EEVblog Electronics Community Forum

Products => Test Equipment => Topic started by: CJay on December 07, 2016, 11:05:18 am

Title: Enabling options for R&S test equipment
Post by: CJay on December 07, 2016, 11:05:18 am
Does any one know if R&S are amenable to providing 'keys' for software options to hobbyists who own older equipment?

I've a CMU200 on which I'd like the K29 AMPS option to be enabled as it'd allow me to rid my tiny bench of some clutter but obviously, as a hobbyist, the cost would be a massive issue so if R&S need me to have a deep wallet it won't be possible.
Title: Re: Enabling options for R&S test equipment
Post by: rfbroadband on December 07, 2016, 03:27:36 pm
they will most likely not do that. If you are not a regular customer that spends n* 10k or >100k each year....you won't even get a meaningful discount.
Title: Re: Enabling options for R&S test equipment
Post by: CJay on December 07, 2016, 03:31:41 pm
they will most likely not do that. If you are not a regular customer that spends n* 10k or >100k each year....you won't even get a meaningful discount.

Ah nuts, still, nothing ventured, nothing gained. I'll email them and ask how much it would cost but it's a 15+ year old piece of kit.

I might have to revisit some of my old hobbies.
Title: Re: Enabling options for R&S test equipment
Post by: nctnico on December 08, 2016, 01:04:46 pm
I once asked about the decoding options for an older oscilloscope (RTM1500 series IIRC) but they cost more than the scope so never mind.
Title: Re: Enabling options for R&S test equipment
Post by: CJay on December 08, 2016, 02:53:42 pm
Oh well, shame.

*digs out copy of IDA and Sourcer*

Title: Re: Enabling options for R&S test equipment
Post by: tmbinc on December 12, 2016, 11:29:35 pm
R+S's response to support for the CRTU-RU was basically "sorry, we don't have that software anymore, you're out of luck". It wasn't that they didn't _want_ to help me (in their words), but that they couldn't. (I'm not sure if that was the complete truth, though.)

I wished they could have helped me. Instead, I had to help myself...

from Crypto.Cipher import ARC2
import struct

for l in open("SWOPT.DAT"):
   if len(l) == 17:
      a, b = struct.unpack("<II", ARC2.new("Revision\0").decrypt(l.strip().decode("hex")))
      print "SN: %d - %08x" % (a, b)

Title: Re: Enabling options for R&S test equipment
Post by: dcarr on December 12, 2016, 11:34:27 pm
Question:  Is the actual software for the options included on the base system?

(ie: They didn't have to mail you a disk with the new code on it?)
Title: Re: Enabling options for R&S test equipment
Post by: eliocor on December 13, 2016, 08:44:53 pm
Not sure it can help you, but some time ago I found this (see attachment).
Maybe it can be used also for other devices....
Title: Re: Enabling options for R&S test equipment
Post by: CJay on December 22, 2016, 11:35:49 am
OK, so it's Python, it runs after importing pycrypto to my Raspberry Pi, needed a minor tweak I think related to the difference between DOS and Linux EOL/LF handling but the output appears valid.

I get output which is my serial number and then an option number I can tie up to installed options, trivial to work out the option number from this code.

I think I'm safe to assume I need to encipher 01D000C3 using my serial number as key (or vice versa) to obtain the option key for K29 and this is where I'm stuck as I'm struggling to understand the python code and how it decrypts, let alone how to reverse the process and obtain a valid ciphertext key.

What's also worrying me at the moment is that there's no 'installed version' for K29 so I have a sinking dread that K29 software may not actually be on the machine unless it's hidden somewhere in an archive and needs to be installed by Version Manager?

Also very curious about the 'FM Stereo' option in there if anyone has any knowledge of it?
Title: Re: Enabling options for R&S test equipment
Post by: eb4eqa on December 22, 2016, 12:13:34 pm
Hi,

No idea about the Stereo option, but I do have K29 in my CMU200. If you need me to check something or get some files, I'll be happy to do it. Always interesting.

Regards,
Roberto
Title: Re: Enabling options for R&S test equipment
Post by: AudioplatinumService on December 22, 2016, 01:05:34 pm
Hi guys.. Nice to saw here some progress. I have R&S UPL and I Am also interested in some sw options.
@CJay  Can you give me more information how do you make setup on RPi?

Cheers,
Damir


Sent from my iPad using Tapatalk
Title: Re: Enabling options for R&S test equipment
Post by: CJay on December 22, 2016, 02:14:25 pm
Hi guys.. Nice to saw here some progress. I have R&S UPL and I Am also interested in some sw options.
@CJay  Can you give me more information how do you make setup on RPi?

Cheers,
Damir


Sent from my iPad using Tapatalk

I only used a Pi to run the Python code provided by TMBInc earlier in this thread because Python is included with the Raspbian image and it's very simple to install the PyCrypto software so I went with the easiest option available to me.

It would have been non trivial for me to install Python and PyCrypto on my laptop, though if you're proficient with Python I'm sure it would be very simple to install. 

The only change I had to make to the code was to change

if len(l) == 17:

to

if len(l) == 18:

because I think the way DOS and Linux terminate lines is different. Or perhaps there's a difference between CMU and CRTU SWOPT.DAT files

I'm really not a programmer so it's going to be a voyage of discovery for me to unpick what is almost definitely a very simple python script and reverse it to make myself a key generator.
Title: Re: Enabling options for R&S test equipment
Post by: Jackob on December 22, 2016, 05:53:48 pm
CJay - I am curious;  how did you figure out that you need to encipher 01D000C3 to obtain the option key for K29?

BR, Jackob
Title: Re: Enabling options for R&S test equipment
Post by: CJay on December 22, 2016, 06:19:44 pm
If I've understood the code and its output correctly, the licenses decode to serial number - option code where option code is 0xx0003C and xx is the hex representation of the decimal option number.

So, K29 would be 01d0003C

I could be way off the mark though.
Title: Re: Enabling options for R&S test equipment
Post by: oh2ftu on December 22, 2016, 08:11:29 pm
Hi,
I have a CMU200 with the K29 option enabled.
Below is the contents from swopt.dat:
Code: [Select]
FEEC0364A639F575
A2AF0325E648F54D
4D8CB38F128844B2
0A4080E5DDB3F339
08678B2806514740
D710C80B984FFD23
8E1182008AE45EB2
42D23B964CE7C522
DE8BC25F5305D1EB
6E1701C72B5F9256
6B53740D41CF8780
DBBE31F8EAEB9C22
And the options installed are
K21-K24, K27-K29, K42, K43, K53, K84, K85. Serial 837109/035

From another,
Code: [Select]
917D1CFF38E8F2C1
AC15C4AFBA26733A
D87CDA77974C9514
BE238053BEA30B16
75AE27EBF3F52E40
DFB718A6C9D85764
11B26D02CEE94BEA
and options:
K21-K24, K42, K43 and K45. Oh, and serial 103086.
Title: Re: Enabling options for R&S test equipment
Post by: artag on December 22, 2016, 11:28:57 pm
So that gives

SN: 837109 - 01500023
SN: 837109 - 01600023
SN: 837109 - 01700023
SN: 837109 - 01b00023
SN: 837109 - 01c00023
SN: 837109 - 01d00023
SN: 837109 - 01800023
SN: 837109 - 02a00023
SN: 837109 - 05400023
SN: 837109 - 05500023
SN: 837109 - 03500023
SN: 837109 - 02b00023


and
SN: 103086 - 01500002
SN: 103086 - 01600002
SN: 103086 - 01700002
SN: 103086 - 01800002
SN: 103086 - 02b00002
SN: 103086 - 02a00002
SN: 103086 - 02d00002

Not having a CMU200, I don't understand what you mean by 'Serial 837109/035' - but the 035 turns up again as 0023. So what does 002 on the second example refer to ?


Title: Re: Enabling options for R&S test equipment
Post by: artag on December 23, 2016, 12:09:07 am
For those, like me, with little experience of python, that fragment can be expressed less tersely as :

Code: [Select]
from Crypto.Cipher import ARC2
import struct
KEY = "Revision\0"  # decryption key for the data
STRUCT_TWO_UNSIGNED_INTS = "<II"
for line in open("SWOPT.DAT"):
    if len(line) == 17:
        cipher = ARC2.new(KEY)  # a new ARC2 cipher with the right key (ARC2 is a symmetric block cipher, we need a new cipher for each ciphertext)
        ciphertext = line.strip().decode("hex")  # Decode our ciphertext from hex, removing whitespace from the start and end
        plaintext = cipher.decrypt(ciphertext)  # Decrypt the cyphertext using the key
        a, b = struct.unpack(STRUCT_TWO_UNSIGNED_INTS, plaintext)  # unpack two unsigned ints from the plaintext
        print "SN: %d - %08x" % (a, b)

(courtesy of a more knowledgeable person elsewhere)
Title: Re: Enabling options for R&S test equipment
Post by: oh2ftu on December 23, 2016, 08:34:13 am
In what format should the code be entered? just as 01500023 or must the hexadecimal version?
I'm not into crypto so I can only get a basic understanding of what the python does. How would one create new keys if I need them in hexadecimal format?
Apparently the decrypt is essential to do first, then crypt them again?
Title: Re: Enabling options for R&S test equipment
Post by: CJay on December 23, 2016, 10:46:18 am
At the moment I'm just trying to write code which will verify what we have, simply entering the results from a known good pair generated from an existing enabled option, encrypting it and testing it against the input for a match. Once that works it'll generate new option keys as well.

it'll need to be manually edited to suit the required option but that'll be plenty for my needs, someone else can polish it to take command line options etc.

My available time is running out until after the holidays so it'll have to take a place on the back burner for a little while if I can't work it out today.

I'd like to complete this myself, good motivation to get a grip on Python but of course, if someone else works it out (and I'm sure it's trivial as it seems 'all' that needs to be done is work out how to get the plaintext into the ARC2 routine) given the information we have) then I will be happy too.
Title: Re: Enabling options for R&S test equipment
Post by: artag on December 23, 2016, 10:46:31 am
The decrypt does give the 0023 or whatever, from your existing licences. I don't see that you'd need to do it for any other reason than proving the process. It would be better to know how to derive the 23 (or 2, or C3 ..) directly, so you don't need an existing licence to make a new one.

The encrypt process would be something like :

make a record consisting of serial number, option number, suffix (23 etc) in binary
encrypt it using the RC2 cypher and the key 'Revision'
convert to ascii
add to the license file
 
Title: Re: Enabling options for R&S test equipment
Post by: CJay on December 23, 2016, 11:00:50 am
That last byte (or perhaps two bytes)  would seem to be the /xxx part of the serial number, mine is 836072/060 and the last byte of what I'm calling the option code is 3C, 060 decimal, the last byte of OH2FTU's matches the /035 of his serial number.

The SWOPT.DAT file will probably exist on all machines and have at least one or two licences in it, but even if it's empty it should be possible to create an 'option code' from the full serial number and the desired option.

Title: Re: Enabling options for R&S test equipment
Post by: artag on December 23, 2016, 11:29:40 am
This seems to do the reverse :

Code: [Select]
from Crypto.Cipher import ARC2
import struct

serial = 103086
serial2 = 2
option = 45

record = struct.pack("<II", serial, serial2 + (option <<20))
encyphered = ARC2.new("Revision\0").encrypt(record)
print encyphered.encode("hex")

produces

11b26d02cee94bea

i.e. the last entry in oh2ftu's list

Title: Re: Enabling options for R&S test equipment
Post by: CJay on December 23, 2016, 11:47:33 am
If that's the case I think we have a winner. :) :)

My CMU is at home and I'm unable to get to it until later but I'll be able to test it later.
Title: Re: Enabling options for R&S test equipment
Post by: artag on December 23, 2016, 11:48:14 am
Check it with some existing options for your machine first
Title: Re: Enabling options for R&S test equipment
Post by: CJay on December 23, 2016, 11:53:47 am
I will, unfortunately I'm unable to install python on this machine but I will run my options through it first and report back.
Title: Re: Enabling options for R&S test equipment
Post by: oh2ftu on December 23, 2016, 12:10:33 pm
I'm unable to reproduce they keys found for the /035 -serial. Any advice?
The newer machine is no longer in my posession :(

Best regards


I set serial2 as 35 instead of 035 and bang! it works!
Title: Re: Enabling options for R&S test equipment
Post by: CJay on December 23, 2016, 12:21:02 pm
Well that's exciting :)

Many thanks to everyone who's provided information and code, this will definitely be one of my favourite Christmas presents this year.

I can't wait to get home and try it on my CMU now.

Anyone got any ideas what Option K14 does?
Title: Re: Enabling options for R&S test equipment
Post by: artag on December 23, 2016, 12:27:30 pm
I'm unable to reproduce they keys found for the /035 -serial. Any advice?
The newer machine is no longer in my posession :(

Best regards


I set serial2 as 35 instead of 035 and bang! it works!

Looks as though python (like C) interprets a leading 0 as meaning 'octal'. So 035 is 29 decimal.
Title: Re: Enabling options for R&S test equipment
Post by: CJay on December 23, 2016, 04:10:43 pm
Well, I can confirm it works.

Sadly it seems the AMPS software may not be on my CMU. More exploration needed.

OF2HTU, when you enabled options what happened?
Title: Re: Enabling options for R&S test equipment
Post by: oh2ftu on December 23, 2016, 04:26:32 pm
Well, I can confirm it works.

Sadly it seems the AMPS software may not be on my CMU. More exploration needed.

OF2HTU, when you enabled options what happened?
Hi,
The AMPS (K29) should be just easily enabled as anything else. You'll find it under the menu select -button.

I sold my other (without) K29 about 12hrs before this thread activated the day before yesterday. Had I known the outcome, I would've sold the one I now have left.
All the software is there. A reboot is required.
Title: Re: Enabling options for R&S test equipment
Post by: CJay on December 23, 2016, 04:29:15 pm
even after the reboot I only see a tick and no 'Version' so I don't think it's present but I do have another two disk images I can explore.

Did yours have a version number before you enabled it?
Title: Re: Enabling options for R&S test equipment
Post by: oh2ftu on December 23, 2016, 04:40:49 pm
even after the reboot I only see a tick and no 'Version' so I don't think it's present but I do have another two disk images I can explore.

Did yours have a version number before you enabled it?
Try to run a system upgrade from the bootup-menu
Title: Re: Enabling options for R&S test equipment
Post by: grw1983 on December 27, 2016, 03:52:22 pm
Hi,

maybe this may help:
https://bitschubbser.org/nextcloud/index.php/s/6TCghFbYMsbkfph (PW: eevblog)

This is the r+s software for CMU200: Base, Bluetooth, AMPS, GSM.
Completely untested (may even be that these are the wrong files) because I don't have a PCMCIA-card for my unit yet.

Regards,
grw

EDIT: New link to the archive!
Title: Re: Enabling options for R&S test equipment
Post by: grw1983 on December 28, 2016, 09:56:20 pm
Okay,
everybody just downloading, nobody replying. So here it goes:
I was able to activate the AMPS-module with the "keygen" and by installing
the IS1MV5.20.exe package.

Note:
The files from the IS1MV5.20.exe need to be in a directory called "IS1MV5.20"
for the CMU200 versionmanager to find them. AND you need to install the
corresponding base-package first.

Greetings
Title: Re: Enabling options for R&S test equipment
Post by: CJay on December 29, 2016, 08:00:41 am
I'm waiting on a PCMCIA to CF adapter to try installing those packages so I am guilty of downloading and not replying, did you have to 'install' from PCMCIA or were you able to put it on the HDD directly?
Title: Re: Enabling options for R&S test equipment
Post by: AudioplatinumService on December 29, 2016, 08:38:22 am
Hi guys,

I have R+S UPL unit, OS is DOS 6.22 and options numbering is similar like on cmu200. No SWOPT.DAT file in system, but I make some progress with python scripts here. I have some option codes from same unit/different serial number, and one code for option in my unit. Then I make with this script

Code: [Select]
from Crypto.Cipher import ARC2
import struct

serial = 103086
serial2 = 2
option = 45

record = struct.pack("<II", serial, serial2 + (option <<20))
encyphered = ARC2.new("Revision\0").encrypt(record)
print encyphered.encode("hex")

entry and I put this in SWOP.DAT file, and run next script

Code: [Select]
from Crypto.Cipher import ARC2
import struct
KEY = "Revision\0"  # decryption key for the data
STRUCT_TWO_UNSIGNED_INTS = "<II"
for line in open("SWOPT.DAT"):
    if len(line) == 17:
        cipher = ARC2.new(KEY)  # a new ARC2 cipher with the right key (ARC2 is a symmetric block cipher, we need a new cipher for each ciphertext)
        ciphertext = line.strip().decode("hex")  # Decode our ciphertext from hex, removing whitespace from the start and end
        plaintext = cipher.decrypt(ciphertext)  # Decrypt the cyphertext using the key
        a, b = struct.unpack(STRUCT_TWO_UNSIGNED_INTS, plaintext)  # unpack two unsigned ints from the plaintext
        print "SN: %d - %08x" % (a, b)

Output from this script is my serial number(serial is correct), but code is not ok for my unit. Maybe somebody know how make script working from valid licence codes? I am stuck here...  |O

Unit serial:849260/015
option B21: 19559
option B22: 42997
option B10: 14917
option B4 : 15747

Cheers,
Damir
Title: Re: Enabling options for R&S test equipment
Post by: Jackob on December 30, 2016, 08:11:19 am
A side note -  the keygen in Reply #7 of this thread seems to work for R&S FSU, FSQ, FSP and FSIQ series on spectrum & signal analyzer; (at least).  :)
Title: Re: Enabling options for R&S test equipment
Post by: stones on December 30, 2016, 09:26:29 am
A side note -  the keygen in Reply #7 of this thread seems to work for R&S FSU, FSQ, FSP and FSIQ series on spectrum & signal analyzer; (at least).  :)

Do you now how to customize the option keys in the option_list[] for FSIQ Options or other devices?
Title: Re: Enabling options for R&S test equipment
Post by: Jackob on December 30, 2016, 11:01:30 am
Based on how the C-file is written no custoimization of the keys is needed.

Just edit in your analyzer serial number into main.c -file to the line stating "char SerString [] = {"xxxxxx/xxx"}; // Seriale dello strumento". When you compile and run the program it will list all keys which may work in your analyzer.

You can also experiment by chaning all the "FALSE" statements to "TRUE" in the table of "Acceptable Options" in the beginning of the main.c file and test which ones of all the options work in your analyzer.

E.g. running Tiny C Compiler (TCC) in a PC in command prompt window  ("TCC -run main.c") should give the list of your option keys.

BR, Jackob
Title: Re: Enabling options for R&S test equipment
Post by: CJay on December 30, 2016, 11:14:40 am
Handy info perhaps, enabling 'K14 FM Stereo' allows the RF signal generator on the CMU to generate mono, Left and Right FM stereo signals but it doesn't appear as an 'installed' option with version number, just as 'enabled' and you then have extra modulation options.

Handy if you're servicing HiFi etc.
Title: Re: Enabling options for R&S test equipment
Post by: nctnico on December 30, 2016, 06:16:27 pm
A side note -  the keygen in Reply #7 of this thread seems to work for R&S FSU, FSQ, FSP and FSIQ series on spectrum & signal analyzer; (at least).  :)
Any ideas about other equipment like oscilloscopes?
Title: Re: Enabling options for R&S test equipment
Post by: grw1983 on December 31, 2016, 02:30:05 pm
I'm waiting on a PCMCIA to CF adapter to try installing those packages so I am guilty of downloading and not replying, did you have to 'install' from PCMCIA or were you able to put it on the HDD directly?

