Products > Test Equipment
Agilent E7495 linux root account
<< < (26/91) > >>
DogP:

--- Quote from: jwm_ on November 05, 2016, 03:00:19 am ---Anyone figure out a fix for the screen bezel coming undone? The system works fine, but part of the screen is obscured. Picture attached

--- End quote ---
If you look at the service manual, there's a detailed procedure for removing and disassembling the display.  Pg. 111 removes the front panel from the unit, and pg. 145 removes the display from the front panel.  Once there, it looks like the gasket is accessible (MP29).

Pat
DogP:
I spent a bit of time looking at this again, trying to get some remote access/control working.  As noted earlier, the E7495 has a webpage, but doesn't accept the normal login.  I noticed a similar non-working login on port 5025.  Using netstat, I saw that elgato was listening on those ports.  When looking in the /flash/egServer directory, I noticed a passwd file.  It looked different than the standard *nix passwd file, but appeared to have a hashed root password in it (RzSdSbSdye).

Rather than trying to crack the password, I decided to try simply renaming the passwd file and rebooting.  Surprisingly, it didn't recreate it, and now simply accepts any login! (on both the webpage and port 5025).

The webpage has a bunch of configuration stuff, though the coolest thing seems to be the "Transducer I/O" section.  For example, if you click "Active STIM" you can select 16 (Spectrum Analyzer), and then go to the "Channel I/O" page and click "Array" under Channel 1 to get the spectrum data.  You can set parameters, etc. as well, which get set using http POST.  I'm not really familiar with it, but I believe this is IEEE 1451 standard stuff.  Maybe there's a way to tell elgato to do these operations directly, rather than through http.

Port 5025 now accepts any login as well, though I was hoping it'd be SCPI (commonly on that port)... instead, it looks like it's something called the "DMC Shell".  Typing "help", it says "The Dmc Shell accepts "C" like function statements and assignments" and gives some examples... not sure how useful it is.


I also took a look at the remote GUI... it didn't seem to work on Windows with Java 8 (even using the commands further up in the thread).  Rather than dig into it, I installed Java 1.4.2 in a VM, grabbed the jre directory, and explicitly ran RemoteGui.jar using that version of java ("jre\bin\java -jar RemoteGui.jar").  By doing that, the remote GUI worked first try.

I was interested in how it communicated, so I sniffed the packets.  It looks like most stuff goes over port 5028.  The commands and acknowledgements go over TCP, and the spectrum display data goes over UDP.  It looks like there’s some status (power, GPS, etc) coming out 1027 as well.

I had to make sure Windows allowed the data through the firewall (without it, the TCP commands would go through, but the UDP data wouldn’t, so the GUI would never show the spectrum).  Also, Windows 7 temporarily goes back to basic graphics (disabling Aero) when you run Java 1.4.2.

The commands going over 5028 don't look to be any standard I'm familiar with.  Some examples are (without the quotes, <\n> is hex 0A): “cmd: local<\n><\n>”, "cmd: set<\n>topic: display.global<\n>printFilter: 0<\n><\n>", etc.  If you dig through the elgato binary, you can see a bunch of available commands (and you can test them out using nc).

 
Oh, and I quickly glanced at the decompiled egclient posted earlier in the thread... if you look in the manufacturing directory, it appears that there’s a Snake and Tetris game, seemingly in a hidden menu on the Display Test screen.  It wasn’t immediately obvious how to access it though.


Pat
DogP:
Heh, it bugged me having games on here that I couldn't get to, so I tracked it down. :-P

Though the code has it with the DisplayTestScreen stuff, it really doesn't have anything to do with that.  To get there, you click the Spectrum Analyzer / Tools menu, then quickly click the bottom right display button 3 times.  Then the "Extras" buttons pop up with Tetris and Nibbles.

DogP
TheSteve:
Nice find!

You can enable the same web login etc on the E7495's big brother, the N1996A by renaming the /flash/toroServer/passwd file.
DogP:
Here's a quick (and kinda pointless) mod... I didn't really like this being called a "Base Station" test set, since it's never gonna test another base station in its life. ;)  So I opened up the egclient JAR file (with 7-zip), and replaced the cell tower background with a generic modern Agilent background (that they use on their documentation, etc... grabbed from: http://eprocurement.agilent.com/ ).  I also got rid of the "Base Station" text.  It's just a matter of modifying the ModeScreen.jpg and ModeScreen_overlay-E7495A.png (-E7495B if you've got the B model).

The colors on the LCD aren't very accurate (it had a much greener tint than it should have), so I adjusted the hue/saturation a bit to get it kinda close to the original blue, and it turned out pretty good.

Oh, and something interesting I noticed... in the JAR file is a graphic for the an E7496A.  AFAIK, that doesn't exist... I wonder what the specs of that unit would have been.

Pat
Navigation
Message Index
Next page
Previous page
There was an error while thanking
Thanking...

Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod