Siglent SDS1104X-E Hack to 200Mhz， and full options ?

[S.Garrix]

I have two Siglent 1104x-e in my lab, and noticed the thread：https://www.eevblog.com/forum/testgear/siglent-sds1204x-e-released-for-domestic-markets-in-china/825/
and in Reply #785 @ian.ameline “upgraded” the SDS1104X-E to 200Mhz, Rf loop confirmed
thanks to Ian and rfloop,  I patch the OS update so that the root password is known, and had one of my SDS1104X-E upgraded to 200Mhz ,
1. patch the OS update , set password
2. Connect SDS1104X-E by telnet.
3. Input command "mount -o remount,rw,sync /usr/bin/siglent/firmdata0".
4. Input command "rm /usr/bin/siglent/firmdata0/bandwidth.txt".
5. Restart the scope.         

!!Update for commands
 by the exact same way I also got MSO,AWG, WIFI full options
Step 4,  command "rm /usr/bin/siglent/firmdata0/options_mso_times.txt".
"rm /usr/bin/siglent/usr/usr/options_mso_times.txt"
         "rm /usr/bin/siglent/firmdata0/options_awg_times.txt"
"rm/usr/bin/siglent/usr/usr/options_awg_times.txt"
"rm /usr/bin/siglent/firmdata0/options_wifi_times.txt"
"rm /usr/bin/siglent/usr/usr/options_wifi_times.txt"

Not sure if Siglent will close the door or not

[innkeeper]

unless someone sees fault with this, id use an mv (move) command to move it to a new name or place instead of rm (remove) in case you ever needed to put it back.

[GregDunn]

Yes, definitely do not remove the files - suppose Siglent requires them to be present for an OS or firmware upgrade at some future time?  You'd have to restore them from your backup (you did make a backup, right?).   

[tubularnut]

The files only contain the text "30" , if you still have the 30 remaining times.

However, it didn't work for me, either by renaming the files (mv) or deleting them.

As a note there are also 3 copies in the folder "/usr/bin/siglent/usr/usr" which get recreated if you rename or delete them.

[GregDunn]

Those files don't even exist on my scope in the firmdata0 directory...  and I can confirm that renaming the files in /usr/bin/siglent/usr/usr doesn't work.

[BillB]

Those files don't even exist on my scope in the firmdata0 directory...  and I can confirm that renaming the files in /usr/bin/siglent/usr/usr doesn't work.

Hmmm...

Code: [Select]

/usr/bin/siglent/firmdata0 # ls -l
total 140
-rw-r--r--    1 root     root           241 Jan  1 00:33 NSP_system_info.xml
-rw-r--r--    1 root     root            63 Jan  1 00:00 NSP_trends_config_info.xml
--wxr-Sr--    1 root     root          7012 Jan  1 00:31 acq_quick_cal_factory.bin
-rwxrwxrwx    1 1000     1000          7688 Aug 21  2017 acq_self_cal_user.bin
-rwxrwxrwx    1 1000     1000          7448 Jan  1 00:15 acq_self_factory_cal.bin
-rwxrwxrwx    1 1000     1000            16 Jan  1 00:00 bandwidth.bak
-rwxrwxrwx    1 root     root         52916 Jan  1 00:00 factory_setting.xml
---sr----x    1 root     root            20 Jan  1 00:23 options_awg_cfg.bin
---sr----x    1 root     root            20 Jan  1 00:23 options_awg_license.txt
-------r-x    1 root     root            10 Jan  1 00:00 options_awg_times.txt
-rwx--sr-T    1 root     root            20 Jan  1 00:21 options_mso_cfg.bin
-rwx--sr-T    1 root     root            20 Jan  1 00:21 options_mso_license.txt
------x---    1 root     root            10 Jan  1 00:00 options_mso_times.txt
--ws--x---    1 root     root            20 Jan  1 00:25 options_wifi_cfg.bin
--ws--x--x    1 root     root            20 Jan  1 00:25 options_wifi_license.txt
-------r-x    1 root     root            10 Jan  1 00:00 options_wifi_times.txt
-rwxrwxrwx    1 1000     1000            16 Jan  1 00:00 pro_filter_cfg.bin
-rw-r--r--    1 root     root          3320 Jan  1 00:00 sys_cfg.cfg
-rwxrwxrwx    1 1000     1000            67 Aug 21  2017 version.txt
-rw-r--r--    1 root     root             5 Jan  1 00:00 whoami.txt
/usr/bin/siglent/firmdata0 #

This is with the both the latest firmware and OS updates: 7.1.6.1.25R2
 

[GregDunn]

Code: [Select]

