Author Topic: Siglent SDS1104X-E Hack to 200Mhz, and full options ?  (Read 22138 times)

0 Members and 2 Guests are viewing this topic.

Offline S.Garrix

  • Newbie
  • Posts: 2
Siglent SDS1104X-E Hack to 200Mhz, and full options ?
« on: July 11, 2018, 03:29:13 pm »
I have two Siglent 1104x-e in my lab, and noticed the thread:https://www.eevblog.com/forum/testgear/siglent-sds1204x-e-released-for-domestic-markets-in-china/825/
and in Reply #785 @ian.ameline “upgraded” the SDS1104X-E to 200Mhz, Rf loop confirmed
thanks to Ian and rfloop,  I patch the OS update so that the root password is known, and had one of my SDS1104X-E upgraded to 200Mhz ,
1. patch the OS update , set password
2. Connect SDS1104X-E by telnet.
3. Input command "mount -o remount,rw,sync /usr/bin/siglent/firmdata0".
4. Input command "rm /usr/bin/siglent/firmdata0/bandwidth.txt".
5. Restart the scope.         

!!Update for commands
 by the exact same way I also got MSO,AWG, WIFI full options
Step 4,  command "rm /usr/bin/siglent/firmdata0/options_mso_times.txt".
"rm /usr/bin/siglent/usr/usr/options_mso_times.txt"
         "rm /usr/bin/siglent/firmdata0/options_awg_times.txt"
"rm/usr/bin/siglent/usr/usr/options_awg_times.txt"
"rm /usr/bin/siglent/firmdata0/options_wifi_times.txt"
"rm /usr/bin/siglent/usr/usr/options_wifi_times.txt"

Not sure if Siglent will close the door or not
« Last Edit: July 18, 2018, 07:01:10 am by S.Garrix »
 
The following users thanked this post: TheNewLab, ian.ameline, Coldblackice

Offline innkeeper

  • Supporter
  • ****
  • Posts: 512
  • Country: us
  • Country: us
Re: SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #1 on: July 11, 2018, 04:47:02 pm »
unless someone sees fault with this, id use an mv (move) command to move it to a new name or place instead of rm (remove) in case you ever needed to put it back.



Hobbyist and a retired engineer and possibly a test equipment addict, though, searching for the equipment to test for that.
 

Online GregDunn

  • Frequent Contributor
  • **
  • Posts: 711
  • Country: us
  • Country: us
Re: SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #2 on: July 11, 2018, 05:51:27 pm »
Yes, definitely do not remove the files - suppose Siglent requires them to be present for an OS or firmware upgrade at some future time?  You'd have to restore them from your backup (you did make a backup, right?).   :D
 

Offline tubularnut

  • Contributor
  • Posts: 19
  • Country: gb
  • Country: gb
Re: SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #3 on: July 11, 2018, 06:12:26 pm »
The files only contain the text "30" , if you still have the 30 remaining times.

However, it didn't work for me, either by renaming the files (mv) or deleting them.

As a note there are also 3 copies in the folder "/usr/bin/siglent/usr/usr" which get recreated if you rename or delete them.
 

Online GregDunn

  • Frequent Contributor
  • **
  • Posts: 711
  • Country: us
  • Country: us
Re: SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #4 on: July 11, 2018, 06:30:30 pm »
Those files don't even exist on my scope in the firmdata0 directory...  and I can confirm that renaming the files in /usr/bin/siglent/usr/usr doesn't work.
 

Online BillB

  • Frequent Contributor
  • **
  • Posts: 542
  • Country: us
  • Country: us
Re: SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #5 on: July 11, 2018, 10:50:45 pm »
Those files don't even exist on my scope in the firmdata0 directory...  and I can confirm that renaming the files in /usr/bin/siglent/usr/usr doesn't work.

Hmmm...

Code: [Select]
/usr/bin/siglent/firmdata0 # ls -l
total 140
-rw-r--r--    1 root     root           241 Jan  1 00:33 NSP_system_info.xml
-rw-r--r--    1 root     root            63 Jan  1 00:00 NSP_trends_config_info.xml
--wxr-Sr--    1 root     root          7012 Jan  1 00:31 acq_quick_cal_factory.bin
-rwxrwxrwx    1 1000     1000          7688 Aug 21  2017 acq_self_cal_user.bin
-rwxrwxrwx    1 1000     1000          7448 Jan  1 00:15 acq_self_factory_cal.bin
-rwxrwxrwx    1 1000     1000            16 Jan  1 00:00 bandwidth.bak
-rwxrwxrwx    1 root     root         52916 Jan  1 00:00 factory_setting.xml
---sr----x    1 root     root            20 Jan  1 00:23 options_awg_cfg.bin
---sr----x    1 root     root            20 Jan  1 00:23 options_awg_license.txt
-------r-x    1 root     root            10 Jan  1 00:00 options_awg_times.txt
-rwx--sr-T    1 root     root            20 Jan  1 00:21 options_mso_cfg.bin
-rwx--sr-T    1 root     root            20 Jan  1 00:21 options_mso_license.txt
------x---    1 root     root            10 Jan  1 00:00 options_mso_times.txt
--ws--x---    1 root     root            20 Jan  1 00:25 options_wifi_cfg.bin
--ws--x--x    1 root     root            20 Jan  1 00:25 options_wifi_license.txt
-------r-x    1 root     root            10 Jan  1 00:00 options_wifi_times.txt
-rwxrwxrwx    1 1000     1000            16 Jan  1 00:00 pro_filter_cfg.bin
-rw-r--r--    1 root     root          3320 Jan  1 00:00 sys_cfg.cfg
-rwxrwxrwx    1 1000     1000            67 Aug 21  2017 version.txt
-rw-r--r--    1 root     root             5 Jan  1 00:00 whoami.txt
/usr/bin/siglent/firmdata0 #

This is with the both the latest firmware and OS updates: 7.1.6.1.25R2
 
« Last Edit: July 11, 2018, 11:17:43 pm by BillB »
 
The following users thanked this post: tautech

Online GregDunn

  • Frequent Contributor
  • **
  • Posts: 711
  • Country: us
  • Country: us
Re: SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #6 on: July 12, 2018, 12:38:57 am »
Code: [Select]
/usr/bin/siglent/firmdata0 # ls -l
total 100
-rw-r--r--    1 root     root           241 Jan  1 00:02 NSP_system_info.xml
-rw-r--r--    1 root     root            63 Jan  1 00:00 NSP_trends_config_info.xml
--wxr-Sr--    1 root     root          7012 Jan  1 00:31 acq_quick_cal_factory.bin
-rwxrwxrwx    1 1000     1000          7688 Sep 18  2017 acq_self_cal_user.bin
-rwxrwxrwx    1 1000     1000          7448 Jan  1 00:05 acq_self_factory_cal.bin
-rwxrwxrwx    1 1000     1000            16 Jan  1 00:01 bandwidth.bak
-rwxrwxrwx    1 root     root         52916 Jan  1 00:00 factory_setting.xml
-rwxrwxrwx    1 1000     1000            16 Jan  1 00:01 pro_filter_cfg.bin
-rw-r--r--    1 root     root          3320 Jan  1 00:00 sys_cfg.cfg
-rwxrwxrwx    1 1000     1000            67 Sep 18  2017 version.txt

Very interesting...  7.1.6.1.25 R2 here too.
 

Online SMB784

  • Regular Contributor
  • *
  • Posts: 170
  • Country: us
  • Country: us
Re: SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #7 on: July 12, 2018, 02:14:10 am »
Code: [Select]
/usr/bin/siglent/firmdata0 # ls -l
total 100
-rw-r--r--    1 root     root           241 Jan  1 00:02 NSP_system_info.xml
-rw-r--r--    1 root     root            63 Jan  1 00:00 NSP_trends_config_info.xml
--wxr-Sr--    1 root     root          7012 Jan  1 00:31 acq_quick_cal_factory.bin
-rwxrwxrwx    1 1000     1000          7688 Sep 18  2017 acq_self_cal_user.bin
-rwxrwxrwx    1 1000     1000          7448 Jan  1 00:05 acq_self_factory_cal.bin
-rwxrwxrwx    1 1000     1000            16 Jan  1 00:01 bandwidth.bak
-rwxrwxrwx    1 root     root         52916 Jan  1 00:00 factory_setting.xml
-rwxrwxrwx    1 1000     1000            16 Jan  1 00:01 pro_filter_cfg.bin
-rw-r--r--    1 root     root          3320 Jan  1 00:00 sys_cfg.cfg
-rwxrwxrwx    1 1000     1000            67 Sep 18  2017 version.txt

Very interesting...  7.1.6.1.25 R2 here too.

Have you also installed the latest software update?
"Anything will lase if you hit it hard enough."

-Arthur L. Schawlow
 

Online GregDunn

  • Frequent Contributor
  • **
  • Posts: 711
  • Country: us
  • Country: us
Re: SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #8 on: July 12, 2018, 02:47:05 am »
I installed the latest versions from Siglent's website as soon as I verified the scope was running properly:

SDS1004X-E Firmware (4-Channel Model) - 6.1.25R2 (Release Date 06.05.18 )
SDS1004X-E Operating System -V1 (Only For 4-Channel ) (Release Date 06.26.18 )

That's 7.1 (OS).6.1.25R2 (firmware), as I indicated, right?
 

Offline innkeeper

  • Supporter
  • ****
  • Posts: 512
  • Country: us
  • Country: us
Re: SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #9 on: July 12, 2018, 03:21:35 am »
7.1.6.1.25 R2 here too - similar - no mso,wifi,awg configs
and i did install and run the latest software - EasyScopeX – 100R001B02D01P20 (Release Date 06.07.18 ) (if that's what your referring to)
is there a newer os image we should be using?

Code: [Select]
/usr/bin/siglent/firmdata0 # ls -l
total 112
-rw-r--r--    1 root     root           241 Jan  1 00:00 NSP_system_info.xml
-rw-r--r--    1 root     root            63 Jan  1 00:00 NSP_trends_config_info.xml
--wxr-Sr--    1 root     root          7012 Jan  1 00:32 acq_quick_cal_factory.bin
-rwxrwxrwx    1 1000     1000          7688 Sep 18  2017 acq_self_cal_user.bin
-rwxrwxrwx    1 1000     1000          7448 Jan  1 00:12 acq_self_factory_cal.bin
-rwxrwxrwx    1 1000     1000            16 Jan  1 00:01 bandwidth.bak
-rwxrwxrwx    1 root     root         52916 Jan  1 00:00 factory_setting.xml
-------r-x    1 root     root            10 Jan  1 00:00 options_awg_times.txt
------x---    1 root     root            10 Jan  1 00:00 options_mso_times.txt
------x---    1 root     root            10 Jan  1 00:00 options_wifi_times.txt
-rwxrwxrwx    1 1000     1000            16 Jan  1 00:01 pro_filter_cfg.bin
-rw-r--r--    1 root     root          3320 Jan  1 00:00 sys_cfg.cfg
-rwxrwxrwx    1 1000     1000            67 Sep 18  2017 version.txt
/usr/bin/siglent/firmdata0 #
« Last Edit: July 12, 2018, 03:35:19 am by innkeeper »
Hobbyist and a retired engineer and possibly a test equipment addict, though, searching for the equipment to test for that.
 

Online GregDunn

  • Frequent Contributor
  • **
  • Posts: 711
  • Country: us
  • Country: us
Re: SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #10 on: July 12, 2018, 05:11:48 pm »
Are you suggesting that (for example) he has a wifi adapter plugged in, and set it up in the options?  Mine won't let me configure any of those options because the hardware is not attached; nonetheless, the temp licenses still show up on it:
 

Online GregDunn

  • Frequent Contributor
  • **
  • Posts: 711
  • Country: us
  • Country: us
Re: SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #11 on: July 12, 2018, 06:16:01 pm »
Agreed.
 

Offline tautech

  • Super Contributor
  • ***
  • Posts: 15666
  • Country: nz
  • Country: nz
  • Taupaki Technologies Ltd. NZ Siglent Distributor
    • Taupaki Technologies Ltd.
Re: SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #12 on: July 12, 2018, 07:59:28 pm »
Are you suggesting that (for example) he has a wifi adapter plugged in, and set it up in the options?  Mine won't let me configure any of those options because the hardware is not attached; nonetheless, the temp licenses still show up on it:
Correct.

The option HW modules at substantial extra cost so it's debatable that you need MSO and AWG permanent licensing whereas the WiFi HW is cheap at acquire. Just to do Bode plot no licensing at all is required.

BTW, see how your ch 3 and 4 0V position indicators are the same but the traces are not......means you need to run the Auto Cal.
Avid Rabid Hobbyist
 

Offline kerouanton

  • Regular Contributor
  • *
  • Posts: 58
  • Country: ch
  • Country: ch
Re: SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #13 on: July 14, 2018, 07:34:15 pm »
The option HW modules at substantial extra cost so it's debatable that you need MSO and AWG permanent licensing whereas the WiFi HW is cheap at acquire. Just to do Bode plot no licensing at all is required.

Agreed. I don't see the point of having to activate options that require a specific, proprietary hardware. I ordered the SLA1016 and just received the license code to activate the software option. It seems obvious this option is totally useless without the hardware, which embedds a FPGA, buffer memory chips and probably another ARM processor to manage the whole. So the activation should simply be done by plugging the corresponding hardware (which has its own serial number).

Btw, since I managed to telnet into my 1104X-E and make full backups today, before and after activating the MSO option, it may be interesting to have a look at the changes on those backup files.
 

Offline S.Garrix

  • Newbie
  • Posts: 2
Re: SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #14 on: July 17, 2018, 09:42:30 am »
what I can see after resetting is all option times back to 30 times
 

Offline ian.ameline

  • Regular Contributor
  • *
  • Posts: 55
  • Country: ca
  • Country: ca
Re: SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #15 on: July 17, 2018, 02:15:29 pm »
You could try putting a larger number than "30" into those files. Try "32767" or "65535" or if you are feeling adventurous, "2147483647"
(2^15-1, 2^16-1 and 2^31-1)

 
 

Offline timgiles

  • Regular Contributor
  • *
  • Posts: 237
  • Country: se
  • Country: se
  • Programmer, DB architect
Re: Siglent SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #16 on: July 26, 2018, 01:44:50 pm »
When I edit the options - it opens in vi as read only. What am I doing wrong?
 

Online SMB784

  • Regular Contributor
  • *
  • Posts: 170
  • Country: us
  • Country: us
Re: SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #17 on: July 26, 2018, 02:48:43 pm »
You could try putting a larger number than "30" into those files. Try "32767" or "65535" or if you are feeling adventurous, "2147483647"
(2^15-1, 2^16-1 and 2^31-1)

Does anyone know if this worked?
"Anything will lase if you hit it hard enough."

-Arthur L. Schawlow
 

Offline ian.ameline

  • Regular Contributor
  • *
  • Posts: 55
  • Country: ca
  • Country: ca
Re: Siglent SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #18 on: July 26, 2018, 02:52:28 pm »
When I edit the options - it opens in vi as read only. What am I doing wrong?

You need to remount as read/write

(Search the ads forum for "remount" for the form of the command)

 

Offline timgiles

  • Regular Contributor
  • *
  • Posts: 237
  • Country: se
  • Country: se
  • Programmer, DB architect
Re: Siglent SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #19 on: July 26, 2018, 10:12:51 pm »
Thanks, Ill come back to the thread in the morning once I have a second bite of the sav!
 

Offline TheNewLab

  • Regular Contributor
  • *
  • Posts: 232
  • Country: us
  • Country: us
Re: Siglent SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #20 on: July 27, 2018, 06:30:34 am »
I want to do the MSO hack, and attempt to design my own hardware unit. What I have heard is the SLA1016 is nothing to write home about. For $200, my thought is why not make my own hardware unit to experiment/play around with?

Only I noticed above something about a serial number inside the SLA1016 that helps activate the feature on the scope?

What type of programming do I learn to try and encode the FPGA with? and other chips for a DIY SLA1016? Has anyone scanned or reversed engineered the PCB board inside the SLA1016?
RIght now, the only difficulty I see in getting parts is the non-standard SBUS connector

I am having too much fun pushing my first actual legitimate oscilloscope.. :-X ::)
 
The following users thanked this post: Coldblackice

Offline timgiles

  • Regular Contributor
  • *
  • Posts: 237
  • Country: se
  • Country: se
  • Programmer, DB architect
Re: Siglent SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #21 on: July 27, 2018, 03:47:23 pm »
Hi all,

Any value inserted in to the three text files (/usr/bin/siglent/usr/usr/options....) over 30, is shown as 30 in the menu 'Options' on the scope on restart.

What would be interesting is what would happen to the actual value in the text file if I have the MSO or AWG hardware. I assume it would tick from my set value (500 say) to 29 once the HW is plugged in the first time. But prehaps it is only the view function in the code that knows the maximum value for a temporary licence is 30...

Has someone tried the temporary licences and resetting to 30? Prehaps Ill buy the MSO or AWG and find out. The SAG isnt too expensive...


Nice idea to reverse engineer the SLA1016 protocol NewLab.



 

Online BillB

  • Frequent Contributor
  • **
  • Posts: 542
  • Country: us
  • Country: us
Re: Siglent SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #22 on: July 27, 2018, 04:13:39 pm »
...
Only I noticed above something about a serial number inside the SLA1016 that helps activate the feature on the scope?
...

I believe the activation license for the MSO option on the scope is completely independent of the SLA1016.  That is, I do not believe the MSO option is locked to any particular SLA1016.  I've got one SDS1104X-E and and one SLA1016, so I can't confirm 100%, but the scope MSO option was activated prior to installing the SLA1016.

« Last Edit: July 27, 2018, 04:31:02 pm by BillB »
 

Offline tmbinc

  • Regular Contributor
  • *
  • Posts: 174
Re: Siglent SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #23 on: July 27, 2018, 04:19:31 pm »
It would be great if someone could make pictures of the SLA1016. Based on my information (but I could be wrong; I haven't ever seen this device) the SLA1016 is a Zynq-based essentially "stand-alone LA", connected via "SBUS" via relatively-slow (non-realtime; USB even?) communication. Especially the sample memory seems to be on the SLA1016 itself.

Would be great if someone could confirm/refute this.
 

Offline ironcurtain

  • Regular Contributor
  • *
  • Posts: 55
  • Country: es
  • Country: es
Re: Siglent SDS1104X-E Hack to 200Mhz, and full options ?
« Reply #24 on: July 28, 2018, 06:20:16 pm »
Hey, just joined this. My time at the moment for personal reasons is very limited, but I can offer help and advice on reverse engineering firmware and Linux ELF DSOs and executables.

I own a SDS1204X-E though, and I can't or couldn't find the firmware images for my kit. I would like to unlock the WIFI options and others, especially if we can interface it with third-party solutions that are more affordable, or better quality.

I'm somewhat of a novice with EE, but I will trade OS design/reversing knowhow for some mentoring every now and then.

As for the firmware images: I see that they obfuscate them with XOR, correct? And another part is "encrypted" with a modified version of 3DES, presumably with the key known to us (they need to ship it so...). Are there any tools for reassembling images readily available?
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf