Author Topic: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair (Read 15137 times)

dschiedsch · « **on:** August 26, 2016, 12:30:44 pm »

I'm starting this topic because I have bought 2 Advantest R3273 Analyzers on ebay.
Both with different defects.
So far I have been able to replace the step attenuator and got the signal path below 3GHz working.
There was a defect bias circuit for the first mixer which put DC voltage in the first stage and degraded the signal greatly.

Since I also had to replace the mainboard all the cal data is incorrect.
This is not a problem for the range <3.5GHz because the inbuilt cal puts everything back in order.
However for frequncies above 3.5Ghz they go through a different frontend (YTF -> YIG tuned filter) and this is not calibrated with the built in cal function but has to be calibrated thorugh service menu.
Sadly I'm missing the cal manual and the password for the service menu.
I have extracted the firmware / OS which is on a CF card but so far haven't been able to find the password anywhere.
The image can be found here:
good_spectrum.img

Also I'm not sure what architecture the CPU is.
I've taken pictures.
http://imgur.com/a/gGEWs
Maybe someone on the forum is able to point me in the right direction.

Regards

PA0PBZ · « **Reply #1 on:** August 26, 2016, 02:17:19 pm »

The image contains only one file: good_spectrum.exe, which has a signature indicating that it is for Intel X86 architecture. None of the text in that file points to a spectrum analyzer.
Also, what's up with all the red paint

dschiedsch · « **Reply #2 on:** August 26, 2016, 05:38:17 pm »

Hi
You downloadad the wrong file. Damn upload sites

You have to use the correct download button (see picture)
you should get a ~15Mb .img file. Which you can either mount or open with 7-zip
I would not touch the .exe probably a trojan or similar

About the red paint. I was thinking maybe quality control or something similar.
Not sure though.
Both analyzers have it.

PA0PBZ · « **Reply #3 on:** August 26, 2016, 06:49:56 pm »

Oops, can't imagine I made a noob mistake like that!

It started to download automatically so I assumed it was the correct file, but trying again I could click the correct download button. Of course I did not execute it

Well, this is interesting. It looks like the image is FAT, at least I could extract the files that way. This is what I found so far:

* Processor is Motorola 68020, I found '68020' in the iplx.sys file and I could disassemble it as 68020 code.
* OS is a mystery, I think it's called ATOS but I've never heard of it. it's built on a bunch of .X executables like SETUP.X, STATUS.X, MENU.X and so on.
*I think I found your options:

OPT61: IS-95 [A08] Aug 08 2001
OPT62: 3GPP [J01] Jul 21 2004
OPT65: cdma2000
[D00] Jan 24 2003
OPT67: HDR [E00] Jun 28 2004

I found the occurrence of the text "password" in the MAINTE.X file but nothing obvious stands out as the solution at first glance:

nctnico · « **Reply #4 on:** August 26, 2016, 06:55:33 pm »

What would be interesting is loading the executables into a debugger and the see where the 'password' texts are referenced to. The could help to determine how the password is tested (and perhaps patch the software to just skip the test and accept any password).

dschiedsch · « **Reply #5 on:** August 26, 2016, 07:01:30 pm »

Yes skipping the password is definitly also an option since I can try with different program versions by just swapping cf cards there is also no risk of bricking the device.
Which disassembler did you load the code into?
Also found the mention of "password" in the MAINTE.X but am not sure which occurence references to what I see in the menus. and a short search for number strings between 4 and 8 characters doesn't show much useful information.
Maybe the PW is not on the CF Card but somewhere in an EEPROM on the board. Allthough I think its unlikely. The pw is just to keep normal people out not to keep the device super secure.

PA0PBZ · « **Reply #6 on:** August 26, 2016, 07:07:07 pm »

I used IDA to test disassemble the MENU.X file, but I will have a look at MAINTE.X later. The 'KEY is invalid' string looks interesting

dschiedsch · « **Reply #7 on:** August 27, 2016, 05:41:17 am »

Not as interesting as you might expect.
If you enter a wrong password for the service menu the analyzer just does nothing.
It doesn't display a message like key invalid.
I guess this string is used for the option licensing maybe?

PA0PBZ · « **Reply #8 on:** August 27, 2016, 09:27:41 pm »

Well, that turned out disappointing. I think the .X files are some kind of DLL files, there's nothing but subroutines in there and no pointers to any of the strings in the code! It looks like they are loaded and used as some kind of resource files, called by a yet unknown OS. What I noticed is that there are 8 SLOT files which seem to define sub processes and SLOT.009 looks like it has something to do with MAINTE.X:

SLOT   MAINTE   MAINTE   MAINTE.X     80 D/0/96/96     U

GETQUE MAINTE   93 8 0
GETQUE MAISUB   92 8 0
GETQUE MAISWO 94 8 0

EXECS   MAINTE

ALTOS OS is still my best guess on what is running there, but like I said I've never seen it before and google is not helpful at all. Let's hope that someone knows what's going on here.

nctnico · « **Reply #9 on:** August 27, 2016, 09:49:00 pm »

So the password is somewhere hardcoded in the executable in ASCII or the input is converted into a number and then compared.