Hi, sorry for the "late" reply. I installed using a PCMCIA-CF-card adapter, directly via PCMCIA.
I actually don't know how the access the CMU200-files externally.
Title: Re: Enabling options for R&S test equipment
Post by: Brainbox on December 31, 2016, 03:25:05 pm
The way I did it was installing Norton Commander on the CF card and boot the CMU in Dos mode.
Then its easy to access or copy files to CF.
Title: Re: Enabling options for R&S test equipment
Post by: dhillman on December 31, 2016, 07:08:18 pm
A side note -  the keygen in Reply #7 of this thread seems to work for R&S FSU, FSQ, FSP and FSIQ series on spectrum & signal analyzer; (at least).  :)

This strikes me as very interesting.    I've been working with the SMIQ's i960 firmware and complicated addressing scheme.   

Does anyone know the origin of the 'Seed Keys' in main.c?     

Title: Re: Enabling options for R&S test equipment
Post by: Jackob on December 31, 2016, 07:35:25 pm
Sorry - no idea where the keygen with the seed keys come from - except that they were posted by eliocor. Would love to have similar tool for  RTO-series of oscilloscopes.

BR, Jackob
Title: Re: Enabling options for R&S test equipment
Post by: rickells on January 02, 2017, 04:43:49 pm
CJay,

I am trying to contact you about your Aeroflex IFR 3414    GHz Signal Generator repair.
I have an Aeroflex IFR 3416, same or very similar problems.

rickells
Title: Re: Enabling options for R&S test equipment
Post by: slurry on January 02, 2017, 10:37:14 pm
I set them all to "TRUE" and went through all options on my FSEB30, most of them where accepted as valid keys but none of them seemed to work.
Looking in the >runtime>ini>options file on the HDD the options revealed nothing useful with the generated keys, it was mostly unintelligble so i wiped almost everything away.

I would be happy to try out another set of keys
Title: Re: Enabling options for R&S test equipment
Post by: slurry on January 02, 2017, 10:42:38 pm
A side note -  the keygen in Reply #7 of this thread seems to work for R&S FSU, FSQ, FSP and FSIQ series on spectrum & signal analyzer; (at least).  :)


Are you sure about the FSIQ you mention, maybe it has newer HW and thus have the same setup of SW options as the FSU, FSQ and FSP..  :-//
Title: Re: Enabling options for R&S test equipment
Post by: stones on January 03, 2017, 09:03:42 am
Works fine with my FSIQ :) The first 17 Keys are valid.
Title: Re: Enabling options for R&S test equipment
Post by: radiorick on January 06, 2017, 06:39:32 pm
Hi Everyone,  Having some issues trying to enable some of the SW opts, Perhaps I am doing something wrong,  One unit SN 835687/054 and the other is SN 114603 (Not seeing the "/xxx").  Anyway I could use a bit of guidance to enable the sw opts I would like to use.  Just having some issues figuring out the whole crypto.  I tried several RC2 methods but am not getting anywhere.  Thanks

RR
Title: Re: Enabling options for R&S test equipment
Post by: radiorick on January 08, 2017, 06:24:59 pm
Cancel last request for Help.  Found the issue.
RR
Title: Re: Enabling options for R&S test equipment
Post by: CJay on January 13, 2017, 03:30:57 pm
Well, K29 is an excellent addition to my CMU200, now I need a GPIB interface and some way of programming it so I can produce test reports :)

Seriously though, thanks to everyone who chipped in with help and code here, it's helped a lot of people and made my CMU into an even better instrument than it was before and I'm having a lot more fun with it now.

Next mission is to extend it below 10MHz with an external mixer :)
Title: Re: Enabling options for R&S test equipment
Post by: Brainbox on January 13, 2017, 03:53:55 pm
Next mission is to extend it below 10MHz with an external mixer :)

I am working on the same mission:
https://www.eevblog.com/forum/rf-microwave/rs-userservice-manuals-cmu200-and-crtu/msg1024073/#msg1024073 (https://www.eevblog.com/forum/rf-microwave/rs-userservice-manuals-cmu200-and-crtu/msg1024073/#msg1024073)
My first thought was to lift the input by 10 MHz, which is available at the reference output.
After all I am working now at al lift by 100 MHz, which is more convenient with available input filters and offers a wider input span of 100 Hz - 90 MHz.
Title: Re: Enabling options for R&S test equipment
Post by: CJay on January 13, 2017, 05:50:04 pm
This probably needs another thread or at least to be tacked into one of the other existing ones but MSRaya has done it, he used the sig gen on the CMU as a 1GHz LO for an external ADE-1 mixer which worked nicely from what I can tell.

I've ordered some ADE1 mixers and have managed to scrounge a PCB from a generous member of a mailing list so once I've received that I might start a new thread with test results.



Title: Re: Enabling options for R&S test equipment
Post by: msraya on January 14, 2017, 10:40:26 am
Sorry, I'm out working... Very interesting thread...

I not have the CMU200 right now in house, but I have the files, and I tested my SWOPT.DAT with the python script in the post #5 in Windows with python(x,y) not problem.. My SWOPT.DAT info match exactly with my serial number in IDENTITY.TXT and options..
I have:

SN: 10XXXX - 01500002  --> K21  GSM900, R-GSM, and E-GSM mobile station signaling/non-signaling test
software
SN: 10XXXX - 01600002  --> K22  GSM1800 (DCS) mobile station signaling/non-signaling test software
SN: 10XXXX - 01700002  --> K23  GSM1900 (PCS) mobile station signaling/non-signaling test software
SN: 10XXXX - 01800002  --> K24  GSM850 mobile station signaling/non-signaling test software
SN: 10XXXX - 02A00002  --> K42  GPRS test software extension for all GSM test software packages
SN: 10XXXX - 02B00002  --> K43  EGPRS classic (EDGE) signaling test software for all GSM test software
packages
SN: 10XXXX - 02C00002  --> K44  Dual transfer mode: simultaneous CS and PS connection for all GSM packages
SN: 10XXXX - 02D00002  --> K45  AMR test software extension for all GSM test software packages

I will try next week K29.. Here we go!!  ;-)

Thank You all!
Manuel
Title: Re: Enabling options for R&S test equipment
Post by: ernemo on January 15, 2017, 12:51:55 pm
Hello, I'm new and a little bit inexperienced. I have bought a CMU200 and I would like to use the option K29. My problem is where do I find the SWOPT.DAT file? How can I read it? If I can download it, can I publish it on the forum so that one of you can give me the key to activate the option K29?
Thank you very much.
Ernesto
Title: Re: Enabling options for R&S test equipment
Post by: CJay on January 15, 2017, 05:22:58 pm
You don't neeed the SWOPT.DAT file, you just need the serial number of your CMU and a way to edit and run the Python code.

Title: Re: Enabling options for R&S test equipment
Post by: ernemo on January 15, 2017, 05:45:08 pm
Thanks for your reply. My serial number is 111264. And now what do I do? Do I need to write the keygen of the post #21 in pycrypto? I'm sorry but I don't really know what to do. :scared:
Thanks
Ernesto
Title: Re: Enabling options for R&S test equipment
Post by: CJay on January 16, 2017, 09:51:05 am
Your serial number will be something like 111264/xxx, you need this full serial number.

You then need to edit the python code so that it reflects your serial number but if the last part of your serial, xxx, starts with a 0 it must be omitted, change 'yy' to the option number you wish to enable

In your case, for option 29

serial = 111264
serial2 = xxx
option = 29





Title: Re: Enabling options for R&S test equipment
Post by: msraya on January 16, 2017, 03:29:36 pm
Ernesto, for your information:

1. Download and Install python(x,y), use google for download link  ;)
2. Open program and select in Applications "IPython QT console" and click the green checkmark to run it.
3. In the console window that open, cut and paste the following code line by line (press enter after you paste each line), change XX for your second serial number, you can get it from the IDENTITY.TXT file (the soft has option to generate it):

from Crypto.Cipher import ARC2
import struct

serial = 111264
serial2 = XX
option = 29

record = struct.pack("<II", serial, serial2 + (option <<20))
encyphered = ARC2.new("Revision\0").encrypt(record)
print encyphered.encode("hex").upper()

4. Note the resulting code on paper.
5. In the CMU200 exit from program to MSDOS(Alt-F4) and go to the location of SWOPT.DAT file, i don't remember, you will need a keyboard  ;).
6. Make a backup of file (I always make a backup of entire disk before make modifications).
7. Use the MSDOS edit command with the file and put the code at end of file. Save the file.
8. Restart the equipment.

It's very easy, right?
By the way, I think it is possible to enter the code directly in the program as an option of system menu.
Regards
Manuel
Title: Re: Enabling options for R&S test equipment
Post by: axel on January 16, 2017, 08:31:40 pm
To bypass editing the file and to enter the code directly, the menu is "Setup" under the System box -> Options -> your desired option -> enter.

Then enter your generated code and there you go!

To those above enabling K29 - how did you get around the option enabling but the features not appearing? Did it require copying over new files to the internal hard drive?

EDIT

I partly figured it out and I'm trying to get this working. I installed the base as a new version (I can't upgrade from 3.5 for some reason) and added AMPS and Bluetooth as a test. Now it will boot to this new version, get past the loading screen and then exit to a dos terminal saying that it has reached the end of "verm.bat". I'm not too familiar with this unit so I'm at a loss.

EDIT 2

Looks like it's running out of memory. Apparently 64MB isn't enough for version 5.21 firmware. That's disappointing.
Title: Re: Enabling options for R&S test equipment
Post by: msraya on January 17, 2017, 12:04:10 pm
Yes, the memory is important...

Mine does have 128MB base in a weird configuration...
However i upgrade it with a Infineon 128MB PC133 133MHz 144-Pin SODIMM HYS64V16220GDL-7.5-C2 without problem...

Mine is a slooooow AMD K6 with INTEL Triton chipset and It has only cache for 64MB of RAM unfortunately. In programm I not noted anything different with 256MB.

Manuel
Title: Re: Enabling options for R&S test equipment
Post by: CJay on January 17, 2017, 01:34:54 pm
I wonder if there'd be any advantage to trying an Intel part in there...
Title: Re: Enabling options for R&S test equipment
Post by: axel on January 17, 2017, 02:47:44 pm
So am I outta luck trying to get AMPS on my CMU? I wonder if somebody's got the firmware files for the 3.5 version of AMPS lying around.

Upgrading the CPU could be possible but I imagine it's either an AMD socket or even worse, soldered to the motherboard.


Sent from my iPhone using Tapatalk
Title: Re: Enabling options for R&S test equipment
Post by: CJay on January 17, 2017, 02:51:13 pm
So am I outta luck trying to get AMPS on my CMU? I wonder if somebody's got the firmware files for the 3.5 version of AMPS lying around.

Upgrading the CPU could be possible but I imagine it's either an AMD socket or even worse, soldered to the motherboard.


Sent from my iPhone using Tapatalk

CPU is socketed and it's pin compatible with the Intel chips of the same era, it's using an Intel 430 chipset too I think, can't remember which chips were compatible though and if there's a speed advantage to fitting an Intel, if there is it'll be marginal I think.



Title: Re: Enabling options for R&S test equipment
Post by: ernemo on January 17, 2017, 07:30:15 pm
Thank you all for your answers. I've finally made it  :-+. On the right side of my CMU there are some stickers with the activation code of the different options. On these stickers is always repeated the symbols /02. I have used this /02 as the second serial code and it worked. Now I'm waiting my PMCIA adapter for loading the "AMP" software.
Thanks again.
Ernesto
Title: Re: Enabling options for R&S test equipment
Post by: 2N3055 on January 17, 2017, 09:57:51 pm
AMD K6 was faster than Socket 7 Intels of the time... Fastest K6 was 300MHz.If memory servers me well, upgrade path would be  a K6-2+ or K6-3+ if motherboard supports 1.4 - 2.0 volts that the K6-2+ and K6-3+ requires. Original K6 was 3.3V part... Those processors support higher speeds and include L2 cache (128K and 256K)...
Title: Re: Enabling options for R&S test equipment
Post by: axel on January 18, 2017, 06:55:11 pm
How hard/possible is ram replacement in these units? I haven't done too much digging other than getting the hard drive out because I still have a tentativeness to messing with expensive test gear.

I'd love to know what hardware configurations the people who are running the 5.21 FW and AMPS have. It seems like the person before me also tried to upgrade the firmware without success, as there are several versions of 5.21 installed and none of them boot properly.
Title: Re: Enabling options for R&S test equipment
Post by: CJay on January 18, 2017, 07:46:48 pm
Well  mine's the FMR5 processor module, AMD K6-2/300 CPU and 256MB memory.

So, it seems any processor upgrades would be minor unless the FMR5 supports various multipliers and 100MHz FSB, in that case it may be possible to go as far as 550MHz but I'm not sure how much, if any, benefit it would give me.

Memory is on a single SODIMM, it may be possible to fit more as there are two slots but I don't think it'd support it.
Title: Re: Enabling options for R&S test equipment
Post by: axel on January 18, 2017, 08:03:24 pm
I've only got 64MB and as I said above I can't even get the newest firmware to run because of that. I've got the K6-300 so I'd imagine I can at least bump it up to 256 since you seem to have that working just fine.

Title: Re: Enabling options for R&S test equipment
Post by: 2N3055 on January 18, 2017, 09:54:09 pm
Well  mine's the FMR5 processor module, AMD K6-2/300 CPU and 256MB memory.

So, it seems any processor upgrades would be minor unless the FMR5 supports various multipliers and 100MHz FSB, in that case it may be possible to go as far as 550MHz but I'm not sure how much, if any, benefit it would give me.

Memory is on a single SODIMM, it may be possible to fit more as there are two slots but I don't think it'd support it.

The K6-2+ has additional L2 cache... I'm sure it would give visible speedup even without faster FSB and on the same clock... also on those you can set multiplier to X2 and get X6 , so 366 MHz on 66MHz bus..
If you can get your hands on it, worth a try...
Title: Re: Enabling options for R&S test equipment
Post by: msraya on January 19, 2017, 01:14:18 pm
Unfortunately I have not been able to make it work.

When I install the base package v5.20 and the other packages with the VERM installation utility everything is successful. After the installation of the update, the firmware update of FPGA and other boards occurs. Once done, the new version starts and everything works correctly.

However, upon reboot, the hard drive ends corrupted and the files have random content, so it doesn't boot. I do not know if this is a motherboard problem or a problem with the upgrade process. I have tested it with two different hard disks and it does the same. I think others have same problem.

I also have v5.22 base and gsm and it does exactly the same. So it doesn't work so far..  :-//

EDIT: I manage to get an image of a CMU200 with base v5.20 installed that an eevblog user send me long time ago. I put the image in my CMU and start it, it show no valid licenses but it works, I put AMPS license. Then I reboot with the PCMCIA on the unit wit the AMPS firmware and It run VERM, it installed the AMPS via upgrade, update FPGA and then it worked after power recycle..

So, I have a working unit with AMPS, I put all the others licenses I have in the new software and it worked... I think the process of base installation is not operational, perhaps due to a VERM upgrade installation error that overwrites hard disk.

I try to adjust a FM transceiver and it worked well, but I cannot compare with my willtek 4032 as I not have both analyzers in the same lab.. However, I found the interface somewhat confused, but it will work with FM and SSB SINAD RX adjustments. Also TX and RX graphical base band frequency response, TX noise, TX deviation and carrier frequency. But I need two tone in the RF modulator to test FM RX as i need also ctcss tone. I found a signaling generator, but not ctcss... I will continue looking for dual tone..

By the way, I found the last original software right on the r&s server:
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR001Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR001Z?OpenDocument)
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR003Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR003Z?OpenDocument)
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR004Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR004Z?OpenDocument)
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR006Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR006Z?OpenDocument)

EDIT:

I found this: https://cdn.rohde-schwarz.com/pws/dl_downloads/dl_application/application_notes/1cm53/1CM53_0e.pdf (https://cdn.rohde-schwarz.com/pws/dl_downloads/dl_application/application_notes/1cm53/1CM53_0e.pdf) It can be used as AMPS software manual...

And now I understand how signaling works, and I thinks It is possible to modulate RF with external signal, and two or three tones also... I will try tomorrow..

Manuel
Title: Re: Enabling options for R&S test equipment
Post by: grw1983 on January 20, 2017, 03:57:55 pm
By the way, I found the last original software right on the r&s server:
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR001Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR001Z?OpenDocument)
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR003Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR003Z?OpenDocument)
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR004Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR004Z?OpenDocument)
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR006Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR006Z?OpenDocument)

Sadly no WCDMA-package :(
Title: Re: Enabling options for R&S test equipment
Post by: Brainbox on January 21, 2017, 08:52:32 am
Great work msraya for finding out all those features.

How did You get access tot this R&S server?
Perhaps I can dig for some other useful info.
Title: Re: Enabling options for R&S test equipment
Post by: msraya on January 21, 2017, 09:47:22 am
Quote
How did You get access tot this R&S server?
Perhaps I can dig for some other useful info.

I only used the Google Search Engine and Common Sense  :-+
Unfortunately I do not found more information.
The equipment is old and R&S want you to buy the new equipment that substitutes it.

Quote
Sadly no WCDMA-package :(

For WCDMA, bear in mind that you also need an additional hardware board option.

I think that, there are three types of communications analyzers:

1.- Old Semi-Analog, to use with Analog Communications: Example Willtek Stabilock, R&S CMT and CMS, Marconi 2955
2.- Digital ones with IQ Modulation, with Custom protocol communications, to use with digital modulation as GMS: Example R&S CMU200,  HP 8960
3.- Digital Modern for use with All Type communications, providing IQ Arbitrary Waveform modulator, Constellation Analyzer, Software modifiable, Ex: Agilent EXA signal analyzer, ..

I have a type 1 to play with, a type 2, then now I need a type 3.. HI HI...  So I need to win lottery..

Manuel
Title: Re: Enabling options for R&S test equipment
Post by: msraya on January 25, 2017, 07:22:55 pm
Hello!!

I have all working right now, except Bluetooth... I installed Bluetooth, but it doesn't worked.. In don't know why  :-//
Perhaps I need some hardware option?

I'm very happy with the addition, but It not work with external modulation... I tried with the connect control option, external AUX1 and external ref and nothing occurs... I don't know if it is some hardware problem or user not selecting appropriate option...

The signaling tones are 3KHz fixed and there are filters too and it is not useful for ctcss... I don't have ctcss nor possibility of have it via external modulation... :-( In my 4032, I have only one audio source, but I can combine it with external audio generator to test ctcss equipment... no problem... but Here no possibility  :--

I also installed some word and adobe acrobat via wifi, also Mozilla. Dual Boot with Windows 2000.
If someone want the HD image, please drop a PM to me and I share it, the HD image is very heavy...

Manuel
Title: Re: Enabling options for R&S test equipment
Post by: Brainbox on January 25, 2017, 09:19:59 pm
Quote
  have all working right now, except Bluetooth... I installed Bluetooth, but it doesn't worked.. In don't know why  :-//
Perhaps I need some hardware option?
Do You have the B53 Hardware option installed?
Title: Re: Enabling options for R&S test equipment
Post by: msraya on January 25, 2017, 09:41:31 pm

Thank You for answer my question..
Not, I only have B11, B17, B21, B41 and B95  :--

B53 is Bluetooth® extension; CMU-B21 necessary... But It only appears in options brochure as good to have, but not as compulsory or mandatory..   :-//  Can be an error and was it necessary?

