Root access to Siglent scopes - not for license, but for adding functions - Page 1
Forum section: electronics / testgear

author: mcleinn
author_rank: Newbie
timestamp: April 04, 2025, 10:47:01 am
content: Dear community, I am thinking about buying a Siglent scope. I read a few threads by people who jailbroke their scope to change licenses/parameters.But has anyone tried to add custom functionality?For example, I would like to some simple maths between waveforms in "History" memory - it would be great to do that onboard, as downloading the memory to a PC via network would take too long for my task.Question to those who did the jailbreaks: is that a realistic idea? Have people done so?I see two ways, either by direct memory manipulation, second by running SCPI scripts locally.Thank you (P.S. I am thinking in particular about the SDS824X HD)

author: tv84
author_rank: Super Contributor
timestamp: April 04, 2025, 11:35:22 am
content: Quote from: mcleinn on April 04, 2025, 10:47:01 amIf you don't know the answer to that question then that's not a realistic idea.BTW, nobody has been jailbreaking in order to license the units. They just insert the licenses using the vendor built-in method.

author: nctnico
author_rank: Super Contributor
timestamp: April 04, 2025, 11:41:31 am
content: Quote from: mcleinn on April 04, 2025, 10:47:01 amIf you want to do that, buy the new GW Instek oscilloscope. This has Python scripting built in which allows to add almost any kind of functionality (including controlling other test equipment over the network).

author: mcleinn
author_rank: Newbie
timestamp: April 04, 2025, 12:19:01 pm
content: QuoteObviously everything is possible, with enough time at hand. This is not rocket science.I suspect it's doable without a big effort, but I don't have the unit at hand to be sure whether it's worth it & not that much public information.So I am looking for opinions of people who actually tried, just because it might save some time. Legit question, IMHOProbably adding my own scripts to the web server should be the most comfortable route.QuoteInteresting, thank you! On the first glance it seems that a device which compares to the SDS824X HD (200 MHz 2Gsa/s) seems to be much more expensive, but I will look into it.

author: pascal_sweden
author_rank: Super Contributor
timestamp: April 04, 2025, 12:37:41 pm
content: There is a Swedish guy on EEVBlog that was reverse engineering an Owon oscilloscope, and he was planning to make an open source firmware for itHe posted all his findings regarding this activity on a blog:http://blog.weinigel.se/2016/05/01/sds7102-hacking.htmlMaybe several people on this forum should team up together and do a similar effort on a Siglent or a Rigol oscilloscope.

author: Kean
author_rank: Unknown
timestamp: April 04, 2025, 01:36:12 pm
content: There is also someone who has been doing UI customisation on the Rigol DHO800 by reverse engineering of the original apphttps://github.com/mriscoc/RIGOL_DHO800_DHO900_GUIHe has posted a few times here, but I don't think he has done anything like what you mentione.g.https://www.eevblog.com/forum/testgear/hacking-the-rigol-dho800900-scope/msg5863807/#msg5863807Being able to run scripts locally on a GW Instek as mentioned by nctnico sounds like the better option if you really don't want to use a PC to control the scope.Or maybe just use a PC based scope and a tool like ngscopeclient

author: tv84
author_rank: Super Contributor
timestamp: April 04, 2025, 02:42:19 pm
content: I would guess none of those previous projects ensure the capability of accessing/dealing with Siglent's "History" memory directly on the scope...

author: KungFuJosh
author_rank: Super Contributor
timestamp: April 04, 2025, 06:51:29 pm
content: Quote from: mcleinn on April 04, 2025, 12:19:01 pmRocket science isn't that hard, but getting the scope to do what you want may take more time than you have or are willing to spend. tv84 is the authority on this subject. If he says it's not realistic for you, you should probably believe him.Nico is correct, if you want a customizable platform, you should start with an intentionally customizable platform like the GW Instek.The Rigol DHO stuff is garbage IMO, but you can customize it and make it usable. That might be an okay platform for you if the GW Instek doesn't fit your budget.

author: mcleinn
author_rank: Newbie
timestamp: April 04, 2025, 07:26:59 pm
content: QuoteWith due respect - he knows exactly 0 about me, and gave no arguments.Let's concentrate on tech here, not on speculations about others & gatekeeping.GW Intek did exactly the right thing, but the price tag for a comparable scope (200MHz 2GSa/s) is at least four times higher, same for Rigol.As for pure USB scopes, a comparable Picoscope is twice as expensive.tl;dr; nobody brought a *technical* argument why this shouldn't work, so I will try the Siglent first.According to public information it is a Linux / ARM based system which can be rooted without any difficulty.It features a webserver running SCPI requests, so at the very least running a local script or cross compiled executable interacting with the SCPI socket should be possible.That will be slower than direct memory manipulation, but still faster than sending out full memory dumps over 100Mbit LAN or USB2.0Anyway, I will get the scope tomorrow and have a look.

author: KungFuJosh
author_rank: Super Contributor
timestamp: April 04, 2025, 07:58:25 pm
content: Quote from: mcleinn on April 04, 2025, 07:26:59 pmI look forward to seeing the results of your efforts.

author: egonotto
author_rank: Super Contributor
timestamp: April 05, 2025, 12:32:41 am
content: Hello,I'm not sure what you need. How much data do you want in what time?Maybe a Red Pitaya is suitable?Perhaps even an Analog Discovery would be suitable.Best regardsegonotto

author: optotester
author_rank: Regular Contributor
timestamp: April 05, 2025, 07:08:03 am
content: You would only be able to add features in the web UI/remote management side (I added a shell and recompiled a better VNC server) on my SDS2000HD.Now both the kernel is quite old + the PHP version is old and lack many standard extensions (although you can recompile it).You won’t be able to modify the main scope UI though as it is a single executable, the only way would be direct asssembly/bytecode edition which is an unreasonable amount of work.You can modify the default waveforms, but you do not need really need jailbreak as you can already load custom ones. Maybe some filters/math functions can be modified too but it has been a long time, so I am not sure of the file structure anymore.

author: mcleinn
author_rank: Newbie
timestamp: April 05, 2025, 04:50:31 pm
content: UPDATE: Today I got my SDS824X HD (actually, pre-modded SDS804X) - firmware 1.1.3.8 (2024-04-11) - and changed root password using the internal serial port. I understand that even though SHELLCMD and telnet tricks stopped working long ago, there still is a non-invasive method - but it was faster for me to solder the three breakout cables than reading through thousands of forum posts, many of them outdated or intentionally secretive. Pressed key to get the U-Boot (3.8.12) prompt, loaded into the kernel and changed passwd in single user mode, reboot.Code:setenv bootargs console=ttyPS0,115200 root=/dev/mmcblk0p7 rw init=/bin/shsetenv bootcmdfatload mmc 0:5 0x1000000 Imagefatload mmc 0:5 0x3000000 system.dtbbooti 0x1000000 - 0x3000000in Linux:Code:mount -t proc proc /procmount -o remount,rw /passwdsyncStill familiarizing myself with the system.QuoteNot sure if I agree. I am not talking about waveform generation, but about analyzing my records. The task I want to solve involves hundreds of almost-identical waveform sequences I recorded into deep memory. My aim is to do an operation comparing those sequences and doing some post-processing (sort of FFT). That should be possible with memory access. First I need to identify where the sequences are saved. So my plan is to do a test record, create a dump via SCPI and then locate the waveforms in memory, and modify them there. Originally I thought I could just locally run SCPI, which would be easier, but it seems that on the SDS804X HD there is no SCPI command for modifying sequence memory.The reason why I can't simply export the dump and do the math on the PC is that I want to record much more than the onboard memory allows, and as the device only features USB2.0 and 100Bit LAN there is no way I can stream at the required data rates (min 200MHz & 1 GSa/s). I understand that Picoscope 3xxx or others would solve the issue, but for the same specs those are all significantly more expensive (factor 2-4)P.S. adding the missing external trigger (in the SDS8__X HD series) would also be great. But that's probably done not in software, but using the SBUS, simulating a digital channel. I am pretty sure that soldering another cable to the right position on the mainboard should also do it. But that's for later.