Hack of Sigllent spectrum analyzer ssa3021X?

[tv84]

I'm very interested in a high end model from them but this puts a damper on that.  Also, this encryption crap for all of their files helps no one.  The calibration kits should be picked up from external files that can be examined, or cloned and modified for special use.

Since you seem expert in the matter, can you elaborate the information you checked in Siglent files?

I don't think there is any "encryption" at play here, just a simple custom structure by Siglent. Maybe one could understand the structure and their kits.

Maybe I could help a little but time is rare nowadays.

[EE-digger]

Sorry, no expert here but I've worked with a lot of DIY standards until I landed a few real kits, and am somewhat familiar with the cal constants.  And you may be correct in that their data is just that, data and only in their own structure.  Kit labels for the soft keys would have to be elsewhere in resources.  But since today's experiment, I found that the 2 missing files did not fix the problem.  Then I found the limited .csv files.  Not all kits are present.

But the problem remains that only a handful of kits from the menus are present in .csv form.  The files are named for the type such as 85032F.csv.  These kits do not contain the usual data found in kits, delays, c0, c1, c2, c3 and lo, l1, l2, l3.  They are frequency and a pair of data, probably in real, imaginary form.  This example file is a 85032F kit for a type N connector, not sure of the sex.  My real kit is 85033E for 3.5mm (similar to SMA).  It has no .csv file and there's no reason for that.

Quick summary:

1.  performing a cal with the internal 85033E kit results in way off responses, perhaps because there is NO KIT present
2.  entering the proper 85033E constants into the USER1 cal kit results in near perfect cal.
3.  If the.csv files are indeed Siglent's implementation, then:
     a) many are missing and
     b) this is not a good practice

They could/should have been in .xml or delimited text or some other ascii readable format and contained data from Agilent.

Since posting I also repeated this with an Anritsu Tee shaped cal kit I have.  I entered it as USER2 and it behaved near perfectly.

You can tell if the cal matches the kit if the arc produced for a short or open can be brought to a dot by entering a port extension equal in time to the delay constant from the kit for that type and sex of connector.

I think what's left is for someone else to repeat this on a real SVA.  Then it can be brought up with Siglent.

[EE-digger]

A nice treat found 

While trying to get the "upgraded" SVA1032X to save a calibrated session AND apply that calibration to a measurement, I discovered that the unit now saves SNP files.  This was a shortcoming noticed by many.  This addition does not appear in the pdf manual or in the firmware revision notes.  Just an unannounced gift 

To repeat, with the latest firmware (haven't looked before this), the SVA1032X now saves an S1P file for the VNA mode.

The file produced opened correctly in an online S1P viewer.

For those wondering WTF is this about, you can sweep an antenna or network, save the S1P and bring it into a PC based program to view the plot and to add LRC networks to move the plot response as desired.  You can then add that network for real and watch the VNA plot the new response.  Up to tens of MHz, it should be easy.  Once in the GHz, things are not that easy due to pcb layout, stray capacitance and inductance and the phase of the moon 

[EE-digger]

Another little gem that is not in the documentation, the CSA save as format.

Borrowed from its big brothers, as well as Agilent / Keysight, the CSA save allows you to bring back a session with calibration AND state settings applied.

Example:  calibrate the unit with test cable in place, attach your antenna, circuit, etc.  Adjust screen settings, markers, etc.  The CSA save will allow you to come back completely to this "arrangement".  Neither STATE nor CAL alone will do this.

Incidentally, Siglent's high end, SNA5032A, does document this format.

[EE-digger]

Regarding cal kit issues, I noticed that the SNA5032A, for instance, allows cal kits in the .xkt format which is used by Keysight.  They also allow full editing of cal kits, creation of custom kits and more of what you'd expect for $32,000.

While it's obvious you're not going to get this functionality in a < $3000 unit, the essentials should have remained.  Keep the .xkt format for external cal kits AND for internal kits from Keysight or others.

