Agilent n5181a Software Upgrade / Hack - Page 1
Forum section: electronics / testgear

author: Karnathe
author_rank: Contributor
timestamp: February 28, 2025, 04:06:02 pm
content: Hello,I have a (hopefully) working Agilent n5181a rf Signal Generator and would like to hack in some extra software options. Does anyone know of functioning software / methods to do this? I looked around online but did not see anything obvious.Keysight link to the equipment:https://www.keysight.com/us/en/product/N5181A/mxg-rf-analog-signal-generator-100-khz-to-6-ghz.html

author: PA0PBZ
author_rank: Super Contributor
timestamp: February 28, 2025, 04:45:46 pm
content: Since the product status is obsolete I don't mind having a look. Do you have any active options where you can see the key? Does it have a HOSTID?

author: Karnathe
author_rank: Contributor
timestamp: March 07, 2025, 10:39:28 pm
content: Sorry for this very late reply.Quote from: PA0PBZ on February 28, 2025, 04:45:46 pmI have attached a few images, not sure if it is what you need. I have censored my serial, message me if you need it. I assume this forum has DM's.If I have not found what you need, please guide me to it. This is all from the utility menu.

author: squadchannel
author_rank: Frequent Contributor
timestamp: March 07, 2025, 11:45:35 pm
content: I also have an N5181A.I looked into this before and if I am not misinterpreting, need to replace the A3 RF board to add options other than UNT/UNU (FM AM PM option). The parts number is listed in the service manual. I am not sure what the difference is.

author: tv84
author_rank: Super Contributor
timestamp: March 08, 2025, 10:01:03 am
content: Quote from: Karnathe on March 07, 2025, 10:39:28 pmCheck the device to see if it has a label on the back or bottom that includes the model number and serial number. This label might also include the Host ID.If so, send me a pm.

author: tv84
author_rank: Super Contributor
timestamp: March 08, 2025, 11:10:24 am
content: List of options as seen in the FW. (Dependent on each model of this series.)

author: PA0PBZ
author_rank: Super Contributor
timestamp: March 08, 2025, 11:34:58 am
content: Since tv84 jumped in I'll just watch this thread for now.

author: squadchannel
author_rank: Frequent Contributor
timestamp: March 08, 2025, 11:56:09 am
content: send PM

author: Karnathe
author_rank: Contributor
timestamp: March 08, 2025, 10:41:44 pm
content: I have sent a DM.

author: tv84
author_rank: Super Contributor
timestamp: March 09, 2025, 11:49:33 am
content: @PA0PBZ, need your help.This is what we need to recreate:FEATURE 501 aspk 1.0 permanent 0 63A7F5F2744A6ECB HOSTID=N5181A,MFG0000001 #1 GHz frequency rangeFEATURE 503 aspk 1.0 permanent 0 D240E450C8227F4D HOSTID=N5181A,MFG0000001 #3 GHz frequency rangeFEATURE 506 aspk 1.0 permanent 0 74D831FDECE46AAF HOSTID=N5181A,MFG0000001 #6 GHz frequency range

author: PA0PBZ
author_rank: Super Contributor
timestamp: March 09, 2025, 01:24:56 pm
content: Quote from: tv84 on March 09, 2025, 11:49:33 amThat looks like the newer (more difficult) lmcrypt format, 128 bit key.. I don't think we ever did that?

author: Karnathe
author_rank: Contributor
timestamp: March 14, 2025, 07:39:32 pm
content: Hello all, I have (maybe) figured out how to talk to this wretched instrument. Instructions follow:Plug in via ethernet into your routerFind it's IP address (your router should have it listed)If you are on windows, you need to enable telnet (https://phoenixnap.com/kb/telnet-windows)open cmd, type telnet then its ip then SPACE not : and type 5023For me, the command is telnet 10.0.0.39 5023This will get you to this lovely page included in attachments.Check the agilent / keysight Manual_N5180-90004(SCPI_command) for the commands, but the tldr isif it is lowercase, it does not matterthis instrument is picky about commands. If you type it wrong, it will give you nothing, press ctrl+c to reset. Check the error screen either on the instrument or on its interactive menu on its webpage, see attached image.finally, the command you want is: :SYST:LIC:LIST? which will return all licenses on the instrument, as well as I think what the very helpful people in this thread needed.Last note, if you go to its IP address in a web browser it will return a lovely menu which will be very helpful. If you don't want to mess around with windows command prompt try putty, specify telnet and port 5023.

author: tv84
author_rank: Super Contributor
timestamp: March 14, 2025, 08:57:43 pm
content: Nice! Then the possible way to insert the licenses is probably also via SCPI command.

author: Karnathe
author_rank: Contributor
timestamp: March 14, 2025, 09:11:00 pm
content: Yes, let me include a screen shot of the relevant command.

author: tv84
author_rank: Super Contributor
timestamp: March 14, 2025, 10:19:30 pm
content: Quote from: Karnathe on March 14, 2025, 09:11:00 pmNow we just need to find out the seeds...

author: Karnathe
author_rank: Contributor
timestamp: March 14, 2025, 10:20:33 pm
content: Is that not included in the license info I sent you? Or does that not come from me.

author: tv84
author_rank: Super Contributor
timestamp: July 21, 2025, 10:22:59 pm
content: Quote from: PA0PBZ on March 09, 2025, 01:24:56 pmWe hadn't...But this is a "fake" lmcrypt. The only thing that looks the same is the license string. They use simple hashing to create the license.As a PoC I attach all the options for the standard factory device S/N MFG0000001.