Author Topic: Agilent E7495 linux root account  (Read 136092 times)

0 Members and 2 Guests are viewing this topic.

Online tv84

  • Super Contributor
  • ***
  • Posts: 3213
  • Country: pt
Re: Agilent E7495 linux root account
« Reply #400 on: September 27, 2020, 08:04:44 am »
For options you don't need to continue patching the "the cat" file.

Here;)
 
The following users thanked this post: kirill_ka, HandBuilt

Offline 9aplus

  • Regular Contributor
  • *
  • Posts: 158
Re: Agilent E7495 linux root account
« Reply #401 on: February 28, 2021, 10:46:45 pm »
Hi Eric,
following your progress, but no time to test on my unit.
Usually using Anaren DBM to extend range up to 4 GHz by mixing ;)
 

Offline 9aplus

  • Regular Contributor
  • *
  • Posts: 158
Re: Agilent E7495 linux root account
« Reply #402 on: March 15, 2021, 06:36:15 am »
Great work, congratulate  :clap:

Assuming you gained full functions as described:
http://rltechnical.com/_sample_files/sample_indesign/L4600A_technical_overview.pdf

Except hardware option -> L4600A-530 5-pin Connector with FM Audio Demodulation Out (Voice Out)

Top limit in document is still 2,7 GHz?

Do you have now signal generator functionality from 2 MHz to 2,5 GHz ?

In case of all answers are YES, just need one step by step instruction set for dummies to run up my E7495B  :popcorn:

Regards
Djani
 

Offline 9aplus

  • Regular Contributor
  • *
  • Posts: 158
Re: Agilent E7495 linux root account
« Reply #403 on: March 17, 2021, 08:03:28 am »
Looking from the side,
the only real gain is that (for E7495B) additional FM modulation option?
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
Re: Agilent E7495 linux root account
« Reply #404 on: March 26, 2021, 07:33:11 pm »
The big brother N1996A only required an edit of text based files to extend the gen frequency range. Is there a block diagram of the entire 7495 - that should show us if hardware is present to gen below 375 MHz.
VE7FM
 

Offline kirill_ka

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: Agilent E7495 linux root account
« Reply #405 on: March 30, 2021, 08:10:07 pm »
Hi Eric,

I can imagine two ways to recover the DSP firmware.
1) To dig into the bootstrap procedure for the SHARC. Maybe this can be done by reverse engineering the replaceTrashedRunCode. Also it might be possible to find some clues in the SHARC manuals.
2) To recover the DSP flash directly. I'm pretty sure there should be a JTAG connector on the DSP board which can be used to access the flash.
Here's the picture of the board:
https://www.ebay.com/itm/Agilent-E7495-63015-E7495-20015-990075-101602-REV-103-Board-Assembly/284074186099

I don't understand what you mean by "mounting" serial ports. "mount" is the term which is only used for filesystems.
 

Offline kirill_ka

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: Agilent E7495 linux root account
« Reply #406 on: March 31, 2021, 10:59:15 am »
tty sure there should be a JTAG connector on the DSP board which can be used to access the flash.
Here's the picture of the board:
https://www.ebay.com/itm/Agilent-E7495-63015-E7495-20015-990075-101602-REV-103-Board-Assembly/284074186099
Ah, right. The link above should be the "Complex source board". I was fooled because it also contains a similar ADSP processor. Note the similarities between the boards.
If you are not fluent with reverse engineering linux/arm code, I think that your best bet is to identify the JTAG connector. Once you can extract the flash image, I might be able to help with recovery.
 

Offline kirill_ka

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: Agilent E7495 linux root account
« Reply #407 on: April 01, 2021, 09:45:09 pm »
Eric,
Why ever you think that the logic analyser's giving you wrong numbers and 2403 should be read as 230400?   :-//
I'd say it's pointless to assume that replaceTrashedRunCode /which is designed to run on different hardware of N1996A/ will magically recover your E7495.
 

Offline kirill_ka

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: Agilent E7495 linux root account
« Reply #408 on: April 01, 2021, 10:17:31 pm »
I would like to believe that it is only a problem of configuration before I part with this object in parts.  ;D
In Russian this is called "searching at well lit place but not the place where you've lost the thing;) I don't know an English equivalent for the phrase.
 

Offline kirill_ka

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: Agilent E7495 linux root account
« Reply #409 on: April 02, 2021, 08:27:17 am »
we could say that with the differences that i don't know what i lost, nor where i lost it.  :-BROKE  ;D

At first I thought I had flashed the DSP card, but with these last measurements on J102, I am not sure of anything.
why would the A4A1 ADS / CPU Board drop to 4800bd / s and why a
setserial / dev / ttyS3 Baud_base 230400 does not change anything.
I admit being a little confused about the impact of replacing the Dragonfly / Firmware / *. bin files with those from the N1996A as well as the comPort4 file.