Manuel

Title: Re: Enabling options for R&S test equipment
Post by: Brainbox on January 26, 2017, 07:08:08 am
The B53 have to be factory installed, else according to R&S:


"For users who already own a CMU200 radio test set, the  CMU-U53 upgrade kit is available to add

Bluetooth testing functionality. This option is a particularly cost-effective upgrade path offering maximum-throughput

testing for the existing very large base of  CMU200 users. "
Title: Re: Enabling options for R&S test equipment
Post by: msraya on January 26, 2017, 11:42:50 am
Ok, Thank You! 
I get it  ;)
https://cdn.rohde-schwarz.com/pws/dl_downloads/dl_application/application_notes/1ma46/1MA46_0E_transmitter_and_receiver_meas_Bluetooth_mod.pdf

I don't need bluetooth right now.. so... no problem...

Manuel
Title: Re: Enabling options for R&S test equipment
Post by: bobaru on January 28, 2017, 09:50:18 pm
Hi,

Just picked up a nice CMU200 off the usual auction site.   It has the Celeron Mobile 650 processor with 256MB as well as B17, B21, B41, B52, B54, B56, B68, B83, B85 and B96 hardware options.  It is nicely optioned, but I am trying to add some software options, mainly the FM Stereo modulation option.     

My first problem is finding the second serial number.    I have exited to dos and found the SWOPT.dat file, but I am unable to find a file with the second half of the serial number.   There are no stickers with the number on the machine.  Does anyone know specifically where in the file system to look?   I believe someone mentioned an Info???   I perused all of the directories and sub directories, but didn't see anything like that.  From what I have read here I should be able to verify the complete serial number using the valid code keys from the SWOPT.dat file in reverse.  Is this correct?

My second problem is that I am python illiterate.    From what I can gather there seems to be two ways of generating the code keys.    The first using the keygen file that was listed in Reply#7.   The second by downloading and running pycrypto.     Is this correct?

I have access to many computers and operating systems including a Rasp Pi.    My main pc is a Windows 10 machine that I have Python 3.4 installed on.    I have tried to use both options listed above, but as I have gotten older, my patience level is not what it used to be.   :)

If anyone can lead me in the right direction I would appreciate it.   I can provide my serial number #1 and the list from SWOPT.dat if that would be easier.

TIA,

-bob
Title: Re: Enabling options for R&S test equipment
Post by: msraya on January 30, 2017, 05:56:40 am
Bob:

You can always generate the IDENTITY.DAT file from the setup or maintenance menu, I can't remember. Inside the file you can find the full serial number and the options of the equipment. My old IDENTITY.DAT file is:


/***************************************************************/
/***************************************************************/
/************************* CMU IDENTITY ************************/
/***************************************************************/
/***************************************************************/

GENERAL INFORMATION


Serial number: XXXXXX/XXX


CPU and memory:

CPU (FMR)       FMR5
Memory          128 MB
BSW/FSW         V5.10

Statistics data:


Firmware versions:

RXTX_1 CP-SW    08.50, 2006-05-02
....

And the file continues with much more...

Here is the actual procedure to create the identity.dat file:

1. Once the unit has completed booting, press ‘MENU SELECT’
2. Select ‘BASE FUNCTIONS’ -> ‘BASE’.
3. Press the button beside ‘SELECT’
4. Scroll down to the second selection ‘SYSTEM IDENTITY’ and press ENTER
5. Press the button beside ‘Test’ and then press ‘ON’

The unit will then write the file to your memory card under the name of Identity.dat
If you are not using a PCMCIA card then follow the same steps as above and the file identlty.dat is written in the internal disk of the CMU.

C:\internal\log\identlty.dat.

You can attach a PS2 or USB keyboard and press Alt-F4 to exit to MS-DOS, then go to the c:\INTERNAL\LOG\ and use the MS-DOS command "edit identity.dat" to edit the file and take note of the serial number.

The SWOPT.DAT file is plain text and you can find it in c:\CMU\DATA folder. You can save the keys for your licenses.
In message #59 I explain as you can generate the keys with python(x,y) by cut and paste the lines of python code, it is easy.

Manuel
Title: Re: Enabling options for R&S test equipment
Post by: bobaru on January 30, 2017, 02:34:43 pm
THANK YOU Manuel!   Somtimes I just need things spelled out in order to get me started.

I followed your instructions and was able find the second serial number (mine was 002), downloaded the python x,y program and pasted your instructions in.    I deleted the leading zeros from the second serial number and just used 2.   The last instruction generated the hex code and I used that and entered it in the options section.   This prompted me to reboot and when I did it added the FM Stereo modulation option to the unit.  WOO HOO!

I will now take some time to review the other options to see if I want to add any more.

On a side note, my unit didn't come with an optional OCXO.   Anyone know of a source for these?    I don't really want to purchase another CMU200 just to get the B11 or B12 option.

-bob
Title: Re: Enabling options for R&S test equipment
Post by: msraya on January 30, 2017, 07:21:03 pm
Bob:

I think that to search for a B11 or B12 board don't worth it.. as you can get a Rubidium standard from ebay quite cheap (100$ aprox)..

I do it and It is very useful. I get a EFRATOM LPRO-101 that I use and It have senoidal output with very low phase noise: http://www.ka7oei.com/10meg_rubidium1.html (http://www.ka7oei.com/10meg_rubidium1.html)
Also you can get a 10MHz amplifier and supply all the equipment in your lab with the frequency standard..

Manuel
Title: Re: Enabling options for R&S test equipment
Post by: Brainbox on January 30, 2017, 09:49:28 pm
I think MSRAYA is right, You better buy an external clock generator which You can use for all Your equipment.
Me myself us a GPSDO with a accuracy of 10e-14
http://www.ebay.com/itm/Trimble-65256-57963-B-GPS-precision-clock-thermostat-board-10MHz-oscillator-/162166562432?hash=item25c1e15e80:g:qusAAOSwU-pXrTIf (http://www.ebay.com/itm/Trimble-65256-57963-B-GPS-precision-clock-thermostat-board-10MHz-oscillator-/162166562432?hash=item25c1e15e80:g:qusAAOSwU-pXrTIf)
Add a GPS antenna and a 6 V power supply ans You have all You need.
Title: Re: Enabling options for R&S test equipment
Post by: bobaru on January 31, 2017, 01:17:27 pm
That sounds like a plan.   I will research adding a Rubidium standard to the bench.   I have other devices that could take advantage of it as well.

Thanks,

-bob
Title: Re: Enabling options for R&S test equipment
Post by: senseless on February 05, 2017, 12:47:40 pm
Thank you all for your successful investigations. I was able to enable some software options easily. But for some applications, my system is crashing. The basic RF stuff is working just fine, but 3G stuff for example is not starting. Has somebody encountered the same problem in the past? And was able to fix it?
Title: Re: Enabling options for R&S test equipment
Post by: bobaru on February 05, 2017, 06:00:13 pm
It could be the hard drive failing.  It is one of the achilles heels of this unit.  Once you enabled the option it needed to load the file into memory and it is having an issue when it gets to the bad line.      Are you able to copy the file from the hard drive to a floppy disk or pcmcia card (whichever your unit has)?    When I get a chance I will see if that file is on my unit.    Also, how much memory does your unit have?    Perhaps loading the file is causing an out of memory condition. 

-bob
Title: Re: Enabling options for R&S test equipment
Post by: senseless on February 05, 2017, 08:26:43 pm
It could be the hard drive failing.  It is one of the achilles heels of this unit.  Once you enabled the option it needed to load the file into memory and it is having an issue when it gets to the bad line.      Are you able to copy the file from the hard drive to a floppy disk or pcmcia card (whichever your unit has)?    When I get a chance I will see if that file is on my unit.    Also, how much memory does your unit have?    Perhaps loading the file is causing an out of memory condition. 

Unfortunately, I do not have a pcmcia card yet, but it is probably a good idea to have one in general.. Nevertheless, I will test if any of my other units has the behavior after unlocking.
My unit has the FMR6 processor with 256MB RAM. I guess that should be no problem.
Title: Re: Enabling options for R&S test equipment
Post by: oh2ftu on February 18, 2017, 02:26:17 pm
Has someone been able to hack the amps software to allow for other than 30kHz stepping? 12,5kHz would be nice, or why not 5kHz?

Title: Re: Enabling options for R&S test equipment
Post by: Velund on February 23, 2017, 02:16:43 am
By the way, I found the last original software right on the r&s server:
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR001Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR001Z?OpenDocument)
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR003Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR003Z?OpenDocument)
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR004Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR004Z?OpenDocument)
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR006Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR006Z?OpenDocument)

Sadly no WCDMA-package :(

All packages and all software manuals is there. I noted this in some other CRTU-related thread.

WCDMA s/w and release notes: http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr007z2?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr007z2?OpenDocument)
WCDMA manual: http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr007m2?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr007m2?OpenDocument)
Title: Re: Enabling options for R&S test equipment
Post by: Fohdeesha on March 10, 2017, 07:25:07 am
Just wanted to give this a little bump and say thanks to everyone in here for all the work figuring this out. Just won 2 CRTU-RU's in an auction and am excited to dick around. I'll be imaging the drives they come with right away just in case, and probably replacing them with some slightly newer IDE drives I have laying around to skip that issue altogether.

I'm pretty sure one of them has the B7 IQ/IF option, I remember reading that's somewhat desirable?

Also, I take it I won't be able to use this unit for GSM? The few pics they sent me show a whole lot of missing hardware options for GSM, I'm guessing those can't magically be licensed? I do know it was used in a WCDMA lab so I'd imagine it does have that hardware, perhaps someone here could use that? - http://i.imgur.com/aGyrmZI.jpg (http://i.imgur.com/aGyrmZI.jpg)

EDIT: Just Kidding! Dovebid decided to cancel all winning bids in this particular lot because uh...reasons?
Title: Re: Enabling options for R&S test equipment
Post by: Pieh0 on March 24, 2017, 08:55:38 pm
By the way, I found the last original software right on the r&s server:
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR001Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR001Z?OpenDocument)
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR003Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR003Z?OpenDocument)
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR004Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR004Z?OpenDocument)
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR006Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR006Z?OpenDocument)

Sadly no WCDMA-package :(

All packages and all software manuals is there. I noted this in some other CRTU-related thread.

WCDMA s/w and release notes: http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr007z2?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr007z2?OpenDocument)
WCDMA manual: http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr007m2?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr007m2?OpenDocument)

"This page is only available until 31/12/2017"

Download these and put them somewhere safe!
Title: Re: Enabling options for R&S test equipment
Post by: tech255 on April 24, 2017, 06:14:31 pm
Thanks to all that have contributed to this subject, it has taken me a while to figure out how to load and run python as i am not a programmer.

So my cmu200 is the 1100.008.30 model which i gather is mainly for calibrating phones on a production line it comes with the base system which seems to include ssb dsb am fm and stereo modulation.

I have tried to unlock some of the options that are available k56 and k64 both wcdma extras i have used the python code isted to generate the option unlock codes.

Serial no 100344
Serial no  30
Opt 56

Returns 98a3997dc1d76c93

I went into the options update section and entered to code it accepted it and asked me to reboot i did all this but the option does not appear.

I am wondering i do have a swopt.dat file but it is listed with 0 bytes its an empty file should there not be keys in there already from the stuff thats already setup.
Title: Re: Enabling options for R&S test equipment
Post by: smgvbest on May 06, 2017, 01:48:56 am
Has anyone looked at enabling options for the SMIQ Vector Signal Generators?
Would love to try to get a few options turned on

Title: Re: Enabling options for R&S test equipment
Post by: RF_fanatic on May 15, 2017, 05:17:17 pm
By the way, I found the last original software right on the r&s server:
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR001Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR001Z?OpenDocument)
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR003Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR003Z?OpenDocument)
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR004Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR004Z?OpenDocument)
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR006Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR006Z?OpenDocument)

Sadly no WCDMA-package :(

All packages and all software manuals is there. I noted this in some other CRTU-related thread.

WCDMA s/w and release notes: http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr007z2?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr007z2?OpenDocument)
WCDMA manual: http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr007m2?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr007m2?OpenDocument)

In order to be complete :

The CDMA 2000 MS 5.20 package is here : http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr009z2?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr009z2?OpenDocument)

Does anybody has the install file for the 1xEV-DO 5.20 ?

Title: Re: Enabling options for R&S test equipment
Post by: Velund on May 15, 2017, 07:24:49 pm
Does anybody has the install file for the 1xEV-DO 5.20 ?

http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr015m?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr015m?OpenDocument) - manual
http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr015Z?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr015Z?OpenDocument) - install

BTW - http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/DATS?OpenDocument (http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/DATS?OpenDocument) - It is PC part of CMU-K92 option, GPRS application testing package. Manual is also there.
Title: Re: Enabling options for R&S test equipment
Post by: Muxr on May 15, 2017, 11:45:39 pm
I've tried the encode script on my RTM 1054 Oscilloscope without luck. My scope doesn't have a /xxx serial, it only has one number. Also unless I am missing something only software options possible are K1, K2 and K3. But since the input is an integer, I can only enter 1, 2 or 3. So I tried those without luck. I get the error (-02) when trying to activate the produced code.

(http://i.imgur.com/ywnXSAu.png)

I don't think this will work with oscilloscopes.

I also have a SMIQ RF generator I will try this on this weekend.

Title: Re: Enabling options for R&S test equipment
Post by: nctnico on May 16, 2017, 12:00:06 am
Maybe the scripts needs more tweaking. I can't imagine R&S uses totally different schemes for different equipment. This would upset their entire logistics dealing with option keys.
Title: Re: Enabling options for R&S test equipment
Post by: Muxr on May 16, 2017, 12:04:48 am
Aye, that's true.. will look into it further.
Title: Re: Enabling options for R&S test equipment
Post by: ve7xen on June 03, 2017, 05:50:11 am
Received a CMU200 today in pretty good nick, but not many options, I do have the audio measuring stuff though. It's kind of annoying that the RF generator turns off when you switch to the audio measurement application. What were they thinking??

I tweaked the keygen a bit to hopefully make it easier to use, it prompts for your S/N and generates all (I think) available keys. You can also run it directly from a browser on repl.it. Just click here: https://repl.it/I4Pp/0 (https://repl.it/I4Pp/0) Or find it on the repository below.

I created a repository on my website as well to host documents, firmware, etc. for the CMU200. I've placed some useful files there. If you think there is anything else that belongs, please PM me and I'd be happy to host it. http://gotroot.ca/cmu200/ (http://gotroot.ca/cmu200/)

Thanks for the efforts of those in the thread!
Title: Re: Enabling options for R&S test equipment
Post by: Skippossauro on June 05, 2017, 05:19:34 pm
Hi,

Today checked installed keys on newer equipment's with Win7 and Win10 installed, and keys are in pure decimal, and have 30 digits long, I've checked FSV, RTO and RTM R&S parts. To generate keys with double length, i.e. 16 byte long I believe other method should be used, right?

Regards,
Skippy

Received a CMU200 today in pretty good nick, but not many options, I do have the audio measuring stuff though. It's kind of annoying that the RF generator turns off when you switch to the audio measurement application. What were they thinking??

I tweaked the keygen a bit to hopefully make it easier to use, it prompts for your S/N and generates all (I think) available keys. You can also run it directly from a browser on repl.it. Just click here: https://repl.it/I4Pp/0 (https://repl.it/I4Pp/0) Or find it on the repository below.

I created a repository on my website as well to host documents, firmware, etc. for the CMU200. I've placed some useful files there. If you think there is anything else that belongs, please PM me and I'd be happy to host it. http://gotroot.ca/cmu200/ (http://gotroot.ca/cmu200/)

Thanks for the efforts of those in the thread!
Title: Re: Enabling options for R&S test equipment
Post by: Astrodev on July 14, 2017, 10:18:02 pm
Just got round to trying the interactive version of the generator and it worked when I enabled the K54 Bluetooth Audio Profiles and it worked exactly as expected.

However in getting the DAT files off the instruments I noticed something that on a couple of different instruments the Hex identifier was the same as the last 2 digits of the R&S numeric model number printed on the front panel, is this just a coincidence or is this where it originates to identify different versions of an instrument.
Title: Re: Enabling options for R&S test equipment
Post by: fisafisa on August 20, 2017, 10:17:57 pm
Hi
Anybody tried adding software options to a CRTU unit?
I was able to install the various packages but I do not have the option to enabling them with the code.
The only sw options I can enable are K2,K5,K6,K9

Code generation works otherwise.

F
Title: Re: Enabling options for R&S test equipment
Post by: ps on August 21, 2017, 06:04:39 pm
I was able to install the various packages but I do not have the option to enabling them with the code.
The only sw options I can enable are K2,K5,K6,K9

You have Option B5/B6 installed? This is required for stand-alone GSM, K20 - K26.

WCDMA does not run on the CRTU-RU (what you probably have), but on the CRTU-PU. This is a separate Protocol Unit with a PC and a couple of DSP boards that connects to the CRTU-RU via the B7 I/Q interface. Usually you have either a stand-alone GSM system (with B5/B6) or an expanded system with B7 and CRTU-PU box.
Title: Re: Enabling options for R&S test equipment
Post by: fl30216 on September 01, 2017, 09:51:29 pm
Hi,
I would like go back to the topic: Enabling options for R&S test equipment.

I have the same problem like AudioplatinumService in re #35 with an R&S UPL Audio Analyzer. I would like to enable the UPL-B6 Option for advanced analyzing.

Unfortunatelly I can't find out the key methode, but it seems others then for the CMU200.
Maybe someone has more experience as I and can help.

The key code are 5 numbers in the rage from 00000 until 65535.

The required inputs are the same like for CMU200:
1.) SNumber: new 100404 or old 849260
2.) SNumber2 new 1078.2008Kxx (xx = 06 or 16 or 66) or the second part of the old Serial Number xxx
3.) Option Number e.g. Option UPL-B4 = "2", UPL-B10 = "3", UPL-B6 = "4"

Sample key codes that I have:
SN           SN2         B4 (0)      B21 (1)    B22 (2)     B10 (3)    B6 (4)      B8 (6)      B9 (8)      U81 (9)
100404    06           43505                                      44597     37262                      38524   
100882    06           51667                                      52759            
100918    06           35281       65062                      36373            
100103    16           46338                                      45766      36221      36071      35471      65007
100254    16           18966                                      17822      15080                     13580      28134
100261    16           38152                                      37580      43653         
                           
849260    015         15747       19559      42997       14917            
833494    002         33711                                      33899      48080       47690      
829567    001         10410                                      10018      11306         
826546    007         51993                                      52445      62310         
Title: Re: Enabling options for R&S test equipment
Post by: fisafisa on September 02, 2017, 10:31:38 pm
HI
I have got two CRTUs
one has :
rxtx1                V7.20    17.01.03
rxtx2                V7.20    17.01.03
PMGR_RX_DSP_1     
PMGR_TX_DSP_1     
PMGR_RX_DSP_2     
PMGR_TX_DSP_2     
CMU-B17           
CMU-B27           
2nd RF Channel   
DIG               
ADC 1             
DDC 1             
AUC 1             
ADC 2             
DDC 2             
AUC 2             
OCXO 2           
NETCLK 1         
NETCLK 2         
REF_EEP           
RXTX2_EEP         
DIG_EEP           
AUC1_EEP         
AUC2_EEP         
ADC1_EEP         
ADC2_EEP         
IQIF_EEP         
CMU-B11/B12       B12
Harddisk         
PCMCIA           
CPU               Intel Pentium III
CRTU-B1/B2        B2
CRTU-B5           +
CRTU-B5-1_V04     
CRTU-B5-2_V04     
CRTU-B56-1       
CRTU-B56-2       
CRTU-B6           
CRTU-B7           
FE (1100.3120.02)
CMUDrv           
CMU               
K2               
K5               
K20               not enabled
K21               not enabled
K22               not enabled
K23               not enabled
K24               not enabled
Audio             
RF               
GSM 400 MS       
GSM 850 MS       
GSM 900 MS       
GSM 1800 MS       
GSM 1900 MS       

The other has
rxtx1                V7.20    17.01.03
rxtx2                V7.20    17.01.03
PMGR_RX_DSP_1     
PMGR_TX_DSP_1     
PMGR_RX_DSP_2     
PMGR_TX_DSP_2     
2nd RF Channel   
DIG               
ADC 1             
DDC 1             
AUC 1             
ADC 2             
DDC 2             
AUC 2             
OCXO 2           
NETCLK 1         
NETCLK 2         
REF_EEP           
RXTX1_EEP         
DIG_EEP           
AUC1_EEP         
AUC2_EEP         
ADC1_EEP         
ADC2_EEP         
CMU-B11/B12       B12
Harddisk         
PCMCIA           
CPU               Intel Pentium III
CRTU-B1/B2        B2
CRTU-B5           
CRTU-B5-1_V04     
CRTU-B5-2_V04     
CRTU-B56-2       
CRTU-B6           
FE (1100.3120.02)
CMUDrv           
CMU               
K2               
K20               not enabled
K21               not enabled
K22               not enabled
K23               not enabled
K24               not enabled
Audio             
RF               
GSM 400 MS       
GSM 850 MS       
GSM 900 MS       
GSM 1800 MS       
GSM 1900 MS       

I guess I should be able to enable options K20-K24 in both?

Thanks

Title: Re: Enabling options for R&S test equipment
Post by: fl30216 on September 03, 2017, 08:53:59 am
What is your type number? Normally the RU's have 82 or 83. That is your SN2 for the key generator.

BR
Title: Re: Enabling options for R&S test equipment
Post by: MaartenH on September 07, 2017, 07:33:55 pm
Back to installing the AMPS option:
I downloaded IS1MV5.20.exe and put this on the PCMCIA drive.
In the DOS mode I tried to execute this file but the answer was "This program cannot be run in DOS mode" How to execute it ?
Title: Re: Enabling options for R&S test equipment
Post by: Velund on September 07, 2017, 07:41:14 pm
If memory serves me correctly, it is self-extracting archive, need to be extracted to the root of PCMCIA drive. Then put this drive in turned off CMU, start and enter Version Manager and choose s/w installation.
Title: Re: Enabling options for R&S test equipment
Post by: MaartenH on September 07, 2017, 08:32:35 pm
But the R&S site says:
 " Download the file IS1MV5.20.exe on your PCMCIA-Memory card and execute it.
It will create the installation folder "IS1MV5.20" with the necessary files for the software update.
After this you can delete the file IS1MV5.20.exe"
Title: Re: Enabling options for R&S test equipment
Post by: Velund on September 07, 2017, 08:50:18 pm
It is self-extracting archive. Once you execute it from root of PCMCIA (in Windows) - it unpack yourself to a folder on the same drive.
Title: Re: Enabling options for R&S test equipment
Post by: MaartenH on September 07, 2017, 09:01:18 pm
Clear, but how do I start Windows ?
When I start normally I come direct in the CMU application, from there I can go with (ALT-F4) to DOS, but how to start only Windows ?
Title: Re: Enabling options for R&S test equipment
Post by: Velund on September 07, 2017, 09:14:05 pm
I used my old laptop PC with Windows 98 to make installation card.

You can try to unpack on PC and move resulting folder to card
Title: Re: Enabling options for R&S test equipment
Post by: fisafisa on September 07, 2017, 09:57:26 pm
replying to fl30216
subtype is 082
Title: Re: Enabling options for R&S test equipment
Post by: eliocor on September 07, 2017, 10:11:06 pm
Quote
Skippossauro on 2017-06-05, 17:19:34 (https://www.eevblog.com/forum/index.php?topic=79496.msg1225995#msg1225995)
Today checked installed keys on newer equipment's with Win7 and Win10 installed, and keys are in pure decimal, and have 30 digits long, I've checked FSV, RTO and RTM R&S parts. To generate keys with double length, i.e. 16 byte long I believe other method should be used, right?

A friend of mine owns a SMJ100A unit (discontinued) and I discovered the options key is composed of 15 couples of numbers (no alphabetic chars), so the generator proposed in this discussion is useless.
Any hope to find a compatible generator?
Title: Re: Enabling options for R&S test equipment
Post by: MaartenH on September 08, 2017, 12:25:29 pm
@ Velund THANKS !
Title: Re: Enabling options for R&S test equipment
Post by: fl30216 on September 10, 2017, 03:02:47 pm
@fisafisa

It looks like, that it is not possible to enable the K2x (signaling) options in a CRTU-RU device. For enabling any options it must to see in the SETUP --> OPTION menue. If not you can't enable.
Maybe it is depend on the HW option. The CMU200 and the CRTU-RU have different HW (B5 vs. B21) and different FW (5.2x vs. 3.23) in it. You know, the CRTU-RU is not a stand alone device, it comes always together with a CRTU-PU (protocol unit). You can see it on your serial number ("part of ...).
What you want is using the signaling options of an CMU200, but the signaling options for a CRTU-W (this is the real name of the device combination) is generated in the PU (protocol unit), the RU is controlled be remote.
You can only using the non-signaling and the maintenance possibilities in the RU if its stand alone.

BR
Title: Re: Enabling options for R&S test equipment
Post by: tmbinc on September 11, 2017, 09:17:32 pm
CRTU-RUs are only paired with CRTU-PUs for WCDMA application. For GSM, the CRTU-RU is stand-alone.

The CRTU-RUs paired with PUs have the IQ option (B7 if i remember correctly?), but they don't have the CRTU-RU's GSM signalling options. The CRTU-RUs from stand-alone configurations (CRTU-G) usually don't have the IQ option (unless they were used with an external fading simulator, or interfacing to a phone baseband directly), but did contain the GSM signalling boards.

Now, the CRTU signalling options are detected by the CMU software, but - as far as I know - cannot be used for GSM signalling mode. The CMU software seem to be able to load the FPGAs for these, but it doesn't "unlock" the signalling test options due to missing hardware. (I once patched the executables to show the menu, but access to it crashes; it's definitively not a software licensing/option issue.)
Title: Re: Enabling options for R&S test equipment
Post by: fisafisa on September 11, 2017, 10:17:47 pm
If tmbinc is correct, then there is a hardware configuration with a GSM signalling card.
Do you know what card would that be?
Is that a module that slots inside one of the cards?

Title: Re: Enabling options for R&S test equipment
Post by: tmbinc on September 12, 2017, 03:22:32 pm
I should have been more clear: The GSM signalling hardware for CRTU-RUs is different from the GSM signalling hardware for CMU200. The DOS OPSW only supports the CMU200 version.


(That's the simplified version.)

I think there are different types of GSM signalling options for CMU200 (B21; B21Var14; V21Var02); there's the USU (Universal Signalling Unit) and the ULH (Universal Link Handler). There's also B56Var14 (PowerPC for USU).

Now, for CRTU, there's CRTU-B5-{1,2}_V02 and CRTU-B5-{1,2}_V04 (mine has the CRTU-B5-{1,2}_V04 fitted), as well as the CRTU-B56-2 (PowerPC board; from Windows you can telnet into it and it runs Linux(!)).  But these do not allow the signalling tests to be used. I agree that they _sound_ similar to the CMU-200 options, they physically seem to be different; so I believe.

Do we have board photos of them to compare them with the CRTU-RU cards?
Title: Re: Enabling options for R&S test equipment
Post by: fisafisa on September 15, 2017, 10:04:16 pm
hi.
Thanks for the info.
Are you able to telnet to them on the standard port?

Running linux... If so we can ask RS to release the source code...
I think it would be really great if we had a more detailed block diagram of the CRTUs..
Title: Re: Enabling options for R&S test equipment
Post by: Wilts01 on November 08, 2017, 01:26:32 pm
I have been following this thread with some interest.

I have managed to get the ability to add additional sw modules working on my CMU200.  For example, I have got the stereo K14 option working.  However, I am having problems getting AMPS (K29) to work. 

I started off by putting in the option code for K29 which it accepted.  However, no sign of the AMPS option on the menu.  I then realised that I should have installed the IS1MV5.20 software which I successfully managed to do.  However, I still do not have AMPS working.  As you can see from the photo below, the CMU200 seems to see AMPS is there but it isn't enabled on Chan 1 (and selecting it makes no difference).  Any idea what I have missed?  I have the following hardware options B12, B21v14, B54v14, B56v14, B66, B68, B96, U65v04.


Any advice gratefully received


Title: Re: Enabling options for R&S test equipment
Post by: Velund on November 08, 2017, 01:38:12 pm
I started off by putting in the option code for K29 which it accepted.  However, no sign of the AMPS option on the menu.

You have no AMPS software package installed. Option is activated, but no software to use it in instrument. Installation package is available, so just install it and go ahead.
Title: Re: Enabling options for R&S test equipment
Post by: Wilts01 on November 08, 2017, 03:30:00 pm
Thanks.  Apologies if I am being stupid but exactly what is the AMPS software?  i thought it was part of the IS1MV5.20 package which i have installed.  Is there another package I should be installing?  If so, where do I get it?

Title: Re: Enabling options for R&S test equipment
Post by: Velund on November 08, 2017, 03:39:23 pm
Yes, it is part of the IS1MV5.20 package.
Maybe you have more than one base versions on disk and package was installed with another base?
Title: Re: Enabling options for R&S test equipment
Post by: Wilts01 on November 08, 2017, 04:04:36 pm
Further update.  I have edited SWOPT.dat to remove the option.  Rebooted and then put the option code back in.  Still no joy with AMPS.

I then tried enabling the IS136 option to prove that the IS1MV5.2 software was working properly.   This worked fine.  Also, Version Manager reports that IS!MV/AMPS is installed.

One thought - is the B41 option hardware mandatory for AMPS?
Title: Re: Enabling options for R&S test equipment
Post by: RF_fanatic on November 08, 2017, 08:56:04 pm
Yes B41 is manditory for AMPS

Without B41 the AMPS will not be shown in the menu of the CMU regardless if you have an official code for the AMPS option or not.

Just to be sure I have checked it with one of my CMU units with an original AMPS key. When I remove the B41 than the option is gone

I have some spare B41 units for sale but the distance will make it difficult
Title: Re: Enabling options for R&S test equipment
Post by: bernroth on November 25, 2017, 09:18:28 pm
Anyone with some luck for other gear like FSL spectrum analyzer? It uses keys with 32 decimal digits. Looks like there is a newer algoritm used in newer gear.
Title: Re: Enabling options for R&S test equipment
Post by: Octane on February 03, 2018, 05:02:07 pm
Hi y’all!

I got a CMU 200 a few days ago and I was very lucky with the fitted options:

Model CMU 200-1100.0008.02
SW Version [Basesystem]: V5.22

Software Options:
CMU-K21 GSM900-MS V5.22
CMU-K22 GSM1800-MS V5.22
CMU-K23 GSM1900-MS V5.22
CMU-K24 GSM850-MS V5.22
CMU-K42 GPRS@GSM-MS V5.22
CMU-K43 EGPRS@GSM-MS V5.22

Hardware Options:
CMU-B11 OCXO
CMU-B17 I/Q-IF Interface
CMU-B21V14 Universal Signalling Unit
CMU-B41 Audio Measurement Unit
CMU-B54V14 Signalling Module f. GSM, TDMA, AMPS
CMU-B95 Additional RF Generator
PCMCIA
CMU-U65V04 DSP f. Wideband Measurement
CMU-U99 RF1 with RF2 Level Range

Hardware Equipment:
Front Module: FMR6
CPU: Intel Celeron Mobil
Memory: 256 MB

Firmware Versions:
uP1: V8.50 02.05.06

I would like to try to enable a few more options:
CMU-K14 Stereo FM Transmitter
CMU-K20 GSM400 (just for fun)
CMU-K21 GSM900, R-GSM, E-GSM (Just for fun)
CMU-K27 IS-136 (fun)
CMU-K28 IS-136/PCs (fun)
CMU-K29 AMPS
CMU-K48 I/Q versus slot
CMU-K53 Bluetooth

I think I should have all the necessary hardware options for those, right?

The list of software installed on the machine is:
Base V3.61 — GSM MS V3.62
Base V5.21 — GSM MS V5.22
Base V5.22 — GSM MS V5.22 (active)

So I probably need another software package, but can I use the IS1MV5.20.exe package that VE7XEN is so kindly hosting? Or do I need the same version number?

Thanks for all your help!

Michael
Title: Re: Enabling options for R&S test equipment
Post by: Velund on February 03, 2018, 05:08:32 pm
You need Bluetooth hardware and installed Bluetooth software to enable BT option. Looks like your CMU is not BT-capable.

Get the last versions you can get and install them.

I made a full image of internal HDD before changing something on my unit, just to be able to get it back to original state if something goes really wrong.
Title: Re: Enabling options for R&S test equipment
Post by: Octane on February 03, 2018, 05:11:49 pm
Oh, yes, CMU-B53. I did indeed overlook that, thanks for pointing it out.

Michael
Title: Re: Enabling options for R&S test equipment
Post by: Octane on February 04, 2018, 03:13:00 am
Get the last versions you can get and install them.

I made a full image of internal HDD before changing something on my unit, just to be able to get it back to original state if something goes really wrong.

Yes, I will do that before installing anything. I’m just waiting for the IDE/USB adapter to arrive.
I put some codes in and the FM stereo seems to work. AMPS does not yet, so I’ll need the software package.
I’ll try to install IS1MV5.20.exe on my base V5.22 after I have a backup.

Thanks for your help Velund!

Michael
Title: Re: Enabling options for R&S test equipment
Post by: Octane on February 09, 2018, 03:38:35 am
Issue resolved! Reformatting as FAT16 fixed the problem. The weird thing was that Mac OS X said from the beginning that it was FAT16 formatted....hmmm

So the USB/IDE adapter arrived, I got the HDD out of the CMU 200 and took an image. Put it back and the CMU works. Everything fine so far.
I also got a SanDisk CF to PCMCIA adapter and WD SiliconDrive 2GB PATA CF cards (SSD-C02G-3800).

I made sure that the CF card is formatted with FAT16.
Extracted the IS1MV5.20 folder from the IS1MV5.20.exe and put it onto the CF card.
Put the card into the PCMCIA adapter and plugged it into the left slot on the front of the CMU.

Pressed the power button. The usual beeping happens.
The R&S splash screen with the green rectangle "progress bar" on the bottom appears.
All the rectangles appear the message to enter the "Version Manager" is still there.
The hexagons on the top right keep animating, but nothing else happens.

Same with the right PCMCIA slot.

If the PCMCIA adapter is in the slot I can't get into the version manager by pressing the "Menu Select" button during the 3 quick beeps.
It just does the same thing as before.

I booted up the machine without the card. Then "Alt-F4". I put the card in and tried to change to different drive letters.
At one it crashed with the message "Divide Overflow".

Next I rebooted and got into the BIOS.
The BIOS does not show any drives in addition to the internal one. Is that normal with PCMCIA cards?
I have not used any of those for a very long time and I never used an adapter for CF cards.
Could somebody please check this on his unit?

I then removed the card again, booted into the version manager (not very reliable to get into it in my opinion).
I scanned for additional drives, non-found as expected.
Then I put the card in and scanned again. I got the "Divide Overflow" error again and the machine froze.

I just got onto the DOS prompt again (Alt-F4 after booting) and hat the PCMCIA card installed all the time (no CF card yet).
Drive letters D: and E: Fail to read, as expected.
If I put the CF card in and try to change to E: again the weird "Divide Overflow" error happens again with a full freeze.

Any ideas what I'm doing wrong? What could I check?

Thanks in advance guys!

BR,
Michael

Edit: Typo...
Title: Re: Enabling options for R&S test equipment
Post by: riku on February 10, 2018, 08:25:32 am
Hi! i was very luck find this place to talks about cmu.

okey letme ask dump question, i do have same problem as Wilts01 user have, the option K29 AMPS is grey out selection, how to enable it?
I have sticker behind unit where is serial number for that option so it is legite one, software version is 5.10 and i have audio module B41 installed on system, while Wilts01 did not have it.
so where i can enable it? it is installed at somepoint as sticker is there it should suppose to work.
Is only way to upgrade whole unit? because the sticker is still there and and... i have no idea how to upgrade unit, is it just run IS1MV5.20.exe file, or it need some flash methood? just cpoy file into cmu and run it? found exe file on google couple megs, dunno if that is right one..
recently i swapped hard drive because old one was almost end of life, i managed clone it, and do image backup from it on desktop pc.

Please, im very novice on this, would appriciate ant tips :)
Title: Re: Enabling options for R&S test equipment
Post by: Bicurico on February 10, 2018, 09:23:06 am
You can only activate software options if they are installed.

So yes, first you install the IS1MV5.20 and then you should be able to activate it with the code from within the SETUP menu.

Or, you just activate everything with the keygen and directly write into the license file with a text editor. However, that is of no use if you don't have the respective HW or SW versions installed. Just activating the options will list them as present, but you get no extra functionality.

Regards,
Vitor
Title: Re: Enabling options for R&S test equipment
Post by: riku on February 10, 2018, 03:27:24 pm
thanks vitor for answer,
however after abit digging i found out base system need be 5.20, and i found only 5.21 on r&s website, it involves i guess upgrade whole system... i dont know even can i upgrade from 5.10 to 5.21 direcly.. oh my this simple thing became just complicated :D:D
Title: Re: Enabling options for R&S test equipment
Post by: Bicurico on February 10, 2018, 03:48:44 pm
The upgrades coexist side-by-side. In this thread there is a link where you can download the v5.20 software with at least some options. Follow the instructions to install it.

You use the software manager to select which is the active installation. After turning the device on, press the MENU SELECT key during boot after the beep.

Important: make a backup of the whole existing HDD, just in case.

Regards,
Vitor
Title: Re: Enabling options for R&S test equipment
Post by: harald_schmitt on February 15, 2018, 11:30:16 pm
hello to all. i have a nice rohde schwarz fph spectrum rider and would like to know if there is a chance to get some license keys / serials for the options.

best regards

harald
Title: Re: Enabling options for R&S test equipment
Post by: pressurefm on March 27, 2018, 08:44:03 pm
Good afternoon friends! I am a ham radio, there is an R & S FSH3, please help how to activate the options, K2, K3, K4?
Serial number 5 digit, without a fraction. A ready-made key should be only from digits and have 10 characters.
The guys really need your help !!!
 |O
Title: Re: Enabling options for R&S test equipment
Post by: stabista on April 02, 2018, 11:12:02 am
Serial number of mine FSH3 is 100561. Model number is 23 (023?). Needed option is K2 (2? i havent option number in hex). I tried to use methods from enabling options threads for other R&S equipment (crypto script for python and script for c (but for that last one i`m also havent hex representation for option codes), in first case got hex code, but need 10 digit.
Title: Re: Enabling options for R&S test equipment
Post by: pressurefm on April 02, 2018, 11:43:37 am
//
// Valori Strumento FSP "http://www.rohde-schwarz.it/it/prodotti/test_and_measurement/spectrum_analysis/FSP-|--|-100-|-6394.html"
//
char KeyString []   = {"0123456789"};      // Opzione originale ottenuta da "Rohde & Schwarz", per verifica funzionamento Keygen
char SerString []   = {"xxxxxx/xxx"};      // Seriale dello strumento

//
// Programma Calcolo Codici Opzioni FSP
//
int main(void)
{
   unsigned long key;
   unsigned long opzione;

   option_type * option = option_list;

   //
   // Test funzionamento con opzione valida
   //

   // Decodifica Opzione
   opzione = decrypt(KeyString, SerString);

   // Codifica Opzione
   key = encrypt(option->raw_option, SerString);   

   //
   // Calcolo tutte le opzioni "Funzionanti" per Seriale
   //

   // Per tutte le opzioni dispinibili
   while (option->raw_option)
   {
      // Controllo se opzione valida
      if(option->valid_option == TRUE)
      {
         // Calcolo chiave
         key = encrypt(option->raw_option, SerString);   

         // Stampo valore opzione da immettere nello strumento
         printf("%010lu - %s\r\n", key, option->descr_option);
      }

      // Opzione successiva
      option++;
   }
}
Title: Re: Enabling options for R&S test equipment
Post by: jacobhl on May 02, 2018, 01:02:56 pm
I have a R&S ZVB8 2 port Vector Network Analyzer, but I can't see any options file (SWOPT.DAT or similar). Under 'Info', no files are loaded that indicate which file it could be.

