep hitting open/load until complete file system of unit is shown. was able to copy and past most relevant files needed for hacking to 3032X. I continued to back up everything as instructions say. but when it came to renaming files I was able to do so on unit GUI , not on putty/telnet. I noticed that depending on the sequence of opening firmdat0 it was in rw mode, allowing me to change following files structure to include an (x). even with all this I still synced it through putty . I was able to run side/byside and preform needed changes. is this something new or did I miss something in this thread.
anyways ,much thanks for contributors of this thread. I'm in no way a seasoned shell command user but was able to follow instructions :phew:
here are some screen shots.
-
Hi,
I have the last firmware installed: 1.2.8.5a and I wanted to backup all the MTD partitions prior to play with the unit :-)
As many of you, I suffered the MTD7 read error using the previously posted "DD" procedure.
Well, today I succeded dumping the MTD7 using the nanddump command:
root@am335x-evm:~# nanddump -f /usr/bin/siglent/usr/mass_storage/U-disk0/mtd7 /dev/mtd7
ECC failed: 0
ECC corrected: 1
Number of bad blocks: 0
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x02b00000...
ECC: 1 corrected bitflip(s) at offset 0x01fe0000
the file size then is :
root@am335x-evm:~# ls -l /usr/bin/siglent/usr/mass_storage/U-disk0/
-rwxr-xr-x 1 root root 45088768 Apr 13 11:04 mtd7
and this is the list of partitions... just in case....
root@am335x-evm:~# cat /proc/mtd
dev: size erasesize name
mtd0: 00020000 00020000 "SPL"
mtd1: 00020000 00020000 "SPL.backup1"
mtd2: 00020000 00020000 "SPL.backup2"
mtd3: 00020000 00020000 "SPL.backup3"
mtd4: 001e0000 00020000 "U-Boot"
mtd5: 00020000 00020000 "U-Boot Env"
mtd6: 00300000 00020000 "Manufacturedata"
mtd7: 02b00000 00020000 "File System"
mtd8: 00600000 00020000 "kerneldata"
mtd9: 00600000 00020000 "fpgadata"
mtd10: 03200000 00020000 "firmdata0"
mtd11: 03200000 00020000 "firmdata1"
mtd12: 05f80000 00020000 "datafs"
Hope this could help .
Cheers
-
Dear all,
I need your help because I'm not an expert of linux.
What is the correct syntax for login to SSA3021X (with PuTTYPortable).
I get no response, but I can check the connection by "*IDN?" - there is a response and also I'm able to reboot over LAN.
I have done the last update to firmware SSA3000X_1.2.8.5a_EN (date 180312) :palm:. Unfortunately I have not the possibility like Bandit327, the Back-key is blocked.
Has somebody an idea, ore must I go over the internal serial-port?
-
Dear all,
I need your help because I'm not an expert of linux.
What is the correct syntax for login to SSA3021X (with PuTTYPortable).
I get no response, but I can check the connection by "*IDN?" - there is a response and also I'm able to reboot over LAN.
I have done the last update to firmware SSA3000X_1.2.8.5a_EN (date 180312) :palm:. Unfortunately I have not the possibility like Bandit327, the Back-key is blocked.
Has somebody an idea, ore must I go over the internal serial-port?
You need use TELNET!
But please if you do not know what you are doing then study before you do anything. When you have root then with mistakes you can mess whole SA.
PuTTYtel client you can find here
https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html (https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html)
And there you download 32 or 64 bit version (a Telnet-only client)
32-bit: puttytel.exe
64-bit: puttytel.exe
(and for tracking some possible mistakes turn also log on so that it log all your work to log file.)
Also keep care you follow right instructions and not all fake informations here and there.
Remember, if you are not sure what you do then do not. Golden rule: First brain - then muscle.
This is how SSA3000X answer when it see your terminal. If you do not see this kind of terminal screen (coming from SA) when you connect terminal then you are doing wrong or something is wrong. (Terminal..what terminal...you have sopme kind of PC, you do not have real terminal (exept if you have), you have Windows PC or Kylin PC or whatever OS PC somehow emulating real terminal)
Connection protocol is Telnet and telnet port is 23 (PuTTYtel default) and IP address is how you set in SA and then also in PuTTY settings correspondingly.
_____ _____ _ _
| _ |___ ___ ___ ___ | _ |___ ___ |_|___ ___| |_
| | _| .'| . | . | | __| _| . | | | -_| _| _|
|__|__|_| |__,|_ |___| |__| |_| |___|_| |___|___|_|
|___| |___|
Arago Project http://arago-project.org am335x-evm
Arago 2013.05 am335x-evm
am335x-evm login:
Read carefully this msg
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1251608/#msg1251608 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1251608/#msg1251608)
and all what you can find here (including links) and if you find some instructions then adjust some parts of instructions with this message (because something have bit changed after V05 instructions.)
And remember that right use of copypaste is your friend for avoid any typing errors in command lines. Worst case some mistake/error may be fatal.
-
Thank you rf-loop :clap:,
the important information was port 23.
My mistake was port 5025 (I found at a Siglent information)
Now I get the response and was able to to solve my problems (thanks to gonzo_the_great).
Many thanks for the fast support, rf-loop! :-+
-
Something happened to my SSA3032X today :scared:
I got it with TG but.....
(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=414693)
Thanks Roger for your help. :)
-
Something happened to my SSA3032X today :scared:
I got it with TG but.....
(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=414693)
Thanks Roger for your help. :)
Hi tautech, could you please explain the miracle?
Thanks Karsten
Gesendet von meinem STH100-2 mit Tapatalk
-
I'm jonesing for one of these soooo badly, but I just can't justify it. While I do work with SDR/wireless technology at work, I don't do much at home as I haven't been a ham since I was a kid.
If anyone outgrows theirs, please let me know!
-
Something happened to my SSA3032X today :scared:
I got it with TG but.....
(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=414693)
Thanks Roger for your help. :)
Hi tautech, could you please explain the miracle?
Thanks Karsten
Gesendet von meinem STH100-2 mit Tapatalk
See reply #504 and follow all links.
Read, study and understand........lots !
If you are PuTTY or TELNET illiterate .......then totally forget the hack or get 'trusted' and 'capable' help. < This I stress strongly.
We used LAN cable between W7 laptop and SSA and for the hack,TELNET as my helper (EEVblog member)was very proficient in its use.
I only needed the remaining 3 options for my demo SSA3032X and there probably is a neater way to get them without loosing the SN#. :(
-
Hi,
version 1.2.9.1 is out. Is this hack still valid?
/m
-
Hi,
version 1.2.9.1 is out. Is this hack still valid?
/m
Well, it doesn't affect it. :)
(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=417625)
-
Hi,
version 1.2.9.1 is out. Is this hack still valid?
/m
Well, it doesn't affect it. :)
Thanks. Will try it later today ...
-
after update to 1.2.9.1 information of last 'Calibration date' is lost .. ?
Karsten
-
If Siglent was smart it would sell and release all its spectrum analyzers with all firmware upgrade options. They would sell thousands more units and would certainly make them more money than selling firmware licenses. Them trying to emulate Keysight with Option 1 to 99999999999 is really not smart in today's business model.
If they announced this policy tomorrow, they would at least get 1000 more sales tomorrow!
Oh well opportunity lost.
-
If Siglent was smart it would sell and release all its spectrum analyzers with all firmware upgrade options. They would sell thousands more units and would certainly make them more money than selling firmware licenses. Them trying to emulate Keysight with Option 1 to 99999999999 is really not smart in today's business model.
If they announced this policy tomorrow, they would at least get 1000 more sales tomorrow!
Oh well opportunity lost.
You can test what options you really need after purchase as all are active for a trial period.
Presently TG that was previously $237 is now free and that move by Siglent alone reflects the popularity of these models.
And the current lead times.............. :(
-
hello.
I update from 1.2.8.5a to 1.2.9.1 and lost the Calibration date to.?? Bugs? Never tried to hack the SSA3021.
Get it few days ago incl TG .
Someone tried to only activate the the options on this last firmware? It was delivered with TG
-
hello.
I update from 1.2.8.5a to 1.2.9.1 and lost the service info to.?? Bugs? Never tried to hack the SSA3021.
Get it few days ago.
Welcome to the forum.
I'll send an email to Siglent about this update after I apply it to a new unit I have in stock. I have ~18hrs until they are at work.
Someone tried to only activate the the options on this last firmware? It was delivered with TG
They all come with TG free now.
In my invoices from Siglent TG option is listed separately and at $0.00. :)
-
Was ist los.? After the last upgrade 1.2.9.1 it was very quiet. Was going on? What happens?
Per O
-
Was ist los.? After the last upgrade 1.2.9.1 it was very quiet. Was going on? What happens?
Per O
I got no reply from Siglent and when I installed 9.1 into a new 3021X before sale I saw no changes so I presume it just affects hacked units but I'm not entirely sure. Needs more feedback from others.
-
Thanks. I get a feedback from the seller here in Norway, today. He told siglent new FW had make a change in the UI . I make a png of the page, and hi told me the same happens on 2 hiof new equipments. Nor more. I thinl it is no importent fault anyway. A another thing. Some times I could not shut down the analyzer, and get to move the 220v connector. Nobody of this happens with the FW 1.2.8.5a originally installed. Maybe I want to cansel the bay. I am tired of all data bugs around me. They do not doing things right. My car to, must upgrade against bygs in the FW. have a nice weekend all.
-
If Siglent was smart it would sell and release all its spectrum analyzers with all firmware upgrade options. They would sell thousands more units and would certainly make them more money than selling firmware licenses. Them trying to emulate Keysight with Option 1 to 99999999999 is really not smart in today's business model.
If they announced this policy tomorrow, they would at least get 1000 more sales tomorrow!
Oh well opportunity lost.
Then they would charge more $$ and people would complain that they were paying extra for features they don't want/use. So they would most likely sell fewer units.
A base $$ price plus $$ options allows people to start with a basic SA that they might not otherwise afford. They can then expand capability without buying a new SA. Base plus options is a smart model. The automotive industry has been doing it for decades.
-
Hello everyone im new and new to Sigllent spectrum analyzers just got a ssa3021x and was looking for hacks to open it up.
i been getting lost in the posts on how to do it my unit is new and made in 4/2018
any help/info would be nice
thanks everyone
-
Hello everyone im new and new to Sigllent spectrum analyzers just got a ssa3021x and was looking for hacks to open it up.
i been getting lost in the posts on how to do it my unit is new and made in 4/2018
any help/info would be nice
thanks everyone
Welcome to the forum.
See reply #509 and follow links but before you venture down that path I strongly recommend you use most of the free trial time available and become familiar and confident with the UI. TELNET or PuTTY it doesn't matter BUT you really need to know what you're doing ! I didn't and enlisted trusted and highly competent assistance.
One trick that can be overlooked is removing the power entirely as the last step.
-
ok thank you
-
Hello,
I'm trying to push this hack a little further... :-)
Has anybody already tested the effect of the "pro_mode" (should take TRUE or FALSE values) and "reset_times" xml nodes ?
-
Hi
Just working through some instructions I found.
The instructions include a mv command. For non-Linux readers, this is a move (source) (destination) command.
In the instructions I found, the source/destination are reversed. These errors are corrected in post 428.
*Make sure your USB stick is inserted. This command saves a backup to a USB stick.
nanddump -f /usr/bin/siglent/usr/mass_storage/U-disk0/mtd7 /dev/mtd7
* change to the root directory.
cd /
*this command puts the storage into read/write mode.
mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
cd /usr/bin/siglent/firmdata0
* make sure your USB stick is inserted. This copies files and the directory to the USB stick as a backup
cp -r * /usr/bin/siglent/usr/mass_storage/U-disk0/
* the mv command renames files by adding a x to the file name. Note only 3 files.
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml
mv nsp_data_b nsp_data_bx
cd /usr/bin/siglent/usr/backup
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml
mv nsp_data_b nsp_data_bx
cd /
sync
exit
* then switch off/on
If you get an error that looks like this:
can't rename 'NSP_sn_bandwidth.xml': Read-only file system
Just rerun the mount... command.
I decided to back out of this and I didn't get to the last part because I am wondering if there is an alternative way of doing this.
What about writing a small bash script saved in /etc/init.d that resets the timers on the options???
This would run each time the analyser was switched on and set the timer to 48h.
Normally such a script would go in rc.local, but thats not there.
Ideally the script would be rerun every 47hours but crontab is not installed.
This would preserve all of the factory settings. It wouldn't expand the bandwidth though.
Just a thought.
-
Hi everyone,
while I managed to update/unlock some other devices (router, TV box etc) :-+, my scripting knowledge is close to zero :--. This definitely will not stop me from trying to upgrade SSA3k I am awaiting to be delivered, but some help/advise would be very helpful, especially after reading some warning posts.
I has read all current thred and still have questions:
1) if I understand Gonzo_the_grate script on #428, it makes backup to usb stick and makes copies of xml files adding 'x'-es in firmdata0 and backup?
plug in FAT32 formatted USB memory stick (to take a backup).
telnet to SSA30xxX
root/ding1234
cd /
cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
cd /usr/bin/siglent/firmdata0
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml
mv nsp_data_b nsp_data_bx
cd /usr/bin/siglent/usr/backup
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml
mv nsp_data_b nsp_data_bx
cd /
sync
logout
reboot
2) where should be added this licence line? Is it xml file should be edited manually?:
<?xml version="1.0" encoding="UTF-8"?>
<nsp_system_info_root>
<device>
<system_information>
<serial_number>
<chip>SSA3XHAxxxxxxxxxxx</chip>
</serial_number>
<license><_3032>TRUE</_3032><_tTG>TRUE</_tTG><_tEMI>TRUE</_tEMI><_tMeas>TRUE</_tMeas><_tCAT>TRUE</_tCAT><_t1HZ>TRUE</_t1HZ><_t3M>TRUE</_t3M></license></system_information>
</device>
</nsp_system_info_root>
-
Do not forget to dump all mtdX partitions on the external stick with sufficient space.
X in range [0..12] according to output of cat on /proc/mtd:
root@am335x-evm:~# cat /proc/mtd
dev: size erasesize name
mtd0: 00020000 00020000 "SPL"
mtd1: 00020000 00020000 "SPL.backup1"
mtd2: 00020000 00020000 "SPL.backup2"
mtd3: 00020000 00020000 "SPL.backup3"
mtd4: 001e0000 00020000 "U-Boot"
mtd5: 00020000 00020000 "U-Boot Env"
mtd6: 00300000 00020000 "Manufacturedata"
mtd7: 02b00000 00020000 "File System"
mtd8: 00600000 00020000 "kerneldata"
mtd9: 00600000 00020000 "fpgadata"
mtd10: 03200000 00020000 "firmdata0"
mtd11: 03200000 00020000 "firmdata1"
mtd12: 05f80000 00020000 "datafs"
Dump command to use:
nanddump -f /usr/bin/siglent/usr/mass_storage/U-disk0/mtdX /dev/mtdX
Markus
-
Hi
Just working through some instructions I found.
The instructions include a mv command. For non-Linux readers, this is a move (source) (destination) command.
In the instructions I found, the source/destination are reversed. These errors are corrected in post 428.
*Make sure your USB stick is inserted. This command saves a backup to a USB stick.
nanddump -f /usr/bin/siglent/usr/mass_storage/U-disk0/mtd7 /dev/mtd7
* change to the root directory.
cd /
*this command puts the storage into read/write mode.
mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
cd /usr/bin/siglent/firmdata0
* make sure your USB stick is inserted. This copies files and the directory to the USB stick as a backup
cp -r * /usr/bin/siglent/usr/mass_storage/U-disk0/
* the mv command renames files by adding a x to the file name. Note only 3 files.
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml
mv nsp_data_b nsp_data_bx
cd /usr/bin/siglent/usr/backup
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml
mv nsp_data_b nsp_data_bx
cd /
sync
exit
* then switch off/on
If you get an error that looks like this:
can't rename 'NSP_sn_bandwidth.xml': Read-only file system
Just rerun the mount... command.
I decided to back out of this and I didn't get to the last part because I am wondering if there is an alternative way of doing this.
What about writing a small bash script saved in /etc/init.d that resets the timers on the options???
This would run each time the analyser was switched on and set the timer to 48h.
Normally such a script would go in rc.local, but thats not there.
Ideally the script would be rerun every 47hours but crontab is not installed.
This would preserve all of the factory settings. It wouldn't expand the bandwidth though.
Just a thought.
Another idea - make the .xml files readonly and see if you can prevent the OS from counting down the timeouts on the demo options?
-
Another idea - make the .xml files readonly and see if you can prevent the OS from counting down the timeouts on the demo options?
I like that idea.
Dazz
-
Hi
Currently exploring my SSA30xx.
I saved some files of scans in the local:/ folder. Copying these to a USB stick is painful.
Is there a simple way of transferring these by Telnet session or other means?
Where is the local:/ folder?
-
Hi
Currently exploring my SSA30xx.
I saved some files of scans in the local:/ folder. Copying these to a USB stick is painful.
Is there a simple way of transferring these by Telnet session or other means?
Where is the local:/ folder?
Actually its real easy to transfer files from the local drive to USB.
From the File menu browse to the local drive and select File browse mode, then use the Copy key.
Change back to Dir browse mode to select USB stick then select File browse again, then Operate key to get into another menu where you can Paste the Copy'ed file into the USB root or a folder.
Once you've done it a couple of times it becomes pretty straightforward.
-
Hi
I tried that and quickly got frustrated.
I did find that if I have a USB stick in the port, it automatically saves to the USB. That is a better option.
It would still be useful to be able to remotely manage files.
-
Hi
I tried that and quickly got frustrated.
I did find that if I have a USB stick in the port, it automatically saves to the USB. That is a better option.
It would still be useful to be able to remotely manage files.
OK, we will look for a solution for you.
Anybody have a quick one for Dazz ?
-
Just for information of all ;)
Patch works also on SSA3021X 1.2.9.1 (patch applied AFTER firmware upgrade)
if you are interested:
I looked into the xml files before the trial licenses expire. File: NSP_sn_bandwidth.xml For each trial license there is a field: <remain>1040</remain> where the "1040" is the remaining demo time.
I had still 18h of demo and the counter was 1080, then with 17h and 40min of demo the counter was 1060 (if I recall right by heart).
So this seems also another available path.
Cheers to everyone / Hope it helped!!!
:popcorn:
-
Is this applicable to new units bought recently? I might snatch one off Batronix....
-
Is this applicable to new units bought recently? I might snatch one off Batronix....
They are back-ordered for us in the US until August. :(
-
Hi
Currently exploring my SSA30xx.
I saved some files of scans in the local:/ folder. Copying these to a USB stick is painful.
Is there a simple way of transferring these by Telnet session or other means?
Where is the local:/ folder?
Actually its real easy to transfer files from the local drive to USB.
From the File menu browse to the local drive and select File browse mode, then use the Copy key.
Change back to Dir browse mode to select USB stick then select File browse again, then Operate key to get into another menu where you can Paste the Copy'ed file into the USB root or a folder.
Once you've done it a couple of times it becomes pretty straightforward.
I've been doing this today... really painful if you have over 10 files.
I just HOPE Siglent will add a "select all" or something similar option for the move/copy function.
Btw, as I now have the full range of Siglent hardware, I'm very surprised to see that no 2 systems are similar in terms of UI. They must have separate teams that don't talk to each other... and they probably don't do ergonomic testing of their interfaces to see if in the field it is really usable. For example, this "copy file to USB" is just poorly implemented. And another example that really frustrates me is the SDG6022X. Great hardware, poor UI : Having to press up to 8 keys to select a waveform is just not practical, it could have been done much easier:
- Pressing "waveform" button twice to switch from page to page, instead of having to select "waveform" then "page 2".
- Leaving the waveform menubar to the current settings, instead to going back to the main menubar after a waveform selection.
In short: good hardware, UI can be improved. But that is quite common on most electronics companies, for reasons I still don't fully understand !
-
Btw, as I now have the full range of Siglent hardware, I'm very surprised to see that no 2 systems are similar in terms of UI. They must have separate teams that don't talk to each other... and they probably don't do ergonomic testing of their interfaces to see if in the field it is really usable.
Similar problems exist with their SCPI command set. Very different command languages for their products. Even things like the AWG built into the SDS2000X has a different SCPI command set from the SDG2000X.
-
Hi
Currently exploring my SSA30xx.
I saved some files of scans in the local:/ folder. Copying these to a USB stick is painful.
Is there a simple way of transferring these by Telnet session or other means?
Where is the local:/ folder?
Actually its real easy to transfer files from the local drive to USB.
From the File menu browse to the local drive and select File browse mode, then use the Copy key.
Change back to Dir browse mode to select USB stick then select File browse again, then Operate key to get into another menu where you can Paste the Copy'ed file into the USB root or a folder.
Once you've done it a couple of times it becomes pretty straightforward.
I've been doing this today... really painful if you have over 10 files.
I just HOPE Siglent will add a "select all" or something similar option for the move/copy function.
Unfortunately at this time there is no simple solution to this.
We'll ask Siglent to implement UI changes and/or SCPI commands.
Btw, as I now have the full range of Siglent hardware, I'm very surprised to see that no 2 systems are similar in terms of UI. They must have separate teams that don't talk to each other... and they probably don't do ergonomic testing of their interfaces to see if in the field it is really usable. For example, this "copy file to USB" is just poorly implemented. And another example that really frustrates me is the SDG6022X. Great hardware, poor UI : Having to press up to 8 keys to select a waveform is just not practical, it could have been done much easier:
- Pressing "waveform" button twice to switch from page to page, instead of having to select "waveform" then "page 2".
- Leaving the waveform menubar to the current settings, instead to going back to the main menubar after a waveform selection.
In short: good hardware, UI can be improved. But that is quite common on most electronics companies, for reasons I still don't fully understand !
Thanks, good feedback. :-+
Really this should be in the SSA main thread not the one about hacks.
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/)
-
Hi,
I’m recently bought a SSA3021X-TG (for free actually) for personnal and professionnal use.
But after using TG intensely, it does not work at all.
I looking for this problem and see the TG was in demo mode.
But there’s not any serial number in the package for the TG.
I was send multiple emails to Siglent via the web form without any response !!! It’s a mistake !
I’ve found the hack of the device and applying with success.*
My device is :
SW1 1.2.9.1
FW 07.03
I’ve corrected the procedure :
Part 1 - Backup files
1. Insert USB stick
2. Go in System => System info
3. Establish a telnet session with root/ding1234
4. "cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup"
5. "cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0"
6. "sync"
7. "cd /usr/bin/siglent/usr/backup" and "ls –l" (do a screen pic with a phone)
8. "cd /usr/bin/siglent/firmdata0" and "ls –l" (do a screen pic with a phone)
9. "logout"
Part 2 - Hack the device
1. Go in System => System info
2. Establish a telnet session with root/ding1234
3. "mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0"
4. "cd /usr/bin/siglent/firmdata0"
5. "mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml"
6. "mv NSP_trends_config_info.xml NSP_trends_config_infox.xml"
7. "mv nsp_data_b nsp_data_bx"
8. "cd /usr/bin/siglent/usr/backup"
9. "mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml"
10. "mv NSP_trends_config_info.xml NSP_trends_config_infox.xml"
11. "mv nsp_data_b nsp_data_bx"
12. "sync"
13. "logout"
14. Soft power cycle (power off and power on with button "power")
15. Go in System => Pwr On/Preset => Reset & Clear => Enter
16. Soft power cycle (power off and power on with button "power")
My device works now with TG.
I’m really sad to use this kind of method in order to work… I had to hack my own Adobe licenses to use them properly.
Anybody know how to disable 3MHz RBW ?
-
Hi,
I’m recently bought a SSA3021X-TG (for free actually) for personnal and professionnal use.
But after using TG intensely, it does not work at all.
You don't say how old the SA was before it was given to you.
Siglent probably expect you to buy a TG license.
I’ve corrected the procedure :
What did you correct??
Anybody know how to disable 3MHz RBW ?
Select another range of RBW. There is no point in crippling your SA.
-
Hi,
I’m recently bought a SSA3021X-TG (for free actually) for personnal and professionnal use.
But after using TG intensely, it does not work at all.
You don't say how old the SA was before it was given to you.
Siglent probably expect you to buy a TG license.
It will have been old stock as they now come with the TG option for $0.
Dazz, for your one TG was included free.
-
You don't say how old the SA was before it was given to you.
Siglent probably expect you to buy a TG license.
The SSA3021X was delivered 10 days ago (and ordered 2 weeks ago with marked "FREE TG LICENSE").
What did you correct??
I've added "reset & clear" and an additionnal power cycle.
Without doing these 2 interactions, the device does not work properly.
Anybody know how to disable 3MHz RBW ?
Select another range of RBW. There is no point in crippling your SA.
In Auto mode, the 3MHz RBW is automatically selected (you always think about it...), I prefer max 1MHz RBW (like before the hack - but I always waiting for any Siglent answer to unhack the SSA...).
-
In Auto mode, the 3MHz RBW is automatically selected (you always think about it...), I prefer max 1MHz RBW (like before the hack - but I always waiting for any Siglent answer to unhack the SSA...).
So that all understand:
The hack that is advertised here activates the PRO_MODE in the SSA. The PRO_MODE overrides all the licensing that the equipment has and activates all its features.
It's not possible to have PRO_MODE active and some features disabled!
If you don't want 3MHz, undo the hack. It's as simple as that!
I’m recently bought a SSA3021X-TG (for free actually) for personnal and professionnal use.
But after using TG intensely, it does not work at all.
I looking for this problem and see the TG was in demo mode.
But there’s not any serial number in the package for the TG.
Go to the old file NSP_sn_bandwidth.xml and see what TG licenses you have there.
Do you have any _TG or _tTG ?
If you have only a _tTG then you never had a permanent license, and you only have an expired temporary license.
-
You don't say how old the SA was before it was given to you.
Siglent probably expect you to buy a TG license.
The SSA3021X was delivered 10 days ago (and ordered 2 weeks ago with marked "FREE TG LICENSE").
If seller did not already give "authorized" code you need contact this Siglent seller/distributor where did you buy it!
If still not, then contact Siglent for get it.
After then you get TG Licence here (http://service.siglenteu.com/easyweb/), this is automatic system for get licence codes for options. Only now is suprice that seller did not deliver this authorization code to you. This is seller error!:
For automatic licence key generation using authorization code and SSA serial number:
http://service.siglenteu.com/easyweb/ (http://service.siglenteu.com/easyweb/)
If this all fails you sure get license code also from Siglent. You need your serial number and copy from purchase receipt. Are you sure seller did not include authorization code for get license, example printed in receipt or package list etc.
There in activation side you can also get instructions sheet (pdf) and there you find contacts: I think it is best you use Headquarter contact emal.
Just write subject: SSA3000X missing TG option license code
And then tell your serial number and tell that you did not get license for TG as Siglent offer is.
So there is hope that it go to right people for hadle it.
-
I just upgraded my new out of the box unit to the latest FW, and noticed that the Spectrum Monitor is not available in the 3021X.
Can it be enabled through the hack or it is impossible to have it in this model? I assumed the hardware was the same between the two.
Where can I find the exact post with the latest confirmed procedure to do the hack?
EDIT: Unlocked the rig. This forum is awesome :)
Any caveat emptors?
-
Hi,
I haven't got any licence paper... but 1560€ (incl VAT) from Siglent...
After sending new messages to Siglent, I still have no answer.
Where is the support? It does not seem to exist at Siglent! It's not professional.
That's enough ! I'm giving up. I will continue to use the hacked version.
Edit:
I've just received my TG licence after sending a complaint to the intermediary expeditor (this takes 4 hours !!!).
Thanks for all.
-
I just upgraded my new out of the box unit to the latest FW, and noticed that the Spectrum Monitor is not available in the 3021X.
Can it be enabled through the hack or it is impossible to have it in this model? I assumed the hardware was the same between the two.
Where can I find the exact post with the latest confirmed procedure to do the hack?
EDIT: Unlocked the rig. This forum is awesome :)
Any caveat emptors?
did you use the gonzo_the_great script in post #428?
-
Successfully modded on FW 1.2.9.1 with no issues. Follow post # 428 (or # 460 which is the same...)
However, there are a couple of things which I hope this is the right thread to discuss it
How does your 1Hz/3Hz RBW look like? I mean how do they behave?
Look at the attached photos I got for 100MHz CF and Span of 1KHz.
Clearly these RBWs are just digital filters (not actual bandpass filters like those old agilent SA which didn't go below 1KHz or so)
So it seems 1Hz and 3Hz RWB are just "heavy" averaging methods. But the noise floor is just a flat line. Is this the right behavior?
Also note that the flat noise floor is a couple of dB HIGHER for 1Hz RBW than 3Hz?!
Can someone confirm this? I have tried other center frequencies and it is the same
of course your span should be very small otherwise it will not accept 1Hz or 3Hz (sweep time will be out of range)
another issue is a small bug I guess, at power up, at the bottom line it shows center frequency (left) and stop frequency (right)! instead of showing the span (I use a USER defined power up state with CF and span)
can someone also try this?
thanks
EDIT: If I choose "Last" state as the power up state, again after turn on it shows center frequency and stop frequency rather than span. I think it should be fixed in the next firmware
EDIT: dug around a bit more and found the answer (kind of) in other threads. according to Siglent this is normal. you need to have input signal at those RBWs and then you will see the correct (somewhat) behavior. But the small bug (showing CF and stop freq together) remains
-
I have posted this observation few months ago in the Siglent support
thread in this forum.
No one seems to care about this realy.
Markus
-
Received today my SSA3021X and it has the SW1 version 1.2.8.5a with HW version 07.03.00.
By going thru the topic it seems it can be upgraded without too much of a hassle.
But that is for the IT expert of course....
Would there be any of those experts willing to remotely assist with this upgrade?
Tnx!
Michael
-
I can crash my SSA3021x when entering e.g. "868"+"Enter" immediately after it has booted. ::)
After that it does not resond to any key anymore and the display stops updating.
The only way to get it working again is to powercycle it.
Is that bug a result of hacking it or is this "normal"?
SA is running 1.2.8.5a FW version.
-
I can crash my SSA3021x when entering e.g. "868"+"Enter" immediately after it has booted. ::)
After that it does not resond to any key anymore and the display stops updating.
The only way to get it working again is to powercycle it.
Is that bug a result of hacking it or is this "normal"?
SA is running 1.2.8.5a FW version.
Please see this thread for remedy:
https://www.eevblog.com/forum/testgear/siglent-ssa3021x-user-interface-bug/ (https://www.eevblog.com/forum/testgear/siglent-ssa3021x-user-interface-bug/)
-
I managed to do the SW upgrade to 1.2.9.1 without problems.
Furthermore I tried to get the hack done following #428 and #541.
The result is that the SA is still showing the original version with only the (already free) TG active.
When looking at the folders I see:
SA backup
nsp_data_b
NSP_sn_bandwidth.xml
nsp_data_bx
NSP_sn_bandwidthx.xml
NSP_trends_config_infox.xml
SA-firmdata0
nsp_data_b
NSP_sn_bandwidth.xml
nsp_data_bx
NSP_sn_bandwidthx.xml
NSP_trends_config_infox.xml
I assume because the original files without the "x", the hack didn't take place yet.
How can I remove the original files in both folders.
nsp_data_b
NSP_sn_bandwidth.xml
Thanks for advice!
-
My Telnet adventure worked out well in the end....phew :o
I managed to remove the files without the "x" on the end by means of the rm command.
After reboot the SA came back with all options permanently active.
-
I am wondering if i should change the root password of the device? After all it is a public know password.
Of course my LA is not accessible from the I-Net (protected by firewall) and it is not an interesting target for a hack (as most of the time off).
But you never know. Has anybody tried changing the root-password already? Using the passwd command?
P.S:
I got my unit yesterday and flashing latest FW and applying the hack was straight forward - thank you!
-
My Telnet adventure worked out well in the end....phew :o
I managed to remove the files without the "x" on the end by means of the rm command.
After reboot the SA came back with all options permanently active.
|O
-
But you never know. Has anybody tried changing the root-password already? Using the passwd command?
You'll be able to change it for that session BUT, once you reboot, you'll get the original as the CRAMFS is RO. (If I remember correctly.)
-
Folks,
I have a SSA3021x w/ v1.2.8.5a firmware (HW 7.03). It's already modified. If I want to upgrade to 1.2.9.1, do I need to reverse the modification process before applying the upgrade? Or can I just update the firmware with the patch already in place. I've read the the last two pages of posts but it's not entirely clear.
-
Folks,
I have a SSA3021x w/ v1.2.8.5a firmware (HW 7.03). It's already modified. If I want to upgrade to 1.2.9.1, do I need to reverse the modification process before applying the upgrade? Or can I just update the firmware with the patch already in place. I've read the the last two pages of posts but it's not entirely clear.
It is, just one page further back in reply #490.
-
Hi,
I have a SSA3021X which I upgraded to 1.2.9.1 and then modified to get all options. I did this in beginning of July and it worked very well (with all options enabled) until today. Now when I switch it on, both TG and Mode key are lit, then it shows the Siglent Logo, then after some seconds TG and MODE are switched off and ... that's it, i.e. Siglent Logo stays on screen, no measurement screen occurs.
Of course I did try to login via network, however the device does not request an IP from my DHCP. So it is NOT reachable via network too.
Any suggestions on what to try ? Are there any undocumented key combinations which allow to reset, get a console, or something ?
Please help, I'm stuck. The device seems to be bricked...
Thanks
Chris
-
You can connect the serial port (console) and investigate the boot process.
From your description it could be a NAND-memory error. I had similar symptoms on my analyser after a firmware update.
A restore/flash of a NAND partition would be possible.
- Harald.
-
Now you need to navigate on page 9 and try the same steps
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1106559/#msg1106559 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1106559/#msg1106559)
I did rebuild once my SDG2000X using sdcard repair...
-
Hello all,
Thanks for your help in advance.
I just bought a SSA3021X, the software is 1.2.8.5a. When i telnet, it say connection refused.
Does any one have the same problem and how can i login the machine?
Thanks
-
Hello all,
Thanks for your help in advance.
I just bought a SSA3021X, the software is 1.2.8.5a. When i telnet, it say connection refused.
Does any one have the same problem and how can i login the machine?
Thanks
Read.
First this:
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1480492/#msg1480492 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1480492/#msg1480492)
and there follow msg links and read more, all what you find.
There is not free lounges. It need work. It is, as usually, first brain (read, study, try understand), then muscle (connect to machine and make what needed). If you just start "try this and that and test if you have just good luck" only you get is big hassle or even "bricked" SSA..
-
Hi, thank you very much.
By some reason, my putty put the port of 22. Now all working fine
-
Hi,
Sorry for my newbie question, but it's the first time I connect a device to pc through the Ethernet port.
I have an SSA3021X with the following config:
SW1: 1.2.8.5a
SW2: 20170512-1
SW3: 000000D1
HW : 07.03.00
Unfortunately it doesn't seem to connect to my laptop (I have Win10).
The procedure I followed:
connected the SSA ethernet port directly to my laptop Ethernet port through the cable,
the SSA static IP address is 10.11.13.220
Submask: 255.255.0.0 (same as my laptop ethernet card)
Control panel shows "unidentified network",
If I try to ping 10.11.13.220 from CMD I get:
connection timed out,
4 packets sent, 4 packets lost (100% lost)
same thing with PuTTY.
On the rear of the instrument both LEDs are lit (green and orange)
What am I doing wrong? ???
thnx
-
Hi,
Sorry for my newbie question, but it's the first time I connect a device to pc through the Ethernet port.
I have an SSA3021X with the following config:
SW1: 1.2.8.5a
SW2: 20170512-1
SW3: 000000D1
HW : 07.03.00
What am I doing wrong? ???
thnx
Welcome to the forum.
I strongly suggest that you get your firmware up to date to the current version: V1.2.9.2a
All the later FW versions are here:
https://www.siglenteu.com/service-and-support/firmware-software/spectrum-analyzers/#ssa3000x-series (https://www.siglenteu.com/service-and-support/firmware-software/spectrum-analyzers/#ssa3000x-series)
Each version comes with a changelog file and installation instructions.
Hopefully that will fix any connectivity issues you have.
BTW, this is the main thread for these spectrum analyzers:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/)
-
The procedure I followed:
connected the SSA ethernet port directly to my laptop Ethernet port through the cable,
the SSA static IP address is 10.11.13.220
Submask: 255.255.0.0 (same as my laptop ethernet card)
Connecting the PC directly to the DSO through ether requires a crossover cable. Are you using one?
-
The procedure I followed:
connected the SSA ethernet port directly to my laptop Ethernet port through the cable,
the SSA static IP address is 10.11.13.220
Submask: 255.255.0.0 (same as my laptop ethernet card)
Connecting the PC directly to the DSO through ether requires a crossover cable. Are you using one?
I have never seen this level modern laptop what accept win10 and still need crossover cable. Mostly today these have AutoCrossOver. AutoCrossOver have been available 20 years and today most machines have it.
But yes of course all is possible.
Your subnet mask... do you really need network for up to 65534 IP's when your whole network is one PC and one SSA.
I think class C network is well enough for 2 machines private "network". (direct cable between laptop and SSA)
Subnet mask 255.255.255.0 (this accept one octet of addresses for hosts because last 8 bits in mask are zero)
And it is private network so is it quite common to use example 192.168.0.x
and x between 1 - 254 (address 0 and 255 do not use)
In some cases also firewall may have role with problems.
http://www.subnet-calculator.com/ (http://www.subnet-calculator.com/)
If your laptop really do not have AutoCrossOver LAN then you need cross over cable. If it have AutoCrossOver then both cables can use.
-
My crossover suggestion was based on the " both LEDs are lit (green and orange)". I assumed solid lit.
-
My crossover suggestion was based on the " both LEDs are lit (green and orange)". I assumed solid lit.
There is so many kind of lights.. example my PC redorange is constant and yelloworange is blinking when trafic and SSA green continuously and yelloworange blinking when trafic. There is not tight standards for these lights. In some cases led color also tell speed... 10/100 or 1000
But how ever I will recommend class C network in this case.
Class C IP addresses range from 192.0.0.x to 223.255.255.x.
Default subnet mask for Class C is 255.255.255.x
@pri:
One example:
Download puttytel.exe (select right version for you) here https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html (https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html)
It do not need any kind of installation, just run
But first:
This is only for direct connection so that PC LAN port --- cable --- SSA LAN port
Set your PC LAN and SSA as in images and run puttytel.exe and enter address as in image and open it and you see puttytel console as in image. If not then your LAN do not work. Check that your PC do not restrict this communication or if your cable is ok. Sidenote, in this case this default gateway is just dummy... but some systems are happy if there is something and also in some other cases subnet IP address range bottom is nice to use for this.
Images do not need explanation and perhaps if these are clear for you still they may help some other peoples.
(of course there can use more common 192.168..etc what are many equipments "default" but example my system have some other things also so 222 sure do not make collision...
Just like 1, 2, 3, 4,.... and then enter what need...
(you can set puttytel (telnet client) so that it do not forget every time all and also good practice is set it so that it keep log about all what have done with console so that if something goes wrong you can inspect log.... or show log to some other people if need some help)
-
Hi,
Sorry for my newbie question, but it's the first time I connect a device to pc through the Ethernet port.
I have an SSA3021X with the following config:
SW1: 1.2.8.5a
SW2: 20170512-1
SW3: 000000D1
HW : 07.03.00
What am I doing wrong? ???
thnx
Welcome to the forum.
I strongly suggest that you get your firmware up to date to the current version: V1.2.9.2a
All the later FW versions are here:
https://www.siglenteu.com/service-and-support/firmware-software/spectrum-analyzers/#ssa3000x-series (https://www.siglenteu.com/service-and-support/firmware-software/spectrum-analyzers/#ssa3000x-series)
Each version comes with a changelog file and installation instructions.
Hopefully that will fix any connectivity issues you have.
BTW, this is the main thread for these spectrum analyzers:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/)
Thanks, it was easy to upgrade to the latest version.
My crossover suggestion was based on the " both LEDs are lit (green and orange)". I assumed solid lit.
There is so many kind of lights.. example my PC redorange is constant and yelloworange is blinking when trafic and SSA green continuously and yelloworange blinking when trafic. There is not tight standards for these lights. In some cases led color also tell speed... 10/100 or 1000
But how ever I will recommend class C network in this case.
Class C IP addresses range from 192.0.0.x to 223.255.255.x.
Default subnet mask for Class C is 255.255.255.x
@pri:
One example:
Download puttytel.exe (select right version for you) here https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html (https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html)
It do not need any kind of installation, just run
But first:
This is only for direct connection so that PC LAN port --- cable --- SSA LAN port
Set your PC LAN and SSA as in images and run puttytel.exe and enter address as in image and open it and you see puttytel console as in image. If not then your LAN do not work. Check that your PC do not restrict this communication or if your cable is ok. Sidenote, in this case this default gateway is just dummy... but some systems are happy if there is something and also in some other cases subnet IP address range bottom is nice to use for this.
Images do not need explanation and perhaps if these are clear for you still they may help some other peoples.
(of course there can use more common 192.168..etc what are many equipments "default" but example my system have some other things also so 222 sure do not make collision...
Just like 1, 2, 3, 4,.... and then enter what need...
(you can set puttytel (telnet client) so that it do not forget every time all and also good practice is set it so that it keep log about all what have done with console so that if something goes wrong you can inspect log.... or show log to some other people if need some help)
rf-loop NUMBER ONE!!!
kudos to you!!
It worked as you suggested!
Is this message still valid to upgrade vers. HW 7.03 ?
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998366/#msg998366 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998366/#msg998366)
Any hint?
Thanks! :-+
-
Is this message still valid to upgrade vers. HW 7.03 ?
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998366/#msg998366 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998366/#msg998366)
Any hint?
Be careful!
You have HW 7.03 but that msg refers to FW 7.07. You now have what we could call FW 9.02a. Study the rest of the thread.
-
Hi,
Sorry for my newbie question, but it's the first time I connect a device to pc through the Ethernet port.
I have an SSA3021X with the following config:
SW1: 1.2.8.5a
SW2: 20170512-1
SW3: 000000D1
HW : 07.03.00
What am I doing wrong? ???
thnx
Welcome to the forum.
I strongly suggest that you get your firmware up to date to the current version: V1.2.9.2a
All the later FW versions are here:
https://www.siglenteu.com/service-and-support/firmware-software/spectrum-analyzers/#ssa3000x-series (https://www.siglenteu.com/service-and-support/firmware-software/spectrum-analyzers/#ssa3000x-series)
Each version comes with a changelog file and installation instructions.
Hopefully that will fix any connectivity issues you have.
BTW, this is the main thread for these spectrum analyzers:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/)
Thanks, it was easy to upgrade to the latest version.
My crossover suggestion was based on the " both LEDs are lit (green and orange)". I assumed solid lit.
There is so many kind of lights.. example my PC redorange is constant and yelloworange is blinking when trafic and SSA green continuously and yelloworange blinking when trafic. There is not tight standards for these lights. In some cases led color also tell speed... 10/100 or 1000
But how ever I will recommend class C network in this case.
Class C IP addresses range from 192.0.0.x to 223.255.255.x.
Default subnet mask for Class C is 255.255.255.x
@pri:
One example:
Download puttytel.exe (select right version for you) here https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html (https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html)
It do not need any kind of installation, just run
But first:
This is only for direct connection so that PC LAN port --- cable --- SSA LAN port
Set your PC LAN and SSA as in images and run puttytel.exe and enter address as in image and open it and you see puttytel console as in image. If not then your LAN do not work. Check that your PC do not restrict this communication or if your cable is ok. Sidenote, in this case this default gateway is just dummy... but some systems are happy if there is something and also in some other cases subnet IP address range bottom is nice to use for this.
Images do not need explanation and perhaps if these are clear for you still they may help some other peoples.
(of course there can use more common 192.168..etc what are many equipments "default" but example my system have some other things also so 222 sure do not make collision...
Just like 1, 2, 3, 4,.... and then enter what need...
(you can set puttytel (telnet client) so that it do not forget every time all and also good practice is set it so that it keep log about all what have done with console so that if something goes wrong you can inspect log.... or show log to some other people if need some help)
rf-loop NUMBER ONE!!!
kudos to you!!
It worked as you suggested!
Is this message still valid to upgrade vers. HW 7.03 ?
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998366/#msg998366 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998366/#msg998366)
Any hint?
Thanks! :-+
This info is old! ETA: (now I can see also @tv84 msg ;) )
You have lot of more new FW. Use more fresh info.
Example this https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1132969/#msg1132969 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1132969/#msg1132969) look "attached instructions"
But also after then later in thread you may find some bit more fresh info. (but still you can use this V05 as some kind of basic info.
Your SSA is much more new and there have not been installed older very different FW so there is perhaps not all files what are displayed in instrictions V05. They are perhaps some residues from older generation FW.
But, this instruction v05 is overall roughly ok if you can detect what tiny differences there is (some obsolete files what are not there anymore when you look using ls command in your SSA. One reason is that today all new SSA's have never updated from very old totally obsolete "generation 7 FW". All are generation 8 FW or later. (also older SSA's are mostly HW version 07.03.00 and this 7 have nothing to do with this) So if there is some files what your system do not have, then just do not care these files. Soon you find what is idea...
For commands, copypaste is your friend...
-
Hi all,
I have got my new SSA3021X. Unfortunately it's a new firmware that has not been referenced anywhere before in hacking threads.
SW1: 1.2.9.a
SW2: 20180708-1
SW3: 000000E1
HW: 0C.03.00
It has a different from previous versions file set:
-rw-r--r-- 1 root root 425 Dec 13 21:53 NSP_sn_bandwidth.xml
-rw-rw-rw- 1 1000 1000 606 Aug 9 06:17 NSP_trends_config_info.xml
drwxrwxrwx 2 1000 1000 4392 Oct 17 15:07 calib
-rw-r--r-- 1 root root 480 Dec 13 21:53 nsp_data_b
Contents of NSP_sn_bandwidth.xml:
<?xml version="1.0" encoding="UTF-8"?>
<sn_bw_root>
<serial_number>
<chip>SSA3XLBD2R1093</chip>
</serial_number>
<license><_3021><lic>qp3jq3tm8hmyv4p2</lic></_3021><_TG><lic>zvj63iatp4enm6pn</lic></_TG><_tEMI><lic>gymq7rs258awp984</lic><remain>2810</remain></_tEMI><_tMeas><lic>st6ef9vw9q34pv6p</lic><r
emain>2810</remain></_tMeas><_tCAT><lic>cm2b22hhmi7kpui7</lic><remain>2810</remain></_tCAT></license></sn_bw_root>
contents of NSP_trends_config_info.xml:
<?xml version="1.0" encoding="UTF-8"?>
<nsp_trends_info_root>
<device>
<language>english</language>
<pid>0x1300</pid>
<vid>0xf4ec</vid>
<product_type_1>SSA3032X</product_type_1>
<product_type_2>SSA3030X</product_type_2>
<product_type_3>SSA3021X</product_type_3>
<product_type_4>SSA3018X</product_type_4>
<product_type_5>SSA3015X</product_type_5>
<product_type_6>SSA3010X</product_type_6>
<manufacturer>Siglent</manufacturer>
<Support_Touch_Flag>0</Support_Touch_Flag>
<Support_VXI11_Flag>1</Support_VXI11_Flag>
<file_prefix>SSA_</file_prefix>
</device>
</nsp_trends_info_root>
Does anyone have experience with this version? Can I mock around with these files and avoid bricking the device?
I have found one suggestion referencing file NSP_sn_bandwidth.xml: http://www.sonsivri.to/forum/index.php?PHPSESSID=k4bq3evsktigvsbiljac9r6ni2&topic=58738.msg189056#msg189056 (http://www.sonsivri.to/forum/index.php?PHPSESSID=k4bq3evsktigvsbiljac9r6ni2&topic=58738.msg189056#msg189056)
Basically it says to rename the files.
-
Sorry for the noise in the old thread, I can confirm that hack renaming files works on FW 1.2.9.a
-
I just ordered a 3021X and I am wading waist deep through this thread while waiting for it to arrive :scared:
I see a reference in the previous post to renaming the files for FW 1.2.9a and it works. Can someone point me to that post as I have not seen it yet and has it worked for other people?
Also is the serial number issue been fixed or does it still disappear?
Thanks for any help.
-
I finally got around to "upgrading" my SSA3021X today. FW version 1.2.9.2a. Everything went well.
I then attached an antenna to the RF input, plugged in my headphones, hit the "Demod" button, and used my very expensive FM radio to listen to the NPR newscast (US national public radio). 8)
-
This info is old! ETA: (now I can see also @tv84 msg ;) )
You have lot of more new FW. Use more fresh info.
Example this https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1132969/#msg1132969 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1132969/#msg1132969) look "attached instructions"
But also after then later in thread you may find some bit more fresh info. (but still you can use this V05 as some kind of basic info.
Your SSA is much more new and there have not been installed older very different FW so there is perhaps not all files what are displayed in instrictions V05. They are perhaps some residues from older generation FW.
But, this instruction v05 is overall roughly ok if you can detect what tiny differences there is (some obsolete files what are not there anymore when you look using ls command in your SSA. One reason is that today all new SSA's have never updated from very old totally obsolete "generation 7 FW". All are generation 8 FW or later. (also older SSA's are mostly HW version 07.03.00 and this 7 have nothing to do with this) So if there is some files what your system do not have, then just do not care these files. Soon you find what is idea...
For commands, copypaste is your friend...
Finally I could do the hack following V05.
Now it's a 3.2GHz unit, no serial, options ALL permanent.
No 1Hz RBW though, my limit is still 10Hz.
Was anyone able to add the 1Hz on the new 1.2.9.2a firmware?
-
Was anyone able to add the 1Hz on the new 1.2.9.2a firmware?
I am on 1.2.9.1 and don't get a valid measurement at 1Hz RBW either.
-
Was anyone able to add the 1Hz on the new 1.2.9.2a firmware?
I am on 1.2.9.1 and don't get a valid measurement at 1Hz RBW either.
I am also on 1.2.9.1 but at 1Hz RBW the unit is very very slow and the noise floor becomes a flat line
and the measurement is not reliable either. Even before the hack when it did have the official promotional licence for a while (before it expired)
the 1Hz RBW was the same, useless. Even the 3Hz is not working properly. Basically I can only use >=10Hz so you are not missing anything!
-
Was anyone able to add the 1Hz on the new 1.2.9.2a firmware?
I am on 1.2.9.1 and don't get a valid measurement at 1Hz RBW either.
I am also on 1.2.9.1 but at 1Hz RBW the unit is very very slow and the noise floor becomes a flat line
and the measurement is not reliable either. Even before the hack when it did have the official promotional licence for a while (before it expired)
the 1Hz RBW was the same, useless. Even the 3Hz is not working properly. Basically I can only use >=10Hz so you are not missing anything!
Slow, yes it is. Here can find math.
https://www.siglenteu.com/application-note/spectrum-analyzer-basics-bandwidth/ (https://www.siglenteu.com/application-note/spectrum-analyzer-basics-bandwidth/)
Also if it helps there is available HP/Agilent/Keysight AN-150 for further readings.
http://literature.cdn.keysight.com/litweb/pdf/5952-0292.pdf (http://literature.cdn.keysight.com/litweb/pdf/5952-0292.pdf)
It is true that specially 1Hz RBW in Siglent this model have some limits and these are not specified. Originally there was not at all 1Hz and 3Hz RBW. Some time later they give these free to all users for use. But there is some things based to hardware. (Imho, there are not enough "bits" in ADC and perhaps ADC autoranging have some limiting factors in HW??. I suspect it have something to do with this. So, it can not "pull up" if there is not enough signal level. Some tiny possible indirect tip in Keysight AN-150 page 38 figure 3-3 )
Is it useless... no it is not. But user need understand some limits.
Here tiny examples SSA3021X (mod32X). Yes and FW is 1.2.9.2a
Who can say it is useless when look these images. Carrier 118.7MHz, -30dBm, AM mod with 20Hz sine and modulation depth 2% (LSB and USB -40dBc)
1Hz RBW and for compare same with 10Hz RBW
(span 600Hz (2x minimum block, it is hopping 300Hz blocks in this case))
(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=609589;image)
RBW10Hz
(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=609595;image)
RBW 1Hz
Useless, really?
-
Was anyone able to add the 1Hz on the new 1.2.9.2a firmware?
I am on 1.2.9.1 and don't get a valid measurement at 1Hz RBW either.
I am also on 1.2.9.1 but at 1Hz RBW the unit is very very slow and the noise floor becomes a flat line
and the measurement is not reliable either. Even before the hack when it did have the official promotional licence for a while (before it expired)
the 1Hz RBW was the same, useless. Even the 3Hz is not working properly. Basically I can only use >=10Hz so you are not missing anything!
Slow, yes it is. Here can find math.
https://www.siglenteu.com/application-note/spectrum-analyzer-basics-bandwidth/ (https://www.siglenteu.com/application-note/spectrum-analyzer-basics-bandwidth/)
Also if it helps there is available HP/Agilent/Keysight AN-150 for further readings.
http://literature.cdn.keysight.com/litweb/pdf/5952-0292.pdf (http://literature.cdn.keysight.com/litweb/pdf/5952-0292.pdf)
It is true that specially 1Hz RBW in Siglent this model have some limits and these are not specified. Originally there was not at all 1Hz and 3Hz RBW. Some time later they give these free to all users for use. But there is some things based to hardware. (Imho, there are not enough "bits" in ADC and perhaps ADC autoranging have some limiting factors in HW??. I suspect it have something to do with this. So, it can not "pull up" if there is not enough signal level. Some tiny possible indirect tip in Keysight AN-150 page 38 figure 3-3 )
Is it useless... no it is not. But user need understand some limits.
Here tiny examples SSA3021X (mod32X). Yes and FW is 1.2.9.2a
Who can say it is useless when look these images. Carrier 118.7MHz, -30dBm, AM mod with 20Hz sine and modulation depth 2% (LSB and USB -40dBc)
1Hz RBW and for compare same with 10Hz RBW
(span 600Hz (2x minimum block, it is hopping 300Hz blocks in this case))
(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=609589;image)
RBW10Hz
(https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/?action=dlattach;attach=609595;image)
RBW 1Hz
Useless, really?
very nice example. I just replicated it with my Anritsu MG3633A. The Siglent really struggles but it comes through :-+
-
Today I tried to upgrade the firmware of my SSA3021X to the newest version V1.2.9.2a.
After automatically rebooting there happens nothing, only the Siglent logo on the screen and the TG and Mode buttons are lighted.
I waited for about a hour but nothing happens. Probably the install went wrong?
Is there a way to restore?
-
Try the upgrade process again. I had the same issue. I powered off my scope, re-created my USB stick, and inserted it prior to powering up the scope. I then powered up the scope and it upgraded successfully the second time.
-
Try the upgrade process again. I had the same issue. I powered off my scope, re-created my USB stick, and inserted it prior to powering up the scope. I then powered up the scope and it upgraded successfully the second time.
I tried but still nothing happens.
Also no possibility to connect via LAN
-
Same thing happened to me.
Reflashing the root file system solved the issue. NAND flash is the problem.
To get rid of possible future problems I unsoldered the NAND chip, burnt a fresh one and soldered it back in. I experienced no problems in subsequent firmware updates.
-
Same thing happened to me.
Reflashing the root file system solved the issue. NAND flash is the problem.
To get rid of possible future problems I unsoldered the NAND chip, burnt a fresh one and soldered it back in. I experienced no problems in subsequent firmware updates.
Unfortunately no way to reflash, no connection possible.
According my supplier warranty, so I shipped it to them and will wait.
-
Serial connection always works, and reflash in U-Boot.
Before doing all the things I mentioned before, also sent my device in for service under warranty. Jerks in Eindhoven accused me of having hacked my analyzer which, at the time, I had not done. They revoked my warranty. That's when I could blissfully remove the sticker and fire up the hot-air station and soldering iron.
-
Just got my SSA3021X and Wow am I happy with it :-+
Best bang for the buck piece of test equipment I have ever bought.
Unfortunately I also seem to have a hardware revision and the latest software.
SW1: 1.2.9.a
SW2: 20180708-1
SW3: 000000E1
HW: 0C.03.00
So I am not sure any of these previous hacks will work. If anybody tries it on the HW version please let me know.
Thanks
-
Unit just been hacked by renaming only "NSP_sn_bandwidth.xml" files located inside of "firmdata0" and "backup" folders.
:) 3,2GHz and all options are enabled forever.
SW1: 1.2.9.a
SW2: 20180708-1
SW3: 000000E1
HW: 0C.03.00
-
Unit just been hacked by renaming only "NSP_sn_bandwidth.xml" files located inside of "firmdata0" and "backup" folders.
:) 3,2GHz and all options are enabled forever.
SW1: 1.2.9.a
SW2: 20180708-1
SW3: 000000E1
HW: 0C.03.00
Interesting, has anyone else done it this way?
-
Unit just been hacked by renaming only "NSP_sn_bandwidth.xml" files located inside of "firmdata0" and "backup" folders.
:) 3,2GHz and all options are enabled forever.
SW1: 1.2.9.a
SW2: 20180708-1
SW3: 000000E1
HW: 0C.03.00
Interesting, has anyone else done it this way?
Yes, i can confirm that. Few days ago other ham radio from EA7 succeed to hack same SSA version using above procedure.
EA7 feedback: "Already done it. Have all options with valid permanent, spans to 3.2 GHz, and RWB shows on narrow spans minimum 1 Hz, super!"
Please contact me if you have any doubt. Robert, yo4hfu
-
Unit just been hacked by renaming only "NSP_sn_bandwidth.xml" files located inside of "firmdata0" and "backup" folders.
:) 3,2GHz and all options are enabled forever.
SW1: 1.2.9.a
SW2: 20180708-1
SW3: 000000E1
HW: 0C.03.00
Interesting, has anyone else done it this way?
Yes, i can confirm that. Few days ago other ham radio from EA7 succeed to hack same SSA version using above procedure.
EA7 feedback: "Already done it. Have all options with valid permanent, spans to 3.2 GHz, and RWB shows on narrow spans minimum 1 Hz, super!"
Please contact me if you have any doubt. Robert, yo4hfu
Hey Robert I sent you an email to your Yahoo account. Thanks for getting back to me with that information.
-
Good luck! Ask if you have something unclear.
This is my procedure (Microsoft Word .docx file). Nothing new inside, all instructions are according Eevblog forum. It is not my contribution.
73 de Robert
LE 24.01.2019
READ V05 TXT FILE BEFORE ANY HACKING ATTEMPT! Use my docx file only if you are very familiar with linux language.
-
Today I tried to upgrade the firmware of my SSA3021X to the newest version V1.2.9.2a.
After automatically rebooting there happens nothing, only the Siglent logo on the screen and the TG and Mode buttons are lighted.
I waited for about a hour but nothing happens. Probably the install went wrong?
Is there a way to restore?
The exact thing happened when I tried to upgrade a couple of months ago. Fortunately my unit is under warranty and Siglent America reflashed it.
-
Good luck! Ask if you have something unclear.
This is my procedure (Microsoft Word .docx file). Nothing new inside, all instructions are according Eevblog forum. It is not my contribution.
73 de Robert
Robert Thanks so much for the great document. It explains it in a way that makes it very easy.
I emailed you because I think that there is one problem. It does not seem to remove the NSP_np_Bandwidth.xml file. It just makes a copy with the x added to the end of the name and I end up with the two files in the directory. This means that nothing changes, the unit operates as it did before the attempt. The backup folder just has only the X copy in it.
73s
-
Good luck! Ask if you have something unclear.
This is my procedure (Microsoft Word .docx file). Nothing new inside, all instructions are according Eevblog forum. It is not my contribution.
73 de Robert
Robert Thanks so much for the great document. It explains it in a way that makes it very easy.
I emailed you because I think that there is one problem. It does not seem to remove the NSP_np_Bandwidth.xml file. It just makes a copy with the x added to the end of the name and I end up with the two files in the directory. This means that nothing changes, the unit operates as it did before the attempt. The backup folder just has only the X copy in it.
73s
Indeed, you still have old bandwidth file inside of firmdata0 and i don't why... I'm quite sure, similar issue was reported in the past by other eevblog user (LE: #370...#377).
Please check my email reply. There you have the instruction for how to delete "NSP_sn_Bandwidth.xml" located inside of "Firmdata0".
-
Good luck! Ask if you have something unclear.
This is my procedure (Microsoft Word .docx file). Nothing new inside, all instructions are according Eevblog forum. It is not my contribution.
73 de Robert
Robert Thanks so much for the great document. It explains it in a way that makes it very easy.
I emailed you because I think that there is one problem. It does not seem to remove the NSP_np_Bandwidth.xml file. It just makes a copy with the x added to the end of the name and I end up with the two files in the directory. This means that nothing changes, the unit operates as it did before the attempt. The backup folder just has only the X copy in it.
73s
If you see there
NSP_np_Bandwidth.xml then something have gone totally wrong, b and B are not same in real operating systems.
------------
(I give also warning about this microsoft total junk crap story writing program Word. Who is programmer who even think to use this kind of total junk. There is text handling programs what do not mess anything, like example notepad++ and of course also others. Even windows Notepad is better than this total junk Word for programs (and other things where we need plain text without hidden control character and other messy things what is more like made for artists than programmers.)
Example if I wrongly open this docx and take copy (copypaste) from this docx and then paste it here, after then it is NSP_sn_Bandwidth.xml.
It is also explained original but very old V05 (1) instructions what can find somewhere (even when it have some residues from older times but today we do not meet anymore new SSA's what have been pre installed generation 7 FW and then changed to 8 etc... )
(1) I mean this V05 (clip from start of it):
* Some experimental instructions for SSA30??X
*
* This is ONLY FOR SSA30??X running original FW 1.2.8.1 ( P08.01 )
*
* IF YOUR SYSTEM IS NOT THIS VERSION - EXIT NOW
*
*********************************************************************************
*********************************************************************************
*
*
* Status: Preliminary V0.5
* Author: Li Xiu Ying
* Date: 1888-08-08
*
* This document is best read using fixed spacing fonts, example: Consolas or FixedSys
* If you use Windows, please open this document using example windows Notepad, WordWrap turned OFF.
*
*
* IF you are familiar with UNIX, Kylin, NeoKylin or Linux systems no need read all. You can now jump
* directly to CHAPTER 8. There all is compressed without any boring comments.
*
* After V0.3
*
* V0.4 Removed Chapter 2.
*
* V0.5 Add instructions and notes what to do with some file names
* which are possibly missing in some SSA's
<clip>
Let's hope some day we get next revised and updated edition!
-
I'm quite sure it's just a typing mistake here on forum thread.
Dread sent me next snapshot of his SSA Firmdata0 content and both files seem to be OK. He made a new backup in order to check the files...
Of course is more better to check the files using telnet and V05 instructions!
-
And what happen with
NSP_trends_config_info.xml
is it now original or system self made dummy version as it goes in older times.
-
And what happen with
NSP_trends_config_info.xml
is it now original or system self made dummy version as it goes in older times.
Man you guys are making me nervous. I have always kind of stayed away from Linux which was a mistake but anyway I know very little about Linux. I did some reading and was able to navigate to the directory and try to remove the "NSP_sn_bandwidth.xml" located inside of "Firmdata0 using the "rm" command and I got back a message saying it's read only and cannot be deleted. So I guess it has something to do with the mounting of the file or the directory. I am not sure how to proceed so I am waiting to see if anyone can help.
Thanks
-
OK I got it working :phew: I am now at 3.2GHZ with all Lic options now permanent.
I looked back on page 22 of this thread and saw the command for mounting the directory in RW mode.
"mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0"
So now I was able to remove the file.
Should I leave it in R/W mode or should I revert it back to read only?
Also for future users does anybody have any idea why this did not work right the first time and it left behind the file?
Thanks again for all the help guys.
-
And what happen with
NSP_trends_config_info.xml
is it now original or system self made dummy version as it goes in older times.
Man you guys are making me nervous. I have always kind of stayed away from Linux which was a mistake but anyway I know very little about Linux. I did some reading and was able to navigate to the directory and try to remove the "NSP_sn_bandwidth.xml" located inside of "Firmdata0 using the "rm" command and I got back a message saying it's read only and cannot be deleted. So I guess it has something to do with the mounting of the file or the directory. I am not sure how to proceed so I am waiting to see if anyone can help.
Thanks
I did some reading and was able to navigate to the directory and try to remove the "NSP_sn_bandwidth.xml" located inside of "Firmdata0 using the "rm" command and I got back a message saying it's read only and cannot be deleted.
I will recommend Nintendo. If you guess wrong you can always start a new game without losing anything but perhaps most valued thing what exist - time.
Playing inside SSA system is as elephant is in porcelain store. Nice thing is that system is least even somehow protected.
;)
EDit:
Oh now I can see, removed. Why removed? What a heck is idea to remove something.
Rename is your 1st friend.
-
I will recommend Nintendo. If you guess wrong you can always start a new game without losing anything but perhaps most valued thing what exist - time.
Playing inside SSA system is as elephant is in porcelain store. Nice thing is that system is least even somehow protected.
;)
EDit:
Oh now I can see, removed. Why removed? What a heck is idea to remove something.
Rename is your 1st friend.
I had it backed onto the USB stick and now my NAS drives so I think I am safe removing the file.
When I said remove BTW I meant the original and just leave the one that ended with X.
YO4HFU was really a great help with this, he actually had sent me an email to fix the issue but for some reason the email system stripped the attachment. I found it after I had already fixed the problem.
Your right about playing with Nintendos rather than a SA for the first time out. I typically proceed very cautiously when I am using a programming languages or OS I am not versed in. Even if I see a solution by one person I look up the command to make sure the syntax and application are correct before using it.
As for the Analyzer, I am loving it now even more than before. There is just something about being able to play around with it and not have those dam timers ticking down! I really wish that companies would start the timer when you are actually using that feature and only on that feature. It would be better to give me 10 hours of real usage time then 48 hours that starts the moment I power the machine. Anyway it's great to feel like a bird set free !
Thanks to all that helped, especially YO4HFU and you rf-loop.
-
Well done Dread!
Something was wrong during your first attempt. Maybe "mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0" operation was not correctly done and one more file has born by renaming of "NSP_sn_Bandwidth". The solution was to delete "NSP_sn_Bandwidth" and to keep "NSP_sn_Bandwidthx".
Conclusion:
- SSA3021x [SW1: 1.2.9.a; SW2: 20180708-1; SW3: 000000E1; HW: 0C.03.00] can be hacked be renaming only the "NSP_sn_Bandwidth" files.
- Read "V05" txt file in order to be familiar with Linux commands.
Regards,
-
Rename is your 1st friend.
Actually..
"cp" is your first friend.
"mv" is your second friend.
"tar" is your best friend.
And "rename"? Crazy foreign talk. :)
-
Hi all
This thread has gotten pretty long over the last 2 years. I read 20ish pages of the 25 and received my new SSA3021 yesterday and profiled a couple of bandpass filters to get familiar with options and functionality/use.
I thought I was ready to mod and familiar with many OS's, so I set out to perform the mod and now telnet connections are refused. Thought I would try telnet/ssl, ssh1 and ssh2 thinking they may have locked down telnet and running an ssh daemon, but no luck.
My device is :
Model SSA3021X
SW1 1.2.9.2.a
SW2 20180708-1
SW3 000000E1
HW 0C.03.00
EMI, AMK and Refl are temporarily enabled for 44 hours remaining and TG permanently enabled
I intended to perform the following:
Part 1 - Backup files
1. Insert USB stick
2. Go in System => System info
3. Establish a telnet session with root/ding1234
4. cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
5. cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
8. sync
9. logout
Part 2 - Perform hack
1. Establish a telnet session with root/ding1234
2. mv /usr/bin/siglent/firmdata0/NSP_sn_bandwidth.xml /usr/bin/siglent/firmdata0/NSP_sn_bandwidthx.xml
3. mv /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup/NSP_sn_bandwidth.xml /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup/NSP_sn_bandwidthx.xml
4. sync
5. logout
6. Soft power cycle (power off and power on with button "power")
7. Go in System => Pwr On/Preset => Reset & Clear => Enter
8. Soft power cycle (power off and power on with button "power")
But I mistaking performed the following instead:
Part 1 - Backup files
1. Insert USB stick
2. Go in System => System info
3. Establish a telnet session with root/ding1234
4. cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
5. cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
8. sync
9. Soft power cycle (power off and power on with button "power") <-- |O
10. Go in System => Pwr On/Preset => Reset & Clear => Enter <-- |O
11. Soft power cycle (power off and power on with button "power") <-- |O
12. logout
Part 2 - Perform hack
1. Establish a telnet session with root/ding1234 <-- Now refusing connections :--
Please advise if there is anyway I can undo the damage as I'm not able to telnet in anymore. I wonder if performing a factory reset would resolve issue or trash my license and halt all operations.
SSA is still fully functioning, I’m just unable to telnet in and rename the bandwidth files to perform the mod.
Thank you
Rich
-
What you did couldn't break anything, make sure that the SSA network connection is enabled and the IP address is still the same .
-
I checked the IP address and it had change do a different subnet, so I assigned a static IP as I do everything and verified it worked. The refused connection is from the SSA. So it is responding and never prompts for a username. In my experience with rebooting servers this message it normal when all the services for that run level are still starting and the daemon does not accept new connections until some other dependency is meet. Normally it is another service at that run level that is still starting.
Good idea, but IP address, netmask and gateway are not the cause of the refused connection in my case.
-
I checked the IP address and it had change do a different subnet, so I assigned a static IP as I do everything and verified it worked. The refused connection is from the SSA. So it is responding and never prompts for a username. In my experience with rebooting servers this message it normal when all the services for that run level are still starting and the daemon does not accept new connections until some other dependency is meet. Normally it is another service at that run level that is still starting.
Good idea, but IP address, netmask and gateway are not the cause of the refused connection in my case.
I also don't think you have damaged anything and the reason must be something else. I just didn't figure out how you did "logout" in step 12 after two power cycles?
-
Good catch, logout was done before 2 power cycles. I copied intended instructions down and merge the unintended power cycle steps before the logout and should have been pasted after it.
My fear is that the reset/clear removed some key data or file that is needed for all the services to start and allow the telnet to start accepting connections.
-
I checked the IP address and it had change do a different subnet, so I assigned a static IP as I do everything and verified it worked. The refused connection is from the SSA.
So, the SSA does respond to a ping at the static address you expect?
-
Yes, it pings instantly
-
I checked the IP address and it had change do a different subnet, so I assigned a static IP as I do everything and verified it worked. The refused connection is from the SSA.
So, the SSA does respond to a ping at the static address you expect?
I was just going to ask exactly the same thing!
and does the SA work normally (except the telnet issue)?
-
Yes, the SSA seems to be in perfect health otherwise. Thank goodness.
Telnet session to SSA gets a response of --> "The remote system refused the connection."
I’ve scared myself at this point and afraid to try resetting to factory settings
** Update - I decided to try Pwr On/Present/Factory Reset and the only change I can tell is it went back to static IP with a dot 10 class IP assignment. I switched back to DHCP and pings promptly and same telnet "The remote system refused the connection." message. I did 3 Pwr On/Present/Factory Reset with a power cycle between each thinking it may implement some sort of poor mans registry and swap previous setting back in. Nada, problem has not changed.
-
Which telnet application? OS?
-
Windows 10
SecureCRT 6.7
-
Use a port scanner to see if the telnet port has changed!
-
Just use putty or even Windows own telnet command.
100% sure you are doing something wrong as you could not have changed root password by mistake.
Regards,
Vitor
-
Hi Vitor
Its the little stuff that can get you. I have putty but was so confident in SecureCRT as I've used it for ~25 years that I thought there is no way. Well guess what, yes way!
Putty worked like a charm and I performed the mod and all options are permanently and it now reports as a SSA3032x with X's for a serial number.
Here is the updated steps:
Model SSA3021X
SW1 1.2.9.2.a
SW2 20180708-1
SW3 000000E1
HW 0C.03.00
Part 1 - Backup files
1. Insert USB stick
2. Go in System => System info
3. Establish a telnet session with root/ding1234
4. cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
5. cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
8. sync
9. logout
Part 2 - Perform hack
1. Establish a telnet session with root/ding1234
2. mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
2. mv /usr/bin/siglent/firmdata0/NSP_sn_bandwidth.xml /usr/bin/siglent/firmdata0/NSP_sn_bandwidthx.xml
3. mv /usr/bin/siglent/usr/backup/NSP_sn_bandwidth.xml /usr/bin/siglent/usr/backup/NSP_sn_bandwidthx.xml
4. sync
5. logout
6. Soft power cycle (power off and power on with button "power")
7. Go in System => Pwr On/Preset => Reset & Clear => Enter # Wait for SSA to complete the erase and it will reboot on its on
8. Soft power cycle (power off and power on with button "power")
Regards to all and all the suggestions were very much appreciated
-
I just ordered a Siglent SSA3021X with 2.1 tracking generator for $948 brand new with free shipping from Amazon. I had to triple check everything to make sure but yes.
Here is the link https://www.amazon.com/Siglent-SSA3021X-Spectrum-Analyzer-9KHz-2-1GHz/dp/B01N6M4UNQ/ref=sr_1_fkmrnull_9?hvadid=316076274941&hvdev=c&hvlocphy=9012068&hvnetw=g&hvpos=1t3&hvqmt=e&hvrand=16359178291538897281&hvtargid=kwd-316747328064&keywords=siglent+ssa3021x&qid=1550356053&s=gateway&sr=8-9-fkmrnull&tag=googhydr-20 (https://www.amazon.com/Siglent-SSA3021X-Spectrum-Analyzer-9KHz-2-1GHz/dp/B01N6M4UNQ/ref=sr_1_fkmrnull_9?hvadid=316076274941&hvdev=c&hvlocphy=9012068&hvnetw=g&hvpos=1t3&hvqmt=e&hvrand=16359178291538897281&hvtargid=kwd-316747328064&keywords=siglent+ssa3021x&qid=1550356053&s=gateway&sr=8-9-fkmrnull&tag=googhydr-20)
Let me know if I screwed up on this.
Jim
-
I just ordered a Siglent SSA3021X with 2.1 tracking generator for $948 brand new with free shipping from Amazon. I had to triple check everything to make sure but yes.
Let me know if I screwed up on this.
Jim
Hey Jim, that seems like a great price. The description indicates that the TG function is optional, but I believe it is included for free now (as it says in the title of the Item page you linked), as well as the lower RBW. Might just be old marketing copy, as they are just software changes. As long as the seller is legit, looks like you got a nice deal (especially if you plan to "upgrade" it).
-
I thought it was too good to be true. Amazon just cancelled it. I assume it was an old ad.
Jim
-
I thought it was too good to be true. Amazon just cancelled it. I assume it was an old ad.
Jim
You got lucky, it was more likely an unscrupulous third party seller and Amazon cut them off.
-
I would also add, it probably won't be covered under Siglents warranty. ;)
-
Hello,
a time ago my SSA3021 was not starting up, just the screen from siglent and stopped. Entry via telnet was still possible
I have placed a few file's back from a backup that I have make before the hack of the SSA3021 and all worked fine again.
now 6 monds later again the same problem.
who can give me the list with files/sub. that are into
/usr/bin/siglent/usr/backup
/usr/bin/siglent/firmdata0
via the telnet must it be possible to readout these list "ls -al"
if some one have a new not hacked SSA3021 it will be interesting me to see what is in there
thanks into advance,
Greetings Luc, ON7KZ
-
Hi,
I have an early (2016) vintage SSA3021X. It was "upgraded" as per this thread in 2016; EMI, AMK, TG, Refl all display as Permanent
I see there is now 25 pages of updates, and I'm not sure if it's "safe" to attempt to load the latest firmware from Siglent without risking either bricking it or loosing the previous enhancements?
SW1 100.01.02.07.07
SW2 20160606-2
SW3 000000D1
HW 07.03.00
Is it safe to upgrade or should I leave it as is?
If it's safe where can I find the latest procedure?
Thanks
-
Hi,
I have an early (2016) vintage SSA3021X. It was "upgraded" as per this thread in 2016; EMI, AMK, TG, Refl all display as Permanent
I see there is now 25 pages of updates, and I'm not sure if it's "safe" to attempt to load the latest firmware from Siglent without risking either bricking it or loosing the previous enhancements?
SW1 100.01.02.07.07
SW2 20160606-2
SW3 000000D1
HW 07.03.00
Is it safe to upgrade or should I leave it as is?
If it's safe where can I find the latest procedure?
Thanks
Let the FW release notes give you some guidance on what has been changed and what you might be missing out on.
You can read them here:
https://www.siglentamerica.com/wp-content/uploads/2019/02/SSA3000X-Firmware-Revise-History-Update-Instructions_V2.pdf (https://www.siglentamerica.com/wp-content/uploads/2019/02/SSA3000X-Firmware-Revise-History-Update-Instructions_V2.pdf)
TG is now free with new units and should've been activated in one of the FW releases.
-
Hi Vitor
Its the little stuff that can get you. I have putty but was so confident in SecureCRT as I've used it for ~25 years that I thought there is no way. Well guess what, yes way!
Putty worked like a charm and I performed the mod and all options are permanently and it now reports as a SSA3032x with X's for a serial number.
Here is the updated steps:
Model SSA3021X
SW1 1.2.9.2.a
SW2 20180708-1
SW3 000000E1
HW 0C.03.00
Part 1 - Backup files
1. Insert USB stick
2. Go in System => System info
3. Establish a telnet session with root/ding1234
4. cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
5. cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
8. sync
9. logout
Part 2 - Perform hack
1. Establish a telnet session with root/ding1234
2. mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
2. mv /usr/bin/siglent/firmdata0/NSP_sn_bandwidth.xml /usr/bin/siglent/firmdata0/NSP_sn_bandwidthx.xml
3. mv /usr/bin/siglent/usr/backup/NSP_sn_bandwidth.xml /usr/bin/siglent/usr/backup/NSP_sn_bandwidthx.xml
4. sync
5. logout
6. Soft power cycle (power off and power on with button "power")
7. Go in System => Pwr On/Preset => Reset & Clear => Enter # Wait for SSA to complete the erase and it will reboot on its on
8. Soft power cycle (power off and power on with button "power")
Regards to all and all the suggestions were very much appreciated
Worked flawlessly here! Thank you!
-
Hi Vitor
Its the little stuff that can get you. I have putty but was so confident in SecureCRT as I've used it for ~25 years that I thought there is no way. Well guess what, yes way!
Putty worked like a charm and I performed the mod and all options are permanently and it now reports as a SSA3032x with X's for a serial number.
Here is the updated steps:
Model SSA3021X
SW1 1.2.9.2.a
SW2 20180708-1
SW3 000000E1
HW 0C.03.00
Part 1 - Backup files
1. Insert USB stick
2. Go in System => System info
3. Establish a telnet session with root/ding1234
4. cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
5. cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
8. sync
9. logout
Part 2 - Perform hack
1. Establish a telnet session with root/ding1234
2. mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
2. mv /usr/bin/siglent/firmdata0/NSP_sn_bandwidth.xml /usr/bin/siglent/firmdata0/NSP_sn_bandwidthx.xml
3. mv /usr/bin/siglent/usr/backup/NSP_sn_bandwidth.xml /usr/bin/siglent/usr/backup/NSP_sn_bandwidthx.xml
4. sync
5. logout
6. Soft power cycle (power off and power on with button "power")
7. Go in System => Pwr On/Preset => Reset & Clear => Enter # Wait for SSA to complete the erase and it will reboot on its on
8. Soft power cycle (power off and power on with button "power")
Regards to all and all the suggestions were very much appreciated
This worked for me also. !!
-
Anyone know if these hack are working with 0F.03.00 ?
SW1 Version 1.2.9.2.a
I have just got one of these and would like the feature also.
regards
Nick
-
I have an SSA3021 that I would like to "open up" but have no Linux experience and worry I might turn it into an expensive brick.
I've got a couple of tutorials on Linux and PuTTY but I'm proceeding cautiously. I know what format C: does for Windows....
Is there anyone in the Little Rock, Arkansas or the Springfield, Missouri area that could help me with this ?
Thanks.
-
I have very little Linux experience and it worked for me. If you follow the steps that have been outlined it's pretty easy. I doubt you will brick the unit but if your really that worried maybe somebody on the forum might be able to use teamviewer and do it remotely.
-
Well that's good to hear. I'll practice some more with PuTTY and Telnet on a little Windows notebook and then see if I can work up my nerve. I suppose the really big item is to copy the original files in case of a problem. I have the latest firmware (I think) SSA3000X_v1.2.9.2a_V2.zip as well as the earlier versions going back a couple of years. Did you install all the updates before the Telnet session and do you still have the 10Hz resolution ?
When they came out with the free TG option I called them and they did give me a code to make that option permanent. I have yet to try that install but suppose it would be a good place to start. The menu is not very intuitive but will work through it....
-
Any info on the OF hardware and if this works.?
I can telnet into the system into root OK.
I just don't want to change anything that may upset anything in it.
so some help would be totally appreciated if possible.
Thank in advance.
-
Anyone modified this version?
Can it be done, it's the new Hardware Version 0F.
Screen shot if anyone can help
-
Or does it actually matter about the HW Version, and it's just the SW version thats involved ?
Maybe this is why I am being ignored, because it's so simple.
-
Many thanks for all the help and replies>
Just for the record, and to help anyone else out there who is effectively "ON THEIR OWN"
It does work.
-
Yes, that worked for me. I have
SW1: 1.2.9.a
SW2: 20180708-1
SW3: 000000E1
HW: 0F.03.00
However, if I do a System => Pwr On/Preset => Reset & Clear => Enter, the machine resets itself to an SSA3021X and options are temporary (except for TG which is permanent)
-
doesnt with mine, I do it regularly as I twiddle with things and the only way to get them back is with a reset/clear
I'll just go test now, to see if it is still ok
-
Yep, just tried it, it's still there. I video'd it but it was too big to upload.
-
I have yet to "open up" mine which is an earlier 2017 version and I have not updated any of the firmware. Does your display still show the serial number as xxxxxx's or does the original number reload? I'm wondering if it can be restored to the factory shipped condition if the original files are reloaded. That way if it needed to be returned for repairs the factory should accept it. Thanks.
-
@TOWERSIGNALS - if your F/W is 7.07 or earlier, please make sure to follow the "improvement" instructions attached to this post (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg998366/#msg998366) before updating the firmware. Upon update to 8.xx, this will generate "official" keys and your serial number will survive and the "hack" cannot be removed by future firmware updates. If your firmware is >= 8.xx, just go ahead and modify the instrument as described in the more recent instructions.
Good luck and all the best,
Thomas
-
Thanks Thomas. I downloaded your zip file and saved it to my laptop SSA3021 folder. My SSA 3021 serial number has a letter preceding just four numbers at the end. Not five numbers - maybe that is normal. It's an SSA3021 model from 2017 so I'm sure I do not have the FW 8.xx version. Most all my work is below 1 GHz so it's the added features that are more valuable right now than the extra bandwidth.
-
My ssa3021 had 7.07 fw but i upgraded to v8 and hacked so i lost the serial number, is there a procedure to return to 7.0.7 and apply the new hack procedure described by Thomas? If yes what is the correct path step to step, thanks in advance
-
My ssa3021 had 7.07 fw but i upgraded to v8 and hacked so i lost the serial number, is there a procedure to return to 7.0.7 and apply the new hack procedure described by Thomas? If yes what is the correct path step to step, thanks in advance
There's no (easy way for) going back. It's just not worthy it! You would have to repartition the NAND, etc, etc
If you want to recover the S/N, remove the hack. It's simple.
-
TV84,
How does one "remove the hack"? ( I can see logging-in and copying the backed-up files back to the operating files. Perhaps you meant that?
I performed the upgrade on my new SSA3021X, but I see my SN has been 'X'd out.
Any way to get the feature set and retain the proper serial number?
Thanks, in advance!
Shane
-
You can reinsert the S/N via SCPI.
Try something like
:SRLN <serial_num>
(I don't remember if this is the right command for the SSA but should be here in the forum...)
-
Thank you, TV84. I don't seem to.be able to get an http session with the SA at this time.
I found a manual on the SCPI commands for the SA, but I don't see any command that allows configuring the S/N for the SA.
Best Regards,
Shane
-
Thank you, TV84. I don't seem to.be able to get an http session with the SA at this time.
I found a manual on the SCPI commands for the SA, but I don't see any command that allows configuring the S/N for the SA.
Best Regards,
Shane
Of course, it's a hidden undocumented command.
From P7 of the programming manual:
https://www.siglentamerica.com/wp-content/uploads/dlm_uploads/2017/10/SSA3000X_ProgrammingGuide_PG0703X_E04A.pdf (https://www.siglentamerica.com/wp-content/uploads/dlm_uploads/2017/10/SSA3000X_ProgrammingGuide_PG0703X_E04A.pdf)
Telnet mode. The telnet SCPI service is available on port 5024.
-
TV84 is correct:
:SRLN <serial_num>
... is the correct SCPI command to set the serial number (note the space after :SRLN)
Thanks to TV84 :)
-
Thank you TauTech and TTH!
I have successfully logged-in as you suggested, but I'm having difficulty getting the SN set.
I have tried:
:SLRN SSA3XABC1t2682
:SYST:SLRN SSA3XABC1t2682
:SYSTCONF:SYST:SLRN SSA3XABC1t2682 (Number changed to protect the innocent)
Nothing seems to set the serial number... Should I enter some sort of save command to fix the change into the SSA???
I skimmed through the manual- perhaps I missed the details???
Your hints are very helpful!
Thank you, again!
Shane
-
I have successfully logged-in as you suggested, but I'm having difficulty getting the SN set.
Sanity check *IDN?
Does this return the correct answer ?
For SCPI it's always a good idea to prove you have a valid connection first.....especially if you're a programming novice like me. :-[
-
Hi TauTech,
Yes, *IDN? returns the scope model and SNXXXXXXXXXX, 1.2.9.2.a
-
Hi TauTech,
Yes, *IDN? returns the scope model and SNXXXXXXXXXX, 1.2.9.2.a
See the little 't' in your SN# ? That doesn't look right to me. Double triple check it belongs there.
-
That's not the real SN of my SSA. When I do the *IDN? I get all X's for the SN.
-
That's not the real SN of my SSA.
Yes I know but it should be SSA3X***#R####
When I do the *IDN? I get all X's for the SN.
Yes, when they are hacked XXX...... is the SN#.
Someone here will pop by and rescue you. :)
They go just fine without a SN# so no need to worry unduly.
-
Tautech-
Thank you- my SSA has the SN of this form:
SSA3X***2R####
I hope to be rescued! Ha ha! It would be good to put the SN right, even though it doesn't affect the function of the analyzer.
I appreciate your kind replies!
Best Regards,
Shane
-
Thank you TauTech and TTH!
I have successfully logged-in as you suggested, but I'm having difficulty getting the SN set.
I have tried:
:SLRN SSA3XABC1t2682
:SYST:SLRN SSA3XABC1t2682
:SYSTCONF:SYST:SLRN SSA3XABC1t2682 (Number changed to protect the innocent)
Nothing seems to set the serial number... Should I enter some sort of save command to fix the change into the SSA???
I skimmed through the manual- perhaps I missed the details???
Your hints are very helpful!
Thank you, again!
Shane
Just for the record and for others that might want to use this method.
In your SCPI commands you seem to have made a typo; :SLRN, should be :SRLN
-
Thank you TauTech and TTH!
I have successfully logged-in as you suggested, but I'm having difficulty getting the SN set.
I have tried:
:SLRN SSA3XABC1t2682
:SYST:SLRN SSA3XABC1t2682
:SYSTCONF:SYST:SLRN SSA3XABC1t2682 (Number changed to protect the innocent)
Nothing seems to set the serial number... Should I enter some sort of save command to fix the change into the SSA???
I skimmed through the manual- perhaps I missed the details???
Your hints are very helpful!
Thank you, again!
Shane
Just for the record and for others that might want to use this method.
In your SCPI commands you seem to have made a typo; :SLRN, should be :SRLN
Also, regardless of whether it worked or not. Until today, I have not seen Siglent serial numbers what include other than capital letters and numbers.
-
It's been a long time but I think when you force the S/N to be the one you want with the SCPI command, you automatically disable the hack that most people use.
After activated, if I remember correctly, the hack works by checking if the S/N is XXXXXXXXX.
But I could be wrong...
-
TV84 is correct:
The SCPI command
:SRLN SSA3X*********
... changes the serial number
... but results in the creation of a new NSP_sn_bandwidth.xml file (and backup)
... populated with the serial number - but no option licence keys : (
It does appear that you have to live with the XXX serial number if you want all the options.
-
TV84 is correct:
The SCPI command
:SRLN SSA3X*********
... changes the serial number
... but results in the creation of a new NSP_sn_bandwidth.xml file (and backup)
... populated with the serial number - but no option licence keys : (
It does appear that you have to live with the XXX serial number if you want all the options.
It looks like Alzheimer hasn't catch me yet... I had this idea from what I saw in my code analysis although I didn't asked nobody to test. Now it's confirmed!
-
However, there is one drawback: AFAIR, Siglents software EasySpectrum will not work without the serial number. If you would like to use the analyzer for doing pre-compliance measurements, the software saves a lot of time and makes things much easier.
However: I cannot test/confirm this, as my unit does have serial number and all options. Maybe somebody can double check this.
But I am pretty sure that EasySpectrum was very sensitive about the connected analyzer.
-
Easy Spectrum functionality works (both Monitor and EMI) with Serial XXXXXXXXXX
-
There is a new firmware 1.2.9.3a out.
This one seems to block telnet access to the device. It is not available on the regular port 23, and also not on 10101 (which some other Siglent products use).
Downgrading to 1.2.9.2a is possible, but does not bring telnet access back!
So I wouldn't recommend to install this update for now.
-
Seems like Siglent is starting to secure their product line. :(
-
The new FW SSA3000X_v1.2.9.3a has 2 interesting files, besides new versions of the common ones.
See attached.
And, of course, SHELLCMD was removed from the main app. ;)
-
@tv,
how to mod the lines from
rm -f to echo rm -f
or from
rm -f to # rm -f
Any ide?
Markus
-
how to mod the lines from
You'd have to package a modified ADS update file. The format is obfuscated and sometimes also encrypted. You can find some info here: https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/ (https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/). But while the descriptions there are probably enough to get someone determined on the right track, they are not simple recipes you can just follow along. tv84 seems to have mastered this though.
Just an idea: if someone creates a modified ads file, wouldn't it be better to create one that just re-enables the telnet service and doesn't do anything else, like replacing ecomb? This way you could just install the regular update and install the re-enabler.ads afterwards. When Siglent releases the next update, it will most probably disable telnet again, so you could use the same re-enabler again and wouldn't have to do modifications again.
-
rm -f to echo rm -f
Test at your own risk. (http://s000.tinyupload.com/?file_id=32864100176686764352)
This is the official ADS with additional.sh "slightly" modded.
If you already installed the official update, you already had telnetd deleted, so in that case this won't work.
-
Just an idea: if someone creates a modified ads file, wouldn't it be better to create one that just re-enables the telnet service and doesn't do anything else, like replacing ecomb?
Next time we go that way. :popcorn:
-
Next time we go that way. :popcorn:
I can't - I installed the unmodified update so I don't have telnet anymore.
Would my idea work? I mean must an update always contain ecomb and so on to work or could you really just re-add telnet and be done?
It would be nice if you could try to create such an update.
-
An .ADS can contain whatever we desire. No restrictions.
"Give me a telnetd, and I shall move the earth."
BTW, telnetd is only a link to busybox telnetd. So we just need to recreate the links.
Can anyone provide the script to recreate the links?
-
An .ADS can contain whatever we desire. No restrictions.
that's what I wanted to hear.
BTW, telnetd is only a link to busybox telnetd. So we just need to recreate the links.
was just going to mention this, but cross checked with my ubi dumps to be sure.
To me it seems like they deleted just the links to the initscripts that start and stop telnetd. The actual telnetd link is not touched in the additional.sh you posted before.
Can anyone provide the script to recreate the links?
how about the attached script?
-
how about the attached script?
Do you want me to pack it for you?
-
Do you want me to pack it for you?
That would be nice.
You'd probably have to rename it to .sh (had to rename because of the forum limits). And maybe add some .ads magic that is needed to have it actually executed.
-
Maybe it's no so simple. Isn't there the problem of the FS RO ?
Why do they use that fstab change in the official script?
These are the other scripts in the official .ADS.
-
Maybe it's no so simple. Isn't there the problem of the FS RO ?
When the additional.sh is run as intended by Siglent the fs is rw, otherwise the regular update can't remove these symlinks.
Why do they use that fstab change in the official script?
I just diffed the new fstab against one from my ubi dump. They just add the line where they mount /tmp with tmpfs. So before /tmp was probably mounted to the root fs and that caused problems so they fixed it. I don't think this change has something to do with closing down access, I think it is just regular bugfixing.
These are the other scripts in the official .ADS.
Thanks, that gives me a lot more context to work with. I'll have to look through this code to determine how to get the update system into the right state, but without overwriting ecomb or other important stuff.
-
Here is your script:
After I began reading the stuff in siglentlib.sh I don't think they intended an .ads to not contain ecomb and some other stuff. The additional.sh is only run through upgrade_app(), which overwrites ecomb and so on. I think I need some more time to understand what is exactly going on when an update is running and what is the best way to inject a script without causing negative side effects.
So I don't think this simple way is going to work. I'll post some updated scripts when I have finished my investigation.
I'm not sure if ../init/ is the best path option because I think this script runs in /usr/bin/siglent/usr/usr/upgrade/
ln stores exactly the string you give as parameter into the symlink. The relative path is resolved when you later access the file. This relative symlink is exactly what was in there before, I checked that with my ubi dump.
-
In that case, you can run the ADS.
Of course, my ADS contains only the upgrade.sh with the contents that I wrote above. Because the ecomb doesn't recognize anything else.
No additional.sh sh*t and the rest. Well, I included the fstab but, as you said, it's harmless now.
hmm. have a look at check_and_upgrade() in the siglentlib.sh. If there are update files there (is_need_upgrade), then it directly begins overwriting stuff (upgrade_uboot, upgrade_uimage). It then calls upgrade_app which in turn first overwrites ecomb, ui_data,... then only the additional.sh is called. We absolutely don't want to run that part of the script as it would overwrite uboot and the kernel image.
What I haven't figured out yet is how upgrade.sh is called and how it interacts with the other stuff in siglentlib.sh.
My current guess is that upgrade.sh is called directly when the .ads is installed, before the first reboot. After the reboot, some startup script calls check_and_upgrade() and executes the calls in there.
If that is indeed what is happening, then we'd need to do the rw-remount in upgrade.sh and also remove /usr/bin/siglent/usr/usr/upgrade/upgrade.sh afterwards so that is_need_upgrade() doesn't trigger.
Do you concur?
-
Read my previous msg as I re-edited.
I'm not using any of that stuff because all we want is the symlink creation.
When you go for an update, in the SSA, the app knows it has to search for an upgrade.sh in the .ADS. This is an upgrade feature! No need to investigate.
But, of course our simplistic script won't work as needed because we are not doing the FS RW. As I said, investigate that part sequence and don't worry with partitions/directories updates/replaces/reformats as we won't be doing any of those.
Edit: The .ADS isn't "installed" as you say. The .ADS is decrypted and decompressed into the /upgrade/ dir and then the upgrade.sh is immediately exceuted. It then takes care of the rest.
-
I'm not using any of that stuff because all we want is the symlink creation.