[zurczurc]

Hello everyone, I'm new here. I have a SSA3021X spectrum analyzer that had some options unlocked and the Model: SSA3032X and it had firmware 1.2.8.5a with Telnet enabled, all OK. But there was an small attenuation problem on the TG the -1.0dbm. Siglent asked me to update to 1.3.9.10. After I updated, the Model appears now as SSA3010X and Telnet was blocked, and the TG started to have an attenuation ranging from -22 dBm to -30 dBm. Does anyone have any idea how to re-enable Telnet and adjust the model and calibration? I appreciate the help in advance.

[james38]

OK, i hope you were really sure it was 1.2.8.5a.
An Update to 1.3.9.10 are only possible directly since 1.2.8.1 like said in the update instructions.

I don't know  a SSA3010X but i think it is a typo, right?
if it is really SSA3010X do you have a screenshot?

And yes from a certain version telnet was removed.
But as i know it exists a special ADS in the forum with which you can enable  temporarily.

Have you ever reset the configuration to factory settings?

regards Chris

Addendum:

Is it possible that the device currently only has a maximum of 1 GHz?
Did you change something on an xml using telnet beforehand?

[ironcurtain]

I will be coming back to this now "cult classic" thread as my SSA3021X needs updating and I'm positively not sure if it won't cause problems. It was hacked to enable all options and the serial number is amusingly set to XXXX(...).

I still have a copy of the original files, including calibration.

[coromonadalix]

telnet enabled  FW      thks to the poster,  not me   loll

[ironcurtain]

What original FW version is this one based off?

I'm not near the SA so I can't check anything on my end until later. It's running 1.3.9.1 I believe.

Is it safe to flash the latest firmware over? I completely forgot the process I followed to introduce the licensing keys (but I have the original ones in the backup).

[ozkarah]

Hello all,

I have just tried to upgrade my SSA3021X Plus -> SVA1032X.

Upgrading from SSA3021X Plus to SSA3032X Plus worked flawlessly.

SSA3021X Plus FW Version: V3.2.2.6.0R10
SVA1000X FW Version (tried):  V3.2.2.6.0R7



However, I have issues upgrading from SSA3032X Plus to SVA1032X.


STEPS TAKEN:
--------------------
1- Enabled Telnet and made a backup of the necessary folders as described here ( STEP II )
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3563577/#msg3563577

2 - Enabled options for SSA3000X Plus
Using the Pyhton Script (https://www.online-python.com/PX3v0J8nbs), created option keys, and loaded "ALL" and "3032" keys using the "Load Option" menu item of the SSA3021X Plus.

NOTE: Now I have a SSA3032X Plus. Applied following steps for converting it to SVA1032X..

3- Edited /usr/bin/siglent/config/NSP_config_upgrade_info.xml using telnet and vi command.
Changed "<upgrade_static_id>11411</upgrade_static_id>" to "<upgrade_static_id>11403</upgrade_static_id>" as explained here (STEP 3) :
https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3563577/#msg3563577

4- Rebooted and tried to flash SVA1000X firmware version SVA1000X_V3.2.2.6.0R7 using the SA "Upgrade Firmware" menu item.
Tried this step many times (even with different USB sticks), however every time after waiting at the upgrade screen for some time, the upgrade screen closes and nothing happens. SA continues with file browser screen.  No error message, no update, no change at the info screen, even after reset.

  ->     ->   


QUESTIONS:
------------------
1- Do you see any error in the steps I applied?

2- Do the firmware of SSA and SVA have to be at the same version for cross-flashing? (SSA: V3.2.2.6.0R10, SVA:V3.2.2.6.0R7 in my case) 
Should I downgrade to SSA3000X Plus V3.2.2.6.0R7 firmware first?
Is it safe to downgrade the fw to SSA3000X Plus V3.2.2.6.0R7? Is there anything I need to take care of?
I couldn't find my firmware (R10) on the Siglent web sites. The latest public version is V3.2.2.6.0R7. Does anyone have a link for R10?

3- Is it still necessary to Hex edit the SVA firmware?

Thanks in advance...

[Bicurico]

I think you have the wrong Product ID.

For FW "SVA1000X_V3.2.2.6.0R7_EN" the Product ID has to be 11410.

EDIT:

1- Do you see any error in the steps I applied?

--> 11403 is for SVA1032X_V3.2.2.4.0_EN

2- Do the firmware of SSA and SVA have to be at the same version for cross-flashing? (SSA: V3.2.2.6.0R10, SVA:V3.2.2.6.0R7 in my case)
Should I downgrade to SSA3000X Plus V3.2.2.6.0R7 firmware first?

--> No.

Is it safe to downgrade the fw to SSA3000X Plus V3.2.2.6.0R7? Is there anything I need to take care of?

--> You should not need to downgrade.

I couldn't find my firmware (R10) on the Siglent web sites. The latest public version is V3.2.2.6.0R7. Does anyone have a link for R10?

--> Might be an internal FW version, with not enough changes to justify releasing it.

3- Is it still necessary to Hex edit the SVA firmware?

--> You cannot just edit the ADS file, because the embedded checksum would be wrong and the device would reject the FW file. This has been done before, to change the Product ID and update the checksum, so that you don't have to change the Product ID of your device. It allows to crossflash directly.

[ozkarah]

Thank you very much, I will test the product id 11410 and inform.

[ozkarah]

I think you have the wrong Product ID.

For FW "SVA1000X_V3.2.2.6.0R7_EN" the Product ID has to be 11410.

EDIT:

1- Do you see any error in the steps I applied?

--> 11403 is for SVA1032X_V3.2.2.4.0_EN

2- Do the firmware of SSA and SVA have to be at the same version for cross-flashing? (SSA: V3.2.2.6.0R10, SVA:V3.2.2.6.0R7 in my case)
Should I downgrade to SSA3000X Plus V3.2.2.6.0R7 firmware first?

--> No.

Is it safe to downgrade the fw to SSA3000X Plus V3.2.2.6.0R7? Is there anything I need to take care of?

--> You should not need to downgrade.

I couldn't find my firmware (R10) on the Siglent web sites. The latest public version is V3.2.2.6.0R7. Does anyone have a link for R10?

--> Might be an internal FW version, with not enough changes to justify releasing it.

3- Is it still necessary to Hex edit the SVA firmware?

--> You cannot just edit the ADS file, because the embedded checksum would be wrong and the device would reject the FW file. This has been done before, to change the Product ID and update the checksum, so that you don't have to change the Product ID of your device. It allows to crossflash directly.

Changing Product ID to 11410 worked great. Thank you very much  Bicurico.

After installing SVA1000X V3.2.2.6.0R7 firmware, I installed DTF option too. Now everything looks perfect, except from the Model Number in System Info. It is still SSA3032X Plus.
Is it normal, or did I miss some step?


In this message I recognized a step in which @TheDefpom changes /usr/bin/siglent/firmdata0/NSP_trends_config_info.xml
https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg4937101/#msg4937101

Is it necessary?

[tv84]

It's aesthetics. But I would do it.

[ozkarah]

It's aesthetics. But I would do it.

Any positive or negative effects on calibration or future firmware upgrades ?

[EE-digger]

SA and VNA look good.  SA response across range is good.  S11 calibrated match (noise floor) looks about the same as the "original" range.  A precision 20dB mismatch (circle on a Smith chart) looks good.

I'll defer firmware to the expert 

[tv84]

Any positive or negative effects on calibration or future firmware upgrades ?

In principle, no. But future is a very open matter...

[videobelu]

Good morning, I wanted to know if anyone knows how to make a precision adjustment on the frequency
of the 10MHZ internal oscillator of the SSA3021X. I think it can be done somehow via software.
Thank you

[Electro Fan]

Good morning, I wanted to know if anyone knows how to make a precision adjustment on the frequency
of the 10MHZ internal oscillator of the SSA3021X. I think it can be done somehow via software.
Thank you

If you can dial it in with software go for it.  As an alternative I think your model has a 10 MHz Reference Input.  You might be impressed with what it can do when the 10 MHz Ref In is attached to a GPSDO.

[OP-SEC]

Hello all,

I have a SSA3021X-Plus that I've upgraded to a SSA3032X-Plus with all options enabled using the codes generated by the python script.

SW1: 3.2.2.6.0R8
SW2: 20230524-1501
SW3: 000000D4
HW:   01.00.00

I now want to cross-flash it to a SVA1032X.  Thus far, I know I need to do the following:

• telnet xxx.xxx.xxx.xxx:5024
• Send SCPI command 'DEBTTT' to enable telnet server on default telnet port 23. (It is normal for it to not send any response)
• telnet xxx.xxx.xxx.xxx (default port 23)
• Log in as 'root', pw 'ding1234'
• edit /usr/bin/siglent/config/NSP_config_upgrade_info.xml to change ProductID under <upgrade_static_id> to 11410.
• sync & reboot
• Set defaults
• Flash unmodified official SVA firmware SVA1000X_V3.2.2.6.0R7
• Reenable options using codes from python script
  

I promise, I have read and re-read the various threads.  There seem to be multiple (many outdated) methods and keeping track of the latest and easiest method is lost on me.  I'm pretty sure that I'll have a device running the SVA firmware if I follow the above steps.  The question is do I need to edit / copy any more files after I do the upgrade?

Also, @EE-digger mentioned some cal issues... I'm no VNA expert but, I do have some inexpensive N-male standards to calibrate with... I'm wondering if I'm not using one of the standards that the SVA has cal-data for, if I will have issues?

Thanks!

[Florida-Rob]

I have read all 49 pages, thank you !

New SSA3021X PLUS
SW1: 3.2.2.6.0R10
SW2: 20231127-1601
SW3: 000000D4
HW:  01.00.00

1) Can anyone confirm if the VNA cross firmware fully supports all the Spectrum Analyzer functions / menus ? my main use case is a Spectrum Analyser, and I just need the full options enabled and speed, hence not sure I need to crossflash to a SVA1032X, so like #1152, thinking of just enabling features for *SSA3032X-Plus*
2) is the process in #1152 the latest for my given firmware ?

thank you in advance for your time to reply.

[ozkarah]

I promise, I have read and re-read the various threads.  There seem to be multiple (many outdated) methods and keeping track of the latest and easiest method is lost on me.  I'm pretty sure that I'll have a device running the SVA firmware if I follow the above steps.  The question is do I need to edit / copy any more files after I do the upgrade?

This steps should be enough. That's more or less what I did. You could also consider backing up the configuration files as described in the link I refer to in my previous posts..

For the calibration issue, I am not experienced enough to answer.

[OP-SEC]

This steps should be enough. That's more or less what I did. You could also consider backing up the configuration files as described in the link I refer to in my previous posts..

For the calibration issue, I am not experienced enough to answer.

Thanks for the response.  Next silly question:  I have the Siglent RBSSA3X25 reflection bridge. (Yep, I dropped $718USD on the bridge+license so, I don't feel even the slightest bit guilty hacking the SSA!!!)  I know that I should be able to do S11 LOGMAG on the VNA but, is S21 using the reflection bridge an option with the SVA firmware?  Is the Measure->Reflection option available or some reasonable facsimile?

Screen capture of me actually using the RBSSA3X25 and "Measure->Reflection" on my SSA3021X Plus as tax for my silly questions.


Thanks!

[tautech]

Next silly question:  I have the Siglent RBSSA3X25 reflection bridge. (Yep, I dropped $718USD on the bridge+license so, I don't feel even the slightest bit guilty hacking the SSA!!!)  I know that I should be able to do S11 LOGMAG on the VNA but, is S21 using the reflection bridge an option with the SVA firmware?  Is the Measure->Reflection option available or some reasonable facsimile?

Screen capture of me actually using the RBSSA3X25 and "Measure->Reflection" on my SSA3021X Plus as tax for my silly questions.
(Attachment Link)

Thanks!

Question should really have been placed here:
https://www.eevblog.com/forum/testgear/siglent-sva1015x-1-5ghz-spectrum-vector-network-analyzer-(coming)/

SVA1000X models by virtue of the additional Modes they have do not have a Reflection measurement and instead use the VNA mode for S11 reflection measurements of which they are several types.
Screenshots from SVA1032X menus attached.