Hack of Sigllent spectrum analyzer ssa3021X?

[rf-loop]

Hi,
yes upgrade is still possible  - red in thread before.
Regards

Might a new guide for dummies be required ?

I'm one and I'd have no idea where to start. 

I've read this forum several times and as is started in this post we, yes me as well, need a upgrade for dummies step by step guide. It's confusing to read to replace ecomb from 8 with the one from 7 and then what?? You can now roll back upgrades? That's great if I read that correctly but chances are high I didn't. There are some pretty incredibly talented users in this form and if one or a few could help those of us who need the upgrades for dummies methods I think we and everyone else who is trying to do the upgrade and failing or just afraid to try would be very grateful.

Does please and thank you work? 

You have not read.
This message is mandatory to read:

https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1069844/#msg1069844

self-censorship: <deleted funny paragraph>

[TurboTom]

As far as I know, so far nobody has been able to run a "proper" update after the manual "downgrade" from F/W 8.01 to 7.07 by just exchanging the "ecomb" application file. Since most (all??) of those who contributed to the "DIY improvements" of the instrument so far own older machines that initially had FW 7.0x installed and thus have the options and full bandwidth active allready, there won't be much motivation for them for further experimentation.

To "properly" hack a machine that came with F/W 8.01, the script of the 7.07 -> 8.01 update would have to be analyzed and checked if all the steps that are executed in there could be reversed. Only if this is possible, a downgrade to 7.0x would be an option that permits that application of the "old" hack and re-update to 8.01 with the standard update file.

I showed a method to enable the "test mode" with all the options, full frequency range and even 3MHz and 1Hz RBW active. I'm pretty sure that Siglent will lock this hole with the next F/W update. This modification and also the reverse functionality could be easily put in a script. But I also think that those who tamper with their machines should be knowing what they are doing. There's always a risk of bricking the instrument when messing with it in such a way and in my opinion (others may have a different one...), some basic knowledge of the operating system and what's going on internally will be the best insurance from fatal (to the instrument that is) errors. And I guess the information found in this thread makes it almost as easy as it gets to apply the improvements. It's all within the last four pages of the thread.

Just noticed, rf-loop made it even easier for the newbies... So be sure to cut&paste and save a copy of his post before he deletes it again (as he told he will -- sorry, too late...).

Cheers,
Thomas

[Bicurico]

TurboTom is correct:

Onwers of devices shipped with FW prior to P08.01 have had the opportunity to hack their device and ENABLE the missing options. These stay enabled after the P08.01 upgrade, except 3MHz and 1Hz RBW.

On top of that, by removing/renaming the already mentioned files, the P08.01 firmware will assume that it is in manufacturer mode, where ALL OPTIONS are enabled for an unknown serial number.

Conclusion:

1) The hack is permanent for older devices (if done correctly).
2) The hack is temporary for all devices (including new devices shipped with P08.01) on FW P08.01.
3) Next FW will probably invalidate the easy P08.01 hack.

History of hacks:

1) A "werewolf mode" FW appeared by accident on SIGLENT.COM, that enabled all options (P05)
2) The Telnet login/password was discovered
3) It was discovered that the timed options could be made permanent by putting silly values in them (this would lead to a non-permanent hack upon P08.01 upgrade)
4) It was discovered that all options could be autorised by changing missing options status to TRUE
5) Siglent ceased using a simple file listing TRUE/FALSE on options and instead uses the corresponding activation keys starting with P08.01
6) It was discovered that deleting/renaming 4 files, all options get authorised by default - as the device behaves as a stock device without serial number

Conclusion:

1) Everyone right now can enable all options
2) If a newer FW is released, do not upgrade, if you want maintain the hacked status
3) Existing users with hacked device are not that keen to do experiments, as the machine costs 1500 Euro (+VAT) and can be damaged by doing so
4) Siglent may not be "hunting" the hackers but are certainly closing the doors enabling the hacks
5) Did the hack increase sales? I would say yes (at least that was a big motivation for me to get the device, as it made it much more attractive). Will Siglent be permissive because of that? Nobody knows!
6) If you cannot be bothered to read a thread with JUST 9 PAGES, then you are not in a position to demand anything! 

Regards,
Vitor

[lz1pro]

Hello to all and Happy New Year!

I'm new in this forum. So I broke my new SSA3000X whit fw 08.01 .

After attempt to downgrade  to 7.07 whit copy file ecomb broke my NAND rootfs. The problem is on the screen I only see the Siglent logo and nothing happens after that.
I still have access via UART interface and U-boot.
Please, can anybody help to restore my NAND?

I have a backup copy of firmdata0 and /usr/bin/siglent/usr/backup/.

Regards
Yanko
 

[Bicurico]

How did you break the NAND rootfs? Please give as much info as possible.

@all: Somewhere (can't remember) I uploaded a tool that extracts the firmware contents to an almost regular ZIP archive. You can then uncompress most of it.

Doing so will show you 2-3 shell batchfiles (*.sh), one is called "siglentlib.sh". It kind of shows what is done during the upgrade.

Since you can decompress any firmware version, you can i.e. compare the differences between the P07.07 and the P08.01 upgrade.

Hope this helps.

Regards,
Vitor

[TurboTom]

@lz1pro

Could Siglent have a real problem here? Your failure mode appears very much similar to Jobber's: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1088378/#msg1088378 .
Yet, he reported that this happened on his instrument during the attempt to update from native 7.07 to 8.01. We should really keep an eye on this. Could it be possible that Siglent got hold of a series of faulty or counterfeit NAND flash chips? The error message is a clear indication of a faulty block in the NAND that should have been mapped out.
If your SSA is still in the warranty period, I would consider to have it replaced. It shouldn't be possible to trace your hacking attempts easily with this kind of error.

Good luck,
Thomas

[tautech]

@lz1pro

Could Siglent have a real problem here? Your failure mode appears very much similar to Jobber's: https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg1088378/#msg1088378 .
Yet, he reported that this happened on his instrument during the attempt to update from native 7.07 to 8.01. We should really keep an eye on this. Could it be possible that Siglent got hold of a series of faulty or counterfeit NAND flash chips? The error message is a clear indication of a faulty block in the NAND that should have been mapped out.
If your SSA is still in the warranty period, I would consider to have it replaced. It shouldn't be possible to trace your hacking attempts easily with this kind of error.

Good luck,
Thomas

Sadly this may not be the case, check the changelog for Version: P08.01:

5. After this firmware, do not support downgrade operation

http://www.siglentamerica.com/gjjrj-xq.aspx?id=4973&tid=15

This may be something we all need take note of.

[lz1pro]

How did you break the NAND rootfs? Please give as much info as possible.

@all: Somewhere (can't remember) I uploaded a tool that extracts the firmware contents to an almost regular ZIP archive. You can then uncompress most of it.

Doing so will show you 2-3 shell batchfiles (*.sh), one is called "siglentlib.sh". It kind of shows what is done during the upgrade.

Since you can decompress any firmware version, you can i.e. compare the differences between the P07.07 and the P08.01 upgrade.

Hope this helps.

Regards,
Vitor

It's a good idea to start play with "siglentlib.sh", but first I need to boot from an SD card to can access shell. I trying to find image to boot from SD card, but without success.
Any suggestion will be fine.

Regards,
Yanko

[KeBeNe]

Hello,

I have the same problem as lz1pro with the hack, device was delivered with 8.01.

regards

[Bicurico]

Neither of you describe what you guys did that led to breaking the root filesystem!

Please explain step by step what you did and when your device broke.

It won't be easy to recover, as I at least have no idea how to boot, flash or install a new rootfs.

I think the answer is somewhere in the siglentlib.sh file. But I guess you need a working fs to start with.

In worst case scenario you need to JTAG the flash, but for that you need a flash dump. This again needs someone with a good device to open it (losing warranty ans risking damage), in order to dump the flash contents.

Perhaps there is an easier way, but I guess nobody knows how to do that.

Is there anything you can do from the serial shell?

Also, I agree with TurboTom: just request a repair under warranty claiming that this happens during a firmware upgrade...

Regards,
Vitor

[lz1pro]

@KeBeNe
Hello here,
can you tell  when is done, after attempt to mount the rootfs or command like this "mount -o remount,rw /"?
It is will be helpful for another user that  tray to downgrade.
Hire is the link whit same problem on another device: http://linux-mtd.infradead.narkive.com/aO9xNZvZ/temporarily-remounting-rootfs-as-rw-leads-to-kernel-panic-on-reboot

Regards,
Yanko

[nctnico]

It is very important to use the 'sync' command before cycling power because otherwise data may not be written to the filesystem yet which leads to incomplete or missing files.

[janekivi]

Somewhere I posted 08.01 in zip format and decoded nsp_data_b too.
In img files I look with ubidump, maybe there is better utility for this.

08.01.zip firmware

[KeBeNe]

Hello,

I've done,

-FW 7.07 (Siglent FW-tool + 7zip)
-ecomb from FW7.07 to usb stick
-SSA3021X connected via Telnet (Putty)
-Login: root, PW: ding1234 - all ok
- first, backup "cp -R /usr/bin/siglent /usr/bin/siglent/usr/mass_storage/U-disk0/SSA3021x_backup" -ok
- then "mount rootfs -o remount, rw" -ok
- "cd/usr/bin/siglent" -ok
- "cp/usr/bin/siglent/usr/mass_storage/U-disk0/ecomb" -ok
- "sync" -ok
- "mount rootfs -o remount, ro" -ok
- "shutdown -r" -ok
As far as everything ok, device makes a reboot, downgrade to 7.07 but still not possible.

I thought, I switch times and again, so a complete reboot, then the device stopped at "Siglent", no more start


regards René

[ExplodingLemur]

Does anyone have the 7.07 firmware image converted to a zip file?  I want to compare the upgrade scripts.  I think an 8.01 device can be reverted to 7.07 with some manual file copies.

[ExplodingLemur]

KeBeNe, at this point can you still get a shell on the device?  If so I'll try to get you a set of instructions.

[TurboTom]

I think when messing around with ecomb, it is mandatory to first stop this process since that's the main application that's running in background.

Type "ps [enter]" to show the processes that are currently running on the system. Note the process number of ecomb, let's assume it's 374.
To terminate the process, type "kill 374 [enter]". After this, repeat the "ps" command to make sure ecomb is no longer running.

After this, it should be less risky to copy / replace it but anyway, my own experiments with this didn't show any substantial use of it, at least as long as the "firmdata0 hack" is available. Actually, I would recommend to just leave the root FS mounted read-only and don't mess with it anymore (of course this wouldn't help those who already have a broken machine).

All the best,
Thomas

[fact]

@janekivi What utility do you use to convert the ADS-file to a fully extractable zip?

[lz1pro]

Hi to all,

My SSA3000X is back to living.
So I want  to say BIG Thanks to TurboTom for help and support.
Thank you very much Thomas!

Regards,
Yanko

[tautech]

Hi to all,

My SSA3000X is back to living.
So I want  to say BIG Thanks to TurboTom for help and support.
Thank you very much Thomas!

Regards,
Yanko

Nice. 

It would be polite to further thank Tom, use the button.

[fact]

Experimenting with a 'clean" TI SD-card image gave this output:

Code: [Select]

P
U-Boot SPL 2013.01.01 (Jan 11 2016 - 14:14:06)
Start buzzer++
Stop buzzer--nand_init+++++
nand_init-----
>>spl_load_lcd_fpga++
LCD init()++
Lcd_Init()++
SetUpLCD()++
SetUpLCD()--
len=1228852, height=600, width=1024
Logo from nandflash: base=0x81000000; end=0x8112c01f; end-base=0x12c01f; rwsize=0x12c020; r=0x0
Lcd_Init()--
>>spl_load_lcd_fpga--


U-Boot 2013.01.01 (Jan 11 2016 - 14:14:06)

I2C:   ready
DRAM:  128 MiB
NAND:  256 MiB
MMC:   OMAP SD/MMC: 0, OMAP SD/MMC: 1
Using default environment

set_default_env::4309
Net:   <ethaddr> not set. Validating first E-fuse MAC
cpsw
Hit any key to stop autoboot
mmc0 is current device
SD/MMC found on device 0
reading uEnv.txt
** Unable to read file uEnv.txt **
reading uImage
** Unable to read file uImage **
** File not found /boot/uImage **
Could not find uImage
U-Boot#
So adding a valid uEnv.txt and uImage might do the trick.....

[KeBeNe]

@janekivi What utility do you use to convert the ADS-file to a fully extractable zip?

--> https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/?action=dlattach;attach=269048 + 7zip 16.4

[KeBeNe]

KeBeNe, at this point can you still get a shell on the device?  If so I'll try to get you a set of instructions.

Thanks for the offer, I have returned my device and get a new one, I would not want to destroy the guarantee seal.

Perhaps lz1pro can briefly describe how he has made it to bring his device back to life.

[lz1pro]

In my way to restore need to access SD card slot and UART interface. So there is no possibility to access them, without manipulate the warranty sticker.
Regards,
Yanko

[fact]

You could always drill a hole in the side for access. The sticker remains undamaged that way.