What means "using"? I think it gets automatically "used" if a upgrade.sh script is existing at the right place on bootup.
When you go for an update, in the SSA, the app knows it has to search for an upgrade.sh in the .ADS. This is an upgrade feature! No need to investigate.
Edit: The .ADS isn't "installed" as you say. The .ADS is decrypted and decompressed into the /upgrade/ dir and then the upgrade.sh is immediately exceuted. It then takes care of the rest.
ok, the .ads is unpacked and upgrade.sh executed, directly and before rebooting. A regular upgrade.sh will then trigger the reboot.
You posted a upgrade.sh from Siglent. It doesn't replace ecomb, but we know that it is replaced somehow. So how does this happen?
I think after the reboot the ecomb program will call check_and_upgrade(). That will then overwrite some stuff, remove upgrade.sh and then do a reboot. That is the second reboot you always experience when doing an update on the SSA. On the next reboot no upgrade.sh is there anymore, so the system boots into the regular program.
But, of course our simplistic script won't work as needed because we are not doing the FS RW. As I said, investigate that part sequence and don't worry with partitions/directories updates/replaces/reformats as we won't be doing any of those.
I think you have to activetly prevent the replacement of this stuff, because if you leave upgrade.sh in place it will automatically take place.
Another idea: can't we just directly start telnetd from upgrade.sh and then remove upgrade.sh? That way don't have to take care of file system modifications and so on.
Do you know if upgrade.sh is called as root or as another user?
-
Could you please build me an .ADS with just the attached upgrade.sh?
That should open up telnet just once and only during this session. Deleting the upgrade.sh will make sure there are no surprises at the next reboot.
-
Another idea: can't we just directly start telnetd from upgrade.sh and then remove upgrade.sh?
The attached .ADS should activate telnetd for the current SSA session. Login as usual. :popcorn:
The script inside is electronic_eel's creation. I just applied the external paint.
-
This script works! (after tv84 and I did some back and forth to figure out what was going on)
When you install it as update you get instant telnet access. But for this session only, so after a reboot everything is unchanged and as before.
The SSA shows a small progress bar when installing, it halts at 60%. This is normal and means you can now telnet in. The password is unchanged. The ui becomes unresponsive, it says you should wait for the update to complete. So just call "reboot" in your telnet session when you are done.
-
Ok thanks for trying and create it, but what’s the exact procedure to install new update with all options enabled?
-
Ok thanks for trying and create it, but what’s the exact procedure to install new update with all options enabled?
you install the original update from Siglent website. Now telnet access is closed.
Then you install the telnet_SSA3000X update as posted by tv84 above. That gets you telnet access back for the current session, but doesn't change or update anything of the system. Now you use telnet to do the regular procedure to extend your bw/options as posted previously in this thread. done.
-
Nice, could i recuperate my s/n with that procedure or it’s the same as before?
-
hey all :)
after reading the thread (all new posts since I was here last time) I'm a little bit puzzled if I should upgrade the fw or not.
I currently have fw 1.2.8.2 (HW 07.03.00) which I applied months ago after I got the device.
Can I safely upgrade to the newest fw like I see it in post #633 without losing anything?
1.2.9.1 is on the siglent download page and here you talk about v1.2.9.3a.
Which would be better?
Thanks for unpuzzling me ;D
-
You can upgrade peacefully (to 1.2.9.3a since it's the latest).
-
oh wow, quick reply
thanks, tv84, so I just apply the new fw and all options will stay :)
edit: yay, done :)
-
Hi,
Is it possible to upgrade the SSA3021X, SW1 1.2.9.3a, SW220180708-1, HW 0F.03.00 ?
Anyone! -is it possible to to upgrade SSA3021X that comes with SW1 1.2.9.3a??
-
You can enable all options using the previously documented procedure - after running telnet_11201.ads for the session.
-
Hi everybody,
I have been reading this thread and decided to order a Siglent SSA3021. It came with the tracking generator license and the 1.2.9.2.a firmware installed.
I managed to get all the options enable, using knowledge from this thread ;D everything looks fine, apart from the license number which is XXXXXXX as I knew it would be when hacking it.
My question is; have anybody tried the TekBox EMCView pre-compliance software (Link (https://www.tekbox.com/product/emcview-pc-software-emc-compliance-testing/)) with a hacked Siglent? They state the software will be locked to the SSA's serial number, but wil this work with a hacked unit?
I have the original S/N, but I suppose the unit reports "XXXXXXXX" back to the software?!?
Hope someone can help me out here.
-
For that case, maybe you can use a hexeditor and change the app file to SCPI report your S/N in the place where it has the XXXXXXXXX. Leave all the other files as they are.
But you would have to do that patch in every update...
Poor's man solution.
-
hmmm, how would I go about that?
where do I find the SCPI app file?
-
hmmm, how would I go about that?
where do I find the SCPI app file?
I meant the SA main app (that runs in the equipment)! It's the main app that answers to the SCPI requests.
-
oh ok, any clues to where I should look for this app?
Any ideas where to find the serial, or can I just search for the XXXXXXX thingy?
-
Search the thingy.
-
I get it :)
but where is the app located?
-
Deep blue is just a disguise, right? :)
-
but where is the app located?
The program is called "ecomb" and can be found below /usr/bin/siglent
-
Thanks, I found the app.
searched it and found two places where XXXXXXXX. the first one is at addr. 001052E8 (FW 1.2.9.2.a) the second is at addr. 00130D44.
At the first addr. it states "XXXXXXXX Changed".
It would be nice to have the original non-hacked ecomb file to compare with. anyone have this for this firmware?
I guess I should change it both placed?
When I have the modified file, how do I shutdown the process to be able to copy it? I guess I need to remount the drive RW also ?
-
It would be nice to have the original non-hacked ecomb file to compare with. anyone have this for this firmware?
Why do you have a hacked or modified ecomb binary? Opening the telnet port or renaming the license files does not patch your binary, it just changes how the binary behaves.
When I have the modified file, how do I shutdown the process to be able to copy it? I guess I need to remount the drive RW also ?
use the kill command (see first few pages of this thread), then remount rw and copy.
-
It would be nice to have the original non-hacked ecomb file to compare with. anyone have this for this firmware?
Why do you have a hacked or modified ecomb binary? Opening the telnet port or renaming the license files does not patch your binary, it just changes how the binary behaves.
When I have the modified file, how do I shutdown the process to be able to copy it? I guess I need to remount the drive RW also ?
use the kill command (see first few pages of this thread), then remount rw and copy.
Thanks, I just thought the binary was changed as it states the dummy serial with a "Changed" text behind it? This cannot be correct in a non-hacked unit, can it?
-
Hi everybody,
I have been reading this thread and decided to order a Siglent SSA3021. It came with the tracking generator license and the 1.2.9.2.a firmware installed.
I managed to get all the options enable, using knowledge from this thread ;D everything looks fine, apart from the license number which is XXXXXXX as I knew it would be when hacking it.
My question is; have anybody tried the TekBox EMCView pre-compliance software (Link (https://www.tekbox.com/product/emcview-pc-software-emc-compliance-testing/)) with a hacked Siglent? They state the software will be locked to the SSA's serial number, but wil this work with a hacked unit?
I have the original S/N, but I suppose the unit reports "XXXXXXXX" back to the software?!?
Hope someone can help me out here.
Hi,
Perhaps you would like to test my software? Much cheaper, can be tested for free and doesn't care for your serial number...
Click the link on my signature.
Regards,
Vitor
-
Hi,
Perhaps you would like to test my software? Much cheaper, can be tested for free and doesn't care for your serial number...
Click the link on my signature.
Regards,
Vitor
Hi Victor, thank you for notifying me on your software. I am definitely in the market for alternative software.
It seems like your software is not offering EMI pre-compliance tools :( at least I'm unable to find any info on it.
I'm looking for some software to do pre-compliance with corrections factors for the system setup ie. cables, antennas, CDN's etc.
It must do avg. and quasi-peak measurements according to CISPR-16.
maybe the Siglent EasySpectrum software can be used? anybody tried this out in a pre-comliance setup?
-
I am not literate in EMI.
But I think that I could add missing functionality if someone guides me to what is required.
-
Proud owner of a brand new SSA3021 spectrum analyzer that I received today. Thank you, community, for the unlock. Latest firmware, with the telnet script and rename of the file works.
-
Hello everybody. I tried to "upgrade" my SSA3021 this morning, but the file fun_opt_valid_config.xml does not seem to be on my unit.
The only 4 files in the directory are:
NSP_sn_bandwidth.xml
NSP_trends_config_info.xml
nsp_data_b
calib
Does it matter? I would not appreciate to crash everything and I am not an expert in this kind of command lines...
Ben
-
Hi everybody,
I have been reading this thread and decided to order a Siglent SSA3021. It came with the tracking generator license and the 1.2.9.2.a firmware installed.
I managed to get all the options enable, using knowledge from this thread ;D everything looks fine, apart from the license number which is XXXXXXX as I knew it would be when hacking it.
My question is; have anybody tried the TekBox EMCView pre-compliance software (Link (https://www.tekbox.com/product/emcview-pc-software-emc-compliance-testing/)) with a hacked Siglent? They state the software will be locked to the SSA's serial number, but wil this work with a hacked unit?
I have the original S/N, but I suppose the unit reports "XXXXXXXX" back to the software?!?
Hope someone can help me out here.
The Tekbox Software is bound to your analyzer. You will have to provide your SA serial number at the purchase. They are then creating a license file you need to run the software and it will not work with different analyzer (though in case of a defective unit, where you have to exchange the hardware, they ensured me, that they will create a new license file). Thus it all comes down to the question, if the real serial number will be available through the SCPI command *IDN?
If you only get "xxxxxxx", then the software would not work.......... mmmmh - idea: you may try to purchase the Tekbox software by providing them the serial # "xxxxxxx" ;D
This Tekbox software is a very useful tool. I recently made a pre compliance check with one of my customers hardware with one of Texbox' TEM Cells. Report of this one measurement is attached (printed from EMCView).
These Tekbox TEM cells and also their software are worth every cent. They are paying themselves at the first usage (though the customer will have to pay for a pre-compliance check of his hardware).
Btw: I am doing another group-buy at Tekbox shortly - this will save you money! So if you are interested in some discount of the Tekbox LISN / TEM Cell / software, just drop me a PM.
-
The Tekbox Software is bound to your analyzer. You will have to provide your SA serial number at the purchase. They are then creating a license file you need to run the software and it will not work with different analyzer (though in case of a defective unit, where you have to exchange the hardware, they ensured me, that they will create a new license file). Thus it all comes down to the question, if the real serial number will be available through the SCPI command *IDN?
If you only get "xxxxxxx", then the software would not work.......... mmmmh - idea: you may try to purchase the Tekbox software by providing them the serial # "xxxxxxx" ;D
Shouldn't be all that difficult to bypass. I imagine someone could create a proxy (Serial/USB/Ethernet) which intercepts the IDN? SCPI command and returns your actual serial number, and passes through all other SCPI commands unmodified.
-
Shouldn't be all that difficult to bypass. I imagine someone could create a proxy (Serial/USB/Ethernet) which intercepts the IDN? SCPI command and returns your actual serial number, and passes through all other SCPI commands unmodified.
Hmm sounds like a great idea. I would be able to do this in hardware on Serial and maybe on USB, but Ethernet is out of bounds for me :(
Would be great if someone could write a software tool to implement this. I wonder if it could be done with Wire Shark??
-
idea: you may try to purchase the Tekbox software by providing them the serial # "xxxxxxx" ;D
That would be the ultimate group buy! :-DD
-
Have followed the forum/thread for years ... Great work everyone. !!
I have an unmodified SSA3021X with a few purchased options, but now need to access the WiFI band.
Have FW version 1.2.8.5a installed. Read all of the threads ( multiple times) but here is my question :
Can the udpated ZIP file posted by Tom #71 still be used to obtain the options. This adds the NSP_system_info.XML folder into the firmdata0 SA folder after you edit it with your SA serial number. Advantage is that you retain your S/N OR
Do I use the latest method that just renames files in the firmdata0 and backup folder and loose my S/N
Thanks for the info,
Hank
-
Willie -
since oyur SSA is already on Firmware 8.5, the "old" way to improve the instrument isn't an option for you anymore. You've got to use the new method with renaming / moving the corresponding XML files. I guess you've got to apply the more recent hack (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg2162218/#msg2162218) that unfortunately results in your SSA's S/N to be displayed as "XXXXXXXX". I don't know if there's a work-around for that meanwhile since I was lucky to be one of the "early adopters" with the result of the hack having become permanent with a valid S/N. Anyway, you can always revert back from the hack with the result of losing the improved specs but getting back your S/N. I'ld know what I prefer ;).
Cheers,
Thomas
P.S. I only now noticed that you also tried to contact me by PN, sorry for not replying to that before...
-
Tom
Thanks for your reply. Guess my only concern is if I need to use the additional analysis SW that requires a valid license. Since It appears that the telnet port is closing in V 1.2.9.3 , now I guess is the time.
I plan to backup the files and just rename the single file NSP_sn_bandwidth.xml in both the firmdata0 and backup folders.
Thanks,
Hank
-
Hi all. I successfully hacked my SSA3021 with firmware 1.9.2.3a month or so ago, and it worked as it supposed to. Today i was busy controlling it over USB when my PC crashed. To make a long story short, when I next switched the spectrum analyzer on, it remained stuck on the boot screen. I think when my PC crashed, it must have sent some garbage to the analyzer. Has anybody experienced something similar, or does anybody know how to get it into a mode so that one can reload its firmware?
Hendrik
-
Hi all. I successfully hacked my SSA3021 with firmware 1.9.2.3a month or so ago, and it worked as it supposed to. Today i was busy controlling it over USB when my PC crashed. To make a long story short, when I next switched the spectrum analyzer on, it remained stuck on the boot screen. I think when my PC crashed, it must have sent some garbage to the analyzer. Has anybody experienced something similar, or does anybody know how to get it into a mode so that one can reload its firmware?
Hendrik
Using what SW can I ask ?
-
Today i was busy controlling it over USB when my PC crashed. To make a long story short, when I next switched the spectrum analyzer on, it remained stuck on the boot screen. I think when my PC crashed, it must have sent some garbage to the analyzer.
Are you sure it was some data that bricked your ssa? Couldn't it be some electrical thing, like overvoltage or overcurrent, that crashed your pc and at the same time damaged your ssa?
Did you have any devices connected to the ports of the ssa when the crash happened? Could they have caused overvoltage or overcurrent through the ssa?
-
quite sure there was no overload. Spectrum Analyzer was connected via a 20dB pad to my signal generator and was reading -30dBm. The software is my own, talking to the SPA over USB.
-
quite sure there was no overload. Spectrum Analyzer was connected via a 20dB pad to my signal generator and was reading -30dBm. The software is my own, talking to the SPA over USB.
OK, I’ll see what the factory can give us to help you.
-
I guess it could have been just coincidence too that the SPA broke just after the PC crash. Murphy was really on the loose in my workshop today. 1 step forward, and 100 steps back. Guess I’ll give it some time to see if a solution can be found on EEVBlog, else will have to contact the seller and see what they say. The unit is only 2 months old.
-
Did you make a backup of the flash partitions when you were in there doing the hack? Several individuals managed to fix their SSAs via the UBOOT console by flashing back partition images. UBOOT can be accesses by the UART terminals at the lower right corner of the logic PCB (as viewed from behind). I think you'll find some more information on that "emergency" access port on the first few pages of this thread.
Good luck,
Thomas
-
Script to dump the NAND. I had it here laying around. If anyone needs it...
Always good idea to have a NAND backup.
-
hey guys, Spectrum Analyzer is now fixed!!!! :-DD :-DD :-DD
Read through the fist couple of pages, and there was a comment about keeping the “System” button pressed whilst booting. Did it, and the unit came back to life!!!! Will check it out fully later (02:15 over here, and I don’t want to push my luck any further. Maybe that trick should be written up somewhere. Guess it is sort of a hard-reset.
Thanks for all the advice, was thinking of opening the unit up and hook into its serial port, but that seems not necessary. Will do the NAND dump later when I feel brave enough to open the unit.
Come to think of it, I have set my unit to start in the same state as when I switch it off, so maybe the the “system” button whilst booting forces it to start up in default state.
Hendrik
-
Will do the NAND dump later when I feel brave enough to open the unit.
You don't need to open the unit. You just need to have telnet access to the SSA and run the script. Maybe I'll release a .ADS that does that...
-
the hack seems to stop working with SSA3000X_1.2.9.3a.ADS (if you update). Telnet is deactivated with this version, if you update. Tried to get access on the serial port -> works. Root password unchanged. But if i remove the serialno XMLs the user interface freezes. Serial access works, so i can go back. Now back to 2.1 GHz ... Easy come, easy go. On a factory new Analyzer with 1.2.9.3a telnet works and also the hack.
-
the hack seems to stop working with SSA3000X_1.2.9.3a.ADS (if you update). Telnet is deactivated with this version, if you update. Tried to get access on the serial port -> works. Root password unchanged. But if i remove the serialno XMLs the user interface freezes. Serial access works, so i can go back. Now back to 2.1 GHz ... Easy come, easy go. On a factory new Analyzer with 1.2.9.3a telnet works and also the hack.
I just downgraded mine from 1.2.9.2.a to 1.2.8.3 and was able to do the firmware hack.
-
Hello,
Do you know if this hack works on the SSA3000...Plus ?
Thank you :)
-
Hello,
I have made all the options permanent on my recently purchased SSA3021X using the method outlined in this thread. The serial number has become XXXXX. . . as expected. Current System Information Version is as follows :
SW1 1.2.9.2.a
SW2 20180708-1
SW3 000000E1
HW 0F.03.00
Can someone please advise if i upgrade my Firmware to the latest 1.2.9.3a, will all the options remain permanent as they are now ? I would like the Peak Table Sort By Frequency / Amplitude feature, this is a good idea.
Thanks
Len
-
... will all the options remain permanent as they are now ?
Yes.
-
Today i hacked my SSA3021X and turned it into a SSA3032X with ALL options permanent AND KEPT MY SERIAL NUMBER, therefore (hopefully) future proofing it against any firmware updates ;D
When i received the unit the installed firmware was 1.2.9.2a which (thankfully) still had telnet access.
Whilst waiting for delivery i read this whole thread 3 or 4 times to get as much information as i could and it has been invaluable, thanks to all who contributed :)
Ok, so we know if the "NSP_system_info.xml" from version 7 was edited so that the license info was TRUE that this would open it up on that firmware series.
Hint....Create one now and make sure it has YOUR serial number ..
<?xml version="1.0" encoding="UTF-8"?>
<nsp_system_info_root>
<device>
<system_information>
<serial_number>
<chip>SSA3xxxxxxxxxx</chip>
</serial_number>
<license><_3032>TRUE</_3032><_3021>FALSE</_3021><_TG>TRUE</_TG><_EMI>TRUE</_EMI><_Meas>TRUE</_Meas><_CAT>TRUE</_CAT></license></system_information>
</device>
</nsp_system_info_root>
Copy it to a blank USB stick.
Next step is to obtain a copy of the V8.01 firmware (1.2.8.1) and using the "converter tool", make a zip file and extract it with 7-Zip (details are on this thread).
In the extracted folder you will find a copy of the main application file "ecomb", copy this to the USB stick and rename it "ecomb8".
Place the USB stick into the SSA and open a telnet session.
Here is what i did, i'm not a linux user but there is plenty of info here and on the web to get some basics.
Remember, dont enter the " marks, just the text between them.
Enter "mount -o remount, rw /"
Enter "cd /usr/bin/siglent"
Enter "ps"
You will get a list like this...
PID USER VSZ STAT COMMAND
1 root 1320 S init [5]
2 root 0 SW [kthreadd]
3 root 0 SW [ksoftirqd/0]
4 root 0 SW [kworker/0:0]
5 root 0 SW [kworker/u:0]
6 root 0 SW< [khelper]
7 root 0 SW< [netns]
8 root 0 SW [kworker/u:1]
154 root 0 SW [sync_supers]
156 root 0 SW [bdi-default]
158 root 0 SW< [kblockd]
168 root 0 SW< [omap2_mcspi]
179 root 0 SW [khubd]
286 root 0 SW< [musb-hdrc.0]
291 root 0 SW< [musb-hdrc.1]
293 root 0 SW< [rpciod]
295 root 0 SW [kworker/0:1]
305 root 0 SW [kswapd0]
306 root 0 SW [fsnotify_mark]
307 root 0 SW< [nfsiod]
308 root 0 SW< [crypto]
324 root 0 SW< [OMAP UART0]
326 root 0 SW< [OMAP UART1]
328 root 0 SW< [OMAP UART2]
330 root 0 SW< [OMAP UART3]
332 root 0 SW< [OMAP UART4]
334 root 0 SW< [OMAP UART5]
411 root 0 SW [mtdblock0]
416 root 0 SW [mtdblock1]
421 root 0 SW [mtdblock2]
426 root 0 SW [mtdblock3]
431 root 0 SW [mtdblock4]
436 root 0 SW [mtdblock5]
441 root 0 SW [mtdblock6]
446 root 0 SW [mtdblock7]
451 root 0 SW [mtdblock8]
456 root 0 SW [mtdblock9]
461 root 0 SW [mtdblock10]
466 root 0 SW [mtdblock11]
471 root 0 SW [mtdblock12]
479 root 0 SW [ubi_bgt0d]
495 root 0 SW [irq/172-ads7846]
540 root 1776 S < /sbin/udevd -d
719 root 2112 S /usr/sbin/telnetd
726 root 152m S ./ecomb
727 root 1572 S /sbin/getty 115200 ttyO0
728 daemon 1456 S portmap
745 root 0 SW [ubi_bgt1d]
750 root 0 SW [ubifs_bgt1_0]
767 root 0 SW [ubi_bgt2d]
834 root 1772 S < /sbin/udevd -d
873 root 2588 S -sh
2530 root 0 SW [ubifs_bgt0_0]
2651 root 0 SW [flush-ubifs_0_0]
2652 root 0 SW [flush-ubifs_1_0]
2656 root 0 SW [flush-ubifs_2_0]
2704 root 0 SW [scsi_eh_0]
2705 root 0 SW [usb-storage]
2708 root 0 SW [kworker/u:2]
2711 root 1772 S < /sbin/udevd -d
2720 root 2112 R ps
in YOUR list find "./ecomb" and get the "PID" number, in my case above, it was "726"
Enter "kill -9 726" - not sure if the "-9" is needed but it certainly killed the process.
Enter "ps" again and make sure "./ecomb" is NOT shown
Enter "cp /usr/bin/siglent/usr/mass_storage/U-disk0/ecomb8 ecomb8" - This copies "ecomb8" from the USB stick to the "/usr/bin/siglent" directory.
Enter "ls -l" - and make sure it is there.
Enter "mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0"
Enter "cd firmdata0"
Enter "cp /usr/bin/siglent/usr/mass_storage/U-disk0/NSP_system_info.xml NSP_system_info.xml" - this copies the "NSP_system_info.xml" file you created above to "/usr/bin/siglent/firmdata0"
Enter "ls -l" and make sure it is there.
Enter "cd .." to drop back one level to the "/usr/bin/siglent" directory.
NOW FOR THE FUN PART
Enter "./ecomb8" - Loads of text will appear on the telnet screen, the application will start and will read the "NSP_system_info.xml" file and will automatically create a fully licensed "NSP_sn_bandwidth.xml" file, the application will start up on the SSA and using "System info" you will see that your SSA3021X is now a SSA3032X with all options permanent and with the correct serial number.
Power off the SSA, remove the USB and power it back on, all options will remain and it will be running the correct version of "ecomb"
Dont forget to backup to USB stick your new "NSP_sn_bandwidth.xml" file (details are in this thread).
Hope this helps and thanks again to those you have provided the tools and knowledge that has enabled me to do this, now i dont care if telnet has been removed as i can carry out firmware updates knowing it is safe. ;D
P.S. One thing to note was i did have both the original "NSP_sn_bandwidth" files in place, the process just added all the licenses to it.
-
Cool!
-
Today i hacked my SSA3021X and turned it into a SSA3032X with ALL options permanent AND KEPT MY SERIAL NUMBER, therefore (hopefully) future proofing it against any firmware updates ;D
Not the "final hack" but very well done! :clap:
-
Good news
Can you tell more about "
Next step is to obtain a copy of the V8.01 firmware (1.2.8.1) and using the "converter tool", make a zip file and extract it with 7-Zip (details are on this thread).
In the extracted folder you will find a copy of the main application file "ecomb", copy this to the USB stick and rename it "ecomb8".
My English was very poor and when i search "converter tool" or "1.2.8.1" i find only you're post.
In advance, thank you for your answer.
-
Find the tool at:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/?action=dlattach;attach=269048 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/?action=dlattach;attach=269048)
-
BEWARE: That tool is unable to extract a full working zip. But it should be OK to extract the ecomb app most of the times.
So, while you may get errors opening the zip, ensure that you don't get an error when unzipping the ecomb file!
-
Script to dump the NAND. I had it here laying around. If anyone needs it...
Always good idea to have a NAND backup.
Hi,
I'm not familiar with linux and telnet. Can you, if you have time, in short steps explain how to use this script?
Best regards
-
You could start reading here to get an idea of telnet access to the analyzer:
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1480492/?topicseen#msg1480492 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1480492/?topicseen#msg1480492)
-
Script to dump the NAND. I had it here laying around. If anyone needs it...
Always good idea to have a NAND backup.
Hi,
I'm not familiar with linux and telnet. Can you, if you have time, in short steps explain how to use this script?
Best regards
Hi Dennis,
I wouldn't recommend an expensive spectrum analyzer as your first vehicle into the land of linux and telnet. You may want to come up to speed on something else; there are tons of tiny little linux based devices that have a telnet console.
-
You could try telnetting to a Raspberry Pi and honing your Linux skills on that platform. When you break something on the RPi, just start fresh with a new Raspbian image. You'll never end with an expensive paper weight.
-
@myexige
Tried your step by step instructions, but my SSA (also running 1.2.9.2.a) remains a SSA3021X and I see no changes in the NSP_sn _bandwidth.xml after executing the 1.2.8.1 ecomb executable. After ecomb1281 starts, In system info I see SW1 as 1.2.8.1 but the Model remains a SSA3021X and the trial licenses are what is shown under Option.
Is there anything you might have forgotten to mention? What was the exact contents of your backup and firmdata0 directories?
-
@myexige
Tried your step by step instructions, but my SSA (also running 1.2.9.2.a) remains a SSA3021X and I see no changes in the NSP_sn _bandwidth.xml after executing the 1.2.8.1 ecomb executable. After ecomb1281 starts, In system info I see SW1 as 1.2.8.1 but the Model remains a SSA3021X and the trial licenses are what is shown under Option.
Is there anything you might have forgotten to mention? What was the exact contents of your backup and firmdata0 directories?
I tried putting it all back to a 3021 with only the TG enabled and then ran through my previous instructions and it didn't work this time ???!!!
Ok so i have found the problem, you also need to rollback the "nsp_data_b" file in firmdata0 after the process has been killed, i have attached the file i used.
I have tried this numerous times now and each time it works, no changes to the original procedure.
n.b. when you save the file remove the .txt extension
-
@myexige
Tried your step by step instructions, but my SSA (also running 1.2.9.2.a) remains a SSA3021X and I see no changes in the NSP_sn _bandwidth.xml after executing the 1.2.8.1 ecomb executable. After ecomb1281 starts, In system info I see SW1 as 1.2.8.1 but the Model remains a SSA3021X and the trial licenses are what is shown under Option.
Is there anything you might have forgotten to mention? What was the exact contents of your backup and firmdata0 directories?
I tried putting it all back to a 3021 with only the TG enabled and then ran through my previous instructions and it didn't work this time ???!!!
Ok so i have found the problem, you also need to rollback the "nsp_data_b" file in firmdata0 after the process has been killed, i have attached the file i used.
I have tried this numerous times now and each time it works, no changes to the original procedure.
n.b. when you save the file remove the .txt extension
I can confirm that, with the "original" nsp_data_b in place (kindly provided by myexige), the method works flawlessly.
@myexige
Thanks for sorting out the problem I had.
-
@fact - Thanks for confirming, thought i was going mad when i returned it back to normal and it didn't work.
Unfortunately the "tool" for un-encrypting the nsp_data_b file is not available, it was just by chance i noticed that it had grown in size when comparing the backups i had made.
-
Unfortunately the "tool" for un-encrypting the nsp_data_b file is not available, it was just by chance i noticed that it had grown in size when comparing the backups i had made.
The tool is available but it's not public domain. Siglent's 3DES decryption of your "original" file is attached (raw).
<?xml version="1.0" encoding="UTF-8"?>
<sn_backup_root>
<factory>TRUE</factory>
<pro_mode>TRUE</pro_mode>
</sn_backup_root>
A typical nsp_data_b contents can be seen here (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1370553/#msg1370553).
-
Easy way to overcome losing telnet before updating to 1.2.9.3a is to create your own symbolic links for the telnet deamon.
e.g.
Enter "mount -o remount,rw /"
Enter "cd /etc/rc0.d"
Enter "ls -al"
Examine the telnet symbolic link, K10telnetd in this case and create your own with a different number, 15 in this example.
Enter "ln -s ../init.d/telnetd K15telnetd"
Enter "sync"
Replicate this for the other rc directories .
Restart the analyzer.
After this, you can safely update to 1.2.9.3a while preserving telnet access.
-
Easy way to overcome losing telnet when updating to 1.2.9.3a is to create your own symbolic links for the telnet deamon.
e.g.
Enter "mount -o remount,rw /"
Enter "cd /etc/rc0.d"
Enter "ls -al"
Examine the telnet symbolic link, K10telnetd in this case and create your own with a different number, 15 in this example.
Enter "ln -s ../init.d/telnetd K15telnetd"
Enter "sync"
Replicate this for the other rc directories .
Restart the analyzer.
After this, you can safely update to 1.2.9.3a while preserving telnet access.
Hi
it does not work for me...
Rather it is ok to name it S15telnetd not K15telnetd
K<something> is called in *nix when the runlevel is "exiting" (aka shutdown);
S<something> is called when the runlevel starts (whent the SA is booting up in our case)
In my case I used the script at previous post #752 after the upgrade to latest fw (and the telnet was disabled) , then I manually created S10telnetd symlink in rc5.d (only) and the telnet now is on...
Hope this help
Bye
-
@swanawood
In all but rc5.d the original entries are K10telnetd, only in rc5.d the telnet deamon is started with S10telnetd.
That's exaclty why I suggested examining the outcome of the ls -al command before creating the symbolic link.
So if you want to stick to what was originally in the analyzer, that's the way to do it.
-
@swanawood
In all but rc5.d the original entries are K10telnetd, only in rc5.d the telnet deamon is started with S10telnetd.
That's exaclty why I suggested examining the outcome of the ls -al command before creating the symbolic link.
So if you want to stick to what was originally in the analyzer, that's the way to do it.
I followed exactly your suggestion and the telnetd did not survive fw to upgrade....
The goal here is to have the telnetd starting with the proper runlevel (5) through the Stelnetd script.
How one would achieve this, is relatively relevant ....
Anyway, could be both ways are valid for someone else.
Bye
-
Unfortunately the "tool" for un-encrypting the nsp_data_b file is not available, it was just by chance i noticed that it had grown in size when comparing the backups i had made.
The tool is available but it's not public domain. Siglent's 3DES decryption of your "original" file is attached (raw).
<?xml version="1.0" encoding="UTF-8"?>
<sn_backup_root>
<factory>TRUE</factory>
<pro_mode>TRUE</pro_mode>
</sn_backup_root>
A typical nsp_data_b contents can be seen here (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1370553/#msg1370553).
Thanks for that, it took awhile but after a bit of research i have extracted both the 3DES keys they use and decrypted the nsp_data_b file using the one that begins with 0x4E
Cheers
-
I tried myexige’s hack with my newly bought SSA3021X. This came with 1.2.9.3a. After reading this thread, I could temporally enabled telnetd and successfully logged in.
I followed step by step instruction by myexige. I also used nsp_data_b provided by myexige.
Then, after the last step of starting ./ecomb8, I had the following messages, and the telnet session freezed.
-----
root@am335x-evm:/usr/bin/siglent# ./ecomb8
WARNING: Logging before InitGoogleLogging() is written to STDERR
E1019 10:16:11.091491 983 hw_access.cpp:86] >>>>>CHWAccess::spi2open failed!
E1019 10:16:11.099678 983 hw_access.cpp:109] >>>>>CHWAccess::gpmc open failed!
check_and_upgrade:starting...
mount_fs: rw,ubi1_0,/usr/bin/siglent/usr
ubi1_0attached
MOUNT_DIR_NAME = /usr/bin/siglent/usr
TEST_RESTURN = ubi1_0 /usr/bin/siglent/usr ubifs rw,relatime 0 0 /dev/sda1 /usr/bin/siglent/usr/mass_storage/U-disk0 vfat rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
is_fs_mounted 1 --- ubi1_0 /usr/bin/siglent/usr ubifs rw,relatime 0 0 /dev/sda1 /usr/bin/siglent/usr/mass_storage/U-disk0 vfat rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
mount: mounting ubi1_0 on /usr/bin/siglent/usr failed: Device or resource busy
mount_fs: mounted
is_need_upgrade
is_need_upgrade:not need upgrade
check_and_upgrade:end...
++mount_check_copy_appdata: starting
mount_fs: ro,ubi2_0,/usr/bin/siglent/firmdata0
ubi2_0attached
MOUNT_DIR_NAME = /usr/bin/siglent/firmdata0
TEST_RESTURN = ubi2_0 /usr/bin/siglent/firmdata0 ubifs rw,relatime 0 0
is_fs_mounted 1 --- ubi2_0 /usr/bin/siglent/firmdata0 ubifs rw,relatime 0 0
mount: mounting ubi2_0 on /usr/bin/siglent/firmdata0 failed: Device or resource busy
mount_fs: mounted
--mount_check_copy_appdata: ending
-----
I shutdown with power button, power on again, found no change.
I telnet again and found NSP_sn_bandwidth.xml is as before.
I killed ./ecomb, then tried to start ./ecomb8 again.
This time, I saw the following message.
Does anyone advise me what was wrong?
-----
root@am335x-evm:/usr/bin/siglent# ./ecomb8
WARNING: Logging before InitGoogleLogging() is written to STDERR
E1019 10:21:46.518117 883 hw_access.cpp:86] >>>>>CHWAccess::spi2open failed!
E1019 10:21:46.526294 883 hw_access.cpp:109] >>>>>CHWAccess::gpmc open failed!
Segmentation fault
-
The segmentation fault normally occurs when a another instance of ecomb is running.
Is
-
Thanks myexige for your comment. I’m pretty sure that the ‘./ecomb’ process was killed. I have all the operation log in hand and I did check ‘ps’ before and after the ‘kill’ command, and confirmed the ‘./ecomb’ was killed.
My guess is as follows. As I said, my bland new SSA3021X came already with 1.2.9.3a, so I used telnet_11201.ads to restore telnetd. The ecomb loads telnet_11201.ads and start telnetd, then using this telnetd, I killed ecomb. Probably some processes won’t be killed by just killing ‘./ecomb’. This is possibly why there were error messages saying ‘Device or resource busy’ or ‘Segmentation fault’.
So my solution was to restore telnetd by not using ADS, but by creating sym link S15telnetd in /etc/rc5.d pointing to /etc/init.d/telnetd. Then using telnetd startd by /sbin/init, myexig’s script works perfect!!
Now I can play with 3032X. Thanks.
-
Not sure what happened to the rest of my previous post, there was a lot more than that :-DD
Just glad you got it sorted :clap:
-
Hi,
I would like to try to enter the club, but I do lack basic knowledge. I don't "need" to enter the club, but I would like to learn something new, hence my interest and motivation.
I ask help for this:
1) What is the importance of being able to decrypt the "nsp_data_b" file? Is it only important to verify that the correct 3DES key has been found?
2) How is the key calculated based on the serial number? Is it something like name_of_option+serial_number encrypted with the 3DES key or is it a whole lot more complicated?
3) Is the ecomb using a plain 3DES algorithm? Should I be able to use a website like this to test the key: http://tripledes.online-domain-tools.com/ (http://tripledes.online-domain-tools.com/)
3) Did you guys find this out just by looking at ecomb with a HEX Editor or did you actually decompile ecomb?
4) If you did decompile it, could you enlighten me on the process? What decompiler, etc.
5) Can I have the second byte of the key (4E xx)?
Just by looking at the HEX file I found a passage that seems to check if there is a DEVELOPER license? Has anyone checked that out? There is also something that looks like a huge key/password.
Kind regards,
Vitor
-
Hi,
I would like to try to enter the club, but I do lack basic knowledge. I don't "need" to enter the club, but I would like to learn something new, hence my interest and motivation.
I ask help for this:
1) What is the importance of being able to decrypt the "nsp_data_b" file? Is it only important to verify that the correct 3DES key has been found?
2) How is the key calculated based on the serial number? Is it something like name_of_option+serial_number encrypted with the 3DES key or is it a whole lot more complicated?
3) Is the ecomb using a plain 3DES algorithm? Should I be able to use a website like this to test the key: http://tripledes.online-domain-tools.com/ (http://tripledes.online-domain-tools.com/)
3) Did you guys find this out just by looking at ecomb with a HEX Editor or did you actually decompile ecomb?
4) If you did decompile it, could you enlighten me on the process? What decompiler, etc.
5) Can I have the second byte of the key (4E xx)?
Just by looking at the HEX file I found a passage that seems to check if there is a DEVELOPER license? Has anyone checked that out? There is also something that looks like a huge key/password.
Kind regards,
Vitor
1) - For me, none, it was a challenge to exercise my old brain and of course i was interested to see "my" file after the "hack".
2) - Having played around with serial numbers and genuine license files the key is NOT based on serial number alone but what is unique to each SSA is the Host ID so i expect that both values are used as well as the option identifier.
3) - Siglent use a modified version of 3DES and you will find a python script on this thread (or maybe on the ADS format one) which works.
4) - I used IDA Pro V7.2 and Ghidra to disassemble it and then compared the 2 as i'm not clever enough to know if it was correct or not!
5) - Even if i gave you the second byte there are many many occurrences in the file, What i did was to find where in the listing the file was loaded and copied into memory and then decrypted because before decryption the key has to be loaded ;)
Read up on DES and search for the permutaion tables etc, the disassembled list will give xrefs to functions that use them so its a case of following the flow!
-
@Vitor,
The 3DES keys that myexige found have nothing to do with "licenses". The keys are used only in decrypting the .ADS files (or nsp_data_b, etc).
You can see them in ecomb with a hex editor. So, finding/using them is a good admission test to the club (1st grade).
-
So, finding/using them is a good admission test to the club (1st grade).
I'm still in pre-school :-DD
-
Hello,
I have a SSA 3021X that I was trying to unlock using the steps in post "Reply #504" of this thread. I did not receive any errors as I followed the steps until I started ecomb8, the output of which is below. When I got to the System Info screen it shows I am running 1.2.8.3 but I still have the SSA3021X model and the licenses are still temporary. When I restart the analyzer it comes back up in the 1.2.9.2.a version with the temporary licenses.
I do see an error in the log below where it tied to mount the firmdata0 folder and failed but I am not sure if this is the cause of the issue or not.
Any help would be appreciated.
Louis
root@am335x-evm:/usr/bin/siglent# ./ecomb8
check_and_upgrade:starting...
mount_fs: rw,ubi1_0,/usr/bin/siglent/usr
ubi1_0attached
MOUNT_DIR_NAME = /usr/bin/siglent/usr
TEST_RESTURN = ubi1_0 /usr/bin/siglent/usr ubifs rw,relatime 0 0 /dev/sda1 /usr/bin/siglent/usr/mass_storage/U-disk0 vfat rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
is_fs_mounted 1 --- ubi1_0 /usr/bin/siglent/usr ubifs rw,relatime 0 0 /dev/sda1 /usr/bin/siglent/usr/mass_storage/U-disk0 vfat rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
mount: mounting ubi1_0 on /usr/bin/siglent/usr failed: Device or resource busy
mount_fs: mounted
is_need_upgrade
is_need_upgrade:not need upgrade
check_and_upgrade:end...
++mount_check_copy_appdata: starting
mount_fs: ro,ubi2_0,/usr/bin/siglent/firmdata0
ubi2_0attached
MOUNT_DIR_NAME = /usr/bin/siglent/firmdata0
TEST_RESTURN = ubi2_0 /usr/bin/siglent/firmdata0 ubifs rw,relatime 0 0
is_fs_mounted 1 --- ubi2_0 /usr/bin/siglent/firmdata0 ubifs rw,relatime 0 0
mount: mounting ubi2_0 on /usr/bin/siglent/firmdata0 failed: Device or resource busy
mount_fs: mounted
--mount_check_copy_appdata: ending
$Task start:: SCPI
$Task start:: USBTMC
route: SIOCADDRT: Invalid argument
$Task start:: Devce
vxi11_main = 799413
Error[module:ui_task func:ui_if_display_wm line:00177]:: hwin is 0
$Task start:: Udisk&Lan
offse == 0, pos == 6, freq1 == 9300.0, g_caliTg[offset].freq1 = 9300000.000000
offse == 0, pos == 8, freq2 == 589300.0,g_caliTg[offset].freq2 = 589300000.000000
offse == 0, pos == 1, att == 3 ,g_caliTg[offset].att == 3
offse == 1, pos == 8, freq1 == 589300.0, g_caliTg[offset].freq1 = 589300000.000000
offse == 1, pos == 9, freq2 == 1249300.0,g_caliTg[offset].freq2 = 1249300000.000000
offse == 1, pos == 1, att == 4 ,g_caliTg[offset].att == 4
offse == 2, pos == 9, freq1 == 1249300.0, g_caliTg[offset].freq1 = 1249300000.000000
offse == 2, pos == 9, freq2 == 1439300.0,g_caliTg[offset].freq2 = 1439300000.000000
offse == 2, pos == 1, att == 4 ,g_caliTg[offset].att == 4
offse == 3, pos == 9, freq1 == 1439300.0, g_caliTg[offset].freq1 = 1439300000.000000
offse == 3, pos == 9, freq2 == 1569300.0,g_caliTg[offset].freq2 = 1569300000.000000
offse == 3, pos == 1, att == 5 ,g_caliTg[offset].att == 5
offse == 4, pos == 9, freq1 == 1569300.0, g_caliTg[offset].freq1 = 1569300000.000000
offse == 4, pos == 9, freq2 == 2349300.0,g_caliTg[offset].freq2 = 2349300000.000000
offse == 4, pos == 1, att == 4 ,g_caliTg[offset].att == 4
offse == 5, pos == 9, freq1 == 2349300.0, g_caliTg[offset].freq1 = 2349300000.000000
offse == 5, pos == 9, freq2 == 2889300.0,g_caliTg[offset].freq2 = 2889300000.000000
offse == 5, pos == 1, att == 3 ,g_caliTg[offset].att == 3
offse == 6, pos == 9, freq1 == 2889300.0, g_caliTg[offset].freq1 = 2889300000.000000
offse == 6, pos == 9, freq2 == 2969300.0,g_caliTg[offset].freq2 = 2969300000.000000
offse == 6, pos == 1, att == 3 ,g_caliTg[offset].att == 3
offse == 7, pos == 9, freq1 == 2969300.0, g_caliTg[offset].freq1 = 2969300000.000000
offse == 7, pos == 9, freq2 == 3199300.0,g_caliTg[offset].freq2 = 3199300000.000000
offse == 7, pos == -1, att == 3 ,g_caliTg[offset].att == 3
LoadTgCaliRamData == 3success !!!!!
LoadTgCaliRamData == 4success !!!!!
LoadTgCaliRamData == 4success !!!!!
LoadTgCaliRamData == 5success !!!!!
LoadTgCaliRamData == 4success !!!!!
LoadTgCaliRamData == 3success !!!!!
LoadTgCaliRamData == 3success !!!!!
LoadTgCaliRamData == 3success !!!!!
$Task start:: Buzzer
Error[module:ui_task func:ui_text_tr_set_info line:00299]:: num = 0 not found, parent_hwnd == 468
Error[module:ui_task func:ui_get_menu_info_get_option line:00226]:: the last option is not option num, last option = 0, option num = 3, lang_id = 0, menu hwnd = 104, button id = 3
Error[module:ui_task func:ui_get_menu_info_menu_check line:00358]:: not found menu node, lang_id = 0, hwnd = 110, key_word = math_type
Error[module:ui_task func:ui_get_help_get_button_help line:00460]:: not found button node, lang_id = 0, hwnd = 276, button_id = 4, key_word = button5
Error[module:ui_task func:ui_get_help_get_button_help line:00460]:: not found button node, lang_id = 0, hwnd = 276, button_id = 5, key_word = button6
Error[module:ui_task func:ui_get_text_info_check line:00583]:: not found text node, lang_id = 0, hwnd = 1871, key_word = harmo_dist_thd
Error[module:ui_task func:ui_text_tr_set_info line:00299]:: num = 0 not found, parent_hwnd == 1871
Error[module:ui_task func:ui_get_text_info_check line:00583]:: not found text node, lang_id = 0, hwnd = 1877, key_word = harmo_dist_num
Error[module:ui_task func:ui_text_tr_set_info line:00299]:: num = 0 not found, parent_hwnd == 1877
Error[module:ui_task func:ui_get_text_info_check line:00583]:: not found text node, lang_id = 0, hwnd = 1882, key_word = thd_num
Error[module:ui_task func:ui_text_tr_set_info line:00299]:: num = 0 not found, parent_hwnd == 1882
Error[module:ui_task func:ui_get_text_info_check line:00583]:: not found text node, lang_id = 0, hwnd = 1885, key_word = thd_freq
Error[module:ui_task func:ui_text_tr_set_info line:00299]:: num = 0 not found, parent_hwnd == 1885
Error[module:ui_task func:ui_get_text_info_check line:00583]:: not found text node, lang_id = 0, hwnd = 1888, key_word = thd_ampt
Error[module:ui_task func:ui_text_tr_set_info line:00299]:: num = 0 not found, parent_hwnd == 1888
Error[module:ui_task func:ui_text_tr_set_info line:00299]:: num = 0 not found, parent_hwnd == 1871
Error[module:ui_task func:ui_text_tr_set_info line:00299]:: num = 0 not found, parent_hwnd == 1877
Error[module:ui_task func:ui_text_tr_set_info line:00299]:: num = 0 not found, parent_hwnd == 1882
Error[module:ui_task func:ui_text_tr_set_info line:00299]:: num = 0 not found, parent_hwnd == 1885
Error[module:ui_task func:ui_text_tr_set_info line:00299]:: num = 0 not found, parent_hwnd == 1888
Error: could not insert module /usr/bin/siglent/drivers/cfbcopyarea.ko: File exists
Error: could not insert module /usr/bin/siglent/drivers/cfbfillrect.ko: File exists
Error: could not insert module /usr/bin/siglent/drivers/cfbimgblt.ko: File exists
Error: could not insert module /usr/bin/siglent/drivers/da8xx-fb.ko: File exists
xres=1024,yres=600,bits_per_pixel=16
init_lcd_driver OK g_lcdsize=1228800
$Task start:: UI
LoadTgCaliRefLevelData == 20success !!!!!
Error[module:ui_task func:ui_if_show_wm line:00328]:: hwin is 0
Error[module:ui_task func:ui_if_bring_under_wm_to_top line:00199]:: hwin is 0
^
-
Have you copied the "clean" nsp_data_b as provided by myexige to firmdata0?
-
Originally I did not as I had not made any changes to the analyzer. I did download and copy over the file that you mentioned and I got the same result. The firmdata0 directory listings are below. Any other suggestions?