I could really use the ZVAB-K2 Time Domain option - does anyone have any good suggestions? The serial-number is 6-digits.

To be honest, I can't even see where I would load a valid software option key.
Title: Re: Enabling options for R&S test equipment
Post by: carver on May 29, 2018, 10:36:57 pm
To be honest, I can't even see where I would load a valid software option key.
check Option Key Entry section in manual.
need load xml or input 30 digit key.
both produced from unique DeviceKey and SN,
like for all r&s device, produced over ten years.
Title: Re: Enabling options for R&S test equipment
Post by: Ice-Tea on September 09, 2018, 07:04:07 pm
Hello Gents,

As some of you know, I have a stack of CMU200's. The herd is, however, thinning so I can no longer just pick one from the stack if a customer requires certain features. I recently sent out a unit with BT and I pressume it quite litteraly fell of a truck as it was damaged upon arrival. I want to send him a new unit obviously but I have none that are in good enough shape *and* have Bluetooth. So, I swapped a board with BT. The HW option is now listed but the SW option is not enabled.

Could anyone help me out by generating the key for me? Would be a great help...

Ice-Tea
Title: Re: Enabling options for R&S test equipment
Post by: tv84 on September 11, 2018, 08:57:10 pm
A side note -  the keygen in Reply #7 of this thread seems to work for R&S FSU, FSQ, FSP and FSIQ series on spectrum & signal analyzer; (at least).  :)

This strikes me as very interesting.    I've been working with the SMIQ's i960 firmware and complicated addressing scheme.   

Does anyone know the origin of the 'Seed Keys' in main.c?   

I know this is old but just for the records:

The seed keys and the functions used in the FSIQ KG were extracted from the API.DLL. (As an example here is the file from FSIQ_FW_v440_SP3 firmware file).
Title: Re: Enabling options for R&S test equipment
Post by: dl2ocb on September 14, 2018, 11:57:33 am
Hello,
does anyone know if the Keygen is usable for the ZVH4 Handheld too ?
Title: Re: Enabling options for R&S test equipment
Post by: tv84 on September 14, 2018, 12:39:28 pm
Hello,
does anyone know if the Keygen is usable for the ZVH4 Handheld too ?

The FSQ KG isn't.
Title: Re: Enabling options for R&S test equipment
Post by: dl2ocb on September 17, 2018, 08:53:44 am
Tnaks for the Info.

Does anyone know a Keygen for FSH oder ZVH Handheld Instruments fron Rohde&Schwarz ?

I got a ZVH4 and maybe i can supply some DLLs or other needed Files to create a KG.

Lets Keep the nice R&S Stuff alive !!!
Title: Re: Enabling options for R&S test equipment
Post by: mbirth on September 17, 2018, 09:35:29 am


Quote from: dl2ocb on Today at 10:53:44 (https://www.eevblog.com/forum/index.php?topic=79496.msg1829129#msg1829129)
Does anyone know a Keygen for FSH oder ZVH Handheld Instruments fron Rohde&Schwarz ?


The FSP keygen in this thread also works for the FSH. Use the serial number alone, no "/" and no model number.

Make sure to enable all keys and try them top to bottom until all options are unlocked.
Title: Re: Enabling options for R&S test equipment
Post by: dl2ocb on November 27, 2018, 07:20:30 am
Hello,

i tested the KeyGen for FSE/FSIQ to enable Options for the ZVH4 but with no success. I tried with full Serial-Nr. and with only the first part of the S/N.

I dont have a FSHx Model to check if the keygen does its Job on FSHx style analyzers.

Any Ideas out there what to try to free the Beast in the ZVH4 ?

CU
Stefan
Title: Re: Enabling options for R&S test equipment
Post by: sm7ovk on December 05, 2018, 08:15:49 am
Hello,
Tried the codes on my FSIQ and some of them are only accepted as correct but without any action. I also got one option that I would like to remove, frequency to 41GHz and it doesn't work without the correct hardware, anybody know how to remove?

My intention was to get K3 and K4 options but this seems to need some extra diskettes to install. Anybody have these?

Regards 73
Jens
Title: Re: Enabling options for R&S test equipment
Post by: vk3st on December 12, 2018, 08:30:24 am
Hi,
what compiler or assembler is ised for the script please?
I have tried Python and a number of others to no avail - all fail.
Maybe old age getting to me but never was a good programmer ;-(
Ian
ian@ian-foster.com
Title: Re: Enabling options for R&S test equipment
Post by: hidjedewitje on December 12, 2018, 08:50:39 am
Has anyone tried unlocking the options on the RTB2000/RTM3000 series oscilloscopes?

I am currently in doubt on whether I should go for a RTB2002 or save up a little more for a Keysight 3000T series. Mainly because the Keysight has the ability to unlock options.

I know Rigol scopes are able to be hacked, but their software seems buggy and slow.
Title: Re: Enabling options for R&S test equipment
Post by: eb4fbz on December 12, 2018, 09:47:16 am
Hello,

i tested the KeyGen for FSE/FSIQ to enable Options for the ZVH4 but with no success. I tried with full Serial-Nr. and with only the first part of the S/N.

I dont have a FSHx Model to check if the keygen does its Job on FSHx style analyzers.

Any Ideas out there what to try to free the Beast in the ZVH4 ?

CU
Stefan

I'm interested in ZVH options too  :-/O
Title: Re: Enabling options for R&S test equipment
Post by: hafrse on December 12, 2018, 02:39:46 pm
Hello,

had a problem with the hardisk and the CPU card, after replacing the CPU with another haddisk from another CMU, now I have another serial number shown from the new CPU card.
How do I get hold of Serial2 if I have replaced the cpu card and the harddisk? if there any way to dump the serial2 number?  after replacing the CPU with another haddisk, now I have another serial number shown.
many thanks in advance!
Title: Re: Enabling options for R&S test equipment
Post by: hafrse on December 12, 2018, 03:55:49 pm
I can try have a look at the ZVH licenses. For that I would need an example of S/N and one license from a volunteer. pm me.
Hello,

I think I found the answer, it is stated in post #59 in this thread. I only need to execute the Identity menu selection and a file will be generated with the serial1 and serial2.
I will try that .
Thanks anyway!
Title: Re: Enabling options for R&S test equipment
Post by: tv84 on December 12, 2018, 07:34:14 pm
I can try have a look at the ZVH licenses. For that I would need an example of S/N and one license from a volunteer. pm me.
Hello,

I think I found the answer, it is stated in post #59 in this thread. I only need to execute the Identity menu selection and a file will be generated with the serial1 and serial2.
I will try that .
Thanks anyway!

That has nothing to do with ZVH. It's only for CMU, FSU, FSQ, FSP and FSIQ.
Title: Re: Enabling options for R&S test equipment
Post by: Ice-Tea on December 17, 2018, 01:03:04 pm
Well, I'm trying to bring the script up myself again (HW guy trying to do SW stuf lolzz... yeah...)

I found that I can't get the PyCrypto package to work. Seems to have issues finding some VS install (tried several) and newer versions of Python (yes, also tried older ones). So I gave up on PyCrypto and use PyCryptoDome which should be close to compatible. At least it installs but when running

Code: [Select]
from Crypto.Cipher import ARC2
import struct

serial = 103086
serial2 = 2
option = 45

record = struct.pack("<II", serial, serial2 + (option <<20))
encyphered = ARC2.new("Revision\0").encrypt(record)
print encyphered.encode("hex")

I get

Code: [Select]
C:\Pyhton>python cmu.py
Traceback (most recent call last):
  File "cmu.py", line 9, in <module>
    encyphered = ARC2.new("Revision\0").encrypt(record)
TypeError: new() takes at least 2 arguments (1 given)

So, uhm, yeah... some help please?
Title: Re: Enabling options for R&S test equipment
Post by: KaneTW on December 17, 2018, 01:12:43 pm
Two options:
1. Use Anaconda
2. Install a Ubuntu VM and `sudo apt install python-crypto`

You could adapt the other library, but I don't know if it'll cause issues down the line.
Title: Re: Enabling options for R&S test equipment
Post by: Ice-Tea on December 17, 2018, 06:57:25 pm
Yeah, uh, I'm not going to learn how to use/install a new OS in a VM because I can't get a piece of SW to work. Thanks for the suggestions though...

Anaconda didn't do it for me either.

Actually found this link in this thread:

https://repl.it/repls/SkeletalDelectableDwarfrabbit

Didn't work at first, but got it to go!
Title: Re: Enabling options for R&S test equipment
Post by: Giedrius on December 21, 2018, 02:23:23 pm
Hello,
Has anyone been able to generate codes for FSL?
I used the python script to generate code and it produced a hex number. However, the device itself only takes decimal digits (0-9) as input (under install options dialog).
I tried converting hex code to decimal and entering but that didn't work either.
Has anyone had better luck with FSL device?
Title: Re: Enabling options for R&S test equipment
Post by: mbirth on December 21, 2018, 02:59:58 pm
Quote from: Giedrius on Today at 17:23:23 (https://www.eevblog.com/forum/index.php?topic=79496.msg2057695#msg2057695)
Has anyone been able to generate codes for FSL?
I used the python script
[...]
Has anyone had better luck with FSL device?


Have you tried the generator from Reply #7 (https://www.eevblog.com/forum/testgear/enabling-options-for-rs-test-equipment/msg1090718/#msg1090718)?
Title: Re: Enabling options for R&S test equipment
Post by: Giedrius on January 23, 2019, 10:18:33 pm
Hello and sorry for the late reply.
Yes, I tried the generator from reply #7 but the codes did not work.
I am not sure if I am using the correct serial number.
I am expecting serial number to be in a form like xxxxxx/yyy. The first part is given by software and a sticker on the back of the device. However, I cannot find the last three digits (yyy) anywhere. I tried various combinations from the stickers on the back of the device, motherboard and RF boards. But none of them generated working upgrade code.
Do you know where I can find the full number required for the generator - I mean the last three digits (yyy)?
Thank you very much for your help!
Title: Re: Enabling options for R&S test equipment
Post by: mbirth on January 23, 2019, 10:48:15 pm
Quote from: Giedrius on Today at 01:18:33 (https://www.eevblog.com/forum/index.php?topic=79496.msg2143669#msg2143669)
I am expecting serial number to be in a form like xxxxxx/yyy. The first part is given by software and a sticker on the back of the device. However, I cannot find the last three digits (yyy) anywhere. I tried various combinations from the stickers on the back of the device, motherboard and RF boards.


For an old FSH it was as easy as using xxxxxx as the serial number. No dash, no nothing. And make sure to set all entries in the option_list to TRUE and try them one after another.
Title: Re: Enabling options for R&S test equipment
Post by: Qw3rtzuiop on January 29, 2019, 04:52:47 pm
Did someone already tried unlocking options of the SMU200A?
Title: Re: Enabling options for R&S test equipment
Post by: hafrse on February 06, 2019, 11:14:55 am
Quote from: Giedrius on Today at 01:18:33 (https://www.eevblog.com/forum/index.php?topic=79496.msg2143669#msg2143669)
I am expecting serial number to be in a form like xxxxxx/yyy. The first part is given by software and a sticker on the back of the device. However, I cannot find the last three digits (yyy) anywhere. I tried various combinations from the stickers on the back of the device, motherboard and RF boards.


For an old FSH it was as easy as using xxxxxx as the serial number. No dash, no nothing. And make sure to set all entries in the option_list to TRUE and try them one after another.
But the genrated key is a HEX string and the FSH accepts only numbers,  how it is possible?
Thanks
Title: Re: Enabling options for R&S test equipment
Post by: mbirth on February 06, 2019, 11:32:48 am
Quote from: hafrse on Today at 14:14:55 (https://www.eevblog.com/forum/index.php?topic=79496.msg2181503#msg2181503)

But the genrated key is a HEX string and the FSH accepts only numbers,  how it is possible? Thanks


You used the keygen from comment #7, didn't you?
Title: Re: Enabling options for R&S test equipment
Post by: hafrse on February 06, 2019, 07:07:07 pm
Quote from: hafrse on Today at 14:14:55 (https://www.eevblog.com/forum/index.php?topic=79496.msg2181503#msg2181503)

But the genrated key is a HEX string and the FSH accepts only numbers,  how it is possible? Thanks


You used the keygen from comment #7, didn't you?
Hello, No, from commect #21 with Python code.
Title: Re: Enabling options for R&S test equipment
Post by: mbirth on February 06, 2019, 07:28:03 pm
Quote from: hafrse on Today at 22:07:07 (https://www.eevblog.com/forum/index.php?topic=79496.msg2182322#msg2182322)


Hello, No, from commect #21 with Python code.


Well, then try the one from #7. ;)
Title: Re: Enabling options for R&S test equipment
Post by: hafrse on February 06, 2019, 08:48:05 pm
Quote from: hafrse on Today at 22:07:07 (https://www.eevblog.com/forum/index.php?topic=79496.msg2182322#msg2182322)


Hello, No, from commect #21 with Python code.


Well, then try the one from #7. ;)
tried to compile the project in VS2017 using sdk 10 and sdk 8.1, ended up on stdio.h not found when using sdk 8.1 , I am not very familier with VS...
Title: Re: Enabling options for R&S test equipment
Post by: ve7xen on February 07, 2019, 10:53:57 pm
It's just a trivial C program. I compiled it for you.
Title: Re: Enabling options for R&S test equipment
Post by: hafrse on February 08, 2019, 08:42:57 pm


Quote from: dl2ocb on Today at 10:53:44 (https://www.eevblog.com/forum/index.php?topic=79496.msg1829129#msg1829129)
Does anyone know a Keygen for FSH oder ZVH Handheld Instruments fron Rohde&Schwarz ?


The FSP keygen in this thread also works for the FSH. Use the serial number alone, no "/" and no model number.

Make sure to enable all keys and try them top to bottom until all options are unlocked.
The FSP keygen has seeds for the options on the fsp but where to get the seeds for options K2,K3 and K4 for the FSH?  thanks
Title: Re: Enabling options for R&S test equipment
Post by: mbirth on February 09, 2019, 01:47:06 am
Quote from: hafrse on Yesterday at 23:42:57 (https://www.eevblog.com/forum/index.php?topic=79496.msg2187932#msg2187932)

The FSP keygen has seeds for the options on the fsp but where to get the seeds for options K2,K3 and K4 for the FSH?  thanks


That's why I said to enable the disabled options in the source code. (set FALSE to TRUE)

"K84 - 1xEV-DO BTS" for the FSP is K1 for the FSH
"K84 - 1xEV-DO MS" for the FSP is K3 for the FSH
The fourth entry in the options list is K2.

K4 I don't know. The device I had was too old and didn't support that option. Just try them one after another and you'll probably find it.

btw: The entry labelled "K7" enables the DEMO mode on the FSH and unlocks all features for a month.

And don't forget to input your serial number in the SerString variable further down, then recompile the thing.
Title: Re: Enabling options for R&S test equipment
Post by: hafrse on February 10, 2019, 06:39:30 pm
Thanks :)
Title: Re: Enabling options for R&S test equipment
Post by: tv84 on February 17, 2019, 09:15:27 pm
K4 I don't know. The device I had was too old and didn't support that option. Just try them one after another and you'll probably find it.

Let me try clarify some things  (although I don't know much about this).

The list of options extracted from FSP firmware v4.50 API.DLL is the following:
Code: [Select]
K5     GSM/EDGE Application                 GSM K5 ANALYZER               FSPSpectrumAnalyzerLI   
K7     FM Demodulator                       FM DEMODULATOR                FSPSpectrumAnalyzerLI   
       #1                                   
       #2                                   
K84    1xEV-DO BTS                          1X EV DATA ONLY BTS           FSPSpectrumAnalyzerLI           
K85    1xEV-DO MS                           1X EV DATA ONLY MS            FSPSpectrumAnalyzerLI           
K90      FSQ WLAN 802.11a                   WLAN                          FSQ-Wlan(LI)                   
K72      WCDMA 3GPP FDD BTS                 WCDMA BTS ANALYZER            FSPSpectrumAnalyzerLI           
K74      WCDMA HSDPA BTS                    WCDMA HSDPA BTS               FSPSpectrumAnalyzerLI           
K75      WCDMA HSDPA MS                     WCDMA HSDPA MS                FSPSpectrumAnalyzerLI           
K9     Power Meter                          POWER METER                   FSPSpectrumAnalyzerLI           
K73      WCDMA 3GPP FDD MS                  WCDMA MS ANALYZER             FSPSpectrumAnalyzerLI           
K90      FSP WLAN 802.11a                   FSP WLAN                      FSP_Wlan(LI)                   
K90UP    FSQ WLAN 802.11a,b,g               WLAN UPGRADE                                                 
K76    TD-SCDMA BTS                         TD-SCDMA BTS ANALYZER         FSPSpectrumAnalyzerLI           
K77    TD-SCDMA MS                          TD-SCDMA     MS ANALYZER      FSPSpectrumAnalyzerLI           
K30    Noise Figure                         NOISE MEASURE                 FSx-Noise(LI)                   
K82    CDMA2000 BTS                         CDMA2000 BTS                  FSPSpectrumAnalyzerLI           
K83    CDMA2000 MS                          CDMA2000 MS                   FSPSpectrumAnalyzerLI           
K8     Bluetooth                            BLUETOOTH                     FSPSpectrumAnalyzerLI           
K40    Phase Noise Measurement              PHASE NOISE MEASURE           FSx-PNoise(LI)                 
K70    Vector Signal Analysis               VECTOR SIGNAL ANALYSIS        FSPSpectrumAnalyzerLI           
       #3                                       
K50    Triggered Coverage Meas              TRIGGERED COVERAGE MEAS                                       
K51    Synchronized Stepped Sweep           SYNCHRONIZED FREQ LISTS                                       
       %d days remaining trial period       TRIAL PERIOD 180 HRS                                         
K0     %d days remaining trial period       TRIAL PERIOD 2000 HRS                                         
K91      FSQ WLAN 802.11a,b,g               WLAN ABG                      FSQ-WlanExtension(LI)           
       #5                                   FREQ LIMIT 31 GHZ                                             
B%s    Frequency Extension                  FREQ NO LIMIT                                                 
K92      FSQ 802.16                         FSQ 802_16                    FSQ-Wman(LI)                   
K52    Transducer Set                       REG_TP                                                       
K53    FFT Scan                             FFT SCAN                                                     
K901   %d days remaining trial period       TRIAL PERIOD 2500 HRS                                         
K902   %d days remaining trial period       TRIAL PERIOD 3000 HRS                                         
K92UP    FSQ 802.16e                        FSQ 802_16 UPGRADE                                           
K93      FSQ 802.16e                        FSQ 802_16E                   FSQ-WmanExtension(LI)           
K903   %d days remaining trial period       TRIAL PERIOD 3500 HRS                                         
K904   %d days remaining trial period       TRIAL PERIOD 4000 HRS                                         
K100     LTE FDD Downlink                   LTE FDD DOWNLINK              FSx-LTE FSx-LTE(LI)             
K101     LTE FDD Uplink                     LTE FDD UPLINK                FSx-LTE FSx-LTE(LI)             
B29    Frequency Extension 20Hz             FREQ EXT 20HZ                                                 
K15    Avionics Demodulator                 AVIONICS DEMODULATOR          FSPSpectrumAnalyzerLI           
K91N   FSQ WLAN 802.11n                     WLAN 802 11N UPGRADE          FSQ-Wlan80211n(LI)             
K94    FSQ 802.16e MIMO                     FSQ 802_16 Mimo UPGRADE       FSQ-WmanMimo(LI)               
K102     LTE Downlink MIMO                  LTE DOWNLINK MIMO             FSx-LTE FSx-LTE(LI)             
K103     LTE Uplink MIMO                    LTE UPLINK MIMO               FSx-LTE FSx-LTE(LI)             
K96    OFDM-VSA                             OFDM-VSA                                                     
K74+     WCDMA HSPA+ BTS                    WCDMA HSPA+ BTS                                               
       #4                                             
K400   RFEX-F Launcher                      RFEX-F                                                       
K17    EX IQ Box                            EX IQBOX                      FSx-ExIqBox(LI)                 
K110   TETRA 2                              TETRA2                        FSQ-Tetra2(LI)                 
K10      GSM/EDGE/EDGE Evolution            GSM/EDGE ANALYZER             FSx-Gsm(LI)                     
K73+     WCDMA HSPA+ MS                     WCDMA HSPA+ MS                                               
K104     LTE TDD Downlink                   LTE TDD DOWNLINK              FSx-LTE(LI)                     
K105     LTE TDD Uplink                     LTE TDD UPLINK                FSx-LTE(LI)                     
K106   LTE TDD/FDD Upgrade                  LTE TDD/FDD UPGRADE                                           
K5UP     GSM K5 Upgrade to K10              GSM K5 ANALYZER UPGRADE       FSx-Gsm(LI)                     
K150   Support for User Calibration         USER CAL SUPPORT                                             


They are ordered according to the seeds table (used in the prog to generate licenses).

Also, in that .DLL we can extract a more complete seed (uint32) table than the one used in the original prog (post #7). I attach it below.

Those that are using the program should add the new seeds because they may be needed to enable other Options.

The FSH Option names can be extracted from the FSH firmware's API.DLL. If anyone sends me a current FSH API.DLL I might extract the complete list of Options.

When adding the Option seeds you should also make them TRUE so that all possibilities are calculated.
Title: Re: Enabling options for R&S test equipment
Post by: goaty on March 14, 2019, 03:55:14 pm
For FSH3, I looked into the update file which contains GALAXY.ldf, GALAXY2M.ldf and GALAXY3G.ldf.

Seems there is an easteregg there:

"
Mines left: %d
Time: %3d
Best time: %3d
Lives: %d
Score: %d
HighScore: %d
Waiting for opponent...
Congratulations, you won!!
Ouch, you lost!!
Your fleet
Opponents fleet
Drop bomb...
Watch out for incoming...
Expose a part of one of your ships...
Watch out for incoming...
"
Title: Re: Enabling options for R&S test equipment
Post by: fisafisa on April 27, 2019, 08:31:15 pm
HI
I have got an AMIQ waveform generator.
I tried with the options generator but no luck.
Looking at the manual it would seem that the options here are only 8 characters long.
Anybody has an example of option code (together with the serial number)
Maybe it is possible to figure out the algorithm.

Thanks
 
Title: Re: Enabling options for R&S test equipment
Post by: sky2city on June 12, 2019, 05:56:32 am
Hey Guys,

I have a ZVR, SN is 835068/005. and I found the SW sn  \R_S\INSTR\INI\OPTOIN.INI
Is't anyone know how to decode it?

--------------------------------------------------------
4056071223; EMBED DEEMBED
0436723430; TIME DOMAIN
1234299954; CONVERTER 4 CHAN
--------------------------------------------------------
Title: Re: Enabling options for R&S test equipment
Post by: sky2city on June 12, 2019, 06:44:17 am
K4 I don't know. The device I had was too old and didn't support that option. Just try them one after another and you'll probably find it.

Let me try clarify some things  (although I don't know much about this).

The list of options extracted from FSP firmware v4.50 API.DLL is the following:
Code: [Select]
K5     GSM/EDGE Application                 GSM K5 ANALYZER               FSPSpectrumAnalyzerLI   
K7     FM Demodulator                       FM DEMODULATOR                FSPSpectrumAnalyzerLI   
       #1                                   
       #2                                   
K84    1xEV-DO BTS                          1X EV DATA ONLY BTS           FSPSpectrumAnalyzerLI           
K85    1xEV-DO MS                           1X EV DATA ONLY MS            FSPSpectrumAnalyzerLI           
K90      FSQ WLAN 802.11a                   WLAN                          FSQ-Wlan(LI)                   
K72      WCDMA 3GPP FDD BTS                 WCDMA BTS ANALYZER            FSPSpectrumAnalyzerLI           
K74      WCDMA HSDPA BTS                    WCDMA HSDPA BTS               FSPSpectrumAnalyzerLI           
K75      WCDMA HSDPA MS                     WCDMA HSDPA MS                FSPSpectrumAnalyzerLI           
K9     Power Meter                          POWER METER                   FSPSpectrumAnalyzerLI           
K73      WCDMA 3GPP FDD MS                  WCDMA MS ANALYZER             FSPSpectrumAnalyzerLI           
K90      FSP WLAN 802.11a                   FSP WLAN                      FSP_Wlan(LI)                   
K90UP    FSQ WLAN 802.11a,b,g               WLAN UPGRADE                                                 
K76    TD-SCDMA BTS                         TD-SCDMA BTS ANALYZER         FSPSpectrumAnalyzerLI           
K77    TD-SCDMA MS                          TD-SCDMA     MS ANALYZER      FSPSpectrumAnalyzerLI           
K30    Noise Figure                         NOISE MEASURE                 FSx-Noise(LI)                   
K82    CDMA2000 BTS                         CDMA2000 BTS                  FSPSpectrumAnalyzerLI           
K83    CDMA2000 MS                          CDMA2000 MS                   FSPSpectrumAnalyzerLI           
K8     Bluetooth                            BLUETOOTH                     FSPSpectrumAnalyzerLI           
K40    Phase Noise Measurement              PHASE NOISE MEASURE           FSx-PNoise(LI)                 
K70    Vector Signal Analysis               VECTOR SIGNAL ANALYSIS        FSPSpectrumAnalyzerLI           
       #3                                       
K50    Triggered Coverage Meas              TRIGGERED COVERAGE MEAS                                       
K51    Synchronized Stepped Sweep           SYNCHRONIZED FREQ LISTS                                       
       %d days remaining trial period       TRIAL PERIOD 180 HRS                                         
K0     %d days remaining trial period       TRIAL PERIOD 2000 HRS                                         
K91      FSQ WLAN 802.11a,b,g               WLAN ABG                      FSQ-WlanExtension(LI)           
       #5                                   FREQ LIMIT 31 GHZ                                             
B%s    Frequency Extension                  FREQ NO LIMIT                                                 
K92      FSQ 802.16                         FSQ 802_16                    FSQ-Wman(LI)                   
K52    Transducer Set                       REG_TP                                                       
K53    FFT Scan                             FFT SCAN                                                     
K901   %d days remaining trial period       TRIAL PERIOD 2500 HRS                                         
K902   %d days remaining trial period       TRIAL PERIOD 3000 HRS                                         
K92UP    FSQ 802.16e                        FSQ 802_16 UPGRADE                                           
K93      FSQ 802.16e                        FSQ 802_16E                   FSQ-WmanExtension(LI)           
K903   %d days remaining trial period       TRIAL PERIOD 3500 HRS                                         
K904   %d days remaining trial period       TRIAL PERIOD 4000 HRS                                         
K100     LTE FDD Downlink                   LTE FDD DOWNLINK              FSx-LTE FSx-LTE(LI)             
K101     LTE FDD Uplink                     LTE FDD UPLINK                FSx-LTE FSx-LTE(LI)             
B29    Frequency Extension 20Hz             FREQ EXT 20HZ                                                 
K15    Avionics Demodulator                 AVIONICS DEMODULATOR          FSPSpectrumAnalyzerLI           
K91N   FSQ WLAN 802.11n                     WLAN 802 11N UPGRADE          FSQ-Wlan80211n(LI)             
K94    FSQ 802.16e MIMO                     FSQ 802_16 Mimo UPGRADE       FSQ-WmanMimo(LI)               
K102     LTE Downlink MIMO                  LTE DOWNLINK MIMO             FSx-LTE FSx-LTE(LI)             
K103     LTE Uplink MIMO                    LTE UPLINK MIMO               FSx-LTE FSx-LTE(LI)             
K96    OFDM-VSA                             OFDM-VSA                                                     
K74+     WCDMA HSPA+ BTS                    WCDMA HSPA+ BTS                                               
       #4                                             
K400   RFEX-F Launcher                      RFEX-F                                                       
K17    EX IQ Box                            EX IQBOX                      FSx-ExIqBox(LI)                 
K110   TETRA 2                              TETRA2                        FSQ-Tetra2(LI)                 
K10      GSM/EDGE/EDGE Evolution            GSM/EDGE ANALYZER             FSx-Gsm(LI)                     
K73+     WCDMA HSPA+ MS                     WCDMA HSPA+ MS                                               
K104     LTE TDD Downlink                   LTE TDD DOWNLINK              FSx-LTE(LI)                     
K105     LTE TDD Uplink                     LTE TDD UPLINK                FSx-LTE(LI)                     
K106   LTE TDD/FDD Upgrade                  LTE TDD/FDD UPGRADE                                           
K5UP     GSM K5 Upgrade to K10              GSM K5 ANALYZER UPGRADE       FSx-Gsm(LI)                     
K150   Support for User Calibration         USER CAL SUPPORT                                             


They are ordered according to the seeds table (used in the prog to generate licenses).

Also, in that .DLL we can extract a more complete seed (uint32) table than the one used in the original prog (post #7). I attach it below.

Those that are using the program should add the new seeds because they may be needed to enable other Options.

The FSH Option names can be extracted from the FSH firmware's API.DLL. If anyone sends me a current FSH API.DLL I might extract the complete list of Options.

When adding the Option seeds you should also make them TRUE so that all possibilities are calculated.

Hi tv84,

I attached a API.DLL form a ZVR.  could you decode the option from it?
Title: Re: Enabling options for R&S test equipment
Post by: carver on June 12, 2019, 12:06:33 pm
Hey Guys,

I have a ZVR, SN is 835068/005. and I found the SW sn  \R_S\INSTR\INI\OPTOIN.INI
Is't anyone know how to decode it?

--------------------------------------------------------
4056071223; EMBED DEEMBED
0436723430; TIME DOMAIN
1234299954; CONVERTER 4 CHAN
--------------------------------------------------------

maybe
feat_0 = 'HARMONIC MEAS', 'B3', 'Harmonic Measurements'
feat_1 = 'MIXER MEAS', 'B4', 'Mixer Measurements'
feat_2 = 'NONLINEAR MEAS', 'B5', 'Nonlinear Measurements'
feat_3 = 'REF MIXER PORTS', 'B6', 'Reference Mixer Ports'
feat_4 = 'POWER CALIBRATION', 'B7', 'Power Calibration'
feat_5 = '4 PORT MEAS', 'B99', '4-Port Measurements'
feat_6 = 'QUARTZ MEAS', 'BXX', 'Quartz Measurements'

This is an old public algorithm.
test Feat_2+, if all OK - test b3-b4 too,
in newer devices - these numbers(0 or 1) used for demo.


now r&s used new long key.
many know how to create new too,
but no one wants to share it to public ))
Code: [Select]
sn: 835068.005  id: 00 option key: 1542267991  desc: feat_0
sn: 835068.005  id: 01 option key: 2797899109  desc: feat_1
sn: 835068.005  id: 02 option key: 2277388772  desc: feat_2
sn: 835068.005  id: 03 option key: 2328386865  desc: feat_3
sn: 835068.005  id: 04 option key: 0302356071  desc: feat_4
sn: 835068.005  id: 05 option key: 3024766616  desc: feat_5
sn: 835068.005  id: 06 option key: 4252011699  desc: feat_6
sn: 835068.005  id: 07 option key: 4056071223  desc: TIME DOMAIN, B2, Time Domain Measurements
sn: 835068.005  id: 08 option key: 0436723430  desc: CONVERTER 4 CHAN, C4C, 4 Channel Converter
sn: 835068.005  id: 09 option key: 1234299954  desc: EMBED DEEMBED, K9, Virtual Embedding Networks
sn: 835068.005  id: 10 option key: 0493488890  desc: feat_A
Title: Re: Enabling options for R&S test equipment
Post by: tv84 on June 12, 2019, 09:29:24 pm
Hi tv84,

I attached a API.DLL form a ZVR.  could you decode the option from it?

I don't think so. Do you have examples of options for that equipment?
Title: Re: Enabling options for R&S test equipment
Post by: sky2city on June 13, 2019, 04:25:03 am
Hi tv84,

I attached a API.DLL form a ZVR.  could you decode the option from it?

I don't think so. Do you have examples of options for that equipment?

I double checked with ZVR manual, the only K option for ZVR is K9 only, there is nothing to do with this unit.

So I am looking in another one, FSEA30. the datasheet say the K option for FSEA is:
---------------------------------------------------------------
FSE-K4  Phase Noise Measurement Software,
FSE-K3  Noise Measurement Software
FSE-K10 GSM Test Software, Mobile
FSE-K11 GSM Test Software, Base Station
FSE-K20 GSM Test Software, Edge Mobile
FSE-K21 GSM Test Software, EDGE Base Station
FSE-K30 GSM Test Software, 850 GHz band Mobile
FSE-K31 GSM Test Software, 850 GHz band Base Station
----------------------------------------------------------------

Just decoded the SN using "Rohde & Schwarz FSP option generator".

Notice: that I decode all  seeds, the comment "Kx  xxxx Application Firmware" is not correct, it's for FSP
--------------------------------------------------------------------------
3780795724 - K5  - GSM/EDGE Application Firmware
0284552823 - K7  - AM/FM/PM Measurement Demodulator
4196994763 - B17 - IQ Online
0684125256 - None
1514211661 - K84 - 1xEV-DO BTS Application Firmware
0579586646 - K84 - 1xEV-DO MS  Application Firmware
3285910640 - None
1332515167 - FSP-B15 FSP-B70 FS-K7
1746004935 - K72 prior K74
0425836556 - None
3914572062 - K9  - Power Meter
0367944746 - FSP-B15 FS-K7
0178533596 - None
0084427020 - None
0973137605 - K76 - 3GPP TD-SCDMA BTS Application Firmware
4058089560 - K77 - 3GPP TD-SCDMA MS  Application Firmware
2816669065 - K30 - Noise Figure Measurament
0774785927 - K82 - CDMA2000 BTS Application Firmware
1251526595 - K83 - CDMA2000 MS  Application Firmware
0364322959 - K8  - Bluetooth Application Firmware
3912188941 - K40 - Phase Noise Measurament
2043795852 - None
2216559242 - None
3509799288 - None
0667766505 - None
2179962388 - 31 days trial period
4232888520 - 78 days trial period
1998016984 - None
1665344687 - None
0081926458 - Frequency Extension
1876889287 - None
2554963261 - Trasducer Set
0989643314 - None
1367083121 - None
2589261327 - None
3754352886 - None
2349723378 - None
2713318677 - None
0242151735 - None
3807482493 - None
2651669256 - None
0586577237 - None
3525044770 - None
0034228987 - None
1143727560 - None
2616543767 - None
1636617207 - None
0959025083 - None
1318982380 - None
2600577035 - None
--------------------------------------------------------------------------
compare with the options.ini in my FSEA. the fisrt line is the "FSE-K10 GSM Test Software, Mobile".

------------------------------------------------------
Options file in my FSEA:
3780795724; GSM MTS ANALYZER
------------------------------------------------------

My question is which line of the SN is for other option?
-------------------------------------------------------------------
FSE-K4  Phase Noise Measurement Software,            ??????
FSE-K3  Noise Measurement Software                     ????????
FSE-K10 GSM Test Software, Mobile                       3780795724
FSE-K11 GSM Test Software, Base Station
FSE-K20 GSM Test Software, Edge Mobile
FSE-K21 GSM Test Software, EDGE Base Station
FSE-K30 GSM Test Software, 850 GHz band Mobile
FSE-K31 GSM Test Software, 850 GHz band Base Station
-------------------------------------------------------------------

another thing I found is that there is no API.dll in my FSEA30. I search all *.ll in hard disk, it seems that "FSEFPNL.DLL" is the suspect one.



Title: Re: Enabling options for R&S test equipment
Post by: sky2city on June 13, 2019, 04:28:09 am
Hey Guys,

I have a ZVR, SN is 835068/005. and I found the SW sn  \R_S\INSTR\INI\OPTOIN.INI
Is't anyone know how to decode it?

--------------------------------------------------------
4056071223; EMBED DEEMBED
0436723430; TIME DOMAIN
1234299954; CONVERTER 4 CHAN
--------------------------------------------------------

maybe
feat_0 = 'HARMONIC MEAS', 'B3', 'Harmonic Measurements'
feat_1 = 'MIXER MEAS', 'B4', 'Mixer Measurements'
feat_2 = 'NONLINEAR MEAS', 'B5', 'Nonlinear Measurements'
feat_3 = 'REF MIXER PORTS', 'B6', 'Reference Mixer Ports'
feat_4 = 'POWER CALIBRATION', 'B7', 'Power Calibration'
feat_5 = '4 PORT MEAS', 'B99', '4-Port Measurements'
feat_6 = 'QUARTZ MEAS', 'BXX', 'Quartz Measurements'

This is an old public algorithm.
test Feat_2+, if all OK - test b3-b4 too,
in newer devices - these numbers(0 or 1) used for demo.


now r&s used new long key.
many know how to create new too,
but no one wants to share it to public ))
Code: [Select]
sn: 835068.005  id: 00 option key: 1542267991  desc: feat_0
sn: 835068.005  id: 01 option key: 2797899109  desc: feat_1
sn: 835068.005  id: 02 option key: 2277388772  desc: feat_2
sn: 835068.005  id: 03 option key: 2328386865  desc: feat_3
sn: 835068.005  id: 04 option key: 0302356071  desc: feat_4
sn: 835068.005  id: 05 option key: 3024766616  desc: feat_5
sn: 835068.005  id: 06 option key: 4252011699  desc: feat_6
sn: 835068.005  id: 07 option key: 4056071223  desc: TIME DOMAIN, B2, Time Domain Measurements
sn: 835068.005  id: 08 option key: 0436723430  desc: CONVERTER 4 CHAN, C4C, 4 Channel Converter
sn: 835068.005  id: 09 option key: 1234299954  desc: EMBED DEEMBED, K9, Virtual Embedding Networks
sn: 835068.005  id: 10 option key: 0493488890  desc: feat_A

Got it. thanks for your reply. :)
Title: Re: Enabling options for R&S test equipment
Post by: sky2city on June 13, 2019, 04:40:25 am
I have a R&S ZVB8 2 port Vector Network Analyzer, but I can't see any options file (SWOPT.DAT or similar). Under 'Info', no files are loaded that indicate which file it could be.

I could really use the ZVAB-K2 Time Domain option - does anyone have any good suggestions? The serial-number is 6-digits.

To be honest, I can't even see where I would load a valid software option key.

Hi Jacod,
I don't have the ZVB yet. I download the firmware  form RS and than extract all files.
there is a DLL file "OptionKeyServices.dll", I guess this Dll is work for the option key.

for the SW option key, you should search *option*.* or *opt*.* in D disk. in my ZVR, it's "Option.ini".

and check the serial-number on "info" hard key manu.


Title: Re: Enabling options for R&S test equipment
Post by: sky2city on June 13, 2019, 02:58:25 pm
I have a R&S ZVB8 2 port Vector Network Analyzer, but I can't see any options file (SWOPT.DAT or similar). Under 'Info', no files are loaded that indicate which file it could be.

I could really use the ZVAB-K2 Time Domain option - does anyone have any good suggestions? The serial-number is 6-digits.

To be honest, I can't even see where I would load a valid software option key.

Hi Jacod,
I don't have the ZVB yet. I download the firmware  form RS and than extract all files.
there is a DLL file "OptionKeyServices.dll", I guess this Dll is work for the option key.

for the SW option key, you should search *option*.* or *opt*.* in D disk. in my ZVR, it's "Option.ini".

and check the serial-number on "info" hard key manu.

I went through the "OptionKeyServices.dll", it seems that some fuction is base on OpenSSL 0.95 lib.

But I can't find the where the key hidden.

Stuck here ....
Title: Re: Enabling options for R&S test equipment
Post by: sky2city on June 16, 2019, 07:08:57 pm
I have a R&S ZVB8 2 port Vector Network Analyzer, but I can't see any options file (SWOPT.DAT or similar). Under 'Info', no files are loaded that indicate which file it could be.

I could really use the ZVAB-K2 Time Domain option - does anyone have any good suggestions? The serial-number is 6-digits.

To be honest, I can't even see where I would load a valid software option key.

 I did some Reverse Engineering of OptionKeyServices.dll. it show that the OptionKeyServices.dll always access the Register table of windows.
Maybe the Option key is store in register table.

Pls. check reg table on:
HKEY_LOCAL_MACHINE\SOFTWEARE\Rohde&Schwarz\......



Title: Re: Enabling options for R&S test equipment
Post by: vk3st on June 29, 2019, 06:49:02 am
Hi all,
Still frustrated trying to get several option running on our radio club ZVH.
Really wanting to activate K1, K9 and K39.
I did have a contact with a guy in Russia but the expected cost was way way beyond the budget by many orders of magnitude and was probably more based on a commercial proposition.
Have tried all the options with variations mentioned in these pages to no avail.
If someone does have a key gen stored away and can provide me with activation codes for Ser No 102660/24 I would be prepared to pay a fee or donate a suitable sum not being a kings ransom for the service.
If there is such a person, pm me at vk3st@ian-foster.com please.
Title: Re: Enabling options for R&S test equipment
Post by: carver on June 30, 2019, 09:57:36 am
as I wrote above,
many have access to R&S tools, me too.
but no one wants to share this tool to public, as R&S too.
Title: Re: Enabling options for R&S test equipment
Post by: mbirth on June 30, 2019, 11:35:41 am
Quote from: vk3st on Yesterday at 08:49:02 (https://www.eevblog.com/forum/index.php?topic=79496.msg2516280#msg2516280)

Have tried all the options with variations mentioned in these pages to no avail.


Did you also try the tool from comment #7 but with only the first part of your serial number? (Have to edit the serial number in the source code, then compile and run. Make sure to also set all the options in the source code to TRUE first.)
Title: Re: Enabling options for R&S test equipment
Post by: vk3st on July 07, 2019, 10:00:26 am
Hi, can you pm me with RS tool info please?
Info@ian-foster.com
Title: Re: Enabling options for R&S test equipment
Post by: vk3st on July 07, 2019, 10:06:50 am
I looked. At it and could not seem to get it to compile without error.
What is recommended compiler please and sorry but has been many years since compiling scripts etc so am a bit slow in this area.
Title: Re: Enabling options for R&S test equipment
Post by: larry42 on July 27, 2019, 06:27:38 am
I've been reading through this thread - anyone know the situation with the more modern series of R&S equipment (e.g. RTE / RTO series of scopes).

R&S seem to base their designs on a couple of platforms, with occasional "mid-life" upgrades of the underlying HW (and OS - usually embedded Windows of some kind). The RTE / RTO platform is common and Win7 / Win10 embedded. with license key support for temporary and time limited licenses as well as portable licenses and license de-activation.

Anyone confirm whether these can be played with?


Title: Re: Enabling options for R&S test equipment
Post by: carvalhoatx on August 01, 2019, 09:10:02 am
Hello Folks, anyone who has working with RTO scope oscilloscope (model 10 24 ) ? If so, could you help me. I tried to save the x-y axis waveform in .csv.
When I tried it, only the y-axis (voltage was salved). I need also, the Time axis. How to set to both ? I tried to find that "basic" info with manual, but there is no it....
Or it doesnt work to that Oscilloscope? kind regards  for comments,
Title: Re: Enabling options for R&S test equipment
Post by: little.tesla on August 06, 2019, 05:44:18 pm
Hello,

did anybody try to enable options for signal generators like SMIQ, SME?
I did try different combinations on a SME which expects a 6-digit activation key without luck. The serial number is same as the others xxxxxx/xxx.

Any hints are highly appreciated.

BR,
 Dimce
Title: Re: Enabling options for R&S test equipment
Post by: darkstar49 on August 09, 2019, 12:04:48 pm
I've been reading through this thread - anyone know the situation with the more modern series of R&S equipment (e.g. RTE / RTO series of scopes).

R&S seem to base their designs on a couple of platforms, with occasional "mid-life" upgrades of the underlying HW (and OS - usually embedded Windows of some kind). The RTE / RTO platform is common and Win7 / Win10 embedded. with license key support for temporary and time limited licenses as well as portable licenses and license de-activation.

Anyone confirm whether these can be played with?

to my knowledge, no one has succeeded so far hacking any recent R&S scope (incl. RTO's, which have their crypto stuff on a smart card inside the scope, btw), although I'd like to be wrong ! RTB & RTA firmware files/updates are encrypted, and I've never seen anything able to decrypt those either... (which would be a starting point for further 'research'...)




Title: Re: Enabling options for R&S test equipment
Post by: tv84 on August 09, 2019, 01:27:07 pm
Anyone confirm whether these can be played with?

I would guess they can once the owners want to... No one seems interested in opening his precious.
Title: Re: Enabling options for R&S test equipment
Post by: KaneTW on August 09, 2019, 01:39:44 pm
Yeah, I have a RTB2004 but it's a fully optioned 5k instrument. Not touching that unless someone has a spare with a busted frontend or something and I can experiment with it.
Title: Re: Enabling options for R&S test equipment
Post by: analogRF on August 09, 2019, 03:38:29 pm
Hello,

did anybody try to enable options for signal generators like SMIQ, SME?
I did try different combinations on a SME which expects a 6-digit activation key without luck. The serial number is same as the others xxxxxx/xxx.

Any hints are highly appreciated.

BR,
 Dimce

may I ask what options on SMIQ/SME you want to enable? I don't know how it can be done but if there is any useful option that can be hacked
I would be very interested to do it. As I remember most of the 'good' options are hardware options for which you need a HW module. Software options were not many and they didn't seem very interesting to me at least
Title: Re: Enabling options for R&S test equipment
Post by: little.tesla on August 10, 2019, 06:40:19 pm
I have here at the moment only a SME where I would like to play a bit with the POCSAG Protocol (pagers) option SME-B42. The required hardware options are available. There are as well B41 and B43 software options which are at the moment not of interest for me.
As far as I can tell for the SMIQ the options >B42 (Digital Standard IS-95 CDMA) and >K11 (Digital Standard IS-95 CDMA) are software options. I think they just require the modulation coder/data generator and memory.
How good is your i960 assembly? :)
Title: Re: Enabling options for R&S test equipment
Post by: EEngo on August 11, 2019, 01:17:01 pm
does anyone know how to enable options for a DVRG? I have two of them, but one of them is missing one of the previously installed options after a HDD crash  :-BROKE

I have all the HDD images, but couldn't find something key-related.

-ingo-
Title: Re: Enabling options for R&S test equipment
Post by: Pattymorr on August 12, 2019, 01:51:52 am
Newbie here for everything.

Got 2 old units FSH3, one is fully operational type 13 from 2005 (with tracking generator SN103585 Firmware V10.00),  the other one is from 2004 (base model 03 with preamp SN 102121)  which seems to have a corrupt Firmware V7.20 cause the frequency range shows random numbers i.e Center -1.656726599e+181; despite all keys and menus are functional the only response I got for the instrument is for Manual BW to 1Mhz  and Span 0hz,  all others shows Out of Range. 

I had try to look for firmware update and found a file on R&S site for the new version with TV features which I am not sure if it will be suitable for the old units. Furthermore, I had not been able to find the Optical Rs232 cable interface  neither the software tools needed to perform the update, I guess there is plenty of this items stocked at R&S at considerable price.

After reading this post I downloaded the file on post #7. Unfortunately,  I wont have access to the files until I have a way to communicate with the units. Does anyone know what is the pinout / transceiver configuration for the optical rs232?

Thanks in advance for help

Sincerely

Patty.





     

Title: Re: Enabling options for R&S test equipment
Post by: Pattymorr on August 14, 2019, 08:18:11 pm
The Fluke 190 rs232  interface is suitable for tryouts but the closes one is from the Fluke 279/289.

Found this DIY rich in info as part of my own answer :DIY optical link cable for the Fluke Scopemeter 190 series http://omapalvelin.homedns.org/fluke/ (http://omapalvelin.homedns.org/fluke/)

After assembly and testing on HyperTerminal  at 19200bps I was able to send a few commands and had response for GD (Get Down), SO (Switch ON)  and RI (Reset Instrument). ID (instrument ID) , IS (Instrument status) and RT,RD and others returned nothing. Down to 9600 bps minimum for FSH3 and checking the RX signal on oscilloscope shows a lot of noise and missing data at the output of the IR comparator. 

The info and pictures of the 189 interface in this blog motivated to keep me going : http://kimboricha.blogspot.com/2013/12/build-usb-to-fluke-189-irinfrared.html (http://kimboricha.blogspot.com/2013/12/build-usb-to-fluke-189-irinfrared.html) even though none of the suggestions and mods worked

The two transistor darlington configuration was the solution for the high speed required : https://electronics.stackexchange.com/questions/391266/high-speed-infrared-uart-link-with-photodiode (https://electronics.stackexchange.com/questions/391266/high-speed-infrared-uart-link-with-photodiode)

Confirmed optical Rs232 interface working by Hyperterminal, any command sent  replied using mirror( a spoon is better) and when connected to FSH3 I sent ID enter  returned all R&S info and firmware version.  Observed  a nice square wave modulated when tested with a TV remote. Tested the home made Rs232 interface with both instruments and FSH viewer connected a 19200bps.


Firmware updated fix the FSH3 Frequency range anomaly.

Have found version 13  of FSH viewer here: http://www.korearental.co.kr/cData/CDATA_PDS_VIEW.ASPX?IDX=250&Cate=1&bbscode=7,2,0, (http://www.korearental.co.kr/cData/CDATA_PDS_VIEW.ASPX?IDX=250&Cate=1&bbscode=7,2,0,) .
And Version 14.2 is here: https://uloz.to/file/B41l7yCShG9O/fshview-v14-20-setup-exe?showDialog=1 (https://uloz.to/file/B41l7yCShG9O/fshview-v14-20-setup-exe?showDialog=1) . 

The new firmware update ver. 14 is a self extracting file and is suitable for all old FSH 3 ,6,18 but requires FSH Viewer 14 and up Installed .

IF administrator have a way to let me upload somewhere the two 10MB FSH Viewer installers I will be happy to do it before the links disappear 

I got some progress on the option keys from my serial 102121.

2918745366 - K5  - GSM/EDGE Application Firmware           (Option Key error)
0659588824 - K7  - AM/FM/PM Measurement Demodulator   (Enabled)  DEMO MODE ENABLED FOR 1000Hrs
1048859114 - B17 - IQ Online                                            (Option Key error)
3837700883 - None                                                           (Option Key error)
0840658593 - K84 - 1xEV-DO BTS Application Firmware       Remote Control Enabled
2135204116 - K84 - 1xEV-DO MS  Application Firmware       Receiver Meas. Enabled
1863906345 - None                                                            (Option Key error)
0204267013 - FSP-B15 FSP-B70 FS-K7                                (Option Key error)
2684356591 - K72 prior K74                                               (Option Key error)
0371030575 - None                                                            (Option Key error)
0679722459 - K9  - Power Meter                                          (Option Key error)
3208052079 - FSP-B15 FS-K7                                              (Option Key error)
3516151515 - None                                                             (Option Key error)
3712172277 - None                                                             (Option Key error)
1067738526 - K76 - 3GPP TD-SCDMA BTS Application Firmware    (Option Key error)
4183377164 - K77 - 3GPP TD-SCDMA MS  Application Firmware    (Option Key error)
0890457939 - K30 - Noise Figure Measurament                           (Option Key error)
3488976067 - K82 - CDMA2000 BTS Application Firmware            (Option Key error)
4253200286 - K83 - CDMA2000 MS  Application Firmware            (Option Key error)
2499311400 - K8  - Bluetooth Application Firmware                     (Option Key error)
0071209860 - K40 - Phase Noise Measurament                            (Option Key error)
2187555649 - None                                                                (Option Key error)
1044162665 - None                                                                (Option Key error)
1586385696 - None                                                                (Option Key error)
1960780550 - None                                                                (Option Key error)
2793864759 - 31 days trial period                                            (Option Key error)
0212545182 - 78 days trial period                                            (Option Key error)
3895538962 - None                                                                 (Option Key error)
1099830336 - None                                                                 (Option Key error)
0581656715 - Frequency Extension                                           (Option Key error)
1434950248 - None                                                                   Accepted None
1662463819 - Trasducer Set                                                       Accepted None


Patty
 
Title: Re: Enabling options for R&S test equipment
Post by: hgl on November 01, 2019, 09:33:34 pm
Hello, I need the R & S option key TSMU-K35 for RF scan with my TSMU devices. Unfortunately, R & S does not sell it to private individuals.

For example, Option Key 15 looks like this:
 
1. TSMU
<! DOCTYPE KeyInstallation>
<KeyInstallation format_id = "0" content_type = "OptionKey" device_id = "1153.6000k02 / 100449" material_description = "Radio Network Analyzer (default)" model_name = "TSMU">
 <OptionKeyData material_no = "1153.4595.02" format_id = "0" option_index = "15" start_date = "" full_name = "TSMU-K15" creation_date = "2006-07-27" customer_order_no = "109171" duration = "" key_type = "Customer Order" license_count = "1" option_type = "K15" activation_type = "Permanent" />
 <OptionKey format_id = "0" key = "213827836019817947172267609678" license_count = "1" />
</ KeyInstallation>

I still have examples for other keys and other devices.

Can someone help me

Title: Re: Enabling options for R&S test equipment
Post by: hgl on November 03, 2019, 09:22:29 am
I am interested in existing information. Please do not offer hack for payment.

Title: Re: Enabling options for R&S test equipment
Post by: sixtimesseven on December 30, 2019, 05:05:28 pm
Hey Guys,

I have a ZVR, SN is 835068/005. and I found the SW sn  \R_S\INSTR\INI\OPTOIN.INI
Is't anyone know how to decode it?

--------------------------------------------------------
4056071223; EMBED DEEMBED
0436723430; TIME DOMAIN
1234299954; CONVERTER 4 CHAN
--------------------------------------------------------

maybe
feat_0 = 'HARMONIC MEAS', 'B3', 'Harmonic Measurements'
feat_1 = 'MIXER MEAS', 'B4', 'Mixer Measurements'
feat_2 = 'NONLINEAR MEAS', 'B5', 'Nonlinear Measurements'
feat_3 = 'REF MIXER PORTS', 'B6', 'Reference Mixer Ports'
feat_4 = 'POWER CALIBRATION', 'B7', 'Power Calibration'
feat_5 = '4 PORT MEAS', 'B99', '4-Port Measurements'
feat_6 = 'QUARTZ MEAS', 'BXX', 'Quartz Measurements'

This is an old public algorithm.
test Feat_2+, if all OK - test b3-b4 too,
in newer devices - these numbers(0 or 1) used for demo.


now r&s used new long key.
many know how to create new too,
but no one wants to share it to public ))
Code: [Select]
sn: 835068.005  id: 00 option key: 1542267991  desc: feat_0
sn: 835068.005  id: 01 option key: 2797899109  desc: feat_1
sn: 835068.005  id: 02 option key: 2277388772  desc: feat_2
sn: 835068.005  id: 03 option key: 2328386865  desc: feat_3
sn: 835068.005  id: 04 option key: 0302356071  desc: feat_4
sn: 835068.005  id: 05 option key: 3024766616  desc: feat_5
sn: 835068.005  id: 06 option key: 4252011699  desc: feat_6
sn: 835068.005  id: 07 option key: 4056071223  desc: TIME DOMAIN, B2, Time Domain Measurements
sn: 835068.005  id: 08 option key: 0436723430  desc: CONVERTER 4 CHAN, C4C, 4 Channel Converter
sn: 835068.005  id: 09 option key: 1234299954  desc: EMBED DEEMBED, K9, Virtual Embedding Networks
sn: 835068.005  id: 10 option key: 0493488890  desc: feat_A

Which method did you use to get the code? The python script mentioned in #21 does not give me the same results.

Code: [Select]
from Crypto.Cipher import ARC2
import struct

serial = 835068
serial2 = 005
option = 9

record = struct.pack("<II", serial, serial2 + (option <<20))
encyphered = ARC2.new("Revision\0").encrypt(record)
print encyphered.encode("hex")

I get:

Code: [Select]
24147d39d5347618


My ZVR displays the Serial Number 100041/061 and has several options installed (attached the options.init file). However I would like to get the rest :)
Title: Re: Enabling options for R&S test equipment
Post by: Decee1 on February 20, 2020, 08:18:04 pm
Hello
Can anyone convert the script into Python 3.6? Been struggling for too long with converting it but there are just a few things im not familiar with..
Title: Re: Enabling options for R&S test equipment
Post by: ve7xen on February 20, 2020, 08:44:56 pm
Hello
Can anyone convert the script into Python 3.6? Been struggling for too long with converting it but there are just a few things im not familiar with..

Assuming you're talking about the generator for CMU200 and related boxes, I have already ported it. You can get it here http://gotroot.ca/cmu200/cmuopts.py (http://gotroot.ca/cmu200/cmuopts.py) . You'll need to also install the pycrypto module (pip3 install pycrypto).
Title: Re: Enabling options for R&S test equipment
Post by: Decee1 on February 20, 2020, 08:59:36 pm
AND IT WORKS LIKE A CHARM
No problems AT ALL...
Even tho you gotta give it a few thoughts that you need to add the whole serial number but just took a few seconds to figure out!
RESPECT!
Title: Re: Enabling options for R&S test equipment
Post by: charlyd on March 16, 2020, 02:49:02 pm
Hello is this topic also to enable R&S Options topic for the SMIQ (hrw/sft) options ?
Title: Re: Enabling options for R&S test equipment
Post by: analogRF on March 16, 2020, 03:21:33 pm
yes it should work. most hardware options usually work out of he box. software options need keys to be generated
Title: Re: Enabling options for R&S test equipment
Post by: hafrse on April 13, 2020, 04:38:22 pm
Hi tv84,

I attached a API.DLL form a ZVR.  could you decode the option from it?

I don't think so. Do you have examples of options for that equipment?

I double checked with ZVR manual, the only K option for ZVR is K9 only, there is nothing to do with this unit.

