Hack of Sigllent spectrum analyzer ssa3021X?

[Deepblue]

hmmm, how would I go about that?
where do I find the SCPI app file?

[tv84]

hmmm, how would I go about that?
where do I find the SCPI app file?

I meant the SA main app (that runs in the equipment)! It's the main app that answers to the SCPI requests.

[Deepblue]

oh ok, any clues to where I should look for this app?
Any ideas where to find the serial, or can I just search for the XXXXXXX thingy?

[tv84]

Search the thingy.

[Deepblue]

I get it
but where is the app located?

[tv84]

Deep blue is just a disguise, right? 

[electronic_eel]

but where is the app located?

The program is called "ecomb" and can be found below /usr/bin/siglent

[Deepblue]

Thanks, I found the app.
searched it and found two places where XXXXXXXX. the first one is at addr. 001052E8 (FW 1.2.9.2.a) the second is at addr. 00130D44.
At the first addr. it states "XXXXXXXX  Changed".
It would be nice to have the original non-hacked ecomb file to compare with. anyone have this for this firmware?

I guess I should change it both placed?

When I have the modified file, how do I shutdown the process to be able to copy it? I guess I need to remount the drive RW also ?

[electronic_eel]

It would be nice to have the original non-hacked ecomb file to compare with. anyone have this for this firmware?

Why do you have a hacked or modified ecomb binary? Opening the telnet port or renaming the license files does not patch your binary, it just changes how the binary behaves.

When I have the modified file, how do I shutdown the process to be able to copy it? I guess I need to remount the drive RW also ?

use the kill command (see first few pages of this thread), then remount rw and copy.

[Deepblue]

It would be nice to have the original non-hacked ecomb file to compare with. anyone have this for this firmware?

Why do you have a hacked or modified ecomb binary? Opening the telnet port or renaming the license files does not patch your binary, it just changes how the binary behaves.

When I have the modified file, how do I shutdown the process to be able to copy it? I guess I need to remount the drive RW also ?

use the kill command (see first few pages of this thread), then remount rw and copy.

Thanks, I just thought the binary was changed as it states the dummy serial with a "Changed" text behind it? This cannot be correct in a non-hacked unit, can it?

[Bicurico]

Hi everybody,
I have been reading this thread and decided to order a Siglent SSA3021. It came with the tracking generator license and the 1.2.9.2.a firmware installed.
I managed to get all the options enable, using knowledge from this thread  everything looks fine, apart from the license number which is XXXXXXX as I knew it would be when hacking it.

My question is; have anybody tried the TekBox EMCView pre-compliance software (Link) with a hacked Siglent? They state the software will be locked to the SSA's serial number, but wil this work with a hacked unit?
I have the original S/N, but I suppose the unit reports "XXXXXXXX" back to the software?!?

Hope someone can help me out here.

Hi,

Perhaps you would like to test my software? Much cheaper, can be tested for free and doesn't care for your serial number...

Click the link on my signature.

Regards,
Vitor

[Deepblue]

Hi,

Perhaps you would like to test my software? Much cheaper, can be tested for free and doesn't care for your serial number...

Click the link on my signature.

Regards,
Vitor

Hi Victor, thank you for notifying me on your software. I am definitely in the market for alternative software.
It seems like your software is not offering EMI pre-compliance tools at least I'm unable to find any info on it.

I'm looking for some software to do pre-compliance with corrections factors for the system setup ie. cables, antennas, CDN's etc.
It must do avg. and quasi-peak measurements according to CISPR-16.

maybe the Siglent EasySpectrum software can be used? anybody tried this out in a pre-comliance setup?

[Bicurico]

I am not literate in EMI.
But I think that I could add missing functionality if someone guides me to what is required.

[hfleming]

Proud owner of a brand new SSA3021 spectrum analyzer that I received today. Thank you, community, for the unlock. Latest firmware, with the telnet script and rename of the file works.

[benjamin73]

Hello everybody. I tried to "upgrade" my SSA3021 this morning, but the file fun_opt_valid_config.xml does not seem to be on my unit.

The only 4 files in the directory are:
NSP_sn_bandwidth.xml
NSP_trends_config_info.xml
nsp_data_b
calib

Does it matter? I would not appreciate to crash everything and I am not an expert in this kind of command lines...

Ben

[Pinkus]

Hi everybody,
I have been reading this thread and decided to order a Siglent SSA3021. It came with the tracking generator license and the 1.2.9.2.a firmware installed.
I managed to get all the options enable, using knowledge from this thread  everything looks fine, apart from the license number which is XXXXXXX as I knew it would be when hacking it.

My question is; have anybody tried the TekBox EMCView pre-compliance software (Link) with a hacked Siglent? They state the software will be locked to the SSA's serial number, but wil this work with a hacked unit?
I have the original S/N, but I suppose the unit reports "XXXXXXXX" back to the software?!?

Hope someone can help me out here.

The Tekbox Software is bound to your analyzer. You will have to provide your SA serial number at the purchase. They are then creating a license file you need to run the software and it will not work with different analyzer (though in case of a defective unit, where you have to exchange the hardware, they ensured me, that they will create a new license file). Thus it all comes down to the question, if the real serial number will be available through the SCPI command *IDN?
If you only get "xxxxxxx", then the software would not work.......... mmmmh - idea: you may try to purchase the Tekbox software by providing them the serial # "xxxxxxx"

This Tekbox software is a very useful tool. I recently made a pre compliance check with one of my customers hardware with one of Texbox' TEM Cells. Report of this one measurement is attached (printed from EMCView).
These Tekbox TEM cells and also their software are worth every cent. They are paying themselves at the first usage (though the customer will have to pay for a pre-compliance check of his hardware).
Btw: I am doing another group-buy at Tekbox shortly - this will save you money! So if you are interested in some discount of the Tekbox LISN / TEM Cell / software, just drop me a PM.

[vtwin@cox.net]

The Tekbox Software is bound to your analyzer. You will have to provide your SA serial number at the purchase. They are then creating a license file you need to run the software and it will not work with different analyzer (though in case of a defective unit, where you have to exchange the hardware, they ensured me, that they will create a new license file). Thus it all comes down to the question, if the real serial number will be available through the SCPI command *IDN?
If you only get "xxxxxxx", then the software would not work.......... mmmmh - idea: you may try to purchase the Tekbox software by providing them the serial # "xxxxxxx"

Shouldn't be all that difficult to bypass. I imagine someone could create a proxy (Serial/USB/Ethernet) which intercepts the IDN? SCPI command and returns your actual serial number, and passes through all other SCPI commands unmodified.

[Deepblue]

Shouldn't be all that difficult to bypass. I imagine someone could create a proxy (Serial/USB/Ethernet) which intercepts the IDN? SCPI command and returns your actual serial number, and passes through all other SCPI commands unmodified.

Hmm sounds like a great idea. I would be able to do this in hardware on Serial and maybe on USB, but Ethernet is out of bounds for me
Would be great if someone could write a software tool to implement this. I wonder if it could be done with Wire Shark??

[tv84]

idea: you may try to purchase the Tekbox software by providing them the serial # "xxxxxxx"

That would be the ultimate group buy!   

[willie]

Have followed the forum/thread for years ... Great work everyone. !!

I have an unmodified SSA3021X with a few purchased options, but now need to access the WiFI band.
Have FW version 1.2.8.5a installed.  Read all of the threads ( multiple times) but here is my question :
Can the udpated ZIP file posted by Tom #71 still be used to obtain the options.  This adds the NSP_system_info.XML folder into the firmdata0 SA folder after you edit it with your SA serial number. Advantage is that you retain your S/N OR

Do I use the latest method that just renames files in the firmdata0 and backup folder and loose my S/N

Thanks for the info,
Hank

[TurboTom]

Willie -

since oyur SSA is already on Firmware 8.5, the "old" way to improve the instrument isn't an option for you anymore. You've got to use the new method with renaming / moving the corresponding XML files. I guess you've got to apply the more recent hack that unfortunately results in your SSA's S/N to be displayed as "XXXXXXXX". I don't know if there's a work-around for that meanwhile since I was lucky to be one of the "early adopters" with the result of the hack having become permanent with a valid S/N. Anyway, you can always revert back from the hack with the result of losing the improved specs but getting back your S/N. I'ld know what I prefer  .

Cheers,
Thomas

P.S. I only now noticed that you also tried to contact me by PN, sorry for not replying to that before...

[willie]

Tom
Thanks for your reply.  Guess my only concern is if I need to use the additional analysis SW that requires a valid license.  Since It appears that the telnet port is closing  in V 1.2.9.3 , now I guess is the time.
I plan to backup the files and just rename the single file NSP_sn_bandwidth.xml in both the firmdata0 and backup folders.
Thanks,
Hank

[hfleming]

Hi all. I successfully  hacked my SSA3021 with firmware 1.9.2.3a month or so ago, and it worked as it supposed to. Today i was busy controlling it over USB when my PC crashed. To make a long story short, when I next switched the spectrum analyzer on, it remained stuck on the boot screen. I think when my PC crashed, it must have sent some garbage to the analyzer. Has anybody experienced something similar, or does anybody know how to get it into a mode so that one can reload its firmware?

Hendrik

[tautech]

Hi all. I successfully  hacked my SSA3021 with firmware 1.9.2.3a month or so ago, and it worked as it supposed to. Today i was busy controlling it over USB when my PC crashed. To make a long story short, when I next switched the spectrum analyzer on, it remained stuck on the boot screen. I think when my PC crashed, it must have sent some garbage to the analyzer. Has anybody experienced something similar, or does anybody know how to get it into a mode so that one can reload its firmware?

Hendrik

Using what SW can I ask ?

[electronic_eel]

Today i was busy controlling it over USB when my PC crashed. To make a long story short, when I next switched the spectrum analyzer on, it remained stuck on the boot screen. I think when my PC crashed, it must have sent some garbage to the analyzer.

Are you sure it was some data that bricked your ssa? Couldn't it be some electrical thing, like overvoltage or overcurrent, that crashed your pc and at the same time damaged your ssa?

Did you have any devices connected to the ports of the ssa when the crash happened? Could they have caused overvoltage or overcurrent through the ssa?