Thanks,
Louis
Before start of ecomb8:
root@am335x-evm:/usr/bin/siglent# ls -lart firmdata0/
-rw-rw-rw- 1 1000 1000 606 Aug 9 2018 NSP_trends_config_info.xml
drwxrwxrwx 2 1000 1000 4392 Oct 29 2018 calib
drwxrwxrwx 8 1000 1000 680 Oct 26 02:06 ..
-rw-r--r-- 1 root root 425 Oct 26 03:35 NSP_sn_bandwidth.xml
-rwxr-xr-x 1 root root 367 Oct 26 06:38 NSP_system_info.xml
-rwxr-xr-x 1 root root 128 Oct 26 06:38 nsp_data_b
drwxrwxrwx 3 1000 1000 544 Oct 26 06:38 .
After ecomb8 is running:
root@am335x-evm:/usr/bin/siglent/firmdata0# ls -lart
-rw-rw-rw- 1 1000 1000 606 Aug 9 2018 NSP_trends_config_info.xml
drwxrwxrwx 2 1000 1000 4392 Oct 29 2018 calib
drwxrwxrwx 8 1000 1000 680 Oct 26 02:06 ..
-rw-rw-rw- 1 1000 1000 425 Oct 26 03:35 NSP_sn_bandwidth.xml
-rw-rw-rw- 1 1000 1000 367 Oct 26 06:38 NSP_system_info.xml
-rw-rw-rw- 1 1000 1000 128 Oct 26 06:38 nsp_data_b
drwxrwxrwx 3 1000 1000 544 Oct 26 06:38 .
-
it shows I am running 1.2.8.3
Firmware 1.2.8.3 will not work, it HAS to be 1.2.8.1 as this is the only version that creates the license file.
-
Thanks, I am all good now. Moving forward I can install the latest firmware and updated with no issues?
Thanks,
Louis
-
Does anyone know if this hack works on the SSA3021X Plus version or just the non-Plus?
Thanks all
-
Does anyone know if this hack works on the SSA3021X Plus version or just the non-Plus?
Thanks all
From what I've seen it is so far not possible to hack the Plus version, just the older model. I would be very happy to be proven wrong though as I'm trying to decide between models currently!
-
... I'm trying to decide between models currently!
I am also trying to decide between models and this would probably swing me one way or the other.
-
While no one buys it, we'll never know...
But with 200€ difference, I would say it's a no-brainer!
-
I’ve brought a Plus.
-
Have you been able to determine if it's hack-friendly?
-
Have you been able to determine if it's hack-friendly?
Investigation in progress, but looking promising, I will post screenshots later :)
BTW, I brought the unit in a Black Friday sale, so got it around the same price as normal unit. That was before someone posted it was not possible to hack the Plus versions, doh!
-
Try this script to open telnet port 10101.
-
Before and after screenshot of EMI and AMK unlocked. Will post proper photo of bandwidth mod once complete.
-
Update with all options unlocked and 3.2 GHz
-
That is most excellent. I wish I had seen the Black Friday sale you're referring to!
-
That is most excellent. I wish I had seen the Black Friday sale you're referring to!
Obviously I could have brought the normal version cheaper too, but very pleased with the end result.
-
Obviously I could have brought the normal version cheaper too,........
Yeah but for a couple of hundred bucks extra the SSA3kX Plus models now have touch display, mouse and keyboard support, webserver and Modulation Analysis, any of them are worthy of the increased price IMHO.
These improvements brings SSA3kX into line with the later SVA1kX SA/VNA models that already have all these features.
Enjoy your SSA3032X+ ! :)
-
Obviously I could have brought the normal version cheaper too,........
Yeah but for a couple of hundred bucks extra the SSA3kX Plus models now have touch display, mouse and keyboard support, webserver and Modulation Analysis, any of them are worthy of the increased price IMHO.
These improvements brings SSA3kX into line with the later SVA1kX SA/VNA models that already have all these features.
Enjoy your SSA3032X+ ! :)
Indeed, exactly my reasoning :)
-
Great to hear that it's possible to do the same with the SSA3021X+, got one here.
-
How are you using the telnet script?
You simply need to copy the telnet file to a USB drive, then perform a fake firmware update from that file.
Leave the update running, and you can telnet to port 10101, password can be found by searching the forum.
-
... will all the options remain permanent as they are now ?
Yes.
So updating from Ver 1.2.9.2.a on an unlocked unit to ver 1.2.9.3a is just a case of doing a normal firmware update as if the unit had never had it's options unlocked? Sounds to easy :)
Thanks
-
With FW v1.2.9.3a the telnet access has been removed.
This means that you can no longer apply the common hack - unless you apply the pseudo FW file made by fellow forum member tv84. This file will be read and executed by the SSA as if it was a FW update, but the script really just temprarily reactivates the telnet daemon, allowing the hack to by applied once again.
Hope this clears this up.
Regards,
vma
-
With FW v1.2.9.3a the telnet access has been removed.
This means that you can no longer apply the common hack - unless you apply the pseudo FW file made by fellow forum member tv84. This file will be read and executed by the SSA as if it was a FW update, but the script really just temprarily reactivates the telnet daemon, allowing the hack to by applied once again.
Hope this clears this up.
Regards,
vma
Thanks, I got it. I think I will skip the update. The sorting option is nice but nothing else is really all that usefull.
Regards
Rob
-
I think I will skip the update. The sorting option is nice but nothing else is really all that usefull.
Maybe....if you have considerable SA experience .....
Just the addition of the UNCAL warning in V1.2.9.3a warrants installation IHMO.
'Select All' in the file system is another very handy addition let alone the few measurement bugs that have also been fixed.
Link to V1.2.9.3a release notes:
http://siglentna.com/wp-content/uploads/dlm_uploads/2019/05/SSA3000X-Firmware-Revise-History-Update-Instructions.pdf (http://siglentna.com/wp-content/uploads/dlm_uploads/2019/05/SSA3000X-Firmware-Revise-History-Update-Instructions.pdf)
-
I have my SSA3032X at fw 1.2.9.1, HW is 07.03.00 and SW2 says 20180320-1.
I have all options enabled and the serial is displayed as XXX... unfortunately I do think I lost the original memory dump files in a pendrive that was misplaced :/
What is the wisest way to approach an upgrade? Will the options be unlocked still after upgrading or there are known caveats?
-
Update with all options unlocked and 3.2 GHz
I was able to unlock all of the options on my 3021X Plus using the rename-x trick and the telnet.ADS. I also added to NSP_system_info.xml:
<license><_3032>TRUE</_3032><_3021>FALSE</_3021><_TG>TRUE</_TG><_EMI>TRUE</_EMI><_Meas>TRUE</_Meas><_CAT>TRUE</_CAT></license>
However, I'm still not upgraded to 3.2GHz. I'm confused on what the proper way to do that on the newest Plus firmware is. Version (FW. 2.2.1.2.5) Does anyone know? I'm pretty familiar with Linux.
Thank you.
[attach=1]
[attach=2]
-Brian
-
Hi btierney,
amazing. How did you do that exactly? Can you tell me a bit more?
I try this since 3 Weeks but when I rename the file with the x-trick the apllication seems not to start anymore.
Do you still have a serial-number? How did you get to manage this?
The only difference was, that my licenses were expired when I started doing this.
Do you have any more information on that?
Would be really helpful.
-
I did still have my serial number after renaming the NSP_sn_bandwidth.xml to NSP_sn_bandwidthx.xml and I think NSP_system_info.xml to NSP_system_infox.xml as well. I've tried so many different combinations that I'm not 100% sure what all I did now. I was able to get 3.2GHz working as well, but now my model number is "none" and my serial number is all X. I think I did that by doing the above and then renaming nsp_data in firmwar0 and backup folders to something else. I have backups of everything before I started, so I may try to put it back and get the 3.2GHz without messing up the Serial and Model numbers.
Thank you.
-Brian
-
I received my 3021 Plus in the mail today and have all the options unlocked and permanent, retained my SN but it's still a 3021X Plus, not the 3032X Plus.
Any pointers are appreciated!
SW1: 2.2.1.2.3r1
What I did:
- Telnet'ed in using putty, over LAN
- Modified the NSP_system_info.xml to have the license line
- Renamed NSP_system_info.xml to NSP_system_infox.xml
- Renamed NSP_sn_bandwidth.xml to NSP_sn_bandwidthx.xml
- sync, power switch reboot, System->Pwr On/Reset->Reset & Clear, power switch reboot
- I didn't do anything with the telnet.ads script
-
I received my 3021 Plus in the mail today and have all the options unlocked and permanent, retained my SN but it's still a 3021X Plus, not the 3032X Plus.
Any pointers are appreciated!
SW1: 2.2.1.2.3r1
What I did:
- Telnet'ed in using putty, over LAN
- Modified the NSP_system_info.xml to have the license line
- Renamed NSP_system_info.xml to NSP_system_infox.xml
- Renamed NSP_sn_bandwidth.xml to NSP_sn_bandwidthx.xml
- sync, power switch reboot, System->Pwr On/Reset->Reset & Clear, power switch reboot
- I didn't do anything with the telnet.ads script
Don't think you need it for the first release (factory) firmware for Plus models and as there's only V2.2.1.2.5 available online don't be tempted to update it or you'll not be able to roll the FW back to 2.2.1.2.3r1.
-
Mine came from the factory with V2.2.1.2.5 and no Telnet. The old script did work, though, so that's good.
-
Mine came from the factory with V2.2.1.2.5 and no Telnet. The old script did work, though, so that's good.
Are you referring to the telnet.ads script (is that just for providing telnet capability)? I recall seeing an upgrade.sh script as well.
-
Yes. It was SSA3000X_Plus_telnet.ADS.
-
Any of the SSA3000X-Plus owners brave enough to follow the forum slogan and do a teardown review of his instrument? ;)
I'ld love to see the hardware differences to the "non-Plus" version and the similarities to the SVA1032X ...
-
Hi All,
I have a SSA3021X which has been upgraded to v1.2.9.3a. I have created a USB and put a copy of ecomb from v1.2.8.1, basline nsp_data_b, a NSP_system_info.xml (with my serial and the license options set) and a copy of telnet_11202.ADS.
Do the 'upgrade' trick with telnet_11202.ADS and I can telnet in (port 23) no problem.
I then go through the Oct 4th post of 'myexige' ...
mount -o remount, rw /
cd /usr/bin/siglent
killall ecomb
cp /usr/bin/siglent/usr/mass_storage/U-disk0/ecomb8 ecomb8
mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
cd firmdata0
cp /usr/bin/siglent/usr/mass_storage/U-disk0/NSP_system_info.xml NSP_system_info.xml
cp /usr/bin/siglent/usr/mass_storage/U-disk0/nsp_data_b nsp_data_b
cd ..
./ecomb8
... and when I run ecomb8, all I get is ...
WARNING: Logging before InitGoogleLogging() is written to STDERR
E0111 10:41:10.170817 933 hw_access.cpp:86] >>>>>CHWAccess::spi2open failed!
E0111 10:41:10.179559 933 hw_access.cpp:109] >>>>>CHWAccess::gpmc open failed!
check_and_upgrade:starting...
mount_fs: rw,ubi1_0,/usr/bin/siglent/usr
ubi1_0attached
MOUNT_DIR_NAME = /usr/bin/siglent/usr
TEST_RESTURN =
is_fs_mounted 0 ---
At which point the Telnet session becomes unresponsive and nothing else happens!
So, my question is ... are the hw_access.cpp failures normal? Why does TEST_RESTURN = is_fs_mounted 0 --- ??
Is there some thing that I've missed (something else that needs mounting??) or extra that needs doing? does something else need killing? do I need to issue a sync?
If I unplug the USB stick and reboot the SSA runs as it used to (same Model, same Options status, serial number still ok)!
TIA, Simon.
-
@sjb:
Make sure to use the nsp_data_b file from message 748 (october 12).
-
@fact, yep I'm already using that.
I went back in an renamed (appended the x) the files in /firmdata0 and /backup (to move them out the way in case they were posing a write issue) before adding the baseline nsp_data_b (from #748) and NSP_system_info.xml (with my serial number in it, from post #737) and I got the same results with respect to ./ecomb8. Also tried a 'sync' before running ecomb8 to ensure that the changes had been committed from cache to to disc.
However, I now have a SSA3032X (All Option) with XXXXXXX as the serial number, so the regen of the license files did not happen, but it does seem to have opened up the SSA!
Still would like to figure out what is wrong with regen of the license files and why ecomb8 hangs! Maybe @tv84 or @myexige might have some thoughts on it.
-
Still would like to figure out what is wrong with regen of the license files and why ecomb8 hangs!
Read this (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg2746898/#msg2746898) carefully and execute.
-
Thanks @tv84.
If you're refering to ... "So my solution was to restore telnetd by not using ADS, but by creating sym link S15telnetd in /etc/rc5.d pointing to /etc/init.d/telnetd. Then using telnetd startd by /sbin/init, myexig’s script works perfect!!"...
So, how do you go about this 'link' in novice (to linux) terms. i.e. is it a script, file, or what? Sorry, it may seem quite straight forward to you guys, but I'm only used to Windows OS and embedded RTOS systems (not linux), so please be gentle!
TIA.
-
Thanks @tv84.
If you're refering to ... "So my solution was to restore telnetd by not using ADS, but by creating sym link S15telnetd in /etc/rc5.d pointing to /etc/init.d/telnetd. Then using telnetd startd by /sbin/init, myexig’s script works perfect!!"...
So, how do you go about this 'link' in novice (to linux) terms. i.e. is it a script, file, or what? Sorry, it may seem quite straight forward to you guys, but I'm only used to Windows OS and embedded RTOS systems (not linux), so please be gentle!
TIA.
ln -s /directory/sourcefile /directory/linkname
-
Thanks all,
logged in using telnet from the telnet_11201.ADS (upgrade) and then ran ...
mount -o remount, rw /
cd /etc/rc5.d
ls -al
ln -s ../init.d/telnetd S15telnetd
sync
Rebooted the SSA and logged in using the builtin telnet (still there from earlier firmware version), then did the license gen process again using ecomb8 ... and BINGO! :-+
SSA3032X, All option permanent, with my serial number on the System Info page.
Thanks all :) ...
-
Hi,
I just got a Siglent SSA3021X
It has Firmware version: 1.2.9.2.a
After reading almostbthe entire topic, i was getting really confused :-)
So i am asking rather before doing something wrong....
What is the best current way of “upgrade” for having all the options?
Thanks!
-
TO TURBOTOM AND THE LINUX EXPERTS
Guys,
My older SSA3021 came with HW 07.03.00 and SW1 is still 1.2.8.2 - no updates. I did get a key from Siglent when the TG option became free and installed that so my TG is now Valid and Permanent. The Refl, AMG & EMK are still only temporary though. I was finally able to copy some back up files to a new formatted 32Gb thumbdrive. The 64Gb didn't work.
My SSA3021 did not have the "NSP_system_info.xml file but something almost identical called "NSP_sn_bandwidth.xml". I compared both files in Notepad and they follow the same format.
I was reluctant to try the final hack as directed in Post #71 because the file sizes and names were different. I attached my "NSP_sn_bandwidth.xml" file on this post to see if that should be modified. Or should I just rename your "NSP_system_info.xml" from (Post #71) with my serial number in it. In both files the serial number is 14 characters long. Also tried this: root@am335x-evm:~# ls /usr/bin/siglent/upgrade/ and it returned: datafs.img & firmdata0.img - two rather large image files - unknown contents.
Your advice would be most appreciated.
TowerSignals
-
Hi,
i just bought a SSA3021X Plus. I read a lot in this thread and i was able to set it to set it to 3.2GHz and to activate some options with the rename x Trick. Now the serialnumber is XX and the device is still named a 3021. There were no xml files in the backup folder. Dont know if thats okay so far, but the reflected measurement is not activated and for some options i havent found any information (rcv,rta, cat). Before i try to update to 2.2.1.2.5 i want to be sure to have tried it with the current firmware. Telnet was enabled in 2.2.1.2.3r. Maybe someone with a 3021X+ can tell his experience.
Many thanks in advance, regads Hecke
-
Hello, everybody,
I have read this thread several times and I am not sure how to update my SSA3021X to the SSA3032X.
Unfortunately my english is not good.
My SSA3021X has the following version:
SW1 1.2.9.1
SW2 20180320-1
SW3 000000D1
HW 07.03.00
Can someone please help me to update ssa3032x step by step?
Thanks a lot.
Greetings Wolfgang
-
Hello, everybody,
I have read this thread several times and I am not sure how to update my SSA3021X to the SSA3032X.
Unfortunately my english is not good.
My SSA3021X has the following version:
SW1 1.2.9.1
SW2 20180320-1
SW3 000000D1
HW 07.03.00
Can someone please help me to update ssa3032x step by step?
Thanks a lot.
Greetings Wolfgang
Hi Wolfgang,
i was able to modify mine following post #597 of this treat.
Regards
Rodrigo
-
Hello, Rodrigo,
thank you very much for the info, this was the right way! ;D ;D ;D
The extension to 3.2 GHz worked, all options are enabled 8)
[attach=1]
One more question: Can I install the latest update 1.2.9.3a with the serial number xxxx ?
And has anyone already recalibrated the SSA?
The Spectrum goes up slightly above 2 GHz.
[attach=2]
Thanks again to Rodrigo!
Many greetings
Wolfgang DD1WKS
-
Hi everybody,
I would like to know if the hack can be work with the last version of SSA3021X plus ?
I don't know witch last version of the firmeware is actualy.
And I would like also to know, if I can remove hack, if I must do repair It
Thanks :)
-
Hello all,first thanks a lot for information from forum, i have a brand new ssa3021x with FW 1.2.9.3a (without telnet access).
I used telnet_11201.ads, it stopped at 60% and i went with telnet into system.
Done a backup with dumpnand and hacked with
rename the NSP_sn_bandwidth.xml in NSP_sn_bandwidthx.xml in firmwar0 and backup folder
sync
logout
power off/on
go in system ----pwr on/preset----- reset&clear ----- a.s.o.
In system info i saw al options valid permanent and ser.nr. only xxxxxxxx
All ok
After this, i decided to make the ser,nr. in system info
logged in using telnet from the telnet_11201.ADS 60% and then run telnet 192.168. …..
mount -o remount, rw /
cd /etc/rc5.d
ls -al
ln -s ../init.d/telnetd S15telnetd
sync
reboot
Power off/on
Now i have permanent telnet access.
New USB stick with 3 files ecomb8 – NSP_system_info.xml – nsp_data_b
This files i got from ecomb FW 8.1, the other from this forum and i installed my ser.nr. in NSP_system file
telnet 192.168. and so on
mount -o remount, rw /
cd /usr/bin/siglent
killall ecomb
cp /usr/bin/siglent/usr/mass_storage/U-disk0/ecomb8 ecomb8
mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
cd firmdata0
cp /usr/bin/siglent/usr/mass_storage/U-disk0/NSP_system_info.xml NSP_system_info.xml
cp /usr/bin/siglent/usr/mass_storage/U-disk0/nsp_data_b nsp_data_b
cd ..
./ecomb8
result is: all option are valid permanent and my ser.nr. is visible in system information.
But i have a problem
I dont know if it is really valid permanent. I can see 3,2ghz and If i press the
mode key i see spec analyser and reflection meas for selection. I have not checked if it works.
but if i press file key i see nothing no file i believe this is not correct, there i expect some files.file menu bar is away for working in optionvalid permanent mode
what is wrong in my system? Has anyone an idea? Was the hacking steps not correct?
What is with the entry in rc5.d i have done S15telnetd, but is S10 correct?
Info from forum:
„So my solution was to restore telnetd by not using ADS, but by creating sym link S15telnetd in /etc/rc5.d pointing to /etc/init.d/telnetd. Then using telnetd startd by /sbin/init, myexig’s script works perfect!!"...
The information i dont understand : Then using telnetd startd by /sbin/init
Is this info important for using telnet without stick FW 11201.ads?
i am not a linux operator, sorry
Regards
pievke
-
I just got my ssa3021X PLUS and did the change. If you want it to show ssa3032X plus you need to edit the file nsp_trends_info.xml. Just change the numbers by type 1 and type 2. See below
<?xml version="1.0" encoding="UTF-8"?>
<nsp_trends_info_root>
<device>
<language>english</language>
<pid>0x1305</pid>
<vid>0xf4ec</vid>
<product_type_1>SSA3032X Plus</product_type_1> change to SSA3021
<product_type_2>SSA3021X Plus</product_type_2> change to SSA3032
<manufacturer>Siglent</manufacturer>
<Support_Touch_Flag>1</Support_Touch_Flag>
<Support_VXI11_Flag>1</Support_VXI11_Flag>
<file_prefix>CP_</file_prefix>
</device>
</nsp_trends_info_root>
For the reflection option you need to upgrade to the newer firmware.
regards, techneut
;
-
Hi Guys.
Is it possible to hack SSA3021X to SSA3032X with 1.3.9.5 software version? Thanks.
-
Anyone know if 2.1 -> 7.5 is possible on the plus?
Just got mine and enabled all.. tried a few lazy hacks but nothing interesting returned, functions still capped at 3.2
Interestingly a 3075 tag also enabled 3.2 so i wouldnt say its completely invalid
I'll eventually clone it to a flash drive and look deeper but really all i am interested in was the emi module and already got it lol
-
Interestingly a 3075 tag also enabled 3.2 so i wouldnt say its completely invalid
That I find it hard to believe.
Did you tried after configure a "tag" for 2.1 or 3.2? Because what must have happened is: unaccepted and the last valid remained.
-
Interestingly a 3075 tag also enabled 3.2 so i wouldnt say its completely invalid
That I find it hard to believe.
Did you tried after configure a "tag" for 2.1 or 3.2? Because what must have happened is: unaccepted and the last valid remained.
Ah your right, so where is it caching the last known valid?
-
Ah your right, so where is it caching the last known valid?
In some config file. The "tags" get translated to other places internally when correctly applied. But I've forgotten these inner works...
-
After looking at this some more they really thinned down the places it could be lurking, most of the system is now using cram making a read only file system with only a handful of exceptions like the siglent directory. So you can make onetime changes and recompile a cram image but would have to do it for each firmware release as they just reimage it with their new one that would then be unmodded.
Was mainly looking at seeing if ssh could be kicked on, they left evidence of having had dropbear on there at one time. Thinking of making a custom cram image to perma enable telnet but this telnet script ads file works just as well to do whatever
/dev/root / cramfs ro,relatime 0 0
devtmpfs /dev devtmpfs rw,relatime,size=69852k,nr_inodes=17463,mode=755 0 0
none /proc proc rw,relatime 0 0
none /sys sysfs rw,relatime 0 0
none /tmp tmpfs rw,relatime 0 0
none /dev/pts devpts rw,relatime,gid=5,mode=620 0 0
ubi1_0 /usr/bin/siglent ubifs ro,relatime 0 0
ubi2_0 /usr/bin/siglent/firmdata0 ubifs ro,relatime 0 0
ubi3_0 /usr/bin/siglent/log ubifs rw,relatime 0 0
ubi0_0 /usr/bin/siglent/usr ubifs rw,relatime 0 0
none /sys/kernel/debug debugfs rw,relatime 0 0
-
First post! Just want to thank all of you for the help you provide. Thanks to this forum I now have a hacked Rigol MSO5074 and now a hacked Siglent SSA 3021X!
Now I can really start to play with the analyzer, I've been keeping the play time down to a minimum because I didn't want to use up all the free time on the options.
:-+
-
1Hz and 3MHz resolution bandwidth lost?
Hi all. After upgrading successfully to latest firmware 1.2.9.3a and hack my 3021X to fully serialized permanent options I have noticed that I lost the 1Hz and 3 MHz RBW and VBW in the Easy Spectrum latest version starting from 10Hz. up to 1Mhz.
In manual mode by the way RBW goes from 1Hz to 1MHz (loosing the 3Mhz) while VBW goes fully from 1Hz to 3MHz.
Is it correct or am I missing some useful info??
Regards and thanks for the great work and info.
Steve
-
1Hz and 3MHz resolution bandwidth lost?
Hi all. After upgrading successfully to latest firmware 1.2.9.3a and hack my 3021X to fully serialized permanent options I have noticed that I lost the 1Hz and 3 MHz RBW and VBW in the Easy Spectrum latest version starting from 10Hz. up to 1Mhz.
In manual mode by the way RBW goes from 1Hz to 1MHz (loosing the 3Mhz) while VBW goes fully from 1Hz to 3MHz.
Is it correct or am I missing some useful info??
Regards and thanks for the great work and info.
Steve
The specs for the SSA3021X only show 3MHz on VBW, and 1MHz on RBW, unless there was a firmware update to expand it?
I have a SSA3021X Plus (opened up), and it only goes to 1MHz on RBW and VBW which matches the specs. Think I'm losing out here :(
I'll install Easy Spectrum and see if I lose the 1Hz.
-
Have installed Easy Spectrum, and confirm that you lose the 1Hz option for RBW and VBW.
-
EasySpectrum only uses SCPI commands of the SSA3021X. It will not allow more or less functionality, measurement-wise, than what's active on your device.
However, it has hardcoded inside the possible RBW values: it does not matter if your specific SSA3021X has more or less RBW options - you can only select what's in the ComboBox!
This means that the lack of RBW options has nothing to do with licensed options or an applied hack. These are the options the programmer of EasySpectrum put in the ComboBox.
Regards,
Vitor
-
Here's a screenshot of the message I get if I try to reduce the resolution bandwidth below 30kHz while the tracking generator is turned on. Since the message only appears for a relatively short time, and it isn't possible to save the screen with the message directly on USB-Stick, the photo with my cell phone didn't turn out too well. Anyway, it's readable. Yet, I don't understand why there's the lower limit for RBW with the TG open. Rigol's DSA800TG series hasn't got this shortcoming.
Cheers,
Thomas
With TG minimum RBW is 30kHz. (this is also most narrow filter what can not go to FFT mode)
What is problem with it? Do it have too fast response or what?
Here is one small example, Nominal center frequency 21.953MHz, width ~3.5kHz Band Pass filter. (in this example filter under test have problem)
With RBW30 also used Span is 30kHz! (note also used VBW)
With TG there is some DUT between TG output and SA input. This is your "filter" and it have most relevance, not SA RBW filter.
Of course this 30kHz Span is not limit. If narrow filter under test there can use more narrow Span.
(http://i181.photobucket.com/albums/x2/aghp55/SSA3000X/SSA3k-esku/SSA3000X-21-TG-filter-work.png)
As sidenote here is limits with different RBW widths.
Sweep Span limits using FFT or Sweep (SWP) mode
Spectrum analyzer. (TG Off)
10Hz, FFT 33.83MHz, SWP ---
30Hz, FFT 106.6MHz, SWP 330kHz
100Hz, FFT 318MHz, SWP 3.7MHz
300Hz, FFT 793.6MHz, SWP 33,3MHz
1kHz, FFT 2.1GHz, SWP 371MHz
3kHz, FFT, SWP 2.1GHz
10kHz, FFT, SWP 2.1GHz
Spectrum analyzer + TG in use.
30kHz, FFT ---, SWP 2.1GHz
100kHz, FFT ---, SWP 2.1GHz
300kHz, FFT ---, SWP 2.1GHz
1000kHz, FFT ---, SWP 2.1GHz
I know that this was a while ago but to 10Hz to 33.83MHz option is VERY important to me. Is this only available with the hack? The specs say it has a minimum of 9KHz which is far too high a frequency for us audio people :-)
Or is this not the range?
It's a lot of money to get it wrong.
-
The SSA3021X has a frequency range that goes from 9kHz up to 2.1GHz. It can be hacked to increase frequency range up to 3.2GHz, making it equivalent to the SSA3032X.
But there is no hack to make it work under 9kHz.
Most spectrum analyzers start at 9kHz, btw.!
If you need much less than that, you probably need an audio spectrum analyzer, which is a different category of test equipment. These, however, are mostly obsolete due to high end audio sound cards for computers, which can be combined with software spectrum analyzers that do FFT.
Don't confuse the frequency range with RBW (Resolution Band Width): this can be set from 1Hz up to 3MHz (in predefined steps), depending on the activated options. This is the sample bandwidth of the spectrum analyzer: all values within the set RBW will be averaged into one sample. If you have a span of 100MHz and an RBW of 1MHz, you get 100 samples with the signal average of 1MHz in each sample.
Regards,
Vitor
-
The SSA3021X has a frequency range that goes from 9kHz up to 2.1GHz. It can be hacked to increase frequency range up to 3.2GHz, making it equivalent to the SSA3032X.
But there is no hack to make it work under 9kHz.
Most spectrum analyzers start at 9kHz, btw.!
If you need much less than that, you probably need an audio spectrum analyzer, which is a different category of test equipment. These, however, are mostly obsolete due to high end audio sound cards for computers, which can be combined with software spectrum analyzers that do FFT.
Don't confuse the frequency range with RBW (Resolution Band Width): this can be set from 1Hz up to 3MHz (in predefined steps), depending on the activated options. This is the sample bandwidth of the spectrum analyzer: all values within the set RBW will be averaged into one sample. If you have a span of 100MHz and an RBW of 1MHz, you get 100 samples with the signal average of 1MHz in each sample.
Regards,
Vitor
It is for audio. All the older ones are VERY expensive and might last 3 months then break. I was hoping that I could find a modern one and then use it for other things too. I've tried a couple of PC based ones but they don't seem to do what I need. Any suggestions would be good
-
Hi everyone. I'm new to this site but thanks to everyone who's posted all this useful info.
I successfully modified my SSA3021X and everything looks good - showing as 3032X with all options.
I've since upgraded to v1.2.9.3a and as I've now found out from trawling through the thread, the telnet is no longer available.
Everything else works ok.
I read about loading the telnet.ads but not quite sure which version. Is it the SSA3000X_Plus_telnet.zip file or is that only for the Plus version.
Thanks.
-
I read about loading the telnet.ads but not quite sure which version. Is it the SSA3000X_Plus_telnet.zip file or is that only for the Plus version.
Thanks.
Hi and welcome :)
Afraid I can’t say for sure, as I’ve only got the Plus and use the Plus telnet script. But knowing you need a different one again for the Plus SVA hack, it’s probably best to find the non-Plus telnet version.
-
@tv84
Not a good day. Loaded telnet.ads last night and it started to upgrade, then stuck at 60%.
Still like that this morning so had no option but to power off. Now the TG and Mode light come on but nothing else.
Not booting.
Is there a way out of this potential bricking?
-
@tv84
Not a good day. Loaded telnet.ads last night and it started to upgrade, then stuck at 60%.
Still like that this morning so had no option but to power off. Now the TG and Mode light come on but nothing else.
Not booting.
Is there a way out of this potential bricking?
That’s correct.
Whilst it is that condition you can telnet in. Then reboot when finished. It is not an upgrade in itself.
-
That’s correct.
Whilst it is that condition you can telnet in. Then reboot when finished. It is not an upgrade in itself.
I see - misunderstood the instruction. I have no boot up now so how can I get any further?
-
I have no boot up now so how can I get any further?
Translate please.
-
I have no boot up now so how can I get any further?
Translate please.
If I have no screen and the analyser isn't booting how can I fix it?
-
I have no boot up now so how can I get any further?
Translate please.
If I have no screen and the analyser isn't booting how can I fix it?
There is nothing to fix
This is 'expected' behaviour
The .ADS file tv84 provided is a 'boot' file which starts the telnet service in the SSA (magic for you and me -> always big thanks to tv :-+)
Once you 'boot' this file - the screen sill only have spinning 'hour glass' - because nothing will be booted-up except the telnet service in the SSA
The telnet service is not visible on the SSA screen - it is a 'service' it runs in the background
However - you now CAN use a telnet 'client' (such as PUTTY) - to open a telnet session
If you are familiar with telnet / port numbers and how it all works - then you should be 'good-to-go' ;)
-
If I have no screen and the analyser isn't booting how can I fix it?
Don't boot the SSA with this USB disk inserted! Only do the "update" after the SSA is up and running.
-
If I have no screen and the analyser isn't booting how can I fix it?
Don't boot the SSA with this USB disk inserted! Only do the "update" after the SSA is up and running.
No USB disk inserted.
Sorry to be a pain but the screen is totally black, no hour glass. TG & Mode button lit.
No network service seems to be running so can't use Putty
-
If I have no screen and the analyser isn't booting how can I fix it?
Don't boot the SSA with this USB disk inserted! Only do the "update" after the SSA is up and running.
No USB disk inserted.
Sorry to be a pain but the screen is totally black, no hour glass. TG & Mode button lit.
No network service seems to be running so can't use Putty
Just to be clear ...
1. remove power cord from SSA and ANYTING plugged into USB or Network connector in rear of SSA
2. wait 2 minutes
3. plug-in power cord into SSA
4. observe if 'power button' on front of SSA is illuminated
5. if power button illuminated - press to swith on device
6. do you hear a 'beep' OR see 'anything' on the screen shortly after pressing the 'on' button - is there a SIGLENT logo displayed briefly??
7. does the TG and Mode lights 'remain' lit PERMENANTLY after you power-on?
Report your findings
-
Just to be clear ...
1. remove power cord from SSA and ANYTING plugged into USB or Network connector in rear of SSA
2. wait 2 minutes
3. plug-in power cord into SSA
4. observe if 'power button' on front of SSA is illuminated
5. if power button illuminated - press to swith on device
6. do you hear a 'beep' OR see 'anything' on the screen shortly after pressing the 'on' button - is there a SIGLENT logo displayed briefly??
7. does the TG and Mode lights 'remain' lit PERMENANTLY after you power-on?
Report your findings
Thanks noreply.
1. Power cord and extra cables removed from SSA
2. Waited at least 2 minutes
3. Plugged in power cord
4. Power button illuminated but cycling between full and dimmer brightness
5. Power button pressed - light stays constantly bright
6. No beep or anything on the screen
7. TG and Mode lights remain on permanently
-
Just to be clear ...
1. remove power cord from SSA and ANYTING plugged into USB or Network connector in rear of SSA
2. wait 2 minutes
3. plug-in power cord into SSA
4. observe if 'power button' on front of SSA is illuminated
5. if power button illuminated - press to swith on device
6. do you hear a 'beep' OR see 'anything' on the screen shortly after pressing the 'on' button - is there a SIGLENT logo displayed briefly??
7. does the TG and Mode lights 'remain' lit PERMENANTLY after you power-on?
Report your findings
Thanks noreply.
1. Power cord and extra cables removed from SSA
2. Waited at least 2 minutes
3. Plugged in power cord
4. Power button illuminated but cycling between full and dimmer brightness
5. Power button pressed - light stays constantly bright
6. No beep or anything on the screen
7. TG and Mode lights remain on permanently
OK thanks
4. the fact that power button is illuninated but cycling in brightness is not a good sign :(
Is your power cable inserted into the rear SSA socket 'fully'??
Check another mains power cable (if you have spare) as well as another mains line (not the one you been using) - just to eliminate some obvious things that could cause problem.
5, 6 its obvious that your SSA is not going through boot process at all
7. the fact that TG and Mode stay illuminated immediately after you press 'on' button - is a good indicator that boot loader is not functioning - you are at 'pre boot' stage - TG and Mode ARE illuminated momintarily at power-on (the pre-boot stage) when loader is about to load the software to start your system - after boot process they go off - in your case they stay on all the time - implying that you are 'waiting' to initiate the boot process and its waiting??
Can you exxplain exactly what you did to SSA - since you had a succesful boot and SSA was operational??
-
Just to be clear ...
1. remove power cord from SSA and ANYTING plugged into USB or Network connector in rear of SSA
2. wait 2 minutes
3. plug-in power cord into SSA
4. observe if 'power button' on front of SSA is illuminated
5. if power button illuminated - press to swith on device
6. do you hear a 'beep' OR see 'anything' on the screen shortly after pressing the 'on' button - is there a SIGLENT logo displayed briefly??
7. does the TG and Mode lights 'remain' lit PERMENANTLY after you power-on?
Report your findings
Thanks noreply.
1. Power cord and extra cables removed from SSA
2. Waited at least 2 minutes
3. Plugged in power cord
4. Power button illuminated but cycling between full and dimmer brightness
5. Power button pressed - light stays constantly bright
6. No beep or anything on the screen
7. TG and Mode lights remain on permanently
OK thanks
4. the fact that power button is illuninated but cycling in brightness is not a good sign :(
Is your power cable inserted into the rear SSA socket 'fully'??
Check another mains power cable (if you have spare) as well as another mains line (not the one you been using) - just to eliminate some obvious things that could cause problem.
5, 6 its obvious that your SSA is not going through boot process at all
7. the fact that TG and Mode stay illuminated immediately after you press 'on' button - is a good indicator that boot loader is not functioning - you are at 'pre boot' stage - TG and Mode ARE illuminated momintarily at power-on (the pre-boot stage) when loader is about to load the software to start your system - after boot process they go off - in your case they stay on all the time - implying that you are 'waiting' to initiate the boot process and its waiting??
Can you exxplain exactly what you did to SSA - since you had a succesful boot and SSA was operational??
If you know the IP you set up the SSA to respond to - PLEASE try the following;
Open putty and telnet into the SSA using the IP you set-up and using port 10101 (not the default putty telnet port)
Report your findings
-
1. Power cord and extra cables removed from SSA
2. Waited at least 2 minutes
3. Plugged in power cord
4. Power button illuminated but cycling between full and dimmer brightness
5. Power button pressed - light stays constantly bright
6. No beep or anything on the screen
7. TG and Mode lights remain on permanently
OK thanks
4. the fact that power button is illuninated but cycling in brightness is not a good sign :(
Is your power cable inserted into the rear SSA socket 'fully'??
Check another mains power cable (if you have spare) as well as another mains line (not the one you been using) - just to eliminate some obvious things that could cause problem.
5, 6 its obvious that your SSA is not going through boot process at all
7. the fact that TG and Mode stay illuminated immediately after you press 'on' button - is a good indicator that boot loader is not functioning - you are at 'pre boot' stage - TG and Mode ARE illuminated momintarily at power-on (the pre-boot stage) when loader is about to load the software to start your system - after boot process they go off - in your case they stay on all the time - implying that you are 'waiting' to initiate the boot process and its waiting??
Can you exxplain exactly what you did to SSA - since you had a succesful boot and SSA was operational??
If you know the IP you set up the SSA to respond to - PLEASE try the following;
Open putty and telnet into the SSA using the IP you set-up and using port 10101 (not the default putty telnet port)
Report your findings
Thanks noreply.
As in my earlier comment, I loaded telnet.ads last night and it started to upgrade, then stuck at 60%. At the time I didn't realise that it was waiting for a Telnet connection. Still like that this morning so had no option but to power off. Now the TG and Mode light come on but nothing else.
Before that it was fine with v1.2.9.3a
Tried with different power cable in a different room - still the same.
Tried 23 and 10101 earlier but no connection. It doesn't ping either - not sure if should anyway.
-
Thanks noreply.
As in my earlier comment, I loaded telnet.ads last night and it started to upgrade, then stuck at 60%. At the time I didn't realise that it was waiting for a Telnet connection. Still like that this morning so had no option but to power off. Now the TG and Mode light come on but nothing else.
Before that it was fine with v1.2.9.3a
Tried with different power cable in a different room - still the same.
Tried 23 and 10101 earlier but no connection. It doesn't ping either - not sure if should anyway.
OK thanks for the feedback
Try the following ...
1. Get the file tv84 provided SSA3000X_telnet.zip
2. Extract from this .zip the following file - SSA3000X_telnet.ADS
3. Get a 'clean' FAT32 formated USB (with no other files)
4. Copy the SSA3000X_telnet.ADS to the USB
What we are trying to do here is to 'boot directly from USB' the SSA3000X_telnet.ADS file - so you will have access to telnet - then you will be able to 'fix' everything.
I have not done this myself - so not 100% sure of process
1. either the .ads file has to be 'only one' on USB - so it will boot first .ads
2. the SSA3000X_telnet.ADS needs to be renamed to special 'boot me from usb' name - if there is such a thing
3. there is a KEY sequence you need to press - to force boot from USB
I did read something on forums - explaining the above - but can't recall where
So you can try to 'read' some threads to see how to force boot from USB
At least you now know what needs to be done - we need to 'boot' the SSA3000X_telnet.ADS directly from the USB drive - so you can regain access to telnet.
It looks like you must have corrupted the internal flash when you 'pulled the power' as it was waiting for you to start your telnet client
Your SSA should be fine - once you can restore from backup - then you can start again - but with the knowledge you have now - without any problems :P
OR
Perhaps someone will chime-in with some specific instructions on directly booting from USB .ADS file ;)
-
I suggest to leave the _telnet script aside for now. Because if the filesystem doesnt start, your telnet session will never work.
Try to see if you can reflash a stock FW with the help of bootloader. Don't know if it's possible with the help of the bootloader. But there should be members who can confirm that.
-
Thank you tv84 and noreply.
I'll wait and see if someone can advise on the bootloader scenario.
-
Thank you tv84 and noreply.
I'll wait and see if someone can advise on the bootloader scenario.
I have another untouched SSA3021X here. Is there a way to dump its FW and load it on to the poorly one - unless someone has a copy of a stock FW?
This is assuming that there is a suitable bootloader. I also have the two original directories from before the update hack.
-
I have another untouched SSA3021X here. Is there a way to dump its FW and load it on to the poorly one - unless someone has a copy of a stock FW?
Here is an .ADS that executes this script:
#! /bin/bash
export USBDEV=`df -h | tail -1 | awk '{print $6}'`
for i in `seq 0 1 12`
do
nanddump -f ${USBDEV}/mtd${i} /dev/mtd${i}
if [ $? == 0 ]
then
echo SUCCESS dumping /dev/mtd${i} >> ${USBDEV}/SSA3KDMP.log
else
echo ERROR dumping /dev/mtd${i} >> ${USBDEV}/SSA3KDMP.log
fi
sleep 1
done
sync
sleep 5
reboot
Try it to see if you can do a NAND dump with it.
With the NAND dump you can go in the other SSA via serial port and attempt to restore the NAND. Remember, first you should try to dump it also while on uboot prompt and then, comparing with the previous dump, you should flash only the MTDs that seem problematic. Don't start flashing before you know exactly what you are doing!
As a reference, here is a list of the MTDs you should be dumping:
[ 0.187415] 0x000000000000-0x000000020000 : "SPL"
[ 0.188736] 0x000000020000-0x000000040000 : "SPL.backup1"
[ 0.189948] 0x000000040000-0x000000060000 : "SPL.backup2"
[ 0.191119] 0x000000060000-0x000000080000 : "SPL.backup3"
[ 0.192293] 0x000000080000-0x000000260000 : "U-Boot"
[ 0.194221] 0x000000260000-0x000000280000 : "U-Boot Env"
[ 0.195493] 0x000000280000-0x000000580000 : "Manufacturedata"
[ 0.198010] 0x000000580000-0x000003080000 : "File System"
[ 0.217098] 0x000003080000-0x000003680000 : "kerneldata"
[ 0.220689] 0x000003680000-0x000003c80000 : "fpgadata"
[ 0.224311] 0x000003c80000-0x000006e80000 : "firmdata0"
[ 0.246439] 0x000006e80000-0x00000a080000 : "firmdata1"
[ 0.268373] 0x00000a080000-0x000010000000 : "datafs"
EDIT: I removed this .ADS because there are some members reporting bricked SSAs. Without more investigation, I advise you all to not use the previously shared .ADS file.
If you want to dump the NAND, enter via telnet and run the dump script manually.
-
Thank you tv84 and noreply.
I'll wait and see if someone can advise on the bootloader scenario.
I have another untouched SSA3021X here. Is there a way to dump its FW and load it on to the poorly one - unless someone has a copy of a stock FW?
This is assuming that there is a suitable bootloader. I also have the two original directories from before the update hack.
First step, open it up and attach to the uart port then paste here what it outputs to your terminal
Thats going to say what road you are about to go down
Edit: Poor wording, open the broke one and do the needful
-
I'll wait and see if someone can advise on the bootloader scenario.
No harm in getting into alternative way to recover your SSA
- but there is a specific way you can do this via recovery boot (USB)
- my Siglent contact is currently unavailable
- I have tried to get in touch during the last 24 hours to discover the best way to do this
- unfortunately still waiting :(
BUT perhaps tautech can 'chime-in' and could PM you with specific instructions on the recovery procedure??
OR if allowed
- post the procedure for others here in the forum to make note
- in case we find ourselves in the same situation :P
-
I'll wait and see if someone can advise on the bootloader scenario.
No harm in getting into alternative way to recover your SSA
- but there is a specific way you can do this via recovery boot (USB)
- my Siglent contact is currently unavailable
- I have tried to get in touch during the last 24 hours to discover the best way to do this
- unfortunately still waiting :(
BUT perhaps tautech can 'chime-in' and could PM you with specific instructions on the recovery procedure??
OR if allowed
- post the procedure for others here in the forum to make note
- in case we find ourselves in the same situation :P
Thanks noreply.
I'll hang on and see what your Siglent contact says - and tautech as well.
Again, thanks for all the help so far....
-
If memory serves this model has a hidden sd card slot inside that is used to recover from a bad flash.. but i think the last user with a bad flash had to send the unit into siglent's regional hq
and by bad flash, i mean nuking the bootloader as well
-
Hello.It is worth to buy this spectrum analyzer ? My wife will KILL me if she finds out the price |O . I will use it for hobby , ham radio.Is the mod for 3GHz still working ? Sorry if I ask silly question . 73! de YO8SHP
-
Hello.It is worth to buy this spectrum analyzer ? My wife will KILL me if she finds out the price |O . I will use it for hobby , ham radio.Is the mod for 3GHz still working ? Sorry if I ask silly question . 73! de YO8SHP
If you are going to burn you might as well get the plus model that is secretly a sva.. and is only 200 more
-
Hello.It is worth to buy this spectrum analyzer ? My wife will KILL me if she finds out the price |O . I will use it for hobby , ham radio.Is the mod for 3GHz still working ? Sorry if I ask silly question . 73! de YO8SHP
If you are going to burn you might as well get the plus model that is secretly a sva.. and is only 200 more
Indeed I have in mind to to buy the plus version if I sell my kidney why not buying this version :-DD .But still I do not have an answer as I read almost all the topic : does the hack still apply ? I understand that the firmware is important...Thanks a lot for help.
-
Thanks a lot.I will program for operation so that I have my kidney removed ( I hope that all know that is a joke ) :-DD Anyway if you will be kind you will help me into hack this beautiful machine.Thank you.
-
Hello friends.I sold my kidney ( JOKE !!! - I borrow money from some friends of mine) so I bought the SSA 3021X PLUS witch I hope will arrive as a "gift" for my birthday.I'm just so happy that i wanted to share with you , and I hope you will help me solve the "problem" with the hack , meanwille I read half of the discussion.Thank you guys , keep safe.73! de YO8SHP.
-
Hi everyone,
I just bought brand new ssa3021x plus with 2.2.1.2.5 fw. and I try telnet option but no response from network. Remote connection is ok as well as web. Maybe telnet is disabled in this fw. So if anyone have any suggestions to upgrade to 3.1Ghz please let me know.
Thnx
-
Hello there my friend.Mine just arrived also.My firmware is also 2.2.1.2.5 and indeed I cant connect via telnet , is seems that we have to do some mods to see our beautifull machins in PUTTY . Maybe some one will help us.I read what we have to do but still i'm stuck.Thank you friends , have a nice day.
-
I'm in the same situation as rozzy in #845 and my device seems bricked now after using the telnet script SSA3000X_telnet of #832. Has anyone found a way to recover the instrument?
When I start it now it just shows the Power, TG and Mode button lit and nothing happens.
-
I want to understand how you bricked the SSA.
Was it just by running my telnet.ADS or any operation you did while inside the telnet session?
-
Thank you Rozzy for the quick reply and the link to the update files. I just gave it a shot with the USB files but that doesn't seem to work. When I switch the instrument on with the USB drive attached it doesn't seem to be doing anything, Mode and TG buttons are lit and that's it.
I'll have to see if I can open it up without voiding warranty, otherwise I'll return it.
