Has anybody enabled Tracking Gen on Agilent N9340B?

[analogRF]

I was wondering if someone have found a way to enable the TG on N9340B or any other options for that matter.

There are interesting functions such as OptionCodeGenerate, OptionCodeVerify, GenLicense, readOptionLicense, etc...buried in the firmware
but I am a total idiot when it comes to firmware dis-assembly and reverse engineering, so I have no idea what is what in there but
there must be a way for those in the know...

The processor is Sharp LH7A404 (32bit ARM922T core) and it is based on vxWorks.

Actually the serial console is easily
accessible without even opening the instrument! Just open the battery door! however it is not TTL level (RS232)

EDIT: there is a MAX232 chip a few blocks away on the back side of cpu board if you really want to have TTL levels

[analogRF]

BTW I have downloaded all the files from the internal flash memory. I guess they also could be extracted from the downloadable firmware file as well but with the serial console easily accessible, I just copied the whole thing on a USB stick but I have no way of knowing how the options can be
enabled.
I am guessing perhaps a method similar to what people did for DSO6000A oscilloscope might be applicable here too but I have no idea how that one came about either...

[PA0PBZ]

Can you drop the files somewhere?

[analogRF]

Can you drop the files somewhere?

PM sent

[abyrvalg]

Joining the “project”. Some questions:
- is there any official way to install option keys on this device?
- how does the serial console look exactly? (having some “anchor” helps identifying the handling code)

[abyrvalg]

Looks like there is some menu to enter codes. And the funny part: when you enter a code, the firmware doesn't decode it, but tries to generate valid codes for all possible feature+period combinations (18 features * 4 periods), outputting each code via printf("license=%s\n", code) (to that console UART? or some other debug UART?). So it should be possible to enter some random code and get all those valid combinations from the output.

[analogRF]

Joining the “project”. Some questions:
- is there any official way to install option keys on this device?
- how does the serial console look exactly? (having some “anchor” helps identifying the handling code)

 there is a menu under System > More > Options > Add Option. It asks for license key

here are some pictures with error generated (bottom of screen) after entering a random license.
http://www.mediafire.com/file/msijnbnr8chinbk/file

that error message can be found in " sysdata\Errmsg.err " file.

here I have attached a sample boot record that I got from one UART port that is close to the battery door.

[analogRF]

Looks like there is some menu to enter codes. And the funny part: when you enter a code, the firmware doesn't decode it, but tries to generate valid codes for all possible feature+period combinations (18 features * 4 periods), outputting each code via printf("license=%s\n", code) (to that console UART? or some other debug UART?). So it should be possible to enter some random code and get all those valid combinations from the output.

Wow! This is a lot of information that you got from this 

actually I never tried to look at the UART port while entering a random key for option keys. However, there are two debug ports in
the unit, one that is clearly accessible from the battery door and it has even identified TX/RX/GND pins on the silk screen and has a pin header
and I got the boot console from it. There is another UART port a couple of blocks away on the CPU port hidden under the metal shield
and has no pin header but it has identifier TX/RX on the silk screen. I tried that one too but there was no activity on that port during boot and normal operation. However, I didn't think of looking at it (them) while entering a license key.

But why the unit should generate all license code combinations and output them on a UART port? so eventually how does it identify and accept the code? I could see that there is a routine that seems to be generating the correct code within the software but I never understood why.

by the way, the instrument determines what option(s) must be enabled with a given license code. I mean you just enter a license key and it will decode what option(s) will be cleared. You DO NOT choose the option name and then enter a code for it

[abyrvalg]

Since the console is a "true" VxWorks shell, you can try invoking the writeoption() function directly:

Code: [Select]

-> writeoption(1,0)This should enable the TG3 (tracking generator) option permanently (no time limit).

