Agilent N1996A software unlock

[yamakasi8686]

Hello, everybody.
I have an old Agilent N1996A spectrum analyzer.
Could you to help me software unlock tis device to have got more option? How can I get root?

[PA0PBZ]

Did you try to search the forum?

[yamakasi8686]

Hello, PA0PBZ, thanks for your responce.
Ofcourse, I tried.
I had red the post: https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/ , but I can't start FTP session on my N1996A, all my login/password do not right.

[PA0PBZ]

You have mail.

[geekdoug]

I know this is an older thread, but I'm having the same issue. I've been through the other thread, but keep hitting roadblocks. Any help would be appreciated!!

[PA0PBZ]

You got mail.

[startronic]

Hello PAOPBZ

you can also send root to min for the N1996a

tanks

[analogRF]

Hi
I have got a N9320B spectrum analyzer which is stuck at boot. after the Agilent splash screen there is a Keysight logo splash screen and then it gets stuck on that screen.
I am hoping I can connect to it through the LAN port (haven't tried yet) but I have no idea what the root username and password might be.
I thought maybe the passwd from N1996A could work if someone can send it to me.

BTW, I tried the USB host at the back but it was not detected on my laptop

I was also thinking maybe a CMOS reset (taking out the CMOS battery which is the only thing accessible on CPU board) might do something, any advice? I have no idea about its past history. All I know is that it came from a university lab and apparently it just stopped booting one day

[TheSteve]

The N9320B and N1996A don't share any hardware/design as far as I know.

[tv84]

With this picture, you don't need patching... 

[analogRF]

With this picture, you don't need patching... 

this is not for N9320B, is it?

[tv84]

this is not for N9320B, is it?

  Can't you test it?

[analogRF]

this is not for N9320B, is it?

  Can't you test it?

not at the moment because i dont have access to it for a while (it's all opened and boards are piled up for later because needs repair)
but I dont think it is based on flexlm. I have looked into the debug port many times and i have also looked around the instrument's flash rom
Never saw any reference to flexlm anywhere.

[rogersstuart]

I tried to enable an option on the N1996A through the UI and neither of those keys worked. How should I use them?

[PA0PBZ]

I tried to enable an option on the N1996A through the UI and neither of those keys worked. How should I use them?

From memory: enter the option, then enter the generated key.
If you want help post your hostid, the option and the key you generated and we can have a look.

Or if you don't want to post that public send me a PM with the same.

[rogersstuart]

Actually, I just typed in what I saw in the screenshot a few posts back. So, there's a FLEXlm keygen? My host ID is 307929DE. Most of the options are enabled. I just figured it fully option it out. The only locked options remaining are 271 Spectrogram, AFM AM/FM Tune and Listen, and N8996A-1FP AM/FM Modulation Analyzer. There's also 330-380 but I think those are installable programs that Agilent/Keysight used to offer.

[rogersstuart]

Okay, so I was able to telnet in. I'm not exactly sure what I should be looking for. I did search Google for the key generator in the image but I wasn't able to quickly find anything. I would try adding a line to this file but surely there's more security than that?

guest@N1996A:/flash/toroServer/license$ cat elgato.lic
FEATURE GPS agilent 1.000 permanent uncounted \
        HOSTID=ID_STRING=307929DE
FEATURE P03 agilent 1.000 permanent uncounted \
        HOSTID=ID_STRING=307929DE
FEATURE 500 agilent 1.000 permanent uncounted \
        HOSTID=ID_STRING=307929DE
FEATURE 503 agilent 1.000 permanent uncounted \
        HOSTID=ID_STRING=307929DE
FEATURE 506 agilent 1.000 permanent uncounted \
        HOSTID=ID_STRING=307929DE SIGN=B7C02E16A4D2
FEATURE P06 agilent 1.000 permanent uncounted \
        HOSTID=ID_STRING=307929DE SIGN=959C790C5ECC
FEATURE TG3 agilent 1.000 permanent uncounted \
        HOSTID=ID_STRING=307929DE
FEATURE TG6 agilent 1.000 permanent uncounted \
        HOSTID=ID_STRING=307929DE
FEATURE 271 agilent 1.000 permanent uncounted \
        HOSTID=ID_STRING=307929DE
FEATURE N8995A agilent 1.000 permanent uncounted \
        HOSTID=ID_STRING=307929DE
FEATURE N8995A-SR6 agilent 1.000 permanent uncounted HOSTID=ID_STRING=307929DE \
        SIGN=4D9A17588B14