To tv84's question: I downloaded the file of #832, put it on a USB drive and then initiated the update in the system menu. Then the device seemed stuck at 60%. I tried to log in via telnet and port 10101 but that didn't work. So I restarted the device (which is probably where I went wrong). At that point it was bricked.
-
To tv84's question: I downloaded the file of #832, put it on a USB drive and then initiated the update in the system menu. Then the device seemed stuck at 60%. I tried to log in via telnet and port 10101 but that didn't work. So I restarted the device (which is probably where I went wrong). At that point it was bricked.
I think it shouldn't be from the file. BUT, I don't want to facilitate people in bricking their devices so I removed the file. Until I get positive feedback that the file works, I won't make it available again.
Try different USB disks with the USB_recovery.
-
Exactly what I did. As tv84 says, try a variety of usb sticks.
I'm sure the file wasn't at fault as other people have used it successfully.
Hope you fix it
-
I successfully unlocked all options and updated to model SSA-3032X tonight using a combination of posts on this thread. It took a very long time to carefully gather all the details and corrections from many different posts. Since it worked in the end for me, I thought I would share back by consolidating the instructions into one single post. In general, I enhanced @Myexige's original post by adding into the steps what he found later about nsp_data_b file. I also added the Telnet RC file fix to the steps, so everything is in one spot here. Please feel free to make enhancements/corrections/additions, to help others. Here is the process from start to finish that worked fine for me, and others apparently;
NEW PROCEDURE FOR UNLOCK TO PRESERVE SERIAL NUMBER:
A. First, Make Backup Files:
1. Insert USB stick
2. Establish a telnet session with root/ding1234
3. cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
4. cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
5. Sync
2. Start with BOTH of your original "NSP_sn_bandwidth" XML files in place. If you need to, restore them from backup if you tried some previous method to unlock. Once the original files are there, then proceed below:
3. SSA3021X - the final hack?
« Reply #737 on: October 04, 2019, 07:23:07 pm »
Today I hacked my SSA3021X and turned it into a SSA3032X with ALL options permanent AND KEPT MY SERIAL NUMBER, therefore (hopefully) future proofing it against any firmware updates
When I received the unit the installed firmware was 1.2.9.2a which (thankfully) still had telnet access.
Whilst waiting for delivery I read this whole thread 3 or 4 times to get as much information as i could and it has been invaluable, thanks to all who contributed.
Ok, so we know if the "NSP_system_info.xml" from version 7 firmware was edited so that the license info was TRUE that this would open up the analyzer options on that firmware series. Now we are at FW version 8 series, with actual firmware download versions like 1.2.8.1, 1.2.9.2, 1.2.9.3, etc.
Hint....Create a new "NSP_system_info.xml" file using your favorite editor now and make sure it contains YOUR serial number:
<?xml version="1.0" encoding="UTF-8"?>
<nsp_system_info_root>
<device>
<system_information>
<serial_number>
<chip>SSA3xxxxxxxxxx</chip> <<<---- INSERT YOUR SERIAL# HERE!
</serial_number>
<license><_3032>TRUE</_3032><_3021>FALSE</_3021><_TG>TRUE</_TG><_EMI>TRUE</_EMI><_Meas>TRUE</_Meas><_CAT>TRUE</_CAT></license></system_information>
</device>
</nsp_system_info_root>
Copy it to a blank USB stick.
Next step is to obtain a copy of the V8.01 firmware (1.2.8.1) from the Siglent web site, and unzip it into a folder. Also, download the Firmware Converter Tool (that converts a .ADS Firmware File to a .ZIP file from here:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/?action=dlattach;attach=269048 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/?action=dlattach;attach=269048)
Using the "converter tool", Select the Siglent Firmware V01.02.08.01.ADS file that you downloaded and convert it to a ZIP file.
NOTE: IT MUST BE FIRMWARE 1.2.8.1, because we need two files from that specific version to generate a license. NO OTHER VERSION WILL WORK!
The zip file that the above tool creates is fussy and can ONLY be opened with 7-Zip. Extract it with 7-Zip.
In the extracted folder you will find a copy of the main application file "ecomb", copy this to the USB stick and rename it "ecomb8".
Also copy the file nsp_data_b from the extracted folder, onto your USB stick. We will need it below.
BEWARE: That tool is unable to extract a full working zip. But it should be OK to extract the ecomb app and the nsp_data_b file most of the times. Those are the only two files we need from the 1.2.8.1 firmware.
So, while you may get errors opening the zip, ensure that you don't get an error when unzipping the ecomb file or the nsp_data_b file!
Place the USB stick into the SSA and open a telnet session. For the commands below, copy and paste them into your putty telnet window. ( Control-C copy on the windows side, Right-Mouse-Click on the Putty Telnet side. )
Remember, don’t enter the quotation " marks, just the text between them.
Enter "mount -o remount, rw /"
Enter "cd /usr/bin/siglent"
Enter "ps"
You will get a list like this...
PID USER VSZ STAT COMMAND
1 root 1320 S init [5]
2 root 0 SW [kthreadd]
3 root 0 SW [ksoftirqd/0]
4 root 0 SW [kworker/0:0]
…lots more lines here…
719 root 2112 S /usr/sbin/telnetd
726 root 152m S ./ecomb <<<--- ECOMB
727 root 1572 S /sbin/getty 115200 ttyO0
in YOUR list of processes, find "./ecomb" and get the "PID" number, in my case above, it was "726".
Enter "kill -9 726" - not sure if the "-9" is needed but it certainly killed the process.
Or “kill -9 <The Process ID of YOUR ./ecomb>”
Enter "ps" again and make sure "./ecomb" is NOT shown. It MUST NOT be running for the next steps.
Enter "cp /usr/bin/siglent/usr/mass_storage/U-disk0/ecomb8 ecomb8" - This copies "ecomb8" from the USB stick to the "/usr/bin/siglent" directory.
Enter "ls -l" - and make sure it is there.
Enter "mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0"
Enter "cd firmdata0"
Enter "cp /usr/bin/siglent/usr/mass_storage/U-disk0/NSP_system_info.xml NSP_system_info.xml" - this copies the "NSP_system_info.xml" file you created above to "/usr/bin/siglent/firmdata0"
Enter "ls -l" and make sure it is there.
Next: you also need to roll-back (The version) of the "nsp_data_b" file in firmdata0 after the ecomb process has been killed. Roll it back to the version from the 1.2.8.1 FW. Copy it from the USB stick into the "/usr/bin/siglent/firmdata0" directory as follows:
Enter “cp /usr/bin/siglent/usr/mass_storage/U-disk0/nsp_data_b nsp_data_b”
Enter “ls –l” and make sure it is there.
Next,
Enter "cd .." to drop back one level to the "/usr/bin/siglent" directory.
NOW FOR THE FUN PART
Enter "./ecomb8" - Loads of text will appear on the telnet screen, the application will start and will read the "NSP_system_info.xml" file and will automatically create a fully licensed "NSP_sn_bandwidth.xml" file, the application will start up on the SSA and using "System info" you will see that your SSA3021X is now a SSA3032X with all options permanent and with the correct serial number.
Power off the SSA, remove the USB and power it back on, all options will remain and it will be running the correct version of "ecomb"
Don’t forget to backup to USB stick your new "NSP_sn_bandwidth.xml" licensing file.
<START Backup Procedure>
1. Make sure USB stick is still inserted in the analyzer.
2. cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup-NEW
3. cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0-NEW
4. Sync
<END Backup Procedure>
Finally, If you wish to upgrade PAST the 1.2.9.2a Firmware:
PRESERVE TELNET ++BEFORE++ UPGRADING TO FW VERSION 1.2.9.3
Re: Hack of Sigllent spectrum analyzer ssa3021X?
« Reply #752 on: October 13, 2019, 06:00:59 pm »
Easy way to overcome losing telnet before updating to 1.2.9.3a is to create your own symbolic links for the telnet deamon.
e.g.
Enter "mount -o remount,rw /"
Enter "cd /etc/rc0.d"
Enter "ls -al"
Examine the telnet symbolic link, K10telnetd in this case and create your own with a different number, 15 in this example.
Enter "ln -s ../init.d/telnetd K15telnetd"
Enter “cd /etc/rc1.d”
Enter "ln -s ../init.d/telnetd K15telnetd"
Enter “cd /etc/rc6.d”
Enter "ln -s ../init.d/telnetd K15telnetd"
NOW, this next directory uses a little different syntax, it is S15telnetd; ("S" for Start)
Enter “cd /etc/rc5.d”
Enter "ln -s ../init.d/telnetd S15telnetd”
Enter "sync"
Restart the analyzer.
After this, you can safely update to 1.2.9.3a and forward, while preserving telnet access.
-
Hi nealix,
I just received my ssa3021. Version 1.2.9.3a.
Ready to go. Ping works, no telnet on port 10101 (port 23 neither) . How did you solve this? Youre instructions are great and very clear but don't know how to start without telnet.
Should I start with the telnet telnet_11201.ADS file who failed by Tleilax :-- scarry.
Rgds,
Herman
-
Yes. I have not done a unit that came with 1.2.9.3a, but others have. You Start with the telnet_11201.ADS file to get access. Once you get access, install the links per:
=====
Easy way to overcome losing telnet before updating to 1.2.9.3a is to create your own symbolic links for the telnet deamon.
e.g.
Enter "mount -o remount,rw /"
Enter "cd /etc/rc0.d"
Enter "ls -al"
Examine the telnet symbolic link, K10telnetd in this case and create your own with a different number, 15 in this example.
Enter "ln -s ../init.d/telnetd K15telnetd"
Enter “cd /etc/rc1.d”
Enter "ln -s ../init.d/telnetd K15telnetd"
Enter “cd /etc/rc6.d”
Enter "ln -s ../init.d/telnetd K15telnetd"
NOW, this next directory uses a little different syntax, it is S15telnetd; ("S" for Start)
Enter “cd /etc/rc5.d”
Enter "ln -s ../init.d/telnetd S15telnetd”
Enter "sync"
=====
Then, if you reboot/repower, you should come up able to login via telnet. If you can do that, you can upgrade.
You could also at that point down-grade to 1.2.9.2, do the changes, and then upgrade to the latest.
The main key is that you want normal telnet access, and THEN try to do the update.
Another user also mentions that he had to use the nsp_data_b file from @myexige in post #748,
and not the one that I used from the actual 1.2.8.1 firmware. It worked for me just fine, but if yours
does not, you could try the file from post 748.
Neal
-
Hi Neal & others,
I started today. Put the file on a USB stick (Double checked that the stick was ok). Load the file telnet_11201.ADS. It was loaded till 60%. Then it stops.
Wait for 15 minutes. No progress. Escape etc. did'nt work. Every button i pressed gave the message: Please wait for the upgrade to complete.
With putty no telnet access. Ping was ok.
So the only possibility was to power cycle.
Luckely, it came back up to normal. Tried again telnet, no result.
Downgraded to version V1.2.9.1
ping worked. Again no telnet access.
Did run again file telnet_11201.ADS. Still no telnet.
I'm puzzelded. I believe that there is something done to prevent us from hacking :-\
Any suggestions are appriciated.
Thanks,
Herman.
-
:-// The telnet ADS is supposed to hang. You should telnet while it is hanged.
-
Really thanks!
It works!
After running the script and starting putty I used port 23 (not 10101) end pressed several times enter. Then the telnet session was established :D
Then I did exactly what Neal did summerizing in his post.
The ./ecomb8 script however failed.
I followed port 800 to create sym link S15telnetd in /etc/rc5.d pointing to /etc/init.d/telnetd
Then did run ./ecomb8 again & then everything updated as expected.
Rgds,
Herman.
-
Hi tv84,
I unzipped the file SSA3000X_NAND_dump.zip and ran the ADS update
on my new SSA3021X running 1.2.9.3a.
It ran and then dumped 12 files successfully, as reported by the SSA3KDMP.log file. All files are non-zero and contain something.
Now my unit is bricked.
The power button is lit, as well as the TG and MODE buttons.
There is nothing on the display.
Is there any recovery other than trying to send it in?
-
@kakeller1,
I don't know what is happening... :-// But other members have said the same.
For that reason I had already deleted my post where I shared the file.
The script that does the NAND dump (which is inside the .ADS) is attached. So you can see it seems peaceful.
Don't know if it is something with the latest FW units, NAND or something.
I think many guys have used in the script in the past without problems.
My best hint is to try get UART access to see the booting log and try to see the error. (but this involves opening the machine) :(
-
Hi!
Given the problems faced by some users when applying the .ADS, is it possible to alternatively upgrade/convert the SSAX+ via UART (assuming machine is open, of course)? I think it is but I'd prefer to have confirmation in order to ease my buying decision.
Thanks in anticipation!
--
Olivier
-
Given the problems faced by some users when applying the .ADS, is it possible to alternatively upgrade/convert the SSAX+
The problems surrouding the NAND dump script for SSAX has nothing to do with SSAX+ crossflashing! Please don't mix these matters.
-
Given the problems faced by some users when applying the .ADS, is it possible to alternatively upgrade/convert the SSAX+
The problems surrouding the NAND dump script for SSAX has nothing to do with SSAX+ crossflashing! Please don't mix these matters.
Ooops! :) Thanks for clarification, @tv84: my mind were confused as to what version it applied. Sorry for that!
-
Can the Siglent SSA3021X be hacked to SSA3021X with the actual firmware?
-
Yes it can be "upgraded" to a SSA3032X Plus and then "upgraded" to a SVA1032X.
I was able to do this with the helpful folks on here.
Best,
-
Yes it can be "upgraded" to a SSA3032X Plus and then "upgraded" to a SVA1032X.
I was able to do this with the helpful folks on here.
Best,
That is not true!
The question was: "Can the Siglent SSA3021X be hacked to SSA3021X with the actual firmware?"
There are two different modelos:
SSA3021X
SSA3021X Plus
The SSA3021X can be hacked to a SSA3032X with full options, but it cannot be hacked into a PLUS/SVA model, since the hardware is different.
Regards,
Vitor
-
Yes it can be "upgraded" to a SSA3032X Plus and then "upgraded" to a SVA1032X.
I was able to do this with the helpful folks on here.
Best,
That is not true!
The question was: "Can the Siglent SSA3021X be hacked to SSA3021X with the actual firmware?"
There are two different modelos:
SSA3021X
SSA3021X Plus
The SSA3021X can be hacked to a SSA3032X with full options, but it cannot be hacked into a PLUS/SVA model, since the hardware is different.
Regards,
Vitor
Correction the SSA3021X Plus can be upgraded to a SSA3032X Plus which can be expanded to a SVA1032X.
Best,
-
Hi !
I have just carefully read the 36 pages of this thread. I am looking to buy a SSA3021X Plus (which will likely have the latest firmware from factory), to convert it to a SVA1032X. However I could not find the procedure, just someone saying they have done it.
Can someone help me ?
Thanks
[EDIT] Of course after hours of searching, I post the question, and then seconds after posting the question, I finally find the answer here : https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3180754/#msg3180754 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3180754/#msg3180754)
Hope this helps someone else
-
I successfully converted my SSA3021x FW V3.2.2.3.2 Plus to a SVA1032X FW V2.2.1.2.8 with all options.
So far so good and many thanks to all of the guys making this possible. I'm really impressed by the knowledge of some people here. Respect!
At the moment there is just one Question left: What's about going to the SVA FW V3.2.2.3.2? Have somebody done it?
-
Pease... order!
Why this total mess between models.
Please keep SSA3000X Plus (with and SVA1000X) and then whole older SSA3000X models in different threads. This thread is about SSA3000X. Is it difficult? Or is it that fingers are more fast than brains.
They are different instruments!
-
Reading thru the thread makes the limitation to non-plus models not very obvious. There's also another thread about both models where the hacking topic have been swapped out to here.
So, limitation to non-plus models seems to be nothing more that your wish. Sorry!
-
So, limitation to non-plus models seems to be nothing more that your wish. Sorry!
Have you simply read the thread title? If so, where does it contain the word "Plus"?
The fact that in the last 10 posts or so there were some OT regarding the Plus version, which BTW only confuses SSAX newbies, doesn't transform the thread in a Plus version.
Also, your question NOW seem to be of a SVA nature, as such, technically it would be OT in either a SSAX or a SSAX+ thread. "Sorry!"
-
I just gave an answer to the question in #881, wether it is possible to do the hack with the newest possible Firmware or not, because I did it (mainly based on your work, thanks a lot for it).
Sorry!
-
So, limitation to non-plus models seems to be nothing more that your wish. Sorry!
... regarding the Plus version, which BTW only confuses SSAX newbies,
Just and only this what you said - due to reasons.
In worst case some peoples may bric they new instrument due to mess.
I did not mean this just to @Kibabalu but he was just now randomly in front. Overall I wish we try make this bit less messy. 2016, 2017 it was simple due to fact there was only SSA3021X and 3032X.
Now we have SSA3021X and 3032X and then we have different new hardware machines SSA3015XPlus, 3021XPlus, 3032XPlus, 3075XPlus. Then we have VNA's SVA1015X, SVA1032X and SVA1075X and after then real time spectrum analyzers SSA3032X-R 3050X-R and 3075X-R. And perhaps more is coming. Some of these product lines need handle separately for avoid total mess. And more is coming so my opinion is that least around this time now we need organize and arrange these so that they all are not just big messy mix. Later it is more difficult, even now it is difficult.
Specially if we talk about experimental HW/FW changes where always is easy road to make mistake what leads to failures. And much more easy when some newbie is totally messed when all information is here and there and everywhere in nice messy mix with sugar and pepper. Of course we who have been here before beginning can quite easy follow what is what but my concern is newbies or other peoples who do not have so much experience.
I hope no one goes to troubles and permanently or less permanently find themselves with bricked SA.
-
Has anyone successfully upgraded SSA3021X version 1.3.9.5 ? Some of the posts in this thread warn about bricking the unit during the first step of enabling the telnet daemon. I just bought the unit so Id hate to brick it so early in its life. I assume there is no need to perform the upgrade while the unit is new. FWIW a nmap on the device returns:
Starting Nmap 7.60 ( https://nmap.org ) at 2020-10-08 14:25 PDT
Nmap scan report for 10.X.X.220
Host is up (0.90s latency).
Not shown: 998 closed ports
PORT STATE SERVICE
111/tcp open rpcbind
898/tcp open sun-manageconsole
Thank you. Quite an interesting thread.
-
The recent unexplained bricking incidents involved a NAND dump script, not the telnet daemon script. The dump script has been removed and advised against.
I don't remember bricking incidents with telnet daemon but I could be wrong since this SSAX has a mind of its own...
As always, it's your responsibility.
EDIT Nov 5th: It's a fact that the telnet script for SSAX also was bricking the analyzer, in recent FW versions. I removed the file. The situation is recoverable.
-
I just bought one.
Are they still hackable?
I am unclear if I need the option to do "return loss" or can I do it without the option?
-
New Firmware V1.3.9.6
https://int.siglent.com/download/firmwares/?ProId=29 (https://int.siglent.com/download/firmwares/?ProId=29)
-
New Firmware V1.3.9.6
https://int.siglent.com/download/firmwares/?ProId=29 (https://int.siglent.com/download/firmwares/?ProId=29)
Please note this firmware is for the older SSA3000X models only !
7.4 MB
Release notes
This firmware must be upgraded from V1.2.8.1 or later. If your SSA3000X has an earlier version, please update to V1.2.8.1 first and then proceed to update to the latest version.
Fixed the problem unit in TG and the UNCAL condition
Fixed the AVG detector in frequency LOG scale
Fixed the display error with long file name
Fixed some SCPI commands
Fixed the beeper switch
Fixed the .cor file error when recalling it
Add Limit mask offset in frequency and amplitude
-
This firmware deactivated my telnet access. :(
Not that it makes a big difference, but I did like being able to log into my SSA3021X.
@tv84: will your fake FW update that turns telnet on work on devices with this FW or is it necessary to increase the version number? How could I turn telnet back on again?
Regards,
Vitor
-
This firmware deactivated my telnet access. :(
Not that it makes a big difference, but I did like being able to log into my SSA3021X.
Will port 5024 not work ?
From the programming manual:
Standard mode. Available on port 5025. Use this port for programming.
Telnet mode. The telnet SCPI service is available on port 5024.
-
I am referring to the telnet port 23.
SCPI continues to work of course.
-
The telnet upgrade script from here https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/msg1870091/#msg1870091 (https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/msg1870091/#msg1870091)
will brick your SSA to the state that even the recovery package will not work any longer. It wipes out the MLO loader and also the u-boot loader completely.
Port 10101 is also not functioning, in fact the whole SSA is dead after running the script. And yes I did NOT boot the SSA with the USB drive in the SSA.
This is experienced with the latest SSA firmware 1.3.9.6
The symptoms are, no beep, no fan , only the TG light during power up.
I think Siglent does some nasty stuff with these 'update' scripts.
-
That's evil! Did you check the output of the internal UART port?
-
That's evil! Did you check the output of the internal UART port?
Yes, it outputs CCCCCCC at a slow rate.
-
The telnet upgrade script from here https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/msg1870091/#msg1870091 (https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/msg1870091/#msg1870091)
will brick your SSA to the state that even the recovery package will not work any longer. It wipes out the MLO loader and also the u-boot loader completely.
Port 10101 is also not functioning, in fact the whole SSA is dead after running the script. And yes I did NOT boot the SSA with the USB drive in the SSA.
This is experienced with the latest SSA firmware 1.3.9.6
The symptoms are, no beep, no fan , only the TG light during power up.
I think Siglent does some nasty stuff with these 'update' scripts.
Script removed from that msg.
BUT, it's NOT true that it can't be recovered. Member bicurico has just recovered his SSAX after using the bad script.
-
Hi Chaps,
I've had a look at the 1.3.9.6 firmware and there are some interesting SCPI commands including;
BOARDTEST?
CHIP?
DMESg?
IDN-SGLT-PRI?
LICENSE?
LICENSE_ID?
LICENSE_PR?
LOAD:CALI:FILE?
MMEMory:UPLoad?
NET_BRIDGE_ADDR?
REBOOT
SCDP
SGLT-TEST-VAST-DATA?
SVNALL?
:SYSTem:BEEPer:STATe?
:SYSTem:COMMunicate:LAN:GATeway?
:SYSTem:COMMunicate:LAN:IPADdress?
:SYSTem:COMMunicate:LAN:MAC?
:SYSTem:COMMunicate:LAN:SMASk?
:SYSTem:COMMunicate:LAN:TYPE?
:SYSTem:CONFigure:SYSTem?
SYSTem:COUNt?
:SYSTem:DATE
:SYSTem:DATE?
SYSTem:FileSystem:Type?
:SYSTem:LANGuage?
:SYSTem:LKEY?
:SYSTem:LKEY:TIME:RESet <--- this resets the trial licenses to 48 hours
:SYSTem:LOAD:USER:CONFig
:SYSTem:OPTions?
:SYSTem:PON:TYPE?
:SYSTem:POWer:OFF
:SYSTem:PRESet
:SYSTem:PRESet:TYPE
:SYSTem:PRESet:TYPE?
:SYSTem:RESTart
:SYSTem:RST
:SYSTem:TIME
:SYSTem:TIME?
SYSTem:VERSion?
SYSTtem:ERRor?
WEB:PSW?
>nc 99.99.99.250 5024
Welcome to the SCPI instrument 'Siglent SSA3021X'
>>:SYSTem:DATE?
20201105
:SYSTem:PRESet:TYPE?
DFT
:SYSTem:PON:TYPE?
LAST
:SYSTem:COMMunicate:LAN:TYPE?
DHCP
:SYSTem:BEEPer:STATe?
1
:SYSTem:CONFigure:SYSTem?
Model:SSA3021X, Serial Number:SSAblahblahblah, Version:1.3.9.6 ,Firmware:EMI, Meas, TG, RM, ...
:SYSTem:LKEY?
:SYSTem:LKEY:TIME:RESet
Obviously bugger around with these at your own risk...
regards,
pjm
-
Would you be so kind as to share with us how you created (or got) the "SD recovery package", please?
Best regards,
ZPP
-
It appears that the new SSA3021X units are sold with FW v1.3.9.5 installed. This version has never been "published" by Siglent (only the latest v1.3.9.6 has), and it seems to be prone to bricking the SSA when trying to re-enable the telnet - the good old one, as we all love it...).
When scanning for open ports, the result is:
111 (TCP)(rpcbind)
5024 (TCP)
5025 (TCP)
There is also another port which (randomly) appears open: 898 (TCP) / 904 (TCP) / 905 (TCP).
Telnetting the port 5024 opens a connection with the prompt:
>>Welcome to the SCPI instrument 'Siglent SSA3021X'
>>
but only SCPI commands (as described in Programming Manual) are accepted. Telnetting the port 5025 has the same result, but without any prompt.
I've got two questions for you guys:
1. Has anyone tried to upgrade this particular FW version to the newest FW v1.3.9.6?
2. Has anyone tried to downgrade this particular FW version to an older one (ex.: 1.2.8.3, 1.2.9.1, 1.2.9.3a)?
Thanks and regards,
ZPP
-
It appears that the new SSA3021X units are sold with FW v1.3.9.5 installed. This version has never been "published" by Siglent (only the latest v1.3.9.6 has),...
This is not unusual by any means while a more major upgrade is still being developed.
I've got two questions for you guys:
1. Has anyone tried to upgrade this particular FW version to the newest FW v1.3.9.6?
2. Has anyone tried to downgrade this particular FW version to an older one (ex.: 1.2.8.3, 1.2.9.1, 1.2.9.3a)?
Upgrades and downgrade work just fine within the limits of the upgrade instructions in that there are some more major than others that don't permit further downgrades. The full release notes and upgrade instructions in each version list these conditions FYI.
-
Hi all,
I dont have a SSA3021x yet but have the ability to get one.
It depends if it is upgradeable with the hack who is mentioned in this thread.
I know that this Analyzer will be has the latest FW.
Since the telnet_11201.ADS maybe has some issues (bricking) with some FW Revisions,
is it possible to downgrade to a 1.2.8.x with official FW to get telnet access again?.
I don't know exactly at which version telnet was been disabled.
The problem I see is that someone says he has downgraded but not say from which base firmware.
What I would like to know, whether I'm right.
I guess that a downgrade is only possible in the following ranges:
1.2.8.x (1.2.8.1 -> 1.2.8.5a)
1.2.9.x (1.2.9.1 -> 1.2.9.3a)
1.3.9.6 (1.3.9.6- > )
Downgrade from 1.2.9.x to 1.2.8.x is not possible
Downgrade from 1.3.9.x to 1.2.9.x and 1.2.8.x is not possible.
Maybe i am wrong but can someone confirm or correct this?
Regards Chris
-
Chris,
If the price is good and you really want to have the SSA3021X model as opposed to the newer (and more expensive) Plus version, then by all means go for it.
It is still hackable and I am sure you will get the required help if needed. Also, bear in mind that the device might come already hacked (have you checked that?).
Regards,
Vitor
-
Hi,
I have a dumb question:
Is it possible to "upgrade"/hack the SSA3015X Plus or do you need an SSA3021X Plus?
For some odd reason everybody seems to be buying the more expensive 2.1GHz model (SSA3021X Plus) as a base to upgrade it to SVA1032X, instead of the cheaper 1.5GHz model (SSA3015X Plus).
Regards,
Vitor
-
Answer seems to be no:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3191602/#msg3191602 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3191602/#msg3191602)
-
1.5GHz Version differs from 2.1/3.2 and these differs from 7.5..
So no you only can upgrade to SVA1015 with ssa3015x plus.
And if you need 2.4GHz you habe to go for 2.1 and upgrade..
-
Hi,
i own a hacked SSA3021X with FW Version: 1.2.9.1.
Can i update to V1.3.9.6 just by doing the normal Firmware Update process or do i need to do some hacks? (just confused)
-
Yes, you can.
-
Hi all,
I've updated my unit to the latest and greatest firmware 1.3.9.6, and all seems fine so far. This was from version 1.3.9.5 as shipped back from Siglent after a repair. (They moaned like a drain about modified file system / hack etc)
[attachimg=1]
regards,
pjm
-
Hi all,
Whilst looking at the firmware, it seems there is some facilities for a 'web update' - does anyone happen to know if its actually used, or can be triggered through a key combination on boot etc? It appears to POST to the siglent site, download an update .sh file and execute it as root.... If its possible to trigger it, the rest as they say might be history.
regards,
pjm.
PS there is also an add-on license option called "RM" anyone know what that does?
-
Hi guys,
I have a SSA3021X with firmware 1.2.9.3a.
If I want to enable all options I believe I first need to enable telnet access and rename some files?
So I do this via the firmware ADS file here:
https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/msg1870091/#msg1870091 (https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/msg1870091/#msg1870091)
https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/?action=dlattach;attach=1126548 (https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/?action=dlattach;attach=1126548)
I'd love to know if its that simple on the slightly older firmware the device is currently running?
Sorry for the questions.
Kind Regards,
Darrell
-
Darrel ?? are you able to figure any of this out ??
I just got a brand new SSA3021X
sw version 1.3.9.5
its TG is enabled all the time, so at least that is fine.
the 3 other options: 47 hrs left (what crap)
and it is 2.1GHz only..
PLEASE HELP... it is VERY confusing the stuff you people explain here, many different links, and stuff to do..
why not have ONE place ?
with a full updated detailed instruction covering all things we must do, and access to the needed files ??
-
@oz2cpu: The reason is simple... Let me break it down.
1) The hack evolved over time with many people contributing their discoveries.
2) The different hacks changed over time due to Siglents "counter measures".
2) This has all been documented in this thread.
3) The ones contributing have their device hacked and already contributed with their findings. Don't expect them to write noob tutorials.
4) The ones who arrive here just to hack without exploring (or risking to break) their devices, did not spend time to write up such a detailed instruction set as you are requesting (there are some exceptions), after having their devices upgraded.
5) Why don't YOU read all pages and then make said documentation, describing how you did it on your device?
6) Having to spend a couple of hours to read through this thread is a joke compared to the amount of hours it took to get to this point.
Don't get me wrong, but "with a full updated detailed instruction covering all things we must do, and access to the needed files ??" is totally the wrong attitude. If you want an express solution, just purchase the keys from Siglent. That is quick, safe and you keep your warranty.
Otherwise, if you do read through this thread and have questions, you are more than welcome to ask whatever youneed to know.
Regards,
Vitor
-
Hi,
i own a hacked SSA3021X with FW Version: 1.2.9.1.
Can i update to V1.3.9.6 just by doing the normal Firmware Update process or do i need to do some hacks? (just confused)
cnkz, were you able to maintain your unlocks after doing so? Or did the normal firmware update path from a hacked version result in loss of the features?
-
Updating to the latest version shoul dnot change the status of the hack,
You will however for sure lose telnet access, if you still retained it.
There are ways to switch it back on again.
Vitor
-
Thank you Bicurico!
On a second note, do you or anyone know if it would be possible to enable Mouse support for the SSA 3021X (non Plus) via Telnet?
I'm guessing there could be a limitation in that the Plus firmware has completely different UI code that integrates Mouse (probably directly associated with the touch screen support for the touch hardware) and wouldn't be as simple as enabling a USB daemon
-
Hello, my name is Raul. I would like to know if someone keeps the 07.03.00 update. The link is down and there is no way to get it. Thank you.
-
It seems to me you'd want to grab the current FW update just in case it gets pulled. :-\
Not sure if it has opened the hole to allow the upgrade but just in case it has here's the link:
http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA-firmware-0705.rar (http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA-firmware-0705.rar)
~7.5 Mb
Hello, do you still have the update? It is impossible for me to get it, the link is down.
-
All notable SSA3000X updates are here:
https://int.siglent.com/download/firmwares/?ProId=29
SSA3000X Plus updates here:
https://int.siglent.com/download/firmwares/?ProId=48
-
Since upgrading my SSA3021X to firmware v1.3.9.6 (from v1.2.9.3a), whenever I do an EMC frequency scan, the last 2 values of the 751 captured data points (far right of the display) always return the maximum value (+1.069900000E+02) in a SCPI request for trace data!
The peak table always shows them as 106.99 dBuV peaks! Never did this in any previous firmware version.
I can roll back to v1.2.9.3a and all is ok again, upgrade back to v1.3.9.6 and the problem shows again!
Has anyone else seen oddities introduced with v1.3.9.6?
Can anyone test this on their SSA3000X. The SA was in EMI mode and the sweep was set to single. I also get weird UI issues like I seta trace to 'Blank' then enable the peak table and the trace suddenly switches to 'Clear/Write' and re-appears again! It's very odd, and very repeatable.
-
The ADS to ZIP file tool appears to be missing.
-
you say
SSA3000X Plus updates here:
https://int.siglent.com/download/firmwares/?ProId=48
the lates file for my SSA3021X is called
SSA3021_3032XP_V3.2.2.4.0_EN
firmware update just say : System update failed in red.
WHY ?
my SSA is brand new, but its shipped fw is called : 20190610-1
so it come with 2years old sw ??
-
you say
SSA3000X Plus updates here:
https://int.siglent.com/download/firmwares/?ProId=48
the lates file for my SSA3021X is called
SSA3021_3032XP_V3.2.2.4.0_EN
firmware update just say : System update failed in red.
WHY ?
my SSA is brand new, but its shipped fw is called : 20190610-1
so it come with 2years old sw ??
No, that is the SSA3000X Plus firmware and the correct one for your SSA3021X is here:
https://int.siglent.com/upload_file/zip/firmware/Spectrum_analyzer/SSA3000X_1.3.9.6_EN.zip
-
Hi all,
Long time lurker here - I own one of these units. Thanks for all the work done by the forum members.
I have a contribution to add. I've developed a web interface for the SSA3021X, so you can do a screen capture via a web interface straight to your PC (instead of using the USB stick). I find it much more convenient than the USB stick method.
I've attached a zip file to this posting with the files & install instructions.
(https://ibb.co/mhTh3S3)
-
I like it. Very nice. Thanks for posting!
Yes, it is obvious with the CPU usage then why Siglent didn't provide a native web interface.
-
Thanks !! that SW update link worked, 1.3.9.6
I am a bit sad about the model confusion, web pages on siglent site is very unclear,
my order sheet say my version is a PLUS version !!
that update solved my USB stick problems,
-
If you ordered the Plus model and received a non-plus model, return it immediately!
The Plus model is considerably better feature-wise and hacking-wise.
-
Thanks !! that SW update link worked, 1.3.9.6
I am a bit sad about the model confusion, web pages on siglent site is very unclear,
my order sheet say my version is a PLUS version !!
that update solved my USB stick problems,
Here December 16, 2020, 04:19:06 am » you told
Darrel ?? are you able to figure any of this out ??
I just got a brand new SSA3021X
sw version 1.3.9.5
its TG is enabled all the time, so at least that is fine.
the 3 other options: 47 hrs left (what crap)
and it is 2.1GHz only..
PLEASE HELP... it is VERY confusing the stuff you people explain here, many different links, and stuff to do..
why not have ONE place ?
with a full updated detailed instruction covering all things we must do, and access to the needed files ??
FW revision list do not have at all this FW version.
But also it can not be SSA3021X Plus
Are you sure there was 1.3.9.5.
Then now you tell you have purchased Plus version. After it arrive you still talk you get brand new SSA3021X
In this time if you have purchased Plus version why did you note it is wrong. They are totally very different machines.
When you receive it did you not look front panel at all where also read model.
But now if you have documents you have purchased SSA3021X Plus and not SSA3021X...
You need asap contact seller and start dispute you have get wrong model. Bad that there is now so long time after you get it...
Or is it really you have purchased Plus model or is it now just mistake in this order sheet. Difficult to say without perfect and deeply detailed documents starting from purchase and full record from it.
Also it depends what kind of seller it have been.
Can you find any record about this seller prices from just this day you buy it. Looking this and your receipt may tell what you have really purchased, paid.
Btw, in Europe Siglent know every serial number what they have sold to individual distributors and when.
Of course it is possible that factory have used FW version what is more new than this time most new public shared and then there come new public FW and this factory version do not never come to public share, this can happen. So if this is case it tell that least it is factory original and no one have updated it after factory.
If you have purchased Plus, then you need get Plus. Period. If seller is hones and he have made mistake of course he solve this for your best.
In this case only weird is that why you have not noted earlier you have wrong model.
-
Thanks !! that SW update link worked, 1.3.9.6
I am a bit sad about the model confusion, web pages on siglent site is very unclear,
my order sheet say my version is a PLUS version !!
that update solved my USB stick problems,
What is unclear with models in Siglent side.
There is models list, there is data sheets there is simple key features list, every model have brochure where bit more about features and finally data sheets and user manuals. How it is unclear between X and X Plus. It is good to know and forward to Siglent some note for develop information more clear if this is true..
https://www.siglenteu.com/spectrum-analyzers/ (https://www.siglenteu.com/spectrum-analyzers/)
And this is ONLY Siglent in whole EU area. If you mean Siglent. If you mean some Siglent distributors sides, it is totally other case. Also it is good to note where is so unclear things that can not make clear what are what models. Then they need education.
-
Hello everyone!
I'm new to the forum and the thread. Thank you all for your work and dedication. I've been all over the 38 pages of the thread.
I just received a brand new SSA3021X and I was wondering if I could unlock it's EMI and AMK for good. Getting it to 3.2G will be fine, but it's not the main goal.
Is 1.3.9.6 still a major hindrance?
All the best!
73 de LZ1SWE,
Bill
-
1.3.9.6 works great here
-
For anyone who's interested, source files & build instructions for the SSA3021X webserver are posted here:
https://github.com/frankvanhooft/SSA3021X-webserver (https://github.com/frankvanhooft/SSA3021X-webserver)
-
Hello!
Long time reader, first time poster.
Anything in this message is for "educational research" only!
First I'd like to say that 1.3.9.5 can be downgraded to 1.2.8.3.
I'd like to use the method in post #866 compiled by nealix and then upgrading from there, but the link to the Firmware Converter Tool doesn't work. Unless someone has a working link or a link to the files that are needed from the ZIP file, I'm stuck!
Yes, I've read all 38 pages multiple times over months. I have seen nothing special regarding the link other a couple of complaints that it doesn't work. If I've missed something, it's not for lack of effort. (I have a masters in Missing the Obvious.)
The link leads to a permissions-based error. (A no-go for newbies?)
I welcome PMs. Help from any source is welcome as I have a limited time to finish my "educational research" on this device!
Also, there was all of this talk of making very expensive bricks to the point that some files were removed. Then all of a sudden it's no longer mentioned. The files seem to be back. Has this problem been solved? It's one of the reasons I downgraded to the oldest version that worked mentioned in this thread.
-
Hello everyone!
I'm new to the forum and the thread. Yesterday I brick my SSA 3032X .... Before I upgraded to last version SSA3000X_1.3.9.6.ADS It wofked fine, but telnet is gone. So I use SSA3000X_telnet.
Connected with telnet first I copy cp /etc/rc5.d/S98ecomb /etc/rc5.d/S98ecomb.orig then I try change script /etc/rc5.d/S98ecomb to add /usr/sbin/telnetd -l /bin/sh -p 23
but somethig went wrong and do this echo "#! /bin/sh" >S98ecomb After that I reboot device. And suprise me |O
I need help to restore device to working state.
This is serial console output
U-Boot SPL 2013.01.01-svn72327 (Sep 27 2020 - 15:29:08)
Start buzzer++
Stop buzzer--nand_init+++++
nand_init-----
>>spl_load_lcd_fpga++
LCD init()++
Lcd_Init()++
SetUpLCD()++
SetUpLCD()--
len=1228852, height=600, width=1024
Logo from nandflash: base=0x81000000; end=0x8112c01f; end-base=0x12c01f; rwsize= 0x12c020; r=0x0
Lcd_Init()--
>>spl_load_lcd_fpga--
U-Boot 2013.01.01-svn72327 (Sep 27 2020 - 15:29:08)
I2C: ready
DRAM: 128 MiB
NAND: 256 MiB
MMC: OMAP SD/MMC: 0, OMAP SD/MMC: 1
Using default environment
set_default_env::4393
musb-hdrc: ConfigData=0xde (UTMI-8, dyn FIFOs, bulk combine, bulk split, HB-ISO Rx, HB-ISO Tx, SoftConn)
musb-hdrc: MHDRC RTL version 2.0
musb-hdrc: setup fifo_mode 4
musb-hdrc: 28/31 max ep, 16384/16384 memory
USB Host mode controller at 47401800 using PIO, IRQ 0
Net: <ethaddr> not set. Validating first E-fuse MAC
cpsw
Hit any key to stop autoboot
mmc_send_cmd : timeout: No status update
Card did not respond to voltage select!
mmc0(part 0) is current device
mmc_send_cmd : timeout: No status update
Card did not respond to voltage select!
(Re)start USB...
USB0: lowlevel init failed
USB error: all controllers failed lowlevel init
MUSB found on device 0
** Bad device usb 0 **
Booting from nand ...
NAND read: device 0 offset 0x3080000, size 0x240000
2359296 bytes read: OK
## Booting kernel from Legacy Image at 80007fc0 ...
Image Name: Linux-3.2.0
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2207888 Bytes = 2.1 MiB
Load Address: 80008000
Entry Point: 80008000
XIP Kernel Image ... OK
OK
Starting kernel ...
Uncompressing Linux... done, booting the kernel.
[ 0.180654] mtdoops: mtd device (mtddev=name/number) must be supplied
[ 0.796710] smartreflex smartreflex: am33xx_sr_probe: cannot determine opp
[ 0.804377] sr_init: platform driver register failed
INIT: version 2.88 booting
Starting udev
INIT: Entering runlevel: 5
start ecomb running...
start ecomb running...
[ 3.977662] Failed to request GPMC mem for FPGA
[ 3.982850] Unhandled fault: external abort on non-linefetch (0x1008) at 0xc884a000
[ 3.990842] Internal error: : 1008 [#1]
[ 3.994838] Modules linked in:
[ 3.998027] CPU: 0 Not tainted (3.2.0 #208)
[ 4.002750] pc : [<c01a89ac>] lr : [<c02329b4>] psr: 80000113
[ 4.002757] sp : c73199c0 ip : 00000000 fp : c73199e4
[ 4.014723] r10: c7118000 r9 : 00000200 r8 : 00000000
[ 4.020168] r7 : c71ac810 r6 : 00000001 r5 : c7118000 r4 : 00000200
[ 4.026973] r3 : c884c000 r2 : 80000000 r1 : c7118000 r0 : c884a000
[ 4.033779] Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
[ 4.041218] Control: 10c5387d Table: 874b0019 DAC: 00000015
[ 4.047209] Process ecomb (pid: 721, stack limit = 0xc73182f0)
[ 4.053289] Stack: (0xc73199c0 to 0xc731a000)
[ 4.057834] 99c0: 00000000 c71ac810 c71aca28 c71ac810 00000802 0000000e c7319a3c c73199e8
[ 4.066365] 99e0: c0231d64 c0232910 00000000 00000004 00000000 c046781c c7114480 c7118000
[ 4.074895] 9a00: c7114000 00002242 00000200 00000000 c022ede0 c71aca28 00000800 c71ac810
[ 4.083425] 9a20: 00000001 00002242 c7118000 00000000 c7319aac c7319a40 c022e348 c0231cac
[ 4.091954] 9a40: c022ea14 00000001 c7319a50 60000113 00000040 00000004 0000003f 00000000
[ 4.100484] 9a60: 00000000 c7118000 00002242 00000ec4 00000000 00000000 00000000 00000000
[ 4.109014] 9a80: 00000000 01121000 00000000 10000000 00000000 00000ec4 00000ec4 c71ac810
[ 4.117544] 9aa0: c7319afc c7319ab0 c022e9fc c022e1f0 c7319ab8 00000000 00000000 00000ec4
[ 4.126074] 9ac0: 00000f43 00000004 c7271b40 000000bc c7118000 00000000 00ba1000 00000000
[ 4.134604] 9ae0: 02b00000 00000000 c71dc400 c7319b74 c7319b4c c7319b00 c0222b98 c022e98c
[ 4.143134] 9b00: 00000ec4 c7319b74 c7118000 c74bdf80 00000000 00000000 00000000 00000000
[ 4.151665] 9b20: c023880c 00ba1000 00000000 00000004 c7118000 00000ec4 c7319b74 c71ac000
[ 4.160195] 9b40: c7319ba4 c7319b50 c023a1d8 c0222b18 00000ec4 c7319b74 c7118000 00000000
[ 4.168724] 9b60: 00000001 00000000 00001000 0000005d c7319ba4 c7319b80 c02386d0 c7266c00
[ 4.177255] 9b80: c71ac000 c7266c00 00000000 0000005d c7118000 0000005b c7319bec c7319ba8
[ 4.185785] 9ba0: c0238994 c023a17c 00000ec4 00000001 c01f43a8 3131a3dc 39383234 00000000
[ 4.194314] 9bc0: c7319bec c7266c00 00000000 0000014b c7118000 00000003 0000005b 00000000
[ 4.202844] 9be0: c7319c24 c7319bf0 c0238100 c023889c 00000000 00000ec4 00000000 c7319cdd
[ 4.211374] 9c00: c03766ab c7118000 00000ec4 00000000 0000005b 2000002c c7319c54 c7319c28
[ 4.219905] 9c20: c0164254 c023805c 00000ec4 00000000 00000006 ffffffff c7118000 c7319d10
[ 4.228437] 9c40: c72d01a8 00000ec4 c7319c9c c7319c58 c0165d74 c0164230 00000ec4 00000001
[ 4.236968] 9c60: c0167450 c0177ef8 00000041 c72d0000 c7319cfc c72d0000 c7319d10 c72d01a8
[ 4.245498] 9c80: 00000000 00000000 00000001 c7118000 c7319cec c7319ca0 c0167670 c0165d34
[ 4.254029] 9ca0: 00000000 c73074c0 0000031a 2000002c 00000000 0000005b 00000000 00000ec4
[ 4.262559] 9cc0: 00000000 c055f280 c055f280 c687ab38 0000002c 000000d8 c7814000 c7118000
[ 4.271090] 9ce0: c7319d44 c7319cf0 c015ce00 c0167588 00000000 c7319d00 c007a050 c0079654
[ 4.279621] 9d00: 000d750c 00000000 c0442d9c 00000002 0000031a 2000002c c0079a94 c055f280
[ 4.288151] 9d20: c055f280 0000002c c687ab38 0000002d c72d0000 00080001 c7319d9c c7319d48
[ 4.296683] 9d40: c015e144 c015cce8 0000002c c749a740 c7319e00 00080001 c7319d84 c7319d68
[ 4.305214] 9d60: c0074ae8 c01aefc4 c055f280 c055f280 00000000 c687abf8 c055f280 0000002c
[ 4.313743] 9d80: c687abf8 c749a740 00000000 00080001 c7319dec c7319da0 c00766fc c015e110
[ 4.322273] 9da0: 00000001 00000041 c0442d9c c687ab38 c7319e00 c731bcd8 c687ab38 00000004
[ 4.330803] 9dc0: c055f0e0 c731bcd8 00000000 00000000 00000000 40380000 c74b1008 c7478cc0
[ 4.339334] 9de0: c7319e3c c7319df0 c0089c30 c007645c c7319ed8 00000000 c74b1008 00000000
[ 4.347863] 9e00: 00000000 0000002c 40380000 00000000 c007e54c 40354000 c731bcd8 40380000
[ 4.356393] 9e20: c7478cc0 c731bcd8 c74b1008 00000000 c7319e8c c7319e40 c008c610 c0089bcc
[ 4.364925] 9e40: 0000002c 00000000 00000000 c7319f60 00000000 c7319e90 c7318000 00000001
[ 4.373456] 9e60: c7319ed8 c74b0000 00000201 40380000 c7478cc0 c731bcd8 c74b1008 00000000
[ 4.381987] 9e80: c7319ec4 c7319e90 c008cc40 c008c5a4 c74b1008 00000000 ea3f3d72 c7319fb0
[ 4.390519] 9ea0: c7478cc0 80000007 c71e0140 40380efc c731bcd8 c7478cf4 c7319efc c7319ec8
[ 4.399050] 9ec0: c0019c90 c008cbbc c00ac3e4 c00abf74 00000041 00000007 c0019b34 c040274c
[ 4.407582] 9ee0: 40380efc c7319fb0 00000000 4003a000 c7319fac c7319f00 c0008454 c0019b40
[ 4.416111] 9f00: 00000000 00000000 00000000 00000005 c7409cc0 c73aed40 00000000 00000002
[ 4.424642] 9f20: c7319f54 c7319f30 c00b644c 00000002 00000000 00000000 c03fe2ac ffffffff
[ 4.433172] 9f40: c72cf000 ffffff9c c7319f94 c7319f58 c009ebe4 c009c380 c74bc340 00000004
[ 4.441701] 9f60: 00000002 00000000 00000026 00000100 0057fba8 000fb2ec 0057fc18 00000005
[ 4.450231] 9f80: c0013ee8 00000000 c7319fa4 40380efc 80000030 ffffffff 00000000 00000000
[ 4.458761] 9fa0: 00000000 c7319fb0 c0013cd8 c0008424 0012f6fc be838e14 be838e1c 0000f309
[ 4.467290] 9fc0: 0012f6fc be838cd8 0057fac0 00000000 00000000 00000000 4003a000 00000000
[ 4.475821] 9fe0: 40381359 be838c88 00019f07 40380efc 80000030 ffffffff bdffffff ffffffff
[ 4.484344] Backtrace:
[ 4.486895] Function entered at [<c0232904>] from [<c0231d64>]
[ 4.492975] r7:0000000e r6:00000802 r5:c71ac810 r4:c71aca28
[ 4.498890] Function entered at [<c0231ca0>] from [<c022e348>]
[ 4.504967] Function entered at [<c022e1e4>] from [<c022e9fc>]
[ 4.511046] Function entered at [<c022e980>] from [<c0222b98>]
[ 4.517123] Function entered at [<c0222b0c>] from [<c023a1d8>]
[ 4.523200] Function entered at [<c023a170>] from [<c0238994>]
[ 4.529279] Function entered at [<c0238890>] from [<c0238100>]
[ 4.535357] Function entered at [<c0238050>] from [<c0164254>]
[ 4.541436] r8:2000002c r7:0000005b r6:00000000 r5:00000ec4 r4:c7118000
[ 4.548442] Function entered at [<c0164224>] from [<c0165d74>]
[ 4.554520] r7:00000ec4 r6:c72d01a8 r5:c7319d10 r4:c7118000
[ 4.560434] Function entered at [<c0165d28>] from [<c0167670>]
[ 4.566512] Function entered at [<c016757c>] from [<c015ce00>]
[ 4.572590] Function entered at [<c015ccdc>] from [<c015e144>]
[ 4.578668] Function entered at [<c015e104>] from [<c00766fc>]
[ 4.584746] Function entered at [<c0076450>] from [<c0089c30>]
[ 4.590824] Function entered at [<c0089bc0>] from [<c008c610>]
[ 4.596902] Function entered at [<c008c598>] from [<c008cc40>]
[ 4.602980] Function entered at [<c008cbb0>] from [<c0019c90>]
[ 4.609058] Function entered at [<c0019b34>] from [<c0008454>]
[ 4.615136] Function entered at [<c0008418>] from [<c0013cd8>]
[ 4.621214] Exception stack(0xc7319fb0 to 0xc7319ff8)
[ 4.626480] 9fa0: 0012f6fc be838e14 be838e1c 0000f309
[ 4.635010] 9fc0: 0012f6fc be838cd8 0057fac0 00000000 00000000 00000000 4003a000 00000000
[ 4.643538] 9fe0: 40381359 be838c88 00019f07 40380efc 80000030 ffffffff
[ 4.650431] r8:00000000 r7:00000000 r6:ffffffff r5:80000030 r4:40380efc
[ 4.657443] Code: e1b02f82 25903000 2590c000 28a11008 (15903000)
[ 4.663878] ---[ end trace 1b2fea6f67d37128 ]---
Thanks
-
After that console is unresponsive, but if atach USB stick kernel respond with this
[ 1759.295694] usb 1-1: new high-speed USB device number 3 using musb-hdrc
[ 1759.443232] usb 1-1: New USB device found, idVendor=058f, idProduct=6387
[ 1759.450242] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1759.457698] usb 1-1: Product: Mass Storage
[ 1759.461968] usb 1-1: Manufacturer: Generic
[ 1759.466247] usb 1-1: SerialNumber: 9091E617
[ 1759.478047] scsi0 : usb-storage 1-1:1.0
[ 1760.488165] scsi 0:0:0:0: Direct-Access Generic Flash Disk 8.07 PQ: 0 ANSI: 4
[ 1760.499266] sd 0:0:0:0: [sda] 7866368 512-byte logical blocks: (4.02 GB/3.75 GiB)
[ 1760.508176] sd 0:0:0:0: [sda] Write Protect is off
[ 1760.513178] sd 0:0:0:0: [sda] Mode Sense: 23 00 00 00
[ 1760.519156] sd 0:0:0:0: [sda] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA
[ 1760.534720] sda: sda1
[ 1760.540287] sd 0:0:0:0: [sda] Attached SCSI removable disk
-
Yes, you can downgrade to at least 1.2.8.3. I've done it.
-
Why don't you just copy back the copy of the original S98ecomb file?
Also, it doesn't seem correct to me to add the telnet start to this file! Telnet is started by its own file:
K10telnetd in /etc/rc1.d and /etc/rc.6:
#! /bin/sh
#Permission is hereby granted, free of charge, to any person obtaining a copy
#of this software and associated documentation files (the "Software"), to deal
#in the Software without restriction, including without limitation the rights
#to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
#copies of the Software, and to permit persons to whom the Software is
#furnished to do so, subject to the following conditions:
#
#The above copyright notice and this permission notice shall be included in
#all copies or substantial portions of the Software.
#
#THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
#IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
#FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
#AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
#LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
#OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
#THE SOFTWARE.
telnetd=/usr/sbin/telnetd
test -x "$telnetd" || exit 0
case "$1" in
start)
echo -n "Starting telnet daemon"
start-stop-daemon --start --quiet --exec $telnetd
echo "."
;;
stop)
echo -n "Stopping telnet daemon"
start-stop-daemon --stop --quiet --pidfile /var/run/telnetd.pid
echo "."
;;
*)
echo "Usage: /etc/init.d/telnetd {start|stop}"
exit 1
esac
exit 0
S10telnetd in /etc/rc5.d:
#! /bin/sh
#Permission is hereby granted, free of charge, to any person obtaining a copy
#of this software and associated documentation files (the "Software"), to deal
#in the Software without restriction, including without limitation the rights
#to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
#copies of the Software, and to permit persons to whom the Software is
#furnished to do so, subject to the following conditions:
#
#The above copyright notice and this permission notice shall be included in
#all copies or substantial portions of the Software.
#
#THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
#IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
#FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
#AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
#LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
#OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
#THE SOFTWARE.
telnetd=/usr/sbin/telnetd
test -x "$telnetd" || exit 0
case "$1" in
start)
echo -n "Starting telnet daemon"
start-stop-daemon --start --quiet --exec $telnetd
echo "."
;;
stop)
echo -n "Stopping telnet daemon"
start-stop-daemon --stop --quiet --pidfile /var/run/telnetd.pid
echo "."
;;
*)
echo "Usage: /etc/init.d/telnetd {start|stop}"
exit 1
esac
exit 0
The original content of S98ecomb in /etc/rc5.d:
#! /bin/sh
#test by Kener.Liao
#echo "start to mount datafs to usr dir... "
#if [ -c "/dev/ubi1_0" ]; then
# echo "ubi1_0 exit already!"
# exit 0
#fi
#info=`cat /proc/mtd | grep datafs`
#if [ "$info" = "" ]; then
# echo "nand have no datafs mtd!!"
# exit 0
#fi
#mtd=${info%:*}
#mtd=${mtd:3}
#cmd="ubiattach /dev/ubi_ctrl -m "$mtd" -O 2048"
#$cmd
#mount -t ubifs ubi1_0 /usr/bin/siglent/usr
#if [ $? -eq 0 ]; then
# echo "mount datafs success!!!"
echo "start ecomb running... "
portmap &
cd /usr/bin/siglent/
#insmod /usr/bin/siglent/drivers/cfbcopyarea.ko
#insmod /usr/bin/siglent/drivers/cfbfillrect.ko
#insmod /usr/bin/siglent/drivers/cfbimgblt.ko
#insmod /usr/bin/siglent/drivers/da8xx-fb.ko
./ecomb &
#else
# echo "mount datafs failed!!!"
#fi
exit 0
Good luck!
Regards,
Vitor
-
Can not, no access to telnet, serial console is not working.
Only access is U-BOOT, but I dont know how procede.
-
I've read all 38 pages again and I'd like to know if I've got this right. Until version 1.2.9.3a it looks like telnet was active. Downgrading to a pre-1.2.9.3a version doesn't restore telnet. Then a script was created and converted into an ADS file to enable telnet temporarily. Around version 1.3.9.5 the backup and telnet enabling ADS files started super bricking machines. :( This topic was left hanging, except for one affirmative answer to the question, "Could 1.3.9.6 be successfully hacked?"
Mine shipped with 1.3.9.5. Originally, I downgraded it to 1.2.8.3 to try to avoid the problems with super bricking. But if downgrading doesn't restore the telnet symlinks (I can ping, but not telnet), who knows what else it doesn't change? Maybe the super bricking code? Since I've never read a reason or solution to that problem, I'm leery to try anything except to bring it up to 1.3.9.6. :scared:
So is the super-bricking problem still occurring? If not, how should I proceed?
TIA for any help/advice!
-
So is the super-bricking problem still occurring? If not, how should I proceed?
Use the new script (https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/msg1870091/#msg1870091).
-
tv84,
Thanks for letting me know the file had been updated. You have truly provided much help and knowledge in these groups. :-+
I would like to use the "ecomb8" file method if it's still safe. But every time I try to download the converter using the link posted multiple times in this thread, I get:
An Error Has Occurred!
You are not allowed to access this section
:( :( :(
I've only seen one other poster say the link doesn't work. Should I chant "Bob's your uncle!" three times before clicking on the link? Or does access require a poultry-themed meal? ;)
-
But every time I try to download the converter using the link posted multiple times in this thread
I'm not the provider of such tool.
Nonetheless, I'll say it again: there is no public tool that can correctly decrypt an .ADS file! That tool only deals with reversing and xoring some file zones. BUT, there is an encrypted part of the file that the toold doesnt decrypt SO BEWARE when using such thing. Depending on what you want to extract, the contents might be corrupted.
-
Thank you for the warning. I have read many times in this thread that if there are any errors extracting the ecomb file, don't use it! There is also a xml file, but the contents of it have been posted.
I have no problem with using the "backup and delete by renaming" method. The ecomb method just sounds more "future proof" by providing a set of keys.
It would be nice to know why I'm denied permission. Maybe someone reading this post knows? Newbie thing?
Boy! The mobile version of this site leaves a lot to be desired as it leaves out a lot of information! I know it's not a "newbie thing" because I'm no longer in the newbie class.
-
I posted the initial version of my "Siglent Firmware Tool" and recently decided to remove it again.
Regards,
Vitor
-
Yesterday I tried the upgrade described in #737. Everything worked including the verification of system information, but the unit failed to reboot. The UART output indicates ECC errors when trying to mount the root file system. Is there anything that can be done to recover from this ?
U-Boot SPL 2013.01.01 (Jan 11 2016 - 14:14:06)
Start buzzer++
Stop buzzer--nand_init+++++
nand_init-----
>>spl_load_lcd_fpga++
LCD init()++
Lcd_Init()++
SetUpLCD()++
SetUpLCD()--
len=1228852, height=600, width=1024
Logo from nandflash: base=0x81000000; end=0x8112c01f; end-base=0x12c01f; rwsize=0x12c020; r=0x0
Lcd_Init()--
>>spl_load_lcd_fpga--
U-Boot 2013.01.01 (Jan 11 2016 - 14:14:06)
I2C: ready
DRAM: 128 MiB
NAND: 256 MiB
MMC: OMAP SD/MMC: 0, OMAP SD/MMC: 1
Using default environment
set_default_env::4309
Net: <ethaddr> not set. Validating first E-fuse MAC
cpsw
Hit any key to stop autoboot
mmc_send_cmd : timeout: No status update
Card did not respond to voltage select!
mmc0(part 0) is current device
mmc_send_cmd : timeout: No status update
Card did not respond to voltage select!
Booting from nand ...
NAND read: device 0 offset 0x3080000, size 0x240000
2359296 bytes read: OK
## Booting kernel from Legacy Image at 80007fc0 ...
Image Name: Linux-3.2.0
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2191976 Bytes = 2.1 MiB
Load Address: 80008000
Entry Point: 80008000
XIP Kernel Image ... OK
OK
Starting kernel ...
Uncompressing Linux... done, booting the kernel.
[ 0.179899] mtdoops: mtd device (mtddev=name/number) must be supplied
[ 0.795802] smartreflex smartreflex: am33xx_sr_probe: cannot determine opp
[ 0.803448] sr_init: platform driver register failed
[ 0.958967] UBI error: ubi_io_read: error -74 (ECC error) while reading 126976 bytes from PEB 3:4096, read 126976 bytes
[ 1.113803] UBI error: ubi_io_read: error -74 (ECC error) while reading 126976 bytes from PEB 4:4096, read 126976 bytes
[ 1.128401] UBI error: ubi_io_read: error -74 (ECC error) while reading 11 bytes from PEB 9:6144, read 11 bytes
[ 1.138954] UBIFS error (pid 1): ubifs_leb_read: reading 11 bytes from LEB 7:2048 failed, error -74
[ 1.149143] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[ 29.66⸮
-
After a bit of research I believe I figured out why the SA failed to restart after the upgrade. The step to remount rootfs rw has the potential to corrupt the partition. It all depends on how it was initially created. The explanation is in this link https://linux-mtd.infradead.narkive.com/aO9xNZvZ/temporarily-remounting-rootfs-as-rw-leads-to-kernel-panic-on-reboot.
With help from some of the experienced forum members I am back up and running again.
-
I don't think it was any bug.
The instructions on #737 are clever, but prone to brick your SSA3021X. In my opionion, the offending step is:
Enter "cp /usr/bin/siglent/usr/mass_storage/U-disk0/ecomb8 ecomb8"
This assumes that the filesystem on the flash has enough space to have BOTH ecomb (original one and ecomb8) installed in parallel, which in your case was not true. By sync'ing and rebooting you overwrote some block in the filesystem and thus corrupted it.
I would say that it would be better, if one was to follow this route, to make a backup of the original ecomb to USB and first delete the ecomb, before copying the "ecomb8" (renaming would be unnecessary).
After generating the codes, the modded ecomb would be replaced with the original one from the backup. I guess that would be safer, but I have not tried it.
Anyway, this was one of the reasons I removed the "Siglent Firmware Tool" I had published, before someone had this issue. I don't know how you obtained the ecomb (the one you renamed to ecomb8).
To all: when modding/hacking your test equipment, especially new ones, never forget that you are messing with an expensive piece of equipment and you may/will void your warranty!
Regards,
Vitor
-
New Firmware V1.3.9.7 2021/1/30
1. This firmware must be upgraded from V1.2.8.1 or later. If your SSA3000X has an
earlier version, please update to V1.2.8.1 first and then proceed to update to the
latest version.
2. Fixed the LOG scale sweep time and display error
3. Fixed the trace file .trc load and display error
4. Improve the stability of TG
5. Add peak excursion require command
:CALCulate:MARKer:PEAK:EXCursion?
Add sweep state require command
:TRACe:SWEep:STATe?
Add N dB Bandwidth left and right frequency require command
:CALCulate:MARKer*:BANDwidth:RLEFt?
:CALCulate:MARKer*:BANDwidth:RRIGht?
https://int.siglent.com/download/firmwares/?ProId=29
-
I think you mean firmware date of 2021/03/26 ?
Edit: Odd, web site says the above, release notes say 2021/01/30 ?
-
yes
-
This FW will remove any active telnet. if you managed to keep telnet active, you will lose it if you upgrade.
For some strange reason, I found this file, which will not remove the telnet daemons: https://we.tl/t-i0ddwxSXOT :)
Note that it will not activate telnet. It will just skip removing it.
Regards,
Vitor
-
Hello,
Attached is a link for another FW I "found" for the SSA3021X: https://we.tl/t-lFH6APawHi (https://we.tl/t-lFH6APawHi)
It is the latest firmware release (SSA3000X_1.3.9.7), but it ADDS telnet if not already activated (instead of removing it) and it ADDS the webserver posted by frankvh2: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg3451746/#msg3451746 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg3451746/#msg3451746)
Note that all credits for the webserver go to frankvh2!
Just run the update and you get both.
If there is any problem, let me know. It worked fine on my unit. This FW has nothing to do with any license hacks: these are not touched or modified.
UPDATE:
The previous link expired. Here is a new one: https://we.tl/t-f5ZHi6Rhmq (https://we.tl/t-f5ZHi6Rhmq)
It will expire April, 15th and I will not repost it, so get it now.
Only reposting due to EEVBlog's server downtime...
Regards,
Vitor
-
Hello and great thanks for all contributors discovered methods for fun things with SSA3021X :)
Since ADS to ZIP tool referenced in this thread has limited access for downloading it, does anyone have the extracted ecomb file from version 1.2.8.1 and can it be shared?
the method described in post #866
updated:
the tool is not public and now it is not available for download
-
Hello!
I am happy to announce that I found a way to upgrade the SSA3021X into a full featured SVA1032!
It requires a bit of soldering, as a few components need to be retorfitted. After that, a crossflash is possible and as a bonus, the attached package includes a "special" firmware that activates all options by generating the propper keys!
Download here: shorturl.at/wVWX2 (http://shorturl.at/wVWX2)
Regards,
Vitor
Hi everyone!
This was my attempt for a harmless April, 1st joke.
Life in the pandemic is otherwise much too serious. Hope you enjoyed being "Rick Rolled"!
Regards,
Vitor
-
Thank, works great.
-
This thread has several links to ADS to ZIP converter tool in order to use ecomb replacement method for generating proper licensed, the initial refered attachement is not available now
it was deleted on January 09, 2021 by Bicurico in the thread https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/500/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/500/)
I hope my finding will help newcomers to understand why they are getting error when trying to download the tool, it is not permission related problem, the attachement is just not available now
-
This thread has several links to ADS to ZIP converter tool in order to use ecomb replacement method for generating proper licensed, the initial refered attachement is not available now
it was deleted on January 09, 2021 by Bicurico in the thread https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/500/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/500/)
I hope my finding will help newcomers to understand why they are getting error when trying to download the tool, it is not permission related problem, the attachement is just not available now
I mentioned it here:
I posted the initial version of my "Siglent Firmware Tool" and recently decided to remove it again.
Regards,
Vitor
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg3490298/#msg3490298 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg3490298/#msg3490298)
Regards,
Vitor
-
This thread has several links to ADS to ZIP converter tool in order to use ecomb replacement method for generating proper licensed, the initial refered attachement is not available now
:horse:
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg3489400/#msg3489400 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg3489400/#msg3489400)
-
I'm not the provider of such tool.
so previously the words from Bicurico explained good enough the issue
-
Hi
It has been a long time since I followed this thread and there has been a large number of postings.
I am seeking guidance on updating my hacked SSA.
I have a Siglent SSA3032X
version SW1 1.2.9.3a
SW2 201870708-1
SW3 D1
HW 07.03.00
Options
EMI
AMK
TG
Refl
Only the TG option came with the SSA. The others are hacked.
I am looking to update the software versions but I have some questions:
Is it worth updating the software?
If so, what features are added and bugs fixed?
Can someone please kindly outline what I would need to do to upgrade the software without losing options and maintaining future hackability.
I am comfortable using Linux etc, so I am just looking for the latest procedure.
Thanks in advance.
Dazz
-
All FW version release notes are listed in a PDF in each upgrade package.
https://int.siglent.com/download/firmwares/?ProId=29
Never heard of hacks being impacted by firmware updates.
-
Hello,
Attached is a link for another FW I "found" for the SSA3021X:
It is the latest firmware release (SSA3000X_1.3.9.7), but it ADDS telnet if not already activated (instead of removing it) and it ADDS the webserver posted by frankvh2:
UPDATE:
The previous link expired. Here is a new one: https://we.tl/t-f5ZHi6Rhmq (https://we.tl/t-f5ZHi6Rhmq)
It will expire April, 15th and I will not repost it, so get it now.
Only reposting due to EEVBlog's server downtime...
Regards,
Vitor
Hi
I updated the firmware from ver 1.2.9.3a.
The firmware installed faster than I expected and the SSA went to the default user screen, just like after a normal start.
The firmware version still showed as 1.2.9.3a.
I cycled the power and the version then showed as 1.3.9.7.
I haven't tried the telnet or web server but it appears the update was successful. I can't see any obvious change/difference in the user interface.
Thanks for "finding" this hacked firmware version.
Dazz
-
......
UPDATE:
The previous link expired. Here is a new one: https://we.tl/t-f5ZHi6Rhmq (https://we.tl/t-f5ZHi6Rhmq)
It will expire April, 15th and I will not repost it, so get it now.
Only reposting due to EEVBlog's server downtime...
Regards,
Vitor
Hi,
could you please re-post the file as the link is expired (again) and I missed it ?
Thanks
-
Hello,
sorry I am really new. I have also a SSA3021 and I want to test to hack it. But I read and read all the post and cannot find the mentioned files I have to download.
Is there a trick?
Thank You
-
I answer to myself (as it is the only one who responded me :-)
I managed to overcome to the telnet deltion by last upgrade without using any other "black magic" firmware provided by anyone.... (even because I am not able to have it....).
So, basically for all the people in my situation I can give this simple tip:
act before launching the upgrade to the latest version, using your brain and some little unix knowledge... this is enough to prevent the telnet vanishing....
-
Having read the 39 pages of this topic twice I began to understand what was required.
1) Telnet access is required to do anything.
2) There is a basic option to rename replace 2 files: "nsp_data_b", and "NSP_system_info.xml" with custom versions.
- this gives you an options fully loaded SSA3021x (or even SSA3032x) BUT the serial no. is set to SSA_XXXXXXXXX
3) The updated procedure is more complicated and requires switching off the running "ecomb" program on the SSA and running "ecomb8" instead.
You should first replace the "nsp_data_b" with the version from version 1.2.8.1 of the Firmware.
The "ecomb" renamed as "ecomb8" is also obtained from this firmware.
The former has been posted on this forum but the later has never been.
There is an extraction tool to obtain these files from the 1.2.8.1 FW (V01.02.08.01) but this is not reliable and has been withdrawn.
The "NSP_system_info.xml" also needs to be replaced with a customised version containing the users serial number (if they want to keep it).
This method seems to be the best in the long term but seems unavailable unless someone is kind enough to post a tested version of the "ecomb" from 1.2.8.1
There is also something about the RBW being reduced by the simpler hack?
OK. Please correct the above if I have misunderstood.
Now to my attempts.
As my machine arrived with version 1.2.9.3a I was faced with a problem of no Telnet.
I realised there was a risk of using the Telnet.ADS but it seems that it was a risk with later software (hopefully!!). I gave it a go. It was no go. It went to 60% loaded but no telnet. I switched off using the power button and held my breath - rebooted as normal. Phew!
Without this telnet option working my only other thought was to try the 1.3.9.7 (with Telnet / Webserver ) version posted above. This loaded although I had to do a reset before it was shown (even though the machine had power cycled). Seemed to be all ok on the machine.
I found that the webserver was working (very well actually).
The telnet was a different matter. I had got the "Welcome to SCPI instrument Siglent SSA3021X" login with port 5024 before the upgrade and this still worked.
Port 5025 also continued the telnet session but "returns" just produced a blank screen.
I did a port scan and found these ports open 80(http), 111,897,5024,5025. 10101 and 800 were not.
Port 111 opened (and stayed open) but like 5025 produced a blank screen.
Port 897 immediately closed on starting (I was using PUTTY in windows 10).
Well, thats all the info I have I'm afraid. I'm a bit stuck now. If I had got into telnet my plan was to copy all the files, then try and downgrade to 1.2.8.1 and copy all the files there. I was going to compare the two "ecomb" files to see if the downgraded software would give me the desired version for the complex hack?? I may even have been able to do it there and then. But ofcourse this depends on if the downgrade worked.
I would appreciate any thoughts, particularly in relation to the 111 and 897 open ports. Wonder what is going on there?
Thanks.
weejag
-
Just a thought....
If you can downgrade your firmware ( as some people have said is possible) to 1.2.8.1 does the ecomb app get downgraded?
Could you not just stop it running, replace the neccessary files then start it up again? Would that do the job?
All this messing about extracting the ecomb from the .ADS file would then become irrelevent?? Or am I missing something obvious?
Doesnt look like I'm going to get anywhere with the telnet so its just an academic question for me.
-
I sent you a PM...
Don't start messing up your device randomly. In the end you might have a brick.
-
Thanks Bicurico for the reply. I've responded to your PM.
I have tried to be extremely careful in my actual explorations but I realise that I have been mistaken in a number of aspects (maybe it comes with doing things and posting at 2 am)
Firstly, what I wrote in 2) above is rubbish.
The basic option is to rename the NSP_bandwidth.xml files (in both the firmdata0 folder and the backup folder) to NSP_bandwidthx.xml
These contain the Serial Number and the licence data. I presume that if the originals are not found the system replaces it with a default version giving full specs to the SSA?
Also my thoughts about grabbing ecomb - I guess this was a stupid idea. One of the people much smarter than me would have already done this if it were possible. I suspect that my understanding of linux is far too rudimentary at the moment.
-
I presume that if the originals are not found the system replaces it with a default version giving full specs to the SSA?
You presume wrong. The app takes care of that in runtime. Nonetheless, most of your previous analysis is correct.
As such, you may answer my pm and I'll be able to help you.
-
Hi,
I have a Siglent SSA3032X Firmware V1.3.9.7 2021/1/30. I tried reading most of the 39 pages of this thread, to be able to unlock the extra available options. I know there should be enough information in this thread to achieve this, but all the talk of upgrading, downgrading, locking, unloking, downloading files not available any more, is rather confusing and i don't want to brick my device. Could somebody please point me in the right direction ?
-
I have a SSA3021 Plus that I have cross loaded the firmware to make it think its a SVA1032. Thanks for the great info , it works great as a 3.2 Ghz SA.
I cant seem to understand how to get the Smith charting of Distance to fault to work correctly, I can use the options to get the displays but the data isn't correct. I have performed the open, close, 50 ohm load calibrations. I dont have a huge amount of vna experience so I am not sure if I am correct to assume the SSA hardware is capable of the SVA functions.
I did check in the forum but I cant find a post that details the difference in the hardware, there is some mention that a SSA and SVA have different front ends.
When you cross load firmware from a SVA onto a SSA:
Is it correct to assume the TG becomes Port 1 and RF-In becomes Port 2?
Or
Do you need to add an external bridge to use the VNA functionality on the SSA hardware.
Apologies in advance if I have missed the obvious.
Cheers
-
Maybe your SSA misses an internal cable. Check the forum as that are plenty of examples of how to solve the matter.
-
Perfect , found the problem.
Thanks
Jamie
-
New Firmware Version： V1.3.9.8
1. This firmware must be upgraded from V1.2.8.1 or later. If your SSA3000X has an earlier
version, please update to V1.2.8.1 first and then proceed to update to the latest version.
2. Compatible with different batches hardware
https://int.siglent.com/download/firmwares/?ProId=29
-
Nothing new or fixed in the new update?
I will wait for a next one
-
I bet they had to change some component due to lack of supply, like the LCD screen or something else, and this FW just has the required driver supporting it added.
-
I just got hold of my calib data backup, as well as my original XML files:
drwxrwxrwx 1 1000 1000 4,0K oct 23 23:27 .
drwxrwxrwx 1 1000 1000 4,0K oct 23 23:27 ..
drwxrwxrwx 1 1000 1000 20K oct 23 23:27 calib
-rwxrwxrwx 2 1000 1000 480 may 12 03:04 nsp_data_b
-rwxrwxrwx 2 1000 1000 425 may 12 03:04 NSP_sn_bandwidth.xml
-rwxrwxrwx 2 1000 1000 606 may 12 03:04 NSP_trends_config_info.xml
I'm running a 2018 ancient 1.2.9.1. I converted to 3032X (3031X non plus originally).
I'm looking for some advice on upgrading it further head without affecting the options, and possibly restoring my SN. Keeping telnet is a bonus.
-
I'm running a 2018 ancient 1.2.9.1. I converted to 3032X (3031X non plus originally).
I'm looking for some advice on upgrading it further head without affecting the options, and possibly restoring my SN. Keeping telnet is a bonus.
If you are at 3032 with all options, how further do you wanna go? :-//
-
Like running a firmware that isn't 4 years old? (I understand English is not your first language, so no offense taken, but it was obvious I was asking about firmware upgrade safety).
Anyway, I went ahead and backed up the data again, and performed a 1.3.9.x upgrade from 1.2.9.x. It's working fine, although I do want to verify calibration and check that everything is working fine. I did not restore the SN, but that isn't causing any woes.
Some users have reported problems with some calculations coming skewed in the UI (I have to dig into the thread, but not today) during cont sweep.
-
Hi,
I'm about to buy a SSA3021X Plus (2.1G). As of Nov 2021, is it still possible to upgrade a base model (to 32x Plus) and unlock all sw options?
1. Do you get to use the latest firmware version? The post above mentions a 'skewed UI'.
2. Do you keep the unique serial number?
Particularly interested in the Advanced Measurement option (power measurement in a user defined band), Reflection/VSWR option and Modulation Analysis options. These are quite useful options.
Has anyone tried the VSWR option with a 3rd party reflection bridge? Does the in-built software allow you calibrate out non-linearity in the bridge? If so, I assume the software would ask you to perform an O/S/L cal on the end of the bridge. Nothing in the user manual on the SWR option.
Thanks.
-
Hi,
I'm about to buy a SSA3021X Plus (2.1G). As of Nov 2021, is it still possible to upgrade a base model (to 32x Plus) and unlock all sw options?
1. Do you get to use the latest firmware version? The post above mentions a 'skewed UI'.
2. Do you keep the unique serial number?
Particularly interested in the Advanced Measurement option (power measurement in a user defined band), Reflection/VSWR option and Modulation Analysis options. These are quite useful options.
Has anyone tried the VSWR option with a 3rd party reflection bridge? Does the in-built software allow you calibrate out non-linearity in the bridge?
Thanks.
Yes, this just the standard process of Normalize where any TG sweep irregularities are nulled.
If so, I assume the software would ask you to perform an O/S/L cal on the end of the bridge. Nothing in the user manual on the SWR option.
OSL Cal is used on a VNA not a SA.
Last time I used the SWR feature in SA mode it was self explanatory but of late I have been spoilt with using a SVA in SA mode for this.
-
On the SSA3021X with an external reflection bridge, the only calibration option is for OPEN.
-
Dear All ,
can someone post a revised guide for a 3021X (NON PLUS) at SW1 : 1.2.9.2.a? HW:0F.30.00
because I got quite confused and I think there are some "special files missing" ( or guide me somehow OR point me to the right direction ? )
If someone could help me out I would gladly appreciated it.
Thanks
the idiot.
-
I also hacked my SAA3021x years agoe to be a SAA3032x running FW 1.2.9.2.a (HW: 07.03.00).
Telent is open and i would also be happy about some help/guide on how to update to the latest firmware without loosing telnet and the other options.
To be honest, the thread has become too confusing to me. :-\
-
have anybody tried the TekBox EMCView pre-compliance software (Link (https://www.tekbox.com/product/emcview-pc-software-emc-compliance-testing/)) with a hacked Siglent? They state the software will be locked to the SSA's serial number, but wil this work with a hacked unit?
I have the original S/N, but I suppose the unit reports "XXXXXXXX" back to the software?!?
I suppose this is a long shot, but there's likely no workaround for this issue? I'm interested in upgrading my dated SA with a more modern unit with proper features for EMC pre-compliance testing. Still, for personal HAM work, some of the options available would be a nice addon. And to really dive into the deep end, having a chance to enable VNA features by crossgrading to SVA (from SSA3000X+) is really tempting.
I'm having a hard time making my mind about the balance between the features I really need and what are "nice to have". I would definitely benefit from EMCView for wok, but that route seems to block all the other nice possibilities.
-
Can someone please explain to me, what measurements are requir do for EMC? I might eventually add those to my software.
EMC testing is something I have never done, so I would need some assistance.
-
Hi,
I'm about to buy a SSA3021X Plus (2.1G). As of Nov 2021, is it still possible to upgrade a base model (to 32x Plus) and unlock all sw options?
Just out of curiosity...did you succeed in turning your 21x plus into a 31x plus?
Wanna give myself a xmas gift and getting me a 3021x as well for upgrading....though not sure if I should better go for the plus version.....although TG is a software option as well...
-
Hi,
I'm about to buy a SSA3021X Plus (2.1G). As of Nov 2021, is it still possible to upgrade a base model (to 32x Plus) and unlock all sw options?
Just out of curiosity...did you succeed in turning your 21x plus into a 31x plus?
Wanna give myself a xmas gift and getting me a 3021x as well for upgrading....though not sure if I should better go for the plus version.....although TG is a software option as well...
Certainly the little more for SSA3021X+ is well worth it....touch and mouse capable, webserver, modulation analysis and a better and dedicated EMI mode.....it's a no brainer and why we have chosen only to stock the Plus model.
BTW all SSA models have TG enabled free of charge.
-
Well thanks for that clarification......but....
Still don't know if the SSA3021X Plus could be upgraded/modified with current firmware it is shipped.
-
Well thanks for that clarification......but....
Still don't know if the SSA3021X Plus could be upgraded/modified with current firmware it is shipped.
More/better information is in this thread:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/ (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/)
-
For anyone who's interested, I have dug through and found a complete list of SCPI commands avaliable here:
https://www.eevblog.com/forum/testgear/siglent-sva1015x-1-5ghz-spectrum-vector-network-analyzer-(coming)/msg3881942/#msg3881942 (https://www.eevblog.com/forum/testgear/siglent-sva1015x-1-5ghz-spectrum-vector-network-analyzer-(coming)/msg3881942/#msg3881942)
-
The list has been vaguely discussed in both SSA/SVA threads.
Note that some commands, if used incorrectly, can mess up your device.
Cheers,
Vitor
-
Hello,
Attached is a link for another FW I "found" for the SSA3021X: https://we.tl/t-lFH6APawHi (https://we.tl/t-lFH6APawHi)
It is the latest firmware release (SSA3000X_1.3.9.7), but it ADDS telnet if not already activated (instead of removing it) and it ADDS the webserver posted by frankvh2: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg3451746/#msg3451746 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg3451746/#msg3451746)
Note that all credits for the webserver go to frankvh2!
Just run the update and you get both.
If there is any problem, let me know. It worked fine on my unit. This FW has nothing to do with any license hacks: these are not touched or modified.
UPDATE:
The previous link expired. Here is a new one: https://we.tl/t-f5ZHi6Rhmq (https://we.tl/t-f5ZHi6Rhmq)
It will expire April, 15th and I will not repost it, so get it now.
Only reposting due to EEVBlog's server downtime...
Regards,
Vitor
Sorry to revive this old post ... but having an SSA3021X successfully hacked with 1.2.9.1 on it i'm quite interested to upgrade to a recent firmware without losing Telnet support.
I searched a lot on the web and found nothing, could you PLEASE help me in this matter ?
Regards,
Marco
-
For precompliance work you could just use the peak detector and just get radiated and conducted emissions as low as possible.
If you are doing compliant work, you will need the correct EMC bandwidth depending on the frequency range. You can calculate it with 10log(bw1/b2) as a correction factor.
Having a Dbuv scale is a must for compliance work unless you like wasting a lot of time doing conversions. The Siglent EMC option is worthwhile compared to buying a old clunky slow spectrum analyzer with no emc.
Doing radiated emissions these days in any civilised place is just about impossible since the RF spectrum is so occupied and polluted. You can use a dipole, loop or biconical.
Forget about buying super expensive junk on Ebay( all over priced and no cal certificate) Most of these antennas have worn out RF connectors, mechanical problems and other issues. Cal certificate data is hard to find. If you pay for a cal you might as well buy a new antenna!!!
The Tekbox biconical would make a decent antenna since you get some calibration data. Any antenna with no cal certificate is only useful for relative compliance work and nothing else. Just about all EMC equipment on Ebay is worn out junk whose prices are ridiculous for 30 year old rubbish. It is ridiculous how surplus dealers have become. Save and buy new!
A LISN and a set of decent of near field probes are a must. Just forget about the Chinese junk PCB near field probes, just make them with decent microwave coax. You need properly shielded probes that is decoupled for common mode rejection and better balance.
There is no EMC problem that cant be solved if you know what you are doing even with homemade decent equipment that is technically correct. Compliance measurements needs expensive equipment if you want to just go below the limit line to pass. 1 or 2 Db is a big deal in EMC when reingineering costs could cost millions!
EMC is testing is relative straightforward with decent equipment, its a nightmare when are using equipment that is not calibrated. You also need a decent RF silent location even when doing things like 1 meter radiated emissions testing. When you unsure, shoot for 10Db under the limit lines to be sure if you are using marginal equipment.
Good luck
-
Hi, can anyone help me restore the SN? I have the the SSA plus version now SVA and telnet access.
-
Hi, can anyone help me restore the SN? I have the the SSA plus version now SVA and telnet access.
The key has similar generating pattern to the SDS series scope. SSA even gives you a gdbserver for debug. After placing a few breakpoints on the main app you will find the exact string for hash.
-
Hi there,
Lurker here. Sorry to revive the thread. I am considering getting a SSA3021X Plus and I was wondering what is the current state of things? Is there still an upgrade door available for the SA? Also, is there a way to get a discount when buying from Europe?
Thank you!
-
Hi all. I have a SSA3021X with firmware version 2.1.1.1. I guess it's firmware for the Plus version, as there is options for touch screen but not a physcially touch screen. There is also an integrated webserver. I can't get any connection via LAN and Telnet. Now my question: Can I "upgrade" this scope to 3.2GHz? If so, how? Thanks in advance.
-
... the script works great with FW: 1.3.9.6 for my SSA3021(NON+) which is now a fully modified SSA3021 all options permanet
Great Job
Thanks and regards from Munich :)
-
Hi. Did you installed an older firmware than default in the instrument? If so, what was your default firmware? Thanks.
-
Hi. Did you installed an older firmware than default in the instrument? If so, what was your default firmware? Thanks.
Hi, modification has been done with 1.3.9.6, which was updatet from initial version 1.3.9.5 @ delivery.
Finally after modification updated to 1.3.9.7
Regards
Thomas
-
Hi all,
I got a SSA3021X plus running the 3.2.2.5.0 firmware. Is there a way to increase the span to 3.2GHz? I looked through the forum posts but got lost in a lot of non plus messages.
Thank you!
-
Just wanted to confirm that I managed to unlock it (thanks @cubitus), so the upgrade path for brand new SSA3021X Plus with 3.2.2.5.0 is still there.
-
Hi. Can you tell us how you did it in more detail? Thanks.
-
I will quote the instructions I received which were good for me:
TELNET
IP web browser of the SSA3021
- telnet to port 5024 (SCPI) and send the command 'DEBTTT' (this should start a telnet server on port 23)
- telnet to port 23 and log in as 'root', pw 'ding1234
at first ceca just allows you to have all the options #428
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/425/ (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/425/)
to go further : #1620
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3563577/#msg3563577 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3563577/#msg3563577)
-
:) Thanks. I will try this method.
-
Hi all,
Do you have to do something different as described in #1620 ? Did you flash it with the new SVA V3.2.2.5.0 or with the SVA 3.2.2.4.0 Firmware?
Did you deviate from something else?
I Also got a new SSA3021X Plus with the 3.2.2.5.0 FW installed.
Sorry, that I'm asking I'm a little nervous
Tanks :)
-
Again for the latest version...
For those that have the v3.2.2.5.0 version, you can download the SVA1000X_V3.2.2.5.0 from Siglent site and do this patch using an hexeditor. After that, flash the firmware in your SSAX+ and you'll have a SVA.
PS: Combine this with previous instructions as it will only replace some parts.
-
Thank you so much! :)
-
Hi. Did you installed an older firmware than default in the instrument? If so, what was your default firmware? Thanks.
Hi, modification has been done with 1.3.9.6, which was updatet from initial version 1.3.9.5 @ delivery.
Finally after modification updated to 1.3.9.7
Regards
Thomas
Mine was at 1.3.9.8, dropped it down to 1.3.9.6 and was able to telnet on port 10101 with the file SSA3000X_telnet listed by tv84,
I didn't have to use a login or pw, when I tried it didn't recognize the commands, but it was displaying the Arago project logo and seem to be responding, I then typed in the following commands.
cd /
cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
the progress bar on the SSA stopped at 60% so I waited about 20 minutes, I then pulled the USB out and re started the SSA, it was not bricked, then read the USB stick on the PC and the two files were in there. I tried the whole procedure again and this time after the two files were written to the USB stick by the SSA using SSA3000X_telnet I entered the following commands,
cd /
mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
cd /usr/bin/siglent/firmdata0
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
cd /
cd /usr/bin/siglent/usr/backup
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
cd /
sync
exit
didn't get any errors but after re starting the SSA it turned on just fine but no upgrades. |O
Any help would be appreciated.
-
Hi. Did you installed an older firmware than default in the instrument? If so, what was your default firmware? Thanks.
Hi, modification has been done with 1.3.9.6, which was updatet from initial version 1.3.9.5 @ delivery.
Finally after modification updated to 1.3.9.7
Regards
Thomas
Mine was at 1.3.9.8, dropped it down to 1.3.9.6 and was able to telnet on port 10101 with the file SSA3000X_telnet listed by tv84,
I didn't have to use a login or pw, when I tried it didn't recognize the commands, but it was displaying the Arago project logo and seem to be responding, I then typed in the following commands.
cd /
cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
the progress bar on the SSA stopped at 60% so I waited about 20 minutes, I then pulled the USB out and re started the SSA, it was not bricked, then read the USB stick on the PC and the two files were in there. I tried the whole procedure again and this time after the two files were written to the USB stick by the SSA using SSA3000X_telnet I entered the following commands,
cd /
mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
cd /usr/bin/siglent/firmdata0
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
cd /
cd /usr/bin/siglent/usr/backup
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
cd /
sync
exit
didn't get any errors but after re starting the SSA it turned on just fine but no upgrades. |O
Any help would be appreciated.
Root and PW is necessary
-
Got it figured out thanks to Thomas. It's running with 1.3.9.8 :-+
Thank you for all the help guys,
-
Hello,
is it possible to patch a ssa3032X-R to be a ssa3075X-R ? if so, where I can find the information , thanks
-
Someone asked about the EMCView software once, maybe the attachment will be useful to someone who has a spectrum analyzer with the serial number XXXX (and not only) :P
Edit by gnif: Attachment removed, we are not a cracking/warez site.
-
I don't consider it reasonable to publish a keygen for a software that is still in development and being sold.
Why harm this company? Should they rather close business and stop furher development?
-
I don't consider it reasonable to publish a keygen for a software that is still in development and being sold.
Why harm this company? Should they rather close business and stop furher development?
The company will buy such software because it needs support, a few amateurs hacking a Siglent device would never buy it and it would not hurt the software manufacturer (the company does not hack spectrum analyzers to have a serial number XXXXX). Hacking Siglent devices - theoretically, we also harm the device manufacturer. How is cracked software running on a spectrum analyzer different from software running on a PC ? (symptoms of hypocrisy ?)
Looking at it differently - an amateur electronics engineer who builds do-it-yourself constructions can get to know the software (as well as EMI / EMC issues) better, which may translate into purchasing software in the company he works for.
For example, at home I use hacked devices such as Siglent, Rigol etc. as well as such software (I have a limited budget for DIY), but in my company I already have legal versions of devices and software (The company earns more because I buy two devices, one cheaper for my home, the other more expensive for my business).
-
Hi all. I have a SSA3021X with firmware version 2.1.1.1. I guess it's firmware for the Plus version, as there is options for touch screen but not a physcially touch screen. There is also an integrated webserver. I can't get any connection via LAN and Telnet. Now my question: Can I "upgrade" this scope to 3.2GHz? If so, how? Thanks in advance.
I have the exact same issue. Version 2.1.1.1 seems to be a version shipping with new units that isn't available publicly on Siglent's website. My unit seems to indicate that this firmware update was from October 11, 2021.
It won't seem to let me downgrade to a 1.x.x.x version either. No telnet connection for me, though I can get a ping. I am wondering if Siglent is trying to permanently patch new units to be unhackable through the currently known means and is holding on to the new firmware to prevent people from messing around with it.
-
It won't seem to let me downgrade to a 1.x.x.x version either. No telnet connection for me, though I can get a ping. I am wondering if Siglent is trying to permanently patch new units to be unhackable through the currently known means and is holding on to the new firmware to prevent people from messing around with it.
Did you try this one? https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4143817/?topicseen#msg4143817 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4143817/?topicseen#msg4143817)
-
It won't seem to let me downgrade to a 1.x.x.x version either. No telnet connection for me, though I can get a ping. I am wondering if Siglent is trying to permanently patch new units to be unhackable through the currently known means and is holding on to the new firmware to prevent people from messing around with it.
Did you try this one? https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4143817/?topicseen#msg4143817 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4143817/?topicseen#msg4143817)
Yes I did. No telnet on port 5024 either.
-
You must be doing something wrong then.
This is the SCPI port and it must work.
-
I figured I might be. It's been a while since I have done anything with telnet like this and it isn't my specialty. I tried it with both PuTTY and the Windows built-in telnet.
-
Ok, I was definitely doing it wrong xP. I wasn't telnetting to the right thing lol. I was able to telnet into port 5024 and reactivate telnet on port 23 just as was suggested. Now I just have to run back through this thread to find the appropriate method to pull off the hack.
-
Ok cool! Was able to telnet in and change the file names and now everything is unlocked! Though I didn't do the thing where my SN is preserved, but I don't really care too much unless that somehow causes issues.
I followed this procedure:
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1299182/#msg1299182 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1299182/#msg1299182)
Now I am only curious about this mysterious 2.1.1.1 firmware that doesn't seem to be available on Siglent's website.
-
Ok cool! Was able to telnet in and change the file names and now everything is unlocked!
Now I am only curious about this mysterious 2.1.1.1 firmware that doesn't seem to be available on Siglent's website.
Happy that you managed to unlock options!
Regarding instruments sold with a newer firmware version than published as an update, it's not the only case: for example, SDS2202X-E scopes have been sold with firmware 1.1.20R3 since at least mid-2021, but most recent published firmware is still 1.1.19R5 dated 3/2020. I have one and I managed to find a copy of the 1.1.20R3 update ADS file thanks to an eevblog user. I have complained about this more than once and also with the Siglent representative for my country, but with no feedback from the factory. I wonder if the new release may not be 100% compatible with earlier hardware versions, although it seems to work fine with my scope and solves several bugs.
-
Hi. Did you only change file names (and not edit any of the files)?
I have managed to get access via telnet, but the NSP_sn_bandwidth.xml only contains:
<?xml version="1.0"?>
<nsp_system_info_root>
<device>
<system_information>
<serial_number>
<chip>0123456789</chip>
</serial_number>
</system_information>
</device>
</nsp_system_info_root>
and the NSP_trends_config_info.xml
<?xml version="1.0" encoding="UTF-8"?>
<nsp_trends_info_root>
<device>
<language>english</language>
<pid>0x1301</pid>
<vid>0xf4ec</vid>
<product_type_1>SSA3075X</product_type_1>
<product_type_2>SSA3050X</product_type_2>
<product_type_3>SSA3032X</product_type_3>
<product_type_4>SSA3021X</product_type_4>
<product_type_5>SSA3015X</product_type_5>
<manufacturer>Siglent</manufacturer>
<Support_Touch_Flag>1</Support_Touch_Flag>
<Support_VXI11_Flag>1</Support_VXI11_Flag>
<file_prefix>CP_</file_prefix>
</device>
</nsp_trends_info_root>
Thanks in advance!
-
I have one of the first ssa3021X (from 2016 :o OMG, how time flies) - this one could be hacked with the serial number preserved. This is also important, because e.g. EMCView from Tekbox is licensed to the serial number of the SA and will (probably) not run without a SN.
This fact has so far kept me from switching to a Plus model. As I am not 100% sure, I am asking: there is still no way to keep the serial number, even with the newer ssa3021X-Plus devices?
-
Hi. Did you only change file names (and not edit any of the files)?
You only need to change the file names to pull it off. However, your serial number wont be preserved in the system. I dont see exactly why it might need to be preserved anyway though some seem to say it might prevent firmware updates from deleting the exploit. The methods for preserving the SN seems a bit more complicated so I just went the easy route.
-
Yes, Root and password are needed, but how do you enter them when it doesn't ask for them?
-
Hi. Did you installed an older firmware than default in the instrument? If so, what was your default firmware? Thanks.
Hi, modification has been done with 1.3.9.6, which was updatet from initial version 1.3.9.5 @ delivery.
Finally after modification updated to 1.3.9.7
Regards
Thomas
Mine was at 1.3.9.8, dropped it down to 1.3.9.6 and was able to telnet on port 10101 with the file SSA3000X_telnet listed by tv84,
I didn't have to use a login or pw, when I tried it didn't recognize the commands, but it was displaying the Arago project logo and seem to be responding, I then typed in the following commands.
cd /
cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
the progress bar on the SSA stopped at 60% so I waited about 20 minutes, I then pulled the USB out and re started the SSA, it was not bricked, then read the USB stick on the PC and the two files were in there. I tried the whole procedure again and this time after the two files were written to the USB stick by the SSA using SSA3000X_telnet I entered the following commands,
cd /
mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
cd /usr/bin/siglent/firmdata0
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
cd /
cd /usr/bin/siglent/usr/backup
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
cd /
sync
exit
didn't get any errors but after re starting the SSA it turned on just fine but no upgrades. |O
Any help would be appreciated.
Root and PW is necessary
How to enter root and the password ? It doesn't ask for it, straight to the command prompt.
-
Picture or it did not happen!
You are either telnetting to some other device or you are using the SCPI port at 5224 (if I am not mistaken). That does work with telnet protocol but only accepts SCPI commands.
-
I just got a SSA3021x with 2.1.1.1.r1 firmware. I was able through the telnet do the hack, specifically:
Format USB flash drive as FAT32 and insert into unit, then:
- telnet to port 5024 (SCPI) and send the command 'DEBTTT' (this should start a telnet server on port 23)
- telnet to port 23 and log in as 'root', pw 'ding1234
cd /
cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
cd /usr/bin/siglent/firmdata0
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml
mv nsp_data_b1 nsp_data_bx
cd /usr/bin/siglent/usr/backup
mv NSP_sn_bandwidth.xml NSP_sn_bandwidthx.xml
mv NSP_trends_config_info.xml NSP_trends_config_infox.xml
mv nsp_data_b1 nsp_data_bx
cd /
sync
logout
reboot
Note, I had to change the nsp_data_b to nsp_data_b1, but once I did this It shows all the options.
Then I went to upgrade the firmware from siglent website and it appears that firmware updates do not work. The unit shows it is updating firmware and has hour glass icon for several second but then when done it does not reboot and the firmware is the same version.
Has anyone else seen this problem?
-
I think the issue is that my unit is not the SSA3021X plus but rather the SSA3021X, so if you are buying a new unit you might want to make sure you are getting a plus unit, which appears to have higher bandwidth capability?
-
I think the issue is that my unit is not the SSA3021X plus but rather the SSA3021X, so if you are buying a new unit you might want to make sure you are getting a plus unit, which appears to have higher bandwidth capability?
Yes, it's different electronics, the Plus version can be upgraded to the full functionality of the SVA version (it's the same electronics). So we get VNA, digital modulation analysis etc.
However, in the case of the non-plus version, we can still extend the band to 3.2 GHz.
Recently, there has been some change regarding the hacking of spectrum analyzers from Siglent. It may turn out to be easier than you think;)
Check out this topic on the forum: https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4355635/#msg4355635 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4355635/#msg4355635)
-
I returned the SSA3021X and purchased the SSA3021X-plus instead, for the extra $200 it is worth it to have the VNA features.
Thanks
-
I returned the SSA3021X and purchased the SSA3021X-plus instead, for the extra $200 it is worth it to have the VNA features.
Thanks
If it was possible, it was a good choice - now it is worth paying extra for the Plus version.
-
You are either telnetting to some other device or you are using the SCPI port at 5224 (if I am not mistaken). That does work with telnet protocol but only accepts SCPI commands.
Not absolutely sure about the 3021X, but with 3021X+ that I have, using tv84 special boot file to enable telnet on port 10101, no username/password are required. You get straight inside the Linux console.
Also later, by modifying startup_app.sh to include the telnet daemon.
User/pw are required if starting telnet from SCPI with command DEBTTT. Perhaps also when using the internal hardware serial port, but I never opened the unit to try ;).
-
I stand corrected.
-
New Firmware Version： V2.1.1.3R1
Improvements:
• Optimize the Ref level and Att couple
Solved Issues:
• Fix the zero sweep type when fft in SA mode
• Fix the OPC response in EMI mode
https://int.siglent.com/download/firmwares/?ProId=29
-
New Firmware Version： V2.1.1.3R1
This firmware must be upgraded from v2.1.1.1 or later. If your analyzer has an earlier version, don’t use this FW to update.
Huge change of Prod_ID to 11413.
Let's see what are the rest of the surprises...
-
I wonder if this is new HW... ::)
-
This is indeed probably due to new HW.
The old models with FW1.x are not compatible with FW2.x and vice-versa..
Interestingly they replaced the "ecomb" with the new "Aladdin " binary.
The Aladdin bin is 22622469 bytes in size, while the ecomb has just 5113340 bytes (latest FW). The Aladdin FW is 4x bigger! Can it be the same bin as used by the Plus model?
This single FW works for 15, 32 and 75 models. But hold your horses: the FW has an individual folder with the bin file for the FPGA. I don't know if the HW is really the same for 32 and 75 models, but chances are, it might actually be. --> any volunteer with a new FW 2.x model wanting to test if you can upgrade the 15 to 32 or 75, or the 32 to 75? This is interesting!
Finally, despite the new public hack, it is good news that the hash used remains the same.
Other interesting things: this firmware activates a FTP daemon and a VNC daemon. These did not exist in FW1.x. My guess is that the base HW has a faster CPU? Nah, I really think they use the same base HW for SSA-X/SSA-P/SSA-R/SVA (note that the SVA-R has an extra RT board fitted). Probably the board/device is not fully populated for higher models. This makes sense to keep prices competive. The SSA line has probably been effectively stopped from a HW point of view and for commercial reasons there is a new low-cost SSA-X based on the same HW platform as the SSA-P/SVA
UPDATE: I just checked and the Aladdin bin of the lates FW for the SSA-P is 13,856,588 bytes in size, half the size of the new SSA-X bin. That is strange!
UPDATE2: Apart from a different CRC on the Aladdin bin, all remaning files have the same CRC (SSA-X vs SSA-P) - All? Well, I checked most and they match. Conclusion: BOTH DEVICES USE THE SAME HW PLATFORM!
Regards,
Vitor
-
Then I wonder if there is the possibility of crossflashing a SSA-X 2.0 to SVA... ::)
-
A crossflash to SSA-P or SVA might be possible, now that I am thinking of it.
But It comes with added risk, while a Recovery USB is not available.
-
It kind of annoys me that the Aladdin is twice the size for the SSA-P.
Is it because this version works with all platforms and the license determines the functionality?
I would be interested to get any known key and matching HostID to check what model is used for the licensing.
But for sure there is potential for hacking! Any sponsor willing to provide me with a device?
-
These are the license options found in the new Aladdin bin:
AMK
tMeas
tAMK
tALL
tLALL
CAT
DMA
AMA
WDMA
RTA
tEMI
tTG
tCAT
tDMA
tAMA
WDMA
tDTF
tVNA
tRTA
3021
3032
1015
RT40
MA
tMA
NA
tNA
NONE
7075
t7075
7050
t7050
3032
t3021
t1015
RT25
Looks like this Aladdin works on all variants...
Perhaps there is no crossgrade required, but just the approriate license keys?
Just speculation, of course.
-
just ordered a SSA3032X-R anyone want hardware photos when it gets here ?
I'm hoping for a 7.5ghz unlock
-
Warning, I updated my hacked 3021X(non+) with the latest firmware (V2.1.1.3R1). Everything that was working before still seems ok. But, now I have a dozen options permanently enabled that showed up in the gui, but don't work! And worse, if I press Mode, I can get to the working modes, but trying to go back to spectrum analyzer locks up the system, requiring a reboot.
-
Warning, I updated my hacked 3021X(non+) with the latest firmware (V2.1.1.3R1). Everything that was working before still seems ok. But, now I have a dozen options permanently enabled that showed up in the gui, but don't work! And worse, if I press Mode, I can get to the working modes, but trying to go back to spectrum analyzer locks up the system, requiring a reboot.
Except that it was not latest update version for your SSA3021X !!!
There is clear information/warning about this:
These both pdfs are included in update zip.
From version history pdf:_ V2.1.1.3R1
2022/6/10
Notice:
This firmware must be upgraded from v2.1.1.1 or later. If your analyzer has an earlier version, don’t
use this FW to update.
And from Update instructions pdf:
Notes：
1. During the updating, do not cut off the power or pull out the U-disk.
2. If your analyzer has an earlier version（V1.x.x.x）, it can not upgrade to” V2.x.x.x” version and the “V2.x.x.x” version also can not downgrade to the earlier version
You have updated the FW but totally ignored these all warnings.
Whenever anybody is designing to do update what ever machine, it would be a good idea, or better say - mandatory to read all the relevant information BEFORE do anything else.
It's famous: RTFM and it's better to do it beforehand rather than afterwards.
ETA:
But also:
My opinion is that it is better that also Siglent write some note or other sign about this directly to download side:
https://www.siglenteu.com/service-and-support/firmware-software/spectrum-analyzers/#ssa3000x-series (https://www.siglenteu.com/service-and-support/firmware-software/spectrum-analyzers/#ssa3000x-series)
https://siglentna.com/service-and-support/firmware-software/spectrum-analyzers/#ssa3000x-series (https://siglentna.com/service-and-support/firmware-software/spectrum-analyzers/#ssa3000x-series)
Because there it just looks like normal latest update to all SSA3kX and as we know that today peoples do not read manuals or instructions. (as can see in many places and many situations wherever)
-
While it is not impossible to restore the FW, you should first try to get free help from Siglent. I find it unacceptable that the upgrade run through without a check to determine prerequisites.
The new FW is obviously for a unified FW/HW platform, not suitable for the original SSA3000X HW platform.
Contact your dealer and see what support they offer. They should send you instructions and a special image for USB that restores the original FW. Let us know how this rolls out.
If the refuse or want you to pay, we can try a different route. But this is an unofficial way that would definitely void your warranty and may not work, as this is untested territory.
And yes, read the instructions before doing something like this. There were warnings all over to not do this upgrade on older versions.
-
Perhaps, in this special case, better to call directly to Siglent NA office for support. Some dealers know only prices and how to send parcel...
And as Bicurico said: Please do not try anything until you get official instructions from Siglent for recover back to V1.x.x.x FW versions.
-
Warning, I updated my hacked 3021X(non+) with the latest firmware (V2.1.1.3R1). Everything that was working before still seems ok. But, now I have a dozen options permanently enabled that showed up in the gui, but don't work! And worse, if I press Mode, I can get to the working modes, but trying to go back to spectrum analyzer locks up the system, requiring a reboot.
Well, in theory, you shouldn't have been able to update as the new package has a Prod_ID = 11413. I think Siglent tried to ensure some protection there.
Nonetheless there could be some bug in their implementation OR something in your own setup that somehow disabled that basic protection.
When you say a "hacked 3021X", you mean with proper licenses or in "pro_mode" with files removed and S/N = XXXXXX... ?
-
Well, don't I feel stupid. I'm normally pretty good about checking documentation and usually read the Firmware Release Notes. Anyway, my unit is in "pro-mode" with files removed and S/N = XXXXXX. My distributer told me they only distribute, not service. So, I filled out an online Siglent message. I'll let you know how it goes. Thanks guys.
-
just ordered a SSA3032X-R anyone want hardware photos when it gets here ?
I'm hoping for a 7.5ghz unlock
It's possible.
Credit goes to tv84
Vna also works up to that frequency.
-
Hello everyone. I have a SSA3021X (non plus) with the 2.1.1.1 FW from the factory. It is stock and I want to enable all of the available options. The TG came enabled factory and currently is. I have read thru all of the threads in this topic and most in the other relevant topic. I gotta say..I am a bit confused so lets start here.
I cannot Telnet into this unit with PuTTY or with windows telnet at the cmd prompt. Does the Telnet script work or not?
Has anyone actually been able to "hack" a 3021X (non plus) unit with the most current FW? If so then how did you get access? Lol
My brain is swimming in too much info...most of it irrelevant I think.
Thanks:
Mike
-
Hello everyone. I have a SSA3021X (non plus) with the 2.1.1.1 FW from the factory. It is stock and I want to enable all of the available options. The TG came enabled factory and currently is. I have read thru all of the threads in this topic and most in the other relevant topic. I gotta say..I am a bit confused so lets start here.
I cannot Telnet into this unit with PuTTY or with windows telnet at the cmd prompt. Does the Telnet script work or not?
Has anyone actually been able to "hack" a 3021X (non plus) unit with the most current FW? If so then how did you get access? Lol
My brain is swimming in too much info...most of it irrelevant I think.
Thanks:
Mike
I suggest not to fiddle with telnet. There is better way. Safer, quicker, better...
-
There is no knowledge on this forum regarding the new models with 2.x.x.x firmware.
I suspect that these models might have a revised HW platform, shared with the SSA/SSA-P/SSA-R/SVA product line. This does not mean that generic crossgrade is possible, as some product lines have different modules built-in:
SSA: no touch screen
SSA-P/SVA: share the same HW and can be crossgraded
SSA-R: adds a realtime board
Also, some models go up to 1.5GHz, 3.2GHz or 7.5GHz. Again, they have different HW built-in.
It seems that the NEW 1.5GHz models now use the same HW as the 2.1/3.2GHz models and can be bandwidth upgraded, but that is just speculation.
If I remember correctly, the SSA-R can always be upgraded to 7.5GHz, but I am not sure about that one.
Conclusion:
1) If you have the new style SSA with FW 2.x.x.x, then do NOT flash an older 1.x.x.x FW or you will definitely brick your device! The FW upgrade PDF explicitly tells you not to do it. Why the FW does it anyway is beyond my comprehension and is a plain bug.
2) If you want to hack your new device, just use the keygen that has been published on this forum. It will allow you to get full options in a "clean" way.
3) If you read the threads again, you will find a secret SCPI command that enables telnet on SSA-P, SSA-R and SVA devices. I suspect it will work on your device, too. I am not just telling you what command it is, because i don't remember (I have an old SSA).
-
There is no knowledge on this forum regarding the new models with 2.x.x.x firmware.
I suspect that these models might have a revised HW platform, shared with the SSA/SSA-P/SSA-R/SVA product line. This does not mean that generic crossgrade is possible, as some product lines have different modules built-in:
SSA: no touch screen
SSA-P/SVA: share the same HW and can be crossgraded
SSA-R: adds a realtime board
Also, some models go up to 1.5GHz, 3.2GHz or 7.5GHz. Again, they have different HW built-in.
It seems that the NEW 1.5GHz models now use the same HW as the 2.1/3.2GHz models and can be bandwidth upgraded, but that is just speculation.
If I remember correctly, the SSA-R can always be upgraded to 7.5GHz, but I am not sure about that one.
Conclusion:
1) If you have the new style SSA with FW 2.x.x.x, then do NOT flash an older 1.x.x.x FW or you will definitely brick your device! The FW upgrade PDF explicitly tells you not to do it. Why the FW does it anyway is beyond my comprehension and is a plain bug.
2) If you want to hack your new device, just use the keygen that has been published on this forum. It will allow you to get full options in a "clean" way.
3) If you read the threads again, you will find a secret SCPI command that enables telnet on SSA-P, SSA-R and SVA devices. I suspect it will work on your device, too. I am not just telling you what command it is, because i don't remember (I have an old SSA).
Update:
Big thanks to @IAmBack and you for the help. I now have all available options enabled permanent. Next will be to find the secret SCPI command so that I can try to increase the BW to 3.2ghz. For what its worth the HW 00.00.00 as shown in the system info section.
Thanks again guys.
Mike
-
Is this the SSA3000X non Plus thread?
-
Is this the SSA3000X non Plus thread?
Back when this thread was started the Plus didn’t exist but since they have been lumped in together which does create some confusion. They operate almost identically however the options and feature set are slightly different.
-
Update:
Big thanks to @IAmBack and you for the help. I now have all available options enabled permanent. Next will be to find the secret SCPI command so that I can try to increase the BW to 3.2ghz. For what its worth the HW 00.00.00 as shown in the system info section.
Thanks again guys.
Mike
You need to generate keys for option: 3032
There is no SCPI command to increase the bandwidth.
-
Update:
Big thanks to @IAmBack and you for the help. I now have all available options enabled permanent. Next will be to find the secret SCPI command so that I can try to increase the BW to 3.2ghz. For what its worth the HW 00.00.00 as shown in the system info section.
Thanks again guys.
Mike
You need to generate keys for option: 3032
There is no SCPI command to increase the bandwidth.
Ahh..okay. I will try that first thing in the AM eastern time. Thanks!
Mike
Update: I tried the 3032 key but it shows invalid when entered. I even tried the ALL option. No luck with the frequency expansion.
-
Hi. Perhaps I can help you.
Go to your system info screen, and give me your "HOST ID" number.
-
hello,
thanks to this forum, I was able to modify my SSA2031X (year 2018, with FW version 1.2.8.5a) to obtain all the options and 3.2Ghz 😃
now I would like to update it with the latest version of Siglent compatible: 1.3.9.8
can I follow the classic update process and will I keep the modification made to jailbreak the device?
Thanks for your help
:-)
-
hello,
thanks to this forum, I was able to modify my SSA2031X (year 2018, with FW version 1.2.8.5a) to obtain all the options and 3.2Ghz 😃
now I would like to update it with the latest version of Siglent compatible: 1.3.9.8
can I follow the classic update process and will I keep the modification made to jailbreak the device?
Thanks for your help
:-)
Yes, and welcome to the forum.
-
Hi there!
I have an SSA3021X+ on order, Christmas gift to myself ;D
I have been trying to educate myself on the way to convert it to a SVA1032X.
So far, what I have found is this.
1) Need to do a backup with this script : https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3559946/#msg3559946 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3559946/#msg3559946)
2) Then enable telnet : https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3528256/#msg3528256 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3528256/#msg3528256)
3) Then crossflash with this process : https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3563577/#msg3563577 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3563577/#msg3563577)
Seems like there is a simpler process here: https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3518544/#msg3518544 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3518544/#msg3518544)
I believe that we also now need to restore the serial number, and use the Python script (https://www.online-python.com/PX3v0J8nbs) to generate the ALL license, as the final step.
Calibration data: https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4355749/#msg4355749 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4355749/#msg4355749)
Is there something I am missing? Trying to make sure I won't brick my unit, and also that I would be using the latest procedure because it seems like the newest firmware is different?
Thanks!
-
Has anyone been able to successfully crossflash a SSA3021X Plus that came factory with firmare 3.2.2.5.0 ?
I can use DEBTTT SCPI command to get telnet access. I can reflash SSA firmware version 3.2.2.5.0 over 3.2.2.5.0.
However, I cannot downgrade it to SSA version 3.2.2.4.0, and after changing the static ID from 11411 to 11403, I cannot crossflash to any SVA version either !!!
All I get in these situations is a "Upgrade fail" message at the bottom of the screen.
It is possible I am doing something wrong.... but I doubt it since I was able to flash 3.2.2.5.0 over itself, but not 3.2.2.4.0, showing that I can successfully edit the static_id.
Any idea?
[EDIT] The only thing I was able to flash is the newer SSA3021X Plus firmware 3.2.2.5.1R1. It seems to me that Siglent has done something to prevent crossflash AND prevent downgrade to 3.2.2.4.0 or below.
[EDIT2] Seems like other users had the same issue
- https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3853307/#msg3853307 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3853307/#msg3853307)
- https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4143763/#msg4143763 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4143763/#msg4143763)
EDIT: SOLVED: Instructions I found above were inapplicable. Starting from 3.2.2.4.0 Siglent changed the product ID. I used 11410 instead of 11403 and was able to crossflash. Now continuing the work and will post a summary of my steps later.
-
My logbook. No warranties whatsoever, only proceed at your own risk. I found it is NOT for the faint of the heart.
Initial state: brand new SSA3021X Plus with firmare 3.2.2.5.0
---
STEP 1: Backup the device
Download SSA3000X+_backup_NAND+mem+firmdata0_11411.zip from https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3559946/#msg3559946 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3559946/#msg3559946)
Format new USB disk as FAT32 with mkfs.vfat or similar, extract ADS file on disk.
Go to System menu, launch ADS file. Wait for system to reboot.
Once system is rebooted, delete ADS file from USB disk.
Compress all other files into a zip archive (I called mine initial_factory_as_delivered.zip), store in another secure location, and delete from USB drive.
USB drive should now be empty. You have successfully created a backup of your instrument.
---
STEP 2: Enable telnet
Connect the instrument to your home network (with DHCP) and find what IP it has (ask your router).
From https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg4233178/#msg4233178 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg4233178/#msg4233178) follow the specific instructions:
Enable telnet and login
- telnet to port 5024 (SCPI) and send the command 'DEBTTT' followed by enter on your keyboard (this should start a telnet server on port 23) and close this telnet session
- telnet to port 23 and log in as 'root', pw 'ding1234
Telnet to the instrument (telnet ip 23) and login
From this step onwards, you may have to repeat this STEP 2 as necessary to reenable telnet, as it may get disabled during various reboots and reflashes. If you get a connection refused on port 23, just redo the DEBTTT part.
---
STEP 3: Do a manual backup
Reinsert the now empty FAT32 USB drive to the instrument
Do a backup (per https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3563577/#msg3563577 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3563577/#msg3563577)) :
cd /
cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
cp -R /usr/bin/siglent/usr/config /usr/bin/siglent/usr/mass_storage/U-disk0/SA-config
cp -R /usr/bin/siglent/usr/usr /usr/bin/siglent/usr/mass_storage/U-disk0/SA-usr
cp -R /usr/bin/siglent/usr/vnacalikitdata /usr/bin/siglent/usr/mass_storage/U-disk0/SA-vnacalikitdata
cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
sync
umount /usr/bin/siglent/usr/mass_storage/U-disk0
Then immediately remove the USB drive, put it back to your computer, and do another ZIP file in a secure location (called mine initial_factory_as_delivered_manual.zip)
Then erase again the content of the USB drive.
You have now successfully performed a higher level, easier to access backup of the files in your instrument
---
STEP 4: Flash latest firmware
The current consensus is to flash the latest firmware before performing the hack. I would caution, before doing so, to check the latest posts in the various threads to make sure that the latest firmware, whatever it is, still allows the hack.
In my case, I flashed to https://int.siglent.com/upload_file/zip/firmware/Spectrum_analyzer/SSA3000X%20Plus_V3.2.2.5.1R1_EN.zip (https://int.siglent.com/upload_file/zip/firmware/Spectrum_analyzer/SSA3000X%20Plus_V3.2.2.5.1R1_EN.zip)
Flash and wait for reboot. Check version, should be 3.2.2.5.1R1.
---
STEP 5: Change product ID, to accept SVA firmware instead of SSA
Recently, for versions 2.2.4.0+, Siglent changed the product ID. It is no longer 11403, it is 11410, per https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/msg1364981/#msg1364981 (https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/msg1364981/#msg1364981)
Copied from https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3563577/#msg3563577 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3563577/#msg3563577) but updating the ID accordingly
1) Open telnet
telnet <SSA IP address> 10101 (for example, Windows terminal Win+R, CMD works)
2) edit /usr/bin/siglent/config/NSP_config_upgrade_info.xml to change ProductID:
replace
<upgrade_static_id>11411</upgrade_static_id>
with
<upgrade_static_id>11410</upgrade_static_id>
3) Finalise changes and reboot
sync && reboot
---
STEP 6: Crossflash to SVA
Flash unmodified, official SVA firmware https://int.siglent.com/upload_file/zip/firmware/Spectrum_analyzer/SVA1000X_V3.2.2.5.1R1_EN.zip (https://int.siglent.com/upload_file/zip/firmware/Spectrum_analyzer/SVA1000X_V3.2.2.5.1R1_EN.zip)
Extract ADS to the empty USB flash drive
Insert flash drive
Then flash and pray
If all goes well, unit will reboot. Check device info page, if all goes well you have a new option called "VNA" licensed "Permanent"
You can press the Mode hardkey and you should also have a Vector Network Analyzer option. Nice!
But the bandwidth is still limited to 2.1GHz...and your unit still thinks it is a SSA3021X Plus.
---
STEP 7: Model edit and prepare bandwidth hack
mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
cd /usr/bin/siglent/firmdata0
vi NSP_trends_config_info.xml
As below
<?xml version="1.0" encoding="UTF-8"?>
<nsp_trends_info_root>
<device>
<language>english</language>
<pid>0x1301</pid>
<vid>0xf4ec</vid>
<product_type_1>SVA1032X</product_type_1>
<manufacturer>Siglent</manufacturer>
<Support_Touch_Flag>1</Support_Touch_Flag>
<Support_VXI11_Flag>1</Support_VXI11_Flag>
<file_prefix>CP_</file_prefix>
</device>
</nsp_trends_info_root>
vi NSP_sn_bandwidth.xml
As below (make sure to put your serial number):
<?xml version="1.0"?>
<nsp_system_info_root>
<device>
<system_information>
<serial_number>
<chip>0123456789</chip>
</serial_number>
</system_information>
</device>
<serial_number>SSA3PCxxxxxxxx</serial_number>
</nsp_system_info_root>
sync&&reboot
Now you have a SVA1032X in the System info menu.
---
STEP 8: Add options, liberate the bandwidth
Go to System Info. Note Host ID. Put it into the script here https://www.online-python.com/PX3v0J8nbs (https://www.online-python.com/PX3v0J8nbs)
Uncomment SVA1000X into the script.
Launch the script.
Add option 3032 using "Load Option" menu item. Unit will reboot and you will get 3.2GHz.
Add option ALL. Unit will reboot and you will get all other options.
Note that it takes several seconds, once you validate, to check the license. Be patient.
Also note that I just had trial for AMK EMI DMA AMA and permanent for VNA and TG. But now I have an extra option DTF that appeared, which is Time Domain Reflectometry.
---
STEP 9: Install VNA calib data
Extract files in cali.zip from post https://www.eevblog.com/forum/testgear/siglent-sva1015x-1-5ghz-spectrum-vector-network-analyzer-(coming)/msg3707803/#msg3707803 (https://www.eevblog.com/forum/testgear/siglent-sva1015x-1-5ghz-spectrum-vector-network-analyzer-(coming)/msg3707803/#msg3707803) to the root of the USB disk
mount -o remount,rw /usr/bin/siglent/firmdata0/
cp /usr/bin/siglent/usr/mass_storage/U-disk0/na_?p /usr/bin/siglent/firmdata0/cali/
sync && reboot
WARNING: I don't know where these files come from. It is likely that the instrument won't be perfectly calibrated. If that is an issue, maybe you can find a proper calibration lab, and ask them to calibrate your unit as if it was SVA1032X, but make 100% sure they don't send your unit to Siglent...
--
STEP 10: Verify that your unit has the VNA cable inside
Set the instrument to VNA mode, Lin/Phase Smith chart.
Connect a 50 ohms load. Curve should move to the center of the screen, roughly.
Congratulations, enjoy your new VNA.
My recommendation is to keep ALL files, inluding the backups, on a microSD card in a small ESD-proof bag, that you tape on the side of the instrument. You will thank yourself (and me) in a few years.
Thank you Siglent, and those who made this possible. I would never do that in my lab at work. But for hobbyists... this is awesome.
I hope my post will help new users.
-
STEP 9: Install VNA calib data
....
WARNING: I don't know where these files come from. It is likely that the instrument won't be perfectly calibrated. If that is an issue, maybe you can find a proper calibration lab, and ask them to calibrate your unit as if it was SVA1032X, but make 100% sure they don't send your unit to Siglent...
I believe those files simply hold the default calibration at startup, which is normally referred to the front panel N connectors. It is not particularly useful in my opinion, because it is old and normally overridden by the last saved (and applied) user calibration.
Besides, in my knowledge, no independent laboratory will replace those files: calibration labs check performance against specifications, while adjustments can be done only by Siglent. But they are normally required only in case of repair, with replacement of components.
-
Good to know, thanks!
What really tripped me up is the change of product IDs. It is really not well mentioned in the other posts, which prompted me to publish my howto.
11403 is no more, for these new instruments with newer firmwares.
-
Thank you uski for you very helpful summary. :-+ Just in time before the discounts end, have ordered SSA3021X-P. Noticed the very nice prices just days ago. Been on a lookout for a new SA already, I think this should just fulfill my needs. Will try your how to and report back in a week or two.
-
I found it is NOT for the faint of the heart.
Initial state: brand new SSA3021X Plus with firmare 3.2.2.5.0
No so. Currently all of this can be done by people with pacemakers or even TAH's :D but many continue to not read the latest developments... this thread is only 43 pages long and most of them only repeat what has already been said obscuring important details.
The easiest path is here (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg4249003/#msg4249003).
-
Is it possible to enhance the RBW to 3Mhz on a SSA3021X+ in order to speed up the SWT with the python script for example (I prefer not to try it if it's not possible in order not to break my warranty) ?
-
Hello
I have Sigllent Spectrum analyzer with model number SSA3021X.
SW1 is 1.3.9.6 can i upgrade V3.2.2.4.0?
can this model upgrade from 2.4Ghz into 3.2Ghz?
regards
Antony
-
Hello
I have Sigllent Spectrum analyzer with model number SSA3021X.
SW1 is 1.3.9.6 can i upgrade V3.2.2.4.0?
NO !
V3.2.2.4.0 is firmware for 3000X Plus models.
The correct firmware is here:
https://int.siglent.com/download/firmwares/?ProId=29
can this model upgrade from 2.4Ghz into 3.2Ghz?
Oh please, yours is a 2.1 GHz model, not 2.4.
It will upgrade and the methods are in this thread, please study it.
-
where can i find the firmware 7.07?
-
hello
thxs for replying, my current SW1 is 1.3.9.6 and HW is 0C.03.00
do i have to upgrade to the latest firmware? SSA3000X Firmware – V1.3.9.8 (Release Date 08.15.21 )
or SSA3000X_Firmware_V2.1.1.3R1 (Release Date 09.16.22 )
I was reading the methods of how to upgrading and i have some questions to ask you, before i proceed the procedure of hacking my siglent specrum analyzer, do i have to upgrade to the latest version? from SW1 1.3.9.6 into 1.3.9.8 or 2.1.1.3R1?
i heard about firmware version 7.07 where can i get that file ?
regards
Antony
-
I found it is NOT for the faint of the heart.
Initial state: brand new SSA3021X Plus with firmare 3.2.2.5.0
No so. Currently all of this can be done by people with pacemakers or even TAH's :D but many continue to not read the latest developments... this thread is only 43 pages long and most of them only repeat what has already been said obscuring important details.
The easiest path is here (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg4249003/#msg4249003).
Ah yes I saw that post. However, I like to understand what I do... I was not going to hex edit a bunch of bytes in a firmware image not knowing what it does. The more complicated way is much more transparent.
I think it would be good if you could explain what this modification does. I am assuming you are changing the header of the upgrade file and its checksum, so that the SSA applies the SVA firmware, thinking it is an SSA firmware. But more details would really help!
As you say, a lot of minimalistic, 2-3 lines post, require a lot of context and are really hard to process for people new to this thread. 40+ pages is a lot of information and we should not require people to read everything to do the hack.
By posting what I did, from A to Z instead of requiring people to compile a bunch of partial information, I was hoping to give a one-stop-shop post with clear and transparent explanations. But yeah, it's likely the way you shown is much easier and simpler :-+ could just do with more explanations
Thanks for your help, definitely would not have been possible without you and others :)
-
I am assuming you are changing the header of the upgrade file and its checksum, so that the SSA applies the SVA firmware, thinking it is an SSA firmware.
That's exactly that and only that! :-+ (it's in the thread somewhere...)
You did well, no worry.
-
Hello and Happy New Year! to everyone
I've just received my new SSA 3021X plus and I'm very happy but the firmware is 3.2.2.5.1R20
And Unfortunately the backup SSA3000X+_backup_11411.ADS doesn't work for me :(
The usb stick is empty only with ads file. Maybe I'm doing something wrong or it is related to the firmware
I also try downgrade to 3.2.2.5.1R1 the screen show progress but after rebooting the firmware is the same.
Any ideas?
P.S. I'm not familiar with linux but is it anywhere instructions how to make backup trough telnet and of what?
I've already hex modified 3.2.2.5.1R1 ads file.
-
Regarding not working backup SSA3000X+_backup_11411.ADS - of course script will only work under following conditions;:
- Before crossflash on original SS3000X *Plus* devices with V3.2.x.y.z firmware
- Plugged in USB-Stick formatted with a single FAT32 partition
- USB-Stick should allow write access: try with File|Create Folder if you can create a new folder on your stick
Otherwise reformat the USB stick with FAT32 (not ExtendedFAT) and with MBR (master boot record).
If it still does not work after that, it will be necessary to go the way over telnet and to re-mount the mass-storage filesystem once in RW-mode.
-
Thank yo so much!
I've already tried all of this, usb stick is freshly formatted.
The device is in initial state with its firmware 3.2.2.5.1R20
How about telnet access I've succeed trough pot 10101, but and how to change the filesystem to RW-mode?
-
I just tested it again, I think using File|Create Folder works because the main application process /usr/bin/siglent/Aladdin runs as root and therefore it can write.
So telnet to your device and execute:
mount -o remount,rw /usr/bin/siglent/usr/mass_storage/U-disk0
Then load this "pseudo" firmware update with backup script.
After you are done just restart the device once, then all filesystems are read only again.
-
Thank you again so much For the help DeDe!
I succeeded in everything and the upgrade is finished successfully
But unfortunately It seem like something is missing in VNA part maybe This VNA cable.
The Smith chart was total Mess and after adding the two configuration files na_1p na_2p it becomes more or less normal at least now is in the contour of the chart :D
But the port Doesn't react to any Load 50ohm Close - Nothing!
Where is this "VNA cable" and is there a fix to this?
Any other guy with same version of this firmware 3.2.2.5.1R20 Does Experience the same problem?
My unit is quite New - manufacture date is 13.12.2022 Maybe because of the unlucky date they stop putting the cables ;)
or at lest at This date :'(
Any help will be Highly appreciated!
-
The Smith chart was total Mess and after adding the two configuration files na_1p na_2p it becomes more or less normal at least now is in the contour of the chart :D
But the port Doesn't react to any Load 50ohm Close - Nothing!
Sure you connected to the right port? Port for S11 measurements is TG, not RF in.
Measurements will be very inaccurate without a calibration.
-
See https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4621357/#msg4621357 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4621357/#msg4621357)
-
Hello and a happy new year to all
I have a problem with my "open" SSA3032x (w/o SN) FW version 1.3.9.7
Refelection mode measurement is only able on Trace C and cannot changed to other trace No
Not sure whether this problem is caused by "open procedure at all", FW Bug or defect of my device.
Hopefully someone can help
Thanks and regards
Thomas
-
Hello and a happy new year to all
I have a problem with my "open" SSA3032x (w/o SN) FW version 1.3.9.7
Refelection mode measurement is only able on Trace C and cannot changed to other trace No
Not sure whether this problem is caused by "open procedure at all", FW Bug or defect of my device.
Hopefully someone can help
Thanks and regards
Thomas
First sanity check is to Preset to Factory settings. How Preset operates is selected within the System menu.
-
Hello and a happy new year to all
I have a problem with my "open" SSA3032x (w/o SN) FW version 1.3.9.7
Refelection mode measurement is only able on Trace C and cannot changed to other trace No
Not sure whether this problem is caused by "open procedure at all", FW Bug or defect of my device.
Hopefully someone can help
Thanks and regards
Thomas
First sanity check is to Preset to Factory settings. How Preset operates is selected within the System menu.
...no change, problem is still present
-
That seems to be normal behaviour.
On my SSA3021X trace C is used and cannot be modified.
Not sure why this is, but I guess that this way the device does not touch the more commonly used traces A and B.
-
hello
is anyone here who can help me please!!!
many thanks
Antony
hello
thxs for replying, my current SW1 is 1.3.9.6 and HW is 0C.03.00
do i have to upgrade to the latest firmware? SSA3000X Firmware – V1.3.9.8 (Release Date 08.15.21 )
or SSA3000X_Firmware_V2.1.1.3R1 (Release Date 09.16.22 )
I was reading the methods of how to upgrading and i have some questions to ask you, before i proceed the procedure of hacking my siglent specrum analyzer, do i have to upgrade to the latest version? from SW1 1.3.9.6 into 1.3.9.8 or 2.1.1.3R1?
i heard about firmware version 7.07 where can i get that file ?
regards
Antony
-
That seems to be normal behaviour.
On my SSA3021X trace C is used and cannot be modified.
Not sure why this is, but I guess that this way the device does not touch the more commonly used traces A and B.
ok thanks
Also i found a video in the web describing reflection measuring mode.
Was also on trace c
-
hello
is anyone here who can help me please!!!
many thanks
Antony
hello
thxs for replying, my current SW1 is 1.3.9.6 and HW is 0C.03.00
do i have to upgrade to the latest firmware? SSA3000X Firmware – V1.3.9.8 (Release Date 08.15.21 )
or SSA3000X_Firmware_V2.1.1.3R1 (Release Date 09.16.22 )
I was reading the methods of how to upgrading and i have some questions to ask you, before i proceed the procedure of hacking my siglent specrum analyzer, do i have to upgrade to the latest version? from SW1 1.3.9.6 into 1.3.9.8 or 2.1.1.3R1?
i heard about firmware version 7.07 where can i get that file ?
regards
Antony
...update to 1.3.9.7 and than make your modifications. Further FW update not necessary because 1.3.9.8 is only for newer HW
-
Further FW update not necessary because 1.3.9.8 is only for newer HW
No, you can use 1.3.9.8 with old hardware.
-
Further FW update not necessary because 1.3.9.8 is only for newer HW
No, you can use 1.3.9.8 with old hardware.
...however it is not necesarry to update to 1.3.9.8 because the diffeence to 1.3.9.7 is only the compatibility to new HW parts within the Analyzer
I am wrong? Than please explain more in detail
-
Anyone looking to sell one already hacked?
-
Hi,
my new SSA3021X+ (fw: 3.2.2.51R1) is just hacked with TV84 patched SVA firmware (backup done first), same version of SSA, all went OK and the VNA module appeared in system info list as permanently activated as TG, all other are time-limited demos.
The model declared remain as SSA3021X+, I've used the script to change to 3.2GHz (3032)... activation keys are accepted only with SVA1000X model specified in the script, after a factory reset the model is automatically changed in SSA3032X+ in system info, s/n UNchanged as the original (SSAxxx...)
Then I used the 'ALL' key to enable all options, 'DFT' option appeared in the list with all other permanently activated.
My question:
IT's necessary to change the info model to SVA1032X modifying the 'NSP_trends_config_info.xml' file ?
Thanks
-
IT's necessary to change the info model to SVA1032X modifying the 'NSP_trends_config_info.xml' file ?
It is. Maybe someday I'll create an .ADS to do that...
The rest of what you did is the correct and simplest way.
-
Thank you tv84,
I've just modified the NSP file, after another factory reset all is apparently OK, info model declare SVA1032X as expected and s/n is UNchanged.
-
I’m thinking of buying a new SSA3021 are you still able to unlock licenses with simple software/ firmware upgrade?
Drew
-
Hello,
took a lil while till I finally got some time to hack my Siglent SSA3021X-Plus, with the kind help of my more linux-savvy friend xorly.
We have proceeded according to the summary provided by user uski in post #1070 here (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg4596574/#msg4596574).
We have studied a bit beforehand the dos and dont's, so everything was absolutely smooth, apart from one of my USB flash drives being killed in the process. Once in STEP 6: Crossflash to SVA, I put the firmware file on the USB disk and the SSA did not detect the USB drive at all. We got a bit scared at that point. But simple check of that USB drive revealed, I could not access it any more from Windows, formatting could not be done and upon closer inspection by my friend it was found the USB drive lost the MBR and we could not restore it even with my friend's sheer linux force. Very weird. That USB drive served me well for years and have successfully installed numerous computers from it.
However, I have noted some weird behavior in the VNA mode: I can not get it fully calibrated. If I apply the open-short-load cal, I can get the load to show up exactly as a 50ohm point in the middle of the smith chart for a full span of frequency, however connecting back the open or short shows as a rather long line by the circumference of the smith chart. I would not expect this happen. Is this normal behavior, or do I miss something important?
-
Does this hack work on the SSA3015X Plus? If not any known hacks for the SSA3015X Plus one might point me too?
-
Hi,
I have a new ssa3021x plus fw 3.2.2.5 that i have crossflashed to sva1032 as per tv84 and the patch,that worked fine.
I have run the python script and unlocked all licences,
And now have run into a brick wall with trying to change the NSF_trends_config_info.xml and NSF_sn_bandwith.xml files.
I can telnet into the unit and add code from uski but then i am unable to save and continue im not very familiar with telnet apart from basics.
How can i change the file and save them to the unit.
Im sure it is something simple.
Thanks
Dennis
UPdate,
i now have it all working i changed to putty for the telnet but it seems that it is a very slow process to update the file i waited about 30min the :wq to be able to continue did one file at a time and success, so be patient.
-
So, what's the deal these days with unlocking the options SAA3021x? (non plus)
I've trawling through multiple message threads for a few hours trying to make sense of what you need to do.
One message linked to a Python script to generate unlock keys from the host ID, is it that simple now?
I only picked this up again to try and find out what the V2 firmware update was about and if it really was for a new hardware revision.
Sorry, im sure this gets asked over and over again but there's just not a clear thread now on what the actual process is, not that i can find anyway!
I figured it out in the end :)
So thanks whoever put the work into that one, its been bugging me for years!
-
I have an upgraded ssa3021x plus to a SVA1032x v3.2.2.4.0.r2 with no serial number. All features appear to function correctly. Is this the best arraingement available? I would like to have my serial number back but not at the cost of loosing features.
-
Bicurico, Quote: "To all: when modding/hacking your test equipment, especially new ones, never forget that you are messing with an expensive piece of equipment and you may/will void your warranty!"
This is the reason. At some time here in the near future I am going to ask for a way to do the upgrade from my SSA3021X Plus to the 1032X. I am going to read this thread from start to finish until I feel I have read it enough to ask for help. I'm 70yrs old on a fixed income. Just trying to learn as much as I can with the time I have left. This thread between firmware updates and people adding models. is quite a mess and fills me with anxiety at times with equal parts of, "this is going to be great OR will I kill it"?
Much appreciation to the People providing this information for ALL THE HARD WORK THEY DO!! You know who you are, and so do we. Thank you. Mick
-
huge thanks for this thread and some special people here
unlocked an ssa3021x too a 3032x and a few goodies with it
REFL option was not unlocked easily ---- did not work, received help from this thread
yeah i'm an oldie too at 52 ...
:-+ :-+ :-+ :-+ :-+
-
Bicurico, Quote: "To all: when modding/hacking your test equipment, especially new ones, never forget that you are messing with an expensive piece of equipment and you may/will void your warranty!"
This is the reason. At some time here in the near future I am going to ask for a way to do the upgrade from my SSA3021X to the 3032X. I am going to read this thread from start to finish until I feel I have read it enough to ask for help. I'm 70yrs old on a fixed income. Just trying to learn as much as I can with the time I have left. This thread between firmware updates and people adding models. is quite a mess and fills me with anxiety at times with equal parts of, "this is going to be great OR will I kill it"?
Much appreciation to the People providing this information for ALL THE HARD WORK THEY DO!! You know who you are, and so do we. Thank you. Mick
If you have the SSA-X version and not the SSA-XP (plus) version, all you need to do is to run the Python script and generate the keys. Enter them with the device keyboard and you have zero risks of damaging what so ever.
In worst case, the keys are wrong and won't work.
-
And yes
Thru the keypad, it is a bit long, but safe, if accepted, do a reboot
And if it is not accepted, the instrument will say so .... nothing broken
-
Tried to upgrade my SSA3021X with help of the Python script mentioned in reply 1070.
EMI option now valid but get an error when entering the licence for AMK, is there something wrong in the script? I tried it several times.
-
Somewhere in this thread there are several mentions, one of mine, on which name each option has.
-
Tried some things like tAMK, tMeas. But 'Meas' did the job! Thanks for your advise
-
The options with a "t" are timed options.
The firmware contains more option strings than the device accepts. Because some people extracted all option strings, they ended up published and are indeed confusing.
Some might even be accepted as valid, but won't do anything. Yet, they will be stored in the respective file.
Siglent contributed to the confusion by using different names commercially.
-
Hi, yesterday I tried the upgrade my vintage 2016 year SSA3021X. And before that I wanted to create symbolic links for telnet. Unfortunately now I am in the same situation as described by joeB in #947. The output of UART, looks exactly the same (Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)). So I assume I have the same problem due to the remount rootfs rw and kernel unable to mount root fs after that. It looks like joeB was able to solve the issue with the help from some of the experienced forum members (#948). Now I am looking for the help too...
-
Thank you. I sent it back and got the 3032X-Plus and you know what I'm doing today. :-+
-
Hi,
Greetings and many thanks to you all. Fresh owner of a 3021x plus here.
Seems that the python keygen does not work with fw = 3.2.2.5.1R20. I have this FW release and generated codes seems to be invalid.
Did anyone have success with python generated codes on a 3.2.2.5.1 Rel 20 firmware ?
Thank you in advance, BR
mitb67
-
Did anyone have success with python generated codes on a 3.2.2.5.1 Rel 20 firmware ?
Probably everyone except you. That should mean something... ::)
-
Did anyone have success with python generated codes on a 3.2.2.5.1 Rel 20 firmware ?
Probably everyone except you. That should mean something... ::)
Hi, TV84, not sure what your statement would say, but if you imply some shortage in wisdom or intelligence, you are being very mean.
Which would mean something too. ;)
I am sorry I woke you up. Go back to sleep.
Regards
mitb67
-
... if you imply some shortage in wisdom or intelligence, you are being very mean.
:palm: You definitely should improve your deductive skills.
-
Did anyone have success with python generated codes on a 3.2.2.5.1 Rel 20 firmware ?
Probably everyone except you. That should mean something... ::)
Hi, TV84, not sure what your statement would say, but if you imply some shortage in wisdom or intelligence, you are being very mean.
Which would mean something too. ;)
I am sorry I woke you up. Go back to sleep.
Regards
mitb67
What tv84 finds simple to many is a challenge and mistakes can be made.
Revisit your work very carefully.
-
So grateful to the people who have been working on this. :-+
Here is my experience to share with inexperienced people like me.
