Author Topic: Hack of Sigllent spectrum analyzer ssa3021X? (Read 434172 times)

IzzMan · « **Reply #1050 on:** October 11, 2022, 01:00:16 am »

Warning, I updated my hacked 3021X(non+) with the latest firmware (V2.1.1.3R1). Everything that was working before still seems ok. But, now I have a dozen options permanently enabled that showed up in the gui, but don't work! And worse, if I press Mode, I can get to the working modes, but trying to go back to spectrum analyzer locks up the system, requiring a reboot.

rf-loop · « **Reply #1051 on:** October 11, 2022, 06:22:42 am »

Quote from: IzzMan on October 11, 2022, 01:00:16 am

Warning, I updated my hacked 3021X(non+) with the latest firmware (V2.1.1.3R1). Everything that was working before still seems ok. But, now I have a dozen options permanently enabled that showed up in the gui, but don't work! And worse, if I press Mode, I can get to the working modes, but trying to go back to spectrum analyzer locks up the system, requiring a reboot.

Except that it was not latest update version for your SSA3021X !!!

There is clear information/warning about this:
These both pdfs are included in update zip.
From version history pdf:_

Quote

V2.1.1.3R1
2022/6/10
Notice:
This firmware must be upgraded from v2.1.1.1 or later. If your analyzer has an earlier version, don’t
use this FW to update.

And from Update instructions pdf:

Quote

Notes：
1. During the updating, do not cut off the power or pull out the U-disk.

2. If your analyzer has an earlier version（V1.x.x.x）, it can not upgrade to” V2.x.x.x” version and the “V2.x.x.x” version also can not downgrade to the earlier version

You have updated the FW but totally ignored these all warnings.

Whenever anybody is designing to do update what ever machine, it would be a good idea, or better say - mandatory to read all the relevant information BEFORE do anything else.
It's famous: RTFM and it's better to do it beforehand rather than afterwards.

ETA:
But also:

My opinion is that it is better that also Siglent write some note or other sign about this directly to download side:
https://www.siglenteu.com/service-and-support/firmware-software/spectrum-analyzers/#ssa3000x-series
https://siglentna.com/service-and-support/firmware-software/spectrum-analyzers/#ssa3000x-series

Because there it just looks like normal latest update to all SSA3kX and as we know that today peoples do not read manuals or instructions. (as can see in many places and many situations wherever)

Bicurico · « **Reply #1052 on:** October 11, 2022, 07:03:14 am »

While it is not impossible to restore the FW, you should first try to get free help from Siglent. I find it unacceptable that the upgrade run through without a check to determine prerequisites.

The new FW is obviously for a unified FW/HW platform, not suitable for the original SSA3000X HW platform.

Contact your dealer and see what support they offer. They should send you instructions and a special image for USB that restores the original FW. Let us know how this rolls out.

If the refuse or want you to pay, we can try a different route. But this is an unofficial way that would definitely void your warranty and may not work, as this is untested territory.

And yes, read the instructions before doing something like this. There were warnings all over to not do this upgrade on older versions.

rf-loop · « **Reply #1053 on:** October 11, 2022, 07:16:09 am »

Perhaps, in this special case, better to call directly to Siglent NA office for support. Some dealers know only prices and how to send parcel...

And as Bicurico said: Please do not try anything until you get official instructions from Siglent for recover back to V1.x.x.x FW versions.

tv84 · « **Reply #1054 on:** October 11, 2022, 09:29:06 am »

Quote from: IzzMan on October 11, 2022, 01:00:16 am

Warning, I updated my hacked 3021X(non+) with the latest firmware (V2.1.1.3R1). Everything that was working before still seems ok. But, now I have a dozen options permanently enabled that showed up in the gui, but don't work! And worse, if I press Mode, I can get to the working modes, but trying to go back to spectrum analyzer locks up the system, requiring a reboot.

Well, in theory, you shouldn't have been able to update as the new package has a Prod_ID = 11413. I think Siglent tried to ensure some protection there.

Nonetheless there could be some bug in their implementation OR something in your own setup that somehow disabled that basic protection.

