Author Topic: Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B  (Read 411 times)

0 Members and 1 Guest are viewing this topic.

Offline analogRF

  • Frequent Contributor
  • **
  • Posts: 279
  • Country: ca
Hi
I was wondering if anyone ever hacked these ESA spectrum analyzers to enable options?

some options like 1DR and 1DS (or even 1D5 for S/N > 4421) can be enabled by license key only

https://www.keysight.com/main/editorial.jspx?cc=US&lc=eng&ckey=277453&nid=-11143.0.00&id=277453
 

Offline mbielman

  • Contributor
  • Posts: 11
  • Country: us
Re: Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B
« Reply #1 on: November 08, 2019, 12:41:59 am »
I have the same question! Specifically I want to enable the RF Preamp option. (the hardware should be there) Wondering if I can set a bit in the EEprom on the processor card. OR maybe figure out the key(s) based on the serial number.

Anyone?


Mark B
 

Offline analogRF

  • Frequent Contributor
  • **
  • Posts: 279
  • Country: ca
Re: Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B
« Reply #2 on: November 08, 2019, 02:45:15 am »
I have heard that these analyzers have been cracked but people who know how it's done, won't disclose anything  :-//
 

Offline mbielman

  • Contributor
  • Posts: 11
  • Country: us
Re: Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B
« Reply #3 on: November 08, 2019, 03:52:42 am »
I have an idea but it would be tedious and slightly dangerous...

Pull the EEPROM (processor board - an assumption on my part) from a unit that has some options enabled, and read that.
Put it back, disable an option or two, remove it again and reread, then look for changes.

Ug!
 

Offline analogRF

  • Frequent Contributor
  • **
  • Posts: 279
  • Country: ca
Re: Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B
« Reply #4 on: November 11, 2019, 02:20:05 pm »
disabling the option in the menus does not remove it from the EEPROM

I am pretty sure someone has found a way to enable the options but it is not shared....
 

Online PA0PBZ

  • Super Contributor
  • ***
  • Posts: 4137
  • Country: nl
Re: Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B
« Reply #5 on: November 11, 2019, 02:51:49 pm »
If it's the same as the N1996a CSA and the E7495 it uses FlexLM, I'm the one to blame for the "enhancement" and I have no problem to have a look at these machines as they are discontinued anyway. Does anyone have root access to these machines already?
Keyboard error: Press F1 to continue.
 

Offline analogRF

  • Frequent Contributor
  • **
  • Posts: 279
  • Country: ca
Re: Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B
« Reply #6 on: November 11, 2019, 03:04:43 pm »
If it's the same as the N1996a CSA and the E7495 it uses FlexLM, I'm the one to blame for the "enhancement" and I have no problem to have a look at these machines as they are discontinued anyway. Does anyone have root access to these machines already?

that would be awesome. unfortunately I don't have root access . I think N1996A is a much newer machine than ESA series...but of course they might be using the same os
 

Online PA0PBZ

  • Super Contributor
  • ***
  • Posts: 4137
  • Country: nl
Re: Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B
« Reply #7 on: November 11, 2019, 03:09:57 pm »
Can you see what format the license code should be? That would probably show if it is FlexLM or something else.
I just downloaded the firmware upgrade but it is 9 discs  |O And the other version for older OS does not run on my PC.
-to be continued-
Keyboard error: Press F1 to continue.
 

Offline analogRF

  • Frequent Contributor
  • **
  • Posts: 279
  • Country: ca
Re: Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B
« Reply #8 on: November 11, 2019, 03:16:45 pm »
actually I personally do not have one of these analyzers but have been hunting for one for quite some time. if there is a way to enable some non-hardware options then it would be awesome...I have worked with them though...

maybe this page will help?

https://www.keysight.com/main/editorial.jspx?cc=US&lc=eng&ckey=1000004808:epsg:faq&nid=-35489.384884&id=1000004808:epsg:faq

 

Offline Miek

  • Contributor
  • Posts: 19
  • Country: gb
Re: Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B
« Reply #9 on: November 11, 2019, 03:23:24 pm »
I think you may be able to just concatenate the five ESAFW files, though I'm not completely sure - there might be a header on each.

There are references in the source to FlexLM, and an RTOS named pSOS.
 

Online PA0PBZ

  • Super Contributor
  • ***
  • Posts: 4137
  • Country: nl
Re: Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B
« Reply #10 on: November 11, 2019, 05:54:35 pm »
So it runs on some kind of *nix, it is FlexLM and the license file is here: /usr/local/flexlm/licenses/license.dat.
The bad news is that the bytes that have to be patched in the other instruments are not to be found in the ESAFW file.

So, is there any way to communicate with the ESA, is there a prompt on a serial port? I don't think it has ethernet..
Is there a harddisk inside that is readable? [Edit] No, it's flash.
« Last Edit: November 11, 2019, 06:30:34 pm by PA0PBZ »
Keyboard error: Press F1 to continue.
 

Online PA0PBZ

  • Super Contributor
  • ***
  • Posts: 4137
  • Country: nl
Re: Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B
« Reply #11 on: November 11, 2019, 06:46:34 pm »
Processor is Motorola Coldfire:

Keyboard error: Press F1 to continue.
 

Offline mbielman

  • Contributor
  • Posts: 11
  • Country: us
Re: Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B
« Reply #12 on: November 11, 2019, 08:59:44 pm »
Not sure what you are trying to convey here. The ESA instruments use the MC68LC040 (integer only version) and as far as I know do not have a "traditional" OS at all, unlike the newer units.

If there is a way to interrogate the system, I would love to know how!
 

Online PA0PBZ

  • Super Contributor
  • ***
  • Posts: 4137
  • Country: nl
Re: Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B
« Reply #13 on: November 11, 2019, 09:17:43 pm »
I'm trying to find a way into the ESA to be able to patch the FlexLM part. It looks like the code disassembles fine as a Coldfire processor but you could be right that it is a 68LC040. It looks like it's not that different and it disassembles fine. The method I used to get around the FlexLM stuff in the other instruments is always returning "ok" on an entered license but you have to patch the FlexLM daemon. If you can't get to the file that is going to be difficult so I'm looking at the install.o file to see how it works and if there is a way to install a patched file, that's basically it :)

Keyboard error: Press F1 to continue.
 

Offline mbielman

  • Contributor
  • Posts: 11
  • Country: us
Re: Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B
« Reply #14 on: November 11, 2019, 09:57:26 pm »
Yeah, not much differs I think between those processors, at least basic op codes. Coldfire is newer than the old MOT 680xx.
As mentioned, don't think these run HP-UX, Windows or any such OS. So no idea if there is anything resembling a file system.
Although it has A: and C: drives (floppy and flash) so who knows! If it's there, you do not see it when the system boots.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf