Siglent SDS2000X Plus Hack

[Andy_70]

All right.  Now I have entered the 500 Mhz command.Do I see the bandwidth expansion somewhere?

[tautech]

All right.  Now I have entered the 500 Mhz command.Do I see the bandwidth expansion somewhere?

Utility/Sys info

[Andy_70]

All right.
All that remains for me is to say thank you.

For those who also have difficulties with SCPI.
Enter the command and code only separated by spaces, without parentheses, etc.
MCBD xxxxxxxxxxxxxxxx

Have a great week, Andy

[Echo88]

That went unexpectedly silky smooth compared to upgrading the SSA3021X Plus, i love it  Another happy Siglent customer. Thanks to anyone involved in making this possible. 
Now i just need to find a reason to buy a SDG6022X also...

[rfspezi]

Which affordable 500 MHz (or higher?) passive probes are recommended for the scope?

[BillyO]

Affordable is relative but is generally never associated with the words "500MHz (or higher?) passive probes". 

I got a couple of used and (almost) complete Tek P-6139A probes that work well from a seller that I found on eBay.  They generally (for the almost complete ones tested an working) run from $150 to $200 each.  I ended up getting mine pretty much thrown in on a more comprehensive deal. 

I also got a pair of new no-name P-6139A probes that work fairly well for about $41 each off of Amazon.  Now, however, they have gone through the roof @ more than $57.  https://www.amazon.ca/gp/product/B08P3N9VYG

Just a little update.  If you wanted the current model of the Tek P-6139 (the B model) - well .. 4 of them will cost a bit more than twice what your scope cost.

All considered the Siglent SP3050A probes are pretty reasonable at $150 a pop. 

[rfspezi]

Would the Siglent SP3050A probes be ok aswell?

[BillyO]

Would the Siglent SP3050A probes be ok aswell?

No first hand experience with them, but the other Siglent stuff I have is crazy good for the money.

[tautech]

Would the Siglent SP3050A probes be ok as well?

They are specified for the SDS5000X series but of course will work on a SDS2304X Plus however their compensation range is not quite as wide, 8-20pF vs 9-25pF for SP2035A.
Here are the production recommendations for probes:
https://siglentna.com/wp-content/uploads/dlm_uploads/2022/08/Probe_List_008102022.pdf
Quick overview of all the Siglent probes here:
https://siglentna.com/wp-content/uploads/dlm_uploads/2022/08/Probe_DataSheet-E01B.pdf

Remember for these models 500 MHz capability is only available on 2 channels and each must be on an ADC by itself or a 350 MHz BW filter will automatically engage so a couple of 500 and SP2035A 350 MHz probes will be the most cost effective solution.
https://siglentna.com/product/sp2035a-auto-sense-350-mhz-oscilloscope-probes/
https://siglentna.com/product/sp3050a-500-mhz-oscilloscope-probe/

[mawyatt]

Remember for these models 500 MHz capability is only available on 2 channels and each must be on an ADC by itself or a 350 MHz BW filter will automatically engage so a couple of 500 and SP2035A 350 MHz probes will be the most cost effective solution.
https://siglentna.com/product/sp2035a-auto-sense-350-mhz-oscilloscope-probes/
https://siglentna.com/product/sp3050a-500-mhz-oscilloscope-probe/

Nice smart note, 4 500MHz probes need another DSO with dedicated ADCs per channel, or much faster ADCs that are shared

Best,

[BillyO]

Remember for these models 500 MHz capability is only available on 2 channels and each must be on an ADC by itself or a 350 MHz BW filter will automatically engage so a couple of 500 and SP2035A 350 MHz probes will be the most cost effective solution.
https://siglentna.com/product/sp2035a-auto-sense-350-mhz-oscilloscope-probes/
https://siglentna.com/product/sp3050a-500-mhz-oscilloscope-probe/

Nice smart note, 4 500MHz probes need another DSO with dedicated ADCs per channel, or much faster ADCs that are shared

Best,

Exactly.  That's why I only procured 2 "real" 500 MHz probes.  Only makes sense.

Another thing of note is that probes above 350 MHz are usually just 10X probes.  This allows them to be compact and up to the task.  You still need to keep around some probes that will do 1X for the rare applications you need those.  So just don't go sell all your stock probes at a flea market. 

[BillyO]

Remember for these models 500 MHz capability is only available on 2 channels and each must be on an ADC by itself or a 350 MHz BW filter will automatically engage so a couple of 500 and SP2035A 350 MHz probes will be the most cost effective solution.

I love the accessory kit that comes with the Siglent probes.  It may have cost me less initially the way I went, but by the time I equipped myself with equivalent capabilities and taking into account the effort, I think it was a wash at best.  If I was not retired with time on my hands it would be a no brainer to go with the Siglent probes.

[JDW]

I see from the opening post that the "keygen" consists of a file named "main.py" which includes this code...

import hashlib

SCOPEID = '0000000000000000'
Model   = 'SDS2000X+'

bwopt = ('25M', '40M', '50M', '60M', '70M', '100M', '150M', '200M', '250M', '300M', '350M', '500M', '750M', '1000M', 'MAX', 'AWG', 'WIFI', 'MSO', 'FLX', 'CFD', 'I2S', '1553', 'PWA')

hashkey = '5zao9lyua01pp7hjzm3orcq90mds63z6zi5kv7vmv3ih981vlwn06txnjdtas3u2wa8msx61i12ueh14t7kqwsfskg032nhyuy1d9vv2wm925rd18kih9xhkyilobbgy'

def gen(x):
   h = hashlib.md5((
      hashkey +
      (Model+'\n').ljust(32, '\x00') +
      opt.ljust(5, '\x00') +
      2*((SCOPEID + '\n').ljust(32, '\x00')) +
      '\x00'*16).encode('ascii')
   ).digest()
   key = ''
   for b in h:
      if (b <= 0x2F or b > 0x39) and (b <= 0x60 or b > 0x7A):
         m = b % 0x24
         b = m + (0x57 if m > 9 else 0x30)
      if b == 0x30: b = 0x32
      if b == 0x31: b = 0x33
      if b == 0x6c: b = 0x6d
      if b == 0x6f: b = 0x70
      key += chr(b)
   return key.upper()
   
for opt in bwopt:
   print('{:5} {}'.format(opt, gen(SCOPEID)))

QUESTIONS:
1. What is the step-by-step procedure for using "main.py" to generate and then use the keys?
2. Will generated keys work on the 2-channel SDS2102X Plus, even with latest firmware?
3. From reading some posts in this thread, it seems that 500MHz operation will be unlocked with a keygen-created key, but what other Software Options are unlocked?  For example, is there a key to unlock the logic analyzer?  (Bad idea to buy the expensive SPL2016 if the scope can't be unlocked to use it.) Arbitrary Waveform Generator?  CAN FD Decoder? Etc.?

Thank you!

[Martin72]

Hi,

1) It´s here.
2) Should work, I haven´t "heard" about any problems - Just try it..
3) See 1, it generates all the option keys - But it also generate keys you don´t need.

[tautech]

Hi,

1) It´s here.
2) Should work, I haven´t "heard" about any problems - Just try it..
3) See 1, it generates all the option keys - But it also generate keys you don´t need.

More correctly...can't use as they either don't apply to this instrument or are beyond its capabilities.
The risk of damage/bricking is ever present if care is not taken.
YMMV

[Martin72]

Rob are right, so edit this line:

bwopt = ('25M', '40M', '50M', '60M', '70M', '100M', '150M', '200M', '250M', '300M', '350M', '500M', '750M', '1000M', 'MAX', 'AWG', 'WIFI', 'MSO', 'FLX', 'CFD', 'I2S', '1553', 'PWA')

To:

bwopt = ('200M', '350M', 'AWG', 'MSO', 'FLX', 'CFD', 'I2S', '1553', 'PWA')

And get only the keys you really need.
And don´t forget: ScopeID means not the serialnumber.

[JDW]

Rob are right, so edit this line:

bwopt = ('25M', '40M', '50M', '60M', '70M', '100M', '150M', '200M', '250M', '300M', '350M', '500M', '750M', '1000M', 'MAX', 'AWG', 'WIFI', 'MSO', 'FLX', 'CFD', 'I2S', '1553', 'PWA')

To:

bwopt = ('200M', '350M', 'AWG', 'MSO', 'FLX', 'CFD', 'I2S', '1553', 'PWA')

And get only the keys you really need.
And don´t forget: ScopeID means not the serialnumber.

So if one does not edit the code exactly as above, the scope will be bricked?

Also, why is there 200M and 300M in the above?  Isn't the scope we are talking about either 100MHz or 200MHz or 350MHz or 500MHz as per the following product page?
https://siglentna.com/digital-oscilloscopes/sds2000xp/

If so, wouldn't it be best to mention those 4 values in the code/hack?  Or if one only wants 200MHz, then one would need only use the following?

bwopt = ('200M', 'AWG', 'MSO', 'FLX', 'CFD', 'I2S', '1553', 'PWA')

[Martin72]

So if one does not edit the code exactly as above, the scope will be bricked?

No...
It´s only a script, it needs the scoope id as input, from this it generates keys.
The outputs are the variables named "PWA", "AWG" and so on.
There are more variables than you´ll need, therefore I´ve suggested the edit.
It´s only for clarification, you can leave it as it is and pick only the keys you really need.

[JDW]

It´s only a script, it needs the scoope id as input, from this it generates keys.

I'm a little confused on which Scope ID is correct.  If we go back to page 1 of this thread, we see Dave posting a text dump...

Scope ID: 00 00 00 00 00 00 00 00 00 00 00 00
8dd6-bb73-29a7
ScopeID(64): 4914a72973bbd68d

Then at 34:50 in Dave's video, we see the following info in System Status...

Scope ID: 0800-001b-3d4a-4d01

Now it's obvious that all of us are not to use his Scope ID, but I am asking WHICH Scope ID is correct, since his data dump shows multiple Scope IDs, and then the System Status shows yet another.  Are we to use the Scope ID shown on the scope itself within System Status?

[tv84]

8dd6-bb73-29a7

[JDW]

8dd6-bb73-29a7

If correct, that means in order to do the HACK, we need to perform these steps...

1. Open the scope, as Dave does in his video at 23:40.
2. Connect wires (how many though, I cannot see in Dave's video) to the rightmost to the right of the round battery on the scope's main board, then connect those wires to a USB-to-Serial interface, which in turn is connected to a computer with Terminal software set to COM9.
3. Soft power on the scope to see the data dump in the Terminal software.
4. Look for "Scope ID" with all those zeros, but then actually use the number on the line beneath, which in Dave's case was 8dd6-bb73-29a7.

Are my steps above correct?  Or am I missing something?  Also, how many wires is Dave connecting to the main board?

Still very confused as to why there are multiple Scope IDs, both in the data dump and then on the scope's UI within "System Status"!

[tubularnut]

NO!

The scope ID can be found on the System Status screen.

[JDW]

NO!

The scope ID can be found on the System Status screen.

Thank you for proving CORRECT information.  I appreciate facts.  Not sure why other people are posting only speculation.

By the way, why are there multiple Scope ID's as I mention in my previous post?

[tubularnut]

By the way, why are there multiple Scope ID's as I mention in my previous post?

I think only Siglent can answer that one 

Don’t panic too much over the scope ID and license keys generated by the script.

If you get anything wrong during the process, the keys simply won’t activate the wanted option.

[Martin72]

Or pm the ID and get the keys..