/usr/bin/siglent/firmdata0 # ls -l
total 100
-rw-r--r--    1 root     root           241 Jan  1 00:02 NSP_system_info.xml
-rw-r--r--    1 root     root            63 Jan  1 00:00 NSP_trends_config_info.xml
--wxr-Sr--    1 root     root          7012 Jan  1 00:31 acq_quick_cal_factory.bin
-rwxrwxrwx    1 1000     1000          7688 Sep 18  2017 acq_self_cal_user.bin
-rwxrwxrwx    1 1000     1000          7448 Jan  1 00:05 acq_self_factory_cal.bin
-rwxrwxrwx    1 1000     1000            16 Jan  1 00:01 bandwidth.bak
-rwxrwxrwx    1 root     root         52916 Jan  1 00:00 factory_setting.xml
-rwxrwxrwx    1 1000     1000            16 Jan  1 00:01 pro_filter_cfg.bin
-rw-r--r--    1 root     root          3320 Jan  1 00:00 sys_cfg.cfg
-rwxrwxrwx    1 1000     1000            67 Sep 18  2017 version.txt

Very interesting...  7.1.6.1.25 R2 here too.

[SMB784]

Code: [Select]

/usr/bin/siglent/firmdata0 # ls -l
total 100
-rw-r--r--    1 root     root           241 Jan  1 00:02 NSP_system_info.xml
-rw-r--r--    1 root     root            63 Jan  1 00:00 NSP_trends_config_info.xml
--wxr-Sr--    1 root     root          7012 Jan  1 00:31 acq_quick_cal_factory.bin
-rwxrwxrwx    1 1000     1000          7688 Sep 18  2017 acq_self_cal_user.bin
-rwxrwxrwx    1 1000     1000          7448 Jan  1 00:05 acq_self_factory_cal.bin
-rwxrwxrwx    1 1000     1000            16 Jan  1 00:01 bandwidth.bak
-rwxrwxrwx    1 root     root         52916 Jan  1 00:00 factory_setting.xml
-rwxrwxrwx    1 1000     1000            16 Jan  1 00:01 pro_filter_cfg.bin
-rw-r--r--    1 root     root          3320 Jan  1 00:00 sys_cfg.cfg
-rwxrwxrwx    1 1000     1000            67 Sep 18  2017 version.txt

Very interesting...  7.1.6.1.25 R2 here too.

Have you also installed the latest software update?

[GregDunn]

I installed the latest versions from Siglent's website as soon as I verified the scope was running properly:

SDS1004X-E Firmware (4-Channel Model) - 6.1.25R2 (Release Date 06.05.18 )
SDS1004X-E Operating System -V1 (Only For 4-Channel ) (Release Date 06.26.18 )

That's 7.1 (OS).6.1.25R2 (firmware), as I indicated, right?

[innkeeper]

7.1.6.1.25 R2 here too - similar - no mso,wifi,awg configs
and i did install and run the latest software - EasyScopeX – 100R001B02D01P20 (Release Date 06.07.18 ) (if that's what your referring to)
is there a newer os image we should be using?

Code: [Select]

/usr/bin/siglent/firmdata0 # ls -l
total 112
-rw-r--r--    1 root     root           241 Jan  1 00:00 NSP_system_info.xml
-rw-r--r--    1 root     root            63 Jan  1 00:00 NSP_trends_config_info.xml
--wxr-Sr--    1 root     root          7012 Jan  1 00:32 acq_quick_cal_factory.bin
-rwxrwxrwx    1 1000     1000          7688 Sep 18  2017 acq_self_cal_user.bin
-rwxrwxrwx    1 1000     1000          7448 Jan  1 00:12 acq_self_factory_cal.bin
-rwxrwxrwx    1 1000     1000            16 Jan  1 00:01 bandwidth.bak
-rwxrwxrwx    1 root     root         52916 Jan  1 00:00 factory_setting.xml
-------r-x    1 root     root            10 Jan  1 00:00 options_awg_times.txt
------x---    1 root     root            10 Jan  1 00:00 options_mso_times.txt
------x---    1 root     root            10 Jan  1 00:00 options_wifi_times.txt
-rwxrwxrwx    1 1000     1000            16 Jan  1 00:01 pro_filter_cfg.bin
-rw-r--r--    1 root     root          3320 Jan  1 00:00 sys_cfg.cfg
-rwxrwxrwx    1 1000     1000            67 Sep 18  2017 version.txt
/usr/bin/siglent/firmdata0 #


[GregDunn]

Are you suggesting that (for example) he has a wifi adapter plugged in, and set it up in the options?  Mine won't let me configure any of those options because the hardware is not attached; nonetheless, the temp licenses still show up on it:

[GregDunn]

Agreed.

[tautech]

Are you suggesting that (for example) he has a wifi adapter plugged in, and set it up in the options?  Mine won't let me configure any of those options because the hardware is not attached; nonetheless, the temp licenses still show up on it:

Correct.

The option HW modules at substantial extra cost so it's debatable that you need MSO and AWG permanent licensing whereas the WiFi HW is cheap at acquire. Just to do Bode plot no licensing at all is required.

BTW, see how your ch 3 and 4 0V position indicators are the same but the traces are not......means you need to run the Auto Cal.

[kerouanton]

The option HW modules at substantial extra cost so it's debatable that you need MSO and AWG permanent licensing whereas the WiFi HW is cheap at acquire. Just to do Bode plot no licensing at all is required.

Agreed. I don't see the point of having to activate options that require a specific, proprietary hardware. I ordered the SLA1016 and just received the license code to activate the software option. It seems obvious this option is totally useless without the hardware, which embedds a FPGA, buffer memory chips and probably another ARM processor to manage the whole. So the activation should simply be done by plugging the corresponding hardware (which has its own serial number).

Btw, since I managed to telnet into my 1104X-E and make full backups today, before and after activating the MSO option, it may be interesting to have a look at the changes on those backup files.

[S.Garrix]

what I can see after resetting is all option times back to 30 times

[ian.ameline]

You could try putting a larger number than "30" into those files. Try "32767" or "65535" or if you are feeling adventurous, "2147483647"
(2^15-1, 2^16-1 and 2^31-1)

 

[timgiles]

When I edit the options - it opens in vi as read only. What am I doing wrong?

[SMB784]

You could try putting a larger number than "30" into those files. Try "32767" or "65535" or if you are feeling adventurous, "2147483647"
(2^15-1, 2^16-1 and 2^31-1)

Does anyone know if this worked?

[ian.ameline]

When I edit the options - it opens in vi as read only. What am I doing wrong?

You need to remount as read/write

(Search the ads forum for "remount" for the form of the command)

[timgiles]

Thanks, Ill come back to the thread in the morning once I have a second bite of the sav!

[TheNewLab]

I want to do the MSO hack, and attempt to design my own hardware unit. What I have heard is the SLA1016 is nothing to write home about. For $200, my thought is why not make my own hardware unit to experiment/play around with?

Only I noticed above something about a serial number inside the SLA1016 that helps activate the feature on the scope?

What type of programming do I learn to try and encode the FPGA with? and other chips for a DIY SLA1016? Has anyone scanned or reversed engineered the PCB board inside the SLA1016?
RIght now, the only difficulty I see in getting parts is the non-standard SBUS connector

I am having too much fun pushing my first actual legitimate oscilloscope..

[timgiles]

Hi all,

Any value inserted in to the three text files (/usr/bin/siglent/usr/usr/options....) over 30, is shown as 30 in the menu 'Options' on the scope on restart.

What would be interesting is what would happen to the actual value in the text file if I have the MSO or AWG hardware. I assume it would tick from my set value (500 say) to 29 once the HW is plugged in the first time. But prehaps it is only the view function in the code that knows the maximum value for a temporary licence is 30...

Has someone tried the temporary licences and resetting to 30? Prehaps Ill buy the MSO or AWG and find out. The SAG isnt too expensive...


Nice idea to reverse engineer the SLA1016 protocol NewLab.

[BillB]

...
Only I noticed above something about a serial number inside the SLA1016 that helps activate the feature on the scope?
...

I believe the activation license for the MSO option on the scope is completely independent of the SLA1016.  That is, I do not believe the MSO option is locked to any particular SLA1016.  I've got one SDS1104X-E and and one SLA1016, so I can't confirm 100%, but the scope MSO option was activated prior to installing the SLA1016.

[tmbinc]

It would be great if someone could make pictures of the SLA1016. Based on my information (but I could be wrong; I haven't ever seen this device) the SLA1016 is a Zynq-based essentially "stand-alone LA", connected via "SBUS" via relatively-slow (non-realtime; USB even?) communication. Especially the sample memory seems to be on the SLA1016 itself.

Would be great if someone could confirm/refute this.

[ironcurtain]

Hey, just joined this. My time at the moment for personal reasons is very limited, but I can offer help and advice on reverse engineering firmware and Linux ELF DSOs and executables.

I own a SDS1204X-E though, and I can't or couldn't find the firmware images for my kit. I would like to unlock the WIFI options and others, especially if we can interface it with third-party solutions that are more affordable, or better quality.

I'm somewhat of a novice with EE, but I will trade OS design/reversing knowhow for some mentoring every now and then.

As for the firmware images: I see that they obfuscate them with XOR, correct? And another part is "encrypted" with a modified version of 3DES, presumably with the key known to us (they need to ship it so...). Are there any tools for reassembling images readily available?