Author Topic: Siglent .ads firmware file format  (Read 79666 times)

0 Members and 2 Guests are viewing this topic.

Offline tv84

  • Super Contributor
  • ***
  • Posts: 1327
  • Country: pt
Re: Siglent .ads firmware file format
« Reply #325 on: June 10, 2019, 04:34:28 pm »
Out of curiosity, I've lately seen that xor with 0xFF in few places, and I have been thinking why not using the operator that does the same without the 2nd parameter (or the only parameter written explicitly when using compound assignment variants), i.e. bitwise complement (~).  That is "buf1[i1] = ~buf1[i1];"  (To me the complement is also "clearer" to read as it doesn't have the "unnecessary" 2nd parameter, but this may very well be a matter of opinion.)

Only a question of habit. The compiler should do it's magic...
 

Offline tv84

  • Super Contributor
  • ***
  • Posts: 1327
  • Country: pt
Re: Siglent .ads firmware file format
« Reply #326 on: July 04, 2019, 07:39:57 pm »
The SDL1000X-E FW has been released.

It has a FW format different from all previous Siglent equipment's FW.

Nonetheless the first 0x70 bytes are the file header with the usual Siglent 3DES encryption:

Code: [Select]
File Header Size: 00000070
00000000 - File Header Checksum: FFFFF9C9 [00000004-0000006F]   CKSM OK
00000004 - File Size: 000DA5F4
0000000C - Product_ID: 700
00000026 - Vendor/Brand: SIGLENT
0000003A - USB Host Controller: ISP1763

The rest of the file may be sporadically encrypted or obfuscated but haven't discovered more details...

Janekivi, what's your opinion?

Proc seems to be STM32F427VGT6.
 
The following users thanked this post: BillB

Offline janekivi

  • Frequent Contributor
  • **
  • Posts: 364
  • Country: ee
Re: Siglent .ads firmware file format
« Reply #327 on: July 05, 2019, 01:45:04 pm »
No reverse, no FF.
screen.bmp at 0x000D70DC where are couple icons for the screen
like network, battery and yellow exclamation triangle.
 

Offline tv84

  • Super Contributor
  • ***
  • Posts: 1327
  • Country: pt
Re: Siglent .ads firmware file format
« Reply #328 on: July 13, 2019, 05:01:29 pm »
Just for the record:

The SDL1000X(-E) .ADS has a 0x70 bytes encrypted header (usual Siglent 3DES).

After that, it has 3 concatenated blocks which start with executable STM32 ARM programs. These are unencrypted and unobfuscated.

The final parsing of the 1st public release is attached.

Until now, no other Siglent FW had this format.

Edit1: I tried to add the loading addresses for IDA. I'm not 100% sure they are correct but they do a pretty good job in disassembling.
If anyone knows a better way to automatically determine the correct Loading addresses of the STM32 blocks, etc please contact me.
« Last Edit: July 14, 2019, 12:26:09 pm by tv84 »
 

Offline wgoeo

  • Contributor
  • Posts: 10
  • Country: 00
Re: Siglent .ads firmware file format
« Reply #329 on: July 24, 2019, 10:26:00 pm »
For the SDS1000X-E, I summarized the replies so far in the Python 3 code below. You only need to recover the key in sds1000b.app. Without the correct key the .app will be corrupted but you can force extract and analyze it.

Code: [Select]
import sys
import codecs
import struct
# Reply #25
import pyDesSiglent

# Reply #186
key = codecs.decode('00000000000000000000000000000000', 'hex')
des = pyDesSiglent.triple_des(key)

# Reply #74
def checksum(b):
return -sum(b) & 0xffffffff

# Specify the .ads file as a command line argument
b = open(sys.argv[1], 'rb').read(-1)
# Reply #235
b = des.decrypt(b[:0x70]) + b[0x70:]
# Compare with parsing (Reply #99)
csum, size = struct.unpack('<LL', b[:8])
print('file size w/o header', hex(size), 'checksum', hex(csum), '=?', hex(checksum(b[4:])))
# skip header
b = b[0x70:]
# Reply #21, #186
b = des.decrypt(b[:0x2800]) \
+ b[0x2800:0x2E777] \
+ des.decrypt(b[0x2E777:0x2E777+0x1400]) \
+ b[0x2E777+0x1400:]
# Reply #24 (modified)
b = bytearray(b[::-1])
a = 1
i = len(b)
j = 1
while j < i:
b[j] ^= 0xff
a += 1
j += a
i = len(b)
j = len(b) - len(b)//2
while j < i:
b[j] ^= 0xff
j += 1

# Compare with parsing (Reply #99)
i = 0
while (i < len(b)):
csum, size = struct.unpack('<LL', b[i:i+8])
section = b[i+8]
payload = b[0x34:0x34+size]
print('section', section, 'size', hex(size), 'checksum', hex(csum), '=?', hex(checksum(payload)))
open('section%d.zip' % b[i+8], 'wb').write(payload)
i += 0x34 + size

Edit: to those who want a faster DES implementation I attached some code derived from mbedtls with just the necessary parts.
« Last Edit: July 27, 2019, 01:38:48 am by wgoeo »
 

Offline wgoeo

  • Contributor
  • Posts: 10
  • Country: 00
Re: Siglent .ads firmware file format
« Reply #330 on: July 29, 2019, 12:51:41 am »
If anyone knows a better way to automatically determine the correct Loading addresses of the STM32 blocks

These are only heuristics so not very reliable.
One way is to search for the pattern of the reset handler:
Code: [Select]
48__    ldr  r0, [pc, #__]
4780    blx  r0
48__    ldr  r0, [pc, #__]
4700    bx   r0
e7fe    b    .

Another is the pattern that sets the vector table offset register:
Code: [Select]
62498:       4817            ldr     r0, [pc, #92]   ; (0x624f8)
6249a:       4918            ldr     r1, [pc, #96]   ; (0x624fc)
6249c:       6008            str     r0, [r1, #0]
.
.
624f8:       08040000
624fc:       e000ed08
If it does not exist then 0x08000000 is assumed.
 

Offline n3mmr

  • Regular Contributor
  • *
  • Posts: 94
  • Country: se
Re: Siglent .ads firmware file format
« Reply #331 on: September 23, 2019, 10:06:47 am »
How to open a telnet session in a Siglent when the root password is unknown?

Use the following scripts, according to each equipment.

They provide a root session via port 10101.

Could exactly the same be done for an SDS1104X-E?
It'd be nice to have a consistent method for all instruments.
 

Offline netlend

  • Contributor
  • Posts: 9
  • Country: ua
Re: Siglent .ads firmware file format
« Reply #332 on: September 30, 2019, 06:16:29 am »
Hello, friends. Can SDS1102CFL do SDS1302CFL?
 

Offline tv84

  • Super Contributor
  • ***
  • Posts: 1327
  • Country: pt
Re: Siglent .ads firmware file format
« Reply #333 on: October 20, 2019, 07:59:41 pm »
Could exactly the same be done for an SDS1104X-E?
It'd be nice to have a consistent method for all instruments.

Go here.

 

Offline tv84

  • Super Contributor
  • ***
  • Posts: 1327
  • Country: pt
Re: Siglent .ads firmware file format
« Reply #334 on: October 20, 2019, 08:01:52 pm »
Hello, friends. Can SDS1102CFL do SDS1302CFL?

Do you have one to try? If so, maybe I can help but in a more appropriate thread. Or pm me.
 

Offline Aqunity

  • Newbie
  • Posts: 1
  • Country: ca
Re: Siglent .ads firmware file format
« Reply #335 on: December 12, 2019, 08:31:48 pm »
Happy to say that the SPD3303X-E to SPD3303X Hack is still working at the end of 2019. :-+

I can make the same trick here like when I was uploading LeCroy in to SDG1025
but who can try this and there may be the same check routine and instrument
will say "Not supported firmware, please reflash correct. Otherwise I will wait 15 min".
This is stupid, it will wait that time anyway before you can access flash menu...

So... do not be the first who is using this firmware file on SPD3303X-E
but this first hack may be needed to be tried out by someone.

SPD3303X-V100R001B01D02P03_with _E_header.zip
OK, I give this only individually after request. I can't test it.

A year ago nobody volunteered to confirm Janekivi's work so I resuscitated the challenge and was successfull!   :popcorn:

Attached is the proof of a Siglent SPD3303X-E conversion to a SPD3303X model.

The method is simple:

1. Run the SCPI command in the X-E to enable the 1mV step:

FACTORY ON

2. Using EasyPower flash the required FW file from the attached ZIP. (ConvertFromX-E)

(3. If you want to rollback, flash the other file.)

The FWs are Siglent official versions with Prod_ID's swapped like janekivi suggested.

The HW version of the board where the test was done is 0.3.

ATTENTION: This may involve a certain risk so do it at your own responsability!

Enjoy!
 

