Unlocking Siglent SDS1104X-E, step by step

[Rerouter]

LANG is for scope
LAGG is for AWG

[ucognitive]

I'm not sure that changing model name is possible by SCPI.

PROD?
PROD MODEL,SDS1000X-E,BAND,25MHZ

LAGG?
LAGG CH

LANG?
LANG SC

[vtwin@cox.net]

I'm not sure that changing model name is possible by SCPI.

I do not believe so.

It is my recollection the scope calculates its "model" number based on the bandwidth, e.g. a SDS1104X-E with a 200 mhz bandwidth key will show up as a SDS1204X-E in the menus, etc.

[tv84]

I'm not sure that changing model name is possible by SCPI.

PROD?
PROD MODEL,SDS1000X-E,BAND,25MHZ

LAGG?
LAGG CH

LANG?
LANG SC

Just try:

LANG EN

I agree that we won't be able to change it with the PRODUCT MODEL as you show with the SCPI responses.

[ucognitive]

I've tried LANG EN, LANG ENG, LANG SE with not effect:(

[Rerouter]

On the latest firmware, they hard coded the language text inside the scope application, with the help files just being a left over. I've not dug into it recently, but it could be as simple as patching the language tree in the application

Other places you can have a look

usr\bin\siglent\config\NSP_trends_config_info.xml
usr\bin\siglent\firmdata0\factory_settings.xml
usr\bin\siglent\usr\user_default_settings.xml
usr\bin\siglent\usr\config\NSP_usr_system_info.xml
usr\bin\siglent\usr\config\temp_settings.xml
usr\bin\siglent\usr\config\save_settings.xml

for the ones that use a numeric language, looks like "2" is english

[KaLi]

Hi folks,

about a year ago I had the idea to buy this scope and read the thread about patching and hacking it... but I didn't.

Now -- with christmas vacation spare time in mind -- I came back to this idea.

To make my question short: Does everything work with the same hacking instruction as a year ago? Are the actual firmwares safe, or is there a catch? It's much to read and especially over-read in this and the other thread about that topic. And the important parts are well distributed in that large amounts of text.

thank you
Kai

[aimc]

Dear Kai, if your question concerns the SDS1104X-E, the bandwidth hack (with model number change to SDS1204X-E) still works perfectly fine. I did mine about a month ago (see also my posts).
Regards, Lutz

[tonykids]

After updating FW language is changing back to Chinese.

I see X-C label on scope info screen with versions.
Also *IND? command return X-C model name.

update the the X-C model whit X-E's update package will change it to X-E , right?
The capture rate is 400000wfm/s but X-C is 200000wfm/s

[tjohejsanhopp]

The codes generated by the python-script (doing it as described in #168) seem to activate the 200MHz correctly, but no other features show up as activated, and instead stay as Trial with a countdown.
I tried to enter all codes at once, then do the reboot.
Then tried one and one, rebooting in between, same result.
Is the script not able to correctly generate the other codes correctly or am I doing it wrong?

[aimc]

The codes generated by the python-script (doing it as described in #168) seem to activate the 200MHz correctly, but no other features show up as activated, and instead stay as Trial with a countdown.
I tried to enter all codes at once, then do the reboot.
Then tried one and one, rebooting in between, same result.
Is the script not able to correctly generate the other codes correctly or am I doing it wrong?

Everything is working correctly, have a look at my post below. Did you use the newer (see "update" link inside post from wgoe) Python code? If not, you need to use the serial number instead of the scope id. Also, for the SW options you can't use MCBD. Best way is to type it in the scopes UI as if you bought the upgrade...
Hope this helps.
Lutz

Hi all! I am newbie and I have some questions about updating my SDS1104X-E (Current FW is 6.1.26):

I have done memorydump, but not yet activating wifi, 200 MHz etc.. So should I first upgrade FW to 6.1.33, and next install Plurs .ads file from usbstick? And what is Python file, I can't find it ?

Could someone please send me more detailed instructions on the upgrade via PM?

Thanks

Well, I had my fair share of mishaps, but now I can say with confidence that everything is quiet trivial. Here is what worked for me:

1) I updated to 6.1.33 but as I understood from others you don't have to. All license changes will be persistent after FW changes.
2) Connect your scope to your local network and write down the IP address. You can also use the USB if you don't have LAN, in this case skip to (4).
3) Use IE or other browser from a PC in that LAN simply by the IP address (http://xxx.yyy.zzz.aaa).
4) Your scope answers you with a web page containing 4 big buttons on the left, push the bottom (SPCI control) one.
5) In the command line enter SCOPEID? and receive your scope ID in the text window below, write it down, remove the dashes.
6) Have your scope's serial number ready. Get it from either your cal sheet or from scope Info button, or finally via SPCI command *IDN? (it returns comma separated model, SN, SW version)
7) Get the updated (!) Python code from here: (The updated link from wgoeo goes to a website that can also run the code).

I haven't fully tested this but the output matches the bandwidth keys in reply #89.
Needs Python 3, just replace the serial and run.

Edit: Update, thanks tinhead!

8 ) Enter 16 character Scope ID (remove the dashes inbetween!) and the 14 character serial number in the corresponding placeholders of the py-code file.
9) Run the Python code, either on your PC if you have PyCharm or Visual Studio or find an online Python engine where you can paste the patched py code and run it. Most simple is to just run it off the website provided by wgeoe. There you can also paste your ID/SN in.
10) Pick the for the SDS1000X-E relevant keys from the result (100M, 200M, AWG, WIFI, MSO).
11) Go back to the SPCI terminal and install the bandwidth key with MCBD <key> (e.g. MCBD 0123456789ABCDEF). If the key was taken you will see with MCBD?. Then the same key you just entered appears in the result window. Also you can see instantly that the scope has now changed model number. (No scope restart is needed, result is immediate. You even see the change in noise when in the 0.5mV range with nothing connected).
12) Now install the SW options. On the SPCI use LCISL <option> <key> (Option AWG, WIFI, MSO), (e.g. LCISL WIFI 0123456789ABCDE). I used the scope's function to enter the key under Utilities, Options, on one of the pages select one of the three options and press install button to enter the key, scope will answer "License key installed" (make sure the key is correct, I fell victim to my own handwriting and almost gave up until I noticed that I mistook Z for a 2  ).
13) Although changes are imminent, for sanity reboot the scope and do a calibration.
14) Congratulations you are done. Don't forget to thank wgoeo and tinhead.

cheers
Lutz

[tjohejsanhopp]

Ok, I figured out my error.
On the scope-UI, one must FIRST SELECT TYPE on the left most button before pressing INSTALL-button
Well that was...in a way logical...but...yeah...

[troian]

Ok, I figured out my error.
On the scope-UI, one must FIRST SELECT TYPE on the left most button before pressing INSTALL-button
Well that was...in a way logical...but...yeah...

I've go same issue as tjohejsanhopp, 200MHz upgrade went just fine. All other options returning The data is invalid! on scope screen. LCISL command returns Success but options remains trial.
Scope fw is 6.1.33

[aimc]

Ok, I figured out my error.
On the scope-UI, one must FIRST SELECT TYPE on the left most button before pressing INSTALL-button
Well that was...in a way logical...but...yeah...

I've go same issue as tjohejsanhopp, 200MHz upgrade went just fine. All other options returning The data is invalid! on scope screen. LCISL command returns Success but options remains trial.
Scope fw is 6.1.33

Have you tried the scope UI? This should work nonetheless. Check again the key(s) for typos and remember to use the serial number (not the scope ID) to generate them.

[troian]

That was just extra 0 in serial #. All went fine through

[Musclor]

Hi all, amazing thread, I read every message carefully - great to see the teamwork at play here!
One non-technical question, I spotted a few users having successfully 'upgraded' their scope even after updating the fw to 6.1.33 (which is the very latest).

This implies that Siglent has not implemented a countermeasure to this 'upgrade' - am i missing something? Not that I'm complaining, but I find it curious, to say the least (a quick google search returns this thread when you look for 'most hackable scope' etc).

[Fungus]

This implies that Siglent has not implemented a countermeasure to this 'upgrade' - am i missing something?

Would you have bought yours if ir wasn't hackable? 

Not that I'm complaining, but I find it curious, to say the least (a quick google search returns this thread when you look for 'most hackable scope' etc).

It's a marketing ploy - make the buyers feel clever and like they're getting something for free. Who can resist that feeling?

It also allows them to sell 'scopes for double price to institutional people people who are paranoid about warranties - double win!

PS: It was Rigol who really started this practice. I'm convinced the riglol website is really run by Rigol.

[Rerouter]

Siglents stance on it is, as long as it is not a remote code execution exploit, they have better things to work on,

The earlier SCPI method was a remote command that executed as root with no authentication... so that got patched quickly,
The new method needs physcial access, so much less of a concern. seeing as they are trying to sell these things in schools and businesses.

[aimc]

This implies that Siglent has not implemented a countermeasure to this 'upgrade' - am i missing something?

Would you have bought yours if ir wasn't hackable? 

Not that I'm complaining, but I find it curious, to say the least (a quick google search returns this thread when you look for 'most hackable scope' etc).

It's a marketing ploy - make the buyers feel clever and like they're getting something for free. Who can resist that feeling?

It also allows them to sell 'scopes for double price to institutional people people who are paranoid about warranties - double win!

PS: It was Rigol who really started this practice. I'm convinced the riglol website is really run by Rigol.

Oh you really think its a business plan for us nerd population? Sounds plausible ...

[e0ne199]

hello everyone, i just want to hack my SDS1204X-E 's AWG, LA, and WIFI license...does anyone here know how to do that? thx before, and i am sorry if it is OOT 

[tmcks]

Quote from: aimc on November 14, 2019, 06:17:49 pm

...

Thanks for posting this step-by-step summary. Followed it precisely and completed my 1104X-E -> "1204X-E," w/ options unlocked, in ~10 mins.

[e0ne199]

The codes generated by the python-script (doing it as described in #168) seem to activate the 200MHz correctly, but no other features show up as activated, and instead stay as Trial with a countdown.
I tried to enter all codes at once, then do the reboot.
Then tried one and one, rebooting in between, same result.
Is the script not able to correctly generate the other codes correctly or am I doing it wrong?

Everything is working correctly, have a look at my post below. Did you use the newer (see "update" link inside post from wgoe) Python code? If not, you need to use the serial number instead of the scope id. Also, for the SW options you can't use MCBD. Best way is to type it in the scopes UI as if you bought the upgrade...
Hope this helps.
Lutz

Hi all! I am newbie and I have some questions about updating my SDS1104X-E (Current FW is 6.1.26):

I have done memorydump, but not yet activating wifi, 200 MHz etc.. So should I first upgrade FW to 6.1.33, and next install Plurs .ads file from usbstick? And what is Python file, I can't find it ?

Could someone please send me more detailed instructions on the upgrade via PM?

Thanks

Well, I had my fair share of mishaps, but now I can say with confidence that everything is quiet trivial. Here is what worked for me:

1) I updated to 6.1.33 but as I understood from others you don't have to. All license changes will be persistent after FW changes.
2) Connect your scope to your local network and write down the IP address. You can also use the USB if you don't have LAN, in this case skip to (4).
3) Use IE or other browser from a PC in that LAN simply by the IP address (http://xxx.yyy.zzz.aaa).
4) Your scope answers you with a web page containing 4 big buttons on the left, push the bottom (SPCI control) one.
5) In the command line enter SCOPEID? and receive your scope ID in the text window below, write it down, remove the dashes.
6) Have your scope's serial number ready. Get it from either your cal sheet or from scope Info button, or finally via SPCI command *IDN? (it returns comma separated model, SN, SW version)
7) Get the updated (!) Python code from here: (The updated link from wgoeo goes to a website that can also run the code).

I haven't fully tested this but the output matches the bandwidth keys in reply #89.
Needs Python 3, just replace the serial and run.

Edit: Update, thanks tinhead!

8 ) Enter 16 character Scope ID (remove the dashes inbetween!) and the 14 character serial number in the corresponding placeholders of the py-code file.
9) Run the Python code, either on your PC if you have PyCharm or Visual Studio or find an online Python engine where you can paste the patched py code and run it. Most simple is to just run it off the website provided by wgeoe. There you can also paste your ID/SN in.
10) Pick the for the SDS1000X-E relevant keys from the result (100M, 200M, AWG, WIFI, MSO).
11) Go back to the SPCI terminal and install the bandwidth key with MCBD <key> (e.g. MCBD 0123456789ABCDEF). If the key was taken you will see with MCBD?. Then the same key you just entered appears in the result window. Also you can see instantly that the scope has now changed model number. (No scope restart is needed, result is immediate. You even see the change in noise when in the 0.5mV range with nothing connected).
12) Now install the SW options. On the SPCI use LCISL <option> <key> (Option AWG, WIFI, MSO), (e.g. LCISL WIFI 0123456789ABCDE). I used the scope's function to enter the key under Utilities, Options, on one of the pages select one of the three options and press install button to enter the key, scope will answer "License key installed" (make sure the key is correct, I fell victim to my own handwriting and almost gave up until I noticed that I mistook Z for a 2  ).
13) Although changes are imminent, for sanity reboot the scope and do a calibration.
14) Congratulations you are done. Don't forget to thank wgoeo and tinhead.

cheers
Lutz

lols thx so much everyone... i have finally unlocked them all..hope that siglent won't get angry about this 

[modoran]

Unlocking 1104x-e to 200 Mhz bandwith ( 1204x-e ) is reversible ?   I suppose this voids the warranty ?

[aimc]

Unlocking 1104x-e to 200 Mhz bandwith ( 1204x-e ) is reversible ?   I suppose this voids the warranty ?

You can reverse to 100MHz. Just use the key for 100MHz. Does not void warranty.

[vicenç]

I also succeeded finding codes with wgoeo python script (thanks man!!) and later on MCBD ing for 200MHz and introducing codes for MSO / WIFI / AWG directly on scope interface. They seem to be properly set as when pressing the options => Information menu i can not change they appear as permanent licenses.

BUT... i bought a WIFI TPLINK WN725N, the one advertised to be used. After plugging it I am able to manually scan for the Wifi networks, finding those around without hassle. I am able to connect to a wlan and to manually set an ip or to leave it to DHCP. In both cases the scope returns a wlan connected message and shows the wifi wave icon in the bottom down menu. In the dhcp mode it is assigned a proper IP, according to the range defined in the wlan router (so no random IP, but a logical one).

BUT... unfortunately it is not really working. I cannot access the webpage (that i am capable to do so with a wired LAN connection). If i ping it, no answer at all. If i try to use it to connect to my awg emulated server it is not working either.

Therefore, I don't know if it is TPLINK usb interface (there seems to be several versions out there) despite it properly finds wlan's and says "wlan connected" OR if it is an issue with the codes the python script calculated, requiring an extra step

Reading through the entire pages it seems to happen at least to another user.

Regards