Enabling options for R&S test equipment

[vishaldotgupta]

hi

i have worked for R&S.  the key system and its generator is very secret as its  a source of revenue.  i can provide you some hints based on my finding.

The active keys are in a some kind of start up file.  this file is referred to each time when the equipment is booted to load new options

if this file is modified, a new file will be created at boot up.  so what ever you modify will be gone

there is will a small memory on some main module which is likely to have the installed key options

in the windows services, there will be some kind of license manager application that would be running.  this app has the capability to modify that flash memory and create a new startup file.

you may like to note that whenever a new license key is added, the equipment need a reboot for that license to be active.

[vishaldotgupta]

Hello,
i also did investigate reversing option code encryption for newer R&S instruments like ETL.
It uses the long 30-digit key.
Is there anybody who knows more about it (maybe won't share it to pblic)?
If so please pm me, i am very interested in it and could provide other license generators for radio equipment.

I did investigate R&S Option key encryption on NRPV.exe (NRPV Software for use with power sensors.)
I entered (wrong) code and debugged SW.
I see that SW does the following with the entered key:
It does multiply first digit by 10 (0xA), adds the next digit, multiplys again with 10 (0xA), adds the next digit and so on.

License Key: 39 85 31 34 42 02 58 53 47 46 26 30 69 80 69

in NRPV.exe:
call bei 0x0100768F:

3 * 0xA = 0x1E + 9 = 0x27
 * 0xA = 0x186 + 8 = 0x18E
 * 0xA = 0xF8C + 5 = 0xF91
 * 0xA = 0x9BAA + 3 = 0x9BAD
 * 0xA = 0x614C2 + 1 = 0x614C3
 * 0xA = 0x3CCF9E + 3 = 0x3CCFA1
 * 0xA = 0x02601C4A + 4 = 0x02601C4E
 * 0xA = 0x17C11B0C + 4 = 0x17C11B10
 * 0xA = 0xED8B0EA0 + 2 = 0xED8B0EA2

0 * 0xA = 0x0 + 0 = 0x00
 * 0xA = 0x0 + 2 = 0x2
 * 0xA = 0x14 + 5 = 0x19
 * 0xA = 0xFA + 8 = 0x102
 * 0xA = 0xA14 + 5 = 0xA19
 * 0xA = 0x64FA + 3 = 0x64FD
 * 0xA = 0x03F1E2 + 4 = 0x03F1E6
 * 0xA = 0x2772FC + 7 = 0x277303
 * 0xA = 0x018A7E1E + 4 = 0x018A7E22
 * 0xA = 0x0F68ED54 + 6 = 0x0F68ED5A

0 * 0xA = 0x0 + 2 = 0x02
 * 0xA = 0x14 + 6 = 0x1A
 * 0xA = 0x104 + 3 = 0x107
 * 0xA = 0xA46 + 0 = 0xA46
 * 0xA = 0x66BC + 6 = 0x66C2
 * 0xA = 0x40394 + 9 = 0x4039D
 * 0xA = 0x282422 + 8 = 0x28242A
 * 0xA = 0x019169A4 + 0 =
 * 0xA = 0x0FAE2068 + 6 = 0x0FAE206E
 * 0xA = 0x9CCD444C + 9 = 0x9CCD4455

Did anyone see such a processing of entered keys?

Again, thanks in advance for reply.
Kind Regards.

ETL is actually based on FSL and ZVL..

so the keysgen of all three should be indentical

[yoshihi]

I'm using the ZVH4 as a hobby.
Unfortunately, my ZVH4 doesn't have options like the spectrum analyzer, so its use is somewhat limited.
Would anyone be willing to share a keygen?

[squadchannel]

https://www.eevblog.com/forum/testgear/enabling-options-for-rohde-schwarz-fsh-series-(discontinued)-analyzers/msg2651010/#msg2651010

laserK has not been seen since 2021. send him a PM and see what happens.
https://www.eevblog.com/forum/profile/?u=110796

ZVH is still available. Options are also available for purchase.
if R&S's profits are harmed, we are the ones who are in trouble. we do not want to unlock the options on products that are not even discontinued.

[sotto]

I’m a great proponent of R&S, using their test gear daily at work. I am also a thrifty hobbyist and not a throw away person. I don’t want to see a good instrument go to waste when there is still relevant use for it. I have the SFE Broadcast tester from around 2008. A discontinued and unsupported product, more humble than the CMU, if there is such a humble product in the R&S range. This is probably relevant to many other instruments of that time.

 The SFE requires a 30 digit decimal as the option key. In the initial configuration files and using a hex editor, on one of the .dfl files, I found all the K (software enabled) options and 7 bytes later a 16 byte sequence.

