EEVblog Electronics Community Forum

Products => Test Equipment => Topic started by: Urs42 on February 16, 2015, 04:49:55 pm

Title: Agilent E7495 linux root account
Post by: Urs42 on February 16, 2015, 04:49:55 pm
I found out i'ts running linux on an ARM CPU, i can't have any Linux Box without root access, so i did some password cracking:

User: guest
Pass: noname

User: root
Pass: wh1skers

You can log in to it with telnet, it has many serial ports, i suspect that most of them are used to communicate with the Spectrum Analyzer Part. The Powerup Config of the Device is stored in /flash/egServer/registry/Powerup/ if you want to change some default settings. There is an ftp client on the device, if you run a ftp server on your computer, you can use it to copy files from and to the device. Binaries from debian woody will work on the Device.

Title: Re: Agilent E7495 linux root account
Post by: jwm_ on February 17, 2015, 01:38:39 pm
That is great, time to email them and ask for the source code. Depending on their mood, we may get the source to drivers for their hardware in it.
Title: Re: Agilent E7495 linux root account
Post by: Wuerstchenhund on February 17, 2015, 05:52:09 pm
Nice find! Yes, the E7495 is a nice device, and great for hacking or expanding its capabilities, probably more so than most other VSAs in that price class.

You should be able to get the source code for the OSS stuff from Keysight but I believe the hardware drivers are closed source binaries.

But hey, there's a lot that could potentially be done with that thing. Maybe someone can fix the sometimes temperamental screen capture function, or even modify it so that it works with USB drives as well.
Title: Re: Agilent E7495 linux root account
Post by: Urs42 on February 17, 2015, 07:14:49 pm
There is no USB Storage Support in the kernel running on the device, and the module is also missing :-(

The kernel Version that is running on the device is available on the internet, the .config from the kernel would help with building a matching module, i'm not sure if it's possible to build it without the .config.

They are Obligated to give us the source, because of the GPL...

I think that the mounting and unounting of the cf card is done with shell scripts, it should be possible to switch the scripts to USB.

The licensing of options is done with the flexlm license manager, i have no idea how secure this thing is. There are many Options that don't need additional hardware. I think it might be possible to copy licenses from one device to another.

Title: Re: Agilent E7495 linux root account
Post by: jwm_ on February 17, 2015, 07:17:51 pm
If it does just communicate with its devices over serial links, it would be easy to interpose a driver to capture and sniff the data. also possible for usb, but a bit trickier if we can't load a kernel module.

can you post its full boot logs, lspci and lsusb?

I was thinking of picking up one of those for use as a general spectrum analyzer, how hampered will i be that it was designed for a specific purpose? Will i always be fighting the UI that keeps on wanting me to repair base stations?
Title: Re: Agilent E7495 linux root account
Post by: Lukas on February 17, 2015, 09:24:06 pm
Btw, you can download a firmware upgrade from Keysight and reverse engineer as you like.

Strangely, this device runs some embedded sort of java! xkcd: http://xkcd.com/801/ (http://xkcd.com/801/)

They took advantage of that, so the PC software they offer simply is the same one that runs on the device, with the difference that it doesn't connect to localhost.

You're wondering why this thing takes so long to boot? This may be part of the answer:

Code: [Select]
# There's some defect in the GUI that results in
# intermittent hangs on startup (very rare, but some
# boxes can hit it regularly). This delay is a workaround
# to avoid them. When the root cause is found and fixed
# this delay can be removed.
sleep 16
Title: Re: Agilent E7495 linux root account
Post by: Wuerstchenhund on February 17, 2015, 09:28:43 pm
I was thinking of picking up one of those for use as a general spectrum analyzer, how hampered will i be that it was designed for a specific purpose?

Not hampered at all. It's a normal Vector SA which covers from 500kHz to 2.5GHz (E7495A)/2.7GHz (E7495B) all the way from zero span to full span.

Also no need to "fight" the menu. You can ignore the BTS specific software and selectr "Spectrum Analyzer" directly in the main menu.

I'm working on a review of my E7495B, with some luck I might finish it this weekend.
Title: Re: Agilent E7495 linux root account
Post by: Urs42 on February 18, 2015, 05:30:14 am
The GUI Part of the Software is java, there is also a server part that is not written in Java. Some parts of the Software are missing in the Firmware update.

Some details from a running system:

Code: [Select]
[root@Linux /root]$dmesg
Linux version 2.4.19-rmk7-ads5 (sreynard@elgato2.soco.agilent.com) (gcc version 2.95.2 19991024 (release)) #30 Wed Apr 28 13:36:58 UTC 2004
CPU: StrongARM-1110 revision 9
Machine: ADS GraphicsMaster
Warning: bad configuration page, trying to continue
On node 0 totalpages: 8192
zone(0): 256 pages.
zone(1): 7936 pages.
zone(2): 0 pages.
On node 1 totalpages: 8192
zone(0): 256 pages.
zone(1): 7936 pages.
zone(2): 0 pages.
Kernel command line: console=tty1 mem=32m@0xC0000000 mem=32m@0xC8000000 rw ramdisk_size=8192 initrd=0xC0800000,3m root=/dev/ram sa1100_pcmcia_opts=sock:0(speed_io:100,fast_mode),sock:1(speed_io:80)
Relocating machine vectors to 0xffff0000
Console: colour dummy device 80x30
Calibrating delay loop... 137.21 BogoMIPS
Memory: 32MB 32MB = 64MB total
Memory: 59552KB available (1716K code, 360K data, 88K init)
Dentry cache hash table entries: 8192 (order: 4, 65536 bytes)
Inode cache hash table entries: 4096 (order: 3, 32768 bytes)
Mount-cache hash table entries: 1024 (order: 1, 8192 bytes)
Buffer-cache hash table entries: 4096 (order: 2, 16384 bytes)
Page-cache hash table entries: 16384 (order: 4, 65536 bytes)
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
sa1111_pcibuf: initializing SA-1111 DMA workaround
SA1111 Microprocessor Companion Chip: silicon revision 1, metal revision 1
Starting kswapd
JFFS version 1.0, (C) 1999, 2000  Axis Communications AB
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
ttyS0 at I/O 0xf0100000 (irq = 50) is a 16550A
ttyS1 at I/O 0xf0120000 (irq = 51) is a 16550A
ttyS2 at I/O 0xf0140000 (irq = 52) is a 16550A
ttyS3 at I/O 0xf0160000 (irq = 54) is a 16550A
ttySA0 at MEM 0x80050000 (irq = 17) is a SA1100
ttySA1 at MEM 0x80010000 (irq = 15) is a SA1100
ttySA2 at MEM 0x80030000 (irq = 16) is a SA1100
Console: switching to colour frame buffer device 80x30
initialize_kbd: Keyboard reset failed, no ACK
Keyboard timed out[1]
keyboard: Timeout - AT keyboard not present?
Keyboard timed out[1]
keyboard: Timeout - AT keyboard not present?
pty: 256 Unix98 ptys configured
UCB1200 generic module installed
ucb1200 touch screen driver initialized
ucb1200 adc driver initialized
UCB1200 audio driver version 2.2 initialized
UCB1200 audio driver Click-Avoid patch: TT <tthaele@papenmeier.de>
UCB1200 Mixer driver version 0.1 initialized. TT <tthaele@papenmeier.de>
smartio driver initialized. version 1.10, date:28-Jun-2002
SmartIO ID     : 0x5002
Device Version : 6(0x36)
Device Type    : 0x8535
SA1100 Real Time Clock driver v1.00
Uniform Multi-Platform E-IDE driver Revision: 6.31
ide: Assuming 50MHz system bus speed for PIO modes; override with idebus=xx
smc9194.c:v0.14 12/15/00 by Erik Stahlman (erik@vt.edu)
eth0: SMC91C96(r:9) at 0xf00e0000 IRQ:58 INTF:TP MEM:6144b ADDR: 00:60:0c:00:4c:5f
RAMDISK driver initialized: 16 RAM disks of 8192K size 1024 blocksize
loop: loaded (max 8 devices)
PPP generic driver version 2.4.2
Sound: SA1111 UDA1341: dsp id 3 mixer id 0
SA1111 audio out: SA-1111 SAC DMA channel 6 in use
DMA request for SAC output failed
physmap flash device: 4000000 at 8000000
Physically mapped flash: Found 2 x16 devices at 0x2000000 in 32-bit mode
0: offset=0x0,size=0x40000,blocks=128
1: offset=0x2000000,size=0x40000,blocks=128
Using buffer write method
SA1100 flash: probing 32-bit flash bus
SA1100 flash: Found 2 x16 devices at 0x2000000 in 32-bit mode
0: offset=0x0,size=0x40000,blocks=128
1: offset=0x2000000,size=0x40000,blocks=128
Using buffer write method
Using static partition definition
Creating 3 MTD partitions on "SA1100 flash":
0x00000000-0x00100000 : "zImage"
0x00100000-0x00400000 : "ramdisk.gz"
0x00400000-0x04000000 : "User FS"
Linux Kernel Card Services 3.1.22
  options:  [pm]
SA-1100 PCMCIA (CS release 3.1.22)
usb.c: registered new driver usbdevfs
usb.c: registered new driver hub
hcd/ohci-sa1111.c: starting SA-1111 OHCI USB Controller
hcd/ohci-sa1111.c: ohci-hcd (SA-1111) at 0xf4000400, irq 109

usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 1 port detected
usb.c: registered new driver hiddev
usb.c: registered new driver hid
hid-core.c: v1.8.1 Andreas Gal, Vojtech Pavlik <vojtech@suse.cz>
hid-core.c: USB HID support drivers
mice: PS/2 mouse device common for all mice
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 4096 bind 4096)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NetWinder Floating Point Emulator V0.95 (c) 1998-1999 Rebel.com
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 3072K
EXT2-fs warning: checktime reached, running e2fsck is recommended
VFS: Mounted root (ext2 filesystem).
Freeing init memory: 88K
hub.c: USB new device connect on bus1/1, assigned device number 2
hub.c: USB hub found
hub.c: 4 ports detected
enable_irq(114) unbalanced from c032558c
Trying to free nonexistent resource <ce8a6000-ce8a600f>
hda: SILICONSYSTEMS INC 128MB, ATA DISK drive
ide0 at 0xce8a6000-0xce8a6007,0xce8a600e on irq 114
hda: 254208 sectors (130 MB) w/0KiB Cache, CHS=993/8/32
Partition check:
 hda: hda1
ide_cs: hda: Vcc = 3.3, Vpp = 0.0
 hda: hda1
 hda: hda1
VFS: Can't find ext2 filesystem on dev ide0(3,1).
 hda: hda1
 hda: hda1
cramfs: wrong magic
 hda: hda1
 hda: hda1
 hda: hda1
 hda: hda1
VFS: Can't find ext2 filesystem on dev ide0(3,1).
 hda: hda1
 hda: hda1
cramfs: wrong magic
 hda: hda1
 hda: hda1
AVR driver initialized. version 1.1, date:Aug  6 2004

Code: [Select]
[root@Linux /proc]$cat /proc/cpuinfo
Processor : StrongARM-1110 rev 9 (v4l)
BogoMIPS : 137.21
Features : swp half 26bit fastmult

Hardware : ADS GraphicsMaster
Revision : 0000
Serial : 0000000000000000
[root@Linux /proc]$

I think this module is used to reprogram a avr controller in the device
Code: [Select]
[root@Linux /root]$lsmod
Module                  Size  Used by
avrprog                 5416   0 (unused)
[root@Linux /root]$

Code: [Select]
[root@Linux /root]$cat /proc/interrupts
  0:      42792   ADS_ext_IRQ
  1:          0   sleep
 11:          0   GPIO 11-27
 12:          1   LCD
 17:       1224   serial_sa1100
 26:      62869   timer
 27:          0   rtc timer
 30:          2   rtc 1Hz
 31:          0   rtc Alrm
 49:        223   SA1111
 50:      40201   serial
 52:        982   serial
 54:        191   serial
 57:          0   UCB1200
 58:       1059   eth0
 63:          8   sio
 87:          0   keyboard
 97:          0   SA1111 audio out
 98:          0   SA1111 audio in
 99:          0   SA1111 audio out
100:          0   SA1111 audio in
109:         24   ohci-hcd
114:        240   ide0
116:          0   SA1111 PCMCIA card detect
117:          0   SA1111 CF card detect
118:          0   SA1111 PCMCIA BVD1
119:          0   SA1111 CF BVD1
Err:          0
[root@Linux /root]$

Code: [Select]
[root@Linux /root]$ps aux
USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME COMMAND
root         1  1.1  0.8  1384  544 ?        S    Feb13   0:07 init
root         2  0.0  0.0     0    0 ?        SW   Feb13   0:00 [keventd]
root         3  0.0  0.0     0    0 ?        SWN  Feb13   0:00 [ksoftirqd_CPU0]
root         4  0.0  0.0     0    0 ?        SW   Feb13   0:00 [kswapd]
root         5  0.0  0.0     0    0 ?        SW   Feb13   0:00 [bdflush]
root         6  0.0  0.0     0    0 ?        SW   Feb13   0:00 [kupdated]
root         7  0.0  0.0     0    0 ?        SW   Feb13   0:00 [mtdblockd]
root         8  0.0  0.0     0    0 ?        SW   Feb13   0:00 [khubd]
root        40  0.0  0.0     0    0 ?        SWN  Feb13   0:00 [jffs2_gcd_mtd3]
root        56  0.0  1.1  1480  744 ?        S    Feb13   0:00 /sbin/cardmgr -f
root       587  0.0  1.0  1568  644 ?        S    Feb13   0:00 dhcpcd -DH -t 10
root       610  0.0  0.8  1680  544 ?        S    Feb13   0:00 syslogd -m 0
bin        636  0.0  0.7  1456  444 ?        S    Feb13   0:00 [portmap]
root       666  0.0  1.0  1592  644 ?        S    Feb13   0:00 inetd
root       679  0.0  0.8  1704  544 ?        S    Feb13   0:00 /bin/sh /etc/rc.d/rc3.d/S51timeUpdate.sh start
root       680  0.0  1.2  1788  772 ?        S    Feb13   0:00 /bin/bash /flash/elgato/utils/keepTimeUpdated
root       681  0.0  0.5  1672  336 ?        S    Feb13   0:00 sleep 1200
root       701  0.8 11.4 93644 7176 ?        S    Feb13   0:05 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       710  0.0  0.7  1572  476 tty1     S    Feb13   0:00 /sbin/getty 38400 tty1
root       711  0.0  0.7  1572  484 ttyS/ttySA0 S Feb13   0:00 /sbin/getty -L ttyS0 38400 vt100
root       712  0.0  1.2  1796  808 ?        S    Feb13   0:00 /bin/bash /root/catch_sleep.sh
root       724  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       725  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       726  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       727  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       729  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       730  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       731  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       732  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       738  0.2 11.4 93644 7176 ?        S    Feb13   0:01 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       751  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       752  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       753  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       754  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       755  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       756  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       757  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       758  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       759  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       774  1.1 22.2 18540 13968 tty2    S    Feb13   0:07 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -
root       776  0.0 22.2 18540 13968 tty2    S    Feb13   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -
root       777  0.0 22.2 18540 13968 tty2    S    Feb13   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -
root       778  0.0 22.2 18540 13968 tty2    S    Feb13   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -
root       779  0.0 22.2 18540 13968 tty2    S    Feb13   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -
root       780  9.9 22.2 18540 13968 tty2    S    Feb13   1:02 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -
root       781  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       782  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       783  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       784  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       785  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       786  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       787  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       788  0.0 22.2 18540 13968 tty2    S    Feb13   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -
root       789  0.0 22.2 18540 13968 tty2    S    Feb13   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -
root       790  0.0 22.2 18540 13968 tty2    S    Feb13   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -
root       791  0.0 22.2 18540 13968 tty2    S    Feb13   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -
root       792  0.0 22.2 18540 13968 tty2    S    Feb13   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -
root       795  0.2 22.2 18540 13968 tty2    S    Feb13   0:01 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -
root       798  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       799  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       800  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       801  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       802  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       803  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       804  0.7 11.4 93644 7176 ?        S    Feb13   0:04 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       805  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       806  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       807  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       808  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       809  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       810  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       811  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       812  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       813  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       814  0.0 11.4 93644 7176 ?        S    Feb13   0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0
root       819  0.0 22.2 18540 13968 tty2    S    Feb13   0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -
root       824  0.0  1.3  1956  848 ?        S    Feb13   0:00 in.telnetd
root       825  0.0  1.5  1824  948 pts/0    S    Feb13   0:00 -bash
root       839  0.0  1.3  2736  876 pts/0    R    00:03   0:00 ps aux
[root@Linux /root]$

The serial port /dev/ttyS/ttySA0 is used for a serial console, and elgato is using ttyS0, ttyS2 and ttyS3. I think ttySA0 and ttySA1 are available on the back of the device.

The java part of the software is using /dev/rpg which is a simlink to /dev/sio15 i'm not sure what this is.
Title: Re: Agilent E7495 linux root account
Post by: Urs42 on February 18, 2015, 05:36:37 am
It would be interessting to add some non GSM/UMTS signals to the signal generator,  the data files for the generator are stored in /flash/egServer/Dragonfly/Measurements/Data/ and i have no idea about the format.
Title: Re: Agilent E7495 linux root account
Post by: Wuerstchenhund on February 21, 2015, 12:45:24 pm
It would be interessting to add some non GSM/UMTS signals to the signal generator,  the data files for the generator are stored in /flash/egServer/Dragonfly/Measurements/Data/ and i have no idea about the format.

I guess these are waveform binaries for the built-in Arbitrary Waveform Generator.

If we find out the format then we could create our own and push it to the E7495. Maybe even a function could be added to the Java GUI to enable copying waveforms from/to the CF card and PCMCIA card.

Thinking about it, it would make the E7495 into a really flexible tool.
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 22, 2015, 02:16:40 pm
Hello to all,
 
It is nice to know that someone else is digging out around E7495B software....
Own one unit just couple of months, working just fine, except remote SW on PC with new windows version XP and later.
Therefore I made debug of JAVA code in attempt to write own SW... for PC operated under Linux (Ubuntu 12 and later)
and new Windows versions.

I am interested to join efforts to bring this nice instrument to full use :)

Here my hardware configuration ->
(http://www.hrvhf.net/forum/index.php?action=dlattach;topic=2848.0;attach=16120;image)
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 22, 2015, 03:02:28 pm
Here just for educational evaluation
decompiled Java egclient app...
https://www.dropbox.com/s/waxxkz9c44h7dy2/egclient.src.zip?dl=0 (https://www.dropbox.com/s/waxxkz9c44h7dy2/egclient.src.zip?dl=0)
Title: Re: Agilent E7495 linux root account
Post by: Urs42 on February 22, 2015, 03:36:11 pm
The remote software consists of two parts egclient.jar and  RemoteGui.jar. egclient.jar is also the GUI that you see on the device itself. RemoteGui.jar is a wrapper around egclient.jar it provides some additional buttons, for example the ESC/Lcl Button that is needed to switch between the local and remote mode. egclient.jar runs just fine on a Debian 7 System, didn't test any Windows version because i don't have one. The problem with running egclient alone, is that you can't press the ESC/Lcl button, so the remote control dons't work :-(

Code: [Select]
java -Dserver=10.10.0.101 -DlocalAddress=micro -classpath "egclient.jar:xerces.jar:JimiProClasses.zip:RemoteGui.jar" elgato.gui.MainWindow
I do have the same options installed.
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 22, 2015, 04:38:16 pm
Must try than on my Ubuntu 12.04 LTS but so far no luck with j2re-1_4_2-linux-i586.bin from Oracle site....
Quote
Do you agree to the above license terms? [yes or no]
yes
Unpacking...
tail: cannot open `+473' for reading: No such file or directory
Checksumming...
1
The download file appears to be corrupted.  Please refer
to the Troubleshooting section of the Installation
Instructions on the download page for more information.
Please do not attempt to install this archive file.
q@ubuntu:~/Desktop$
Title: Re: Agilent E7495 linux root account
Post by: Wuerstchenhund on February 22, 2015, 05:08:47 pm
Here my hardware configuration ->
(http://www.hrvhf.net/forum/index.php?action=dlattach;topic=2848.0;attach=16120;image)

Nice. I'd love to have options 240 and 245, as well as 230 and 235. My unit only came with CDMA+EV-DO unfortunately.
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 22, 2015, 05:23:08 pm
Right,
but on the other hand I was not so lucky with SW keys ->
(http://www.hrvhf.net/forum/index.php?action=dlattach;topic=2848.0;attach=16118;image)
Title: Re: Agilent E7495 linux root account
Post by: Urs42 on February 22, 2015, 05:48:05 pm
I'm using the openjdk-6 Package from Debian.

I think you can copy the license file from one device to another if you change the hostid on the target device. But i'm not sure...
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on February 22, 2015, 06:01:31 pm
The E7495 firmware looks very much the same as for the N1996 CSA SA, I can even use the remote client on my CSA. The license manager on the CSA is easy to patch so that it accepts any license code, maybe it is the same for the E7495. The license daemon on the CSA is called TORO, but I could not see something simular in the ps output posted above.

Title: Re: Agilent E7495 linux root account
Post by: Urs42 on February 22, 2015, 06:09:24 pm
The licensing is done by the elgato process. I think they are using flexlm. Here is the license file from my device, i did remove the HOSTID and SIGN Values.

Code: [Select]
$ cat elgato.lic
FEATURE 200 agilent 1.000 permanent uncounted \
HOSTID=ID_STRING=XXXXX SIGN=YYYYYYYYY
FEATURE 220 agilent 1.000 permanent uncounted \
HOSTID=ID_STRING=XXXXX SIGN=YYYYYYYYY
FEATURE 240 agilent 1.000 permanent uncounted \
HOSTID=ID_STRING=XXXXX SIGN=YYYYYYYYY
FEATURE 245 agilent 1.000 permanent uncounted \
HOSTID=ID_STRING=XXXXX SIGN=YYYYYYYYY
FEATURE 205 agilent 1.000 permanent uncounted HOSTID=ID_STRING=XXXXX \
SIGN=YYYYYYYYY
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on February 22, 2015, 06:23:45 pm
I think they are using flexlm.

Yes, that is FlexLM, same as N1996A and E4406A.
Title: Re: Agilent E7495 linux root account
Post by: theatrus on February 22, 2015, 06:39:19 pm
Looks nearly identical to the N1996A.

The good news is the binaries have most of their symbols intact - objdump (for ARM) and search for some likely functions :)
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 22, 2015, 06:50:50 pm
Here more luck with OpenJDK Java 6 runtime

Now RemoteGUI.jar is running but not happy with egclient.jar version.
Program is offering download of egclient.jar from E7495B but file
transfer ends with 0 size....


 
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on February 22, 2015, 06:52:32 pm
Well. I just downloaded the firmware and did a quick compare between the toro process and the elgato one. Then I did a search for 16 bytes around the patch area and elgato had only one hit. So for whoever feels lucky, try this: (latest firmware downloaded from HP Agilent Keysight site)

Elgato offset 337A7C, change 01 00 00 EA to 00 00 A0 E1.

Then check your license file if there are any entries without the SIGN = part, because they start to work magically if the patch works and you don't want any weird options enabled. Just take them out.

Good luck and let me know  ;)

Edit: Version A06.25
Title: Re: Agilent E7495 linux root account
Post by: Urs42 on February 22, 2015, 07:21:54 pm
Many thanks PA0PBZ, i'll try that.

toroServer looks alot like egServer. It would be interessting to see how similar the hardware of both devices is. FM/AM Demodulation and other Stuff i see in the toroServer directory would be cool...
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on February 22, 2015, 07:42:04 pm
toroServer looks alot like egServer.

It does, I even see a lot of possible options in the CSA that looks to be for the E7495:

200   CDMA / CDMA 2000 Analyzer
205   1xEV-DO Analyzer
210   CDMA Over Air Test
220   Channel Scanner
230   GSM Analyzer
235   GSM Edge
250   W-CDMA (UMTS) Over Air Test
270   Interference Analyzer
271   Spectrogram
300   DC Bias
330   NEM Software <unknown>
500   Internal Agilent Mfg Source
503   Frequency Range 100 kHz to 3 GHz
506   Frequency Range 100 kHz to 6 GHz
600   Power Meter
700   T1 Analyzer
710   E1 Analyzer
AFM   AM/FM Tune & Listen
HAR   Harmonics Analyzer
IQD   IQ Waveform
N8995A   Stimulus/Response Measurement Suite
N8995A-SR3   Stimulus/Response Measurement Suite, 3 GHz
N8995A-SR6   Stimulus/Response Measurement Suite, 6 GHz
N8996A-1FP   AM/FM Modulation Analyzer
N8996A-2FP   ASK/FSK Analyzer ASK/FSK
N8997A-1FP   W-CDMA (UMTS) Analyzer
N8997A-2FP   HSDPA Measurement
P03   Preamplifier, 3 GHz
P06   Preamplifier, 6 GHz
SEM   Spectral Emmissions Mask
TG3   Tracking Generator, 3 GHz
TG6   Tracking Generator, 6 GHz
TOI   TOI Analyzer
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 22, 2015, 07:51:19 pm
Yes in deed, that looks like many of E7495B options....

Here still version download trouble....
(http://i730.photobucket.com/albums/ww304/d9aplus/safety/Screenshot%20from%202015-02-22%20203048_zpsbklcsqyq.jpg)
Title: Re: Agilent E7495 linux root account
Post by: Urs42 on February 22, 2015, 08:12:06 pm
Try http://192.168.1.209/egclient.jar (http://192.168.1.209/egclient.jar)

@PA0PBZ The patch works perfectly!
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on February 22, 2015, 08:16:15 pm
@PA0PBZ The patch works perfectly!

That was a fast one then, without even having the E7495.  :-+
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 22, 2015, 08:54:59 pm
So SW options unlocked ;)
Great  :-+

that with link
Quote
Try http://192.168.1.209/egclient.jar (http://192.168.1.209/egclient.jar)
can not work, but ftp transfer may work....
flie on E7495B is->
 /flash/egGui/
3480541 Nov  1  2007 egclient.jar
Title: Re: Agilent E7495 linux root account
Post by: Urs42 on February 22, 2015, 09:08:27 pm
I managed to start the remote Gui on my System!

You need the folowing files

Code: [Select]
egclient.jar
JimiProClasses.zip
RemoteGui.jar
xerces.jar

I think it will only work with the OpenJDK Java 6 runtime

You need to change the server and localAddress parameters, the server is the E7495 and localAddress is the IP of your PC.

Code: [Select]
java -Dserver=10.10.0.101 -DlocalAddress=10.10.0.156 -classpath "egclient-patch.jar:xerces.jar:JimiProClasses.zip:RemoteGui.jar" elgato.gui.MainWindow
Some helpful Key kombinations
CTRL-H = Help
CTRL-L = Local (This one is important!)
F1 to F7 =  Menu items on the left side
F9 = Mode Button
1 to 7 = Menu items on the right side

Before you can do anything you have to switch to the local mode on your PC, press CTRL-L to do this.




Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 22, 2015, 09:19:54 pm
Great, I have JDK 6 runtime, but
sorry I am not able to follow you...

Can you please explain step by step for dummies  (me)

Here is directory on my E7495B ->
Quote
[root@00-60-0c-00-48-9c egGui]$ls -al
drwxrwxr-x    1 root     root            0 Nov 13  1969 .
drwxrwxr-x    1 root     root            0 Nov 13  1969 ..
-r--r--r--    1 root     root       455489 Nov  1  2007 JimiProClasses.zip
-rw-rw-r--    1 root     root      3480541 Nov  1  2007 egclient.jar
-r--r--r--    1 root     root         8070 Nov  1  2007 libguiutil.so
-r--r--r--    1 root     root       596528 Nov  1  2007 rhino-1.5R4.jar
-rw-------    1 root     root            0 Dec 18  2006 shellexec.log
-r--r--r--    1 root     root      1897838 Nov  1  2007 swing.jar
-r--r--r--    1 root     root      1812019 Nov  1  2007 xerces.jar

E7495B is on 192.168.1.209
PC-Ubuntu 12.04 is on 192.168.205
Title: Re: Agilent E7495 linux root account
Post by: Urs42 on February 23, 2015, 05:00:08 am
@9aplus How do you start the gui, and what is the error message you get?
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 23, 2015, 09:32:27 am
This error message ->
(http://i730.photobucket.com/albums/ww304/d9aplus/safety/Screenshot%20from%202015-02-22%20203048_zpsbklcsqyq.jpg)

I am running RemoteGUI.jar with OpenJDK Java 6 runtime
Than after OK, file sistem is opened and after another ->Save
egclient.jar is with 0 size (download started, but not finished)

My intention now is to set up ftp transfer E7495B to PC-Ubuntu of whole egGui folder:
-----
drwxrwxr-x    1 root     root            0 Nov 13  1969 .
drwxrwxr-x    1 root     root            0 Nov 13  1969 ..
-r--r--r--    1 root     root       455489 Nov  1  2007 JimiProClasses.zip
-rw-rw-r--    1 root     root      3480541 Nov  1  2007 egclient.jar
-r--r--r--    1 root     root         8070 Nov  1  2007 libguiutil.so
-r--r--r--    1 root     root       596528 Nov  1  2007 rhino-1.5R4.jar
-rw-------    1 root     root            0 Dec 18  2006 shellexec.log
-r--r--r--    1 root     root      1897838 Nov  1  2007 swing.jar
-r--r--r--    1 root     root      1812019 Nov  1  2007 xerces.jar
------
And than to try with start of
RemoteGUI.jar with OpenJDK Java 6 runtime
on PC again.....
Title: Re: Agilent E7495 linux root account
Post by: Urs42 on February 23, 2015, 11:02:18 am
The download did work with my E7495, it should work with yours, i have no idea what the problem is. You could try to debug it with tcpdump or ngrep.

Please look at Reply #29, don't klick on anything, open a console and run the java command in my reply. If you can't download the egclient.jar file, telnet in to the E7495 and then copy the file with ftp to the PC, you can find it in the directory /flash/egGui/. Or you could extract the file from the firmware that you can get on the Agilent site.

You are running Firmware 6.23 i'm running 6.25, i think you should update your device first.
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 23, 2015, 11:51:24 am
Thank you,
yes UPDATE of FIRMWARE may be solution, must find PCMCIA reader first, this PC do not have one...

Here what is answer on java command run ->
Quote
q@ubuntu:~$ java -Dserver=192.168.1.209 -DlocalAddress=192.168.1.205 -classpath "egclient-patch.jar:xerces.jar:JimiProClasses.zip:RemoteGui.jar" elgato.gui.MainWindow
Exception in thread "main" java.lang.NoClassDefFoundError: elgato/gui/MainWindow
Caused by: java.lang.ClassNotFoundException: elgato.gui.MainWindow
   at java.net.URLClassLoader$1.run(URLClassLoader.java:217)
   at java.security.AccessController.doPrivileged(Native Method)
   at java.net.URLClassLoader.findClass(URLClassLoader.java:205)
   at java.lang.ClassLoader.loadClass(ClassLoader.java:323)
   at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:294)
   at java.lang.ClassLoader.loadClass(ClassLoader.java:268)
Could not find the main class: elgato.gui.MainWindow. Program will exit.
q@ubuntu:~$
Title: Re: Agilent E7495 linux root account
Post by: Urs42 on February 23, 2015, 11:58:28 am
It loos like you are running the command in your home directory, that won't work. Run it in the directory where all the java files are.

I pasted the wrong command line, please replace egclient-patch.jar with egclient.jar

Code: [Select]
java -Dserver=192.168.1.209 -DlocalAddress=192.168.1.205 -classpath "egclient.jar:xerces.jar:JimiProClasses.zip:RemoteGui.jar" elgato.gui.MainWindow
A PCMCIA adapter won't be easy to find. I'm not sure if it's possible to update the firmware with a CF card. Card readers with CF are available in every electronics store (at least here). If you need a PCMCIA card for the upgrade, buy a CF to PCMCIA adapter and a CF card.

If you have a PCMCIA Card in your device, you could also use ftp to copy the upgrade to the card, you need some linux knowledge to do this.
Title: Re: Agilent E7495 linux root account
Post by: Wuerstchenhund on February 23, 2015, 12:07:33 pm
Thank you,
yes UPDATE of FIRMWARE may be solution, must find PCMCIA reader first, this PC do not have one...

You don't need PCMCIA. The E7495 also has a separate Compact Flash slot, just copy the firmware update to a FAT32 formatted CF card, plug in into the E7495 and switch it on. It will find the file and start the firmware update process.
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 23, 2015, 12:43:18 pm
Right, thank you :)
must visit the store next door... for CF card than

My Linux knowledge is limited, or a bit rusty, last time running approx 30 years ago
on some Unix XWin on Truevision Graphic Workstation  :palm:
but anyway have manged to start ftp server on Ubuntu and can login
using telnet like root from E7495B...

Here java runing from right folder ->
Quote
q@ubuntu:~/Desktop$ cd E7495xRemoteGui
q@ubuntu:~/Desktop/E7495xRemoteGui$ ls -al
total 4420
drwxrwxr-x 2 q q    4096 Feb 22 20:00 .
drwxr-xr-x 7 q q    4096 Feb 23 12:23 ..
-rwxrwxr-x 1 q q 2208850 Mar 25  2005 egclient.jar
-rwxrwxr-x 1 q q  455489 Jan 13  2004 JimiProClasses.zip
-rwxrwxr-x 1 q q   32611 Jun 30  2005 RemoteGui.jar
-rwxrwxr-x 1 q q 1812019 Sep 14  2004 xerces.jar
q@ubuntu:~/Desktop/E7495xRemoteGui$ java -Dserver=192.168.1.209 -DlocalAddress=192.168.1.205 -classpath "egclient.jar:xerces.jar:JimiProClasses.zip:RemoteGui.jar" elgato.gui.MainWindow
1424695201661 INFO util.LocaleManager No locale set, using default.
1424695201677 ERROR:  measurement.ListActuator Value 'en_GB' is not in the list -English (United States)
Exception in thread "main" java.lang.NoClassDefFoundError: ceej/awt/KeyEventFilter
   at elgato.util.Platform.createPlatform(Unknown Source)
   at elgato.util.Platform.<clinit>(Unknown Source)
   at elgato.gui.MainWindow.initKeyManager(Unknown Source)
   at elgato.gui.MainWindow.initializeApplication(Unknown Source)
   at elgato.gui.MainWindow.initializeApplication(Unknown Source)
   at elgato.gui.MainWindow.main(Unknown Source)
Caused by: java.lang.ClassNotFoundException: ceej.awt.KeyEventFilter
   at java.net.URLClassLoader$1.run(URLClassLoader.java:217)
   at java.security.AccessController.doPrivileged(Native Method)
   at java.net.URLClassLoader.findClass(URLClassLoader.java:205)
   at java.lang.ClassLoader.loadClass(ClassLoader.java:323)
   at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:294)
   at java.lang.ClassLoader.loadClass(ClassLoader.java:268)
   ... 6 more
q@ubuntu:~/Desktop/E7495xRemoteGui$
Title: Re: Agilent E7495 linux root account
Post by: jwm_ on February 23, 2015, 05:01:16 pm
Ordered a broken (unknown reasons, non engineer seller) one for $275. Hopefully I will be able to get it up and running or I'll have some spare parts for you all.
Title: Re: Agilent E7495 linux root account
Post by: theatrus on February 23, 2015, 05:35:57 pm
Since Sun at the tie wasn't in the business of shipping embedded Linux VMs, this will be using a VM made by these folks:

http://www.skelmir.com/ (http://www.skelmir.com/)

It looks like the libraries are setup to call into their implementation of AWT. In theory you could use proguard or similar to re-write the class references to normal AWT.

Java: write once, run somewhere

Right, thank you :)
must visit the store next door... for CF card than

My Linux knowledge is limited, or a bit rusty, last time running approx 30 years ago
on some Unix XWin on Truevision Graphic Workstation  :palm:
but anyway have manged to start ftp server on Ubuntu and can login
using telnet like root from E7495B...

Here java runing from right folder ->
Quote
q@ubuntu:~/Desktop$ cd E7495xRemoteGui
q@ubuntu:~/Desktop/E7495xRemoteGui$ ls -al
total 4420
drwxrwxr-x 2 q q    4096 Feb 22 20:00 .
drwxr-xr-x 7 q q    4096 Feb 23 12:23 ..
-rwxrwxr-x 1 q q 2208850 Mar 25  2005 egclient.jar
-rwxrwxr-x 1 q q  455489 Jan 13  2004 JimiProClasses.zip
-rwxrwxr-x 1 q q   32611 Jun 30  2005 RemoteGui.jar
-rwxrwxr-x 1 q q 1812019 Sep 14  2004 xerces.jar
q@ubuntu:~/Desktop/E7495xRemoteGui$ java -Dserver=192.168.1.209 -DlocalAddress=192.168.1.205 -classpath "egclient.jar:xerces.jar:JimiProClasses.zip:RemoteGui.jar" elgato.gui.MainWindow
1424695201661 INFO util.LocaleManager No locale set, using default.
1424695201677 ERROR:  measurement.ListActuator Value 'en_GB' is not in the list -English (United States)
Exception in thread "main" java.lang.NoClassDefFoundError: ceej/awt/KeyEventFilter
   at elgato.util.Platform.createPlatform(Unknown Source)
   at elgato.util.Platform.<clinit>(Unknown Source)
   at elgato.gui.MainWindow.initKeyManager(Unknown Source)
   at elgato.gui.MainWindow.initializeApplication(Unknown Source)
   at elgato.gui.MainWindow.initializeApplication(Unknown Source)
   at elgato.gui.MainWindow.main(Unknown Source)
Caused by: java.lang.ClassNotFoundException: ceej.awt.KeyEventFilter
   at java.net.URLClassLoader$1.run(URLClassLoader.java:217)
   at java.security.AccessController.doPrivileged(Native Method)
   at java.net.URLClassLoader.findClass(URLClassLoader.java:205)
   at java.lang.ClassLoader.loadClass(ClassLoader.java:323)
   at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:294)
   at java.lang.ClassLoader.loadClass(ClassLoader.java:268)
   ... 6 more
q@ubuntu:~/Desktop/E7495xRemoteGui$
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 23, 2015, 06:40:44 pm
Well for sure something is not good regarding The file transfer....

Here is my FTP transfer attempt, maybe someone can find out, what is wrong....
Quote
q@ubuntu:/home$ ls -al
total 12
drwxrwxrwx  3 root root 4096 Feb  5 15:21 .
drwxr-xr-x 24 root root 4096 Feb 19 10:27 ..
drwxr-xr-x 34 q    q    4096 Feb 23 17:47 q
q@ubuntu:/home$ sudo chmod 777 q
[sudo] password for q:
q@ubuntu:/home$ ls -al
total 12
drwxrwxrwx  3 root root 4096 Feb  5 15:21 .
drwxr-xr-x 24 root root 4096 Feb 19 10:27 ..
drwxrwxrwx 34 q    q    4096 Feb 23 17:47 q
Enabling all kind of reading and writing on home of user q
Quote
q@ubuntu:/home$ sudo /etc/init.d/vsftpd start
vsftpd start/running, process 5611
ftp server start....
Quote
q@ubuntu:/home$ telnet 192.168.1.209
Trying 192.168.1.209...
Connected to 192.168.1.209.
Escape character is '^]'.

Linux login: root
Password:

telnet on E7495B
Quote
[root@Linux /root]$cd ..
[root@Linux /]$cd ..
[root@Linux /]$ls -al
drwxr-xr-x   19 root     root         1024 Feb 20 08:17 .
drwxr-xr-x   19 root     root         1024 Feb 20 08:17 ..
-rwxr-xr-x    1 root     root           31 Feb 20 08:17 .flexlmrc
drwxr-xr-x    2 root     root         2048 Oct 21  1968 bin
drwxr-xr-x    6 root     root         2048 Oct 21  1968 dev
drwxr-xr-x    6 root     root         1024 Oct 21  1968 etc
drwxrwxr-x    1 root     root            0 Nov 13  1969 flash
drwxr-xr-x    8 root     root         1024 Aug 23  2004 home
drwxr-xr-x    4 root     root         2048 Oct 21  1968 lib
lrwxrwxrwx    1 root     root           11 Aug 23  2004 linuxrc -> bin/busybox
drwxr-xr-x    2 root     root        12288 Apr  4  2000 lost+found
drwxr-xr-x    2 root     root         1024 Aug 23  2004 mnt
drwxr-xr-x    2 root     root         1024 Aug 23  2004 nfs
dr-xr-xr-x   89 root     root            0 Oct 21  1968 proc
drwxr-xr-x    2 root     root         1024 Aug 23  2004 rd
drwxr-xr-x    2 root     root         1024 Feb 20 08:17 root
drwxr-xr-x    2 root     root         1024 Apr  7  2004 sbin
drwxr-xr-t    3 root     root         1024 Feb 20 08:17 tmp
drwxr-xr-x    7 root     root         1024 Apr  7  2004 usr
drwxr-xr-x    7 root     root         1024 Apr  7  2004 var
drwxr-xr-x    2 root     root         1024 Aug 23  2004 xdrive
[root@Linux /]$cd flash
[root@Linux /flash]$ls
COPYRIGHTS.TXT.gz     firmware_upgrade.log  mnt
egGui                 linux                 mntArms
egServer              ln                    siege
elgato                loadkernel            siege_current
[root@Linux /flash]$cd egGui
[root@Linux egGui]$ls -al
drwxrwxr-x    1 root     root            0 Nov 13  1969 .
drwxrwxr-x    1 root     root            0 Nov 13  1969 ..
-r--r--r--    1 root     root       455489 Nov  1  2007 JimiProClasses.zip
-rw-rw-r--    1 root     root      3480541 Nov  1  2007 egclient.jar
-r--r--r--    1 root     root         8070 Nov  1  2007 libguiutil.so
-r--r--r--    1 root     root       596528 Nov  1  2007 rhino-1.5R4.jar
-rw-------    1 root     root            0 Dec 18  2006 shellexec.log
-r--r--r--    1 root     root      1897838 Nov  1  2007 swing.jar
-r--r--r--    1 root     root      1812019 Nov  1  2007 xerces.jar
changing path to righ folder....
Quote
[root@Linux egGui]$ftp
ftp> open 192.168.1.205
Connected to 192.168.1.205.
220 Welcome to VIHOR FTP service.
Name (192.168.1.205:root): q
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
Login to ftp server on Ubuntu PC
Quote
ftp> passive
Passive mode on.
ftp> put libguiutil.so
local: libguiutil.so remote: libguiutil.so
227 Entering Passive Mode (192,168,1,205,56,86).
150 Ok to send data.
421 Data timeout. Reconnect. Sorry.
8070 bytes sent in 0.00125 secs (6.3e+03 Kbytes/sec)
ftp> close
Not connected.
ftp> exit
[root@Linux egGui]$quitConnection closed by foreign host.
Transfer started, but takes bit long for small 8kb file (smallest in folder), ftp closed, telnet quit
Quote
q@ubuntu:/home$ ls -al
total 12
drwxrwxrwx  3 root root 4096 Feb  5 15:21 .
drwxr-xr-x 24 root root 4096 Feb 19 10:27 ..
drwxrwxrwx 34 q    q    4096 Feb 23 19:10 q
q@ubuntu:/home$ cd q
q@ubuntu:~$ ls -al
total 216
drwxrwxrwx 34 q    q     4096 Feb 23 19:10 .
drwxrwxrwx  3 root root  4096 Feb  5 15:21 ..
drwx------  3 q    q     4096 Feb  5 21:02 .adobe
... lot of flies and folders
-rw-------  1 q    q        0 Feb 23 19:10 libguiutil.so
... lot of files and folders
-rw-------  1 q    q     8935 Feb 23 12:37 .xsession-errors.old
q@ubuntu:~$
Same result, test file libguiutil.so have 0 size....

For reference vsftpd.conf is ->
Quote
listen=YES
anonymous_enable=YES
local_enable=YES
write_enable=YES
anon_upload_enable=YES
anon_mkdir_write_enable=YES
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
chown_uploads=YES
chown_username=q
ftpd_banner=Welcome to VIHOR FTP service.
secure_chroot_dir=/var/run/vsftpd
pam_service_name=vsftpd
rsa_cert_file=/etc/ssl/certs/vsftpd.pem
anon_root=/srv/ftp/incoming

Any tips or tricks  :-\

EDIT: for evidence, just made ftp transfer of 40 k file from another PC terminal console, without any trouble....
conclusion my ftp server setup on Ubuntu is OK
E7495B do not like to give his precious files away  ;)
Title: Re: Agilent E7495 linux root account
Post by: Urs42 on February 23, 2015, 08:40:36 pm
The most important line is:

Code: [Select]
421 Data timeout. Reconnect. Sorry.
Looks like a network or firewall problem. I have no idea about the default firewall config on a Ubuntu System.  You also had troubles with the HTTP download. I think HTTP should work with any default firewall setup.  Is telnet stable? Can you compare the Output of ifconfig on the PC and E7495? Are there any errors in the output of dmesg on both devices?
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 23, 2015, 11:00:34 pm
Telnet is stable, tests with mkdir or chmod are ok

HTTP transfer failed on Ubuntu and Windows 7 (second PC was first try) both are on Wireless and E7495 is on LAN Ethernet....
Maybe should test tomorrow with crossover CAT 5 cable or on other LAN hub/switch too. (LAN to LAN)

After booting there are no Errors by dmesg
Regarding Output of ifconfig on the PC and E7495, will see that tomorrow.
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 24, 2015, 12:33:55 pm
After some re-formating of CF (8 GB Trascend) upgrade done....
(http://i730.photobucket.com/albums/ww304/d9aplus/safety/IMG-20150224-00299_zpse2g97mqj.jpg) (http://s730.photobucket.com/user/d9aplus/media/safety/IMG-20150224-00299_zpse2g97mqj.jpg.html)

(http://i730.photobucket.com/albums/ww304/d9aplus/safety/IMG-20150224-00300_zpscccwqyma.jpg) (http://s730.photobucket.com/user/d9aplus/media/safety/IMG-20150224-00300_zpscccwqyma.jpg.html)

(http://i730.photobucket.com/albums/ww304/d9aplus/safety/IMG-20150224-00306_zpso1bi6oeh.jpg) (http://s730.photobucket.com/user/d9aplus/media/safety/IMG-20150224-00306_zpso1bi6oeh.jpg.html)

but comm / download problem for egclient.jar still exist, at last on HTTP protocol
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 24, 2015, 02:24:13 pm
Now copy of ifconfig...

Ubuntu PC->
Quote
q@ubuntu:~$ sudo /etc/init.d/vsftpd restart
Rather than invoking init scripts through /etc/init.d, use the service(8)
utility, e.g. service vsftpd restart

Since the script you are attempting to invoke has been converted to an
Upstart job, you may also use the stop(8) and then start(8) utilities,
e.g. stop vsftpd ; start vsftpd. The restart(8) utility is also available.
vsftpd stop/waiting
vsftpd start/running, process 3482
q@ubuntu:~$ ifconfig
eth0      Link encap:Ethernet  HWaddr 00:1b:38:07:e1:35 
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback 
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:1519 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1519 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:147453 (147.4 KB)  TX bytes:147453 (147.4 KB)

wlan0     Link encap:Ethernet  HWaddr 00:1b:77:53:a1:e1 
          inet addr:192.168.1.205  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::21b:77ff:fe53:a1e1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:47025 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10301 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:9331190 (9.3 MB)  TX bytes:1644170 (1.6 MB)


E7495B ->
Quote
q@ubuntu:~$ telnet 192.168.1.209
Trying 192.168.1.209...
Connected to 192.168.1.209.
Escape character is '^]'.

Linux login: root
Password:
[root@Linux /root]$ifconfig
eth0      Link encap:Ethernet  HWaddr 00:60:0C:00:48:9C 
          inet addr:192.168.1.209  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST NOTRAILERS RUNNING  MTU:1500  Metric:1
          RX packets:1852 errors:0 dropped:0 overruns:0 frame:0
          TX packets:59 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:113381 (110.7 kb)  TX bytes:0 (0.0 b)
          Interrupt:58

lo        Link encap:Local Loopback 
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:496 errors:0 dropped:0 overruns:0 frame:0
          TX packets:496 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:41823 (40.8 kb)  TX bytes:41823 (40.8 kb)

[root@Linux /root]$
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 24, 2015, 03:32:09 pm
Another ftp session now wire LAN to LAN... no luck
Quote
[root@Linux egGui]$ftp
ftp> open 192.168.1.204
Connected to 192.168.1.204.
220 Welcome to VIHOR FTP service.
Name (192.168.1.204:root): q
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> put libguiutil.so
local: libguiutil.so remote: libguiutil.so
200 PORT command successful. Consider using PASV.
150 Ok to send data.
421 Data timeout. Reconnect. Sorry.
8070 bytes sent in 0.00131 secs (6e+03 Kbytes/sec)
ftp> exit
[root@Linux egGui]$ifconfig
eth0      Link encap:Ethernet  HWaddr 00:60:0C:00:48:9C 
          inet addr:192.168.1.209  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST NOTRAILERS RUNNING  MTU:1500  Metric:1
          RX packets:6659 errors:0 dropped:0 overruns:0 frame:0
          TX packets:296 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:414038 (404.3 kb)  TX bytes:0 (0.0 b)
          Interrupt:58

lo        Link encap:Local Loopback 
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:1528 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1528 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:123075 (120.1 kb)  TX bytes:123075 (120.1 kb)

[root@Linux egGui]$quitConnection closed by foreign host.
q@ubuntu:~$ ifconfig
eth0      Link encap:Ethernet  HWaddr 00:1b:38:07:e1:35 
          inet addr:192.168.1.204  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::21b:38ff:fe07:e135/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:9376 errors:1 dropped:0 overruns:0 frame:0
          TX packets:4340 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1845529 (1.8 MB)  TX bytes:623224 (623.2 KB)

lo        Link encap:Local Loopback 
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:3987 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3987 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:410258 (410.2 KB)  TX bytes:410258 (410.2 KB)

wlan0     Link encap:Ethernet  HWaddr 00:1b:77:53:a1:e1 
          inet addr:192.168.1.205  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::21b:77ff:fe53:a1e1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:123593 errors:0 dropped:0 overruns:0 frame:0
          TX packets:51103 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:65287362 (65.2 MB)  TX bytes:10418010 (10.4 MB)

q@ubuntu:~$

Must be some of E7495B Linux setting :-[
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 24, 2015, 06:51:21 pm
Well, after upgrade is done,
at last can use CF memory to get some measurement data out of E7495B

(http://i730.photobucket.com/albums/ww304/d9aplus/safety/printScreen_1274455450093_zpskhpwl53q.png)
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 24, 2015, 10:16:00 pm
By the way,
any of you managed to set HW date/clock....

Can not figure what is set sintax?

Quote
[root@E749xx /root]$date -s
date: option requires an argument -- s
BusyBox v0.60.3 (2002.06.05-19:04+0000) multi-call binary

Usage: date [OPTION]... [+FORMAT]

Displays the current time in the given FORMAT, or sets the system date.

Options:
   -R      Outputs RFC-822 compliant date string
   -d STRING   display time described by STRING, not `now'
   -s      Sets time described by STRING
   -u      Prints or sets Coordinated Universal Time

[root@E749xx /root]$date -R
Fri, 21 May 2010 21:04:06 +0000
[root@E749xx /root]$hwclock
Fri May 21 21:42:30 2010  -0.969888 seconds


EDIT:
Later managed that sintax->
Quote
date -s 2015.02.24-22:29

When you are happy with your system time, remember to set hwclock too,
Set hardware clock to system time ->
Quote
hwclock -w

Useful link, it seems that good part of E7495B Linux distribution is sourced from here ->
http://busybox.net/downloads/BusyBox.html (http://busybox.net/downloads/BusyBox.html)
http://busybox.net/downloads/ (http://busybox.net/downloads/)
Title: Re: Agilent E7495 linux root account
Post by: Wuerstchenhund on February 25, 2015, 06:34:17 am
(http://i730.photobucket.com/albums/ww304/d9aplus/safety/printScreen_1274455450093_zpskhpwl53q.png)

One of the things that annoy me with the E7495 is that the default setting for screen shots is a white background. It looks bad on the image above, but it's absolutely crap in other modes like SA mode where the line is in light green.

The setting can be changed in the setup but it has to be done for each mode, and even then will often revert back to white.

It would be great if someone figured out a way to make black background the default.
Title: Re: Agilent E7495 linux root account
Post by: Wuerstchenhund on February 25, 2015, 06:40:31 am
By the way,
any of you managed to set HW date/clock....

Yes, GPS does it automatically.

Quote

Useful link, it seems that good part of E7495B Linux distribution is sourced from here ->
http://busybox.net/downloads/BusyBox.html (http://busybox.net/downloads/BusyBox.html)
http://busybox.net/downloads/ (http://busybox.net/downloads/)

As far as I know it uses parts of BusyBox but apparently the Linux on the E7495B is based on an old SUSE Linux variant from around 2004.
Title: Re: Agilent E7495 linux root account
Post by: Urs42 on February 25, 2015, 08:07:21 am
Quote
The setting can be changed in the setup but it has to be done for each mode, and even then will often revert back to white.
It would be great if someone figured out a way to make black background the default.

Warning: Changes in /flash are permanent! You can brick your device! Don't change anything there if you are not sure what you are doing. Before you do anything there, use tar to back up all files from /flash to the CF or PCMCIA card!

In my first post i mentioned that the power up settings are stored in /flash/egServer/registry/Powerup/ i think that you can't change the powerup configuration with the GUI, but you can configure the device, save the configuration to a profile an then use telnet to copy your profile to /flash/egServer/registry/Powerup/. All profiles are stored as supdirectories of /flash/egServer/registry/

Quote
Must be some of E7495B Linux setting ?

I'm sorry, i can't see anything wrong from here, it's not easy to debug stuff like this without a way to reproduce the issue. I think the Linux on the E7495B isn't the issue here, It could be a hardware issue with your E7495B or some problem with your Network or Computer(s).
Title: Re: Agilent E7495 linux root account
Post by: Wuerstchenhund on February 25, 2015, 08:23:39 am
i think that you can't change the powerup configuration with the GUI

Sure you can. Just save your preset as "powerup"  ;)

However this doesn't seem to help for the screen capture background setting, which still seems to revert to white.

I also couldn't find a parameter for it in the registry, but maybe I just didn't look hard enough or overlooked something.
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 25, 2015, 09:04:01 am
Yes, GPS does it automatically.
In that case that is not stored on hwclock or there is no clock backup battery... because my unit was on GPS couple days ago.

I'm sorry, i can't see anything wrong from here, it's not easy to debug stuff like this without a way to reproduce the issue. I think the Linux on the E7495B isn't the issue here, It could be a hardware issue with your E7495B or some problem with your Network or Computer(s).
Thank you for your kind efforts  :-+
No rush... after all, with all this I am refreshing my Unix know how :)
With CF use can pick up necessary data for now... and remote is in to do list.
E7495B must be capable on VXI or USBTMC commands, that may be also god solution for my future remote...

Considering from last night one other way to bring E7485B version of egclient.jar
to Ubuntu PC...  by simple copy on CF card, but
path ->
on /flash/mnt/cf/
>ls -al
.
..
empty folder! (some data like screns, xls and update files are on CF for sure....

Anyone, what is right path for my CF card?
Quote
enable_irq(114) unbalanced from c032558c
Trying to free nonexistent resource <ce8a6000-ce8a600f>
hda: SILICONSYSTEMS INC 128MB, ATA DISK drive
ide0 at 0xce8a6000-0xce8a6007,0xce8a600e on irq 114
hda: 254208 sectors (130 MB) w/0KiB Cache, CHS=993/8/32
Partition check:
 hda: hda1
ide_cs: hda: Vcc = 3.3, Vpp = 0.0
enable_irq(115) unbalanced from c032558c
Trying to free nonexistent resource <ce8b7000-ce8b700f>
hdc: TS8GCF133, ATA DISK drive
ide1 at 0xce8b7000-0xce8b7007,0xce8b700e on irq 115
hdc: task_no_data_intr: status=0x51 { DriveReady SeekComplete Error }
hdc: task_no_data_intr: error=0x04 { DriveStatusError }
hdc: 15662304 sectors (8019 MB) w/1KiB Cache, CHS=974/255/63
 hdc: hdc1
ide_cs: hdc: Vcc = 3.3, Vpp = 0.0
 hda: hda1
 hda: hda1
VFS: Can't find ext2 filesystem on dev ide0(3,1).
 hda: hda1
 hda: hda1
cramfs: wrong magic
 hda: hda1
 hda: hda1
 hdc: hdc1
 hdc: hdc1
VFS: Can't find ext2 filesystem on dev ide1(22,1).
 hdc: hdc1
 hdc: hdc1
cramfs: wrong magic
 hdc: hdc1
 hdc: hdc1
 hda: hda1
 hda: hda1
VFS: Can't find ext2 filesystem on dev ide0(3,1).
 hda: hda1
 hda: hda1
cramfs: wrong magic
 hda: hda1
 hda: hda1
 hdc: hdc1
 hdc: hdc1
VFS: Can't find ext2 filesystem on dev ide1(22,1).
 hdc: hdc1
 hdc: hdc1
cramfs: wrong magic
 hdc: hdc1
 hdc: hdc1

Asking because >mount
report same devices with and without PCMCIA and CF card plugged on E7495B
no >lsblk to find out, any other way to do it?
Quote
[root@E749xx /root]$mount
rootfs on / type rootfs (rw)
/dev/root on / type ext2 (rw)
/proc on /proc type proc (rw)
none on /dev/pts type devpts (rw)
/dev/mtdb3 on /flash type jffs2 (rw)
Title: Re: Agilent E7495 linux root account
Post by: Wuerstchenhund on February 25, 2015, 03:45:37 pm
Yes, GPS does it automatically.
In that case that is not stored on hwclock or there is no clock backup battery... because my unit was on GPS couple days ago.

I didn't check but without a charged battery in the battery bays or PSU power it will probably forget the date/time as I doubt it has a separate backup battery.

Quote
Considering from last night one other way to bring E7485B version of egclient.jar
to Ubuntu PC...  by simple copy on CF card, but
path ->
on /flash/mnt/cf/
>ls -al
.
..
empty folder! (some data like screns, xls and update files are on CF for sure....

You *did* mount the card in the E7495 before you tried to access it, didn't you?

Quote
Anyone, what is right path for my CF card?

Now that's really easy. It says it right there (I highlighted the relevant part in bold):

Quote
enable_irq(114) unbalanced from c032558c
Trying to free nonexistent resource <ce8a6000-ce8a600f>
hda: SILICONSYSTEMS INC 128MB, ATA DISK drive
ide0 at 0xce8a6000-0xce8a6007,0xce8a600e on irq 114
hda: 254208 sectors (130 MB) w/0KiB Cache, CHS=993/8/32
Partition check:
 hda: hda1
ide_cs: hda: Vcc = 3.3, Vpp = 0.0
enable_irq(115) unbalanced from c032558c
Trying to free nonexistent resource <ce8b7000-ce8b700f>
hdc: TS8GCF133, ATA DISK drive
ide1 at 0xce8b7000-0xce8b7007,0xce8b700e on irq 115
hdc: task_no_data_intr: status=0x51 { DriveReady SeekComplete Error }
hdc: task_no_data_intr: error=0x04 { DriveStatusError }
hdc: 15662304 sectors (8019 MB) w/1KiB Cache, CHS=974/255/63
 hdc: hdc1

ide_cs: hdc: Vcc = 3.3, Vpp = 0.0
hda: hda1
 hda: hda1
VFS: Can't find ext2 filesystem on dev ide0(3,1).
 hda: hda1
 hda: hda1
cramfs: wrong magic
 hda: hda1
 hda: hda1
 hdc: hdc1
 hdc: hdc1
VFS: Can't find ext2 filesystem on dev ide1(22,1).
 hdc: hdc1
 hdc: hdc1
cramfs: wrong magic
 hdc: hdc1
 hdc: hdc1
 hda: hda1
 hda: hda1
VFS: Can't find ext2 filesystem on dev ide0(3,1).
 hda: hda1
 hda: hda1
cramfs: wrong magic
 hda: hda1
 hda: hda1
 hdc: hdc1
 hdc: hdc1
VFS: Can't find ext2 filesystem on dev ide1(22,1).
 hdc: hdc1
 hdc: hdc1
cramfs: wrong magic
 hdc: hdc1
 hdc: hdc1

It seems you're using a Transcend 8GB 133x Compact Flash card. But the error messages shouldn't be there.

Is the card formatted properly (FAT32)?

Quote
Asking because >mount
report same devices with and without PCMCIA and CF card plugged on E7495B
no >lsblk to find out, any other way to do it?
Quote

Easy:

Code: [Select]
# mount /dev/hdc1 /mnt
If you want to access the PCMCIA flash card (or a CF card in a PCMCIA adapter) then it's /dec/hda1 instead.
Title: Re: Agilent E7495 linux root account
Post by: Urs42 on February 25, 2015, 04:08:51 pm
Quote
I didn't check but without a charged battery in the battery bays or PSU power it will probably forget the date/time as I doubt it has a separate backup battery.

Some init script stores date and time at shutdown to a file in /flash, this date will be restored at the next boot.

Quote
hdc: TS8GCF133, ATA DISK drive
ide1 at 0xce8b7000-0xce8b7007,0xce8b700e on irq 115
hdc: task_no_data_intr: status=0x51 { DriveReady SeekComplete Error }
hdc: task_no_data_intr: error=0x04 { DriveStatusError }
hdc: 15662304 sectors (8019 MB) w/1KiB Cache, CHS=974/255/63
 hdc: hdc1

I'm not sure if this is a critical error, some CF/PCMCIA cards will produce errors like this one, because they don't understand all command that the kernel sends to them while initializing the card.



Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 25, 2015, 05:32:38 pm
CF card is formated properly. That's the same one from which update to A.06.25 is performed

Well

I didn't check but without a charged battery in the battery bays or PSU power it will probably forget the date/time as I doubt it has a separate backup battery.

You *did* mount the card in the E7495 before you tried to access it, didn't you?

My date went crazy again, both accu was inside unit....
Quote
[root@E749xx /root]$date
Wed Feb 25 02:10:32 UTC 2015
[root@E749xx /root]$hwtime
bash: hwtime: command not found
[root@E749xx /root]$hwclock
Wed Feb 25 06:53:49 2015  -0.763275 seconds
[root@E749xx /root]$


Well my expectation was that the system already done that for me....

Thank you to both of you :)
Must try advices, than report later....
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 25, 2015, 05:52:51 pm
Done... on second attempt after reboot
 
Quote
[root@E749xx /root]$mount /dev/hdc1 /mnt
[root@E749xx /root]$mount
rootfs on / type rootfs (rw)
/dev/root on / type ext2 (rw)
/proc on /proc type proc (rw)
none on /dev/pts type devpts (rw)
/dev/mtdb3 on /flash type jffs2 (rw)
/dev/hdc1 on /mnt type vfat (rw)
[root@E749xx /root]$
Title: Re: Agilent E7495 linux root account
Post by: Wuerstchenhund on February 25, 2015, 07:31:56 pm
Some init script stores date and time at shutdown to a file in /flash, this date will be restored at the next boot.

Yes, but that is only to avoid that new files are written with older timestamps than existing files.

Quote
I'm not sure if this is a critical error, some CF/PCMCIA cards will produce errors like this one, because they don't understand all command that the kernel sends to them while initializing the card.

In my experience (I use CF cards a lot for embedded stuff) the Transcend cards are often more problematic than say Sandisk or Apacer. Especially when they are treated as a fixed disk (like in the E7495) and not like a removable device.

However, I have used similar cards (same model, just 1GB and 16GB instead of 8GB) and didn't see such errors.
Title: Re: Agilent E7495 linux root account
Post by: Wuerstchenhund on February 25, 2015, 07:41:32 pm
Well my expectation was that the system already done that for me....

Both CF and PCMCIA storage remain unmounted until you press the screen shot button or save some measurement data, where the card gets mounted, written to and unmounted. Ever wondered why saving a simple screen shot takes so long? That's why.

This way the cards can be removed while the E7495 is still running.
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 25, 2015, 09:30:08 pm
Last session ->
Quote
E749xx login: root
Password:
[root@E749xx /root]$mount /dev/hdc1 /mnt
[root@E749xx /root]$mount
rootfs on / type rootfs (rw)
/dev/root on / type ext2 (rw)
/proc on /proc type proc (rw)
none on /dev/pts type devpts (rw)
/dev/mtdb3 on /flash type jffs2 (rw)
/dev/hdc1 on /mnt type vfat (rw)
[root@E749xx /root]$cd ..
[root@E749xx /]$cd ..
[root@E749xx /]$ls
bin         flash       linuxrc     nfs         root        usr
dev         home        lost+found  proc        sbin        var
etc         lib         mnt         rd          tmp         xdrive
[root@E749xx /]$cd flash
[root@E749xx /flash]$cd egGui
[root@E749xx egGui]$ls
JimiProClasses.zip  rhino-1.5R4.jar     xerces.jar
egclient.jar        shellexec.log
libguiutil.so       swing.jar
[root@E749xx egGui]$cp egclient.jar /dev/hdc1
[root@E749xx egGui]$umount /dev/hdc1
[root@E749xx egGui]$mount
rootfs on / type rootfs (rw)
/dev/root on / type ext2 (rw)
/proc on /proc type proc (rw)
none on /dev/pts type devpts (rw)
/dev/mtdb3 on /flash type jffs2 (rw)
[root@E749xx egGui]$

This is 4th try and failure.... after >cp on CF card file system is gone, full format on Win PC help to restore... data and screen copy
on same CF goes well....
Title: Re: Agilent E7495 linux root account
Post by: CustomEngineerer on February 26, 2015, 02:53:27 am
Last session ->
Quote
E749xx login: root
Password:
[root@E749xx /root]$mount /dev/hdc1 /mnt
[root@E749xx /root]$mount
rootfs on / type rootfs (rw)
/dev/root on / type ext2 (rw)
/proc on /proc type proc (rw)
none on /dev/pts type devpts (rw)
/dev/mtdb3 on /flash type jffs2 (rw)
/dev/hdc1 on /mnt type vfat (rw)
[root@E749xx /root]$cd ..
[root@E749xx /]$cd ..
[root@E749xx /]$ls
bin         flash       linuxrc     nfs         root        usr
dev         home        lost+found  proc        sbin        var
etc         lib         mnt         rd          tmp         xdrive
[root@E749xx /]$cd flash
[root@E749xx /flash]$cd egGui
[root@E749xx egGui]$ls
JimiProClasses.zip  rhino-1.5R4.jar     xerces.jar
egclient.jar        shellexec.log
libguiutil.so       swing.jar
[root@E749xx egGui]$cp egclient.jar /dev/hdc1
[root@E749xx egGui]$umount /dev/hdc1
[root@E749xx egGui]$mount
rootfs on / type rootfs (rw)
/dev/root on / type ext2 (rw)
/proc on /proc type proc (rw)
none on /dev/pts type devpts (rw)
/dev/mtdb3 on /flash type jffs2 (rw)
[root@E749xx egGui]$

This is 4th try and failure.... after >cp on CF card file system is gone, full format on Win PC help to restore... data and screen copy
on same CF goes well....

Your syntax is a little off. "cp egclient.jar /dev/hdc1" is copying egclient.jar over the hdc1 device, not into it. I didn't think unix/linux would actually let you do that. My guess is that it wrote egclient.jar starting at the beginning of the cf card and overwrote the partition table which is why the file system is gone. The correct syntax would be "cp egclient.jar /dev/hdc1/", notice the trailing front slash after hdc1. Though I still would not recommend doing it this way. I would reformat the the CF card, mount it and then copy it with this command. "cp egclient.jar /mnt/" Again, make sure you get the trailing front slash.
Title: Re: Agilent E7495 linux root account
Post by: ldhn1uec on February 26, 2015, 12:35:57 pm
New to the group, new to the unit. At the hamcation flea market i picked up 4 units, all "broken", seems they all work to some extent. one has a broken lcd, all took the firmware upgrade. all have slightly different opotions. dissasembled and reassembled cracked unit,  it still works and is useable with remote software. saw some talk of the download issues, check any/all firewall settings on the host pc as the file is pulled from the pc within the java parent. i had trouble until i used the early 1.4 java package. that worked well on xp and still works on w7. starting to look into modifying the options, i'll post results here. i will also mention that since this is an older unit, don't use cf larger than 2g due to changes in sector sizes.  find a 64 or 128 MEG cf card for transfers and you'll have much fewer problems.  hope that helps.

Lou... N1UEC


Sent from my iPad using Tapatalk
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 26, 2015, 07:42:56 pm
@CustomEngineerer thank you, that was useful tip, copy now in order  :-+

Concerning overall progress, something still missing.....  Correct path maybe?

RemoteGui.jar is not able to start egclient.jar, even not when all are within Home folder

When run alone egclient.jar makes this screen, and it is not possible to quit OpenJDK Java 6 Runtime.
(http://i730.photobucket.com/albums/ww304/d9aplus/safety/Screenshot%20from%202015-02-26%20203340_zpspjkgz56d.png)
 
Title: Re: Agilent E7495 linux root account
Post by: CustomEngineerer on February 27, 2015, 01:09:23 am
@CustomEngineerer thank you, that was useful tip, copy now in order  :-+

Concerning overall progress, something still missing.....  Correct path maybe?

RemoteGui.jar is not able to start egclient.jar, even not when all are within Home folder

When run alone egclient.jar makes this screen, and it is not possible to quit OpenJDK Java 6 Runtime.
 

Glad you were able to get the copy done. For what's going wrong now all I can think of is to make sure that you are starting RemoteGui.jar like Urs42 suggested in Reply #35. Pasting it below. Also note that the command is a little different than when he first suggested it back in Reply #29. Good luck.

Quote
It loos like you are running the command in your home directory, that won't work. Run it in the directory where all the java files are.

I pasted the wrong command line, please replace egclient-patch.jar with egclient.jar

Code: [Select]
java -Dserver=192.168.1.209 -DlocalAddress=192.168.1.205 -classpath "egclient.jar:xerces.jar:JimiProClasses.zip:RemoteGui.jar" elgato.gui.MainWindow
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 27, 2015, 12:35:43 pm
Yes, you are right, just forgot on that advice...

Now all running well  :-+
(except ftp file transfer, but who cares)

Like to thank to all of you. for kind assistance and patience
on this small E7495B tutorial on Java & Linux
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 27, 2015, 06:44:39 pm
Java application running but something is still not good regarding communication ->
Quote
q@ubuntu:~/Desktop$ cd E7495xRemoteGui
q@ubuntu:~/Desktop/E7495xRemoteGui$ java -Dserver=192.168.1.209 -DlocalAddress=192.168.1.205 -classpath "egclient.jar:xerces.jar:JimiProClasses.zip:RemoteGui.jar" elgato.gui.MainWindow
1425060510121 INFO util.Resources Loaded resource file: /elgato/system.properties
1425060510182 INFO util.Resources Loaded resource file: /elgato/gui.properties
1425060510790 INFO util.LocaleManager No locale set, using default.
1425060512755 INFO util.Resources Loaded resource file: /elgato/infrastructure.properties
1425060518929 INFO util.DebugServer DebugServer started on port 5100
1425060519272 INFO gui.MainWindow Display area: java.awt.Dimension[width=472,height=414]
1425060519529 INFO commChannel.DefaultCommandProcessor STATUS: Startup in process...
1425060519725 INFO commChannel.DefaultCommandProcessor STATUS: Startup complete.
1425060521582 INFO commChannel.UDPMeasurementReader Binding to DatagramSocket
1425060521583 INFO commChannel.UDPMeasurementReader Bound to UDP port 37537
1425060522662 INFO mainScreens.ProductFactory Instantiating El Gato Product Factory (class ElgatoFactory)
1425060545849 INFO util.Resources Loaded resource file: /elgato/measurement.properties
1425060599560 WARN commChannel.DefaultCommandProcessor Suspected GUI hang received while waiting for a packet, re-sending readyToReceive
1425060647308 WARN commChannel.DefaultCommandProcessor Suspected GUI hang received while waiting for a packet, re-sending readyToReceive
1425060674497 INFO util.Resources Loaded resource file: /help/help.properties
1425061378924 WARN commChannel.DefaultCommandProcessor Suspected GUI hang received while waiting for a packet, re-sending readyToReceive
1425061738848 WARN commChannel.DefaultCommandProcessor Suspected GUI hang received while waiting for a packet, re-sending readyToReceive
1425062015101 ERROR:  util.FileSystemHelper saveImage(null, /tmpscreenTmp.png, image, true):
null
com.sun.jimi.core.JimiException
   at com.sun.jimi.core.JimiWriter.putImage(JimiWriter.java:242)
   at com.sun.jimi.core.Jimi.putImage(Jimi.java:601)
   at com.sun.jimi.core.Jimi.putImage(Jimi.java:587)
   at com.sun.jimi.core.Jimi.putImage(Jimi.java:575)
   at elgato.infrastructure.util.FileSystemHelper.saveImage(Unknown Source)
   at elgato.infrastructure.util.FileSystemHelper.saveImage(Unknown Source)
   at elgato.infrastructure.mainScreens.PrintScreenMessageScreen.decorateImage(Unknown Source)
   at elgato.infrastructure.mainScreens.PrintScreenMessageScreen.saveScreenImage(Unknown Source)
   at elgato.infrastructure.mainScreens.PrintScreenMessageScreen.printScreen(Unknown Source)
   at elgato.infrastructure.mainScreens.PrintScreenMessageScreen.commitAction(Unknown Source)
   at elgato.infrastructure.mainScreens.MediaMessageScreen.run(Unknown Source)
   at java.lang.Thread.run(Thread.java:701)

1425062015219 ERROR:  widgets.ImageIcon Timed out waiting for image to load
1425062015220 WARN mainScreens.PrintScreenMessageScreen decorateImage: No addition of filename to screen capture image...java.lang.IllegalArgumentException: Width (-1) and height (45) cannot be <= 0
1425062015220 ERROR:  util.FileSystemHelper saveImage(null, /tmp/printScreen_20150127_193334.png, image, true):
null
java.lang.NullPointerException
   at com.sun.jimi.core.Jimi.putImage(Jimi.java:575)
   at elgato.infrastructure.util.FileSystemHelper.saveImage(Unknown Source)
   at elgato.infrastructure.util.FileSystemHelper.saveImage(Unknown Source)
   at elgato.infrastructure.mainScreens.PrintScreenMessageScreen.saveScreenImage(Unknown Source)
   at elgato.infrastructure.mainScreens.PrintScreenMessageScreen.printScreen(Unknown Source)
   at elgato.infrastructure.mainScreens.PrintScreenMessageScreen.commitAction(Unknown Source)
   at elgato.infrastructure.mainScreens.MediaMessageScreen.run(Unknown Source)
   at java.lang.Thread.run(Thread.java:701)

1425062436250 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436273 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436287 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436287 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436288 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436288 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436288 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436289 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436290 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436292 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436292 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436295 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436296 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436296 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436296 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436296 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436297 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436297 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436303 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436307 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436307 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436315 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436316 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436316 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436316 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436317 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436317 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436317 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436318 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436318 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436318 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436318 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436319 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436319 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436320 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436321 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436327 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436328 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436328 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436328 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436329 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436329 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436329 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436330 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436331 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436331 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436332 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436333 ERROR:  util.DebugServer Couldn't accept connection
Socket closed
java.net.SocketException: Socket closed
   at java.net.PlainSocketImpl.socketAccept(Native Method)
   at java.net.AbstractPlainSocketImpl.accept(AbstractPlainSocketImpl.java:375)
   at java.net.ServerSocket.implAccept(ServerSocket.java:478)
   at java.net.ServerSocket.accept(ServerSocket.java:446)
   at elgato.infrastructure.util.DebugServer.run(Unknown Source)

1425062436335 INFO util.DebugServer DebugServer stopped
1425062436337 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436338 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436338 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436339 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closed
1425062436340 WARN commChannel.UDPMeasurementReader -80 bytes remaining after reading packet
1425062436341 WARN commChannel.UDPMeasurementReader Error reading measurement packet, ignoring: java.net.SocketException: Socket closedq@ubuntu:~/Desktop/E7495xRemoteGui$
Title: Re: Agilent E7495 linux root account
Post by: jwm_ on February 27, 2015, 11:32:32 pm
got my E7495A for repair but without any accesories or charger. can someone tell me the polarity/voltage of the external power port?
Title: Re: Agilent E7495 linux root account
Post by: Wuerstchenhund on February 28, 2015, 08:36:15 am
got my E7495A for repair but without any accesories or charger. can someone tell me the polarity/voltage of the external power port?

24Vdc, positive inside, negative outside
Title: Re: Agilent E7495 linux root account
Post by: Wuerstchenhund on February 28, 2015, 08:51:06 am
The E7495 firmware looks very much the same as for the N1996 CSA SA

It would be interesting to find out how similar the hardware is, and if some of the capabilities of the N1996A could be transferred to the E7495.
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on February 28, 2015, 09:11:42 am
The E7495 firmware looks very much the same as for the N1996 CSA SA

It would be interesting to find out how similar the hardware is, and if some of the capabilities of the N1996A could be transferred to the E7495.