[PA0PBZ]

Only the options where the second line contain a SIGN= are enabled. Try to add the SIGN= to the line below FEATURE 271 like this:

FEATURE 271 agilent 1.000 permanent uncounted \
   HOSTID=ID_STRING=307929DE SIGN=EE8797F25E0C

That should enable the waterfall (option 271), give it a try and let me know.
You can also enter the option without changing the file using 271 and the SIGN in the menu.

[rogersstuart]

That worked. Thank you! Out of curiosity, did you use a keygen or is there a table of these codes? I'd like to enable all of the listed options and see what I get.

[rogersstuart]

If you don't mind me asking here, I have a general question about spectrum analyzers. I've never touched a new and/or freshly calibrated unit, so I'm a bit unsure about how their output is supposed to look. The last one I owned had a function where I could attach a 50 ohm load and it would self calibrate and kind of "flatten" out a bit. This particular unit has a discontinuity around 2.7 GHz and no self calibration procedure. Is this simply an artifact caused by the architecture or is it a sign that it needs to be sent in for servicing?

[TheSteve]

The N1996A switches bands internally at 2.7 GHz which is why you see some changes there.
That is also a hint that both the 3 and 6 GHz models have 6 GHz hardware in them

[PA0PBZ]

You can even see this 'wobble' at 2.7GHz in the product brochure so I consider it as normal.

I have a keygen which unfortunately I can't share for undisclosed reasons, but if you tell me what options you still need I will generate the keys for you.
Here's what I think you need:

AFM               D8031F9C907E
N8996A-1FP   D146D7D42F30

[TheSteve]

Some fun stuff for those of you with a 3 GHz N1996A:

***All done at your own risk***

Login via telnet and go to:

/flash/toroServer/Dragonfly/Receivers

Make a backup of the original 3 GHz profile:

cp  N1996A-503  N1996A-503-orig


Copy the 6 GHz profile to the 3 GHz profile:

cp  N1996A-506  N1996A-503

Reboot and your N1996A will now go to 6 GHz instead of 3 GHz!
The amplitude will not be at the proper calibrated level from 3 to 6 GHz as there is no cal data beyond 3 GHz. It is still very useful for relative measurements.
The tracking gen also works to 6 GHz and will normalize fine.

And while you're messing about how about changing the start frequency of the tracking generator from 10 MHz to 1 MHz:

Edit "Start  10e6^M" to "Start  1e6^M" in the file "N1996A-503" you just copied. This is very useful for checking out antennas in the amateur radio HF spectrum.

One other thing I found useful at times was enabling permanent ftp root login, to do this add the file /flash/linux/etc/shells with contents "/bin/bash".

[tv84]

Copy the 6 GHz profile to the 3 GHz profile:

cp  N1996A-506  N1996A-503

Wouldn't it work by only activating the 506 option?

[TheSteve]

I don't have a N1996A to do any testing anymore. When I was experimenting a few years back I had the license verification bypassed and tried using option 506 and recall having a problem with it. I think the issue is that the Digital IF board is programmed as 3 or 6 GHz and it gave an error because it was initialized for 3 GHz instead of 6 GHz and would only boot with an error.

Copy the 6 GHz profile to the 3 GHz profile:

cp  N1996A-506  N1996A-503

Wouldn't it work by only activating the 506 option?