I believe these 16 bytes are the secret keys used along with the instrument serial number to confirm a correct option key has been entered. I think it uses RC2 crypto and that the option key can be determined from the serial and secret key.

Below is the detail of option K170 AM/FM/RDS, as it appears in hex and the serial number (there is no fractional part). Can anyone help to determine the option key? I believe the serial number 122085 is padded out for the decryption process but this not my subject.

  K   .   1   .    7   .   0  .    .    .    .   .   .    .   è    í   ½   ª   9   Ø   s   B   ¿   „     L   x   ˆ    ×  ®
4B 00 31 00 37 00 30 00 00 00 02 00 00 00 E8 ED BD AA 39 D8 73 42 BF 84 07 4C 78 88 D7 AE


ID:2112.4300K02-122085-Yb

[ve7xen]

Do you have any examples of valid keys? Or access to the firmware image? If it's also of similar vintage to CMU200 it probably uses a similar scheme (also based on RC2), but if the ciphertext is 30 decimal characters it must be using a different cleartext (CMU200 has 16 hex character keys).

[sotto]

Yes, this is the 30 digit valid option key for [K40 AWGN Noise], listed under Active options on this SFE

196623250602195838860031142113

Would a PM be better? Where should I look in the firmware image?

[michal82]

Additional information.
Some R&S devices have a sim card on the motherboard, and the description in the service manual, for example, from the SMBV100A is as follows:

" SIM Card
The instrument identity (Serial Number and Options) is stored on a SIM card. The SIM card is mounted on
the backside of the Basis Board"

"NOTICE
When changing the Basis Board, you have to remove the SIM card.
The SIM card is part of your instrument and will not be replaced by Rohde & Schwarz if
lost. Therefore, always keep the SIM card with you."

[geoffwood]

I have a CMU200 and want to activate the K14 option. R&S no longer support the CMU200, and will not even attempt to sell me an activate Q!!!  Wankers.

I have no chops for how to run the 'Rohde & Schwartz FSP option generator' or other gymnastics described in this thread, and would be eternally grateful if somebody here who does could run my details thru to generate it. Happy to buy some beers for the effort.
 
My Activation screen pic attached.

[MorzeCBP]

I have a CMU200 and want to activate the K14 option.

https://rohde.nonexistent.ca/

[geoffwood]

All sorted thanks to several helpers.

No thanks to R&S who don't/won't even attempt to sell me an activation, presumably thinking I'll purchase replacement gear from them !

[ciasteczkowypotwor]

Hi, Can someone generate option numbers for FSH3 for me?

[pdenisowski]

Hi, Can someone generate option numbers for FSH3 for me?

Can't help you generate license keys for our products, but love the user name

[analogRF]

Hello, friends!

I have an old FSH6, I want to improve it. I need keys for options. I spent 2 days with the key generator program, but I still don't understand how to run it. Can you help with the keys?

Держи:
3764584245 Demo Mode
3087642571 DTF B1
1944932055 Vector Calibration K2
2480215784 Remote Control K1
4021211727 Receiver Measurement K3
3323216289 Restricted Acc K60
0027545025 Calibration Allowed K15

does anybody know how K60 and K15 work? I mean what do they do?
they dont seem to be adding anything in the system menus anywhere.

[ciasteczkowypotwor]

I managed to get the codes, thanks to tv84.
But while the first four work, the next ones don't. What could be the problem?


S/N: 101302/00   OptIndex_000: 1138917325
S/N: 101302/00   OptIndex_001: 1007896614
S/N: 101302/00   OptIndex_002: 3119874071
S/N: 101302/00   OptIndex_003: 0304019205
S/N: 101302/00   OptIndex_004: 2274318544
S/N: 101302/00   OptIndex_005: 3384963188
S/N: 101302/00   OptIndex_006: 2826251885
S/N: 101302/00   OptIndex_007: 3979592507
S/N: 101302/00   OptIndex_008: 0841462956
S/N: 101302/00   OptIndex_009: 3067136231
S/N: 101302/00   OptIndex_010: 0387794094

[KungFuJosh]

Search earlier in the thread; there's more than one script.

[KungFuJosh]

Check reply #338. You might be able to use or modify that script if it's from the same era.

[KungFuJosh]

Check reply #338. You might be able to use or modify that script if it's from the same era.

I took a look. The script generates a 6 digit option key. However, I need an 8 digit option key.

Correct. That's why I said to try and modify it. I dunno if that will work or not, but if the codes were generated similarly, but with different lengths, maybe?

[deJulian1988]

Hello!
I have two SFE100 (2112.4100.03). There are the same Option installed (K170 AM/FM)
Here are the Serials and the Option Keys... Maybe Somebody can make a Key Generator, Please ;-)

Serial 132177 ----> Option Key for K170     348782566612647858460902399539
Serial 133374 ----> Option Key for K170     238036896919974275992441810211

And Sorry for my English Skills :-)

Best Regards Julian

[pmx]

Hi, a funny (so to speak..) thing happen to me.

