Author Topic: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair  (Read 9617 times)

0 Members and 1 Guest are viewing this topic.

Offline dschiedsch

  • Contributor
  • Posts: 22
  • Country: at
Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« on: August 26, 2016, 12:30:44 pm »
I'm starting this topic because I have bought 2 Advantest R3273 Analyzers on ebay.
Both with different defects.
So far I have been able to replace the step attenuator and got the signal path below 3GHz working.
There was a defect bias circuit for the first mixer which put DC voltage in the first stage and degraded the signal greatly.

Since I also had to replace the mainboard all the cal data is incorrect.
This is not a problem for the range <3.5GHz because the inbuilt cal puts everything back in order.
However for frequncies above 3.5Ghz they go through a different frontend (YTF -> YIG tuned filter) and this is not calibrated with the built in cal function but has to be calibrated thorugh service menu.
Sadly I'm missing the cal manual and the password for the service menu.
I have extracted the firmware / OS which is on a CF card but so far haven't been able to find the password anywhere.
The image can be found here:
good_spectrum.img

Also I'm not sure what architecture the CPU is.
I've taken pictures.
http://imgur.com/a/gGEWs
Maybe someone on the forum is able to point me in the right direction.

Regards
« Last Edit: August 28, 2016, 07:58:48 pm by dschiedsch »
 

Online PA0PBZ

  • Super Contributor
  • ***
  • Posts: 4239
  • Country: nl
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #1 on: August 26, 2016, 02:17:19 pm »
The image contains only one file: good_spectrum.exe, which has a signature indicating that it is for Intel X86 architecture. None of the text in that file points to a spectrum analyzer.
Also, what's up with all the red paint  :-//
Keyboard error: Press F1 to continue.
 

Offline dschiedsch

  • Contributor
  • Posts: 22
  • Country: at
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #2 on: August 26, 2016, 05:38:17 pm »
Hi
You downloadad the wrong file. Damn upload sites  :horse:
You have to use the correct download button (see picture)
you should get a ~15Mb .img file. Which you can either mount or open with 7-zip
I would not touch the .exe probably a trojan or similar

About the red paint. I was thinking maybe quality control or something similar.
Not sure though.
Both analyzers have it.
 

Online PA0PBZ

  • Super Contributor
  • ***
  • Posts: 4239
  • Country: nl
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #3 on: August 26, 2016, 06:49:56 pm »
Oops, can't imagine I made a noob mistake like that!  :palm: It started to download automatically so I assumed it was the correct file, but trying again I could click the correct download button. Of course I did not execute it :)

Well, this is interesting. It looks like the image is FAT, at least I could extract the files that way. This is what I found so far:

* Processor is Motorola 68020, I found '68020' in the iplx.sys file and I could disassemble it as 68020 code.
* OS is a mystery, I think it's called ATOS but I've never heard of it. it's built on a bunch of .X executables like SETUP.X, STATUS.X, MENU.X and so on.
*I think I found your options:

OPT61: IS-95  [A08] Aug 08 2001
OPT62: 3GPP   [J01] Jul 21 2004
OPT65: cdma2000
              [D00] Jan 24 2003
OPT67: HDR    [E00] Jun 28 2004


I found the occurrence of the text "password" in the MAINTE.X file but nothing obvious stands out as the solution at first glance:


Keyboard error: Press F1 to continue.
 

Online nctnico

  • Super Contributor
  • ***
  • Posts: 18580
  • Country: nl
    • NCT Developments
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #4 on: August 26, 2016, 06:55:33 pm »
What would be interesting is loading the executables into a debugger and the see where the 'password' texts are referenced to. The could help to determine how the password is tested (and perhaps patch the software to just skip the test and accept any password).
There are small lies, big lies and then there is what is on the screen of your oscilloscope.
 

Offline dschiedsch

  • Contributor
  • Posts: 22
  • Country: at
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #5 on: August 26, 2016, 07:01:30 pm »
Yes skipping the password is definitly also an option since I can try with different program versions by just swapping cf cards there is also no risk of bricking the device.
Which disassembler did you load the code into?
Also found the mention of "password" in the MAINTE.X but am not sure which occurence references to what I see in the menus. and a short search for number strings between 4 and 8 characters doesn't show much useful information.
Maybe the PW is not on the CF Card but somewhere in an EEPROM on the board. Allthough I think its unlikely. The pw is just to keep normal people out not to keep the device super secure.
« Last Edit: August 26, 2016, 07:06:42 pm by dschiedsch »
 

Online PA0PBZ

  • Super Contributor
  • ***
  • Posts: 4239
  • Country: nl
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #6 on: August 26, 2016, 07:07:07 pm »
I used IDA to test disassemble the MENU.X file, but I will have a look at MAINTE.X later. The 'KEY is invalid' string looks interesting  >:D
Keyboard error: Press F1 to continue.
 

Offline dschiedsch

  • Contributor
  • Posts: 22
  • Country: at
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #7 on: August 27, 2016, 05:41:17 am »
Not as interesting as you might expect.
If you enter a wrong password for the service menu the analyzer just does nothing.
It doesn't display a message like key invalid.
I guess this string is used for the option licensing maybe?
 

Online PA0PBZ

  • Super Contributor
  • ***
  • Posts: 4239
  • Country: nl
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #8 on: August 27, 2016, 09:27:41 pm »
Well, that turned out disappointing. I think the .X files are some kind of DLL files, there's nothing but subroutines in there and no pointers to any of the strings in the code! It looks like they are loaded and used as some kind of resource files, called by a yet unknown OS. What I noticed is that there are 8 SLOT files which seem to define sub processes and SLOT.009 looks like it has something to do with MAINTE.X:

SLOT   MAINTE   MAINTE   MAINTE.X      80 D/0/96/96      U

GETQUE  MAINTE   93 8 0
GETQUE  MAISUB   92 8 0
GETQUE  MAISWO  94 8 0

EXECS   MAINTE

ALTOS OS is still my best guess on what is running there, but like I said I've never seen it before and google is not helpful at all. Let's hope that someone knows what's going on here.
Keyboard error: Press F1 to continue.
 

Online nctnico

  • Super Contributor
  • ***
  • Posts: 18580
  • Country: nl
    • NCT Developments
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #9 on: August 27, 2016, 09:49:00 pm »
So the password is somewhere hardcoded in the executable in ASCII or the input is converted into a number and then compared.

Edit: I tried to do some 'smart' (but not extremely thourough) searching in the image for numbers and came up with these:
20010207
0218
080080
0020213380
647463

Try them if you have some time to waste.

One more: 64746

edit2: fun fact: one of the programmers misspelled 'board' consequently as 'borad'.
« Last Edit: August 27, 2016, 10:50:12 pm by nctnico »
There are small lies, big lies and then there is what is on the screen of your oscilloscope.
 

Offline dschiedsch

  • Contributor
  • Posts: 22
  • Country: at
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #10 on: August 28, 2016, 08:05:03 am »
Hi. Yes i will try these in the evening when i get back home. Strange that they used this OS / Software combination. Maybe it was more popular in Japan.
 

Offline dschiedsch

  • Contributor
  • Posts: 22
  • Country: at
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #11 on: August 28, 2016, 07:58:28 pm »
I'm sad to inform you that none of these gave any result.
I tried both ways to get to the PW screen:
Shift + Window and Shift + Format
then entered the password and pressed Enter
Nothing happened.  :(
What I thought was that I could on purpose misspell each entry of Password in the MAINTE.X with different characters to find out which one is the relevant one that gets displayed in the password request.
Would that help you?

The borad misspelling is a good catch. Wonder if any of the other programmers saw it and thought, ah what the heck just leave it there.

regards
 

Online nctnico

  • Super Contributor
  • ***
  • Posts: 18580
  • Country: nl
    • NCT Developments
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #12 on: August 28, 2016, 08:11:51 pm »
Did you try to get into the service menus? On the R3477 it is not clear the password got accepted or not but if the password is right then the service menus become enabled. Perhaps you can also try to use the serial number (normal and reversed).
There are small lies, big lies and then there is what is on the screen of your oscilloscope.
 

Offline dschiedsch

  • Contributor
  • Posts: 22
  • Country: at
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #13 on: August 28, 2016, 08:58:11 pm »
From what I saw there is no dedicated Service Menu Entry in the menu system.
Someone on another forum posted about the Shift + windows and shift + format button combination.
https://groups.yahoo.com/neo/groups/advantestinstrument/conversations/messages/602
Quote
I found that pressing SHIFT/WINDOW or SHIFT/FORMAT I have it asking for PASSWORD but I have no idea what it is or if it takes me to a calibration menu.

But alas I'm not sure if this is the right entrance to the service menu.
There is no mention of it in the normal user manual at all.
Advantest are really strangely secretive when it comes to calibrating their instruments.
 

Offline Ico

  • Newbie
  • Posts: 2
  • Country: bg
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #14 on: January 25, 2017, 05:00:04 pm »
I found a password: 882323
After pressing:
Shift  Format  882323
the analyzer  enter in "Maintenace menu" , where "ATT switch count" and "Power ON switch count" can be set to zero. Probably there are other passwords for service menus.
 

Offline dschiedsch

  • Contributor
  • Posts: 22
  • Country: at
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #15 on: January 26, 2017, 07:53:10 am »
Very interesting
Will try tonight.
How did you find the password?
 

Offline dschiedsch

  • Contributor
  • Posts: 22
  • Country: at
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #16 on: January 29, 2017, 07:43:09 pm »
Can confirm that the password works
Also SHIFT WINDOW + 882323 gets you into another maintenance menu which allows much more calibration stuff
YTO calib here I come ;-)
Now I have to find someone with a high-f signal source
Thanks
 

Offline Ico

  • Newbie
  • Posts: 2
  • Country: bg
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #17 on: February 05, 2017, 07:25:26 am »
Yes, the password work also with SHIFT WINDOW.
But I could not  save the changes. There is a window: "Write protection: ON"
 Any idea how to switch off wirite protection ?
 

Offline hafrse

  • Regular Contributor
  • *
  • Posts: 72
  • Country: se
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #18 on: February 26, 2017, 02:05:16 pm »
Hello,

I tried  SHIFT WINDOW  882323 on my r3273 but nothing happens. Any clue?

Thanks
 

Offline dschiedsch

  • Contributor
  • Posts: 22
  • Country: at
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #19 on: February 26, 2017, 02:38:34 pm »
Interesting.
You could try comparing your CF-card image with mine (posted above) to see if there is a difference.
I think the PW is stored on the CF-card.
You could also try booting up your analyzer with my cf-image
just keep a copy of your image safe ;-)
 

Offline dschiedsch

  • Contributor
  • Posts: 22
  • Country: at
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #20 on: February 26, 2017, 02:43:50 pm »
Forgot
You have to press enter (Hz button) after entering the PW
 

Offline hafrse

  • Regular Contributor
  • *
  • Posts: 72
  • Country: se
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #21 on: February 26, 2017, 03:42:33 pm »
Great, it worked.

Regarding the write protection, could it be the Flash card or the SW2 switches on the motherboard?

Regards
 

Offline dschiedsch

  • Contributor
  • Posts: 22
  • Country: at
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #22 on: February 26, 2017, 04:54:48 pm »
Maybe. Worth a try at least.
I don't know if the calibration is stored on the CF Card but it would make sense.
 

Offline hafrse

  • Regular Contributor
  • *
  • Posts: 72
  • Country: se
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #23 on: February 26, 2017, 05:24:43 pm »
Found it, write protect is under the system menu (after you enter Shift window password)
 

Offline hafrse

  • Regular Contributor
  • *
  • Posts: 72
  • Country: se
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #24 on: February 26, 2017, 09:45:07 pm »
Hello,

I think the  image file you posted is removed from the link you have, can you please check ? I am curious to check the files there.
Thanks
 

Offline hafrse

  • Regular Contributor
  • *
  • Posts: 72
  • Country: se
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #25 on: February 26, 2017, 09:49:24 pm »
I'm starting this topic because I have bought 2 Advantest R3273 Analyzers on ebay.
Both with different defects.
So far I have been able to replace the step attenuator and got the signal path below 3GHz working.
There was a defect bias circuit for the first mixer which put DC voltage in the first stage and degraded the signal greatly.

Since I also had to replace the mainboard all the cal data is incorrect.
This is not a problem for the range <3.5GHz because the inbuilt cal puts everything back in order.
However for frequncies above 3.5Ghz they go through a different frontend (YTF -> YIG tuned filter) and this is not calibrated with the built in cal function but has to be calibrated thorugh service menu.
Sadly I'm missing the cal manual and the password for the service menu.
I have extracted the firmware / OS which is on a CF card but so far haven't been able to find the password anywhere.
The image can be found here:
good_spectrum.img

Also I'm not sure what architecture the CPU is.
I've taken pictures.
http://imgur.com/a/gGEWs
Maybe someone on the forum is able to point me in the right direction.

Regards

Hello,

I think the  image file you posted is removed from the link you have, can you please check ? I am curious to check the files there.
Thanks

Regards
 

Online PA0PBZ

  • Super Contributor
  • ***
  • Posts: 4239
  • Country: nl
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #26 on: February 26, 2017, 10:00:35 pm »
I think the  image file you posted is removed from the link you have, can you please check ? I am curious to check the files there.

Uploaded here: http://www.filedropper.com/goodspectrum
Keyboard error: Press F1 to continue.
 

Offline hafrse

  • Regular Contributor
  • *
  • Posts: 72
  • Country: se
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #27 on: February 27, 2017, 04:41:36 pm »
I think the  image file you posted is removed from the link you have, can you please check ? I am curious to check the files there.

Uploaded here: http://www.filedropper.com/goodspectrum
Thanks
 

Offline dschiedsch

  • Contributor
  • Posts: 22
  • Country: at
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #28 on: February 27, 2017, 10:10:33 pm »
Hi.
No I haven't found someone with a signal source yet.
I'm talking to someone at the university which looks good but I don't have that much time at the moment so it will take another month or so to do it.
Since someone else reuploaded the image I didn't reupload my copy. I hope thats ok. Otherwise I can upload mine as well
 

Offline hafrse

  • Regular Contributor
  • *
  • Posts: 72
  • Country: se
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #29 on: March 02, 2017, 09:46:27 pm »
You are right, no way to save calibration values , write protection is on and can not be changed....
 

Offline lowtension

  • Contributor
  • Posts: 24
  • Country: de
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #30 on: April 10, 2017, 03:32:54 pm »
Not as interesting as you might expect.
If you enter a wrong password for the service menu the analyzer just does nothing.
It doesn't display a message like key invalid.
I guess this string is used for the option licensing maybe?

Pressing SHIFT + TRANSIENT will also ask for a password. 882323 will not work. any clues what this password is?

Thanks
 

Offline mvanocht

  • Contributor
  • Posts: 8
  • Country: us
Re: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair
« Reply #31 on: June 07, 2017, 07:24:08 pm »
I also have this model analyzer.  Documentation says they offered an "Option 5" Audio Demodulation.  I wondered if it was just enabled through software or if it included some hardware.  I had the front panel off a few days ago, and found the internal speaker is there, along with the headphone jack, and everything is wired up and therefore I think it is just a software option.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf