'Free' VSA options

[PA0PBZ]

Two weeks ago I bought an E4406A from KJDS as a companion to my E4433D. Since it only came with the GSM-Edge option I sniffed around a bit to see what was possible, since I wanted the wcdma enabled. So I did what I normally do, download a firmware upgrade to get an easy access to the system files. Well, in this case it is an interesting upgrade because it comes with a java installer to update the VSA via the lan. Peeking around a bit told me that most of the stuff is done via FTP and of course in there was the user/pass for that and the location of the license files. To my surprise on my VSA there were not only the standard license files which come in the form of OPT.lic (like 202.lic) but also some other files:

Code: [Select]

202.lic
252.lic
B78.lic
BAC.lic
BAE.lic
nfstmp.3bd8829400000001
nfstmp.3bd8829400000002
nfstmp.3bd8829400000003
nfstmp.3bd8829400000004
nfstmp.3bd8829400000005
nfstmp.3bd8829400000006
nfstmp.3bdeb64f00000001
nfstmp.3bdeb64f00000002
nfstmp.3bdeb64f00000003
nfstmp.3bdeb64f00000004
nfstmp.3bdeb64f00000005
nfstmp.3bdeb64f00000006
nfstmp.3c029a2400000001
nfstmp.3c029a2400000002
nfstmp.3c029a2400000003
nfstmp.3c029a2400000004
nfstmp.3c029a2400000005
TEMPLATE.lic

I know these license files, They are used by FlexLM which you see in a lot of Agilent products from that time. They are all like this:

FEATURE 202 TMOMID01 1.0 permanent uncounted 0123456789AB  \
  HOSTID=VSA_HOSTID=E1234567

Where HOSTID is the ID of the instrument and the 0123456789AB is the generated key. So what are these nfstmp files? It turnes out that this VSA for some strange reason has a few license files for three different host id's, and luckily one of the id's is the same as my machine. So all I have to do is to copy the nfstmp file with the correct host id and the wcdma option (BAF) to BAF.lic right? Almost... The VSA has only the option code for the installed options, so while I now have the correct license for wcdma the code is still missing. No panic! Just download the correct firmware update, unpack and transfer the (in this case) orion.wcdmart.0 to the VSA. Done!

Of course YMMV but if you are into some fun have a look in your VSA. FTP to it, use vsa/service as user/pass and do an ls-l licenses, who knows you are as lucky as I was 

[dxl]

Hi,

i played a few years ago with the licensing, and i needed to change the following bytes in the binary to make it accept all licenses regardless whether the checksum is valid:

$ cmp -l orion.cchprt orion.cchprt.ori
2530905  64 213
2530906  34 200
2530907   0  40
2530908   0 250

I think that was already with the latest VSA Firmware (A.10.08?).

With that hack you just need to copy the license file to a new name, and modify the contents.

Have fun

[PA0PBZ]

With that hack you just need to copy the license file to a new name, and modify the contents.

Yes I was planning to go that route (did the same with a N1996a) but since I found the license I was after I called it a day.
Maybe I'll look into it later, thanks!

[harha]

Hi
I have serviced some e4406A`s and found exactly the same as you-many of them have the license files for many options stored!
All of them came from nokia.
Could someone please explain how to use the metod mentioned by dxl?.
Would also like to have  H17 wlan option installed-have the lic file,but where do i get the file from?-its not a part of A10.08 firmware.
Regards
Hardy

[helius]

dxl used cmp(1) to print out the bytes differing in the original and his patch.
you can apply the patch using xxd(1):

Code: [Select]

cp orion.cchprt orion.cchprt.modified
echo "40220000" | xxd -r -p -s2530905 - orion.cchprt.modified

[PA0PBZ]

Would also like to have  H17 wlan option installed-have the lic file,but where do i get the file from?-its not a part of A10.08 firmware.

I'm not sure what version of the firmware updater I installed, but the wlan file is there.
In the folder data_files you will find the file h17.install.txt which shows you what file you need:

Option: H17
orion.wlanrt.0

The orion.wlanrt.0 file is in the FTPFiles folder.

[harha]

Thanks to All
Yes-PAOPBZ-
You are right,did find the file for h17-thanks..
But as I am not a great programmer and afraid of doing something very wrong,could someone explain(maybe helius?) how to use the patch shown by helius?.

[PA0PBZ]

But as I am not a great programmer and afraid of doing something very wrong,could someone explain(maybe helius?) how to use the patch shown by helius?.

In an earlier post you mentioned that you have the LIC file, and in that case a patch is not needed, just rename the file to H17.lic and upload the orion.wlanrt.0 to the unit.

[harha]

Sorry
I have not been clear!
Have installed h17-thanks,but would like to know how to install other options withouth lic files.Cant open the orion file..

[PA0PBZ]

Have installed h17-thanks,but would like to know how to install other options withouth lic files.Cant open the orion file..

The orion.cchprt file is a binary file, so you need some kind of hex editor to change the contents.
I'm not sure what tools are available in the OS of the machine so I'd download it to the PC and use your favorite tool.
Make a copy first (orion.cchprt.orig) and store this on the VSA.
Then open the file in a hex editor, check if the file locations mentioned contain the first value, then change it to the second value.

Code: [Select]

2530905  64 213
2530906  34 200
2530907   0  40
2530908   0 250

After that copy the file back to the VSA.

Since I did not create the hack I'm not sure what to do next, probably you will have to create fake .lic files with the proper name (like 202.lic) but the content doesn't matter, so just copy an existing .lic file to a file with the proper name.

[mikerj]

Then open the file in a hex editor, check if the file locations mentioned contain the first value, then change it to the second value.

Possibly the other way around?  The files in dxl's post are orion.cchprt and orion.cchprt.ori, so if one ending in .ori is the original then the values in the first column are the new ones.

Also cmp outputs the byte values in octal, so you need to be aware of this if using a hex editor.

[PA0PBZ]

Possibly the other way around?  The files in dxl's post are orion.cchprt and orion.cchprt.ori, so if one ending in .ori is the original then the values in the first column are the new ones.

You are totally right. My mind interpreted the list as a patch list 

[harha]

Hi All
Have copied the orioncchprt and use free hex editor neo-it let me choose octal,hex etc---but cant see the addresses mentioned(2530905.....2530908)??
I make somthing wrong,but cant figure what?.
Regards
Ps   Have any of you made a script for greater spans?have used
ve2zaz python script-works great-but really would like if it could continusly make updates.

[Pieh0]

dxl used cmp(1) to print out the bytes differing in the original and his patch.
you can apply the patch using xxd(1):

Code: [Select]

cp orion.cchprt orion.cchprt.modified
echo "40220000" | xxd -r -p -s2530905 - orion.cchprt.modified

Tried doing that, and checked it against dxl's compare between the files, and got totally the wrong results, so after toying around with it, here is the correct command.

Code: [Select]

echo "341C0000" | xxd -r -p -s2530904 - orion.cchprt.modified
Doing that gets me the correct result

cmp -l orion.cchprt.modified orion.cchprt.10.08.orig     
2530905  64 213
2530906  34 200
2530907   0  40
2530908   0 250

Just tried it now and it works, rather than crashing on bootup requiring you to do a full install.

[helius]

Good catch, my mistake was relying on the GNU manual page for cmp(1) 
It doesn't tell you that the output bytes are in octal.

[harha]

Hi All
Have tried to modify the orion lic file without any luck.
Were thinking about if it would be possible to use a working copy of this modified orion.cchprt file from one of your e4406a`s?
Or maybe it have to be my orion.cchprt file?-if so i can at least find out to copy and transfer it.
Any help welcome.
Hardy

[davorin]

Let me get this straight...

My machine has:

Code: [Select]

252.lic
BAF.lic
BAH.lic
The license Folder contains also nfstmp files (is there nfs enabled?)
with following licenses:

Code: [Select]

FEATURE 202
FEATURE B78
FEATURE BAE
FEATURE BAC
FEATURE 204
The system screen also shows information, that a key is installed, but not the firmware, for example for BAH.lic.

So would I also need to install the nirmware or is it enough to just copy over the nfstmp files and reboot?

[PA0PBZ]

You also need the firmware and enough space to put it on the machine, maybe taking off something you don't need.
See my original post in this thread. Also check if the nfstemp files have the correct hostid.

[davorin]

Yes the HOSTIDs are all the same....

But does for every installed key has to be an installed firmware in the system info menu?

Well...what the heck is jwview the Firmware updater is looking for.....(o;

[PA0PBZ]

Just unpack the updater and move the files you need to the VSA. There is a nice script inside the update package which shows you how it is done 

[davorin]

Okay...installed a new Firmware for WCDMA and shows as 10.08 now...as also copied over one nfstmp file to 202.lic...seems to work...

Guess I can just replace all "Orion.*" files then with the 10.08 files?
Or needs the system also to be updated from the "install" folder?

[PA0PBZ]

I think that the orion files should be used with the corresponding firmware, but maybe that version is already on your machine?
ISTR that I downloaded the firmware version that was already on my VSA and took the orion files from there.

[davorin]

Well firmware Revision is still shown as 10.05 on top of the system info....

[PA0PBZ]

Well firmware Revision is still shown as 10.05 on top of the system info....

Maybe not enough difference then? If I remember correctly I once tried an orion file from a different version and it didn't like it.

[davorin]

Hmm..bastards....configured telnet in inetd.conf but left out /bin/telnetd....


But instead have a web server running (o;