I installed various options in my VNA. Worked like a charm (when supported).
I tried various keys, some supported, other not.
Unsupported keys were simply ignored with an error message..

But one of the rejected option keys triggered  "something" : the HD begun to spin like mad. I stopped the VNA,

After the next startup, the already installed options were still listed in the startup screen, but not anymore accessible via the "Mode" menu.
And after the next reboot, the options were not listed anymore.
(Looks like a 2 stages elimination process...)

The funny (!!) thing is :
Whenever I reinstall an option key, the option works perfectly, but after a reboot, it disappears (in 2 stages, like before).

I suspect a missing or corrupted file :
the CMOS battery (motherboard) is obviously dead as the clock resets to a date in 1997 after every reboot.
And I found an file named "options.ini",  with the same 1997 modification date.
Maybe there is something here ?
But I cant read this file (I can't find how to  access the Windows NT desktop)

Sadly, I hadn't made a disk image (not the hardware for that, and I got the VNA only 2 days ago).

Any clues ?

P.S. I tried again the offending option key, nothing happened this time, it was simply rejected with the usual error message.

[pmx]

Last evening, I was updating a keygen code found on this thread (the Italian one, written in C) to work with my VNA.

I tried almost all the possible option keys to see which one are valid and which ones are rejected, in order to make the code more useful for the ZVR/ZVC family (it was originally designed for the FSP, as far as i know).
I'm mostly doing this out of curiosity and for the benefit of the community, as I personally don't really need most of the advanced firmware options : for complex tasks with a VNA, I tend to post-process the ".s_p" files .

Some option keys are rejected, but strangely some other are accepted but don't appears to do anything (on the surface)...
Furthermore, at least 2 times, an option key froze the VNA (reboot needed) (doesn't seem to be repeatable).

And then I ran into a SERIOUS PROBLEM (screaming and crying loud!!...  ) :
one of the option key, I don't now which one, silently downgraded my ZVR (4 receivers) to a ZVRE (3 receivers).
As my ZVR (+ ZVR-B25 option) and a ZVRE internal cabling is different, I lost even the most  basic VNA functionalities.

Where am I so far ?
I' still haven't opened the VNA, nor accessed the HDD.
I noticed that the "options.ini"  file size changed.(this file is in a sub-directory of  C:\r_s\  )
Also, I found some system log messages saying that "options.ini" file is corrupted .(Maybe it happened some time before this problem, see my previous post).

Any suggestion on how the revert the VNA to it's original ZVR identity ?

I hope the setting resides is a WinNT file, not in an EEPROM on the transputer boards (remember the frozen VNA...).
30 years ago, storing settings in an  EEPROM was less common I guess.

Maybe a kind soul could share an "options.ini" file from a working ZVR ?
Even better if it comes from a ZVR with the following hardware options : ZVR-25 (External Measurements) ans ZVR-B21 to B24 (step attenuators).
But I would happily do with any flavour of "options.in"
Thanks in advance...

[ And NO, as I had just received this VNA a few days ago, I hadn't clone the HDD... ]

[pmx]

Hi again...

There is a "Service" or "Maintenance" menu in tne ZVR (can't remember the exact name) protected by a password.
Is there a default or factory" password I could try ? Or a way to reset this password ?
Just in case...I

[tv84]

Try these and report:

894129
20122004
30473035

[pmx]

Hi TV84,
old post, I know...

Let me try clarify some things  (although I don't know much about this).

The list of options extracted from FSP firmware v4.50 API.DLL is the following:
K5     GSM/EDGE Application                 GSM K5 ANALYZER               FSPSpectrumAnalyzerLI   
K7     FM Demodulator                       FM DEMODULATOR                FSPSpectrumAnalyzerLI   
[...]

I'm currently updating the FSP keygen for the ZVx VNA series, but trying blindly all possible option keys I somewhat bricked my ZVR. 
My ZVR (with hardware option ZVR-B25) is now seen as a ZVRE.
As the RF path is different, no measurement can be done anymore.

I would appreciate a pointer to the tools you used.
Maybe there is a "back to ZVR" option of sorts listed in the ZVR's API.DLL ?.
And at least, a proper options description in the keygen code would prevent others to fall in the same trap.
Help would be highly appreciated !

You can PM me if you prefer.

(I'll share the updater ZVx keygen once finished and tested).

[pmx]

Try these and report:

894129
20122004
30473035

Funny, I just mentioned you in my previous post...
I'l try these passwords and report quickly.
THANKS !