Offline Veteran68

  • Contributor
  • Posts: 47
  • Country: us
Re: Siglent .ads firmware file format
« Reply #336 on: January 05, 2020, 03:15:16 pm »
A couple of questions on these Siglent firmware hacks and the process when Siglent releases a new firmware version.

The SDS1104X-E and 1204X-E appear to use the same firmware file (as it applies to the entire 1xx4 series) so obviously when new firmware gets released there's no choice to make.

However with the SPD3303X-E to 3303X, Siglent has released these as separate firmware files. Now there hasn't been a new release in 2 years, so maybe this is a moot question, but should they release again, can I now just apply the X firmware instead of the X-E since the device now identifies as the X model? Or do I have to repeat the "hack" process again?

In other words, is the hack a "one time only" operation that permanently changes the identity of the product such that it now accepts standard firmware for the upgraded product?

[DSO] Siglent SDS1104X-E   [PS] Siglent SPD3303X-E, Tekpower TP3005T   [LA] DSLogic Plus 16ch/400Mhz, Saleae Clone 8ch/24Mhz
[DMM] Agilent 34401A, Fluke 87V, Aneng 870/8008/8009, Greenlee DM-200, Mustool X1 Clamp, Craftsman 82351, Bunch of DT830x...
 

Offline tv84

  • Super Contributor
  • ***
  • Posts: 1327
  • Country: pt
Re: Siglent .ads firmware file format
« Reply #337 on: January 05, 2020, 03:35:46 pm »
In other words, is the hack a "one time only" operation that permanently changes the identity of the product such that it now accepts standard firmware for the upgraded product?

Yes.
 
The following users thanked this post: Veteran68

Offline Veteran68

  • Contributor
  • Posts: 47
  • Country: us
Re: Siglent .ads firmware file format
« Reply #338 on: January 09, 2020, 03:40:33 am »
Well I've successfully applied the hack to my new SPD3303X-E. It wouldn't take through the normal upload though, I had to boot into firmware mode.
[DSO] Siglent SDS1104X-E   [PS] Siglent SPD3303X-E, Tekpower TP3005T   [LA] DSLogic Plus 16ch/400Mhz, Saleae Clone 8ch/24Mhz
[DMM] Agilent 34401A, Fluke 87V, Aneng 870/8008/8009, Greenlee DM-200, Mustool X1 Clamp, Craftsman 82351, Bunch of DT830x...
 

Offline MathWizard

  • Contributor
  • Posts: 43
  • Country: ca
Re: Siglent .ads firmware file format
« Reply #339 on: March 17, 2020, 11:15:46 am »
Well I've successfully applied the hack to my new SPD3303X-E. It wouldn't take through the normal upload though, I had to boot into firmware mode.
Hi How did you do it ? I got 1 from Amazon last year, and it's V3.0, FW:1.01.01.02.05

I put in the FACTORY ON cmd the 1st time and didn't reboot right away, so maybe that botched it. But did have the machine reset from the voltages I had set rebooting.

Anyways I tried again 3-4 times,  FACTORY ON, reboot, go into Easypower and select the
SPD3303X-1.01.01.02.05_ConvertFromX-E.ADS
and it only lets me try normal mode update, so I try that and it says "this is not update file!"


What procedure did you follow ? What's this about booting into FW mode?

I wish I knew programming, I DL'ed Phython again today, I'll need that for EE anyways.
« Last Edit: March 17, 2020, 11:25:49 am by MathWizard »
 

Offline MathWizard

  • Contributor
  • Posts: 43
  • Country: ca
Re: Siglent .ads firmware file format
« Reply #340 on: March 17, 2020, 01:00:13 pm »
HAHAHAHA I did it.

Before I used the USB to try FW upgrade to 3303X, this time I had wireshark recording and tried the hack procedure over LAN, and it did it.

The PSU now has 3 decimal places

WOO HOO


It doesn't track perfectly, but IDK what it's really supposed to track like, but I can adjust it to within a few mV, so that's great.

I'll check those posts I remember seeing about the calibration maybe different after flashing.
« Last Edit: March 17, 2020, 01:06:33 pm by MathWizard »
 

Offline tv84

  • Super Contributor
  • ***
  • Posts: 1327
  • Country: pt
Re: Siglent .ads firmware file format
« Reply #341 on: March 17, 2020, 03:51:49 pm »
HAHAHAHA I did it.

Before I used the USB to try FW upgrade to 3303X, this time I had wireshark recording and tried the hack procedure over LAN, and it did it.

Explain what you saw in wireshark, please.
 

Offline tautech

  • Super Contributor
  • ***
  • Posts: 18125
  • Country: nz
  • Taupaki Technologies Ltd. NZ Siglent Distributor
    • Taupaki Technologies Ltd.
Re: Siglent .ads firmware file format
« Reply #342 on: April 04, 2020, 07:34:56 am »
SDS1000CML .CFG file nested here so to be easier to find.  :phew:
Avid Rabid Hobbyist
 

Offline tv84

  • Super Contributor
  • ***
  • Posts: 1327
  • Country: pt
Re: Siglent .ads firmware file format
« Reply #343 on: April 04, 2020, 12:47:44 pm »
 

Offline douggoldberg

  • Contributor
  • Posts: 33
  • Country: us
Re: Siglent .ads firmware file format
« Reply #344 on: April 05, 2020, 10:09:28 pm »
Having successfully “improved” my SDG AWG with help of this community I’d like a go at the 2104X+. I’m having trouble finding concrete instructions. Can anyone point me in the right direction?
 

Offline alexitaly

  • Contributor
  • Posts: 49
  • Country: it
Re: Siglent .ads firmware file format
« Reply #345 on: April 22, 2020, 07:39:46 pm »
Hello everyone. Sorry for my english (I'm helping with the google translator).
First of all, nice to meet you, I'm Alessandro and it's the first time I write in this forum.

I have problems with my ATTEN ADS1102CAL oscilloscope. The revision of the motherboard is SAT7.820.681H. The memory is 40k.
Due to several bugs with trigger and time base I've installed the firmware of the SIGLENT SDS1102CNL oscilloscope:
version 5.01.02.13
file SDS1000CNL_SSP_V100R005B01D02P13
I also tried the last one (32).

Unfortunately, with the time base set from 100ms down to 1s and beyond, the update of the track on the time scale fails.
A friend lent me his SDS1102CML oscilloscope and there is no problem with that.
I would like to restore the original firmware ATTEN
file ADS1000CAL_V100R003B01D01P31R16
but the currently installed SIGLENT firmware does not let me do it: PRODUCT ID WRONG.
Could someone help me please?
Thank you.
 

Offline tv84

  • Super Contributor
  • ***
  • Posts: 1327
  • Country: pt
Re: Siglent .ads firmware file format
« Reply #346 on: April 22, 2020, 08:43:27 pm »
Could someone help me please?

That Atten FW is Product_ID: 80

Your Siglent FW is Product_ID: 79

I think I can do that for you but you're sailing in dangerous waters...


Edit: Go here.
« Last Edit: April 27, 2020, 11:57:41 am by tv84 »
 
The following users thanked this post: alexitaly

Offline alexitaly

  • Contributor
  • Posts: 49
  • Country: it
Re: Siglent .ads firmware file format
« Reply #347 on: April 22, 2020, 09:20:30 pm »


Quote
That Atten FW is Product_ID: 80

Your Siglent FW is Product_ID: 79

I think I can do that for you but you're sailing in dangerous waters...

Very Very Thanks!  :-+
Actually the scope is unusable with the timebase settings over 100ms...
The oscilloscope does not draw points at regular intervals on the time axis, it seems to add random delays... i think there is a bug in some pointer in my CNL firmware (or my hw is old for this FW)   :'(
 

Offline routerfan

  • Regular Contributor
  • *
  • Posts: 52
  • Country: cn
Re: Siglent .ads firmware file format
« Reply #348 on: April 26, 2020, 07:37:26 am »
I have an atten 1102cal oscilloscope, hardware version: 3.41.1.16 software version: 3.01.01.21 SN: 30xxxx, then I refresh the firmware version number of siglent SDS 1102cnl: 5.01.02.13, everything looks normal. A few days later, I found the chip to upgrade the long memory( Is61lps5123a-200tqli), after welding it and brushing in 1102cml firmware, the failure occurred. After traversing all relevant discussions in this forum, I downloaded the binary file package to refresh the chip with the programmer, but the failure is still not solved. Now I have removed the chip. I think it's because of the compatibility between the firmware and the device. Thank you for your resources. But I still need to find the right firmware to save my oscilloscope.  |O
 

Offline routerfan

  • Regular Contributor
  • *
  • Posts: 52
  • Country: cn
Re: Siglent .ads firmware file format
« Reply #349 on: April 26, 2020, 07:50:21 am »
I wrote this through translation software. I don't know if anyone can understand it :palm:
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf