Hi!
I accidentally bought a vanilla ZVL13 and it turns out R&S isn't selling the ZVL-K1 Spectrum Analyzer (software) option any more

The ZVL really feels like half an instrument without the SA option, so I'm bummed.
I've read through this entire thread (very interesting in general) hoping to find some clues if it'd be possible to unlock ZVL-K1.
In reply #266 someone mentions the FSH20 uses the R&S Orion platform, that it's "WinCE on Flash". I think this might be the case for the ZVL as well after finding some photos (external to this forum) dissecting the HW to fix the PSU. It's definitely some sort of embedded WinNT/CE. Around reply #185 someone was trying to reverse engineer an OptionKeyServices.dll for a ZVB8 and I can confirm this DLL also exist on the ZVL. I got no further dissecting it, just getting stuck in some OLE/COM DLL rabbit hole, where I'm unsure if it's possible to extract useful COM interface/type information somehow or if it's stripped out. Perhaps it can be done by digging out information in the Windows registry? I could not find traces of any "HKEY" string in the .dll binary, e.g. pointing to Windows registry keys (as found on the ZVB8 in reply #185), so it might simply not be the same .dll implementation on the ZVL. Although I did find traces of ZVL options in the Windows registry when searching it directly, I'm not sure it's related to unlocking options, or if it's more of a software architecture thing.
I also found a "R_S/Instr/eeprom/xml/InstrumentData.xml" file. This file clearly lists out all the options installed, with some kind of chronological timestamps and serial numbers, instrument DeviceKey (258 hex numbers / nibbles), OptionKey (30 decimal numbers), option_index, etc. But I'm not sure if this .xml file really affects anything on the system or if it's just some human readable dump from some EEPROM on the motherboard that holds the real options programming?
By chance I have access to a second ZVL13 where the K1 option is installed. This is the ZVL I've been studying so far. I haven't really started to compare it against mine (without the K1 option). I suppose comparing the InstrumentData.xml files might give something.
Anyone here have any further ideas?