Siglent SDG1025 hack? - Page 1
Forum section: electronics / testgear

author: echen1024
author_rank: Super Contributor
timestamp: September 08, 2013, 01:58:38 am
content: Well, I'm still trying to decide between the Siglent SDG5082/1025, or the Rigol DS1022A/4062, and am wondering about the hackability of the Siglent models. Would it be possible to purchase a 5 MHz function gen, and hack it up to the 50Mhz, or buy a 5082, and take it up to 160MHz? Any help would be appreciated. I know that the Rigol DG4062 can be hacked into a DG4202, and that there is only one 1022 model.

author: rf-loop
author_rank: Super Contributor
timestamp: September 08, 2013, 09:21:13 am
content: I think Siglent do not use this designed hackability marketing method in narrow hobby segment of markets.

author: Macbeth
author_rank: Super Contributor
timestamp: December 06, 2013, 07:54:32 pm
content: I just got my Siglent SDG1025 today.From what I know, the lower bandwidth Siglent models (SDG1005-SG1020) don't even come with a fan - which kind of says something about the hardware. I would go for the 1025, the extra $20 or so is worth it for piece of mind.However, the Siglent SDG1050 is exactly the same in spec as the 1025, except for the Sine Wave function going up to 50MHz. All the rest are limited to 25MHz, 300kHz, etc.So for the SDG1025, I actually do believe a simple software mod could be enough, perhaps?Simarlarly, I have a Hantek MSO5102D (100 MHz). I could have got the 60MHz version, but the supplied probes don't make it worth it. I can software upgrade this to 200MHz (which I don't even think is offered in the MSO series anyway!).

author: wilheldp
author_rank: Regular Contributor
timestamp: December 06, 2013, 08:22:57 pm
content: I'd be interested if you figured out that software hack on the SDG1025 since I also recently bought one.

author: 0xPIT
author_rank: Regular Contributor
timestamp: September 06, 2015, 12:27:05 pm
content: Oh, the most recent firmware (1.01.01.37R3) has a Bandwidth Update option (Utility -> 3/3 -> BW Update) that allows to enter a license key...

author: tautech
author_rank: Super Contributor
timestamp: September 06, 2015, 07:21:32 pm
content: Quote from: 0xPIT on September 06, 2015, 12:27:05 pmYes, but at this time Siglent have yet to offer BW upgrade pricing and until they do who knows when this will be enabled.

author: Macbeth
author_rank: Super Contributor
timestamp: September 06, 2015, 08:00:00 pm
content: It's taking far too long. Maybe they are leaving this out there for the community to derive their own hack, ala Riglol"Sniffing the rigol's internal i2c busI've got a copy of IDA, but a 25 to 50 MHz sine wave isn't really worth it to me.

author: tautech
author_rank: Super Contributor
timestamp: September 06, 2015, 08:19:45 pm
content: Quote from: Macbeth on September 06, 2015, 08:00:00 pmI've wondered this too, but so far nobody seems to have taken the bait.

author: rf-loop
author_rank: Super Contributor
timestamp: September 07, 2015, 06:17:03 am
content: Also need remember that SDG1010 and 1025 can produce 50MHz sinewave. (Temporary occasional use, when some of the restrictions or the sine wave characteristics may be compromised. When user know some limits and can accept these, it can use)(EasyWave: open "new" with default property settings (-10 - +10V))Draw -> Equation drawNew EquationWrite exactly: 10*(sin(10*x))OkStore as 10SIN.CSV (name it as you want xxxxx.CSV) to USB and move this 10SIN.CSV to your SDG.Turn arb on and select this new 10SIN.CSV.Set Arb freq 5MHz and there you have 50MHz sine out.(set arb to wanted/10 frequency.)Then user need know that there is 8ns system jitter with most frequencies due to system working principle - with all arb and pulse waveforms - as in specifications tell)Also you can do other waveforms, example pulse with this method. But you need know how to write math functions for different waveforms. (if do not want hand draw waveform)Something like this (and this is NOT Square math but in paractice you can try what it give out AND look real out with oscilloscope - theory and practice differ because we do not have right theory due to fact that real world and equipments are not ideal)Just for fun, all waveforms are sum of some sinewaves.You can write for SDG1000:10*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(1.6*(sin(10*x))))))))))))))))))))))))With these harmonics and harmonic levels..... it is partially shit but if think square, you get idea how you can doChange numbers and look how it change..And look what scope show example if you set arb freq for 1kHz.caution:It is also good to know that continuous run with maximal signal power and specially to poor matched load impedance may lead to high thermal stress, even over stress, there in end amplifier(s) stage.

author: Steps
author_rank: Contributor
timestamp: April 13, 2016, 12:46:06 pm
content: Quote from: rf-loop on September 07, 2015, 06:17:03 amThank you for your effort. Useful information.And how it is possible to obtain AM modulated signal (and with e.g. 70% modulation depth)?(sin(x)(sin(1000*x))) - this is just AM modulated.

author: Macbeth
author_rank: Super Contributor
timestamp: May 28, 2018, 04:51:05 pm
content: To force it into an SDG1050, maybe changingE4F02 B8 E4 0D 00 R0 = B[FP + 0xd] (Z);to something likeE4F02 80 E1 05 00 R0 = 0x5 (Z);

author: nctnico
author_rank: Super Contributor
timestamp: May 28, 2018, 05:57:53 pm
content: What would be interesting is to find out whether the model is set by an eeprom or jumpers on the board. The early 5MHz and 10MHz models don't have a fan so there may be more differences in the hardware.

author: janekivi
author_rank: Frequent Contributor
timestamp: May 29, 2018, 02:38:38 pm
content: I have something here. I desoldered flash once.https://www.eevblog.com/forum/testgear/siglent-ads-firmware-file-format/msg1050089/#msg1050089I did with him all kinds of other experiments too.https://www.eevblog.com/forum/testgear/siglent-sdg1000-(aka-lecroy-wavestation)-firmware-updates/msg989932/#msg989932But I was sending square wave to led matrix displays and somehow it won't workcorrectly any more. Something is wrong with FPGA as manual say. It don't havesquare wave and output levels are messy. After that I got 2048X.So now it is for experiments good enough.

author: tv84
author_rank: Super Contributor
timestamp: May 29, 2018, 04:04:02 pm
content: Quote from: Macbeth on May 28, 2018, 04:51:05 pmThat could be a 1st attempt or change inside the previous call... I'm gonna see with janekivi now that I know he has an experimental testbed.

author: janekivi
author_rank: Frequent Contributor
timestamp: May 29, 2018, 04:11:48 pm
content: Quote from: 0xPIT on September 06, 2015, 12:27:05 pmOh, the most recent firmware (1.01.01.39R2) has a Bandwidth Update option (Utility -> 3/3 -> BW Update) removed, that doesn't allow to enter a license key...-------------------------------And the most recent firmware (1.01.01.39R5) too...

author: Macbeth
author_rank: Super Contributor
timestamp: May 29, 2018, 05:52:48 pm
content: Quote from: tv84 on May 29, 2018, 04:04:02 pmGood on janekivi! I was a little reluctant to be the Guinea Pig

author: janekivi
author_rank: Frequent Contributor
timestamp: June 04, 2018, 06:51:09 pm
content: OooKey...Did the experiments and there was no difference with this function change.QuoteNow I can make new files bit easyer and try other changes you suggest.First edited ADS update file I made wit notepad (hex edit)...

author: toli
author_rank: Frequent Contributor
timestamp: June 09, 2018, 03:36:35 pm
content: Quote from: Macbeth on May 28, 2018, 04:51:05 pmThe value its compared against is actually different, if you have a look, its:ROM:E4F62 29 60 R1 = 0x5 (X); # R1=0x5which is (X), not (Z). So its extended with sign, no zeros. I've looked at the BF manual, and its indeed different as its extending with '1's instead of '0's. I'm unsure of the actual instruction code to define R0 to be this value, no experience with the BF at all on my side. If you know the instruction structure and which bits state the register number, it would be great.From the few instruction in the snippet of code above, I think its 2860 (similar to the 2960 for setting R1 to 0x5(X), with a single bit change to mark the register number), but I can't verify this.One other way would be to try and set:ROM:E4F68 01 E1 20 E9 R1.L = 0xe920; # R1=0xe920instead of the different values set for the other models. As other than that the section seems practically identical for all models. Although its hard to say what happening at the subroutine in address "sub_575F2" which is being called there. Right before jumping into it, R0 is again set to the value of R7, so it is possible that its used there again for defining the parameters, and therefore this change wont suffice. Chances are I'm just too pessimistic

author: sleary78
author_rank: Unknown
timestamp: October 13, 2018, 08:37:44 am
content: Any updates on this. Is there anything i can do to help? I have a SDG1025 and its im happy to test out firmwares. The IDA database is no longer available.

author: azaaxx
author_rank: Newbie
timestamp: February 14, 2024, 10:34:42 am
content: Hi,I`m also the owner of SDG1025.There has been not much activity there since a lot of time.I noticed that there is a way to "unlock" siglent scopes and awg by using license:https://www.eevblog.com/forum/testgear/siglent-sds-sdg-hack-scriptI also saw on other sites same procedure for spectrum analyzers.I believe the procedure should be pretty much similar for this scope.I have some experience in reverse engineering and also can do some stuff with device itself (if needed)I would need to get decoded binaries / mem dump of scope.Anyway, It is better to ask instead of reinventing the wheel.