Agilent n5181a Software Upgrade / Hack

[Karnathe]

Hello,

I have a (hopefully) working Agilent n5181a rf Signal Generator and would like to hack in some extra software options. Does anyone know of functioning software / methods to do this? I looked around online but did not see anything obvious.

Keysight link to the equipment: https://www.keysight.com/us/en/product/N5181A/mxg-rf-analog-signal-generator-100-khz-to-6-ghz.html

[PA0PBZ]

Since the product status is obsolete I don't mind having a look. Do you have any active options where you can see the key? Does it have a HOSTID?

[Karnathe]

Sorry for this very late reply.

Since the product status is obsolete I don't mind having a look. Do you have any active options where you can see the key? Does it have a HOSTID?

I have attached a few images, not sure if it is what you need. I have censored my serial, message me if you need it. I assume this forum has DM's.
If I have not found what you need, please guide me to it. This is all from the utility menu.

[squadchannel]

I also have an N5181A.
I looked into this before and if I am not misinterpreting, need to replace the A3 RF board to add options other than UNT/UNU (FM AM PM option). The parts number is listed in the service manual. I am not sure what the difference is.

[tv84]

If I have not found what you need, please guide me to it. This is all from the utility menu.

Check the device to see if it has a label on the back or bottom that includes the model number and serial number. This label might also include the Host ID.

If so, send me a pm.

[tv84]

List of options as seen in the FW. (Dependent on each model of this series.)

[PA0PBZ]

Since tv84 jumped in I'll just watch this thread for now.

[squadchannel]

send PM

[Karnathe]

I have sent a DM.

[tv84]

@PA0PBZ, need your help.

This is what we need to recreate:

FEATURE 501 aspk 1.0 permanent 0 63A7F5F2744A6ECB HOSTID=N5181A,MFG0000001 #1 GHz frequency range
FEATURE 503 aspk 1.0 permanent 0 D240E450C8227F4D HOSTID=N5181A,MFG0000001 #3 GHz frequency range
FEATURE 506 aspk 1.0 permanent 0 74D831FDECE46AAF HOSTID=N5181A,MFG0000001 #6 GHz frequency range

[PA0PBZ]

This is what we need to recreate:

That looks like the newer (more difficult) lmcrypt format, 128 bit key.. I don't think we ever did that?

[Karnathe]

Hello all, I have (maybe) figured out how to talk to this wretched instrument. Instructions follow:
Plug in via ethernet into your router
Find it's IP address (your router should have it listed)
If you are on windows, you need to enable telnet (https://phoenixnap.com/kb/telnet-windows)
open cmd, type telnet then its ip then SPACE not : and type 5023
For me, the command is telnet 10.0.0.39 5023
This will get you to this lovely page included in attachments.
Check the agilent / keysight Manual_N5180-90004(SCPI_command) for the commands, but the tldr is
if it is lowercase, it does not matter
this instrument is picky about commands. If you type it wrong, it will give you nothing, press ctrl+c to reset. Check the error screen either on the instrument or on its interactive menu on its webpage, see attached image.
finally, the command you want is: :SYST:LIC:LIST? which will return all licenses on the instrument, as well as I think what the very helpful people in this thread needed.

Last note, if you go to its IP address in a web browser it will return a lovely menu which will be very helpful. If you don't want to mess around with windows command prompt try putty, specify telnet and port 5023.

[tv84]

Nice! Then the possible way to insert the licenses is probably also via SCPI command.

[Karnathe]

Yes, let me include a screen shot of the relevant command.

[tv84]

Yes, let me include a screen shot of the relevant command.

  Now we just need to find out the seeds... 

[Karnathe]

Is that not included in the license info I sent you? Or does that not come from me.

[tv84]

That looks like the newer (more difficult) lmcrypt format, 128 bit key.. I don't think we ever did that?

We hadn't...

But this is a "fake" lmcrypt. The only thing that looks the same is the license string.  They use simple hashing to create the license. 

As a PoC I attach all the options for the standard factory device S/N MFG0000001.

Edit: Nov. 11th, 2025 - I patched my keygen in order to make correct MFG0000001 licenses (see new attached file). Not all user's HOSTIDs need that keygen patch...   
Edit: Nov. 12th, 2025 - Corrected my keygen with a detail I had bypassed. No need for patches anymore.   

[darryllll]

Hey tv, has the hashing formula ever been figured out?

[tv84]

Hey tv, has the hashing formula ever been figured out?

Yes.

[ua4yhz]

At the time of manufacture, these devices do not have a model number.
The model number is calculated based on the installed options each time the device is turned on.
The model number, options, and settings are stored in two flash memory chips: block A3 (RF assembly) and block A5 (processor).
This allows them to automatically recover from any failures.

[darryllll]

I'm assuming the keygen isn't currently public?

[ua4yhz]

I'm assuming the keygen isn't currently public?

Typically, it becomes available after the equipment is no longer in production or service.
We can revisit this topic in about five years.

[ua4yhz]

Edit: Nov. 11th, 2025 - I patched my keygen in order to make correct MFG0000001 licenses (see new attached file). Not all user's HOSTIDs need that keygen patch...   
Edit: Nov. 12th, 2025 - Corrected my keygen with a detail I had bypassed. No need for patches anymore.   

You are using
FUNCTION 501 aspk 1.0 constant 0 63A7F5F2744A6ECB HOSTID=N5181A,MFG0000001
The datasheet uses
FUNCTION 501 aspk 0 constant 0 63A7F5F2744A6ECB HOSTID=N5181A,MFG0000001
Sorry. My stupid question... I didn't mean to break your newly debugged code again.

[tv84]

You are using
FUNCTION 501 aspk 1.0 constant 0 63A7F5F2744A6ECB HOSTID=N5181A,MFG0000001
The datasheet uses
FUNCTION 501 aspk 0 constant 0 63A7F5F2744A6ECB HOSTID=N5181A,MFG0000001
Sorry. My stupid question... I didn't mean to break your newly debugged code again.

You didn't broke my code.     You broke the datasheet!   

As you can easily research, the FLEXlm uses a version number in that position. It would never be just "0".

Nonetheless, I attach a dump from a U4 chip (on a N5181A) for you to have a look. Nice catch, BTW.

[44kgk1lkf6u]

I'm assuming the keygen isn't currently public?

Typically, it becomes available after the equipment is no longer in production or service.
We can revisit this topic in about five years.

Why do people wait that long to post it?