It would be nice to have a service manual for either, but I only found the N1996A one at Agilent for about $400  :palm:
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on February 28, 2015, 10:00:55 am
got my E7495A for repair but without any accesories or charger. can someone tell me the polarity/voltage of the external power port?

24Vdc, positive inside, negative outside
100W PS ->  4+ A current
Title: Re: Agilent E7495 linux root account
Post by: ldhn1uec on February 28, 2015, 09:58:00 pm
so, i have found the power supply can bve almost anything with a + center. the spec for the instrument is 10-24 volts at least 65 watts. 12v 5 amps works fine, as well as 19.8v and 4.14a.

my tinkering is going well. DO NOT ALTER the lower limit of the receivers as that will cause the system to fault. 375 is the actual \low limit. (was trying to squeeze vhf out of the swr bridge).

still comparing the dumps of the 4 units to decode the licensing arrangement. does seem that the only changes are the lic files as the other files are present anyway.

anyone have luck rebuilding or replacing the li-ion batteries?

as far as the remote gui, no joy on java 6, go back to java 1.4.2 and all was well. don't forget the loc/remote button to enable full control from the pc. even with a cracked lcd the remote software allows me to work with it.

so far so good 3/4 are working and 1 works but is -10db on spectrum

not bad for $50 each!



Sent from my iPad using Tapatalk
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on March 01, 2015, 10:45:10 am
Quote
as far as the remote gui, no joy on java 6, go back to java 1.4.2 and all was well.

You are running 1.4.2 on windows ?
Which one ? My try on Win 7 no luck....
How do you run remote gui on Win os?
Title: Re: Agilent E7495 linux root account
Post by: Urs42 on March 01, 2015, 05:31:31 pm
Quote
my tinkering is going well. DO NOT ALTER the lower limit of the receivers as that will cause the system to fault. 375 is the actual \low limit. (was trying to squeeze vhf out of the swr bridge).

Do you have the A or B model? The range of the E7495B goes from 10MHz to 2.7GHz, but the preamplifiers only go down to 375 MHz. 10MHz is written on the front panel, but i can enter frequencies down to 500KHz.
Title: Re: Agilent E7495 linux root account
Post by: ldhn1uec on March 02, 2015, 03:00:39 am
i have the 7495A. the spectrum analyzers go down fine, the swr bridge/return loss port will not go below 375m

as far as the gui, you need to uninstall java completely, go to the java site archives and get the 1.4.2 java package and install it. then the gui parts work fine. when i get round to it i may try 6.

attempted to swap lic&hostid files with no luck. seems to be more involved. may try the patch listed above.


Sent from my iPad using Tapatalk
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on March 02, 2015, 03:48:24 pm
Regarding sensitivity of E74 on low freq...

Last night have tuned down on AM 0,5-1,6 MHz band, result lot of AM carriers - not good....

Therefore just made small test by joining E7495B with FT-817 (Yaesu), same LW antenna with N 1 to 2 switch.
Conclusion is what 817 hear that E74 can "see". Must try also on 3,79-3,80 MHz DX window
during the night or early in the morning (gray zone) too but for day time here is 14.070 MHz PSK stream.
(http://i730.photobucket.com/albums/ww304/d9aplus/safety/printScreen_1424890085271_zpsyw3szejy.png)
Title: Re: Agilent E7495 linux root account
Post by: Aleuli on March 02, 2015, 07:38:01 pm
The E7495 does have a higher noise floor bellow 375Mhz(~37dBm more). This is due to internal Pre-AMP limits.
http://www.keysight.com/owc_discussions/thread.jspa?messageID=106466 (http://www.keysight.com/owc_discussions/thread.jspa?messageID=106466)
Title: Re: Agilent E7495 linux root account
Post by: LogicalDave on March 20, 2015, 05:02:34 pm
I have an E7495A and an E7495B.  Does anyone know:

1) What the latest firmware version is for each and where to download it?
2) Where replacement batteries can be purchased at a reasonable price?

Thanks!
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on March 20, 2015, 06:25:42 pm
1) What the latest firmware version is for each and where to download it?

Go here http://www.keysight.com/main/facet.jspx?&cc=US&lc=eng&k=E7495A&sm=g (http://www.keysight.com/main/facet.jspx?&cc=US&lc=eng&k=E7495A&sm=g) then drivers, firmware & software on the left
Title: Re: Agilent E7495 linux root account
Post by: Wuerstchenhund on March 26, 2015, 06:18:29 am
2) Where replacement batteries can be purchased at a reasonable price?

The batteries are made by Inspired Energy, the original model number is NI2040AG (if it carries the Agilent label) or NI2040MG (if it carries the IE label). There are now variants with larger capacity:

http://inspired-energy.com/standard_products/NI2040/NI2040.htm (http://inspired-energy.com/standard_products/NI2040/NI2040.htm)

In the UK, they're sold by Accutronics:
http://www.accutronics.co.uk/inspired_energy_batteries/ni2040hd24.html (http://www.accutronics.co.uk/inspired_energy_batteries/ni2040hd24.html)
http://www.accutronics.co.uk/inspired_energy_batteries/ni2040ed29.html (http://www.accutronics.co.uk/inspired_energy_batteries/ni2040ed29.html)
Title: Re: Agilent E7495 linux root account
Post by: The_Hari on May 02, 2015, 11:16:59 am
Hello Everyone,
I have an e7495a from ebay and i'm very happy with it.
My Questions are:
1. Is it possible to use SCPI over Lan?
2. There is also a Webserver, it asks for a Password but the root-or guest-password doesn't work.
3. Anyone an Idea, how to add other Modulations to the Generator?

Thx to Alll for the nice Work on this Device till now  :-+ 
 
Title: Re: Agilent E7495 linux root account
Post by: duggerd on May 26, 2015, 04:43:17 pm
I bought one of these a few weeks ago, and through my searching around I have found the service manual for it, as well as the latest FW. The FW is the same for both the E7495A and E7495B models.

Service Manual: https://www.w35ktn5.com/share/e7495serv.pdf (https://www.w35ktn5.com/share/e7495serv.pdf)

Latest FW (A.06.25): https://www.w35ktn5.com/share/full625.zip (https://www.w35ktn5.com/share/full625.zip)

The service manual details the installation of the FW as an upgrade (just unzip to a CF or PCMCIA card) and insert before boot. Then confirm the upgrade using the OK button.

You can also do a fresh install by instead of pressing OK at the upgrade screen, press the bottom button on the right hand side of the screen, the one directly opposite the screen from the NO option on the analyzer.
Title: Re: Agilent E7495 linux root account
Post by: The_Hari on May 26, 2015, 11:09:13 pm
Thank you very much
 :-+  :-+  :-+
Feels a little bit faster with the new Firmware  ;)
My next Step will be a self-made Battery, because an original one is way too expensive.
Title: Re: Agilent E7495 linux root account
Post by: duggerd on May 26, 2015, 11:12:35 pm
Thank you very much
 :-+  :-+  :-+
Feels a little bit faster with the new Firmware  ;)
My next Step will be a self-made Battery, because an original one is way too expensive.

I was just going to make a battery that attaches to the back of the instrument and connects using the existing DC barrel connector.

It would be interesting to make some batteries that use the SMBus protocol that are not the rare ones that it comes with. You could probably do it with some lithium primary cells and 3D printed endcaps along with a little controller board.

It would probably be cheaper than the $200 that the replacement batteries are going for, even for one-offs.
Title: Re: Agilent E7495 linux root account and n1996a
Post by: realcastle on June 09, 2015, 10:06:28 pm
Hello everybody

In find very interesting this approach of Agilent E7495 ,specially getting access into ARM LINUX system as root.
My problem is on CSA n1996a ,it works very well as guest-TELNET using "noname " password , but unfortunately
telnet as root can not login using the E7495 "wh1skers" password.
Could someone help me?
Thank you. :)
Title: Re: Agilent E7495 linux root account
Post by: cepillo on June 10, 2015, 01:39:26 pm
Does anybody can help me with the password?


(https://lh3.googleusercontent.com/kEYyjfv195822N4V7gWIYHTOUc9Z6ev3k56jDFUUcXE=w595-h315-no)
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on June 10, 2015, 01:42:26 pm
Does anybody can help me with the password?

There's probably nothing behind there, at least on the N1996A there's nothing.
Title: Re: Agilent E7495 linux root account
Post by: cepillo on June 10, 2015, 03:00:22 pm
Thanks for the response.

The reason is I can't save (download) the collected data.

I don't have PCMCIA and CF card and readers (or adopters).

According to the Guid :
 -Two RS 232 (DB-9) (reserved for future use)
 -Two USB 1.1 (reserved for future use)
 -One LAN Port 10 Base T
 -PCMCIA Card slot
 -CompactFlash memory (type 1 & 2)

Is USB working after version upgrade?
Title: Re: Agilent E7495 linux root account
Post by: realcastle on June 10, 2015, 05:43:04 pm
Thanks to    PA0PBZ

My  CSA n1996a, FW :A.02.07 works full options ! The USB mount and transfer method very simple.
As hex editor I have an Octeta on a Linux MINT OS.

Best regards !
Title: Re: Agilent E7495 linux root account
Post by: wavebits on July 04, 2015, 07:21:11 pm
Thanks to everyone that has contributed to this interesting thread..  It looks to be a pretty cool instrument that has some hacking potential.

I just picked up a E7495B from fleabay and have been playing a bit. The original firmware as received was v6.10 which I upgraded with the 6.25 fw from the link in this thread. I was able to telnet into the device and back up the /flash directory to CF first. One thing I am noticing I did not appreciate before the update is a periodic hesitation in the SA display; once about every 10-12 seconds there is a about a 1 second pause in the display response. It is fairly subtle but definitely there. Has anyone else noticed it?

My unit has the 510 complex signal generator. It seems to be a pretty common option.  It sure would be great to get some conventional FM modulation from the SG to provide partial "service monitor"  functionality for testing analog FM radios and repeaters . It can generate QPSK signals for IS95 forward and reverse links so one would guess the hardware may be capable of conventional FM or at least PM modulation with it's internal ARB. Any thoughts?

Even better would be the ability to add more digital modulation modes like P25 and DMR.  That would make it really useful.

Dave, K7DMK

 

Title: Re: Agilent E7495 linux root account
Post by: Urs42 on September 16, 2015, 11:53:44 am
Hi wavebits

I did find the data files for the complex signal generator on the device, i think you can find them in

Code: [Select]
/flash/egServer/Dragonfly/Measurements/Data
The Content of this Directory:

Code: [Select]
Size   Filename
-----   ---------------------------------------------
788K 1xEVDORev4608ArbPlayback1.bin
788K 1xEVDORev96ArbPlayback1.bin
788K 1xEVDORevArbPlayback1.bin
 12K C2KRevFundamentalRandomPayload.bin
 12K C2KRevFundamentalZeroPayload.bin
1.4M iDENInOneSixthArbPlayback1.bin
 12K IS95RevAccessZeroPayload.bin
 12K IS95RevTraffic144FixedPayload.bin
 12K IS95RevTraffic144ZeroPayload.bin
 12K IS95RevTraffic96FixedPayload.bin
 12K IS95RevTrafficRandomPayload.bin
 12K IS95RevTrafficZeroPayload.bin

The Data is sent to the signal generator over a serial interface. I think that it should be possible to replace those Files. I'm not sure about renaming the menu options on the Device, i think you would have to recompile the gui .jar file to do that.
Title: Re: Agilent E7495 linux root account
Post by: ve7xen on September 17, 2015, 06:13:19 am
Hi guys, thanks for all the hard work on this SA! I've just picked one up in good working order and have been playing around, seems like an excellent unit for the money I paid.

I intend to do some more poking around at this box over the coming weeks and will post my findings here.

For now I have mirrored some of the useful files on my web server in case they ever disappear (as the firmware updates apparently have from Agilent's site...): http://www.gotroot.ca/e7495/ (http://www.gotroot.ca/e7495/) . Many thanks to those who found them.
Title: Re: Agilent E7495 linux root account
Post by: TheSteve on September 17, 2015, 06:20:12 am
Excellent buy - did you pick the one up that has been for sale on CL locally(Burnaby) for a while now?
Title: Re: Agilent E7495 linux root account
Post by: uski on October 08, 2015, 03:07:30 am
Hi

Does any of you have the latest E7495B firmware update files ? They seem to have disappeared from Agilent website...

Also, do you know if there are some hardware options or all options user installable ?

Thanks !
Title: Re: Agilent E7495 linux root account
Post by: ve7xen on October 08, 2015, 03:08:49 am
Hi

Does any of you have the latest E7495B firmware update files ? They seem to have disappeared from Agilent website...

Also, do you know if there are some hardware options or all options user installable ?

Thanks !
See my post two up from you...
Title: Re: Agilent E7495 linux root account
Post by: uski on October 08, 2015, 03:26:02 am
See my post two up from you...

Thanks for the firmware !!!  :-+

Do you know about the options ? Specifically is it possible to install option 240 if the unit didn't come with it ? (question before buying, I can't try...)
Title: Re: Agilent E7495 linux root account
Post by: ve7xen on October 08, 2015, 03:28:13 am
See my post two up from you...

Thanks for the firmware !!!  :-+

Do you know about the options ? Specifically is it possible to install option 240 if the unit didn't come with it ? (question before buying, I can't try...)
Yes, all the software options are hackable pretty easily. Read the thread, you need to hex edit one file and maybe fiddle around a bit.
Title: Re: Agilent E7495 linux root account
Post by: uski on October 08, 2015, 03:34:56 am
Yes, all the software options are hackable pretty easily. Read the thread, you need to hex edit one file and maybe fiddle around a bit.

Thanks. Wasn't sure if 240 was a software or hardware option.

EDIT: Here's the list of hardware vs software options from the service manual :
(https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/?action=dlattach;attach=175151;image)
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on November 06, 2015, 04:48:09 pm
Over the time of approx 10 months my unit LCD developed delamination / deterioration
See both up left and bottom corners, and switch off picture of left up, it is between LCD layers...
Unit was stored over the summer in original bag within dark & dry and temperature was never more than 30-32 o C

(http://i730.photobucket.com/albums/ww304/d9aplus/safety/IMG-20151023-01474_zpshg1f4xnj.jpg) (http://s730.photobucket.com/user/d9aplus/media/safety/IMG-20151023-01474_zpshg1f4xnj.jpg.html)

(http://i730.photobucket.com/albums/ww304/d9aplus/safety/IMG-20151023-01479_zpsrvslzfgh.jpg) (http://s730.photobucket.com/user/d9aplus/media/safety/IMG-20151023-01479_zpsrvslzfgh.jpg.html)

This is the same unit picture from FEB 2015.

(http://i730.photobucket.com/albums/ww304/d9aplus/safety/IMG-20150224-00306_zpso1bi6oeh.jpg) (http://s730.photobucket.com/user/d9aplus/media/safety/IMG-20150224-00306_zpso1bi6oeh.jpg.html)

Unit is still good for use, but
now looking for spare screen
or whole broken unit with good LCD  :-BROKE

PS any lead on LCD type and producer is much appreciated  :-+
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on November 08, 2015, 03:58:39 pm
LCD Info from OM Serge @ HP/Agilent-Yahoo group
Quote
It's a 10.4" VGA LCD from NEC:
NL6448BC33-50
Title: Re: Agilent E7495 linux root account
Post by: Wuerstchenhund on November 09, 2015, 04:16:20 pm
LCD Info from OM Serge @ HP/Agilent-Yahoo group
Quote
It's a 10.4" VGA LCD from NEC:
NL6448BC33-50

Datasheet:
http://www.spectrah.com/product/lcd_panel/nec_lcd_panel/nec_NL6448BC33-50_tft_color_lcd_module_specification.pdf (http://www.spectrah.com/product/lcd_panel/nec_lcd_panel/nec_NL6448BC33-50_tft_color_lcd_module_specification.pdf)
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on November 09, 2015, 08:39:14 pm
Tnx @Wuerstchenhund
Have located few sources, prices going from USD200 to 380Euro
Just must first open my unit to verify model, just to be on safe side.
Title: Re: Agilent E7495 linux root account
Post by: jwm_ on November 10, 2015, 08:02:52 pm
My LCD is undergoing the exact same thing, except is more further along than yours. Unit still works properly, but a good cm of the corners are now gone.

It almost looks repairable, like a gasket or something is being pushed over the lcd or behind the backlight. Have not tried to dissasemble it yet though.
Title: Re: Agilent E7495 linux root account
Post by: sportq on September 01, 2016, 10:34:46 am

I just got one of these, an E7495A with all the hardware options except E1 tester. I tried to follow the instructions in post #22 to patch the /flash/egServer/elgato binary however it doesn't seem to work. In fact when I try to go to page 2 of 2 of the SYSTEM menu the device hangs. I've put it back to the original binary and the menu works again. Is there anything else that needs to be modified? It mentions editing the ]tt]elgato.lic[/tt] file but it's not clear what should be done. I'd really like to enable option 300, the DC Bias output.

I've also downloaded the Debian Woody (3.0) ARM iso to get some useful Linux binaries. So far I've extracted and tested busybox  :-+ to test the process but I'll make an archive of useful ones (sshd would be great if it works). If any owners want something specific, let me know.

Lastly, I've contacted Keysight to see if they will release the Linux kernel .config file. It's a while since I hand-rolled a kernel but I'm sure I'll manage it. USB storage support would be very useful, even if it's only 1.0 (12Mbit/s).

Peter
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on September 01, 2016, 10:48:22 am
Hi Peter,

Do you have the correct firmware version? The patch is for version A06.25.
Did you find the to change bytes to be the same?


Title: Re: Agilent E7495 linux root account
Post by: sportq on September 01, 2016, 10:54:13 am
Yes, sorry, I should have said, I upgraded to A.06.25 via the link above and the bytes to be changed matched exactly. I reloaded the modified binary into the hex editor to check they had changed too.

Pete
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on September 01, 2016, 10:59:08 am
If your hex editor didn't do anything weird to the file like inserting the bytes and not overwrite them (file length still the same? Can you run a compare?) then the only other thing I can think of is that there is something strange in your license file that is causing this. Can you post the contents, or maybe PM me if you don't want it exposed to the world...?
Title: Re: Agilent E7495 linux root account
Post by: Urs42 on September 01, 2016, 11:42:20 am
Or send us the MD5 sum of the original and modified file

I think the modified version should have the md5sum

f05c12d848c7faf8866359ae33e1cfec elgato.patch
7e7736a973cccb6b131f803e7f92dcac elgato.orig

I'm not 100% sure about the two checksums, i'm at work and my computer at home not on.
Title: Re: Agilent E7495 linux root account
Post by: sportq on September 01, 2016, 11:54:43 am

I'm away from the device too, I'll post the checksums later. Thanks for all your help.

One other interesting observation the processor board has an IrDA port but I don't think it's available on the case. There's a script to start it in /etc/

Peter
Title: Re: Agilent E7495 linux root account
Post by: sportq on September 01, 2016, 08:06:07 pm
Confirm the md5 checksum:

Code: [Select]
$ md5 elgato.mod
MD5 (elgato.mod) = f05c12d848c7faf8866359ae33e1cfec

... and both the original and modified files have 5165908 bytes.

Peter
Title: Re: Agilent E7495 linux root account
Post by: DogP on October 22, 2016, 10:52:27 am
I recently grabbed one of these (E7495A)... Thanks for all the work everyone's put into it so far.

I've been having fun with it, like most of us in this thread. :)  I rebuilt one of my battery packs, and got it running my own waveforms... so I'll post that stuff when I get some time tomorrow.

I tried to follow the instructions in post #22 to patch the /flash/egServer/elgato binary however it doesn't seem to work. In fact when I try to go to page 2 of 2 of the SYSTEM menu the device hangs. I've put it back to the original binary and the menu works again. Is there anything else that needs to be modified? It mentions editing the ]tt]elgato.lic[/tt] file but it's not clear what should be done. I'd really like to enable option 300, the DC Bias output.
I'm seeing the exact same thing... did you ever work it out?  What I've noticed is that the options actually work (i.e. other tests, waveforms, etc. show up and are usable), but going to pg. 2 of the system menu causes it to hang.  I'm curious whether it's something to do with E7495A.  I upgraded my firmware to 6.25 as well.

BTW, I'm pretty sure the DC Bias option is only supported on the E7495B.  I tried removing it from my .lic file, just in case that was the problem, but it didn't fix it.

Can anyone else that has the modified file confirm that they're able to access pg. 2 of the system menu?  Are you running an E7495A or E7495B?

Thanks,
Pat
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on October 22, 2016, 11:45:59 am
... going to pg. 2 of the system menu causes it to hang.  I'm curious whether it's something to do with E7495A.  I upgraded my firmware to 6.25 as well.

So this only happens after you patch the elgato binary? What if you replace the .lic file with an empty one or just one option?

Edit: Please PM me your original .lic file. I found a problem with the one sportq was using and we solved it.  :)
Title: Re: Agilent E7495 linux root account
Post by: DogP on October 22, 2016, 12:12:05 pm
So this only happens after you patch the elgato binary? What if you replace the .lic file with an empty one or just one option?
Yeah, it's just with the patched binary... but I got it working.  I just had to add SIGN=000000000000 to the end of the lines.  It seems that the license page barfs without some SIGN value for features it has.

Thanks,
Pat
Title: Re: Agilent E7495 linux root account
Post by: sportq on October 22, 2016, 12:16:55 pm
Pat, really interested in the waveforms you've created. What are they? FM and AM would be useful but I'm not sure there would be any control over the modulation parameters.

Pete
Title: Re: Agilent E7495 linux root account
Post by: DogP on October 22, 2016, 07:55:48 pm
Pat, really interested in the waveforms you've created. What are they? FM and AM would be useful but I'm not sure there would be any control over the modulation parameters.

Currently, I've just been making test files... mostly offset CW to make sure I understand the format and specifics of how it works.

It's not a great signal generator... for most modulated signals (arbitrary and internally generated), it looks like they're simply mixing a 60 MHz IF with an LO (at the desired frequency + 60 MHz).  So, the desired signal, LO, and an image are all very strong.  The one signal (iDEN) looks like they're using a 24 MHz IF, but probably still at the same internal sample rate or something, as there are images 12 MHz off from the desired and upper image (one being up 60 MHz from the desired freq).  So, if you just need a signal present in a narrow bandwidth it's fine, but without a suppressed carrier or images, it's not a very good general purpose generator.

It's also not very flexible.  If you change the size of the file, it looks like the software knows that it needs to process more or less (generating takes shorter or longer), but when it actually plays it, it's always the size of the original file.  I'm guessing it writes the file into RAM of the signal generator depending on the actual file size, and then tells the generator to play a hardcoded size depending which "file" you're playing.  So, if you give it a file smaller than the original, you can see it play your file and then the end of whatever file you played before that... and a longer file never plays anything beyond the size of the original file.

The files are also short.  The 1xEVDORev bin files are all only 80ms long, and the iDENInOneSixthArbPlayback1.bin file is 1.44 seconds long.  The "Arb" in the name means that it's an arbitrary waveform... the other files are basically just parameters to use to make the signal (for example IS95RevAccessZeroPayload.bin is just 12KB of 0s... obviously not an actual waveform file).  Those non-Arb waveforms look like they may be generated and uploaded to the signal generator in a similar way though, so it may be possible to write your own program on the box to generate and upload your own waveform... if you can figure out the interface/protocol.

The file format for the Arb files is simply a complex (interleaved I and Q) signed 16-bit integer (no header or anything).  The integers are little endian, and it's I then Q (i.e. bytes 0 and 1 are I, 2 and 3 are Q... and so on).  The EVDO files are 2.5Msps and the iDEN file is 250Ksps.

Attached are some screenshots of various signals (simply cabled between RF Out and RF In).  The selected output frequency of all of them is 2 GHz.  The 10k file is a tone at +10 KHz, the 50k file is a tone at +50 KHz.  I tuned the spectrum analyzer to 2 GHz for the close-in views, and to the LO frequency for the wide views.

I also attached those files in case you'd like to try them out.  Simply copy them to the signal directory and rename them to the desired file name (50k is for an EVDO file, 10k is the iDEN file) and select it in the signal generator to play them back.

If anyone can figure out how to make the generator play different length files, that'd be great.  It seems to fail generating files larger than ~2MB, but even so, a 2 second 250Ksps (or 200ms 2.5Msps) file, remapped to a CF card instead of internal flash would be pretty nice.

Pat
Title: Re: Agilent E7495 linux root account
Post by: DogP on October 22, 2016, 11:14:46 pm
Here are a bunch of pics from my battery pack rebuild.  It's a 9 cell 18650 pack, with SMBus, fuel gauge, protection, etc.  I'll try to go through the process, and mention any gotchas as well.  But first of all... let me start by saying I've never rebuilt an 18650 battery pack, and I don't own a battery tab welder.  So, I bought batteries with tabs already attached, so I could solder to them (soldering directly to 18650s is hard, and the heat isn't good for the battery).  The battery tab welder would have made things quicker and easier though.

The obvious things: safety first... lithium batteries hold a lot of charge and can be dangerous, catch fire, etc.  Pay attention to battery polarity, and don't attempt this if you don't know what you're doing.

I chose the HyperPS brand batteries, with tabs attached, which were <$3 each shipped on ebay (these: www.ebay.com/itm/272359448176 (http://www.ebay.com/itm/272359448176) ).  They claim guaranteed >2600mAh, but suspicious of unknown brands, I made sure to test them in my BT-C3100 charger/tester before building the battery pack.  These actually tested quite well, >2800mAh each.  In case you don't know, fake 18650 cells claiming ridiculously large capacity (6000mAh, 9800mAh, etc) are all over the place, and generally they are actually junk (<1000mAh).  A real 18650 will generally be around 2000-3000 mAh.  The original batteries were MOLI FSPE.70037 (ICR-18650G), which were 2000mAh cells.

GOTCHA: make sure the length of the new cells are close to that of the original cells (~65mm).  The original cells are unprotected, so you'll probably want to stick with unprotected cells, as the protection circuit generally adds a little bit of length, and there isn't a lot of extra room.

To open the pack, peel back the short side of the label (or cut it, though if you leave it in one piece, it works well to hold the pack together).  Go around the edge of the pack with a knife to crack the small dots of superglue holding the plastic pieces together at the edges.  You can also crack the glue by twisting it like you're popping ice cubes out of a tray.

GOTCHA: the pack was assembled in the bottom half (side with the battery contacts), and then some RTV was put on top and closed up.  You want to disassemble it in the reverse order.  If you pull the pack out of the bottom (like I did), it'll bend the battery contacts and rip the LCD cable (I ended up replacing it with standard 0.05" ribbon).  Instead, you should open the pack by prying the top from the batteries.  Then, once the top is open, lift the pack straight out of the bottom.  Clean out any large globs of RTV from the case so they don't interfere with the fit of the new cells.

Once it's out, desolder the two tabs from the PCB, undo the Kapton tape holding the fuses, and cut the metal strips connecting the fuses to the batteries (leaving as much of the strip as possible, as you'll probably want to reuse it), and remove the PCB and fuses.  Once that's removed, you can pop apart the original pack and see how it's connected... it's 3 series packs of 3 batteries in parallel.  You'll want to start by assembling your 3 parallel battery packs.  If using the solder kind, rotate the tabs so you're soldering away from the center of the battery, so it'll solder easier, and apply less heat to the battery.  Make sure the tabs also line up on all packs, so they're easy to connect in series.  The battery pack is tight, so try to keep the solder fairly low profile.  Once they're all assembled, drop them in for a quick test fit.

Next, you need to add the tabs that go to the PCB.  Look at their placement on the original pack, and try to get it as close as possible on the new pack, so the PCB will fit properly.  I added Kapton tape between the packs, so all current will flow through the tabs... though that's not very important, as they're connected in series anyway.  I then soldered the tabs between packs together and slipped a piece of heatshrink over them and taped them down with Kapton.  I then transferred over the tape from the old batteries to the new ones for the boards and fuses, and put a few pieces of Kapton over the pack to keep it held together.  I desoldered the red and black wires from the PCB (so the PCB was completely out of the way), and connected the fuse tabs to the tabs on the ends of the pack, and cut off any extra tails.  I then put Kapton over the ends, since there wasn't enough room in the pack for the cardboard endcaps that were on the originals.

This gives you batteries fully assembled, with a red and black wire and two tabs sticking up.  Then solder the red and black wires to the PCB and press it down over the tabs and solder the tabs.  Then carefully drop the entire pack into the bottom of the shell, making sure the battery contacts go straight into the slots.  You may need to pry the plastic back a bit on the LCD end to pop the LCD in place.  Then with a multimeter, make sure you have around 11V across the points where you soldered the red and black wires.

Finally, temporarily close the lid, slide it into the E7495, and make sure it's functional before permanently closing it up. Once you know it works, I'd put a few dabs of superglue around the plastic shell, pull the label tightly over the shell and seal it up (the label should still be tacky, but will probably need a bit of glue/adhesive for a permanent seal).

The battery fuel gauge will be wrong (mine said 0% when it started, even though it already had a half charge), but after a full charge and discharge, it figured itself out.  There's an option to refresh the battery on the E7495 (automatically charges, discharges, and recharges), though it didn't work for me (it never completed because the gauge never showed that it was fully charged).

Anyway, I hope this helps... or convinces you to just spend the $200 on a new one. :-P

Pat
Title: Re: Agilent E7495 linux root account
Post by: TheSteve on October 23, 2016, 12:30:47 am
Nice rebuild of the battery. I need to find some cheap/free packs from the 7495's big brother the N1996A to rebuild. I rarely want to run it on batteries but once in a while it could be handy.

btw for anyone doing a battery rebuild like this be sure to start with all cells having an equal charge status.
Title: Re: Agilent E7495 linux root account
Post by: smgvbest on October 23, 2016, 01:20:31 am
Thank you for the battery rebuild,   that will come in very handy.  I've got one battery going thru the recondition now and the other no so healty so this is great timing.

Also thank you for the hack to enable options.   I don't have the HW for Opt 500 or the E1/T1 options but every thing else enabled just fine.

Does anyone know how to get to a self test screen or if it even has one?
Title: Re: Agilent E7495 linux root account
Post by: DogP on October 23, 2016, 01:45:44 am
btw for anyone doing a battery rebuild like this be sure to start with all cells having an equal charge status.

Ah, yes... good call on the charge status.  Another note... according to the manual, the E7495 heavily drains batteries even when turned off.  It says 18% per day, just to monitor for the power button :palm: .

I know what you mean about batteries though... plugged in is nice on the bench, but laziness usually gets the best of me, and not having to find an outlet somewhere else makes me more likely to use it.  That's why I've got a battery powered oscilloscope as well.

Oh, somewhat related... I tested the batteries I pulled from the original MOLI battery pack.  One battery was shorted, which drained all 3 of those connected cells to 0V and ruined them.  The other 6 actually tested good, between 1700 and 1900 mAh.  So, I'll keep them around for future projects where a mediocre used cell will work fine.

Does anyone know how to get to a self test screen or if it even has one?
Under system->pg. 2->service->verification there's a display and button test... but it's not much of a self test.  I'm not aware of anything like a memory, etc. test.

Pat
Title: Re: Agilent E7495 linux root account
Post by: DogP on October 23, 2016, 10:42:14 am
Pat, really interested in the waveforms you've created. What are they? FM and AM would be useful but I'm not sure there would be any control over the modulation parameters.

For anyone interested in making your own waveforms, but not really sure where to start... here's a quick tutorial for making a compatible FM file in Octave (should work in MATLAB too).  You'll need the communications package installed (I believe you'll need the communications toolbox for MATLAB).

I'm using the piano2.wav file from this page: http://www.kozco.com/tech/soundtests.html (http://www.kozco.com/tech/soundtests.html) as an example.  Below is the code... first you read the wav file, resample it from 48Ksps (audio file sample rate) to 250Ksps (iDEN file sample rate), and take just one channel of the stereo file (and rotate the matrix).  Then you FM modulate it to a complex baseband signal.  Then to get the signal ready to output, you need to scale it to full 16-bit integer scale, shorten it to 360000 samples (length of original iDEN file), and break the real/imag part of the complex signal into seperate columns of the matrix (for fwrite to output properly).  Finally, simply open the file for writing, write the file, and close it.  Then copy it to your E7495, put it in place of the iDEN file, and test it out!  The process is basically identical for the EVDO signals, except they're 2.5Msps, and only 200000 samples long.

Code: [Select]
pkg load communications
piano=wavread("piano2.wav");
music=resample(piano(:,1).', 250, 48);
fm=amodce(music, 250000, "fm", 7500);
cp_fm(1,:)=real(fm(1:360000))*32767;
cp_fm(2,:)=imag(fm(1:360000))*32767;
myfile=fopen("fm_music.bin", 'w');
fwrite(myfile, cp_fm, "int16");
fclose(myfile);

Of course the E7495 doesn't go down to the normal FM broadcast band (only goes down to 375 MHz), so I used an RTLSDR dongle with SDR# to demodulate the FM at a frequency it could work at, to verify it worked.

Pat
Title: Re: Agilent E7495 linux root account
Post by: DogP on October 26, 2016, 06:40:44 am
Does anyone know what the actual differences are between the E7495A and E7495B?  I know the front panel of the E7495A says 10MHz-2.5GHz and E7495B says 10MHz-2.7GHz, but as far as I can tell, both have the same frequency ranges (spectrum analyzer goes from 500KHz to 2.7GHz, antenna/cable analyzer and signal generator goes from 375MHz to 2.5GHz).

The only differences I've found (though can't confirm since I don't have both to actually compare) are that the B has the DC Bias option, the signal generator has slightly higher maximum output power for most signals, and accepts more external reference frequencies.

Did the B come out after the A and have an upgraded CPU, memory, flash, or anything like that?

BTW, I did some more testing on waveform files, and it appears that the largest file it'll fully process is 2MB (corresponds to 200ms @ 2.5Msps, or 2s @ 250Ksps).  I haven't gotten it to actually play any longer than the original file length though.

Thanks,
Pat
Title: Re: Agilent E7495 linux root account
Post by: DogP on November 02, 2016, 05:48:59 am
I've noticed a few strange things with my E7495A... can anyone else confirm that these are or are not normal, and that your box does what would seem "normal"?

1) Fairly regularly when I turn the box on from the off state, the screen lights up, then fades to black, but it doesn't actually boot (nothing shows on the screen at all).  I press the power button again to turn it off (either off or standby), and then press it again, and it boots fine on the 2nd attempt.  It doesn't look like it's an LCD issue... it looks like it's just not booting (it never connects to the network, when it does come on it goes through the full boot process, etc).

2) When I connect a GPS antenna with a good view of the sky, I easily get GPS (bottom left says GPS Locked), location usually shows ~8 satellites tracked, but the GPS icon in the bottom right never goes to the green dot (I've left it tracking for over 24 hours).  It always stays at the yellow triangle.  Because of that, I can't run the Time Base Adjustment (it requires me to wait for the green dot).  Switching to the internal reference shows a green dot, and the frequency accuracy seems pretty good, so I don't think the TCXO is bad.

Also, I noticed that it shows time on the screen, but it never gets set to the correct GPS time (and it appears that the time/date gets reset to the time/date that was set at boot every 30 seconds, even if I manually set it over telnet).  The GPS location looks correct though (drops a dot right on my neighbors house :-P ).

3) I rebuilt my 2nd battery pack, and like the first one, going through the battery recalibration procedure never finished.  It says that it'd take up to 12 hours, and on the first battery I left it running for almost 2 days and it never finished, so it aborted... on the 2nd battery, I left it running since I rebuilt the pack on Friday night... so almost 5 days.  I finally aborted it tonight.  The battery voltage was slowly creeping upward around 12.4 (going up around 10mV per day) but never hit 12.6V (4.2V per cell)... not sure if it didn't think it was done because of that, or something else.  It almost always showed 0 mA current.  The percentage shown is usually 99%, though it sometimes bounces down to 98% or up to 100%.

The battery life seems fine (~1.5 - 2 hours per battery), so I'm not too worried about it... just seems strange (and my OCD would like that fuel gauge error to say 0%, not 10% ;) )... I also tried just running the batteries down and recharging them normally, but that didn't make a difference.

Related to that... the 2nd battery rebuild went smoother than the first.  I'll update my rebuild post above with a couple more notes/pics.

BTW, I did a fresh firmware install of 6.25 (pressing the bottom right button, across from NO), and it didn't make any difference.

Thanks,
Pat
Title: Re: Agilent E7495 linux root account
Post by: TheSteve on November 02, 2016, 06:15:30 am
Are you using the factory power adapter? Does the unit always boot first try with the batteries removed?
Title: Re: Agilent E7495 linux root account
Post by: DogP on November 02, 2016, 07:57:42 am
Are you using the factory power adapter? Does the unit always boot first try with the batteries removed?
I'm using an aftermarket power adapter... actually, I've tried two different ones (one of them is a generic 24V 5A supply, the other is a universal 19.5V laptop power supply).  Unfortunately, it's not something that I can reliably reproduce.  I was able to get it to happen running from battery only, with the 24V supply with a battery installed, and with the 19.5V supply and no battery installed.

Not sure if it's a temperature, cap, etc. issue... I assume it's not normal, but wondering if anyone else has run into this issue.

Thanks,
Pat
Title: Re: Agilent E7495 linux root account
Post by: jwm_ on November 05, 2016, 03:00:19 am
Anyone figure out a fix for the screen bezel coming undone? The system works fine, but part of the screen is obscured. Picture attached
Title: Re: Agilent E7495 linux root account
Post by: DogP on November 05, 2016, 09:13:33 pm
Anyone figure out a fix for the screen bezel coming undone? The system works fine, but part of the screen is obscured. Picture attached
If you look at the service manual, there's a detailed procedure for removing and disassembling the display.  Pg. 111 removes the front panel from the unit, and pg. 145 removes the display from the front panel.  Once there, it looks like the gasket is accessible (MP29).

Pat
Title: Re: Agilent E7495 linux root account
Post by: DogP on December 08, 2016, 11:54:09 am
I spent a bit of time looking at this again, trying to get some remote access/control working.  As noted earlier, the E7495 has a webpage, but doesn't accept the normal login.  I noticed a similar non-working login on port 5025.  Using netstat, I saw that elgato was listening on those ports.  When looking in the /flash/egServer directory, I noticed a passwd file.  It looked different than the standard *nix passwd file, but appeared to have a hashed root password in it (RzSdSbSdye).

Rather than trying to crack the password, I decided to try simply renaming the passwd file and rebooting.  Surprisingly, it didn't recreate it, and now simply accepts any login! (on both the webpage and port 5025).

The webpage has a bunch of configuration stuff, though the coolest thing seems to be the "Transducer I/O" section.  For example, if you click "Active STIM" you can select 16 (Spectrum Analyzer), and then go to the "Channel I/O" page and click "Array" under Channel 1 to get the spectrum data.  You can set parameters, etc. as well, which get set using http POST.  I'm not really familiar with it, but I believe this is IEEE 1451 standard stuff.  Maybe there's a way to tell elgato to do these operations directly, rather than through http.

Port 5025 now accepts any login as well, though I was hoping it'd be SCPI (commonly on that port)... instead, it looks like it's something called the "DMC Shell".  Typing "help", it says "The Dmc Shell accepts "C" like function statements and assignments" and gives some examples... not sure how useful it is.


I also took a look at the remote GUI... it didn't seem to work on Windows with Java 8 (even using the commands further up in the thread).  Rather than dig into it, I installed Java 1.4.2 in a VM, grabbed the jre directory, and explicitly ran RemoteGui.jar using that version of java ("jre\bin\java -jar RemoteGui.jar").  By doing that, the remote GUI worked first try.

I was interested in how it communicated, so I sniffed the packets.  It looks like most stuff goes over port 5028.  The commands and acknowledgements go over TCP, and the spectrum display data goes over UDP.  It looks like there’s some status (power, GPS, etc) coming out 1027 as well.

I had to make sure Windows allowed the data through the firewall (without it, the TCP commands would go through, but the UDP data wouldn’t, so the GUI would never show the spectrum).  Also, Windows 7 temporarily goes back to basic graphics (disabling Aero) when you run Java 1.4.2.

The commands going over 5028 don't look to be any standard I'm familiar with.  Some examples are (without the quotes, <\n> is hex 0A): “cmd: local<\n><\n>”, "cmd: set<\n>topic: display.global<\n>printFilter: 0<\n><\n>", etc.  If you dig through the elgato binary, you can see a bunch of available commands (and you can test them out using nc).

 
Oh, and I quickly glanced at the decompiled egclient posted earlier in the thread... if you look in the manufacturing directory, it appears that there’s a Snake and Tetris game, seemingly in a hidden menu on the Display Test screen.  It wasn’t immediately obvious how to access it though.


Pat
Title: Re: Agilent E7495 linux root account
Post by: DogP on December 09, 2016, 08:28:41 am
Heh, it bugged me having games on here that I couldn't get to, so I tracked it down. :-P

Though the code has it with the DisplayTestScreen stuff, it really doesn't have anything to do with that.  To get there, you click the Spectrum Analyzer / Tools menu, then quickly click the bottom right display button 3 times.  Then the "Extras" buttons pop up with Tetris and Nibbles.

DogP
Title: Re: Agilent E7495 linux root account
Post by: TheSteve on December 09, 2016, 08:50:49 am
Nice find!

You can enable the same web login etc on the E7495's big brother, the N1996A by renaming the /flash/toroServer/passwd file.
Title: Re: Agilent E7495 linux root account
Post by: DogP on December 10, 2016, 10:38:12 am
Here's a quick (and kinda pointless) mod... I didn't really like this being called a "Base Station" test set, since it's never gonna test another base station in its life. ;)  So I opened up the egclient JAR file (with 7-zip), and replaced the cell tower background with a generic modern Agilent background (that they use on their documentation, etc... grabbed from: http://eprocurement.agilent.com/ (http://eprocurement.agilent.com/) ).  I also got rid of the "Base Station" text.  It's just a matter of modifying the ModeScreen.jpg and ModeScreen_overlay-E7495A.png (-E7495B if you've got the B model).

The colors on the LCD aren't very accurate (it had a much greener tint than it should have), so I adjusted the hue/saturation a bit to get it kinda close to the original blue, and it turned out pretty good.

Oh, and something interesting I noticed... in the JAR file is a graphic for the an E7496A.  AFAIK, that doesn't exist... I wonder what the specs of that unit would have been.

Pat
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on January 11, 2017, 10:49:17 am
Thank you all for information in this thread. Because of it now I have a new toy (A model).

Port 5025 now accepts any login as well, though I was hoping it'd be SCPI (commonly on that port)... instead, it looks like it's something called the "DMC Shell".  Typing "help", it says "The Dmc Shell accepts "C" like function statements and assignments" and gives some examples... not sure how useful it is.
The "DMC shell" looks like some kind debugger. It knows functions and variables of elgato process. I don't think it's useful without source code.
Interesting thing I found that E7495 is supported by toro executable - N1996A server.
I guess, E7495 might be used during N1996A development when N1996 hw was not ready. Maybe E7496 = N1996.
Up to this point I got "toro" running on E7495 with some tweaking. It responds to SCPI and HTTP and looks quite healthy. toroGui starts but it might be useless due to keypad differencies.
Next thing is to deal with license file and options. Spectrum analyser refuses to work without license. I don't expect a lot, because toro doesn't handle E7495 as N1996.
We'll see...
Title: Re: Agilent E7495 linux root account
Post by: DogP on January 12, 2017, 09:17:34 am
Interesting thing I found that E7456A is supported by toro executable - N1996A server.
I guess, E7456 might be used during N1996A development when N1996 hw was not ready. Maybe E7496 = N1996.
Up to this point I got "toro" running on E7456 with some tweaking. It responds to SCPI and HTTP and looks quite healthy. toroGui starts but it might be useless due to keypad differencies.
Next thing is to deal with license file and options. Spectrum analyser refuses to work without license. I don't expect a lot, because toro doesn't handle E7456 as N1996.
We'll see...
Hmm... interesting!

I'm not quite sure I totally understand though... what is the E7456?  When you run toro, is that what it detects your E7495A as?  That's a good guess that maybe E7496 = N1996, since both pieces of hardware seem to be related.

Regarding toroGui, maybe you could run it over the network, like the E7495 remote GUI, in which case the keypad wouldn't be a problem (using a virtual keypad on the PC)?

Pat
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on January 13, 2017, 09:08:37 am
I'm not quite sure I totally understand though... what is the E7456?  When you run toro, is that what it detects your E7495A as?  That's a good guess that maybe E7496 = N1996, since both pieces of hardware seem to be related.

Regarding toroGui, maybe you could run it over the network, like the E7495 remote GUI, in which case the keypad wouldn't be a problem (using a virtual keypad on the PC)?
Typo... 95, not 56. Fixed that. toro detects E7495A as E7495A. There's a special option for it called GPSA. I see two separate option lists (E7495 and N1996) inside the executable.
Unfortunately that GPSA (= general purpose spectrum analyser) doesn't work. I mean it tries. It seems to load dsp program Dragonfly/Measurements/KernelBasic/Superfly/gpSpecAn  but fails to communicate with it.
"Basic" sectrum analyser (Dragonfly/Measurements/KernelBasic/Superfly/nSpecAn) works according to web page (Active STIM/Transducer IO), but SCPI and GUI both trying to use GPSA.
Now I'm out of ideas what to try. Maybe older N1996 firmware...
Anyway, if you want to try:
1. copy flash/toroServer from N1996 firmware A.02.07 to CF/PCMCIA formatted as ext2 (fat may work, I didn't try it)
2. change baud rate in toroServer/registry/df1.ini 921600 -> 230400
3. patch toro executable and add GPSA license option to license/elgato.lic
4. copy cals from egServer
5. copy Dragonfly/Firmware/E7495A and Dragonfly/Firmware/CPXSRC from egServer
If you don't copy, toroServer includes older firmware versions and tries to update. A bit frightening. It failed to update CPXSRC. After reboot elgato recovered the firmware, but it took some minutes to start.
6. copy Dragonfly/Receivers/comPort4 from egServer
Although, It didn't change anything.
7. killall _siege; /etc/rc.d/init.d/egServer stop
8. run toro from toroServer directory
Attaching output from toro.

Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on January 13, 2017, 09:24:01 am
Debug log from GPSA.
That "waiting for getMessage(1000)" looks like a problem.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on January 22, 2017, 09:07:50 am
I didn't see if it was mentioned, GSM analyser provides some time domain display. It's quite limited, but still usable. Bandwidth is fixed 500kHz. Frequency is in 200kHz increments, but config file can be tweaked for finer adjustments.
Here's analogue video signal caught from the air:
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on January 25, 2017, 01:07:55 pm
BTW, I did some more testing on waveform files, and it appears that the largest file it'll fully process is 2MB (corresponds to 200ms @ 2.5Msps, or 2s @ 250Ksps).  I haven't gotten it to actually play any longer than the original file length though.
Length seems to be hardcoded in DSP program genIS95.
AFAIK debug log show what is passed to DSP. It's modulation type (4, 5, 6, 7 - separate value for each Arb file). And then the ARB file is written to DSP memory.

To get debug output:
1. Save settings (save state button) to <set>
2. Set debug parameter in registy/<set>/sourceStim.ini
3. connect to that DMC shell
4. activate <set>
5. play with generator
Debug output will appear in DMC shell.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on February 11, 2017, 09:45:24 pm
I just noticed a weird thing. If I change sig gen amplitude in spectrum analyser mode, signal level jumps up about 25dB. This only happens if spectrum analyser runs in full span (500kHz-2.7GHz). Amplitude control still works, but signal level is higher than normal (i.e. at -50dBm setting, actual level is -23dBm). It recovers after suspend-resume cycle.
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on February 27, 2017, 04:07:50 am
I just picked up one of these for a bargain (partially broken / incomplete). The only known problem is a intermittent busted LCD screen. Since I don't necessarily plan to use it in a portable mode, I may not replace the LCD right away especially if I can get all of this PC-based GUI stuff working. The other problem I anticipate is that it seems like I am just getting the unit -- no accessories whatsoever. Maybe when the seller ships the backpack to me, it might have some items in it.

So, I have a slew of questions:

For reference, the unit I supposedly will have in a few days is:

Agilent E7495A Options:

My current questions:

I will no doubt have further questions, but for now I don't even have the device in hand.

Thanks in advance!
Title: Re: Agilent E7495 linux root account
Post by: DogP on February 28, 2017, 08:19:10 am
I'll try to take a crack at your Qs...

1. What are the minimum set of accessories I will need to test the unit, and test the self-calibration? It seems like I need rather specific cable lengths, specific Agilent-branded 10dB pads, etc. Can I get away with cheaper parts?
I don't think there's anything special about the ones supplied.  I'm personally using standard cables and attenuators, and a homemade short, open, and load.

2. Does anyone know the full list of power sensors that will work with this device? It seems like there are only one or two.
The manual specifies that it works with the 8481A, 8481D, and 8482A (and CFT variants).

3. When I entered the model and serial number on Keysight's site, the list of options did not match the advertised list, nor did it match the list on the metallic sticker shown in the auction. Does anyone know if this is normal? Is it possible that this unit was upgraded after initial selling? I know the sticker on the device says Agilent last calibrated it in 2013.
Got a link where you entered the info?  I can try mine and see if it's different as well... though I personally wouldn't worry what Agilent thinks you've got.  If you go into setup and read out your options, that's what you've got.  And if you hack the file described earlier in the thread, you can have all the software options. :-P

4. Does anyone know what kind of power supplies one can get away with? One of the manuals lists a range of voltages. I have a whole slew of power bricks, but I don't think I have a 24V 4A one. I don't have any batteries to charge, so presumably I don't need that much current anyway.
The manual states +9V to +25V DC (55W).  I've personally run mine from a 24V 5A supply (cheap Chinese power pack) as well as a universal 90W 19.5V laptop power supply.

5. I doubt I have any PCMCIA flash cards. Do I need to buy a specific size? Like really, do I need exactly a 64MB one?
I'm not aware of any limitations... I'm using an 8GB card in mine.

6.The service manual mentions an optional, internal 90dB attenuator. But I can't find any reference to this anywhere else. Do any of your units have this? Do all units have it? Does nobody have it?
If mine has it, I'm not aware of it.

Pat
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on February 28, 2017, 10:19:40 pm
Well, I forgot an important question. I just got my unit today, so before I do something stupid...



* I looked through this thread more carefully; it's 9-24V DC, somewhere between 3 and 5 amps; center-pin positive.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on March 01, 2017, 02:08:08 pm
2. Does anyone know the full list of power sensors that will work with this device? It seems like there are only one or two.
The manual specifies that it works with the 8481A, 8481D, and 8482A (and CFT variants).
I've read somewhere that 8484 should work. I got 8481D, but not tested yet - cable is on the way.

5. I doubt I have any PCMCIA flash cards. Do I need to buy a specific size? Like really, do I need exactly a 64MB one?
I'm not aware of any limitations... I'm using an 8GB card in mine.
I use CF with CF to pcmcia adapter. Note that there's also CF slot (it works same as PCMCIA, but doesn't allow to close the door).

6.The service manual mentions an optional, internal 90dB attenuator. But I can't find any reference to this anywhere else. Do any of your units have this? Do all units have it? Does nobody have it?
If mine has it, I'm not aware of it.
It's for signal generator (source). I think, it's included if it allows to change level to -90 dBm.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on March 01, 2017, 02:52:57 pm
Here it is, ATTN OUT to J7/SOURCE IN connection.
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 04, 2017, 08:40:29 am
Another few questions:

1) Is it possible to keep the power meter reference output on but go back to the spectrum analyzer window, to see it? Apparently this is possible to do with the signal generator, but not with the spectrum analyzer.

2) Does anyone have the Service Test software? By this I mean the software package that lets you test all of the functions of the device, as described in the service manual. Perhaps this is something which is on the machine but is not available until you login as root (or some other method to gain access)?

3) In terms of disassembly, what actions are likely to destroy any hope of keeping the calibration? E.g. can I (without automatic ruining of calibration):


If you'd prefer, a qualitative assessment of what I can take a look at would be fine with me. I don't (yet) have a suitable torque wrench, so I don't think I'll be doing any of this until after I get one. But I've heard that it's common for these connectors to be overtightened from the factory, and presumably I wouldn't want to repeat that over tightening.

Thanks!

Title: Re: Agilent E7495 linux root account
Post by: DogP on March 04, 2017, 10:52:52 am
1) I don't think so, besides maybe manually poking a register under the hood somewhere to turn it on.

2) I assume you're referring to the "Agilent E7495A/B Performance Verification and Adjustment software"?  I've never come across it, and I don't think it's on the unit itself... I'm pretty sure that's PC based software, similar to this: http://www.keysight.com/en/pd-1000000762%3Aepsg%3Apro-pn-N2717A/performance-verification-and-adjustment?cc=US&lc=eng (http://www.keysight.com/en/pd-1000000762%3Aepsg%3Apro-pn-N2717A/performance-verification-and-adjustment?cc=US&lc=eng) .  It seems like it's generally option 0BW, which includes service and calibration manuals and software, but I don't see this option listed for the E7495, so it may have never been available for customers.

3) I'd say you can open the case of the unit, but as soon as you disconnect ANY RF cable, you're going to ruin the calibration.  Maybe you'll get it close to original spec, but it'll likely change slightly, and the whole point of calibration is that the system is calibrated for those conditions.  Once it changes, you either need to recalibrate, or just live with the fact that your unit isn't calibrated.  I don't know what you're hoping to see, but I definitely wouldn't remove any of the cans.  It might not affect "calibration" much, but you'll likely affect the shielding effectiveness, and increase your noise floor, interference, spurs, etc.

I've never heard about Agilent overtightening of the connectors... that's surprising (I'd figure Agilent would have a pretty good handle on connector torque).  There are different torque specs depending on the connector material, specific type, and application though, so they might be tighter than the 8 in-lbs of a standard SMA torque wrench.  For example: http://www.amphenolrf.com/connectors/sma.html (http://www.amphenolrf.com/connectors/sma.html) says 4-6"lb recommended for commercial grade parts, 7-10" lb recommended for industrial/military grade parts, and 15" lb maximum for industrial/military grade parts.  Generally, brass parts should be torqued less than stainless steel.

Pat
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 04, 2017, 02:18:31 pm
1) I don't think so, besides maybe manually poking a register under the hood somewhere to turn it on.

OK. I'll take a poke around. I also want to reset all of the default setups because they are very silly for my usage. What the hell is "Chan 500" and why did they like it so much? :)

2) I assume you're referring to the "Agilent E7495A/B Performance Verification and Adjustment software"?  I've never come across it, and I don't think it's on the unit itself... I'm pretty sure that's PC based software, similar to this: http://www.keysight.com/en/pd-1000000762%3Aepsg%3Apro-pn-N2717A/performance-verification-and-adjustment?cc=US&lc=eng (http://www.keysight.com/en/pd-1000000762%3Aepsg%3Apro-pn-N2717A/performance-verification-and-adjustment?cc=US&lc=eng) .  It seems like it's generally option 0BW, which includes service and calibration manuals and software, but I don't see this option listed for the E7495, so it may have never been available for customers.

Yes indeed. I really hope to get this one day, so perhaps someone here has come across it. I guess I could ask Keysight for it, but I doubt that will get very far.

3) I'd say you can open the case of the unit, but as soon as you disconnect ANY RF cable, you're going to ruin the calibration.  Maybe you'll get it close to original spec, but it'll likely change slightly, and the whole point of calibration is that the system is calibrated for those conditions.  Once it changes, you either need to recalibrate, or just live with the fact that your unit isn't calibrated.  I don't know what you're hoping to see, but I definitely wouldn't remove any of the cans.  It might not affect "calibration" much, but you'll likely affect the shielding effectiveness, and increase your noise floor, interference, spurs, etc.

Well, I am just very curious by nature; and I've never torn down any RF equipment. I also figured it would be nice to get pictures and/or part numbers and post them, since nobody has posted even block diagrams, let alone schematics.

I've never heard about Agilent overtightening of the connectors... that's surprising (I'd figure Agilent would have a pretty good handle on connector torque).  There are different torque specs depending on the connector material, specific type, and application though, so they might be tighter than the 8 in-lbs of a standard SMA torque wrench.  For example: http://www.amphenolrf.com/connectors/sma.html (http://www.amphenolrf.com/connectors/sma.html) says 4-6"lb recommended for commercial grade parts, 7-10" lb recommended for industrial/military grade parts, and 15" lb maximum for industrial/military grade parts.  Generally, brass parts should be torqued less than stainless steel.


I think my only references are two or three videos of Shahriar's @ The Signal Path. And perhaps it was specifically HP gear that was overtightened. In any case, given the above it won't be a problem since I won't be taking it apart.
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on March 04, 2017, 02:54:34 pm
Yes indeed. I really hope to get this one day, so perhaps someone here has come across it. I guess I could ask Keysight for it, but I doubt that will get very far.

If I remember correctly the software it is supposed to work with specific TM equipment (think sig gen, rf meter and such), and as long as you don't have those it will be of no use at all
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 04, 2017, 09:40:44 pm
Yes indeed. I really hope to get this one day, so perhaps someone here has come across it. I guess I could ask Keysight for it, but I doubt that will get very far.

If I remember correctly the software it is supposed to work with specific TM equipment (think sig gen, rf meter and such), and as long as you don't have those it will be of no use at all

Oh. I thought this unit sort of contained most of the hardware it needed to test itself. I also figured they left space in the UI for those buttons, so maybe it was on the machine. Ah well. It's still an incredible buy at $300 shipped (and now) fixed.
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 06, 2017, 04:54:20 am
In searching around for possible calibration software information (both on the unit and in general), I have so far only found this document (http://www.keysight.com/upload/cmc_upload/All/TMETutorial_E_02_11.pdf) which describes TME or Test Management Environment.

This is the aforementioned piece of software which runs on a computer (apparently with some IO libraries and a GPIB card of some sort).

It seems you can download the latest version (http://cal.software.keysight.com/) though it needs a license key. It seems there are very old calibration applications (C.xx.xx), old calibration applications (D.xx.xx) and newer ones (E.xx.xx).

The are two new facts that I think this document brings to light, however. One concerns Agilent internal numbering for these devices:


However, the reason I know this is new information is the same reason I also know this is not useful information: a search for N7816A reveals nothing except the above PDF.

Secondly, it seems like a very small subset of devices are labeled (internal Agilent only) which presumably means only Agilent themselves can run that cal application. These include:


I guessed that this is because all of these units incorporate 'Dragonfly' units (the E7495s appear to), but the 34970A seems to be an exception to this. I won't speculate further.


In any case, I wonder if we could appeal to Keysight to release the software and licenses for this, since it's long since unsupported; and they won't even do CALs for these devices anymore.
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 06, 2017, 08:21:07 am
If anyone cares to test, I had a theory that perhaps turning off some levels of logging/debugging might help. It turns out that there is no straightforward way to stop the debugging processes, but you can disable any logging.

Simply edit this file with the following changes:

/flash/linux/etc/rc.d/init.d/egGui
Code: [Select]
-DLogger.level=2
to:

Code: [Select]
-DLogger.level=0
Unfortunately I can't find a good thing to test this with. But the UI does seem a bit snappier. I wonder what other options are there for -Dxxx.


Also, I played around with the files in /flash/egServer/Dragonfly/Recievers, like E7495A and CPXSRC. You can indeed change things here and sometimes see the effects (e.g. you can change E7495A to have Freq Range be 3000e6, and it makes it possible to enter that value). However, some of these changes will have no effect for other reasons (here, I assume it's because there is actually a filter which sharply cuts off at ~ 2.7GHz).

However however, I could not find a way to try and make the signal generator make higher or lower frequency signals.

Did anyone actually try porting things from the N1996 over to ElGato? The only things I'd really be interested in are FM/AM demodulation and audio playing, and Harmonics viewing.

Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on March 07, 2017, 09:23:20 am
Did anyone actually try porting things from the N1996 over to ElGato? The only things I'd really be interested in are FM/AM demodulation and audio playing, and Harmonics viewing.

N1996A spectrum analyser code doesn't work with E7495 for some reason. It attempts to work, but DSP code seems to hang somewhere. See my post above. If you can find different versions of N1996A firmware, we might have a better luck.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on March 07, 2017, 09:30:52 am

Also, I played around with the files in /flash/egServer/Dragonfly/Recievers, like E7495A and CPXSRC. You can indeed change things here and sometimes see the effects (e.g. you can change E7495A to have Freq Range be 3000e6, and it makes it possible to enter that value). However, some of these changes will have no effect for other reasons (here, I assume it's because there is actually a filter which sharply cuts off at ~ 2.7GHz).

Limitations are spread in configs, gui, elgato, dsp code and hardware. I mean along with configs there are many hardcoded values.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on March 07, 2017, 09:38:29 am
Another few questions:

1) Is it possible to keep the power meter reference output on but go back to the spectrum analyzer window, to see it? Apparently this is possible to do with the signal generator, but not with the spectrum analyzer.
There's a separate serial port which is used to communicate with power meter hw. It's closed immediately when you exit the power meter. If I have time, I'll try to decode the protocol.
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on March 07, 2017, 10:01:22 am

Also, I played around with the files in /flash/egServer/Dragonfly/Recievers, like E7495A and CPXSRC. You can indeed change things here and sometimes see the effects (e.g. you can change E7495A to have Freq Range be 3000e6, and it makes it possible to enter that value). However, some of these changes will have no effect for other reasons (here, I assume it's because there is actually a filter which sharply cuts off at ~ 2.7GHz).

Limitations are spread in configs, gui, elgato, dsp code and hardware. I mean along with configs there are many hardcoded values.

If the 7495 is anything like the N1996 (and we have a lot of reasons to believe so) you will not be able to go above 2.7GHz.
The N1996 has 2 receive paths, one for 0.1MHz - 2.7GHz and the other for 2.7GHz to 3/6GHZ. Since the N1996, depending on the model, has an upper limit of 3 or 6GHz both receive paths are there, and that is why you can change the 3GHz model to 6GHz by changing the upper limit value. Since the 7495 goes to 2.7GHz only I assume that the upper part is missing in the 7495. See below the N1996 receive path:

(https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/?action=dlattach;attach=297243;image)
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 07, 2017, 04:06:52 pm

Also, I played around with the files in /flash/egServer/Dragonfly/Recievers, like E7495A and CPXSRC. You can indeed change things here and sometimes see the effects (e.g. you can change E7495A to have Freq Range be 3000e6, and it makes it possible to enter that value). However, some of these changes will have no effect for other reasons (here, I assume it's because there is actually a filter which sharply cuts off at ~ 2.7GHz).

Limitations are spread in configs, gui, elgato, dsp code and hardware. I mean along with configs there are many hardcoded values.

If the 7495 is anything like the N1996 (and we have a lot of reasons to believe so) you will not be able to go above 2.7GHz.
The N1996 has 2 receive paths, one for 0.1MHz - 2.7GHz and the other for 2.7GHz to 3/6GHZ. Since the N1996, depending on the model, has an upper limit of 3 or 6GHz both receive paths are there, and that is why you can change the 3GHz model to 6GHz by changing the upper limit value. Since the 7495 goes to 2.7GHz only I assume that the upper part is missing in the 7495. See below the N1996 receive path:

(https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/?action=dlattach;attach=297243;image)


Do you have any idea about extending the range (power) or (frequency) of the signal sources? Also, it seems the N1996A has a zero-span mode. I wonder if this could be enabled on this device. Also, I wonder if we can expose the number of sample points (in fact, I find it downright weird that these aren't at least listed somewhere, let alone adjustable).
Title: Re: Agilent E7495 linux root account
Post by: TheSteve on March 07, 2017, 05:18:34 pm

Do you have any idea about extending the range (power) or (frequency) of the signal sources? Also, it seems the N1996A has a zero-span mode. I wonder if this could be enabled on this device. Also, I wonder if we can expose the number of sample points (in fact, I find it downright weird that these aren't at least listed somewhere, let alone adjustable).

I was able to extend both the power and frequency range of the signal source in a N1996A. The power range difference was only a few dB so I changed it back to stock as the real maximum output varied with frequency. I extended the frequency range down to 1 MHz from 10 MHz. I believe the E7495A has similar text files which can edited however I have read someone tried lowering the source range on an E7495A in the past and it would crash the unit when you tried to enter a lower frequency.
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 08, 2017, 04:11:17 am
2) When I connect a GPS antenna with a good view of the sky, I easily get GPS (bottom left says GPS Locked), location usually shows ~8 satellites tracked, but the GPS icon in the bottom right never goes to the green dot (I've left it tracking for over 24 hours).  It always stays at the yellow triangle.  Because of that, I can't run the Time Base Adjustment (it requires me to wait for the green dot).  Switching to the internal reference shows a green dot, and the frequency accuracy seems pretty good, so I don't think the TCXO is bad.


Also, I noticed that it shows time on the screen, but it never gets set to the correct GPS time (and it appears that the time/date gets reset to the time/date that was set at boot every 30 seconds, even if I manually set it over telnet).  The GPS location looks correct though (drops a dot right on my neighbors house :-P ).


I thought I might have some insight into this problem, but it appears you already noticed what I noticed. The GPS never goes GREEN, it stays at YELLOW TRIANGLE.

I think the problem lies with the time/clock itself. Something is clearly fighting the GPS to reset the clock to some (arbitrary, it seems) earlier value. And I do mean arbitrary. I tried this procedure and I think this pretty well proves something is fighting it:



However, I do have something additional to report: You can fool the device into launching the Time Base Adjustment (... sort of):


This doesn't help us, but I think it must be the case that something is fighting us for the clock. So we just need to find what other processes/stims/whatever access/try to change the clock. Perhaps this is a sign of a hardware malfunction in a clock on the motherboard, or some other malfunction that could be tested/corrected if we could e.g. get into the BIOS? Is there a BIOS?


3) I rebuilt my 2nd battery pack, and like the first one, going through the battery recalibration procedure never finished.  It says that it'd take up to 12 hours, and on the first battery I left it running for almost 2 days and it never finished, so it aborted... on the 2nd battery, I left it running since I rebuilt the pack on Friday night... so almost 5 days.  I finally aborted it tonight.  The battery voltage was slowly creeping upward around 12.4 (going up around 10mV per day) but never hit 12.6V (4.2V per cell)... not sure if it didn't think it was done because of that, or something else.  It almost always showed 0 mA current.  The percentage shown is usually 99%, though it sometimes bounces down to 98% or up to 100%.

The battery life seems fine (~1.5 - 2 hours per battery), so I'm not too worried about it... just seems strange (and my OCD would like that fuel gauge error to say 0%, not 10% ;) )... I also tried just running the batteries down and recharging them normally, but that didn't make a difference.

Related to that... the 2nd battery rebuild went smoother than the first.  I'll update my rebuild post above with a couple more notes/pics.


I rebuilt one of my battery packs, and I took pictures of the process. Unfortunately the 2nd one I rebuilt was actually already good, and I simply hadn't checked. I will be getting batteries in soon to replace the first pack.
Title: Re: Agilent E7495 linux root account
Post by: TheSteve on March 08, 2017, 04:36:06 am
I was hoping you were on to something to help adjust the time base on the N1996A. On the N1996A there is a frequency/reference setting menu. It won't let you continue though unless the system is configured for GPS.
However the N1996A doesn't support a GPS - it was never enabled and the receiver is not installed.

I can set the external reference to "even second" but it locks just fine to a 1 PPS signal(even second doesn't lock).

Not a big deal but it would have been fun to adjust the timebase without using the crazy expensive calibration software Keysight sells for the N1996A.
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 08, 2017, 05:20:52 am
I was hoping you were on to something to help adjust the time base on the N1996A. On the N1996A there is a frequency/reference setting menu. It won't let you continue though unless the system is configured for GPS.
However the N1996A doesn't support a GPS - it was never enabled and the receiver is not installed.

I can set the external reference to "even second" but it locks just fine to a 1 PPS signal(even second doesn't lock).

Not a big deal but it would have been fun to adjust the timebase without using the crazy expensive calibration software Keysight sells for the N1996A.


Well, this may be a route toward that (if a circuitous one). I really don't know that hardware (or this hardware, to be honest). But this method let me see the the value stored somewhere (in firmware or eeprom or something) for the calibration setting (which is, in this case, an integer constant for the ADC). If we could use the screen in which this was displayed (I did not get a screenshot or photograph; I was actually driving my car at the time!) to find where it's writing a firmware setting to, perhaps we could translated this process back to your device?
Title: Re: Agilent E7495 linux root account
Post by: DogP on March 08, 2017, 06:35:27 am
This doesn't help us, but I think it must be the case that something is fighting us for the clock. So we just need to find what other processes/stims/whatever access/try to change the clock.
IIRC, I came to the conclusion that it's a script running in the background that's causing the time to constantly reset.  I think it was keepTimeUpdated or something like that.  I don't think the system clock is why GPS never goes green though (I don't think there's any code for the GPS to even try updating the system clock).

I was able to extend both the power and frequency range of the signal source in a N1996A. The power range difference was only a few dB so I changed it back to stock as the real maximum output varied with frequency. I extended the frequency range down to 1 MHz from 10 MHz. I believe the E7495A has similar text files which can edited however I have read someone tried lowering the source range on an E7495A in the past and it would crash the unit when you tried to enter a lower frequency.
That'd be great to be able to extend the sig gen freq below 375 MHz... and if it could do that, maybe it could do the insertion loss test below 375 MHz as well.  Those features would be very high on my wishlist (even though the arbitrary sig gen kinda sucks since it doesn't filter the LO or image).  Does the N1996A have an arbitrary sig gen, or just a tracking generator?

Pat
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 08, 2017, 10:38:10 pm
IIRC, I came to the conclusion that it's a script running in the background that's causing the time to constantly reset.  I think it was keepTimeUpdated or something like that.  I don't think the system clock is why GPS never goes green though (I don't think there's any code for the GPS to even try updating the system clock).

I think you are correct. I think I might have proof, but I don't think it's (yet) needed. In any case, when I was having trouble running the Calibrate Timebase thing, it turns out the hardware clock (as displayed by hwclock) was set to Jan 1 1970. In other words, it was just counting up from epoch. There is also an 'rtc' module, which could be the source of our problem: if the RTC is faulty or resetting, then it's possible the RTC or the manager of it is fighting attempts to set the clock.

I have found some code regarding this in the GUI, so I can investigate further.


Has anyone been able to decompile the ARM code? I assume there is little to no hope to decompile the firmware for the Dragonfly chips, but the ARM code (of elgato server) should be easy to decompile. I tried downloading and using snowman, but it is unfortunately stupid and it runs out of memory at the "regenerating types" stage. It seems to have generated all of the functions from two different binaries, but because I only have 8GB of memory I can't get much further. Does anyone know how to force a process to work from a disk instead of from memory?

You can look at the elgato GUI (siege) source JAR linked here, and it's clear that there are a few checking conditions before you're allowed to enter the timebase recalibration. Also, there appears to be a direct command you can issue to some command listener to set the new timebase ADC value directly -- this may help N1996A owners. At the very least, you could GET the existing timebase ADC value and then SET a new one, then compare the clocks (though how one would go about this, I have no idea).
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 08, 2017, 10:46:33 pm
Can you guys post screenshots of the noise floor of your instruments? I am wondering noise floor curve on my instrument is wrong or not. See the attached images. This is with nothing connected at all.

The screenshots show the measurements and diffs between:

Something tells me that a gain of 10.4dB over that range is probably not a good thing.
Title: Re: Agilent E7495 linux root account
Post by: TheSteve on March 08, 2017, 11:54:31 pm
Looks pretty normal to me.

Edit:

I've attached a full span screen shot of my N1996A - however it is only valid to 3 GHz. The drop you see is when it passes 2.7 GHz. The noise floor from 3 GHz to 6 GHz should actually rise as the frequency increases. It doesn't as that portion of it is uncalibrated(I enabled the 3-6 GHz portion myself).
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 15, 2017, 12:40:22 pm

Also, I played around with the files in /flash/egServer/Dragonfly/Recievers, like E7495A and CPXSRC. You can indeed change things here and sometimes see the effects (e.g. you can change E7495A to have Freq Range be 3000e6, and it makes it possible to enter that value). However, some of these changes will have no effect for other reasons (here, I assume it's because there is actually a filter which sharply cuts off at ~ 2.7GHz).

Limitations are spread in configs, gui, elgato, dsp code and hardware. I mean along with configs there are many hardcoded values.

If the 7495 is anything like the N1996 (and we have a lot of reasons to believe so) you will not be able to go above 2.7GHz.
The N1996 has 2 receive paths, one for 0.1MHz - 2.7GHz and the other for 2.7GHz to 3/6GHZ. Since the N1996, depending on the model, has an upper limit of 3 or 6GHz both receive paths are there, and that is why you can change the 3GHz model to 6GHz by changing the upper limit value. Since the 7495 goes to 2.7GHz only I assume that the upper part is missing in the 7495. See below the N1996 receive path:

(https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/?action=dlattach;attach=297243;image)

Do you have more information from this source? I'd like to see any schematics or block diagrams I can find.
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on March 15, 2017, 01:10:21 pm
Do you have more information from this source? I'd like to see any schematics or block diagrams I can find.


N1996 Service manual guide: https://www.dropbox.com/s/5axcrduzvvd3rvb/N1996-90006.pdf?dl=0 (https://www.dropbox.com/s/5axcrduzvvd3rvb/N1996-90006.pdf?dl=0)
Title: Re: Agilent E7495 linux root account
Post by: ferdinandkeil on March 16, 2017, 09:30:01 pm
Can you guys post screenshots of the noise floor of your instruments? I am wondering noise floor curve on my instrument is wrong or not. See the attached images. This is with nothing connected at all.

The screenshots show the measurements and diffs between:
  • 500 kHz and 375 MHz (+2.8dB)
  • 375 MHz and 2.7 GHz (+10.4dB)

Something tells me that a gain of 10.4dB over that range is probably not a good thing.

Did the same test with my E7495B and got similar results. Looks to be normal.
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 17, 2017, 06:47:50 am
I'm still trying to hunt down the clock problem, as unlike an above poster I do think this is the reason the GPS won't go from yellow to green (though I don't yet have any firm information on this, other than configuration information: In the web UI, the STIM # 106 says the internal clock gets its time from Time).

In any case, I can confirm that basically something is resetting the clock exactly every 60 second. This is not the hardware rtc (which for me, defaults to Jan 1 1970 epoch). You can actually look at some of this with /proc/interrupts:

Code: [Select]
  0:     323496   ADS_ext_IRQ
 26:     502791   timer
 27:          0   rtc timer
 30:         18   rtc 1Hz
 31:          0   rtc Alrm

I can confirm that "rtc 1Hz" is the number of times I have accessed the RTC with hwclock. You can easily confirm this.


I was interested to note that (I need to state this carefully): the time the clock resets back to every 60 seconds, is the timestampped value of /etc/adjclock. It didn't seem like changing the timestamp on this had any effect, so I just moved it to the side. I thought this was the end of this route. However, 30 minutes later (again, exactly) the file was recreated with the timestamp 30 minutes later, but now with zeroed contents (0.000000 0 0.0000000 / 0 / LOCAL).

Note that all of this was carried out with all of the time-related processes and local GUI processes killed. So either this is a driver, something kernel level, or elgato (the server itself) doing this.


edit 1:

More notes. It looks like /dev/receiver is a pointer to a UART where the GPS dumps raw information. Maybe.

In any case, looking at /dev/ram0 shows:

Code: [Select]
ttyS0 at I/O 0xf0100000 (irq = 50) is a 16550A
ttyS1 at I/O 0xf0120000 (irq = 51) is a 16550A
ttyS2 at I/O 0xf0140000 (irq = 52) is a 16550A
ttyS3 at I/O 0xf0160000 (irq = 54) is a 16550A

So these are all UART-things.
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 17, 2017, 07:01:37 am
Funny enough, they were nice enough to fill out their /etc/services with their own services:

Code: [Select]
diag            31415/tcp                       # ARMS diagnostics
elgato_cmd 5028/tcp # ElGato Command Generator
elgato_reporter 5029/tcp # ElGato Reporter
scpi            5025/tcp                        # SCPI
scpi            5025/udp                        # SCPI (to be safe ?!?)

I'm not sure if all of these are known, I will have to make yet another pass through this thread. :/
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on March 17, 2017, 01:46:51 pm
Code: [Select]
scpi            5025/tcp                        # SCPI
scpi            5025/udp                        # SCPI (to be safe ?!?)

scpi code is missing from elgato. There's SCPI STIM in N1996A's toro, which we don't have in elgato.
Title: Re: Agilent E7495 linux root account
Post by: ve7xen on March 18, 2017, 04:05:15 am
I did some digging into the time setting issue, since I was pretty sure my unit successfully synched to GPS time back when I got it, but I see the same 'yellow triangle' behaviour now.

Long story short, I did some poking around with the logging. Nothing useful comes out of the client (though maybe some insight into the protocol, it's quite verbose when set to level 255), but the server application logs directly to /dev/ttyS0 at 38400 8N1 (which is also the bootloader and a Linux tty). This happens to be 'Serial 2' on the top panel of the instrument. Looking at the log output, it seems that some variant of the Y2K / Y2038 bug could be in play here, this repeats every 30 seconds:

Code: [Select]
System time less than minimum allowed. Setting clock to Thu Jan  1 00:00:00 2004

What I presume is happening is that the GPS is setting the clock, then the server process doesn't like it and resets it. Some strange things start happening if I set the system clock manually (date -s "YYYY.MM.DD-HH:MM:SS"). For example, if I set the system clock to Fri Dec  1 00:00:00 UTC 2017, I now get this error, setting the time back exactly 12 hours? Where did the new set time come from (it's not in the script mentioned below).

Code: [Select]
System time less than minimum allowed. Setting clock to Thu Nov 30 12:00:00 2017

So this is quite odd, since Linux itself has no trouble with the current date, but the egServer process seems to be rolling it over zero to 'less than the minimum'. I guess egServer must be internally representing the time in a nonstandard way. Maybe just patching the comparison would make it work again?

In case you're curious, the keepTimeUpdated mentioned is a simple script that writes the current date every 20 minutes to another script that is part of the startup of the instrument. I guess to get it 'closeish' to the previous time when it boots.
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 18, 2017, 06:15:48 am
I did some digging into the time setting issue, since I was pretty sure my unit successfully synched to GPS time back when I got it, but I see the same 'yellow triangle' behaviour now.

Long story short, I did some poking around with the logging. Nothing useful comes out of the client (though maybe some insight into the protocol, it's quite verbose when set to level 255), but the server application logs directly to /dev/ttyS0 at 38400 8N1 (which is also the bootloader and a Linux tty). This happens to be 'Serial 2' on the top panel of the instrument. Looking at the log output, it seems that some variant of the Y2K / Y2038 bug could be in play here, this repeats every 30 seconds:

Code: [Select]
System time less than minimum allowed. Setting clock to Thu Jan  1 00:00:00 2004

What I presume is happening is that the GPS is setting the clock, then the server process doesn't like it and resets it. Some strange things start happening if I set the system clock manually (date -s "YYYY.MM.DD-HH:MM:SS"). For example, if I set the system clock to Fri Dec  1 00:00:00 UTC 2017, I now get this error, setting the time back exactly 12 hours? Where did the new set time come from (it's not in the script mentioned below).

Code: [Select]
System time less than minimum allowed. Setting clock to Thu Nov 30 12:00:00 2017

So this is quite odd, since Linux itself has no trouble with the current date, but the egServer process seems to be rolling it over zero to 'less than the minimum'. I guess egServer must be internally representing the time in a nonstandard way. Maybe just patching the comparison would make it work again?

In case you're curious, the keepTimeUpdated mentioned is a simple script that writes the current date every 20 minutes to another script that is part of the startup of the instrument. I guess to get it 'closeish' to the previous time when it boots.

I wonder if this is as simple as Agilent assuming the epoch is Jan 1 2004. I think 'hwclock' is happy to set an epoch that is different from the typical 1970 one. This is, of course, the RTC. I don't know if they are reading this directly or not, but I think they could be (e.g. I think elgato could be bypassing the interrupts and going directly to the RTC).

I also wonder if this issue happened in the previous firmware. Does anyone still have it? I didn't keep it, unfortunately.
Title: Re: Agilent E7495 linux root account
Post by: TheSteve on March 18, 2017, 06:40:13 am
I am thinking that the GPS used to lock fine on the E7495A as that surely would have been a fixed bug if it was always present. I also didn't find any service note related to it.
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 18, 2017, 07:11:48 am
I learned a little bit more. First:

* We can be 100% sure the time resetting is caused by elgato itself.
* If you kill elgato and run your own copy, you get a shell. This isn't the most friendly shell, but we might be able to find useful commands by searching through the elgato binary.

First of all, we can directly see this system time problem:

System time less than minimum allowed. Setting clock to Thu Jan  1 00:00:00 2004

Second, we can do the one thing they suggest doing, which is:

debugIPub=1; (or 2, or maybe 3?)

Code: [Select]
Samplers/timeLicense.p1 publishing {argArray with 10 elements} as 'timeLicense'
gui1.s23 receiving data as timeLicense

System time less than minimum allowed. Setting clock to Thu Jan  1 00:00:00 2004

Samplers/timeFreqRef.p1 publishing {argArray with 10 elements} as 'timeFreqRef'
gui1.s9 receiving data as timeFreqRef


With the same setting to 2, we get:

Code: [Select]
Samplers/timeFreqRef.p1 publishing {argArray with 10 elements} as 'timeFreqRef'
<ArgArray length="10">
<UInt32>1</UInt32>
<UInt32>1072915200</UInt32>
<Int32>3397774</Int32>
<Int32>-8440589</Int32>
<Int32>32993</Int32>
<Int32>4</Int32>
<UInt32>2</UInt32>
<UInt32>1</UInt32>
<UInt32>0</UInt32>
<UInt32>3</UInt32>
</ArgArray>

We've seen this before, this is the data gotten directly from the GPS unit STIM.

And we also get:
Code: [Select]
Samplers/timeLicense.p1 publishing {argArray with 10 elements} as 'timeLicense'
<ArgArray length="10">
<Int32>-1</Int32>
<Int32>-1</Int32>
<Int32>-1</Int32>
<Int32>-1</Int32>
<Int32>-1</Int32>
<Int32>-1</Int32>
<Int32>-1</Int32>
<Int32>-1</Int32>
<Int32>-1</Int32>
<Int32>-1</Int32>
</ArgArray>

I don't think turning off the hack has any effect on this problem, but maybe someone should double check that.

In any case, there are a *bunch* more symbols to turn on and off. Certainly anything that starts with debug. I'll keep looking...










Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on March 24, 2017, 07:14:44 pm
Today I have some progress in decoding serial protocol used to communicate with power meter.
Below is the shell command to enable 50 MHz power reference. GUI shouldn't be in power meter mode while you run it.
Code: [Select]
(stty 38400; sleep 2; printf "\x83\xf8\x04\x08\x01\x00\x01") < /dev/ttyS4 > /dev/ttyS4Turn it off with
Code: [Select]
(stty 38400; sleep 2; printf "\x83\xf8\x04\x08\x01\x00\x00") < /dev/ttyS4 > /dev/ttyS4However, it turns off when you open the port. Opening the serial port seems to reset some power meter state.
Title: Re: Agilent E7495 linux root account
Post by: Puffin on March 25, 2017, 05:47:35 pm
Has anyone else had issues with the remote GUI not responding to clicks on the right-side buttons?   I had it working once, but struggling to make those buttons work again which severely limits what you can do with the GUI.

On the subject of the date reset, it's every 30 seconds, not every 60.  Done by the elgato process itself (killing that stops the time getting reset anyway).    A crude hack to run hwclock --hctosys every few seconds is a kind of work-around.

I'm also noticing the GPS seems somewhat unreliable - and even when it does get 6 sats locked, I've never seen the GPS indicator with anything other than the yellow triangle.

I'll likely prod at this some more, but I'm somewhat nervous to try hacking things further due to fear of bricking this otherwise nicely functional kit.
Title: Re: Agilent E7495 linux root account
Post by: lectrohamlincoln on April 19, 2017, 07:46:46 am
Hello Everybody,

I picked up an E7495A described as "LOCKS UP ON POWER UP." I suspected that the firmware was corrupted and it would be easy enough to flash the latest A.06.25 version. I've tried using both a Sandisk 512MB and a 8Gb Compact Flash formatted to FAT32. With no luck :(

So, I followed the "Update via Load Firmware Utility" procedure described in the Service Guide. I removed the RF section and set the DIP Switch as instructed. I tried again with both Sandisk CFs, but my E7495A would only turn on with a blank display. Is it possible this factory reset requires a PCMCIA instead of CF?

I'm beginning to suspect there might be a hardware problem. I also noticed that there was a red LED lit on the controller board. I'm hoping for any suggestions before I start doing a component level debug tomorrow.
Title: Re: Agilent E7495 linux root account
Post by: DogP on April 19, 2017, 08:21:05 am
I picked up an E7495A described as "LOCKS UP ON POWER UP." I suspected that the firmware was corrupted and it would be easy enough to flash the latest A.06.25 version. I've tried using both a Sandisk 512MB and a 8Gb Compact Flash formatted to FAT32. With no luck :(
Did you try doing a fresh firmware install?  When you put the CF card in with the 6.25 update, and are promted to install... press the bottom right button, across from NO.  I believe that does a rebuild of the drive.  That error does look more like a Linux/disk kinda error than a general hardware error (other than bad flash maybe).

Other than that, if you can connect into it over a serial port, maybe you can check the logs for more specifics on the crash?

DogP
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on April 21, 2017, 04:12:24 pm
Hello Everybody,

I picked up an E7495A described as "LOCKS UP ON POWER UP." I suspected that the firmware was corrupted and it would be easy enough to flash the latest A.06.25 version. I've tried using both a Sandisk 512MB and a 8Gb Compact Flash formatted to FAT32. With no luck :(

So, I followed the "Update via Load Firmware Utility" procedure described in the Service Guide. I removed the RF section and set the DIP Switch as instructed. I tried again with both Sandisk CFs, but my E7495A would only turn on with a blank display. Is it possible this factory reset requires a PCMCIA instead of CF?
That's the right thing to do. I don't know if it's supposed to work from CF. If it doesn't boot kernel anymore, "utility" was able to erase it at least...
I'm beginning to suspect there might be a hardware problem. I also noticed that there was a red LED lit on the controller board. I'm hoping for any suggestions before I start doing a component level debug tomorrow.
I think that "load firmware utility" should write something to the screen or serial port. Maybe you should try it again and check the output?
Title: Re: Agilent E7495 linux root account
Post by: lectrohamlincoln on April 22, 2017, 12:52:10 am
I was able to get serial port 2 working. It says all DRAM tests have passed at least. If anyone's curious the baud rate is 38400 and it expects a return CR on transmitted text.

I also tried the A.06.25 firmware on a CF to PCMCIA adapter to no avail. I know its loaded too because without the PCMCIA inserted it says "There is no PCMCIA card on Socket 0"

With DIP switch set to 1&2 I get the same error message on the bottom of the screen: "Kernel Panic: No init found. Try passing init= option to kernel"

With DIP switch set to 2&3, 1&3 or 1&2&3, I get the following menu options from the serial terminal:

--
[1] Display Register
[2] Set Register
[3] Dump Memory
[4] Set Memory
[5] Erase Blocks of Flash
[E] Set Ethernet MAC Address

Select Menu & Hit Enter Key:
--

The "Dump Memory" returns real looking values. I'm unsure how to use the "Set Memory" and I feel a little uneasy using the "Erase Blocks of Flash."

I wish we had a board level Maintenance Manual. I just have a feeling that Red LED means somethings gone bad. I was able to find this brief BOOT ROM manual that seems to correspond to the E7495 http://support.eurotech-inc.com/developers/linux/files/boot/bootrom.pdf (http://support.eurotech-inc.com/developers/linux/files/boot/bootrom.pdf)

I'll do some more investigating this weekend.
Title: Re: Agilent E7495 linux root account
Post by: DogP on April 22, 2017, 02:58:42 am
Did you try the full fresh reinstall (not just the standard firmware upgrade)?  IMO, it sounds like a file system problem... you can read a bit about the "No init found" message here: http://lxr.free-electrons.com/source/Documentation/init.txt?v=3.13 (http://lxr.free-electrons.com/source/Documentation/init.txt?v=3.13) .

DogP
Title: Re: Agilent E7495 linux root account
Post by: lectrohamlincoln on April 22, 2017, 03:38:26 am
I believe I am doing a full reinstall. The boot process never gets to stage where I am prompted with a Yes or No about firmware upgrades and the buttons are all unresponsive.

The only sign of life I have gotten out the E7495 is through the Serial Terminal after following what the Service Guide calls a "Update via Load Firmware Utility." Which is "used to reload firmware on an E7495A/B just as it is loaded at the factory," according to the Guide.

Is there another way to initiate a full fresh reinstall? I scoured the manual and can't find any reference. I fear my only option might be to Block Erase the Flash and hope for the best. But, I think I'm first going to write a program to try and download the flash before I do anything irreversible.
Title: Re: Agilent E7495 linux root account
Post by: DogP on April 22, 2017, 04:52:12 am
Ah... if it never actually gets to the yes/no, then it's probably not actually doing any sort of reinstall.

I think you want to do switch 1 and 4 off, switch 2 and 3 on, as described in the manual.  I believe that will reconfigure the board to boot Linux from the PCMCIA card, rather than internal flash.  With the firmware upgade CF card in a PCMCIA adapter in the PCMCIA slot, it should boot.  You mentioned that you get a debug menu over the serial port... does nothing show up on the screen when you do that?  And the debug menu is all you can do... there's no way to log into a terminal over the serial port?

One thing you might want to try is the OLD firmware version (1.60) that's still available on the Keysight website: http://www.keysight.com/main/software.jspx?ckey=sw411&lc=eng&cc=US&nid=-11143.0.00&id=sw411 (http://www.keysight.com/main/software.jspx?ckey=sw411&lc=eng&cc=US&nid=-11143.0.00&id=sw411) .  In the root of that zip is a script called reloadFFS, which does a reinstall.  In version 6.25, that file exists, but is empty.  This might be the key difference between the instructions and what you're seeing.  There's also readme describes how to use it.

Quote
This contains directions on how to recover a /flash file system that
has been corrupted.

WARNING: DO NOT DO THIS UNLESS ABSOLUTELY NECESSARY!  IF YOU'RE NOT
SURE, DON'T DO IT.

To use reloadFFS:

- Boot the elgato
- Log in as root through the serial port
  - This assumes that you can log in.  If you can't then this won't work.
  - If you must log in through telnet follow "Log in through telnet"
    instructions below.
- Install PCMCIA card
- "mount /xdrive"
- "sh /xdrive/reloadFFS"
- Follow instructions given by script



Log in through telnet:

- Log in as root
- mv /etc/passwd.old /etc/passwd
- mv /flash/linux /flash/linux-
- reboot -f
- After reboot is complete (30 seconds or more) log back in as root
- Continue instructions above

Pat
Title: Re: Agilent E7495 linux root account
Post by: TheSteve on April 22, 2017, 05:15:42 am
I don't have an E7495A but I do have the close cousin the N1996A. Firmware updates on it are generally done via USB. If you have a failure during flashing there is an internal PCMCIA slot that can be used to recover the unit. The instructions do say a CF card is supported via an adapter. You do need a different image compared to the USB image though which has the update and a boot image with a kernel etc.
Is there a special PCMCIA image for the E7495? And if so does it also have cmdline.txt, ramdisk.gz, register.txt, version and zImage?

If you don't have those files check out the USB and PCMCIA updates from the N1996A - maybe you can borrow the needed boot files.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on April 22, 2017, 09:31:55 pm
With DIP switch set to 1&2 I get the same error message on the bottom of the screen: "Kernel Panic: No init found. Try passing init= option to kernel"
It means that flash filesystem is corrupt (because of software error, or flash is failing). I can't imagine how other hardware problem can prevent linux from finding init executable.
I wish we had a board level Maintenance Manual. I just have a feeling that Red LED means somethings gone bad. I was able to find this brief BOOT ROM manual that seems to correspond to the E7495 http://support.eurotech-inc.com/developers/linux/files/boot/bootrom.pdf (http://support.eurotech-inc.com/developers/linux/files/boot/bootrom.pdf)
"Then 2 & 3 ON Copy any/all of zImage, ramdisk.gz and flashfs1 file to Flash ROM and
copy zImage & ramdisk.gz from Flash ROM to RAM and Boot from RAM"
It's clear that it expects zImage and ramdisk.gz on the card. Note that bootloaders a quite picky about filesystem format. Some require fat16 for example. Hopefully it would say something if it can't read the files.
Title: Re: Agilent E7495 linux root account
Post by: lectrohamlincoln on April 26, 2017, 06:36:37 am
The filesystem is definitely corrupted. Most likely the ram disk is corrupted in a way that the kernel can't load it. The start-up log has the following, "RAMDISK: Couldn't find valid RAM disk image starting at 0"  (I can copy the entire boot log if anyone is curious)

The 1.60 firmware did not work. It definitely detects the PCMCIA when DIP 2&3 are set, but does not boot from it. It just gets to Serial Terminal with a the menu options I described in the previous post.

I'm a little confused by the 1.60 directions. What does it mean by "To use reloadFFS: - Boot the elgato" Is "elgato" just referring to the E7495?

Does anyone know how to recover from a corrupted filesystem? The only ideas I have right now are to use the Serial Terminal menu to load in data at 38400 baud, or to find a JTAG header for the SA1100 chip. In either case I'm not sure what I would load, or even what address I would load it to  :-\
Title: Re: Agilent E7495 linux root account
Post by: DogP on April 26, 2017, 10:03:09 am
Yeah, I don't think loading memory locations is gonna help, since it's very unlikely that the flash is simply fully memory mapped to the CPU.

Have you tried plugging it into the network to see if you can telnet into it when you boot from the PCMCIA slot?  Obviously you'll need to check your router to see if DHCP gave out an IP address.

And if it is booting from PCMCIA, then another possibility is modifying the ramdisk file on the card.  You should be able to un-gzip the ramdisk.gz and mount the ramdisk (on Linux of course).  Then make changes (i.e. automatically run upgrade scripts, give you a terminal over the serial port instead of the debug menu, etc.), re-gzip the file and put it back on the card.

When you run from the PCMCIA slot, does you see any of the boot process on the screen, or does it stay blank?

And yeah, elgato is their name for the E7495.

Pat
Title: Re: Agilent E7495 linux root account
Post by: lectrohamlincoln on April 26, 2017, 11:01:14 pm
I tried plugging it into the network again no luck. AFAIK it never boots from the PCMCIA.

If DIP switch 2&3 are set, it looks like it just boots from the 1Mib flash ROM (the AT29LV1024 chip). The screen is blank and I only get a Serial Menu with a few crappy option and no way of booting from the PCMCIA or getting an actual command line. Although, it does detect when a PCMCIA card is not inserted (it prints an extra line over Serial saying the PCMCIA card is missing).

If DIP 1&2 are set, it gets part way through the Kernel boot then hangs. No command line, no option for firmware upgrade, no difference if the PCMCIA card is inserted.

Is there some special formatting of the PCMCIA necessary for recovery?
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on April 27, 2017, 08:49:33 am
The filesystem is definitely corrupted. Most likely the ram disk is corrupted in a way that the kernel can't load it. The start-up log has the following, "RAMDISK: Couldn't find valid RAM disk image starting at 0"  (I can copy the entire boot log if anyone is curious)
Does it mean something's changed from your first attempt? There's "no init" error on the screen shot you posted earlier.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on April 27, 2017, 09:14:07 am
Is there some special formatting of the PCMCIA necessary for recovery?
I'd try different cards formatted as FAT16.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on April 27, 2017, 09:30:43 am
So this is quite odd, since Linux itself has no trouble with the current date, but the egServer process seems to be rolling it over zero to 'less than the minimum'. I guess egServer must be internally representing the time in a nonstandard way. Maybe just patching the comparison would make it work again?

No. What we see here is "GPS week rollover" problem.
http://www.npl.co.uk/reference/faqs/when-and-what-is-the-gps-week-rollover-problem-(faq-time) (http://www.npl.co.uk/reference/faqs/when-and-what-is-the-gps-week-rollover-problem-(faq-time))
The message doesn't show the time which is "less than minimum". I verified that it's current time minus 1024 weeks.
So GPS subsystem adjusts system clock and then it's immediately reset to "minimum time".
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on April 27, 2017, 06:24:11 pm
Apply following patch to elgato binary to fix GPS time synchronisation:
0x0122880: replace 4b2585e2152882e2 with de2585e23f2882e2
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on April 28, 2017, 03:24:00 am
Apply following patch to elgato binary to fix GPS time synchronisation:
0x0122880: replace 4b2585e2152882e2 with de2585e23f2882e2

This is why, as a citizen of the United States, I can't stay mad at Russians. The dopest hackers on the planet.

See below, finally we can calibrate out the expected timebase drift! Thanks kirill_ka. We all owe you one.
Title: Re: Agilent E7495 linux root account
Post by: DogP on April 28, 2017, 08:57:58 am
Apply following patch to elgato binary to fix GPS time synchronisation:
0x0122880: replace 4b2585e2152882e2 with de2585e23f2882e2
Awesome... I'll give this a try shortly!  And we get to look forward to this problem again in 2 years (got a patch ready for the 2019 rollover?). ;)

Thanks,
Pat
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on April 28, 2017, 09:35:05 am
Awesome... I'll give this a try shortly!  And we get to look forward to this problem again in 2 years (got a patch ready for the 2019 rollover?). ;)
I think the receiver was designed to operate before 1999. So it's thrown backwards not the same time GPS week count wraps. I.e. it should work for another 20 years.
In 2038 old *NIX stuff will die anyway :)
Title: Re: Agilent E7495 linux root account
Post by: DogP on April 28, 2017, 10:24:43 am
Just tested it, and it worked great!  For anyone keeping track, I let the unit warm up for 15 minutes (with the GPS antenna connected), like the instructions say.  From the calibration, my DAC setting went from 2162 (factory) to 2121... so a similar change to what technogeeky had.  I left it on the adjustment screen and clicked the repeat button a few times over the last 20 minutes, and it has continued to climb (it's up to 2190 now).  I'm gonna leave it on overnight and check it in the morning.

Thanks again!

Pat
Title: Re: Agilent E7495 linux root account
Post by: DogP on April 28, 2017, 03:31:35 pm
And, a final update... after letting it run overnight, it seems to have landed at a DAC setting of 2223 (it bounces around +/- a few values, but hasn't drifted over the last 45 minutes).

Pat
Title: Re: Agilent E7495 linux root account
Post by: alpha89 on May 05, 2017, 04:46:45 pm
Apply following patch to elgato binary to fix GPS time synchronisation:
0x0122880: replace 4b2585e2152882e2 with de2585e23f2882e2

Where is the elgato binary file located?  Thanks for figuring this out as my box is needing a frequency
calibration.
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on May 07, 2017, 08:52:43 am
I spent some time the other day looking for any spurs, and I only found one. I've attached two screenshots; the first is at RBW of 50 Hz with 10 averages and the second is at RBW of 10 Hz.

Can anyone else confirm this spur? Does anyone know of other spurs?



Title: Re: Agilent E7495 linux root account
Post by: usagi on May 08, 2017, 05:10:52 am
I spent some time the other day looking for any spurs, and I only found one. I've attached two screenshots; the first is at RBW of 50 Hz with 10 averages and the second is at RBW of 10 Hz.

Can anyone else confirm this spur? Does anyone know of other spurs?

spur at 396.8 is probably the LO.
Title: Re: Agilent E7495 linux root account
Post by: hawaii596 on May 08, 2017, 06:47:31 pm
New to forum. I have a couple of Agilent E7495B units with lots of accessory, the backpack, and transit case that I am preparing to issue out. They have a problem that they are not able to sinchronize wih GPS clock. According to one of the technicians who looked at them, it is because the onboard dates are too old (more than 12 years), and they can't synch to GPS if there is more than 12 years between today (May 8, 2017) and the onboard date.

I am not a programmer or engineer; just a metrologist in an instrument lab.  Due in part to things I read at this site, I figured out how to connect to the E7495B with Telnet. I was able to log in as "root," and using LINUX commands, check and reset both the normal date and hardware clock. But once I rebooted the system, both reset to some sort of base date. The Hardware clock, back to 1970, and the system date back to 2008. I am guessing the 1970 is a base date for the hardware, and 2008 is the initial release date of the installed firmware.

This leads me to think perhaps there may be a bad CPU battery.  However, I have been unable to physically find one in the instrument. And at least one user on a Keysight (Agilent) thread said there is no CPU battery. 

If anyone has experience or understanding about this, I would sincerely appreciate any of your thoughts. Is there a CPU battery?  If not, is there a reason why the dates are reverting?

Also, could it be that once I manually update both of these dates in LINUX, do I need to do a GPS synch to get them to take more permanently (could this be the need)?  Thanks one and all for any inputs.
Title: Re: Agilent E7495 linux root account
Post by: usagi on May 08, 2017, 06:58:19 pm
If not, is there a reason why the dates are reverting?

read this entire thread, especially this post (https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg1195508/#msg1195508).
Title: Re: Agilent E7495 linux root account
Post by: hawaii596 on May 09, 2017, 08:07:40 pm
I've now pretty much read through the entire thread. I did read the particular post about applying the patch per the quote below:

Apply following patch to elgato binary to fix GPS time synchronisation:
0x0122880: replace 4b2585e2152882e2 with de2585e23f2882e2

As a non-programmer, that is fully above my head.  If there is a set of Linux commands that do this, I would greatly appreciate some instruction on how to do this.  Otherwise, whatever other instructions for specifically how to do this. I realize this thread is mostly for techno types who experiment with these things.  I am a techno type in metrology. I have deep understanding of how accuracies work. And I am a fast learner. But unfortunately, even with my decades in metrology, communications/navigation systems/RADAR systems/instrument calibration, this is a weak zone for me.

If anyone could explain is some detail how to apply this patch, I would be forever grateful.
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on May 10, 2017, 01:28:07 am
I've now pretty much read through the entire thread. I did read the particular post about applying the patch per the quote below:

Apply following patch to elgato binary to fix GPS time synchronisation:
0x0122880: replace 4b2585e2152882e2 with de2585e23f2882e2

As a non-programmer, that is fully above my head.  If there is a set of Linux commands that do this, I would greatly appreciate some instruction on how to do this.  Otherwise, whatever other instructions for specifically how to do this. I realize this thread is mostly for techno types who experiment with these things.  I am a techno type in metrology. I have deep understanding of how accuracies work. And I am a fast learner. But unfortunately, even with my decades in metrology, communications/navigation systems/RADAR systems/instrument calibration, this is a weak zone for me.

If anyone could explain is some detail how to apply this patch, I would be forever grateful.

The original poster is basically telling us to do a binary patch on the file ("elgato" binary). The first thing you would do when doing any patch of any file (binary or not) is to make sure you have a good copy of the original, of course.

All of the important files on the device are in /flash. In prose, they are in a subfolder in the root of the filesystem. This is certainly unusual in most Linux systems. In this case, there are also a bunch of other folders in /: bin, dev, etc, lib, mnt, home, nfs, root, tmp, var, sbin, usr, xdrive. These are the usual thing you are used to in Linux systems. I think these files are generated out of files located in the /flash directory, though; but that's not important. When listing files, make sure to do ls -l so you see where the files point to (many important files point to e.g. /flash/linux/etc/...).

As for the "elgato" binary, that's in /flash/egServer/elgato. This file is the actual instrumentation server. This is what the GUI  communicates with to control the hardware. (The GUI is located in /flash/egGui, by the way).

Now that we have the location and context of the file, all we need to do is interpret the original instruction:

Apply following patch to elgato binary to fix GPS time synchronisation:
0x0122880[location]: replace 4b2585e2152882e2[old value] with de2585e23f2882e2[new value].


This line is telling us to use a hex editor (vi/vim has a hex edit mode, emacs has one, there are probably command line tools to hex edit too). It's telling us to starting changing the actual file (though we are representing this in hex for convenience) on disk at [location] bytes from the start of the file. It further specifies that we should see, at this location, the value [old value]. And we should change [old value][A] to [new value], then save the file.

Some/most editors are usually used to operate on text files, so you may need to tell the editor to load the file in binary (e.g. vi -b). Then once you open the file, you use some command to convert the binary to hex (http://www.kevssite.com/2009/04/21/using-vi-as-a-hex-editor/). Then you find the [old value], replace it with the [new value], convert the file back to binary from hex, and then save the file.

Since you have a backup, you can afford to make a mistake in this process. You'll probably get it right on the first try though. Note there are two hex changes (at two different locations) listed in this thread: one which changes the program which handles licensing to automatically allow all license options that are listed (regardless of them having a correct key). The other corrects the clock issue. Presumably there will be more of these in the future.

We go through all of this trouble for basically two reasons, in order:


I hope this is cleared up. Hopefully, you or someone else can find all of the binary file changes to allow the signal generator to go down to whatever the true lower limit of the hardware is, one day.


[A]: Notice that it was not necessary here to actually give the old value for this process to work (since you were told the location to start the edit). It's given as a checksum: if the value you see in your file is not [old value], then you are either at the wrong location in the file, are editing the wrong version of the file, or both.

Title: Re: Agilent E7495 linux root account
Post by: DogP on May 10, 2017, 09:49:31 am
I've now pretty much read through the entire thread. I did read the particular post about applying the patch per the quote below:

Apply following patch to elgato binary to fix GPS time synchronisation:
0x0122880: replace 4b2585e2152882e2 with de2585e23f2882e2

As a non-programmer, that is fully above my head.  If there is a set of Linux commands that do this, I would greatly appreciate some instruction on how to do this.  Otherwise, whatever other instructions for specifically how to do this. I realize this thread is mostly for techno types who experiment with these things.  I am a techno type in metrology. I have deep understanding of how accuracies work. And I am a fast learner. But unfortunately, even with my decades in metrology, communications/navigation systems/RADAR systems/instrument calibration, this is a weak zone for me.

If anyone could explain is some detail how to apply this patch, I would be forever grateful.
IMO, copying the file to a CF card, modifying in a GUI hex editor on your desktop PC, then copying it back to the box is the most intuitive way to do it... if you're familiar with hex editing.

An alternative, if you simply telnet into the box, you can run the following commands to patch the binary in place.  Once you're done, you should reboot the box to make sure it's running the modified binary.

The first line copies the binary file to be modified.  The 2nd line does the actual patch.  The 3rd line backs up the original file in case you screw something up and/or need to revert to the original.  The 4th line moves the modified binary in place of the original.  Note that Linux is case sensitive, so copy it exactly as shown (i.e. capital S on egServer).
Code: [Select]
cp /flash/egServer/elgato /flash/egServer/elgato.mod
printf '\xde\x25\x85\xe2\x3f\x28\x82\xe2' | dd of=/flash/egServer/elgato.mod bs=1 seek=1190016 count=8 conv=notrunc
mv /flash/egServer/elgato /flash/egServer/elgato.orig
mv /flash/egServer/elgato.mod /flash/egServer/elgato

Similarly, if you want to do the license patch posted earlier, you'd run this additional line (before the mv commands):
Code: [Select]
printf '\x00\x00\xa0\xe1' | dd of=/flash/egServer/elgato.mod bs=1 seek=3373692 count=4 conv=notrunc
Pat
Title: Re: Agilent E7495 linux root account
Post by: kr5j on May 10, 2017, 08:18:30 pm
Thanks for the info! been waiting for a better description of the patch.
Title: Re: Agilent E7495 linux root account
Post by: ke6iyc on May 10, 2017, 10:36:30 pm
Hello all!

Ordered one of the cheap units on fleabay (but it does power up and function) for a good price today.

Glad I found this thread AFTER I ordered (otherwise I would have been tempted to pay too much).

Thank you to all for the hard work and time you have put into this.

Will have to  disassemble to fix the screen gasket when it arrives mid next week.

Brian
KE6IYC
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on May 10, 2017, 11:25:11 pm
Hello all!

Ordered one of the cheap units on fleabay (but it does power up and function) for a good price today.

Glad I found this thread AFTER I ordered (otherwise I would have been tempted to pay too much).

Thank you to all for the hard work and time you have put into this.

Will have to  disassemble to fix the screen gasket when it arrives mid next week.

Brian
KE6IYC

This reminds me...

Q: What kind of plastic is the screen protector, and how can I clean the adhesive gunk off of it?

Unless you are a better chemist than I am (entirely possible...) , you're going to find that the only solution (no pun intended) which actually releases the gasket adhesive is acetone. This same acetone will destroy the top layer of the plastic (and/or the UV coating, or something). It doesn't look great. It looks pretty awful, actually. Since I used acetone, and hence destroyed the plastic (or its coating), I decided to try and identify the exact plastic so I could find a replacement. I did some destructive testing (http://www.loyresearchgroup.com/uploads/1/0/2/2/10227236/new_id_chart_.pdf) to determine exactly what kind of plastic the screen protector is, and after some burning, melting, and inhaling burned plastic odors... I am pretty sure I came up with an answer. And probably nose cancer. PVF. Polyvinyl Fluoride (https://en.wikipedia.org/wiki/Polyvinyl_fluoride). And while this link (https://www.curbellplastics.com/Research-Solutions/Technical-Resources/Technical-Resources/Plastic-Material-Selection-Guide) (it's a good URL to bookmark. As is the other one. Do it.) wasn't helpful, further browsing and this site (http://www.makeitfrom.com/compare/Polyvinyl-Fluoride-PVF/Chlorinated-Polyvinyl-Chloride-CPVC-PVC-C) convinced me that PVF is an understandable choice for this screen. It could also be any of the self-extinguishing, non-dripping ones (PPO, PVC). In any case, I couldn't find a good supplier of PVF clear sheets, and I could easily find many places to get PVC clear sheets.

In any case, I wasn't able to find any easy to way to buy PVF glass sheets, so I eventually went with plain PVC. I got them custom cut from an Amazon vendor, and I still have three sheets exactly cut to size. I will be happy to send them out if you want, or otherwise I can just share the measurements I took so you can see if you agree; and we can learn where and how to buy PVF plastic clear thick sheets.


Q: What facts do we know about the plastic type of the screen?


No, the stuff I have does not have any anti-glare or anti-reflective coating. Yes, it's slightly worse than the original. Yes, you would about $1 plus shipping. Oh, thanks for the interest. My address is, roughly speaking:

Atlanta, GA, USA, Earth, Sol, Milky Way, Universe A

So if shipping to you would be uncomplicated, let me know. I have 3 more of them. They still have the factory tape on them, so there should not be any defects.

Title: Re: Agilent E7495 linux root account
Post by: ke6iyc on May 11, 2017, 11:44:37 am
That would be most helpful, but I would only need one (share the love).

I am, roughly speaking, Boise, Idaho, USA, Earth, Sol, Milky Way, Universe A

Currently sitting in Florida, however, so that might be a tad cheaper.

If you have PayPal, I would happily reimburse for any costs incurred......

Email would look something like ke6iyc (at) mac (dot) com , but with the generally accepted punctuation and symbology, instead of the parenthetical words.

Thank you in advance!

Brian
KE6IYC
Title: Re: Agilent E7495 linux root account
Post by: ke6iyc on May 12, 2017, 03:36:45 pm
Simple question,

Is the RS-232 cable for Telnet straight through, or null modem?

Thanks!
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on May 12, 2017, 03:56:12 pm
Is the RS-232 cable for Telnet straight through, or null modem?
E7495 ports are normal "DTE" ports. So the cable should have TX to RX connections (null modem).
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on May 12, 2017, 04:13:00 pm
An alternative, if you simply telnet into the box, you can run the following commands to patch the binary in place.  Once you're done, you should probably reboot the box to make sure it's running the modified binary.

The first line backs up the binary file, in case you screw something up, or need to revert back to the original.  The 2nd line does the actual patch.  Note that Linux is case sensitive, so copy it exactly as shown (i.e. capital S on egServer).
Code: [Select]
cp /flash/egServer/elgato /flash/egServer/elgato.bak
printf '\xde\x25\x85\xe2\x3f\x28\x82\xe2' | dd of=/flash/egServer/elgato bs=1 seek=1190016 count=8 conv=notrunc
I would hesitate to use that command unless I'm absolutely sure the binary is the right one.
There are few caveats:
1. Original binary should be the same version. Probably we'd post md5sums of original and patched files.
2. Writing to the executable which is running may fail.
3. There are number of "printf" versions you can find on the same system. Some of them may not support hex escape sequences. E.g. bash built-in printf, /bin/sh built-in printf, /usr/bin/printf.
Title: Re: Agilent E7495 linux root account
Post by: ke6iyc on May 12, 2017, 04:36:04 pm
Thank you on the cable question.

As for the patching in place, has anyone ACTUALLY tried it?

I am out of state right now, and have a unit waiting for me at my hotel.  I would like to patch it (Would like to try out the Interference analyzer) before I return home, but not at the risk of bricking the unit.

Thanks a bunch to all!

Brian
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on May 12, 2017, 06:27:09 pm
Thank you on the cable question.

As for the patching in place, has anyone ACTUALLY tried it?

I am out of state right now, and have a unit waiting for me at my hotel.  I would like to patch it (Would like to try out the Interference analyzer) before I return home, but not at the risk of bricking the unit.

Thanks a bunch to all!

Brian

Once you connect to the unit via telnet, the the first thing you'll want to do is make a copy of all of the files in /flash. The easiest way to do this, in my opinion, is to setup a FTP server on your computer and run an ftp client on the E7495a. The easiest way to modify the elgato binary is simply to do it on your host computer (using a tool that does hex editing -- there are plenty of these for windows, osx, linux). Then, you can use the FTP client to get the file back.

The other obvious way to make a backup is to simply dump things onto the CF card, insert into host computer, copy, and put it back in.

Destroying the elgato binary won't brick the unit, as far as I know. You'll still have telnet access. Plus, you can just 'cp elgato elgato.original'. There is enough space to have a few copies of the binary around.


Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on May 12, 2017, 06:33:33 pm
you can just 'cp elgato elgato.original'. There is enough space to have a few copies of the binary around.

Yup, and a 'killall elgato' to make sure you are not trying to patch a running executable.
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on May 12, 2017, 06:36:48 pm
you can just 'cp elgato elgato.original'. There is enough space to have a few copies of the binary around.

Yup, and a 'killall elgato' to make sure you are not trying to patch a running executable.

For future reference, in Linux there is no risk of modifying a running executable. The entire process tree of the executable (e.g. elgato and anything it runs or calls) will only be able to reference the original file. I am about 99% sure this is the case, at least.
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on May 12, 2017, 06:39:22 pm
For future reference, in Linux there is no risk of modifying a running executable. The entire process tree of the executable (e.g. elgato and anything it runs or calls) will only be able to reference the original file. I am about 99% sure this is the case, at least.

I was thinking about copying back the patched file, that doesn't work when it's running, not sure about patching.
Title: Re: Agilent E7495 linux root account
Post by: DogP on May 12, 2017, 07:28:27 pm
Ah, yes... before posting, I ran the commands to make sure they worked, but not on the file actually running (since mine was already patched).  I just reverted mine to the original and tested it, and dd didn't like modifying the running file, so I updated the instructions to modify the copy of the file and then move the files.

I just tested it, and the new instructions do work.  All you have to do is simply telnet into the box, log in as root, and run the commands exactly as shown.  As pointed out, no matter how you patch the files, you need to make sure you're on the correct version.  I believe all of these patches are for 6.25.

There should be no reason that you'll brick your box though, since you should be able to simply telnet back in, and move the elgato.orig file back in place of the patched elgato binary.

Pat
Title: Re: Agilent E7495 linux root account
Post by: DogP on May 12, 2017, 07:46:27 pm
Q: What kind of plastic is the screen protector, and how can I clean the adhesive gunk off of it?
BTW, did you rule out Polycarbonate?  That would have been my first guess, just from looks and feel, and because it's commonly used for these types of things.  It definitely had an anti-glare coating or something on it... mine was REALLY scratched up (and had a few large gouges), so I used some Novus on it, and it took care of a lot of the scratches, but of course also took off the coating.  It's really nice and shiny now though. ;)

Pat
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on May 12, 2017, 07:55:11 pm
Q: What kind of plastic is the screen protector, and how can I clean the adhesive gunk off of it?
BTW, did you rule out Polycarbonate?  That would have been my first guess, just from looks and feel, and because it's commonly used for these types of things.  It definitely had an anti-glare coating or something on it... mine was REALLY scratched up (and had a few large gouges), so I used some Novus on it, and it took care of a lot of the scratches, but of course also took off the coating.  It's really nice and shiny now though. ;)

Pat

Pat: I can not rule out polycarbonate by the tests that I performed. PVF actually seems unlikely since I can't find it in sheets anywhere. Polycarbonate does seem more likely. It's hard to know, really. I don't remember a "phenol" smell when I burned it.

Nevertheless, since I agree it's far more likely to be polycarbonate, I'll switch the answer in the comment.
Title: Re: Agilent E7495 linux root account
Post by: usagi on May 12, 2017, 08:43:50 pm
yes, far more likely its polycarbonate - the rigidity of the protector screams polycarbonate to me. also the fact acetone damaged it.
Title: Re: Agilent E7495 linux root account
Post by: ke6iyc on May 13, 2017, 12:09:34 am
Good evening all!

OK, got the instrument in.

Two batteries, but I suspect one to be trashed (reading as 227% charged) other one is charging.

Also had a 64 MB PCMCIA Flash card in it (BIG bonus!).

Powered up no issue (once I figured out the operation of said power button).

Has all factory hardware options installed (per internal reporting) and there is only one software option I really want to enable (Interference ID).

Measured a good test cable, and it told me it was good.

Will do an update next (currently it has 5.00 on it....)

THEN on to the patches, and figuring out where to find an SMA GPS antenna locally.....

Thanks to all!

Brian
Title: Re: Agilent E7495 linux root account
Post by: ke6iyc on May 13, 2017, 01:09:41 am
Update to 6.25 went smoothly, as described here.

Telnet will have to wait until tomorrow, as the computer I have with me (that has a hardware serial port) has decided not to acknowledge that telnet is, in fact, installed....

Thanks to all!

Brian
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on May 13, 2017, 02:01:33 am
Update to 6.25 went smoothly, as described here.

Telnet will have to wait until tomorrow, as the computer I have with me (that has a hardware serial port) has decided not to acknowledge that telnet is, in fact, installed....

Thanks to all!

Brian

Use putty like all of us.
Title: Re: Agilent E7495 linux root account
Post by: ke6iyc on May 14, 2017, 02:15:12 pm
Quote from DogP on Dec. 8 2016:

"I spent a bit of time looking at this again, trying to get some remote access/control working.  As noted earlier, the E7495 has a webpage, but doesn't accept the normal login.  I noticed a similar non-working login on port 5025.  Using netstat, I saw that elgato was listening on those ports.  When looking in the /flash/egServer directory, I noticed a passwd file.  It looked different than the standard *nix passwd file, but appeared to have a hashed root password in it (RzSdSbSdye).

Rather than trying to crack the password, I decided to try simply renaming the passwd file and rebooting.  Surprisingly, it didn't recreate it, and now simply accepts any login! (on both the webpage and port 5025)."

In playing around, I did as advised above, and renamed the passwd file, then rebooted.

I had PuTTY running on Serial port 2 during the reboot, and the last thing it spat out was:
"Note: No passwd file found. Adding user 'root' with password 'changeme'"

Not overly useful info, but something...

Brian
Title: Re: Agilent E7495 linux root account
Post by: DogP on May 14, 2017, 04:19:31 pm
Adding user 'root' with password 'changeme'"
I had come across "changeme" as well, but didn't see where it was used.  It didn't work as the original password, and once I got rid of the password file, it took any login (didn't require root/changeme).  Have you found where it's actually used?

Pat
Title: Re: Agilent E7495 linux root account
Post by: ke6iyc on May 14, 2017, 05:10:02 pm
No, thus the limited usefulness of the result....

Brian
Title: Re: Agilent E7495 linux root account
Post by: ke6iyc on May 14, 2017, 05:36:47 pm
What is the 7495 calling the PCMCIA card?

Thanks,

Brian
Title: Re: Agilent E7495 linux root account
Post by: kr5j on May 15, 2017, 09:27:58 pm
I did the patch but it didn't seem to fix the GPS. I went to the adjustment screen to sync the unit with GPS but GPS icon stayed yellow. I also added the license patch but when rebooted it didn't show any new options. So I thought I would try it again and now the unit boots up and hangs on the Copyrights screen. How can I recover?

Thanks
kr5j
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on May 16, 2017, 02:56:14 am
I did the patch but it didn't seem to fix the GPS. I went to the adjustment screen to sync the unit with GPS but GPS icon stayed yellow. I also added the license patch but when rebooted it didn't show any new options. So I thought I would try it again and now the unit boots up and hangs on the Copyrights screen. How can I recover?

Thanks
kr5j

You need to replace the elgato binary with the original, and start over. The only thing I can think if the patches didn't work, is you started with the wrong version of the binary (e.g. you did not upgrade the firmware first).
Title: Re: Agilent E7495 linux root account
Post by: kr5j on May 16, 2017, 03:01:13 am
Whew! Found a copy of A.06.25 FW, put it on a CF card and installed it and the unit is back to original performance. So the patches did not appear to work for me. I went back and installed just the license one but no new options appeared. If I do the GPS one, unit appears normal but if I try to go to the GPS adjustment screen, it hangs. But I did see the GPS icon go green at one point! I was using the date command to set the time/date and maybe that got it to go green but as soon as the FW changed the time it went yellow. the saga continues...
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on May 16, 2017, 03:20:20 am
Whew! Found a copy of A.06.25 FW, put it on a CF card and installed it and the unit is back to original performance. So the patches did not appear to work for me. I went back and installed just the license one but no new options appeared. If I do the GPS one, unit appears normal but if I try to go to the GPS adjustment screen, it hangs. But I did see the GPS icon go green at one point! I was using the date command to set the time/date and maybe that got it to go green but as soon as the FW changed the time it went yellow. the saga continues...

Let's focus on one thing at a time.

Remember, for the license hack, you have to also modify the license file for each license you wish to add. The trick that the patch provides is that the key isn't ever read, so it doesn't need to be valid. Perhaps you are not doing this step.


Once you have done the GPS patch, you do not want to be setting the date/time manually. The date/time will be set properly by the GPS. At the very least, you can use the web interface to set the date/time once, using the date/time of the PC you are browsing to it from. If you ever have the green circle, then you are in a state where you can do the timebase calibration. Note you probably want to have the unit on for some 30 minutes plus, and you want to make sure you have at least 5 or 6 satellites locked.
Title: Re: Agilent E7495 linux root account
Post by: ke6iyc on May 16, 2017, 07:16:24 pm
@kr5j

You also need to "install" the options, done on the unit itself.

They do not automatically appear...

Brian
Title: Re: Agilent E7495 linux root account
Post by: kr5j on May 16, 2017, 09:07:46 pm
I started with A.06.25 FW then did the GPS patch. I rebooted and the GPS patch appears to have worked, now the GPS info has the current UTC time. Also the GPS icon turns green! Then I did the license patch and it appears to have worked but cannot access the screen to see installed options. Also cannot get to the GPS adjustment screen. The problem that is once the unit boots up, I select System then press More 2 of 2 to get to Page 2. Unit takes a few seconds then all the button labels on the left side of the screen disappear. Unit stays in this condition and does not respond to any button presses. I have to reboot to get the unit operational again. Why would either patch affect it this way?
Title: Re: Agilent E7495 linux root account
Post by: DogP on May 17, 2017, 01:13:52 am
I had that same problem: https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg1053888/#msg1053888 (https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg1053888/#msg1053888) .  You need to modify the /flash/egServer/license/elgato.lic file and add a SIGN value (like SIGN=000000000000 ) to any that don't already have a SIGN.

Pat
Title: Re: Agilent E7495 linux root account
Post by: ve7xen on May 17, 2017, 08:52:07 am
So this is quite odd, since Linux itself has no trouble with the current date, but the egServer process seems to be rolling it over zero to 'less than the minimum'. I guess egServer must be internally representing the time in a nonstandard way. Maybe just patching the comparison would make it work again?

No. What we see here is "GPS week rollover" problem.
http://www.npl.co.uk/reference/faqs/when-and-what-is-the-gps-week-rollover-problem-(faq-time) (http://www.npl.co.uk/reference/faqs/when-and-what-is-the-gps-week-rollover-problem-(faq-time))
The message doesn't show the time which is "less than minimum". I verified that it's current time minus 1024 weeks.
So GPS subsystem adjusts system clock and then it's immediately reset to "minimum time".

Curious, because rollover last happened in 1999 and doesn't happen again until 2019. The instrument was released sometime around 2002-3. So I kind of thought of that but wrote it off as something else. It's definitely this though, probably the firmware is checking some arbitrary date in the past to decide what GPS epoch it is in, and how many weeks to add. We went past that boundary date, so it think it's pre-1999 again. If anyone's curious, the disassembly of the patched region is:
Code: [Select]
old
---
0x2122880: 4b 25 85 e2   r2 = r5 + 314572800                                                                                                                                                                   
0x2122884: 15 28 82 e2   r2 = r2 + 1376256
0x2122888: f6 2d 82 e2   r2 = r2 + 15744

new
---
0x2122880: de 25 85 e2   r2 = r5 + 931135488                                                                                                                                                                   
0x2122884: 3f 28 82 e2   r2 = r2 + 4128768
0x2122888: f6 2d 82 e2   r2 = r2 + 15744

Which adds exactly 1024 weeks to the constant.

Nice work on the patch and thanks! I couldn't crack it.
Title: Re: Agilent E7495 linux root account
Post by: kr5j on May 18, 2017, 01:22:25 am
I copied the legato.lic file to mnt but it does not appear on the CF card. There were also 2 screen shots in the mnt folder and they are not on the CF card. I did a screenshot and when I opened the CF card on my PC the screenshot was there but nothing else. How do I put the legato.lic file on the CF card? I tried the mount /devf/hdc1/ /mnt command and it said it failed: not a directory.
Title: Re: Agilent E7495 linux root account
Post by: DogP on May 18, 2017, 09:47:57 am
You should use the command "mount /dev/hda1 /mnt" (no trailing slash after hda1).  On my box the CF is hda, not hdc... but if for some reason yours is hdc, then use that.  And I assume "legato.lic" and "/devf/" are just typos in your reply (should be "elgato.lic" and "/dev/" respectively).

Pat
Title: Re: Agilent E7495 linux root account
Post by: kr5j on May 18, 2017, 09:03:13 pm
Yep the fat finger of fate struck. What are the commands to copy the license file to the CF card and then the modified file back? I think my CF card is hda1. Here is what I get with a df -h command:

[root@E749xx /]$df -h

Filesystem                Size      Used Available Use% Mounted on
rootfs                    7.7M      6.1M      1.2M  83% /
/dev/root                 7.7M      6.1M      1.2M  83% /
/dev/mtdb3               60.0M     21.6M     38.4M  36% /flash

But none of these is the CF card inserted, since it is a 500 MB card. Not sure what the disks listed are.

If I press the Media Manager button from System, it shows the CF card format button highlighted indicating it is recognized by the system.
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on May 18, 2017, 11:08:48 pm
Yep the fat finger of fate struck. What are the commands to copy the license file to the CF card and then the modified file back? I think my CF card is hda1. Here is what I get with a df -h command:

[root@E749xx /]$df -h

Filesystem                Size      Used Available Use% Mounted on
rootfs                    7.7M      6.1M      1.2M  83% /
/dev/root                 7.7M      6.1M      1.2M  83% /
/dev/mtdb3               60.0M     21.6M     38.4M  36% /flash

But none of these is the CF card inserted, since it is a 500 MB card. Not sure what the disks listed are.

If I press the Media Manager button from System, it shows the CF card format button highlighted indicating it is recognized by the system.

kr5j:


File Locations (first the ones you need, second some interesting locations):


As far as the elgato file goes, the following sha256 hashes should tell you if you have the same file or not. Copied from sha256sum command[c]:



Tips:

df reports results for each mounted disk. Until you do something with the GUI that will cause a write to the disk (try to save file, save data, or format PCMCIA), the unit won't even mount it. You can manually mount the disk, in its proper location, by typing:

mount /dev/hda1 /flash/mnt/pcmcia

Then, you can browse to /flash/mnt/pcmcia to read (or copy) files you stored on the device. Picture and data saves will now also work (assuming the device can read your partition).



[a]: Again, for me, I formatted it as ext3. You can use fat16, I think. I am not sure about fat32.
[2]: Notice they have their own copy of ps, grep. They also have some custom scripts like elgatosleep, diagServer, enable_matrix_kb. And then some are just configuration files, like the files in /etc. do "find ." in /flash/linux to see this stuff.
[c]: Since sha256sum isn't included in BusyBox or agilent's files, then you'll have to do this on your desktop or whatever.
Title: Re: Agilent E7495 linux root account
Post by: kr5j on May 19, 2017, 04:57:56 pm
I edited the license file with VI and now have all options. Still not clear on how to copy a file to the CF card but will pursue it.
Thanks for the help. So now my E7495A has a green GPS indicator and all options.

Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on May 19, 2017, 05:05:32 pm
I edited the license file with VI and now have all options.

Just for the record, there is no need to edit the license file if you can't work it out. You can use the built in menu to add licenses, just use anything you like for the license key.
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on May 19, 2017, 06:45:02 pm
I edited the license file with VI and now have all options. Still not clear on how to copy a file to the CF card but will pursue it.
Thanks for the help. So now my E7495A has a green GPS indicator and all options.

If you are using the CF card, insert it, then, for instance to copy the elgato binary:
Code: [Select]
mount /dev/hda1 /flash/mnt/cf
cp /flash/egServer/elgato /flash/mnt/cf

If you are using a (CF or SD) to PCMCIA adapter:

Code: [Select]
mount /dev/hda1 /flash/mnt/pcmcia
cp /flash/egServer/elgato /flash/mnt/pcmcia


Note that it might be /dev/hda2.
Title: Re: Agilent E7495 linux root account
Post by: kr5j on May 19, 2017, 08:10:25 pm
Ah it was that easy to do! But I had more fun using VI editor :)
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on June 21, 2017, 01:57:17 pm
Has anyone made any progress on unlocking whatever potential might be in the CW source (or the modulated version, 510)?

I'd really like to learn if there is potential to extend the frequency range of the output downward. 100kHz would be nice, but even 10 MHz would do just fine.

Has anyone ever opened up the CW/mod and taken a guess at what the restriction actually is? I still haven't had the time or courage to open up my E7495a, but I would be happy to do so if it would help someone figure out a starting point to getting lower frequency output.
Title: Re: Agilent E7495 linux root account
Post by: kr5j on July 11, 2017, 08:08:04 pm
How to enable the demod option?????
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on July 12, 2017, 08:49:26 am
How to enable the demod option?????
There's no such option. E7495 demodulation options are limited to cellular phone stuff.
Title: Re: Agilent E7495 linux root account
Post by: TheSteve on July 12, 2017, 04:07:00 pm
The N1996A supports AM/FM demod though - so you never know if it can be enabled on the E7495.
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on July 12, 2017, 05:30:51 pm
The option code for the N1996A is AFM so if you have a liberated E7495 just give it a try.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on July 12, 2017, 07:24:07 pm
The N1996A supports AM/FM demod though - so you never know if it can be enabled on the E7495.
How do you know that I never know?
toroServer/Dragonfly/Measurements/KernelBasic/Superfly/Am*
toroServer/Dragonfly/Measurements/KernelBasic/Superfly/Fm*
toroServer/Dragonfly/Measurements/KernelBasic/Superfly/am.txt
toroServer/Dragonfly/Measurements/KernelBasic/Superfly/fm.txt
That DSP stuff looks like AM/FM demodulation code for N1996A, doesn't it?
It's not present in egServer. And adding functionality is not just a matter of copying missing files.
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 07, 2018, 04:25:01 am
I wanted to bring to attention what I believe is an example of drifting or failing calibration. In a specific sense, none of this matters (because you are probably going to normalize, which makes the measurement you make relative to the problematic measurement below). It's still interesting, and I'd love to hear speculation on why this is happening. I can make further measurements (such as using a different spectrum analyzer to view the output, or a SDR).

The following will tell you the default settings after preset, then show which one or two things to change from the previous. For all tests, the only connection is a 0.5 meter Agilent N-to-N cable.


Two Port Insertion Loss (default settings)

* 375 MHz - 2.5 GHz
* Source Lev Auto (10 dBm)
* Optimize Accy

So when we go to a preset configuration, we have a sudden downward jump at 1 GHz. In addition, the average insertion loss is genuinely lower than it should be. Substituting a different cable has no effect:

(https://i.imgur.com/WcPmEUbl.png) (https://i.imgur.com/WcPmEUb.png)


If we pick a manual output level, then we can cut down on this effect...

* 375 MHz - 2.5 GHz
* Source Lev Manual (0 dBm)
* Optimize Accy

(https://i.imgur.com/4ixfgu3l.png) (https://i.imgur.com/4ixfgu3.png)

And if we keep reducing the output level, we can eventually make this jump very small:

* 375 MHz - 2.5 GHz
* Source Lev Manual (-10 dBm)
* Optimize Accy

(https://i.imgur.com/MHeqI6rl.png) (https://i.imgur.com/MHeqI6r.png)

If we change to "Range" mode, this sharp jump effect totally disappears but the insertion loss offset does not change.

* 375 MHz - 2.5 GHz
* Source Lev Auto (10 dBm)
* Optimize Range

(https://i.imgur.com/ADbuPWVl.png) (https://i.imgur.com/ADbuPWV.png)

Likewise, if we change to Manual source level and change it to - 10dBm, we get a more or less correct measurement of insertion loss:

* 375 MHz - 2.5 GHz
* Source Lev Manual [/b](-10 dBm)[/b]
* Optimize Range

(https://i.imgur.com/ZC39uD3l.png) (https://i.imgur.com/ZC39uD3.png)

In case you think this is an effect which shows up only when you have a large span, it's exactly the same up close:

* 999 MHz - 1001 MHz
* Source Lev Auto (10 dBm)
* Optimize Range
* Source Lev

(https://i.imgur.com/XRaVuKwl.png) (https://i.imgur.com/XRaVuKw.png)


Any thoughts, guesses, or further tests would be appreciated. I have SDRs which I can use to monitor the output from the CW/generator. I can use another spectrum analyzer to view the output. I think I've done this, and I didn't see any sudden jumps at 1GHz exactly. Likewise, when I use another signal generator into this spectrum analyzer (E7495a), I similarly do not see any sudden jump. So this leads me to believe that this effect is from some sort of calibration table that the unit stores for the Two Port Insertion measurement mode specifically.

It's worth noting, too, that the procedure for this originally calls for using a two 10dB attenuators (back to back) on the RF out port. Using an attenuator set  does, of course, reduce this effect but it's still noticeable.
Title: Re: Agilent E7495 linux root account
Post by: ferdinandkeil on March 10, 2018, 11:11:15 am
I wanted to bring to attention what I believe is an example of drifting or failing calibration. In a specific sense, none of this matters (because you are probably going to normalize, which makes the measurement you make relative to the problematic measurement below). It's still interesting, and I'd love to hear speculation on why this is happening. I can make further measurements (such as using a different spectrum analyzer to view the output, or a SDR).

The following will tell you the default settings after preset, then show which one or two things to change from the previous. For all tests, the only connection is a 0.5 meter Agilent N-to-N cable.



...

Any thoughts, guesses, or further tests would be appreciated. I have SDRs which I can use to monitor the output from the CW/generator. I can use another spectrum analyzer to view the output. I think I've done this, and I didn't see any sudden jumps at 1GHz exactly. Likewise, when I use another signal generator into this spectrum analyzer (E7495a), I similarly do not see any sudden jump. So this leads me to believe that this effect is from some sort of calibration table that the unit stores for the Two Port Insertion measurement mode specifically.

It's worth noting, too, that the procedure for this originally calls for using a two 10dB attenuators (back to back) on the RF out port. Using an attenuator set  does, of course, reduce this effect but it's still noticeable.

I can verify this effect with my E7495B. But this is not erroneous behavior: it is caused by the preamp not spanning the complete frequency range (see https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg621126/#msg621126 (https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg621126/#msg621126)).

When do the test with a short cable (RG316) and a 20dB attenuator, the insertion loss measurement is flat to within 2dB. After normalization I get a nice straight line across the whole frequency range. The insertion-loss measurement is probably designed for longer cable runs with significant loss. This would explain the use of the 20dB attenuation when normalizing. So if your cable is quite short and has negligible attenuation the preamp is saturating, thus giving you wrong results.
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 10, 2018, 04:52:01 pm
I wanted to bring to attention what I believe is an example of drifting or failing calibration. In a specific sense, none of this matters (because you are probably going to normalize, which makes the measurement you make relative to the problematic measurement below). It's still interesting, and I'd love to hear speculation on why this is happening. I can make further measurements (such as using a different spectrum analyzer to view the output, or a SDR).

The following will tell you the default settings after preset, then show which one or two things to change from the previous. For all tests, the only connection is a 0.5 meter Agilent N-to-N cable.



...

Any thoughts, guesses, or further tests would be appreciated. I have SDRs which I can use to monitor the output from the CW/generator. I can use another spectrum analyzer to view the output. I think I've done this, and I didn't see any sudden jumps at 1GHz exactly. Likewise, when I use another signal generator into this spectrum analyzer (E7495a), I similarly do not see any sudden jump. So this leads me to believe that this effect is from some sort of calibration table that the unit stores for the Two Port Insertion measurement mode specifically.

It's worth noting, too, that the procedure for this originally calls for using a two 10dB attenuators (back to back) on the RF out port. Using an attenuator set  does, of course, reduce this effect but it's still noticeable.

I can verify this effect with my E7495B. But this is not erroneous behavior: it is caused by the preamp not spanning the complete frequency range (see https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg621126/#msg621126 (https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg621126/#msg621126)).

When do the test with a short cable (RG316) and a 20dB attenuator, the insertion loss measurement is flat to within 2dB. After normalization I get a nice straight line across the whole frequency range. The insertion-loss measurement is probably designed for longer cable runs with significant loss. This would explain the use of the 20dB attenuation when normalizing. So if your cable is quite short and has negligible attenuation the preamp is saturating, thus giving you wrong results.

Thanks!

I had another problem yesterday which I'm sure is new. The display on the unit keeps turning off the backlight, crazy fast. I can actually sometimes catch it saying in the status bar something like "Turning off backlight in 3 seconds" with a countdown.

Any ideas where this could be stopped or configured?
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 11, 2018, 06:18:42 am
Thanks!

I had another problem yesterday which I'm sure is new. The display on the unit keeps turning off the backlight, crazy fast. I can actually sometimes catch it saying in the status bar something like "Turning off backlight in 3 seconds" with a countdown.

Any ideas where this could be stopped or configured?

This, along with another problem (the network interface not working), just disappeared after I left the unit unplugged for a while (a few hours). So that's good and bad, but more good than bad.

I still had practical problems making two port insertion loss measurements (even with 20dB worth of pads) and Auto (+10dBm) output level. I would get sudden burst of uncertainty in the response right after 1GHz, for almost 500MHz. In any case, I managed to make the measurements by going to 0dB.
Title: Re: Agilent E7495 linux root account
Post by: ferdinandkeil on March 11, 2018, 11:24:06 pm
Thanks!

I had another problem yesterday which I'm sure is new. The display on the unit keeps turning off the backlight, crazy fast. I can actually sometimes catch it saying in the status bar something like "Turning off backlight in 3 seconds" with a countdown.

Any ideas where this could be stopped or configured?

This, along with another problem (the network interface not working), just disappeared after I left the unit unplugged for a while (a few hours). So that's good and bad, but more good than bad.

I still had practical problems making two port insertion loss measurements (even with 20dB worth of pads) and Auto (+10dBm) output level. I would get sudden burst of uncertainty in the response right after 1GHz, for almost 500MHz. In any case, I managed to make the measurements by going to 0dB.

Glad to hear that the problem went away on its own.

Regarding the insertion loss measurement, 10dBm just might be a little much for the preamp. Did you normalize (aka calibrate) the measurement?
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 12, 2018, 05:23:05 am
Thanks!

I had another problem yesterday which I'm sure is new. The display on the unit keeps turning off the backlight, crazy fast. I can actually sometimes catch it saying in the status bar something like "Turning off backlight in 3 seconds" with a countdown.

Any ideas where this could be stopped or configured?

This, along with another problem (the network interface not working), just disappeared after I left the unit unplugged for a while (a few hours). So that's good and bad, but more good than bad.

I still had practical problems making two port insertion loss measurements (even with 20dB worth of pads) and Auto (+10dBm) output level. I would get sudden burst of uncertainty in the response right after 1GHz, for almost 500MHz. In any case, I managed to make the measurements by going to 0dB.

Glad to hear that the problem went away on its own.

Regarding the insertion loss measurement, 10dBm just might be a little much for the preamp. Did you normalize (aka calibrate) the measurement?

Yep. I don't believe the 10dBm claim, but that's what it says on the source level of my instrument. I'll take some SDR screenshots (while restraining the tracking generator to a small frequency range). It normalizes fine. But once I make a measurement, and it's still in +10dBm mode, there is a bunch of noise right after 1000 MHz.
Title: Re: Agilent E7495 linux root account
Post by: JessieAMorris on March 14, 2018, 03:55:34 pm
Just picked up a working unit off the 'Bay for $300 shipped. Excited to start playing with some RF goodness.
Title: E7495 flash update fails with odd results
Post by: walter2 on April 15, 2018, 09:54:39 pm
I recently got 2 E7495A, both booted and worked. Working with a fellow conspirator here in kelowna, we took his known good PCMCIA/Flash update card with 6.25, and did the flash upgrade to the best unit with 6.24 working on it.

the update never completes, it runs for a very long time, gets to anywhere from 70-90% of the flash update, and never goes further. when we transferred the flash card right to the machine (rather than via the pcmcia adaptor), it runs faster, and doesn't complete, but also throws up a strange message "inflate returns -3" repeatedly, then a blosk fo data too fast to read, then stalls again. we tried the normal on-screen update, and the hidden lower right button full refresh, but fail at the end.

we have tried all variants of the process, but cannot get to an updated machine. this appears to indicate that the internal flash on the motherboard is bad at some location, and doesn't permit a valid update. is this right?  if so, how can I fix the flash on the motherboard.?? does anybody have ANY internal documentation for this unit?  I see nothing at hp/agilent/keysite.

you can email me directly at walter2 -at- sphere.bc.ca

I would really like to get this unit working, and am incredibly sorry I tried this update.  any help appreciated.

regards,
walter

Title: Re: E7495 flash update fails with odd results
Post by: technogeeky on April 15, 2018, 10:59:42 pm
I recently got 2 E7495A, both booted and worked. Working with a fellow conspirator here in kelowna, we took his known good PCMCIA/Flash update card with 6.25, and did the flash upgrade to the best unit with 6.24 working on it.

the update never completes, it runs for a very long time, gets to anywhere from 70-90% of the flash update, and never goes further. when we transferred the flash card right to the machine (rather than via the pcmcia adaptor), it runs faster, and doesn't complete, but also throws up a strange message "inflate returns -3" repeatedly, then a blosk fo data too fast to read, then stalls again. we tried the normal on-screen update, and the hidden lower right button full refresh, but fail at the end.

we have tried all variants of the process, but cannot get to an updated machine. this appears to indicate that the internal flash on the motherboard is bad at some location, and doesn't permit a valid update. is this right?  if so, how can I fix the flash on the motherboard.?? does anybody have ANY internal documentation for this unit?  I see nothing at hp/agilent/keysite.

you can email me directly at walter2 -at- sphere.bc.ca

I would really like to get this unit working, and am incredibly sorry I tried this update.  any help appreciated.

regards,
walter

walter:

From here (https://www.zlib.net/manual.html), inflate() returning -3 is evidently the error Z_DATA_ERROR. This error arises during extraction from a compressed file (hence inflate). Z_DATA_ERROR implies that the source data is missing, invalid, or corrupted. I would get a new or different CF card, or a different CF card to flash adapter.

I know the update process is run during boot (it checks to see if a card with an update is present, and asks you if you want to try and install it). Since this is just some command, it should be possible to run this command from the local memory inside the machine. You can telnet in, use FTP to upload the update file/images, and then run the update manually.
Title: Re: E7495 flash update fails with odd results
Post by: ogden on April 15, 2018, 11:07:31 pm
From here (https://www.zlib.net/manual.html), inflate() returning -3 is evidently the error Z_DATA_ERROR. This error arises during extraction from a compressed file (hence inflate). Z_DATA_ERROR implies that the source data is missing, invalid, or corrupted. I would get a new or different CF card, or a different CF card to flash adapter.

Also it is worth checking MD5 checksum of the file(s). It could be so that during download file somehow became corrupted.
Title: Update not working, error messages displayed
Post by: walter2 on April 16, 2018, 02:23:42 pm
For "greater clarity" here, I was able to use that SAME update flash card to successfully update my second unit, so there is no question that it works. we also confirmed it was good on three other machines.

I would have thought the messages about inflating were just as others suggested, that it is an update source problem after decompression, but it is certain that is not the issue, the problem is at the destination, the internal flash on the motherboard. I believe this message indicates that a checksum failed after attempted writing, but am not positive.  more disturbing is that I have zero info on the mother board.  the issue always arises towards the end of the process, which points to a bad or marginal area at the end of the local flash storage.

anyone with motherboard info, and how to fix the on-board flash would be greatly appreciated. there is no local flash card or other easily replaceable memory on the card, other than what appears to be a boot ROM.

regards,
walter
Title: Re: Agilent E7495 linux root account
Post by: TheSteve on April 16, 2018, 04:27:56 pm
Is it possible the problem unit had a bunch of user data stored on the internal memory before the upgrade was started so it is running out of space?
Title: Re: Agilent E7495 linux root account
Post by: walter2 on April 16, 2018, 09:39:08 pm
I don't think that is the case, since the "re-build" option re-does EVERYTHING, including errasing and re-formatting the flash...  I suspect the problem is a poor sector of flash on the motherboard, works a bit some times, fails others.

since you are in BC, come see us for stuff day next saturday, the 21st! we are in west kelowna.
all the details are here, assuming the posting software allows it:
http://www.sphere.bc.ca/test/stuffday.html (http://www.sphere.bc.ca/test/stuffday.html)

if it gets vaporized, google sphere research corp., and look for the stuff day link at the top of /index.html.

all the best,
walter
Title: Re: Agilent E7495 linux root account
Post by: RCHRDM on May 12, 2018, 10:04:52 pm
Hello

I will be picking up an Agilent E7495 next week.  I am not sure of which options are included.

Does anyone have unlock codes for the options for this instrument?

Richard
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on May 13, 2018, 11:57:27 pm
Hello

I will be picking up an Agilent E7495 next week.  I am not sure of which options are included.

Does anyone have unlock codes for the options for this instrument?

Richard

There are no codes. The nature of the unlock process is:

* patch the binary so that it doesn't check if the unlock code is valid or not
* insert any dummy text instead of the code in the license file, for each option you want to enable

This will be easier to understand once you have a device in front of you. The license file will have examples of valid codes that ship with the device, so you will have an example of the structure of each option.
Title: Re: Agilent E7495 linux root account
Post by: RCHRDM on May 17, 2018, 01:12:32 am
I got my E7345 today.  It has a few cosmetic issues, but it boots up!  There is no power meter option.

There appears to be a gasket around the LCD that is loose on the left and bottom of the display, so I guess I will have to take the thing apart and replace the plastic screen overlay or cover.  I attached a picture.  The spectrum analyzer works OK.

There is also a missing threaded insert that takes the battery door retaining screw.  Would someone mind taking a picture of where the battery door screw threads into the case to hold the door closed?

Richard
Title: Agilent E7495 Service Manual or Parts List?
Post by: RCHRDM on May 17, 2018, 05:05:01 am
Does anyone have a service manual or parts list?  I tried Agilent and they said they did not have one...

Richard
Title: Re: Agilent E7495 linux root account
Post by: RCHRDM on May 25, 2018, 06:42:18 am
I am in the process of hopefully getting some additional parts to replace those missing from y E7495.

Could you please step me through the "hacking" process to enable the power meter?  I can follow along with the my instrument now.

BTW, I have a service manual now if anyone needs one.

Richard
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on May 25, 2018, 08:48:00 pm
I am in the process of hopefully getting some additional parts to replace those missing from y E7495.

Could you please step me through the "hacking" process to enable the power meter?  I can follow along with the my instrument now.

BTW, I have a service manual now if anyone needs one.

Richard

What do you mean about missing parts?

The power meter is not a software option. If it's physically installed, it will be working (I think).

You have the real service manual? I'd love to see it. PM me.
Title: Re: Agilent E7495 linux root account
Post by: RCHRDM on May 25, 2018, 09:24:03 pm
After I got the E7495 home, I noticed that it was missing the connector for the power meter.  (Someone had put tape over the hole, so I could not tell from the auction photos.) 

I took it apart to repair a problem with the LCD cover and found that the power meter board was installed, but two ribbon cable connections were missing.  I assume one of them is for the power meter connector on the case.

I also found that there were a few other missing things including the main case gasket, a couple of screws, and the cover for the PCMIA area.

There is a guy who has a parts machine, so we are talking about pulling some parts from it.

When the instrument is powered up, the power meter button is grayed out, so I assume the option is not activated.

Richard
Title: Re: Agilent E7495 linux root account
Post by: kk6ioz on May 28, 2018, 06:36:27 am
To extend the lower range, can we build a transverter with a 400MHz LO to cover 0Hz to 400MHz for the VNA measurement? and would a transverter work for SWR measurement.

It would be great if a SW hack could be found.



Title: Re: Agilent E7495 linux root account
Post by: jokkydee on June 07, 2018, 05:41:47 am
The company I work for have a N1996A and I wanted to enable the stimulus/response N8995A-SR3 option so I contacted Keysight and they said the unit is no longer supported and that I can't even pay to get the option enabled. I mentioned that people have hacked the software to enable options, and they just referred me to their forums and said hopefully I can find someone who can help. So now I have a clear conscience with hacking the firmware to enable options since I tried the formal path. Can anyone explain how I can do this, considering I don't have much experience with Linux? I read over this forum but couldn't get a clear picture of what exactly I need to do. I understand I need to patch the firmware, PA0PBZ mentioned a patch for the E7495 but that uses the elgato process, I don't know what I need to do for the N1996A. Can anyone please help?
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on June 07, 2018, 07:23:47 am
You've got mail.
Title: Re: Agilent E7495 linux root account
Post by: jokkydee on June 07, 2018, 07:34:06 am
Thanks PA0PBZ, I'll let you know how it goes. Also, reading the installation note for the TG option, https://literature.cdn.keysight.com/litweb/pdf/N1996-90009.pdf?id=1132460 (https://literature.cdn.keysight.com/litweb/pdf/N1996-90009.pdf?id=1132460) it notes that several adjustments are required after this option is enabled, including TG flatness and return loss calibration. Also they mention some minimum performance checks like freq response and DANL. There's a calibration software that requires a license to use it in order to run these adjustments. I wonder how critical these are. I've contacted Keysight regarding this software to see what they say.
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on June 07, 2018, 07:56:53 am
It's not only the software you need but also the instruments, which is an even larger problem. If you just normalize before your measurement flatness should not be a problem.
Title: Re: Agilent E7495 linux root account
Post by: jokkydee on June 08, 2018, 04:14:26 am
I've got the options enabled after the patch, thanks for the help. I take it that normalising will mean for the purposes of doing measurements with the unit itself it should be ok, but if for example, characterising a cable for use in an external system by exporting the insertion loss data, it may not be reliable without those adjustments and checks?
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on June 08, 2018, 10:36:12 am
When normalizing you connect the output of the instrument to the input and the instrument builds a correction table that takes the wrinkles out of the signal generator and the receiver. That way you can do your measurement and it will not be influenced by any anomalies of the instrument.
Title: Agilent E7495 Parts?
Post by: RCHRDM on June 09, 2018, 10:51:18 pm
My E7495 works OK, but is missing a few parts.  Does anyone have parts they would be willing to sell?  The main thing is that the power meter board is installed, but the two ribbon cables (one presumably going to the case-mounted connector) are missing, along with the connector.

I also need a main case gasket and the threaded insert that the battery door retaining screw threads into.

Thanks.

Richard
Title: Agilent E7495 Mods
Post by: RCHRDM on June 09, 2018, 10:53:28 pm
Is there a way to hack the software or firmware in the E7495 so that the lower frequency limit for the one port and two port loss can be set lower than 375 MHz?  Being able to cover the ham HF bands would be nice.

Richard
Title: Re: Agilent E7495 linux root account
Post by: startronic on June 11, 2018, 08:52:26 pm
Hello Friend

you can describe, how to do full options
Title: Re: Agilent E7495 Mods
Post by: TheSteve on June 12, 2018, 05:45:57 am
Is there a way to hack the software or firmware in the E7495 so that the lower frequency limit for the one port and two port loss can be set lower than 375 MHz?  Being able to cover the ham HF bands would be nice.

Richard

The lower frequency limit can be changed by editing a text file however I believe it has been documented in this thread that lowering it causes the generator to crash when it boots.
Title: Re: Agilent E7495 linux root account
Post by: kk6ioz on June 13, 2018, 03:38:08 pm
in the reply #148:

"I played around with the files in /flash/egServer/Dragonfly/Receivers, like E7495A and CPXSRC. You can indeed change things here and sometimes see the effects (e.g. you can change E7495A to have Freq Range be 3000e6, and it makes it possible to enter that value). However, some of these changes will have no effect for other reasons (here, I assume it's because there is actually a filter which sharply cuts off at ~ 2.7GHz). However however, I could not find a way to try and make the signal generator make higher or lower frequency signals"

Maybe we should do more experiments with this and document if it works below 375 MHz for the one port and two port measurements.
Title: Re: Agilent E7495 linux root account
Post by: TheSteve on June 13, 2018, 04:26:20 pm
I've lowered the gen frequency on its big brother the N1996A and it works fine but I don't have an E7495A to experiment with.
Title: Re: Agilent E7495 linux root account
Post by: RCHRDM on June 13, 2018, 04:41:59 pm
That's great!  Can you say how you did that?

