SDS1102x+

[Raima010]

Have somebody tried to unlock this model. ID has xxx.yyy.zzz format. Backdoors closed to read memdump. Somehow I have managed to stop countdown counter for trial licenses which are stuck on 28 days now. But nothing other what works from described methods.

[tautech]

SCPI access is described on P13:
https://siglentna.com/wp-content/uploads/dlm_uploads/2021/01/SDS1000-SeriesSDS2000XSDS2000X-E_ProgrammingGuide_PG01-E02D.pdf

[Raima010]

Yes, SCPI commands do work but, as I know this does not help to extract memdump. Plus unlock code calculators on forum all works with ID xxxx.yyyy.wwww.zzzz format - 16 digits. On this scope we get only xxxx.yyyy.wwww numer, ie 12 instead of 16 digits. Tried to calculate unlock code with only 12 digits - doesnt work. Probably needs another technique to read memdump or 12 digits code extractor. Thinking if is there another methods to read memdump, maybe some connection ports inside the scope like seriar/uart/ SPI which can be usefull?

[tautech]

A little Google points back to this thread that has plenty of clues of what to try:
https://www.eevblog.com/forum/testgear/unlocking-siglent-sds1104x-e-step-by-step/

[Raima010]

Well, not very promising..
Tried to downgrade all the way firmware to the lowest available via siglent official download. One is dated 2017 before they probably closed the doors, but still no luck to dump memory,
no SHELL commands,
no Telnet

Ni-Visa makes connection via usb, but *IDN? command returns same ID number which is awailable via scope's info screen with 12 number format 000-abcd-efgh which I believe is not full. Does not work with script for calculating unlock codes either.

Made it clear that SDS X models are blackfin machines not utilizing linux att all, thanks to tv84 - https://www.eevblog.com/forum/testgear/siglent-sds2000x-hack/50/

so that telnet is not possible in its nature with this kind of machines. This well is confirmed even in the official siglent webpage https://www.siglenteu.com/operating-tip/instrument-socket-and-telnet-port-information/

At the end have disassembled device with hope to connect to Serial port and get some info from there. Still no luck. Serial does not issue any signals, just silence. Blocked in software, hardware level - unclear.

Last hope is JTAG method but haven't tried it yet. Does someone have some experience with this?
Interestingly, all the pin outs on the mainboard are not marked on my scope, what I see in some other scopes on videos. Late production extra safety measures?
Serial port was not hard to find by its 4 wire connection in any way.

[tv84]

Show these SCPI outputs:

MCBD?
MD5_PR?

It should respond with errors.

I think you are confusing things: I recently said CML+ is an ARM machine. I think I was not referring to a SDS1000X+.

A SDS1000X+ is A BF machine as its cousin SDS1000X.

So, you won't be able to change BW. Just any other options that it might have. The BW upgrade in the SDS1000X/SDS2000X requires desolderings...

[Raima010]

Yes, it responds with errors to these commands:

*MCBD?\n

Read Operation
Error

VISA:  (Hex 0xBFFF0037) Device reported an input protocol error during transfer.

To IDN for example responds correctly:

*IDN?\n

Read Operation
Return Count: 47 bytes
*IDN\sSIGLENT,SDS1102X+,SDS1XECD3R0857,1.1.2.15\n

Sorry I am not sure if I do have confused something, your post was:


Re: Siglent SDS1000(X) / SDS2000(X) or LeCroy WaveAce (Blackfin) hacks?
« Reply #74 on: February 18, 2019, 04:38:13 pm »
Say ThanksReplyQuote
SDS X is a Blackfin machine. No ARM and no linux OS.

No telnet is possible.


So yes, scope has no any code input option for bandwidth upgrade. Only Decode and AWG options. As it was said earlier scope gives 0000-aaaa-bbbb 12 digits ID with 4 leading zeros and none of scripts gives unlock code which would work.

By desoldering you mean any of those capacitors in analog part? (actual my scope picture)

UPDATE: and as I have disassembled the scope here I can confirm that SDS1102X+ contains BF processor onboard, so maybe there is no doubt longer about hardware configuration.

[tv84]

@Raima, so if there was any doubt... BF indeed.

I think I never talked about a X+ because I've never seen a user with a X+. You're the 1st.

See my pm.

[tautech]

@Raima, so if there was any doubt... BF indeed.

I think I never talked about a X+ because I've never seen a user with a X+. You're the 1st.