As you restored the ARM board firmware, there's no reason to think that something's wrong with the configuration of the "CPU board".
The serial port speed is normally set by an application to whatever it wants. So I assume that replaceTrashedRunCode does what it's supposed to do. It may be just incompatible.
 

Offline kirill_ka

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: Agilent E7495 linux root account
« Reply #410 on: April 03, 2021, 10:28:18 pm »
Code: [Select]
USAGE: replaceTrashedRunCode [-r <rev>]
where: -r <rev>   = revision to be replaced

If the help text doesn't lie, you need to specify the revision to be replaced, but not the revision you are going to replace with.
 

Offline pieroc91

  • Contributor
  • Posts: 46
  • Country: ar
Re: Agilent E7495 linux root account
« Reply #411 on: June 14, 2021, 11:14:18 pm »
Amazing all you guys hacked on this thing... on my device i got stuck at the Copyright screen and does not respond to anything, i've updated the firmware, replaced the elgato binary modified licences and still can't pass that screen, had anyone came across this problem and might have a clue on how to fix it?
Thanks!
 

Offline kirill_ka

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: Agilent E7495 linux root account
« Reply #412 on: June 15, 2021, 12:06:57 pm »
Amazing all you guys hacked on this thing... on my device i got stuck at the Copyright screen and does not respond to anything, i've updated the firmware, replaced the elgato binary modified licences and still can't pass that screen, had anyone came across this problem and might have a clue on how to fix it?
Thanks!
The symptom is not specific. It's probably the "elgato" fails to initialize (possibly due to some hardware problem). Try to gather more information (messages, logs, diagnostic web pages* ). Despite the UI is not started the device still can be accessed through the Ethernet and console ports.

* The ones you gеt by accessing the device via http.
 

Offline pieroc91

  • Contributor
  • Posts: 46
  • Country: ar
Re: Agilent E7495 linux root account
« Reply #413 on: June 15, 2021, 01:54:37 pm »
Hi @kirill_ka yes, i can access via telnet without a problem, the web interface is unstable for me, sometimes work, sometimes doesn't and when it works it does not log in.

if i give it a ps aux i get this

Code: [Select]
[root@Linux /root]$ps aux
USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME COMMAND
root         1  2.0  0.8  1384  544 ?        S    14:40   0:07 init
root         2  0.0  0.0     0    0 ?        SW   14:40   0:00 [keventd]
root         3  0.0  0.0     0    0 ?        SWN  14:40   0:00 [ksoftirqd_CPU0]
root         4  0.0  0.0     0    0 ?        SW   14:40   0:00 [kswapd]
root         5  0.0  0.0     0    0 ?        SW   14:40   0:00 [bdflush]
root         6  0.0  0.0     0    0 ?        SW   14:40   0:00 [kupdated]
root         7  0.0  0.0     0    0 ?        SW   14:40   0:00 [mtdblockd]
root         8  0.0  0.0     0    0 ?        SW   14:40   0:00 [khubd]
root        40  0.0  0.0     0    0 ?        SWN  14:40   0:00 [jffs2_gcd_mtd3]
root        54  0.0  1.1  1480  732 ?        S    14:40   0:00 /sbin/cardmgr -f
root       574  0.0  1.0  1568  648 ?        S    14:40   0:00 dhcpcd -DH -t 10
root       597  0.0  0.8  1680  544 ?        S    14:40   0:00 syslogd -m 0
bin        623  0.0  0.7  1456  444 ?        S    14:40   0:00 [portmap]
root       653  0.0  1.0  1592  644 ?        S    14:40   0:00 inetd
root       666  0.0  0.8  1704  544 ?        S    14:40   0:00 /bin/sh /etc/rc.d/rc3.d/S51timeUpdate.sh start
root       667  0.0  1.2  1788  772 ?        S    14:40   0:00 /bin/bash /flash/elgato/utils/keepTimeUpdated
root       668  0.0  0.5  1672  336 ?        S    14:40   0:00 sleep 1200
root       697  0.0  0.7  1572  476 tty1     S    14:41   0:00 /sbin/getty 38400 tty1
root       698  0.0  0.7  1572  484 ttyS/ttySA0 S 14:41   0:00 /sbin/getty -L ttyS0 38400 vt100
root       699  0.0  1.2  1796  808 ?        S    14:41   0:00 /bin/bash /root/catch_sleep.sh
root       732  2.2 12.1 12060 7624 tty2     S    14:41   0:07 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jar
root       734  0.0 12.1 12060 7624 tty2     S    14:41   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jar
root       735  0.0 12.1 12060 7624 tty2     S    14:41   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jar
root       736  0.0 12.1 12060 7624 tty2     S    14:41   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jar
root       737  0.0 12.1 12060 7624 tty2     S    14:41   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jar
root       738  0.2 12.1 12060 7624 tty2     S    14:41   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jar
root       739  0.0 12.1 12060 7624 tty2     S    14:41   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jar
root       740  0.0 12.1 12060 7624 tty2     S    14:41   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jar
root       741  0.0 12.1 12060 7624 tty2     S    14:41   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jar
root       742  0.0 12.1 12060 7624 tty2     S    14:41   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jar
root       743  0.0  4.2 18604 2660 ?        S    14:42   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       744  0.4  1.3  1956  848 ?        S    14:46   0:00 in.telnetd
root       745  0.5  1.4  1816  928 pts/0    S    14:46   0:00 -bash
root       757  0.0  1.3  2712  852 pts/0    R    14:46   0:00 ps aux


if a dmesg i cant get a clear error from the elgato server
Code: [Select]
jffs2_scan_inode_node(): Data CRC failed on node at 0x032efdfc: Read 0xe6bf2df9, calculated 0xb90b73e0
jffs2_scan_eraseblock(): Node at 0x032f0884 {0x1985, 0xe001, 0x00000b28) has invalid CRC 0xe5525c47 (calculated 0x63c62ee9)
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f0888: 0x0b28 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f088c: 0x5c47 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f0890: 0x02a9 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f0894: 0x01c8 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f0898: 0x8124 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f08a0: 0x8000 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f08a4: 0x22ff instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f08a8: 0x22ff instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f08ac: 0x22ff instead
Further such events for this erase block will not be printed
AVR driver initialized. version 1.1, date:Aug  6 2004
elgato: unhandled page fault at pc=0x40136f9c, lr=0x02540590 (bad address=0x6765723b, code -1)
pc : [<40136f9c>]    lr : [<02540590>]    Not tainted
sp : beffe654  ip : 000003a0  fp : beffe6a4
r10: 401e61a0  r9 : 00000170  r8 : 401e5498
r7 : 0000004d  r6 : 72747369  r5 : 6765722f  r4 : 00000510
r3 : 000003a1  r2 : 02540700  r1 : 401e56f8  r0 : 401e5700
Flags: nzCv  IRQs on  FIQs on  Mode USER_32  Segment user
Control: C08A717F  Table: C08A717F  DAC: 00000015


i'm running it almost barebones, without the A3 board on it.

still with the A3 board on it the ps aux is

Code: [Select]
[root@Linux /root]$ps aux
USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME COMMAND
root         1  8.4  0.8  1384  544 ?        S    14:40   0:07 init
root         2  0.0  0.0     0    0 ?        SW   14:40   0:00 [keventd]
root         3  0.0  0.0     0    0 ?        SWN  14:40   0:00 [ksoftirqd_CPU0]
root         4  0.0  0.0     0    0 ?        SW   14:40   0:00 [kswapd]
root         5  0.0  0.0     0    0 ?        SW   14:40   0:00 [bdflush]
root         6  0.0  0.0     0    0 ?        SW   14:40   0:00 [kupdated]
root         7  0.0  0.0     0    0 ?        SW   14:40   0:00 [mtdblockd]
root         8  0.0  0.0     0    0 ?        SW   14:40   0:00 [khubd]
root        40  0.0  0.0     0    0 ?        SWN  14:40   0:00 [jffs2_gcd_mtd3]
root        54  0.0  1.1  1480  732 ?        S    14:40   0:00 /sbin/cardmgr -f
root       574  0.0  1.0  1568  644 ?        S    14:40   0:00 dhcpcd -DH -t 10
root       597  0.0  0.8  1680  544 ?        S    14:40   0:00 syslogd -m 0
bin        623  0.0  0.7  1456  444 ?        S    14:40   0:00 [portmap]
root       653  0.0  1.0  1592  644 ?        S    14:40   0:00 inetd
root       666  0.0  0.8  1704  544 ?        S    14:40   0:00 /bin/sh /etc/rc.d/rc3.d/S51timeUpdate.sh start
root       667  0.0  1.2  1788  772 ?        S    14:40   0:00 /bin/bash /flash/elgato/utils/keepTimeUpdated
root       668  0.0  0.5  1672  336 ?        S    14:40   0:00 sleep 1200
root       688  2.8  4.2 15520 2636 ?        S    14:40   0:01 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       697  0.0  0.7  1572  476 tty1     S    14:41   0:00 /sbin/getty 38400 tty1
root       698  0.0  0.7  1572  484 ttyS/ttySA0 S 14:41   0:00 /sbin/getty -L ttyS0 38400 vt100
root       699  0.0  1.2  1796  808 ?        S    14:41   0:00 /bin/bash /root/catch_sleep.sh
root       711  0.0  4.2 15520 2636 ?        S    14:41   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       712  0.0  4.2 15520 2636 ?        S    14:41   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       713  0.0  4.2 15520 2636 ?        S    14:41   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       714  0.0  4.2 15520 2636 ?        S    14:41   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       717  0.0  4.2 15520 2636 ?        S    14:41   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       732 17.5 11.6 11032 7328 tty2     S    14:41   0:07 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jar
root       734  0.0 11.6 11032 7328 tty2     S    14:41   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jar
root       735  0.0 11.6 11032 7328 tty2     S    14:41   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jar
root       736  0.0 11.6 11032 7328 tty2     S    14:41   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jar
root       737  0.1 11.6 11032 7328 tty2     S    14:41   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jar
root       738  2.6 11.6 11032 7328 tty2     S    14:41   0:01 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jar
root       739  0.0 11.6 11032 7328 tty2     S    14:41   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jar
root       740  0.0 11.6 11032 7328 tty2     S    14:41   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jar
root       741  0.0 11.6 11032 7332 tty2     S    14:41   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jar
root       742  0.0 11.6 11032 7332 tty2     S    14:41   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jar
root       743  1.1  1.3  1956  856 ?        S    14:41   0:00 in.telnetd
root       744  0.8  1.4  1816  928 pts/0    S    14:41   0:00 -bash
root       757  0.0  1.3  2716  856 pts/0    R    14:42   0:00 ps aux


and the dmesg is

Code: [Select]
[root@Linux /root]$dmesg
Linux version 2.4.19-rmk7-ads5 (sreynard@elgato2.soco.agilent.com) (gcc version 2.95.2 19991024 (release)) #30 Wed Apr 28 13:36:58 UTC 2004
CPU: StrongARM-1110 revision 9
Machine: ADS GraphicsMaster
Warning: bad configuration page, trying to continue
On node 0 totalpages: 8192
zone(0): 256 pages.
zone(1): 7936 pages.
zone(2): 0 pages.
On node 1 totalpages: 8192
zone(0): 256 pages.
zone(1): 7936 pages.
zone(2): 0 pages.
Kernel command line: console=tty1 mem=32m@0xC0000000 mem=32m@0xC8000000 rw ramdisk_size=8192 initrd=0xC0800000,3m root=/dev/ram sa1100_pcmcia_opts=sock:0(speed_io:100,fast_mode),sock:1(speed_io:80)
Relocating machine vectors to 0xffff0000
Console: colour dummy device 80x30
Calibrating delay loop... 137.21 BogoMIPS
Memory: 32MB 32MB = 64MB total
Memory: 59552KB available (1716K code, 360K data, 88K init)
Dentry cache hash table entries: 8192 (order: 4, 65536 bytes)
Inode cache hash table entries: 4096 (order: 3, 32768 bytes)
Mount-cache hash table entries: 1024 (order: 1, 8192 bytes)
Buffer-cache hash table entries: 4096 (order: 2, 16384 bytes)
Page-cache hash table entries: 16384 (order: 4, 65536 bytes)
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
sa1111_pcibuf: initializing SA-1111 DMA workaround
SA1111 Microprocessor Companion Chip: silicon revision 1, metal revision 1
Starting kswapd
JFFS version 1.0, (C) 1999, 2000  Axis Communications AB
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
ttyS0 at I/O 0xf0100000 (irq = 50) is a 16550A
ttyS1 at I/O 0xf0120000 (irq = 51) is a 16550A
ttyS2 at I/O 0xf0140000 (irq = 52) is a 16550A
ttyS3 at I/O 0xf0160000 (irq = 54) is a 16550A
ttySA0 at MEM 0x80050000 (irq = 17) is a SA1100
ttySA1 at MEM 0x80010000 (irq = 15) is a SA1100
ttySA2 at MEM 0x80030000 (irq = 16) is a SA1100
Console: switching to colour frame buffer device 80x30
initialize_kbd: Keyboard reset failed, no ACK
Keyboard timed out[1]
keyboard: Timeout - AT keyboard not present?
Keyboard timed out[1]
keyboard: Timeout - AT keyboard not present?
pty: 256 Unix98 ptys configured
UCB1200 generic module installed
ucb1200 touch screen driver initialized
ucb1200 adc driver initialized
UCB1200 audio driver version 2.2 initialized
UCB1200 audio driver Click-Avoid patch: TT <tthaele@papenmeier.de>
UCB1200 Mixer driver version 0.1 initialized. TT <tthaele@papenmeier.de>
smartio driver initialized. version 1.10, date:28-Jun-2002
SmartIO ID     : 0x5002
Device Version : 6(0x36)
Device Type    : 0x8535
SA1100 Real Time Clock driver v1.00
Uniform Multi-Platform E-IDE driver Revision: 6.31
ide: Assuming 50MHz system bus speed for PIO modes; override with idebus=xx
smc9194.c:v0.14 12/15/00 by Erik Stahlman (erik@vt.edu)
eth0: SMC91C96(r:9) at 0xf00e0000 IRQ:58 INTF:TP MEM:6144b ADDR: 00:60:0c:00:f5:28
RAMDISK driver initialized: 16 RAM disks of 8192K size 1024 blocksize
loop: loaded (max 8 devices)
PPP generic driver version 2.4.2
Sound: SA1111 UDA1341: dsp id 3 mixer id 0
SA1111 audio out: SA-1111 SAC DMA channel 6 in use
DMA request for SAC output failed
physmap flash device: 4000000 at 8000000
Physically mapped flash: Found 2 x16 devices at 0x2000000 in 32-bit mode
0: offset=0x0,size=0x40000,blocks=128
1: offset=0x2000000,size=0x40000,blocks=128
Using buffer write method
SA1100 flash: probing 32-bit flash bus
SA1100 flash: Found 2 x16 devices at 0x2000000 in 32-bit mode
0: offset=0x0,size=0x40000,blocks=128
1: offset=0x2000000,size=0x40000,blocks=128
Using buffer write method
Using static partition definition
Creating 3 MTD partitions on "SA1100 flash":
0x00000000-0x00100000 : "zImage"
0x00100000-0x00400000 : "ramdisk.gz"
0x00400000-0x04000000 : "User FS"
Linux Kernel Card Services 3.1.22
  options:  [pm]
SA-1100 PCMCIA (CS release 3.1.22)
usb.c: registered new driver usbdevfs
usb.c: registered new driver hub
hcd/ohci-sa1111.c: starting SA-1111 OHCI USB Controller
hcd/ohci-sa1111.c: ohci-hcd (SA-1111) at 0xf4000400, irq 109

usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 1 port detected
usb.c: registered new driver hiddev
usb.c: registered new driver hid
hid-core.c: v1.8.1 Andreas Gal, Vojtech Pavlik <vojtech@suse.cz>
hid-core.c: USB HID support drivers
mice: PS/2 mouse device common for all mice
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 4096 bind 4096)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NetWinder Floating Point Emulator V0.95 (c) 1998-1999 Rebel.com
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 3072K
EXT2-fs warning: checktime reached, running e2fsck is recommended
VFS: Mounted root (ext2 filesystem).
Freeing init memory: 88K
hub.c: USB new device connect on bus1/1, assigned device number 2
hub.c: USB hub found
hub.c: 4 ports detected
jffs2_scan_inode_node(): Data CRC failed on node at 0x032efdfc: Read 0xe6bf2df9, calculated 0x7e418cdb
jffs2_scan_eraseblock(): Node at 0x032f0884 {0x1985, 0xe001, 0x00000b28) has invalid CRC 0xe5525c47 (calculated 0x63c62ee9)
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f0888: 0x0b28 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f088c: 0x5c47 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f0890: 0x02a9 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f0894: 0x01c8 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f0898: 0x8124 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f08a0: 0x8000 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f08a4: 0x22ff instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f08a8: 0x22ff instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f08ac: 0x22ff instead
Further such events for this erase block will not be printed
AVR driver initialized. version 1.1, date:Aug  6 2004
[root@Linux /root]$


but the fault is still the same. device stuck at copyright screen, no web interface and no remote access app response.

Thanks
 

Offline pieroc91

  • Contributor
  • Posts: 46
  • Country: ar
Re: Agilent E7495 linux root account
« Reply #414 on: June 15, 2021, 01:56:25 pm »
Oh also this is the user manual for the computer running the device, there are descripted all the jumpers and yes, it does have two Ps/2 ports for keyboard and mouse
https://support.eurotech-inc.com/developers/documents/110110-9001B_GM_Manual.pdf

In case my box is completely dead i'm using it to run Doom.
 

Offline pieroc91

  • Contributor
  • Posts: 46
  • Country: ar
Re: Agilent E7495 linux root account
« Reply #415 on: June 15, 2021, 02:16:55 pm »
well on a closer look running elgato via telnet i found that i have license problems of which my elgato.lic is completely missing, replacing with a generic one from this post does not help since my hostID is other. is there a way to recover the hostID?

Code: [Select]
ElgatoManager::ElgatoManager instanceName elgatoMgr
Welcome to the DMC Shell.  Type 'quit' or 'bye' to exit.
> DragonflyIO::waitForCTS() 5000 ms timeout: readyLevel=Open, ms elapsed since last write: 10711, read: 10711

DflyIO::write(buf=0xbffff8b0, length=4) waitForCTS() failed with error=0x810000
ElgatoManager::waitForLicenseReady() !!!!! Dragonfly expected but not found on port 4 after 90 seconds
ElgatoManager::initialize() !!!! waitForLicenseReady() timeout #1, trying again ...
ElgatoManager::waitForLicenseReady() !!!!! Dragonfly expected but not found on port 4 after 90 seconds
ElgatoManager::initialize() !!!! waitForLicenseReady() timeout #2, trying again ...
 

Offline kirill_ka

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: Agilent E7495 linux root account
« Reply #416 on: June 15, 2021, 02:31:03 pm »
Hi,
There's no reason in trying to start elgato without all modules connected.
In my case  removing just the power meter board will cause it to stuck at the copyright screen.
Unfortunately I don't have time to prepare any clear directions for you (enabling log, etc.). You should be able to find some clues in the thread.
As I remember, you can access web pages by removing entry in the egServer/passwd (or you need to remove the file as whole, I don't remember).
 

Offline pieroc91

  • Contributor
  • Posts: 46
  • Country: ar
Re: Agilent E7495 linux root account
« Reply #417 on: June 15, 2021, 03:13:42 pm »
Thanks for your reply, i will check my modules to see if anything is faulty, it has already some bodge wires running along which don't seem original ones. Still do you know if there's a way to recover the Host ID? my license folder is completely empty.

Thanks
 

Offline kirill_ka

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: Agilent E7495 linux root account
« Reply #418 on: June 15, 2021, 04:01:48 pm »
well on a closer look running elgato via telnet i found that i have license problems of which my elgato.lic is completely missing, replacing with a generic one from this post does not help since my hostID is other. is there a way to recover the hostID?

Code: [Select]
ElgatoManager::ElgatoManager instanceName elgatoMgr
Welcome to the DMC Shell.  Type 'quit' or 'bye' to exit.
> DragonflyIO::waitForCTS() 5000 ms timeout: readyLevel=Open, ms elapsed since last write: 10711, read: 10711

DflyIO::write(buf=0xbffff8b0, length=4) waitForCTS() failed with error=0x810000
ElgatoManager::waitForLicenseReady() !!!!! Dragonfly expected but not found on port 4 after 90 seconds
ElgatoManager::initialize() !!!! waitForLicenseReady() timeout #1, trying again ...
ElgatoManager::waitForLicenseReady() !!!!! Dragonfly expected but not found on port 4 after 90 seconds
ElgatoManager::initialize() !!!! waitForLicenseReady() timeout #2, trying again ...

Aha, that's something. I don't think that the hostid is a problem here. It just fails to communicate with the DSP board.
All the device identification (IDs, HW options) are stored on the DSP board. So no surprise that license functions are trying to communicate with the "dragonfly" first.
 

Offline pieroc91

  • Contributor
  • Posts: 46
  • Country: ar
Re: Agilent E7495 linux root account
« Reply #419 on: June 15, 2021, 08:05:43 pm »
Sucess!! one of the serial cables that goes to the A3 board was misconnected on a previous repair, now it booted fine but with no options, still now on the menu i can look my host ID an i can create a new elgato.lic with the correct data!
 

Offline 9aplus

  • Regular Contributor
  • *
  • Posts: 158
Re: Agilent E7495 linux root account
« Reply #420 on: June 17, 2021, 06:37:35 am »
Any of the members here ever in need of ISO calibration for your E7495 ?

I was surprised with price of calibration within EU/Germany...

Agilent E7495
traceable ISO calibration
(CW signals only; no digital modulation) 1.800 euro ;)

Any suggestions ?
 

Offline nsd_c

  • Contributor
  • Posts: 36
Re: Agilent E7495 linux root account
« Reply #421 on: August 11, 2021, 05:58:14 pm »
Hi all,

I have an E7495A that I purchased a few years ago off of eBay used that I've used successfully for one- and two-port measurements, distance to fault, and as a general spectrum analyzer. It has come in very handy for all of these functions. I decided recently to extend its functionality by purchasing a power probe, the Agilent 8481H (-10 to +35dBm), from eBay. The seller claimed that it was working, and seems reputable, however, after running the 'zero' and 'calibrate' functions, this power sensor reads around -19dBm with the power reference turned on (and the sensor hooked directly to the power reference output). From reading the manual, I believe it should read 0dBm (1mW @ 50 Hz is the rated output). It does read very low with the power reference turned off (about -40dBm).

For lack of any other useful instrumentation, I tried measuring the power output using an RTL-SDR and about 39dB of attenuators chained together. The RTL-SDR showed -28.94dB of input power (appearing as a peak at around 50 MHz), which gives +10.09dBm coming out of the '7495A... or 10mW instead of 1mW (a ten-fold increase).

I did do a continuity check of the probe cable, and it seems OK.

For lack of instrumentation to check with (I do not have another power meter or probe), I'd like to check the power sensor reading using not the power reference port, but the E7495A's built in generator (if possible). I am able to telnet into the instrument (thanks to info on this thread). I have seen some of the Java GUI reversing bits on this thread as well, so I was curious to try to find out if there is a back-door way of commanding the power reference on while the spectrum analyzer is running, or likewise turning the generator on when the power meter application is running.

To that end, I found this bit in PowerMeterScreen.class:

Code: [Select]
  MenuItem createPowerRefButton()
  {
    return new MultiStateActuatorButton(PowerMeterMeasurementSettings.instance().getPmRef(), getContextString("powerMeterCalibrate.powerRef"));
  }

If I dig into MultiStateActuatorButton, I can see that the first argument to the constructor is a 'ListActuator' that the MultiStateActuatorButton uses to "do the thing" when the button is pressed:

Code: [Select]
  public MultiStateActuatorButton(ListActuator paramListActuator, String paramString)
  {
    super(paramListActuator.getLabel(), paramString);
    this._actuator = paramListActuator;
    addActionListener(this);
  }
 
  public void actionPerformed(ActionEvent paramActionEvent)
  {
    if (!isFocused()) {
      getMenuPanel().focusButton(this);
    }
    this._actuator.increment();                  <<< The magic
    repaint();
  }

Skipping some in-between stuff, the getPmRef() method returns this:

Code: [Select]
private ListActuator _pmRef = new ListActuator("pwrMeter", "pmRef", Text.SCREEN_POWER_POWER_REF, new Value[] { Value.createValue(Text.ON, 1), Value.createValue(Text.OFF, 0) });

where the ListActuator constructor takes these args:

Code: [Select]
String paramString1, String paramString2, String paramString3, Value[] paramArrayOfValue

I got kind of lost reading through ListActuator, but it looks like ListActuator ultimately sends a command to the elgato server with the send() method of the WebPlugConversion() class.

It looks like WebPlugConversion then uses the Command() class to build a string that it sends:

Code: [Select]
  public static Command makeSetCommand(String paramString)
  {
    Command localCommand = new Command("set");
    if (!paramString.equals("global")) {
      localCommand.addProperty("topic", paramString);
    }
    return localCommand;
  }

I likewise got a little lost trying to figure out what the final command string ends up looking like. However, after digging through this thread some more, I came across reply #126, where user DogP shared some observations:

Quote
I also took a look at the remote GUI... [... snip ...]

I was interested in how it communicated, so I sniffed the packets.  It looks like most stuff goes over port 5028.  The commands and acknowledgements go over TCP, and the spectrum display data goes over UDP.  It looks like there’s some status (power, GPS, etc) coming out 1027 as well.

[... snip ...]

The commands going over 5028 don't look to be any standard I'm familiar with.  Some examples are (without the quotes, <\n> is hex 0A): “cmd: local<\n><\n>”, "cmd: set<\n>topic: display.global<\n>printFilter: 0<\n><\n>", etc.  If you dig through the elgato binary, you can see a bunch of available commands (and you can test them out using nc).

Armed with this information (namely, what port to look at), I found that if you telnet into port 5028, pressing buttons on the front panel has the effect of the system echoing on that port these commands. So, if I turn the power meter on through the front panel, I see:

Code: [Select]
cmd: set
topic: pwrMeter
pmRef: 0

get printed to the terminal.

I am able to make the ‘get’ commands work: if I type (for example)

Code: [Select]
cmd: get
topic: spectrum
cf:

the instrument responds with:

Code: [Select]
cmd: set
topic: spectrum
cf: 1955000

However, I can’t seem to get ‘set’ commands to work—attempting to change any parameter causes the instrument to do… nothing.

The only command other than ‘get’ that works is ‘cmd: closeGui’, which causes the connection to be closed by the host (instrument). I’ll note that when I first connect to this port, the instrument prints:

Code: [Select]
cmd: remote

cmd: setActive
meas:

cmd: notifyEvent
event: startupComplete

I was hoping to use Wireshark to capture commands sent by the Java GUI running on my PC, but I can’t seem to get the GUI to work quite 100%. It starts (in a very old Debian Squeeze VM running in a Windows host by way of VirtualBox), but hangs at “Please wait while the measurement is loading…”. It does work insofar as the GUI running on my PC does show the correct instrument mode (i.e., main menu, spectrum analyzer, power meter, etc.). User DogP’s aforementioned post did mention

Quote
[…] the remote GUI […] didn't seem to work on Windows with Java 8 (even using the commands further up in the thread).  Rather than dig into it, I installed Java 1.4.2 in a VM, grabbed the jre directory, and explicitly ran RemoteGui.jar using that version of java ("jre\bin\java -jar RemoteGui.jar").  [...] It looks like most stuff goes over port 5028.  The commands and acknowledgements go over TCP, and the spectrum display data goes over UDP. […]

I had to make sure Windows allowed the data through the firewall (without it, the TCP commands would go through, but the UDP data wouldn’t, so the GUI would never show the spectrum).  Also, Windows 7 temporarily goes back to basic graphics (disabling Aero) when you run Java 1.4.2.

I tried installing JRE 1.4.2_20, but invoking the application with the command line given earlier in this thread failed with
Code: [Select]
Exception in thread "main" java.lang.NoClassDefFoundError: elgato/gui/MainWindow

I found that this works instead, though:
Code: [Select]
java.exe -Dserver=192.168.1.186 -DlocalAddress=192.168.1.1 -classpath "./*" elgato.gui.MainWindow

However, clicking around in the Java GUI doesn't do anything. I did try copying over the RemoteGUI.jar file, but this causes its own problems. I am able to change the spectrum analyzer center frequency by pressing the 'up' and 'down' arrows on my computer, and I can sniff out the 'cmd: set' command that are being sent when I do this in Wireshark.

I'll note also that my instrument has a significantly newer version of SW than what's available for download from Keysight's site (A.06.00, from 2006, instead of A.01.60, from 2003).

Anyway, I thought I'd share that progress, and ask a few questions:

  • Does anyone know why the power ref output might be generating 10mW instead of 1mW?
  • Does anyone already know of a back-door way of doing what I'm trying to accomplish?
  • Any ideas why the instrument doesn't like my 'cmd: set' commands?
 

Offline kirill_ka

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: Agilent E7495 linux root account
« Reply #422 on: August 12, 2021, 06:51:53 am »
Hi, lets proceed with one problem at a time :)

I suspect RTL-SDR is not a reliable tool to do power measurements.
Try enabling power ref as I described here:
https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg1169477/#msg1169477
Then measure the reference using E7495 itself (don't forget to add some attenuators!).
 

Offline kirill_ka

  • Frequent Contributor
  • **
  • Posts: 292
  • Country: ru
Re: Agilent E7495 linux root account
« Reply #423 on: August 12, 2021, 08:48:10 am »
functions, this power sensor reads around -19dBm with the power reference turned on (and the sensor hooked directly to the power reference output). From reading the manual, I believe it should read 0dBm (1mW @ 50 Hz is the rated output). It does read very low with the power reference turned off (about -40dBm).
My understanding is that HP8481H = HP8481A + 20dB attenuator.
So it could be a bug with handling this particular type of sensor.
Though, I don't know where -19dBm comes from. Maybe the calibration fails?
Or maybe HP8481H is supposed to have 19dB attenuator?
What's the actual reading? Is it exact -19.00 dBm?
 

Offline Ick

  • Newbie
  • Posts: 7
  • Country: de
Re: Agilent E7495 linux root account
« Reply #424 on: August 29, 2021, 07:20:40 am »
Pieroc91,

From the logs it seems you have a problem with a corrupt file system ( the lose serial cable you have fixed already); all the jffs2 error messages.
You need to reinstall the firmware and recreate the filesystem.
This is done the following way:
- insert the firmware to preferably PCMCIA slot(CF card in PCMCIA adapter). On my unit the upgrade from CF slot would not work properly.
- start/ reboot the unit
- on the upgrade screen with the continue yes button, press the LOWER RIGHT soft button next to the LCD instead. Yes, there is no marking, description or hint on the upgrade screen that this button has a function. Press this lower right soft key and the complete flash will be erased, file system re-created and firmware files newly written.

It seems a backup of the license file is automatically been made, I would save it in advance anyway.

I had the similar issues with my unit - file system errors with same message. That caused all kind of odd behaviour, e.g could not properly access CF slot and FS anymore , no dhcp, no upgrade possible (needed to go via dip switches on the COU board)

After the new filesystem created, all was hunky dory. Error messages were gone during boot and all properly working.
BR ick
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf