Has anybody enabled Tracking Gen on Agilent N9340B? - Page 1
Forum section: electronics / testgear

author: analogRF
author_rank: Super Contributor
timestamp: August 17, 2020, 07:22:31 pm
content: I was wondering if someone have found a way to enable the TG on N9340B or any other options for that matter.There are interesting functions such as OptionCodeGenerate, OptionCodeVerify, GenLicense, readOptionLicense, etc...buried in the firmwarebut I am a total idiot when it comes to firmware dis-assembly and reverse engineering, so I have no idea what is what in there butthere must be a way for those in the know...The processor is Sharp LH7A404 (32bit ARM922T core) and it is based on vxWorks.Actually the serial console is easilyaccessible without even opening the instrument! Just open the battery door! however it is not TTL level (RS232)EDIT: there is a MAX232 chip a few blocks away on the back side of cpu board if you really want to have TTL levels

author: analogRF
author_rank: Super Contributor
timestamp: August 19, 2020, 12:44:24 pm
content: BTW I have downloaded all the files from the internal flash memory. I guess they also could be extracted from the downloadable firmware file as well but with the serial console easily accessible, I just copied the whole thing on a USB stick but I have no way of knowing how the options can beenabled.I am guessing perhaps a method similar to what people did for DSO6000A oscilloscope might be applicable here too but I have no idea how that one came about either...

author: PA0PBZ
author_rank: Super Contributor
timestamp: August 19, 2020, 02:23:48 pm
content: Can you drop the files somewhere?

author: analogRF
author_rank: Super Contributor
timestamp: August 19, 2020, 02:46:40 pm
content: Quote from: PA0PBZ on August 19, 2020, 02:23:48 pmPM sent

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 20, 2020, 06:17:00 am
content: Joining the “project”. Some questions:- is there any official way to install option keys on this device?- how does the serial console look exactly? (having some “anchor” helps identifying the handling code)

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 20, 2020, 10:34:51 am
content: Looks like there is some menu to enter codes. And the funny part: when you enter a code, the firmware doesn't decode it, but tries to generate valid codes for all possible feature+period combinations (18 features * 4 periods), outputting each code via printf("license=%s\n", code) (to that console UART? or some other debug UART?). So it should be possible to enter some random code and get all those valid combinations from the output.

author: analogRF
author_rank: Super Contributor
timestamp: August 20, 2020, 10:49:18 am
content: Quote from: abyrvalg on August 20, 2020, 06:17:00 amthere is a menu under System > More > Options > Add Option. It asks for license keyhere are some pictures with error generated (bottom of screen) after entering a random license.http://www.mediafire.com/file/msijnbnr8chinbk/filethat error message can be found in " sysdata\Errmsg.err " file.here I have attached a sample boot record that I got from one UART port that is close to the battery door.

author: analogRF
author_rank: Super Contributor
timestamp: August 20, 2020, 10:56:25 am
content: Quote from: abyrvalg on August 20, 2020, 10:34:51 amWow! This is a lot of information that you got from thisactually I never tried to look at the UART port while entering a random key for option keys. However, there are two debug ports inthe unit, one that is clearly accessible from the battery door and it has even identified TX/RX/GND pins on the silk screen and has a pin headerand I got the boot console from it. There is another UART port a couple of blocks away on the CPU port hidden under the metal shieldand has no pin header but it has identifier TX/RX on the silk screen. I tried that one too but there was no activity on that port during boot and normal operation. However, I didn't think of looking at it (them) while entering a license key.But why the unit should generate all license code combinations and output them on a UART port? so eventually how does it identify and accept the code? I could see that there is a routine that seems to be generating the correct code within the software but I never understood why.by the way, the instrument determines what option(s) must be enabled with a given license code. I mean you just enter a license key and it will decode what option(s) will be cleared. You DO NOT choose the option name and then enter a code for it

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 20, 2020, 11:16:42 am
content: Since the console is a "true" VxWorks shell, you can try invoking the writeoption() function directly:Code:-> writeoption(1,0)This should enable the TG3 (tracking generator) option permanently (no time limit).Full list of first parameter values:Code:0PA3PreAmplifier1TG3Tracking Generator2SO3Source3DMAASK/FSK Demodulation4AMAAM/FM Demodulation5DFSDiagnostics6KLSDelSystem7IBCIBOC AM and FM8IBFIBOC FM9INMInterference Monitor10XDMXDSL Measurement11BASSimple Mode12PAKSimple Mode PACK13SEMSimple Mode SEM14SPTSimple Mode SpecBase15PWMSimple Mode PowerMeter16MKTSupper License17U01Window LimitSecond parameter is expiration date as "unix epoch time". Set to 0 for "endless".Edit: updated second parameter info.

author: analogRF
author_rank: Super Contributor
timestamp: August 20, 2020, 11:27:16 am
content: OMG!That was so quickBut only a few of these options are official. I have never heard of many of them such as SEM, SPT, PWM, etc...and I dont think they actually work on this unitI know some of them like IBC and IBF require a (very expensive) hardware (the RF board needs to be replaced)but AMA, DMA, TG3, IBF, IBC, PA3 are official options

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 20, 2020, 11:48:12 am
content: MKT looks like a "distributor superlicense" enabling all options in one shot (present in many other instruments).DFS is some diagnostic option, it can be enabled by entering a fixed option code 44448888.

author: analogRF
author_rank: Super Contributor
timestamp: August 20, 2020, 11:52:40 am
content: does the MKT enable only the working/supported options on the unit or just blindly enables everything that the code allows?I mean, sometimes if you enable an option that is not actually supported it can brick the unit (I learned that in a hard way with a lecroy waveproalthough I managed to fix it in that case)

author: analogRF
author_rank: Super Contributor
timestamp: August 20, 2020, 12:56:29 pm
content: by the way, is there any way to remove an option? it can come very handy if you mess with a wrong option

author: 1design
author_rank: Regular Contributor
timestamp: August 20, 2020, 01:46:32 pm
content: I tried the writeoption() function for AMA and DMA. They now show up in the option screen, but even though I used ,3 , the option screen labels them as Expire: 19700101.The functions do not appear in the menu as apparently they expired 50 years agoAny help would be appreciated.

author: analogRF
author_rank: Super Contributor
timestamp: August 20, 2020, 02:22:47 pm
content: Quote from: 1design on August 20, 2020, 01:46:32 pmI havent tried it yet but it seems to me that that second argument alone may not determine the option expiry date. perhaps another argument to that function is needed or it must be set separately. There is a reference to optionPeriodStr in the code that leads to those 4 numbers that abyrvlag listed however there is a reference to "lastLicense" in the code that means "DEFAULT" which I know it means permanent option. But I cannot figure out how that "lastLicense" is linked to the "writeoption" command

author: tv84
author_rank: Super Contributor
timestamp: August 20, 2020, 02:53:38 pm
content: The licenses seem easy to generate.Do you have any example of a working license?

author: analogRF
author_rank: Super Contributor
timestamp: August 20, 2020, 03:05:21 pm
content: Quote from: tv84 on August 20, 2020, 02:53:38 pmno, mine only has PA3 and it shows DEFAULT which means permanent and there is no code. I dont think this unit ever shows the license code on screen. It only shows the option and expiry date

author: analogRF
author_rank: Super Contributor
timestamp: August 20, 2020, 03:07:33 pm
content: there is a writeOptionTime function and a optionPeriodStr in the code that may be useful. I dont know how they are related if at all

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 20, 2020, 04:14:48 pm
content: Looks like I was wrong. Change the second parameter from 3 to 0. Updated the original message.

author: 1design
author_rank: Regular Contributor
timestamp: August 20, 2020, 04:38:37 pm
content: Quote from: abyrvalg on August 20, 2020, 04:14:48 pmI can confirm, that worked like a charm

author: analogRF
author_rank: Super Contributor
timestamp: August 20, 2020, 04:41:14 pm
content: Quote from: abyrvalg on August 20, 2020, 04:14:48 pmgreatI'll try that very soon after lunch

author: tv84
author_rank: Super Contributor
timestamp: August 20, 2020, 06:13:16 pm
content: There are 3 temporary license types: 30 days, 270 days and 730 days.They probably should all showDEFAULTin the license window.A FOREVER license should show anemptyexpiration reference.If anyone wants to try a license, pm his HostID.

author: analogRF
author_rank: Super Contributor
timestamp: August 20, 2020, 06:46:04 pm
content: Quote from: 1design on August 20, 2020, 04:38:37 pmme too

author: 1design
author_rank: Regular Contributor
timestamp: August 20, 2020, 06:46:56 pm
content: I can confirm that using writeoption(x,0) gives a permanent license.Make sure you reboot the unit after enabling the new option.

author: analogRF
author_rank: Super Contributor
timestamp: August 20, 2020, 06:55:24 pm
content: Quote from: 1design on August 20, 2020, 06:46:56 pmyes, that worksbut did you dare to try SO3 option? does it work?