X+ was only a model designation change as previously they were X-S signifying models that housed the AWG HW.
IIRC X had the UI to support the AWG card but it was greyed out.

[Raima010]

It looks like the problem have been solved 

Thank you tv84!! You are genius!

Next step would be uncage bandwidth..

[Raima010]

Upgraded to latest software, all licenses still in place.

Just to mention about strange effect.. In the beginning there was 2 licenses to enter according to license table on the screen - AWG and Decode. Firstly entered AWG license ant then it disappeared from the table but MSO appeared as  Permanent instead. Then entered Decode it become as Permanent also (both were entered via scopes interface).

Over Type selection button both Decode and MSO become grayed also. AWG still not, but install key does not gave possibility to enter AWG code via scopes interface. It wasn't on license table as well.

AWG code entered via SCPI command. Was accepted without error and only then AWG over Type button become grayed also. AWG still not in the table.


And lastly, what the PAS license code stands for?

[tautech]

AWG code entered via SCPI command. Was accepted without error and only then AWG over Type button become grayed also. AWG still not in the table.

X+ = AWG std AFAIK.

And lastly, what the PAS license code stands for?

Power Analysis Software.

[Raima010]

Yes AWG - arbitrary wave generator which is built-in with X+. But in the beginning it was under Trial license in the table with 27 remaining times. After decoding AWG it disappeared from table but MSO come in table like licensed. MSO was not in the table before.

SDS1102X+ has no Power analysis options, so does not need this code possibly.

[tautech]

Yes AWG - arbitrary wave generator which is built-in with X+. But in the beginning it was under Trial license in the table with 27 remaining times. After decoding AWG it disappeared from table but MSO come in table like licensed. MSO was not in the table before.

Maybe as a result of old firmware. 
Looking at a recent pricelist AWG is standard, Decode and MSO are options.

SDS1102X+ has no Power analysis options, so does not need this code possibly.

Yes, PAS is not available in SDS1000X or X+ models.

[Raima010]

It was really weird to se AWG under Trial with xx remaining times when you buy device with AWG as advertised and pay extra for this.

[tautech]

It was really weird to se AWG under Trial with xx remaining times when you buy device with AWG as advertised and pay extra for this.

There are 2 FW updates that maybe caused this, 1.1.1.2.6 (Relates to SDS1000X+ models) and 1.1.1.2.13R3 (Note: This update requires performing the update procedure twice) and if either have not been performed to the update instructions weird results might result.

All the info is online and freely available.
https://int.siglent.com/download/firmwares/?ProId=1

[radiolistener]

Over Type selection button both Decode and MSO become grayed also.

what means MSO option?

By desoldering you mean any of those capacitors in analog part? (actual my scope picture) (Attachment Link)

I don't know about SDS1102X+ model, but it looks that you're pointing to the wrong capacitors, because at a glance your photo looks very similar to the SDS1102X/SDS1202X model. So, you're needs to see for the capacitor on another side of a chip.

Here is detail for SDS1102X:

[Raima010]

what means MSO option?

MSO- mixed signal oscilloscope
MDO- mixed domain oscilloscope

I don't know about SDS1102X+ model, but it looks that you're pointing to the wrong capacitors, because at a glance your photo looks very similar to the SDS1102X/SDS1202X model. So, you're needs to see for the capacitor on another side of a chip.

As I see its identical layout. Have you removed shown cap? What bandwidth increase did you get?

[radiolistener]

As I see its identical layout. Have you removed shown cap? What bandwidth increase did you get?

I didn't tried this mod, but people who found this difference (he compare his SDS1102X with SDS1202X teardown video from Dave) tried to remove that cap on one channel and reported that he got more flat frequency response up to 120 MHz (maximum of his sig gen). He said that he was very pleased with the result. You can try to find his message in the topic about SDS1202X oscilloscope on this forum

[Raima010]

100mHz->120mHz it not much and worth maybe. But was it right cap? I saw on someone's video that after removing some cap was quite significant bandwidth increase like 200mHz->350mHz. At least AD8370 chip declared bandwidth in datasheet is up to 750mHz.

[SimpleXP]

Hi,

today I also tried unlocking the MSO of my SDS1102X+ but can't generate the correct license...
Can you tell me what you have changed in the generator?

[Latet]

Hello @tv84, sorry to bother you but can you tell us how to obtain the 16-digit ID instead of the 12-digit one? The model of my scope is SDS1102X and I have the same issue that @Raima010 describes in the post.