Enabling options for R&S test equipment - Page 1
Forum section: electronics / testgear

author: CJay
author_rank: Super Contributor
timestamp: December 07, 2016, 11:05:18 am
content: Does any one know if R&S are amenable to providing 'keys' for software options to hobbyists who own older equipment?I've a CMU200 on which I'd like the K29 AMPS option to be enabled as it'd allow me to rid my tiny bench of some clutter but obviously, as a hobbyist, the cost would be a massive issue so if R&S need me to have a deep wallet it won't be possible.

author: rfbroadband
author_rank: Unknown
timestamp: December 07, 2016, 03:27:36 pm
content: they will most likely not do that. If you are not a regular customer that spends n* 10k or >100k each year....you won't even get a meaningful discount.

author: CJay
author_rank: Super Contributor
timestamp: December 07, 2016, 03:31:41 pm
content: Quote from: rfbroadband on December 07, 2016, 03:27:36 pmAh nuts, still, nothing ventured, nothing gained. I'll email them and ask how much it would cost but it's a 15+ year old piece of kit.I might have to revisit some of my old hobbies.

author: nctnico
author_rank: Super Contributor
timestamp: December 08, 2016, 01:04:46 pm
content: I once asked about the decoding options for an older oscilloscope (RTM1500 series IIRC) but they cost more than the scope so never mind.

author: CJay
author_rank: Super Contributor
timestamp: December 08, 2016, 02:53:42 pm
content: Oh well, shame.*digs out copy of IDA and Sourcer*

author: tmbinc
author_rank: Frequent Contributor
timestamp: December 12, 2016, 11:29:35 pm
content: R+S's response to support for the CRTU-RU was basically "sorry, we don't have that software anymore, you're out of luck". It wasn't that they didn't _want_ to help me (in their words), but that they couldn't. (I'm not sure if that was the complete truth, though.)I wished they could have helped me. Instead, I had to help myself...from Crypto.Cipher import ARC2import structfor l in open("SWOPT.DAT"):if len(l) == 17:a, b = struct.unpack("<II", ARC2.new("Revision\0").decrypt(l.strip().decode("hex")))print "SN: %d - %08x" % (a, b)

author: dcarr
author_rank: Regular Contributor
timestamp: December 12, 2016, 11:34:27 pm
content: Question: Is the actual software for the options included on the base system?(ie: They didn't have to mail you a disk with the new code on it?)

author: eliocor
author_rank: Unknown
timestamp: December 13, 2016, 08:44:53 pm
content: Not sure it can help you, but some time ago I found this (see attachment).Maybe it can be used also for other devices....

author: CJay
author_rank: Super Contributor
timestamp: December 22, 2016, 11:35:49 am
content: OK, so it's Python, it runs after importing pycrypto to my Raspberry Pi, needed a minor tweak I think related to the difference between DOS and Linux EOL/LF handling but the output appears valid.I get output which is my serial number and then an option number I can tie up to installed options, trivial to work out the option number from this code.I think I'm safe to assume I need to encipher 01D000C3 using my serial number as key (or vice versa) to obtain the option key for K29 and this is where I'm stuck as I'm struggling to understand the python code and how it decrypts, let alone how to reverse the process and obtain a valid ciphertext key.What's also worrying me at the moment is that there's no 'installed version' for K29 so I have a sinking dread that K29 software may not actually be on the machine unless it's hidden somewhere in an archive and needs to be installed by Version Manager?Also very curious about the 'FM Stereo' option in there if anyone has any knowledge of it?

author: eb4eqa
author_rank: Regular Contributor
timestamp: December 22, 2016, 12:13:34 pm
content: Hi,No idea about the Stereo option, but I do have K29 in my CMU200. If you need me to check something or get some files, I'll be happy to do it. Always interesting.Regards,Roberto

author: AudioplatinumService
author_rank: Contributor
timestamp: December 22, 2016, 01:05:34 pm
content: Hi guys.. Nice to saw here some progress. I have R&S UPL and I Am also interested in some sw options.@CJay Can you give me more information how do you make setup on RPi?Cheers,DamirSent from my iPad using Tapatalk

author: CJay
author_rank: Super Contributor
timestamp: December 22, 2016, 02:14:25 pm
content: Quote from: AudioplatinumService on December 22, 2016, 01:05:34 pmI only used a Pi to run the Python code provided by TMBInc earlier in this thread because Python is included with the Raspbian image and it's very simple to install the PyCrypto software so I went with the easiest option available to me.It would have been non trivial for me to install Python and PyCrypto on my laptop, though if you're proficient with Python I'm sure it would be very simple to install.The only change I had to make to the code was to changeif len(l) == 17:toif len(l) == 18:because I think the way DOS and Linux terminate lines is different. Or perhaps there's a difference between CMU and CRTU SWOPT.DAT filesI'm really not a programmer so it's going to be a voyage of discovery for me to unpick what is almost definitely a very simple python script and reverse it to make myself a key generator.

author: Jackob
author_rank: Contributor
timestamp: December 22, 2016, 05:53:48 pm
content: CJay - I am curious; how did you figure out that you need to encipher 01D000C3 to obtain the option key for K29?BR, Jackob

author: CJay
author_rank: Super Contributor
timestamp: December 22, 2016, 06:19:44 pm
content: If I've understood the code and its output correctly, the licenses decode to serial number - option code where option code is 0xx0003C and xx is the hex representation of the decimal option number.So, K29 would be 01d0003CI could be way off the mark though.

author: oh2ftu
author_rank: Regular Contributor
timestamp: December 22, 2016, 08:11:29 pm
content: Hi,I have a CMU200 with the K29 option enabled.Below is the contents from swopt.dat:Code:FEEC0364A639F575A2AF0325E648F54D4D8CB38F128844B20A4080E5DDB3F33908678B2806514740D710C80B984FFD238E1182008AE45EB242D23B964CE7C522DE8BC25F5305D1EB6E1701C72B5F92566B53740D41CF8780DBBE31F8EAEB9C22And the options installed areK21-K24, K27-K29, K42, K43, K53, K84, K85. Serial 837109/035From another,Code:917D1CFF38E8F2C1AC15C4AFBA26733AD87CDA77974C9514BE238053BEA30B1675AE27EBF3F52E40DFB718A6C9D8576411B26D02CEE94BEAand options:K21-K24, K42, K43 and K45. Oh, and serial 103086.

author: artag
author_rank: Super Contributor
timestamp: December 22, 2016, 11:28:57 pm
content: So that givesSN: 837109 - 01500023SN: 837109 - 01600023SN: 837109 - 01700023SN: 837109 - 01b00023SN: 837109 - 01c00023SN: 837109 - 01d00023SN: 837109 - 01800023SN: 837109 - 02a00023SN: 837109 - 05400023SN: 837109 - 05500023SN: 837109 - 03500023SN: 837109 - 02b00023andSN: 103086 - 01500002SN: 103086 - 01600002SN: 103086 - 01700002SN: 103086 - 01800002SN: 103086 - 02b00002SN: 103086 - 02a00002SN: 103086 - 02d00002Not having a CMU200, I don't understand what you mean by 'Serial 837109/035' - but the 035 turns up again as 0023. So what does 002 on the second example refer to ?

author: artag
author_rank: Super Contributor
timestamp: December 23, 2016, 12:09:07 am
content: For those, like me, with little experience of python, that fragment can be expressed less tersely as :Code:from Crypto.Cipher import ARC2import structKEY = "Revision\0" # decryption key for the dataSTRUCT_TWO_UNSIGNED_INTS = "<II"for line in open("SWOPT.DAT"):if len(line) == 17:cipher = ARC2.new(KEY) # a new ARC2 cipher with the right key (ARC2 is a symmetric block cipher, we need a new cipher for each ciphertext)ciphertext = line.strip().decode("hex") # Decode our ciphertext from hex, removing whitespace from the start and endplaintext = cipher.decrypt(ciphertext) # Decrypt the cyphertext using the keya, b = struct.unpack(STRUCT_TWO_UNSIGNED_INTS, plaintext) # unpack two unsigned ints from the plaintextprint "SN: %d - %08x" % (a, b)(courtesy of a more knowledgeable person elsewhere)

author: oh2ftu
author_rank: Regular Contributor
timestamp: December 23, 2016, 08:34:13 am
content: In what format should the code be entered? just as 01500023 or must the hexadecimal version?I'm not into crypto so I can only get a basic understanding of what the python does. How would one create new keys if I need them in hexadecimal format?Apparently the decrypt is essential to do first, then crypt them again?

author: CJay
author_rank: Super Contributor
timestamp: December 23, 2016, 10:46:18 am
content: At the moment I'm just trying to write code which will verify what we have, simply entering the results from a known good pair generated from an existing enabled option, encrypting it and testing it against the input for a match. Once that works it'll generate new option keys as well.it'll need to be manually edited to suit the required option but that'll be plenty for my needs, someone else can polish it to take command line options etc.My available time is running out until after the holidays so it'll have to take a place on the back burner for a little while if I can't work it out today.I'd like to complete this myself, good motivation to get a grip on Python but of course, if someone else works it out (and I'm sure it's trivial as it seems 'all' that needs to be done is work out how to get the plaintext into the ARC2 routine) given the information we have) then I will be happy too.

author: artag
author_rank: Super Contributor
timestamp: December 23, 2016, 10:46:31 am
content: The decrypt does give the 0023 or whatever, from your existing licences. I don't see that you'd need to do it for any other reason than proving the process. It would be better to know how to derive the 23 (or 2, or C3 ..) directly, so you don't need an existing licence to make a new one.The encrypt process would be something like :make a record consisting of serial number, option number, suffix (23 etc) in binaryencrypt it using the RC2 cypher and the key 'Revision'convert to asciiadd to the license file

author: CJay
author_rank: Super Contributor
timestamp: December 23, 2016, 11:00:50 am
content: That last byte (or perhaps two bytes) would seem to be the /xxx part of the serial number, mine is 836072/060 and the last byte of what I'm calling the option code is 3C, 060 decimal, the last byte of OH2FTU's matches the /035 of his serial number.The SWOPT.DAT file will probably exist on all machines and have at least one or two licences in it, but even if it's empty it should be possible to create an 'option code' from the full serial number and the desired option.

author: artag
author_rank: Super Contributor
timestamp: December 23, 2016, 11:29:40 am
content: This seems to do the reverse :Code:from Crypto.Cipher import ARC2import structserial = 103086serial2 = 2option = 45record = struct.pack("<II", serial, serial2 + (option <<20))encyphered = ARC2.new("Revision\0").encrypt(record)print encyphered.encode("hex")produces11b26d02cee94beai.e. the last entry in oh2ftu's list

author: CJay
author_rank: Super Contributor
timestamp: December 23, 2016, 11:47:33 am
content: If that's the case I think we have a winner.My CMU is at home and I'm unable to get to it until later but I'll be able to test it later.

author: artag
author_rank: Super Contributor
timestamp: December 23, 2016, 11:48:14 am
content: Check it with some existing options for your machine first

author: CJay
author_rank: Super Contributor
timestamp: December 23, 2016, 11:53:47 am
content: I will, unfortunately I'm unable to install python on this machine but I will run my options through it first and report back.

author: oh2ftu
author_rank: Regular Contributor
timestamp: December 23, 2016, 12:10:33 pm
content: I'm unable to reproduce they keys found for the /035 -serial. Any advice?The newer machine is no longer in my posessionBest regardsI set serial2 as 35 instead of 035 and bang! it works!

author: CJay
author_rank: Super Contributor
timestamp: December 23, 2016, 12:21:02 pm
content: Well that's excitingMany thanks to everyone who's provided information and code, this will definitely be one of my favourite Christmas presents this year.I can't wait to get home and try it on my CMU now.Anyone got any ideas what Option K14 does?

author: artag
author_rank: Super Contributor
timestamp: December 23, 2016, 12:27:30 pm
content: Quote from: oh2ftu on December 23, 2016, 12:10:33 pmLooks as though python (like C) interprets a leading 0 as meaning 'octal'. So 035 is 29 decimal.

author: CJay
author_rank: Super Contributor
timestamp: December 23, 2016, 04:10:43 pm
content: Well, I can confirm it works.Sadly it seems the AMPS software may not be on my CMU. More exploration needed.OF2HTU, when you enabled options what happened?

author: oh2ftu
author_rank: Regular Contributor
timestamp: December 23, 2016, 04:26:32 pm
content: Quote from: CJay on December 23, 2016, 04:10:43 pmHi,The AMPS (K29) should be just easily enabled as anything else. You'll find it under the menu select -button.I sold my other (without) K29 about 12hrs before this thread activated the day before yesterday. Had I known the outcome, I would've sold the one I now have left.All the software is there. A reboot is required.

author: CJay
author_rank: Super Contributor
timestamp: December 23, 2016, 04:29:15 pm
content: even after the reboot I only see a tick and no 'Version' so I don't think it's present but I do have another two disk images I can explore.Did yours have a version number before you enabled it?

author: oh2ftu
author_rank: Regular Contributor
timestamp: December 23, 2016, 04:40:49 pm
content: Quote from: CJay on December 23, 2016, 04:29:15 pmTry to run a system upgrade from the bootup-menu

author: grw1983
author_rank: Newbie
timestamp: December 27, 2016, 03:52:22 pm
content: Hi,maybe this may help:https://bitschubbser.org/nextcloud/index.php/s/6TCghFbYMsbkfph(PW: eevblog)This is the r+s software for CMU200: Base, Bluetooth, AMPS, GSM.Completelyuntested (may even be that these are the wrong files) because I don't have a PCMCIA-card for my unit yet.Regards,grwEDIT: New link to the archive!

author: grw1983
author_rank: Newbie
timestamp: December 28, 2016, 09:56:20 pm
content: Okay,everybody just downloading, nobody replying. So here it goes:I was able to activate the AMPS-module with the "keygen" and by installingthe IS1MV5.20.exe package.Note:The files from the IS1MV5.20.exe need to be in a directory called "IS1MV5.20"for the CMU200 versionmanager to find them. AND you need to install thecorresponding base-package first.Greetings

author: CJay
author_rank: Super Contributor
timestamp: December 29, 2016, 08:00:41 am
content: I'm waiting on a PCMCIA to CF adapter to try installing those packages so I am guilty of downloading and not replying, did you have to 'install' from PCMCIA or were you able to put it on the HDD directly?

author: AudioplatinumService
author_rank: Contributor
timestamp: December 29, 2016, 08:38:22 am
content: Hi guys,I have R+S UPL unit, OS is DOS 6.22 and options numbering is similar like on cmu200. No SWOPT.DAT file in system, but I make some progress with python scripts here. I have some option codes from same unit/different serial number, and one code for option in my unit. Then I make with this scriptCode:from Crypto.Cipher import ARC2import structserial = 103086serial2 = 2option = 45record = struct.pack("<II", serial, serial2 + (option <<20))encyphered = ARC2.new("Revision\0").encrypt(record)print encyphered.encode("hex")entry and I put this in SWOP.DAT file, and run next scriptCode:from Crypto.Cipher import ARC2import structKEY = "Revision\0" # decryption key for the dataSTRUCT_TWO_UNSIGNED_INTS = "<II"for line in open("SWOPT.DAT"):if len(line) == 17:cipher = ARC2.new(KEY) # a new ARC2 cipher with the right key (ARC2 is a symmetric block cipher, we need a new cipher for each ciphertext)ciphertext = line.strip().decode("hex") # Decode our ciphertext from hex, removing whitespace from the start and endplaintext = cipher.decrypt(ciphertext) # Decrypt the cyphertext using the keya, b = struct.unpack(STRUCT_TWO_UNSIGNED_INTS, plaintext) # unpack two unsigned ints from the plaintextprint "SN: %d - %08x" % (a, b)Output from this script is my serial number(serial is correct), but code is not ok for my unit. Maybe somebody know how make script working from valid licence codes? I am stuck here...Unit serial:849260/015option B21: 19559option B22: 42997option B10: 14917option B4 : 15747Cheers,Damir

author: Jackob
author_rank: Contributor
timestamp: December 30, 2016, 08:11:19 am
content: A side note - the keygen in Reply #7 of this thread seems to work for R&S FSU, FSQ, FSP and FSIQ series on spectrum & signal analyzer; (at least).

author: stones
author_rank: Newbie
timestamp: December 30, 2016, 09:26:29 am
content: Quote from: Jackob on December 30, 2016, 08:11:19 amDo you now how to customize the option keys in the option_list[] for FSIQ Options or other devices?

author: Jackob
author_rank: Contributor
timestamp: December 30, 2016, 11:01:30 am
content: Based on how the C-file is written no custoimization of the keys is needed.Just edit in your analyzer serial number into main.c -file to the line stating "char SerString [] = {"xxxxxx/xxx"}; // Seriale dello strumento". When you compile and run the program it will list all keys which may work in your analyzer.You can also experiment by chaning all the "FALSE" statements to "TRUE" in the table of "Acceptable Options" in the beginning of the main.c file and test which ones of all the options work in your analyzer.E.g. running Tiny C Compiler (TCC) in a PC in command prompt window ("TCC -run main.c") should give the list of your option keys.BR, Jackob

author: CJay
author_rank: Super Contributor
timestamp: December 30, 2016, 11:14:40 am
content: Handy info perhaps, enabling 'K14 FM Stereo' allows the RF signal generator on the CMU to generate mono, Left and Right FM stereo signals but it doesn't appear as an 'installed' option with version number, just as 'enabled' and you then have extra modulation options.Handy if you're servicing HiFi etc.

author: nctnico
author_rank: Super Contributor
timestamp: December 30, 2016, 06:16:27 pm
content: Quote from: Jackob on December 30, 2016, 08:11:19 amAny ideas about other equipment like oscilloscopes?

author: grw1983
author_rank: Newbie
timestamp: December 31, 2016, 02:30:05 pm
content: Quote from: CJay on December 29, 2016, 08:00:41 amHi, sorry for the "late" reply. I installed using a PCMCIA-CF-card adapter, directly via PCMCIA.I actually don't know how the access the CMU200-files externally.

author: Brainbox
author_rank: Contributor
timestamp: December 31, 2016, 03:25:05 pm
content: The way I did it was installing Norton Commander on the CF card and boot the CMU in Dos mode.Then its easy to access or copy files to CF.

author: dhillman
author_rank: Contributor
timestamp: December 31, 2016, 07:08:18 pm
content: Quote from: Jackob on December 30, 2016, 08:11:19 amThis strikes me as very interesting. I've been working with the SMIQ's i960 firmware and complicated addressing scheme.Does anyone know the origin of the 'Seed Keys' in main.c?

author: Jackob
author_rank: Contributor
timestamp: December 31, 2016, 07:35:25 pm
content: Sorry - no idea where the keygen with the seed keys come from - except that they were posted by eliocor. Would love to have similar tool for RTO-series of oscilloscopes.BR, Jackob

author: slurry
author_rank: Regular Contributor
timestamp: January 02, 2017, 10:37:14 pm
content: I set them all to "TRUE" and went through all options on my FSEB30, most of them where accepted as valid keys but none of them seemed to work.Looking in the >runtime>ini>options file on the HDD the options revealed nothing useful with the generated keys, it was mostly unintelligble so i wiped almost everything away.I would be happy to try out another set of keys

author: slurry
author_rank: Regular Contributor
timestamp: January 02, 2017, 10:42:38 pm
content: Quote from: Jackob on December 30, 2016, 08:11:19 amAre you sure about the FSIQ you mention, maybe it has newer HW and thus have the same setup of SW options as the FSU, FSQ and FSP..

author: stones
author_rank: Newbie
timestamp: January 03, 2017, 09:03:42 am
content: Works fine with my FSIQThe first 17 Keys are valid.

author: radiorick
author_rank: Newbie
timestamp: January 06, 2017, 06:39:32 pm
content: Hi Everyone, Having some issues trying to enable some of the SW opts, Perhaps I am doing something wrong, One unit SN 835687/054 and the other is SN 114603 (Not seeing the "/xxx"). Anyway I could use a bit of guidance to enable the sw opts I would like to use. Just having some issues figuring out the whole crypto. I tried several RC2 methods but am not getting anywhere. ThanksRR

author: radiorick
author_rank: Newbie
timestamp: January 08, 2017, 06:24:59 pm
content: Cancel last request for Help. Found the issue.RR

author: CJay
author_rank: Super Contributor
timestamp: January 13, 2017, 03:30:57 pm
content: Well, K29 is an excellent addition to my CMU200, now I need a GPIB interface and some way of programming it so I can produce test reportsSeriously though, thanks to everyone who chipped in with help and code here, it's helped a lot of people and made my CMU into an even better instrument than it was before and I'm having a lot more fun with it now.Next mission is to extend it below 10MHz with an external mixer

author: Brainbox
author_rank: Contributor
timestamp: January 13, 2017, 03:53:55 pm
content: Quote from: CJay on January 13, 2017, 03:30:57 pmI am working on the same mission:https://www.eevblog.com/forum/rf-microwave/rs-userservice-manuals-cmu200-and-crtu/msg1024073/#msg1024073My first thought was to lift the input by 10 MHz, which is available at the reference output.After all I am working now at al lift by 100 MHz, which is more convenient with available input filters and offers a wider input span of 100 Hz - 90 MHz.

author: CJay
author_rank: Super Contributor
timestamp: January 13, 2017, 05:50:04 pm
content: This probably needs another thread or at least to be tacked into one of the other existing ones but MSRaya has done it, he used the sig gen on the CMU as a 1GHz LO for an external ADE-1 mixer which worked nicely from what I can tell.I've ordered some ADE1 mixers and have managed to scrounge a PCB from a generous member of a mailing list so once I've received that I might start a new thread with test results.

author: msraya
author_rank: Unknown
timestamp: January 14, 2017, 10:40:26 am
content: Sorry, I'm out working... Very interesting thread...I not have the CMU200 right now in house, but I have the files, and I tested my SWOPT.DAT with the python script in the post #5 in Windows with python(x,y) not problem.. My SWOPT.DAT info match exactly with my serial number in IDENTITY.TXT and options..I have:SN: 10XXXX - 01500002 --> K21 GSM900, R-GSM, and E-GSM mobile station signaling/non-signaling testsoftwareSN: 10XXXX - 01600002 --> K22 GSM1800 (DCS) mobile station signaling/non-signaling test softwareSN: 10XXXX - 01700002 --> K23 GSM1900 (PCS) mobile station signaling/non-signaling test softwareSN: 10XXXX - 01800002 --> K24 GSM850 mobile station signaling/non-signaling test softwareSN: 10XXXX - 02A00002 --> K42 GPRS test software extension for all GSM test software packagesSN: 10XXXX - 02B00002 --> K43 EGPRS classic (EDGE) signaling test software for all GSM test softwarepackagesSN: 10XXXX - 02C00002 --> K44 Dual transfer mode: simultaneous CS and PS connection for all GSM packagesSN: 10XXXX - 02D00002 --> K45 AMR test software extension for all GSM test software packagesI will try next week K29.. Here we go!! ;-)Thank You all!Manuel

author: ernemo
author_rank: Newbie
timestamp: January 15, 2017, 12:51:55 pm
content: Hello, I'm new and a little bit inexperienced. I have bought a CMU200 and I would like to use the option K29. My problem is where do I find the SWOPT.DAT file? How can I read it? If I can download it, can I publish it on the forum so that one of you can give me the key to activate the option K29?Thank you very much.Ernesto

author: CJay
author_rank: Super Contributor
timestamp: January 15, 2017, 05:22:58 pm
content: You don't neeed the SWOPT.DAT file, you just need the serial number of your CMU and a way to edit and run the Python code.

author: ernemo
author_rank: Newbie
timestamp: January 15, 2017, 05:45:08 pm
content: Thanks for your reply. My serial number is 111264. And now what do I do? Do I need to write the keygen of the post #21 in pycrypto? I'm sorry but I don't really know what to do.ThanksErnesto

author: CJay
author_rank: Super Contributor
timestamp: January 16, 2017, 09:51:05 am
content: Your serial number will be something like 111264/xxx, you need this full serial number.You then need to edit the python code so that it reflects your serial number but if the last part of your serial, xxx, starts with a 0 it must be omitted, change 'yy' to the option number you wish to enableIn your case, for option 29serial = 111264serial2 = xxxoption = 29

author: msraya
author_rank: Unknown
timestamp: January 16, 2017, 03:29:36 pm
content: Ernesto, for your information:1. Download and Install python(x,y), use google for download link2. Open program and select in Applications "IPython QT console" and click the green checkmark to run it.3. In the console window that open, cut and paste the following code line by line (press enter after you paste each line), change XX for your second serial number, you can get it from the IDENTITY.TXT file (the soft has option to generate it):from Crypto.Cipher import ARC2import structserial = 111264serial2 = XXoption = 29record = struct.pack("<II", serial, serial2 + (option <<20))encyphered = ARC2.new("Revision\0").encrypt(record)print encyphered.encode("hex").upper()4. Note the resulting code on paper.5. In the CMU200 exit from program to MSDOS(Alt-F4) and go to the location of SWOPT.DAT file, i don't remember, you will need a keyboard.6. Make a backup of file (I always make a backup of entire disk before make modifications).7. Use the MSDOS edit command with the file and put the code at end of file. Save the file.8. Restart the equipment.It's very easy, right?By the way, I think it is possible to enter the code directly in the program as an option of system menu.RegardsManuel

author: W3AXL
author_rank: Regular Contributor
timestamp: January 16, 2017, 08:31:40 pm
content: To bypass editing the file and to enter the code directly, the menu is "Setup" under the System box -> Options -> your desired option -> enter.Then enter your generated code and there you go!To those above enabling K29 - how did you get around the option enabling but the features not appearing? Did it require copying over new files to the internal hard drive?EDITI partly figured it out and I'm trying to get this working. I installed the base as a new version (I can't upgrade from 3.5 for some reason) and added AMPS and Bluetooth as a test. Now it will boot to this new version, get past the loading screen and then exit to a dos terminal saying that it has reached the end of "verm.bat". I'm not too familiar with this unit so I'm at a loss.EDIT 2Looks like it's running out of memory. Apparently 64MB isn't enough for version 5.21 firmware. That's disappointing.

author: msraya
author_rank: Unknown
timestamp: January 17, 2017, 12:04:10 pm
content: Yes, the memory is important...Mine does have 128MB base in a weird configuration...However i upgrade it with a Infineon 128MB PC133 133MHz 144-Pin SODIMM HYS64V16220GDL-7.5-C2 without problem...Mine is a slooooow AMD K6 with INTEL Triton chipset and It has only cache for 64MB of RAM unfortunately. In programm I not noted anything different with 256MB.Manuel

author: CJay
author_rank: Super Contributor
timestamp: January 17, 2017, 01:34:54 pm
content: I wonder if there'd be any advantage to trying an Intel part in there...

author: W3AXL
author_rank: Regular Contributor
timestamp: January 17, 2017, 02:47:44 pm
content: So am I outta luck trying to get AMPS on my CMU? I wonder if somebody's got the firmware files for the 3.5 version of AMPS lying around.Upgrading the CPU could be possible but I imagine it's either an AMD socket or even worse, soldered to the motherboard.Sent from my iPhone using Tapatalk

author: CJay
author_rank: Super Contributor
timestamp: January 17, 2017, 02:51:13 pm
content: Quote from: axel on January 17, 2017, 02:47:44 pmCPU is socketed and it's pin compatible with the Intel chips of the same era, it's using an Intel 430 chipset too I think, can't remember which chips were compatible though and if there's a speed advantage to fitting an Intel, if there is it'll be marginal I think.

author: ernemo
author_rank: Newbie
timestamp: January 17, 2017, 07:30:15 pm
content: Thank you all for your answers. I've finally made it. On the right side of my CMU there are some stickers with the activation code of the different options. On these stickers is always repeated the symbols /02. I have used this /02 as the second serial code and it worked. Now I'm waiting my PMCIA adapter for loading the "AMP" software.Thanks again.Ernesto

author: 2N3055
author_rank: Super Contributor
timestamp: January 17, 2017, 09:57:51 pm
content: AMD K6 was faster than Socket 7 Intels of the time... Fastest K6 was 300MHz.If memory servers me well, upgrade path would be a K6-2+ or K6-3+ if motherboard supports 1.4 - 2.0 volts that the K6-2+ and K6-3+ requires. Original K6 was 3.3V part... Those processors support higher speeds and include L2 cache (128K and 256K)...

author: W3AXL
author_rank: Regular Contributor
timestamp: January 18, 2017, 06:55:11 pm
content: How hard/possible is ram replacement in these units? I haven't done too much digging other than getting the hard drive out because I still have a tentativeness to messing with expensive test gear.I'd love to know what hardware configurations the people who are running the 5.21 FW and AMPS have. It seems like the person before me also tried to upgrade the firmware without success, as there are several versions of 5.21 installed and none of them boot properly.

author: CJay
author_rank: Super Contributor
timestamp: January 18, 2017, 07:46:48 pm
content: Well mine's the FMR5 processor module, AMD K6-2/300 CPU and 256MB memory.So, it seems any processor upgrades would be minor unless the FMR5 supports various multipliers and 100MHz FSB, in that case it may be possible to go as far as 550MHz but I'm not sure how much, if any, benefit it would give me.Memory is on a single SODIMM, it may be possible to fit more as there are two slots but I don't think it'd support it.

author: W3AXL
author_rank: Regular Contributor
timestamp: January 18, 2017, 08:03:24 pm
content: I've only got 64MB and as I said above I can't even get the newest firmware to run because of that. I've got the K6-300 so I'd imagine I can at least bump it up to 256 since you seem to have that working just fine.

author: 2N3055
author_rank: Super Contributor
timestamp: January 18, 2017, 09:54:09 pm
content: Quote from: CJay on January 18, 2017, 07:46:48 pmThe K6-2+ has additional L2 cache... I'm sure it would give visible speedup even without faster FSB and on the same clock... also on those you can set multiplier to X2 and get X6 , so 366 MHz on 66MHz bus..If you can get your hands on it, worth a try...

author: msraya
author_rank: Unknown
timestamp: January 19, 2017, 01:14:18 pm
content: Unfortunately I have not been able to make it work.When I install the base package v5.20 and the other packages with the VERM installation utility everything is successful. After the installation of the update, the firmware update of FPGA and other boards occurs. Once done, the new version starts and everything works correctly.However, upon reboot, the hard drive ends corrupted and the files have random content, so it doesn't boot. I do not know if this is a motherboard problem or a problem with the upgrade process. I have tested it with two different hard disks and it does the same. I think others have same problem.I also have v5.22 base and gsm and it does exactly the same. So it doesn't work so far..EDIT: I manage to get an image of a CMU200 with base v5.20 installed that an eevblog user send me long time ago. I put the image in my CMU and start it, it show no valid licenses but it works, I put AMPS license. Then I reboot with the PCMCIA on the unit wit the AMPS firmware and It run VERM, it installed the AMPS via upgrade, update FPGA and then it worked after power recycle..So, I have a working unit with AMPS, I put all the others licenses I have in the new software and it worked... I think the process of base installation is not operational, perhaps due to a VERM upgrade installation error that overwrites hard disk.I try to adjust a FM transceiver and it worked well, but I cannot compare with my willtek 4032 as I not have both analyzers in the same lab.. However, I found the interface somewhat confused, but it will work with FM and SSB SINAD RX adjustments. Also TX and RX graphical base band frequency response, TX noise, TX deviation and carrier frequency. But I need two tone in the RF modulator to test FM RX as i need also ctcss tone. I found a signaling generator, but not ctcss... I will continue looking for dual tone..By the way, I found the last original software right on the r&s server:http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR001Z?OpenDocumenthttp://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR003Z?OpenDocumenthttp://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR004Z?OpenDocumenthttp://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR006Z?OpenDocumentEDIT:I found this:https://cdn.rohde-schwarz.com/pws/dl_downloads/dl_application/application_notes/1cm53/1CM53_0e.pdfIt can be used as AMPS software manual...And now I understand how signaling works, and I thinks It is possible to modulate RF with external signal, and two or three tones also... I will try tomorrow..Manuel

author: grw1983
author_rank: Newbie
timestamp: January 20, 2017, 03:57:55 pm
content: By the way, I found the last original software right on the r&s server:http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR001Z?OpenDocumenthttp://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR003Z?OpenDocumenthttp://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR004Z?OpenDocumenthttp://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/SR006Z?OpenDocumentSadly no WCDMA-package

author: Brainbox
author_rank: Contributor
timestamp: January 21, 2017, 08:52:32 am
content: Great work msraya for finding out all those features.How did You get access tot this R&S server?Perhaps I can dig for some other useful info.

author: msraya
author_rank: Unknown
timestamp: January 21, 2017, 09:47:22 am
content: QuoteI only used the Google Search Engine and Common SenseUnfortunately I do not found more information.The equipment is old and R&S want you to buy the new equipment that substitutes it.QuoteFor WCDMA, bear in mind that you also need an additional hardware board option.I think that, there are three types of communications analyzers:1.-Old Semi-Analog, to use with Analog Communications: Example Willtek Stabilock, R&S CMT and CMS, Marconi 29552.-Digital ones with IQ Modulation, with Custom protocol communications, to use with digital modulation as GMS: Example R&S CMU200, HP 89603.-Digital Modern for use with All Type communications, providing IQ Arbitrary Waveform modulator, Constellation Analyzer, Software modifiable, Ex: Agilent EXA signal analyzer, ..I have a type 1 to play with, a type 2, then now I need a type 3.. HI HI... So I need to win lottery..Manuel

author: msraya
author_rank: Unknown
timestamp: January 25, 2017, 07:22:55 pm
content: Hello!!I have all working right now, except Bluetooth... I installed Bluetooth, but it doesn't worked.. In don't know whyPerhaps I need some hardware option?I'm very happy with the addition, but It not work with external modulation... I tried with the connect control option, external AUX1 and external ref and nothing occurs... I don't know if it is some hardware problem or user not selecting appropriate option...The signaling tones are 3KHz fixed and there are filters too and it is not useful for ctcss... I don't have ctcss nor possibility of have it via external modulation... :-( In my 4032, I have only one audio source, but I can combine it with external audio generator to test ctcss equipment... no problem... but Here no possibilityI also installed some word and adobe acrobat via wifi, also Mozilla. Dual Boot with Windows 2000.If someone want the HD image, please drop a PM to me and I share it, the HD image is very heavy...Manuel

author: Brainbox
author_rank: Contributor
timestamp: January 25, 2017, 09:19:59 pm
content: QuoteDo You have the B53 Hardware option installed?

author: msraya
author_rank: Unknown
timestamp: January 25, 2017, 09:41:31 pm
content: Thank You for answer my question..Not, I only have B11, B17, B21, B41 and B95B53 is Bluetooth® extension; CMU-B21 necessary... But It only appears in options brochure as good to have, but not as compulsory or mandatory..Can be an error and was it necessary?Manuel

author: Brainbox
author_rank: Contributor
timestamp: January 26, 2017, 07:08:08 am
content: The B53 have to be factory installed, else according to R&S:"For users who already own a CMU200 radio test set, the CMU-U53 upgrade kit is available to addBluetooth testing functionality. This option is a particularly cost-effective upgrade path offering maximum-throughputtesting for the existing very large base of CMU200 users. "

author: msraya
author_rank: Unknown
timestamp: January 26, 2017, 11:42:50 am
content: Ok, Thank You!I get ithttps://cdn.rohde-schwarz.com/pws/dl_downloads/dl_application/application_notes/1ma46/1MA46_0E_transmitter_and_receiver_meas_Bluetooth_mod.pdfI don't need bluetooth right now.. so... no problem...Manuel

author: bobaru
author_rank: Contributor
timestamp: January 28, 2017, 09:50:18 pm
content: Hi,Just picked up a nice CMU200 off the usual auction site. It has the Celeron Mobile 650 processor with 256MB as well as B17, B21, B41, B52, B54, B56, B68, B83, B85 and B96 hardware options. It is nicely optioned, but I am trying to add some software options, mainly the FM Stereo modulation option.My first problem is finding the second serial number. I have exited to dos and found the SWOPT.dat file, but I am unable to find a file with the second half of the serial number. There are no stickers with the number on the machine. Does anyone know specifically where in the file system to look? I believe someone mentioned an Info??? I perused all of the directories and sub directories, but didn't see anything like that. From what I have read here I should be able to verify the complete serial number using the valid code keys from the SWOPT.dat file in reverse. Is this correct?My second problem is that I am python illiterate. From what I can gather there seems to be two ways of generating the code keys. The first using the keygen file that was listed in Reply#7. The second by downloading and running pycrypto. Is this correct?I have access to many computers and operating systems including a Rasp Pi. My main pc is a Windows 10 machine that I have Python 3.4 installed on. I have tried to use both options listed above, but as I have gotten older, my patience level is not what it used to be.If anyone can lead me in the right direction I would appreciate it. I can provide my serial number #1 and the list from SWOPT.dat if that would be easier.TIA,-bob

author: msraya
author_rank: Unknown
timestamp: January 30, 2017, 05:56:40 am
content: Bob:You can always generate the IDENTITY.DAT file from the setup or maintenance menu, I can't remember. Inside the file you can find the full serial number and the options of the equipment. My old IDENTITY.DAT file is:/***************************************************************//***************************************************************//************************* CMU IDENTITY ************************//***************************************************************//***************************************************************/GENERAL INFORMATIONSerial number: XXXXXX/XXXCPU and memory:CPU (FMR) FMR5Memory 128 MBBSW/FSW V5.10Statistics data:Firmware versions:RXTX_1 CP-SW 08.50, 2006-05-02....And the file continues with much more...Here is the actual procedure to create the identity.dat file:1. Once the unit has completed booting, press ‘MENU SELECT’2. Select ‘BASE FUNCTIONS’ -> ‘BASE’.3. Press the button beside ‘SELECT’4. Scroll down to the second selection ‘SYSTEM IDENTITY’ and press ENTER5. Press the button beside ‘Test’ and then press ‘ON’The unit will then write the file to your memory card under the name of Identity.datIf you are not using a PCMCIA card then follow the same steps as above and the file identlty.dat is written in the internal disk of the CMU.C:\internal\log\identlty.dat.You can attach a PS2 or USB keyboard and press Alt-F4 to exit to MS-DOS, then go to the c:\INTERNAL\LOG\ and use the MS-DOS command "edit identity.dat" to edit the file and take note of the serial number.The SWOPT.DAT file is plain text and you can find it in c:\CMU\DATA folder. You can save the keys for your licenses.In message #59 I explain as you can generate the keys with python(x,y) by cut and paste the lines of python code, it is easy.Manuel

author: bobaru
author_rank: Contributor
timestamp: January 30, 2017, 02:34:43 pm
content: THANK YOU Manuel! Somtimes I just need things spelled out in order to get me started.I followed your instructions and was able find the second serial number (mine was 002), downloaded the python x,y program and pasted your instructions in. I deleted the leading zeros from the second serial number and just used 2. The last instruction generated the hex code and I used that and entered it in the options section. This prompted me to reboot and when I did it added the FM Stereo modulation option to the unit. WOO HOO!I will now take some time to review the other options to see if I want to add any more.On a side note, my unit didn't come with an optional OCXO. Anyone know of a source for these? I don't really want to purchase another CMU200 just to get the B11 or B12 option.-bob

author: msraya
author_rank: Unknown
timestamp: January 30, 2017, 07:21:03 pm
content: Bob:I think that to search for a B11 or B12 board don't worth it.. as you can get a Rubidium standard from ebay quite cheap (100$ aprox)..I do it and It is very useful. I get a EFRATOM LPRO-101 that I use and It have senoidal output with very low phase noise:http://www.ka7oei.com/10meg_rubidium1.htmlAlso you can get a 10MHz amplifier and supply all the equipment in your lab with the frequency standard..Manuel

author: Brainbox
author_rank: Contributor
timestamp: January 30, 2017, 09:49:28 pm
content: I think MSRAYA is right, You better buy an external clock generator which You can use for all Your equipment.Me myself us a GPSDO with a accuracy of 10e-14http://www.ebay.com/itm/Trimble-65256-57963-B-GPS-precision-clock-thermostat-board-10MHz-oscillator-/162166562432?hash=item25c1e15e80:g:qusAAOSwU-pXrTIfAdd a GPS antenna and a 6 V power supply ans You have all You need.

author: bobaru
author_rank: Contributor
timestamp: January 31, 2017, 01:17:27 pm
content: That sounds like a plan. I will research adding a Rubidium standard to the bench. I have other devices that could take advantage of it as well.Thanks,-bob

author: senseless
author_rank: Contributor
timestamp: February 05, 2017, 12:47:40 pm
content: Thank you all for your successful investigations. I was able to enable some software options easily. But for some applications, my system is crashing. The basic RF stuff is working just fine, but 3G stuff for example is not starting. Has somebody encountered the same problem in the past? And was able to fix it?

author: bobaru
author_rank: Contributor
timestamp: February 05, 2017, 06:00:13 pm
content: It could be the hard drive failing. It is one of the achilles heels of this unit. Once you enabled the option it needed to load the file into memory and it is having an issue when it gets to the bad line. Are you able to copy the file from the hard drive to a floppy disk or pcmcia card (whichever your unit has)? When I get a chance I will see if that file is on my unit. Also, how much memory does your unit have? Perhaps loading the file is causing an out of memory condition.-bob

author: senseless
author_rank: Contributor
timestamp: February 05, 2017, 08:26:43 pm
content: Quote from: bobaru on February 05, 2017, 06:00:13 pmUnfortunately, I do not have a pcmcia card yet, but it is probably a good idea to have one in general.. Nevertheless, I will test if any of my other units has the behavior after unlocking.My unit has the FMR6 processor with 256MB RAM. I guess that should be no problem.

author: oh2ftu
author_rank: Regular Contributor
timestamp: February 18, 2017, 02:26:17 pm
content: Has someone been able to hack the amps software to allow for other than 30kHz stepping? 12,5kHz would be nice, or why not 5kHz?

author: Velund
author_rank: Regular Contributor
timestamp: February 23, 2017, 02:16:43 am
content: Quote from: grw1983 on January 20, 2017, 03:57:55 pmAll packages and all software manuals is there. I noted this in some other CRTU-related thread.WCDMA s/w and release notes:http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr007z2?OpenDocumentWCDMA manual:http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr007m2?OpenDocument

author: Fohdeesha
author_rank: Regular Contributor
timestamp: March 10, 2017, 07:25:07 am
content: Just wanted to give this a little bump and say thanks to everyone in here for all the work figuring this out. Just won 2 CRTU-RU's in an auction and am excited to dick around. I'll be imaging the drives they come with right away just in case, and probably replacing them with some slightly newer IDE drives I have laying around to skip that issue altogether.I'm pretty sure one of them has the B7 IQ/IF option, I remember reading that's somewhat desirable?Also, I take it I won't be able to use this unit for GSM? The few pics they sent me show a whole lot of missing hardware options for GSM, I'm guessing those can't magically be licensed? I do know it was used in a WCDMA lab so I'd imagine it does have that hardware, perhaps someone here could use that? -EDIT: Just Kidding! Dovebid decided to cancel all winning bids in this particular lot because uh...reasons?

author: Pieh0
author_rank: Contributor
timestamp: March 24, 2017, 08:55:38 pm
content: Quote from: Velund on February 23, 2017, 02:16:43 am"This page is only available until 31/12/2017"Download these and put them somewhere safe!

author: tech255
author_rank: Contributor
timestamp: April 24, 2017, 06:14:31 pm
content: Thanks to all that have contributed to this subject, it has taken me a while to figure out how to load and run python as i am not a programmer.So my cmu200 is the 1100.008.30 model which i gather is mainly for calibrating phones on a production line it comes with the base system which seems to include ssb dsb am fm and stereo modulation.I have tried to unlock some of the options that are available k56 and k64 both wcdma extras i have used the python code isted to generate the option unlock codes.Serial no 100344Serial no 30Opt 56Returns 98a3997dc1d76c93I went into the options update section and entered to code it accepted it and asked me to reboot i did all this but the option does not appear.I am wondering i do have a swopt.dat file but it is listed with 0 bytes its an empty file should there not be keys in there already from the stuff thats already setup.

author: smgvbest
author_rank: Unknown
timestamp: May 06, 2017, 01:48:56 am
content: Has anyone looked at enabling options for the SMIQ Vector Signal Generators?Would love to try to get a few options turned on

author: RF_fanatic
author_rank: Regular Contributor
timestamp: May 15, 2017, 05:17:17 pm
content: Quote from: Velund on February 23, 2017, 02:16:43 amIn order to be complete :The CDMA 2000 MS 5.20 package is here :http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr009z2?OpenDocumentDoes anybody has the install file for the 1xEV-DO 5.20 ?

author: Velund
author_rank: Regular Contributor
timestamp: May 15, 2017, 07:24:49 pm
content: Quote from: RF_fanatic on May 15, 2017, 05:17:17 pmhttp://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr015m?OpenDocument- manualhttp://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/sr015Z?OpenDocument- installBTW -http://www3.rohde-schwarz.com/www/FileTranCS.nsf/alias/DATS?OpenDocument- It is PC part of CMU-K92 option, GPRS application testing package. Manual is also there.

author: Muxr
author_rank: Super Contributor
timestamp: May 15, 2017, 11:45:39 pm
content: I've tried the encode script on my RTM 1054 Oscilloscope without luck. My scope doesn't have a /xxx serial, it only has one number. Also unless I am missing something only software options possible are K1, K2 and K3. But since the input is an integer, I can only enter 1, 2 or 3. So I tried those without luck. I get the error (-02) when trying to activate the produced code.I don't think this will work with oscilloscopes.I also have a SMIQ RF generator I will try this on this weekend.

author: nctnico
author_rank: Super Contributor
timestamp: May 16, 2017, 12:00:06 am
content: Maybe the scripts needs more tweaking. I can't imagine R&S uses totally different schemes for different equipment. This would upset their entire logistics dealing with option keys.

author: Muxr
author_rank: Super Contributor
timestamp: May 16, 2017, 12:04:48 am
content: Aye, that's true.. will look into it further.

author: ve7xen
author_rank: Super Contributor
timestamp: June 03, 2017, 05:50:11 am
content: Received a CMU200 today in pretty good nick, but not many options, I do have the audio measuring stuff though. It's kind of annoying that the RF generator turns off when you switch to the audio measurement application. What were they thinking??I tweaked the keygen a bit to hopefully make it easier to use, it prompts for your S/N and generates all (I think) available keys. You can also run it directly from a browser on repl.it. Just click here:https://repl.it/I4Pp/0Or find it on the repository below.I created a repository on my website as well to host documents, firmware, etc. for the CMU200. I've placed some useful files there. If you think there is anything else that belongs, please PM me and I'd be happy to host it.http://gotroot.ca/cmu200/Thanks for the efforts of those in the thread!

author: Skippossauro
author_rank: Newbie
timestamp: June 05, 2017, 05:19:34 pm
content: Hi,Today checked installed keys on newer equipment's with Win7 and Win10 installed, and keys are in pure decimal, and have 30 digits long, I've checked FSV, RTO and RTM R&S parts. To generate keys with double length, i.e. 16 byte long I believe other method should be used, right?Regards,SkippyQuote from: ve7xen on June 03, 2017, 05:50:11 am

author: Astrodev
author_rank: Regular Contributor
timestamp: July 14, 2017, 10:18:02 pm
content: Just got round to trying the interactive version of the generator and it worked when I enabled the K54 Bluetooth Audio Profiles and it worked exactly as expected.However in getting the DAT files off the instruments I noticed something that on a couple of different instruments the Hex identifier was the same as the last 2 digits of the R&S numeric model number printed on the front panel, is this just a coincidence or is this where it originates to identify different versions of an instrument.

author: fisafisa
author_rank: Regular Contributor
timestamp: August 20, 2017, 10:17:57 pm
content: HiAnybody tried adding software options to a CRTU unit?I was able to install the various packages but I do not have the option to enabling them with the code.The only sw options I can enable are K2,K5,K6,K9Code generation works otherwise.F

author: ps
author_rank: Regular Contributor
timestamp: August 21, 2017, 06:04:39 pm
content: Quote from: fisafisa on August 20, 2017, 10:17:57 pmYou have Option B5/B6 installed? This is required for stand-alone GSM, K20 - K26.WCDMA does not run on the CRTU-RU (what you probably have), but on the CRTU-PU. This is a separate Protocol Unit with a PC and a couple of DSP boards that connects to the CRTU-RU via the B7 I/Q interface. Usually you have either a stand-alone GSM system (with B5/B6) or an expanded system with B7 and CRTU-PU box.

author: fl30216
author_rank: Newbie
timestamp: September 01, 2017, 09:51:29 pm
content: Hi,I would like go back to the topic: Enabling options for R&S test equipment.I have the same problem like AudioplatinumService in re #35 with an R&S UPL Audio Analyzer. I would like to enable the UPL-B6 Option for advanced analyzing.Unfortunatelly I can't find out the key methode, but it seems others then for the CMU200.Maybe someone has more experience as I and can help.The key code are 5 numbers in the rage from 00000 until 65535.The required inputs are the same like for CMU200:1.) SNumber: new 100404 or old 8492602.) SNumber2 new 1078.2008Kxx (xx = 06 or 16 or 66) or the second part of the old Serial Number xxx3.) Option Number e.g. Option UPL-B4 = "2", UPL-B10 = "3", UPL-B6 = "4"Sample key codes that I have:SN SN2 B4 (0) B21 (1) B22 (2) B10 (3) B6 (4) B8 (6) B9 (8) U81 (9)100404 06 43505 44597 37262 38524100882 06 51667 52759100918 06 35281 65062 36373100103 16 46338 45766 36221 36071 35471 65007100254 16 18966 17822 15080 13580 28134100261 16 38152 37580 43653849260 015 15747 19559 42997 14917833494 002 33711 33899 48080 47690829567 001 10410 10018 11306826546 007 51993 52445 62310

author: fisafisa
author_rank: Regular Contributor
timestamp: September 02, 2017, 10:31:38 pm
content: HII have got two CRTUsone has :rxtx1 V7.20 17.01.03rxtx2 V7.20 17.01.03PMGR_RX_DSP_1PMGR_TX_DSP_1PMGR_RX_DSP_2PMGR_TX_DSP_2CMU-B17CMU-B272nd RF ChannelDIGADC 1DDC 1AUC 1ADC 2DDC 2AUC 2OCXO 2NETCLK 1NETCLK 2REF_EEPRXTX2_EEPDIG_EEPAUC1_EEPAUC2_EEPADC1_EEPADC2_EEPIQIF_EEPCMU-B11/B12 B12HarddiskPCMCIACPU Intel Pentium IIICRTU-B1/B2 B2CRTU-B5 +CRTU-B5-1_V04CRTU-B5-2_V04CRTU-B56-1CRTU-B56-2CRTU-B6CRTU-B7FE (1100.3120.02)CMUDrvCMUK2K5K20 not enabledK21 not enabledK22 not enabledK23 not enabledK24 not enabledAudioRFGSM 400 MSGSM 850 MSGSM 900 MSGSM 1800 MSGSM 1900 MSThe other hasrxtx1 V7.20 17.01.03rxtx2 V7.20 17.01.03PMGR_RX_DSP_1PMGR_TX_DSP_1PMGR_RX_DSP_2PMGR_TX_DSP_22nd RF ChannelDIGADC 1DDC 1AUC 1ADC 2DDC 2AUC 2OCXO 2NETCLK 1NETCLK 2REF_EEPRXTX1_EEPDIG_EEPAUC1_EEPAUC2_EEPADC1_EEPADC2_EEPCMU-B11/B12 B12HarddiskPCMCIACPU Intel Pentium IIICRTU-B1/B2 B2CRTU-B5CRTU-B5-1_V04CRTU-B5-2_V04CRTU-B56-2CRTU-B6FE (1100.3120.02)CMUDrvCMUK2K20 not enabledK21 not enabledK22 not enabledK23 not enabledK24 not enabledAudioRFGSM 400 MSGSM 850 MSGSM 900 MSGSM 1800 MSGSM 1900 MSI guess I should be able to enable options K20-K24 in both?Thanks

author: fl30216
author_rank: Newbie
timestamp: September 03, 2017, 08:53:59 am
content: What is your type number? Normally the RU's have 82 or 83. That is your SN2 for the key generator.BR

author: MaartenH
author_rank: Newbie
timestamp: September 07, 2017, 07:33:55 pm
content: Back to installing the AMPS option:I downloaded IS1MV5.20.exe and put this on the PCMCIA drive.In the DOS mode I tried to execute this file but the answer was "This program cannot be run in DOS mode" How to execute it ?

author: Velund
author_rank: Regular Contributor
timestamp: September 07, 2017, 07:41:14 pm
content: If memory serves me correctly, it is self-extracting archive, need to be extracted to the root of PCMCIA drive. Then put this drive in turned off CMU, start and enter Version Manager and choose s/w installation.

author: MaartenH
author_rank: Newbie
timestamp: September 07, 2017, 08:32:35 pm
content: But the R&S site says:" Download the file IS1MV5.20.exe on your PCMCIA-Memory card and execute it.It will create the installation folder "IS1MV5.20" with the necessary files for the software update.After this you can delete the file IS1MV5.20.exe"

author: Velund
author_rank: Regular Contributor
timestamp: September 07, 2017, 08:50:18 pm
content: It is self-extracting archive. Once you execute it from root of PCMCIA (in Windows) - it unpack yourself to a folder on the same drive.

author: MaartenH
author_rank: Newbie
timestamp: September 07, 2017, 09:01:18 pm
content: Clear, but how do I start Windows ?When I start normally I come direct in the CMU application, from there I can go with (ALT-F4) to DOS, but how to start only Windows ?