When you say a "hacked 3021X", you mean with proper licenses or in "pro_mode" with files removed and S/N = XXXXXX... ?

IzzMan · « **Reply #1055 on:** October 11, 2022, 10:08:50 pm »

Well, don't I feel stupid. I'm normally pretty good about checking documentation and usually read the Firmware Release Notes. Anyway, my unit is in "pro-mode" with files removed and S/N = XXXXXX. My distributer told me they only distribute, not service. So, I filled out an online Siglent message. I'll let you know how it goes. Thanks guys.

dschiedsch · « **Reply #1056 on:** November 08, 2022, 05:00:07 pm »

Quote from: TechMasterJoe on September 20, 2022, 07:11:08 am

just ordered a SSA3032X-R anyone want hardware photos when it gets here ?
I'm hoping for a 7.5ghz unlock

It's possible.
Credit goes to tv84
Vna also works up to that frequency.

Mharris27 · « **Reply #1057 on:** November 14, 2022, 10:10:14 pm »

Hello everyone. I have a SSA3021X (non plus) with the 2.1.1.1 FW from the factory. It is stock and I want to enable all of the available options. The TG came enabled factory and currently is. I have read thru all of the threads in this topic and most in the other relevant topic. I gotta say..I am a bit confused so lets start here.

I cannot Telnet into this unit with PuTTY or with windows telnet at the cmd prompt. Does the Telnet script work or not?
Has anyone actually been able to "hack" a 3021X (non plus) unit with the most current FW? If so then how did you get access? Lol

My brain is swimming in too much info...most of it irrelevant I think.

Thanks:
Mike

IAmBack · « **Reply #1058 on:** November 14, 2022, 10:15:12 pm »

Quote from: Mharris27 on November 14, 2022, 10:10:14 pm

Hello everyone. I have a SSA3021X (non plus) with the 2.1.1.1 FW from the factory. It is stock and I want to enable all of the available options. The TG came enabled factory and currently is. I have read thru all of the threads in this topic and most in the other relevant topic. I gotta say..I am a bit confused so lets start here.

I cannot Telnet into this unit with PuTTY or with windows telnet at the cmd prompt. Does the Telnet script work or not?
Has anyone actually been able to "hack" a 3021X (non plus) unit with the most current FW? If so then how did you get access? Lol

My brain is swimming in too much info...most of it irrelevant I think.

Thanks:
Mike

I suggest not to fiddle with telnet. There is better way. Safer, quicker, better...

Bicurico · « **Reply #1059 on:** November 15, 2022, 09:17:12 am »

There is no knowledge on this forum regarding the new models with 2.x.x.x firmware.

I suspect that these models might have a revised HW platform, shared with the SSA/SSA-P/SSA-R/SVA product line. This does not mean that generic crossgrade is possible, as some product lines have different modules built-in:

SSA: no touch screen
SSA-P/SVA: share the same HW and can be crossgraded
SSA-R: adds a realtime board

Also, some models go up to 1.5GHz, 3.2GHz or 7.5GHz. Again, they have different HW built-in.

It seems that the NEW 1.5GHz models now use the same HW as the 2.1/3.2GHz models and can be bandwidth upgraded, but that is just speculation.

If I remember correctly, the SSA-R can always be upgraded to 7.5GHz, but I am not sure about that one.

Conclusion:

1) If you have the new style SSA with FW 2.x.x.x, then do NOT flash an older 1.x.x.x FW or you will definitely brick your device! The FW upgrade PDF explicitly tells you not to do it. Why the FW does it anyway is beyond my comprehension and is a plain bug.
2) If you want to hack your new device, just use the keygen that has been published on this forum. It will allow you to get full options in a "clean" way.
3) If you read the threads again, you will find a secret SCPI command that enables telnet on SSA-P, SSA-R and SVA devices. I suspect it will work on your device, too. I am not just telling you what command it is, because i don't remember (I have an old SSA).

Mharris27 · « **Reply #1060 on:** November 16, 2022, 10:01:56 pm »

Quote from: Bicurico on November 15, 2022, 09:17:12 am

There is no knowledge on this forum regarding the new models with 2.x.x.x firmware.