Full list of first parameter values:

Code: [Select]

0 PA3 PreAmplifier
1 TG3 Tracking Generator
2 SO3 Source
3 DMA ASK/FSK Demodulation
4 AMA AM/FM Demodulation
5 DFS Diagnostics
6 KLS DelSystem
7 IBC IBOC AM and FM
8 IBF IBOC FM
9 INM Interference Monitor
10 XDM XDSL Measurement
11 BAS Simple Mode
12 PAK Simple Mode PACK
13 SEM Simple Mode SEM
14 SPT Simple Mode SpecBase
15 PWM Simple Mode PowerMeter
16 MKT Supper License
17 U01 Window Limit
Second parameter is expiration date as "unix epoch time". Set to 0 for "endless".

Edit: updated second parameter info.

[analogRF]

OMG!

That was so quick 

But only a few of these options are official. I have never heard of many of them such as SEM, SPT, PWM, etc...
and I dont think they actually work on this unit
I know some of them like IBC and IBF require a (very expensive) hardware (the RF board needs to be replaced)

but AMA, DMA, TG3, IBF, IBC, PA3 are official options

[abyrvalg]

MKT looks like a "distributor superlicense" enabling all options in one shot (present in many other instruments).
DFS is some diagnostic option, it can be enabled by entering a fixed option code 44448888.

[analogRF]

does the MKT enable only the working/supported options on the unit or just blindly enables everything that the code allows?
I mean, sometimes if you enable an option that is not actually supported it can brick the unit (I learned that in a hard way with a lecroy wavepro
although I managed to fix it in that case)

[analogRF]

by the way, is there any way to remove an option? it can come very handy if you mess with a wrong option

[1design]

I tried the writeoption() function for AMA and DMA. They now show up in the option screen, but even though I used ,3 , the option screen labels them as Expire: 19700101.

The functions do not appear in the menu as apparently they expired 50 years ago Any help would be appreciated.

[analogRF]

I tried the writeoption() function for AMA and DMA. They now show up in the option screen, but even though I used ,3 , the option screen labels them as Expire: 19700101.

The functions do not appear in the menu as apparently they expired 50 years ago Any help would be appreciated.

I havent tried it yet but it seems to me that that second argument alone may not determine the option expiry date. perhaps another argument to that function is needed or it must be set separately. There is a reference to optionPeriodStr in the code that leads to those 4 numbers that abyrvlag listed however there is a reference to "lastLicense" in the code that means "DEFAULT" which I know it means permanent option. But I cannot figure out how that "lastLicense" is linked to the "writeoption" command

[tv84]

The licenses seem easy to generate.

Do you have any example of a working license?

[analogRF]

The licenses seem easy to generate.

Do you have any example of a working license?

no, mine only has PA3 and it shows DEFAULT which means permanent and there is no code. I dont think this unit ever shows the license code on screen. It only shows the option and expiry date

[analogRF]

there is a writeOptionTime function and a optionPeriodStr in the code that may be useful. I dont know how  they are related if at all

[abyrvalg]

Looks like I was wrong. Change the second parameter from 3 to 0. Updated the original message.

[1design]

Looks like I was wrong. Change the second parameter from 3 to 0. Updated the original message.

I can confirm, that worked like a charm

[analogRF]

Looks like I was wrong. Change the second parameter from 3 to 0. Updated the original message.

great 
I'll try that very soon after lunch

[tv84]

There are 3 temporary license types: 30 days, 270 days and 730 days.

They probably should all show DEFAULT in the license window.

A FOREVER license should show an empty expiration reference.

If anyone wants to try a license, pm his HostID.

[analogRF]

Looks like I was wrong. Change the second parameter from 3 to 0. Updated the original message.

I can confirm, that worked like a charm

me too

[1design]

I can confirm that using writeoption(x,0) gives a permanent license.

Make sure you reboot the unit after enabling the new option.

[analogRF]

I can confirm that using writeoption(x,0) gives a permanent license.

Make sure you reboot the unit after enabling the new option.

yes, that works
but did you dare to try SO3 option? does it work?