author: tv84
author_rank: Super Contributor
timestamp: August 20, 2020, 06:58:29 pm
content: Agilent N9340B and N9340C license generatorFor all owners of this Agilent HSA, here is a quick vacation gift (created in less than 1 hour between some pool dives).The code is C# but should be totally self-explanatory.Code:private static void calc_license_Agilent_N9340B_C(string hostID, bool is_N9340C){string[] option = { "PA3", "TG3", "SO3", "DMA", "AMA", "DFS", "KLS", "IBC", "IBF","INM", "XDM", "BAS", "PAK", "SEM", "SPT", "PWM", "MKT", "U01" };if (hostID.Length != 8)Console.WriteLine("Error in hostID length!");for (int m = 0; m < option.Length; m++){byte[] hash = MD5.Create().ComputeHash(Encoding.ASCII.GetBytes(hostID + option + (is_N9340C ? "DFE" : "")));Console.Write("{0,-2} {1} ", m, option);for (int i = 0; i < hash.Length; i++){byte c = 0;for (int j = 0; j < 8; j++)c += (byte)(hash ^ hostID);c = (byte)(c % 36 + 48);if (c > 57)c += 7;Console.Write(Convert.ToChar(c));}Console.WriteLine();}}EDIT March 30th, 2023: Added the generation of N9340C family licenses.List of options ishere.

author: 1design
author_rank: Regular Contributor
timestamp: August 20, 2020, 07:53:19 pm
content: Quote from: analogRF on August 20, 2020, 06:55:24 pmI already had the TG3 on mine and added the two remaining official options DMA and AMA. Didn't want to risk it with unofficial options.

author: tv84
author_rank: Super Contributor
timestamp: August 20, 2020, 08:11:15 pm
content: To remove the options:That is achieved by running functions_remoteoptionclearwhich is called by a SCPI command. ATM, don't know the syntax of the command.

author: analogRF
author_rank: Super Contributor
timestamp: August 20, 2020, 08:16:42 pm
content: Quote from: tv84 on August 20, 2020, 08:11:15 pmit would be very handy to have a way of removing options. I saw this function in the code but cannot figure out how/where to call it.

author: tv84
author_rank: Super Contributor
timestamp: August 20, 2020, 08:31:39 pm
content: Try this command:REMOTE:OPTION:CLEAR

author: analogRF
author_rank: Super Contributor
timestamp: August 21, 2020, 03:24:20 am
content: Quote from: tv84 on August 20, 2020, 08:31:39 pmthis didnt work

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 21, 2020, 07:59:34 am
content: Quote from: tv84 on August 20, 2020, 06:58:29 pmSame "mode of operation" here. If you've seen a guy paddling on a SUP board near address 0x8BED0 - that was meInvoking s_remoteoptionclear() without parameters in the shell should clear all options.Btw, there is a full set of SCPI commands under REMOTE:OPTION to query/add/delete options. One idea why "REMOTE:OPTION:CLEAR" didn't worked: the "CLEAR" part is written as "CLEAr" in the binary, maybe it is case sensitive? Does SCPI work at all? Any reply from *IDN? command? (Just in case: these are NOT shell commands, but SCPI).

author: tv84
author_rank: Super Contributor
timestamp: August 21, 2020, 08:43:09 am
content: Quote from: abyrvalg on August 21, 2020, 07:59:34 amThe CLEAr only means that you can use also the CLEA version. But, full uppercase should work as in almost all equipments, as the programs usually convert the full string to uppercase before processing.Have you found a way to extract the SCPI command tree?

author: tv84
author_rank: Super Contributor
timestamp: August 21, 2020, 10:39:18 am
content: HostID is similarly calculated from the last 8 digits of the Digital Module S/N.

author: analogRF
author_rank: Super Contributor
timestamp: August 21, 2020, 10:51:17 am
content: Quote from: abyrvalg on August 21, 2020, 07:59:34 amI'll try this later today but isn't there any way to remove one particular option. perhaps by directly manipulating a memory location in flashby "sysFlashSet"

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 21, 2020, 12:08:04 pm
content: sysFlashSet("111", 4, 0x3202BC+4*option_index) should do the job.I've suggested using a raw address 0xC0001000 instead of "111" earlier (in PM), that's ok too (just need any valid pointer to some data that DOESN'T look like a valid option flag), but IIRC VxWorks shell allows to pass strings for pointer args (it stores them in a temporary buffer and passes correct pointers).You can check the flash contents before writing with a command like: d 0x903202BC,4An active option should have byte0!=FF, byte1!=FF, byte2 = byte0 XOR byte1Note the difference in addresses: 0x90xxxxxx address for "d" command is an absolute address ("d" is not flash-specific), but sysFlashSet() expect an offset from flash base (0x90000000) and adds the base internally.Option-related addresses:Code:0x903202BC: byte activation_flags -  =  ^  means "installed"0x90322000: byte installed_keys - key strings (for display, never checked once installed)0x90322260: uint64 expiration_dates - expiration dates in Unix format

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 21, 2020, 12:45:36 pm
content: Quote from: tv84 on August 21, 2020, 08:43:09 amOne suspicious thing: there is a table of long and short forms at SCPIstr (format is { char long, short }) and there are two separate entries for "CLEAR":long="CLEAR", short="CLE"long="CLEAr", short="CLEA"All other commands have both forms in uppercase. Since the tree (at StateP) is defined as indices into this array, these two entries will have different meanings.

author: tv84
author_rank: Super Contributor
timestamp: August 21, 2020, 01:37:45 pm
content: Quote from: abyrvalg on August 21, 2020, 12:45:36 pmCan you exemplify the indices into the array?

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 21, 2020, 01:54:24 pm
content: The correct cmd is DEBUG:REMOTE:OPTION:CLEARThe tree structure:Code:StateP: array of pointers to arrays of { u8 str_idx, u8, u16 next_state_idx, u16 func_idx }str_idx is an index into SCPIstr array of { char long, short }str_idx==0xFF - last entrynext_state_idx is an index into StateP[]func_idx is an index to FunSP[]"st_main" is the root stateThe parser starts with current_state = 0 (StateP -> st_main), compares the current cmd part with all SCPIstr[StateP[i++].str_idx].long/.short until match, then sets current_state = next_state_idxIf next_state_idx==0 - this is the last token in chain, invoke the function FunSPGoing to code an IDA script to extract a full list

author: tv84
author_rank: Super Contributor
timestamp: August 21, 2020, 02:16:00 pm
content: Quote from: abyrvalg on August 21, 2020, 01:54:24 pmExcellent job! I'll also add to my parser.PS: Did you got off the SUP for this one?PS1: I think:{u8 str_idx, u8,u16 next_state_idx, u16 func_idx }is{u16 str_idx,u16 next_state_idx, u16 func_idx }

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 21, 2020, 03:21:07 pm
content: Done, here is full list with corresponding handler functions:https://pastebin.com/Ue5WtKm8"CMD=" form means "CMD with parameters"

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 21, 2020, 03:23:30 pm
content: Quote from: tv84 on August 21, 2020, 02:16:00 pmNo, they are getting str_idx as a byte. The next byte is just an alignment I guess (never used).Edit: one quirk: if next_state_idx points to current state - this is an "execute w/o parameters" form (used for conflicts like "PREFIX:VALIDEXECCMD", "PREFIX:VALIDEXECCMD:CANHAVESUBCMD")

author: analogRF
author_rank: Super Contributor
timestamp: August 21, 2020, 03:31:25 pm
content: any idea what SYSTEM:OPTION? and DEBUG:REMOTE:OPTION= do?

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 21, 2020, 03:54:43 pm
content: SYSTEM:OPTION? should return a list of all active (not expired) optionsDEBUG:REMOTE:OPTION? should return a list of all possible options with 0/1 flags appended to each one indicating the validityDEBUG:REMOTE:OPTION= should accept an option list in the same format as DEBUG:REMOTE:OPTION?'s output and enable/disable many options in one shot (sounds cool)

author: tv84
author_rank: Super Contributor
timestamp: August 21, 2020, 04:00:40 pm
content: I think DEBUG:REMOTE:OPTION= should accept a license (or list of). Should be the same as entering the lic via the menu.I don't see how it can accept a flag given that to activate you would need a license.Usually the GET commands for options, let you specify the option for which you want to know the status.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 21, 2020, 04:44:35 pm
content: Quote from: tv84 on August 21, 2020, 04:00:40 pmThe key check (MD5, XOR & friends) is performed at installation via menu only. It is NOT checked at each power on (only "byte0^byte1==byte2" check of that array at 0x903202BC).s_remoteoption() handler parses a comma-separated list of shortened 2-letter option codes and single digit flags, then writes all flags to flash with a single call to sysFlashSet(buf, 4*18, 0x3202BC).

author: tv84
author_rank: Super Contributor
timestamp: August 21, 2020, 05:36:05 pm
content: I was talking in logical terms.But, this licensing really defies logic. Once again, well done @abyrvalg.

author: analogRF
author_rank: Super Contributor
timestamp: August 22, 2020, 03:08:01 am
content: I just ran the SYSTEM:OPTION? and DEBUG:REMOTE:OPTION?and here is what I got. Similar to what abyrvalg describedHowever, the list of options from DEBUG:REMOTE:OPTION?does not completely make sense. First they only have two letters followed by a 0/1 indicating which one is supported I guessbut some of the two letter names do not correspond to any option it seems...and some options that we know of, dont seem to be in the list such as INM or AMA...I didnt run the DEBUG:REMOTE:OPTION= because I was not still sure how it must be used/called.can it be used to disable an option, too??

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 22, 2020, 07:45:08 am
content: DEBUG:REMOTE:OPTION (both get and set) uses shortened names:Code:PA3 - PATG3 - TGSO3 - SODMA - PMAMA - DMDFS - DFKLS - DLIBC - IBIBF - IFINM - SPXDM - ADBAS - SMPAK - PKSEM - SESPT - SBPWM - MTMKT - MKU01 - U00/1 digit means "disabled/enabled". So yes, you can disable with this command too. Something like this:DEBUG:REMOTE:OPTION PA1,TG1,SO0,SP0 - should enable PA3, TG3 and disable SO3, INM

author: analogRF
author_rank: Super Contributor
timestamp: August 22, 2020, 10:37:36 am
content: Quote from: abyrvalg on August 22, 2020, 07:45:08 ambut I thought 0/1 only meant which options are supported on the unit and which ones are not allowed.I'll give this a try later today

author: tv84
author_rank: Super Contributor
timestamp: August 22, 2020, 02:35:38 pm
content: Quote from: abyrvalg on August 21, 2020, 03:21:07 pm@abyrvalg,I don't think this list is totally correct. It seems there are many commands which are not valid.My comment is just from an analytical POV and not from commands experimentation and/or code analysis. I think Agilent/KS would never create commands like, for example:STATUS:QUESTIONABLE:EVENT:INTEGRITY:EVENT:UNCALIBRATED:EVENT:NTRANSITION?CALCULATE:MARKER:SET:SET:FCOUNT:STATEAlso, how could 1800+ commands generate only 300+ different functions?I did my parsing, using this rules:0xFF - means end of tree branch0x00 - tree leafcurrent_state_idx == next_state_idx - bypassMy output is attached. I could be missing something (or not) but, definitely, this list seems more like "usual" SCPI commands. Even though, it still generates 808 commands.Edit: I just corrected the current_state_idx == next_state_idx processing because all already included the SET command. New file attached.Edit1: New output in a later msg.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: August 22, 2020, 11:03:08 pm
content: Yes, some commands don't look good definitely. Digged the parser a bit deeper - it is much more complicated than I've thought:- functions specified by func_idx are called for all matching intermediate keywords too (not just for leaves) and they can affect further parsing by setting/clearing some flags (i.e. s_bool, s_unbool), checking for some conditions etc- the current state is checked for some specific values and some parsing actions are taken right in parser loopSo just walking those state arrays is not enough, much more manual work is required (check for each of those intermediate flags-changing funcs in script logic to take some actions, check for special states etc). Doable, but it doesn't look like fun anymore, this is closer to "harvesting a field" than to "hunting" alreadyThe same tree with intermediate functions:https://pastebin.com/xgi3wkcd

author: tv84
author_rank: Super Contributor
timestamp: August 23, 2020, 12:49:08 pm
content: Quote from: abyrvalg on August 22, 2020, 11:03:08 pmI thought you has previously studied that part.I had that question myself from the beginning but decided to close my eyes to that. Nonetheless, the last func is the important one.Quote from: abyrvalg on August 22, 2020, 11:03:08 pmI'll have a look to see if I can add something valid.

author: tv84
author_rank: Super Contributor
timestamp: August 23, 2020, 03:02:19 pm
content: New SCPI command list with lower/upper cases. Includes 322 different commands.I've filtered all the repeated commands.For me, this is the final command list. Fun's over.@abyrvalg, the intermediate "functions" allow for the parsing of what I did manually in this filtering. Not worth the trouble of reversing.

author: analogRF
author_rank: Super Contributor
timestamp: August 24, 2020, 01:03:44 pm
content: confirmed:DEBUG:REMOTE:OPTION:CLEAR workswith DEBUG:REMOTE:OPTION you can enable/disable individual optionsEDIT: DO NOT try undocumented options

author: 1design
author_rank: Regular Contributor
timestamp: August 25, 2020, 04:58:56 pm
content: Quote from: tv84 on August 20, 2020, 06:58:29 pmIs there any way of getting this in Python? I am a HW kind of guy and translating from C# into something I can run locally is sadly above my head..

author: tv84
author_rank: Super Contributor
timestamp: August 25, 2020, 07:35:06 pm
content: Quote from: 1design on August 25, 2020, 04:58:56 pmSorry, I hate python. Maybe someone can do that for you.

author: ytterligare
author_rank: Regular Contributor
timestamp: April 08, 2021, 11:10:58 pm
content: Hello, I resume this topic because I was able, thanks to the hard work of a lot of people here, to "supercharge" my 2nd hand N9340B....( especially with the help of the diving man)Anyhow, I was wondering, among the "dangerous" undocumented options not to be touched, if the following :DFS DiagnosticsSO3 Sourcecould be "less" dangerous to try.The first was described by abyrvalg as "some diagnostic option, it can be enabled by entering a fixed option code 44448888" ( this last sentence is not really clear to me : where should we enter the "option code" ? After enabling the option ?)The second, in my idea, could, I say COULD, enable the option of letting the SA act also as a basic RF Generator, something already seen on other more recent SAsAny thought ?Andrea

author: nexus
author_rank: Regular Contributor
timestamp: July 31, 2021, 06:25:30 pm
content: Hi all,I just picked up a gov. surplus auction n9344c in unknown condition (still on its way in the mail).Very interesting read here; hopefully if this analyzer works I can get some options installed. It doesn't have the TG hardware but the preamp would be great for EMI probing since the analyzer can tune down to 9khz.What I'm gathering is that option enabling can be done in a serial terminal (RS232) right under the batt door. Is pic attached the right connector? Also, does anyone have info on the connector type/pinout and baud/parity for connecting a usb 232 uart?Looking forward to some hacking!

author: Mallocated
author_rank: Newbie
timestamp: July 31, 2021, 10:35:06 pm
content: I bought myself a N9340B, noticed a similar debug connector and then spent months debugging and dumping decompiled code using the VXWorks console and all the wrong type of decompiling tools. Eventually I found that all the correct licence codes were output via the console as a debug message whenever you entered any correct or incorrect licence via the instrument. Too easy. THEN this post popped up and people who knew what they were doing had it cracked within a few days in between dips in the pool!I've now got a N9342C, and unfortunately I don't think the SCPI method in this post works - tried it once. I found a way using the VXWorks console, adding breakpoints and dumping memory locations.To get started, see attached, and this;https://nz.rs-online.com/web/p/wire-to-board-cable-assemblies/1617531/And you'll need this;cidcid123456And you'll hopefully see the attached bootup sequence and login.Baud rate I think was either 19200 or 57600.Baud rate is 115200.

author: nexus
author_rank: Regular Contributor
timestamp: August 01, 2021, 08:44:41 pm
content: Roger. Thank you for this info!Will have an update in the coming weeks once I get the analyzer in hand and have a poke around.

author: nexus
author_rank: Regular Contributor
timestamp: August 04, 2021, 04:08:30 am
content: Good news. My n9344c came in the mail today. It's seen some love in the field but nothing drastic from the outside.I bought a new AC/DC 15 volt adapter straight from Keysight so attached the plug pack to my AC6801 ac supply (for safety when attaching unknown analyzer). Plugged in the N9344C and immediately the plug pack went into protect mode, trying to start up every few seconds but cutting out.So power problem straight away. Measured resistance across barrel jack and under 2 ohms center to shield. Definite problem.So begin teardown to digital motherboard where barrel jack is mounted. Nothing looks burnt, but there is basically a short on DC input.Ok, so whip out the thermal camera and hook up programmable psu to barrel jack. 2 volts, 0.1 amps and keep increasing in 0.1 amp steps. At 0.3 amps, the culprit tantalum cap begins to get warm. Found ya!Took the failed tant off (thank god it didn't explode and ruin the board). Reassembled temporarily and plugged in. Analyzer powers on and sweeps with no errors! Do a firmware update, no problem. It's working with no issues to be seen. Need to test with signal gen but will first clean (a little crusty on the inside too) and replace removed tant. Bought the serial header so we will definitely try to get that preamp option enabled!

author: Mallocated
author_rank: Newbie
timestamp: August 04, 2021, 06:11:22 am
content: Good skills. If you still have the case open, any chance you could post some photos of the GPS module and any identifiers? Wondering if it's Agilent branded or an off-the-shelf product. I've fitted a generic GPS module to my N9342C and got it working with a firmware modification, but the instrument timebase calibration from GPS PPS output is still no go. Thanks.

author: Mallocated
author_rank: Newbie
timestamp: August 04, 2021, 06:49:10 am
content: This might help with troubleshooting the DC input and protection circuit....

author: nexus
author_rank: Regular Contributor
timestamp: August 04, 2021, 03:25:15 pm
content: No problem. Here are some pics. There is only one marking on the board under a sticker, hopefully it can be identified.I know agilent had some good block diagrams for their equipment back in the day. Nice to have an actual schematic too! Is that snip out of a service manual for an N93XX somewhere online?

author: Mallocated
author_rank: Newbie
timestamp: August 06, 2021, 11:54:54 pm
content: I've found photos of another Agilent board with the same MSB-01 and MSS-B labels, so that points to Agilent manufacturing.The module's G253 GPS patch antenna is by Inpaqwww.inpaqgp.comAlso there's the logo next to the sticker that looks like FP or PF of you rotate it 90deg.That's where the trail goes cold for me.Keysight still list the GPS module part for $339https://www.keysight.com/my/partDetail/N9344-65011

author: nexus
author_rank: Regular Contributor
timestamp: August 09, 2021, 09:47:50 pm
content: Replacement tants came in today, so while I was putting those on the main board I also elected to have a look inside the GPS module.Definitely is a little custom agilent board. Looks like the module is mainly a GlobalSat EB-3531 SIRF III with a 50 ohm bidirectional coupler and some matching network and filtering passives. If you have the pinout, might be able to reverse engineer and make one that's plug and play.

author: Mallocated
author_rank: Newbie
timestamp: August 10, 2021, 08:00:00 am
content: When you look at the design and build quality you can see why the module pricetag is $350.I fitted a cheapo Adafruit Ultimate GPS breakout board to mine, which has a Globaltop FGPMMOPA6H module with MediaTek MT3339 GPS Chipset. I had to change the module baud rate to match what the instrument was expecting, which meant reflashing with an altered firmware. If anyone needs the full process I'll start a new post. Quite a long process, it would be heaps easier if there is a compatible SIRF-based module out there.Thanks for disecting your GPS module - for the greater good.

author: milesd969
author_rank: Newbie
timestamp: February 15, 2022, 10:50:36 am
content: I'm new to the forum, I would ask for help I have an agilent n9340b, it can't raise the Agilent logo system on the display and that's it.I will attach a file from the serial console, any help is welcome flash file I would try to write it in my SA, thanks

author: analogRF
author_rank: Super Contributor
timestamp: February 15, 2022, 12:52:08 pm
content: Quote from: milesd969 on February 15, 2022, 10:50:36 amLooks very much like the nand flash device is defective or at least corrupted. But most likely the chip itself is bad. Assuming the power supplies are OK

author: NA5B
author_rank: Contributor
timestamp: February 18, 2022, 05:19:59 am
content: Hello milesd969, I had the same or similar problem with my N9340B. The logo appeared and stayed forever and nothing else.This is what I did to fix the problem:I downloaded Keysight N9340B PC Software and Keysight Connection Expert software first. Found a "Cross Over" LAN cable. Used the device's default 192.168.0.112 IP number. I tried, no success.Later I set my PC IP to 192.168.0.110 that's what the instructions wrote. Connection Expert program registered the SA as UNKNOWN device! I said ok, at least there is something. I verified this by turning on and off the SA. I was able to see this unknown device appear and disappear.Later I tried the Keysight N9340B PC Software program. It had a "LAN connection and firmware update" button. I tried to connect to the SA. Again no response. I restarted the software run as admin. Still the same. I ignored this and I went ahead and chose my latest update file. Clicked the UPDATE button and magically it showed the upload bar, uploading files 1,2, and 3 and it stopped for a long time on 3. I was so happy then I got confused. I started thinking that this was a false upgrade move. BUT then it started counting file 4 and up!!!! :- ) So, some files took longer to load. 280 some files later it wrote: Files uploaded, firmware updated, please restart the SA. This file upload took about 10 minutes forever!I turned the SA off and then on. The Agilent logo stayed a bit longer, then the screen went blank and then showed the actual graphics. Now It works as it should.

author: milesd969
author_rank: Newbie
timestamp: March 17, 2022, 08:13:01 am
content: Problem solved, I bought another analyzer N9340b from the motherboard, I unsoldered a flash S29GL512P10TFIR1. I used the Xeltek Superpro 3000U programmer, I managed to get the contents of the flash file, using the binary image I filled the old flash, when I started the analyzer everything worked.I later unlocked all the options for this analyzer model using an algorithm written by a diving man from this forum

author: WernerFalken
author_rank: Contributor
timestamp: March 30, 2023, 06:09:37 am
content: Bumping this again. Any chance on getting an updated code generator to work on N9342C/N9344C? Works great on the N9340B!

author: tv84
author_rank: Super Contributor
timestamp: March 30, 2023, 06:56:36 pm
content: Quote from: Colby Burkett on March 30, 2023, 06:09:37 amColby, it's your lucky day. I revised the previous code and added the N9340C generation code.Here.

author: tv84
author_rank: Super Contributor
timestamp: March 30, 2023, 09:06:40 pm
content: This is the list of options for N9340C family:Code:P06 - Pre-amplifier, 100kHz to 6GHzTG6 - Tracking Generator, 5MHz to 6GHzDMA - ASK/FSK Modulation AnalysisAMA - AM/FM Modulation AnalysisPWM - U2000 series supportIBO - IBOC AM and FMXDS - xDSL MeasurementSIM - Spectrum monitorCHP - Channel PowerACP - Adjacent Channel Power RatioOBW - Occupied BandwidthSEM - Spectrum Emission MaskFST - Field StrengthF04 - Freq extension to 4.2 GHzF06 - Freq extension to 6 GHzF07 - Freq extension to 7 GHzF13 - Freq extension to 13.6 GHzF20 - Freq extension to 20 GHzLAN - LAN port, TCP/IPRBW - Resolution bandwidth, 10 Hz/3 MHzFSA - Fine resolution step attenuatorGPS - Built-in GPS receiver and antennaTPN - Task planner for test automationTG7 - Tracking Generator, 5 MHz to 7 GHzSEC - Security featuresDST - Temporary License, for demo unitDT1 - Temporary LicenseTG4 - Tracking Generator,5 MHz to 4.2 GHzPA4 - Pre-amplifier, 100 kHz to 4.2 GHzPA7 - Pre-amplifier, 100 kHz to 7 GHzP13 - Pre-amplifier, 13.6 GHzP20 - Pre-amplifier, 20 GHzCAT - Cable and antenna testTMG - Time-gated spectrum analysisBB1 - Baseband inputF7G - Freq extension to 7 GHzPWS - Power suiteDIA - DiagnosticsF24 - Freq extension to 24 GHzOPE - Simplified operator modeSCN - Channel ScannerCAU - Cable and antenna testCA7 - Cable and antenna test, 7GHzCA6 - Cable and antenna test, 6GHzF08 - Freq extension to 8.5 GHzPA8 - Pre-amplifier, 100 kHz to 8.5 GHzPWP - U2020 x-series supportD24 - Temporary License, 24 monthsG01 - General-Purpose Interface BusCAL - CalibrationRM7 - Reflection MeasurementMNT - Spectrum monitorPFR - Precision Frequency ReferenceP07 - Pre-amplifier, 100 kHz to 7 GHzEMC - EMC filter and QPeak DetectorTFE - Tracking Generator frequency extension

author: Vivatspb
author_rank: Newbie
timestamp: April 09, 2023, 06:18:41 pm
content: Hello.Is there any option to explain briefly how to run this code and what program is needed to open the options on my N9342C?Best regards

author: milesd969
author_rank: Newbie
timestamp: April 11, 2023, 06:34:56 am
content: You have to know programming, it is not easy to explain, send the ID number of the analyzer, I will open one option for free

author: mickab
author_rank: Newbie
timestamp: September 11, 2023, 07:15:17 pm
content: Quote from: tv84 on August 20, 2020, 06:58:29 pmHello tv84,Do you know if the script can be adapted for the N9320B ?I have try with "is_N9340C" at "false" and "true" but both results didn't work.I don't understand why you add "DFE" when it is a N9340C.

author: tv84
author_rank: Super Contributor
timestamp: September 15, 2023, 06:44:15 pm
content: Quote from: mickab on September 11, 2023, 07:15:17 pmThat one is similar but a bit more complicated. You won't get there by trial and error.

author: davide10
author_rank: Newbie
timestamp: December 20, 2024, 05:18:41 am
content: Can anyone tell me how to interpret these voltage source readings? Thanks

author: Lydia
author_rank: Contributor
timestamp: February 28, 2025, 11:08:53 am
content: It seems that there's some friends prefer to use Python stuff instead of running C# stuff, although some C# online runner are already available.Anyway, just wrote a Python version which should act the same as our hero TV84's C# code:Maybe no bug? If there's something wrong, plz let me know.Say sorry to my poor English.Code:import hashlibdef calc_license_Agilent_N9340B_C(hostID, is_N9340C):options = ["PA3", "TG3", "SO3", "DMA", "AMA", "DFS", "KLS", "IBC", "IBF","INM", "XDM", "BAS", "PAK", "SEM", "SPT", "PWM", "MKT", "U01"]if len(hostID) != 8:print("Error in hostID length!")for m, option in enumerate(options):# Calculate the MD5 hash of the concatenated stringhash_obj = hashlib.md5((hostID + option + ("DFE" if is_N9340C else "")).encode('ascii'))hash_bytes = hash_obj.digest()# Print the output as per the original C# logicprint(f"{m:<2} {option} ", end="")for i in range(len(hash_bytes)):c = 0for j in range(8):c += hash_bytes ^ ord(hostID)c = c % 256 # Convert this shit to Byte type in Pythonc = c % 36 + 48if c > 57:c += 7print(chr(c), end="")print()# Example usagecalc_license_Agilent_N9340B_C("12345678", False)

author: analogRF
author_rank: Super Contributor
timestamp: April 17, 2025, 04:32:17 pm
content: having the necessary mods for N9320B would be nice

author: JMcC
author_rank: Contributor
timestamp: May 13, 2025, 08:57:00 pm
content: Can anyone confirm please where to get hostID? Someone earlier said it was the last 8 digits of the Digital module serial number. I tried that with the python code above to enable option DMA, but no luck.Thanks,J

author: tv84
author_rank: Super Contributor
timestamp: May 13, 2025, 09:14:45 pm
content: Quote from: JMcC on May 13, 2025, 08:57:00 pmThe HostID is the last 8-char of DIF Module S/N.What's your model?

author: JMcC
author_rank: Contributor
timestamp: May 13, 2025, 09:49:37 pm
content: Its an N9340B. I used the last 8 digits of that module with the python code, called the routine with the parameter is_N9340C set to False. Whereas it generated codes, they were not correct. Maybe there is a bug in the python version.J

author: tv84
author_rank: Super Contributor
timestamp: May 13, 2025, 10:48:12 pm
content: pm me your HostID.

author: JMcC
author_rank: Contributor
timestamp: May 14, 2025, 05:28:44 pm
content: So the python code above works just fine, my problem was that I was using the wrong hostID value. @tv84, I would have responded to you eariler but our PM exchange seems to have disappeared from my account.Thanks,J