Advantest R3273 100Hz-26.5GHz Spectrum Analyzer repair - Page 1
Forum section: electronics / testgear

author: dschiedsch
author_rank: Contributor
timestamp: August 26, 2016, 12:30:44 pm
content: I'm starting this topic because I have bought 2 Advantest R3273 Analyzers on ebay.Both with different defects.So far I have been able to replace the step attenuator and got the signal path below 3GHz working.There was a defect bias circuit for the first mixer which put DC voltage in the first stage and degraded the signal greatly.Since I also had to replace the mainboard all the cal data is incorrect.This is not a problem for the range <3.5GHz because the inbuilt cal puts everything back in order.However for frequncies above 3.5Ghz they go through a different frontend (YTF -> YIG tuned filter) and this is not calibrated with the built in cal function but has to be calibrated thorugh service menu.Sadly I'm missing the cal manual and the password for the service menu.I have extracted the firmware / OS which is on a CF card but so far haven't been able to find the password anywhere.The image can be found here:good_spectrum.imgAlso I'm not sure what architecture the CPU is.I've taken pictures.http://imgur.com/a/gGEWsMaybe someone on the forum is able to point me in the right direction.Regards

author: PA0PBZ
author_rank: Super Contributor
timestamp: August 26, 2016, 02:17:19 pm
content: The image contains only one file: good_spectrum.exe, which has a signature indicating that it is for Intel X86 architecture. None of the text in that file points to a spectrum analyzer.Also, what's up with all the red paint

author: dschiedsch
author_rank: Contributor
timestamp: August 26, 2016, 05:38:17 pm
content: HiYou downloadad the wrong file. Damn upload sitesYou have to use the correct download button (see picture)you should get a ~15Mb .img file. Which you can either mount or open with 7-zipI would not touch the .exe probably a trojan or similarAbout the red paint. I was thinking maybe quality control or something similar.Not sure though.Both analyzers have it.

author: PA0PBZ
author_rank: Super Contributor
timestamp: August 26, 2016, 06:49:56 pm
content: Oops, can't imagine I made a noob mistake like that!It started to download automatically so I assumed it was the correct file, but trying again I could click the correct download button. Of course I did not execute itWell, this is interesting. It looks like the image is FAT, at least I could extract the files that way. This is what I found so far:* Processor is Motorola 68020, I found '68020' in the iplx.sys file and I could disassemble it as 68020 code.* OS is a mystery, I think it's called ATOS but I've never heard of it. it's built on a bunch of .X executables like SETUP.X, STATUS.X, MENU.X and so on.*I think I found your options:OPT61: IS-95  Aug 08 2001OPT62: 3GPP  Jul 21 2004OPT65: cdma2000 Jan 24 2003OPT67: HDR  Jun 28 2004I found the occurrence of the text "password" in the MAINTE.X file but nothing obvious stands out as the solution at first glance:

author: nctnico
author_rank: Super Contributor
timestamp: August 26, 2016, 06:55:33 pm
content: What would be interesting is loading the executables into a debugger and the see where the 'password' texts are referenced to. The could help to determine how the password is tested (and perhaps patch the software to just skip the test and accept any password).

author: dschiedsch
author_rank: Contributor
timestamp: August 26, 2016, 07:01:30 pm
content: Yes skipping the password is definitly also an option since I can try with different program versions by just swapping cf cards there is also no risk of bricking the device.Which disassembler did you load the code into?Also found the mention of "password" in the MAINTE.X but am not sure which occurence references to what I see in the menus. and a short search for number strings between 4 and 8 characters doesn't show much useful information.Maybe the PW is not on the CF Card but somewhere in an EEPROM on the board. Allthough I think its unlikely. The pw is just to keep normal people out not to keep the device super secure.

author: PA0PBZ
author_rank: Super Contributor
timestamp: August 26, 2016, 07:07:07 pm
content: I used IDA to test disassemble the MENU.X file, but I will have a look at MAINTE.X later. The 'KEY is invalid' string looks interesting

author: dschiedsch
author_rank: Contributor
timestamp: August 27, 2016, 05:41:17 am
content: Not as interesting as you might expect.If you enter a wrong password for the service menu the analyzer just does nothing.It doesn't display a message like key invalid.I guess this string is used for the option licensing maybe?

author: PA0PBZ
author_rank: Super Contributor
timestamp: August 27, 2016, 09:27:41 pm
content: Well, that turned out disappointing. I think the .X files are some kind of DLL files, there's nothing but subroutines in there and no pointers to any of the strings in the code! It looks like they are loaded and used as some kind of resource files, called by a yet unknown OS. What I noticed is that there are 8 SLOT files which seem to define sub processes and SLOT.009 looks like it has something to do with MAINTE.X:SLOT MAINTE MAINTE MAINTE.X 80 D/0/96/96 UGETQUE MAINTE 93 8 0GETQUE MAISUB 92 8 0GETQUE MAISWO 94 8 0EXECS MAINTEALTOS OS is still my best guess on what is running there, but like I said I've never seen it before and google is not helpful at all. Let's hope that someone knows what's going on here.

author: nctnico
author_rank: Super Contributor
timestamp: August 27, 2016, 09:49:00 pm
content: So the password is somewhere hardcoded in the executable in ASCII or the input is converted into a number and then compared.Edit: I tried to do some 'smart' (but not extremely thourough) searching in the image for numbers and came up with these:2001020702180800800020213380647463Try them if you have some time to waste.One more: 64746edit2: fun fact: one of the programmers misspelled 'board' consequently as 'borad'.

author: dschiedsch
author_rank: Contributor
timestamp: August 28, 2016, 08:05:03 am
content: Hi. Yes i will try these in the evening when i get back home. Strange that they used this OS / Software combination. Maybe it was more popular in Japan.

author: dschiedsch
author_rank: Contributor
timestamp: August 28, 2016, 07:58:28 pm
content: I'm sad to inform you that none of these gave any result.I tried both ways to get to the PW screen:Shift + Window and Shift + Formatthen entered the password and pressed EnterNothing happened.What I thought was that I could on purpose misspell each entry of Password in the MAINTE.X with different characters to find out which one is the relevant one that gets displayed in the password request.Would that help you?The borad misspelling is a good catch. Wonder if any of the other programmers saw it and thought, ah what the heck just leave it there.regards

author: nctnico
author_rank: Super Contributor
timestamp: August 28, 2016, 08:11:51 pm
content: Did you try to get into the service menus? On the R3477 it is not clear the password got accepted or not but if the password is right then the service menus become enabled. Perhaps you can also try to use the serial number (normal and reversed).

author: dschiedsch
author_rank: Contributor
timestamp: August 28, 2016, 08:58:11 pm
content: From what I saw there is no dedicated Service Menu Entry in the menu system.Someone on another forum posted about the Shift + windows and shift + format button combination.https://groups.yahoo.com/neo/groups/advantestinstrument/conversations/messages/602QuoteBut alas I'm not sure if this is the right entrance to the service menu.There is no mention of it in the normal user manual at all.Advantest are really strangely secretive when it comes to calibrating their instruments.

author: Ico
author_rank: Newbie
timestamp: January 25, 2017, 05:00:04 pm
content: I found a password: 882323After pressing:Shift Format 882323the analyzer enter in "Maintenace menu" , where "ATT switch count" and "Power ON switch count" can be set to zero. Probably there are other passwords for service menus.

author: dschiedsch
author_rank: Contributor
timestamp: January 26, 2017, 07:53:10 am
content: Very interestingWill try tonight.How did you find the password?

author: dschiedsch
author_rank: Contributor
timestamp: January 29, 2017, 07:43:09 pm
content: Can confirm that the password worksAlso SHIFT WINDOW + 882323 gets you into another maintenance menu which allows much more calibration stuffYTO calib here I come ;-)Now I have to find someone with a high-f signal sourceThanks

author: Ico
author_rank: Newbie
timestamp: February 05, 2017, 07:25:26 am
content: Yes, the password work also with SHIFT WINDOW.But I could not save the changes. There is a window: "Write protection: ON"Any idea how to switch off wirite protection ?

author: hafrse
author_rank: Regular Contributor
timestamp: February 26, 2017, 02:05:16 pm
content: Hello,I tried SHIFT WINDOW 882323 on my r3273 but nothing happens. Any clue?Thanks

author: dschiedsch
author_rank: Contributor
timestamp: February 26, 2017, 02:38:34 pm
content: Interesting.You could try comparing your CF-card image with mine (posted above) to see if there is a difference.I think the PW is stored on the CF-card.You could also try booting up your analyzer with my cf-imagejust keep a copy of your image safe ;-)

author: dschiedsch
author_rank: Contributor
timestamp: February 26, 2017, 02:43:50 pm
content: ForgotYou have to press enter (Hz button) after entering the PW

author: hafrse
author_rank: Regular Contributor
timestamp: February 26, 2017, 03:42:33 pm
content: Great, it worked.Regarding the write protection, could it be the Flash card or the SW2 switches on the motherboard?Regards

author: dschiedsch
author_rank: Contributor
timestamp: February 26, 2017, 04:54:48 pm
content: Maybe. Worth a try at least.I don't know if the calibration is stored on the CF Card but it would make sense.

author: hafrse
author_rank: Regular Contributor
timestamp: February 26, 2017, 05:24:43 pm
content: Found it, write protect is under the system menu (after you enter Shift window password)

author: hafrse
author_rank: Regular Contributor
timestamp: February 26, 2017, 09:45:07 pm
content: Hello,I think the image file you posted is removed from the link you have, can you please check ? I am curious to check the files there.Thanks

author: hafrse
author_rank: Regular Contributor
timestamp: February 26, 2017, 09:49:24 pm
content: Quote from: dschiedsch on August 26, 2016, 12:30:44 pmHello,I think the image file you posted is removed from the link you have, can you please check ? I am curious to check the files there.ThanksRegards

author: PA0PBZ
author_rank: Super Contributor
timestamp: February 26, 2017, 10:00:35 pm
content: Quote from: hafrse on February 26, 2017, 09:49:24 pmUploaded here:http://www.filedropper.com/goodspectrum

author: hafrse
author_rank: Regular Contributor
timestamp: February 27, 2017, 04:41:36 pm
content: Quote from: PA0PBZ on February 26, 2017, 10:00:35 pmThanks

author: dschiedsch
author_rank: Contributor
timestamp: February 27, 2017, 10:10:33 pm
content: Hi.No I haven't found someone with a signal source yet.I'm talking to someone at the university which looks good but I don't have that much time at the moment so it will take another month or so to do it.Since someone else reuploaded the image I didn't reupload my copy. I hope thats ok. Otherwise I can upload mine as well

author: hafrse
author_rank: Regular Contributor
timestamp: March 02, 2017, 09:46:27 pm
content: You are right, no way to save calibration values , write protection is on and can not be changed....

author: lowtension
author_rank: Contributor
timestamp: April 10, 2017, 03:32:54 pm
content: Quote from: dschiedsch on August 27, 2016, 05:41:17 amPressing SHIFT + TRANSIENT will also ask for a password. 882323 will not work. any clues what this password is?Thanks

author: mvanocht
author_rank: Contributor
timestamp: June 07, 2017, 07:24:08 pm
content: I also have this model analyzer. Documentation says they offered an "Option 5" Audio Demodulation. I wondered if it was just enabled through software or if it included some hardware. I had the front panel off a few days ago, and found the internal speaker is there, along with the headphone jack, and everything is wired up and therefore I think it is just a software option.

author: 3g57
author_rank: Regular Contributor
timestamp: November 22, 2020, 08:54:54 am
content: Hello! hafrselook at write protection here!Protection is enabled by default!Best Regards, 3G57

author: 3g57
author_rank: Regular Contributor
timestamp: November 22, 2020, 12:08:35 pm
content: Hi there!I uploaded some datasheets to IC of the Advantest R3273 PC board1 mPC4072 J-FET INPUT LOW-NOISE DUAL OPERATIONAL AMPLIFIERhttps://datasheet.octopart.com/UPC4072C-NEC-datasheet-101880.pdf2 DM74LS245 3-STATE Octal Bus Transceiverhttps://pdf1.alldatasheet.com/datasheet-pdf/view/51057/FAIRCHILD/74LS245.html3 74VHC245 Octal Bidirectional Transceiver with 3-STATE Outputshttps://pdf1.alldatasheet.com/datasheet-pdf/view/50653/FAIRCHILD/74VHC245.html4 AD7538KR LC2 MOS Microprocessor-Compatible 14-Bit DAChttps://eu.mouser.com/datasheet/2/609/AD7538-877338.pdf5 LT1027/E5 LT1027 is a precision reference with extra-low drifthttps://www.analog.com/media/en/technical-documentation/data-sheets/1027fcs.pdf6 LV245A SN74LV245AT OCTAL BUS TRANSCEIVER WITH 3-STATE OUTPUTShttps://pdf1.alldatasheet.com/datasheet-pdf/view/192063/TI/LV245A.html7 AC125 74AC125 Quad Buffer with 3-STATE Outputshttps://pdf1.alldatasheet.com/datasheet-pdf/view/50119/FAIRCHILD/74AC125.html8 HD153110 Color Palette with Triple 8-bit DA Converterhttp://www.datasheetq.com/datasheet-download/883579/1/Hitachi/HD1531109 M38802M2-220HP Microcomputer for key-board control(Mask ROM:ROM-8K,RAM-384K)https://www.datasheets360.com/pdf/-641731554192190842010 M514260C-60J 262,144-Word x 16-Bit DYNAMIC RAMhttps://datasheet4u.com/datasheet-parts/MSM514260C-datasheet.php?id=50557211 HM538253BTT-7 262,144-word x 8-bit Multiport CMOS Video RAMhttps://www.datasheets360.com/pdf/361652369388507277112 SIM-65802GN105-1 Specialized microcircuit13 SH-2 HD6417604F28 (Hitaсhi) Renesas 32-Bit RISC Microcomputer SuperHTM RISC engine Familyhttps://www.renesas.com/us/en/doc/products/mpumcu/001/rej09b0171_superh.pdfhttp://www.farnell.com/datasheets/44795.pdf14 RTC-62423 4-bit REAL TIME CLOCK MODULEhttps://pdf1.alldatasheet.com/datasheet-pdf/view/272654/EPSONTOYOCOM/RTC-62423.html15 7673 ICL7673 Automatic Battery Back-Up Switchhttps://www.renesas.com/jp/ja/www/doc/datasheet/icl7673.pdf16 TC551001CF-70L 8-BIT STATIC RAMhttps://pdf1.alldatasheet.com/datasheet-pdf/view/31713/TOSHIBA/TC551001CF-70L.html17 74VHC595 8-Bit Shift Register with Output Latcheshttps://www.mouser.com/datasheet/2/149/74VHC595-101446.pdf18 74AC157 Quad 2-Input Multiplexerhttps://pdf1.alldatasheet.com/datasheet-pdf/view/50125/FAIRCHILD/74AC157.html19 74VHC04 HEX INVERTERhttps://pdf1.alldatasheet.com/datasheet-pdf/view/21830/STMICROELECTRONICS/74VHC04.html20 74LV245A Octal bus transceiver; 3-statehttps://assets.nexperia.com/documents/data-sheet/74LV245A.pdf21 HM5165165FTT6 64M EDO DRAM (4-Mword x 16-bit) 8k refresh/4k refreshhttps://datasheetspdf.com/pdf-file/526944/HitachiSemiconductor/HM5165165F/122 TMS99C14AFNL GPIB TO SERIAL CONVERTERhttps://accelconf.web.cern.ch/ica05/proceedings/pdf/P3_047.pdf23 LSI1032E High-Density Programmable Logichttps://datasheetspdf.com/pdf-file/684967/LatticeSemiconductor/LSI1032E/124 PC97338V ACPI 1.0 and PC98/99 Compliant SuperI/Ohttps://pdf1.alldatasheet.com/datasheet-pdf/view/9318/NSC/PC97338VJG.html25 MC68340PV25E High-performance 32-bit integrated processor with direct memory access (DMA)https://www.datasheets360.com/pdf/-105530422867307166226 29F400BC-90PF1N 4M (512K x 8/256K x 16) BIT FLASH MEMORYhttps://datasheetspdf.com/pdf-file/1114535/Fujitsu/MBM29F400BC-90/127 SIM-190G12S (90G12F0009) Specialized microcircuit28 SIM-65801GD082-1 Specialized microcircuit29 74VHC595 8-Bit Shift Register with Output Latcheshttps://www.mouser.com/datasheet/2/149/74VHC595-101446.pdf30 MB88346B R-2R TYPE 8-BIT D/A CONVERTER WITH OPERATIONAL AMPLIFIER OUTPUT BUFFERShttp://pdf.datasheetcatalog.com/datasheet/FujitsuMicroelectronics/mXrtvyw.pdf31 MAX4581 Low-Voltage, CMOS Analog Multiplexers/Switcheshttps://datasheets.maximintegrated.com/en/ds/MAX4581-MAX4583.pdf32 QUALCOMM CD90-24093-1 Specialized microcircuit33 HI5735KCB 12-Bit, 80 MSPS, High Speed Video D/A Converterhttps://www.renesas.com/cn/en/www/doc/datasheet/hi5735.pdf34 LM6172 Dual High Speed, Low Power, LowDistortion,Voltage Feedback Amplifiershttps://pdf1.alldatasheet.com/datasheet-pdf/view/9004/NSC/LM6172.html35 SN75160B Octal General-Purpose Interface Bus Transceiver (Rev. B)https://www.ti.com/lit/ds/symlink/sn75160b.pdf36 SN75162B OCTAL GENERAL-PURPOSE INTERFACE BUS TRANSCEIVERShttp://pdf.datasheetcatalog.com/datasheet/texasinstruments/sn75162b.pdf37 LM2991S Negative Low Dropout Adjustable Regulatorhttps://pdf1.alldatasheet.com/datasheet-pdf/view/545554/TI/LM2991S.html38 LM2990S (-5.0V) Negative Low-Dropout Regulatorhttps://www.promelec.ru/fs/sources/e6/fd/69/62/d4f1d60f4e4c09941d668328.pdf39 UPC1663 DC to VHF WIDEBAND DIFFERENTIAL INPUT AND OUTPUT AMPLIFIER IChttps://pdf1.alldatasheet.com/datasheet-pdf/view/6675/NEC/UPC1663.html40 961EUA (MAX961EUA-T) Single/Dual/Quad, Ultra-High-Speed, +3V/+5V, Beyond-the-Rails Comparatorshttps://pdf1.alldatasheet.es/datasheet-pdf/view/434192/MAXIM/MAX961EUA-T.html41 74VHC14 Hex Schmitt Inverterhttps://pdf1.alldatasheet.com/datasheet-pdf/view/223002/FAIRCHILD/74VHC14.html42 MC145583V 3.3 VOLT ONLY DRIVER / RECEIVER WITH AN INTEGRATED STANDBY MODEhttps://pdf1.alldatasheet.com/datasheet-pdf/view/158429/MOTOROLA/MC145583VF.html43 K6T1008C2E-GB70 128Kx8 bit Low Power CMOS Static RAMhttps://pdf1.alldatasheet.com/datasheet-pdf/view/37113/SAMSUNG/K6T1008C2E-GB70.html44 M51953B Voltage Detecting, System Resetting IC Serieshttps://pdf1.alldatasheetru.com/datasheet-pdf/view/196325/RENESAS/M51953B.htmlPlease pay attention to item#15 ICL7673 Automatic Battery Back-Up SwitchHow does it work:This item give You possibility for Hot-replace the battery. You should made this very careful.Best regards, 3G57

author: romal76
author_rank: Contributor
timestamp: April 11, 2022, 11:57:35 am
content: Anyone please upload Advantest R3273 CF card image file again, old link's is not working.

author: chick0n
author_rank: Regular Contributor
timestamp: October 26, 2022, 10:33:57 am
content: Quote from: dschiedsch on August 26, 2016, 12:30:44 pmI think i have the same problem. The DC is everywhere in the circuit. This cant be right.Could you explain the repair a bit more?

author: williamlee
author_rank: Contributor
timestamp: August 21, 2025, 07:50:41 am
content: I found that this chip had an issue after I replaced the backup battery. I ordered one, but it's still not doing the replacement job.