Started with an SSA3021X (no plus) equipped with a FW 2.1.1.3R1.
I managed to get the full 3.2GHz but did something wrong at one point since I ended up with 6 additional options (DMA, AMA, WDMA, DTF, VNA, RT40). (Yes I know I sucked, don't blame me anymore than I did |O ) I could access the additional modes like VNA and DTF but functions appeared not to be working properly (plus freeze when getting back to SA mode). S/N was X'd.
Wanted to revert everything to its original state but couldn't do it. Technical support kindly sent me a package for an SSA3021X to 'reset' everything (16Mo package to fit on a USB key). I did use it but did not change anything visible. I believe it did not work because the model was now indicating SSA3032X.
Finally used the SPCI command :SRLN to set my serial number, knowing that it would undo the hack. I restarted and used the python script and voila : successfully transformed a recently purchased SSA3021X (no plus) already equipped with a FW 2.1.1.3R1 into an SSA3032X with all 4 options : AMK, EMI, TG (already permanent) and Refl and kept the S/N. Pfeeeewww !!!!
I have not read it in the various posts but want to ask it to be sure : has anybody succeeded in upgrading from SSA3021X(non plus) to SSA3032X and then into an SVA1032X ? Do you believe it can be done ? All I have read was for the + versions.
-
I have not read it in the various posts but want to ask it to be sure : has anybody succeeded in upgrading from SSA3021X(non plus) to SSA3032X and then into an SVA1032X ? Do you believe it can be done ? All I have read was for the + versions.
Welcome to the forum.
Not possible. Different HW to the Plus models.
-
Hi,
Greetings and many thanks to you all. Fresh owner of a 3021x plus here.
Seems that the python keygen does not work with fw = 3.2.2.5.1R20. I have this FW release and generated codes seems to be invalid.
Did anyone have success with python generated codes on a 3.2.2.5.1 Rel 20 firmware ?
Thank you in advance, BR
mitb67
I have the same firmware as you & opened all the options I wanted except for Refl which gave an invalid code. Don't know why just that 1 won't work. I didn't try VNA so don't know about that one. Perhaps the Refl would work if I chose the keygen for "ALL"? :-//
-
Perhaps the Refl would work if I chose the keygen for "ALL"? :-//
Generate a code for "CAT" and insert it.
-
Perhaps the Refl would work if I chose the keygen for "ALL"? :-//
Generate a code for "CAT" and insert it.
Thanks for quick reply & yep, Refl now activated. Cheers. :-+
-
I am just playing with a SSA3021X Plus *cough* got it to 3.2GHz with all options etc just fine, but it is using a newer firmware of 3.2.2.6.0R1, latest on the site is 3.2.2.6.0R7 which I can obviously upgrade to.
I am wanting to improve it further to cross flash to SVA and I looked at the SVA FW file to change the hex, only the starting address has different values in it, so I think due to the 3.2.2.6 version that the previous hex is no longer valid, (screen shot included of new vs old FW).
I do not want to just go in there and blindly change it in case it bricks my brand new unit, anyone able to confirm if it is safe to change it?
ALSO I could not telnet into the SSA either, so I suspect the product ID has changed, BUT the backup ADS worked on it and I got 436MB of data.
-
I do not want to just go in there and blindly change it in case it bricks my brand new unit, anyone able to confirm if it is safe to change it?
You won't brick it but you also won't make it.
The patch shown only works on that specific FW version. For others, the patch differs. So, try implementing the patch in that specific FW version, as long as it accepts a downgrade version.
-
Good news, I have updated my brand new SSA3021X Plus to an SVA1032X, I did a couple of things slightly differently though.
When I first got the unit I used the ALL code and 3032 code to fully option it as an SSA3032X Plus.
As my unit came flashed with 3.2.2.6.0R1 I had to downgrade first to 3.2.2.5.1R1, BEFORE downgrading i changed the system setting to have it turn on with default settings not "last used", in case it caused problems as I have read that it can cause trouble on devices when doing updates, I then flashed it and that worked fine.
Before installing the cross flashed SVA firmware I copied over the na_1p and na_2p files, I then rebooted and then I flashed it with those already in place (just in case I couldn't get back in with telnet)
After flashing with the SVA cross flash I did the ALL, and 3032 option codes, but still had the model showing as a SSA3032X Plus, then I did another telnet backup, and copied over the NSP file to update the model name using telnet as below:
mount -o remount,rw /usr/bin/siglent/firmdata0
cp /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0/NSP_trends_config_info.xml /usr/bin/siglent/firmdata0/NSP_trends_config_info.xml
Once I did that I updated to the latest firmware 3.2.2.6.0R7
So far all looks perfect, my serial number is intact, I have the correct model name, and seemingly the VNA functions appear to be working fine, now I just need to learn how to use it.
I have recorded some video footage showing how I did the upgrade and all the steps, (more so in case something went wrong and I had to refer to it, or for future reference) I do not know if I will make it public though as I don't want to annoy Siglent as they have been good to me :-)
Thank you very much to all that have been involved in producing this "upgrade path" and documenting the steps to simplify it for others such as myself, especially tv84 & Bicurico.
-
If I get 1 of these in a year or 2, my home-lab will be almost complete.
-
I had a new SSA3021X Plus delivered on Thursday. Following the same procedure as theDefpom, I successfully updated it to a fully licensed SVA1032 on Friday morning :-+
When I copied across the 2 calibration files I noted that they had been given executable attributes. I figured that was not required/desired so I used chmod -x on them to remove the executable attributes.
I havent used it in anger (still waiting for some cables to arrive) so hopefully its all good. I also noted that after flashing it to SVA telnet on port 10101 is no longer available, but I can get in on port 23 using the root/ding1234 combination.
-
I had a new SSA3021X delivered on Thursday. Following the same procedure as theDefpom, I successfully updated it to a fully licensed SVA1032 on Friday morning :-+
Only possible with a SSA3021X PLUS !
-
Whoops - yes - SSA3021X Plus - corrected! And thanks tautech for your pre-purchase advice on this :-+
-
Just to clarify
To upgrade to the SSA3032X Plus I need a SSA3021X Plus?
It can not be done with a any other SSA3000 series analyser?
-
The hardware for the SSA3000X line is or WAS different from the hardware for the SSA3000X-PLUS and SVA1000 line.
What remains to be seen, but I got no feedback here, is: can it be that the NEW SSA3000X models, which use the NEW firmware (incompatible with the old line), can be cross-converted like the SSA3000-PLUS to SVA1000.
To start, I want to know if the NEW SSA3000X has a touch screen.
But the plain answer to your question is:
1) The SSA3021X can be upgraded to SSA3032X
2) The SSA3021X-Plus can be upgraded to SSA3032X-Plus and you can cross-grade it into a SVA1032
This means that there is no reason to keep buying the SSA3021X, since it is only marginally cheaper than the SSA3021X-Plus. Unless, of course, that Siglent decided that the SSA3021X is a dead product for mentioned reasons and replaced the original hardware platform with the SSA-Plus/SVA hardware platform, cutting down the extra options by software.
-
Hi where did you get the python keygen script from? and how do you run the script, can you send me a link?
KR
Andrew
-
Hi where did you get the python keygen script from? and how do you run the script, can you send me a link?
KR
Andrew
The link to the keygen is in another thread. Follow the thread from this post...
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4963210/#msg4963210 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4963210/#msg4963210)
-
I'm owner of a brand new SSA3021X Plus. I've updated to a SSA3032X Plus via the python script and enabled all options. That process was painless and thanks to all who worked on it
I'm preparing to crossflash to a SVA1032X to enable the VNA features. Most who have blazed this trail have included a screen shot of the system info as proof of success. I've noted that they are all at HW revision 00.00.00
Mine is at 01.00.00. Before starting the crossflash I thought I should make a post and check to make sure that this is still an option
-
Hi I have the script now thank you, can you bullet point the steps for this to work? what firmware do I have to lad first, can I use putty? in short Help.
KR
Andrew
-
Hi I have the script now thank you, can you bullet point the steps for this to work? what firmware do I have to lad first, can I use putty? in short Help.
KR
Andrew
What version firmware do you currently have? Do you have the Plus version analyzer?
To upgrade, there's no need to use putty. You enter the keys manually into the analyzer as mentioned in the link above.
-
I'm preparing to crossflash to a SVA1032X to enable the VNA features. Most who have blazed this trail have included a screen shot of the system info as proof of success. I've noted that they are all at HW revision 00.00.00
Mine is at 01.00.00. Before starting the crossflash I thought I should make a post and check to make sure that this is still an option
Did someone suggest something about it ? I'll probably get mine in a month or so, and it will be likely Rev 01.00.00 as well :scared:
Andy
-
It upgraded without issues 8)
-
Thinking on buying ssa3021x-plus.
I'm into amateur radio so interested in crossflashing to sva.
Two qestions.
1. Still should be possible?
2. Is any ssa functionality lost when flashing to sva?
Thanks
-
It is still possible and no loss of functionality
-
I'm torn between getting 1 of these, and some computer upgrades. I use my PC all the time, so upgrading it would be a lot more fun. And how often would I really need to use a dedicated SA or VNA ?
But I keep mixing up the non-plus version's. They are the ones I've been seeing open box and refrub deals on lately. So the SSA3021Xplus is what I'd need to make a VNA version anyways. I'd have to save up a few months more for that.
A NanoVNA looks great for my hobby usage, but it's so little and flimsy, I'd want a box sized version with better connectors and a bigger screen.
How much better is a cheaper, older Siglent SA, than the one in my sds2204X+ ? I'm guessing they can't be turned into a VNA tho.
The fasted hobby stuff I'm working on would be FM radio projects, or maybe some fast pulse generator, or trying to look at high speed data doing some consumer tech repair.
I have no accessories like coax cables, connectors, splitters, terminators, etc. How much money can I expect to pay for accessories if I get all that at once, from a decent brand name, vs amazon/ebay quality ?
-
You need a SSA3021X Plus to make a SVA1032X as they share the same HW.
IMO SMA and BNC adapters covers most needs although you need consider BNC not so suitable for anything beyond 1GHz.
Leave one or the other fitted rather that fit/remove them each time you use it. Even the best quality adapters have a limited fitment lives.
The better quality cheap SMA cables give reasonable service life and are so much nicer to use than N type cabling.
Despite having the much more capable/costly SNA5004A (not hacked yet), SVA1032X remains my favourite RF instrument.
-
I'm confused again, I just read (part of this is Tautech speaking)
Quote from: lebromeau on June 26, 2020, 09:40:51 pm
Could you confirm what was purchased when you are referring to the SVA1015X model (in terms of base device + options)? Asking because as of 9/23/2019, it looks like Siglent North America ships SVA1015X with the VNA option included.
Curious if you are saying that you can use it as an SA up to 7.5G, but as a VNA only up to 1.5G due to the license lock? I could be reading this wrong, and your case is that you haven't purchased the VNA license prior to the hack, and did not have any VNA ability beforehand.
Thanks in advance
Welcome to the forum.
All SVA models now have VNA mode standard out of the box. It is no longer an additional option.
There are 3 models, SVA1015X, 1032X and 1075X.
Their respective BW's 1.5, 3.2 and 7.5 GHz are also their SA rating.
All 3 models have small differences in HW so their is no upgrade path from a lesser model.
Hope that helps.
So a certain SA can be hacked to a Vector analyzer, and they have a separate VNA mode???
I definitely don't need +2GHz anyways. So what can't the SVA1015X do that the hacked SSA3021Xplus could ? They would cost around the same, and the 1015X is only 1.5GHz or whatever. Besides that whats the main difference. ?
-
I definitely don't need +2GHz anyways. So what can't the SVA1015X do that the hacked SSA3021Xplus could ? They would cost around the same, and the 1015X is only 1.5GHz or whatever. Besides that whats the main difference. ?
If you don't value BW then there is no difference.
-
The main difference is:
SVA1015 --> can be hacked to activate all options
SSA3021X-Plus --> can be hacked into a SVA1032 with all options
Considering that the SSA3021X-Plus costs €1,469.00 and the SVA1015 costs €1,359.00, it is common sense that you better buy the SSA3021X-Plus for increased bandwidth compared to the SVA1015.
If you don't like hacking and 1.5GHz is the maximum frequency you need, then you are OK with this model.
-
I don't check the used markets much but I'd buy some older used Siglent models if I had the chance. I guess most people hold on to them, and they don't drop much in value, so nothing sounds like a great savings.
I check the SiglentNA clearance section sometimes. IDK if it's worth it by the time it ships to Canada, but there's some great deals.
The dealer I got most all my Siglent tech from, also sells refrub's and openbox stuff sometimes. And they give me great deals too. So whenever I get a real SA/VA, that's where I should get it.
-
Hello comrades!
I have acquired SSA3021X-Plus
SW1: 3.2.2.6.0R1
SW2: 20221117-1301
SW3: 000000D4
HW: 01.00.00
I want to update it to SSA3032X-Plus
The site has the latest firmware:
SSA3000X Plus_Firmware_V3.2.2.6.0R7 (Release Date 06.09.23 )
What is the hacking procedure?
I have to upgrade to the firmware first 3.2.2.6.0R7 ?
Reading the topic, I realized that I had to do the following:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3563577/#msg3563577 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3563577/#msg3563577)
1) Initial backup of SSA3021X Plus
1.1. Turn on SSA, put USB stick (FAT32) with SSA3000X+_backup_11411.ADS
in the front USB port on SSA
1.2. Navigate to USB directory, select *.ADS via File - Open/Load and press Enter
1.3. Wait until device reboots itself, then turn off, eject USB flash
and copy backup files to PC. Total backup size is ~483MB
https://tis.kz/temp/Siglent/SSA3000X+_backup_NAND+mem+firmdata0_11411.zip (https://tis.kz/temp/Siglent/SSA3000X+_backup_NAND+mem+firmdata0_11411.zip)
2) Telnet access for SSA3021X Plus & Manual backup
2.1. Connect Ethernet cable to SSA3021X and network, configure IP (DHCP option recommended)
2.2. Internal product ID should be 11411. Launch fake update SSA3000X+_telnet_11411.ADS
from USB stick to start telnet. SSA hangs with update screen, that's normal.
2.3. Open telnet, telnet <SSA IP address> 10101
2.4. Backup main directories:
cd /
cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
cp -R /usr/bin/siglent/usr/config /usr/bin/siglent/usr/mass_storage/U-disk0/SA-config
cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
cp -R /usr/bin/siglent/usr/usr /usr/bin/siglent/usr/mass_storage/U-disk0/SA-usr
cp -R /usr/bin/siglent/usr/vnacalikitdata /usr/bin/siglent/usr/mass_storage/U-disk0/SA-vnacalikitdata
2.5. Make files writeable:
mount -o remount,rw /usr/bin/siglent
and add telnet server startup line in file “/usr/bin/siglent/startup_app.sh” :
vi /usr/bin/siglent/startup_app.sh
enter the following line exactly close to the end, just before line "/usr/bin/siglent/Aladdin &" :
/sbin/telnetd -l /bin/sh -p 10101 &
2.6. Finalise changes and reboot
sync && reboot
After SSA reboots, telnet should be started automatically without fake update via USB.
https://tis.kz/temp/Siglent/SSA3000X+_telnet_11411.zip (https://tis.kz/temp/Siglent/SSA3000X+_telnet_11411.zip)
3) Generating keys to open options
Summarizing the collected information (Updated August 29, 2023)
In the Python compiler, run the script
The script itself is in the file: Keygen_for_Siglent_Spectrum_Analyzers.py
In the HOSTID = '0000000000000000' field, enter your ID
Removing the comment # before the line Model = 'SSA3000X_Plus'
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4355635/#msg4355635 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4355635/#msg4355635)
https://tis.kz/temp/Siglent/Keygen_for_Siglent_Spectrum_Analyzers.zip (https://tis.kz/temp/Siglent/Keygen_for_Siglent_Spectrum_Analyzers.zip)
After compilation, we enter the code from the ALL field into the SSA
Are options 3021, 3050, 3075 superfluous? Is it better to remove them from the code? What other extra options are not available on the SSA3032X?
(https://tis.kz/temp/Siglent/Python_Comp_sm.jpg)
Did I get it right?
Why is the CAT field not active in the compilation results?
After entering the code into the SSA device from the ALL field, will the device model name also change to SSA3032X?
---
At the link below, there is an instruction on renaming files, why rename files?
NSP_sn_bandwidth.xml --> NSP_sn_bandwidthx.xml
NSP_trends_config_info.xml --> NSP_trends_config_infox.xml
nsp_data_b --> nsp_data_bx
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1299182/#msg1299182 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1299182/#msg1299182)
-
You can update the firmware before or after the upgrade.
I can't comment on the back up procedure, as I didn't do it first myself. I just went ahead with the upgrade.
I chose the upgrades that only applied to the 3021X Plus (didn't use the "ALL" option). So I chose AMK, EMI, DMA, AMA, 3032, and CAT (to be used for the Refl option).
The model name changes to SSA3032X Plus after entering the "3032" key.
If you want to upgrade to the VNA, then more options & more steps are required.
-
But from this post:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4355635/#msg4355635 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4355635/#msg4355635)
Is the script suitable for generating keys for version 3.2.2.6.0R7 ?
-
But from this post:
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4355635/#msg4355635 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4355635/#msg4355635)
Is the script suitable for generating keys for version 3.2.2.6.0R7 ?
I don't see why it shoudn't. But mine was on firmware 3.2.2.5.1R20 when I upgraded mine in April. I subsequently updated to 3.2.2.6.0R7
-
A NanoVNA looks great for my hobby usage, but it's so little and flimsy, I'd want a box sized version with better connectors and a bigger screen.
The NanoVNA is quite a nice little VNA - but other than e.g. any Siglent VNA, it does not have any SA functionality.
Yet if you need a VNA, the NanoVNA can be a great complement or even replacement for a lab benchtop VNA, depending on what you need it for. If the main task is measuring/adjusting antennas, a small, portable, battery operated device is the better choice in most cases.
How much better is a cheaper, older Siglent SA, than the one in my sds2204X+ ? I'm guessing they can't be turned into a VNA tho.
This is hard to compare. The SDS2000x Plus with FFT acts as a wideband (up to 500 MHz) real time analyzer that starts at DC, hence can be used at very low frequencies, such as mains voltage and its harmonics. Resolution bandwidth (RBM) depends on sample rate; if you want full bandwidth, the sample rate has to be at least 1 GSa/s, hence the frequency step cannot be less than 500 Hz, which in turn means some 1.85 kHz RBW with the universal Flattop window. On the other hand, if you can make do with e.g. just 100 kHz bandwidth (which requires 200 kSa/s), you can have 100 mHz frequency step, hence 0.37 Hz RBW. You can get even lower by further reducing the sample rate.
The SSA is a traditional swept SA with minimal real time bandwidth. You can select the RBW independently of the bandwidth; i.e. you can have a sweep over 1 GHz with just 10 Hz RBW for instance. This will be rather slow though...
You can't use this instrument below 9 kHz and no tricks will get you a RBW below 1 Hz.
Of course you don't have a VNA capability with the FFT of a DSO. For frequencies up to 120 MHz the Bode Plot can do S21 measurements, with some hassle also S11 (if you use a suitable bridge), but this is very slow in comparison and only a real option for low frequencies, where the VNA stops working. AFAIR this is about 50 kHz for the NanoVNA and several MHz for the SVA.
I have no accessories like coax cables, connectors, splitters, terminators, etc. How much money can I expect to pay for accessories if I get all that at once, from a decent brand name, vs amazon/ebay quality ?
Nobody knows what exactly you need, but some adapters to connect virtually everything to the instrument are the bare minimum. Quality ones can be between 10$ and 30$, e.g for BNC:
https://www.digikey.at/en/products/detail/amphenol-rf/31-216/80211 (https://www.digikey.at/en/products/detail/amphenol-rf/31-216/80211)
Then you should decide on a connector standard within your lab. If you're not dealing with super high frequencies, this could be BNC, so at the very least you need a BNC(f)/N(m) adapter that is permanently fitted to the SA. Thankfully, there's no need for a DC block, because this is already built in. Then maybe a few quality (low loss, high shielding) patch cables - BNC-BNC in this case for about 15$ each:
https://hamradioshop.net/coaxial-cable/coaxial-cable/347/hyperflex-5-low-loss-coaxial-cable-pre-fabricated (https://hamradioshop.net/coaxial-cable/coaxial-cable/347/hyperflex-5-low-loss-coaxial-cable-pre-fabricated)
Splitters are quite expensive - a quality resisitve wideband splitter costs about 75$:
https://www.minicircuits.com/WebStore/dashboard.html?model=ZFRSC-2050%2B (https://www.minicircuits.com/WebStore/dashboard.html?model=ZFRSC-2050%2B)
You usually don't need terminators, but some inline attenuators can be handy at times. A set containing 3 dB, 6 dB, 10 dB and 20 dB attenuators for ~15$ each gets you started. For example 20 dB:
https://www.minicircuits.com/WebStore/dashboard.html?model=HAT-10A%2B (https://www.minicircuits.com/WebStore/dashboard.html?model=HAT-10A%2B)
-
Hi
If you are doing high value pro-work you need pro-gear but if not, there are other options.
I buy all my connectors from Aliexpress. They are not a substitute for high quality certified connectors, but I have found them to be good-enough.
I treat the Aliexpress connectors as disposable, consumable items. They have a limited life but are cheap to replace.
I have standardized on SMA but the things I work on often don't follow that standard. I now have adapters to go from SMA to:
RP.SMA
BNC
TNC
N-type
U.FL
50ohm load termination
and
most the above in M-F, M-M, F-M, F-F
so I now have a reasonably extensive collection of adapters by necessity.
I have Minicircuits attenuators, but nothing against Aliexpress versions.
I purchased an expensive 12V rf pre-amp from Minicircuits, but the cheap-as 5V rf pre-amp from Aliexpress has significantly better performance.
I also source rf cable assemblies from Aliexpress.
On Aliexpress, price and quality are closely correlated. Don't buy the cheapest.
Aliexpress sell kits with a diverse range of adapters. If you have nothing, these might be a good choice but don't expect them to cover all of your needs.
I have looked hard at the NanoVNA. It is not a substitute for a pro-bench top VNA but it is really good value for money. If you buy one of these, make sure it is the genuine item from the OEM and not a retarded clone.
-
I have purchased these cables and adapters for my devices and SSA:
https://tis.kz/temp/Siglent/Connectors-Wires-Adapters_aliexpress.doc
After purchasing the SSA, I also bought all sorts of amplifiers, filters and the like to study the device and experiment:
https://tis.kz/temp/Siglent/Amplifiers-Filters-Bridges_aliexpress.doc
-
A really useful accessory is an rf bridge.
See this link on a DIY version that is at least as good as the Siglent version.
https://www.eevblog.com/forum/testgear/test-results-for-the-e-bay-rf-bridge-in-an-enclosure/msg1626220/#msg1626220 (https://www.eevblog.com/forum/testgear/test-results-for-the-e-bay-rf-bridge-in-an-enclosure/msg1626220/#msg1626220)
-
I just bought a SSA3021X (NON PLUS) are these still hackable
-
yes, with the phyton script
-
yes, with the phyton script
I have gone over multiple threads and am beyond confused about the whole process involved in doing this. Instructions aren't clear and keep chronically jumping randomly between the SSA3021X and theSSA3021X plus.
Is the Telnet access and backup steps mandatory
-
I believe with the non plus version, the python script is your only option for upgrades. Here are the quick instructions
1) Launch online python tool: https://www.online-python.com/PX3v0J8nbs (https://www.online-python.com/PX3v0J8nbs)
2) Uncomment #Model = SSA3000X' line (remove #)
3) In you SSA navigate to system info and note HOSTID
4) Input HOSTID into python tool
5) Generate license codes and with SSA menu option System -> Load Option install following options: ALL, 3032
-
ALL does not work on a non plus model. It is accepted but doesn't do anything.
-
I believe with the non plus version, the python script is your only option for upgrades. Here are the quick instructions
1) Launch online python tool: https://www.online-python.com/PX3v0J8nbs (https://www.online-python.com/PX3v0J8nbs)
2) Uncomment #Model = SSA3000X' line (remove #)
3) In you SSA navigate to system info and note HOSTID
4) Input HOSTID into python tool
5) Generate license codes and with SSA menu option System -> Load Option install following options: ALL, 3032
Thanks for you help, will try when I get home. In addition to the expanded bandwidth, will this get me the additional software options
Concerning what you said in your reply, you instructed me not to enter ALL
I am trying to avoid ending up like the guy in this below post
So grateful to the people who have been working on this. :-+
Here is my experience to share with inexperienced people like me.
Started with an SSA3021X (no plus) equipped with a FW 2.1.1.3R1.
I managed to get the full 3.2GHz but did something wrong at one point since I ended up with 6 additional options (DMA, AMA, WDMA, DTF, VNA, RT40). (Yes I know I sucked, don't blame me anymore than I did |O ) I could access the additional modes like VNA and DTF but functions appeared not to be working properly (plus freeze when getting back to SA mode). S/N was X'd.
Wanted to revert everything to its original state but couldn't do it. Technical support kindly sent me a package for an SSA3021X to 'reset' everything (16Mo package to fit on a USB key). I did use it but did not change anything visible. I believe it did not work because the model was now indicating SSA3032X.
Finally used the SPCI command :SRLN to set my serial number, knowing that it would undo the hack. I restarted and used the python script and voila : successfully transformed a recently purchased SSA3021X (no plus) already equipped with a FW 2.1.1.3R1 into an SSA3032X with all 4 options : AMK, EMI, TG (already permanent) and Refl and kept the S/N. Pfeeeewww !!!!
I have not read it in the various posts but want to ask it to be sure : has anybody succeeded in upgrading from SSA3021X(non plus) to SSA3032X and then into an SVA1032X ? Do you believe it can be done ? All I have read was for the + versions.
-
OK - just enter in the keys for the options that are shown under the System Info menu one at a time (that is what I did when I upgraded)
-
@Andrey_Ak ,@mainman did you succeed?
-
@Andrey_Ak ,@mainman did you succeed?
I haven't tried it yet, there's no time yet..
-
OK - just enter in the keys for the options that are shown under the System Info menu one at a time (that is what I did when I upgraded)
@Andrey_Ak ,@mainman did you succeed?
Thanks for all the help
I got almost everything working except it will not take the Meas for Refl licenses
What am I doing wrong
Edit
Problem solved. It turns out I DID need to enter the license for ALL. Everything unlocked now and running
-
This means you have a new model with the unified firmware. Can you please post your firmware version?
-
This means you have a new model with the unified firmware. Can you please post your firmware version?
SW1 2.1.1.3R1
HW 01.00.00
-
Thanks for all the help
I got almost everything working except it will not take the Meas for Refl licenses
What am I doing wrong
Edit
Problem solved. It turns out I DID need to enter the license for ALL. Everything unlocked now and running
As I posted above, it's the CAT license key that unlocks Refl.
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg5215635/#msg5215635 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg5215635/#msg5215635)
-
Thanks for all the help
I got almost everything working except it will not take the Meas for Refl licenses
What am I doing wrong
Edit
Problem solved. It turns out I DID need to enter the license for ALL. Everything unlocked now and running
As I posted above, it's the CAT license key that unlocks Refl.
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg5215635/#msg5215635 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg5215635/#msg5215635)
These are the instructions from the key generator script
"If there is a problem with AMK and Refl licenses, use CAT for AMK and Meas for Refl"
Those instructions didn't work
I own and stated I have a SSA3021X (NON PLUS) which can NOT be upgraded to a PLUS model
You said in your post
"I chose the upgrades that only applied to the 3021X Plus"
This tells me we both have different models as my Analyzer is now identified as a SSA3032X after hack.
-
These are the instructions from the key generator script
"If there is a problem with AMK and Refl licenses, use CAT for AMK and Meas for Refl"
Those instructions didn't work
I own and stated I have a SSA3021X (NON PLUS) which can NOT be upgraded to a PLUS model
You said in your post
"I chose the upgrades that only applied to the 3021X Plus"
This tells me we both have different models as my Analyzer is now identified as a SSA3032X after hack.
If you used the script from the link in this post...
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4355635/#msg4355635 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4355635/#msg4355635)
...then just below the list of 4 model numbers, it says "#Use CAT for Refl (SSA3000X)".
Then further down the page it says "If there is a problem with AMK and Refl licenses, use CAT for AMK and Meas for Refl"
Your non-plus model & my plus model both have the same upgrade options. The difference is that the plus model can be cross flashed to a VNA, unlike the non-plus model.
-
Hello,
I've done something wrong, I have no more screen only Telnet.
I've upload last firmware to clear everything, no change.
Screen is flashing at boot and stay black.
Does anybody can help me ?
Device SSA 3014X Plus
Many thanks
Gui
-
Hello,
I've done something wrong, I have no more screen only Telnet.
I've upload last firmware to clear everything, no change.
Screen is flashing at boot and stay black.
Does anybody can help me ?
Device SSA 3014X Plus
Many thanks
Gui
Welcome to the forum.
While doing what ? <serious question.
Device SSA 3014X Plus
Typo ? No such model !
-
You have a SSAX+ with a SVA S/N?? ::)
-
You have a SSAX+ with a SVA S/N?? ::)
SSA3015X Plus do by default. ;)
-
Hello
Many thanks for your feedback :)
You are right my model is SSA3015X Plus.
I've tried to convert to a SVA1032 with firmware SVA1032X_V3.2.2.4.0_EN.
To do that I've changed NSP_config_upgrade_info.xml to allow firmware.
after flashing screen was flashing 10 times and stayed off.
I've generated and installed some licenses can it explain that?
I've tried to reflash with SSA3000X-Plus_V3.2.2.6.0R7_EN to come to the initial state.
Where can I get the boot log?
-
Humans are naturally curious...
3015X doesn't accept 3032X FW. You should rollback the .xml change and see what happens.
Then you should try to flash the oldest 3015X FW acceptable.
Option licenses shouldn't be the problem.
-
Hello
Many thanks for your feedback :)
You are right my model is SSA3015X Plus.
I've tried to convert to a SVA1032 with firmware SVA1032X_V3.2.2.4.0_EN.
To do that I've changed NSP_config_upgrade_info.xml to allow firmware.
after flashing screen was flashing 10 times and stayed off.
I've generated and installed some licenses can it explain that?
I've tried to reflash with SSA3000X-Plus_V3.2.2.6.0R7_EN to come to the initial state.
Where can I get the boot log?
Not possible as SSA/SVA 1.5 GHz products are different HW to 2.1/3.2 GHz products.
Best you can do is convert to SVA1015X and install licenses. :-X
The info is in this or one of the Siglent analyzer threads.
-
Hi. I purchased an SSA3021x plus, I would like to activate all the options and the bandwidth expansion, I read the descriptions on the forum about the modification process. I got to the stage where I can access via telnet on port 10101, I ran the key generator python script on the PC, I have the keys but I didn't find any details or I missed something about what I have to do with these keys. can someone help me to make this change? I'm not very good at linux and I'm also afraid of destroying the analyzer.
SW1 3.2.2.6.0R8
SW2 20230524-1501
SW3 000000D4
HW 01.00.00
Thank you, Mihaly
-
Hi. I purchased an SSA3021x plus, I would like to activate all the options and the bandwidth expansion, I read the descriptions on the forum about the modification process. I got to the stage where I can access via telnet on port 10101, I ran the key generator python script on the PC, I have the keys but I didn't find any details or I missed something about what I have to do with these keys. can someone help me to make this change? I'm not very good at linux and I'm also afraid of destroying the analyzer.
SW1 3.2.2.6.0R8
SW2 20230524-1501
SW3 000000D4
HW 01.00.00
Thank you, Mihaly
I haven't done the crossmod to VNA. I have only opened all the options & upgraded to 3.2GHz. To enter the keys you have generated go to System > system info > Load option. A license key pop up will appear where you enter the keys that were generated by the script. When I did mine, rather than enter the ALL option, I entered the keys that were relevant one at a time i.e. AMK, EMI, DMA, AMA, CAT (for Refl) and 3032.
-
wow, how simple :). I entered the codes and now everything is OK, 3.2Ghz active, and all the options. I'll probably turn it into a VNA in the future, I'll have to study more, or ask for help :).
Thank you for help 807.
-
Today I received a brand new SSA3021X Plus and, with a little help from this forum, it now believes it is a 3.2 GHz SVA1032X. The upgrade process was quite simple, using the Python keygen to enable options, and then using telnet to change the product id by hand to allow cross-flash of the SVA firmware. Then I used the keygen again to turn on DTF. The model number is correct and my serial number is back in place. For anyone wondering about whether things still work, I started with firmware 3.2.2.6.0R8 on HW 01.00.00 and did a cross-flash directly to the latest SVA firmware, 3.2.2.6.0R7.
There is one thing I have a question about, though. The various instructions say to rename two files:
mv nsp_data_b1 nsp_data_b1x
mv nsp_data_b nsp_data_bx
but nowhere can I find an explanation as to why this is necessary. I didn't do it, and as far as I can tell everything is working perfectly. Is renaming these files actually required?
Thanks to everyone who made this such a simple process!
-
Is renaming these files actually required?
Definitely no. These are remnants of old procedures.
-
Hello,
I have here a just delivered SSA3021 plus with
SW1 3.2.2.5.1R20
HW 00.00.00
...and (of course ;-) I like to upgrade it to SVA.
I tried to backup as described above via the SSA3000X+_backup_NAND+mem+firmdata0_11411.ads.
I also tried to get Telnet-Access using the SSA3000X+_telnet_11411.ads
In both cases I can select the ADS-Files and press "Enter". The "firmware-update" starts. The screen changes to "Upgrading now - pleas wait" an the hourglass turns around for about 30 seconds. Then it ends up in the same screen as before (the file-menu) were I can select the ADS-Files. (there is no reboot)
Telnet does not connect on Port 23 or 10101.
I tried to continue with the procedure described her: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg4596574/?topicseen#msg4596574 (https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg4596574/?topicseen#msg4596574)
After sending DEBTTT via SCPI I can telnet to port 23 with "root" PW "1234ding"
Trying to copy the backups (Step II) I get cp: "can't create directory '/usr/bin/siglent/usr/mass_storage/U-disk0/SA-config': Read-only file system"
So I had to
mount -o remount,rw /usr/bin/siglent/usr/mass_storage/U-disk0 to make the stick writeable (this step is missing in the description)
Then I was able to copy the Folders, but all together tah are only about 8 Mbytes (413 Files) - not 480 Mbytes like in the description
by the way: the folder : "/usr/bin/siglent/usr/backup" is empty => should it be?
Does anybody have an idea what I could do to manage the backup?
I worry about only installing the modified SVA-Firmware without a backup.
Would be very nice if someone could post something helpful
Greets
If needed: Here is my content of three often postet files:
...<?xml version="1.0" encoding="UTF-8"?>
<nsp_trends_info_root>
<device>
<language>english</language>
<pid>0x1305</pid>
<vid>0xf4ec</vid>
<product_type_1>SSA3075X Plus</product_type_1>
<product_type_2>SSA3075X Plus</product_type_2>
<product_type_3>SSA3032X Plus</product_type_3>
<product_type_4>SSA3021X Plus</product_type_4>
<product_type_5>SSA3015X Plus</product_type_5>
<manufacturer>Siglent</manufacturer>
<Support_Touch_Flag>1</Support_Touch_Flag>
<Support_VXI11_Flag>1</Support_VXI11_Flag>
<file_prefix>CP_</file_prefix>
</device>
</nsp_trends_info_root>
<?xml version="1.0" encoding="UTF-8"?>
<nsp_system_info_root>
<device>
<system_information>
<serial_number>
<chip>SSA3xxxxxxxxxx</chip>
</serial_number>
</system_information>
</device>
<Device><Mac>xx:xx:xx:xx:xx:xx</Mac></Device></nsp_system_info_root>
<?xml version="1.0" encoding="UTF-8"?>^M
<nsp_upgrade_info_root>^M
<device>^M
<upgrade_static_id>11411</upgrade_static_id>^M
<upgrade_start_id>11400</upgrade_start_id>^M
<upgrade_end_id>11499</upgrade_end_id>^M
</device>^M
</nsp_upgrade_info_root> ^M
^M
-
The procedure to start telnet with the ADS file worked for me in 2021 with telnet on port 10101, but I think it is now obsoleted by the SCPI command. I remember it didn't reboot the system, because the ADS file just run an executable, but it didn't return control to the instrument, remaining busy there.
As regards the read-only USB stick, perhaps now they make it writable only when needed. Try:
mount -o remount,rw /usr/bin/siglent/usr/mass_storage/U-disk0
-
I also had to mount the USB drive rw before I could copy to it.
The backups that you do with cp are very different from the backups you do with that ads file. The latter backs up the whole firmware, not just some configuration files.
With my brand new SSA3021X+, which came with 3.2.2.6.0R8, I was able to run the firmware backup on the second try. The first didn’t do much but did reboot. So I’d try it again. You might also try upgrading to the latest firmware before trying it.
-
Thank you - i had small success:
meanwhile I tried it several times with 3 different USB-Sticks
2 of them USB 2.0 which normally work well when doing jobs like this...
the 3. stick was USB 3.0 (Jetflash JF 780, 16GB) finally did the job by the second attempt.
Now I have a file named memdump, a folder firmdata0 and mtd0.bin to mtd11.bin :-+
Funny question how could this backup be restored - does anybody did this ever?
-
Hi. I finally managed to convert my SSA3021x+ to SVA1032x and it seems to work well. I have only one problem, when I want to activate the relf or meas option it gives me an invalid key, is this normal or did I miss something. Before I did the transformation it worked.
ok, I found the answer in a post by Tautech (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg5234703/#msg5234703 (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg5234703/#msg5234703)) where he answers a question like "And what is the Refl option?
I noticed that it is on SSA, but it is no longer on SVA. "
Reflection measurements are standard in SVA models and enhanced to provide Smith charts, Mag Loss, SWR and Phase of which you can overlay all using the 4 traces available.
Thank you, Mihaly
-
Hi. I finally managed to convert my SSA3021x+ to SVA1032x and it seems to work well. I have only one problem, when I want to activate the relf or meas option it gives me an invalid key, is this normal or did I miss something. Before I did the transformation it worked.
Thank you, Mihaly
Reflection option is not used in SVA models as VNA mode covers it.
For other options go look at the official options and their option names here:
https://www.siglenteu.com/spectrum-analyzers/sva1000x-spectrum-vector-analyzer/ (https://www.siglenteu.com/spectrum-analyzers/sva1000x-spectrum-vector-analyzer/)
-
Thanks for the info. That's what I thought too, but I wasn't sure.
-
Thanks guys! Just upgraded my SSA3021X Plus to SVA1032X plus full options >:D
-
SSA3021X+ arrived at noon. It's now an SVA1032X except in model number.
I bought this as an experiment to see where these units are really at. The threads have been great on "upgrading" methods but scant information (except good phase noise discussions) on other functions.
Initial thoughts:
Spectrum analyzer - pretty darned good, good speed, clean noise floor, good measurement functions. Channel and occupied BW measurements match an Agilent PSA.
VNA - very disappointing, very basic operation. Perhaps Siglent doesn't want to give away the code from it's higher end units, including IFBW and other functions. But in the end, it works. I have quality plots of antenna response for several eval boards with BT chip antennas. It did a nice job of finding bandwidth and giving good graphics and table of results.
Suggestions
1. *Correction* - missed the BACK arrow over the soft keys - - - The lack of a BACK function is very painful and very lacking. The units are low cost but that doesn't matter. You NEED a back function. A depth of 2 or 3 would be nice.
2. The lack of VNA IF control except on their high end models hurts their noise floor for SOLT calibration. The good news is that it seems very stable over several hours. Unit came in from very cold weather and two hours inside, I'm not seeing drift.
3. STRANGE - loading up a STA file does not flip to the function for that file (i.e. SA or VNA). It will ignore a VNA STA if in SA mode but doesn't tell you.
For me this was a dry run for Siglent and a higher frequency, better performance model from them. Hard to beat for $1600.
And Saelig gives a 6% discount to EEVBlog members. I was told by TEquipment that this discount is GONE with their acquisition by Test Equity. TEq will now CHARGE a stocking fee for returns. Like Keysight, they've gone off key. Some years back you could get a demo unit, then were told to just buy one because you can return freely. All gone for Test Equity. Verified with two individuals so if this is not the case, feel free to respond and flog your support staff. :horse: :horse:
Dooooh !! I didn't even see the back arrow above the soft keys. :palm: :palm:
-
For me this was a dry run for Siglent and a higher frequency, better performance model from them.
SNA5000A ?
Prepared to be pleasantly shocked. A very different beast awaits you.
-
For me this was a dry run for Siglent and a higher frequency, better performance model from them.
SNA5000A ?
Prepared to be pleasantly shocked. A very different beast awaits you.
I have a PNA. I'm already shocked and adjusting. That was $65k ... a long time ago, long before it was mine ;).
Yes, the SNA5000A looks good. At that price though, the competition in the used market is stiff. Also, at that price point, the firmware better be a lot more complete and robust.
One thing that concerns me on this SVA1032X "upgraded" unit is that calibration with an Agilent cal kit does not look right. I'm keying it in by hand as a user1 to see if that makes a difference. The O,S,L look good visibly but when you turn on port extensions, it doesn't look like it used the correct constants.
-
So with the kit constants for an 85033D/E keyed in, the analyzer cals correctly. Short and Open are two arcs of lengths that are close to the constants table for the kit. Performing an AUTO-OPEN shows extension of proper delay.
With the built in 85033D/E menu selection, the results are clearly WRONG. Both arcs are very short and extensions to make dots are way off.
Could this have any relation to how I "upgraded"? I used the simplest method (downgraded then upgraded to the patched, matching version, then applied keys).
-
I believe that Siglent has a major problem with their internal calibration kits but since I have a hacked product, cannot pursue this with them.
Findings:
1. calibration results with an Agilent 85033D/E kit were way off when using the associated kit in the Siglent, as seen on OPEN and SHORT arcs being of incorrect length/delay
2. I hand entered the constants for this kit into USER1 and it worked perfectly
3. The two files in "cali" did not appear when I did the cross flash to an SVA
4. I copied the two files into the "cali" folder
5. They had no effect on the bad cal with the built in kit
6. * this confirmed that the two files NA1_P and NA2_P, DID NOT CONTAIN CAL KIT INFO, but something else
7. Discovered the vnacalikitdata folder and the *.CSV files it contains with cal kit names ... MAJOR PROBLEM HERE ...
* the .csv files are incomplete, do not cover the kits shown in the menu
* BIGGER PROBLEM - the .csv files contain frequency and two columns of data, not the typical cal kit constants, meaning that they are data
or S parameter based *
So currently, this limits us to TWO cal kits, USER1 and USER2, that we need to key in by hand.
This is my assumption based on actual results on one kit and observations of an incomplete list of kits in the .csv files. Perhaps the remainder are elsewhere, I don't know. I do know that a .csv for the 85033D/E does not exist in this folder.
If Siglent has implemented their own data based kits for commercial kits whose data is well published, then Siglent's kits are useless.
I'm very interested in a high end model from them but this puts a damper on that. Also, this encryption crap for all of their files helps no one. The calibration kits should be picked up from external files that can be examined, or cloned and modified for special use.
-
I'm very interested in a high end model from them but this puts a damper on that. Also, this encryption crap for all of their files helps no one. The calibration kits should be picked up from external files that can be examined, or cloned and modified for special use.
Since you seem expert in the matter, can you elaborate the information you checked in Siglent files?
I don't think there is any "encryption" at play here, just a simple custom structure by Siglent. Maybe one could understand the structure and their kits.
Maybe I could help a little but time is rare nowadays.
-
Sorry, no expert here but I've worked with a lot of DIY standards until I landed a few real kits, and am somewhat familiar with the cal constants. And you may be correct in that their data is just that, data and only in their own structure. Kit labels for the soft keys would have to be elsewhere in resources. But since today's experiment, I found that the 2 missing files did not fix the problem. Then I found the limited .csv files. Not all kits are present.
But the problem remains that only a handful of kits from the menus are present in .csv form. The files are named for the type such as 85032F.csv. These kits do not contain the usual data found in kits, delays, c0, c1, c2, c3 and lo, l1, l2, l3. They are frequency and a pair of data, probably in real, imaginary form. This example file is a 85032F kit for a type N connector, not sure of the sex. My real kit is 85033E for 3.5mm (similar to SMA). It has no .csv file and there's no reason for that.
Quick summary:
1. performing a cal with the internal 85033E kit results in way off responses, perhaps because there is NO KIT present
2. entering the proper 85033E constants into the USER1 cal kit results in near perfect cal.
3. If the.csv files are indeed Siglent's implementation, then:
a) many are missing and
b) this is not a good practice
They could/should have been in .xml or delimited text or some other ascii readable format and contained data from Agilent.
Since posting I also repeated this with an Anritsu Tee shaped cal kit I have. I entered it as USER2 and it behaved near perfectly.
You can tell if the cal matches the kit if the arc produced for a short or open can be brought to a dot by entering a port extension equal in time to the delay constant from the kit for that type and sex of connector.
I think what's left is for someone else to repeat this on a real SVA. Then it can be brought up with Siglent.
-
A nice treat found :)
While trying to get the "upgraded" SVA1032X to save a calibrated session AND apply that calibration to a measurement, I discovered that the unit now saves SNP files. This was a shortcoming noticed by many. This addition does not appear in the pdf manual or in the firmware revision notes. Just an unannounced gift :)
To repeat, with the latest firmware (haven't looked before this), the SVA1032X now saves an S1P file for the VNA mode.
The file produced opened correctly in an online S1P viewer.
For those wondering WTF is this about, you can sweep an antenna or network, save the S1P and bring it into a PC based program to view the plot and to add LRC networks to move the plot response as desired. You can then add that network for real and watch the VNA plot the new response. Up to tens of MHz, it should be easy. Once in the GHz, things are not that easy due to pcb layout, stray capacitance and inductance and the phase of the moon ::)
-
Another little gem that is not in the documentation, the CSA save as format.
Borrowed from its big brothers, as well as Agilent / Keysight, the CSA save allows you to bring back a session with calibration AND state settings applied.
Example: calibrate the unit with test cable in place, attach your antenna, circuit, etc. Adjust screen settings, markers, etc. The CSA save will allow you to come back completely to this "arrangement". Neither STATE nor CAL alone will do this.
Incidentally, Siglent's high end, SNA5032A, does document this format.
-
Regarding cal kit issues, I noticed that the SNA5032A, for instance, allows cal kits in the .xkt format which is used by Keysight. They also allow full editing of cal kits, creation of custom kits and more of what you'd expect for $32,000.
While it's obvious you're not going to get this functionality in a < $3000 unit, the essentials should have remained. Keep the .xkt format for external cal kits AND for internal kits from Keysight or others.
-
Hello everyone, I'm new here. I have a SSA3021X spectrum analyzer that had some options unlocked and the Model: SSA3032X and it had firmware 1.2.8.5a with Telnet enabled, all OK. But there was an small attenuation problem on the TG the -1.0dbm. Siglent asked me to update to 1.3.9.10. After I updated, the Model appears now as SSA3010X and Telnet was blocked, and the TG started to have an attenuation ranging from -22 dBm to -30 dBm. Does anyone have any idea how to re-enable Telnet and adjust the model and calibration? I appreciate the help in advance.
-
OK, i hope you were really sure it was 1.2.8.5a.
An Update to 1.3.9.10 are only possible directly since 1.2.8.1 like said in the update instructions.
I don't know a SSA3010X but i think it is a typo, right?
if it is really SSA3010X do you have a screenshot?
And yes from a certain version telnet was removed.
But as i know it exists a special ADS in the forum with which you can enable temporarily.
Have you ever reset the configuration to factory settings?
regards Chris
Addendum:
Is it possible that the device currently only has a maximum of 1 GHz?
Did you change something on an xml using telnet beforehand?