Richard
AE6XO
Title: Re: Agilent E7495 linux root account
Post by: kk6ioz on June 13, 2018, 06:28:17 pm
Regarding "I've lowered the gen frequency on its big brother the N1996A and it works fine but I don't have an E7495A to experiment with."

Could you describe what "it works fine" means? have you done 2-port or 1-port measurements at a lower frequency range (let's say 1MHz or 10MHz) and have you compared the measurement with other VNA?

Do you remember what exact file and parameter you have changed?
Title: Re: Agilent E7495 linux root account
Post by: TheSteve on June 13, 2018, 06:46:44 pm
Regarding "I've lowered the gen frequency on its big brother the N1996A and it works fine but I don't have an E7495A to experiment with."

Could you describe what "it works fine" means? have you done 2-port or 1-port measurements at a lower frequency range (let's say 1MHz or 10MHz) and have you compared the measurement with other VNA?

Do you remember what exact file and parameter you have changed?

The biggest difference is that the N1996A gen out starts at 10 MHz when stock. I lowered it to 1 MHz and it still normalized fine. Its performance was just fine for return loss measurements of HF antennas.
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on June 13, 2018, 07:26:24 pm
The biggest difference is that the N1996A gen out starts at 10 MHz when stock. I lowered it to 1 MHz and it still normalized fine. Its performance was just fine for return loss measurements of HF antennas.

That. There is a model description file in the N1996A firmware that lists the frequency range of the freq generator. If you change the starting freq from 10 to 1 MHz it will obey.
Title: Re: Agilent E7495 linux root account
Post by: PrenticeManNY on June 17, 2018, 10:10:03 pm
Hi everyone. I'm the proud owner of this instrument and recently discovered this thread. I've read through the entire post several times and have learned a great deal thanks to everyone's generous attitudes toward sharing their knowledge and experience.

My particular E7495 was running an ancient firmware of 1.60. Thanks to this forum I was able to easily obtain the now scarce 6.25 firmware package and had little trouble installing this once I got my hands on a compact flash card. The next step was dusting off my linux skills which are no where near as developed as the people in this thread but turned out to be adequate to transfer the required binaries and use a hex editor to manipulate them as described. I have hit a snag unfortunately. I have the same problem reported by another user where I am unable to navigate to the second page of system options due to a system hang when the more options soft key is pressed. I understand the cause of this, at least in that other poster's situation was due to his license file having no entries after "SIGN=".

I thought the solution for me would be that simple as well but it seems I have a unique problem here. My license file does not contain erroneous entries, in fact it seems to be missing information. I have re-installed the 6.25 firmware 2 times and then tried a third time with the recovery script method. This third time I tried a little experiment and modified the License file by changing the values of the populated features and then using the recovery script after moving the file to /flash/egServer/license/elgato.lic . After the update I checked the file and discovered apparently at least in my case this license file is not touched in the update process as my license file had the changes I had made in a hex editor.

I'm not sure how I ended up with what I suspect is a corrupted license file but here I am. I can go to the install license screen when I have a binary with the stock hex values in the 337A7C offset and see all the correct options (i.e. over the air EVDO and so on) but in my original license file these options aren't listed.

Can someone here please take the time when convenient to view my transferred License file and maybe share their thoughts on whether a license file from another machine has any hope of being transplanted into mine and confirm that my file is in fact somehow corrupted?


Thanks in advance to anyone who can spare some time to read all this and help me out! And if something I've done or tried to explain doesn't make sense then thanks too for your patience. I've attached the file as a .txt to meet the forums attachment requirement.
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on June 18, 2018, 07:03:06 am
Was there a value after the SIGN= in the original file? That is the key to unlock the feature together with the HOST string:

FEATURE 503 agilent 1.000 permanent uncounted \
        HOSTID=ID_STRING=12345678 SIGN=F1CE2A146BC6

The HOSTID is the ID of your instrument which is the same as in the file hostid in the same folder, and the SIGN is the key that was entered to activate the option.

Sometimes  there are some default entries in there that don't have a SIGN so normally they do nothing. But when the patch is applied they all start to work...
Also, I see a hex "F0" value behind the sign for option 210 which I'm sure does not belong there, and a lot of hex "00" in every SIGN=

(https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/?action=dlattach;attach=458731;image)

Try to put 12 digits (0-F) after every SIGN= and try again.

Title: Re: Agilent E7495 linux root account
Post by: PrenticeManNY on June 18, 2018, 11:21:10 am
Thanks for the reply, I just realized I mistakenly uploaded the file I had tried to modify which explains the FO entry you pointed out. I tried entering 00 in the fields after sign and must have missed that one. Just to clarify, any value can exist after these entries? obviously if I screw up the correct formatting by entering information into the wrong field as I've done here that matters. But by putting say 00 A1 B1...etc into the field or all 00 00 00 entries as I tried here that is how I fix the file?

Sorry to be dense, I'm struggling a little determining how exactly the file should look....
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on June 18, 2018, 11:46:05 am
Yes you can pick any value(s) for the SIGN= string, the patch disables the check on this value. However, I think that invalid values or length can still do strange things, I don't remember if there was any other checking on this value when I created the patch long ago. In any case, don't use HEX 00 values or other unreadable stuff in there but use 12 characters from '01234567890ABCDEF'.

[Edit]

I don't see anything wrong with your license file apart from the fact that the last option (240) is missing the SIGN= entry, this could well be the problem.
It looks like it contains the following options:

200=CDMA / CDMA 2000 Analyzer
210=CDMA Over Air Test
220=Channel Scanner
240=W-CDMA Analyzer


Title: Re: Agilent E7495 linux root account
Post by: PrenticeManNY on June 18, 2018, 11:41:09 pm
I've just edited the elgato.lic file to include the last sign= portion that was missing. Thank you for finding that missing portion and helping me to fix my mistake. This as you likely already knew has fixed the menu option issue and I can now install all options. I've learned a good amount reading this thread and for that I'm forever grateful.
Title: Re: Agilent E7495 linux root account
Post by: TK on July 20, 2018, 12:48:30 am
Over the time of approx 10 months my unit LCD developed delamination / deterioration
See both up left and bottom corners, and switch off picture of left up, it is between LCD layers...
Unit was stored over the summer in original bag within dark & dry and temperature was never more than 30-32 o C

(http://i730.photobucket.com/albums/ww304/d9aplus/safety/IMG-20151023-01474_zpshg1f4xnj.jpg) (http://s730.photobucket.com/user/d9aplus/media/safety/IMG-20151023-01474_zpshg1f4xnj.jpg.html)

(http://i730.photobucket.com/albums/ww304/d9aplus/safety/IMG-20151023-01479_zpsrvslzfgh.jpg) (http://s730.photobucket.com/user/d9aplus/media/safety/IMG-20151023-01479_zpsrvslzfgh.jpg.html)

This is the same unit picture from FEB 2015.

(http://i730.photobucket.com/albums/ww304/d9aplus/safety/IMG-20150224-00306_zpso1bi6oeh.jpg) (http://s730.photobucket.com/user/d9aplus/media/safety/IMG-20150224-00306_zpso1bi6oeh.jpg.html)

Unit is still good for use, but
now looking for spare screen
or whole broken unit with good LCD  :-BROKE

PS any lead on LCD type and producer is much appreciated  :-+
It is the gasket that sits between the LCD module and a transparent plastic panel that protects the screen.  I have not fixed mine yet, but I took the front panel apart and I verified that is the black gasket.  It should be easily fixable, no need to purchase a new LCD module.  I have seen many units on eBay with the same issue.
Title: Re: Agilent E7495 linux root account
Post by: ua4yhz on July 21, 2018, 03:18:49 pm
I have periodically at different levels of brightness blinking display. I had to find a reason. The culprit was the inverter.  To eliminate the defect, it is necessary to solder the resistor of 1 mom-2 mom in parallel with the capacitor C20.  (Between 4 and 5 pin BA9743A).
Title: Re: Agilent E7495 linux root account
Post by: TK on July 22, 2018, 12:20:13 am
Well, I forgot an important question. I just got my unit today, so before I do something stupid...

  • Is the power supply center-pin positive? Yes*.


* I looked through this thread more carefully; it's 9-24V DC, somewhere between 3 and 5 amps; center-pin positive.
The DC plug is 5.5 x 2.5mm center positive.  The most common plug size is 5.5 x 2.1 and it does not fit unless you push it very hard, which can break the DC jack.
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on July 30, 2018, 06:30:41 am
It is the gasket that sits between the LCD module and a transparent plastic panel that protects the screen.  I have not fixed mine yet, but I took the front panel apart and I verified that is the black gasket.  It should be easily fixable, no need to purchase a new LCD module.  I have seen many units on eBay with the same issue.
True... have find out that, when I finally opened the unit to verify LCD type.
Title: Re: Agilent E7495 linux root account
Post by: ncfireman on August 02, 2018, 01:58:52 am
Has anyone had any luck using either the serial ports or gpio?  I was hoping to get it to spit out useful data on the serial port.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on August 02, 2018, 10:57:54 am
Has anyone had any luck using either the serial ports or gpio?  I was hoping to get it to spit out useful data on the serial port.
There should be no problem accessing serial port from inside of E7495. What kind of data are you going to spit out?
Title: Re: Agilent E7495 linux root account
Post by: ncfireman on August 05, 2018, 06:22:37 am
I'd like to be able to export gps and an average signal level.  Something where I could do a rough drive test.
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on November 22, 2018, 06:52:28 pm
Today during the boot my E7495B stopped to work. The unit was couple months in storage
during the whole summer.
The trouble is localized within PS DC/DC picture with model details in attachment.

Looking for that module, designated in service manual like:
Power supply interface board A4A4
or whole unit E7495 for parts....
PM pls, located within EU
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on November 22, 2018, 07:37:49 pm
The trouble is localized within PS DC/DC picture with model details in attachment.
My E7495A refused to work on battery. Now I regret that I dig into this. It took so much time...
The issue that was looking like a component failure appeared to be a pure software thing.
There is some SMBUS/Smart battery ugliness. Anyway, now I know quite a lot about this module.
I can help with diagnostics and repair.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on November 22, 2018, 07:49:04 pm
Here's PIC16F877 pin map to start with. It's not complete and may have some mistakes, but it's at least something.

Code: [Select]
P/N     NAME    DIR     FUNCTION                                        CONNECTIONS
 1      RC7     I       UART RX                                         J10/5
 2      RD4     O       BATT LED                                        U10
 3      RD5     O       BATT LED                                        U10
 4      RD6     O       BATT LED                                        U10
 5      RD7     O       BATT LED                                        U10
 6      VSS     -
 7      VDD     +
 8      RB0     I       LOBAT(LOW)
 9      RB1     O       3DM(LOW)
10      RB2     O       DCIN (HI)
11      RB3     O       PWR ON LED                                      J20/10
12      NC      x
13      NC      x
14      RB4     I       START OF BATTERY MONITORING?                    J52/4, R96
15      RB5     O       BATDIS(LOW)
16      RB6     O       SUSPEND to ADS?                                 J6/1, J55/2
17      RB7     O       STBY PWR ON (LOW), STDBY LED (LOW)              U101, U11 - J20/7
18      RST     R
19      RA0     A       BATT TEMP
20      RA1     A       BATT TEMP
21      RA2     O       BATT TEMP STROBE
22      RA3     I       CONFIG JUMPER                                   J11/1
23      RA4     I       DCIN DETECT                                     U1
24      RA5     O       BATT TEMP STROBE
25      RE0     A       3.3V SENSE                                      100K - J5/5,6
26      RE1     I       PWR SW                                          U203, J20/9
27      RE2     I       ADS POWER DETECT
28      VDD     +
29      VSS     -
30      X1      C       4MHz clock in                                   U100
31      X2      I       NOT USED
32      RC0     O       CHARGER OFF                                     100K - CR4, Q13 - Q12 - U8/2
33      NC      x
34      NC      x
35      RC1     O       adjusts PROG A of U7                            Q11 - 10K - U7/1
36      RC2     O       charger output voltage setting                  Q14 - ?K - U8/6(Vosense)
37      RC3     I/O     SCL                                             Q20, J52/3
38      RD0     O       CHGSEL
39      RD1     I       BACKLIGHT DISABLE? (NOT USED)                   100K to Q7, GND
40      RD2     O       BATSEL
41      RD3     O       MAIN POWER ON                                   18K to J5/10
42      RC4     I/O     SDA                                             Q16, J52/2
43      RC5     O       I2C BATT MULTIPLEX                              U13
44      RC6     O       UART TX                                         J10/3


Q16, Q19, Q7 = NPN MMBT3904 1AM
B
 C
E

PNP MMB3906 2A
B
 C
E

n-MOS 2N7002 702P

G
 D
S


Title: Re: Agilent E7495 linux root account
Post by: 9aplus on November 22, 2018, 07:54:59 pm
Thank you Kirill,
My unit was on approx half OS boot, then went black.
The protection on external PS was safe triggered like short circuit.

Than I loaded battery on separate load rack and try to power on with
battery, the screen went on for the moment, than black again.

Now with all other connectors disconnected from A4A4 on power on
red LED goes on for short blink than protection trigg. again to black.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on November 22, 2018, 08:12:10 pm
Now with all other connectors disconnected from A4A4 on power on
red LED goes on for short blink than protection trigg. again to black.
Try holding the red button. This should hold the PIC in reset state, so we know whether it shorts the supply before or after the firmware starts.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on November 22, 2018, 08:33:44 pm
The yellow tantalum in the middle of the picture doesn't look good.
Or is it just a shadow?
Title: Re: Agilent E7495 linux root account
Post by: TheSteve on November 22, 2018, 08:41:07 pm
The yellow tantalum in the middle of the picture doesn't look good.
Or is it just a shadow?

It does look like there is a chunk of it missing.
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on November 22, 2018, 08:51:26 pm
True, that tantalum is blown... Thank you for remote troubleshooting.  :-+ 
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on November 22, 2018, 09:09:50 pm
So tomorrow morning I am in chase for 10 uF 35V tantalum.
Will report further development when replaced  ;)
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on November 23, 2018, 09:19:22 am
Do you have a PIC programmer? Maybe you could download the firmware from your PSU board? I'd like to check if they fixed the SMBus code in newer revisions.
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on November 23, 2018, 01:17:27 pm
No PIC programmer at the moment. But can find one when done with this trouble...

Today browse through 3 local shops, some tantalum procured, but not the right one SMD 10 uF 35 V
So trial with:
SMD 4,7uF 50V
or
Pin through 10uF 35V
Must decide after removing of the blown one...
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on November 23, 2018, 01:45:57 pm
I'd stack two 4,7uF
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on November 23, 2018, 05:22:40 pm
Stacking was not feasible operation, therefore classic wire through component replacement.
Unit tested, red LED lit... looks good.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on November 23, 2018, 08:18:52 pm
Good. If you'd be so kind to grab the firmware, the programming header (2mm pitch) pinout is as follows:

1. PGD (PIC pin 17)
2. PGC (PIC pin 16)
4. MCLR (PIC pin 18)
6. VDD (PIC pin 7)
8. VSS (PIC pin 6)

Please, double check the connections before trying.
In my E7495A  PIC pin 17 is connected to the header through 10K resistor, so I had to connect the PICkit to the pin 17 directly.
Other than that I had no problems reading the firmware with the board powered off.
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on November 24, 2018, 08:25:41 am
Locally can find only:
"
Vellman VM203
 PICKit™2 Development Programmer is very versatile.
It features on board sockets for many types of PIC® microcontrollers.
Also provided is an ICSP connector, to program your onboard device.
https://www.velleman.eu/downloads/0/modules/usermanual_vm203.pdf (https://www.velleman.eu/downloads/0/modules/usermanual_vm203.pdf)
"
On A4A4 ISCP is marked like "PIC PGM PORT J55"
Do you know the layout?

Or you have some tool to clamp on PIC 16F877 directly ?

Do you have any picture how did you manage to read out that PIC  ???
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on November 24, 2018, 09:49:49 am
Locally can find only:
"
Vellman VM203
 PICKit™2 Development Programmer is very versatile.
It features on board sockets for many types of PIC® microcontrollers.
Also provided is an ICSP connector, to program your onboard device.
https://www.velleman.eu/downloads/0/modules/usermanual_vm203.pdf (https://www.velleman.eu/downloads/0/modules/usermanual_vm203.pdf)
"
It should work. However, if it's becoming too complex, please, don't waste your time on this.

On A4A4 ISCP is marked like "PIC PGM PORT J55"
Do you know the layout?
Yes, I noted it above. 1. 2. 4. 6. 8. are the pin numbers of J55.

Or you have some tool to clamp on PIC 16F877 directly ?
No.

Do you have any picture how did you manage to read out that PIC  ???
Unfortunately no, my unit is assembled already. I made an adapter to connect PICkit 3 to the J55. Then I cut the trace  going to J55 pin 1 and added a bodge wire to connect J55 pin 1 directly to the pin 17 of  PIC. That's because I wanted to program it many times. If you do it once, you may just solder wires directly to the pins of PIC16 (U201).

Title: Re: Agilent E7495 linux root account
Post by: 9aplus on November 24, 2018, 12:04:08 pm
@kirill ok on all

It seems that my unit will remain open for some time ;)

After reassembly
Power on, green LED ON, no sign on LCD screen, after couple of seconds green LED off
tested on internal BAT and external PS
It seems that some voltages are missing...
The puzzle is that initially with blown tantalum, unit was able to blink LCD powered from BAT...
Possible that I mix some interconnections, but I followed instructions from bellow DOC.

All ideas or experience is more than welcome.

Regarding documentation have only:
Service Guide
Agilent Technologies E7495A/B
Base Station Test Set
Any other available?

To be continued...
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on November 24, 2018, 12:26:00 pm
UPDATE:
For sure some voltage was missing, on recheck have find out one grey wire set
routing from A4A4 to CPU A4A1 board not fitted properly.
Now all good.
Unit boot OK
Just must finish assembly to perform proper test
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on November 24, 2018, 02:53:08 pm
All in order...
Have used the opportunity to clear the LCD screen, from that black internal seal,
the glue is nasty thing to handle. Some minor damage on lexan remains after cleaning.

Pictured with RLB, procured on line recently for some SDR play.
The price was to good, to be true (45 GPB).
On the end RLB OK, and E7495B OK after all  :-+   

Like to thank You all for kind assistance  :clap:

Title: Re: Agilent E7495 linux root account
Post by: jofre on December 24, 2018, 08:57:53 pm
can anyone help me with user and web password inteface?

thanks
Title: Re: Agilent E7495 linux root account
Post by: ddcc on February 23, 2019, 09:28:52 pm
I managed to start the remote Gui on my System!

You need the folowing files

Code: [Select]
egclient.jar
JimiProClasses.zip
RemoteGui.jar
xerces.jar

I think it will only work with the OpenJDK Java 6 runtime

You need to change the server and localAddress parameters, the server is the E7495 and localAddress is the IP of your PC.

Code: [Select]
java -Dserver=10.10.0.101 -DlocalAddress=10.10.0.156 -classpath "egclient-patch.jar:xerces.jar:JimiProClasses.zip:RemoteGui.jar" elgato.gui.MainWindow
Some helpful Key kombinations
CTRL-H = Help
CTRL-L = Local (This one is important!)
F1 to F7 =  Menu items on the left side
F9 = Mode Button
1 to 7 = Menu items on the right side

Before you can do anything you have to switch to the local mode on your PC, press CTRL-L to do this.

I picked up an E7495A recently, and have been poking around the Java remote GUI feature. I ended up patching the bytecode in the main v6.25 egclient.jar to fix a couple of annoying bugs, so hopefully this is useful:

Link: https://www.dcddcc.com/blog/e7495a/egclient.jar (https://www.dcddcc.com/blog/e7495a/egclient.jar)
Title: Re: Agilent E7495 linux root account
Post by: ddcc on March 24, 2019, 06:15:06 am
So it turns out that on my unit, the spectrum analyzer, signal generator, and two-port insertion loss features seem to work fine, but the one-port insertion loss and return loss measurements give incorrect results. Since there's no block diagram available, I ended up taking apart and reverse engineering the receiver board, shown below. I don't have much previous RF experience, so corrections/suggestions are welcome!

It seems that this unit is a superheterodyne receiver using double conversion, with the 1st LO at 1.5 - 3 GHz, the 2nd LO at ~3 GHz, and a final IF at ~135 MHz. The unit seems to have two separate receiver bands, one for < 2.7 GHz, and the other for 2.7 - 4 GHz ??. There are 2x 5-bit (<= 31 dBm) digital attenuators on the input path, and a 0 - 90 dBm electronic attenuator on the output, although the module seems capable of up to 130 dbm attenuation.

(https://www.dcddcc.com/blog/e7495a/annotated.top.jpg)

Since this unit is designed for portable operation, the internal cables are short and the assemblies are all stacked on top of one another, making it difficult to probe the receiver board with the unit running. I ended up removing the connection panel and flipping the receiver board, which gave me access to its top side. Since the spectrum analyzer and signal generator features work independently, I'm guessing that the fault probably lies on the feedback path from the source output on to the input path, which runs from the coupler through some filters and SPDT switches (from D to A on the annotated image). Interestingly enough, some rework seems to have already been performed on the filters on this path, probably by the factory?

Next, I plan to probe this path while operating the unit in return loss mode, but this will be a bit tricky because I only have a 100 MHz scope, and no other spectrum analyzers or high-frequency probes. However, I do have a RTL-SDR and a LimeSDR, so I can probably make do, and just need to compile the software stack on my laptop.
Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on March 24, 2019, 07:57:44 am
This is the block diagram of the RF part for the N1996A, the bigger brother. It could help because they are very similar.

(https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/?action=dlattach;attach=686250;image)
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on March 24, 2019, 07:59:03 am
@ddcc
Thank You for that picture, during my unit PS repair I was wondering what is inside that box  :popcorn:

Member here Wolfgang made nice FET probe which can be of good use during your repair ->
https://electronicprojectsforfun.wordpress.com/2018/08/03/a-homebrew-fet-probe-to-1-5ghz/

Good luck with the rest of your repair journey.
Title: Re: Agilent E7495 linux root account
Post by: ddcc on March 24, 2019, 06:04:35 pm
Member here Wolfgang made nice FET probe which can be of good use during your repair ->
https://electronicprojectsforfun.wordpress.com/2018/08/03/a-homebrew-fet-probe-to-1-5ghz/

Thanks for the link, looks useful!

This is the block diagram of the RF part for the N1996A, the bigger brother. It could help because they are very similar.

Thanks, I saw the reference to the N1996A earlier in the thread. Some parts are a bit similar; e.g. the four 1st LO filter banks, and two mixers for the 1st and 2nd converters. But otherwise, a lot seems to be different; for example, there doesn't seem to be a 3rd converter, the LO/IF frequencies are different, the attenuator values/positions are different, and the intermediate filters also seem different, although most aren't labeled on the PCB. I'm also not sure why there's a 2.7 - 4 GHz high band on the E7495A, since the instrument is only rated up to 2.7 GHz.
Title: Re: Agilent E7495 linux root account
Post by: Wallace Gasiewicz on March 26, 2019, 07:43:30 pm
Has anyone resolved the GPS lock issue where the yellow triangle stays on and there is no green "lock" on the time/frequency base?

Wally
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 27, 2019, 04:10:46 am
So it turns out that on my unit, the spectrum analyzer, signal generator, and two-port insertion loss features seem to work fine, but the one-port insertion loss and return loss measurements give incorrect results. Since there's no block diagram available, I ended up taking apart and reverse engineering the receiver board, shown below. I don't have much previous RF experience, so corrections/suggestions are welcome!

It seems that this unit is a superheterodyne receiver using double conversion, with the 1st LO at 1.5 - 3 GHz, the 2nd LO at ~3 GHz, and a final IF at ~135 MHz. The unit seems to have two separate receiver bands, one for < 2.7 GHz, and the other for 2.7 - 4 GHz ??. There are 2x 5-bit (<= 31 dBm) digital attenuators on the input path, and a 0 - 90 dBm electronic attenuator on the output, although the module seems capable of up to 130 dbm attenuation.

(https://www.dcddcc.com/blog/e7495a/annotated.top.jpg)

Since this unit is designed for portable operation, the internal cables are short and the assemblies are all stacked on top of one another, making it difficult to probe the receiver board with the unit running. I ended up removing the connection panel and flipping the receiver board, which gave me access to its top side. Since the spectrum analyzer and signal generator features work independently, I'm guessing that the fault probably lies on the feedback path from the source output on to the input path, which runs from the coupler through some filters and SPDT switches (from D to A on the annotated image). Interestingly enough, some rework seems to have already been performed on the filters on this path, probably by the factory?

Next, I plan to probe this path while operating the unit in return loss mode, but this will be a bit tricky because I only have a 100 MHz scope, and no other spectrum analyzers or high-frequency probes. However, I do have a RTL-SDR and a LimeSDR, so I can probably make do, and just need to compile the software stack on my laptop.

Thanks for posting this. I've been waiting a long time to see this (since my unit doesn't have problems, I didn't want to open it).

Can we also get the same picture without annotations -- for A/B comparison to see your notes?

Also, can we get some shots from a low angle (say, 30 degrees up from the plane of the board) so we can see the size and configuration of RF gaskets and such.

Thanks!
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 27, 2019, 04:37:37 am
So it turns out that on my unit ...  Interestingly enough, some rework seems to have already been performed on the filters on this path, probably by the factory?

I'm like you and I don't have much RF experience, my initial reaction to looking at this picture carefully is that I would be surprised that this is factory rework. Upon reading your comment and looking at the path involved (along with your statements about what works and what doesn't), I think we have a repair attempt.

It looks like all of the reworked items are passives, too.

My first guess would be to check the SPDT switch that comes out on the right side of the board at A.  :-//

Title: Re: Agilent E7495 linux root account
Post by: Wallace Gasiewicz on March 28, 2019, 10:35:12 am
I think I am almost ready to do the 6.25 upgrade then the clock/freq hack.
I have the 6.25 files
I have putty and telnet
I have a PCMCIA card and a computer with a working PCMCIA port and windows 7
The PCMCIA card has an old 6.14 upgrade on it.
My new 7495 works fine at present with the exception of the Freq/time issue, yellow triangle, tracks satellites .
Questions:
Can I use telnet to do the upgrade? Or do I copy the old 6.4 to my computer and save it, wipe the card and add
egclient.jar and full 6.25 upgrade to the card? Then use the card in the 7495?
I do not have a Hex reader at present, any recommendations? I have Minipro programmer and have used it several times in the past to work with EPROM. Just converted 8713 to 8714, I have an extra unit if anyone is interested.
I would like to make the hack changes to the files before I upgrade the 7495, are the binary addresses the same?
Can I do that?
I know the hack will not work on my present OS because the binary addresses are not the same. I guess I could look for the lines of code though.

Any help would be appreciated, Wally
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on March 28, 2019, 01:07:45 pm
I would like to make the hack changes to the files before I upgrade the 7495, are the binary addresses the same?
Can I do that?
Hi Wally,

Make sure the hash for the resulting binary is correct. This is a reliable way to know you did the right thing. I'm not sure if it's easy to apply the patch to the upgrade package,
but you can always telnet to E7495 and replace the binary after the upgrade.
See here for sha256 hashes: https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg1212269/#msg1212269 (https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg1212269/#msg1212269)
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on March 28, 2019, 01:30:15 pm
Does anyone know, how to disable HW options? For instance, I removed the power meter board to add a second channel to the E4418B power meter.
I hacked some "registry" files to make it boot, but the power meter option is still there. I want to remove it cleanly.
Title: Re: Agilent E7495 linux root account
Post by: darnelld on March 28, 2019, 09:02:22 pm
root login.. I just picked up this great little box to use a spec an for TRP measurements. For the life of me I can't log in as root. I looked at the securetty file (file contents below) and noticed that I according this, I am not allowed to log in as root over telnet because the ttyp0 and ttyp1 are not allowed. Any ideas how I can get around this?

Thanks!

[guest@E749xx /etc]$cat securetty
# /etc/securetty: list of terminals on which root is allowed to login.
# See securetty(5) and login(1).
#
# Include ttyp0, ttyp1, etc to allow telnet access. *NOT RECOMMENDED*
tty1
tty2
ttyS0
ttyS1
ttyS2
ttyS3
ttyS4
ttyS5
pts/0
pts/1
pts/2
pts/3
pts/4
pts/5
[guest@E749xx /etc]$
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on March 29, 2019, 09:53:17 am
pts/? serves the same purpose as ttyp?. I think the comment about ttyp is obsolete. Have you upgraded to 6.25?
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 29, 2019, 10:42:33 am
Does anyone know, how to disable HW options? For instance, I removed the power meter board to add a second channel to the E4418B power meter.
I hacked some "registry" files to make it boot, but the power meter option is still there. I want to remove it cleanly.

I suppose I have a similar question about the T1 analyzer.

As far as I know, the only way to stop the (very) long T1 analyzer initialization process from going is to disconnect the hardware. Anyone else know a way to stop it while leaving the hardware unchanged?
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on March 29, 2019, 11:33:50 am
As far as I know, the only way to stop the (very) long T1 analyzer initialization process from going is to disconnect the hardware.
When I disconnected the power meter board, it didn't start. So I'm not sure if this is an option with the T1.
The service guide mentions some serial number editing utility which is used to enable HW options...
Title: Re: Agilent E7495 linux root account
Post by: ogden on March 29, 2019, 12:09:35 pm
As far as I know, the only way to stop the (very) long T1 analyzer initialization process from going is to disconnect the hardware. Anyone else know a way to stop it while leaving the hardware unchanged?

Try removing hardware option from elgato.lic. The very beginning of this thread is about adding/hacking software options, maybe removal works same way..
Title: Re: Agilent E7495 linux root account
Post by: darnelld on March 29, 2019, 09:51:33 pm
pts/? serves the same purpose as ttyp?. I think the comment about ttyp is obsolete. Have you upgraded to 6.25?

Actually no, let me give that a try... just got a compact flash to install from
Title: Re: Agilent E7495 linux root account
Post by: technogeeky on March 29, 2019, 11:29:57 pm
As far as I know, the only way to stop the (very) long T1 analyzer initialization process from going is to disconnect the hardware. Anyone else know a way to stop it while leaving the hardware unchanged?

Try removing hardware option from elgato.lic. The very beginning of this thread is about adding/hacking software options, maybe removal works same way..

I should have said I tried this; this does not work.
Title: Re: Agilent E7495 linux root account
Post by: Wallace Gasiewicz on March 30, 2019, 01:30:18 pm
I just did an apparently successful upgrade to 6.25.
However, I cannot do the time/frequency patch
There is no egServer file nor any elgato that I can find anywhere.
[root@Linux /root]$cd /flash goes to [root@Linux /flash]$
cd /egServer : No such file or directory
Any suggestions?
Wally
Title: Re: Agilent E7495 linux root account
Post by: Wallace Gasiewicz on March 30, 2019, 06:39:25 pm
OK I did copy Telnet copy elgato to my computer, Linux is new to me, taking a while to comprehend.
However the binary (HEX) address 0x0122880: does not look like  4b2585e2152882e2 in the very least. I am using Frhed. I replaced it with de2585e23f2882e2 anyway and the e7495 boot stopped at the copywrite screen.
Had to reinstall 6.25 from PCMCIA. e7405 works fine . Yellow triangle still present. Date is 2004

Why is my code different?

UPDATE
I did update to 6.25
I got several copies of the zip all were 23104 KB
unzipped,put on PCMCIA Card
Rebooted the e7495 with the card
Seemed to work fine,
Copied elgato
my copy is 5224025 bytes
another person on this site quoted his file was 5195908 byes
Obviously I cannot do the time/freq patch since I cannot find the correct hex to modify
upgrade files on the PCMCIA are:
xImage  version  reloadFFS  ramdisk.gz
and folders upgrade and firmware_upgrade

what am I doing that is wrong???
what am I missing???
Title: Re: Agilent E7495 linux root account
Post by: ddcc on March 30, 2019, 09:49:46 pm
Can we also get the same picture without annotations -- for A/B comparison to see your notes?

Here's the base image.
(https://www.dcddcc.com/blog/e7495a/annotated.top.base.jpg)

Also, can we get some shots from a low angle (say, 30 degrees up from the plane of the board) so we can see the size and configuration of RF gaskets and such.

Attached are some more images. The gasket seems to just be a separate layer of metal foil that is sandwiched between the PCB and the metal enclosure; I lined it up with the metal walls as shown in the photo.
Title: Re: Agilent E7495 linux root account
Post by: ddcc on March 30, 2019, 09:57:12 pm
I plan to do a writeup with some more photos once (if) I manage to fix this receiver. The odd part about this problem is that the loss measurements are consistently too high, and they don't seem to be affected by whatever is connected to the source port. Today, I had a 10db attenuator connected, so I'd expect around 20db of return loss, but the measurements hit -10db!

The generator definitely seems to be working though, when set to a frequency sweep for 1.5 GHz to 1.5001 GHz return loss measurements, I see the correct signal at the coupled port. I also see some weird reflections at the transmitted port, I'm not sure if this is normal? But I don't think the problem is with any of the switches, because I see the signal all the way back on the analyzer input path (although the signal is radiating enough that I can see it without even probing the board), and because I'd expect the measurements to be super low if the switches failed, since there'd probably still be a bit of parasitic coupling? I'm wondering now if the rework performed on my unit might have something to do with this problem.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on April 01, 2019, 12:14:55 pm
Copied elgato
my copy is 5224025 bytes
another person on this site quoted his file was 5195908 byes
It was definitely LF -> CR-LF converted. FTP transfer in text mode I guess. Switch FTP to binary mode.
Title: Re: Agilent E7495 linux root account
Post by: darnelld on April 01, 2019, 03:52:10 pm
pts/? serves the same purpose as ttyp?. I think the comment about ttyp is obsolete. Have you upgraded to 6.25?

Actually no, let me give that a try... just got a compact flash to install from

unfortunately after a clean install and upgrade to 6.25, I am still having the same issues. I am typing (See me image)
su
password: wh1skers

Title: Re: Agilent E7495 linux root account
Post by: TK on April 01, 2019, 03:59:08 pm
pts/? serves the same purpose as ttyp?. I think the comment about ttyp is obsolete. Have you upgraded to 6.25?

Actually no, let me give that a try... just got a compact flash to install from

unfortunately after a clean install and upgrade to 6.25, I am still having the same issues. I am typing (See me image)
su
password: wh1skers
Isn't it "root" instead of "su" ?
Title: Re: Agilent E7495 linux root account
Post by: darnelld on April 01, 2019, 04:04:52 pm
pts/? serves the same purpose as ttyp?. I think the comment about ttyp is obsolete. Have you upgraded to 6.25?

Actually no, let me give that a try... just got a compact flash to install from

unfortunately after a clean install and upgrade to 6.25, I am still having the same issues. I am typing (See me image)
su
password: wh1skers
Isn't it "root" instead of "su" ?

I think they are the same.. unless I should use the tinylogin?
Title: Re: Agilent E7495 linux root account
Post by: ogden on April 01, 2019, 04:08:27 pm
Isn't it "root" instead of "su" ?

Sure. Username is "root".  Su is *command* which w/o arguments defaults to username "root".

http://man7.org/linux/man-pages/man1/su.1.html (http://man7.org/linux/man-pages/man1/su.1.html)
Title: Re: Agilent E7495 linux root account
Post by: TK on April 01, 2019, 04:53:17 pm
Sorry, I didn't see the tinylogin part.
Title: Re: Agilent E7495 linux root account
Post by: darnelld on April 01, 2019, 09:18:56 pm
pts/? serves the same purpose as ttyp?. I think the comment about ttyp is obsolete. Have you upgraded to 6.25?

Actually no, let me give that a try... just got a compact flash to install from

unfortunately after a clean install and upgrade to 6.25, I am still having the same issues. I am typing (See me image)
su
password: wh1skers
Isn't it "root" instead of "su" ?

I think they are the same.. unless I should use the tinylogin?

Did another clean install and I am in! Now only if I can find how to save data remotely onto my CF card :)
Title: Re: Agilent E7495 linux root account
Post by: ogden on April 01, 2019, 09:55:09 pm
Now only if I can find how to save data remotely onto my CF card :)

Everything you need to know about CF is in this thread (https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg617929/#msg617929).

in short: 1) format CF using E7495 GUI (fat32) 2) save spectrum image to CF - then it is automagically mounted as /mnt (if I remember it right) 3) copy files to/from /mnt (thus CF) as you wish

Title: Re: Agilent E7495 linux root account
Post by: Wallace Gasiewicz on April 02, 2019, 05:30:53 pm
I thought I should provide some conclusion to my problem.
I finally solved the time/freq problem

Many thanks to all of you especially Technogeeky and KirillKa
I put the de2585e23f2882e2 code into the full625 on the PCMCIA card and booted the e7495

I have a nice green light and can do the time base adjustment.

I suppose the new Full625 (with the time/freq change) that I now have may be helpful to some of you.
If anyone wants it I believe I can supply it.
I can supply particulars as to the specific file and location if anyone is interested and want to modify the file themselves

I put the file on Groups.io HP Agilent Keysight Equipment Group
Go to the group and Search for e7495, easier to find post this way
Zipped file is an attachment to my last post

Wally
Title: Re: Agilent E7495 linux root account
Post by: darnelld on April 04, 2019, 08:05:15 pm
Thank you all for information in this thread. Because of it now I have a new toy (A model).

Port 5025 now accepts any login as well, though I was hoping it'd be SCPI (commonly on that port)... instead, it looks like it's something called the "DMC Shell".  Typing "help", it says "The Dmc Shell accepts "C" like function statements and assignments" and gives some examples... not sure how useful it is.
The "DMC shell" looks like some kind debugger. It knows functions and variables of elgato process. I don't think it's useful without source code.
Interesting thing I found that E7495 is supported by toro executable - N1996A server.
I guess, E7495 might be used during N1996A development when N1996 hw was not ready. Maybe E7496 = N1996.
Up to this point I got "toro" running on E7495 with some tweaking. It responds to SCPI and HTTP and looks quite healthy. toroGui starts but it might be useless due to keypad differencies.
Next thing is to deal with license file and options. Spectrum analyser refuses to work without license. I don't expect a lot, because toro doesn't handle E7495 as N1996.
We'll see...

