Hack of Sigllent spectrum analyzer ssa3021X?

[pjm]

Hi Chaps,

I've had a look at the 1.3.9.6 firmware and there are some interesting SCPI commands including;

BOARDTEST?
CHIP?
DMESg?
IDN-SGLT-PRI?
LICENSE?
LICENSE_ID?
LICENSE_PR?
LOAD:CALI:FILE?
MMEMory:UPLoad?
NET_BRIDGE_ADDR?
REBOOT
SCDP
SGLT-TEST-VAST-DATA?
SVNALL?
:SYSTem:BEEPer:STATe?
:SYSTem:COMMunicate:LAN:GATeway?
:SYSTem:COMMunicate:LAN:IPADdress?
:SYSTem:COMMunicate:LAN:MAC?
:SYSTem:COMMunicate:LAN:SMASk?
:SYSTem:COMMunicate:LAN:TYPE?
:SYSTem:CONFigure:SYSTem?
SYSTem:COUNt?
:SYSTem:DATE
:SYSTem:DATE?
SYSTem:FileSystem:Type?
:SYSTem:LANGuage?
:SYSTem:LKEY?
:SYSTem:LKEY:TIME:RESet <--- this resets the trial licenses to 48 hours
:SYSTem:LOAD:USER:CONFig
:SYSTem:OPTions?
:SYSTem:PON:TYPE?
:SYSTem:POWer:OFF
:SYSTem:PRESet
:SYSTem:PRESet:TYPE
:SYSTem:PRESet:TYPE?
:SYSTem:RESTart
:SYSTem:RST
:SYSTem:TIME
:SYSTem:TIME?
SYSTem:VERSion?
SYSTtem:ERRor?
WEB:PSW?

>nc 99.99.99.250 5024

Welcome to the SCPI instrument 'Siglent SSA3021X'
>>:SYSTem:DATE?
20201105
:SYSTem:PRESet:TYPE?
DFT
:SYSTem:PON:TYPE?
LAST
:SYSTem:COMMunicate:LAN:TYPE?
DHCP
:SYSTem:BEEPer:STATe?
1
:SYSTem:CONFigure:SYSTem?
Model:SSA3021X, Serial Number:SSAblahblahblah, Version:1.3.9.6 ,Firmware:EMI, Meas, TG, RM, ...
:SYSTem:LKEY?
:SYSTem:LKEY:TIME:RESet

Obviously bugger around with these at your own risk...

regards,

pjm

[Ze Pink Panther]

Would you be so kind as to share with us how you created (or got) the "SD recovery package", please?

Best regards,
ZPP

[Ze Pink Panther]

It appears that the new SSA3021X units are sold with FW v1.3.9.5 installed. This version has never been "published" by Siglent (only the latest v1.3.9.6 has), and it seems to be prone to bricking the SSA when trying to re-enable the telnet - the good old one, as we all love it...).

When scanning for open ports, the result is:
111 (TCP)(rpcbind)
5024 (TCP)
5025 (TCP)
There is also another port which (randomly) appears open: 898 (TCP) / 904 (TCP) / 905 (TCP).

Telnetting the port 5024 opens a connection with the prompt:

>>Welcome to the SCPI instrument 'Siglent SSA3021X'
>>

but only SCPI commands (as described in Programming Manual) are accepted. Telnetting the port 5025 has the same result, but without any prompt.

I've got two questions for you guys:
1. Has anyone tried to upgrade this particular FW version to the newest FW v1.3.9.6?
2. Has anyone tried to downgrade this particular FW version to an older one (ex.: 1.2.8.3, 1.2.9.1, 1.2.9.3a)?

Thanks and regards,
ZPP

[tautech]

It appears that the new SSA3021X units are sold with FW v1.3.9.5 installed. This version has never been "published" by Siglent (only the latest v1.3.9.6 has),...

This is not unusual by any means while a more major upgrade is still being developed.

