New Rigol RSA5000 Real Time Spectrum Analyser

[ON6RF]

Hi!

So I've been "lurking" for quite some time around the forum, and followed the MSO mods saga, amongst other things. The level of skill shown here is quite impressive!

I finally bit the bullet and bought a second-hand RSA3030-TG. I was "foolishly" thinking about how easy it would be to run the serial number through "RigLol" to enable all feature... Boy was I wrong!

Thanks to all the tips posted by scottapotama, tv84 and qip, I was able to re-enable SSH and FTP, as mine didn't have them enabled on the get go. I'll throw some extra notes here to complete what was already said:

I don't believe any of the following is particularly sensitive, but might be of use to someone. This is a small dump of publicly available info, and steps detailed in forums and blog posts around the MSO5k and so on...



Finding the hash as mentioned earlier in the thread can be done by peeking at a firmware file or dump from a unit as described earlier in the thread, then finding the normal linux rootfs/etc/passwd file.

1. Download the Rigol RSA firmware
2. Unzip rsa3000_FW_v2.zip
3. Tear the bundle apart

Code: [Select]

unzip rsa3000_FW_v2.zip
cd RSA5000\(ARM\)update_00.03.04.00.03/
tar -xvf rsa5000_updatefile.bin
gunzip *.gz...
4. not-so-secret cramfs extraction trick - seems like we're leaving this bit as a 'hurdle'...
5. Use hashcat to break the DES hash

Code: [Select]

hashcat -m 1500 -a 3 roothash.txt -o output.txt6. SSH should be available for further poking...

The latest firmware available (v00.03.something), however, is packed with something different than Cramfs (according to binwalk), probably some kind of encryption. Luckily, I was able to find ver 00.02.00 with Wayback machine. The rest of the extraction was smooth sailing, quick cramfsck mod to support larger file size, as @tv84 said. Hashcat found the password within 2 minutes 

Re-enabling SSH was a matter of packing a fw4linux.sh (that re-enables sshd and vsftpd by running the command) with gzip, then tar it into rsa3000_updatefile.bin (I learned that thanks to TV84's backup script).

Now, off to understand how to make it permanent as the rootfs is read-only, then tackle enabling those features! I'm learning quite a lot in the process.
Do you have any pointer on where to look for those? I'm thinking playing with Ghidra and tearing the rsa5000 bin apart, but I don't know much about disassembling executables...

[tv84]

The latest firmware available (v00.03.something), however, is packed with something different than Cramfs (according to binwalk), probably some kind of encryption.

Not true. They are just plain "larger FS" CRAMFS images. binwalk needs some patches for a long time.

To make FS mods permanent, you have to flash a new rootfs.img (with the mods included). Not such an easy task.

Nonetheless, AFAIK, SSH daemon is enabled by default.

[ON6RF]

Got it. As for the FS mods, I won't touch anything for now and use the /mnt/user/ dir to mess around.

That's weird, on mine (and on the 00.02.00 FW unpack), /etc/init.d/rcS has sshd and vsftpd commented out (and port 22 is closed unless I start sshd with the update trick):

Code: [Select]

echo "nameserver 8.8.8.8" >> /run/resolv.conf
/usr/sbin/mac-set
/usr/sbin/network $net_config
#/usr/sbin/vsftpd /etc/vsftpd.conf &
#/usr/sbin/sshd &

As for features (or changing the RTSA version), do I need to poke around the binary itself, or am I missing something simpler perhaps?

[tv84]

As for features (or changing the RTSA version), do I need to poke around the binary itself, or am I missing something simpler perhaps?

Poke, but not the best target to start learning.

[RedCali]

The RSA3000E supports ASK/FSK - but the RSA3000N don't - and vice versa the VNA on the N-Model but not the E-Version 
And in an older Manual i read as well something about AM/FM support for measurement / demod....

Has anybody tried to use / enable the E-Features on an N-Model and nows if the AM/FM stuff is supported? :-)

[r0d3z1]

Does anyone knows if the RSA3015E has a webinterface that allows browser control? thanks

[VK6HP]

No, the 3000E series analysers don't have the web interface in the current firmware.  I played with the web interface on a loan "N" analyser while my 3015E-TG was being repaired and, frankly, I was underwhelmed; I no longer covet the capability on my (now returned) unit.

[r0d3z1]

is there any windows tool to visualize the screen remotely ?

[Userli]

Does anybody know the format of the license option text, which is then signed?

[Userli]

I finally joined the club.
While playing with the device I found that in addition to the buttons described earlier, pushing Mode frequently at startup allows to update the boot manager. The AutoTune button acts like Preset at startup but uses Refresh mode, where all parts in the upgrade file are rewritten and not only the ones different from the current ones.
Not that one would really need it but just for completeness.

Are there any news on the 3.2GHz limit? Did anybody try to add the missing parts or find a software solution?

[Userli]

Does anybody know how to get a demodulated signal to the earplugs? In the manual it's mentioned as the purpose of the ear plug jack but no mention of how to achieve this.

[tautech]

Does anybody know how to get a demodulated signal to the earplugs? In the manual it's mentioned as the purpose of the ear plug jack but no mention of how to achieve this.

Set Span settings to zero. 

[Userli]

Set Span settings to zero. 

Thanks, this works. The demodulation type can be chosen under input/output and the earphones need to be switched on there, too.

[Frex]

Hello all,

I have a question for RSA3000/5000 owners, about the web control interface.
When I connect the RSA to my network I try to take control of it,
 I show it right in the web browser (Firefox on win 10) but if i try to acces
to RSA menues with mouse, nothing work !
I have a message on the bottom on screen capture "RESPONSE:NULL"
for each mouse click on screeen (see screen captures below).
Does anyone have same issue with it's device ?
For now, the web browser is usless...

Another question, I was able to copy a screenshoot to a USB key by using
"save" key on the right path with the RSA, but I wasn't able to save in the same
way the S parameters in my USB key. Data are always saved inside the RSA itself.
Any  idea about that ?

Best regards.

Frex

[Frex]

No RSA3000N/5000N owner here ? 

Frex

[Userli]

Did you enable web control on the device?

[Frex]

Hi,

Yes of course.
If not, you don't see the device as on my screenshots
and a message appear on bottom "DISCONNECTED".

I use DHCP mode, and the web browser show well
all change of screen, but no command are possible.
I tried with different browsers without success too.

Frex

[Userli]

Do you see the answer of the analyzer or any errors in the browser debugging tools?

[Frex]

Hi,

No, how I can do that ?
You  have also a RSA ? You web control work ?
Thank you for the help !

Frex

[Userli]

The browser sends constantly html gets to the device. In firefox and edge you hit F12 to see the debugging tools. On the network tab you should see the gets being send.
Btw. you need to have javascript enabled for that page.

[Frex]

Hi,

I have enable the debugging tool of firefox and i see each new
screen image from RSA, but when I click on screen in web browser
there is no specific line that appear in list.
screen shoot copy below.

Frex

[Frex]

Hello all,

Does anybody has successfully used the web control of RIGOL RSA3000 / RSA5000 ?
I don't know for now if there is something wrong on my network or if the RSA is buggy (it has latest firmware 03.06).
Anyway, I have others devices that work fine via web control without issue on same  network (Siglent SDS2104X-Plus).

No others users feedback to confirm/infirm this ?
Regards.

FRex

[Frex]

So, without any answer from others RSA owners, I finally try to ask to the seller (Batronix).
We will see.. Anyway, I really suspect a bug...
For those who doubt about the fact that there is a web control on RSA, the Rigol link
https://rigol.my.site.com/support/s/article/RSA3000-5000-series-web-control

Frex

[IRB]

So, without any answer from others RSA owners, I finally try to ask to the seller (Batronix).
We will see.. Anyway, I really suspect a bug...
For those who doubt about the fact that there is a web control on RSA, the Rigol link
https://rigol.my.site.com/support/s/article/RSA3000-5000-series-web-control

Frex

Hi Frex,

I just tried the web page control. It has horrible lag.
I used Chome, here is a print screen.

I use a VB6 program I wrote. I use the USB for control and doing automated testing.

I added the IP function to my code, for getting the screen image on another post:
https://www.eevblog.com/forum/testgear/spectrum-analyzer-rigol-dsa815/msg4918783/#msg4918783

The files are there Rev. C and D are USB only. I have received no feed back if it works on the RSA815, it woks on my RSA5065-TG

I tried Save-> Quicksave Path -> Set Path   
I pointed it at a USB drive, and Clicked the Print screen in the browser, I checked the drive there was no save file.
I clicked Save -> Save Image -> Save     That made a new screen file in the local screen folder.

I clicked the soft Key in the main menu Quick Save, the system hung for a bit. It worked The file showed up in the USB drive.
 

[Frex]

Hello IRB,

Thank you for your feedback.

As I understand, you don't use an Ethernet link but the USB. Right ?

On my side, on the web control page in browser I'm able to use "print screen" button
of the web interface.
Anyway, I'm not able to take control of analyzer by clicking on screen in web browser.
There is always a message on bottom of screen "RESPONSE:NULL".

Are you able to control the RSA with your mouse in the web browser ?
Regards.

Frex