Hack of Sigllent spectrum analyzer ssa3021X? - Page 1
Forum section: electronics / testgear

author: papousek
author_rank: Contributor
timestamp: May 13, 2016, 07:15:26 am
content: I been waiting for reviews and being really interested to buy one since i saw the hack of ssa3021X from the post: (https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/100/) .it seems the SSA3021X (Original 2.1G and options closed) are upgraded to 3.2G, full options opened.it's impossible for me to judge if the hack really works since i dont have one,,,,anyone who got one at hand can do me a favor to review or to try the hack?anyway,, 1600 bucks are not a easy budget for me.Tks in advance

author: tautech
author_rank: Super Contributor
timestamp: May 13, 2016, 07:44:02 am
content: It seems to me you'd want to grab the current FW update just in case it gets pulled.Not sure if it has opened the hole to allow the upgrade but just in case it has here's the link:http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SSA-firmware-0705.rar~7.5 Mb

author: tautech
author_rank: Super Contributor
timestamp: May 13, 2016, 08:31:59 am
content: FYI it was reply #106https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg938261/#msg938261

author: Deuze
author_rank: Contributor
timestamp: May 17, 2016, 01:27:21 am
content: Hi Papousek,Here is some info you may want to know. In order to investigate whether it is a accident event. I install the old FW again and find out the 'hack' was gone. But when I upgrade to FW07.05 again and do the same thing to it. The 'hack' appeared again! So I think it means people can really hack it with these steps.Wunderbar

author: drieg
author_rank: Regular Contributor
timestamp: June 20, 2016, 02:07:22 pm
content: Latest SSA3021X and SSA3032X units are hardware identical and SSA3021X is also calibrated up to 3.2GHz, so yes, SSA3021X is "upgradable" to SSA3032X

author: nctnico
author_rank: Super Contributor
timestamp: June 20, 2016, 02:19:02 pm
content: Quote from: Deuze on May 17, 2016, 01:27:21 amThe biggest question is whether a future firmware upgrade undoes the 'hack'.

author: rf-loop
author_rank: Super Contributor
timestamp: June 20, 2016, 02:47:13 pm
content: Quote from: nctnico on June 20, 2016, 02:19:02 pmWith Rigol this afraid and question have been many years, starting from old times DS1052E.(I remember well these RS232 and terminal things what also I have done... and eevery next FW update we afraid if this all have gone... )

author: nctnico
author_rank: Super Contributor
timestamp: June 20, 2016, 05:02:53 pm
content: Quote from: rf-loop on June 20, 2016, 02:47:13 pmThat may be but if downgrading undoes the 'hack' in the SSA3000 then upgrading is likely to do the same because appearantly the hack doesn't update the memory where the enabled options are stored. If the options where enabled permanently by the hack then they would remain after downgrading.

author: continuo
author_rank: Frequent Contributor
timestamp: June 20, 2016, 06:53:23 pm
content: I don't understand, what exactly is the hack on this one? Just an upgrade with the official firmware or is there something else to do? And will this hack enable the Tracking Gen as well?

author: tautech
author_rank: Super Contributor
timestamp: June 20, 2016, 07:52:47 pm
content: Quote from: continuo on June 20, 2016, 06:53:23 pmFirst mentioned here:https://www.eevblog.com/forum/testgear/siglent-ssa3000x-spectrum-analyzers/msg938261/#msg938261

author: nctnico
author_rank: Super Contributor
timestamp: June 20, 2016, 07:56:02 pm
content: Quote from: tautech on June 20, 2016, 07:52:47 pmWe still need confirmation the options stay enabled in future firmware updates otherwise it isn't a hack but a bug. It would be sad when people make their purchase based on the availability of the full-featured SA for the base price only to find out they can only use an old firmware version which doesn't have the latest features.

author: drieg
author_rank: Regular Contributor
timestamp: June 20, 2016, 08:12:52 pm
content: Quote from: tautech on June 20, 2016, 07:52:47 pmIt is possible to turn SSA3021X into SSA3032X and enable all the options unofficially in a different (permanent) way as well

author: PsychoBoy
author_rank: Contributor
timestamp: June 20, 2016, 08:17:42 pm
content: Quote from: nctnico on June 20, 2016, 07:56:02 pmI would hardly call it hack since, man - you don't have to do anything, just upgrade FW, wtf? It's certainly a bug.To me what is more important is to test it now if it really is capable of 3.2GHz span on 2.1GHz model and do all these enabled options work as well, because once you know the technical capabilities are the same then we can do hacks on software. Also if it works it's great base to start working on real hack - I mean for example you could dump memory from EEPROM when you had old FW and then dump once again when upgraded to new one, and see what's changed (maybe nothing unfortunately if it's related to real software bug like IDK wrong date checking?). By the way if it is possible to get trial versions for 48h, isn't it possible to manually adjust RTC clock and find and replace date in memory, I know it's pain in ass solution, but anyway.

author: drieg
author_rank: Regular Contributor
timestamp: June 20, 2016, 08:37:02 pm
content: Quote from: PsychoBoy on June 20, 2016, 08:17:42 pmThe answer to both your questions is yes.

author: PsychoBoy
author_rank: Contributor
timestamp: June 20, 2016, 08:43:24 pm
content: Quote from: drieg on June 20, 2016, 08:12:52 pmGreat info, would you mind to share your method?Quote from: drieg on June 20, 2016, 08:37:02 pmThen this is really nice. All Rigol hackers please take a look at this one!

author: drieg
author_rank: Regular Contributor
timestamp: June 20, 2016, 09:32:03 pm
content: I actually can't because I'm a distributor of Siglent (and Rigol) test gear. Sorry for that.But don't worry, there are many talented guys who will figure out soon. My guess is, that these units will quickly become very popular due its hackability (like Rigol units).Small hint: read tinhead's thread;)

author: tautech
author_rank: Super Contributor
timestamp: June 20, 2016, 09:58:08 pm
content: Quote from: drieg on June 20, 2016, 09:32:03 pmThanks for the hint drieg.Looking at his threads:https://www.eevblog.com/forum/profile/?area=showposts;sa=topics;u=2790Would I be correct the clues are in this one?https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/

author: Pinkus
author_rank: Frequent Contributor
timestamp: June 21, 2016, 10:24:30 am
content: Quote from: drieg on June 20, 2016, 09:32:03 pmI only can recommend Drieg as a distributor/reseller for Rigol and Siglent devices. I know him for years now. He is always very helpful (even months or years after the purchase!) and can help you whenever EVERY other reseller can't. So if you want to purchase such stuff, ask him for a quote.

author: janekivi
author_rank: Frequent Contributor
timestamp: June 24, 2016, 08:28:38 pm
content: Does it have telnet?You know what I'm thinking here...

author: tautech
author_rank: Super Contributor
timestamp: June 24, 2016, 09:43:21 pm
content: Quote from: janekivi on June 24, 2016, 08:28:38 pmEarly in Daves teardown and his only cursory inspection of the processor PCB he identifies a header that he calls as a Jtag and then another for programming.https://www.eevblog.com/forum/blog/eevblog-892-siglent-ssa3021x-spectrum-analyser-teardown/

author: janekivi
author_rank: Frequent Contributor
timestamp: June 24, 2016, 09:51:16 pm
content: Some kind of telnet prompt from LAN port? In shadow may be DES / crypt(3) root password.

author: Pinkus
author_rank: Frequent Contributor
timestamp: June 24, 2016, 10:55:01 pm
content: Quote from: janekivi on June 24, 2016, 09:51:16 pmYes, telnet deamon is active - see screenshot.But I do not know how to proceed from here.

author: nctnico
author_rank: Super Contributor
timestamp: June 24, 2016, 11:47:58 pm
content: They didn't remove the banner? Maybe they kept the default Arago password as well: root

author: Pinkus
author_rank: Frequent Contributor
timestamp: June 25, 2016, 10:02:48 am
content: Quote from: nctnico on June 24, 2016, 11:47:58 pmI am not a hacker, but of course I already tried this (and some other) most obvious password without success.

author: janekivi
author_rank: Frequent Contributor
timestamp: June 25, 2016, 11:53:41 am
content: You can try crack this from SSA3000X_D07P03.ADSxE062W/htPFyUUNIX descrypt