Siglent SDS5000X Oscilloscope Hack status - Dec 2021 - Page 1
Forum section: electronics / testgear

author: killingtime
author_rank: Regular Contributor
timestamp: December 18, 2021, 01:53:12 am
content: Hi,Does anyone know what the 'upgradeability' status is of SDS5000 series scopes, as of Dec 2021?Looking at the optional software decoding and triggering.Also, can anyone confirm that probe attenuation factor (x10 etc) is still configurable from the UI and is not set via the contacts surrounding the analogue inputs on the front? From the UI screenshots I've seen, it looks so, but the manual doesn't say.Thanks.

author: tautech
author_rank: Super Contributor
timestamp: December 18, 2021, 03:10:28 am
content: AFAIK the py scripts still work just fine with the latest FW.Nothing has changed with input attenuation menus, manual, custom and autosense work as they always have.

author: killingtime
author_rank: Regular Contributor
timestamp: December 18, 2021, 03:22:05 pm
content: You mean this thread for the 2k scopes:https://www.eevblog.com/forum/testgear/siglent-sds2000x-plus-hack/125/Thanks.

author: tautech
author_rank: Super Contributor
timestamp: December 18, 2021, 06:49:11 pm
content: Quote from: killingtime on December 18, 2021, 03:22:05 pmYes, the same script.When installing options for customers as a matter of interest we checked the online script produced the same results as the official option code and any we did always matched.

author: killingtime
author_rank: Regular Contributor
timestamp: December 18, 2021, 09:53:10 pm
content: Hello tautech,Thanks for the reply.A bit off topic, but do you know if those scripts work with the new 6k scopes from Siglent?Regards.

author: tautech
author_rank: Super Contributor
timestamp: December 18, 2021, 10:15:25 pm
content: Quote from: killingtime on December 18, 2021, 09:53:10 pmI don't think anyone does just yet however you can be sure I'll be checking the SDS6204X demo unit we get in February.At this time we're confident they will as they do for all models that have been released since scripts were first published. Regardless, the smart cookies here will crack the 6kX in short order.

author: maxwelllls
author_rank: Contributor
timestamp: December 20, 2021, 02:23:32 am
content: I tested SDS6000 Pro with TV84, the "MD5_PRD?" command did not respond. We tried several model names, such as SDS6000PRO/P/H .etc, but the lic generated could not be used.

author: maxwelllls
author_rank: Contributor
timestamp: December 27, 2021, 06:23:54 am
content: Quote from: maxwelllls on December 20, 2021, 02:23:32 amUse "LICENSE_PR?" Command to query the machine modelThanks to @TV84 for working on this thread!

author: djac
author_rank: Regular Contributor
timestamp: December 31, 2021, 07:31:24 pm
content: I received an SDS5034X from Welectron today. An update to 500MHz is currently available free of charge, even with 500MHz probes.I activated the option via the siglenteu.com website and got the key. It works.But what doesn't work is the adapted Pythonscript for the SDS2000X+ to enable further options. My scope has the latest software version 0.9.5R1. For the script I used my scopeid and the model name SDS5000X, as returned by the scpi command license_pr? For the 500MHz bandwidth extension I have both used the official name 4BW05, but also the 500M for the SDS2000X+. Additionally, I have varied the model name to SDS-5000X and also the scopeid with and without hyphens, lower and upper case.In no case did I get the same key as the one from Siglent.After the changeover, the new software version no longer offers an extension to 1GHz.Does anyone know how to do it with this version or do you have to go back to the previous version. But then the question arises as to whether the key for the already activated 500 MHz version still works.Regards Dieter

author: techneut
author_rank: Regular Contributor
timestamp: December 31, 2021, 07:41:03 pm
content: The keygenerator needs the serialnr not the scopid. I made the same mistake comming from a SDS1000.MY MISTAKE: IT IS THE OPPOSITE. You need scopeid not serialnr. Must be the beer.

author: djac
author_rank: Regular Contributor
timestamp: December 31, 2021, 08:53:12 pm
content: Thanks for the tip, but with the serial number it does not work either. I have tried using lower and upper case letters. What is the correct designation for the 500MHz option, 4BW05 as stated in the scope or 500M as for the SDS2000X+?Here are the tried and tested values of the variables:# original script for SDS2000x+:#SCOPEID = '0000000000000000'#Model = 'SDS2000X+'#bwopt = ('25M', '40M', '50M', '60M', '70M', '100M', '150M', '200M', '250M', '300M', '350M', \# '500M', '750M', '1000M', 'MAX', 'AWG', 'WIFI', 'MSO', 'FLX', 'CFD', 'I2S', '1553', 'PWA')#SCOPEID = 'sds5xhex5r0184' # serialnbrSCOPEID = 'SDS5XHEX5R0184' # serialnbr#SCOPEID = '4da12ee5deb6ef67' # scope idModel = 'SDS5000X'bwopt = ('4BW05', '4BW10', '500M', '1000M')#bwopt = ('4bw05', '4bw10', '500m', '1000m')The rest of the script is unchanged.Regards Dieter

author: bson
author_rank: Unknown
timestamp: December 31, 2021, 11:16:59 pm
content: The option name for 1GHz is 1000M. ScopeID is the hex numbers of the scope id in the options dialogs, without dashes.The current firmware doesn't allow upgrading a 350M scope to 1000M. A plausible workaround is to install an older firmware, install the bandwidth option, and upgrade the firmware back to the latest version. However, you may want to uninstall one of the other options first as there is a bug in older firmware that can cause the options screen to lock up when you have all options enabled (other than 1000M).

author: Martin72
author_rank: Super Contributor
timestamp: January 01, 2022, 03:06:02 am
content: Quote from: djac on December 31, 2021, 07:31:24 pmImho it makes sense, the 500Mhz version got different hardware afaik, so upgrading to 1Ghz is only possible with this version, not yours.So forget the 1Ghz thing.What the rest of the possible options concerns, lately I´ve got the permanent licenses for manchester and sent decoding via the known procedre.https://www.eevblog.com/forum/testgear/siglent-sds2000x-plus-hack/msg3829499/#msg3829499

author: bson
author_rank: Unknown
timestamp: January 01, 2022, 03:28:16 am
content: Well, it's possible but it won't quite make it to 1GHz. But 900MHz is better than a sharp stick in the eye... so why not.

author: djac
author_rank: Regular Contributor
timestamp: January 01, 2022, 12:04:34 pm
content: My problem is not first of all whether the 1GHz can be activated under the new software version. That is the second step.First of all, I need to clarify whether the SDS2000x+ script is applicable for the SDS5000X at all. I can easily check this, because I have a stock one for 500MHz. You can get the key for it on the siglenteu.com site. The algorithm behind the webpage must give the same result as the Python script. The input parameters on the webpage are model (selection list), option name (selection list), serial number (input) and authorised code (the authorisation to select options).The webpage then returns the key '89ge ywwy h7tu dphy' for SDS5000X, SDS-5000X-4BW05, SDS5XHEX5R0184, <autcode>. And it works.Incidentally, the same key is delivered for the SDS-5000X-2BW05 option (for the 2-channel version). This indicates that the option name for the script with 500M is probably correct, because the web page, via which all devices and their options can be activated, naturally wants to make the programming of the page as simple as possible. Therefore, the options for the bandwidth are probably mapped to a uniform name. Entering the serial number does not mean that the scopeid does not enter into the algorithm of the webpage, because the context should be known via an internal database.The following parameters go into the python script: the model name here SDS5000X, the scopeid (or the serial number as Techneut thinks) and the option name. If you look at the python script, you will notice that upper or lower case letters give different results.The actual code of the python script consists of the hashkey and the function gen. I don't want to publish both here because I don't know if it's legal. I use the one fromhttps://replit.com. There are several there for the SDS2000x+, but they are all the same and only cosmetically different from each other (in terms of the useless parameter of the gen function). I have also changed it a bit cosmetically, but of course tested whether my version and the original version give the same result. They do.Now, to clarify what results are delivered for upper and lower case, as well as for the option names, I use the following code:Code:import hashlibserial = 'SDS5XHEX5R0184' # serialnbrscopeid = '4da12ee5deb6ef67' # scopeididnbr = ( serial, serial.lower(), scopeid, scopeid.upper())Model = 'SDS5000X'bwopt = ('4BW05', '500M') #, 4BW10, 1000M, 'MAX', 'AWG', 'WIFI', 'MSO', 'FLX', 'CFD', 'I2S', '1553', 'PWA', 'MANC', 'SENT')"""hashkey = ...def gen(opt, idn):...#end gen"""print('{:6} {:16} {:16} {:16} {:16}'.format('option', 'SERIALNBR', 'serialnbr', 'scopeid', 'SCOPEID'))for opt in bwopt:keys = ''for idn in idnbr:keys += gen(opt, idn).ljust(17)#end forprint('{:6} {}'.format(opt, keys))#end forThe Output:option SERIALNBR serialnbr scopeid SCOPEID4BW05 6ngeqt5zk66jeahm 932zp3mymuvefa3y tfxpm5dakugx323w uvppjmbxt8ytbzg3500M wh6g29uuhhpqh3sv fru78bmyfmmqmt9c vc4u3rk2xfpdefmz 2qg249wgwbe3gyhtAs you can see, none of the 500MHz keys correspond to the one I received from Siglent.That's the problem for now!You can try to find out what keys you can get with the data published here.Regards Dieter

author: Emo
author_rank: Regular Contributor
timestamp: January 01, 2022, 03:53:58 pm
content: Hi Dieter,The syntax of the bwopt scentence looks incorrect. I expected bwopt = ('arg1', 'arg2', ...... 'arg3')Eric

author: djac
author_rank: Regular Contributor
timestamp: January 01, 2022, 04:11:56 pm
content: The syntax is right: bwopt = ('4BW05', '500M'). The rest of the line, beginning with '#' is comment in Python. Out commented other possible options.Regards Dieter

author: tv84
author_rank: Super Contributor
timestamp: January 01, 2022, 04:34:19 pm
content: Quote from: djac on January 01, 2022, 04:11:56 pmTry the SCPI command:MCBD ABRMT3GU488DG62Y

author: djac
author_rank: Regular Contributor
timestamp: January 01, 2022, 05:12:49 pm
content: @tv84no change. Bandwidth 590MHz as before. Systemstatus SDS5054X as before.Regards Dieter

author: tv84
author_rank: Super Contributor
timestamp: January 01, 2022, 05:13:54 pm
content: Quote from: djac on January 01, 2022, 05:12:49 pmShow us a picture of the System Info menu and a copy of the firmdata0/bandwidth.txt file. I think your ScopeID must be wrong.

author: bdunham7
author_rank: Super Contributor
timestamp: January 01, 2022, 05:58:10 pm
content: I don't know whether it is true that there is one and only one key which will activate an option. To see if the overall process used by the script will work with your scope, just run the script for all the available options and then try to install one--say a coding option--that you don't have. I ran your SCOPEID and I got the same 500M key you did and the same 1000M key TV84 got, so we're all on the same page there. Pick an option you don't have and post the results.What is the code you got from Siglent for the 500M option?Edit: You can PM if you don't want to post it publicly. I don't thinking a whole bunch of us all pinging Siglent separately for a code for the same s/n scope is helpful to any cause.

author: techneut
author_rank: Regular Contributor
timestamp: January 01, 2022, 07:00:45 pm
content: I upgraded my SDS5034X today tthrough the MBCD command. 500MHz worked at once, bandwith expansion and Info menu showed SDS5054X. With the 1000MHz nothing happend. I remembered an earlier message from bson about this and installed V 0.9.3R3. Now the 1000M worked. Actual bandwith is now 750MHz.Frequenty is from 0,1GHz to 1GHz. Frequenty markers for picture 1 and 2 is 300, 400, 500 and 600MHz. Last picture 500, 600 700 and 800MHz

author: djac
author_rank: Regular Contributor
timestamp: January 01, 2022, 07:46:59 pm
content: @tv84 and bdunham71. Try MSO Option. Got the following keys:scopeid (lower letters) 74yk s33s mu8w 463pSCOPEID (upper letters) gezq gupy 32kx 24ddResponse for keys in upper and lower letters: data invalid2. siglent key for 500M, as mentioned before, is 89ge ywwy h7tu dphy3. Bandwith.txt contains only the siglent key for 500M in upper letters and no <nl>4. systemstatus see picture@techneutand what happens if you now install the new version 0.9.5R1?Regards Dieter

author: tv84
author_rank: Super Contributor
timestamp: January 01, 2022, 08:00:26 pm
content: Quote from: djac on January 01, 2022, 07:46:59 pmInteresting...Maybe new year's news...Can you telnet to the scope and do a memdump?

author: techneut
author_rank: Regular Contributor
timestamp: January 01, 2022, 08:02:45 pm
content: I went to 0.9.5R3 immidiately after the 1000M upgrade. the last picture shows the result

author: bdunham7
author_rank: Super Contributor
timestamp: January 01, 2022, 08:15:08 pm
content: Quote from: djac on January 01, 2022, 07:46:59 pmMy script that worked for my SDS2000X+ gave me MSO 74YKS33SMU8W463P for your SCOPEID. Are you entering that will the CAPS lock on?

author: djac
author_rank: Regular Contributor
timestamp: January 01, 2022, 09:03:53 pm
content: @tv84yes it seems that the script in whole will no longer work for future software versions. Yes I can telnet to the scope, if not I wouldn't have been able to read bandwith,txt. But what Do you mean with memdump. The whole /dev/mem? Can you explain this more precisely?If I decide to go back to 9.3 I would like to know if it is possible to uninstall the 500M Upgrade savely. Do you know that?@bdunham7I make for both generated keys the input first with lower and then with upper case (Caps lock on) letters. All 4 tries lead to 'Data invalid'.Regards Dieter

author: djac
author_rank: Regular Contributor
timestamp: January 01, 2022, 09:11:39 pm
content: @tv84I try the memdump tomorrow, please pm me your mail address. I gues that even the zip file will be big.And how can I remove the installed 500M?Regards Dieter

author: tv84
author_rank: Super Contributor
timestamp: January 02, 2022, 02:14:37 pm
content: Siglent's "Dynamic Key" has arrived!!!Time to exercise some muscles...From the release notes of FW v0.9.5R2:Code:5/22/20210.9.5R2Fixed a bug which may cause failure on installation of option key in 0.9.5R1.This may be the confirmation that starting with (? ? ?) v0.9.5R1 Siglent introduced "Dynamic Key" feature in its option licensing. That would be the only reason why Siglent would mess around with his old licensing app code.So, for all scopes starting with these versions the public keygen will be worthless, for now.The same will happen to SDS2000X+, SDS6000, etc.Attached is a firmdata0/NSP_system_info.xml of such a system (real info obfuscated).

author: techneut
author_rank: Regular Contributor
timestamp: January 02, 2022, 08:18:37 pm
content: I have V0.9.5R3 running and I entered today the last remaining option (Manch) and it was accepted. No problem

author: bdunham7
author_rank: Super Contributor
timestamp: January 02, 2022, 08:26:27 pm
content: Quote from: tv84 on January 02, 2022, 02:14:37 pmI'm not clear on the concept. If the dynamic key system is implemented in firmware using identical hardware, couldn't you just flash in older firmware and upgrade that way?

author: tv84
author_rank: Super Contributor
timestamp: January 02, 2022, 08:46:30 pm
content: Quote from: bdunham7 on January 02, 2022, 08:26:27 pmWe can do several things that I will not discuss here. But, I would suppose Siglent has prevented downgrades.This only applies to newer machines. The oldies will continue until...

author: ozel
author_rank: Newbie
timestamp: February 10, 2022, 12:59:56 pm
content: Quote from: tv84 on January 02, 2022, 08:46:30 pmI'm in the market for a SDS6000A. While 1GHz BW would be enough for me at the moment, I am wondering if it would be helpful to have the top-end SDS6204A 2 GHz model as a reference in the community?

author: tv84
author_rank: Super Contributor
timestamp: March 19, 2022, 11:00:23 am
content: About Siglent's new licensing scheme, seehere.Spoiler alert: it contains no details about the scheme.

author: SpacedCowboy
author_rank: Frequent Contributor
timestamp: April 19, 2022, 11:10:21 pm
content: So, I'm not entirely clear what "We can do several things that I will not discuss here" means, and maybe I don't want to beWhat Iamwondering is if I could purchase the SDS6054A and update it to the SDS6204A. Still after those eye-diagrams, and although my head is saying "it's not worth it", the idea keeps sidling back into my mind when I'm not looking!The gist of this dynamic key (and if I understand "the public keygen will be worthless, for now"), the answer is "If you get it yesterday, you have a chance of getting the old firmware, and you might be able to hack it, but if you get the new firmware, you're SOL".Even if you have the old firmware, seems like you'd get locked out of upgrades in future. The cost difference is $2k from SDS6054A (at $8k) to SDS6204A (at $10k). Not sure if anyone is offering any discounts...

author: FlexibleMammoth
author_rank: Regular Contributor
timestamp: July 08, 2023, 09:35:14 am
content: Hi,sorry for the necromancing, but I hate starting new threads for exactly the same topic.SDS5000X has gained a new option for ARINC429 decoding.It appears I am unable to unlock the option with the known script - I tried ARINC, ARIN, 429 as seeds but none will work, neither CAPS nor lowercase. Tried via UI, since I dont have network connected at the moment... Has anyone succeeded?BR Andreas

author: Sighound36
author_rank: Frequent Contributor
timestamp: July 08, 2023, 02:58:43 pm
content: These extra features which are introduced over the lifetime of the scope are usually included in Firmware updates.Which regard to opening that particular serial data decoding feature, one for the wizards of code on this fair bulletin board

author: Martin72
author_rank: Super Contributor
timestamp: July 08, 2023, 03:04:32 pm
content: QuoteExactly, the latest firmware (V0.9.8R1) from june must be installed before.

author: FlexibleMammoth
author_rank: Regular Contributor
timestamp: July 08, 2023, 04:05:11 pm
content: Hi MartinNice to see you again! Yes I have the latest firmware. Its just that the script works with seeds that are different from the option names (e.g. MANC instead of Manchester etc) and I did not happen to find the right one for ARINC yet.BR Andreas

author: Martin72
author_rank: Super Contributor
timestamp: July 08, 2023, 04:42:24 pm
content: Hi Andreas,Hmm..maybe with the new firmware the old script method doesn´t function anymore..

author: tv84
author_rank: Super Contributor
timestamp: July 08, 2023, 06:33:07 pm
content: Use these:USB20 -> "U20"ARINC -> "A429"

author: Emo
author_rank: Regular Contributor
timestamp: July 08, 2023, 08:18:06 pm
content: I can confirm A429 to be working!Thank you(tried almost every other combination...)Eric

author: FlexibleMammoth
author_rank: Regular Contributor
timestamp: July 09, 2023, 10:59:34 am
content: I remeber someone tried the eye&jotter option on a sds5000x when the 6000a was new and it did not work since it lacks a coprocessor... did anyone try the usb2.0 option?

author: tautech
author_rank: Super Contributor
timestamp: July 09, 2023, 04:18:43 pm
content: Quote from: FlexibleMammoth on July 09, 2023, 10:59:34 amPlease stop and think.No option can work if the SW that makes it do is not installed into a piece of equipment.SDS5000X does not have some of the capabilities SDS6000A has, period !Just because some Python script can generate a license code means nothing if functionality is not installed.....nothing to do with HW capability.

author: Performa01
author_rank: Super Contributor
timestamp: July 10, 2023, 08:58:27 am
content: Quote from: FlexibleMammoth on July 09, 2023, 10:59:34 amThe "coprocessor" is usually implemented in the FPGA, so we can create one whenever we need one. The FPGA resources are limited however - the SDS6000 certainly has a lot more of them compared to the SDS5000.Quote from: FlexibleMammoth on July 09, 2023, 10:59:34 amTo the best of my knowledge, USB 2.0 is actually implemented using some kind of "co-processor", i.e. a special separate chip. USB 2.0 makes only sense in high bandwidth scopes, hence this option is for the SDS6000 and higher models exclusively.

author: Sidoroffff
author_rank: Newbie
timestamp: December 14, 2023, 06:24:54 pm
content: Hello tv84,Sorry for restoring that topic.I have checked license version of my SDS5034x with the SCPI command:syst:board?and got4CH_500M_LIC-V2As expected, the well known Python script does not work. Are there other options to treat my Siglent? Memdump?

author: tv84
author_rank: Super Contributor
timestamp: December 16, 2023, 10:24:20 am
content: With a memdump you should be good to go.And, yes there is a way to downgrade from Lic V2 to V1. It all goes about the Dynamic Key present in the device. But that's a poor man's solution.

author: Sidoroffff
author_rank: Newbie
timestamp: December 17, 2023, 09:19:48 am
content: tv84 thanks a lot for response1. And, yes there is a way to downgrade from Lic V2 to V1.Do you mean its possble to downgrade FW version which doesn't support Licv2 , install SW options and upgrade to latest FW release? Or using special ''patched' FW it that case?2. With a memdump you should be good to go.As I know the SHELLCMD door is closed now. Or agian - downgrade FW version? Do we have anoher way for gettinng root access with the telnet?

author: tv84
author_rank: Super Contributor
timestamp: December 17, 2023, 11:39:11 am
content: 1. The FW supports both v1 and v2.2. What version do you have?

author: Sidoroffff
author_rank: Newbie
timestamp: December 17, 2023, 11:56:19 am
content: 2. 0.9.8R2

author: Detlef
author_rank: Newbie
timestamp: April 05, 2024, 12:30:29 pm
content: Allow me to introduce myself: I’m a retired engineer. My former profession has been software and hardware design, mostly for embedded microcontrollers, which is still my hobby, among general electronic design.A few month ago, I have bought a Siglent SDS5054X oscilloscope. Although I don’t even need the built-in features, this instrument offers, for academic purposes, I am interested in some “enhancements”.Well ladies and gentlemen, is there any functioning hack like the old Python script (which doesn’t work anymore) - and if so, how can I get it. And of course, I would keep it secret. My e-mail address is deposited with my account…

author: IM3
author_rank: Contributor
timestamp: July 23, 2024, 02:25:39 pm
content: Let's see if the UART on my SDS5034X is accessible.To do this, I will need to open the device first. I wanted to avoid damaging the 'calibration void' sticker. You can easily remove this sticker by following the instructions in the following thread:https://www.eevblog.com/forum/blog/eevblog-799-how-to-remove-warranty-void-security-stickers/First, let me emphasize that opening such devices should always be done in an ESD-safe manner. Be aware that even just lifting yourself off your chair can generate ten's of kilovolts of static charge. A tiny spark of 100 volts can damage your expensive equipment, sometimes not immediately, but maybe after a year due to latent damage. So, be careful!That's why you need an ESD mat, ideally in a vibrant red color (RGB 255-0-0).After removing the back cover, the power supply needs to be unscrewed first because of disconnect a few connectors. Only then can you access the main board.It turns out the UART connector is not populated on the main board. There is no Jedec header present. Wires need to be soldered to the pads for GND, TX, and RX. Do not connect VCC, as this would introduce supply voltage from two sources and that is never a good thing.So now you can connect a PC to the UART via a USB to Serial converter, and you'll have a connection. (Baudrate 115200, 8N1).But then comes the real challenge: Username and Password.There is a lot of old discussion on EEVBlog about this, and some believe there is only one password. That is definitely not the case. Passwords can change per device and even per firmware version.For a long time, the username was 'root'. The password used to be a combination of the manufacturer's name and the device name, so here it would be 'siglent_sds5000x'.Unfortunately, this is not the case anymore. I've tried at least 100 different combinations, but the story seems to end here quickly.Does anyone have any suggestions? (Except for screwing everything back together.)

author: IM3
author_rank: Contributor
timestamp: August 10, 2024, 07:56:38 pm
content: Alright, the experiment with the UART has not been successful so far. Those pesky passwords!The ultimate goal is still to liberate my SDS5000X.I’ve tried experimenting with JTAG as well, but that’s not straightforward either. (for me)A Lattice FPGA is visible in the JTAG communication. Thanks to tv84 for the support with that. This FPGA is located on the main board, right next to the JTAG header (see photos 1 and 2).The processor on a separate PCB hasn’t been detected yet. (Xilinx XC7Z020) I need a mem-dump on that processor to get any further.What I find strange on the processor board is the J2 connector. (foto 3 ) It’s labeled as NAND and JTAG. Does anyone have an idea what that might be? I will try to measure activity on those pins.

author: 44kgk1lkf6u
author_rank: Regular Contributor
timestamp: August 12, 2024, 02:11:16 pm
content: You can see that the leftmost hole is ground. I guess that it is intended for a jumper. Shorting the center to the left makes the chip boot from the NAND flash. Shorting the center to the right makes the chip boot from JTAG. The right hole may not be connected at all, that is, it is only there to rest the jumper. You can see if the hole is connected by measuring the diode drop from ground to it. In the finished product there may be a resistor to make it always boot from the flash. Some document for the chip should say how it works.

author: IM3
author_rank: Contributor
timestamp: August 15, 2024, 12:45:18 pm
content: What I know so far:Indeed, one of the pins on the 3-pin connector is ground.The middle pin transmits unknown data during boot and shutdown. The bit time is 200ns, measured with an oscilloscope.The third pin is always low; it might be an input...?The CPU board also features two USB3320 Hi-Speed USB Transceivers, and there is also a DS83848 Ethernet Transceiver. They are close to the 3-pin header.I was hoping to easily memdump the CPU but now I'm not sure if this is the right path that will lead me to liberating the SDS5000X.I have not enough knowledge of this as well.Maybe others find this usefull data to get any further.

author: 44kgk1lkf6u
author_rank: Regular Contributor
timestamp: August 18, 2024, 01:15:01 pm
content: I was not expecting data to be transmitted on the pin. I thought the boot select pin was an input. What kind of chip is the header connected to? Do you still have the capture of the waveform saved? Do you know if the third pin is connected to anything? I am sorry that I can not answer the questions myself. I don't have the device.

author: IM3
author_rank: Contributor
timestamp: August 18, 2024, 04:19:52 pm
content: No, this is what I have.The photos show which chips are on the PCB. The pin that stays low might be an input, but on this multilayer PCB, I can't trace where it leads.Additionally, I don't want to risk damaging the board by randomly applying voltages to these logic inputs with a multimeter. The potential for damage is not worth the risk to me. I am already far outside my comfort zone with this scope disassembly. It’s brand new, and I still remember what I paid for it.Initially, I hoped to establish a connection with the CPU via a JTAG interface so that I could create a memory dump. After that, other experts might be able to generate the keys to liberate this scope.But unfortunately, the CPU doesn’t appear in the JTAG chain.I think this is where it ends for me, and I’ll just put everything back together neatly.

author: Lydia
author_rank: Contributor
timestamp: October 23, 2024, 12:18:47 am
content: It seems like that although firmware 0.9.5 uses a brand new key system, but it can be directly downgrade to 0.9.3, then use some python stuff and upgrade back to 0.9.5 or higher.But the latest firmware 0.9.9 disabled firmware downgrade... so...