Siglent SDS5000X Oscilloscope Hack status - Dec 2021

[Detlef]

Allow me to introduce myself: I’m a retired engineer. My former profession has been software and hardware design, mostly for embedded microcontrollers, which is still my hobby, among general electronic design.

A few month ago, I have bought a Siglent SDS5054X oscilloscope. Although I don’t even need the built-in features, this instrument offers, for academic purposes, I am interested in some “enhancements”.

Well ladies and gentlemen, is there any functioning hack like the old Python script (which doesn’t work anymore) - and if so, how can I get it. And of course, I would keep it secret. My e-mail address is deposited with my account…

[IM3]

Let's see if the UART on my SDS5034X is accessible.

To do this, I will need to open the device first. I wanted to avoid damaging the 'calibration void' sticker. You can easily remove this sticker by following the instructions in the following thread:

https://www.eevblog.com/forum/blog/eevblog-799-how-to-remove-warranty-void-security-stickers/

First, let me emphasize that opening such devices should always be done in an ESD-safe manner. Be aware that even just lifting yourself off your chair can generate ten's of kilovolts of static charge. A tiny spark of 100 volts can damage your expensive equipment, sometimes not immediately, but maybe after a year due to latent damage. So, be careful!

That's why you need an ESD mat, ideally in a vibrant red color (RGB 255-0-0).

After removing the back cover, the power supply needs to be unscrewed first because of disconnect a few connectors. Only then can you access the main board.

It turns out the UART connector is not populated on the main board. There is no Jedec header present. Wires need to be soldered to the pads for GND, TX, and RX. Do not connect VCC, as this would introduce supply voltage from two sources and that is never a good thing.

So now you can connect a PC to the UART via a USB to Serial converter, and you'll have a connection. (Baudrate 115200, 8N1).

But then comes the real challenge: Username and Password.

There is a lot of old discussion on EEVBlog about this, and some believe there is only one password. That is definitely not the case. Passwords can change per device and even per firmware version.

For a long time, the username was 'root'. The password used to be a combination of the manufacturer's name and the device name, so here it would be 'siglent_sds5000x'.

Unfortunately, this is not the case anymore. I've tried at least 100 different combinations, but the story seems to end here quickly.

Does anyone have any suggestions?    (Except for screwing everything back together.)

[tv84]

If you want to crack it:

root:$6$qWDH15y1$JmmNaT8CddB4GCKIRtcel4fv5TavNr1CFZcYC2iLD6OaoVsDXIbV76S2JEmSBJ54kYrAreEBjWTJL8XIKUuu70:0:0:99999:7:::

[IM3]

Alright, the experiment with the UART has not been successful so far. Those pesky passwords!

The ultimate goal is still to liberate my SDS5000X.

I’ve tried experimenting with JTAG as well, but that’s not straightforward either. (for me)
A Lattice FPGA is visible in the JTAG communication. Thanks to tv84 for the support with that. This FPGA is located on the main board, right next to the JTAG header (see photos 1 and 2).

The processor on a separate PCB hasn’t been detected yet. (Xilinx XC7Z020) I need a mem-dump on that processor to get any further.

What I find strange on the processor board is the J2 connector. (foto 3 ) It’s labeled as NAND and JTAG. Does anyone have an idea what that might be? I will try to measure activity on those pins.

[44kgk1lkf6u]

You can see that the leftmost hole is ground.  I guess that it is intended for a jumper.  Shorting the center to the left makes the chip boot from the NAND flash.  Shorting the center to the right makes the chip boot from JTAG.  The right hole may not be connected at all, that is, it is only there to rest the jumper.  You can see if the hole is connected by measuring the diode drop from ground to it.  In the finished product there may be a resistor to make it always boot from the flash.  Some document for the chip should say how it works.