So I am looking in another one, FSEA30. the datasheet say the K option for FSEA is:
---------------------------------------------------------------
FSE-K4  Phase Noise Measurement Software,
FSE-K3  Noise Measurement Software
FSE-K10 GSM Test Software, Mobile
FSE-K11 GSM Test Software, Base Station
FSE-K20 GSM Test Software, Edge Mobile
FSE-K21 GSM Test Software, EDGE Base Station
FSE-K30 GSM Test Software, 850 GHz band Mobile
FSE-K31 GSM Test Software, 850 GHz band Base Station
----------------------------------------------------------------

Just decoded the SN using "Rohde & Schwarz FSP option generator".

Notice: that I decode all  seeds, the comment "Kx  xxxx Application Firmware" is not correct, it's for FSP
--------------------------------------------------------------------------
3780795724 - K5  - GSM/EDGE Application Firmware
0284552823 - K7  - AM/FM/PM Measurement Demodulator
4196994763 - B17 - IQ Online
0684125256 - None
1514211661 - K84 - 1xEV-DO BTS Application Firmware
0579586646 - K84 - 1xEV-DO MS  Application Firmware
3285910640 - None
1332515167 - FSP-B15 FSP-B70 FS-K7
1746004935 - K72 prior K74
0425836556 - None
3914572062 - K9  - Power Meter
0367944746 - FSP-B15 FS-K7
0178533596 - None
0084427020 - None
0973137605 - K76 - 3GPP TD-SCDMA BTS Application Firmware
4058089560 - K77 - 3GPP TD-SCDMA MS  Application Firmware
2816669065 - K30 - Noise Figure Measurament
0774785927 - K82 - CDMA2000 BTS Application Firmware
1251526595 - K83 - CDMA2000 MS  Application Firmware
0364322959 - K8  - Bluetooth Application Firmware
3912188941 - K40 - Phase Noise Measurament
2043795852 - None
2216559242 - None
3509799288 - None
0667766505 - None
2179962388 - 31 days trial period
4232888520 - 78 days trial period
1998016984 - None
1665344687 - None
0081926458 - Frequency Extension
1876889287 - None
2554963261 - Trasducer Set
0989643314 - None
1367083121 - None
2589261327 - None
3754352886 - None
2349723378 - None
2713318677 - None
0242151735 - None
3807482493 - None
2651669256 - None
0586577237 - None
3525044770 - None
0034228987 - None
1143727560 - None
2616543767 - None
1636617207 - None
0959025083 - None
1318982380 - None
2600577035 - None
--------------------------------------------------------------------------
compare with the options.ini in my FSEA. the fisrt line is the "FSE-K10 GSM Test Software, Mobile".

------------------------------------------------------
Options file in my FSEA:
3780795724; GSM MTS ANALYZER
------------------------------------------------------

My question is which line of the SN is for other option?
-------------------------------------------------------------------
FSE-K4  Phase Noise Measurement Software,            ??????
FSE-K3  Noise Measurement Software                     ????????
FSE-K10 GSM Test Software, Mobile                       3780795724
FSE-K11 GSM Test Software, Base Station
FSE-K20 GSM Test Software, Edge Mobile
FSE-K21 GSM Test Software, EDGE Base Station
FSE-K30 GSM Test Software, 850 GHz band Mobile
FSE-K31 GSM Test Software, 850 GHz band Base Station
-------------------------------------------------------------------

another thing I found is that there is no API.dll in my FSEA30. I search all *.ll in hard disk, it seems that "FSEFPNL.DLL" is the suspect one.

Hello,

FSE/FSIQ Analyzers: any clue what seeds for these options in order to generate the keys ?

FSE-K4  Phase Noise Measurement Software,           
FSE-K3  Noise Measurement Software   

I tried all the seeds in the obove list (from previous post)  but none gave these options.


Thanks
Title: Re: Enabling options for R&S test equipment
Post by: Cristian2020 on April 17, 2020, 01:01:03 pm
Hi,

I have try the FSP code generator for post nr. 7 (compiled the C code from the attachment ) for some FSP analyzer that already have the installed option and it seams that the generator does not produce the right keys. I have also try the software without using the extensions (only the serial number as some users suggests ) after the serial number (SN:"xxxxxx/"extention") and combinations but without any luck.
So for instrument with the SN:100218/013 for K5 the intrument has valid key value :0129995137 and k73 :3470174034
Running the C produce the following output:

0129996165 - K5  - GSM/EDGE Application Firmware                                                                       
2115523187 - K7  - AM/FM/PM Measurement Demodulator                                                                     
2038900723 - B17 - IQ Online                                                                                           
18446744073588054323 - K84 - 1xEV-DO BTS Application Firmware
................................................................................................

As can be seen,in this case, from the above the are some similarities  for K5 with the working key but is not what we expect.
Program:     0129996165
working key:0129995137

for k73 i have no clear seed to compare in the program


second example :

Intrument SN
char SerString []   = {"100548/030"};

produces for K8 :
                                                             
18446744072697944362 - K8  - Bluetooth Application Firmware                                                           
 
but the working key of the instrument is :2746489130

I read that the application has been used to generate valid key for FSP but i was not able to verify the usability.
Does anybody has an working example pair (SN-Keys ) that has been verified (for  all options  listed by the C software  so i can test it in my development)
What am i missing here?

Also another aspect that will be welcomed is to explain the decrypt side of the C software
So because ARC is symmetric key block cipher i was expect to encode the SN to a key and when decode the previous encoded key using the same C sw to find the SN. But this was not the case.So using the number in ex. 1 above, the Key for K5 generated by the C code is 0129996165.changing the code to decrypt
#define      DECRYPT      1
#define      ENCRYPT      0

and inputting the above key
char KeyString []   = {"0129996165"};   

the program generate:

1168528319 - K5  - GSM/EDGE Application Firmware                                                                     
0718055252 - K7  - AM/FM/PM Measurement Demodulator                                                                   
18446744072781050645 - B17 - IQ Online     
....................................................................     

As can be seen this does not correspond  to what we expect to find for K5 (apparentley no connection with the encoded side  even when comparing this with the seed for K5 :0x069AF1C1)

Can somebody please explain what i have missed here!

Thank you!




                                                           
                                                         

Title: Re: Enabling options for R&S test equipment
Post by: eliocor on April 17, 2020, 01:32:25 pm
it seems you have done something wrong:
 
I changed only the following line:
Code: [Select]
from:
char SerString []    = {"xxxxxx/xxx"};        // Seriale dello strumento
to:
char SerString []    = {"100218/013"};        // Seriale dello strumento 
I just recompiled the program and I got the following output:
 
0129995137 - K5  - GSM/EDGE Application Firmware
2115523187 - K7  - AM/FM/PM Measurement Demodulator
2156342255 - B17 - IQ Online
0029433139 - K84 - 1xEV-DO BTS Application Firmware
1707468331 - K84 - 1xEV-DO MS  Application Firmware
1152848593 - K9  - Power Meter
0154808364 - K76 - 3GPP TD-SCDMA BTS Application Firmware
4292549013 - K77 - 3GPP TD-SCDMA MS  Application Firmware
3336719522 - K30 - Noise Figure Measurament
4012350171 - K82 - CDMA2000 BTS Application Firmware
1883977506 - K83 - CDMA2000 MS  Application Firmware
2927653398 - K8  - Bluetooth Application Firmware
0642974582 - K40 - Phase Noise Measurament

 0129995137 - K5  - GSM/EDGE Application Firmware
seems to me correct.
Title: Re: Enabling options for R&S test equipment
Post by: jjoonathan on April 17, 2020, 01:57:20 pm
-m32 is your friend.

That, or have a machine so old and crusty that 32 bit is the default.
Title: Re: Enabling options for R&S test equipment
Post by: eliocor on April 17, 2020, 02:53:21 pm
The visual studio project was set for generating a Win32 EXE, not a Win64 one.
BTW, the code was not mine: I just "found" it!
Title: Re: Enabling options for R&S test equipment
Post by: piotrekjan on April 17, 2020, 03:39:07 pm
Hi,
Some these questions will be trivial, sorry - I'm not SW guy.
Comming for a while for SMIQ topic.
I have 2 generators one partially dead with options(hdr/sft) and one working but naked. I've moved some modules to this naked one - but as you guess it is necessary to install them with keys.
This partially dead has following numbers:
S/N: 832870/0020
Factory installation key: 352664
Options:
SMIQ-B42 (1104.7936.02), installation key:553631
SMIQB11 1085.4502.04
SMIQB19 1085.2997.02
SMIQB20 1125.5190.02

This naked has following numbers:
S/N: 100587/0036
Factory installation key: 642681

My question is how to use this Python script listed in the posts here to generate installation keys for these options above for my naked generator. I understand that I have to place there  serial number 100587/0036 but what about codes for these options ?  Smiq rather not basing on any operating system. So it is not possible to read some files like in CMU. It has some EEPROM on it - but not sure what data it keeps there.
The other observation is that key should be 6 digit number - but may be not ?

Any suggestions how to start with this ? 
Title: Re: Enabling options for R&S test equipment
Post by: jjoonathan on April 17, 2020, 05:50:13 pm
> The visual studio project was set for generating a Win32 EXE, not a Win64 one.

And that's why it worked for you. It didn't work for Cristian2020 because he was compiling in 64 bit mode. I haven't even compiled or run the code, but the integer lengths and misalignment in the printout make me 95% sure that was his problem.
Title: Re: Enabling options for R&S test equipment
Post by: piotrekjan on April 19, 2020, 03:23:57 pm
I'm trying repeat an operation that artag described in reply 21, after some playing with success.

After small Internet investigation about values representation and modifications in newer Python:
Code: [Select]
import binascii
import sys
from Crypto.Cipher import ARC2
import struct
import struct
serial = 103086
serial2 = 2
option = 45

record = struct.pack("<II", serial, serial2 + (option <<20))
print(record)
cipher = ARC2.new(b"Revision\0", ARC2.MODE_ECB)
encyphered = cipher.encrypt(record)
msg = binascii.hexlify(encyphered)
msglist = []
for letter in str(msg):
    msglist.append(letter)
msglist.remove("b")
msglist.remove("'")
msglist.remove("'")
for letter in msglist:
    print(letter, end="")
print("")

It gives exactly 11b26d02cee94bea,

and below the final version, maybe  usefull for someone - nothing more than artag made some years ago, just in newer python version:
Code: [Select]
import binascii
import sys
from Crypto.Cipher import ARC2
import struct

serial = 103086
serial2 = 2
#option = 10


sample = open('SWOPT.dat', 'w')

for option in range(10,50):
    record = struct.pack("<II", serial, serial2 + (option <<20))
    cipher = ARC2.new(b"Revision\0", ARC2.MODE_ECB)
    encyphered = cipher.encrypt(record)
    msg = binascii.hexlify(encyphered)
    msglist = []
    for letter in str(msg):
        msglist.append(letter)
    msglist.remove("b")
    msglist.remove("'")
    msglist.remove("'")
    for letter in msglist:
        print(letter, end="", file=sample)
    print("",file=sample)

sample.close()

KEY = b"Revision\0"
STRUCT_TWO_UNSIGNED_INTS = "<II"
for line in open("SWOPT.DAT"):
    if len(line) == 17:
         cipher = ARC2.new(KEY, ARC2.MODE_ECB)  # a new ARC2 cipher with the right key (ARC2 is a symmetric block cipher, we need a new cipher for each ciphertext)
         ciphertext = bytes.fromhex(line.strip()) # Decode our ciphertext from hex, removing whitespace from the start and end
         plaintext = cipher.decrypt(ciphertext)  # Decrypt the cyphertext using the key
         a, b = struct.unpack(STRUCT_TWO_UNSIGNED_INTS, plaintext)  # unpack two unsigned ints from the plaintext
         print ("SN: %d - %08x" % (a, b))

And now fundamental question - how to get the 6 digit code that is the key for option in SMIQ generator ?
If this can be used for SMIQ somehow ?
Do I have to install this visual studio program listed in reply 7 and try to play with or it is some other option to extract it ?
Title: Re: Enabling options for R&S test equipment
Post by: bjirre on April 20, 2020, 12:03:24 pm
Hi Everyone,

Does anybody has any progress on this topic for the Rohde&Schwarz UPL audio analyzer? How to enable the options?

Thanks so much!

Bart
Title: Re: Enabling options for R&S test equipment
Post by: Cristian2020 on April 21, 2020, 10:27:09 pm
I can confirm that the problem get solved using compiler for 32Bit.

Thank's  for suggestions!

PS:

SMIQ has some interesting options to be unlocked like arbitrary modulation ,ber testing ..etc.

It will be very useful to have this options but the problem remain (what is the 6 digit magic number key)

BR,

Title: Re: Enabling options for R&S test equipment
Post by: charliedelta on May 16, 2020, 08:53:39 am
Anyone know how to enable the option on the FSH6? I tried to buy this Key but R&S says they cant generate keys anyone because they have discontinued this product. It just sounds so lillogical I cant even believe they would say something like this. I want to send them money and all that they have to do is generate a key on their PC.

If someone knows a dealer that generates keys that i can buy one for I would be happy to buy it. Moral of the story is buy the options you need before they discontinue them. Test equipment seems to have a very short support life these days especially from R&S
Title: Re: Enabling options for R&S test equipment
Post by: ocom on May 25, 2020, 08:56:36 pm

Hi all,

I have an R&S ZVH4. I would like to add options, do you think this is possible?

it's annoying to see that you manage to activate options on CMUs and to say that maybe on ZVH it is not possible,

thank you
Title: Re: Enabling options for R&S test equipment
Post by: 1design on May 26, 2020, 02:21:36 pm
Looks like the ZVH product line is still available in the US:
https://www.rohde-schwarz.com/us/product/zvh-productstartpage_63493-11194.html?rusprivacypolicy=0 (https://www.rohde-schwarz.com/us/product/zvh-productstartpage_63493-11194.html?rusprivacypolicy=0)

Maybe you can try and check with the US dealer for your license. They are selling the product, they should also be able to send you an activation code.
Title: Re: Enabling options for R&S test equipment
Post by: piotrekjan on July 11, 2020, 07:50:42 pm
Anyone know how to enable the option on the FSH6? I tried to buy this Key but R&S says they cant generate keys anyone because they have discontinued this product. It just sounds so lillogical I cant even believe they would say something like this. I want to send them money and all that they have to do is generate a key on their PC.

If someone knows a dealer that generates keys that i can buy one for I would be happy to buy it. Moral of the story is buy the options you need before they discontinue them. Test equipment seems to have a very short support life these days especially from R&S

Do you think they do bussiness(money) on hobbysts who play with 15 or more years old, 2nd hand equipment ? There is nothing illogical in what they do. Try to understand how much you can pay them and then compare it to recent price of their equipment and options attached. Why they should sell option to equipment they do not sell anymore and even if they would, I see how would you pay some k$ for license ;) I do not defend them but their repair support is long anyhow. And I also understand that they do not want to talk with such hoobysts like we are. An each hour of enginner costs. If you are not happy you can chose other equipment right ? ;) We have to live with this situation and be happy there are contributors who spend time on repairing/hacking some equipment and share it on forum to help others.
Do not take my message as attack - just basic logic justifies their behavior

Regards,
Title: Re: Enabling options for R&S test equipment
Post by: teknut on July 17, 2020, 01:47:20 pm
@ piotrekjan
Any progress on the SMIQ front? I'm starting to get interested in this as I will like to enable B21 - Bit Error Rate Test which is a software only option on top of B20 - Modulation Coder.  I can provide info on the two units I have as in SN, factory installation key (wonder what exactly is this ?) and at least one software installation keys that is attached to one of the units for K42 - DIGITAL STD - IS-95. Needless to say I can't make a difference between a Python and a Cobra so the code around here does not help me much at this time!!
Thanks,
A
Title: Re: Enabling options for R&S test equipment
Post by: piotrekjan on July 17, 2020, 06:12:34 pm
Not really.
I was studing the manual to find GPIB command to install option, to proceed with bruteforce however, there probably no such command or not listed. I still do not know how to generate 6 digit key basing on the hex string generated from S/N and option by described script. So for now sorry but I do not know how to proceed further.

Regards,
Title: Re: Enabling options for R&S test equipment
Post by: piotrekjan on July 18, 2020, 01:23:43 pm
Had someone play with this audio generator ? What is necessary to run it next to module B41 ?
Basing on alu cover that shows B41 connections, B41 is connected to A10 X105 (located next to it) and A7 X704. Here next question - to A7 X704, two cables are connected one from B41 and on from A9 X901.
Is some "T" adapter necessary to connect these cables together on A7 X704 ?
What about software firmware - this mentioned previously IS1MV5.20 will work for this audio too?
And the last question - these, let's call them "RF cables", inside equipment - what plugs these are - is it possible to buy to make cable ourselves or it is some R&S standard ?

Regards,
Title: Re: Enabling options for R&S test equipment
Post by: teknut on July 22, 2020, 04:00:16 pm
Not sure about the audio question but sure about the RF connectors inside. For whatever reason they are using 3 types
SMA - I guess we all know that one right ? - is the one used for the attenuator
SMB - almost the same size as an SMA yet it does not rotate - plugs in and out
MMCX - the smallest one of all used all around
All standard connectors... nothing special
Title: Re: Enabling options for R&S test equipment
Post by: piotrekjan on July 22, 2020, 05:13:48 pm
The MMCX is the plug I was looking for.
Thank you and Regards,
Title: Re: Enabling options for R&S test equipment
Post by: MindBender on July 29, 2020, 10:07:07 am
I have updated the source code of the Rohde & Schwarz FSP option generator in post 7 of this thread and put it on GitHub:
https://github.com/CatGenius/fsxx_keygen (https://github.com/CatGenius/fsxx_keygen)
It now contains all 200 seeds from API.DLL and it takes the serial number from the command line options.

If no instrument type is specified, it prints all 200 keys, generated from the serial number and the 200 seeds. If you have found some of these keys to activate any options, please report:
Please note I am not the original author of this software. I just extended it a bit.
Title: Re: Enabling options for R&S test equipment
Post by: cmu2017 on August 20, 2020, 07:45:21 am
Is there also such a program to enable options for the R&S SFE100?
Title: Re: Enabling options for R&S test equipment
Post by: hg2dok on October 11, 2020, 05:07:41 pm
Hello everyone! I want to activate the AMPS option in cmu200. Can anyone help generate decimal code?CMU serial is 834639/052
Best regards HG2DOK ARON
Title: Re: Enabling options for R&S test equipment
Post by: msraya on October 12, 2020, 09:04:54 am
Hello everyone

Lately I help a friend of mine to enable CMU200 functionality and to doing a backup. I use old good python code.
Unhappily, this code is large obsolete because of update library functionality and Python 2 obsolescence.

So I try to upgrade python code. I think I success, so I share my findings with you.
Below is the code. There are two programs, one to extract and check serial number from encoded user key file SWOPT.DAT hidden file.
The second to obtain user keys. Bear in mind that this code is for educational purpose only. Each one has the responsibility for their use. I don't help nor support anyone questions about the code, sorry. My aim is to help people with old and obsolete equipment.

from Crypto.Cipher import ARC2
from Crypto import Random
import struct
import base64

for l in open("SWOPT.DAT"):
   if len(l) == 17:
      tmp=bytes.fromhex(l.strip())
      cipher = ARC2.new(b'Revision\0', ARC2.MODE_ECB)
      tmp2 = cipher.decrypt(tmp)
      a, b = struct.unpack("<II", tmp2)
      print ("SN: %d - %d" % (a, b/1000000))


from Crypto.Cipher import ARC2
from Crypto import Random
import struct

serial = 101763
serial2 = 2
options = [21,22,23,24,42,43,45,44,14,29,47,48,53,54]

for option in options:
   record = struct.pack("<II", serial, serial2 + (option <<20))
   encyphered = ARC2.new(b'Revision\0', ARC2.MODE_ECB ).encrypt(record)
   print("Option K%2d, key = %s."% (option,encyphered.hex()))

Regards