Has anybody enabled Tracking Gen on Agilent N9340B?

[analogRF]

I was wondering if someone have found a way to enable the TG on N9340B or any other options for that matter.

There are interesting functions such as OptionCodeGenerate, OptionCodeVerify, GenLicense, readOptionLicense, etc...buried in the firmware
but I am a total idiot when it comes to firmware dis-assembly and reverse engineering, so I have no idea what is what in there but
there must be a way for those in the know...

The processor is Sharp LH7A404 (32bit ARM922T core) and it is based on vxWorks.

Actually the serial console is easily
accessible without even opening the instrument! Just open the battery door! however it is not TTL level (RS232)

EDIT: there is a MAX232 chip a few blocks away on the back side of cpu board if you really want to have TTL levels

[analogRF]

BTW I have downloaded all the files from the internal flash memory. I guess they also could be extracted from the downloadable firmware file as well but with the serial console easily accessible, I just copied the whole thing on a USB stick but I have no way of knowing how the options can be
enabled.
I am guessing perhaps a method similar to what people did for DSO6000A oscilloscope might be applicable here too but I have no idea how that one came about either...

[PA0PBZ]

Can you drop the files somewhere?

[analogRF]

Can you drop the files somewhere?

PM sent

[abyrvalg]

Joining the “project”. Some questions:
- is there any official way to install option keys on this device?
- how does the serial console look exactly? (having some “anchor” helps identifying the handling code)

[abyrvalg]

Looks like there is some menu to enter codes. And the funny part: when you enter a code, the firmware doesn't decode it, but tries to generate valid codes for all possible feature+period combinations (18 features * 4 periods), outputting each code via printf("license=%s\n", code) (to that console UART? or some other debug UART?). So it should be possible to enter some random code and get all those valid combinations from the output.

[analogRF]

Joining the “project”. Some questions:
- is there any official way to install option keys on this device?
- how does the serial console look exactly? (having some “anchor” helps identifying the handling code)

 there is a menu under System > More > Options > Add Option. It asks for license key

here are some pictures with error generated (bottom of screen) after entering a random license.
http://www.mediafire.com/file/msijnbnr8chinbk/file

that error message can be found in " sysdata\Errmsg.err " file.

here I have attached a sample boot record that I got from one UART port that is close to the battery door.

[analogRF]

Looks like there is some menu to enter codes. And the funny part: when you enter a code, the firmware doesn't decode it, but tries to generate valid codes for all possible feature+period combinations (18 features * 4 periods), outputting each code via printf("license=%s\n", code) (to that console UART? or some other debug UART?). So it should be possible to enter some random code and get all those valid combinations from the output.

Wow! This is a lot of information that you got from this 

actually I never tried to look at the UART port while entering a random key for option keys. However, there are two debug ports in
the unit, one that is clearly accessible from the battery door and it has even identified TX/RX/GND pins on the silk screen and has a pin header
and I got the boot console from it. There is another UART port a couple of blocks away on the CPU port hidden under the metal shield
and has no pin header but it has identifier TX/RX on the silk screen. I tried that one too but there was no activity on that port during boot and normal operation. However, I didn't think of looking at it (them) while entering a license key.

But why the unit should generate all license code combinations and output them on a UART port? so eventually how does it identify and accept the code? I could see that there is a routine that seems to be generating the correct code within the software but I never understood why.

by the way, the instrument determines what option(s) must be enabled with a given license code. I mean you just enter a license key and it will decode what option(s) will be cleared. You DO NOT choose the option name and then enter a code for it

[abyrvalg]

Since the console is a "true" VxWorks shell, you can try invoking the writeoption() function directly:

Code: [Select]

-> writeoption(1,0)This should enable the TG3 (tracking generator) option permanently (no time limit).

Full list of first parameter values:

Code: [Select]

0 PA3 PreAmplifier
1 TG3 Tracking Generator
2 SO3 Source
3 DMA ASK/FSK Demodulation
4 AMA AM/FM Demodulation
5 DFS Diagnostics
6 KLS DelSystem
7 IBC IBOC AM and FM
8 IBF IBOC FM
9 INM Interference Monitor
10 XDM XDSL Measurement
11 BAS Simple Mode
12 PAK Simple Mode PACK
13 SEM Simple Mode SEM
14 SPT Simple Mode SpecBase
15 PWM Simple Mode PowerMeter
16 MKT Supper License
17 U01 Window Limit
Second parameter is expiration date as "unix epoch time". Set to 0 for "endless".

