Siglent SDS2000X Plus Hack

[widlokm]

Hi,
I'm playing around with the scope for a few days, and not everything works as before. Here is a quick summary:
Scope: SDS2104X plus, firmware: 1.5.2R3, hardware: 05-05.uboot: 5.4
- All license keys generated by python script are valid.
- It is not possible to get "telnetd" running with scpi "SHELLCMD" nor with "siglent_device_startup.sh" file on USB stick.
 
To run telnet I had to get serial console (soldering on mother-borad involved) and work from there. Having full access I've first tried to change root password with passwd and it worked (had to remount /usr/bin/siglent partition as rw before), however telnet login seems strange. I could login via network as "root" and my new password was accepted, but I did not get full root privileges. Skipping password checking with "telnetd -l /bin/sh" however did the trick.
I also tried some ways (found on other threads) to run telnetd permanently, but nothing worked. Finally I modified "/usr/bin/siglent/product_rcs_begin.sh" by adding "/usr/sbin/telnetd -l /bin/sh" line (of course also remount,rw /usr/bin/siglent is needed).
 
One more funny thing: there are some "options_***_times.txt" files in "/usr/bin/siglent/usr/usr", the seem to contain number or left uses of all options. If someone does not want to add permanent licenses it is very likely that modifying these files will do the trick.

 And finally a question: there is a "Developer options" submenu in "Utility -> Maintenance", that asks for a password. What is is menu? Is password known? I've tried my own root password set by passwd before, but no luck.

Best Regards,
Michael W.

[tv84]

And finally a question: there is a "Developer options" submenu in "Utility -> Maintenance", that asks for a password. What is is menu? Is password known? I've tried my own root password set by passwd before, but no luck.

Try "siglentcd" and report back.

[widlokm]

Success, Thank You!!

 It gives access to temperature monitoring, boot times counter, some calibration data manipulation and FSP debug (don't know what it does). Anyway it is nice to have full access to the scope.

[markus_jlrb]

And what is more important - the possibility to save factory CAL data.

tnx2tv84

Markus

[cragen]

Does anyone know of a file I can modify to add a boot-time invocation of telnetd, that will survive a firmware update on an SDS2000X from V1.3.9R6 to V1.5.2R3?

I'd like to move to the new firmware, but rely on the telnet interface for various mods.  Like monitoring device temps to calibrate a PWM fan replacement, maintain the clock on localtime with ntpd, etc.

I'd prefer not to solder on a UART header...

Thanks,
Craig

[tautech]

Does anyone know of a file I can modify to add a boot-time invocation of telnetd, that will survive a firmware update on an SDS2000X from V1.3.9R6 to V1.5.2R3?

I'd like to move to the new firmware, but rely on the telnet interface for various mods.  Like monitoring device temps to calibrate a PWM fan replacement, maintain the clock on localtime with ntpd, etc.

V1.5.2R3 is mainly housekeeping of minor production changes whereas V1.5.2R1 has fixes and enhancements for numerous issues:

Measurement enhancement - Added setup/hold time: tsu@R, tsu@F, th@R, th@F
Optimized UI
Added SCPI commands for Measure Cursors and clearing measure items in Simple mode
Supported LXI (only with the Uboot-OS Version 5.4)
Supported time zone setting
Fixed several bugs
Webserver doesn’t show instrument UI if the scope reboot with a wireless mouse connected
Incorrect “Recall”icon in the File Manager
Scope freezes with AWG enabled and measure cursor on rise time
IP setting of AWG in Bode Plot not remembered after reboot
Network storage only works for SMB1.0
MEAS:SIMPle:ITEM\sOVSN,ON does not work as expected
Roll time incorrect at 1ks/div and 20kpts
Raw data not consistent in x and sinx/x interpolation modes
Math: Dx parameter of Derivation cannot be increased by universal control
Incorrect FFT sample rate

https://int.siglent.com/upload_file/zip/firmware/Oscilloscope/SDS2000X%20Plus_V1.5.2R1_EN-2.zip
However its always best to install the latest version.

[cragen]

Yes, I'd read the release notes, and it looked like a worthwhile update.  I also noted from other posts, that I would loose the "siglent_device_startup.sh" trick via USB stick, and I would really like to maintain shell access to the scope.  Thus, wondering if there is a means to make a persistent file-system change prior to updating.

Craig

[MathWizard]

I must say I'm loving this scope so far. I got the legit 200MHz upgrade when I bought the sds2104x+ a few months ago. So of all the things I would like to unlock, can I unlock the full 500MHz BW ? I've never used a scope over 200MHz, so I'd love to try it out.

I've read through some of these 2000x+threads before, and I've unlocked my PSU, AWG, and sds1104x-e=>1204. How hard is it to unlock these? What page are the key instructions on ?

[tautech]

Same process, same script. 

[Martin72]

What page are the key instructions on ?

Simply use the search function in this topic.

[MathWizard]

Hmm my probes are only rated for 100 and 200MHz, and I seem to remember 500MHz probes and actives probes costing a fortune. I forgot about that part.

[MarkusAJ]

Hmm my probes are only rated for 100 and 200MHz, and I seem to remember 500MHz probes and actives probes costing a fortune. I forgot about that part.

Do you really have a needs to use probes with HF > 200Mhz? Most people use appropriate terminated coax cable.
I bought the SDS2104X+ in Dec 2022, it was one of my best purchases in last 20 years. Unlocking all futures using the Python script was done in ~20 minutes.

[KungFuJosh]

Hmm my probes are only rated for 100 and 200MHz, and I seem to remember 500MHz probes and actives probes costing a fortune. I forgot about that part.

Not as bad as you think. And there's a project with a 2GHz active probe being developed by a user here for under $200.

Also, this was done with a coax cable:

[MathWizard]

Yeah I don't have any coax besides scrap cable TV coax, which I can't connect to anyways, and yeah it's probably 70ohm or something.

I have to get all that stuff and and NanoVNA this winter, but after some computer upgrades. There's a refurbished  SVA3021X on sale now, I'd love to get that, but I better learn on a NanoVNA, and I want those PC upgrades 1st.

Yeah I've seen that probe project, I would get 1. I was going to try making some real cheap/simple HF probe, I have to find Dave EEV video.


I have a few semi-broken 100-200MHz probes. I wonder what I can do with them.

[KungFuJosh]

The source in my screenshot is a TinySA Ultra. It's pretty cute, but I got it because of TEAS, not because I have a use for it beyond that png. 🤣

[tautech]

There's a refurbished  SVA3021X on sale now, ...........

No such model. 

I have a few semi-broken 100-200MHz probes. I wonder what I can do with them.

Scope probes use a lossy coax which wouldn't be much use for the very low signal levels an analyzer can resolve.

[sy]

Hello, I have a SDS2104x+ (100MHz) upgraded to SDS2504X+ (500MHz) with the hack, however, I am unable to upgrade my software options. I have used the generated codes for my unique ScopeID, SerialNumber and Model, but the scope returns "The data is invalid!". Any suggestions? Thanks.

Edit: Additionally, I have tried using the SCPI command: LCISL optioncode hexkey, to no avail. Restarting the scope before entering a new code and downgrading to the original 100MHz to enter the keys.

Finally figured it out after trying things for ages until finally some software option keys worked.

Previously, I was using a script that required the option keys to be generated using serial number. I changed script to the one provided by @Elasia, and boom it worked.

Leaving this here for anyone else that comes across a similar situation. Note all software keys are lowercase input through UI. I put the keys in while on my original scopes bandwidth (not sure if that changed anything at all). 

import hashlib

SCOPEID = '0000000000000000'
Model   = 'SDS2000X+'

bwopt = ('25M', '40M', '50M', '60M', '70M', '100M', '150M', '200M', '250M', '300M', '350M', '500M', '750M', '1000M', 'MAX', 'AWG', 'WIFI', 'MSO', 'FLX', 'CFD', 'I2S', '1553', 'PWA', 'MANC', 'SENT')

hashkey = '5zao9lyua01pp7hjzm3orcq90mds63z6zi5kv7vmv3ih981vlwn06txnjdtas3u2wa8msx61i12ueh14t7kqwsfskg032nhyuy1d9vv2wm925rd18kih9xhkyilobbgy'

def gen(x):
   h = hashlib.md5((
      hashkey +
      (Model+'\n').ljust(32, '\x00') +
      opt.ljust(5, '\x00') +
      2*((SCOPEID + '\n').ljust(32, '\x00')) +
      '\x00'*16).encode('ascii')
   ).digest()
   key = ''
   for b in h:
      if (b <= 0x2F or b > 0x39) and (b <= 0x60 or b > 0x7A):
         m = b % 0x24
         b = m + (0x57 if m > 9 else 0x30)
      if b == 0x30: b = 0x32
      if b == 0x31: b = 0x33
      if b == 0x6c: b = 0x6d
      if b == 0x6f: b = 0x70
      key += chr(b)
   return key.upper()
   
for opt in bwopt:
   print('{:5} {}'.format(opt, gen(SCOPEID)))

[Iwnug]

Hello, I have a SDS2104x+ (100MHz) upgraded to SDS2504X+ (500MHz) with the hack, however, I am unable to upgrade my software options. I have used the generated codes for my unique ScopeID, SerialNumber and Model, but the scope returns "The data is invalid!". Any suggestions? Thanks.

Edit: Additionally, I have tried using the SCPI command: LCISL optioncode hexkey, to no avail. Restarting the scope before entering a new code and downgrading to the original 100MHz to enter the keys.

Hello, i have the same thing as hardware here.
Strange is: I have hacked it to a SDS2204X + via Touchpanel - but can't get back. So i tried it via the Webfrontend with SCPI,
there it worked. Also up to 500MHz SDS2504X + in SystemInfo.
A day later i tried to toggle again, with the stored keys that i got by the script, and again is it not working.

Maybe there is a counter or something else that prevents from switching down and up?

BTW: I have to thank many users here for all the informations that i've found here!

[cte]

I might be wrong, but AFAIK "downgrading" (removing software options) via SCPI is not supported.

[tv84]

I might be wrong, but AFAIK "downgrading" (removing software options) via SCPI is not supported.

But it should be possible to downgrade BW via MCBD command.

[axantas]

I might be wrong, but AFAIK "downgrading" (removing software options) via SCPI is not supported.

But it should be possible to downgrade BW via MCBD command.

Up- and downgrade Bandwidth via MCBD command IS possible. I did it both ways.
>> it has to be done step by step 100/200/350/500. 100>350 might work directly - 100>500 does not work in one step.

[tautech]

I might be wrong, but AFAIK "downgrading" (removing software options) via SCPI is not supported.

But it should be possible to downgrade BW via MCBD command.

100% for my personal explorations…….
This is my first test after generating licenses to be sure you can.
Normally not required other than a double check the script generates the correct ones.

[BillyO]

>> it has to be done step by step 100/200/350/500. 100>350 might work directly - 100>500 does not work in one step.

100 > 350 > 500 seems to work, but 100 > 500 is accepted but does not produce a viable result.

But it should be possible to downgrade BW via MCBD command.

Yes, this works.

[Iwnug]

Hello,

now that i am at home i tried it again:
It works, not sure what was wrong bevor.

Two things: i can change 100MHz to 500MHz in one step
and the second thing is 
it works only via Network/Webbrowser, not via entering the codes via touchscreen.

iwnug

[BillyO]

Two things: i can change 100MHz to 500MHz in one step

Yes you can, but your scope will not work properly at higher frequencies.

Would probably have been best to follow the advice of many that have been down that path and back before.  Now you'll have to go back to 100MHz and do it properly to get a full 500MHz +++.

I think you can skip the 200MHz, but you definitely cannot skip the 350MHz and still have things work out.