I suspect that these models might have a revised HW platform, shared with the SSA/SSA-P/SSA-R/SVA product line. This does not mean that generic crossgrade is possible, as some product lines have different modules built-in:

SSA: no touch screen
SSA-P/SVA: share the same HW and can be crossgraded
SSA-R: adds a realtime board

Also, some models go up to 1.5GHz, 3.2GHz or 7.5GHz. Again, they have different HW built-in.

It seems that the NEW 1.5GHz models now use the same HW as the 2.1/3.2GHz models and can be bandwidth upgraded, but that is just speculation.

If I remember correctly, the SSA-R can always be upgraded to 7.5GHz, but I am not sure about that one.

Conclusion:

1) If you have the new style SSA with FW 2.x.x.x, then do NOT flash an older 1.x.x.x FW or you will definitely brick your device! The FW upgrade PDF explicitly tells you not to do it. Why the FW does it anyway is beyond my comprehension and is a plain bug.
2) If you want to hack your new device, just use the keygen that has been published on this forum. It will allow you to get full options in a "clean" way.
3) If you read the threads again, you will find a secret SCPI command that enables telnet on SSA-P, SSA-R and SVA devices. I suspect it will work on your device, too. I am not just telling you what command it is, because i don't remember (I have an old SSA).

Update:
Big thanks to @IAmBack and you for the help. I now have all available options enabled permanent. Next will be to find the secret SCPI command so that I can try to increase the BW to 3.2ghz. For what its worth the HW 00.00.00 as shown in the system info section.

Thanks again guys.
Mike

killingtime · « **Reply #1061 on:** November 16, 2022, 10:41:13 pm »

Is this the SSA3000X non Plus thread?

tautech · « **Reply #1062 on:** November 16, 2022, 11:02:46 pm »

Quote from: killingtime on November 16, 2022, 10:41:13 pm

Is this the SSA3000X non Plus thread?

Back when this thread was started the Plus didn’t exist but since they have been lumped in together which does create some confusion. They operate almost identically however the options and feature set are slightly different.

Bicurico · « **Reply #1063 on:** November 18, 2022, 02:59:21 pm »

Quote from: Mharris27 on November 16, 2022, 10:01:56 pm

Update:
Big thanks to @IAmBack and you for the help. I now have all available options enabled permanent. Next will be to find the secret SCPI command so that I can try to increase the BW to 3.2ghz. For what its worth the HW 00.00.00 as shown in the system info section.

Thanks again guys.
Mike

You need to generate keys for option: 3032

There is no SCPI command to increase the bandwidth.

Mharris27 · « **Reply #1064 on:** November 20, 2022, 02:00:35 am »

Quote from: Bicurico on November 18, 2022, 02:59:21 pm

Quote from: Mharris27 on November 16, 2022, 10:01:56 pm
Update:
Big thanks to @IAmBack and you for the help. I now have all available options enabled permanent. Next will be to find the secret SCPI command so that I can try to increase the BW to 3.2ghz. For what its worth the HW 00.00.00 as shown in the system info section.

Thanks again guys.
Mike

You need to generate keys for option: 3032

There is no SCPI command to increase the bandwidth.

Ahh..okay. I will try that first thing in the AM eastern time. Thanks!

Mike

Update: I tried the 3032 key but it shows invalid when entered. I even tried the ALL option. No luck with the frequency expansion.

epsilon888 · « **Reply #1065 on:** November 26, 2022, 06:10:04 pm »

Hi. Perhaps I can help you.

Go to your system info screen, and give me your "HOST ID" number.

StefFR · « **Reply #1066 on:** December 19, 2022, 01:31:51 pm »

hello,

thanks to this forum, I was able to modify my SSA2031X (year 2018, with FW version 1.2.8.5a) to obtain all the options and 3.2Ghz 😃

now I would like to update it with the latest version of Siglent compatible: 1.3.9.8

can I follow the classic update process and will I keep the modification made to jailbreak the device?

Thanks for your help
:-)

tautech · « **Reply #1067 on:** December 19, 2022, 06:30:05 pm »

Quote from: StefFR on December 19, 2022, 01:31:51 pm

hello,

thanks to this forum, I was able to modify my SSA2031X (year 2018, with FW version 1.2.8.5a) to obtain all the options and 3.2Ghz 😃

now I would like to update it with the latest version of Siglent compatible: 1.3.9.8

can I follow the classic update process and will I keep the modification made to jailbreak the device?

Thanks for your help
:-)

Yes, and welcome to the forum.

uski · « **Reply #1068 on:** December 20, 2022, 09:24:59 am »

Hi there!

I have an SSA3021X+ on order, Christmas gift to myself

I have been trying to educate myself on the way to convert it to a SVA1032X.

So far, what I have found is this.
1) Need to do a backup with this script : https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3559946/#msg3559946
2) Then enable telnet : https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3528256/#msg3528256
3) Then crossflash with this process : https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3563577/#msg3563577

Seems like there is a simpler process here: https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3518544/#msg3518544

I believe that we also now need to restore the serial number, and use the Python script to generate the ALL license, as the final step.

Calibration data: https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg4355749/#msg4355749

Is there something I am missing? Trying to make sure I won't brick my unit, and also that I would be using the latest procedure because it seems like the newest firmware is different?

Thanks!

uski · « **Reply #1069 on:** December 22, 2022, 05:39:06 am »

Has anyone been able to successfully crossflash a SSA3021X Plus that came factory with firmare 3.2.2.5.0 ?

I can use DEBTTT SCPI command to get telnet access. I can reflash SSA firmware version 3.2.2.5.0 over 3.2.2.5.0.
However, I cannot downgrade it to SSA version 3.2.2.4.0, and after changing the static ID from 11411 to 11403, I cannot crossflash to any SVA version either !!!

All I get in these situations is a "Upgrade fail" message at the bottom of the screen.

It is possible I am doing something wrong.... but I doubt it since I was able to flash 3.2.2.5.0 over itself, but not 3.2.2.4.0, showing that I can successfully edit the static_id.

Any idea?

[EDIT] The only thing I was able to flash is the newer SSA3021X Plus firmware 3.2.2.5.1R1. It seems to me that Siglent has done something to prevent crossflash AND prevent downgrade to 3.2.2.4.0 or below.

[EDIT2] Seems like other users had the same issue

EDIT: SOLVED: Instructions I found above were inapplicable. Starting from 3.2.2.4.0 Siglent changed the product ID. I used 11410 instead of 11403 and was able to crossflash. Now continuing the work and will post a summary of my steps later.

uski · « **Reply #1070 on:** December 22, 2022, 07:16:00 am »

My logbook. No warranties whatsoever, only proceed at your own risk. I found it is NOT for the faint of the heart.

Initial state: brand new SSA3021X Plus with firmare 3.2.2.5.0

---

STEP 1: Backup the device

Download SSA3000X+_backup_NAND+mem+firmdata0_11411.zip from https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3559946/#msg3559946

Format new USB disk as FAT32 with mkfs.vfat or similar, extract ADS file on disk.
Go to System menu, launch ADS file. Wait for system to reboot.
Once system is rebooted, delete ADS file from USB disk.
Compress all other files into a zip archive (I called mine initial_factory_as_delivered.zip), store in another secure location, and delete from USB drive.
USB drive should now be empty. You have successfully created a backup of your instrument.

---

STEP 2: Enable telnet

Connect the instrument to your home network (with DHCP) and find what IP it has (ask your router).

From https://www.eevblog.com/forum/testgear/hack-of-sigllent-spectrum-analyzer-ssa3021x/msg4233178/#msg4233178 follow the specific instructions:

Quote

Enable telnet and login
- telnet to port 5024 (SCPI) and send the command 'DEBTTT' followed by enter on your keyboard (this should start a telnet server on port 23) and close this telnet session
- telnet to port 23 and log in as 'root', pw 'ding1234

Telnet to the instrument (telnet ip 23) and login

From this step onwards, you may have to repeat this STEP 2 as necessary to reenable telnet, as it may get disabled during various reboots and reflashes. If you get a connection refused on port 23, just redo the DEBTTT part.

---

STEP 3: Do a manual backup

Reinsert the now empty FAT32 USB drive to the instrument

Do a backup (per https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3563577/#msg3563577) :

Quote

cd /
cp -R /usr/bin/siglent/usr/backup /usr/bin/siglent/usr/mass_storage/U-disk0/SA-backup
cp -R /usr/bin/siglent/usr/config /usr/bin/siglent/usr/mass_storage/U-disk0/SA-config
cp -R /usr/bin/siglent/usr/usr /usr/bin/siglent/usr/mass_storage/U-disk0/SA-usr
cp -R /usr/bin/siglent/usr/vnacalikitdata /usr/bin/siglent/usr/mass_storage/U-disk0/SA-vnacalikitdata
cp -R /usr/bin/siglent/firmdata0 /usr/bin/siglent/usr/mass_storage/U-disk0/SA-firmdata0
sync
umount /usr/bin/siglent/usr/mass_storage/U-disk0

Then immediately remove the USB drive, put it back to your computer, and do another ZIP file in a secure location (called mine initial_factory_as_delivered_manual.zip)
Then erase again the content of the USB drive.

You have now successfully performed a higher level, easier to access backup of the files in your instrument

---

STEP 4: Flash latest firmware

The current consensus is to flash the latest firmware before performing the hack. I would caution, before doing so, to check the latest posts in the various threads to make sure that the latest firmware, whatever it is, still allows the hack.

In my case, I flashed to https://int.siglent.com/upload_file/zip/firmware/Spectrum_analyzer/SSA3000X%20Plus_V3.2.2.5.1R1_EN.zip

Flash and wait for reboot. Check version, should be 3.2.2.5.1R1.

---

STEP 5: Change product ID, to accept SVA firmware instead of SSA

Recently, for versions 2.2.4.0+, Siglent changed the product ID. It is no longer 11403, it is 11410, per https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/msg1364981/#msg1364981

Copied from https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg3563577/#msg3563577 but updating the ID accordingly

Quote

1) Open telnet
telnet <SSA IP address> 10101 (for example, Windows terminal Win+R, CMD works)
2) edit /usr/bin/siglent/config/NSP_config_upgrade_info.xml to change ProductID:
replace
<upgrade_static_id>11411</upgrade_static_id>
with
<upgrade_static_id>11410</upgrade_static_id>
3) Finalise changes and reboot
sync && reboot

---

STEP 6: Crossflash to SVA

Flash unmodified, official SVA firmware https://int.siglent.com/upload_file/zip/firmware/Spectrum_analyzer/SVA1000X_V3.2.2.5.1R1_EN.zip

Extract ADS to the empty USB flash drive
Insert flash drive
Then flash and pray

If all goes well, unit will reboot. Check device info page, if all goes well you have a new option called "VNA" licensed "Permanent"

You can press the Mode hardkey and you should also have a Vector Network Analyzer option. Nice!
But the bandwidth is still limited to 2.1GHz...and your unit still thinks it is a SSA3021X Plus.

---

STEP 7: Model edit and prepare bandwidth hack

mount -o remount,rw /dev/ubi2_0 /usr/bin/siglent/firmdata0
cd /usr/bin/siglent/firmdata0

vi NSP_trends_config_info.xml

As below

Code: [Select]

<?xml version="1.0" encoding="UTF-8"?>
<nsp_trends_info_root>
	<device>
		<language>english</language>
		<pid>0x1301</pid>
		<vid>0xf4ec</vid>
		<product_type_1>SVA1032X</product_type_1>
		<manufacturer>Siglent</manufacturer>
		<Support_Touch_Flag>1</Support_Touch_Flag>	
		<Support_VXI11_Flag>1</Support_VXI11_Flag>
		<file_prefix>CP_</file_prefix>
	</device>
</nsp_trends_info_root>

vi NSP_sn_bandwidth.xml

As below (make sure to put your serial number):

Code: [Select]

<?xml version="1.0"?>
<nsp_system_info_root>
        <device>
                <system_information>
                        <serial_number>
                                <chip>0123456789</chip>
                        </serial_number>
                </system_information>
        </device>
        <serial_number>SSA3PCxxxxxxxx</serial_number>
</nsp_system_info_root>

sync&&reboot

Now you have a SVA1032X in the System info menu.

---

STEP 8: Add options, liberate the bandwidth

Go to System Info. Note Host ID. Put it into the script here https://www.online-python.com/PX3v0J8nbs
Uncomment SVA1000X into the script.

Launch the script.

Add option 3032 using "Load Option" menu item. Unit will reboot and you will get 3.2GHz.
Add option ALL. Unit will reboot and you will get all other options.

Note that it takes several seconds, once you validate, to check the license. Be patient.

Also note that I just had trial for AMK EMI DMA AMA and permanent for VNA and TG. But now I have an extra option DTF that appeared, which is Time Domain Reflectometry.

---

STEP 9: Install VNA calib data

Extract files in cali.zip from post https://www.eevblog.com/forum/testgear/siglent-sva1015x-1-5ghz-spectrum-vector-network-analyzer-(coming)/msg3707803/#msg3707803 to the root of the USB disk

mount -o remount,rw /usr/bin/siglent/firmdata0/
cp /usr/bin/siglent/usr/mass_storage/U-disk0/na_?p /usr/bin/siglent/firmdata0/cali/
sync && reboot

WARNING: I don't know where these files come from. It is likely that the instrument won't be perfectly calibrated. If that is an issue, maybe you can find a proper calibration lab, and ask them to calibrate your unit as if it was SVA1032X, but make 100% sure they don't send your unit to Siglent...

--

STEP 10: Verify that your unit has the VNA cable inside

Set the instrument to VNA mode, Lin/Phase Smith chart.
Connect a 50 ohms load. Curve should move to the center of the screen, roughly.

Congratulations, enjoy your new VNA.

My recommendation is to keep ALL files, inluding the backups, on a microSD card in a small ESD-proof bag, that you tape on the side of the instrument. You will thank yourself (and me) in a few years.

Thank you Siglent, and those who made this possible. I would never do that in my lab at work. But for hobbyists... this is awesome.
I hope my post will help new users.

RoV · « **Reply #1071 on:** December 22, 2022, 05:16:14 pm »

Quote from: uski on December 22, 2022, 07:16:00 am

STEP 9: Install VNA calib data
....
WARNING: I don't know where these files come from. It is likely that the instrument won't be perfectly calibrated. If that is an issue, maybe you can find a proper calibration lab, and ask them to calibrate your unit as if it was SVA1032X, but make 100% sure they don't send your unit to Siglent...

I believe those files simply hold the default calibration at startup, which is normally referred to the front panel N connectors. It is not particularly useful in my opinion, because it is old and normally overridden by the last saved (and applied) user calibration.

Besides, in my knowledge, no independent laboratory will replace those files: calibration labs check performance against specifications, while adjustments can be done only by Siglent. But they are normally required only in case of repair, with replacement of components.

uski · « **Reply #1072 on:** December 23, 2022, 06:15:21 am »

Good to know, thanks!

What really tripped me up is the change of product IDs. It is really not well mentioned in the other posts, which prompted me to publish my howto.
11403 is no more, for these new instruments with newer firmwares.

Yansi · « **Reply #1073 on:** December 26, 2022, 11:31:14 pm »

Thank you uski for you very helpful summary.

Just in time before the discounts end, have ordered SSA3021X-P. Noticed the very nice prices just days ago. Been on a lookout for a new SA already, I think this should just fulfill my needs. Will try your how to and report back in a week or two.

tv84 · « **Reply #1074 on:** December 27, 2022, 05:00:44 pm »

Quote from: uski on December 22, 2022, 07:16:00 am

I found it is NOT for the faint of the heart.

Initial state: brand new SSA3021X Plus with firmare 3.2.2.5.0

No so. Currently all of this can be done by people with pacemakers or even TAH's

but many continue to not read the latest developments... this thread is only 43 pages long and most of them only repeat what has already been said obscuring important details.

The easiest path is here.


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: Hack of Sigllent spectrum analyzer ssa3021X? (Read 434172 times)

Share me