I have read through this thread a few times... I am looking to be able to send scpi commands to save the spec an trace...a LOT of traces (18*36) for a single TRP measurement. This entry says that it repsponds to SCPI and looks healthy, but I haven't seen anyone comment further. If this is the case, any specifics (other than the 6 stop process below) on how to get it done over TCP/IP. This is the only function I am using the device for, so any other suggestions are welcome if SCPI over TCP/IP doesn't work! ...

Either that or I am going to have some very sore fingers from typing in those file names...
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on April 05, 2019, 09:15:40 am
This entry says that it repsponds to SCPI and looks healthy, but I haven't seen anyone comment further.
That was an attempt to run N1996A software on E7495A. The linux part mostly works but I couldn't get anything useful out of it, because it was not able to properly start the spectrum analyser task inside the RF board. The RF board seem to use the Analog Devices' SHARC DSP which is unknown beast to me. If someone could reverse engineer the DSP code, it would definitely take E7495A hacking to the next level.
Title: Re: Agilent E7495 linux root account
Post by: HandBuilt on April 11, 2019, 06:14:10 pm
Hello all,
Thanks for all the info and help on this great unit.

  Well I found out fixing the gasket creep on the screen is an easy fix! Took the front key panel off, removed a ton of small screws to get to the back of the LCD. More screws to get the bezel removed and out came the LCD display.

 The plastic panel on the front is 170mmx225mm / 6.7"x 8.85" X.065" 1.7mm thick lexan. 

 They attached it to the LCD with a rectangular stamped double side black tape or gasket. it pulls in with age and heat I'd guess.

I ordered some precut 1/16 lexan from Ebay and reattached it with clear 3M tape.

Its perfect now!

Cheers

Title: Re: Agilent E7495 linux root account
Post by: ddcc on April 23, 2019, 06:40:29 am
I made some more measurements on my E7495A, but unfortunately nothing on the one-port RF path appears to be obviously broken. Since this thread is getting a little long, I've made a separate post (https://www.eevblog.com/forum/repair/e7495a-1-port-rf-measurements/).
Title: Re: Agilent E7495 linux root account
Post by: jujun on November 09, 2019, 11:08:28 pm
Hello,
Is there a way to allow measurements (S11 and S21) under 375Mhz ?
It seems that nobody reported a working hack.

Thank you
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on November 10, 2019, 10:50:20 pm
Here doing that in old fashion (no hack & Max Hold on) way... with external RLB (S21) and signal generators (S21/S11).

RLB Eagle N5A 5-3000 MHz
SigGen ERASynth or MorFeus
Title: Re: Agilent E7495 linux root account
Post by: ogden on November 10, 2019, 10:56:58 pm
Is there a way to allow measurements (S11 and S21) under 375Mhz ?
It seems that nobody reported a working hack.
Such hack is impossible because hardware of the signal source is limiting factor here.
Title: Re: Agilent E7495 linux root account
Post by: jujun on November 13, 2019, 10:42:22 am
Well, it's still a very useful tool :)

If somebody in Europe owns an optional signal generator assembly and wants to sell it, PM me.

thank you
Title: Re: Agilent E7495 linux root account
Post by: jordi on July 05, 2020, 10:47:38 am
I'm very impressed with the worldwide collaboration here, thanks for the hard work. I got my hands on an "E7495B", but on arrival, I noticed the front label said "L4600A". I turned it on and it has a lot of the basic functions of the "E7495B", after some digging I find out that this unit is the military version (and has some tools to test their FM COM radios). The only item missing is the Power Meter, and I would like to know if I can activate it (and maybe apply the GPS patch). I'm happy to dump the entire flash here, as soon as my CF arrives. I'm attaching the technical overview of the L4600A and my version of my binary file of "elgato", which is different, my version seems to be newer? A07.24 Dev 6. All the offsets to apply the patches that are described here have different data.  =(

I wonder what they used to figure out the patching locations, IDA Pro?



Title: Re: Agilent E7495 linux root account
Post by: PA0PBZ on July 05, 2020, 11:04:29 am
Hi jordi,

It looks like the offset you are looking for in your elgato file is 0x0033E57C, replace 01 00 00 EA with 00 00 A0 E1. No warranties whatsoever but let us know if it worked.
And yes, IDA :)

Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on July 05, 2020, 11:57:05 am
The only item missing is the Power Meter, and I would like to know if I can activate it
The power meter feature requires at least 2 physical boards and 2 connectors (power reference and sensor). Do you have them?

I'm happy to dump the entire flash here, as soon as my CF arrives.
Please, do so. L4600A seems to have some useful signal generator features. It's likely that they can be used on the E7495.

I wonder what they used to figure out the patching locations, IDA Pro?
In my case (GPS patch) I don't remember actually :) Maybe just objdump -d or gdb running on the device or IDA...
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on July 05, 2020, 12:12:26 pm
All the offsets to apply the patches that are described here have different data.  =(
Code: [Select]
$ bgrep "4b 25 85 e2 15 28 82 e2 f6 2d 82 e2" elgato
elgato: 00123c4c
        ^^^^^^^^
So this should be the offset for the GPS patch.
Title: Re: Agilent E7495 linux root account
Post by: jordi on July 06, 2020, 01:11:10 am
 I wanted to take the credit but you guys are faster! I did use my HEX editor, search for the strings, and reached the same offsets:

0x033E57C for .lic trick.. and

0x0123C4C...to fix the GPS. I will report my results.  :box:

Thanks a lot!
Title: Re: Agilent E7495 linux root account
Post by: jordi on July 06, 2020, 04:00:17 am
So I went ahead and applied the patches. Seems like the modules are now activated, so I can confirm it works. :clap: I went "options spree" and activated everything I could (check the picture attached). Power Meter -Option 600- hangs the device during boot, so I went and dig a little and find out I need am extra hardware module, it can be installed tough (I saw a few on eBay).

The GPS fix seems to work (at least it didn't crash or hang the device). But I'm not sure how to test it. If I go to and try to do the time base adjustment, it won't allow me (I press start and it doesn't do anything), maybe I need to have a GPS fix before activating? 

So I noticed a lot of people here had some Linux difficulties, so whoever is trying to patch the elgato in the future, in either device version please read this:
I did run into a problem when I was updating elgato via FTP (which as curiosity detail it means "The Cat" in Spanish, I assume the guy is obsessed with cats, hint: check at the password), somehow after rebooting it will get stuck on the Disclaimer section (I got a little white). I was lucky to spot during the boot sequence the words "not enough access privileges elgato" So I typed on my telnet terminal "ls -l" and I noticed the Linux permissions were not set correctly:

-rw-r--r--    1 root     root      5224820 May 31 20:12 elgato <------Patched
-rwxr-xr-x    1 root     root      5224820 May 27 14:35 elgato.original <------Original backup

I easily fixed it by giving the same file permissions and allow for execution, so type this from the same folder the elgato file is located (via telnet):
chmod u+rwx elgato
chmod go+rx elgato
or all at once (I didn't try it):
chmod 755 elgato

If anyone wants to learn more about permissions please go here https://www.pluralsight.com/blog/it-ops/linux-file-permissions (https://www.pluralsight.com/blog/it-ops/linux-file-permissions) 
Then I reboot and problem solved.   ;D


Title: Re: Agilent E7495 linux root account
Post by: jordi on July 06, 2020, 04:19:50 am
kirill_ka:

No, I don't have the two boards and the 2 connectors. I wonder if the boards can be replicated? Not sure about the connectors, maybe eBay them.

Yes, I can confirm after activation (290) it has now the option to generate a custom waveform, you must create such files on MatLab put them on the CF and run them. No further details, we need to figure it out. If you send me a waveform I can try to run it.

I will try to record some video next week of the menu and GUI, but the "military suite" has an interesting automated tool that can be customized, saved, and loaded them from your external memory (and share them). You select a set of frequencies, Gain, and tolerances and it will tell you if it passes or not. It would be very useful for manufacturing testing or if you happen to test the same devices over and over or you want to let somebody else do it and you have time for advanced training.

Still waiting for my CF to arrive, <2GB cards are not very common anymore and are overpriced. But if you know a trick to just dump the entire "hard drive" via FTP, so I don't do it one by one, please let me know.




Title: Re: Agilent E7495 linux root account
Post by: DogP on July 06, 2020, 06:04:18 am
That's really cool!  The part that's most intriguing to me is option 520 (Low Frequency Extension for Source).  While the E7495 stock sig gen does 375 MHz - 2.5 GHz, it looks like the stock L4600A does 30 MHz - 1 GHz, with options to extend down to 2 MHz and up to 2.5 GHz.  So, if the hardware is actually the same, I guess that means the E7495 can support sig gen down to 2 MHz w/ the L4600A software.

BTW, regarding custom waveforms... I posted this: https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg1054142/#msg1054142 (https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg1054142/#msg1054142) and https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg1054570/?topicseen#msg1054570 (https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg1054570/?topicseen#msg1054570) for making custom waveforms to replace the existing ones.  I'd suspect that the option 290 uses the same arbitrary waveform format (16-bit I/Q), but allows the file to be specified rather than having to replace built-in files (curious what the size limitations are though).  As I mentioned in one of those posts though... the arbitrary waveform generator doesn't suppress the LO or image, so its usefulness is somewhat limited.

DogP
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on July 06, 2020, 07:35:53 am
No, I don't have the two boards and the 2 connectors. I wonder if the boards can be replicated? Not sure about the connectors, maybe eBay them.
Are you sure you are desperate enough? It may be well cheaper and easier just to buy a standalone power meter.
I used the measurement board from my E7495 to populate a second channel in a E4418 power meter.
The board from E7495 has it's own power reference while the E4418 doesn't have the power reference on the measurement board.
That's the only difference I see.
The remaining hw stuff you might be missing:
1. Power reference connector.
2. Sensor connector.
3. Power meter interface board.
4. Sensor cable.
5. The sensor itself.
6. Ribbon cables.

Plus you need to connect all the stuff and enable the option correctly.
If you still want to go this route, I can afford you some parts I have leftover.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on July 06, 2020, 10:45:29 am
Still waiting for my CF to arrive, <2GB cards are not very common anymore and are overpriced.
I think I have 4GB card in my E7495 (can't check it now). Maybe you can use a smaller partition on a bigger card.

But if you know a trick to just dump the entire "hard drive" via FTP, so I don't do it one by one, please let me know.
There are some advanced FTP clients such as lftp or Filezilla. Possibly you need to do some tricks to allow FTP to access the whole filesystem.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on July 06, 2020, 11:26:28 am
The GPS fix seems to work (at least it didn't crash or hang the device). But I'm not sure how to test it. If I go to and try to do the time base adjustment, it won't allow me (I press start and it doesn't do anything), maybe I need to have a GPS fix before activating? 
Do you have a GPS antenna connector (as pictured in the datasheet)? If not, you might be missing a receiver module.
No, the fix is not required. You should be able to set GPS as a frequency reference. When it's locked (needs an external antenna), you should see a green circle and time/date synchronized with the GPS.

I've extracted and comapred strings from E7495 and L4600A versions of the elgato.
The following looks like new options appeared on the L4600A:
FM Analyzer & Signal Generator
Low Frequency Extension for Source
PCMCIA IQ Modulation for Signal Generator
GPS Receiver
FM Audio Output Connector
Title: Re: Agilent E7495 linux root account
Post by: jordi on July 06, 2020, 11:26:06 pm

BTW, regarding custom waveforms... I posted this: https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg1054142/#msg1054142 (https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg1054142/#msg1054142) and https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg1054570/?topicseen#msg1054570 (https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg1054570/?topicseen#msg1054570) for making custom waveforms to replace the existing ones.  I'd suspect that the option 290 uses the same arbitrary waveform format (16-bit I/Q), but allows the file to be specified rather than having to replace built-in files (curious what the size limitations are though).  As I mentioned in one of those posts though... the arbitrary waveform generator doesn't suppress the LO or image, so its usefulness is somewhat limited.

DogP

Very, very cool, I will give it a look on my next weekend. Thanks for sharing!
Title: Re: Agilent E7495 linux root account
Post by: jordi on July 06, 2020, 11:31:15 pm
Are you sure you are desperate enough? It may be well cheaper and easier just to buy a standalone power meter.
I used the measurement board from my E7495 to populate a second channel in a E4418 power meter.
The board from E7495 has it's own power reference while the E4418 doesn't have the power reference on the measurement board.
That's the only difference I see.
The remaining hw stuff you might be missing:
1. Power reference connector.
2. Sensor connector.
3. Power meter interface board.
4. Sensor cable.
5. The sensor itself.
6. Ribbon cables.

Plus you need to connect all the stuff and enable the option correctly.
If you still want to go this route, I can afford you some parts I have leftover.
No, you are right, I don't even have the internal hardware. I purchased another E7495B which has the port, maybe I will fool with it a little. PM the stuff you have.

I need an accurate power meter to calibrate my radios at ISM bands between 1Watts to 1.5Watts.
Title: Re: Agilent E7495 linux root account
Post by: jordi on July 06, 2020, 11:38:55 pm
Do you have a GPS antenna connector (as pictured in the datasheet)? If not, you might be missing a receiver module.
No, the fix is not required. You should be able to set GPS as a frequency reference. When it's locked (needs an external antenna), you should see a green circle and time/date synchronized with the GPS.

I've extracted and comapred strings from E7495 and L4600A versions of the elgato.
The following looks like new options appeared on the L4600A:
FM Analyzer & Signal Generator
Low Frequency Extension for Source
PCMCIA IQ Modulation for Signal Generator
GPS Receiver
FM Audio Output Connector

Niet, I'm ordering an active antenna, the one I have here uses 3.3V, intended for an uBlox module. I might have blown it, the E7595 GPS SMA port is outputting 5V (bias). I will report on that.

Whoever, on the bottom left of the main screen I see "GPS Unlocked", and on the bottom right of the main screen is a green dot with "Int Ref" label. So even without fixing any sats, it is capable to grab the clocks? Interesting.

Thanks!
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on July 07, 2020, 07:06:09 am
Whoever, on the bottom left of the main screen I see "GPS Unlocked", and on the bottom right of the main creen is a green dot with "Int Ref" label. So even without fixing any sats, it is capable to grab the clocks? Interesting.
Int Ref means the internal TXCO. Unfortunately I can't provide you with screenshots this time.
Anyway, you need to get the GPS receiver locked first. Take a look into the "Displaying Location Information Using GPS" section of the "E7495A/B Measurement Guide".
Title: Re: Agilent E7495 linux root account
Post by: jordi on July 07, 2020, 08:25:11 am
Whoever, on the bottom left of the main screen I see "GPS Unlocked", and on the bottom right of the main creen is a green dot with "Int Ref" label. So even without fixing any sats, it is capable to grab the clocks? Interesting.
Int Ref means the internal TXCO. Unfortunately I can't provide you with screenshots this time.
Anyway, you need to get the GPS receiver locked first. Take a look into the "Displaying Location Information Using GPS" section of the "E7495A/B Measurement Guide".

I got GPS fix! Unfortunately, it won't let me do the time base adjustment, I press the button and it will not allow me to continue, it doesn't say anything. I restored the elgato, but resulted in the same issue. The seller gave me the option to exchange it for a real "E7495B", I will probably do so (after I dump the drive). 
Title: Re: Agilent E7495 linux root account
Post by: DogP on July 07, 2020, 09:38:15 am
The seller gave me the option to exchange it for a real "E7495B", I will probably do so (after I dump the drive).
I wouldn't exchange it!  It seems like the L4600A is a better unit all around (better freq. range, better options, etc)... unless you can confirm that the L4600A software will truly turn the E7495 into an L4600A.

DogP
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on July 07, 2020, 10:05:19 am
I got GPS fix! Unfortunately, it won't let me do the time base adjustment, I press the button and it will not allow me to continue, it doesn't say anything. I restored the elgato, but resulted in the same issue. The seller gave me the option to exchange it for a real "E7495B", I will probably do so (after I dump the drive).
Maybe you need to set clock reference to the GPS before you do the adjustment.
L4600A seems to be a newer hardware, I wouldn't exchange it too.
It looks like they at least fixed very fragile PCB RF connections:
https://www.ebay.com/itm/Agilent-L4600A-Board-Assembly-ATO-70067-Sr-no-US48120110-AS-IS-Untested/124245776467 (https://www.ebay.com/itm/Agilent-L4600A-Board-Assembly-ATO-70067-Sr-no-US48120110-AS-IS-Untested/124245776467)
Title: Re: Agilent E7495 linux root account
Post by: jordi on July 07, 2020, 07:51:57 pm
All right I will keep it then, thanks for the advice. My CF arrived, but I'm having problems copying some of the files, a few of them I can't even copy to Windows because the name is supposedly very long, but they are not (I will switch to Linux).

Also, it was funny to copy mnt into mnt, I didn't catch the loop.

With that said, what are the most important folders that should focus to rescue? Besides the flash folder of course. I already got out the easy ones: bin, etc, and home folder.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on July 07, 2020, 08:55:44 pm
Approach 1:
It seems that the firmware contains gnu tar (maybe it's located in elgato/utils).
You can check what filesystems you have with "mount"
or "cat /proc/mounts"
Then dump them individually  with
tar --one-file-system cvfz  /mnt/fs1.tgz /fs1_mount_point
Where /fs1_mount_point is the mount point you see in the list of mounts above.
Skip virtual and temporary filesystems such as /proc.

Approach 2:
cp /dev/mtdsomething /mnt/mtdsomething.raw
This way you can get a raw flash images (of individual flash partitions or the whole flash chip).
The device names (mtdsomething) you can get from the list of mounts as described above.

I suggest you do both, because the latter approach is good for backup and replication.
The former one gets the files easily accessible.

I can give you the exact commands in a week or so when I return to home.
Or just PM me the output of
cat /proc/mtd
cat /proc/mounts
tar --version
gzip --version
ls -lR /
dmesg

Redirect command outputs to  files with "> filename"
Title: Re: Agilent E7495 linux root account
Post by: jordi on July 07, 2020, 10:30:40 pm
Here is the L4600A dump.

https://j07m.s3-us-west-1.amazonaws.com/Public/L4600A_dump.zip (https://j07m.s3-us-west-1.amazonaws.com/Public/L4600A_dump.zip)

If you see something else interesting please let me know.

Now, I would like to know why the Time Based Calibration doesn't work. =(
Title: Re: Agilent E7495 linux root account
Post by: jordi on July 07, 2020, 10:38:27 pm
Yes, the second approach is the good one, I will try it. Here are my outputs:

Code: [Select]
[root@Linux /root]$cat /proc/mtd
dev:    size   erasesize  name
mtd0: 04000000 00040000 "Physically mapped flash"
mtd1: 00100000 00040000 "zImage"
mtd2: 00300000 00040000 "ramdisk.gz"
mtd3: 03c00000 00040000 "User FS"
[root@Linux /root]$cat /proc/mounts
rootfs / rootfs rw 0 0
/dev/root / ext2 rw 0 0
/proc /proc proc rw 0 0
none /dev/pts devpts rw 0 0
/dev/mtdb3 /flash jffs2 rw 0 0
[root@Linux /root]$tar --version
tar: unrecognized option `--version'
BusyBox v0.60.3 (2002.06.05-19:04+0000) multi-call binary

Usage: tar -[cxtvO] [--exclude FILE] [-X FILE][-f TARFILE] [-C DIR] [FILE(s)] ...

Create, extract, or list files from a tar file.

Options:
        c               create
        x               extract
        t               list

File selection:
        f               name of TARFILE or "-" for stdin
        O               extract to stdout
        exclude         file to exclude
        X               file with names to exclude
        C               change to directory DIR before operation
        v               verbosely list files processed

[root@Linux /root]$gzip --version                                                                                                                                             gzip: invalid option -- -
BusyBox v0.60.3 (2002.06.05-19:04+0000) multi-call binary

Usage: gzip [OPTION]... FILE

Compress FILE with maximum compression.
When FILE is '-', reads standard input.  Implies -c.

Options:
        -c      Write output to standard output instead of FILE.gz
        -d      decompress

[root@Linux /root]$ls IR /
ls: IR: No such file or directory

/:
bin         etc         home        linuxrc     mnt         proc        root        tmp         var
dev         flash       lib         lost+found  nfs         rd          sbin        usr         xdrive
[root@Linux /root]$dmesg
360K data, 88K init)
Dentry cache hash table entries: 8192 (order: 4, 65536 bytes)
Inode cache hash table entries: 4096 (order: 3, 32768 bytes)
Mount-cache hash table entries: 1024 (order: 1, 8192 bytes)
Buffer-cache hash table entries: 4096 (order: 2, 16384 bytes)
Page-cache hash table entries: 16384 (order: 4, 65536 bytes)
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
sa1111_pcibuf: initializing SA-1111 DMA workaround
SA1111 Microprocessor Companion Chip: silicon revision 1, metal revision 1
Starting kswapd
JFFS version 1.0, (C) 1999, 2000  Axis Communications AB
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
ttyS0 at I/O 0xf0100000 (irq = 50) is a 16550A
ttyS1 at I/O 0xf0120000 (irq = 51) is a 16550A
ttyS2 at I/O 0xf0140000 (irq = 52) is a 16550A
ttyS3 at I/O 0xf0160000 (irq = 54) is a 16550A
ttySA0 at MEM 0x80050000 (irq = 17) is a SA1100
ttySA1 at MEM 0x80010000 (irq = 15) is a SA1100
ttySA2 at MEM 0x80030000 (irq = 16) is a SA1100
Console: switching to colour frame buffer device 80x30
initialize_kbd: Keyboard reset failed, no ACK
Keyboard timed out[1]
keyboard: Timeout - AT keyboard not present?
Keyboard timed out[1]
keyboard: Timeout - AT keyboard not present?
pty: 256 Unix98 ptys configured
UCB1200 generic module installed
ucb1200 touch screen driver initialized
ucb1200 adc driver initialized
UCB1200 audio driver version 2.2 initialized
UCB1200 audio driver Click-Avoid patch: TT <tthaele@papenmeier.de>
UCB1200 Mixer driver version 0.1 initialized. TT <tthaele@papenmeier.de>
smartio driver initialized. version 1.10, date:28-Jun-2002
SmartIO ID     : 0x5002
Device Version : 5(0x35)
Device Type    : 0x8535
SA1100 Real Time Clock driver v1.00
Uniform Multi-Platform E-IDE driver Revision: 6.31
ide: Assuming 50MHz system bus speed for PIO modes; override with idebus=xx
smc9194.c:v0.14 12/15/00 by Erik Stahlman (erik@vt.edu)
eth0: SMC91C96(r:9) at 0xf00e0000 IRQ:58 INTF:TP MEM:6144b ADDR: 00:60:0c:01:37:05
RAMDISK driver initialized: 16 RAM disks of 8192K size 1024 blocksize
loop: loaded (max 8 devices)
PPP generic driver version 2.4.2
Sound: SA1111 UDA1341: dsp id 3 mixer id 0
SA1111 audio out: SA-1111 SAC DMA channel 6 in use
DMA request for SAC output failed
physmap flash device: 4000000 at 8000000
Physically mapped flash: Found 2 x16 devices at 0x2000000 in 32-bit mode
0: offset=0x0,size=0x40000,blocks=128
1: offset=0x2000000,size=0x40000,blocks=128
Using buffer write method
SA1100 flash: probing 32-bit flash bus
SA1100 flash: Found 2 x16 devices at 0x2000000 in 32-bit mode
0: offset=0x0,size=0x40000,blocks=128
1: offset=0x2000000,size=0x40000,blocks=128
Using buffer write method
Using static partition definition
Creating 3 MTD partitions on "SA1100 flash":
0x00000000-0x00100000 : "zImage"
0x00100000-0x00400000 : "ramdisk.gz"
0x00400000-0x04000000 : "User FS"
Linux Kernel Card Services 3.1.22
  options:  [pm]
SA-1100 PCMCIA (CS release 3.1.22)
usb.c: registered new driver usbdevfs
usb.c: registered new driver hub
hcd/ohci-sa1111.c: starting SA-1111 OHCI USB Controller
hcd/ohci-sa1111.c: ohci-hcd (SA-1111) at 0xf4000400, irq 109

usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 1 port detected
usb.c: registered new driver hiddev
usb.c: registered new driver hid
hid-core.c: v1.8.1 Andreas Gal, Vojtech Pavlik <vojtech@suse.cz>
hid-core.c: USB HID support drivers
mice: PS/2 mouse device common for all mice
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 4096 bind 4096)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NetWinder Floating Point Emulator V0.95 (c) 1998-1999 Rebel.com
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 3072K
EXT2-fs warning: checktime reached, running e2fsck is recommended
VFS: Mounted root (ext2 filesystem).
Freeing init memory: 88K
hub.c: USB new device connect on bus1/1, assigned device number 2
hub.c: USB hub found
hub.c: 4 ports detected
enable_irq(115) unbalanced from c032558c
Trying to free nonexistent resource <ce8b7000-ce8b700f>
hda: CF Card, ATA DISK drive
ide0 at 0xce8b7000-0xce8b7007,0xce8b700e on irq 115
hda: task_no_data_intr: status=0x51 { DriveReady SeekComplete Error }
hda: task_no_data_intr: error=0x04 { DriveStatusError }
hda: 3902976 sectors (1998 MB) w/1KiB Cache, CHS=242/255/63
Partition check:
 hda: hda1
ide_cs: hda: Vcc = 3.3, Vpp = 0.0
VFS: Can't find ext2 filesystem on dev ide0(3,1).
cramfs: wrong magic
VFS: Can't find ext2 filesystem on dev ide0(3,1).
cramfs: wrong magic
AVR driver initialized. version 1.1, date:Aug  6 2004
VFS: Can't find ext2 filesystem on dev ide0(3,0).
cramfs: wrong magic
FAT: bogus logical sector size 64543
VFS: Can't find a valid FAT filesystem on dev 03:00.
JFFS: Trying to mount a non-mtd device.
jffs2: attempt to mount non-MTD device 03:00
VFS: Can't find ext2 filesystem on dev ide0(3,1).
cramfs: wrong magic
Title: Re: Agilent E7495 linux root account
Post by: jordi on July 07, 2020, 11:08:27 pm
I used DD, not sure if it will work:

Code: [Select]
[root@Linux /]$dd if=/dev/mtdb3 of=/mnt/mtdb3.img bs=32                                                                                                                       
1966080+0 records in                                                                                                                                                         
1966080+0 records out                                                                                                                                                         
[root@Linux /]$ls -l /mnt                                                                                                                                                   
-rwxr-xr-x    1 root     root     62914560 Jul  7 23:06 mtdb3.img                                                                                                             
-rwxr-xr-x    1 root     root       157280 Jul  7 22:54 printScreen.png                                                                                                       
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on July 08, 2020, 07:16:23 am
I used DD, not sure if it will work:
Thanks for the dump!
Yes, dd suites better for the task. I thought there's no dd there.
03c00000 = 62914560 so the size of mtdb3.img is correct.
It would be a good idea to dump the whole flash (mtd0) so you have a whole image if something goes wrong (and, please, share it too).
You may want to set bs=1024 or something so it would go faster.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on July 08, 2020, 07:21:08 am
Quote
[root@Linux /root]$tar --version
tar: unrecognized option `--version'

It's a crippled  busybox version.
Gnu tar is at /flash/elgato/utils/tar
Title: Re: Agilent E7495 linux root account
Post by: jordi on July 10, 2020, 12:18:27 am
Do you think it got corrupted after the transfer? I can dump it again for you or just go straight for the raw dump.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on July 10, 2020, 02:15:12 pm
Do you think it got corrupted after the transfer? I can dump it again for you or just go straight for the raw dump.
No, I think all the needed files are copied ok. A bit of inconvenience is that unix permissions are not saved. But if you do a raw flash dump I should be able to extract them.
I noted the version of tar as the backup procedure I described as "Approach 1" requires GNU tar.
Title: Re: Agilent E7495 linux root account
Post by: jordi on July 11, 2020, 07:21:11 pm
kirill_ka,

Here is the image generated with the DD command from above:

https://j07m.s3-us-west-1.amazonaws.com/Public/mtdb3.img (https://j07m.s3-us-west-1.amazonaws.com/Public/mtdb3.img)

Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on July 11, 2020, 08:49:38 pm
For the very unlikely case someone wants to reverse engineer DSP code for the E7495,
I want to share my findings about the format of DSP .bin files.

The DSP is Analog Devices SHARC 21160M.

egServer/Dragonfly/Measurements/UserCode/*.bin
length of blob1 (32bit, LE)
blob1 (SHARC code)
length of blob2 (32bit, LE)
blob2 (unknown)
length of blob3 (32bit, LE)
blob3 (unknown)
blob4 (unknown)

egServer/Dragonfly/Firmware/E7495A/run.bin
egServer/Dragonfly/Firmware/E7495A/setu.bin
egServer/Dragonfly/Firmware/CPXSRC/run.bin
egServer/Dragonfly/Firmware/CPXSRC/setu.bin

12 byte header or some setup code
flash image

The flash image starts from SHARC code in a weird byte order.

I used unidasm utility from the MAME project to look at the SHARC assembly.
The unidasm doesn't get all the opcodes from 21160M right, but most of the code looks ok.

I'm attaching Tcl script I use to prepare code for unidasm.
Here's how to call it for Firmware:
Code: [Select]
./reord.tcl 12 12 '2 3 0 1 6 7 p p 4 5 10 11 8 9 p p' run.bin tmp.bin
./unidasm -arch sharc tmp.bin

And for UserCode:
Code: [Select]
./reord.tcl 4 6 '5 4 3 2 1 0 p p' demod.bin tmp.bin
./unidasm -arch sharc tmp.bin

bloblist.tcl is for splitting UserCode files.
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on July 11, 2020, 09:27:34 pm
kirill_ka,

Here is the image generated with the DD command from above:

https://j07m.s3-us-west-1.amazonaws.com/Public/mtdb3.img (https://j07m.s3-us-west-1.amazonaws.com/Public/mtdb3.img)

Thank you very much! The image is good.
Could you dump mtdb0 as well?
Title: Re: Agilent E7495 linux root account
Post by: jordi on July 11, 2020, 10:19:13 pm
Quote
Thank you very much! The image is good.
Could you dump mtdb0 as well?

Sure, I have it in my office. I'll try on Monday.

May I ask you, do you know where the piece of code to do the GPS timebase calibration lives? I got a real E7495B and the calibration option works fine. Seems like the files might be corrupted or missing on my L4600A.

Warmly
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on July 12, 2020, 07:19:50 am
May I ask you, do you know where the piece of code to do the GPS timebase calibration lives? I got a real E7495B and the calibration option works fine. Seems like the files might be corrupted or missing on my L4600A.
It won't be localized in one particular place. It should start from GUI then elgato executable and then downstream to the hardware. I think it's a good idea to check the clock externally (what goes on if you change the reference). It may be well possible that the L4600A does the adjustment automatically.
If the code from L4600 runs on my E7495A, I'd check what happens to the time adjustment function.
Title: Re: Agilent E7495 linux root account
Post by: jordi on July 13, 2020, 08:38:51 pm
Quote

Thank you very much! The image is good.
Could you dump mtdb0 as well?

https://j07m.s3-us-west-1.amazonaws.com/Public/mtdb1.img (https://j07m.s3-us-west-1.amazonaws.com/Public/mtdb1.img)
https://j07m.s3-us-west-1.amazonaws.com/Public/mtdb2.img (https://j07m.s3-us-west-1.amazonaws.com/Public/mtdb2.img)

I thought I dumped all of them, but I realize mtdb0 is missing, I need to take the machine back home. Hope mtdb1 and 2 might also be useful. 

Warmly,
Title: Re: Agilent E7495 linux root account
Post by: jordi on July 14, 2020, 06:56:05 pm
Code: [Select]
[root@Linux /dev]$dd if=/dev/mtdb0 of=mtdb0.img bs=1024
dd: /dev/mtdb0: No such device

It didn't allow me.  :(
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on July 17, 2020, 03:35:22 pm
Code: [Select]
[root@Linux /dev]$dd if=/dev/mtdb0 of=mtdb0.img bs=1024
dd: /dev/mtdb0: No such device

It didn't allow me.  :(

Thanks, it should be just a concatenation of other three images. It's not needed as you posted the other ones.

Now I played with the L4600 software for some time.

Good things:
* It does run on the E7495
* FM modulation is working.
* User-defined modulation files should work (I haven't tried it yet).
* FM analyzer is working.
* Source Level adjustment in the "Two port insertion loss" mode adjusts the amplitude smoothly above  -25dBm.

Bad things:
* The calibration is off.
* The generator is not working below 375MHz.
* GPS can't be used as a frequency reference (it's not even listed). I think it's the same problem jordi has on the L4600A.
Title: Re: Agilent E7495 linux root account
Post by: eplpwr on September 04, 2020, 12:23:20 pm
My E7495A refused to work on battery. Now I regret that I dig into this. It took so much time...
The issue that was looking like a component failure appeared to be a pure software thing.
There is some SMBUS/Smart battery ugliness. Anyway, now I know quite a lot about this module.
I can help with diagnostics and repair.

I have an E7495B that refuses to work on batteries. I bought brand new batteries - 2 pcs Inspired Energy, type NI2040ED29 - from accutronics.co.uk . (The batteries were more expensive than the E7495B.)

When running on external power, everything works fine; the batteries are identified and charged - the battery information screen looks just fine with charging status and voltages correctly presented. The problem is, when booting up on battery power it passes the initial BIOS screens and then just powers off itself. Any information on how/where to rectify this would be most welcome.

Best regards,

eplpwr
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on September 04, 2020, 01:31:35 pm

I have an E7495B that refuses to work on batteries. I bought brand new batteries - 2 pcs Inspired Energy, type NI2040ED29 - from accutronics.co.uk . (The batteries were more expensive than the E7495B.)

When running on external power, everything works fine; the batteries are identified and charged - the battery information screen looks just fine with charging status and voltages correctly presented. The problem is, when booting up on battery power it passes the initial BIOS screens and then just powers off itself. Any information on how/where to rectify this would be most welcome.

Best regards,

eplpwr

Yes, the symptoms are very similar to what I have seen. However that's not enough to be sure.
Do you see any glitches while charging? For example, something's like incorrect charge % or battery leds change unexpectedly.
What happens to the leds while booting on battery?
Title: Re: Agilent E7495 linux root account
Post by: m6sso on September 12, 2020, 10:52:08 pm
Hello all,

Im pretty new to Linux hacking and i have a Agilent E7495A that i am trying to do the licence hack on. Is there a pre-made file with all options enabled. Currently I have these options installed

200-cdmaOne/CDMA 2000 Analyzer
210 cdmaOne/CDMA 200 Over air test
220 Channel scanner
510 CW & Complex modulation signal Generator
600 Power Meter
700 T1 analyser

I have pulled off the Elgato file from egServer.

hope someone can help.

TIA
Title: Re: Agilent E7495 linux root account
Post by: jordi on September 14, 2020, 03:30:58 am
Hello all,

Im pretty new to Linux hacking and i have a Agilent E7495A that i am trying to do the licence hack on. Is there a pre-made file with all options enabled. Currently I have these options installed

200-cdmaOne/CDMA 2000 Analyzer
210 cdmaOne/CDMA 200 Over air test
220 Channel scanner
510 CW & Complex modulation signal Generator
600 Power Meter
700 T1 analyser

I have pulled off the Elgato file from egServer.

hope someone can help.

TIA

Hello Tia,

No, I don't think there is a premade file (we all had to mod ours). If you upload it, we can verify if is correct. When el gato is modified correctly (and installed), you must manually add the licenses by modifying the other file (forgot the name).
Title: Re: Agilent E7495 linux root account
Post by: m6sso on September 14, 2020, 01:45:40 pm
Hello all,

Im pretty new to Linux hacking and i have a Agilent E7495A that i am trying to do the licence hack on. Is there a pre-made file with all options enabled. Currently I have these options installed

200-cdmaOne/CDMA 2000 Analyzer
210 cdmaOne/CDMA 200 Over air test
220 Channel scanner
510 CW & Complex modulation signal Generator
600 Power Meter
700 T1 analyser

I have pulled off the Elgato file from egServer.

hope someone can help.

TIA

Hello Tia,

No, I don't think there is a premade file (we all had to mod ours). If you upload it, we can verify if is correct. When el gato is modified correctly (and installed), you must manually add the licenses by modifying the other file (forgot the name).

I've uploaded the original .lic file, the modded version i made and the current version of elgato that is installed on the device. They are inside the zip file. 

all files are untouched apart from the modded .lic file.

Title: Re: Agilent E7495 linux root account
Post by: tv84 on September 14, 2020, 03:01:20 pm
Can anyone provide a (RAM) memdump of E7495A running? Preferably, with valid options running.

(Copying /dev/mem should be sufficient, if possible.)
Title: Re: Agilent E7495 linux root account
Post by: m6sso on September 14, 2020, 05:18:36 pm
Just though I'd add this for you lot if you dont have the calibration kit (50Ohm open, Load and short) there is a cheap set on flebay that works great.


https://www.ebay.com/itm/3pcs-DC-3GHz-Network-Analyzer-Sitemaster-Calibrator-OPEN-SHORT-LOAD-N-Male-40db/274117305821?_trksid=p2485497.m4902.l9144 (https://www.ebay.com/itm/3pcs-DC-3GHz-Network-Analyzer-Sitemaster-Calibrator-OPEN-SHORT-LOAD-N-Male-40db/274117305821?_trksid=p2485497.m4902.l9144)
Title: Re: Agilent E7495 linux root account
Post by: 9aplus on September 14, 2020, 08:06:24 pm
Can anyone provide a (RAM) memdump of E7495A running? Preferably, with valid options running.

(Copying /dev/mem should be sufficient, if possible.)
Can try to do on 7495B in case you have no luck with A
Title: Re: Agilent E7495 linux root account
Post by: kirill_ka on September 15, 2020, 08:09:41 am
Can anyone provide a (RAM) memdump of E7495A running? Preferably, with valid options running.

(Copying /dev/mem should be sufficient, if possible.)

I don't think it's that easy. /dev/mem is not the RAM representation. It gives access to a physical address space. It's not contiguous and may not be safe to access. I think that "cp /dev/ram" would just  fail.
https://superuser.com/questions/71389/what-is-dev-mem

If you're interested in one particular application (process), you would need a core file.
Title: Re: Agilent E7495 linux root account
Post by: tv84 on September 27, 2020, 08:04:44 am
For options you don't need to continue patching the "the cat" file.

Here (https://www.eevblog.com/forum/testgear/agilent-n1996a-software-unlock/msg3251066/#msg3251066).  ;)