Siglent SDS1104X-E Hack to 200Mhz， and full options ?

[TheNewLab]

S.Garrix has the procedure for hacking the options, there are some questions though. No one has confirmed if it works for their units. It should be the same for all three of the 1000X-E models

[SaKhan]

I did the following trying to make the wifi option permanent:

After confirming that the value in /usr/bin/siglent/firmdata0/options_wifi_times.txt gets decremented after each boot, I remounted /usb/bin/siglent read-write and changed /usr/bin/siglent/usr/usr/options_wifi_times.txt with the plugged wifi dongle back to 30. After rebooting, both files had the same value - 30 and any further reboots didn't decrement it anymore. I tried several things afterwards to revert the hack but I couldn't, so if you intend to try it keep that in mind. I hope also that these were the correct steps as I tried that 2 weeks ago. Don't forget also to execute sync and remount read-only afterwards.

[kahuna0k]

hi, I'm trying to flash the _eevblog OS to gain root access, but when I plug the USB and power on nothing happens. The scope just starts as usual and the known password doesn't work. I've tried formatting and copying the files from Linux and Windows, from two different computers and in two different USB keys, all with the same result. My scope already come with 7.1.6.1.25 R2 software version (FPGA Version 2018-03-06 and HW Version 01-03). Could this be the reason? I tried to update the OS using the official firmware and nothing happen either (probably because it is already running that version). Any hint?

[tv84]

hi, I'm trying to flash the _eevblog OS to gain root access, but when I plug the USB and power on nothing happens. The scope just starts as usual and the known password doesn't work. I've tried formatting and copying the files from Linux and Windows, from two different computers and in two different USB keys, all with the same result. My scope already come with 7.1.6.1.25 R2 software version (FPGA Version 2018-03-06 and HW Version 01-03). Could this be the reason? I tried to update the OS using the official firmware and nothing happen either (probably because it is already running that version). Any hint?

The equip isn't recognizing the USB. Verify that you can save files to the USB key to check if it's available. You should be able to upgrade indefinitely.

[kahuna0k]

I'm able to capture files with the print button to the usb drive. They appear under \PNG and look ok. I've also tried with a Raspberry Pi (as suggested somewhere else) with the same result. Updating the firmware works without problems (through the menus). The problem is that the scope ignore the update to the OS. When booting it access the usb drive (the light lights up 3 times for around 2 seconds each and 1 last time for around 1 second.  The files in the root of the USB are:
devicetree.dtb
rootfs.cramfs
sds1004x_e_udiskEnv.txt
uImage

in the pdf it seems that the .txt does not have the extension, but I suppose it is because Windows hides it by default. Anyway I tried without the .txt and didn't work either. Also in the PDF, the uImage seems to have a space after ("uImage "), but probably is a mistake, I think it is possible to have a space at the end of a filename in FAT32 but it is not trivial to achieve. Running out of things to try. Right now I'm trying to explot the fact that the SHELLCMD SCPI command is executed as root to change the password, but it is not that easy, "passwd -d root" seems to do nothing, probably because /etc is mounted as read only. Could anybody with root access execute mount (if possible with a USB inserted) and pasted it here?

[kahuna0k]

well, after trying with the 3rd USB drive it worked ... Murphy is around me

[tv84]

but it is not that easy, "passwd -d root" seems to do nothing, probably because /etc is mounted as read only. Could anybody with root access execute mount (if possible with a USB inserted) and pasted it here?

If that was possible, life would be easier for everyone. You can't do that because CRAMFS is RO. That's why the FS needs to be patched beforehand.

[rf-loop]

well, after trying with the 3rd USB drive it worked ... Murphy is around me

One question, and if someone other wonder, do not think anything,  this is only because i am curious and investigative nature. 

These USB drive sizes, and speed version, these what fails and this what work.

[kahuna0k]

well, after trying with the 3rd USB drive it worked ... Murphy is around me

One question, and if someone other wonder, do not think anything,  this is only because i am curious and investigative nature. 

These USB drive sizes, and speed version, these what fails and this what work.

kingston 16GB USB2 -> fail
samsung 16GB USB3 -> fail
sharkoon accelerate 32GB USB3 -> success

[tubularnut]

Kingston DataTraveler G4 32GB usb3 = success
Lexar 8GB usb2 = success

[rf-loop]

well, after trying with the 3rd USB drive it worked ... Murphy is around me

One question, and if someone other wonder, do not think anything,  this is only because i am curious and investigative nature. 

These USB drive sizes, and speed version, these what fails and this what work.

kingston 16GB USB2 -> fail
samsung 16GB USB3 -> fail
sharkoon accelerate 32GB USB3 -> success

Good, it also gives a signal that the Siglent's the instructions are based on something.




Instructions for OS update tell it clearly:  8G or 32G.
In my logic it do not include 16G at all.
(But still I do not know why  16G is prohibited. I am curious to know why.
But if manufacturer set this kind of rule and if I understand or not  what is reason I still follow it. )

[bugi]

I guess the instructions should use the word "MUST" instead of "should" in that case. Just to reduce the amount of ? ? ?!?!?%%#***@!! from users.

[tv84]

Siglent designers seated at the coffee table: "let's do this work only in 8GB and 32GB sizes!" 

BTW i suggest that you should all report a few other details of the USB disks (namely the controller):
https://www.eevblog.com/forum/testgear/siglent-sdm3045x-boot-hang/msg1565089/#msg1565089

[timgiles]

Worked fine when I used a 4Gb USB drive.

[Coldblackice]

Anyone had any further progress (or luck!) on this? I'm considering getting this scope and would love to help out, if it's still thought that achieving this would be feasible.

[tautech]

Anyone had any further progress (or luck!) on this? I'm considering getting this scope and would love to help out, if it's still thought that achieving this would be feasible.

You can find some info here:
https://www.eevblog.com/forum/testgear/sds1104x-e-hack-to-200mhz-and-full-options/

[Coldblackice]

Anyone had any further progress (or luck!) on this? I'm considering getting this scope and would love to help out, if it's still thought that achieving this would be feasible.

You can find some info here:
https://www.eevblog.com/forum/testgear/sds1104x-e-hack-to-200mhz-and-full-options/

Thanks, but was that link meant to point somewhere else? It points to this same thread. I read through the thread + how to do it, but was wondering how this has been faring for those who have tried it:

• Does it actually work vs. just appearing to support/run at 200mhz?
• Has anyone noticed any issues?
• Have firmware updates affected it?
• etc.

[tautech]

Thanks, though was that link meant to point to somewhere else? It points to this same thread. Unless I'm misunderstanding the current status of this: my understanding is that the hack wasn't fully working/fleshed out (based on the followup discussion in the thread). If not,

Sorry.

Read here too:
https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/

[ripnoel]

Greetings,

I am ready to move forward with my purchase of a Siglent SDS1104X-E and I am wondering if anyone who has recently purchased one of these units can confirm that this hack is still working? Replies and additional info greatly appreciated!

Cheers,

ripnoel

[Gege34]

Ordered last month. I used the memory dump and a hex editor to find all the keys.

[dkggpeters]

Greetings,

I am ready to move forward with my purchase of a Siglent SDS1104X-E and I am wondering if anyone who has recently purchased one of these units can confirm that this hack is still working? Replies and additional info greatly appreciated!

Cheers,

ripnoel

I just hacked mine over the weekend with no issues.  I purchased my unit back in August of 2018.  Also hacked sdg2042x and spd3303x-e.  No issues do all three.

[NicoEFI]

Hello, I received my new Siglent SDS1104x-e. 
I want upgrade it but i have a problem with my english for understand the process  .
Can you help me please (Gege34 peux être ?).

1. patch the OS update
this file ? SDS1xx4X-E Operating System -V1 (Only For 4-Channel models) (Release Date 06.26.18 )
1. set password = where can i find it ?
2. Connect SDS1104X-E by telnet : by usb or RJ45 ? telnet can work with windows10 ?
3-4. Input command " " : i use it in Telnet that right ?

[Gege34]

All necessary informations are here and found by others (thank to them ).
To summarize, I put what I use below (English and French). I use the technics of memory dump which works very well and avoids flashing an alternative firmware.

English:
All of this only works with firmware <= 6.1.26, from firmware 6.1.33 the SHELLCMD is deactivated. But you can downgrade the scope to 6.1.26 to find the keys and after upgrade it to the last version.

• Have a USB stick that is recognized by the oscilloscope (make a screenshot on it to try)
• Connect to the oscilloscope with the web interface
• In the SCPI tab, send the command SCOPEID? and note the result, it is like wwww-xxxx-yyyy-zzzz
• Send the command *IND? to get the serial number like SDSxxxxxxxxxxxx
• Send the command SHELLCMD cat /dev/mem > /usr/bin/siglent/usr/mass_storage/U-disk0/memdump.bin
• Wait a while for this command to finish (we will say 1mn, there is 240MB to write on the USB stick)
• Put the USB stick on a computer, there must be a file memdump.bin
• Open this file in a Hex editor (I use HxD on windows)
• Find your SCOPEID without the - (so wwwwxxxxyyyyzzzz)
• We must have just before a 100M (or 200M according to its oscilloscope), it's the active bandwidth and still a little (37 characters) above SDS1000X-E
• A little lower (116 characters) there must be letters, in fact 2 groups of 16 characters and one of 32 characters (that we cut in half), which makes us 4 groups of 16 characters corresponding to the key to activate the bandwidth option (respectively 100MHz, 200MHz, 50MHz, 70MHz)
• To activate the corresponding license it is necessary to send the command SCPI MCBD key and to turn off/on again the scope
• Start again from the beginning of the file and look for its serial number (SDSxxxxxxxxxxxx), search until find the one where it is written MSO 5 characters before
• A little lower (69 or 117 characters) a group of readable characters, there are 3 groups of 16 characters which correspond to the activation key of options, if this key appears 2 times is that it's already active. The options are respectively (AWG, WIFI, MSO) and can be activated with the command SCPI LCISL option,key

An interesting SCPI command to explore the scope (warning to not brick it), SHELLCMD telnetd -l/bin/sh -p9999 open a telnet (root shell) without password.

Français:
Tout ceci ne fonctionne qu'avec un firmware <= 6.1.26, à partir du firmware 6.1.33 la commande SHELLCMD a été désactivé. Mais vous pouvez rétrograder votre oscilloscope avec le firmware 6.1.26 pour trouver les clefs, puis remettre le dernier firmware.

• Avoir une clef USB qui est reconnu par l'oscilloscope (faire une copie d'écran dessus pour essayer)
• Se connecter à l'oscilloscope avec l'interface web
• Dans l'onglet SCPI, envoyer la commande SCOPEID? et noter le résultat, il est sous la forme wwww-xxxx-yyyy-zzzz
• Envoyer la command *IND? on récupère le numéro de série sous la forme SDSxxxxxxxxxxxx
• Envoyer la commande SHELLCMD cat /dev/mem > /usr/bin/siglent/usr/mass_storage/U-disk0/memdump.bin
• Attendre un certain temps que cette commande se termine (on va dire 1mn, il y a 240Mo à écrire sur la clef USB)
• Mettre la clef USB sur un ordi, il doit y avoir un fichier memdump.bin
• Ouvrir ce fichier dans un éditeur Hexa (J'utilise HxD sous windows)
• Chercher son SCOPEID sans les - (donc wwwwxxxxyyyyzzzz)
• On doit avoir juste avant un 100M (ou 200M en fonction de son oscilloscope), c'est la bande passante active et encore un peu (37 caractères) au dessus SDS1000X-E
• Un peu plus bas (116 caractères) il doit y avoir des lettres, en fait 2 groupes de 16 caractères et un de 32 caractères (que l'on coupe en deux), ce qui nous fait 4 groupes de 16 caractères correspondant à la clef pour activer l'option de bande passante (respectivement 100MHz, 200MHz, 50MHz, 70MHz)
• Pour activer la licence correspondant il faut envoyer la commande SCPI MCBD clef et éteindre/rallumer le scope
• Repartir du début du fichier et chercher son numéro de série (SDSxxxxxxxxxxxx), chercher jusqu'à trouver celui ou il est écrit MSO 5 caractères avant
• On a un peu plus bas (69 ou 117 caractères) un groupe de caractères lisibles, il y a 3 groupes de 16 caractères qui correspondent à la clef d'activation des options, si cette clef apparaît 2 fois c'est qu'elle est déjà active. Les options sont respectivement (AWG, WIFI, MSO) et peuvent être activé avec la commande SCPI LCISL option,clef

Une commande SCPI intéressante pour explorer l'oscilloscope (attention de ne pas tout casser), SHELLCMD telnetd -l/bin/sh -p9999 ouvre un accès telnet (root shell) sans mot de passe.

[vtwin@cox.net]

English:

It should be noted, and bears repeating, that this process only works if your option keys do not span a 4K memory page boundary. If they do, you could find a portion of a key is located 10's of megabytes away in the memory dump from the rest of the key.

cat /dev/mem simply dumps the scopes physical memory, and memory malloc'd by the linux kernel to the scope task may or may not be contiguous within physical memory.

[mroek]

English:

It should be noted, and bears repeating, that this process only works if your option keys do not span a 4K memory page boundary. If they do, you could find a portion of a key is located 10's of megabytes away in the memory dump from the rest of the key.

cat /dev/mem simply dumps the scopes physical memory, and memory malloc'd by the linux kernel to the scope task may or may not be contiguous within physical memory.

True, but it seems many have been lucky in finding keys using this method (myself included). And also, it might be possible to just reboot and retry if not successful the first time, since the memory allocations might not be exactly the same for every boot and application launch.