I've got two questions for you guys:
1. Has anyone tried to upgrade this particular FW version to the newest FW v1.3.9.6?
2. Has anyone tried to downgrade this particular FW version to an older one (ex.: 1.2.8.3, 1.2.9.1, 1.2.9.3a)?

Upgrades and downgrade work just fine within the limits of the upgrade instructions in that there are some more major than others that don't permit further downgrades. The full release notes and upgrade instructions in each version list these conditions FYI.

[james38]

Hi all,

I dont have a SSA3021x yet but have the ability to get one.
It depends if it is upgradeable with the hack who is mentioned in this thread.
I know that this Analyzer will be has the latest FW.

Since the telnet_11201.ADS maybe has some issues (bricking) with some FW Revisions,
is it possible to downgrade to a 1.2.8.x  with official FW to get telnet access again?.
I don't know exactly at which version telnet was been disabled.
The problem I see is that someone says he has downgraded but not say from which base firmware.

What I would like to know, whether I'm right.
I guess that a downgrade is only possible in the following ranges:
1.2.8.x (1.2.8.1 -> 1.2.8.5a)
1.2.9.x (1.2.9.1 -> 1.2.9.3a)
1.3.9.6 (1.3.9.6- > )

Downgrade from 1.2.9.x to 1.2.8.x is not possible
Downgrade from 1.3.9.x to 1.2.9.x and 1.2.8.x is not possible.

Maybe i am wrong but can someone confirm or correct this?

Regards Chris

[Bicurico]

Chris,

If the price is good and you really want to have the SSA3021X model as opposed to the newer (and more expensive) Plus version, then by all means go for it.

It is still hackable and I am sure you will get the required help if needed. Also, bear in mind that the device might come already hacked (have you checked that?).

Regards,
Vitor

[Bicurico]

Hi,

I have a dumb question:

Is it possible to "upgrade"/hack the SSA3015X Plus or do you need an SSA3021X Plus?

For some odd reason everybody seems to be buying the more expensive 2.1GHz model (SSA3021X Plus) as a base to upgrade it to SVA1032X, instead of the cheaper 1.5GHz model (SSA3015X Plus).

Regards,
Vitor

[Bicurico]

Answer seems to be no:

https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3191602/#msg3191602

[Noy]

1.5GHz Version differs from 2.1/3.2 and these differs from 7.5..
So no you only can upgrade to SVA1015 with ssa3015x plus.
And if you need 2.4GHz you habe to go for 2.1 and upgrade..

[cnkz]

Hi,

i own a hacked SSA3021X with FW Version: 1.2.9.1.

Can i update to V1.3.9.6 just by doing the normal Firmware Update process or do i need to do some hacks? (just confused)

[tv84]

Yes, you can.

[pjm]

Hi all,

I've updated my unit to the latest and greatest firmware 1.3.9.6, and all seems fine so far. This was from version 1.3.9.5 as shipped back from Siglent after a repair. (They moaned like a drain about modified file system / hack etc)



regards,

pjm

[pjm]

Hi all,

Whilst looking at the firmware, it seems there is some facilities for a 'web update' - does anyone happen to know if its actually used, or can be triggered through a key combination on boot etc? It appears to POST to the siglent site, download an update .sh file and execute it as root.... If its possible to trigger it, the rest as they say might be history.

regards,

pjm.

PS there is also an add-on license option called "RM" anyone know what that does?

[napalmDaz]

Hi guys,

I have a SSA3021X with firmware 1.2.9.3a.

If I want to enable all options I believe I first need to enable telnet access and rename some files?

So I do this via the firmware ADS file here:
https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/msg1870091/#msg1870091
https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/?action=dlattach;attach=1126548

I'd love to know if its that simple on the slightly older firmware the device is currently running?

Sorry for the questions.

Kind Regards,
Darrell

[oz2cpu]

Darrel ?? are you able to figure any of this out ??
I just got a brand new SSA3021X
sw version 1.3.9.5
its TG is enabled all the time, so at least that is fine.
the 3 other options: 47 hrs left (what crap)
and it is 2.1GHz only..
PLEASE HELP... it is VERY confusing the stuff you people explain here, many different links, and stuff to do..
why not have ONE place ?
with a full updated detailed instruction covering all things we must do, and access to the needed files ??

[Bicurico]

@oz2cpu: The reason is simple... Let me break it down.

1) The hack evolved over time with many people contributing their discoveries.
2) The different hacks changed over time due to Siglents "counter measures".
2) This has all been documented in this thread.
3) The ones contributing have their device hacked and already contributed with their findings. Don't expect them to write noob tutorials.
4) The ones who arrive here just to hack without exploring (or risking to break) their devices, did not spend time to write up such a detailed instruction set as you are requesting  (there are some exceptions), after having their devices upgraded.
5) Why don't YOU read all pages and then make said documentation, describing how you did it on your device?
6) Having to spend a couple of hours to read through this thread is a joke compared to the amount of hours it took to get to this point.

Don't get me wrong, but "with a full updated detailed instruction covering all things we must do, and access to the needed files ??" is totally the wrong attitude. If you want an express solution, just purchase the keys from Siglent. That is quick, safe and you keep your warranty.

Otherwise, if you do read through this thread and have questions, you are more than welcome to ask whatever youneed to know.

Regards,
Vitor

[sjl]

Hi,

i own a hacked SSA3021X with FW Version: 1.2.9.1.

Can i update to V1.3.9.6 just by doing the normal Firmware Update process or do i need to do some hacks? (just confused)

cnkz, were you able to maintain your unlocks after doing so?  Or did the normal firmware update path from a hacked version result in loss of the features?

[Bicurico]

Updating to the latest version shoul dnot change the status of the hack,

You will however for sure lose telnet access, if you still retained it.

There are ways to switch it back on again.

Vitor

[sjl]

Thank you Bicurico!

On a second note, do you or anyone know if it would be possible to enable Mouse support for the SSA 3021X (non Plus) via Telnet?

I'm guessing there could be a limitation in that the Plus firmware has completely different UI code that integrates Mouse (probably directly associated with the touch screen support for the touch hardware) and wouldn't be as simple as enabling a USB daemon

[hervstein]

Hello, my name is Raul. I would like to know if someone keeps the 07.03.00 update. The link is down and there is no way to get it. Thank you.

[hervstein]

It seems to me you'd want to grab the current FW update just in case it gets pulled. 
Not sure if it has opened the hole to allow the upgrade but just in case it has here's the link:

http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA-firmware-0705.rar
~7.5 Mb

Hello, do you still have the update? It is impossible for me to get it, the link is down.

[tautech]

All notable SSA3000X updates are here:
https://int.siglent.com/download/firmwares/?ProId=29

SSA3000X Plus updates here:
https://int.siglent.com/download/firmwares/?ProId=48

[sjb]

Since upgrading my SSA3021X to firmware v1.3.9.6 (from v1.2.9.3a), whenever I do an EMC frequency scan, the last 2 values of the 751 captured data points (far right of the display) always return the maximum value (+1.069900000E+02) in a SCPI request for trace data!

The peak table always shows them as 106.99 dBuV peaks! Never did this in any previous firmware version.

I can roll back to v1.2.9.3a and all is ok again, upgrade back to v1.3.9.6 and the problem shows again!

Has anyone else seen oddities introduced with v1.3.9.6?

Can anyone test this on their SSA3000X. The SA was in EMI mode and the sweep was set to single. I also get weird UI issues like I seta trace to 'Blank' then enable the peak table and the trace suddenly switches to 'Clear/Write' and re-appears again! It's very odd, and very repeatable.

[EE4all]

The ADS to ZIP file tool appears to be missing.

[oz2cpu]

you say
SSA3000X Plus updates here:
https://int.siglent.com/download/firmwares/?ProId=48

the lates file for my SSA3021X is called
SSA3021_3032XP_V3.2.2.4.0_EN

firmware update just say : System update failed in red.
WHY ?
my SSA is brand new, but its shipped fw is called : 20190610-1
so it come with 2years old sw ??