author: Velund
author_rank: Regular Contributor
timestamp: September 07, 2017, 09:14:05 pm
content: I used my old laptop PC with Windows 98 to make installation card.You can try to unpack on PC and move resulting folder to card

author: fisafisa
author_rank: Regular Contributor
timestamp: September 07, 2017, 09:57:26 pm
content: replying to fl30216subtype is 082

author: eliocor
author_rank: Unknown
timestamp: September 07, 2017, 10:11:06 pm
content: QuoteA friend of mine owns a SMJ100A unit (discontinued) and I discovered the options key is composed of 15 couples of numbers (no alphabetic chars), so the generator proposed in this discussion is useless.Any hope to find a compatible generator?

author: MaartenH
author_rank: Newbie
timestamp: September 08, 2017, 12:25:29 pm
content: @ Velund THANKS !

author: fl30216
author_rank: Newbie
timestamp: September 10, 2017, 03:02:47 pm
content: @fisafisaIt looks like, that it is not possible to enable the K2x (signaling) options in a CRTU-RU device. For enabling any options it must to see in the SETUP --> OPTION menue. If not you can't enable.Maybe it is depend on the HW option. The CMU200 and the CRTU-RU have different HW (B5 vs. B21) and different FW (5.2x vs. 3.23) in it. You know, the CRTU-RU is not a stand alone device, it comes always together with a CRTU-PU (protocol unit). You can see it on your serial number ("part of ...).What you want is using the signaling options of an CMU200, but the signaling options for a CRTU-W (this is the real name of the device combination) is generated in the PU (protocol unit), the RU is controlled be remote.You can only using the non-signaling and the maintenance possibilities in the RU if its stand alone.BR

author: tmbinc
author_rank: Frequent Contributor
timestamp: September 11, 2017, 09:17:32 pm
content: CRTU-RUs are only paired with CRTU-PUs for WCDMA application. For GSM, the CRTU-RU is stand-alone.The CRTU-RUs paired with PUs have the IQ option (B7 if i remember correctly?), but they don't have the CRTU-RU's GSM signalling options. The CRTU-RUs from stand-alone configurations (CRTU-G) usually don't have the IQ option (unless they were used with an external fading simulator, or interfacing to a phone baseband directly), but did contain the GSM signalling boards.Now, the CRTU signalling options are detected by the CMU software, but - as far as I know - cannot be used for GSM signalling mode. The CMU software seem to be able to load the FPGAs for these, but it doesn't "unlock" the signalling test options due to missing hardware. (I once patched the executables to show the menu, but access to it crashes; it's definitively not a software licensing/option issue.)

author: fisafisa
author_rank: Regular Contributor
timestamp: September 11, 2017, 10:17:47 pm
content: If tmbinc is correct, then there is a hardware configuration with a GSM signalling card.Do you know what card would that be?Is that a module that slots inside one of the cards?

author: tmbinc
author_rank: Frequent Contributor
timestamp: September 12, 2017, 03:22:32 pm
content: I should have been more clear: The GSM signalling hardware for CRTU-RUs is different from the GSM signalling hardware for CMU200. The DOS OPSW only supports the CMU200 version.(That's the simplified version.)I think there are different types of GSM signalling options for CMU200 (B21; B21Var14; V21Var02); there's the USU (Universal Signalling Unit) and the ULH (Universal Link Handler). There's also B56Var14 (PowerPC for USU).Now, for CRTU, there's CRTU-B5-{1,2}_V02 and CRTU-B5-{1,2}_V04 (mine has the CRTU-B5-{1,2}_V04 fitted), as well as the CRTU-B56-2 (PowerPC board; from Windows you can telnet into it and it runs Linux(!)). But these do not allow the signalling tests to be used. I agree that they _sound_ similar to the CMU-200 options, they physically seem to be different; so I believe.Do we have board photos of them to compare them with the CRTU-RU cards?

author: fisafisa
author_rank: Regular Contributor
timestamp: September 15, 2017, 10:04:16 pm
content: hi.Thanks for the info.Are you able to telnet to them on the standard port?Running linux... If so we can ask RS to release the source code...I think it would be really great if we had a more detailed block diagram of the CRTUs..

author: Wilts01
author_rank: Newbie
timestamp: November 08, 2017, 01:26:32 pm
content: I have been following this thread with some interest.I have managed to get the ability to add additional sw modules working on my CMU200. For example, I have got the stereo K14 option working. However, I am having problems getting AMPS (K29) to work.I started off by putting in the option code for K29 which it accepted. However, no sign of the AMPS option on the menu. I then realised that I should have installed the IS1MV5.20 software which I successfully managed to do. However, I still do not have AMPS working. As you can see from the photo below, the CMU200 seems to see AMPS is there but it isn't enabled on Chan 1 (and selecting it makes no difference). Any idea what I have missed? I have the following hardware options B12, B21v14, B54v14, B56v14, B66, B68, B96, U65v04.Any advice gratefully received

author: Velund
author_rank: Regular Contributor
timestamp: November 08, 2017, 01:38:12 pm
content: Quote from: Wilts01 on November 08, 2017, 01:26:32 pmYou have no AMPS software package installed. Option is activated, but no software to use it in instrument. Installation package is available, so just install it and go ahead.

author: Wilts01
author_rank: Newbie
timestamp: November 08, 2017, 03:30:00 pm
content: Thanks. Apologies if I am being stupid but exactly what is the AMPS software? i thought it was part of the IS1MV5.20 package which i have installed. Is there another package I should be installing? If so, where do I get it?

author: Velund
author_rank: Regular Contributor
timestamp: November 08, 2017, 03:39:23 pm
content: Yes, it is part of the IS1MV5.20 package.Maybe you have more than one base versions on disk and package was installed with another base?

author: Wilts01
author_rank: Newbie
timestamp: November 08, 2017, 04:04:36 pm
content: Further update. I have edited SWOPT.dat to remove the option. Rebooted and then put the option code back in. Still no joy with AMPS.I then tried enabling the IS136 option to prove that the IS1MV5.2 software was working properly. This worked fine. Also, Version Manager reports that IS!MV/AMPS is installed.One thought - is the B41 option hardware mandatory for AMPS?

author: RF_fanatic
author_rank: Regular Contributor
timestamp: November 08, 2017, 08:56:04 pm
content: Yes B41 is manditory for AMPSWithout B41 the AMPS will not be shown in the menu of the CMU regardless if you have an official code for the AMPS option or not.Just to be sure I have checked it with one of my CMU units with an original AMPS key. When I remove the B41 than the option is goneI have some spare B41 units for sale but the distance will make it difficult

author: bernroth
author_rank: Regular Contributor
timestamp: November 25, 2017, 09:18:28 pm
content: Anyone with some luck for other gear like FSL spectrum analyzer? It uses keys with 32 decimal digits. Looks like there is a newer algoritm used in newer gear.

author: Octane
author_rank: Regular Contributor
timestamp: February 03, 2018, 05:02:07 pm
content: Hi y’all!I got a CMU 200 a few days ago and I was very lucky with the fitted options:Model CMU 200-1100.0008.02SW Version : V5.22Software Options:CMU-K21 GSM900-MS V5.22CMU-K22 GSM1800-MS V5.22CMU-K23 GSM1900-MS V5.22CMU-K24 GSM850-MS V5.22CMU-K42 GPRS@GSM-MS V5.22CMU-K43 EGPRS@GSM-MS V5.22Hardware Options:CMU-B11 OCXOCMU-B17 I/Q-IF InterfaceCMU-B21V14 Universal Signalling UnitCMU-B41 Audio Measurement UnitCMU-B54V14 Signalling Module f. GSM, TDMA, AMPSCMU-B95 Additional RF GeneratorPCMCIACMU-U65V04 DSP f. Wideband MeasurementCMU-U99 RF1 with RF2 Level RangeHardware Equipment:Front Module: FMR6CPU: Intel Celeron MobilMemory: 256 MBFirmware Versions:uP1: V8.50 02.05.06I would like to try to enable a few more options:CMU-K14 Stereo FM TransmitterCMU-K20 GSM400 (just for fun)CMU-K21 GSM900, R-GSM, E-GSM (Just for fun)CMU-K27 IS-136 (fun)CMU-K28 IS-136/PCs (fun)CMU-K29 AMPSCMU-K48 I/Q versus slotCMU-K53 BluetoothI think I should have all the necessary hardware options for those, right?The list of software installed on the machine is:Base V3.61 — GSM MS V3.62Base V5.21 — GSM MS V5.22Base V5.22 — GSM MS V5.22 (active)So I probably need another software package, but can I use the IS1MV5.20.exe package that VE7XEN is so kindly hosting? Or do I need the same version number?Thanks for all your help!Michael

author: Velund
author_rank: Regular Contributor
timestamp: February 03, 2018, 05:08:32 pm
content: You need Bluetooth hardware and installed Bluetooth software to enable BT option. Looks like your CMU is not BT-capable.Get the last versions you can get and install them.I made a full image of internal HDD before changing something on my unit, just to be able to get it back to original state if something goes really wrong.

author: Octane
author_rank: Regular Contributor
timestamp: February 03, 2018, 05:11:49 pm
content: Oh, yes, CMU-B53. I did indeed overlook that, thanks for pointing it out.Michael

author: Octane
author_rank: Regular Contributor
timestamp: February 04, 2018, 03:13:00 am
content: Quote from: Velund on February 03, 2018, 05:08:32 pmYes, I will do that before installing anything. I’m just waiting for the IDE/USB adapter to arrive.I put some codes in and the FM stereo seems to work. AMPS does not yet, so I’ll need the software package.I’ll try to install IS1MV5.20.exe on my base V5.22 after I have a backup.Thanks for your help Velund!Michael

author: Octane
author_rank: Regular Contributor
timestamp: February 09, 2018, 03:38:35 am
content: Issue resolved! Reformatting as FAT16 fixed the problem. The weird thing was that Mac OS X said from the beginning that it was FAT16 formatted....hmmmSo the USB/IDE adapter arrived, I got the HDD out of the CMU 200 and took an image. Put it back and the CMU works. Everything fine so far.I also got a SanDisk CF to PCMCIA adapter and WD SiliconDrive 2GB PATA CF cards (SSD-C02G-3800).I made sure that the CF card is formatted with FAT16.Extracted the IS1MV5.20 folder from the IS1MV5.20.exe and put it onto the CF card.Put the card into the PCMCIA adapter and plugged it into the left slot on the front of the CMU.Pressed the power button. The usual beeping happens.The R&S splash screen with the green rectangle "progress bar" on the bottom appears.All the rectangles appear the message to enter the "Version Manager" is still there.The hexagons on the top right keep animating, but nothing else happens.Same with the right PCMCIA slot.If the PCMCIA adapter is in the slot I can't get into the version manager by pressing the "Menu Select" button during the 3 quick beeps.It just does the same thing as before.I booted up the machine without the card. Then "Alt-F4". I put the card in and tried to change to different drive letters.At one it crashed with the message "Divide Overflow".Next I rebooted and got into the BIOS.The BIOS does not show any drives in addition to the internal one. Is that normal with PCMCIA cards?I have not used any of those for a very long time and I never used an adapter for CF cards.Could somebody please check this on his unit?I then removed the card again, booted into the version manager (not very reliable to get into it in my opinion).I scanned for additional drives, non-found as expected.Then I put the card in and scanned again. I got the "Divide Overflow" error again and the machine froze.I just got onto the DOS prompt again (Alt-F4 after booting) and hat the PCMCIA card installed all the time (no CF card yet).Drive letters D: and E: Fail to read, as expected.If I put the CF card in and try to change to E: again the weird "Divide Overflow" error happens again with a full freeze.Any ideas what I'm doing wrong? What could I check?Thanks in advance guys!BR,MichaelEdit: Typo...

author: riku
author_rank: Newbie
timestamp: February 10, 2018, 08:25:32 am
content: Hi! i was very luck find this place to talks about cmu.okey letme ask dump question, i do have same problem as Wilts01 user have, the option K29 AMPS is grey out selection, how to enable it?I have sticker behind unit where is serial number for that option so it is legite one, software version is 5.10 and i have audio module B41 installed on system, while Wilts01 did not have it.so where i can enable it? it is installed at somepoint as sticker is there it should suppose to work.Is only way to upgrade whole unit? because the sticker is still there and and... i have no idea how to upgrade unit, is it just run IS1MV5.20.exe file, or it need some flash methood? just cpoy file into cmu and run it? found exe file on google couple megs, dunno if that is right one..recently i swapped hard drive because old one was almost end of life, i managed clone it, and do image backup from it on desktop pc.Please, im very novice on this, would appriciate ant tips

author: Bicurico
author_rank: Super Contributor
timestamp: February 10, 2018, 09:23:06 am
content: You can only activate software options if they are installed.So yes, first you install the IS1MV5.20 and then you should be able to activate it with the code from within the SETUP menu.Or, you just activate everything with the keygen and directly write into the license file with a text editor. However, that is of no use if you don't have the respective HW or SW versions installed. Just activating the options will list them as present, but you get no extra functionality.Regards,Vitor

author: riku
author_rank: Newbie
timestamp: February 10, 2018, 03:27:24 pm
content: thanks vitor for answer,however after abit digging i found out base system need be 5.20, and i found only 5.21 on r&s website, it involves i guess upgrade whole system... i dont know even can i upgrade from 5.10 to 5.21 direcly.. oh my this simple thing became just complicated:D

author: Bicurico
author_rank: Super Contributor
timestamp: February 10, 2018, 03:48:44 pm
content: The upgrades coexist side-by-side. In this thread there is a link where you can download the v5.20 software with at least some options. Follow the instructions to install it.You use the software manager to select which is the active installation. After turning the device on, press the MENU SELECT key during boot after the beep.Important: make a backup of the whole existing HDD, just in case.Regards,Vitor

author: harald_schmitt
author_rank: Newbie
timestamp: February 15, 2018, 11:30:16 pm
content: hello to all. i have a nice rohde schwarz fph spectrum rider and would like to know if there is a chance to get some license keys / serials for the options.best regardsharald

author: pressurefm
author_rank: Newbie
timestamp: March 27, 2018, 08:44:03 pm
content: Good afternoon friends! I am a ham radio, there is an R & S FSH3, please help how to activate the options, K2, K3, K4?Serial number 5 digit, without a fraction. A ready-made key should be only from digits and have 10 characters.The guys really need your help !!!

author: stabista
author_rank: Newbie
timestamp: April 02, 2018, 11:12:02 am
content: Serial number of mine FSH3 is 100561. Model number is 23 (023?). Needed option is K2 (2? i havent option number in hex). I tried to use methods from enabling options threads for other R&S equipment (crypto script for python and script for c (but for that last one i`m also havent hex representation for option codes), in first case got hex code, but need 10 digit.

author: pressurefm
author_rank: Newbie
timestamp: April 02, 2018, 11:43:37 am
content: //// Valori Strumento FSP "http://www.rohde-schwarz.it/it/prodotti/test_and_measurement/spectrum_analysis/FSP-|--|-100-|-6394.html"//char KeyString [] = {"0123456789"}; // Opzione originale ottenuta da "Rohde & Schwarz", per verifica funzionamento Keygenchar SerString [] = {"xxxxxx/xxx"}; // Seriale dello strumento//// Programma Calcolo Codici Opzioni FSP//int main(void){unsigned long key;unsigned long opzione;option_type * option = option_list;//// Test funzionamento con opzione valida//// Decodifica Opzioneopzione = decrypt(KeyString, SerString);// Codifica Opzionekey = encrypt(option->raw_option, SerString);//// Calcolo tutte le opzioni "Funzionanti" per Seriale//// Per tutte le opzioni dispinibiliwhile (option->raw_option){// Controllo se opzione validaif(option->valid_option == TRUE){// Calcolo chiavekey = encrypt(option->raw_option, SerString);// Stampo valore opzione da immettere nello strumentoprintf("%010lu - %s\r\n", key, option->descr_option);}// Opzione successivaoption++;}}

author: jacobhl
author_rank: Newbie
timestamp: May 02, 2018, 01:02:56 pm
content: I have a R&S ZVB8 2 port Vector Network Analyzer, but I can't see any options file (SWOPT.DAT or similar). Under 'Info', no files are loaded that indicate which file it could be.I could really use the ZVAB-K2 Time Domain option - does anyone have any good suggestions? The serial-number is 6-digits.To be honest, I can't even see where I would load a valid software option key.

author: carver
author_rank: Contributor
timestamp: May 29, 2018, 10:36:57 pm
content: Quote from: jacobhl on May 02, 2018, 01:02:56 pmcheckOption Key Entrysection in manual.need load xml or input 30 digit key.both produced from unique DeviceKey and SN,like for all r&s device, produced over ten years.

author: Ice-Tea
author_rank: Super Contributor
timestamp: September 09, 2018, 07:04:07 pm
content: Hello Gents,As some of you know, I have a stack of CMU200's. The herd is, however, thinning so I can no longer just pick one from the stack if a customer requires certain features. I recently sent out a unit with BT and I pressume it quite litteraly fell of a truck as it was damaged upon arrival. I want to send him a new unit obviously but I have none that are in good enough shape *and* have Bluetooth. So, I swapped a board with BT. The HW option is now listed but the SW option is not enabled.Could anyone help me out by generating the key for me? Would be a great help...Ice-Tea

author: tv84
author_rank: Super Contributor
timestamp: September 11, 2018, 08:57:10 pm
content: Quote from: dhillman on December 31, 2016, 07:08:18 pmI know this is old but just for the records:The seed keys and the functions used in the FSIQ KG were extracted from the API.DLL. (As an example here is the file from FSIQ_FW_v440_SP3 firmware file).

author: dl2ocb
author_rank: Newbie
timestamp: September 14, 2018, 11:57:33 am
content: Hello,does anyone know if the Keygen is usable for the ZVH4 Handheld too ?

author: tv84
author_rank: Super Contributor
timestamp: September 14, 2018, 12:39:28 pm
content: Quote from: dl2ocb on September 14, 2018, 11:57:33 amThe FSQ KG isn't.

author: dl2ocb
author_rank: Newbie
timestamp: September 17, 2018, 08:53:44 am
content: Tnaks for the Info.Does anyone know a Keygen for FSH oder ZVH Handheld Instruments fron Rohde&Schwarz ?I got a ZVH4 and maybe i can supply some DLLs or other needed Files to create a KG.Lets Keep the nice R&S Stuff alive !!!

author: mbirth
author_rank: Contributor
timestamp: September 17, 2018, 09:35:29 am
content: Quote from: dl2ocb onTodayat 10:53:44The FSP keygen in this thread also works for the FSH. Use the serial number alone, no "/" and no model number.Make sure to enable all keys and try them top to bottom until all options are unlocked.

author: dl2ocb
author_rank: Newbie
timestamp: November 27, 2018, 07:20:30 am
content: Hello,i tested the KeyGen for FSE/FSIQ to enable Options for the ZVH4 but with no success. I tried with full Serial-Nr. and with only the first part of the S/N.I dont have a FSHx Model to check if the keygen does its Job on FSHx style analyzers.Any Ideas out there what to try to free the Beast in the ZVH4 ?CUStefan

author: sm7ovk
author_rank: Newbie
timestamp: December 05, 2018, 08:15:49 am
content: Hello,Tried the codes on my FSIQ and some of them are only accepted as correct but without any action. I also got one option that I would like to remove, frequency to 41GHz and it doesn't work without the correct hardware, anybody know how to remove?My intention was to get K3 and K4 options but this seems to need some extra diskettes to install. Anybody have these?Regards 73Jens

author: vk3st
author_rank: Newbie
timestamp: December 12, 2018, 08:30:24 am
content: Hi,what compiler or assembler is ised for the script please?I have tried Python and a number of others to no avail - all fail.Maybe old age getting to me but never was a good programmer ;-(Ianian@ian-foster.com

author: hidjedewitje
author_rank: Newbie
timestamp: December 12, 2018, 08:50:39 am
content: Has anyone tried unlocking the options on the RTB2000/RTM3000 series oscilloscopes?I am currently in doubt on whether I should go for a RTB2002 or save up a little more for a Keysight 3000T series. Mainly because the Keysight has the ability to unlock options.I know Rigol scopes are able to be hacked, but their software seems buggy and slow.

author: eb4fbz
author_rank: Regular Contributor
timestamp: December 12, 2018, 09:47:16 am
content: Quote from: dl2ocb on November 27, 2018, 07:20:30 amI'm interested in ZVH options too

author: hafrse
author_rank: Regular Contributor
timestamp: December 12, 2018, 02:39:46 pm
content: Hello,had a problem with the hardisk and the CPU card, after replacing the CPU with another haddisk from another CMU, now I have another serial number shown from the new CPU card.How do I get hold of Serial2 if I have replaced the cpu card and the harddisk? if there any way to dump the serial2 number? after replacing the CPU with another haddisk, now I have another serial number shown.many thanks in advance!

author: hafrse
author_rank: Regular Contributor
timestamp: December 12, 2018, 03:55:49 pm
content: Quote from: tv84 on December 12, 2018, 03:48:46 pmHello,I think I found the answer, it is stated in post #59 in this thread. I only need to execute the Identity menu selection and a file will be generated with the serial1 and serial2.I will try that .Thanks anyway!

author: tv84
author_rank: Super Contributor
timestamp: December 12, 2018, 07:34:14 pm
content: Quote from: hafrse on December 12, 2018, 03:55:49 pmThat has nothing to do with ZVH. It's only for CMU, FSU, FSQ, FSP and FSIQ.

author: Ice-Tea
author_rank: Super Contributor
timestamp: December 17, 2018, 01:03:04 pm
content: Well, I'm trying to bring the script up myself again (HW guy trying to do SW stuf lolzz... yeah...)I found that I can't get the PyCrypto package to work. Seems to have issues finding some VS install (tried several) and newer versions of Python (yes, also tried older ones). So I gave up on PyCrypto and use PyCryptoDome which should be close to compatible. At least it installs but when runningCode:from Crypto.Cipher import ARC2import structserial = 103086serial2 = 2option = 45record = struct.pack("<II", serial, serial2 + (option <<20))encyphered = ARC2.new("Revision\0").encrypt(record)print encyphered.encode("hex")I getCode:C:\Pyhton>python cmu.pyTraceback (most recent call last):File "cmu.py", line 9, in <module>encyphered = ARC2.new("Revision\0").encrypt(record)TypeError: new() takes at least 2 arguments (1 given)So, uhm, yeah... some help please?

author: KaneTW
author_rank: Frequent Contributor
timestamp: December 17, 2018, 01:12:43 pm
content: Two options:1. Use Anaconda2. Install a Ubuntu VM and `sudo apt install python-crypto`You could adapt the other library, but I don't know if it'll cause issues down the line.

author: Ice-Tea
author_rank: Super Contributor
timestamp: December 17, 2018, 06:57:25 pm
content: Yeah, uh, I'm not going to learn how to use/install a new OS in a VM because I can't get a piece of SW to work. Thanks for the suggestions though...Anaconda didn't do it for me either.Actually found this link in this thread:https://repl.it/repls/SkeletalDelectableDwarfrabbitDidn't work at first, but got it to go!

author: Giedrius
author_rank: Newbie
timestamp: December 21, 2018, 02:23:23 pm
content: Hello,Has anyone been able to generate codes for FSL?I used the python script to generate code and it produced a hex number. However, the device itself only takes decimal digits (0-9) as input (under install options dialog).I tried converting hex code to decimal and entering but that didn't work either.Has anyone had better luck with FSL device?

author: mbirth
author_rank: Contributor
timestamp: December 21, 2018, 02:59:58 pm
content: Quote from: Giedrius onTodayat 17:23:23[...]Has anyone had better luck with FSL device?Have you tried the generator fromReply #7?

author: Giedrius
author_rank: Newbie
timestamp: January 23, 2019, 10:18:33 pm
content: Hello and sorry for the late reply.Yes, I tried the generator from reply #7 but the codes did not work.I am not sure if I am using the correct serial number.I am expecting serial number to be in a form like xxxxxx/yyy. The first part is given by software and a sticker on the back of the device. However, I cannot find the last three digits (yyy) anywhere. I tried various combinations from the stickers on the back of the device, motherboard and RF boards. But none of them generated working upgrade code.Do you know where I can find the full number required for the generator - I mean the last three digits (yyy)?Thank you very much for your help!

author: mbirth
author_rank: Contributor
timestamp: January 23, 2019, 10:48:15 pm
content: Quote from: Giedrius onTodayat 01:18:33For an old FSH it was as easy as using xxxxxx as the serial number. No dash, no nothing. And make sure to set all entries in the option_list to TRUE and try them one after another.

author: Qw3rtzuiop
author_rank: Frequent Contributor
timestamp: January 29, 2019, 04:52:47 pm
content: Did someone already tried unlocking options of the SMU200A?

author: hafrse
author_rank: Regular Contributor
timestamp: February 06, 2019, 11:14:55 am
content: Quote from: mbirth on January 23, 2019, 10:48:15 pmBut the genrated key is a HEX string and the FSH accepts only numbers, how it is possible?Thanks

author: mbirth
author_rank: Contributor
timestamp: February 06, 2019, 11:32:48 am
content: Quote from: hafrse onTodayat 14:14:55You used the keygen from comment #7, didn't you?

author: hafrse
author_rank: Regular Contributor
timestamp: February 06, 2019, 07:07:07 pm
content: Quote from: mbirth on February 06, 2019, 11:32:48 amHello, No, from commect #21 with Python code.

author: mbirth
author_rank: Contributor
timestamp: February 06, 2019, 07:28:03 pm
content: Quote from: hafrse onTodayat 22:07:07Well, then try the one from #7.

author: hafrse
author_rank: Regular Contributor
timestamp: February 06, 2019, 08:48:05 pm
content: Quote from: mbirth on February 06, 2019, 07:28:03 pmtried to compile the project in VS2017 using sdk 10 and sdk 8.1, ended up on stdio.h not found when using sdk 8.1 , I am not very familier with VS...

author: ve7xen
author_rank: Super Contributor
timestamp: February 07, 2019, 10:53:57 pm
content: It's just a trivial C program. I compiled it for you.

author: hafrse
author_rank: Regular Contributor
timestamp: February 08, 2019, 08:42:57 pm
content: Quote from: mbirth on September 17, 2018, 09:35:29 amThe FSP keygen has seeds for the options on the fsp but where to get the seeds for options K2,K3 and K4 for the FSH? thanks

author: mbirth
author_rank: Contributor
timestamp: February 09, 2019, 01:47:06 am
content: Quote from: hafrse onYesterdayat 23:42:57That's why I said to enable the disabled options in the source code. (set FALSE to TRUE)"K84 - 1xEV-DO BTS" for the FSP is K1 for the FSH"K84 - 1xEV-DO MS" for the FSP is K3 for the FSHThe fourth entry in the options list is K2.K4 I don't know. The device I had was too old and didn't support that option. Just try them one after another and you'll probably find it.btw: The entry labelled "K7" enables the DEMO mode on the FSH and unlocks all features for a month.And don't forget to input your serial number in the SerString variable further down, then recompile the thing.

author: hafrse
author_rank: Regular Contributor
timestamp: February 10, 2019, 06:39:30 pm
content: Thanks

author: tv84
author_rank: Super Contributor
timestamp: February 17, 2019, 09:15:27 pm
content: Quote from: mbirth on February 09, 2019, 01:47:06 amLet me try clarify some things (although I don't know much about this).The list of options extracted from FSP firmware v4.50 API.DLL is the following:Code:K5 GSM/EDGE Application GSM K5 ANALYZER FSPSpectrumAnalyzerLIK7 FM Demodulator FM DEMODULATOR FSPSpectrumAnalyzerLI#1#2K84 1xEV-DO BTS 1X EV DATA ONLY BTS FSPSpectrumAnalyzerLIK85 1xEV-DO MS 1X EV DATA ONLY MS FSPSpectrumAnalyzerLIK90 FSQ WLAN 802.11a WLAN FSQ-Wlan(LI)K72 WCDMA 3GPP FDD BTS WCDMA BTS ANALYZER FSPSpectrumAnalyzerLIK74 WCDMA HSDPA BTS WCDMA HSDPA BTS FSPSpectrumAnalyzerLIK75 WCDMA HSDPA MS WCDMA HSDPA MS FSPSpectrumAnalyzerLIK9 Power Meter POWER METER FSPSpectrumAnalyzerLIK73 WCDMA 3GPP FDD MS WCDMA MS ANALYZER FSPSpectrumAnalyzerLIK90 FSP WLAN 802.11a FSP WLAN FSP_Wlan(LI)K90UP FSQ WLAN 802.11a,b,g WLAN UPGRADEK76 TD-SCDMA BTS TD-SCDMA BTS ANALYZER FSPSpectrumAnalyzerLIK77 TD-SCDMA MS TD-SCDMA MS ANALYZER FSPSpectrumAnalyzerLIK30 Noise Figure NOISE MEASURE FSx-Noise(LI)K82 CDMA2000 BTS CDMA2000 BTS FSPSpectrumAnalyzerLIK83 CDMA2000 MS CDMA2000 MS FSPSpectrumAnalyzerLIK8 Bluetooth BLUETOOTH FSPSpectrumAnalyzerLIK40 Phase Noise Measurement PHASE NOISE MEASURE FSx-PNoise(LI)K70 Vector Signal Analysis VECTOR SIGNAL ANALYSIS FSPSpectrumAnalyzerLI#3K50 Triggered Coverage Meas TRIGGERED COVERAGE MEASK51 Synchronized Stepped Sweep SYNCHRONIZED FREQ LISTS%d days remaining trial period TRIAL PERIOD 180 HRSK0 %d days remaining trial period TRIAL PERIOD 2000 HRSK91 FSQ WLAN 802.11a,b,g WLAN ABG FSQ-WlanExtension(LI)#5 FREQ LIMIT 31 GHZB%s Frequency Extension FREQ NO LIMITK92 FSQ 802.16 FSQ 802_16 FSQ-Wman(LI)K52 Transducer Set REG_TPK53 FFT Scan FFT SCANK901 %d days remaining trial period TRIAL PERIOD 2500 HRSK902 %d days remaining trial period TRIAL PERIOD 3000 HRSK92UP FSQ 802.16e FSQ 802_16 UPGRADEK93 FSQ 802.16e FSQ 802_16E FSQ-WmanExtension(LI)K903 %d days remaining trial period TRIAL PERIOD 3500 HRSK904 %d days remaining trial period TRIAL PERIOD 4000 HRSK100 LTE FDD Downlink LTE FDD DOWNLINK FSx-LTE FSx-LTE(LI)K101 LTE FDD Uplink LTE FDD UPLINK FSx-LTE FSx-LTE(LI)B29 Frequency Extension 20Hz FREQ EXT 20HZK15 Avionics Demodulator AVIONICS DEMODULATOR FSPSpectrumAnalyzerLIK91N FSQ WLAN 802.11n WLAN 802 11N UPGRADE FSQ-Wlan80211n(LI)K94 FSQ 802.16e MIMO FSQ 802_16 Mimo UPGRADE FSQ-WmanMimo(LI)K102 LTE Downlink MIMO LTE DOWNLINK MIMO FSx-LTE FSx-LTE(LI)K103 LTE Uplink MIMO LTE UPLINK MIMO FSx-LTE FSx-LTE(LI)K96 OFDM-VSA OFDM-VSAK74+ WCDMA HSPA+ BTS WCDMA HSPA+ BTS#4K400 RFEX-F Launcher RFEX-FK17 EX IQ Box EX IQBOX FSx-ExIqBox(LI)K110 TETRA 2 TETRA2 FSQ-Tetra2(LI)K10 GSM/EDGE/EDGE Evolution GSM/EDGE ANALYZER FSx-Gsm(LI)K73+ WCDMA HSPA+ MS WCDMA HSPA+ MSK104 LTE TDD Downlink LTE TDD DOWNLINK FSx-LTE(LI)K105 LTE TDD Uplink LTE TDD UPLINK FSx-LTE(LI)K106 LTE TDD/FDD Upgrade LTE TDD/FDD UPGRADEK5UP GSM K5 Upgrade to K10 GSM K5 ANALYZER UPGRADE FSx-Gsm(LI)K150 Support for User Calibration USER CAL SUPPORTThey are ordered according to the seeds table (used in the prog to generate licenses).Also, in that .DLL we can extract a more complete seed (uint32) table than the one used in the original prog (post #7). I attach it below.Those that are using the program should add the new seeds because they may be needed to enable other Options.The FSH Option names can be extracted from the FSH firmware's API.DLL. If anyone sends me a current FSH API.DLL I might extract the complete list of Options.When adding the Option seeds you should also make them TRUE so that all possibilities are calculated.

author: goaty
author_rank: Regular Contributor
timestamp: March 14, 2019, 03:55:14 pm
content: For FSH3, I looked into the update file which contains GALAXY.ldf, GALAXY2M.ldf and GALAXY3G.ldf.Seems there is an easteregg there:"Mines left: %dTime: %3dBest time: %3dLives: %dScore: %dHighScore: %dWaiting for opponent...Congratulations, you won!!Ouch, you lost!!Your fleetOpponents fleetDrop bomb...Watch out for incoming...Expose a part of one of your ships...Watch out for incoming..."

author: fisafisa
author_rank: Regular Contributor
timestamp: April 27, 2019, 08:31:15 pm
content: HII have got an AMIQ waveform generator.I tried with the options generator but no luck.Looking at the manual it would seem that the options here are only 8 characters long.Anybody has an example of option code (together with the serial number)Maybe it is possible to figure out the algorithm.Thanks

author: sky2city
author_rank: Contributor
timestamp: June 12, 2019, 05:56:32 am
content: Hey Guys,I have a ZVR, SN is 835068/005. and I found the SW sn \R_S\INSTR\INI\OPTOIN.INIIs't anyone know how to decode it?--------------------------------------------------------4056071223; EMBED DEEMBED0436723430; TIME DOMAIN1234299954; CONVERTER 4 CHAN--------------------------------------------------------

author: sky2city
author_rank: Contributor
timestamp: June 12, 2019, 06:44:17 am
content: Quote from: tv84 on February 17, 2019, 09:15:27 pmHi tv84,I attached a API.DLL form a ZVR. could you decode the option from it?

author: carver
author_rank: Contributor
timestamp: June 12, 2019, 12:06:33 pm
content: Quote from: sky2city on June 12, 2019, 05:56:32 ammaybefeat_0 = 'HARMONIC MEAS', 'B3', 'Harmonic Measurements'feat_1 = 'MIXER MEAS', 'B4', 'Mixer Measurements'feat_2 = 'NONLINEAR MEAS', 'B5', 'Nonlinear Measurements'feat_3 = 'REF MIXER PORTS', 'B6', 'Reference Mixer Ports'feat_4 = 'POWER CALIBRATION', 'B7', 'Power Calibration'feat_5 = '4 PORT MEAS', 'B99', '4-Port Measurements'feat_6 = 'QUARTZ MEAS', 'BXX', 'Quartz Measurements'This is an old public algorithm.test Feat_2+, if all OK - test b3-b4 too,in newer devices - these numbers(0 or 1) used for demo.now r&s used new long key.many know how to create new too,but no one wants to share it to public ))Code:sn: 835068.005 id: 00 option key: 1542267991 desc: feat_0sn: 835068.005 id: 01 option key: 2797899109 desc: feat_1sn: 835068.005 id: 02 option key: 2277388772 desc: feat_2sn: 835068.005 id: 03 option key: 2328386865 desc: feat_3sn: 835068.005 id: 04 option key: 0302356071 desc: feat_4sn: 835068.005 id: 05 option key: 3024766616 desc: feat_5sn: 835068.005 id: 06 option key: 4252011699 desc: feat_6sn: 835068.005 id: 07 option key: 4056071223 desc: TIME DOMAIN, B2, Time Domain Measurementssn: 835068.005 id: 08 option key: 0436723430 desc: CONVERTER 4 CHAN, C4C, 4 Channel Convertersn: 835068.005 id: 09 option key: 1234299954 desc: EMBED DEEMBED, K9, Virtual Embedding Networkssn: 835068.005 id: 10 option key: 0493488890 desc: feat_A

author: tv84
author_rank: Super Contributor
timestamp: June 12, 2019, 09:29:24 pm
content: Quote from: sky2city on June 12, 2019, 06:44:17 amI don't think so. Do you have examples of options for that equipment?

author: sky2city
author_rank: Contributor
timestamp: June 13, 2019, 04:25:03 am
content: Quote from: tv84 on June 12, 2019, 09:29:24 pmI double checked with ZVR manual, the only K option for ZVR is K9 only, there is nothing to do with this unit.So I am looking in another one, FSEA30. the datasheet say the K option for FSEA is:---------------------------------------------------------------FSE-K4 Phase Noise Measurement Software,FSE-K3 Noise Measurement SoftwareFSE-K10 GSM Test Software, MobileFSE-K11 GSM Test Software, Base StationFSE-K20 GSM Test Software, Edge MobileFSE-K21 GSM Test Software, EDGE Base StationFSE-K30 GSM Test Software, 850 GHz band MobileFSE-K31 GSM Test Software, 850 GHz band Base Station----------------------------------------------------------------Just decoded the SN using "Rohde & Schwarz FSP option generator".Notice: that I decode all seeds, the comment "Kx xxxx Application Firmware" is not correct, it's for FSP--------------------------------------------------------------------------3780795724 - K5 - GSM/EDGE Application Firmware0284552823 - K7 - AM/FM/PM Measurement Demodulator4196994763 - B17 - IQ Online0684125256 - None1514211661 - K84 - 1xEV-DO BTS Application Firmware0579586646 - K84 - 1xEV-DO MS Application Firmware3285910640 - None1332515167 - FSP-B15 FSP-B70 FS-K71746004935 - K72 prior K740425836556 - None3914572062 - K9 - Power Meter0367944746 - FSP-B15 FS-K70178533596 - None0084427020 - None0973137605 - K76 - 3GPP TD-SCDMA BTS Application Firmware4058089560 - K77 - 3GPP TD-SCDMA MS Application Firmware2816669065 - K30 - Noise Figure Measurament0774785927 - K82 - CDMA2000 BTS Application Firmware1251526595 - K83 - CDMA2000 MS Application Firmware0364322959 - K8 - Bluetooth Application Firmware3912188941 - K40 - Phase Noise Measurament2043795852 - None2216559242 - None3509799288 - None0667766505 - None2179962388 - 31 days trial period4232888520 - 78 days trial period1998016984 - None1665344687 - None0081926458 - Frequency Extension1876889287 - None2554963261 - Trasducer Set0989643314 - None1367083121 - None2589261327 - None3754352886 - None2349723378 - None2713318677 - None0242151735 - None3807482493 - None2651669256 - None0586577237 - None3525044770 - None0034228987 - None1143727560 - None2616543767 - None1636617207 - None0959025083 - None1318982380 - None2600577035 - None--------------------------------------------------------------------------compare with the options.ini in my FSEA. the fisrt line is the "FSE-K10 GSM Test Software, Mobile".------------------------------------------------------Options file in my FSEA:3780795724; GSM MTS ANALYZER------------------------------------------------------My question is which line of the SN is for other option?-------------------------------------------------------------------FSE-K4 Phase Noise Measurement Software,FSE-K3 Noise Measurement Software??FSE-K10 GSM Test Software, Mobile 3780795724FSE-K11 GSM Test Software, Base StationFSE-K20 GSM Test Software, Edge MobileFSE-K21 GSM Test Software, EDGE Base StationFSE-K30 GSM Test Software, 850 GHz band MobileFSE-K31 GSM Test Software, 850 GHz band Base Station-------------------------------------------------------------------another thing I found is that there is no API.dll in my FSEA30. I search all *.ll in hard disk, it seems that "FSEFPNL.DLL" is the suspect one.

author: sky2city
author_rank: Contributor
timestamp: June 13, 2019, 04:28:09 am
content: Quote from: carver on June 12, 2019, 12:06:33 pmGot it. thanks for your reply.

author: sky2city
author_rank: Contributor
timestamp: June 13, 2019, 04:40:25 am
content: Quote from: jacobhl on May 02, 2018, 01:02:56 pmHi Jacod,I don't have the ZVB yet. I download the firmware form RS and than extract all files.there is a DLL file "OptionKeyServices.dll", I guess this Dll is work for the option key.for the SW option key, you should search *option*.* or *opt*.* in D disk. in my ZVR, it's "Option.ini".and check the serial-number on "info" hard key manu.

author: sky2city
author_rank: Contributor
timestamp: June 13, 2019, 02:58:25 pm
content: Quote from: sky2city on June 13, 2019, 04:40:25 amI went through the "OptionKeyServices.dll", it seems that some fuction is base on OpenSSL 0.95 lib.But I can't find the where the key hidden.Stuck here ....

author: sky2city
author_rank: Contributor
timestamp: June 16, 2019, 07:08:57 pm
content: Quote from: jacobhl on May 02, 2018, 01:02:56 pmI did some Reverse Engineering of OptionKeyServices.dll. it show that the OptionKeyServices.dll always access the Register table of windows.Maybe the Option key is store in register table.Pls. check reg table on:HKEY_LOCAL_MACHINE\SOFTWEARE\Rohde&Schwarz\......

author: vk3st
author_rank: Newbie
timestamp: June 29, 2019, 06:49:02 am
content: Hi all,Still frustrated trying to get several option running on our radio club ZVH.Really wanting to activate K1, K9 and K39.I did have a contact with a guy in Russia but the expected cost was way way beyond the budget by many orders of magnitude and was probably more based on a commercial proposition.Have tried all the options with variations mentioned in these pages to no avail.If someone does have a key gen stored away and can provide me with activation codes for Ser No 102660/24 I would be prepared to pay a fee or donate a suitable sum not being a kings ransom for the service.If there is such a person, pm me at vk3st@ian-foster.com please.

author: carver
author_rank: Contributor
timestamp: June 30, 2019, 09:57:36 am
content: as I wrote above,many have access to R&S tools, me too.but no one wants to share this tool to public, as R&S too.

author: mbirth
author_rank: Contributor
timestamp: June 30, 2019, 11:35:41 am
content: Quote from: vk3st onYesterdayat 08:49:02Did you also try the tool from comment #7 but with only the first part of your serial number? (Have to edit the serial number in the source code, then compile and run. Make sure to also set all the options in the source code to TRUE first.)

author: vk3st
author_rank: Newbie
timestamp: July 07, 2019, 10:00:26 am
content: Hi, can you pm me with RS tool info please?Info@ian-foster.com

author: vk3st
author_rank: Newbie
timestamp: July 07, 2019, 10:06:50 am
content: I looked. At it and could not seem to get it to compile without error.What is recommended compiler please and sorry but has been many years since compiling scripts etc so am a bit slow in this area.

author: larry42
author_rank: Regular Contributor
timestamp: July 27, 2019, 06:27:38 am
content: I've been reading through this thread - anyone know the situation with the more modern series of R&S equipment (e.g. RTE / RTO series of scopes).R&S seem to base their designs on a couple of platforms, with occasional "mid-life" upgrades of the underlying HW (and OS - usually embedded Windows of some kind). The RTE / RTO platform is common and Win7 / Win10 embedded. with license key support for temporary and time limited licenses as well as portable licenses and license de-activation.Anyone confirm whether these can be played with?

author: carvalhoatx
author_rank: Newbie
timestamp: August 01, 2019, 09:10:02 am
content: Hello Folks, anyone who has working with RTO scope oscilloscope (model 10 24 ) ? If so, could you help me. I tried to save the x-y axis waveform in .csv.When I tried it, only the y-axis (voltage was salved). I need also, the Time axis. How to set to both ? I tried to find that "basic" info with manual, but there is no it....Or it doesnt work to that Oscilloscope? kind regards for comments,

author: little.tesla
author_rank: Regular Contributor
timestamp: August 06, 2019, 05:44:18 pm
content: Hello,did anybody try to enable options for signal generators like SMIQ, SME?I did try different combinations on a SME which expects a 6-digit activation key without luck. The serial number is same as the others xxxxxx/xxx.Any hints are highly appreciated.BR,Dimce

author: darkstar49
author_rank: Frequent Contributor
timestamp: August 09, 2019, 12:04:48 pm
content: Quote from: larry42 on July 27, 2019, 06:27:38 amto my knowledge, no one has succeeded so far hacking any recent R&S scope (incl. RTO's, which have their crypto stuff on a smart card inside the scope, btw), although I'd like to be wrong ! RTB & RTA firmware files/updates are encrypted, and I've never seen anything able to decrypt those either... (which would be a starting point for further 'research'...)

author: KaneTW
author_rank: Frequent Contributor
timestamp: August 09, 2019, 01:39:44 pm
content: Yeah, I have a RTB2004 but it's a fully optioned 5k instrument. Not touching that unless someone has a spare with a busted frontend or something and I can experiment with it.

author: analogRF
author_rank: Super Contributor
timestamp: August 09, 2019, 03:38:29 pm
content: Quote from: little.tesla on August 06, 2019, 05:44:18 pmmay I ask what options on SMIQ/SME you want to enable? I don't know how it can be done but if there is any useful option that can be hackedI would be very interested to do it. As I remember most of the 'good' options are hardware options for which you need a HW module. Software options were not many and they didn't seem very interesting to me at least

author: little.tesla
author_rank: Regular Contributor
timestamp: August 10, 2019, 06:40:19 pm
content: I have here at the moment only a SME where I would like to play a bit with the POCSAG Protocol (pagers) option SME-B42. The required hardware options are available. There are as well B41 and B43 software options which are at the moment not of interest for me.As far as I can tell for the SMIQ the options >B42 (Digital Standard IS-95 CDMA) and >K11 (Digital Standard IS-95 CDMA) are software options. I think they just require the modulation coder/data generator and memory.How good is your i960 assembly?

author: EEngo
author_rank: Unknown
timestamp: August 11, 2019, 01:17:01 pm
content: does anyone know how to enable options for a DVRG? I have two of them, but one of them is missing one of the previously installed options after a HDD crashI have all the HDD images, but couldn't find something key-related.-ingo-

author: Pattymorr
author_rank: Newbie
timestamp: August 12, 2019, 01:51:52 am
content: Newbie here for everything.Got 2 old units FSH3, one is fully operational type 13 from 2005 (with tracking generator SN103585 Firmware V10.00), the other one is from 2004 (base model 03 with preamp SN 102121) which seems to have a corrupt Firmware V7.20 cause the frequency range shows random numbers i.e Center -1.656726599e+181; despite all keys and menus are functional the only response I got for the instrument is for Manual BW to 1Mhz and Span 0hz, all others shows Out of Range.I had try to look for firmware update and found a file on R&S site for the new version with TV features which I am not sure if it will be suitable for the old units. Furthermore, I had not been able to find the Optical Rs232 cable interface neither the software tools needed to perform the update, I guess there is plenty of this items stocked at R&S at considerable price.After reading this post I downloaded the file on post #7. Unfortunately, I wont have access to the files until I have a way to communicate with the units. Does anyone know what is the pinout / transceiver configuration for the optical rs232?Thanks in advance for helpSincerelyPatty.

author: Pattymorr
author_rank: Newbie
timestamp: August 14, 2019, 08:18:11 pm
content: The Fluke 190 rs232 interface is suitable for tryouts but the closes one is from the Fluke 279/289.Found this DIY rich in info as part of my own answer :DIY optical link cable for the Fluke Scopemeter 190 serieshttp://omapalvelin.homedns.org/fluke/After assembly and testing on HyperTerminal at 19200bps I was able to send a few commands and had response for GD (Get Down), SO (Switch ON) and RI (Reset Instrument). ID (instrument ID) , IS (Instrument status) and RT,RD and others returned nothing. Down to 9600 bps minimum for FSH3 and checking the RX signal on oscilloscope shows a lot of noise and missing data at the output of the IR comparator.The info and pictures of the 189 interface in this blog motivated to keep me going :http://kimboricha.blogspot.com/2013/12/build-usb-to-fluke-189-irinfrared.htmleven though none of the suggestions and mods workedThe two transistor darlington configuration was the solution for the high speed required :https://electronics.stackexchange.com/questions/391266/high-speed-infrared-uart-link-with-photodiodeConfirmed optical Rs232 interface working by Hyperterminal, any command sent replied using mirror( a spoon is better) and when connected to FSH3 I sent ID enter returned all R&S info and firmware version. Observed a nice square wave modulated when tested with a TV remote. Tested the home made Rs232 interface with both instruments and FSH viewer connected a 19200bps.Firmware updated fix the FSH3 Frequency range anomaly.Have found version 13 of FSH viewer here:http://www.korearental.co.kr/cData/CDATA_PDS_VIEW.ASPX?IDX=250&Cate=1&bbscode=7,2,0,.And Version 14.2 is here:https://uloz.to/file/B41l7yCShG9O/fshview-v14-20-setup-exe?showDialog=1.The new firmware update ver. 14 is a self extracting file and is suitable for all old FSH 3 ,6,18 but requires FSH Viewer 14 and up Installed .IF administrator have a way to let me upload somewhere the two 10MB FSH Viewer installers I will be happy to do it before the links disappearI got some progress on the option keys from my serial 102121.2918745366 - K5 - GSM/EDGE Application Firmware (Option Key error)0659588824 - K7 - AM/FM/PM Measurement Demodulator (Enabled) DEMO MODE ENABLED FOR 1000Hrs1048859114 - B17 - IQ Online (Option Key error)3837700883 - None (Option Key error)0840658593 - K84 - 1xEV-DO BTS Application Firmware Remote Control Enabled2135204116 - K84 - 1xEV-DO MS Application Firmware Receiver Meas. Enabled1863906345 - None (Option Key error)0204267013 - FSP-B15 FSP-B70 FS-K7 (Option Key error)2684356591 - K72 prior K74 (Option Key error)0371030575 - None (Option Key error)0679722459 - K9 - Power Meter (Option Key error)3208052079 - FSP-B15 FS-K7 (Option Key error)3516151515 - None (Option Key error)3712172277 - None (Option Key error)1067738526 - K76 - 3GPP TD-SCDMA BTS Application Firmware (Option Key error)4183377164 - K77 - 3GPP TD-SCDMA MS Application Firmware (Option Key error)0890457939 - K30 - Noise Figure Measurament (Option Key error)3488976067 - K82 - CDMA2000 BTS Application Firmware (Option Key error)4253200286 - K83 - CDMA2000 MS Application Firmware (Option Key error)2499311400 - K8 - Bluetooth Application Firmware (Option Key error)0071209860 - K40 - Phase Noise Measurament (Option Key error)2187555649 - None (Option Key error)1044162665 - None (Option Key error)1586385696 - None (Option Key error)1960780550 - None (Option Key error)2793864759 - 31 days trial period (Option Key error)0212545182 - 78 days trial period (Option Key error)3895538962 - None (Option Key error)1099830336 - None (Option Key error)0581656715 - Frequency Extension (Option Key error)1434950248 - None Accepted None1662463819 - Trasducer Set Accepted NonePatty

author: hgl
author_rank: Regular Contributor
timestamp: November 01, 2019, 09:33:34 pm
content: Hello, I need the R & S option key TSMU-K35 for RF scan with my TSMU devices. Unfortunately, R & S does not sell it to private individuals.For example, Option Key 15 looks like this:1. TSMU<! DOCTYPE KeyInstallation><KeyInstallation format_id = "0" content_type = "OptionKey" device_id = "1153.6000k02 / 100449" material_description = "Radio Network Analyzer (default)" model_name = "TSMU"><OptionKeyData material_no = "1153.4595.02" format_id = "0" option_index = "15" start_date = "" full_name = "TSMU-K15" creation_date = "2006-07-27" customer_order_no = "109171" duration = "" key_type = "Customer Order" license_count = "1" option_type = "K15" activation_type = "Permanent" /><OptionKey format_id = "0" key = "213827836019817947172267609678" license_count = "1" /></ KeyInstallation>I still have examples for other keys and other devices.Can someone help me

author: hgl
author_rank: Regular Contributor
timestamp: November 03, 2019, 09:22:29 am
content: I am interested in existing information. Please do not offer hack for payment.

author: sixtimesseven
author_rank: Frequent Contributor
timestamp: December 30, 2019, 05:05:28 pm
content: Quote from: carver on June 12, 2019, 12:06:33 pmWhich method did you use to get the code? The python script mentioned in #21 does not give me the same results.Code:from Crypto.Cipher import ARC2import structserial = 835068serial2 = 005option = 9record = struct.pack("<II", serial, serial2 + (option <<20))encyphered = ARC2.new("Revision\0").encrypt(record)print encyphered.encode("hex")I get:Code:24147d39d5347618My ZVR displays the Serial Number 100041/061 and has several options installed (attached the options.init file). However I would like to get the rest

author: Decee1
author_rank: Regular Contributor
timestamp: February 20, 2020, 08:18:04 pm
content: HelloCan anyone convert the script into Python 3.6? Been struggling for too long with converting it but there are just a few things im not familiar with..

author: ve7xen
author_rank: Super Contributor
timestamp: February 20, 2020, 08:44:56 pm
content: Quote from: Decee1 on February 20, 2020, 08:18:04 pmAssuming you're talking about the generator for CMU200 and related boxes, I have already ported it. You can get it herehttp://gotroot.ca/cmu200/cmuopts.py. You'll need to also install the pycrypto module (pip3 install pycrypto).

author: Decee1
author_rank: Regular Contributor
timestamp: February 20, 2020, 08:59:36 pm
content: AND IT WORKS LIKE A CHARMNo problems AT ALL...Even tho you gotta give it a few thoughts that you need to add the whole serial number but just took a few seconds to figure out!RESPECT!

author: charlyd
author_rank: Frequent Contributor
timestamp: March 16, 2020, 02:49:02 pm
content: Hello is this topic also to enable R&S Options topic for the SMIQ (hrw/sft) options ?

author: analogRF
author_rank: Super Contributor
timestamp: March 16, 2020, 03:21:33 pm
content: yes it should work. most hardware options usually work out of he box. software options need keys to be generated

author: hafrse
author_rank: Regular Contributor
timestamp: April 13, 2020, 04:38:22 pm
content: Quote from: sky2city on June 13, 2019, 04:25:03 amHello,FSE/FSIQ Analyzers: any clue what seeds for these options in order to generate the keys ?FSE-K4 Phase Noise Measurement Software,FSE-K3 Noise Measurement SoftwareI tried all the seeds in the obove list (from previous post) but none gave these options.Thanks

author: Cristian2020
author_rank: Newbie
timestamp: April 17, 2020, 01:01:03 pm
content: Hi,I have try the FSP code generator for post nr. 7 (compiled the C code from the attachment ) for some FSP analyzer that already have the installed option and it seams that the generator does not produce the right keys. I have also try the software without using the extensions (only the serial number as some users suggests ) after the serial number (SN:"xxxxxx/"extention") and combinations but without any luck.So for instrument with the SN:100218/013 for K5 the intrument has valid key value :0129995137 and k73 :3470174034Running the C produce the following output:0129996165 - K5 - GSM/EDGE Application Firmware2115523187 - K7 - AM/FM/PM Measurement Demodulator2038900723 - B17 - IQ Online18446744073588054323 - K84 - 1xEV-DO BTS Application Firmware................................................................................................As can be seen,in this case, from the above the are some similarities for K5 with the working key but is not what we expect.Program: 0129996165working key:0129995137for k73 i have no clear seed to compare in the programsecond example :Intrument SNchar SerString [] = {"100548/030"};produces for K8 :18446744072697944362 - K8 - Bluetooth Application Firmwarebut the working key of the instrument is :2746489130I read that the application has been used to generate valid key for FSP but i was not able to verify the usability.Does anybody has an working example pair (SN-Keys ) that has been verified (for all options listed by the C software so i can test it in my development)What am i missing here?Also another aspect that will be welcomed is to explain the decrypt side of the C softwareSo because ARC is symmetric key block cipher i was expect to encode the SN to a key and when decode the previous encoded key using the same C sw to find the SN. But this was not the case.So using the number in ex. 1 above, the Key for K5 generated by the C code is 0129996165.changing the code to decrypt#define DECRYPT 1#define ENCRYPT 0and inputting the above keychar KeyString [] = {"0129996165"};the program generate:1168528319 - K5 - GSM/EDGE Application Firmware0718055252 - K7 - AM/FM/PM Measurement Demodulator18446744072781050645 - B17 - IQ Online....................................................................As can be seen this does not correspond to what we expect to find for K5 (apparentley no connection with the encoded side even when comparing this with the seed for K5 :0x069AF1C1)Can somebody please explain what i have missed here!Thank you!

author: eliocor
author_rank: Unknown
timestamp: April 17, 2020, 01:32:25 pm
content: it seems you have done something wrong:I changed only the following line:Code:from:char SerString [] = {"xxxxxx/xxx"}; // Seriale dello strumentoto:char SerString [] = {"100218/013"}; // Seriale dello strumentoI just recompiled the program and I got the following output:0129995137 - K5 - GSM/EDGE Application Firmware2115523187 - K7 - AM/FM/PM Measurement Demodulator2156342255 - B17 - IQ Online0029433139 - K84 - 1xEV-DO BTS Application Firmware1707468331 - K84 - 1xEV-DO MS Application Firmware1152848593 - K9 - Power Meter0154808364 - K76 - 3GPP TD-SCDMA BTS Application Firmware4292549013 - K77 - 3GPP TD-SCDMA MS Application Firmware3336719522 - K30 - Noise Figure Measurament4012350171 - K82 - CDMA2000 BTS Application Firmware1883977506 - K83 - CDMA2000 MS Application Firmware2927653398 - K8 - Bluetooth Application Firmware0642974582 - K40 - Phase Noise Measurament0129995137 - K5 - GSM/EDGE Application Firmwareseems to me correct.

author: jjoonathan
author_rank: Frequent Contributor
timestamp: April 17, 2020, 01:57:20 pm
content: -m32 is your friend.That, or have a machine so old and crusty that 32 bit is the default.

author: eliocor
author_rank: Unknown
timestamp: April 17, 2020, 02:53:21 pm
content: The visual studio project was set for generating a Win32 EXE, not a Win64 one.BTW, the code was not mine: I just "found" it!

author: piotrekjan
author_rank: Contributor
timestamp: April 17, 2020, 03:39:07 pm
content: Hi,Some these questions will be trivial, sorry - I'm not SW guy.Comming for a while for SMIQ topic.I have 2 generators one partially dead with options(hdr/sft) and one working but naked. I've moved some modules to this naked one - but as you guess it is necessary to install them with keys.This partially dead has following numbers:S/N: 832870/0020Factory installation key: 352664Options:SMIQ-B42 (1104.7936.02), installation key:553631SMIQB11 1085.4502.04SMIQB19 1085.2997.02SMIQB20 1125.5190.02This naked has following numbers:S/N: 100587/0036Factory installation key: 642681My question is how to use this Python script listed in the posts here to generate installation keys for these options above for my naked generator. I understand that I have to place there serial number 100587/0036 but what about codes for these options ? Smiq rather not basing on any operating system. So it is not possible to read some files like in CMU. It has some EEPROM on it - but not sure what data it keeps there.The other observation is that key should be 6 digit number - but may be not ?Any suggestions how to start with this ?

author: jjoonathan
author_rank: Frequent Contributor
timestamp: April 17, 2020, 05:50:13 pm
content: > The visual studio project was set for generating a Win32 EXE, not a Win64 one.And that's why it worked for you. It didn't work for Cristian2020 because he was compiling in 64 bit mode. I haven't even compiled or run the code, but the integer lengths and misalignment in the printout make me 95% sure that was his problem.

author: piotrekjan
author_rank: Contributor
timestamp: April 19, 2020, 03:23:57 pm
content: I'm trying repeat an operation that artag described in reply 21, after some playing with success.After small Internet investigation about values representation and modifications in newer Python:Code:import binasciiimport sysfrom Crypto.Cipher import ARC2import structimport structserial = 103086serial2 = 2option = 45record = struct.pack("<II", serial, serial2 + (option <<20))print(record)cipher = ARC2.new(b"Revision\0", ARC2.MODE_ECB)encyphered = cipher.encrypt(record)msg = binascii.hexlify(encyphered)msglist = []for letter in str(msg):msglist.append(letter)msglist.remove("b")msglist.remove("'")msglist.remove("'")for letter in msglist:print(letter, end="")print("")It gives exactly 11b26d02cee94bea,and below the final version, maybe usefull for someone - nothing more than artag made some years ago, just in newer python version:Code:import binasciiimport sysfrom Crypto.Cipher import ARC2import structserial = 103086serial2 = 2#option = 10sample = open('SWOPT.dat', 'w')for option in range(10,50):record = struct.pack("<II", serial, serial2 + (option <<20))cipher = ARC2.new(b"Revision\0", ARC2.MODE_ECB)encyphered = cipher.encrypt(record)msg = binascii.hexlify(encyphered)msglist = []for letter in str(msg):msglist.append(letter)msglist.remove("b")msglist.remove("'")msglist.remove("'")for letter in msglist:print(letter, end="", file=sample)print("",file=sample)sample.close()KEY = b"Revision\0"STRUCT_TWO_UNSIGNED_INTS = "<II"for line in open("SWOPT.DAT"):if len(line) == 17:cipher = ARC2.new(KEY, ARC2.MODE_ECB) # a new ARC2 cipher with the right key (ARC2 is a symmetric block cipher, we need a new cipher for each ciphertext)ciphertext = bytes.fromhex(line.strip()) # Decode our ciphertext from hex, removing whitespace from the start and endplaintext = cipher.decrypt(ciphertext) # Decrypt the cyphertext using the keya, b = struct.unpack(STRUCT_TWO_UNSIGNED_INTS, plaintext) # unpack two unsigned ints from the plaintextprint ("SN: %d - %08x" % (a, b))And now fundamental question - how to get the 6 digit code that is the key for option in SMIQ generator ?If this can be used for SMIQ somehow ?Do I have to install this visual studio program listed in reply 7 and try to play with or it is some other option to extract it ?

author: bjirre
author_rank: Newbie
timestamp: April 20, 2020, 12:03:24 pm
content: Hi Everyone,Does anybody has any progress on this topic for the Rohde&Schwarz UPL audio analyzer? How to enable the options?Thanks so much!Bart

author: Cristian2020
author_rank: Newbie
timestamp: April 21, 2020, 10:27:09 pm
content: I can confirm that the problem get solved using compiler for 32Bit.Thank's for suggestions!PS:SMIQ has some interesting options to be unlocked like arbitrary modulation ,ber testing ..etc.It will be very useful to have this options but the problem remain (what is the 6 digit magic number key)BR,

author: charliedelta
author_rank: Regular Contributor
timestamp: May 16, 2020, 08:53:39 am
content: Anyone know how to enable the option on the FSH6? I tried to buy this Key but R&S says they cant generate keys anyone because they have discontinued this product. It just sounds so lillogical I cant even believe they would say something like this. I want to send them money and all that they have to do is generate a key on their PC.If someone knows a dealer that generates keys that i can buy one for I would be happy to buy it. Moral of the story is buy the options you need before they discontinue them. Test equipment seems to have a very short support life these days especially from R&S

author: ocom
author_rank: Newbie
timestamp: May 25, 2020, 08:56:36 pm
content: Hi all,I have an R&S ZVH4. I would like to add options, do you think this is possible?it's annoying to see that you manage to activate options on CMUs and to say that maybe on ZVH it is not possible,thank you

author: 1design
author_rank: Regular Contributor
timestamp: May 26, 2020, 02:21:36 pm
content: Looks like the ZVH product line is still available in the US:https://www.rohde-schwarz.com/us/product/zvh-productstartpage_63493-11194.html?rusprivacypolicy=0Maybe you can try and check with the US dealer for your license. They are selling the product, they should also be able to send you an activation code.

author: piotrekjan
author_rank: Contributor
timestamp: July 11, 2020, 07:50:42 pm
content: Quote from: charliedelta on May 16, 2020, 08:53:39 amDo you think they do bussiness(money) on hobbysts who play with 15 or more years old, 2nd hand equipment ? There is nothing illogical in what they do. Try to understand how much you can pay them and then compare it to recent price of their equipment and options attached. Why they should sell option to equipment they do not sell anymore and even if they would, I see how would you pay some k$ for licenseI do not defend them but their repair support is long anyhow. And I also understand that they do not want to talk with such hoobysts like we are. An each hour of enginner costs. If you are not happy you can chose other equipment right ?We have to live with this situation and be happy there are contributors who spend time on repairing/hacking some equipment and share it on forum to help others.Do not take my message as attack - just basic logic justifies their behaviorRegards,

author: teknut
author_rank: Newbie
timestamp: July 17, 2020, 01:47:20 pm
content: @ piotrekjanAny progress on the SMIQ front? I'm starting to get interested in this as I will like to enable B21 - Bit Error Rate Test which is a software only option on top of B20 - Modulation Coder. I can provide info on the two units I have as in SN, factory installation key (wonder what exactly is this ?) and at least one software installation keys that is attached to one of the units for K42 - DIGITAL STD - IS-95. Needless to say I can't make a difference between a Python and a Cobra so the code around here does not help me much at this time!!Thanks,A

author: piotrekjan
author_rank: Contributor
timestamp: July 17, 2020, 06:12:34 pm
content: Not really.I was studing the manual to find GPIB command to install option, to proceed with bruteforce however, there probably no such command or not listed. I still do not know how to generate 6 digit key basing on the hex string generated from S/N and option by described script. So for now sorry but I do not know how to proceed further.Regards,

author: piotrekjan
author_rank: Contributor
timestamp: July 18, 2020, 01:23:43 pm
content: Had someone play with this audio generator ? What is necessary to run it next to module B41 ?Basing on alu cover that shows B41 connections, B41 is connected to A10 X105 (located next to it) and A7 X704. Here next question - to A7 X704, two cables are connected one from B41 and on from A9 X901.Is some "T" adapter necessary to connect these cables together on A7 X704 ?What about software firmware - this mentioned previously IS1MV5.20 will work for this audio too?And the last question - these, let's call them "RF cables", inside equipment - what plugs these are - is it possible to buy to make cable ourselves or it is some R&S standard ?Regards,

author: teknut
author_rank: Newbie
timestamp: July 22, 2020, 04:00:16 pm
content: Not sure about the audio question but sure about the RF connectors inside. For whatever reason they are using 3 typesSMA - I guess we all know that one right ? - is the one used for the attenuatorSMB - almost the same size as an SMA yet it does not rotate - plugs in and outMMCX - the smallest one of all used all aroundAll standard connectors... nothing special

author: piotrekjan
author_rank: Contributor
timestamp: July 22, 2020, 05:13:48 pm
content: The MMCX is the plug I was looking for.Thank you and Regards,

author: MindBender
author_rank: Regular Contributor
timestamp: July 29, 2020, 10:07:07 am
content: I have updated the source code of the Rohde & Schwarz FSP option generator in post 7 of this thread and put it on GitHub:https://github.com/CatGenius/fsxx_keygenIt now contains all 200 seeds from API.DLL and it takes the serial number from the command line options.If no instrument type is specified, it prints all 200 keys, generated from the serial number and the 200 seeds. If you have found some of these keys to activate any options, please report:Your instrument type (eg. FSEA20)The key number (a number between 0 and 199,notthe actual keyThe number (eg. K10) and a description (eg. GSM MS Analyzer) of the option it enablesPlease note I am not the original author of this software. I just extended it a bit.

author: cmu2017
author_rank: Contributor
timestamp: August 20, 2020, 07:45:21 am
content: Is there also such a program to enable options for the R&S SFE100?

author: hg2dok
author_rank: Newbie
timestamp: October 11, 2020, 05:07:41 pm
content: Hello everyone! I want to activate the AMPS option in cmu200. Can anyone help generate decimal code?CMU serial is 834639/052Best regards HG2DOK ARON

author: msraya
author_rank: Unknown
timestamp: October 12, 2020, 09:04:54 am
content: Hello everyoneLately I help a friend of mine to enable CMU200 functionality and to doing a backup. I use old good python code.Unhappily, this code is large obsolete because of update library functionality and Python 2 obsolescence.So I try to upgrade python code. I think I success, so I share my findings with you.Below is the code. There are two programs, one to extract and check serial number from encoded user key file SWOPT.DAT hidden file.The second to obtain user keys. Bear in mind that this code is for educational purpose only. Each one has the responsibility for their use. I don't help nor support anyone questions about the code, sorry. My aim is to help people with old and obsolete equipment.from Crypto.Cipher import ARC2from Crypto import Randomimport structimport base64for l in open("SWOPT.DAT"):if len(l) == 17:tmp=bytes.fromhex(l.strip())cipher = ARC2.new(b'Revision\0', ARC2.MODE_ECB)tmp2 = cipher.decrypt(tmp)a, b = struct.unpack("<II", tmp2)print ("SN: %d - %d" % (a, b/1000000))from Crypto.Cipher import ARC2from Crypto import Randomimport structserial = 101763serial2 = 2options = [21,22,23,24,42,43,45,44,14,29,47,48,53,54]for option in options:record = struct.pack("<II", serial, serial2 + (option <<20))encyphered = ARC2.new(b'Revision\0', ARC2.MODE_ECB ).encrypt(record)print("Option K%2d, key = %s."% (option,encyphered.hex()))Regards

author: syau
author_rank: Frequent Contributor
timestamp: November 03, 2020, 02:47:00 am
content: Quote from: MindBender on July 29, 2020, 10:07:07 amTested on FSH6/* FSH option list */static const struct option_t fsh_options[] = {{ 0, FLAGS__INVALID, "NONE" },{ 1, FLAGS__INVALID, "NONE" },{ 2, FLAGS__VALID, "B1 - Distance To Fault" },{ 3, FLAGS__VALID, "K2 - Vector Calibration" },{ 4, FLAGS__VALID, "K1 - Remote Control" },{ 5, FLAGS__VALID, "K3 - Receiver Mode" },};BTW, anybody has a FSHRemote for FSH3/6 usable in Win10x64 ? Tried fshremote_2.12.4, it throw as class error

author: Venture
author_rank: Newbie
timestamp: December 07, 2020, 06:25:44 pm
content: Hello all,I wonder if someone could do me a huge favour. I have an FSU and would love to enable some s/w options (mainly K9 power meter, but others would be nice too).The problem is that I'm no good with computers and just have a WinXP (don't asK) and a Win10 machine here. I have no clue how to get Python working on either machine to run the keygen.I'd very much appreciate it if someone could generate some option keys for me. My instrument serial no. is 200372/003.Failing that, I've had a look here:https://repl.it/repls/SkeletalDelectableDwarfrabbitBut have no clue how to input serial number or run the code (copy & paste code from the left to window on the right brings up several error messages, plus there doesn't seem to be an option 9 listed there) so maybe someone could write a short "dummies guide".Thank you!

author: ve7xen
author_rank: Super Contributor
timestamp: December 14, 2020, 07:24:10 am
content: Quote from: Venture on December 07, 2020, 06:25:44 pmThere should be a Run button at the top of the page, and you will eventually get prompted for the S/N in the right hand panel.However repl.it seems to have broken anonymous snippets and forced signins. I've recreated the repl and fixed the package management so it should run now. I got the list of valid licenses from somewhere but I don't remember where - probably for CMU200 though. I've added option 9 to the list for you.Go tohttps://repl.it/@ktims/SkeletalDelectableDwarfrabbit#main.pyand click Run at the top. It will take some time but eventually prompt you for the S/N in the right pane.

author: Bicurico
author_rank: Super Contributor
timestamp: December 14, 2020, 10:32:19 pm
content: Hello,Just for the sake of it, I tried to convert the Python code (few messages above) into VB .net.I failed miserably and I don't understand what I am doing wrong.My code produces diffferent (wrong) keys. I am 100% sure that my Byte arrays for the Key and Message are correct - I checked them against the Python script.It is the .net Cryptography library that seems to produce a different RC2 result than Crypto.Cipher ARC2 does on Python. But that cannot be true, I would say!So please help me!Here is my code (it is not pretty, but at this moment I just want it to produce the same keys as the Python script):Code:Imports System.Security.CryptographyImports System.TextImports System.IOPublic Class Form1Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.ClickDim key() As Byte = str2byte("Revision ")key(8) = 0Dim opt() As Integer = {9, 14, 16, 17, 20, 21, 22, 23, 24, 26, 27, 28, 29, 42, 43, 44, 45, 46, 47, 48,53, 54, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 83, 84, 85, 86,87, 88, 90, 92, 96, 839, 849, 859, 869}Dim serial1() As Byte = BitConverter.GetBytes(123456) ' <--- Serial Number (first part)Dim serial2() As Byte = BitConverter.GetBytes(2) ' <--- Serial Number (second part)Dim message(7) As Bytemessage(0) = serial1(0)message(1) = serial1(1)message(2) = serial1(2)message(3) = serial1(3)message(4) = serial2(0)message(5) = serial2(1)ListBox1.Items.Clear()For Each o In optDim ob() As Byte = BitConverter.GetBytes(o << 20)message(6) = ob(2)message(7) = ob(3)Dim mStream As New MemoryStreamDim RC2alg As RC2 = RC2.CreateRC2alg.Mode = CipherMode.ECBRC2alg.Padding = PaddingMode.NoneDim cStream As New CryptoStream(mStream, RC2alg.CreateEncryptor(key, RC2alg.IV), CryptoStreamMode.Write)cStream.Write(message, 0, message.Length)cStream.FlushFinalBlock()Dim ret As Byte() = mStream.ToArray()cStream.Close()mStream.Close()ListBox1.Items.Add(Str(o) + " - " + byte2str(ret))NextEnd SubFunction str2byte(str As String) As Byte()Dim b(Len(str) - 1) As ByteFor n = 1 To Len(str)b(n - 1) = Asc(Mid(str, n, 1))NextReturn bEnd FunctionFunction byte2str(b() As Byte) As StringDim t As String = ""byte2str = ""For n = 0 To b.Count - 1t = Hex(b(n))If Len(t) = 1 Then t = "0" + tbyte2str = byte2str + tNextEnd FunctionEnd ClassTo run it, just create a Form, Button1 and Listbox1.Regards,Vitor

author: ve7xen
author_rank: Super Contributor
timestamp: December 15, 2020, 12:43:10 am
content: My word VB is a hideous language. Could it be doing something weird because you are providing an IV to a chaining mode that doesn't use an IV? I also note that the examples seem to call RC2.Create like RC2.Create("RC2"), though I am not sure why or what this parameter is for as its purpose seems basically undocumented.Or perhaps something is going wrong with `Dim serial2() As Byte = BitConverter.GetBytes(2)` as you have specified a literal that fits within uint8_t when calling GetBytes, does it actually cast the literal to uint8_t and you actually get 2+ bytes out of it? I guess since it is little-endian it doesn't matter if it casts to uint32_t or whatever as long as it's not casing to uint8_t. I guess you aren't lying when you say the byte stream is correct.Notwithstanding that I can't run this code and that this is much uglier than the Python solution, it seems to be generally correct, as far as I can tell.

author: Bicurico
author_rank: Super Contributor
timestamp: December 15, 2020, 08:29:34 am
content: Thank you for your reply. My aim is not to discuss the pros and cons of different programming languages. The sheer fact that they exist means there are reasons for them to exist.One of the motivations for me to convert this script from Python to VB.net is simply to understand what the script does. Since the initial code first published by tmbinc (who has my greatest respect), I have wondered how such a small script would get its job done:Code:from Crypto.Cipher import ARC2import structfor l in open("SWOPT.DAT"):if len(l) == 17:a, b = struct.unpack("<II", ARC2.new("Revision\0").decrypt(l.strip().decode("hex")))print "SN: %d - %08x" % (a, b)Of course, the code of the keygen is even more motivating and similarly compact (no need to repost it here).And this is what I think of Python: a very cryptic language with loads of shortcuts/abbreviations, which makes the code almost impossible to read, especially when you are not familiar with Python.It took me quite a while to just understand the meaning of "<II"!Anyway:1) Yes, my MESSAGE and KEY arrays are 100% the same as used in the Python script. I verified it. Also, no coding issues, as we are speaking of raw bytes. No error with little endian vs big endian, either.2) I am using, as in the Python script, ECB. This means that IV is NOT being used at all. And again I verified it: I can define whatever 8 bytes in IV() and pass it to RC2 and the result is the same. IV is simply ignored.3) Padding is set to NONE and this gives me the result of 8 bytes. Before it was adding random bytes to fill up 128 bit.4) I already tried to setup keylength to 64 bit. That did not change anything.So at this point I wonder why .Net RC2 gives a different output than Crypto.Cipher ARC2 in Python. I think that RC2 is somehow working in 128 bit mode and ARC2 in 64 bit mode, but I am not sure.Again, thw whole point is just a personal satisfaction to see "my" VB code producing the same output as the Python script.And yes, by now I understand what the script does.Allthough, there is one part I don't understand. My code now produces the same result, but I find it odd:Code:record = struct.pack("<II", serial, serial2 + (option <<20))So struct.pack will output two little endian integers ("<II") from two inputs: serial and "serial2 + (option << 20)"(option << 20) left shifts the velue in options 20 timesBut now serial 2 is added to this result. My question is: since both are integers, shouldn't they be added like numbers (2 + 20 = 22) instead of (2 + 20 = 0220)?Is this addition treated as if adding two strings? Why?Anyway, this is NOT the problem I am experiencing.Thanks,Vitor

author: tv84
author_rank: Super Contributor
timestamp: December 15, 2020, 12:54:35 pm
content: Quote from: Bicurico on December 14, 2020, 10:32:19 pmI didn't use .Net C# RC2 implementation.I did my own implementation based onthis.Don't remember if I tried .Net version...Quote from: Bicurico on December 15, 2020, 08:29:34 amThat <<20 is the same as multiplying option by 0x100000. SO, definitely, it's not the same as adding those 2 numbers!It'soption * 0x100000 + serial2.

author: Bicurico
author_rank: Super Contributor
timestamp: December 15, 2020, 02:35:32 pm
content: QuoteAhhh! Now it makes sense. I was wondering why one would want to shift 8 bits more than 7 times... now I understand. I knew that one left shift is the same as multipying by two, as a right shift is a division by two (6502/6510 assembly does n ot have multiplication or division, so that's how I did it back then).So much to learn...Thanks tv84!EDIT:I want to add the following:1) I feel dumb and dumber the more I look into how some of the published key generators work, how smoothly they were programmed and, most important, how these algorithms were discovered in first place. It sure is easy to state "yeah, just decompile the code", but I have actually tried it and got next to zero result!2) Big thumbs up for the extremely smart people that visit EEVBlog. I really prefer to hang out with smarter people and get slightly smarter myself, than the other way around. Hope that is not a turn-off for the smart guys!Regards,Vitor

author: ve7xen
author_rank: Super Contributor
timestamp: December 15, 2020, 06:43:41 pm
content: The usage of 'struct.pack' here isn't a very 'Pythonic' way to do things, but maps well onto C structures (hence the name of the module) which is presumably how the original C code packs these values for encryption, and it handles the endianness of whatever platform you're running it on for you, so it's a convenient approach rather than trying to pack and handle byte ordering manually. The idea of pack/unpack comes from Perl, which is indeed a very cryptic language.The intent ofCode:s2 + (opt << 20)is more 'clearly' (IMO) represented asCode:(s2 & 0x000fffff) | (opt << 20). `s2` fills the lower 20-bits of the value, and `opt` fills bits 31-20 (in integer representation anyway, once you pack this the byte order will be reversed). In any language it would be more idiomatic (again, IMO) to use bitwise OR (|) instead of arithmetic addition (+) to accomplish this, but since the bits don't overlap, the result of either operation is the same (+ is XOR with carry, and XOR and OR are the same if you never hit the 1 ^ 1 case).If you assume that `serial2` always fits in 16-bits (which it should, being a 3-digit number) and doesn't require the 20-bits it has been allocated in the data structure, they could have represented this instead as two separate 16-bit values in the struct, but you'd have to beware of byte order: e.g. struct.pack("<HHI", s1, s2, opt << 4) which is ultimately closer to what you are doing in your VB code.Now I'm curious what the original (R&S) developers intended to do with those 4-bits they left unused...

author: Bicurico
author_rank: Super Contributor
timestamp: December 15, 2020, 09:46:24 pm
content: Thanks!"Now I'm curious what the original (R&S) developers intended to do with those 4-bits they left unused..."Kind of thought about this, too.Also, why on earth did they choose "Revision\0" as the key?

author: ve7xen
author_rank: Super Contributor
timestamp: December 15, 2020, 10:30:08 pm
content: I implemented a simple test harness in C# to look at the .NET RC2 implementation.After lots of digging, I think I have figured out the problem here. It appears that pycryptodome's RC2 implementation implicitly sets effective_keylen to 1024, unless the user specifies a different value, while .NET sets EffectiveKeySize to the size of the provided key. I'm not sure what the historical/idiomatic default for this parameter is in other implementations, but I guess whatever the R&S folks used did this too or the output wouldn't work. This is what's causing the different output - both implementations behave identically with the RC2 test vectors that specify EKS. The problem here is that the .NET RC2 provider doesn't support the actual key length and EffectiveKeysize not being the same, it throws:Code:System.Security.Cryptography.CryptographicUnexpectedOperationException: EffectiveKeySize must be the same as KeySize in this implementation.I was thinking maybe you could work around this doing the RC2 key expansion yourself to generate the expanded key that Python is using here, and passing that in, but it appears that .NET RC2 doesn't support keys longer than 128bit for some reason, which is weird, since the RFC explicitly calls out that it accepts a variable length key of 1-128bytes. So it appears that .NET RC2 implementation is not complete, as it doesn't support EffectiveKeyLength properly, nor 1024b keys. The only way around it seems to be to use your own RC2 implementation or one from a third-party library.I don't understand why they would bother including such an incomplete implementation. The limitation doesn't even really make sense, they still need to implement the full 128-byte key expansion even if the expanded size and actual size are the same, since this is what is used in the enciphering process. Makes no sense.

author: Bicurico
author_rank: Super Contributor
timestamp: December 16, 2020, 11:23:23 am
content: @ve7xenThank you for your analysis.I spent 3 days trying to get the correct output and I was getting a mental breakdown for not understanding what was wrong.At least now I know why.Kind regards,Vitor

author: tv84
author_rank: Super Contributor
timestamp: December 16, 2020, 02:42:03 pm
content: Quote from: ve7xen on December 15, 2020, 10:30:08 pmYour conclusions are correct and I remember now that was the reason why I did my own implementation.http://msdn.microsoft.com/en-us/library/system.security.cryptography.rc2.keysize.aspxI think someone in the .NET development read128as the key's max number ofBITSinstead of key's max number ofBYTES.

author: Venture
author_rank: Newbie
timestamp: December 21, 2020, 01:54:38 pm
content: Thank you very much to Ve7Xen and TV84, my problem is now sorted.Merry Christmas All!

author: scopeman
author_rank: Frequent Contributor
timestamp: December 27, 2020, 10:58:04 pm
content: Patty,IIRC the IR Interface tool is the same one that was used to communicate with some Fluke scopemeters.See:https://www.ebay.com/itm/Fluke-IR189USB-USB-Cable-Adapter-for-Models-189-287-and-289/202640369405?hash=item2f2e4ea6fd:g:XFoAAOSwO7pceFR5SamW3OHMScopeman

author: Pattymorr
author_rank: Newbie
timestamp: December 30, 2020, 01:04:03 am
content: Dear Sam,Thanks for the Fluke IR189USB USB Cable Adapter for Models 189, 287 and 289. Nice catch for the ones looking for this on the fly and budget. Others with time and resources can go for the price of DIY with 3 transistors, two IR LED and a USB to Serial adapter if needed.Patty.

author: tv84
author_rank: Super Contributor
timestamp: January 03, 2021, 09:35:10 pm
content: Just a reminder for thoseold FSHowners, to create the licenses (10-digits) using the FSP keygen in this thread, you must consider only the serial number and not the model number!So, in the FSP license generator you should always insert like this (example): 123456/000.

author: thorswait
author_rank: Contributor
timestamp: February 16, 2021, 09:33:11 pm
content: Hi Fisafisa,I've had the same problem with the AMIQ, I tried some of the keygen software then I went back to what I know best. So I took my soldering Iron and play with the EEPROM on the DAC board X24C16 next to the Altera and I've compare when activating the B19 option on it the only change was a bit in the EEPROM, nothing else no checksum... So I reverse engineer the process and found out that the bit for AMIQB19 is placed on address 0X13 then I was able to revert all the bits and the options I was interested in .AMIQB1 Addr 0x11 ; AMIQK11 Addr 0x15 ; AMIQK12 Addr 0x16 ; AMIQK13 Addr 0x17 ; AMIQK14 Addr 0x18 etc ... I went up to AMIQK21 (whick I'm not sure if it's actually an option considering K20 is the last option available in WinIqSim)After modifying the EEPROM and rebooting the system upon a good boot I then use the GPIB command with the command to retrieve the actual key for example for AMIQB1 that would be : SYST:OPT? AMIQB1 then the unit would reply it's key. I had to redo it several time in order to get it working. If you add all the option at once they would be activate and you'll be able to retrieve all the number but if you forgot one and you want to add it after you will need to resend the key to your unit I thing there is some sort of compare with the EEPROM.bin file on the drive that is use for backup.I hope it would help you or anyone else using an AMIQ to "retrieve their option key"Regards

author: thorswait
author_rank: Contributor
timestamp: February 18, 2021, 05:06:11 am
content: Hi all,Is anybody with an AMIQ04 that would be able provide the SDRAM IC use to replace the NEC D4564163G5-A80 from the 03 revision ?Thanks all !

author: fisafisa
author_rank: Regular Contributor
timestamp: February 18, 2021, 06:10:18 pm
content: HiGreat solution to the problem.Only question in my mind is the definition of address.You talk about bits, and then it seems that there is an option per address. Is that a bit address? or is that an 8 bit address?I will try to do the same and I will use an tl866 programmer which presents the data in hex pairs.RegardsFilippo

author: phlegeton
author_rank: Contributor
timestamp: February 18, 2021, 07:17:39 pm
content: Is it possible to post the eeprom bin file, so we can study it and experiment with it?

author: thorswait
author_rank: Contributor
timestamp: February 18, 2021, 09:04:49 pm
content: You are right about the bit thing ... I misexpressed myself when I wrote the post, each options are set on individual address. You have to set it to one in order to set the option (that's why I've mentionne bit at first).I add a picture of the eeprom Original and Modify. I've highlighted the new options in red that are actually activated in my unit.In order to write/read the data to/from the EEPROM I had to remove it from the board and isolate it from the pcb by using a cable in between it and the pcb as you will see in the picture.You might also desolder and resolder it to the board but I think it might be better going this way.

author: Bicurico
author_rank: Super Contributor
timestamp: February 19, 2021, 01:05:48 am
content: Why didn't you just use an EEPROM crimp like in the attached picture?Regards,Vitor

author: thorswait
author_rank: Contributor
timestamp: February 19, 2021, 02:01:30 am
content: I did try with a clip at first but, the connection from the eeprom to the fpga was loading the line and I wasn't able to read or write anything to it even with the device power off.

author: Bicurico
author_rank: Super Contributor
timestamp: February 19, 2021, 10:37:45 am
content: For my own interest, could you please explain better what you did?As I understand the crimp did not work with the device powered off.I assume you did not want to try the crimp with the device turned on.So you soldered the wires to the EEPROM and read the contents while the device was switched on?Is this prodedure safe to reproduce generically when a soldered EEPROM is to be read/written?Thanks,Vitor

author: thorswait
author_rank: Contributor
timestamp: February 19, 2021, 03:52:56 pm
content: Hi Vitor,I've simply removed the IC from the board and install it remotely to a PCB that I can connect to my eeprom reader using a cable with a connector 2x4 pins. When I want to read the eeprom with my eeprom programmer I power off the device and disconnect the cable between my board and the AMIQ. Then I was able to read it reprorgram it and do a backup (the first I did in fact, then I found out that the EEPROM is also copied to the internal HDD of the AMIQ in the c:\AMIQ\ folder file EEPROM.bin.)After I did my test with I disconnect it from the programmer then reconnect it to the PCB then I power up the AMIQ and validate the result.I hope it will help you !

author: Bicurico
author_rank: Super Contributor
timestamp: February 20, 2021, 10:59:57 am
content: I once tried without success to read an eeprom on a PCB - hence why I asked.And yes - this will help me in future.Regards,Vitor

author: Shiv
author_rank: Regular Contributor
timestamp: February 24, 2021, 02:00:10 pm
content: Hi all, wow, what a thread,... I´d missed it.I´m going to upgrade all of my lab "things"...As I see, the codes are generated "ramdomly" I mean: You get the codes, but is when you apply it to the equipment when you know what option activates...Is there a way to erase those options that needs hardware?Equipment:FSEA30FSP 3FSH 6And others...SMA 100ASMGSMGU...

author: OH2LIY
author_rank: Contributor
timestamp: March 21, 2021, 02:33:27 pm
content: Quote from: thorswait on 2021-02-17, 00:33:11

author: hafrse
author_rank: Regular Contributor
timestamp: April 15, 2021, 06:58:50 pm
content: Hello,I have a weird problem in my FSH3, the internal battery went bad and when th FSH3 was without any power, all the installed options are gone! I tried to entrer them again but when there is ´battery or external power, the options are cleared! Could be some EEPROM which went bad? the cal values seems to be ok, it is only the options which disappeared.George

author: goaty
author_rank: Regular Contributor
timestamp: April 15, 2021, 07:54:31 pm
content: Can´t remember I had this. I replaced the dead battery on FSH3 and tried a LiIon replacement and then went back to the NiMH, but the licenses still there.Have you tried a new battery and enter keys then ?

author: hafrse
author_rank: Regular Contributor
timestamp: April 16, 2021, 04:15:48 am
content: Hello,Solved:if you apply the option codes when the battery is dead and only using the power cord, the optoions codes will never be updated in the internal flash memory.

author: alexbi69
author_rank: Newbie
timestamp: April 21, 2021, 11:32:22 am
content: Hello.Is it possible to generate option codes for the FSH20 analyzer by serial number, or is it not possible?

author: goaty
author_rank: Regular Contributor
timestamp: April 21, 2021, 11:59:06 am
content: I think FSH20 is more modern platform than FSH3/6/18. Probably other method of license.

author: carver
author_rank: Contributor
timestamp: May 01, 2021, 09:24:22 am
content: yes, it's a different platform, WinCE on 64Mb flash. R&S named it Orion platform.we have several units, in every regional office. new keys are needed there.

author: sergeyklenov
author_rank: Contributor
timestamp: May 26, 2021, 05:27:41 am
content: All possible, but if ask question in pm just need keep your pm available to receive messages hahaha:)))

author: tv84
author_rank: Super Contributor
timestamp: June 12, 2021, 08:31:37 am
content: Anyone still looking for UPL options? Or know how to calc them?

author: carver
author_rank: Contributor
timestamp: June 12, 2021, 09:34:00 am
content: we did UPL with one guy(Bjirre). somewhere on the Internet, there is a large topic for restoring this device. google "Bjirre UPL".I didn't upload the UPL_SW_gen, but it was a long time ago. maybe it’s already shared somewhere by someone else.send me your SN if you can't find exe or algo.

author: Extrasolar
author_rank: Contributor
timestamp: July 03, 2021, 02:07:01 pm
content: Hi Everyone,I have installed some options on the FSEM30 Spectrum analyzer and fund out that some functions have disappeared, such like Volume Control in Marker Demod, Demod does not start for AM, FM and PM...My qyestion: Is there a way to uninstall those options

author: Extrasolar
author_rank: Contributor
timestamp: July 04, 2021, 05:02:21 pm
content: So.... I've figured out how to remove options on FSEA-FSEM:goto SETUP -> SERVICE -> ENTER PASSWORD -> 894129go back to OPTIONS -> CLEAR ALL OPTIONS.If you have a locked option with hardware, it will not be erased. In my case , the EMI RECEIVER is permanently locked and wont go away when trying to clear the Kxx Firmware Option RECEIVER MODE. This is very annoying as this MODE is messing up all the menus. I believe the only solution to that is to get a working image of the FSEA-FSEM SA and dump it in the instruments HDD...

author: flyingfishfinger
author_rank: Contributor
timestamp: July 13, 2021, 09:13:47 pm
content: Hi there-I have an FPC1500 Spectrum Analyzer that goes to 1Ghz, it would be nice if it were possible to unlock the 2-3Ghz range. Is this one too new for these hacks?Cheers,R

author: tv84
author_rank: Super Contributor
timestamp: July 13, 2021, 10:15:33 pm
content: Quote from: flyingfishfinger on July 13, 2021, 09:13:47 pmNo but BW is a HW option.Edit: It can be enabled via sw but not with any method of this thread.

author: flyingfishfinger
author_rank: Contributor
timestamp: July 13, 2021, 11:53:01 pm
content: QuoteTrue, but we have the model which is unlockable with a key code - even when the HW supports it it still needs to be unlocked. In this case, is it possible to use methods from this thread? I'm unclear on how, if so.R

author: carver
author_rank: Contributor
timestamp: July 14, 2021, 08:49:45 am
content: yes, on ebay - these FPC/HW options, like FPC-B2 are sold as SW.https://www.ebay.com/itm/363414986320

author: Inside21
author_rank: Contributor
timestamp: July 14, 2021, 02:05:36 pm
content: and FPC-B3 (2-3 GHz) is SW option toohttps://www.chipdip.ru/product/fpc-b3-2

author: kendor
author_rank: Newbie
timestamp: September 15, 2021, 10:06:14 pm
content: Hello Pro'sI have a big problem... I used (https://github.com/rdelien/fsxx_keygen) to try to enable some options on my "FSEA 20".I started entering all keys from 000, 001, .., 011. and it did enable FFT GSM EDGE, EMI receiver etc. however, upon entering the number of 012 it froze and when I rebooted thedevice now think it is an "FSIQ 3".Anyone has a hint on how I get my "FSEA" back?thanks

author: analogRF
author_rank: Super Contributor
timestamp: September 15, 2021, 11:36:46 pm
content: Quote from: tv84 on July 13, 2021, 10:15:33 pmall options on FPC including BW are software enabled. The brochure clearly says so and it is actually highlighted as one of their selling points

author: ps
author_rank: Regular Contributor
timestamp: September 18, 2021, 02:30:57 pm
content: Quote from: kendor on September 15, 2021, 10:06:14 pmThe easiest way is to restore the backup of your FSEA hard disk and start over, skipping the 012 key.Otherwise, you would have to keep trying keys until you come across one that converts the personality back to an FSEA.

author: Qw3rtzuiop
author_rank: Frequent Contributor
timestamp: September 18, 2021, 02:41:48 pm
content: Quote from: kendor on September 15, 2021, 10:06:14 pmYou should be able to change the identity via the attached service functions.

author: OH2LIY
author_rank: Contributor
timestamp: September 19, 2021, 07:28:09 am
content: Hi, all options are listed in OPTIONS.INI file (C:\R_S\INSTR\INI\OPTIONS.INI ,path may be wrong). Just remove option line...3311386***; FSIQ1124165***; W-CDMA BTS ANALYZER2331308513;...Ramppa

author: smps
author_rank: Contributor
timestamp: October 30, 2021, 02:56:19 am
content: for FSH3/FSH6 SA, is it possible to remove/disable an option ? thanks

author: kendor
author_rank: Newbie
timestamp: December 01, 2021, 08:25:19 am
content: thanks for the hints. However, I can not enter the service menu anymore since the device seems to have different key assignments between spectrum analyzer and generatorwhat is the easiest way to access the HDD? I find it is burried underneath the powersupply and a pain to get out - or how do I get to edit the options.ini file?

author: Robert763
author_rank: Super Contributor
timestamp: February 01, 2022, 02:04:44 pm
content: Quote from: MindBender on July 29, 2020, 10:07:07 amEDIT.Deleted a request for help . I did an new make and it workedFSH3-13 (tracking generator) fairly late unit with Software 14.0The input string was ./keygen -s 123456/000 (replace 123456 with your FSH's six digit serial number). The FSH does not have a slash number but using 000 works.The codes that worked were keys001: 07225xxxxx Demo Mode002: 09689xxxxx DTF B1003: 27029xxxxx Vector Calibration K2004: 05650xxxxx Remote Control K1005: 40886xxxxx Receiver Measurement K3009: 01360xxxxx Restricted Acc K60010: 23507xxxxx Calibration Allowed K15I stopped at key 040 as there are no other options I'm aware of. Obviously the actual key numbers will be different for other units. Note that Demo mode only worked once. I presume it will work again once the 999hours have passed.I'm very happy that in addition to a SA I now also have Scalar network analyser, Vector network analyser, Cable analyser (DTF) and a measurement receiver with CISPR bandwidths and quasi peak detection.

author: ZeusRDF
author_rank: Newbie
timestamp: February 06, 2022, 07:50:49 am
content: HelloI have a Rohde & Schwarz FSH4 .024 series, I see you had great success with the FSH3 model.I have tried the Python Scripts and also the Github and each time it gave me key results, but all 200 failed, and also the new updated posted Github c program with mods also failed. I added the info "you" provided for the FSH models in the github program, compiled and got key results displayed but nothing worked still for the FSH4 i am working on.The FSH4 does have a 024 after the serial number.I tried with the serial/024 and also /000 and nothing generated proper codes, all failed.Is it possible the FSH4 has a different algorithm than the FSH3 do you think? The 6 digit SERIAL NUMBER is basically the same setup, except I do have a /024 for a complete serial number - I tried it with /024 and also /000 still failed keys. (mine is xxxxxx/xxx format)*** IF ANYONE HAS A FSH4 and has successfully obtained the proper keys with the Py Script or C program, can you let me know how you managed to get it to work properly? The FSH3 and FSH4 are very similar in all ways (except you mentioned you DIDNT have the /024 or anything after your serial so you entered /000 and everything worked great) lucky you.I would greatly appreciate if someone who has had success with a FSH4 could share their process or mods to the scripts/c program that worked for you..... as I have spent several weeks with not one valid key, still working on it tho, patient.Glad to hear someone with a FSH series had success! Any others?Hopefully others with a FSH4 or different FSH model can share their experiences also.Thanks for your time & info and great thread for sure..

author: carver
author_rank: Contributor
timestamp: February 06, 2022, 12:35:29 pm
content: these programs don't work for FSH4/ZVH4(8/etc) on the Orion platform.the new keys should be three times as long.even newer devices, like FSW/SMBV/etc, use the smart card, as your bank.Quote from: ZeusRDF on February 06, 2022, 07:50:49 am

author: radiont
author_rank: Newbie
timestamp: February 19, 2022, 12:54:21 am
content: Hi Guys,I have FSH8 option keys which were in my ZVH4 Analyser case when I purchased (Supplier Mistake I suspect) If anyone can use these let me know.Please see attached Document i've blocked out serial number and complete keys.email me direct.radio@adsl.on.net

author: Tek14
author_rank: Newbie
timestamp: April 21, 2022, 01:38:35 pm
content: Hello,I have a CMU200 with base V5.20 and VersionManager V4.06. Tried to update it with option K29 AMPS. Downloaded IS1MV5.20.exe and unpacked it with the result folder IS1MV5.20 Installed it with R&S RemoteServiceTool V1.7.1. Everything seemed to be going well. But when CMU200 rebooted, I got the message: The version you selected is corrupt! (and so on). IS1MV5.20.exe was downloaded fromhttps://gotroot.ca/cmu200/Does anyone have any idea what might be wrong?73 Anders SA0BDK

author: carvalhoatx
author_rank: Newbie
timestamp: April 21, 2022, 02:23:37 pm
content: Sir. Try to download the last version of the Firmware and all version update info with R&S website.Second. Once you cannot find with R&S website the suitable one version, message the support. They should fix this issue for you.Kind regards,

author: Tek14
author_rank: Newbie
timestamp: April 24, 2022, 11:30:50 am
content: The problem is solved.It turned out that my CMU200 was the older model with FrontModule FMR5 but it was equipped with base V5.20. Downgraded to version V5.10 and now it works as it should.

author: ktgun
author_rank: Contributor
timestamp: July 04, 2022, 10:14:53 am
content: Hi pro's!Veeeeery interesting topic and so many great ideas! I'm newbie in these "options-encrypt/decrypt things", but for me its cool opportunity to improve skills. I have some experience in R&S, Agilent, Keysight, etc. test equipment, but never wondering about options stuff and how they produce, before saw this topic.I've tested an old italian C-script from post #140 and it work's great with FSP, FSIQ, ESU, PR100, old-FSH.Now i have in my lab few FSV and have an idea to activate some option for them. Only for science interest, of course)))I make some little 'investigation' of R&S-software from FSV and FSVR with diassemblers like IDA-pro. Both SA have same software and it seems that main API is "RSCompassFramework.dll". The encrypt\decrypt options algo is similar RC4, but i'm not sure. Maybe somebody can clearify this moment?But what i know exactly, is that active option keys contained in three files: InstrumentData.xls, InstumentData.dds and IstrumentData.mac. Last two have some HEX-text, looks like some checksum. If delete any of them, active option will dissapear from SA, until you will copy a backup of deleted file and rerun "AnalyzerFirmware.exe". I don't have these three files with none-default active option, but maybe somebody will share it to look difference between HEX-text of default and none-default SA files?And finally the most interesting moment:I maked a full memory-dump for my FSV with AcessData FTK Manager, open it with WinHEX and gather all text. Then wrote little simple script in python 3.8 to filter from result text 30-digit sequences:import reimport tkinter as tkfrom tkinter import filedialogroot = tk.Tk()root.withdraw()file_path = filedialog.askopenfilename()pattern = re.compile('^\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\W')f = open(file_path)for line in f:buff_line=lineif (pattern.findall(buff_line)) == []:continueelse:print(pattern.findall(buff_line))It give me array with 18 sequences, where 2 of them was default-option keys from InstrumentData.xls. Like this:['3735038260026847987220783*****\n']['2825359980055994898912437*****\n']['1324212018274908492608555*****\n']['1613021472429378831233579*****\n']['0397841781301905908232242*****\n']I thought it was a succes, BUT none of other codes, except default, DIDN'T WORK!!!! Why? I don't know. What is these keys? I don't know too. Maybe some wise guys will tell me, where i was wrong?I will procced with my investigations and will be very glad for some feedback.P.S. I diggined many special SCPI-commands when dissasemble FSV dll's and want to try make some magic with them. If my resarch are interesting, i will be glad to post some thoughts here from time to time.

author: R-S-chx
author_rank: Newbie
timestamp: September 25, 2022, 09:51:32 am
content: hello,The keygen works perfectly for:FSH 3 serial number: 1018xxFSH 6 serial number: 1006xxthank you for your workTested for an RTM 1054 scope the serial numbers do not workI will try with an FSL3 soon

author: Jens01
author_rank: Contributor
timestamp: October 28, 2022, 10:01:11 am
content: Quote from: ktgun on July 04, 2022, 10:14:53 amthank you for sharing your journey - i also own a FSV and i failed in unlocking more options using the methods mentioned in this thread. My unit does not have any software options, but does have the B3 audio demodulator and B9 tracking gen. I'm curious to see if there is a way to unlock SW options since these units are very powerful (and the options very expensive for hobbyist..). Please let me know if i can help you in some way.

author: randolfss
author_rank: Newbie
timestamp: October 28, 2022, 01:32:14 pm
content: With a memory dump, it is likely possible. For the devices like the FSV/RTM/RTB/RTH/SMU/... that use RSCompassFramework, you need encryption keys that are unique to your individual device, so a universal keygen like in this thread is not possible. A memory dump should include the keys though if you know what to look for. The other thing you need is the mapping from "option index" to the actual option types/descriptions. If you have a device with installed options, you can get the option indexes from the output of the SCPI command :DIAGNOSTIC:PRODUCT:OPTION:LIST? (and can tie the option keys back to option descriptions with :SYST:DFPR? if needed). Otherwise you would have to find the table mapping the option indexes by reversing the firmware.

author: Astralix
author_rank: Regular Contributor
timestamp: November 19, 2022, 12:27:34 am
content: Hi!Recently restored an SMIQ03B and wonder if there is a solution for getting the B57 and B60 option going? I have seen some discussion for the AMIQ so I tried the github code. But the FME code gives me 10 digit codes and the UPL version only 5 digits.But it looks like the SMIQ wants to see 6 digits? I guess, one of the units to repair does have at least one software option, so if that helps and I get some assistance, I can provide necessary input to the developers of the codes...

author: tv84
author_rank: Super Contributor
timestamp: January 01, 2023, 02:02:40 pm
content: I've finally figured out the SMIQ/SME license construction.In the process I learnedherethat the Factory Key is used to determine the Model type of the device.So, with the right HW inside the device, we can change the device model by inserting the correct Factory Key. The other option keys will remain the same.The license algo is a very basic hash based on the S/N. Don't know if it has any similarities to AMIQ licenses...

author: tv84
author_rank: Super Contributor
timestamp: January 08, 2023, 09:52:42 pm
content: ...continuing from last post:The AMIQ licensing is totally different from the SMIQ licensing. It's a MD5 hash based on the S/N.

author: tv84
author_rank: Super Contributor
timestamp: January 16, 2023, 08:07:53 pm
content: Quote from: tv84 on January 01, 2023, 02:02:40 pmHere is the proof, of a SMIQ 04B transformed into a 06B just by inserting the corresponding Factory Key. Not a random mistake.

author: Bicurico
author_rank: Super Contributor
timestamp: January 16, 2023, 08:55:38 pm
content: Top!

author: bdbell
author_rank: Newbie
timestamp: February 02, 2023, 01:34:11 am
content: Has anyone had luck with enabling options on a SME 03? It does not have FM modulation - but I don't see the 'Option to Install' for the SM-B5 option...does this mean it can't be installed/enabled?

author: tv84
author_rank: Super Contributor
timestamp: February 02, 2023, 11:05:54 am
content: Quote from: bdbell on February 02, 2023, 01:34:11 amSM-B5 is a HW option. Not software.

author: bdbell
author_rank: Newbie
timestamp: February 02, 2023, 10:10:28 pm
content: Quote from: tv84 on February 02, 2023, 11:05:54 amThanks - that's pretty much what I figured when I found that there are several empty slots inside...not a problem really at the price I paid.I have replaced the battery which got rid of the errors I was getting before and now have just this one error - "ERROR -221 Settings Conflict; DB HW Make Error" - anyone have any idea what this means? There are no static errors - just this one error showing up on boot.

author: wiredwrx
author_rank: Contributor
timestamp: February 19, 2023, 08:17:35 am
content: Hello All,Wondering how easy it is to move the B41 option from one unit to another. Or is it easier to move some options more than others?TIA

author: wiredwrx
author_rank: Contributor
timestamp: February 21, 2023, 01:35:38 am
content: Just as a follow up, interested to know what, and how, to move the hardware between the units. I believe I can enable them using the python script and/or the IS1MV5.20 package.

author: EA1DDO
author_rank: Newbie
timestamp: February 25, 2023, 11:44:11 am
content: Is anyone able to "read" the option activation code from a ZVH4?For example:216216385720915480672293781207 (This code activates K1 Spectrum Analysis option in my device)Inside this code, it is the date, time, K1 option, etc.Anyone know how to read or decode it?

author: ARF
author_rank: Regular Contributor
timestamp: March 24, 2023, 07:54:24 pm
content: Recently I got FSH3 with firmware 6.0, SN 1014xxI need the option "K3 Receiver" I see that this feature was added in firmware 7.0.I read in detail what changed in the firmwares and found this note:New features V13.14- Option key handling modified for production reasons.Is it safe to upgrade to version 14 and then enter the keys, or do I need to upgrade to an older version first, enter the keys, and then upgrade to the latest?I mean does the key generator work on version 14?

author: carver
author_rank: Contributor
timestamp: March 24, 2023, 08:47:40 pm
content: you can update to the latest version.then enter any options keys.

author: goaty
author_rank: Regular Contributor
timestamp: March 25, 2023, 06:02:28 am
content: Works perfectly on Version 14.Only I have never found out the full option list and what the "Demo" Stuff does...

author: Robert763
author_rank: Super Contributor
timestamp: April 04, 2023, 06:28:30 pm
content: Demo enables all the options for a limited period of time.

author: ARF
author_rank: Regular Contributor
timestamp: April 12, 2023, 02:39:03 pm
content: Quote from: Robert763 on February 01, 2022, 02:04:44 pmI have successfully enabled options on my FSH3-03 with firmware 6.0, SN 1014xx. First I updated the firmware to 14.0 (latest), then I used the script.There were no problems.ADDED:The battery inside my FSH3 is disconnected. After disconnecting the power supply and connecting it back - the options are gone (not installed) My options live until the power supply is connected. It cannot be that they are not stored in non-volatile memory. Very strange.UPD2: Yes, the options are reset along with the clock and settings. So they are stored in the CMOS memory. It's funny that the saved spectrograms are stored in EEPROM))For updating, I used the Fluke PM9080 cable. It's definitely a Chinese copy (low quality plastic), but it fits well and works correctly in Windows 10. $44 + shipping.https://item.taobao.com/item.htm?spm=a1z09.2.0.0.7eed2e8dDbZOFu&id=549550337853&_u=c2jnfgou9e2fR&S FSH-Z37 = Fluke PM9080 USB optical cable.UPD: The board inside is very good, maybe it's not a copy or a very good copy.

author: ARF
author_rank: Regular Contributor
timestamp: April 13, 2023, 08:43:48 am
content: Guys, if someone has FSH3 too without a battery. Can you confirm that options are stored in CMOS?Can anyone share a fresh FSHRemote?

author: goaty
author_rank: Regular Contributor
timestamp: April 13, 2023, 09:05:07 am
content: I can tear mine apart maby next week and remove battery for a few hours.But I doubt serial etc is not in FLASH.Maby there´s a supercap somewhere ?

author: ARF
author_rank: Regular Contributor
timestamp: April 13, 2023, 10:31:21 am
content: Initially, I received my FSH3 with a well-known problem - a burnt FET transistor. When I changed the transistor, I did not notice any other power sources besides the battery.

author: ARF
author_rank: Regular Contributor
timestamp: April 15, 2023, 01:23:12 pm
content: Quote from: hafrse on April 15, 2021, 06:58:50 pmThe same issue. I guess the options on FSH3 in the CMOS))Guys, you know, this so stupid.The solution with CMOS is generally not very good and this can be justified for devices of the 80-90s, but at least lithium batteries were used there and had a service life of 20 years or more.The self-discharge of the NIMN battery is about a year, and several months when it is inserted into the device and powers some kind of logic.You haven't used it for several months - your options are gone and it's good if you have a sticker with a code)))You decided to carry out repair - the options are gone.Cool)

author: ua4yhz
author_rank: Regular Contributor
timestamp: April 28, 2023, 05:10:12 pm
content: How to remove an option in FSH6?

author: ARF
author_rank: Regular Contributor
timestamp: April 28, 2023, 07:44:34 pm
content: Disconnect a battery inside, I guess.

author: ua4yhz
author_rank: Regular Contributor
timestamp: April 30, 2023, 09:18:12 am
content: Quote from: ARF on April 28, 2023, 07:44:34 pmI tried, with FSH6 such a trick does not work.

author: G.Christofi
author_rank: Newbie
timestamp: July 11, 2023, 04:04:01 pm
content: Ok, I'm late to this party but I have my CMU200 and have just done the firmware update to 5.22. I have a fair bit in mine but I'd like to activate some of the other options.I'm fairly confident with hardware but running scripts and things is a skillset I have yet to develop. Is there a step by step guide to using the 'keygen' somewhere so I can try to help myself? I can install software on my pc if needed and I'm ok with copying files etc using dos but beyond that I'm somehow not understanding what I need to do to run the keygen.Help in this would be much appreciated.George

author: eb4fbz
author_rank: Regular Contributor
timestamp: October 09, 2023, 11:47:01 am
content: Any idea about NGE102B options? They seems to be made of 30-digit numbers.NGE-K101 LAN (LXI) : 120 EURNGE-K102 Wireless LAN : 180 EURNGE-K103 Digital I/O (4bit): 90 EURThe hardware is there.

author: FlashPT
author_rank: Newbie
timestamp: December 11, 2023, 10:12:40 pm
content: Hello, to unlock RTM 3004 to 1GHz.does the keygen work?need help please.Thanks.

author: eb4fbz
author_rank: Regular Contributor
timestamp: February 06, 2024, 11:14:04 pm
content: Quote from: ARF on April 13, 2023, 08:43:48 amUser added options are stored in RAM. Factory installed options are stored in flash.

author: drhex
author_rank: Regular Contributor
timestamp: February 16, 2024, 11:01:21 pm
content: @sergeyklenov Tried to PM in case you‘re still on here, not sure of success

author: KonstantinKo
author_rank: Newbie
timestamp: March 12, 2024, 01:21:09 pm
content: HelloI sometimes take the FSH20 to use.Can anyone help with the key to the waterfall option on FSH20?Is there a working keygen for this device?How can I make a backup of the firmware before the changes?Thanks for the help

author: sezhReppo
author_rank: Newbie
timestamp: March 15, 2024, 07:35:39 am
content: Hi!I turned off the batteries on my FSH3 for almost a day, the options remained unchanged.I need help. We need FSH View software for FSH3. Can anyone help?

author: eb4fbz
author_rank: Regular Contributor
timestamp: March 25, 2024, 06:51:02 pm
content: Quote from: sezhReppo on March 15, 2024, 07:35:39 amhttps://we.tl/t-2bL96LII03

author: pdenisowski
author_rank: Super Contributor
timestamp: March 25, 2024, 09:11:55 pm
content: Here's the installer I got from one of my coworkershttps://tinyurl.com/db5w4enz

author: goaty
author_rank: Regular Contributor
timestamp: March 26, 2024, 06:32:27 am
content: Lates FSHView I´ve got here is 14.20.

author: MeasureMan
author_rank: Newbie
timestamp: March 26, 2024, 05:06:07 pm
content: Hello!I have base model of R&S RTH1004. Can anybody help me to activate more wide bandwith?Thanks!

author: imaurente
author_rank: Contributor
timestamp: April 17, 2024, 10:13:56 am
content: Hello, I have the same problem, I need to enable the IQ, DAB and ISDB-T features on my SFE100, has anyone discovered anything???

author: Ennio
author_rank: Newbie
timestamp: April 24, 2024, 08:20:24 pm
content: Hi, I have an R&S ETC and I would like to know how to find out the key to unlock the K240 option for DVBT-2 with the hardware already installed, how can I do it since it can no longer be purchased? Thank you.

author: Ennio
author_rank: Newbie
timestamp: April 28, 2024, 01:09:10 pm
content: Hello everyone, can anyone help me solve the problem?

author: Ennio
author_rank: Newbie
timestamp: May 01, 2024, 01:53:35 pm
content: An original key for the ETC in my possession is: 066379365018881348971792051684 relating to the K140 option. In the results of main.c this type of key does not appear but only 10 numbers. How to solve the problem for the K240 always with 30 numbers?

author: hihiwifi
author_rank: Newbie
timestamp: May 03, 2024, 07:15:01 am
content: I have a PR200 with the Panorama Scan and Time Domain options installed, I can provide firmware, software, documentation(Full manual, pretty sure its 600 pages or something), etc. to anyone who would like to give cracking the option encryption a shot. I would imagine this encryption is still being used on the latest devices, so it may be worthwhile to look into.The firmware is just an .itb file that can be extracted in HexWalk leaving you with a .squashfs archive which I assume is what has the good stuff in it, a 10MB "C0" file, and an 83.8MB C0.gz file.Poked around in the .squashfs file for a bit, to say it's intimidating is an understatement. Ended up finding the lines of code where it calls openssl/crypto when you go to type in the option key, but I have no idea where to go from there.As the PR200 is Rohde's latest portable receiver, I cannot provide option keys for security reasons.

author: mr ed
author_rank: Regular Contributor
timestamp: May 14, 2024, 01:45:51 am
content: ...SMIQ what would be the simple hash???

author: luc-on7kz
author_rank: Newbie
timestamp: May 27, 2024, 07:59:18 am
content: HelloI try to access these linkhttps://bitschubbser.org/nextcloud/index.php/s/6TCghFbYMsbkfph(PW: eevblog)but it give me a error "Page not found"who can help me and give me a link where I can download the AMPS firmware (and more)thanksLuc

author: ve7xen
author_rank: Super Contributor
timestamp: May 27, 2024, 05:22:28 pm
content: https://gotroot.ca/cmu200The AMPS firmware is part of the IS136 package IIRC.

author: leakyDiode
author_rank: Newbie
timestamp: May 29, 2024, 08:28:30 pm
content: I want to share with you my key generator for SMx (SME, SMT, SMP) and SMIQ signal generators. It can generate keys for software options and factory installation keys (aka signal generator personality). The output is a 6 digit number. Please don't laugh at the used encryption methodHow to use it:Edit the c-file and add your serial number, SMIQ flag. See comment "UPDATE below variables"Compile with: gcc -o SMx SMx.cRun with: ./SMxProfitThis key generator has been tested with SME and SMIQ generators.Once a key has been entered I haven't found a way on how to remove it, but based on the firmware it's possible to remove installed keys and options. If somebody knows how, please share the procedure.It might be possible that this generator could generate as well keys for other instruments from the same era, but this has not been further explored yet.

author: tv84
author_rank: Super Contributor
timestamp: May 29, 2024, 09:59:26 pm
content: Well done. I hadn't noticed that the lookup table was a CRC16..From my notes:SMIQB51 - 1105.1831.02 - GPS

author: Gian2975
author_rank: Contributor
timestamp: May 30, 2024, 07:32:40 pm
content: HI,I have an FSH3.23 I would like to calibrate the reference at 10MHz.It seems to be possible only with specific software.I see that among the options that can be enabled there is also this:Cal. Allowed (k15)Would it be possible to proceed with the calibration manually with this option?If you have already installed it, can you check?Or do you have any idea what software you can use to perform the calibrationThank you

author: Gian2975
author_rank: Contributor
timestamp: June 02, 2024, 05:52:17 pm
content: Hi,I managed to enable all available options, but unfortunately this problem happened.The span steps are incorrect, and the up and down keys are reversed.It already had firmware version 14.0, I tried to update again, but unfortunately it didn't solve the problem.Some parameters seem to have been compromised.I attach a short video to help me understand the problem.I have already tried all the resets possible but I haven't solved the problem.Now I would like to try removing the options but it doesn't seem feasible.Do you have any ideas?Thank youLink video:https://www.youtube.com/shorts/YofmDIOqMxk

author: drhex
author_rank: Regular Contributor
timestamp: June 11, 2024, 09:07:19 am
content: And another request for option codes for SMU200A - does anybody have a keygen? Also looking for the calibration software, if anybody has a link I'd be grateful!

author: KeBeNe
author_rank: Regular Contributor
timestamp: June 20, 2024, 03:43:01 am
content: Quote from: leakyDiode on May 29, 2024, 08:28:30 pmJust as a hint,The options for the SME, SME32;33;36 , as well as SME42;43;46 are not software options, but change the device type!(e.g. an SME-02 becomes an SME-32, an SME-03 -> SME-33 etc.)So please do not use them, you will make your device almost unusable!in case someone was so hasty, the keys are entered in Prot-Level3, uninstalling the keys worked for me by entering them again in Prot-Level2.The SME-B41 to B43 options require the SME-B12 option in addition to the SME-B11 option.

author: aXerman
author_rank: Newbie
timestamp: June 26, 2024, 04:22:37 pm
content: If you have an updated link for the FSHView software I would be forever grateful!

author: goaty
author_rank: Regular Contributor
timestamp: June 26, 2024, 07:34:26 pm
content: There is no public link for FSHView, one has to ask RnS.I can send 14.20 via eMail if necessary.

author: carver
author_rank: Contributor
timestamp: June 26, 2024, 07:49:05 pm
content: FSHView_V1420_setup.exehttps://mega.nz/file/zhY0gbJC#Bu-i3R71GKtG8LbKq4M-O9g96m1KuGGTUUSMFhrzffothis is for the old FSH. for the new FSH - all versions at first google links.

author: pdenisowski
author_rank: Super Contributor
timestamp: June 26, 2024, 11:06:13 pm
content: There are basically three software packages for FSH (all free of charge)- FSH3/6 uses the FSHView Software- FSH4/8/up can use either the FSH4View Software or the newer InstrumentView softwareSo unless you're running an FSH3/6, you can download the software directly from the R&S websitehttps://www.rohde-schwarz.com/software/fsh/I have FSHView V13.12 from a colleague of mine if anyone needs it.

author: aXerman
author_rank: Newbie
timestamp: June 28, 2024, 02:15:35 pm
content: Quote from: carver on June 26, 2024, 07:49:05 pmThis is the one I'm looking for, thanks! I have an old FSH3 that I have been playing around with, and another in pieces with damaged RF input melf resistors and non-functioning display I have yet to track down replacements for.

author: Chefbastler
author_rank: Newbie
timestamp: July 19, 2024, 01:59:00 pm
content: Hello, I have an R&S FSL3 Spectrum Analyzer.Has anyone found a keygen generator for the box?

author: carver
author_rank: Contributor
timestamp: July 19, 2024, 02:23:37 pm
content: there are no such programs for FSL3.you can contact anyone, who takes them from the R&S site,but can sell much cheaper. for example to me.I work with FSL3/FSL6 before.

author: Ksi
author_rank: Newbie
timestamp: September 28, 2024, 12:19:19 pm
content: I have updated the firmware from 5.0 to 14.0 in my FSH3, but now it won't boot anymore. Can someone share me older versions from v5 and the like? Or come up with tips how I can get my instrument working again?

author: KaneTW
author_rank: Frequent Contributor
timestamp: October 02, 2024, 01:35:36 pm
content: What's the current state of option unlock hacks for the RT* series? (RTO2000 etc.)

author: dr3hl3rt
author_rank: Newbie
timestamp: October 07, 2024, 03:43:33 pm
content: I have a CBT bluetooth tester, and would really like the BLE option (K57)any ideas?

author: LazyJack
author_rank: Frequent Contributor
timestamp: October 10, 2024, 06:50:27 pm
content: I have a CMU200 and I'm trying to get the K14 (Stereo FM) option working. Now here is the interesting thing. There is nothing in the SWOPT.DAT file. Loads of options are enabled by default, related to mobile phone testing. There are a few that are not enabled, and K14 is nowhere to seen.I can use the key generator to generate keys, which are accepted, get written into the SWOPT.DAT file, but does not enable the option. Even if I edit the file, the option will not appear. I don't care about the various cell phone testing options, but I'd really like to get the stereo fm modulation working. Is it possible that some units have hard-code options and SWOPT.DAT is ignored? It is a 1100.0008.10 unit, if that matters.

author: tv84
author_rank: Super Contributor
timestamp: October 10, 2024, 08:20:37 pm
content: Are you looking at the correct file?

author: LazyJack
author_rank: Frequent Contributor
timestamp: October 10, 2024, 09:00:11 pm
content: Yes. Definitely. If I enter an option from the setup menu, the code is accepted and it appears in the file. But the option is never enabled. Even if I clear the content of the file, the list of enabled options doesn't change. A number of options, like stereo fm or time based demo don't even appear on the list.That is why I wonder if some units may have some kind of hardcoded option list based on the hw config. I even tried with a disk image from an other unit and it behaves the same. So it is not a softwer configuration question.

author: Ksi
author_rank: Newbie
timestamp: October 11, 2024, 11:33:30 am
content: Hello friends!I have an FSH3 and would like help to box up the K3, Receiver. Can someone help me with the code?serial number 100652

author: salomonander
author_rank: Regular Contributor
timestamp: October 11, 2024, 11:47:00 am
content: As someone has asked previously: is there such a keygen for the RTB scopes?

author: sergeyklenov
author_rank: Contributor
timestamp: October 11, 2024, 11:55:56 am
content: Possible but need read eeprom with jtag

author: salomonander
author_rank: Regular Contributor
timestamp: October 11, 2024, 12:03:34 pm
content: In case there is anyone with an RTB willing to do this: you would be my personal hero 🤩

author: salomonander
author_rank: Regular Contributor
timestamp: October 11, 2024, 03:42:41 pm
content: Judging from my question - considering what i just learned - i guess im not qualified to do so 🤣 thxEdit: seems like nobody had success on the RTB scopes. Darn.

author: MorzeCBP
author_rank: Newbie
timestamp: October 11, 2024, 06:42:40 pm
content: Quote from: Ksi on October 11, 2024, 11:33:30 am2963101246 Demo Mode1551245422 DTF B10455019671 Vector Calibration K20222793566 Remote Control K13059944510 Receiver Measurement K34013401352 Restricted Acc K603069895097 Calibration Allowed K15

author: Ksi
author_rank: Newbie
timestamp: October 13, 2024, 08:12:06 pm
content: Thank you so much, you are gold 🙏

author: radiomechanic
author_rank: Newbie
timestamp: October 22, 2024, 10:46:34 pm
content: Hello, friends!Today, after flashing FSH6 to version 14, I noticed that the screen refresh is slower than before. Keep this in mind when updating.

author: ve7xen
author_rank: Super Contributor
timestamp: October 24, 2024, 06:37:18 pm
content: Hey folks, I wanted to play around with running 'desktop apps' on the web with egui + Rust + wasm. Long story short I made a keygen app, It should work for the CMU200 and related units, and the FSxx units. I included all the known seeds for the FSxx units, but I don't know how validity / description maps to different models. Descriptions are just from the original Post #7 code. If anyone has model-specific lists etc. I can incorporate that. Feedback is welcome.https://rohde.nonexistent.ca/

author: cgroen
author_rank: Unknown
timestamp: October 24, 2024, 07:59:57 pm
content: Am I right in assuming that none of this will work for a SMU200A ?

author: tv84
author_rank: Super Contributor
timestamp: October 24, 2024, 08:25:25 pm
content: Quote from: cgroen on October 24, 2024, 07:59:57 pmRight on.

author: cgroen
author_rank: Unknown
timestamp: October 25, 2024, 04:05:11 am
content: ThanksHad a feeling that was indeed the case.

author: LazyJack
author_rank: Frequent Contributor
timestamp: October 25, 2024, 03:47:00 pm
content: It seems like that the 1100.0008.10 model (called 'high end service tester') of the CMU200 has a fixed set of options, based on what hardware is installed and no other options can be enabled. Now it would be interesting to find out where it stores the model number and see how it can be changed. It needs to be changed to 1100.0008.02 'universal radiocommunications tester'.

author: dr3hl3rt
author_rank: Newbie
timestamp: October 25, 2024, 04:20:25 pm
content: Anyone had luck with the CMW500?

author: MorzeCBP
author_rank: Newbie
timestamp: October 25, 2024, 08:44:00 pm
content: Quote from: radiomechanic on October 22, 2024, 10:46:34 pmДержи:3764584245 Demo Mode3087642571 DTF B11944932055 Vector Calibration K22480215784 Remote Control K14021211727 Receiver Measurement K33323216289 Restricted Acc K600027545025 Calibration Allowed K15

author: romal76
author_rank: Contributor
timestamp: October 31, 2024, 04:06:31 pm
content: is there a way to activate options in SMW200A ?

author: amirrezam
author_rank: Newbie
timestamp: November 04, 2024, 08:20:22 am
content: Hii have a PR100 R&S and i read its user manual specifically SCPI partbut it didnt mention about receiving data from device in each sweep and change trace to max hold or clear writedoes anybody know about SCPI commands of this device?

author: MorzeCBP
author_rank: Newbie
timestamp: November 11, 2024, 07:59:38 pm
content: Quote from: amirrezam on November 04, 2024, 08:20:22 am

author: meanmalab
author_rank: Newbie
timestamp: November 22, 2024, 12:22:02 am
content: Hi!I accidentally bought a vanilla ZVL13 and it turns out R&S isn't selling the ZVL-K1 Spectrum Analyzer (software) option any moreThe ZVL really feels like half an instrument without the SA option, so I'm bummed.I've read through this entire thread (very interesting in general) hoping to find some clues if it'd be possible to unlock ZVL-K1.In reply #266 someone mentions the FSH20 uses the R&S Orion platform, that it's "WinCE on Flash". I think this might be the case for the ZVL as well after finding some photos (external to this forum) dissecting the HW to fix the PSU. It's definitely some sort of embedded WinNT/CE. Around reply #185 someone was trying to reverse engineer an OptionKeyServices.dll for a ZVB8 and I can confirm this DLL also exist on the ZVL. I got no further dissecting it, just getting stuck in some OLE/COM DLL rabbit hole, where I'm unsure if it's possible to extract useful COM interface/type information somehow or if it's stripped out. Perhaps it can be done by digging out information in the Windows registry? I could not find traces of any "HKEY" string in the .dll binary, e.g. pointing to Windows registry keys (as found on the ZVB8 in reply #185), so it might simply not be the same .dll implementation on the ZVL. Although I did find traces of ZVL options in the Windows registry when searching it directly, I'm not sure it's related to unlocking options, or if it's more of a software architecture thing.I also found a "R_S/Instr/eeprom/xml/InstrumentData.xml" file. This file clearly lists out all the options installed, with some kind of chronological timestamps and serial numbers, instrument DeviceKey (258 hex numbers / nibbles), OptionKey (30 decimal numbers), option_index, etc. But I'm not sure if this .xml file really affects anything on the system or if it's just some human readable dump from some EEPROM on the motherboard that holds the real options programming?By chance I have access to a second ZVL13 where the K1 option is installed. This is the ZVL I've been studying so far. I haven't really started to compare it against mine (without the K1 option). I suppose comparing the InstrumentData.xml files might give something.Anyone here have any further ideas?

author: Norwaro
author_rank: Newbie
timestamp: December 06, 2024, 05:49:51 pm
content: A wonderful good evening everyone!I likewise have an ZVR and would like to enable the rest of the options, especially Time Domain. I tried for hours to find the pattern and create the keys, though using ARC2 brought no results. I dunno if there is a salt involved or XOR algorythm, couldn't get any results that worked...My SN is the 846939/006. Could anyone please help me here? I really don't know any further :/Thank you so much in advance.

author: bav
author_rank: Newbie
timestamp: December 11, 2024, 03:48:25 pm
content: Hello!I do have FSV7 device. Is there any keygen to activate the options? Any ideas appreciated

author: stepN.6072
author_rank: Newbie
timestamp: January 11, 2025, 06:19:51 pm
content: Hi LazyJack.I'm struggling with this too. The key gen from this thread works great, for model .02, it doesn't work for model .10. I couldn't figure out where the information is stored. If I put a pc and hdd from model .02 into cmu 1100.0008.10, it boots as model .10. So the type and serial number information will be on the motherboard or in the cmu-B21 card? I can't think of anything elseEdit:I think I found itEeprom located under the power supply. Type X24645. It will definitely be locked.

author: pdenisowski
author_rank: Super Contributor
timestamp: January 13, 2025, 12:57:56 pm
content: Quote from: amirrezam on November 04, 2024, 08:20:22 amKeep in mind that the PR100 is a receiver, not a swept (heterodyne) style spectrum analyzer - it basically acquires spectrum in 10 MHz “chunks” and performs an FFT on them. SCPI programming commands for the PR100 will therefore be different from those used in a portable spec a like the FSH.But you absolutely can acquire and process the data via SCPI

author: torosa12
author_rank: Newbie
timestamp: January 25, 2025, 08:43:28 am
content: Hello,i also did investigate reversing option code encryption for newer R&S instruments like ETL.It uses the long 30-digit key.Is there anybody who knows more about it (maybe won't share it to pblic)?If so please pm me, i am very interested in it and could provide other license generators for radio equipment.I did investigate R&S Option key encryption on NRPV.exe (NRPV Software for use with power sensors.)I entered (wrong) code and debugged SW.I see that SW does the following with the entered key:It does multiply first digit by 10 (0xA), adds the next digit, multiplys again with 10 (0xA), adds the next digit and so on.License Key: 39 85 31 34 42 02 58 53 47 46 26 30 69 80 69in NRPV.exe:call bei 0x0100768F:3 * 0xA = 0x1E + 9 = 0x27* 0xA = 0x186 + 8 = 0x18E* 0xA = 0xF8C + 5 = 0xF91* 0xA = 0x9BAA + 3 = 0x9BAD* 0xA = 0x614C2 + 1 = 0x614C3* 0xA = 0x3CCF9E + 3 = 0x3CCFA1* 0xA = 0x02601C4A + 4 = 0x02601C4E* 0xA = 0x17C11B0C + 4 = 0x17C11B10* 0xA = 0xED8B0EA0 + 2 = 0xED8B0EA20 * 0xA = 0x0 + 0 = 0x00* 0xA = 0x0 + 2 = 0x2* 0xA = 0x14 + 5 = 0x19* 0xA = 0xFA + 8 = 0x102* 0xA = 0xA14 + 5 = 0xA19* 0xA = 0x64FA + 3 = 0x64FD* 0xA = 0x03F1E2 + 4 = 0x03F1E6* 0xA = 0x2772FC + 7 = 0x277303* 0xA = 0x018A7E1E + 4 = 0x018A7E22* 0xA = 0x0F68ED54 + 6 = 0x0F68ED5A0 * 0xA = 0x0 + 2 = 0x02* 0xA = 0x14 + 6 = 0x1A* 0xA = 0x104 + 3 = 0x107* 0xA = 0xA46 + 0 = 0xA46* 0xA = 0x66BC + 6 = 0x66C2* 0xA = 0x40394 + 9 = 0x4039D* 0xA = 0x282422 + 8 = 0x28242A* 0xA = 0x019169A4 + 0 =* 0xA = 0x0FAE2068 + 6 = 0x0FAE206E* 0xA = 0x9CCD444C + 9 = 0x9CCD4455Did anyone see such a processing of entered keys?Again, thanks in advance for reply.Kind Regards.

author: 58kk90
author_rank: Newbie
timestamp: January 26, 2025, 05:11:26 am
content: Does anyone know if this thread is applicable to the CMS range or RF test sets?I have an old CMS36 test set with the avionics options, but it does not have the tracking generator option enabled, which I think is option CMS-B59 (could be wrong as it's hard to find a full option list online now as these are quite old).I would love to get the option enabled if possible, and i'm hoping the keygen in this would help with that if anyone is able to confimr plase.Tony

author: simonov
author_rank: Contributor
timestamp: January 30, 2025, 09:04:11 pm
content: I'm happy to report that the serial number generator in post#367 works!I managed to score a working CMU200 for $185. It had slightly damaged LCD but still functional enough to be usable. It came loaded with CMU-B41 and a second generator board. I managed to enable the FM Stereo option with no problems.

author: tv84
author_rank: Super Contributor
timestamp: January 30, 2025, 09:42:50 pm
content: Quote from: ve7xen on October 24, 2024, 06:37:18 pmI have these additional licenses (taken from a FSP .DLL) laying around. Extracted many years ago...

author: D2236
author_rank: Regular Contributor
timestamp: January 31, 2025, 07:54:07 pm
content: I had some unexpected results on my FSEB 20, using the keygen. This unit showed no installed firmware options before I started. I generated the codes for "K40 - Phase Noise Measurement" and "K30 - Noise Figure Measurement." It accepted the first one, but with the last one it requested to install "K72 prior K74" first. When I installed this, it activated a completely unexpected option "K12 Digital Standards ICO" which is not shown in the option list. When I tried again to install K30, it again asked me to install K72 prior K74. When I tried installing it once more, it indicates that this option was already installed. This is the only installed option shown under Info. I can't see that it installed the Phase Noise option. I know my unit had a a Phase Noise menu button before, so maybe it got ignored? The K12 option seems to be active and functional.The unit came with B7 - Vector Signal Analysis hardware installed.

author: tv84
author_rank: Super Contributor
timestamp: February 01, 2025, 12:12:16 pm
content: Quote from: D2236 on January 31, 2025, 07:54:07 pmAlthough the keygen generates valid codes, the options vary according to each FSxxx device. So, you are inserting invalid options for your device.I think you should use the attached list of options.Try and report.

author: D2236
author_rank: Regular Contributor
timestamp: February 01, 2025, 09:07:24 pm
content: I used the online generatorhttps://rohde.nonexistent.ca/earlier in this thread with my serial839062/002and it gave the list below.From the list you provided it will be great to get the FFT and ESI option for my unit. I am not interested in any of the rest.It appears that the ESI is firmware based and FFT requires installed hardware. Still, the ESI will be very useful.Thanks4068241614 - K5 - GSM/EDGE Application Firmware2790122035 - K7 - AM/FM/PM Measurement Demodulator1337183645 - B17 - IQ Online4164823360 - None2543875997 - K84 - 1xEV-DO BTS Application Firmware3696822376 - K84 - 1xEV-DO MS Application Firmware1291491057 - None2844105763 - FSP-B15 FSP-B70 FS-K70191948870 - K72 prior K740385991341 - None2710156630 - K9 - Power Meter1559826699 - FSP-B15 FS-K70947443661 - None2528068337 - None2566209011 - K76 - 3GPP TD-SCDMA BTS Application Firmware2214642442 - K77 - 3GPP TD-SCDMA MS Application Firmware3461591598 - K30 - Noise Figure Measurement0885987233 - K82 - CDMA2000 BTS Application Firmware2915567909 - K83 - CDMA2000 MS Application Firmware0007213584 - K8 - Bluetooth Application Firmware1211025853 - K40 - Phase Noise Measurement2683654821 - None3431503778 - None2684199753 - None2293114792 - None2143980092 - 31 days trial period0035180749 - 78 days trial period3515815711 - None0784892192 - None0303469494 - Frequency Extension0157614633 - None

author: tv84
author_rank: Super Contributor
timestamp: February 02, 2025, 06:00:39 pm
content: Quote from: D2236 on February 01, 2025, 09:07:24 pmSo, just use like this:S/N: 839062/02 OptIndex_000: 4068241614 K10 - GSM MS AnalyzerS/N: 839062/02 OptIndex_001: 2790122035 K11 - GSM BTS AnalyzerS/N: 839062/02 OptIndex_002: 1337183645 B5 - FFTS/N: 839062/02 OptIndex_003: 4164823360 ESI - ESIS/N: 839062/02 OptIndex_004: 2543875997 Kxx - Receiver ModeS/N: 839062/02 OptIndex_005: 3696822376 FSQ - FSIQ ApplicationS/N: 839062/02 OptIndex_006: 1291491057 K71 - CDMA ONE BTS AnalyzerS/N: 839062/02 OptIndex_007: 2844105763 K72 - W-CDMA BTS AnalyzerS/N: 839062/02 OptIndex_008: 0191948870 K12 - Digital Standard ICOS/N: 839062/02 OptIndex_009: 0385991341 K20 - EDGE MS Analyzer ExtensionS/N: 839062/02 OptIndex_010: 2710156630 K21 - EDGE BTS Analyzer ExtensionS/N: 839062/02 OptIndex_011: 1559826699 K73 - W-CDMA MS AnalyzerS/N: 839062/02 OptIndex_012: 0947443661 K30 - 850 MHz Extension for K10/K20S/N: 839062/02 OptIndex_013: 2528068337 K31 - 850 MHz Extension for K11/K21S/N: 839062/02 OptIndex_014: 2566209011 B31 - FREQ LIMIT 31 GHZS/N: 839062/02 OptIndex_015: 2214642442 B40 - FREQ LIMIT 41 GHzS/N: 839062/02 OptIndex_016: 3461591598 K74 - W-CDMA HSDPA BTS

author: D2236
author_rank: Regular Contributor
timestamp: February 02, 2025, 10:23:02 pm
content: Thanks for your help!Ok, so I uninstalled the K12 Digital Standards, then installed the ESI. The EMI receiver menu appeared, but it is not functional, as you can't enter any parameters without getting "parameter not supported" message. It shows a graphing area, but no buttons on the side menu work. Maybe the box needs additional hardware for this to work. Then I installed the FFT option, and that seems to be functional. I am happy about this.Can someone give more info about the ESI and the Kxx Receiver mode options? I couldn't find any documentation on these.

author: KeBeNe
author_rank: Regular Contributor
timestamp: February 03, 2025, 12:48:52 am
content: Hi,the ESI and Kxx options are intended for the R&S ESI and require a different HW, visually the ESI looks like the FSEx series, but has slightly different HW.Please do not activate these options, this will be a problem!For the FSEx and FSIQ series there was no implemented phase measurement (FSE-K4) and noise figure (FSE-K3) measurement, these were extra programs

author: D2236
author_rank: Regular Contributor
timestamp: February 03, 2025, 01:57:28 am
content: The ESI created the button EMI receiver under the modes. Luckily, it looks like it hasn't screwed up the unit as far as the rest of the functions. The only thing I noticed was that it also added another entry "RES BW, 3dB/6dB" under the Coupling Function menu, just below original RES BW AUTO button. If you press this button, it locks up the unit, and you need to power off and restart.As mentioned in an earlier post, the EMI menu stays put even after you uninstalled all the options.Thanks for the info.

author: KeBeNe
author_rank: Regular Contributor
timestamp: February 03, 2025, 03:35:19 am
content: Yes, it has also created new RBW, these can cause your device to no longer pass the Cal.If you have created an original image, you should use this again as it now has errors

author: D2236
author_rank: Regular Contributor
timestamp: February 03, 2025, 04:25:11 am
content: Quote from: KeBeNe on February 03, 2025, 03:35:19 amI ran a full cal and everything passed. I have a spare HDD clone copy if I need to restore everything.

author: ve7xen
author_rank: Super Contributor
timestamp: February 03, 2025, 06:46:13 am
content: Thanks for that, I've updated the keygen to give different descriptions for different models, with those details.I saw your previous post with extracted options but couldn't quite figure out how to correlate appropriately with a model breakdown. Are these options all for FSP series? Some of them seem related to other units?

author: mrcurlyman
author_rank: Newbie
timestamp: February 16, 2025, 05:50:37 pm
content: how did you enable the fm stereo in the generator?

author: simonov
author_rank: Contributor
timestamp: February 20, 2025, 08:46:34 pm
content: In my unit the FM stereo option was already installed(but not enabled). I just entered the key generated by the keygen.

author: Runner
author_rank: Newbie
timestamp: March 20, 2025, 11:53:40 am
content: Quote from: simonov on February 20, 2025, 08:46:34 pmHello! I am a newbie and I don't understand anything about electronics. However, I have the opportunity to buy a Rohde & Schwarz FSH3. I would like to use it as a monitoring receiver. Can you please tell me what I need to do for this? How to install the Receiver mode option?According to the user manual for the Rohde & Schwarz FSH3, this may be available and displayed on the screen.Thank You in advance!

author: pdenisowski
author_rank: Super Contributor
timestamp: March 20, 2025, 02:40:03 pm
content: Quote from: Runner on March 20, 2025, 11:53:40 amWhen you say "monitoring receiver" do you mean using it to make EMI measurements as a stepped scan? This is what "receiver mode" is on FSH analyzers.Some people use the words "monitoring receiver" in the sense of a real-time, FFT-based "receiver" for spectrum monitoring, e.g. like the PR200 portable receiver. This is not supported on the FSH series because it does not contain the HW needed to make real time (i.e. non-swept/heterodyne) measurements.

author: matthieu.e
author_rank: Regular Contributor
timestamp: April 14, 2025, 08:44:42 pm
content: Hello,I am looking for a keygen for a R&S SMJ100A unit (SN100432).Did someone made any progress on this ?In the install sw menu option, it ask a 30 caracters key

author: hkv
author_rank: Newbie
timestamp: April 28, 2025, 08:45:35 am
content: Looking for keygen to enable options for RTH1004. Possible or no working solution available?

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: May 05, 2025, 12:30:08 pm
content: hii have worked for R&S. the key system and its generator is very secret as its a source of revenue. i can provide you some hints based on my finding.The active keys are in a some kind of start up file. this file is referred to each time when the equipment is booted to load new optionsif this file is modified, a new file will be created at boot up. so what ever you modify will be gonethere is will a small memory on some main module which is likely to have the installed key optionsin the windows services, there will be some kind of license manager application that would be running. this app has the capability to modify that flash memory and create a new startup file.you may like to note that whenever a new license key is added, the equipment need a reboot for that license to be active.

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: May 05, 2025, 12:38:41 pm
content: Quote from: torosa12 on January 25, 2025, 08:43:28 amETL is actually based on FSL and ZVL..so the keysgen of all three should be indentical

author: yoshihi
author_rank: Newbie
timestamp: May 20, 2025, 01:24:23 am
content: I'm using the ZVH4 as a hobby.Unfortunately, my ZVH4 doesn't have options like the spectrum analyzer, so its use is somewhat limited.Would anyone be willing to share a keygen?

author: squadchannel
author_rank: Frequent Contributor
timestamp: May 20, 2025, 03:07:31 am
content: https://www.eevblog.com/forum/testgear/enabling-options-for-rohde-schwarz-fsh-series-(discontinued)-analyzers/msg2651010/#msg2651010laserK has not been seen since 2021. send him a PM and see what happens.https://www.eevblog.com/forum/profile/?u=110796ZVH is still available. Options are also available for purchase.if R&S's profits are harmed, we are the ones who are in trouble. we do not want to unlock the options on products that are not even discontinued.

author: sotto
author_rank: Newbie
timestamp: May 26, 2025, 10:39:16 am
content: I’m a great proponent of R&S, using their test gear daily at work. I am also a thrifty hobbyist and not a throw away person. I don’t want to see a good instrument go to waste when there is still relevant use for it. I have the SFE Broadcast tester from around 2008. A discontinued and unsupported product, more humble than the CMU, if there is such a humble product in the R&S range. This is probably relevant to many other instruments of that time.The SFE requires a 30 digit decimal as the option key. In the initial configuration files and using a hex editor, on one of the .dfl files, I found all the K (software enabled) options and 7 bytes later a 16 byte sequence.I believe these 16 bytes are the secret keys used along with the instrument serial number to confirm a correct option key has been entered. I think it uses RC2 crypto and that the option key can be determined from the serial and secret key.Below is the detail of option K170 AM/FM/RDS, as it appears in hex and the serial number (there is no fractional part). Can anyone help to determine the option key? I believe the serial number 122085 is padded out for the decryption process but this not my subject.K . 1 . 7 . 0 . . . . . . . è í ½ ª 9 Ø s B ¿ „ L x ˆ × ®4B 00 31 00 37 00 30 00 00 00 02 00 00 00 E8 ED BD AA 39 D8 73 42 BF 84 07 4C 78 88 D7 AEID:2112.4300K02-122085-Yb

author: ve7xen
author_rank: Super Contributor
timestamp: May 26, 2025, 05:25:07 pm
content: Do you have any examples of valid keys? Or access to the firmware image? If it's also of similar vintage to CMU200 it probably uses a similar scheme (also based on RC2), but if the ciphertext is 30 decimal characters it must be using a different cleartext (CMU200 has 16 hex character keys).

author: sotto
author_rank: Newbie
timestamp: May 26, 2025, 06:35:14 pm
content: Yes, this is the 30 digit valid option key for [K40 AWGN Noise], listed under Active options on this SFE196623250602195838860031142113Would a PM be better? Where should I look in the firmware image?

author: michal82
author_rank: Contributor
timestamp: May 26, 2025, 09:06:17 pm
content: Additional information.Some R&S devices have a sim card on the motherboard, and the description in the service manual, for example, from the SMBV100A is as follows:" SIM CardThe instrument identity (Serial Number and Options) is stored on a SIM card. The SIM card is mounted onthe backside of the Basis Board""NOTICEWhen changing the Basis Board, you have to remove the SIM card.The SIM card is part of your instrument and will not be replaced by Rohde & Schwarz iflost. Therefore, always keep the SIM card with you."

author: geoffwood
author_rank: Newbie
timestamp: June 05, 2025, 02:31:25 am
content: I have a CMU200 and want to activate the K14 option. R&S no longer support the CMU200, and will not even attempt to sell me an activate Q!!! Wankers.I have no chops for how to run the 'Rohde & Schwartz FSP option generator' or other gymnastics described in this thread, and would be eternally grateful if somebody here who does could run my details thru to generate it. Happy to buy some beers for the effort.My Activation screen pic attached.

author: MorzeCBP
author_rank: Newbie
timestamp: June 07, 2025, 08:48:43 am
content: Quote from: geoffwood on June 05, 2025, 02:31:25 amhttps://rohde.nonexistent.ca/

author: geoffwood
author_rank: Newbie
timestamp: June 08, 2025, 07:02:33 am
content: All sorted thanks to several helpers.No thanks to R&S who don't/won't even attempt to sell me an activation, presumably thinking I'll purchase replacement gear from them !

author: ciasteczkowypotwor
author_rank: Contributor
timestamp: June 13, 2025, 03:09:34 pm
content: Hi, Can someone generate option numbers for FSH3 for me?

author: pdenisowski
author_rank: Super Contributor
timestamp: June 13, 2025, 03:28:12 pm
content: Quote from: ciasteczkowypotwor on June 13, 2025, 03:09:34 pmCan't help you generate license keys for our products, but love the user name

author: analogRF
author_rank: Super Contributor
timestamp: June 15, 2025, 10:49:35 am
content: Quote from: MorzeCBP on October 25, 2024, 08:44:00 pmdoes anybody know how K60 and K15 work? I mean what do they do?they dont seem to be adding anything in the system menus anywhere.

author: ciasteczkowypotwor
author_rank: Contributor
timestamp: June 16, 2025, 10:58:14 am
content: I managed to get the codes, thanks totv84.But while the first four work, the next ones don't. What could be the problem?S/N: 101302/00 OptIndex_000: 1138917325S/N: 101302/00 OptIndex_001: 1007896614S/N: 101302/00 OptIndex_002: 3119874071S/N: 101302/00 OptIndex_003: 0304019205S/N: 101302/00 OptIndex_004: 2274318544S/N: 101302/00 OptIndex_005: 3384963188S/N: 101302/00 OptIndex_006: 2826251885S/N: 101302/00 OptIndex_007: 3979592507S/N: 101302/00 OptIndex_008: 0841462956S/N: 101302/00 OptIndex_009: 3067136231S/N: 101302/00 OptIndex_010: 0387794094

author: KungFuJosh
author_rank: Super Contributor
timestamp: June 30, 2025, 02:40:13 am
content: Search earlier in the thread; there's more than one script.

author: KungFuJosh
author_rank: Super Contributor
timestamp: June 30, 2025, 07:52:12 pm
content: Check reply #338. You might be able to use or modify that script if it's from the same era.

author: KungFuJosh
author_rank: Super Contributor
timestamp: July 02, 2025, 12:58:52 am
content: Quote from: cryptoprojects on July 02, 2025, 12:20:58 amCorrect. That's why I said to try and modify it.I dunno if that will work or not, but if the codes were generated similarly, but with different lengths, maybe?

author: deJulian1988
author_rank: Newbie
timestamp: July 08, 2025, 08:22:41 pm
content: Hello!I have two SFE100 (2112.4100.03). There are the same Option installed (K170 AM/FM)Here are the Serials and the Option Keys... Maybe Somebody can make a Key Generator, Please ;-)Serial 132177 ----> Option Key for K170 348782566612647858460902399539Serial 133374 ----> Option Key for K170 238036896919974275992441810211And Sorry for my English Skills :-)Best Regards Julian

author: pmx
author_rank: Contributor
timestamp: August 06, 2025, 10:33:23 pm
content: Hi, a funny (so to speak..) thing happen to me.I installed various options in my VNA. Worked like a charm (when supported).I tried various keys, some supported, other not.Unsupported keys were simply ignored with an error message..But one of the rejected option keys triggered "something" : the HD begun to spin like mad. I stopped the VNA,After the next startup, the already installed options were still listed in the startup screen, but not anymore accessible via the "Mode" menu.And after the next reboot, the options were not listed anymore.(Looks like a 2 stages elimination process...)The funny (!!) thing is :Whenever I reinstall an option key, the option works perfectly, but after a reboot, it disappears (in 2 stages, like before).I suspect a missing or corrupted file :the CMOS battery (motherboard) is obviously dead as the clock resets to a date in 1997 after every reboot.And I found an file named "options.ini", with the same 1997 modification date.Maybe there is something here ?But I cant read this file (I can't find how to access the Windows NT desktop)Sadly, I hadn't made a disk image (not the hardware for that, and I got the VNA only 2 days ago).Any clues ?P.S. I tried again the offending option key, nothing happened this time, it was simply rejected with the usual error message.

author: pmx
author_rank: Contributor
timestamp: August 09, 2025, 08:34:30 am
content: Last evening, I was updating a keygen code found on this thread (the Italian one, written in C) to work with my VNA.I tried almost all the possible option keys to see which one are valid and which ones are rejected, in order to make the code more useful for the ZVR/ZVC family (it was originally designed for the FSP, as far as i know).I'm mostly doing this out of curiosity and for the benefit of the community, as I personally don't really need most of the advanced firmware options : for complex tasks with a VNA, I tend to post-process the ".s_p" files .Some option keys are rejected, but strangely some other are accepted but don't appears to do anything (on the surface)...Furthermore, at least 2 times, an option key froze the VNA (reboot needed) (doesn't seem to be repeatable).And then I ran into a SERIOUS PROBLEM (screaming and crying loud!!...) :one of the option key, I don't now which one, silently downgraded my ZVR (4 receivers) to a ZVRE (3 receivers).As my ZVR (+ ZVR-B25 option) and a ZVRE internal cabling is different, I lost even the most basic VNA functionalities.Where am I so far ?I' still haven't opened the VNA, nor accessed the HDD.I noticed that the "options.ini" file size changed.(this file is in a sub-directory of C:\r_s\ )Also, I found some system log messages saying that "options.ini" file is corrupted .(Maybe it happened some time before this problem, see my previous post).Any suggestion on how the revert the VNA to it's original ZVR identity ?I hope the setting resides is a WinNT file, not in an EEPROM on the transputer boards (remember the frozen VNA...).30 years ago, storing settings in an EEPROM was less common I guess.Maybe a kind soul could share an "options.ini" file from a working ZVR ?Even better if it comes from a ZVR with the following hardware options : ZVR-25 (External Measurements) ans ZVR-B21 to B24 (step attenuators).But I would happily do with any flavour of "options.in"Thanks in advance...[ And NO, as I had just received this VNA a few days ago, I hadn't clone the HDD... ]

author: pmx
author_rank: Contributor
timestamp: August 09, 2025, 09:05:30 am
content: Hi again...There is a "Service" or "Maintenance" menu in tne ZVR (can't remember the exact name) protected by a password.Is there a default or factory" password I could try ? Or a way to reset this password ?Just in case...I

author: tv84
author_rank: Super Contributor
timestamp: August 09, 2025, 09:12:12 am
content: Try these and report:8941292012200430473035

author: pmx
author_rank: Contributor
timestamp: August 09, 2025, 10:09:17 am
content: Hi TV84,old post, I know...Quote from: tv84 on February 17, 2019, 09:15:27 pmI'm currently updating the FSP keygen for the ZVx VNA series, but trying blindly all possible option keys I somewhat bricked my ZVR.My ZVR (with hardware option ZVR-B25) is now seen as a ZVRE.As the RF path is different, no measurement can be done anymore.I would appreciate a pointer to the tools you used.Maybe there is a "back to ZVR" option of sorts listed in the ZVR's API.DLL ?.And at least, a proper options description in the keygen code would prevent others to fall in the same trap.Help would be highly appreciated !You can PM me if you prefer.(I'll share the updater ZVx keygen once finished and tested).

author: pmx
author_rank: Contributor
timestamp: August 09, 2025, 10:32:09 am
content: Quote from: tv84 on August 09, 2025, 09:12:12 amFunny, I just mentioned you in my previous post...I'l try these passwords and report quickly.THANKS!

author: pmx
author_rank: Contributor
timestamp: August 09, 2025, 10:46:25 am
content: 894129 works !OK, I believe it's better not to mess with the calibration here.There is a "service function" field, you probably enter a number (or ID) I will check the service manuals later.For my more immediate problem, nothing related to the options (a kind of reset...) here..MANY THANKSagain for your help !!

author: pmx
author_rank: Contributor
timestamp: August 09, 2025, 03:15:03 pm
content: OK, some news :with the service menu enabled, you get a two things :You get a "remove all options" button next to the "add option" button.The WinNT files are not anymore read-onlyyou access the service menus described in the service manuals[\li]I removed( renamed) the "options.ini" file in the hope it would be rebuilt to some defaults, but it didnt't happen. But the "erase all options" did exactly that.Now, options are maintained between rebootsThe option menu allows you to set the exact model (ZVR, ZVC, etc) and some other options (installed attenuators).For example, ZVR is menu code 1.0.0.3It works instantly, the INFO showing a ZVR model, but for some reason this was lost between reboots and the VNA was still restarting as a ZVREStrangely, after I left the VNA switched OFF for 15 minutes or so, it restarted as a ZVR.The bad thing is that I'm afraid I've lost one of the detector calibration files (including the backup) while exploring the menus the first time I opened the service menu.But this is another story...I've ordered a CF card and an adapter, but it's a bit late...

author: pmx
author_rank: Contributor
timestamp: August 09, 2025, 05:00:46 pm
content: OMG ! The ZVR HDD is buried deep inside this 30kg beast !I expected a big 3.5' drive, for no special reason.It's in fact a tiny 2.5' laptop drive.This one is labeled "WIN NT for ZVR2/ZVC2/ZVM/ZVK", a Fujitsu MHH2048BAT, manufacturing date December 1999.This would make my ZVR born in this century, year 2000 ?BTW, is there a way to know the age of a R&S equipment, maybe based on the serial number ?

author: tv84
author_rank: Super Contributor
timestamp: August 10, 2025, 04:47:30 pm
content: Quote from: pmx on August 09, 2025, 05:00:46 pmI don't think that's possible in those. In newer devices you can do a good guesstimate.

author: pmx
author_rank: Contributor
timestamp: August 11, 2025, 01:44:22 pm
content: I let my ZVR alone, partly disassembled until I get everything to duplicate the disk proceed with the Compact Flash conversion (tomorrow, I think).Regarding the Options : something is not clear for me :if I understancde correctly the paper describing the "Time Domain" option on the R&S website :https://www.rohde-schwarz.com/us/applications/time-domain-measurements-using-vector-network-analyzer-r-s-zvr-application-note_56280-15758.htmlenabling the option should unlock a [TIME DOMAIN] button under the "MODE" menu ("MODE" key on the ZVR front panel).I've not seen that button, although other options create new buttons here, like "4 Ports measurements" or "Non linear measurements".Does it mean that the firmware should be upgraded ?Or maybe some files have to be moved on the HDD to be found by the transputer code ?I can't find information (or any hints) in the manual or the R&S website, and I'm a bit lost here...(If I remember correctly, the firmware version is 3.22.)

author: matthieu.e
author_rank: Regular Contributor
timestamp: August 27, 2025, 09:08:32 pm
content: Hi everyone,I have a SMJ100A for hobby in my lab.I would like to add options.Can someone help me with this ? Thank you.

author: Astralix
author_rank: Regular Contributor
timestamp: September 23, 2025, 10:43:55 am
content: I checked my FSP30 that already has many options. It just misses the K30 Noise Figure and Gain Measurements and / or K40 Phase Noise Measurements.All keys generated are exactly as the preinstalled ones, so I guess the two keys should work too. But both keys are rejected.Is there something additional needed or does it have to be in a service mode to accept new keys?

author: KeBeNe
author_rank: Regular Contributor
timestamp: October 07, 2025, 06:04:19 am
content: Hi,Can someone please generate the optionsKey for the FSH with SN:105336?The keys I've generated are incorrect.Thank you very much.

author: sergeyklenov
author_rank: Contributor
timestamp: October 07, 2025, 06:37:36 am
content: FSH3/6 or FSH4/8? 😜

author: KeBeNe
author_rank: Regular Contributor
timestamp: October 07, 2025, 07:04:22 am
content: Oh, sorry, for a FSH3edit:I managed to do it with the linked online keygen.https://rohde.nonexistent.ca/FSH K7 is K11 on FSEx ?FSH B1 is B5 on FSExFSH K2 is ESI on FSExFSH K1 is Kxx on FSExFSH K3 is FSQ on FSExFSH K60 is K20 on FSEx ?FSH K15 is K21 on FSEx ?

author: ApostropheAndTheCatalyst
author_rank: Newbie
timestamp: October 14, 2025, 11:39:26 pm
content: QuoteWhile digging through the Appl. notes and manuals I stumbled unto the ZVR-K9 Option, which requires a seperate installation to be used.https://scdn.rohde-schwarz.com/ur/pws/dl_downloads/dl_common_library/dl_manuals/dl_user_manual/ZVR_K9_OperatingManual_en.pdfPage 8 in the PDF:QuoteAnd some additional setup is also needed, Page 7:QuoteAs the Appl. note for the B2 option doesn't really specify how it is installed, maybe it is similar to the K9?I've been thinking of picking up a ZVR from a local and if I do I'd be more than happy to help with testing codes. The HDD was already replaced with a flash so making a backup shouldn't take too long. The model that wouldn't make my wallet cry doesn't come with any software options or codes for reverse engineering though.It would be seriously amazing to get a ZVx keygen up and running!

author: KeBeNe
author_rank: Regular Contributor
timestamp: October 15, 2025, 02:32:09 am
content: Doesn't the ZVR use the keygen from FSex/FSIQ?

author: tv84
author_rank: Super Contributor
timestamp: October 15, 2025, 10:10:47 pm
content: Quote from: KeBeNe on October 15, 2025, 02:32:09 am