Edit: updated second parameter info.

[analogRF]

OMG!

That was so quick 

But only a few of these options are official. I have never heard of many of them such as SEM, SPT, PWM, etc...
and I dont think they actually work on this unit
I know some of them like IBC and IBF require a (very expensive) hardware (the RF board needs to be replaced)

but AMA, DMA, TG3, IBF, IBC, PA3 are official options

[abyrvalg]

MKT looks like a "distributor superlicense" enabling all options in one shot (present in many other instruments).
DFS is some diagnostic option, it can be enabled by entering a fixed option code 44448888.

[analogRF]

does the MKT enable only the working/supported options on the unit or just blindly enables everything that the code allows?
I mean, sometimes if you enable an option that is not actually supported it can brick the unit (I learned that in a hard way with a lecroy wavepro
although I managed to fix it in that case)

[analogRF]

by the way, is there any way to remove an option? it can come very handy if you mess with a wrong option

[1design]

I tried the writeoption() function for AMA and DMA. They now show up in the option screen, but even though I used ,3 , the option screen labels them as Expire: 19700101.

The functions do not appear in the menu as apparently they expired 50 years ago Any help would be appreciated.

[analogRF]

I tried the writeoption() function for AMA and DMA. They now show up in the option screen, but even though I used ,3 , the option screen labels them as Expire: 19700101.

The functions do not appear in the menu as apparently they expired 50 years ago Any help would be appreciated.

I havent tried it yet but it seems to me that that second argument alone may not determine the option expiry date. perhaps another argument to that function is needed or it must be set separately. There is a reference to optionPeriodStr in the code that leads to those 4 numbers that abyrvlag listed however there is a reference to "lastLicense" in the code that means "DEFAULT" which I know it means permanent option. But I cannot figure out how that "lastLicense" is linked to the "writeoption" command

[tv84]

The licenses seem easy to generate.

Do you have any example of a working license?

[analogRF]

The licenses seem easy to generate.

Do you have any example of a working license?

no, mine only has PA3 and it shows DEFAULT which means permanent and there is no code. I dont think this unit ever shows the license code on screen. It only shows the option and expiry date

[analogRF]

there is a writeOptionTime function and a optionPeriodStr in the code that may be useful. I dont know how  they are related if at all

[abyrvalg]

Looks like I was wrong. Change the second parameter from 3 to 0. Updated the original message.

[1design]

Looks like I was wrong. Change the second parameter from 3 to 0. Updated the original message.

I can confirm, that worked like a charm

[analogRF]

Looks like I was wrong. Change the second parameter from 3 to 0. Updated the original message.

great 
I'll try that very soon after lunch

[tv84]

There are 3 temporary license types: 30 days, 270 days and 730 days.

They probably should all show DEFAULT in the license window.

A FOREVER license should show an empty expiration reference.

If anyone wants to try a license, pm his HostID.

[analogRF]

Looks like I was wrong. Change the second parameter from 3 to 0. Updated the original message.

I can confirm, that worked like a charm

me too

[1design]

I can confirm that using writeoption(x,0) gives a permanent license.

Make sure you reboot the unit after enabling the new option.

[analogRF]

I can confirm that using writeoption(x,0) gives a permanent license.

Make sure you reboot the unit after enabling the new option.

yes, that works
but did you dare to try SO3 option? does it work?

[tv84]

Agilent N9340B and N9340C license generator

For all owners of this Agilent HSA, here is a quick vacation gift (created in less than 1 hour between some pool dives  ).

The code is C# but should be totally self-explanatory.

Code: [Select]

        private static void calc_license_Agilent_N9340B_C(string hostID, bool is_N9340C)
        {
            string[] option = { "PA3", "TG3", "SO3", "DMA", "AMA", "DFS", "KLS", "IBC", "IBF",
                                "INM", "XDM", "BAS", "PAK", "SEM", "SPT", "PWM", "MKT", "U01" };
           
            if (hostID.Length != 8)
                Console.WriteLine("Error in hostID length!");

            for (int m = 0; m < option.Length; m++)
            {
                byte[] hash = MD5.Create().ComputeHash(Encoding.ASCII.GetBytes(hostID + option[m] + (is_N9340C ? "DFE" : "")));

                Console.Write("{0,-2}   {1}   ", m, option[m]);
                for (int i = 0; i < hash.Length; i++)
                {
                    byte c = 0;
                    for (int j = 0; j < 8; j++)
                        c += (byte)(hash[i] ^ hostID[j]);

                    c = (byte)(c % 36 + 48);
                    if (c > 57)
                        c += 7;
                    Console.Write(Convert.ToChar(c));
                }
                Console.WriteLine();
            }
        }
EDIT March 30th, 2023: Added the generation of N9340C family licenses. List of options is here.

[1design]

I can confirm that using writeoption(x,0) gives a permanent license.

Make sure you reboot the unit after enabling the new option.

yes, that works
but did you dare to try SO3 option? does it work?

I already had the TG3 on mine and added the two remaining official options DMA and AMA. Didn't want to risk it with unofficial options.

[tv84]

To remove the options:

That is achieved by running function s_remoteoptionclear which is called by a SCPI command. ATM, don't know the syntax of the command.

[analogRF]

To remove the options:

That is achieved by running function s_remoteoptionclear which is called by a SCPI command. ATM, don't know the syntax of the command.

it would be very handy to have a way of removing options. I saw this function in the code but cannot figure out how/where to call it.

[tv84]

Try this command:

REMOTE:OPTION:CLEAR

[analogRF]

Try this command:

REMOTE:OPTION:CLEAR

this didnt work 

[abyrvalg]

created in less than 1 hour between some pool dives

Same "mode of operation" here. If you've seen a guy paddling on a SUP board near address 0x8BED0 - that was me

Invoking s_remoteoptionclear() without parameters in the shell should clear all options.

Btw, there is a full set of SCPI commands under REMOTE:OPTION to query/add/delete options. One idea why "REMOTE:OPTION:CLEAR" didn't worked: the "CLEAR" part is written as "CLEAr" in the binary, maybe it is case sensitive? Does SCPI work at all? Any reply from *IDN? command? (Just in case: these are NOT shell commands, but SCPI).

[tv84]

Btw, there is a full set of SCPI commands under REMOTE:OPTION to query/add/delete options. One idea why "REMOTE:OPTION:CLEAR" didn't worked: the "CLEAR" part is written as "CLEAr" in the binary, maybe it is case sensitive? Does SCPI work at all? Any reply from *IDN? command? (Just in case: these are NOT shell commands, but SCPI).

The CLEAr only means that you can use also the CLEA version. But, full uppercase should work as in almost all equipments, as the programs usually convert the full string to uppercase before processing.

Have you found a way to extract the SCPI command tree?

[tv84]

HostID is similarly calculated from the last 8 digits of the Digital Module S/N.     

[analogRF]

created in less than 1 hour between some pool dives

Same "mode of operation" here. If you've seen a guy paddling on a SUP board near address 0x8BED0 - that was me

Invoking s_remoteoptionclear() without parameters in the shell should clear all options.

Btw, there is a full set of SCPI commands under REMOTE:OPTION to query/add/delete options. One idea why "REMOTE:OPTION:CLEAR" didn't worked: the "CLEAR" part is written as "CLEAr" in the binary, maybe it is case sensitive? Does SCPI work at all? Any reply from *IDN? command? (Just in case: these are NOT shell commands, but SCPI).

I'll try this later today but isn't there any way to remove one particular option. perhaps by directly manipulating a memory location in flash
by "sysFlashSet"

[abyrvalg]

sysFlashSet("111", 4, 0x3202BC+4*option_index) should do the job.
I've suggested using a raw address 0xC0001000 instead of "111" earlier (in PM), that's ok too (just need any valid pointer to some data that DOESN'T look like a valid option flag), but IIRC VxWorks shell allows to pass strings for pointer args (it stores them in a temporary buffer and passes correct pointers).
You can check the flash contents before writing with a command like: d 0x903202BC,4
An active option should have byte0!=FF, byte1!=FF, byte2 = byte0 XOR byte1
Note the difference in addresses: 0x90xxxxxx address for "d" command is an absolute address ("d" is not flash-specific), but sysFlashSet() expect an offset from flash base (0x90000000) and adds the base internally.
Option-related addresses:

Code: [Select]

0x903202BC: byte activation_flags[18][4] - [2] = [0] ^ [1] means "installed"
0x90322000: byte installed_keys[18][20] - key strings (for display, never checked once installed)
0x90322260: uint64 expiration_dates[18] - expiration dates in Unix format


[abyrvalg]

The CLEAr only means that you can use also the CLEA version.

One suspicious thing: there is a table of long and short forms at SCPIstr (format is { char long[15], short[6] }) and there are two separate entries for "CLEAR":
long="CLEAR", short="CLE"
long="CLEAr", short="CLEA"
All other commands have both forms in uppercase. Since the tree (at StateP) is defined as indices into this array, these two entries will have different meanings.

[tv84]

Since the tree (at StateP) is defined as indices into this array, these two entries will have different meanings.

Can you exemplify the indices into the array?

[abyrvalg]

The correct cmd is DEBUG:REMOTE:OPTION:CLEAR

The tree structure:

Code: [Select]

StateP: array of pointers to arrays of { u8 str_idx, u8, u16 next_state_idx, u16 func_idx }
str_idx is an index into SCPIstr array of { char long[15], short[6] }
str_idx==0xFF - last entry
next_state_idx is an index into StateP[]
func_idx is an index to FunSP[]
"st_main" is the root state
The parser starts with current_state = 0 (StateP[0] -> st_main), compares the current cmd part with all SCPIstr[StateP[i++].str_idx].long/.short until match, then sets current_state = next_state_idx
If next_state_idx==0 - this is the last token in chain, invoke the function FunSP[func_idx]
Going to code an IDA script to extract a full list

[tv84]

The tree structure:

   Excellent job!  I'll also add to my parser.

PS: Did you got off the SUP for this one? 

PS1:  I think:

{ u8 str_idx, u8, u16 next_state_idx, u16 func_idx }

is

{ u16 str_idx, u16 next_state_idx, u16 func_idx }

[abyrvalg]

Done, here is full list with corresponding handler functions:
https://pastebin.com/Ue5WtKm8

"CMD=" form means "CMD with parameters"

[abyrvalg]

PS1:  I think:

{ u8 str_idx, u8, u16 next_state_idx, u16 func_idx }

is

{ u16 str_idx, u16 next_state_idx, u16 func_idx }

No, they are getting str_idx as a byte. The next byte is just an alignment I guess (never used).

Edit: one quirk: if next_state_idx points to current state - this is an "execute w/o parameters" form (used for conflicts like "PREFIX:VALIDEXECCMD", "PREFIX:VALIDEXECCMD:CANHAVESUBCMD")

[analogRF]

any idea what SYSTEM:OPTION?  and DEBUG:REMOTE:OPTION= do?

[abyrvalg]

SYSTEM:OPTION? should return a list of all active (not expired) options
DEBUG:REMOTE:OPTION? should return a list of all possible options with 0/1 flags appended to each one indicating the validity
DEBUG:REMOTE:OPTION= should accept an option list in the same format as DEBUG:REMOTE:OPTION?'s output and enable/disable many options in one shot (sounds cool )

[tv84]

I think DEBUG:REMOTE:OPTION= should accept a license (or list of). Should be the same as entering the lic via the menu.

I don't see how it can accept a flag given that to activate you would need a license.

Usually the GET commands for options, let you specify the option for which you want to know the status.

[abyrvalg]

I don't see how it can accept a flag given that to activate you would need a license.

The key check (MD5, XOR & friends) is performed at installation via menu only. It is NOT checked at each power on (only "byte0^byte1==byte2" check of that array at 0x903202BC).
s_remoteoption() handler parses a comma-separated list of shortened 2-letter option codes and single digit flags, then writes all flags to flash with a single call to sysFlashSet(buf, 4*18, 0x3202BC).

[tv84]

I was talking in logical terms. But, this licensing really defies logic. Once again, well done @abyrvalg.

[analogRF]

I just ran the SYSTEM:OPTION? and DEBUG:REMOTE:OPTION?
and here is what I got. Similar to what abyrvalg described
However, the list of options from DEBUG:REMOTE:OPTION?
does not completely make sense. First they only have two letters followed by a 0/1 indicating which one is supported I guess
but some of the two letter names do not correspond to any option it seems...and some options that we know of, dont seem to be in the list such as INM or AMA...

I didnt run the DEBUG:REMOTE:OPTION= because I was not still sure how it must be used/called.

can it be used to disable an option, too??

[abyrvalg]

DEBUG:REMOTE:OPTION (both get and set) uses shortened names:

Code: [Select]

PA3 - PA
TG3 - TG
SO3 - SO
DMA - PM
AMA - DM
DFS - DF
KLS - DL
IBC - IB
IBF - IF
INM - SP
XDM - AD
BAS - SM
PAK - PK
SEM - SE
SPT - SB
PWM - MT
MKT - MK
U01 - U0
0/1 digit means "disabled/enabled". So yes, you can disable with this command too. Something like this:
DEBUG:REMOTE:OPTION PA1,TG1,SO0,SP0 - should enable PA3, TG3 and disable SO3, INM

[analogRF]

DEBUG:REMOTE:OPTION (both get and set) uses shortened names:

Code: [Select]

PA3 - PA
TG3 - TG
SO3 - SO
DMA - PM
AMA - DM
DFS - DF
KLS - DL
IBC - IB
IBF - IF
INM - SP
XDM - AD
BAS - SM
PAK - PK
SEM - SE
SPT - SB
PWM - MT
MKT - MK
U01 - U0
0/1 digit means "disabled/enabled". So yes, you can disable with this command too. Something like this:
DEBUG:REMOTE:OPTION PA1,TG1,SO0,SP0 - should enable PA3, TG3 and disable SO3, INM

but I thought 0/1 only meant which options are supported on the unit and which ones are not allowed.

I'll give this a try later today

[tv84]

Done, here is full list with corresponding handler functions:
https://pastebin.com/Ue5WtKm8

"CMD=" form means "CMD with parameters"

@abyrvalg,

I don't think this list is totally correct. It seems there are many commands which are not valid.

My comment is just from an analytical POV and not from commands experimentation and/or code analysis. I think Agilent/KS would never create commands like, for example:

STATUS:QUESTIONABLE:EVENT:INTEGRITY:EVENT:UNCALIBRATED:EVENT:NTRANSITION?
CALCULATE:MARKER:SET:SET:FCOUNT:STATE

Also, how could 1800+ commands generate only 300+ different functions?

I did my parsing, using this rules:
0xFF - means end of tree branch
0x00 - tree leaf
current_state_idx == next_state_idx - bypass

My output is attached. I could be missing something (or not) but, definitely, this list seems more like "usual" SCPI commands. Even though, it still generates 808 commands.

Edit: I just corrected the current_state_idx == next_state_idx processing because all already included the SET command. New file attached.

Edit1: New output in a later msg.

[abyrvalg]

Yes, some commands don't look good definitely. Digged the parser a bit deeper - it is much more complicated than I've thought:
- functions specified by func_idx are called for all matching intermediate keywords too (not just for leaves) and they can affect further parsing by setting/clearing some flags (i.e. s_bool, s_unbool), checking for some conditions etc
- the current state is checked for some specific values and some parsing actions are taken right in parser loop
So just walking those state arrays is not enough, much more manual work is required (check for each of those intermediate flags-changing funcs in script logic to take some actions, check for special states etc). Doable, but it doesn't look like fun anymore, this is closer to "harvesting a field" than to "hunting" already
The same tree with intermediate functions: https://pastebin.com/xgi3wkcd

[tv84]

- functions specified by func_idx are called for all matching intermediate keywords too (not just for leaves) and they can affect further parsing by setting/clearing some flags (i.e. s_bool, s_unbool), checking for some conditions etc

I thought you has previously studied that part.

I had that question myself from the beginning but decided to close my eyes to that. Nonetheless, the last func is the important one.

Doable, but it doesn't look like fun anymore, this is closer to "harvesting a field" than to "hunting" already

  I'll have a look to see if I can add something valid.

[tv84]

New SCPI command list with lower/upper cases. Includes 322 different commands.

I've filtered all the repeated commands.

For me, this is the final command list. Fun's over.

@abyrvalg, the intermediate "functions" allow for the parsing of what I did manually in this filtering. Not worth the trouble of reversing.

[analogRF]

confirmed:
DEBUG:REMOTE:OPTION:CLEAR works
with DEBUG:REMOTE:OPTION you can enable/disable individual options

EDIT: DO NOT try undocumented options 

[1design]

Agilent N9340B license generator

For all owners of this Agilent HSA, here is a quick vacation gift (created in less than 1 hour between some pool dives  ).

The code is C# but should be totally self-explanatory.

Code: [Select]

        private static void calc_Agilent_N9340B(string hostID)
        {
            string[] option = { "PA3", "TG3", "SO3", "DMA", "AMA", "DFS", "KLS", "IBC", "IBF",
                                "INM", "XDM", "BAS", "PAK", "SEM", "SPT", "PWM", "MKT", "U01" };
           
            if (hostID.Length != 8)
                Console.WriteLine("Error in hostID length!");

            for (int m = 0; m < option.Length; m++)
            {
                byte[] hash = MD5.Create().ComputeHash(Encoding.ASCII.GetBytes(hostID + option[m]));

                Console.Write("{0,-2}   {1}   ", m, option[m]);
                for (int i = 0; i < hash.Length; i++)
                {
                    byte c = 0;
                    for (int j = 0; j < 8; j++)
                        c += (byte)(hash[i] ^ hostID[j]);

                    c = (byte)(c % 36 + 48);
                    if (c > 57)
                        c += 7;
                    Console.Write(Convert.ToChar(c));
                }
                Console.WriteLine();
            }
        }

Is there any way of getting this in Python? I am a HW kind of guy and translating from C# into something I can run locally is sadly above my head..

[tv84]

Is there any way of getting this in Python? I am a HW kind of guy and translating from C# into something I can run locally is sadly above my head..

Sorry, I hate python. Maybe someone can do that for you.

[ytterligare]

Hello, I resume this topic because I was able, thanks to the hard work of a lot of people here, to "supercharge" my 2nd hand N9340B.... ( especially with the help of the diving man  )

Anyhow, I was wondering, among the "dangerous" undocumented options not to be touched, if the following :

DFS   Diagnostics
SO3   Source

could be "less" dangerous to try.


The first was described by abyrvalg as "some diagnostic option, it can be enabled by entering a fixed option code 44448888" ( this last sentence is not really clear to me : where should we enter the "option code" ? After enabling the option ?)

The second, in my idea, could, I say COULD, enable the option of letting the SA act also as a basic RF Generator, something already seen on other more recent SAs

Any thought ?

Andrea

[nexus]

Hi all,

I just picked up a gov. surplus auction n9344c in unknown condition (still on its way in the mail).

Very interesting read here; hopefully if this analyzer works I can get some options installed. It doesn't have the TG hardware but the preamp would be great for EMI probing since the analyzer can tune down to 9khz.

What I'm gathering is that option enabling can be done in a serial terminal (RS232) right under the batt door. Is pic attached the right connector? Also, does anyone have info on the connector type/pinout and baud/parity for connecting a usb 232 uart?

Looking forward to some hacking!

[Mallocated]

I bought myself a N9340B, noticed a similar debug connector and then spent months debugging and dumping decompiled code using the VXWorks console and all the wrong type of decompiling tools.  Eventually I found that all the correct licence codes were output via the console as a debug message whenever you entered any correct or incorrect licence via the instrument.   Too easy.  THEN this post popped up and people who knew what they were doing had it cracked within a few days in between dips in the pool!

I've now got a N9342C, and unfortunately I don't think the SCPI method in this post works - tried it once.  I found a way using the VXWorks console, adding breakpoints and dumping memory locations. 

To get started, see attached, and this;

https://nz.rs-online.com/web/p/wire-to-board-cable-assemblies/1617531/

And you'll need this;
cid
cid123456

And you'll hopefully see the attached bootup sequence and login.  Baud rate I think was either 19200 or 57600.
Baud rate is 115200.

[nexus]

Roger. Thank you for this info!
Will have an update in the coming weeks once I get the analyzer in hand and have a poke around.

[nexus]

Good news. My n9344c came in the mail today. It's seen some love in the field but nothing drastic from the outside.

I bought a new AC/DC 15 volt adapter straight from Keysight so attached the plug pack to my AC6801 ac supply (for safety when attaching unknown analyzer). Plugged in the N9344C and immediately the plug pack went into protect mode, trying to start up every few seconds but cutting out.

So power problem straight away. Measured resistance across barrel jack and under 2 ohms center to shield. Definite problem.

So begin teardown to digital motherboard where barrel jack is mounted. Nothing looks burnt, but there is basically a short on DC input.

Ok, so whip out the thermal camera and hook up programmable psu to barrel jack. 2 volts, 0.1 amps and keep increasing in 0.1 amp steps. At 0.3 amps, the culprit tantalum cap begins to get warm. Found ya!

Took the failed tant off (thank god it didn't explode and ruin the board). Reassembled temporarily and plugged in. Analyzer powers on and sweeps with no errors! Do a firmware update, no problem. It's working with no issues to be seen. Need to test with signal gen but will first clean (a little crusty on the inside too) and replace removed tant. Bought the serial header so we will definitely try to get that preamp option enabled!

[Mallocated]

Good skills.  If you still have the case open, any chance you could post some photos of the GPS module and any identifiers?  Wondering if it's Agilent branded or an off-the-shelf product. I've fitted a generic GPS module to my N9342C and got it working with a firmware modification, but the instrument timebase calibration from GPS PPS output is still no go.  Thanks. 

[Mallocated]

This might help with troubleshooting the DC input and protection circuit....

[nexus]

No problem. Here are some pics. There is only one marking on the board under a sticker, hopefully it can be identified.

I know agilent had some good block diagrams for their equipment back in the day. Nice to have an actual schematic too! Is that snip out of a service manual for an N93XX somewhere online?

[Mallocated]

I've found photos of another Agilent board with the same MSB-01 and MSS-B labels, so that points to Agilent manufacturing.

The module's G253 GPS patch antenna is by Inpaq www.inpaqgp.com


Also there's the logo next to the sticker that looks like FP or PF of you rotate it 90deg.

That's where the trail goes cold for me. 

Keysight still list the GPS module part for $339
https://www.keysight.com/my/partDetail/N9344-65011

[nexus]

Replacement tants came in today, so while I was putting those on the main board I also elected to have a look inside the GPS module.

Definitely is a little custom agilent board. Looks like the module is mainly a GlobalSat EB-3531 SIRF III with a 50 ohm bidirectional coupler and some matching network and filtering passives. If you have the pinout, might be able to reverse engineer and make one that's plug and play.

[Mallocated]

When you look at the design and build quality you can see why the module pricetag is $350.

I fitted a cheapo Adafruit Ultimate GPS breakout board to mine, which has a Globaltop FGPMMOPA6H module with MediaTek MT3339 GPS Chipset.  I had to change the module baud rate to match what the instrument was expecting, which meant reflashing with an altered firmware.  If anyone needs the full process I'll start a new post.  Quite a long process, it would be heaps easier if there is a compatible SIRF-based module out there.

Thanks for disecting your GPS module - for the greater good.

[milesd969]

I'm new to the forum, I would ask for help I have an agilent n9340b, it can't raise the Agilent logo system on the display and that's it.
I will attach a file from the serial console, any help is welcome flash file I would try to write it in my SA, thanks

[analogRF]

I'm new to the forum, I would ask for help I have an agilent n9340b, it can't raise the Agilent logo system on the display and that's it.
I will attach a file from the serial console, any help is welcome flash file I would try to write it in my SA, thanks

Looks very much like the nand flash device is defective or at least corrupted. But most likely the chip itself is bad. Assuming the power supplies are OK

[NA5B]

Hello milesd969, I had the same or similar problem with my N9340B. The logo appeared and stayed forever and nothing else.
This is what I did to fix the problem:
I downloaded Keysight N9340B PC Software and Keysight Connection Expert software first. Found a "Cross Over" LAN cable. Used the device's default 192.168.0.112 IP number. I tried, no success.
Later I set my PC IP to 192.168.0.110  that's what the instructions wrote. Connection Expert program registered the SA as UNKNOWN device! I said ok, at least there is something. I verified this by turning on and off the SA. I was able to see this unknown device appear and disappear.

Later I tried the Keysight N9340B PC Software program. It had a "LAN connection and firmware update" button. I tried to connect to the SA. Again no response. I restarted the software run as admin. Still the same. I ignored this and I went ahead and chose my latest update file. Clicked the UPDATE button and magically it showed the upload bar, uploading files 1,2, and 3 and it stopped for a long time on 3. I was so happy then I got confused. I started thinking that this was a false upgrade move. BUT then it started counting file 4 and up!!!! :- )  So, some files took longer to load. 280 some files later it wrote: Files uploaded, firmware updated, please restart the SA. This file upload took about 10 minutes forever!
I turned the SA off and then on. The Agilent logo stayed a bit longer, then the screen went blank and then showed the actual graphics. Now It works as it should.

[milesd969]

Problem solved, I bought another analyzer N9340b from the motherboard, I unsoldered a flash S29GL512P10TFIR1. I used the Xeltek Superpro 3000U programmer, I managed to get the contents of the flash file, using the binary image I filled the old flash, when I started the analyzer everything worked.
I later unlocked all the options for this analyzer model using an algorithm written by a diving man from this forum

[WernerFalken]

Bumping this again. Any chance on getting an updated code generator to work on N9342C/N9344C? Works great on the N9340B!

[tv84]

Bumping this again. Any chance on getting an updated code generator to work on N9342C/N9344C? Works great on the N9340B!

Colby, it's your lucky day. I revised the previous code and added the N9340C generation code.

Here.

[tv84]

This is the list of options for N9340C family:

Code: [Select]

P06 - Pre-amplifier, 100kHz to 6GHz
TG6 - Tracking Generator, 5MHz to 6GHz
DMA - ASK/FSK Modulation Analysis
AMA - AM/FM Modulation Analysis
PWM - U2000 series support
IBO - IBOC AM and FM
XDS - xDSL Measurement
SIM - Spectrum monitor
CHP - Channel Power
ACP - Adjacent Channel Power Ratio
OBW - Occupied Bandwidth
SEM - Spectrum Emission Mask
FST - Field Strength
F04 - Freq extension to 4.2 GHz
F06 - Freq extension to 6 GHz
F07 - Freq extension to 7 GHz
F13 - Freq extension to 13.6 GHz
F20 - Freq extension to 20 GHz
LAN - LAN port, TCP/IP
RBW - Resolution bandwidth, 10 Hz/3 MHz
FSA - Fine resolution step attenuator
GPS - Built-in GPS receiver and antenna
TPN - Task planner for test automation
TG7 - Tracking Generator, 5 MHz to 7 GHz
SEC - Security features
DST - Temporary License, for demo unit
DT1 - Temporary License
TG4 - Tracking Generator,5 MHz to 4.2 GHz
PA4 - Pre-amplifier, 100 kHz to 4.2 GHz
PA7 - Pre-amplifier, 100 kHz to 7 GHz
P13 - Pre-amplifier, 13.6 GHz
P20 - Pre-amplifier, 20 GHz
CAT - Cable and antenna test
TMG - Time-gated spectrum analysis
BB1 - Baseband input
F7G - Freq extension to 7 GHz
PWS - Power suite
DIA - Diagnostics
F24 - Freq extension to 24 GHz
OPE - Simplified operator mode
SCN - Channel Scanner
CAU - Cable and antenna test
CA7 - Cable and antenna test, 7GHz
CA6 - Cable and antenna test, 6GHz
F08 - Freq extension to 8.5 GHz
PA8 - Pre-amplifier, 100 kHz to 8.5 GHz
PWP - U2020 x-series support
D24 - Temporary License, 24 months
G01 - General-Purpose Interface Bus
CAL - Calibration
RM7 - Reflection Measurement
MNT - Spectrum monitor
PFR - Precision Frequency Reference
P07 - Pre-amplifier, 100 kHz to 7 GHz
EMC - EMC filter and QPeak Detector
TFE - Tracking Generator frequency extension

[Vivatspb]

Hello.
Is there any option to explain briefly how to run this code and what program is needed to open the options on my N9342C?

Best regards

[milesd969]

You have to know programming, it is not easy to explain, send the ID number of the analyzer, I will open one option for free

[mickab]

Agilent N9340B and N9340C license generator

For all owners of this Agilent HSA, here is a quick vacation gift (created in less than 1 hour between some pool dives  ).

The code is C# but should be totally self-explanatory.

Code: [Select]

        private static void calc_license_Agilent_N9340B_C(string hostID, bool is_N9340C)
        {
            string[] option = { "PA3", "TG3", "SO3", "DMA", "AMA", "DFS", "KLS", "IBC", "IBF",
                                "INM", "XDM", "BAS", "PAK", "SEM", "SPT", "PWM", "MKT", "U01" };
           
            if (hostID.Length != 8)
                Console.WriteLine("Error in hostID length!");

            for (int m = 0; m < option.Length; m++)
            {
                byte[] hash = MD5.Create().ComputeHash(Encoding.ASCII.GetBytes(hostID + option[m] + (is_N9340C ? "DFE" : "")));

                Console.Write("{0,-2}   {1}   ", m, option[m]);
                for (int i = 0; i < hash.Length; i++)
                {
                    byte c = 0;
                    for (int j = 0; j < 8; j++)
                        c += (byte)(hash[i] ^ hostID[j]);

                    c = (byte)(c % 36 + 48);
                    if (c > 57)
                        c += 7;
                    Console.Write(Convert.ToChar(c));
                }
                Console.WriteLine();
            }
        }
EDIT March 30th, 2023: Added the generation of N9340C family licenses. List of options is here.

Hello tv84,

Do you know if the script can be adapted for the N9320B ?

I have try with "is_N9340C" at "false" and "true" but both results didn't work. 
I don't understand why you add "DFE" when it is a N9340C.

[milesd969]

Send the Host ID number of the analyzer, I can try

[tv84]

Do you know if the script can be adapted for the N9320B ?

That one is similar but a bit more complicated. You won't get there by trial and error.