Siglent SDS2000X Plus Hack

[Sergio66]

Hello Everybody,

      I am a long time reader of this fantastic forum and I became a member since a few days.  I'm an electronic engineer living in Italy, I normally use some LeCroy scopes at my job
and I recently purchased a Siglent SDS2104X Plus for my personal use, at my home.

After a few days using the instrument to verify the correct behavior, I'm going to apply the hacking procedure, simply using the key generator.

So, before proceeding in that direction, I'd like to ask to the community a quite simple and obvious (...maybe "stupid"...) question: is there a way to get back to the
original status of the device (the default state, with no option nor upgrade keys entrered), in the unlucky case I would need to send the scope to repair, under warranty?
Does it make any difference, in that sense, upgrading the bandwidth entering the keys on instrument panel or via SCPI MCBD command?


Thanks in advance for any feedback!


Best regards.

Sergio

[pdx_soft]

Just got my scope from Saelig. All the options worked great, thank you! Had to do the incremental steps on the bandwidth. For me had to do 200M, 350M and then 500M to get the upgrade to work. All the rest just flat out worked on the first try. Cheers

[EEVblog]

So, before proceeding in that direction, I'd like to ask to the community a quite simple and obvious (...maybe "stupid"...) question: is there a way to get back to the
original status of the device (the default state, with no option nor upgrade keys entrered), in the unlucky case I would need to send the scope to repair, under warranty?
Does it make any difference, in that sense, upgrading the bandwidth entering the keys on instrument panel or via SCPI MCBD command?

I don't see any way to uninstall the options, at least in the user menu. Might be some other way to do it or factory restore the unit?

[Elasia]

So, before proceeding in that direction, I'd like to ask to the community a quite simple and obvious (...maybe "stupid"...) question: is there a way to get back to the
original status of the device (the default state, with no option nor upgrade keys entrered), in the unlucky case I would need to send the scope to repair, under warranty?
Does it make any difference, in that sense, upgrading the bandwidth entering the keys on instrument panel or via SCPI MCBD command?

I don't see any way to uninstall the options, at least in the user menu. Might be some other way to do it or factory restore the unit?

console access and its possible..  not really one to spill the beans on that as a courtesy to siglent.. enough people start doing that and they may rethink their position of letting us easily hack their equipment

[tv84]

So, before proceeding in that direction, I'd like to ask to the community a quite simple and obvious (...maybe "stupid"...) question: is there a way to get back to the original status of the device (the default state, with no option nor upgrade keys entrered), in the unlucky case I would need to send the scope to repair, under warranty?
Does it make any difference, in that sense, upgrading the bandwidth entering the keys on instrument panel or via SCPI MCBD command?

Without console access there is but it's not public domain. 

The MCBD lets you enter any BW (up or down). The key panel has limitations.

[cardre]

So, before proceeding in that direction, I'd like to ask to the community a quite simple and obvious (...maybe "stupid"...) question: is there a way to get back to the original status of the device (the default state, with no option nor upgrade keys entrered), in the unlucky case I would need to send the scope to repair, under warranty?

I'm hopefully receiving mine in the next week or so as well. So I'd be interested to know this as well, but understand if this is a 'sensitive' subject.

[rowifi]

I thought the hardware was different on the 300Mhz version. That means 300Mhz and up wont work / work correctly?

[tautech]

I thought the hardware was different on the 300Mhz version. That means 300Mhz and up wont work / work correctly?

Only 100, 200, 350 MHz models and the optional 500 MHz upgrade in the SDS2000X Plus series.

However, this is the info you seek:
https://www.eevblog.com/forum/testgear/siglent-sds2000x-plus-coming/msg3087116/#msg3087116

[AlexandruOprea]

Hi! I am ordering a SDS2104X Plus and I am relatively basing my decision on the ability to hack it (I only need the AWG option for bode plotting). I have read the threads and also the video, but I still have some questions.
Does the hack involve anything ,besides taking the ScopeID from the main screen, generating the keys and typing them on the device.
Has it worked for everyone who tried it?
Does the keygen still work?
Thank you in advance for the answers!

[Martin72]

Hi,

Checked this at last in june, the generated keys were identical so it should work.
Took the keygen from the first post.

[Howardlong]

The bandwidth one might be only doable via the scpi command MCBD <key>

FWIW, on the 100MHz I had, I did it from the front panel, but had to do it in stages, from 100 to 200 to 350 to 500.

I have a question though. When Ch1+Ch2 are used, the sampling rate drops to 1GSa/s. Of course, things then start to go a bit weird beyond about 420MHz, and we see the expected Fs-f aliasing beyond Fs/2 and the counter, for example, shows a 580MHz signal as being 420MHz. On kosher 350MHz units, upgraded to 500MHz, is this still a thing, or do the 350MHz units have additional ADC hardware to maintain the sample rate at 2GSa/s?

The photos mentioned above seem to concentrate on the analog attenuator side alone and not the ADC.

[tv84]

FWIW, on the 100MHz I had, I did it from the front panel, but had to do it in stages, from 100 to 200 to 350 to 500.

I have a question though. When Ch1+Ch2 are used, the sampling rate drops to 1GSa/s. Of course, things then start to go a bit weird beyond about 420MHz, and we see the expected Fs-f aliasing beyond Fs/2 and the counter, for example, shows a 580MHz signal as being 420MHz. On kosher 350MHz units, upgraded to 500MHz, is this still a thing, or do the 350MHz units have additional ADC hardware to maintain the sample rate at 2GSa/s?

In a 500 unit, you can only use Ch1+Ch2 up to 350. So if things only go weird after 420, it's within spec.

The MCBD command allows from 100 to 500 in one shot-only. So, makes it easy.

[Martin72]

Hi,

When Ch1+Ch2 are used, the sampling rate drops to 1GSa/s. Of course, things then start to go a bit weird beyond about 420MHz

Therefore siglent claims to use ch1 or 2 and ch3 or 4 - If you got the 500Mhz option, it will be bandwith-limited to 350Mhz because they know the 1GSa/s thing.

[Howardlong]

FWIW, on the 100MHz I had, I did it from the front panel, but had to do it in stages, from 100 to 200 to 350 to 500.

I have a question though. When Ch1+Ch2 are used, the sampling rate drops to 1GSa/s. Of course, things then start to go a bit weird beyond about 420MHz, and we see the expected Fs-f aliasing beyond Fs/2 and the counter, for example, shows a 580MHz signal as being 420MHz. On kosher 350MHz units, upgraded to 500MHz, is this still a thing, or do the 350MHz units have additional ADC hardware to maintain the sample rate at 2GSa/s?

In a 500 unit, you can only use Ch1+Ch2 up to 350. So if things only go weird after 420, it's within spec.

OK, sounds reasonable.

The MCBD command allows from 100 to 500 in one shot-only. So, makes it easy.

Yeah, I tried that, but no cigar. Probably operator error. I telnetted in on port 5024, *IDN? worked, but I couldn't get MCBD xxxxxxxxxxxxxxxx to do anything, no error or action, on any of the keys. As I say, prolly operator error. I gave up and did them all from the front panel, with the help of a USB keyboard.

[Howardlong]

Hi,

When Ch1+Ch2 are used, the sampling rate drops to 1GSa/s. Of course, things then start to go a bit weird beyond about 420MHz

Therefore siglent claims to use ch1 or 2 and ch3 or 4 - If you got the 500Mhz option, it will be bandwith-limited to 350Mhz because they know the 1GSa/s thing.

(Attachment Link)

Yes, that's precisely the behaviour, it appears to be a different low pass filter, I didn't know if it was a hardware limitation on non-350MHz models. I guess I should RTFM!

[tautech]

I have a question though. When Ch1+Ch2 are used, the sampling rate drops to 1GSa/s. Of course, things then start to go a bit weird beyond about 420MHz, and we see the expected Fs-f aliasing beyond Fs/2 and the counter, for example, shows a 580MHz signal as being 420MHz. On kosher 350MHz units, upgraded to 500MHz, is this still a thing, or do the 350MHz units have additional ADC hardware to maintain the sample rate at 2GSa/s?

There are 2 ADC's, each 2 GSa/s with 200 Mpts memory support each.
To satisfy Nyquist a channel need be assigned to each ADC for work to 500 MHz.

Therefore these are a 4ch 350 MHz DSO or 2ch 500 MHz DSO.
Further reading here:
https://www.eevblog.com/forum/testgear/siglent-sds2000x-plus-coming/msg2786298/#msg2786298

[Howardlong]

I have a question though. When Ch1+Ch2 are used, the sampling rate drops to 1GSa/s. Of course, things then start to go a bit weird beyond about 420MHz, and we see the expected Fs-f aliasing beyond Fs/2 and the counter, for example, shows a 580MHz signal as being 420MHz. On kosher 350MHz units, upgraded to 500MHz, is this still a thing, or do the 350MHz units have additional ADC hardware to maintain the sample rate at 2GSa/s?

There are 2 ADC's, each 2 GSa/s with 200 Mpts memory support each.
To satisfy Nyquist a channel need be assigned to each ADC for work to 500 MHz.

Therefore these are a 4ch 350 MHz DSO or 2ch 500 MHz DSO.
Further reading here:
https://www.eevblog.com/forum/testgear/siglent-sds2000x-plus-coming/msg2786298/#msg2786298

Yes, I was just querying whether there was something special about the 350MHz model which as I understand it is the only model officially upgradeable to 500MHz. I thought that there might be a technical aspect to this also.

[mawyatt]

Hello,

Disclaimer, I'm not a software guru and limited knowledge with these scopes and "hacking" procedures, and have no knowledge with hacking anything.

We've just received the SDS2102X Plus thanks to Rob at Tautech and Saelig. Have an ongoing project for the scope use and was going to wait until attempting to enable the features, fearing I might hose the scope up.

Curiosity got me and I decided to try an unlock an unimportant feature while waiting for some components, figuring I wouldn't hose up the actual scope. So followed the notes on here and got the scope ID (lower case) from the System Status menu, and didn't include the "-" from the ID as it's  xxxx-xxxx-xxxx-xxxx. Then entered this ID sans "-" in the on-line Python script which created all the keys for various features. Tried using the key (Upper case) for the CANFD which failed with a code error message, tried the 1553B with same result. So checked the scope ID and reran the Python script, reentered the keys and failed again, then tried the Bandwidth Option which also failed. The scope software was updated earlier to 1.3.5R5 before any hacking attempts.

Not sure what I'm doing wrong, so any help is greatly appreciated!!

BTW so impressed with the SDS2102X Plus, we just ordered the SDG2042X AWG

Best,

[tv84]

Not sure what I'm doing wrong, so any help is greatly appreciated!!

Here.

[mawyatt]

Not sure what I'm doing wrong, so any help is greatly appreciated!!

Here.

Checked the scope ID and SN from the System Status, ran the indicated python script with scope ID and SN and scope model changed to SDS2000X+, entered the keys generated in scope Options and tried a couple Option Types including Bandwidth, they all failed!!

Best,

[Orange]

Not sure what I'm doing wrong, so any help is greatly appreciated!!

Here.

Checked the scope ID and SN from the System Status, ran the indicated python script with scope ID and SN and scope model changed to SDS2000X+, entered the keys generated in scope Options and tried a couple Option Types including Bandwidth, they all failed!!

Best,

Did you use this keygen ?
https://repl.it/repls/DirectProbableTwintext

Maybe it needs a different hash code for 2 channel models ?

[mawyatt]

Hello,

The keys need to be in lower case, not upper case as they are shown by the generator. Thanks to Tautech for pointing this out!! Now the scope accepts the keys and I've enabled a few functions including extending BW to 200MHz (havent measured tho), tried 500MHz but got a error message.

Unfortunately a drink (Kobucha) was spilled and went inside the scope and into the front panel. I've disassembled and cleaned as best I could but the front panel controls don't work properly, likely due to leakage between controls and knobs from residue. The scope has been disassembled down to main PCB but I can't get the main PCB removed to get to the control panel PCB underneath. It seems the final attachment is around the input connector region (this is a 2 channel scope) and I can't see any screws and seems the attachment is by the input BNC connectors being soldered into place. Hopefully this isn't the case as they look like it would be difficult to unsolder and remove the main PCB.

Anyway, good news is that the keys now work in lower case, bad news is the scope is hosed up by another means 

Any help with the main PCB removal to get to the front panel PCB is appreciated.

Best,

Edit: The label around the input BNC connectors covers bolts that hold the cover on. Removing the label and the bolts allows access to the front PCB. After following this the PCB and push-button membrane were cleaned, dried and replaced. Now the scope is fully functional

[ErikTheNorwegian]

so..today this is good, very good to have the oportunety to do this.
But on the long run, dont we shoot our self in the foot..
Will the scope manufators make software uppgrading imposibol  on new models becouse of this hacking.. They will come up with somthing like verification tru the web or somthing else to make it harder..

just woundering...

Got a rigol MSO4025 thats fully hacked so saved a load of money there. 

[Martin72]

Will be happy when you tell me/us, what your post will have to do with the topic here.
Do you own/got a SDS2K+ and hacked it successfully ?

[ErikTheNorwegian]

Make you happy ?, happy to say that im not gone do that!