Edit: I tried to do some 'smart' (but not extremely thourough) searching in the image for numbers and came up with these:
20010207
0218
080080
0020213380
647463

Try them if you have some time to waste.

One more: 64746

edit2: fun fact: one of the programmers misspelled 'board' consequently as 'borad'.

dschiedsch · « **Reply #10 on:** August 28, 2016, 08:05:03 am »

Hi. Yes i will try these in the evening when i get back home. Strange that they used this OS / Software combination. Maybe it was more popular in Japan.

dschiedsch · « **Reply #11 on:** August 28, 2016, 07:58:28 pm »

I'm sad to inform you that none of these gave any result.
I tried both ways to get to the PW screen:
Shift + Window and Shift + Format
then entered the password and pressed Enter
Nothing happened.

What I thought was that I could on purpose misspell each entry of Password in the MAINTE.X with different characters to find out which one is the relevant one that gets displayed in the password request.
Would that help you?

The borad misspelling is a good catch. Wonder if any of the other programmers saw it and thought, ah what the heck just leave it there.

regards

nctnico · « **Reply #12 on:** August 28, 2016, 08:11:51 pm »

Did you try to get into the service menus? On the R3477 it is not clear the password got accepted or not but if the password is right then the service menus become enabled. Perhaps you can also try to use the serial number (normal and reversed).

dschiedsch · « **Reply #13 on:** August 28, 2016, 08:58:11 pm »

From what I saw there is no dedicated Service Menu Entry in the menu system.
Someone on another forum posted about the Shift + windows and shift + format button combination.
https://groups.yahoo.com/neo/groups/advantestinstrument/conversations/messages/602

Quote

I found that pressing SHIFT/WINDOW or SHIFT/FORMAT I have it asking for PASSWORD but I have no idea what it is or if it takes me to a calibration menu.

But alas I'm not sure if this is the right entrance to the service menu.
There is no mention of it in the normal user manual at all.
Advantest are really strangely secretive when it comes to calibrating their instruments.

Ico · « **Reply #14 on:** January 25, 2017, 05:00:04 pm »

I found a password: 882323
After pressing:
Shift Format 882323
the analyzer enter in "Maintenace menu" , where "ATT switch count" and "Power ON switch count" can be set to zero. Probably there are other passwords for service menus.

dschiedsch · « **Reply #15 on:** January 26, 2017, 07:53:10 am »

Very interesting
Will try tonight.
How did you find the password?

dschiedsch · « **Reply #16 on:** January 29, 2017, 07:43:09 pm »

Can confirm that the password works
Also SHIFT WINDOW + 882323 gets you into another maintenance menu which allows much more calibration stuff
YTO calib here I come ;-)
Now I have to find someone with a high-f signal source
Thanks

Ico · « **Reply #17 on:** February 05, 2017, 07:25:26 am »

Yes, the password work also with SHIFT WINDOW.
But I could not save the changes. There is a window: "Write protection: ON"
Any idea how to switch off wirite protection ?

hafrse · « **Reply #18 on:** February 26, 2017, 02:05:16 pm »

Hello,

I tried SHIFT WINDOW 882323 on my r3273 but nothing happens. Any clue?

Thanks

dschiedsch · « **Reply #19 on:** February 26, 2017, 02:38:34 pm »

Interesting.
You could try comparing your CF-card image with mine (posted above) to see if there is a difference.
I think the PW is stored on the CF-card.
You could also try booting up your analyzer with my cf-image
just keep a copy of your image safe ;-)

dschiedsch · « **Reply #20 on:** February 26, 2017, 02:43:50 pm »

Forgot
You have to press enter (Hz button) after entering the PW

hafrse · « **Reply #21 on:** February 26, 2017, 03:42:33 pm »

Great, it worked.

Regarding the write protection, could it be the Flash card or the SW2 switches on the motherboard?

Regards

dschiedsch · « **Reply #22 on:** February 26, 2017, 04:54:48 pm »

Maybe. Worth a try at least.
I don't know if the calibration is stored on the CF Card but it would make sense.

hafrse · « **Reply #23 on:** February 26, 2017, 05:24:43 pm »

Found it, write protect is under the system menu (after you enter Shift window password)

hafrse · « **Reply #24 on:** February 26, 2017, 09:45:07 pm »

Hello,

I think the image file you posted is removed from the link you have, can you please check ? I am curious to check the files there.
Thanks


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair (Read 15137 times)

Share me