Author Archives: Hal Martin

About Hal Martin

In my free time I like experiment with hardware and embedded systems. Here I write about personal projects and random adventures into firmware land.

Riverbed SteelHead CX 255

The Riverbed SteelHead are a series of bandwidth optimization appliances that can typically be found for a reasonable price on eBay. Today we are looking at the Riverbed CX 255 (36€ from eBay.de), a small unit with 3 Ethernet interfaces.
Riverbed SteelHead CX 255

Powering the CX 255 is an Intel Celeron 725C (1C2T) soldered to the NAMB-3250MB motherboard, along with with 2GB of DDR3-1333 unbuffered ECC. You will not win any benchmarks with this CPU.

NAMB-3250MB motherboard (Rev. A102-1; 19A2325001-01) inside the CX 255

The CX 255 consumes 20W idle, and is powered by an external 12V 7A power supply (5.5×2.5mm, center positive).

Running powertop --auto-tune sadly does nothing to the reduce power consumption. It appears to the primary reason for this is the high power consumption of the DH89xxCC chipset used

DH89xxCC chipset features and TDP (PDF)

The console port uses the Cisco rollover cable pinout, and operates at 115200n8. The two 40mm PWM fans run at around 5000RPM, and while not they do not scream as some 1U servers do, they are clearly audible from several meters away.


OpenWrt x86-64 running on the CX 255

00:00.0 Host bridge: Intel Corporation 2nd Generation Core Processor Family DRAM Controller (rev 09)
00:01.0 PCI bridge: Intel Corporation Xeon E3-1200/2nd Generation Core Processor Family PCI Express Root Port (rev 09)
00:1c.0 PCI bridge: Intel Corporation DH89xxCC PCI Express Root Port #1 (rev 08)
00:1d.0 USB controller: Intel Corporation DH89xxCC USB2 Enhanced Host Controller #1 (rev 08)
00:1f.0 ISA bridge: Intel Corporation DH89xxCC LPC Controller (rev 08)
00:1f.2 SATA controller: Intel Corporation DH89xxCC 4 Port SATA AHCI Controller (rev 08)
00:1f.3 SMBus: Intel Corporation DH89xxCC SMBus Controller (rev 08)
00:1f.6 Signal processing controller: Intel Corporation DH89xxCC Thermal Subsystem (rev 08)
00:1f.7 System peripheral: Intel Corporation DH89xxCC Watchdog Timer (rev 08)
01:00.0 Co-processor: Intel Corporation DH89XXCC Series QAT (rev 21)
01:00.1 Ethernet controller: Intel Corporation DH8900CC Series Gigabit Network Connection (rev 21)
01:00.2 Ethernet controller: Intel Corporation DH8900CC Series Gigabit Network Connection (rev 21)
02:00.0 Ethernet controller: Intel Corporation I210 Gigabit Network Connection (rev 03)

There are also the CX 570 and CX 770, which appear quite similar from the exterior. The CX 570 and CX 770 have three additional Ethernet interfaces and better CPUs. According to this document (PDF) the CX 570 has an Intel Pentium B925C while the CX 770 has an Intel Xeon E3-1125C v2.

From the lspci output on the CX 255 and the board layout, I assume that the CX 570/770 has an additional I210 controller and the remaining 2 Ethernet PHYs from the DH8900CC populated. I anticipate that the idle power consumption is similar to that of the CX 255.


Here is the lspci output from the CX 770:

00:00.0 Host bridge: Intel Corporation 3rd Gen Core processor DRAM Controller (rev 09)
00:01.0 PCI bridge: Intel Corporation Xeon E3-1200 v2/3rd Gen Core processor PCI Express Root Port (rev 09)
00:1c.0 PCI bridge: Intel Corporation DH89xxCC PCI Express Root Port #1 (rev 08)
00:1c.1 PCI bridge: Intel Corporation DH89xxCC PCI Express Root Port #2 (rev 08)
00:1d.0 USB controller: Intel Corporation DH89xxCC USB2 Enhanced Host Controller #1 (rev 08)
00:1f.0 ISA bridge: Intel Corporation DH89xxCC LPC Controller (rev 08)
00:1f.2 SATA controller: Intel Corporation DH89xxCC 4 Port SATA AHCI Controller (rev 08)
00:1f.3 SMBus: Intel Corporation DH89xxCC SMBus Controller (rev 08)
00:1f.6 Signal processing controller: Intel Corporation DH89xxCC Thermal Subsystem (rev 08)
00:1f.7 System peripheral: Intel Corporation DH89xxCC Watchdog Timer (rev 08)
01:00.0 Co-processor: Intel Corporation DH89XXCC Series QAT (rev 21)
01:00.1 Ethernet controller: Intel Corporation DH8900CC Series Gigabit Network Connection (rev 21)
01:00.2 Ethernet controller: Intel Corporation DH8900CC Series Gigabit Network Connection (rev 21)
01:00.3 Ethernet controller: Intel Corporation DH8900CC Series Gigabit Network Connection (rev 21)
01:00.4 Ethernet controller: Intel Corporation DH8900CC Series Gigabit Network Connection (rev 21)
02:00.0 Ethernet controller: Intel Corporation I210 Gigabit Network Connection (rev 03)
03:00.0 Ethernet controller: Intel Corporation I210 Gigabit Network Connection (rev 03)

The CX 770 also includes minimal lights out management (Aspeed AST1050 BMC), which can be configured to share the PRI ethernet interface. The BMC only provides remote power control and sensor readings, there is no support for KVM or serial console redirection.

HP Z420 ATX modification

Using proprietary OEM motherboards outside their intended use case is not a new subject. OEM motherboards are typically less expensive than their enthusiast counterparts on the second hand market, and they often incorporate features that the enthusiast offers lack, such as an integrated TPM or additional I/O.

The HP Z420 is a workstation based on the LGA 2011 (Sandy/Ivy Bridge-EP) socket, released in 2012. There are various forum threads around the internet discussing how to operate the motherboard with a third-party power supply and chassis, however I have not found a succinct document that outlines all the steps required to use the motherboard without HP original parts.


The motherboard has an 18+8pin power arrangement. The motherboard is almost entirely 12V powered, with +11VSB being the only other voltage present. The pinout of the 18 pin main power connector is as follows:

HP Z210/Z420/Z620 18 pin motherboard power pinout

The following pins are the only pins required to power the motherboard:

Z420 PinDescriptionATX PSU pin
1, 105V output from the motherboardN/A
2-6, 11Ground3, 5, 7, 15, 17-19, 24
7, 12-1512V input10-11
8/PSON16
17+11VSB inputN/A (step-up from +5VSB)
18-12V input (not required)N/A

It is possible to inexpensively build an adapter out of a 24 pin ATX extension table and a DC buck-boost converter to step +5VSB up to +11VSB. You can also find very inexpensive adapters for sale on eBay or AliExpress which are purpose built for the Z420/Z620:

ATX to Z420/Z620 18pin adapter

These adapters are typically around $5 and include the buck-boost circuit needed to provide +11VSB (located in the black shrink wrap mid-cable).

The 8 pin power connector on the motherboard is identical to the ATX EPS power connector. However, the EPS power is on a right angle facing the top of the motherboard, you may have clearance issues installing the motherboard into some ATX chassis.


The CPU socket backplate has extrusions which will interfere with your chassis (assuming your chassis does not have a cut-out behind the CPU for accessing the backplate without removing the motherboard). These can be removed by fatiguing the metal (repeated bending using pliers) or with a dremel.

Some other minor modifications are required to convince the motherboard that it is running inside an HP chassis.

From HP service manual (PDF)

CPU fan (25): Connect pin 1 to pin 5

Front panel audio (2): Connect pin 2 (GND) to pin 4 (presence), since the pins are adjacent you can use a jumper. Connect pin 7 (sense_send) to pin 2 (GND).

Front panel IEEE1394 (1): Connect pin 11 (TPB-) to pin 12 (GND), since the pins are adjacent you can use a jumper.

Front panel LEDS (30): Connect pin 11 to Base and Collector of a 2222A NPN transistor, connect pin 12 to the 2222A Emitter.

From HP forum

Front panel USB3.0 (5): Connect pin 10 (USB3B_ID) to GND (one of pins 4, 7, 13, 16)

From HP forum

Front panel USB2.0 (4): Connect pin 8 (GND) to pin 10 (DRAIN), since the pins are adjacent you can use a jumper.


Top view of the front-panel headers on the Z420 motherboard with modifications
HP Z420 motherboard rear showing bridged connections for CPU fan, FP-USB3.0, FP-audio

A final word on power consumption: the Z420 motherboard consumes around 40W idle (E5-2630v2), but supports ACPI suspend-to-ram (S3) and consumes around 10W when in S3. Wake-on-LAN does not work when using an ATX power supply.

Siglent SDS1000X-E license recovery

I know I am late to the “recover your license keys for your Siglent oscilloscope” party, but since I recently went through this to recover my license keys, there is a much easier approach that people don’t seem to be aware of.

There are several forum topics and blog posts on the subject of recovering license keys for the Siglent SDS1000X-E series.

Most of the methods described involve extracting the cramfs, modifying the password hash of the root user, and flashing the modified image as an update.

There is a much easier way to obtain the bandwidth and option licenses of the scope while using only official Siglent firmware images.

  1. Download the firmware 6.1.25R2
  2. Extract the archive and copy the ADS file SDS1004X_E_6.1.25R2.ADS to a FAT32 formatted USB device
  3. Follow the instructions in the 6.1.25R2 archive to “update” (downgrade) the scope firmware to 6.1.25R2
  4. Navigate to the SCPI control page of the web management interface of the scope
  5. Run the following SCPI command: SHELLCMD telnetd -l/bin/sh -p9999
  6. telnet to the scope’s IP address on port 9999
  7. Dump the memory to the USB device: cat /dev/mem > /usr/bin/siglent/usr/mass_storage/U-disk0/memdump
  8. sync and umount /usr/bin/siglent/usr/mass_storage/U-disk0
  9. On a PC, run this python script with your scope_id, serial, and the path to the memory dump
    python3 siglent_sds1000xe.py --serial SDSXXXXXXX9999 --sid 012a3456789bc012 --dump /media/usb0/memdump.bin
  10. Install the 200MHz bandwidth license through the SCPI control page using the command MCBD
  11. Install the options licenses SCPI control page using the commands:
    • LCISL AWG,<code>
    • LCISL WIFI,<code>
    • LCISL MSO,<code>
  12. Reboot the scope to apply the changes
  13. After verifying that the bandwidth and option licenses are installed, update the scope firmware to the latest release (6.1.37R8 at the time of writing)

There is no need to repack the cramfs with a new shadow file containing a known root password. Additionally, the license key extraction from memory doesn’t appear to work (or at least, did not provide valid license keys for options on my scope) so I’ve borrowed the contents of a python script from the SDS2000X thread to provide option license keys for the SDS1000X-E. The script is available here.

Note that the 6.1.25R2 firmware has the root password siglent_sds1000x_e. However the password is not required in any of the above steps.