Products > Test Equipment
Siglent .ads firmware file format
<< < (41/85) > >>
tv84:
Siglent licenses usually can be seen inside a memdump of the equipment. No news there.

How to get the memdump?
In the ARM machines (linux), a simple "cp /dev/mem" to USB, usually does the trick.
In the Blackfin machines, it's also possible but may require JTAG or a patched .ADS, AFAIK.

How to find the (possible) licenses?
You need to have a general knowledge of the license format. One of the 2-types possible:

16-char lowercase (including numbers) or
16-char uppercase (including numbers)

( the upper/lowercase is equipment-dependent )

At the request of several people, to ease the search for those type of strings, I release here a small C# code snippet that processes the memdump file:


--- Code: ---        private static void search_licenses()
        {
            byte[] buffer = System.IO.File.ReadAllBytes(@"memdump.bin");

            for (int j = 0, l = 0; j < 2; j++, l += 0x20)
            for (int i = 0, strStart = 0, strSize = 0; i < buffer.Length; i++)
                if (((buffer[i] < '2') || (buffer[i] > '9')) && ((buffer[i] < 'A' + l) || (buffer[i] > 'Z' + l)) && buffer[i] != ('L' + l) && buffer[i] != ('O' + l))
                {
                    if (strSize == 16)
                        Console.WriteLine("{0:X8} - {1}", strStart, Encoding.UTF8.GetString(buffer, strStart, strSize));
                    strSize = 0;
                    strStart = i + 1;
                }
                else strSize++;
        }
--- End code ---

Of course, then you must use some common sense to filter/extract the ones that may seem valid.

If none of the strings works, bad luck (the most probable thing happening is that the text is concatenated with some other string/license! I leave that as homework. First, inspect both halfs of 32-char size strings... ;) ). Remember this is not a bulletproof process!

How to insert the licenses?
Equipments have the Options license insert menu. So, that's easy.
Most of them usually don't have the BW license insert menu.

In that case, you can use the SCPI command "MCBD" (MACHINE_BAND). Ex:

MCBD N2T7PQ29BPZJ7WB5

BEWARE that you may insert a BW license that corresponds to a lower BW than you currently have. If you know your other "bigger" license, no problem. But, if not, it's not safe to try unlock higher BW if you are not already in the lowest possible.

In some equipments the BW license is the contents of the bandwidth.txt file so you can also read/write it there manually.
tv84:

--- Quote from: janekivi on April 08, 2017, 10:40:18 am ---I can make the same trick here like when I was uploading LeCroy in to SDG1025
but who can try this and there may be the same check routine and instrument
will say "Not supported firmware, please reflash correct. Otherwise I will wait 15 min".
This is stupid, it will wait that time anyway before you can access flash menu...

So... do not be the first who is using this firmware file on SPD3303X-E
but this first hack may be needed to be tried out by someone.

SPD3303X-V100R001B01D02P03_with _E_header.zip
OK, I give this only individually after request. I can't test it.

--- End quote ---

A year ago nobody volunteered to confirm Janekivi's work so I resuscitated the challenge and was successfull!   :popcorn:

Attached is the proof of a Siglent SPD3303X-E conversion to a SPD3303X model.

The method is simple:

1. Run the SCPI command in the X-E to enable the 1mV step:

FACTORY ON

2. Using EasyPower flash the required FW file from the attached ZIP. (ConvertFromX-E)

(3. If you want to rollback, flash the other file.)

The FWs are Siglent official versions with Prod_ID's swapped like janekivi suggested.

The HW version of the board where the test was done is 0.3.

ATTENTION: This may involve a certain risk so do it at your own responsability!

Enjoy!
rf-loop:
Waiting Santa Claus...
SaKhan:
I am curious whether the precision of a hacked SPD3303X-E is similar to SPD3303X.
BillB:

--- Quote from: SaKhan on September 19, 2018, 04:18:28 pm ---I am curious whether the precision of a hacked SPD3303X-E is similar to SPD3303X.

--- End quote ---

I think it is.  Even before the hack, my X-E would accept remote 1mA changes and show them through EasyPower.  It would also accept remote 1mV changes from EasyPower even though it would truncate the response.  However, the 1mA and 1mV changes were happening at the output terminals of the X-E even though the display was not being updated.  From what I could tell, the X-E is really an X minus the display digit.  So, if you were using the X-E purely through SCPI, you'd almost already have an X (except for the truncated mV command response)
Navigation
Message Index
Next page
Previous page
There was an error while thanking
Thanking...

Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod