Agilent E7495 linux root account - Page 1
Forum section: electronics / testgear

author: Urs42
author_rank: Unknown
timestamp: February 16, 2015, 04:49:55 pm
content: I found out i'ts running linux on an ARM CPU, i can't have any Linux Box without root access, so i did some password cracking:User: guestPass: nonameUser: rootPass: wh1skersYou can log in to it with telnet, it has many serial ports, i suspect that most of them are used to communicate with the Spectrum Analyzer Part. The Powerup Config of the Device is stored in /flash/egServer/registry/Powerup/ if you want to change some default settings. There is an ftp client on the device, if you run a ftp server on your computer, you can use it to copy files from and to the device. Binaries from debian woody will work on the Device.

author: jwm_
author_rank: Frequent Contributor
timestamp: February 17, 2015, 01:38:39 pm
content: That is great, time to email them and ask for the source code. Depending on their mood, we may get the source to drivers for their hardware in it.

author: Wuerstchenhund
author_rank: Super Contributor
timestamp: February 17, 2015, 05:52:09 pm
content: Nice find! Yes, the E7495 is a nice device, and great for hacking or expanding its capabilities, probably more so than most other VSAs in that price class.You should be able to get the source code for the OSS stuff from Keysight but I believe the hardware drivers are closed source binaries.But hey, there's a lot that could potentially be done with that thing. Maybe someone can fix the sometimes temperamental screen capture function, or even modify it so that it works with USB drives as well.

author: Urs42
author_rank: Unknown
timestamp: February 17, 2015, 07:14:49 pm
content: There is no USB Storage Support in the kernel running on the device, and the module is also missing :-(The kernel Version that is running on the device is available on the internet, the .config from the kernel would help with building a matching module, i'm not sure if it's possible to build it without the .config.They are Obligated to give us the source, because of the GPL...I think that the mounting and unounting of the cf card is done with shell scripts, it should be possible to switch the scripts to USB.The licensing of options is done with the flexlm license manager, i have no idea how secure this thing is. There are many Options that don't need additional hardware. I think it might be possible to copy licenses from one device to another.

author: jwm_
author_rank: Frequent Contributor
timestamp: February 17, 2015, 07:17:51 pm
content: If it does just communicate with its devices over serial links, it would be easy to interpose a driver to capture and sniff the data. also possible for usb, but a bit trickier if we can't load a kernel module.can you post its full boot logs, lspci and lsusb?I was thinking of picking up one of those for use as a general spectrum analyzer, how hampered will i be that it was designed for a specific purpose? Will i always be fighting the UI that keeps on wanting me to repair base stations?

author: Lukas
author_rank: Frequent Contributor
timestamp: February 17, 2015, 09:24:06 pm
content: Btw, you can download a firmware upgrade from Keysight and reverse engineer as you like.Strangely, this device runs some embedded sort of java! xkcd:http://xkcd.com/801/They took advantage of that, so the PC software they offer simply is the same one that runs on the device, with the difference that it doesn't connect to localhost.You're wondering why this thing takes so long to boot? This may be part of the answer:Code:# There's some defect in the GUI that results in# intermittent hangs on startup (very rare, but some# boxes can hit it regularly). This delay is a workaround# to avoid them. When the root cause is found and fixed# this delay can be removed.sleep 16

author: Wuerstchenhund
author_rank: Super Contributor
timestamp: February 17, 2015, 09:28:43 pm
content: Quote from: jwm_ on February 17, 2015, 07:17:51 pmNot hampered at all. It's a normal Vector SA which covers from 500kHz to 2.5GHz (E7495A)/2.7GHz (E7495B) all the way from zero span to full span.Also no need to "fight" the menu. You can ignore the BTS specific software and selectr "Spectrum Analyzer" directly in the main menu.I'm working on a review of my E7495B, with some luck I might finish it this weekend.

author: Urs42
author_rank: Unknown
timestamp: February 18, 2015, 05:30:14 am
content: The GUI Part of the Software is java, there is also a server part that is not written in Java. Some parts of the Software are missing in the Firmware update.Some details from a running system:Code:[root@Linux /root]$dmesgLinux version 2.4.19-rmk7-ads5 (sreynard@elgato2.soco.agilent.com) (gcc version 2.95.2 19991024 (release)) #30 Wed Apr 28 13:36:58 UTC 2004CPU: StrongARM-1110 revision 9Machine: ADS GraphicsMasterWarning: bad configuration page, trying to continueOn node 0 totalpages: 8192zone(0): 256 pages.zone(1): 7936 pages.zone(2): 0 pages.On node 1 totalpages: 8192zone(0): 256 pages.zone(1): 7936 pages.zone(2): 0 pages.Kernel command line: console=tty1 mem=32m@0xC0000000 mem=32m@0xC8000000 rw ramdisk_size=8192 initrd=0xC0800000,3m root=/dev/ram sa1100_pcmcia_opts=sock:0(speed_io:100,fast_mode),sock:1(speed_io:80)Relocating machine vectors to 0xffff0000Console: colour dummy device 80x30Calibrating delay loop... 137.21 BogoMIPSMemory: 32MB 32MB = 64MB totalMemory: 59552KB available (1716K code, 360K data, 88K init)Dentry cache hash table entries: 8192 (order: 4, 65536 bytes)Inode cache hash table entries: 4096 (order: 3, 32768 bytes)Mount-cache hash table entries: 1024 (order: 1, 8192 bytes)Buffer-cache hash table entries: 4096 (order: 2, 16384 bytes)Page-cache hash table entries: 16384 (order: 4, 65536 bytes)POSIX conformance testing by UNIFIXLinux NET4.0 for Linux 2.4Based upon Swansea University Computer Society NET3.039Initializing RT netlink socketsa1111_pcibuf: initializing SA-1111 DMA workaroundSA1111 Microprocessor Companion Chip: silicon revision 1, metal revision 1Starting kswapdJFFS version 1.0, (C) 1999, 2000 Axis Communications ABJFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.ttyS0 at I/O 0xf0100000 (irq = 50) is a 16550AttyS1 at I/O 0xf0120000 (irq = 51) is a 16550AttyS2 at I/O 0xf0140000 (irq = 52) is a 16550AttyS3 at I/O 0xf0160000 (irq = 54) is a 16550AttySA0 at MEM 0x80050000 (irq = 17) is a SA1100ttySA1 at MEM 0x80010000 (irq = 15) is a SA1100ttySA2 at MEM 0x80030000 (irq = 16) is a SA1100Console: switching to colour frame buffer device 80x30initialize_kbd: Keyboard reset failed, no ACKKeyboard timed outkeyboard: Timeout - AT keyboard not present?Keyboard timed outkeyboard: Timeout - AT keyboard not present?pty: 256 Unix98 ptys configuredUCB1200 generic module installeducb1200 touch screen driver initializeducb1200 adc driver initializedUCB1200 audio driver version 2.2 initializedUCB1200 audio driver Click-Avoid patch: TT <tthaele@papenmeier.de>UCB1200 Mixer driver version 0.1 initialized. TT <tthaele@papenmeier.de>smartio driver initialized. version 1.10, date:28-Jun-2002SmartIO ID : 0x5002Device Version : 6(0x36)Device Type : 0x8535SA1100 Real Time Clock driver v1.00Uniform Multi-Platform E-IDE driver Revision: 6.31ide: Assuming 50MHz system bus speed for PIO modes; override with idebus=xxsmc9194.c:v0.14 12/15/00 by Erik Stahlman (erik@vt.edu)eth0: SMC91C96(r:9) at 0xf00e0000 IRQ:58 INTF:TP MEM:6144b ADDR: 00:60:0c:00:4c:5fRAMDISK driver initialized: 16 RAM disks of 8192K size 1024 blocksizeloop: loaded (max 8 devices)PPP generic driver version 2.4.2Sound: SA1111 UDA1341: dsp id 3 mixer id 0SA1111 audio out: SA-1111 SAC DMA channel 6 in useDMA request for SAC output failedphysmap flash device: 4000000 at 8000000Physically mapped flash: Found 2 x16 devices at 0x2000000 in 32-bit mode0: offset=0x0,size=0x40000,blocks=1281: offset=0x2000000,size=0x40000,blocks=128Using buffer write methodSA1100 flash: probing 32-bit flash busSA1100 flash: Found 2 x16 devices at 0x2000000 in 32-bit mode0: offset=0x0,size=0x40000,blocks=1281: offset=0x2000000,size=0x40000,blocks=128Using buffer write methodUsing static partition definitionCreating 3 MTD partitions on "SA1100 flash":0x00000000-0x00100000 : "zImage"0x00100000-0x00400000 : "ramdisk.gz"0x00400000-0x04000000 : "User FS"Linux Kernel Card Services 3.1.22options: SA-1100 PCMCIA (CS release 3.1.22)usb.c: registered new driver usbdevfsusb.c: registered new driver hubhcd/ohci-sa1111.c: starting SA-1111 OHCI USB Controllerhcd/ohci-sa1111.c: ohci-hcd (SA-1111) at 0xf4000400, irq 109usb.c: new USB bus registered, assigned bus number 1hub.c: USB hub foundhub.c: 1 port detectedusb.c: registered new driver hiddevusb.c: registered new driver hidhid-core.c: v1.8.1 Andreas Gal, Vojtech Pavlik <vojtech@suse.cz>hid-core.c: USB HID support driversmice: PS/2 mouse device common for all miceNET4: Linux TCP/IP 1.0 for NET4.0IP Protocols: ICMP, UDP, TCPIP: routing cache hash table of 512 buckets, 4KbytesTCP: Hash tables configured (established 4096 bind 4096)NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.NetWinder Floating Point Emulator V0.95 (c) 1998-1999 Rebel.comRAMDISK: Compressed image found at block 0Freeing initrd memory: 3072KEXT2-fs warning: checktime reached, running e2fsck is recommendedVFS: Mounted root (ext2 filesystem).Freeing init memory: 88Khub.c: USB new device connect on bus1/1, assigned device number 2hub.c: USB hub foundhub.c: 4 ports detectedenable_irq(114) unbalanced from c032558cTrying to free nonexistent resource <ce8a6000-ce8a600f>hda: SILICONSYSTEMS INC 128MB, ATA DISK driveide0 at 0xce8a6000-0xce8a6007,0xce8a600e on irq 114hda: 254208 sectors (130 MB) w/0KiB Cache, CHS=993/8/32Partition check:hda: hda1ide_cs: hda: Vcc = 3.3, Vpp = 0.0hda: hda1hda: hda1VFS: Can't find ext2 filesystem on dev ide0(3,1).hda: hda1hda: hda1cramfs: wrong magichda: hda1hda: hda1hda: hda1hda: hda1VFS: Can't find ext2 filesystem on dev ide0(3,1).hda: hda1hda: hda1cramfs: wrong magichda: hda1hda: hda1AVR driver initialized. version 1.1, date:Aug 6 2004Code:[root@Linux /proc]$cat /proc/cpuinfoProcessor: StrongARM-1110 rev 9 (v4l)BogoMIPS: 137.21Features: swp half 26bit fastmultHardware: ADS GraphicsMasterRevision: 0000Serial: 0000000000000000[root@Linux /proc]$I think this module is used to reprogram a avr controller in the deviceCode:[root@Linux /root]$lsmodModule Size Used byavrprog 5416 0 (unused)[root@Linux /root]$Code:[root@Linux /root]$cat /proc/interrupts0: 42792 ADS_ext_IRQ1: 0 sleep11: 0 GPIO 11-2712: 1 LCD17: 1224 serial_sa110026: 62869 timer27: 0 rtc timer30: 2 rtc 1Hz31: 0 rtc Alrm49: 223 SA111150: 40201 serial52: 982 serial54: 191 serial57: 0 UCB120058: 1059 eth063: 8 sio87: 0 keyboard97: 0 SA1111 audio out98: 0 SA1111 audio in99: 0 SA1111 audio out100: 0 SA1111 audio in109: 24 ohci-hcd114: 240 ide0116: 0 SA1111 PCMCIA card detect117: 0 SA1111 CF card detect118: 0 SA1111 PCMCIA BVD1119: 0 SA1111 CF BVD1Err: 0[root@Linux /root]$Code:[root@Linux /root]$ps auxUSER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMANDroot 1 1.1 0.8 1384 544 ? S Feb13 0:07 initroot 2 0.0 0.0 0 0 ? SW Feb13 0:00 root 3 0.0 0.0 0 0 ? SWN Feb13 0:00 root 4 0.0 0.0 0 0 ? SW Feb13 0:00 root 5 0.0 0.0 0 0 ? SW Feb13 0:00 root 6 0.0 0.0 0 0 ? SW Feb13 0:00 root 7 0.0 0.0 0 0 ? SW Feb13 0:00 root 8 0.0 0.0 0 0 ? SW Feb13 0:00 root 40 0.0 0.0 0 0 ? SWN Feb13 0:00 root 56 0.0 1.1 1480 744 ? S Feb13 0:00 /sbin/cardmgr -froot 587 0.0 1.0 1568 644 ? S Feb13 0:00 dhcpcd -DH -t 10root 610 0.0 0.8 1680 544 ? S Feb13 0:00 syslogd -m 0bin 636 0.0 0.7 1456 444 ? S Feb13 0:00 root 666 0.0 1.0 1592 644 ? S Feb13 0:00 inetdroot 679 0.0 0.8 1704 544 ? S Feb13 0:00 /bin/sh /etc/rc.d/rc3.d/S51timeUpdate.sh startroot 680 0.0 1.2 1788 772 ? S Feb13 0:00 /bin/bash /flash/elgato/utils/keepTimeUpdatedroot 681 0.0 0.5 1672 336 ? S Feb13 0:00 sleep 1200root 701 0.8 11.4 93644 7176 ? S Feb13 0:05 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 710 0.0 0.7 1572 476 tty1 S Feb13 0:00 /sbin/getty 38400 tty1root 711 0.0 0.7 1572 484 ttyS/ttySA0 S Feb13 0:00 /sbin/getty -L ttyS0 38400 vt100root 712 0.0 1.2 1796 808 ? S Feb13 0:00 /bin/bash /root/catch_sleep.shroot 724 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 725 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 726 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 727 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 729 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 730 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 731 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 732 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 738 0.2 11.4 93644 7176 ? S Feb13 0:01 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 751 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 752 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 753 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 754 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 755 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 756 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 757 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 758 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 759 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 774 1.1 22.2 18540 13968 tty2 S Feb13 0:07 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -root 776 0.0 22.2 18540 13968 tty2 S Feb13 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -root 777 0.0 22.2 18540 13968 tty2 S Feb13 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -root 778 0.0 22.2 18540 13968 tty2 S Feb13 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -root 779 0.0 22.2 18540 13968 tty2 S Feb13 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -root 780 9.9 22.2 18540 13968 tty2 S Feb13 1:02 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -root 781 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 782 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 783 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 784 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 785 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 786 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 787 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 788 0.0 22.2 18540 13968 tty2 S Feb13 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -root 789 0.0 22.2 18540 13968 tty2 S Feb13 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -root 790 0.0 22.2 18540 13968 tty2 S Feb13 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -root 791 0.0 22.2 18540 13968 tty2 S Feb13 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -root 792 0.0 22.2 18540 13968 tty2 S Feb13 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -root 795 0.2 22.2 18540 13968 tty2 S Feb13 0:01 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -root 798 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 799 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 800 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 801 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 802 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 803 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 804 0.7 11.4 93644 7176 ? S Feb13 0:04 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 805 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 806 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 807 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 808 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 809 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 810 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 811 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 812 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 813 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 814 0.0 11.4 93644 7176 ? S Feb13 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 819 0.0 22.2 18540 13968 tty2 S Feb13 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -root 824 0.0 1.3 1956 848 ? S Feb13 0:00 in.telnetdroot 825 0.0 1.5 1824 948 pts/0 S Feb13 0:00 -bashroot 839 0.0 1.3 2736 876 pts/0 R 00:03 0:00 ps aux[root@Linux /root]$The serial port /dev/ttyS/ttySA0 is used for a serial console, and elgato is using ttyS0, ttyS2 and ttyS3. I think ttySA0 and ttySA1 are available on the back of the device.The java part of the software is using /dev/rpg which is a simlink to /dev/sio15 i'm not sure what this is.

author: Urs42
author_rank: Unknown
timestamp: February 18, 2015, 05:36:37 am
content: It would be interessting to add some non GSM/UMTS signals to the signal generator, the data files for the generator are stored in /flash/egServer/Dragonfly/Measurements/Data/ and i have no idea about the format.

author: Wuerstchenhund
author_rank: Super Contributor
timestamp: February 21, 2015, 12:45:24 pm
content: Quote from: Urs42 on February 18, 2015, 05:36:37 amI guess these are waveform binaries for the built-in Arbitrary Waveform Generator.If we find out the format then we could create our own and push it to the E7495. Maybe even a function could be added to the Java GUI to enable copying waveforms from/to the CF card and PCMCIA card.Thinking about it, it would make the E7495 into a really flexible tool.

author: 9aplus
author_rank: Regular Contributor
timestamp: February 22, 2015, 02:16:40 pm
content: Hello to all,It is nice to know that someone else is digging out around E7495B software....Own one unit just couple of months, working just fine, except remote SW on PC with new windows version XP and later.Therefore I made debug of JAVA code in attempt to write own SW... for PC operated under Linux (Ubuntu 12 and later)and new Windows versions.I am interested to join efforts to bring this nice instrument to full useHere my hardware configuration ->

author: 9aplus
author_rank: Regular Contributor
timestamp: February 22, 2015, 03:02:28 pm
content: Here just for educational evaluationdecompiled Java egclient app...https://www.dropbox.com/s/waxxkz9c44h7dy2/egclient.src.zip?dl=0

author: Urs42
author_rank: Unknown
timestamp: February 22, 2015, 03:36:11 pm
content: The remote software consists of two parts egclient.jar and RemoteGui.jar. egclient.jar is also the GUI that you see on the device itself. RemoteGui.jar is a wrapper around egclient.jar it provides some additional buttons, for example the ESC/Lcl Button that is needed to switch between the local and remote mode. egclient.jar runs just fine on a Debian 7 System, didn't test any Windows version because i don't have one. The problem with running egclient alone, is that you can't press the ESC/Lcl button, so the remote control dons't work :-(Code:java -Dserver=10.10.0.101 -DlocalAddress=micro -classpath "egclient.jar:xerces.jar:JimiProClasses.zip:RemoteGui.jar" elgato.gui.MainWindowI do have the same options installed.

author: 9aplus
author_rank: Regular Contributor
timestamp: February 22, 2015, 04:38:16 pm
content: Must try than on my Ubuntu 12.04 LTS but so far no luck with j2re-1_4_2-linux-i586.bin from Oracle site....Quote

author: Wuerstchenhund
author_rank: Super Contributor
timestamp: February 22, 2015, 05:08:47 pm
content: Quote from: 9aplus on February 22, 2015, 02:16:40 pmNice. I'd love to have options 240 and 245, as well as 230 and 235. My unit only came with CDMA+EV-DO unfortunately.

author: 9aplus
author_rank: Regular Contributor
timestamp: February 22, 2015, 05:23:08 pm
content: Right,but on the other hand I was not so lucky with SW keys ->

author: Urs42
author_rank: Unknown
timestamp: February 22, 2015, 05:48:05 pm
content: I'm using the openjdk-6 Package from Debian.I think you can copy the license file from one device to another if you change the hostid on the target device. But i'm not sure...

author: PA0PBZ
author_rank: Super Contributor
timestamp: February 22, 2015, 06:01:31 pm
content: The E7495 firmware looks very much the same as for the N1996 CSA SA, I can even use the remote client on my CSA. The license manager on the CSA is easy to patch so that it accepts any license code, maybe it is the same for the E7495. The license daemon on the CSA is called TORO, but I could not see something simular in the ps output posted above.

author: Urs42
author_rank: Unknown
timestamp: February 22, 2015, 06:09:24 pm
content: The licensing is done by the elgato process. I think they are using flexlm. Here is the license file from my device, i did remove the HOSTID and SIGN Values.Code:$ cat elgato.licFEATURE 200 agilent 1.000 permanent uncounted \HOSTID=ID_STRING=XXXXX SIGN=YYYYYYYYYFEATURE 220 agilent 1.000 permanent uncounted \HOSTID=ID_STRING=XXXXX SIGN=YYYYYYYYYFEATURE 240 agilent 1.000 permanent uncounted \HOSTID=ID_STRING=XXXXX SIGN=YYYYYYYYYFEATURE 245 agilent 1.000 permanent uncounted \HOSTID=ID_STRING=XXXXX SIGN=YYYYYYYYYFEATURE 205 agilent 1.000 permanent uncounted HOSTID=ID_STRING=XXXXX \SIGN=YYYYYYYYY

author: PA0PBZ
author_rank: Super Contributor
timestamp: February 22, 2015, 06:23:45 pm
content: Quote from: Urs42 on February 22, 2015, 06:09:24 pmYes, that is FlexLM, same as N1996A and E4406A.

author: theatrus
author_rank: Frequent Contributor
timestamp: February 22, 2015, 06:39:19 pm
content: Looks nearly identical to the N1996A.The good news is the binaries have most of their symbols intact - objdump (for ARM) and search for some likely functions

author: 9aplus
author_rank: Regular Contributor
timestamp: February 22, 2015, 06:50:50 pm
content: Here more luck with OpenJDK Java 6 runtimeNow RemoteGUI.jar is running but not happy with egclient.jar version.Program is offering download of egclient.jar from E7495B but filetransfer ends with 0 size....

author: PA0PBZ
author_rank: Super Contributor
timestamp: February 22, 2015, 06:52:32 pm
content: Well. I just downloaded the firmware and did a quick compare between the toro process and the elgato one. Then I did a search for 16 bytes around the patch area and elgato had only one hit. So for whoever feels lucky, try this: (latest firmware downloaded fromHPAgilentKeysight site)Elgato offset 337A7C, change 01 00 00 EA to 00 00 A0 E1.Then check your license file if there are any entries without the SIGN = part, because they start to work magically if the patch works and you don't want any weird options enabled. Just take them out.Good luck and let me knowEdit: Version A06.25

author: Urs42
author_rank: Unknown
timestamp: February 22, 2015, 07:21:54 pm
content: Many thanks PA0PBZ, i'll try that.toroServer looks alot like egServer. It would be interessting to see how similar the hardware of both devices is. FM/AM Demodulation and other Stuff i see in the toroServer directory would be cool...

author: PA0PBZ
author_rank: Super Contributor
timestamp: February 22, 2015, 07:42:04 pm
content: Quote from: Urs42 on February 22, 2015, 07:21:54 pmIt does, I even see a lot of possible options in the CSA that looks to be for the E7495:200 CDMA / CDMA 2000 Analyzer205 1xEV-DO Analyzer210 CDMA Over Air Test220 Channel Scanner230 GSM Analyzer235 GSM Edge250 W-CDMA (UMTS) Over Air Test270 Interference Analyzer271 Spectrogram300 DC Bias330 NEM Software <unknown>500 Internal Agilent Mfg Source503 Frequency Range 100 kHz to 3 GHz506 Frequency Range 100 kHz to 6 GHz600 Power Meter700 T1 Analyzer710 E1 AnalyzerAFM AM/FM Tune & ListenHAR Harmonics AnalyzerIQD IQ WaveformN8995A Stimulus/Response Measurement SuiteN8995A-SR3 Stimulus/Response Measurement Suite, 3 GHzN8995A-SR6 Stimulus/Response Measurement Suite, 6 GHzN8996A-1FP AM/FM Modulation AnalyzerN8996A-2FP ASK/FSK Analyzer ASK/FSKN8997A-1FP W-CDMA (UMTS) AnalyzerN8997A-2FP HSDPA MeasurementP03 Preamplifier, 3 GHzP06 Preamplifier, 6 GHzSEM Spectral Emmissions MaskTG3 Tracking Generator, 3 GHzTG6 Tracking Generator, 6 GHzTOI TOI Analyzer

author: 9aplus
author_rank: Regular Contributor
timestamp: February 22, 2015, 07:51:19 pm
content: Yes in deed, that looks like many of E7495B options....Here still version download trouble....

author: Urs42
author_rank: Unknown
timestamp: February 22, 2015, 08:12:06 pm
content: Tryhttp://192.168.1.209/egclient.jar@PA0PBZ The patch works perfectly!

author: PA0PBZ
author_rank: Super Contributor
timestamp: February 22, 2015, 08:16:15 pm
content: Quote from: Urs42 on February 22, 2015, 08:12:06 pmThat was a fast one then, without even having the E7495.

author: 9aplus
author_rank: Regular Contributor
timestamp: February 22, 2015, 08:54:59 pm
content: So SW options unlockedGreatthat with linkQuotecan not work, but ftp transfer may work....flie on E7495B is->/flash/egGui/3480541 Nov 1 2007 egclient.jar

author: Urs42
author_rank: Unknown
timestamp: February 22, 2015, 09:08:27 pm
content: I managed to start the remote Gui on my System!You need the folowing filesCode:egclient.jarJimiProClasses.zipRemoteGui.jarxerces.jarI think it will only work with the OpenJDK Java 6 runtimeYou need to change the server and localAddress parameters, the server is the E7495 and localAddress is the IP of your PC.Code:java -Dserver=10.10.0.101 -DlocalAddress=10.10.0.156 -classpath "egclient-patch.jar:xerces.jar:JimiProClasses.zip:RemoteGui.jar" elgato.gui.MainWindowSome helpful Key kombinationsCTRL-H = HelpCTRL-L = Local (This one is important!)F1 to F7 = Menu items on the left sideF9 = Mode Button1 to 7 = Menu items on the right sideBefore you can do anything you have to switch to the local mode on your PC, press CTRL-L to do this.

author: 9aplus
author_rank: Regular Contributor
timestamp: February 22, 2015, 09:19:54 pm
content: Great, I have JDK 6 runtime, butsorry I am not able to follow you...Can you please explain step by step for dummies (me)Here is directory on my E7495B ->QuoteE7495B is on 192.168.1.209PC-Ubuntu 12.04 is on 192.168.205

author: Urs42
author_rank: Unknown
timestamp: February 23, 2015, 05:00:08 am
content: @9aplus How do you start the gui, and what is the error message you get?

author: 9aplus
author_rank: Regular Contributor
timestamp: February 23, 2015, 09:32:27 am
content: This error message ->I am running RemoteGUI.jar with OpenJDK Java 6 runtimeThan after OK, file sistem is opened and after another ->Saveegclient.jar is with 0 size (download started, but not finished)My intention now is to set up ftp transfer E7495B to PC-Ubuntu of whole egGui folder:-----drwxrwxr-x 1 root root 0 Nov 13 1969 .drwxrwxr-x 1 root root 0 Nov 13 1969 ..-r--r--r-- 1 root root 455489 Nov 1 2007 JimiProClasses.zip-rw-rw-r-- 1 root root 3480541 Nov 1 2007 egclient.jar-r--r--r-- 1 root root 8070 Nov 1 2007 libguiutil.so-r--r--r-- 1 root root 596528 Nov 1 2007 rhino-1.5R4.jar-rw------- 1 root root 0 Dec 18 2006 shellexec.log-r--r--r-- 1 root root 1897838 Nov 1 2007 swing.jar-r--r--r-- 1 root root 1812019 Nov 1 2007 xerces.jar------And than to try with start ofRemoteGUI.jar with OpenJDK Java 6 runtimeon PC again.....

author: Urs42
author_rank: Unknown
timestamp: February 23, 2015, 11:02:18 am
content: The download did work with my E7495, it should work with yours, i have no idea what the problem is. You could try to debug it with tcpdump or ngrep.Please look at Reply #29, don't klick on anything, open a console and run the java command in my reply. If you can't download the egclient.jar file, telnet in to the E7495 and then copy the file with ftp to the PC, you can find it in the directory /flash/egGui/. Or you could extract the file from the firmware that you can get on the Agilent site.You are running Firmware 6.23 i'm running 6.25, i think you should update your device first.

author: 9aplus
author_rank: Regular Contributor
timestamp: February 23, 2015, 11:51:24 am
content: Thank you,yes UPDATE of FIRMWARE may be solution, must find PCMCIA reader first, this PC do not have one...Here what is answer on java command run ->Quote

author: Urs42
author_rank: Unknown
timestamp: February 23, 2015, 11:58:28 am
content: It loos like you are running the command in your home directory, that won't work. Run it in the directory where all the java files are.I pasted the wrong command line, please replaceegclient-patch.jarwithegclient.jarCode:java -Dserver=192.168.1.209 -DlocalAddress=192.168.1.205 -classpath "egclient.jar:xerces.jar:JimiProClasses.zip:RemoteGui.jar" elgato.gui.MainWindowA PCMCIA adapter won't be easy to find. I'm not sure if it's possible to update the firmware with a CF card. Card readers with CF are available in every electronics store (at least here). If you need a PCMCIA card for the upgrade, buy a CF to PCMCIA adapter and a CF card.If you have a PCMCIA Card in your device, you could also use ftp to copy the upgrade to the card, you need some linux knowledge to do this.

author: Wuerstchenhund
author_rank: Super Contributor
timestamp: February 23, 2015, 12:07:33 pm
content: Quote from: 9aplus on February 23, 2015, 11:51:24 amYou don't need PCMCIA. The E7495 also has a separate Compact Flash slot, just copy the firmware update to a FAT32 formatted CF card, plug in into the E7495 and switch it on. It will find the file and start the firmware update process.

author: 9aplus
author_rank: Regular Contributor
timestamp: February 23, 2015, 12:43:18 pm
content: Right, thank youmust visit the store next door... for CF card thanMy Linux knowledge is limited, or a bit rusty, last time running approx 30 years agoon some Unix XWin on Truevision Graphic Workstationbut anyway have manged to start ftp server on Ubuntu and can loginusing telnet like root from E7495B...Here java runing from right folder ->Quote

author: jwm_
author_rank: Frequent Contributor
timestamp: February 23, 2015, 05:01:16 pm
content: Ordered a broken (unknown reasons, non engineer seller) one for $275. Hopefully I will be able to get it up and running or I'll have some spare parts for you all.

author: theatrus
author_rank: Frequent Contributor
timestamp: February 23, 2015, 05:35:57 pm
content: Since Sun at the tie wasn't in the business of shipping embedded Linux VMs, this will be using a VM made by these folks:http://www.skelmir.com/It looks like the libraries are setup to call into their implementation of AWT. In theory you could use proguard or similar to re-write the class references to normal AWT.Java: write once, run somewhereQuote from: 9aplus on February 23, 2015, 12:43:18 pm

author: 9aplus
author_rank: Regular Contributor
timestamp: February 23, 2015, 06:40:44 pm
content: Well for sure something is not good regarding The file transfer....Here is my FTP transfer attempt, maybe someone can find out, what is wrong....QuoteEnabling all kind of reading and writing on home of user qQuoteftp server start....Quotetelnet on E7495BQuotechanging path to righ folder....QuoteLogin to ftp server on Ubuntu PCQuoteTransfer started, but takes bit long for small 8kb file (smallest in folder), ftp closed, telnet quitQuoteSame result, test file libguiutil.so have 0 size....For reference vsftpd.conf is ->QuoteAny tips or tricksEDIT: for evidence, just made ftp transfer of 40 k file from another PC terminal console, without any trouble....conclusion my ftp server setup on Ubuntu is OKE7495B do not like to give his precious files away

author: Urs42
author_rank: Unknown
timestamp: February 23, 2015, 08:40:36 pm
content: The most important line is:Code:421 Data timeout. Reconnect. Sorry.Looks like a network or firewall problem. I have no idea about the default firewall config on a Ubuntu System. You also had troubles with the HTTP download. I think HTTP should work with any default firewall setup. Is telnet stable? Can you compare the Output of ifconfig on the PC and E7495? Are there any errors in the output of dmesg on both devices?

author: 9aplus
author_rank: Regular Contributor
timestamp: February 23, 2015, 11:00:34 pm
content: Telnet is stable, tests with mkdir or chmod are okHTTP transfer failed on Ubuntu and Windows 7 (second PC was first try) both are on Wireless and E7495 is on LAN Ethernet....Maybe should test tomorrow with crossover CAT 5 cable or on other LAN hub/switch too. (LAN to LAN)After booting there are no Errors by dmesgRegarding Output of ifconfig on the PC and E7495, will see that tomorrow.

author: 9aplus
author_rank: Regular Contributor
timestamp: February 24, 2015, 12:33:55 pm
content: After some re-formating of CF (8 GB Trascend) upgrade done....but comm / download problem for egclient.jar still exist, at last on HTTP protocol

author: 9aplus
author_rank: Regular Contributor
timestamp: February 24, 2015, 02:24:13 pm
content: Now copy of ifconfig...Ubuntu PC->QuoteE7495B ->Quote

author: 9aplus
author_rank: Regular Contributor
timestamp: February 24, 2015, 03:32:09 pm
content: Another ftp session now wire LAN to LAN... no luckQuoteMust be some of E7495B Linux setting

author: 9aplus
author_rank: Regular Contributor
timestamp: February 24, 2015, 06:51:21 pm
content: Well, after upgrade is done,at last can use CF memory to get some measurement data out of E7495B

author: 9aplus
author_rank: Regular Contributor
timestamp: February 24, 2015, 10:16:00 pm
content: By the way,any of you managed to set HW date/clock....Can not figure what is set sintax?QuoteEDIT:Later managed that sintax->QuoteWhen you are happy with your system time, remember to set hwclock too,Set hardware clock to system time ->QuoteUseful link, it seems that good part of E7495B Linux distribution is sourced from here ->http://busybox.net/downloads/BusyBox.htmlhttp://busybox.net/downloads/

author: Wuerstchenhund
author_rank: Super Contributor
timestamp: February 25, 2015, 06:34:17 am
content: Quote from: 9aplus on February 24, 2015, 06:51:21 pmOne of the things that annoy me with the E7495 is that the default setting for screen shots is a white background. It looks bad on the image above, but it's absolutely crap in other modes like SA mode where the line is in light green.The setting can be changed in the setup but it has to be done for each mode, and even then will often revert back to white.It would be great if someone figured out a way to make black background the default.

author: Wuerstchenhund
author_rank: Super Contributor
timestamp: February 25, 2015, 06:40:31 am
content: Quote from: 9aplus on February 24, 2015, 10:16:00 pmYes, GPS does it automatically.QuoteAs far as I know it uses parts of BusyBox but apparently the Linux on the E7495B is based on an old SUSE Linux variant from around 2004.

author: Urs42
author_rank: Unknown
timestamp: February 25, 2015, 08:07:21 am
content: QuoteWarning:Changes in /flash are permanent! You can brick your device! Don't change anything there if you are not sure what you are doing. Before you do anything there, use tar to back up all files from /flash to the CF or PCMCIA card!In my first post i mentioned that the power up settings are stored in /flash/egServer/registry/Powerup/ i think that you can't change the powerup configuration with the GUI, but you can configure the device, save the configuration to a profile an then use telnet to copy your profile to /flash/egServer/registry/Powerup/. All profiles are stored as supdirectories of /flash/egServer/registry/QuoteI'm sorry, i can't see anything wrong from here, it's not easy to debug stuff like this without a way to reproduce the issue. I think the Linux on the E7495B isn't the issue here, It could be a hardware issue with your E7495B or some problem with your Network or Computer(s).

author: Wuerstchenhund
author_rank: Super Contributor
timestamp: February 25, 2015, 08:23:39 am
content: Quote from: Urs42 on February 25, 2015, 08:07:21 amSure you can. Just save your preset as "powerup"However this doesn't seem to help for the screen capture background setting, which still seems to revert to white.I also couldn't find a parameter for it in the registry, but maybe I just didn't look hard enough or overlooked something.

author: 9aplus
author_rank: Regular Contributor
timestamp: February 25, 2015, 09:04:01 am
content: Quote from: Wuerstchenhund on February 25, 2015, 06:40:31 amIn that case that is not stored on hwclock or there is no clock backup battery... because my unit was on GPS couple days ago.Quote from: Urs42 on February 25, 2015, 08:07:21 amThank you for your kind effortsNo rush... after all, with all this I am refreshing my Unix know howWith CF use can pick up necessary data for now... and remote is in to do list.E7495B must be capable on VXI or USBTMC commands, that may be also god solution for my future remote...Considering from last night one other way to bring E7485B version ofegclient.jarto Ubuntu PC... by simple copy on CF card, butpath ->on /flash/mnt/cf/>ls -al...empty folder! (some data like screns, xls and update files are on CF for sure....Anyone, what is right path for my CF card?QuoteAsking because >mountreport same devices with and without PCMCIA and CF card plugged on E7495Bno >lsblk to find out, any other way to do it?Quote

author: Wuerstchenhund
author_rank: Super Contributor
timestamp: February 25, 2015, 03:45:37 pm
content: Quote from: 9aplus on February 25, 2015, 09:04:01 amI didn't check but without a charged battery in the battery bays or PSU power it will probably forget the date/time as I doubt it has a separate backup battery.QuoteYou *did* mount the card in the E7495 before you tried to access it, didn't you?QuoteNow that's really easy. It says it right there (I highlighted the relevant part in bold):QuoteIt seems you're using a Transcend 8GB 133x Compact Flash card. But the error messages shouldn't be there.Is the card formatted properly (FAT32)?Quote

author: Urs42
author_rank: Unknown
timestamp: February 25, 2015, 04:08:51 pm
content: QuoteSome init script stores date and time at shutdown to a file in /flash, this date will be restored at the next boot.QuoteI'm not sure if this is a critical error, some CF/PCMCIA cards will produce errors like this one, because they don't understand all command that the kernel sends to them while initializing the card.

author: 9aplus
author_rank: Regular Contributor
timestamp: February 25, 2015, 05:32:38 pm
content: CF card is formated properly. That's the same one from which update to A.06.25 is performedWellQuote from: Wuerstchenhund on February 25, 2015, 03:45:37 pmMy date went crazy again, both accu was inside unit....QuoteWell my expectation was that the system already done that for me....Thank you to both of youMust try advices, than report later....

author: 9aplus
author_rank: Regular Contributor
timestamp: February 25, 2015, 05:52:51 pm
content: Done... on second attempt after rebootQuote

author: Wuerstchenhund
author_rank: Super Contributor
timestamp: February 25, 2015, 07:31:56 pm
content: Quote from: Urs42 on February 25, 2015, 04:08:51 pmYes, but that is only to avoid that new files are written with older timestamps than existing files.QuoteIn my experience (I use CF cards a lot for embedded stuff) the Transcend cards are often more problematic than say Sandisk or Apacer. Especially when they are treated as a fixed disk (like in the E7495) and not like a removable device.However, I have used similar cards (same model, just 1GB and 16GB instead of 8GB) and didn't see such errors.

author: Wuerstchenhund
author_rank: Super Contributor
timestamp: February 25, 2015, 07:41:32 pm
content: Quote from: 9aplus on February 25, 2015, 05:32:38 pmBoth CF and PCMCIA storage remain unmounted until you press the screen shot button or save some measurement data, where the card gets mounted, written to and unmounted. Ever wondered why saving a simple screen shot takes so long? That's why.This way the cards can be removed while the E7495 is still running.

author: 9aplus
author_rank: Regular Contributor
timestamp: February 25, 2015, 09:30:08 pm
content: Last session ->QuoteThis is 4th try and failure.... after >cp on CF card file system is gone, full format on Win PC help to restore... data and screen copyon same CF goes well....

author: CustomEngineerer
author_rank: Frequent Contributor
timestamp: February 26, 2015, 02:53:27 am
content: Quote from: 9aplus on February 25, 2015, 09:30:08 pmYour syntax is a little off. "cp egclient.jar /dev/hdc1" is copying egclient.jar over the hdc1 device, not into it. I didn't think unix/linux would actually let you do that. My guess is that it wrote egclient.jar starting at the beginning of the cf card and overwrote the partition table which is why the file system is gone. The correct syntax would be "cp egclient.jar /dev/hdc1/", notice the trailing front slash after hdc1. Though I still would not recommend doing it this way. I would reformat the the CF card, mount it and then copy it with this command. "cp egclient.jar /mnt/" Again, make sure you get the trailing front slash.

author: ldhn1uec
author_rank: Newbie
timestamp: February 26, 2015, 12:35:57 pm
content: New to the group, new to the unit. At the hamcation flea market i picked up 4 units, all "broken", seems they all work to some extent. one has a broken lcd, all took the firmware upgrade. all have slightly different opotions. dissasembled and reassembled cracked unit, it still works and is useable with remote software. saw some talk of the download issues, check any/all firewall settings on the host pc as the file is pulled from the pc within the java parent. i had trouble until i used the early 1.4 java package. that worked well on xp and still works on w7. starting to look into modifying the options, i'll post results here. i will also mention that since this is an older unit, don't use cf larger than 2g due to changes in sector sizes. find a 64 or 128 MEG cf card for transfers and you'll have much fewer problems. hope that helps.Lou... N1UECSent from my iPad using Tapatalk

author: 9aplus
author_rank: Regular Contributor
timestamp: February 26, 2015, 07:42:56 pm
content: @CustomEngineerer thank you, that was useful tip, copy now in orderConcerning overall progress, something still missing..... Correct path maybe?RemoteGui.jar is not able to start egclient.jar, even not when all are within Home folderWhen run alone egclient.jar makes this screen, and it is not possible to quit OpenJDK Java 6 Runtime.

author: CustomEngineerer
author_rank: Frequent Contributor
timestamp: February 27, 2015, 01:09:23 am
content: Quote from: 9aplus on February 26, 2015, 07:42:56 pmGlad you were able to get the copy done. For what's going wrong now all I can think of is to make sure that you are starting RemoteGui.jar like Urs42 suggested in Reply #35. Pasting it below. Also note that the command is a little different than when he first suggested it back in Reply #29. Good luck.Quote

author: 9aplus
author_rank: Regular Contributor
timestamp: February 27, 2015, 12:35:43 pm
content: Yes, you are right, just forgot on that advice...Now all running well(except ftp file transfer, but who cares)Like to thank to all of you. for kind assistance and patienceon this small E7495B tutorial on Java & Linux

author: 9aplus
author_rank: Regular Contributor
timestamp: February 27, 2015, 06:44:39 pm
content: Java application running but something is still not good regarding communication ->Quote

author: jwm_
author_rank: Frequent Contributor
timestamp: February 27, 2015, 11:32:32 pm
content: got my E7495A for repair but without any accesories or charger. can someone tell me the polarity/voltage of the external power port?

author: Wuerstchenhund
author_rank: Super Contributor
timestamp: February 28, 2015, 08:36:15 am
content: Quote from: jwm_ on February 27, 2015, 11:32:32 pm24Vdc, positive inside, negative outside

author: Wuerstchenhund
author_rank: Super Contributor
timestamp: February 28, 2015, 08:51:06 am
content: Quote from: PA0PBZ on February 22, 2015, 06:01:31 pmIt would be interesting to find out how similar the hardware is, and if some of the capabilities of the N1996A could be transferred to the E7495.

author: PA0PBZ
author_rank: Super Contributor
timestamp: February 28, 2015, 09:11:42 am
content: Quote from: Wuerstchenhund on February 28, 2015, 08:51:06 amIt would be nice to have a service manual for either, but I only found the N1996A one at Agilent for about $400

author: 9aplus
author_rank: Regular Contributor
timestamp: February 28, 2015, 10:00:55 am
content: Quote from: Wuerstchenhund on February 28, 2015, 08:36:15 am100W PS -> 4+ A current

author: ldhn1uec
author_rank: Newbie
timestamp: February 28, 2015, 09:58:00 pm
content: so, i have found the power supply can bve almost anything with a + center. the spec for the instrument is 10-24 volts at least 65 watts. 12v 5 amps works fine, as well as 19.8v and 4.14a.my tinkering is going well. DO NOT ALTER the lower limit of the receivers as that will cause the system to fault. 375 is the actual \low limit. (was trying to squeeze vhf out of the swr bridge).still comparing the dumps of the 4 units to decode the licensing arrangement. does seem that the only changes are the lic files as the other files are present anyway.anyone have luck rebuilding or replacing the li-ion batteries?as far as the remote gui, no joy on java 6, go back to java 1.4.2 and all was well. don't forget the loc/remote button to enable full control from the pc. even with a cracked lcd the remote software allows me to work with it.so far so good 3/4 are working and 1 works but is -10db on spectrumnot bad for $50 each!Sent from my iPad using Tapatalk

author: 9aplus
author_rank: Regular Contributor
timestamp: March 01, 2015, 10:45:10 am
content: QuoteYou are running 1.4.2 on windows ?Which one ? My try on Win 7 no luck....How do you run remote gui on Win os?

author: Urs42
author_rank: Unknown
timestamp: March 01, 2015, 05:31:31 pm
content: QuoteDo you have the A or B model? The range of the E7495B goes from 10MHz to 2.7GHz, but the preamplifiers only go down to 375 MHz. 10MHz is written on the front panel, but i can enter frequencies down to 500KHz.

author: ldhn1uec
author_rank: Newbie
timestamp: March 02, 2015, 03:00:39 am
content: i have the 7495A. the spectrum analyzers go down fine, the swr bridge/return loss port will not go below 375mas far as the gui, you need to uninstall java completely, go to the java site archives and get the 1.4.2 java package and install it. then the gui parts work fine. when i get round to it i may try 6.attempted to swap lic&hostid files with no luck. seems to be more involved. may try the patch listed above.Sent from my iPad using Tapatalk

author: 9aplus
author_rank: Regular Contributor
timestamp: March 02, 2015, 03:48:24 pm
content: Regarding sensitivity of E74 on low freq...Last night have tuned down on AM 0,5-1,6 MHz band, result lot of AM carriers - not good....Therefore just made small test by joining E7495B with FT-817 (Yaesu), same LW antenna with N 1 to 2 switch.Conclusion is what 817 hear that E74 can "see". Must try also on 3,79-3,80 MHz DX windowduring the night or early in the morning (gray zone) too but for day time here is 14.070 MHz PSK stream.

author: Aleuli
author_rank: Newbie
timestamp: March 02, 2015, 07:38:01 pm
content: The E7495 does have a higher noise floor bellow 375Mhz(~37dBm more). This is due to internal Pre-AMP limits.http://www.keysight.com/owc_discussions/thread.jspa?messageID=106466

author: LogicalDave
author_rank: Regular Contributor
timestamp: March 20, 2015, 05:02:34 pm
content: I have an E7495A and an E7495B. Does anyone know:1) What the latest firmware version is for each and where to download it?2) Where replacement batteries can be purchased at a reasonable price?Thanks!

author: PA0PBZ
author_rank: Super Contributor
timestamp: March 20, 2015, 06:25:42 pm
content: Quote from: LogicalDave on March 20, 2015, 05:02:34 pmGo herehttp://www.keysight.com/main/facet.jspx?&cc=US&lc=eng&k=E7495A&sm=gthen drivers, firmware & software on the left

author: Wuerstchenhund
author_rank: Super Contributor
timestamp: March 26, 2015, 06:18:29 am
content: Quote from: LogicalDave on March 20, 2015, 05:02:34 pmThe batteries are made by Inspired Energy, the original model number is NI2040AG (if it carries the Agilent label) or NI2040MG (if it carries the IE label). There are now variants with larger capacity:http://inspired-energy.com/standard_products/NI2040/NI2040.htmIn the UK, they're sold by Accutronics:http://www.accutronics.co.uk/inspired_energy_batteries/ni2040hd24.htmlhttp://www.accutronics.co.uk/inspired_energy_batteries/ni2040ed29.html

author: The_Hari
author_rank: Newbie
timestamp: May 02, 2015, 11:16:59 am
content: Hello Everyone,I have an e7495a from ebay and i'm very happy with it.My Questions are:1. Is it possible to use SCPI over Lan?2. There is also a Webserver, it asks for a Password but the root-or guest-password doesn't work.3. Anyone an Idea, how to add other Modulations to the Generator?Thx to Alll for the nice Work on this Device till now

author: duggerd
author_rank: Contributor
timestamp: May 26, 2015, 04:43:17 pm
content: I bought one of these a few weeks ago, and through my searching around I have found the service manual for it, as well as the latest FW. The FW is the same for both the E7495A and E7495B models.Service Manual:https://www.w35ktn5.com/share/e7495serv.pdfLatest FW (A.06.25):https://www.w35ktn5.com/share/full625.zipThe service manual details the installation of the FW as an upgrade (just unzip to a CF or PCMCIA card) and insert before boot. Then confirm the upgrade using the OK button.You can also do a fresh install by instead of pressing OK at the upgrade screen, press the bottom button on the right hand side of the screen, the one directly opposite the screen from the NO option on the analyzer.

author: The_Hari
author_rank: Newbie
timestamp: May 26, 2015, 11:09:13 pm
content: Thank you very muchFeels a little bit faster with the new FirmwareMy next Step will be a self-made Battery, because an original one is way too expensive.

author: duggerd
author_rank: Contributor
timestamp: May 26, 2015, 11:12:35 pm
content: Quote from: The_Hari on May 26, 2015, 11:09:13 pmI was just going to make a battery that attaches to the back of the instrument and connects using the existing DC barrel connector.It would be interesting to make some batteries that use the SMBus protocol that are not the rare ones that it comes with. You could probably do it with some lithium primary cells and 3D printed endcaps along with a little controller board.It would probably be cheaper than the $200 that the replacement batteries are going for, even for one-offs.

author: realcastle
author_rank: Newbie
timestamp: June 09, 2015, 10:06:28 pm
content: Hello everybodyIn find very interesting this approach of Agilent E7495 ,specially getting access into ARM LINUX system as root.My problem is on CSA n1996a ,it works very well as guest-TELNET using "noname " password , but unfortunatelytelnet as root can not login using the E7495 "wh1skers" password.Could someone help me?Thank you.

author: cepillo
author_rank: Newbie
timestamp: June 10, 2015, 01:39:26 pm
content: Does anybody can help me with the password?

author: PA0PBZ
author_rank: Super Contributor
timestamp: June 10, 2015, 01:42:26 pm
content: Quote from: cepillo on June 10, 2015, 01:39:26 pmThere's probably nothing behind there, at least on the N1996A there's nothing.

author: cepillo
author_rank: Newbie
timestamp: June 10, 2015, 03:00:22 pm
content: Thanks for the response.The reason is I can't save (download) the collected data.I don't have PCMCIA and CF card and readers (or adopters).According to the Guid :-Two RS 232 (DB-9) (reserved for future use)-Two USB 1.1 (reserved for future use)-One LAN Port 10 Base T-PCMCIA Card slot-CompactFlash memory (type 1 & 2)Is USB working after version upgrade?

author: realcastle
author_rank: Newbie
timestamp: June 10, 2015, 05:43:04 pm
content: Thanks to PA0PBZMy CSA n1996a, FW :A.02.07 works full options ! The USB mount and transfer method very simple.As hex editor I have an Octeta on a Linux MINT OS.Best regards !

author: wavebits
author_rank: Contributor
timestamp: July 04, 2015, 07:21:11 pm
content: Thanks to everyone that has contributed to this interesting thread.. It looks to be a pretty cool instrument that has some hacking potential.I just picked up a E7495B from fleabay and have been playing a bit. The original firmware as received was v6.10 which I upgraded with the 6.25 fw from the link in this thread. I was able to telnet into the device and back up the /flash directory to CF first. One thing I am noticing I did not appreciate before the update is a periodic hesitation in the SA display; once about every 10-12 seconds there is a about a 1 second pause in the display response. It is fairly subtle but definitely there. Has anyone else noticed it?My unit has the 510 complex signal generator. It seems to be a pretty common option. It sure would be great to get some conventional FM modulation from the SG to provide partial "service monitor" functionality for testing analog FM radios and repeaters . It can generate QPSK signals for IS95 forward and reverse links so one would guess the hardware may be capable of conventional FM or at least PM modulation with it's internal ARB. Any thoughts?Even better would be the ability to add more digital modulation modes like P25 and DMR. That would make it really useful.Dave, K7DMK

author: Urs42
author_rank: Unknown
timestamp: September 16, 2015, 11:53:44 am
content: Hi wavebitsI did find the data files for the complex signal generator on the device, i think you can find them inCode:/flash/egServer/Dragonfly/Measurements/DataThe Content of this Directory:Code:Size Filename----- ---------------------------------------------788K 1xEVDORev4608ArbPlayback1.bin788K 1xEVDORev96ArbPlayback1.bin788K 1xEVDORevArbPlayback1.bin12K C2KRevFundamentalRandomPayload.bin12K C2KRevFundamentalZeroPayload.bin1.4M iDENInOneSixthArbPlayback1.bin12K IS95RevAccessZeroPayload.bin12K IS95RevTraffic144FixedPayload.bin12K IS95RevTraffic144ZeroPayload.bin12K IS95RevTraffic96FixedPayload.bin12K IS95RevTrafficRandomPayload.bin12K IS95RevTrafficZeroPayload.binThe Data is sent to the signal generator over a serial interface. I think that it should be possible to replace those Files. I'm not sure about renaming the menu options on the Device, i think you would have to recompile the gui .jar file to do that.

author: ve7xen
author_rank: Super Contributor
timestamp: September 17, 2015, 06:13:19 am
content: Hi guys, thanks for all the hard work on this SA! I've just picked one up in good working order and have been playing around, seems like an excellent unit for the money I paid.I intend to do some more poking around at this box over the coming weeks and will post my findings here.For now I have mirrored some of the useful files on my web server in case they ever disappear (as the firmware updates apparently have from Agilent's site...):http://www.gotroot.ca/e7495/. Many thanks to those who found them.

author: TheSteve
author_rank: Unknown
timestamp: September 17, 2015, 06:20:12 am
content: Excellent buy - did you pick the one up that has been for sale on CL locally(Burnaby) for a while now?

author: uski
author_rank: Frequent Contributor
timestamp: October 08, 2015, 03:07:30 am
content: HiDoes any of you have the latest E7495B firmware update files ? They seem to have disappeared from Agilent website...Also, do you know if there are some hardware options or all options user installable ?Thanks !

author: ve7xen
author_rank: Super Contributor
timestamp: October 08, 2015, 03:08:49 am
content: Quote from: uski on October 08, 2015, 03:07:30 amSee my post two up from you...

author: uski
author_rank: Frequent Contributor
timestamp: October 08, 2015, 03:26:02 am
content: Quote from: ve7xen on October 08, 2015, 03:08:49 amThanks for the firmware !!!Do you know about the options ? Specifically is it possible to install option 240 if the unit didn't come with it ? (question before buying, I can't try...)

author: ve7xen
author_rank: Super Contributor
timestamp: October 08, 2015, 03:28:13 am
content: Quote from: uski on October 08, 2015, 03:26:02 amYes, all the software options are hackable pretty easily. Read the thread, you need to hex edit one file and maybe fiddle around a bit.

author: uski
author_rank: Frequent Contributor
timestamp: October 08, 2015, 03:34:56 am
content: Quote from: ve7xen on October 08, 2015, 03:28:13 amThanks. Wasn't sure if 240 was a software or hardware option.EDIT: Here's the list of hardware vs software options from the service manual :

author: 9aplus
author_rank: Regular Contributor
timestamp: November 06, 2015, 04:48:09 pm
content: Over the time of approx 10 months my unit LCD developed delamination / deteriorationSee both up left and bottom corners, and switch off picture of left up, it is between LCD layers...Unit was stored over the summer in original bag within dark & dry and temperature was never more than 30-32 o CThis is the same unit picture from FEB 2015.Unit is still good for use, butnow looking for spare screenor whole broken unit with good LCDPS any lead on LCD type and producer is much appreciated

author: 9aplus
author_rank: Regular Contributor
timestamp: November 08, 2015, 03:58:39 pm
content: LCD Info from OM Serge @ HP/Agilent-Yahoo groupQuote

author: Wuerstchenhund
author_rank: Super Contributor
timestamp: November 09, 2015, 04:16:20 pm
content: Quote from: 9aplus on November 08, 2015, 03:58:39 pmDatasheet:http://www.spectrah.com/product/lcd_panel/nec_lcd_panel/nec_NL6448BC33-50_tft_color_lcd_module_specification.pdf

author: 9aplus
author_rank: Regular Contributor
timestamp: November 09, 2015, 08:39:14 pm
content: Tnx @WuerstchenhundHave located few sources, prices going from USD200 to 380EuroJust must first open my unit to verify model, just to be on safe side.

author: jwm_
author_rank: Frequent Contributor
timestamp: November 10, 2015, 08:02:52 pm
content: My LCD is undergoing the exact same thing, except is more further along than yours. Unit still works properly, but a good cm of the corners are now gone.It almost looks repairable, like a gasket or something is being pushed over the lcd or behind the backlight. Have not tried to dissasemble it yet though.

author: sportq
author_rank: Regular Contributor
timestamp: September 01, 2016, 10:34:46 am
content: I just got one of these, an E7495A with all the hardware options except E1 tester. I tried to follow the instructions in post #22 to patch the/flash/egServer/elgatobinary however it doesn't seem to work. In fact when I try to go to page 2 of 2 of theSYSTEMmenu the device hangs. I've put it back to the original binary and the menu works again. Is there anything else that needs to be modified? It mentions editing the ]tt]elgato.lic file but it's not clear what should be done. I'd really like to enable option 300, the DC Bias output.I've also downloaded the Debian Woody (3.0) ARM iso to get some useful Linux binaries. So far I've extracted and testedbusyboxto test the process but I'll make an archive of useful ones (sshdwould be great if it works). If any owners want something specific, let me know.Lastly, I've contacted Keysight to see if they will release the Linux kernel.configfile. It's a while since I hand-rolled a kernel but I'm sure I'll manage it. USB storage support would be very useful, even if it's only 1.0 (12Mbit/s).Peter

author: PA0PBZ
author_rank: Super Contributor
timestamp: September 01, 2016, 10:48:22 am
content: Hi Peter,Do you have the correct firmware version? The patch is for version A06.25.Did you find theto changebytes to be the same?

author: sportq
author_rank: Regular Contributor
timestamp: September 01, 2016, 10:54:13 am
content: Yes, sorry, I should have said, I upgraded to A.06.25 via the link above and the bytes to be changed matched exactly. I reloaded the modified binary into the hex editor to check they had changed too.Pete

author: PA0PBZ
author_rank: Super Contributor
timestamp: September 01, 2016, 10:59:08 am
content: If your hex editor didn't do anything weird to the file like inserting the bytes and not overwrite them (file length still the same? Can you run a compare?) then the only other thing I can think of is that there is something strange in your license file that is causing this. Can you post the contents, or maybe PM me if you don't want it exposed to the world...?

author: Urs42
author_rank: Unknown
timestamp: September 01, 2016, 11:42:20 am
content: Or send us the MD5 sum of the original and modified fileI think the modified version should have the md5sumf05c12d848c7faf8866359ae33e1cfec elgato.patch7e7736a973cccb6b131f803e7f92dcac elgato.origI'm not 100% sure about the two checksums, i'm at work and my computer at home not on.

author: sportq
author_rank: Regular Contributor
timestamp: September 01, 2016, 11:54:43 am
content: I'm away from the device too, I'll post the checksums later. Thanks for all your help.One other interesting observation the processor board has an IrDA port but I don't think it's available on the case. There's a script to start it in/etc/Peter

author: sportq
author_rank: Regular Contributor
timestamp: September 01, 2016, 08:06:07 pm
content: Confirm the md5 checksum:Code:$ md5 elgato.modMD5 (elgato.mod) = f05c12d848c7faf8866359ae33e1cfec... and both the original and modified files have 5165908 bytes.Peter

author: DogP
author_rank: Regular Contributor
timestamp: October 22, 2016, 10:52:27 am
content: I recently grabbed one of these (E7495A)... Thanks for all the work everyone's put into it so far.I've been having fun with it, like most of us in this thread.I rebuilt one of my battery packs, and got it running my own waveforms... so I'll post that stuff when I get some time tomorrow.Quote from: sportq on September 01, 2016, 10:34:46 amI'm seeing the exact same thing... did you ever work it out? What I've noticed is that the options actually work (i.e. other tests, waveforms, etc. show up and are usable), but going to pg. 2 of the system menu causes it to hang. I'm curious whether it's something to do with E7495A. I upgraded my firmware to 6.25 as well.BTW, I'm pretty sure the DC Bias option is only supported on the E7495B. I tried removing it from my .lic file, just in case that was the problem, but it didn't fix it.Can anyone else that has the modified file confirm that they're able to access pg. 2 of the system menu? Are you running an E7495A or E7495B?Thanks,Pat

author: PA0PBZ
author_rank: Super Contributor
timestamp: October 22, 2016, 11:45:59 am
content: Quote from: DogP on October 22, 2016, 10:52:27 amSo this only happens after you patch the elgato binary? What if you replace the .lic file with an empty one or just one option?Edit: Please PM me your original .lic file. I found a problem with the one sportq was using and we solved it.

author: DogP
author_rank: Regular Contributor
timestamp: October 22, 2016, 12:12:05 pm
content: Quote from: PA0PBZ on October 22, 2016, 11:45:59 amYeah, it's just with the patched binary... but I got it working. I just had to add SIGN=000000000000 to the end of the lines. It seems that the license page barfs without some SIGN value for features it has.Thanks,Pat

author: sportq
author_rank: Regular Contributor
timestamp: October 22, 2016, 12:16:55 pm
content: Pat, really interested in the waveforms you've created. What are they? FM and AM would be useful but I'm not sure there would be any control over the modulation parameters.Pete

author: DogP
author_rank: Regular Contributor
timestamp: October 22, 2016, 07:55:48 pm
content: Quote from: sportq on October 22, 2016, 12:16:55 pmCurrently, I've just been making test files... mostly offset CW to make sure I understand the format and specifics of how it works.It's not a great signal generator... for most modulated signals (arbitrary and internally generated), it looks like they're simply mixing a 60 MHz IF with an LO (at the desired frequency + 60 MHz). So, the desired signal, LO, and an image are all very strong. The one signal (iDEN) looks like they're using a 24 MHz IF, but probably still at the same internal sample rate or something, as there are images 12 MHz off from the desired and upper image (one being up 60 MHz from the desired freq). So, if you just need a signal present in a narrow bandwidth it's fine, but without a suppressed carrier or images, it's not a very good general purpose generator.It's also not very flexible. If you change the size of the file, it looks like the software knows that it needs to process more or less (generating takes shorter or longer), but when it actually plays it, it's always the size of the original file. I'm guessing it writes the file into RAM of the signal generator depending on the actual file size, and then tells the generator to play a hardcoded size depending which "file" you're playing. So, if you give it a file smaller than the original, you can see it play your file and then the end of whatever file you played before that... and a longer file never plays anything beyond the size of the original file.The files are also short. The 1xEVDORev bin files are all only 80ms long, and the iDENInOneSixthArbPlayback1.bin file is 1.44 seconds long. The "Arb" in the name means that it's an arbitrary waveform... the other files are basically just parameters to use to make the signal (for example IS95RevAccessZeroPayload.bin is just 12KB of 0s... obviously not an actual waveform file). Those non-Arb waveforms look like they may be generated and uploaded to the signal generator in a similar way though, so it may be possible to write your own program on the box to generate and upload your own waveform... if you can figure out the interface/protocol.The file format for the Arb files is simply a complex (interleaved I and Q) signed 16-bit integer (no header or anything). The integers are little endian, and it's I then Q (i.e. bytes 0 and 1 are I, 2 and 3 are Q... and so on). The EVDO files are 2.5Msps and the iDEN file is 250Ksps.Attached are some screenshots of various signals (simply cabled between RF Out and RF In). The selected output frequency of all of them is 2 GHz. The 10k file is a tone at +10 KHz, the 50k file is a tone at +50 KHz. I tuned the spectrum analyzer to 2 GHz for the close-in views, and to the LO frequency for the wide views.I also attached those files in case you'd like to try them out. Simply copy them to the signal directory and rename them to the desired file name (50k is for an EVDO file, 10k is the iDEN file) and select it in the signal generator to play them back.If anyone can figure out how to make the generator play different length files, that'd be great. It seems to fail generating files larger than ~2MB, but even so, a 2 second 250Ksps (or 200ms 2.5Msps) file, remapped to a CF card instead of internal flash would be pretty nice.Pat

author: DogP
author_rank: Regular Contributor
timestamp: October 22, 2016, 11:14:46 pm
content: Here are a bunch of pics from my battery pack rebuild. It's a 9 cell 18650 pack, with SMBus, fuel gauge, protection, etc. I'll try to go through the process, and mention any gotchas as well. But first of all... let me start by saying I've never rebuilt an 18650 battery pack, and I don't own a battery tab welder. So, I bought batteries with tabs already attached, so I could solder to them (soldering directly to 18650s is hard, and the heat isn't good for the battery). The battery tab welder would have made things quicker and easier though.The obvious things: safety first... lithium batteries hold a lot of charge and can be dangerous, catch fire, etc. Pay attention to battery polarity, and don't attempt this if you don't know what you're doing.I chose the HyperPS brand batteries, with tabs attached, which were <$3 each shipped on ebay (these:www.ebay.com/itm/272359448176). They claim guaranteed >2600mAh, but suspicious of unknown brands, I made sure to test them in my BT-C3100 charger/tester before building the battery pack. These actually tested quite well, >2800mAh each. In case you don't know, fake 18650 cells claiming ridiculously large capacity (6000mAh, 9800mAh, etc) are all over the place, and generally they are actually junk (<1000mAh). A real 18650 will generally be around 2000-3000 mAh. The original batteries were MOLI FSPE.70037 (ICR-18650G), which were 2000mAh cells.GOTCHA: make sure the length of the new cells are close to that of the original cells (~65mm). The original cells are unprotected, so you'll probably want to stick with unprotected cells, as the protection circuit generally adds a little bit of length, and there isn't a lot of extra room.To open the pack, peel back the short side of the label (or cut it, though if you leave it in one piece, it works well to hold the pack together). Go around the edge of the pack with a knife to crack the small dots of superglue holding the plastic pieces together at the edges. You can also crack the glue by twisting it like you're popping ice cubes out of a tray.GOTCHA: the pack was assembled in the bottom half (side with the battery contacts), and then some RTV was put on top and closed up. You want to disassemble it in the reverse order. If you pull the pack out of the bottom (like I did), it'll bend the battery contacts and rip the LCD cable (I ended up replacing it with standard 0.05" ribbon). Instead, you should open the pack by prying the top from the batteries. Then, once the top is open, lift the pack straight out of the bottom. Clean out any large globs of RTV from the case so they don't interfere with the fit of the new cells.Once it's out, desolder the two tabs from the PCB, undo the Kapton tape holding the fuses, and cut the metal strips connecting the fuses to the batteries (leaving as much of the strip as possible, as you'll probably want to reuse it), and remove the PCB and fuses. Once that's removed, you can pop apart the original pack and see how it's connected... it's 3 series packs of 3 batteries in parallel. You'll want to start by assembling your 3 parallel battery packs. If using the solder kind, rotate the tabs so you're soldering away from the center of the battery, so it'll solder easier, and apply less heat to the battery. Make sure the tabs also line up on all packs, so they're easy to connect in series. The battery pack is tight, so try to keep the solder fairly low profile. Once they're all assembled, drop them in for a quick test fit.Next, you need to add the tabs that go to the PCB. Look at their placement on the original pack, and try to get it as close as possible on the new pack, so the PCB will fit properly. I added Kapton tape between the packs, so all current will flow through the tabs... though that's not very important, as they're connected in series anyway. I then soldered the tabs between packs together and slipped a piece of heatshrink over them and taped them down with Kapton. I then transferred over the tape from the old batteries to the new ones for the boards and fuses, and put a few pieces of Kapton over the pack to keep it held together. I desoldered the red and black wires from the PCB (so the PCB was completely out of the way), and connected the fuse tabs to the tabs on the ends of the pack, and cut off any extra tails. I then put Kapton over the ends, since there wasn't enough room in the pack for the cardboard endcaps that were on the originals.This gives you batteries fully assembled, with a red and black wire and two tabs sticking up. Then solder the red and black wires to the PCB and press it down over the tabs and solder the tabs. Then carefully drop the entire pack into the bottom of the shell, making sure the battery contacts go straight into the slots. You may need to pry the plastic back a bit on the LCD end to pop the LCD in place. Then with a multimeter, make sure you have around 11V across the points where you soldered the red and black wires.Finally, temporarily close the lid, slide it into the E7495, and make sure it's functional before permanently closing it up. Once you know it works, I'd put a few dabs of superglue around the plastic shell, pull the label tightly over the shell and seal it up (the label should still be tacky, but will probably need a bit of glue/adhesive for a permanent seal).The battery fuel gauge will be wrong (mine said 0% when it started, even though it already had a half charge), but after a full charge and discharge, it figured itself out. There's an option to refresh the battery on the E7495 (automatically charges, discharges, and recharges), though it didn't work for me (it never completed because the gauge never showed that it was fully charged).Anyway, I hope this helps... or convinces you to just spend the $200 on a new one. :-PPat

author: TheSteve
author_rank: Unknown
timestamp: October 23, 2016, 12:30:47 am
content: Nice rebuild of the battery. I need to find some cheap/free packs from the 7495's big brother the N1996A to rebuild. I rarely want to run it on batteries but once in a while it could be handy.btw for anyone doing a battery rebuild like this be sure to start with all cells having an equal charge status.

author: smgvbest
author_rank: Unknown
timestamp: October 23, 2016, 01:20:31 am
content: Thank you for the battery rebuild, that will come in very handy. I've got one battery going thru the recondition now and the other no so healty so this is great timing.Also thank you for the hack to enable options. I don't have the HW for Opt 500 or the E1/T1 options but every thing else enabled just fine.Does anyone know how to get to a self test screen or if it even has one?

author: DogP
author_rank: Regular Contributor
timestamp: October 23, 2016, 01:45:44 am
content: Quote from: TheSteve on October 23, 2016, 12:30:47 amAh, yes... good call on the charge status. Another note... according to the manual, the E7495 heavily drains batteries even when turned off. It says 18% per day, just to monitor for the power button.I know what you mean about batteries though... plugged in is nice on the bench, but laziness usually gets the best of me, and not having to find an outlet somewhere else makes me more likely to use it. That's why I've got a battery powered oscilloscope as well.Oh, somewhat related... I tested the batteries I pulled from the original MOLI battery pack. One battery was shorted, which drained all 3 of those connected cells to 0V and ruined them. The other 6 actually tested good, between 1700 and 1900 mAh. So, I'll keep them around for future projects where a mediocre used cell will work fine.Quote from: smgvbest on October 23, 2016, 01:20:31 amUnder system->pg. 2->service->verification there's a display and button test... but it's not much of a self test. I'm not aware of anything like a memory, etc. test.Pat

author: DogP
author_rank: Regular Contributor
timestamp: October 23, 2016, 10:42:14 am
content: Quote from: sportq on October 22, 2016, 12:16:55 pmFor anyone interested in making your own waveforms, but not really sure where to start... here's a quick tutorial for making a compatible FM file in Octave (should work in MATLAB too). You'll need the communications package installed (I believe you'll need the communications toolbox for MATLAB).I'm using the piano2.wav file from this page:http://www.kozco.com/tech/soundtests.htmlas an example. Below is the code... first you read the wav file, resample it from 48Ksps (audio file sample rate) to 250Ksps (iDEN file sample rate), and take just one channel of the stereo file (and rotate the matrix). Then you FM modulate it to a complex baseband signal. Then to get the signal ready to output, you need to scale it to full 16-bit integer scale, shorten it to 360000 samples (length of original iDEN file), and break the real/imag part of the complex signal into seperate columns of the matrix (for fwrite to output properly). Finally, simply open the file for writing, write the file, and close it. Then copy it to your E7495, put it in place of the iDEN file, and test it out! The process is basically identical for the EVDO signals, except they're 2.5Msps, and only 200000 samples long.Code:pkg load communicationspiano=wavread("piano2.wav");music=resample(piano(:,1).', 250, 48);fm=amodce(music, 250000, "fm", 7500);cp_fm(1,:)=real(fm(1:360000))*32767;cp_fm(2,:)=imag(fm(1:360000))*32767;myfile=fopen("fm_music.bin", 'w');fwrite(myfile, cp_fm, "int16");fclose(myfile);Of course the E7495 doesn't go down to the normal FM broadcast band (only goes down to 375 MHz), so I used an RTLSDR dongle with SDR# to demodulate the FM at a frequency it could work at, to verify it worked.Pat

author: DogP
author_rank: Regular Contributor
timestamp: October 26, 2016, 06:40:44 am
content: Does anyone know what the actual differences are between the E7495A and E7495B? I know the front panel of the E7495A says 10MHz-2.5GHz and E7495B says 10MHz-2.7GHz, but as far as I can tell, both have the same frequency ranges (spectrum analyzer goes from 500KHz to 2.7GHz, antenna/cable analyzer and signal generator goes from 375MHz to 2.5GHz).The only differences I've found (though can't confirm since I don't have both to actually compare) are that the B has the DC Bias option, the signal generator has slightly higher maximum output power for most signals, and accepts more external reference frequencies.Did the B come out after the A and have an upgraded CPU, memory, flash, or anything like that?BTW, I did some more testing on waveform files, and it appears that the largest file it'll fully process is 2MB (corresponds to 200ms @ 2.5Msps, or 2s @ 250Ksps). I haven't gotten it to actually play any longer than the original file length though.Thanks,Pat

author: DogP
author_rank: Regular Contributor
timestamp: November 02, 2016, 05:48:59 am
content: I've noticed a few strange things with my E7495A... can anyone else confirm that these are or are not normal, and that your box does what would seem "normal"?1) Fairly regularly when I turn the box on from the off state, the screen lights up, then fades to black, but it doesn't actually boot (nothing shows on the screen at all). I press the power button again to turn it off (either off or standby), and then press it again, and it boots fine on the 2nd attempt. It doesn't look like it's an LCD issue... it looks like it's just not booting (it never connects to the network, when it does come on it goes through the full boot process, etc).2) When I connect a GPS antenna with a good view of the sky, I easily get GPS (bottom left says GPS Locked), location usually shows ~8 satellites tracked, but the GPS icon in the bottom right never goes to the green dot (I've left it tracking for over 24 hours). It always stays at the yellow triangle. Because of that, I can't run the Time Base Adjustment (it requires me to wait for the green dot). Switching to the internal reference shows a green dot, and the frequency accuracy seems pretty good, so I don't think the TCXO is bad.Also, I noticed that it shows time on the screen, but it never gets set to the correct GPS time (and it appears that the time/date gets reset to the time/date that was set at boot every 30 seconds, even if I manually set it over telnet). The GPS location looks correct though (drops a dot right on my neighbors house :-P ).3) I rebuilt my 2nd battery pack, and like the first one, going through the battery recalibration procedure never finished. It says that it'd take up to 12 hours, and on the first battery I left it running for almost 2 days and it never finished, so it aborted... on the 2nd battery, I left it running since I rebuilt the pack on Friday night... so almost 5 days. I finally aborted it tonight. The battery voltage was slowly creeping upward around 12.4 (going up around 10mV per day) but never hit 12.6V (4.2V per cell)... not sure if it didn't think it was done because of that, or something else. It almost always showed 0 mA current. The percentage shown is usually 99%, though it sometimes bounces down to 98% or up to 100%.The battery life seems fine (~1.5 - 2 hours per battery), so I'm not too worried about it... just seems strange (and my OCD would like that fuel gauge error to say 0%, not 10%)... I also tried just running the batteries down and recharging them normally, but that didn't make a difference.Related to that... the 2nd battery rebuild went smoother than the first. I'll update my rebuild post above with a couple more notes/pics.BTW, I did a fresh firmware install of 6.25 (pressing the bottom right button, across from NO), and it didn't make any difference.Thanks,Pat

author: TheSteve
author_rank: Unknown
timestamp: November 02, 2016, 06:15:30 am
content: Are you using the factory power adapter? Does the unit always boot first try with the batteries removed?

author: DogP
author_rank: Regular Contributor
timestamp: November 02, 2016, 07:57:42 am
content: Quote from: TheSteve on November 02, 2016, 06:15:30 amI'm using an aftermarket power adapter... actually, I've tried two different ones (one of them is a generic 24V 5A supply, the other is a universal 19.5V laptop power supply). Unfortunately, it's not something that I can reliably reproduce. I was able to get it to happen running from battery only, with the 24V supply with a battery installed, and with the 19.5V supply and no battery installed.Not sure if it's a temperature, cap, etc. issue... I assume it's not normal, but wondering if anyone else has run into this issue.Thanks,Pat

author: jwm_
author_rank: Frequent Contributor
timestamp: November 05, 2016, 03:00:19 am
content: Anyone figure out a fix for the screen bezel coming undone? The system works fine, but part of the screen is obscured. Picture attached

author: DogP
author_rank: Regular Contributor
timestamp: November 05, 2016, 09:13:33 pm
content: Quote from: jwm_ on November 05, 2016, 03:00:19 amIf you look at the service manual, there's a detailed procedure for removing and disassembling the display. Pg. 111 removes the front panel from the unit, and pg. 145 removes the display from the front panel. Once there, it looks like the gasket is accessible (MP29).Pat

author: DogP
author_rank: Regular Contributor
timestamp: December 08, 2016, 11:54:09 am
content: I spent a bit of time looking at this again, trying to get some remote access/control working. As noted earlier, the E7495 has a webpage, but doesn't accept the normal login. I noticed a similar non-working login on port 5025. Using netstat, I saw that elgato was listening on those ports. When looking in the /flash/egServer directory, I noticed a passwd file. It looked different than the standard *nix passwd file, but appeared to have a hashed root password in it (RzSdSbSdye).Rather than trying to crack the password, I decided to try simply renaming the passwd file and rebooting. Surprisingly, it didn't recreate it, and now simply accepts any login! (on both the webpage and port 5025).The webpage has a bunch of configuration stuff, though the coolest thing seems to be the "Transducer I/O" section. For example, if you click "Active STIM" you can select 16 (Spectrum Analyzer), and then go to the "Channel I/O" page and click "Array" under Channel 1 to get the spectrum data. You can set parameters, etc. as well, which get set using http POST. I'm not really familiar with it, but I believe this is IEEE 1451 standard stuff. Maybe there's a way to tell elgato to do these operations directly, rather than through http.Port 5025 now accepts any login as well, though I was hoping it'd be SCPI (commonly on that port)... instead, it looks like it's something called the "DMC Shell". Typing "help", it says "The Dmc Shell accepts "C" like function statements and assignments" and gives some examples... not sure how useful it is.I also took a look at the remote GUI... it didn't seem to work on Windows with Java 8 (even using the commands further up in the thread). Rather than dig into it, I installed Java 1.4.2 in a VM, grabbed the jre directory, and explicitly ran RemoteGui.jar using that version of java ("jre\bin\java -jar RemoteGui.jar"). By doing that, the remote GUI worked first try.I was interested in how it communicated, so I sniffed the packets. It looks like most stuff goes over port 5028. The commands and acknowledgements go over TCP, and the spectrum display data goes over UDP. It looks like there’s some status (power, GPS, etc) coming out 1027 as well.I had to make sure Windows allowed the data through the firewall (without it, the TCP commands would go through, but the UDP data wouldn’t, so the GUI would never show the spectrum). Also, Windows 7 temporarily goes back to basic graphics (disabling Aero) when you run Java 1.4.2.The commands going over 5028 don't look to be any standard I'm familiar with. Some examples are (without the quotes, <\n> is hex 0A): “cmd: local<\n><\n>”, "cmd: set<\n>topic: display.global<\n>printFilter: 0<\n><\n>", etc. If you dig through the elgato binary, you can see a bunch of available commands (and you can test them out using nc).Oh, and I quickly glanced at the decompiled egclient posted earlier in the thread... if you look in the manufacturing directory, it appears that there’s a Snake and Tetris game, seemingly in a hidden menu on the Display Test screen. It wasn’t immediately obvious how to access it though.Pat

author: DogP
author_rank: Regular Contributor
timestamp: December 09, 2016, 08:28:41 am
content: Heh, it bugged me having games on here that I couldn't get to, so I tracked it down. :-PThough the code has it with the DisplayTestScreen stuff, it really doesn't have anything to do with that. To get there, you click the Spectrum Analyzer / Tools menu, then quickly click the bottom right display button 3 times. Then the "Extras" buttons pop up with Tetris and Nibbles.DogP

author: TheSteve
author_rank: Unknown
timestamp: December 09, 2016, 08:50:49 am
content: Nice find!You can enable the same web login etc on the E7495's big brother, the N1996A by renaming the /flash/toroServer/passwd file.

author: DogP
author_rank: Regular Contributor
timestamp: December 10, 2016, 10:38:12 am
content: Here's a quick (and kinda pointless) mod... I didn't really like this being called a "Base Station" test set, since it's never gonna test another base station in its life.So I opened up the egclient JAR file (with 7-zip), and replaced the cell tower background with a generic modern Agilent background (that they use on their documentation, etc... grabbed from:http://eprocurement.agilent.com/). I also got rid of the "Base Station" text. It's just a matter of modifying the ModeScreen.jpg and ModeScreen_overlay-E7495A.png (-E7495B if you've got the B model).The colors on the LCD aren't very accurate (it had a much greener tint than it should have), so I adjusted the hue/saturation a bit to get it kinda close to the original blue, and it turned out pretty good.Oh, and something interesting I noticed... in the JAR file is a graphic for the an E7496A. AFAIK, that doesn't exist... I wonder what the specs of that unit would have been.Pat

author: kirill_ka
author_rank: Frequent Contributor
timestamp: January 11, 2017, 10:49:17 am
content: Thank you all for information in this thread. Because of it now I have a new toy (A model).Quote from: DogP on December 08, 2016, 11:54:09 amThe "DMC shell" looks like some kind debugger. It knows functions and variables of elgato process. I don't think it's useful without source code.Interesting thing I found that E7495 is supported by toro executable - N1996A server.I guess, E7495 might be used during N1996A development when N1996 hw was not ready. Maybe E7496 = N1996.Up to this point I got "toro" running on E7495 with some tweaking. It responds to SCPI and HTTP and looks quite healthy. toroGui starts but it might be useless due to keypad differencies.Next thing is to deal with license file and options. Spectrum analyser refuses to work without license. I don't expect a lot, because toro doesn't handle E7495 as N1996.We'll see...

author: DogP
author_rank: Regular Contributor
timestamp: January 12, 2017, 09:17:34 am
content: Quote from: kirill_ka on January 11, 2017, 10:49:17 amHmm... interesting!I'm not quite sure I totally understand though... what is the E7456? When you run toro, is that what it detects your E7495A as? That's a good guess that maybe E7496 = N1996, since both pieces of hardware seem to be related.Regarding toroGui, maybe you could run it over the network, like the E7495 remote GUI, in which case the keypad wouldn't be a problem (using a virtual keypad on the PC)?Pat

author: kirill_ka
author_rank: Frequent Contributor
timestamp: January 13, 2017, 09:08:37 am
content: Quote from: DogP on January 12, 2017, 09:17:34 amTypo... 95, not 56. Fixed that. toro detects E7495A as E7495A. There's a special option for it called GPSA. I see two separate option lists (E7495 and N1996) inside the executable.Unfortunately that GPSA (= general purpose spectrum analyser) doesn't work. I mean it tries. It seems to load dsp program Dragonfly/Measurements/KernelBasic/Superfly/gpSpecAn but fails to communicate with it."Basic" sectrum analyser (Dragonfly/Measurements/KernelBasic/Superfly/nSpecAn) works according to web page (Active STIM/Transducer IO), but SCPI and GUI both trying to use GPSA.Now I'm out of ideas what to try. Maybe older N1996 firmware...Anyway, if you want to try:1. copy flash/toroServer from N1996 firmware A.02.07 to CF/PCMCIA formatted as ext2 (fat may work, I didn't try it)2. change baud rate in toroServer/registry/df1.ini 921600 -> 2304003. patch toro executable and add GPSA license option to license/elgato.lic4. copy cals from egServer5. copy Dragonfly/Firmware/E7495A and Dragonfly/Firmware/CPXSRC from egServerIf you don't copy, toroServer includes older firmware versions and tries to update. A bit frightening. It failed to update CPXSRC. After reboot elgato recovered the firmware, but it took some minutes to start.6. copy Dragonfly/Receivers/comPort4 from egServerAlthough, It didn't change anything.7. killall _siege; /etc/rc.d/init.d/egServer stop8. run toro from toroServer directoryAttaching output from toro.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: January 13, 2017, 09:24:01 am
content: Debug log from GPSA.That "waiting for getMessage(1000)" looks like a problem.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: January 22, 2017, 09:07:50 am
content: I didn't see if it was mentioned, GSM analyser provides some time domain display. It's quite limited, but still usable. Bandwidth is fixed 500kHz. Frequency is in 200kHz increments, but config file can be tweaked for finer adjustments.Here's analogue video signal caught from the air:

author: kirill_ka
author_rank: Frequent Contributor
timestamp: January 25, 2017, 01:07:55 pm
content: Quote from: DogP on October 26, 2016, 06:40:44 amLength seems to be hardcoded in DSP program genIS95.AFAIK debug log show what is passed to DSP. It's modulation type (4, 5, 6, 7 - separate value for each Arb file). And then the ARB file is written to DSP memory.To get debug output:1. Save settings (save state button) to <set>2. Set debug parameter in registy/<set>/sourceStim.ini3. connect to that DMC shell4. activate <set>5. play with generatorDebug output will appear in DMC shell.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: February 11, 2017, 09:45:24 pm
content: I just noticed a weird thing. If I change sig gen amplitude in spectrum analyser mode, signal level jumps up about 25dB. This only happens if spectrum analyser runs in full span (500kHz-2.7GHz). Amplitude control still works, but signal level is higher than normal (i.e. at -50dBm setting, actual level is -23dBm). It recovers after suspend-resume cycle.

author: technogeeky
author_rank: Frequent Contributor
timestamp: February 27, 2017, 04:07:50 am
content: I just picked up one of these for a bargain (partially broken / incomplete). The only known problem is a intermittent busted LCD screen. Since I don't necessarily plan to use it in a portable mode, I may not replace the LCD right away especially if I can get all of this PC-based GUI stuff working. The other problem I anticipate is that it seems like I am just getting the unit -- no accessories whatsoever.Maybewhen the seller ships the backpack to me, it might have some items in it.So, I have a slew of questions:For reference, the unit I supposedly will have in a few days is:Agilent E7495AOptions:200205210220510600700My current questions:What are the minimum set of accessories I will need to test the unit, and test the self-calibration? It seems like I need rather specific cable lengths, specific Agilent-branded 10dB pads, etc. Can I get away with cheaper parts?Does anyone know the full list of power sensors that will work with this device? It seems like there are only one or two.When I entered the model and serial number on Keysight's site, the list of options did not match the advertised list, nor did it match the list on the metallic sticker shown in the auction. Does anyone know if this is normal? Is it possible that this unit was upgraded after initial selling? I know the sticker on the device says Agilent last calibrated it in 2013.Does anyone know what kind of power supplies one can get away with? One of the manuals lists a range of voltages. I have a whole slew of power bricks, but I don't think I have a24V 4Aone. I don't have any batteries to charge, so presumably I don't need that much current anyway.I doubt I have any PCMCIA flash cards. Do I need to buy a specific size? Like really, do I need exactly a 64MB one?The service manual mentions anoptional, internal 90dB attenuator. But I can't find any reference to this anywhere else. Do any of your units have this? Do all units have it? Does nobody have it?I will no doubt have further questions, but for now I don't even have the device in hand.Thanks in advance!

author: DogP
author_rank: Regular Contributor
timestamp: February 28, 2017, 08:19:10 am
content: I'll try to take a crack at your Qs...Quote from: technogeeky on February 27, 2017, 04:07:50 amI don't think there's anything special about the ones supplied. I'm personally using standard cables and attenuators, and a homemade short, open, and load.Quote from: technogeeky on February 27, 2017, 04:07:50 amThe manual specifies that it works with the 8481A, 8481D, and 8482A (and CFT variants).Quote from: technogeeky on February 27, 2017, 04:07:50 amGot a link where you entered the info? I can try mine and see if it's different as well... though I personally wouldn't worry what Agilent thinks you've got. If you go into setup and read out your options, that's what you've got. And if you hack the file described earlier in the thread, you can have all the software options. :-PQuote from: technogeeky on February 27, 2017, 04:07:50 amThe manual states +9V to +25V DC (55W). I've personally run mine from a 24V 5A supply (cheap Chinese power pack) as well as a universal 90W 19.5V laptop power supply.Quote from: technogeeky on February 27, 2017, 04:07:50 amI'm not aware of any limitations... I'm using an 8GB card in mine.Quote from: technogeeky on February 27, 2017, 04:07:50 amIf mine has it, I'm not aware of it.Pat

author: technogeeky
author_rank: Frequent Contributor
timestamp: February 28, 2017, 10:19:40 pm
content: Well, I forgot an important question. I just got my unit today, so before I do something stupid...Is the power supply center-pin positive?Yes*.* I looked through this thread more carefully; it's 9-24V DC, somewhere between 3 and 5 amps; center-pin positive.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: March 01, 2017, 02:08:08 pm
content: Quote from: DogP on February 28, 2017, 08:19:10 amI've read somewhere that 8484 should work. I got 8481D, but not tested yet - cable is on the way.Quote from: DogP on February 28, 2017, 08:19:10 amI use CF with CF to pcmcia adapter. Note that there's also CF slot (it works same as PCMCIA, but doesn't allow to close the door).Quote from: DogP on February 28, 2017, 08:19:10 amIt's for signal generator (source). I think, it's included if it allows to change level to -90 dBm.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: March 01, 2017, 02:52:57 pm
content: Here it is, ATTN OUT to J7/SOURCE IN connection.

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 04, 2017, 08:40:29 am
content: Another few questions:1) Is it possible to keep the power meter reference output on but go back to the spectrum analyzer window, to see it? Apparently this is possible to do with the signal generator, but not with the spectrum analyzer.2) Does anyone have the Service Test software? By this I mean the software package that lets you test all of the functions of the device, as described in the service manual. Perhaps this is something which is on the machine but is not available until you login as root (or some other method to gain access)?3) In terms of disassembly, what actions are likely to destroy any hope of keeping the calibration? E.g. can I (without automatic ruining of calibration):Disconnect the internal flexible SMA connectors?Disconnect the internal rigid SMA connectors (without bending the rigid cables)?Open the various metal cans, while being ESD protected and latex gloved, but without noting torque values for the screws?If you'd prefer, a qualitative assessment of what I can take a look at would be fine with me. I don't (yet) have a suitable torque wrench, so I don't think I'll be doing any of this until after I get one. But I've heard that it's common for these connectors to be overtightened from the factory, and presumably I wouldn't want to repeat that over tightening.Thanks!

author: DogP
author_rank: Regular Contributor
timestamp: March 04, 2017, 10:52:52 am
content: 1) I don't think so, besides maybe manually poking a register under the hood somewhere to turn it on.2) I assume you're referring to the "Agilent E7495A/B Performance Verification and Adjustment software"? I've never come across it, and I don't think it's on the unit itself... I'm pretty sure that's PC based software, similar to this:http://www.keysight.com/en/pd-1000000762%3Aepsg%3Apro-pn-N2717A/performance-verification-and-adjustment?cc=US&lc=eng. It seems like it's generally option 0BW, which includes service and calibration manuals and software, but I don't see this option listed for the E7495, so it may have never been available for customers.3) I'd say you can open the case of the unit, but as soon as you disconnect ANY RF cable, you're going to ruin the calibration. Maybe you'll get it close to original spec, but it'll likely change slightly, and the whole point of calibration is that the system is calibrated for those conditions. Once it changes, you either need to recalibrate, or just live with the fact that your unit isn't calibrated. I don't know what you're hoping to see, but I definitely wouldn't remove any of the cans. It might not affect "calibration" much, but you'll likely affect the shielding effectiveness, and increase your noise floor, interference, spurs, etc.I've never heard about Agilent overtightening of the connectors... that's surprising (I'd figure Agilent would have a pretty good handle on connector torque). There are different torque specs depending on the connector material, specific type, and application though, so they might be tighter than the 8 in-lbs of a standard SMA torque wrench. For example:http://www.amphenolrf.com/connectors/sma.htmlsays 4-6"lb recommended for commercial grade parts, 7-10" lb recommended for industrial/military grade parts, and 15" lb maximum for industrial/military grade parts. Generally, brass parts should be torqued less than stainless steel.Pat

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 04, 2017, 02:18:31 pm
content: Quote from: DogP on March 04, 2017, 10:52:52 amOK. I'll take a poke around. I also want to reset all of the default setups because they are very silly for my usage. What the hell is "Chan 500" and why did they like it so much?Quote from: DogP on March 04, 2017, 10:52:52 amYes indeed. I really hope to get this one day, so perhaps someone here has come across it. I guess I could ask Keysight for it, but I doubt that will get very far.Quote from: DogP on March 04, 2017, 10:52:52 amWell, I am just very curious by nature; and I've never torn down any RF equipment. I also figured it would be nice to get pictures and/or part numbers and post them, since nobody has posted even block diagrams, let alone schematics.Quote from: DogP on March 04, 2017, 10:52:52 amI think my only references are two or three videos of Shahriar's @ The Signal Path. And perhaps it was specifically HP gear that was overtightened. In any case, given the above it won't be a problem since I won't be taking it apart.

author: PA0PBZ
author_rank: Super Contributor
timestamp: March 04, 2017, 02:54:34 pm
content: Quote from: technogeeky on March 04, 2017, 02:18:31 pmIf I remember correctly the software it is supposed to work with specific TM equipment (think sig gen, rf meter and such), and as long as you don't have those it will be of no use at all

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 04, 2017, 09:40:44 pm
content: Quote from: PA0PBZ on March 04, 2017, 02:54:34 pmOh. I thought this unit sort of contained most of the hardware it needed to test itself. I also figured they left space in the UI for those buttons, so maybe it was on the machine. Ah well. It's still an incredible buy at $300 shipped (and now) fixed.

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 06, 2017, 04:54:20 am
content: In searching around for possible calibration software information (both on the unit and in general), I have so far only foundthis documentwhich describesTMEor Test Management Environment.This is the aforementioned piece of software which runs on a computer (apparently with some IO libraries and a GPIB card of some sort).It seems you candownload the latest versionthough it needs a license key. It seems there are very old calibration applications(C.xx.xx), old calibration applications(D.xx.xx)and newer ones(E.xx.xx).The are two new facts that I think this document brings to light, however. One concerns Agilent internal numbering for these devices:TheN1996ACSA is internally known asN7813ATheE7495xBST is internally known asN7816AHowever, the reason I know this is new information is the same reason I also know this is not useful information: a search for N7816A reveals nothing except the above PDF.Secondly, it seems like a very small subset of devices are labeled(internal Agilent only)which presumably means only Agilent themselves can run that cal application. These include:OurE7495xunits.An ACQ/SW unit34970A.All of the Dragonfly-based Digital Receivers (E640xx, E745xx, E747xx).I guessed that this is because all of these units incorporate 'Dragonfly' units (the E7495s appear to), but the 34970A seems to be an exception to this. I won't speculate further.In any case, I wonder if we could appeal to Keysight to release the software and licenses for this, since it's long since unsupported; and they won't even do CALs for these devices anymore.

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 06, 2017, 08:21:07 am
content: If anyone cares to test, I had a theory that perhaps turning off some levels of logging/debugging might help. It turns out that there is no straightforward way to stop the debugging processes, but you can disable any logging.Simply edit this file with the following changes:/flash/linux/etc/rc.d/init.d/egGuiCode:-DLogger.level=2to:Code:-DLogger.level=0Unfortunately I can't find a good thing to test this with. But the UI does seem a bit snappier. I wonder what other options are there for -Dxxx.Also, I played around with the files in/flash/egServer/Dragonfly/Recievers, like E7495A and CPXSRC. You can indeed change things here and sometimes see the effects (e.g. you can change E7495A to haveFreq Rangebe 3000e6, and it makes it possible to enter that value). However, some of these changes will have no effect for other reasons (here, I assume it's because there is actually a filter which sharply cuts off at ~ 2.7GHz).However however, I could not find a way to try and make the signal generator make higher or lower frequency signals.Did anyone actually try porting things from the N1996 over to ElGato? The only things I'd really be interested in are FM/AM demodulation and audio playing, and Harmonics viewing.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: March 07, 2017, 09:23:20 am
content: Quote from: technogeeky on March 06, 2017, 08:21:07 amN1996A spectrum analyser code doesn't work with E7495 for some reason. It attempts to work, but DSP code seems to hang somewhere. See my post above. If you can find different versions of N1996A firmware, we might have a better luck.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: March 07, 2017, 09:30:52 am
content: Quote from: technogeeky on March 06, 2017, 08:21:07 amLimitations are spread in configs, gui, elgato, dsp code and hardware. I mean along with configs there are many hardcoded values.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: March 07, 2017, 09:38:29 am
content: Quote from: technogeeky on March 04, 2017, 08:40:29 amThere's a separate serial port which is used to communicate with power meter hw. It's closed immediately when you exit the power meter. If I have time, I'll try to decode the protocol.

author: PA0PBZ
author_rank: Super Contributor
timestamp: March 07, 2017, 10:01:22 am
content: Quote from: kirill_ka on March 07, 2017, 09:30:52 amIf the 7495 is anything like the N1996 (and we have a lot of reasons to believe so) you will not be able to go above 2.7GHz.The N1996 has 2 receive paths, one for 0.1MHz - 2.7GHz and the other for 2.7GHz to 3/6GHZ. Since the N1996, depending on the model, has an upper limit of 3 or 6GHz both receive paths are there, and that is why you can change the 3GHz model to 6GHz by changing the upper limit value. Since the 7495 goes to 2.7GHz only I assume that the upper part is missing in the 7495. See below the N1996 receive path:

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 07, 2017, 04:06:52 pm
content: Quote from: PA0PBZ on March 07, 2017, 10:01:22 amDo you have any idea about extending the range (power) or (frequency) of the signal sources? Also, it seems the N1996A has a zero-span mode. I wonder if this could be enabled on this device. Also, I wonder if we can expose the number of sample points (in fact, I find it downright weird that these aren't at least listed somewhere, let alone adjustable).

author: TheSteve
author_rank: Unknown
timestamp: March 07, 2017, 05:18:34 pm
content: Quote from: technogeeky on March 07, 2017, 04:06:52 pmI was able to extend both the power and frequency range of the signal source in a N1996A. The power range difference was only a few dB so I changed it back to stock as the real maximum output varied with frequency. I extended the frequency range down to 1 MHz from 10 MHz. I believe the E7495A has similar text files which can edited however I have read someone tried lowering the source range on an E7495A in the past and it would crash the unit when you tried to enter a lower frequency.

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 08, 2017, 04:11:17 am
content: Quote from: DogP on November 02, 2016, 05:48:59 amI thought I might have some insight into this problem, but it appears you already noticed what I noticed. The GPS never goes GREEN, it stays at YELLOW TRIANGLE.I think the problem lies with the time/clock itself. Something is clearly fighting the GPS to reset the clock to some (arbitrary, it seems) earlier value. And I do mean arbitrary. I tried this procedure and I think this pretty well proves something is fighting it:Turn on device, connect GPS antenna.At any time (but for sake of argument, after you notice at least 5 satellites locked), log into the web interface (port 5000). Click on Date and Time, and tell the device to take the current time of the your computer.It will update, but then after about 30 seconds, it will reset to this initial time.No matter how long you wait, it will continue to allow you to set the time; but it will always rollback to this 1st clock set.You can confirm this by changing the time zone on your host computer. This will set the clock to the same time, but it will suddenly be many hours ahead; and the device will still go back to whatever the initial setting was (this can sometimes be Jan 1 2004).However, I do have something additional to report: You can fool the device into launching the Time Base Adjustment (... sort of):When you are at the Time Base Adjustment screen (the Calibrate button will be greyed out)...Log onto the web interface.Click on Active STIM.Select and activate the GPS stim.Click on Channel I/O.Set the Frequency Reference parameter (10) to 0, using the Int 10M reference.This will fool the unit into believing that the 10MHz reference (e.g. the one we are trying to calibrate) is the locked signal. It will bring up the menu we are all trying to see. It will show the ADC value for the reference, and where/when it was chosen (2053, and Initial Factory).This doesn't help us, but I think it must be the case that something is fighting us for the clock. So we just need to find what other processes/stims/whatever access/try to change the clock. Perhaps this is a sign of a hardware malfunction in a clock on the motherboard, or some other malfunction that could be tested/corrected if we could e.g. get into the BIOS? Is there a BIOS?Quote from: DogP on November 02, 2016, 05:48:59 amI rebuilt one of my battery packs, and I took pictures of the process. Unfortunately the 2nd one I rebuilt was actually already good, and I simply hadn't checked. I will be getting batteries in soon to replace the first pack.

author: TheSteve
author_rank: Unknown
timestamp: March 08, 2017, 04:36:06 am
content: I was hoping you were on to something to help adjust the time base on the N1996A. On the N1996A there is a frequency/reference setting menu. It won't let you continue though unless the system is configured for GPS.However the N1996A doesn't support a GPS - it was never enabled and the receiver is not installed.I can set the external reference to "even second" but it locks just fine to a 1 PPS signal(even second doesn't lock).Not a big deal but it would have been fun to adjust the timebase without using the crazy expensive calibration software Keysight sells for the N1996A.

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 08, 2017, 05:20:52 am
content: Quote from: TheSteve on March 08, 2017, 04:36:06 amWell, this may be a route toward that (if a circuitous one). I really don't know that hardware (or this hardware, to be honest). But this method let me see the the value stored somewhere (in firmware or eeprom or something) for the calibration setting (which is, in this case, an integer constant for the ADC). If we could use the screen in which this was displayed (I did not get a screenshot or photograph; I was actually driving my car at the time!) to find where it's writing a firmware setting to, perhaps we could translated this process back to your device?

author: DogP
author_rank: Regular Contributor
timestamp: March 08, 2017, 06:35:27 am
content: Quote from: technogeeky on March 08, 2017, 04:11:17 amIIRC, I came to the conclusion that it's a script running in the background that's causing the time to constantly reset. I think it was keepTimeUpdated or something like that. I don't think the system clock is why GPS never goes green though (I don't think there's any code for the GPS to even try updating the system clock).Quote from: TheSteve on March 07, 2017, 05:18:34 pmThat'd be great to be able to extend the sig gen freq below 375 MHz... and if it could do that, maybe it could do the insertion loss test below 375 MHz as well. Those features would be very high on my wishlist (even though the arbitrary sig gen kinda sucks since it doesn't filter the LO or image). Does the N1996A have an arbitrary sig gen, or just a tracking generator?Pat

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 08, 2017, 10:38:10 pm
content: Quote from: DogP on March 08, 2017, 06:35:27 amI think you are correct. I think I might have proof, but I don't think it's (yet) needed. In any case, when I was having trouble running the Calibrate Timebase thing, it turns out the hardware clock (as displayed by hwclock) was set to Jan 1 1970. In other words, it was just counting up from epoch. There is also an 'rtc' module, whichcouldbe the source of our problem: if the RTC is faulty or resetting, then it's possible the RTC or the manager of it is fighting attempts to set the clock.I have found some code regarding this in the GUI, so I can investigate further.Has anyone been able to decompile the ARM code?I assume there is little to no hope to decompile the firmware for the Dragonfly chips, but the ARM code (of elgato server) should be easy to decompile. I tried downloading and usingsnowman, but it is unfortunately stupid and it runs out of memory at the "regenerating types" stage. It seems to have generated all of the functions from two different binaries, but because I only have 8GB of memory I can't get much further. Does anyone know how to force a process to work from a disk instead of from memory?You can look at the elgato GUI (siege) source JAR linked here, and it's clear that there are a few checking conditions before you're allowed to enter the timebase recalibration. Also, there appears to be a direct command you can issue tosomecommand listener to set the new timebase ADC value directly -- this may help N1996A owners. At the very least, you could GET the existing timebase ADC value and then SET a new one, then compare the clocks (though how one would go about this, I have no idea).

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 08, 2017, 10:46:33 pm
content: Can you guys post screenshots of the noise floor of your instruments? I am wondering noise floor curve on my instrument is wrong or not. See the attached images. This is with nothing connected at all.The screenshots show the measurements and diffs between:500 kHz and 375 MHz (+2.8dB)375 MHz and 2.7 GHz(+10.4dB)Something tells me that a gain of 10.4dB over that range is probably not a good thing.

author: TheSteve
author_rank: Unknown
timestamp: March 08, 2017, 11:54:31 pm
content: Looks pretty normal to me.Edit:I've attached a full span screen shot of my N1996A - however it is only valid to 3 GHz. The drop you see is when it passes 2.7 GHz. The noise floor from 3 GHz to 6 GHz should actually rise as the frequency increases. It doesn't as that portion of it is uncalibrated(I enabled the 3-6 GHz portion myself).

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 15, 2017, 12:40:22 pm
content: Quote from: PA0PBZ on March 07, 2017, 10:01:22 amDo you have more information from this source? I'd like to see any schematics or block diagrams I can find.

author: PA0PBZ
author_rank: Super Contributor
timestamp: March 15, 2017, 01:10:21 pm
content: Quote from: technogeeky on March 15, 2017, 12:40:22 pmN1996 Servicemanualguide:https://www.dropbox.com/s/5axcrduzvvd3rvb/N1996-90006.pdf?dl=0

author: ferdinandkeil
author_rank: Unknown
timestamp: March 16, 2017, 09:30:01 pm
content: Quote from: technogeeky on March 08, 2017, 10:46:33 pmDid the same test with my E7495B and got similar results. Looks to be normal.

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 17, 2017, 06:47:50 am
content: I'm still trying to hunt down the clock problem, as unlike an above poster I do think this is the reason the GPS won't go from yellow to green (though I don't yet have any firm information on this, other than configuration information: In the web UI, the STIM # 106 says the internal clock gets its time from Time).In any case, I can confirm that basically something is resetting the clockexactlyevery 60 second. This is not the hardware rtc (which for me, defaults to Jan 1 1970 epoch). You can actually look at some of this with /proc/interrupts:Code:0: 323496 ADS_ext_IRQ26: 502791 timer27: 0 rtc timer30: 18 rtc 1Hz31: 0 rtc AlrmI can confirm that "rtc 1Hz" is the number of times I have accessed the RTC withhwclock. You can easily confirm this.I was interested to note that (I need to state this carefully): the time the clock resets back to every 60 seconds, is the timestampped value of /etc/adjclock. It didn't seem like changing the timestamp on this had any effect, so I just moved it to the side.I thought this was the end of this route. However, 30 minutes later (again, exactly) the file was recreated with the timestamp 30 minutes later, but now with zeroed contents (0.000000 0 0.0000000 / 0 / LOCAL).Note that all of this was carried out with all of the time-related processes and local GUI processes killed. So either this is a driver, something kernel level, or elgato (the server itself) doing this.edit 1:More notes. It looks like/dev/receiveris a pointer to a UART where the GPS dumps raw information. Maybe.In any case, looking at /dev/ram0 shows:Code:ttyS0 at I/O 0xf0100000 (irq = 50) is a 16550AttyS1 at I/O 0xf0120000 (irq = 51) is a 16550AttyS2 at I/O 0xf0140000 (irq = 52) is a 16550AttyS3 at I/O 0xf0160000 (irq = 54) is a 16550ASo these are all UART-things.

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 17, 2017, 07:01:37 am
content: Funny enough, they were nice enough to fill out their /etc/services with their own services:Code:diag 31415/tcp # ARMS diagnosticselgato_cmd5028/tcp# ElGato Command Generatorelgato_reporter5029/tcp# ElGato Reporterscpi 5025/tcp # SCPIscpi 5025/udp # SCPI (to be safe ?!?)I'm not sure if all of these are known, I will have to make yet another pass through this thread. :/

author: kirill_ka
author_rank: Frequent Contributor
timestamp: March 17, 2017, 01:46:51 pm
content: Quote from: technogeeky on March 17, 2017, 07:01:37 amscpi code is missing from elgato. There's SCPI STIM in N1996A's toro, which we don't have in elgato.

author: ve7xen
author_rank: Super Contributor
timestamp: March 18, 2017, 04:05:15 am
content: I did some digging into the time setting issue, since I was pretty sure my unit successfully synched to GPS time back when I got it, but I see the same 'yellow triangle' behaviour now.Long story short, I did some poking around with the logging. Nothing useful comes out of the client (though maybe some insight into the protocol, it's quite verbose when set to level 255), but the server application logs directly to /dev/ttyS0 at 38400 8N1 (which is also the bootloader and a Linux tty). This happens to be 'Serial 2' on the top panel of the instrument. Looking at the log output, it seems that some variant of the Y2K / Y2038 bug could be in play here, this repeats every 30 seconds:Code:System time less than minimum allowed. Setting clock to Thu Jan 1 00:00:00 2004What I presume is happening is that the GPS is setting the clock, then the server process doesn't like it and resets it. Some strange things start happening if I set the system clock manually (date -s "YYYY.MM.DD-HH:MM:SS"). For example, if I set the system clock to Fri Dec 1 00:00:00 UTC 2017, I now get this error, setting the time back exactly 12 hours? Where did the new set time come from (it's not in the script mentioned below).Code:System time less than minimum allowed. Setting clock to Thu Nov 30 12:00:00 2017So this is quite odd, since Linux itself has no trouble with the current date, but the egServer process seems to be rolling it over zero to 'less than the minimum'. I guess egServer must be internally representing the time in a nonstandard way. Maybe just patching the comparison would make it work again?In case you're curious, the keepTimeUpdated mentioned is a simple script that writes the current date every 20 minutes to another script that is part of the startup of the instrument. I guess to get it 'closeish' to the previous time when it boots.

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 18, 2017, 06:15:48 am
content: Quote from: ve7xen on March 18, 2017, 04:05:15 amI wonder if this is as simple as Agilent assuming the epoch is Jan 1 2004. I think 'hwclock' is happy to set an epoch that is different from the typical 1970 one. This is, of course, the RTC. I don't know if they are reading this directly or not, but I think they could be (e.g. I think elgato could be bypassing the interrupts and going directly to the RTC).I also wonder if this issue happened in the previous firmware. Does anyone still have it? I didn't keep it, unfortunately.

author: TheSteve
author_rank: Unknown
timestamp: March 18, 2017, 06:40:13 am
content: I am thinking that the GPS used to lock fine on the E7495A as that surely would have been a fixed bug if it was always present. I also didn't find any service note related to it.

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 18, 2017, 07:11:48 am
content: I learned a little bit more. First:* We can be 100% sure the time resetting is caused by elgato itself.* If you kill elgato and run your own copy, you get a shell. This isn't the most friendly shell, but we might be able to find useful commands by searching through the elgato binary.First of all, we can directly see this system time problem:System time less than minimum allowed. Setting clock to Thu Jan 1 00:00:00 2004Second, we can do the one thing they suggest doing, which is:debugIPub=1;(or 2, or maybe 3?)Code:Samplers/timeLicense.p1 publishing {argArray with 10 elements} as 'timeLicense'gui1.s23 receiving data as timeLicenseSystem time less than minimum allowed. Setting clock to Thu Jan 1 00:00:00 2004Samplers/timeFreqRef.p1 publishing {argArray with 10 elements} as 'timeFreqRef'gui1.s9 receiving data as timeFreqRefWith the same setting to 2, we get:Code:Samplers/timeFreqRef.p1 publishing {argArray with 10 elements} as 'timeFreqRef'<ArgArray length="10"><UInt32>1</UInt32><UInt32>1072915200</UInt32><Int32>3397774</Int32><Int32>-8440589</Int32><Int32>32993</Int32><Int32>4</Int32><UInt32>2</UInt32><UInt32>1</UInt32><UInt32>0</UInt32><UInt32>3</UInt32></ArgArray>We've seen this before, this is the data gotten directly from the GPS unit STIM.And we also get:Code:Samplers/timeLicense.p1 publishing {argArray with 10 elements} as 'timeLicense'<ArgArray length="10"><Int32>-1</Int32><Int32>-1</Int32><Int32>-1</Int32><Int32>-1</Int32><Int32>-1</Int32><Int32>-1</Int32><Int32>-1</Int32><Int32>-1</Int32><Int32>-1</Int32><Int32>-1</Int32></ArgArray>I don't think turning off the hack has any effect on this problem, but maybe someone should double check that.In any case, there are a *bunch* more symbols to turn on and off. Certainly anything that starts with debug. I'll keep looking...

author: kirill_ka
author_rank: Frequent Contributor
timestamp: March 24, 2017, 07:14:44 pm
content: Today I have some progress in decoding serial protocol used to communicate with power meter.Below is the shell command to enable 50 MHz power reference. GUI shouldn't be in power meter mode while you run it.Code:(stty 38400; sleep 2; printf "\x83\xf8\x04\x08\x01\x00\x01") < /dev/ttyS4 > /dev/ttyS4Turn it off withCode:(stty 38400; sleep 2; printf "\x83\xf8\x04\x08\x01\x00\x00") < /dev/ttyS4 > /dev/ttyS4However, it turns off when you open the port. Opening the serial port seems to reset some power meter state.

author: Puffin
author_rank: Unknown
timestamp: March 25, 2017, 05:47:35 pm
content: Has anyone else had issues with the remote GUI not responding to clicks on the right-side buttons? I had it working once, but struggling to make those buttons work again which severely limits what you can do with the GUI.On the subject of the date reset, it's every 30 seconds, not every 60. Done by the elgato process itself (killing that stops the time getting reset anyway). A crude hack to runhwclock --hctosysevery few seconds is a kind of work-around.I'm also noticing the GPS seems somewhat unreliable - and even when it does get 6 sats locked, I've never seen the GPS indicator with anything other than the yellow triangle.I'll likely prod at this some more, but I'm somewhat nervous to try hacking things further due to fear of bricking this otherwise nicely functional kit.

author: lectrohamlincoln
author_rank: Contributor
timestamp: April 19, 2017, 07:46:46 am
content: Hello Everybody,I picked up an E7495A described as "LOCKS UP ON POWER UP." I suspected that the firmware was corrupted and it would be easy enough to flash the latest A.06.25 version. I've tried using both a Sandisk 512MB and a 8Gb Compact Flash formatted to FAT32. With no luckSo, I followed the "Update via Load Firmware Utility" procedure described in the Service Guide. I removed the RF section and set the DIP Switch as instructed. I tried again with both Sandisk CFs, but my E7495A would only turn on with a blank display. Is it possible this factory reset requires a PCMCIA instead of CF?I'm beginning to suspect there might be a hardware problem. I also noticed that there was a red LED lit on the controller board. I'm hoping for any suggestions before I start doing a component level debug tomorrow.

author: DogP
author_rank: Regular Contributor
timestamp: April 19, 2017, 08:21:05 am
content: Quote from: lectrohamlincoln on April 19, 2017, 07:46:46 amDid you try doing a fresh firmware install? When you put the CF card in with the 6.25 update, and are promted to install... press the bottom right button, across from NO. I believe that does a rebuild of the drive. That error does look more like a Linux/disk kinda error than a general hardware error (other than bad flash maybe).Other than that, if you can connect into it over a serial port, maybe you can check the logs for more specifics on the crash?DogP

author: kirill_ka
author_rank: Frequent Contributor
timestamp: April 21, 2017, 04:12:24 pm
content: Quote from: lectrohamlincoln on April 19, 2017, 07:46:46 amThat's the right thing to do. I don't know if it's supposed to work from CF. If it doesn't boot kernel anymore, "utility" was able to erase it at least...Quote from: lectrohamlincoln on April 19, 2017, 07:46:46 amI think that "load firmware utility" should write something to the screen or serial port. Maybe you should try it again and check the output?

author: lectrohamlincoln
author_rank: Contributor
timestamp: April 22, 2017, 12:52:10 am
content: I was able to get serial port 2 working. It says all DRAM tests have passed at least. If anyone's curious the baud rate is 38400 and it expects a return CR on transmitted text.I also tried the A.06.25 firmware on a CF to PCMCIA adapter to no avail. I know its loaded too because without the PCMCIA inserted it says "There is no PCMCIA card on Socket 0"With DIP switch set to 1&2 I get the same error message on the bottom of the screen: "Kernel Panic: No init found. Try passing init= option to kernel"With DIP switch set to 2&3, 1&3 or 1&2&3, I get the following menu options from the serial terminal:-- Display Register Set Register Dump Memory Set Memory Erase Blocks of Flash Set Ethernet MAC AddressSelect Menu & Hit Enter Key:--The "Dump Memory" returns real looking values. I'm unsure how to use the "Set Memory" and I feel a little uneasy using the "Erase Blocks of Flash."I wish we had a board level Maintenance Manual. I just have a feeling that Red LED means somethings gone bad. I was able to find this brief BOOT ROM manual that seems to correspond to the E7495http://support.eurotech-inc.com/developers/linux/files/boot/bootrom.pdfI'll do some more investigating this weekend.

author: DogP
author_rank: Regular Contributor
timestamp: April 22, 2017, 02:58:42 am
content: Did you try the full fresh reinstall (not just the standard firmware upgrade)? IMO, it sounds like a file system problem... you can read a bit about the "No init found" message here:http://lxr.free-electrons.com/source/Documentation/init.txt?v=3.13.DogP

author: lectrohamlincoln
author_rank: Contributor
timestamp: April 22, 2017, 03:38:26 am
content: I believe I am doing a full reinstall. The boot process never gets to stage where I am prompted with a Yes or No about firmware upgrades and the buttons are all unresponsive.The only sign of life I have gotten out the E7495 is through the Serial Terminal after following what the Service Guide calls a "Update via Load Firmware Utility." Which is "used to reload firmware on an E7495A/B just as it is loaded at the factory," according to the Guide.Is there another way to initiate a full fresh reinstall? I scoured the manual and can't find any reference. I fear my only option might be to Block Erase the Flash and hope for the best. But, I think I'm first going to write a program to try and download the flash before I do anything irreversible.

author: DogP
author_rank: Regular Contributor
timestamp: April 22, 2017, 04:52:12 am
content: Ah... if it never actually gets to the yes/no, then it's probably not actually doing any sort of reinstall.I think you want to do switch 1 and 4 off, switch 2 and 3 on, as described in the manual. I believe that will reconfigure the board to boot Linux from the PCMCIA card, rather than internal flash. With the firmware upgade CF card in a PCMCIA adapter in the PCMCIA slot, it should boot. You mentioned that you get a debug menu over the serial port... does nothing show up on the screen when you do that? And the debug menu is all you can do... there's no way to log into a terminal over the serial port?One thing you might want to try is the OLD firmware version (1.60) that's still available on the Keysight website:http://www.keysight.com/main/software.jspx?ckey=sw411&lc=eng&cc=US&nid=-11143.0.00&id=sw411. In the root of that zip is a script called reloadFFS, which does a reinstall. In version 6.25, that file exists, but is empty. This might be the key difference between the instructions and what you're seeing. There's also readme describes how to use it.QuotePat

author: TheSteve
author_rank: Unknown
timestamp: April 22, 2017, 05:15:42 am
content: I don't have an E7495A but I do have the close cousin the N1996A. Firmware updates on it are generally done via USB. If you have a failure during flashing there is an internal PCMCIA slot that can be used to recover the unit. The instructions do say a CF card is supported via an adapter. You do need a different image compared to the USB image though which has the update and a boot image with a kernel etc.Is there a special PCMCIA image for the E7495? And if so does it also have cmdline.txt, ramdisk.gz, register.txt, version and zImage?If you don't have those files check out the USB and PCMCIA updates from the N1996A - maybe you can borrow the needed boot files.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: April 22, 2017, 09:31:55 pm
content: Quote from: lectrohamlincoln on April 22, 2017, 12:52:10 amIt means that flash filesystem is corrupt (because of software error, or flash is failing). I can't imagine how other hardware problem can prevent linux from finding init executable.Quote from: lectrohamlincoln on April 22, 2017, 12:52:10 am"Then 2 & 3 ON Copy any/all of zImage, ramdisk.gz and flashfs1 file to Flash ROM andcopy zImage & ramdisk.gz from Flash ROM to RAM and Boot from RAM"It's clear that it expects zImage and ramdisk.gz on the card. Note that bootloaders a quite picky about filesystem format. Some require fat16 for example. Hopefully it would say something if it can't read the files.

author: lectrohamlincoln
author_rank: Contributor
timestamp: April 26, 2017, 06:36:37 am
content: The filesystem is definitely corrupted. Most likely the ram disk is corrupted in a way that the kernel can't load it. The start-up log has the following, "RAMDISK: Couldn't find valid RAM disk image starting at 0" (I can copy the entire boot log if anyone is curious)The 1.60 firmware did not work. It definitely detects the PCMCIA when DIP 2&3 are set, but does not boot from it. It just gets to Serial Terminal with a the menu options I described in the previous post.I'm a little confused by the 1.60 directions. What does it mean by "To use reloadFFS: - Boot the elgato" Is "elgato" just referring to the E7495?Does anyone know how to recover from a corrupted filesystem? The only ideas I have right now are to use the Serial Terminal menu to load in data at 38400 baud, or to find a JTAG header for the SA1100 chip. In either case I'm not sure what I would load, or even what address I would load it to

author: DogP
author_rank: Regular Contributor
timestamp: April 26, 2017, 10:03:09 am
content: Yeah, I don't think loading memory locations is gonna help, since it's very unlikely that the flash is simply fully memory mapped to the CPU.Have you tried plugging it into the network to see if you can telnet into it when you boot from the PCMCIA slot? Obviously you'll need to check your router to see if DHCP gave out an IP address.And if it is booting from PCMCIA, then another possibility is modifying the ramdisk file on the card. You should be able to un-gzip the ramdisk.gz and mount the ramdisk (on Linux of course). Then make changes (i.e. automatically run upgrade scripts, give you a terminal over the serial port instead of the debug menu, etc.), re-gzip the file and put it back on the card.When you run from the PCMCIA slot, does you see any of the boot process on the screen, or does it stay blank?And yeah, elgato is their name for the E7495.Pat

author: lectrohamlincoln
author_rank: Contributor
timestamp: April 26, 2017, 11:01:14 pm
content: I tried plugging it into the network again no luck. AFAIK it never boots from the PCMCIA.If DIP switch 2&3 are set, it looks like it just boots from the 1Mib flash ROM (the AT29LV1024 chip). The screen is blank and I only get a Serial Menu with a few crappy option and no way of booting from the PCMCIA or getting an actual command line. Although, it does detect when a PCMCIA card is not inserted (it prints an extra line over Serial saying the PCMCIA card is missing).If DIP 1&2 are set, it gets part way through the Kernel boot then hangs. No command line, no option for firmware upgrade, no difference if the PCMCIA card is inserted.Is there some special formatting of the PCMCIA necessary for recovery?

author: kirill_ka
author_rank: Frequent Contributor
timestamp: April 27, 2017, 08:49:33 am
content: Quote from: lectrohamlincoln on April 26, 2017, 06:36:37 amDoes it mean something's changed from your first attempt? There's "no init" error on the screen shot you posted earlier.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: April 27, 2017, 09:14:07 am
content: Quote from: lectrohamlincoln on April 26, 2017, 11:01:14 pmI'd try different cards formatted as FAT16.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: April 27, 2017, 09:30:43 am
content: Quote from: ve7xen on March 18, 2017, 04:05:15 amNo. What we see here is "GPS week rollover" problem.http://www.npl.co.uk/reference/faqs/when-and-what-is-the-gps-week-rollover-problem-(faq-time)The message doesn't show the time which is "less than minimum". I verified that it's current time minus 1024 weeks.So GPS subsystem adjusts system clock and then it's immediately reset to "minimum time".

author: kirill_ka
author_rank: Frequent Contributor
timestamp: April 27, 2017, 06:24:11 pm
content: Apply following patch to elgato binary to fix GPS time synchronisation:0x0122880: replace 4b2585e2152882e2 with de2585e23f2882e2

author: technogeeky
author_rank: Frequent Contributor
timestamp: April 28, 2017, 03:24:00 am
content: Quote from: kirill_ka on April 27, 2017, 06:24:11 pmThis is why, as a citizen of the United States, I can't stay mad at Russians. The dopest hackers on the planet.See below, finally we can calibrate out the expected timebase drift! Thankskirill_ka. We all owe you one.

author: DogP
author_rank: Regular Contributor
timestamp: April 28, 2017, 08:57:58 am
content: Quote from: kirill_ka on April 27, 2017, 06:24:11 pmAwesome... I'll give this a try shortly! And we get to look forward to this problem again in 2 years (got a patch ready for the 2019 rollover?).Thanks,Pat

author: kirill_ka
author_rank: Frequent Contributor
timestamp: April 28, 2017, 09:35:05 am
content: Quote from: DogP on April 28, 2017, 08:57:58 amI think the receiver was designed to operate before 1999. So it's thrown backwards not the same time GPS week count wraps. I.e. it should work for another 20 years.In 2038 old *NIX stuff will die anyway

author: DogP
author_rank: Regular Contributor
timestamp: April 28, 2017, 10:24:43 am
content: Just tested it, and it worked great! For anyone keeping track, I let the unit warm up for 15 minutes (with the GPS antenna connected), like the instructions say. From the calibration, my DAC setting went from 2162 (factory) to 2121... so a similar change to what technogeeky had. I left it on the adjustment screen and clicked the repeat button a few times over the last 20 minutes, and it has continued to climb (it's up to 2190 now). I'm gonna leave it on overnight and check it in the morning.Thanks again!Pat

author: DogP
author_rank: Regular Contributor
timestamp: April 28, 2017, 03:31:35 pm
content: And, a final update... after letting it run overnight, it seems to have landed at a DAC setting of 2223 (it bounces around +/- a few values, but hasn't drifted over the last 45 minutes).Pat

author: alpha89
author_rank: Newbie
timestamp: May 05, 2017, 04:46:45 pm
content: Quote from: kirill_ka on April 27, 2017, 06:24:11 pmWhere is the elgato binary file located? Thanks for figuring this out as my box is needing a frequencycalibration.

author: technogeeky
author_rank: Frequent Contributor
timestamp: May 07, 2017, 08:52:43 am
content: I spent some time the other day looking for any spurs, and I only found one. I've attached two screenshots; the first is at RBW of 50 Hz with 10 averages and the second is at RBW of 10 Hz.Can anyone else confirm this spur? Does anyone know of other spurs?

author: usagi
author_rank: Frequent Contributor
timestamp: May 08, 2017, 05:10:52 am
content: Quote from: technogeeky on May 07, 2017, 08:52:43 amspur at 396.8 is probably the LO.

author: hawaii596
author_rank: Newbie
timestamp: May 08, 2017, 06:47:31 pm
content: New to forum. I have a couple of Agilent E7495B units with lots of accessory, the backpack, and transit case that I am preparing to issue out. They have a problem that they are not able to sinchronize wih GPS clock. According to one of the technicians who looked at them, it is because the onboard dates are too old (more than 12 years), and they can't synch to GPS if there is more than 12 years between today (May 8, 2017) and the onboard date.I am not a programmer or engineer; just a metrologist in an instrument lab. Due in part to things I read at this site, I figured out how to connect to the E7495B with Telnet. I was able to log in as "root," and using LINUX commands, check and reset both the normal date and hardware clock. But once I rebooted the system, both reset to some sort of base date. The Hardware clock, back to 1970, and the system date back to 2008. I am guessing the 1970 is a base date for the hardware, and 2008 is the initial release date of the installed firmware.This leads me to think perhaps there may be a bad CPU battery. However, I have been unable to physically find one in the instrument. And at least one user on a Keysight (Agilent) thread said there is no CPU battery.If anyone has experience or understanding about this, I would sincerely appreciate any of your thoughts. Is there a CPU battery? If not, is there a reason why the dates are reverting?Also, could it be that once I manually update both of these dates in LINUX, do I need to do a GPS synch to get them to take more permanently (could this be the need)? Thanks one and all for any inputs.

author: usagi
author_rank: Frequent Contributor
timestamp: May 08, 2017, 06:58:19 pm
content: Quote from: hawaii596 on May 08, 2017, 06:47:31 pmread this entire thread, especiallythis post.

author: hawaii596
author_rank: Newbie
timestamp: May 09, 2017, 08:07:40 pm
content: I've now pretty much read through the entire thread. I did read the particular post about applying the patch per the quote below:Apply following patch to elgato binary to fix GPS time synchronisation:0x0122880: replace 4b2585e2152882e2 with de2585e23f2882e2As a non-programmer, that is fully above my head. If there is a set of Linux commands that do this, I would greatly appreciate some instruction on how to do this. Otherwise, whatever other instructions for specifically how to do this. I realize this thread is mostly for techno types who experiment with these things. I am a techno type in metrology. I have deep understanding of how accuracies work. And I am a fast learner. But unfortunately, even with my decades in metrology, communications/navigation systems/RADAR systems/instrument calibration, this is a weak zone for me.If anyone could explain is some detail how to apply this patch, I would be forever grateful.

author: technogeeky
author_rank: Frequent Contributor
timestamp: May 10, 2017, 01:28:07 am
content: Quote from: hawaii596 on May 09, 2017, 08:07:40 pmThe original poster is basically telling us to do a binary patch on the file ("elgato" binary). The first thing you would do when doing any patch of any file (binary or not) is to make sure you have a good copy of the original, of course.All of the important files on the device are in/flash. In prose, they are in a subfolder in the root of the filesystem. This is certainly unusual in most Linux systems. In this case, there are also a bunch of other folders in /:bin, dev, etc, lib, mnt, home, nfs, root, tmp, var, sbin, usr, xdrive. These are the usual thing you are used to in Linux systems. I think these files are generated out of files located in the /flash directory, though; but that's not important. When listing files, make sure to dols -lso you see where the files point to (many important files point to e.g./flash/linux/etc/...).As for the "elgato" binary, that's in/flash/egServer/elgato. This file is the actual instrumentation server. This is what the GUI communicates with to control the hardware. (The GUI is located in/flash/egGui, by the way).Now that we have the location and context of the file, all we need to do is interpret the original instruction:Apply following patch to elgato binary to fix GPS time synchronisation:0x0122880: replace4b2585e2152882e2[old value]withde2585e23f2882e2[new value].This line is telling us to use a hex editor (vi/vim has a hex edit mode, emacs has one, there are probably command line tools to hex edit too). It's telling us to starting changing the actual file (though we are representing this in hex for convenience) on disk at  bytes from the start of the file. It further specifies that we should see, at this location, the value [old value]. And we should change [old value]to [new value], then save the file.Some/most editors are usually used to operate on text files, so you may need to tell the editor to load the file in binary (e.g. vi -b). Then once you open the file, you usesome command to convert the binary to hex. Then you find the [old value], replace it with the [new value], convert the filebackto binary from hex, and then save the file.Since you have a backup, you can afford to make a mistake in this process. You'll probably get it right on the first try though. Note there are two hex changes (at two different locations) listed in this thread: one which changes the program which handles licensing to automatically allow all license options that are listed (regardless of them having a correct key). The other corrects the clock issue. Presumably there will be more of these in the future.We go through all of this trouble for basically two reasons, in order:We don't have access to the source code for this file, so we can't tell you a change in code to fix the problem.Once you have found some change to make, you have to make the appropriate change in the binary file. People typically don't distribute the binary file since it is covered by copyright and various other things. So patch instructions are used instead.I hope this is cleared up. Hopefully, you or someone else can find all of the binary file changes to allow the signal generator to go down to whatever the true lower limit of the hardware is, one day.: Notice that it was not necessary here to actually give the old value for this process to work (since you were told the location to start the edit). It's given as a checksum: if the value you see in your file is not [old value], then you are either at the wrong location in the file, are editing the wrong version of the file, or both.

author: DogP
author_rank: Regular Contributor
timestamp: May 10, 2017, 09:49:31 am
content: Quote from: hawaii596 on May 09, 2017, 08:07:40 pmIMO, copying the file to a CF card, modifying in a GUI hex editor on your desktop PC, then copying it back to the box is the most intuitive way to do it... if you're familiar with hex editing.An alternative, if you simply telnet into the box, you can run the following commands to patch the binary in place. Once you're done, you should reboot the box to make sure it's running the modified binary.The first line copies the binary file to be modified. The 2nd line does the actual patch. The 3rd line backs up the original file in case you screw something up and/or need to revert to the original. The 4th line moves the modified binary in place of the original. Note that Linux is case sensitive, so copy it exactly as shown (i.e. capital S on egServer).Code:cp /flash/egServer/elgato /flash/egServer/elgato.modprintf '\xde\x25\x85\xe2\x3f\x28\x82\xe2' | dd of=/flash/egServer/elgato.mod bs=1 seek=1190016 count=8 conv=notruncmv /flash/egServer/elgato /flash/egServer/elgato.origmv /flash/egServer/elgato.mod /flash/egServer/elgatoSimilarly, if you want to do the license patch posted earlier, you'd run this additional line (before the mv commands):Code:printf '\x00\x00\xa0\xe1' | dd of=/flash/egServer/elgato.mod bs=1 seek=3373692 count=4 conv=notruncPat

author: kr5j
author_rank: Contributor
timestamp: May 10, 2017, 08:18:30 pm
content: Thanks for the info! been waiting for a better description of the patch.

author: ke6iyc
author_rank: Contributor
timestamp: May 10, 2017, 10:36:30 pm
content: Hello all!Ordered one of the cheap units on fleabay (but it does power up and function) for a good price today.Glad I found this thread AFTER I ordered (otherwise I would have been tempted to pay too much).Thank you to all for the hard work and time you have put into this.Will have to disassemble to fix the screen gasket when it arrives mid next week.BrianKE6IYC

author: technogeeky
author_rank: Frequent Contributor
timestamp: May 10, 2017, 11:25:11 pm
content: Quote from: ke6iyc on May 10, 2017, 10:36:30 pmThis reminds me...Q:What kind of plastic is the screen protector, and how can I clean the adhesive gunk off of it?Unless you are a better chemist than I am (entirely possible...) , you're going to find that the only solution (no pun intended) which actually releases the gasket adhesive is acetone. This same acetone willdestroythe top layer of the plastic (and/or the UV coating, or something). It doesn't look great. It looks pretty awful, actually. Since Iusedacetone, and hencedestroyedthe plastic (or its coating), I decided to try and identify the exact plastic so I could find a replacement. Idid some destructive testingto determine exactly what kind of plastic the screen protector is, and after some burning, melting, and inhaling burned plastic odors... I am pretty sure I came up with an answer. And probably nose cancer.PVF.Polyvinyl Fluoride. And whilethis link(it's a good URL to bookmark. As is the other one. Do it.) wasn't helpful, further browsing andthis siteconvinced me that PVF is an understandable choice for this screen. It could also be any of the self-extinguishing, non-dripping ones (PPO, PVC). In any case, I couldn't find a good supplier of PVF clear sheets, and I could easily find many places to get PVC clear sheets.In any case, I wasn't able to find any easy to way to buy PVF glass sheets, so I eventually went with plain PVC. I got them custom cut from an Amazon vendor, and I still have three sheets exactly cut to size. I will be happy to send them out if you want, or otherwise I can just share the measurements I took so you can see if you agree; and we can learn where and how to buy PVF plastic clear thick sheets.Q:What facts do we know about the plastic type of the screen?available in clear, rather rigid sheets that do not creasesome sort of UV or anti-reflective coatingsoftens, not burns (thermoplastic)sinks in waterdoes not appear to have flames (50%?)does not continue to burn (95%?)does not appear to drip (50%)No, the stuff I have does not have any anti-glare or anti-reflective coating. Yes, it's slightly worse than the original. Yes, you would about $1 plus shipping. Oh, thanks for the interest. My address is, roughly speaking:Atlanta, GA, USA, Earth, Sol, Milky Way, Universe ASo if shipping to you would be uncomplicated, let me know. I have 3 more of them. They still have the factory tape on them, so there should not be any defects.

author: ke6iyc
author_rank: Contributor
timestamp: May 11, 2017, 11:44:37 am
content: That would be most helpful, but I would only need one (share the love).I am, roughly speaking, Boise, Idaho, USA, Earth, Sol, Milky Way, Universe ACurrently sitting in Florida, however, so that might be a tad cheaper.If you have PayPal, I would happily reimburse for any costs incurred......Email would look something like ke6iyc (at) mac (dot) com , but with the generally accepted punctuation and symbology, instead of the parenthetical words.Thank you in advance!BrianKE6IYC

author: ke6iyc
author_rank: Contributor
timestamp: May 12, 2017, 03:36:45 pm
content: Simple question,Is the RS-232 cable for Telnet straight through, or null modem?Thanks!

author: kirill_ka
author_rank: Frequent Contributor
timestamp: May 12, 2017, 03:56:12 pm
content: Quote from: ke6iyc on May 12, 2017, 03:36:45 pmE7495 ports are normal "DTE" ports. So the cable should have TX to RX connections (null modem).

author: kirill_ka
author_rank: Frequent Contributor
timestamp: May 12, 2017, 04:13:00 pm
content: Quote from: DogP on May 10, 2017, 09:49:31 amI would hesitate to use that command unless I'm absolutely sure the binary is the right one.There are few caveats:1. Original binary should be the same version. Probably we'd post md5sums of original and patched files.2. Writing to the executable which is running may fail.3. There are number of "printf" versions you can find on the same system. Some of them may not support hex escape sequences. E.g. bash built-in printf, /bin/sh built-in printf, /usr/bin/printf.

author: ke6iyc
author_rank: Contributor
timestamp: May 12, 2017, 04:36:04 pm
content: Thank you on the cable question.As for the patching in place, has anyone ACTUALLY tried it?I am out of state right now, and have a unit waiting for me at my hotel. I would like to patch it (Would like to try out the Interference analyzer) before I return home, but not at the risk of bricking the unit.Thanks a bunch to all!Brian

author: technogeeky
author_rank: Frequent Contributor
timestamp: May 12, 2017, 06:27:09 pm
content: Quote from: ke6iyc on May 12, 2017, 04:36:04 pmOnce you connect to the unit via telnet, the the first thing you'll want to do is make a copy of all of the files in /flash. The easiest way to do this, in my opinion, is to setup a FTP server on your computer and run an ftp client on the E7495a. The easiest way to modify the elgato binary is simply to do it on your host computer (using a tool that does hex editing -- there are plenty of these for windows, osx, linux). Then, you can use the FTP client to get the file back.The other obvious way to make a backup is to simply dump things onto the CF card, insert into host computer, copy, and put it back in.Destroying the elgato binary won't brick the unit, as far as I know. You'll still have telnet access. Plus, you can just 'cp elgato elgato.original'. There is enough space to have a few copies of the binary around.

author: PA0PBZ
author_rank: Super Contributor
timestamp: May 12, 2017, 06:33:33 pm
content: Quote from: technogeeky on May 12, 2017, 06:27:09 pmYup, and a 'killall elgato' to make sure you are not trying to patch a running executable.

author: technogeeky
author_rank: Frequent Contributor
timestamp: May 12, 2017, 06:36:48 pm
content: Quote from: PA0PBZ on May 12, 2017, 06:33:33 pmFor future reference, in Linux there is no risk of modifying a running executable. The entire process tree of the executable (e.g. elgato and anything it runs or calls) will only be able to reference the original file. I am about 99% sure this is the case, at least.

author: PA0PBZ
author_rank: Super Contributor
timestamp: May 12, 2017, 06:39:22 pm
content: Quote from: technogeeky on May 12, 2017, 06:36:48 pmI was thinking about copying back the patched file, that doesn't work when it's running, not sure about patching.

author: DogP
author_rank: Regular Contributor
timestamp: May 12, 2017, 07:28:27 pm
content: Ah, yes... before posting, I ran the commands to make sure they worked, but not on the file actually running (since mine was already patched). I just reverted mine to the original and tested it, and dd didn't like modifying the running file, so I updated the instructions to modify the copy of the file and then move the files.I just tested it, and the new instructions do work. All you have to do is simply telnet into the box, log in as root, and run the commands exactly as shown. As pointed out, no matter how you patch the files, you need to make sure you're on the correct version. I believe all of these patches are for 6.25.There should be no reason that you'll brick your box though, since you should be able to simply telnet back in, and move the elgato.orig file back in place of the patched elgato binary.Pat

author: DogP
author_rank: Regular Contributor
timestamp: May 12, 2017, 07:46:27 pm
content: Quote from: technogeeky on May 10, 2017, 11:25:11 pmBTW, did you rule out Polycarbonate? That would have been my first guess, just from looks and feel, and because it's commonly used for these types of things. It definitely had an anti-glare coating or something on it... mine was REALLY scratched up (and had a few large gouges), so I used some Novus on it, and it took care of a lot of the scratches, but of course also took off the coating. It's really nice and shiny now though.Pat

author: technogeeky
author_rank: Frequent Contributor
timestamp: May 12, 2017, 07:55:11 pm
content: Quote from: DogP on May 12, 2017, 07:46:27 pmPat: I can not rule out polycarbonate by the tests that I performed. PVF actually seems unlikely since I can't find it in sheets anywhere. Polycarbonate does seem more likely. It's hard to know, really. I don't remember a "phenol" smell when I burned it.Nevertheless, since I agree it's far more likely to be polycarbonate, I'll switch the answer in the comment.

author: usagi
author_rank: Frequent Contributor
timestamp: May 12, 2017, 08:43:50 pm
content: yes, far more likely its polycarbonate - the rigidity of the protector screams polycarbonate to me. also the fact acetone damaged it.

author: ke6iyc
author_rank: Contributor
timestamp: May 13, 2017, 12:09:34 am
content: Good evening all!OK, got the instrument in.Two batteries, but I suspect one to be trashed (reading as 227% charged) other one is charging.Also had a 64 MB PCMCIA Flash card in it (BIG bonus!).Powered up no issue (once I figured out the operation of said power button).Has all factory hardware options installed (per internal reporting) and there is only one software option I really want to enable (Interference ID).Measured a good test cable, and it told me it was good.Will do an update next (currently it has 5.00 on it....)THEN on to the patches, and figuring out where to find an SMA GPS antenna locally.....Thanks to all!Brian

author: ke6iyc
author_rank: Contributor
timestamp: May 13, 2017, 01:09:41 am
content: Update to 6.25 went smoothly, as described here.Telnet will have to wait until tomorrow, as the computer I have with me (that has a hardware serial port) has decided not to acknowledge that telnet is, in fact, installed....Thanks to all!Brian

author: technogeeky
author_rank: Frequent Contributor
timestamp: May 13, 2017, 02:01:33 am
content: Quote from: ke6iyc on May 13, 2017, 01:09:41 amUse putty like all of us.

author: ke6iyc
author_rank: Contributor
timestamp: May 14, 2017, 02:15:12 pm
content: Quote from DogP on Dec. 8 2016:"I spent a bit of time looking at this again, trying to get some remote access/control working. As noted earlier, the E7495 has a webpage, but doesn't accept the normal login. I noticed a similar non-working login on port 5025. Using netstat, I saw that elgato was listening on those ports. When looking in the /flash/egServer directory, I noticed a passwd file. It looked different than the standard *nix passwd file, but appeared to have a hashed root password in it (RzSdSbSdye).Rather than trying to crack the password, I decided to try simply renaming the passwd file and rebooting. Surprisingly, it didn't recreate it, and now simply accepts any login! (on both the webpage and port 5025)."In playing around, I did as advised above, and renamed the passwd file, then rebooted.I had PuTTY running on Serial port 2 during the reboot, and the last thing it spat out was:"Note: No passwd file found. Adding user 'root' with password 'changeme'"Not overly useful info, but something...Brian

author: DogP
author_rank: Regular Contributor
timestamp: May 14, 2017, 04:19:31 pm
content: Quote from: ke6iyc on May 14, 2017, 02:15:12 pmI had come across "changeme" as well, but didn't see where it was used. It didn't work as the original password, and once I got rid of the password file, it took any login (didn't require root/changeme). Have you found where it's actually used?Pat

author: ke6iyc
author_rank: Contributor
timestamp: May 14, 2017, 05:10:02 pm
content: No, thus the limited usefulness of the result....Brian

author: ke6iyc
author_rank: Contributor
timestamp: May 14, 2017, 05:36:47 pm
content: What is the 7495 calling the PCMCIA card?Thanks,Brian

author: kr5j
author_rank: Contributor
timestamp: May 15, 2017, 09:27:58 pm
content: I did the patch but it didn't seem to fix the GPS. I went to the adjustment screen to sync the unit with GPS but GPS icon stayed yellow. I also added the license patch but when rebooted it didn't show any new options. So I thought I would try it again and now the unit boots up and hangs on the Copyrights screen. How can I recover?Thankskr5j

author: technogeeky
author_rank: Frequent Contributor
timestamp: May 16, 2017, 02:56:14 am
content: Quote from: kr5j on May 15, 2017, 09:27:58 pmYou need to replace the elgato binary with the original, and start over. The only thing I can think if the patches didn't work, is you started with the wrong version of the binary (e.g. you did not upgrade the firmware first).

author: kr5j
author_rank: Contributor
timestamp: May 16, 2017, 03:01:13 am
content: Whew! Found a copy of A.06.25 FW, put it on a CF card and installed it and the unit is back to original performance. So the patches did not appear to work for me. I went back and installed just the license one but no new options appeared. If I do the GPS one, unit appears normal but if I try to go to the GPS adjustment screen, it hangs. But I did see the GPS icon go green at one point! I was using the date command to set the time/date and maybe that got it to go green but as soon as the FW changed the time it went yellow. the saga continues...

author: technogeeky
author_rank: Frequent Contributor
timestamp: May 16, 2017, 03:20:20 am
content: Quote from: kr5j on May 16, 2017, 03:01:13 amLet's focus on one thing at a time.Remember, for the license hack, you have to also modify the license file for each license you wish to add. The trick that the patch provides is that thekeyisn't ever read, so it doesn't need to be valid. Perhaps you are not doing this step.Once you have done the GPS patch, you do not want to be setting the date/time manually. The date/time will be set properly by the GPS. At the very least, you can use the web interface to set the date/time once, using the date/time of the PC you are browsing to it from. If you ever have the green circle, then you are in a state where you can do the timebase calibration. Note you probably want to have the unit on for some 30 minutes plus, and you want to make sure you have at least 5 or 6 satellites locked.

author: ke6iyc
author_rank: Contributor
timestamp: May 16, 2017, 07:16:24 pm
content: @kr5jYou also need to "install" the options, done on the unit itself.They do not automatically appear...Brian

author: kr5j
author_rank: Contributor
timestamp: May 16, 2017, 09:07:46 pm
content: I started with A.06.25 FW then did the GPS patch. I rebooted and the GPS patch appears to have worked, now the GPS info has the current UTC time. Also the GPS icon turns green! Then I did the license patch and it appears to have worked but cannot access the screen to see installed options. Also cannot get to the GPS adjustment screen. The problem that is once the unit boots up, I select System then press More 2 of 2 to get to Page 2. Unit takes a few seconds then all the button labels on the left side of the screen disappear. Unit stays in this condition and does not respond to any button presses. I have to reboot to get the unit operational again. Why would either patch affect it this way?

author: DogP
author_rank: Regular Contributor
timestamp: May 17, 2017, 01:13:52 am
content: I had that same problem:https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg1053888/#msg1053888. You need to modify the /flash/egServer/license/elgato.lic file and add a SIGN value (like SIGN=000000000000 ) to any that don't already have a SIGN.Pat

author: ve7xen
author_rank: Super Contributor
timestamp: May 17, 2017, 08:52:07 am
content: Quote from: kirill_ka on April 27, 2017, 09:30:43 amCurious, because rollover last happened in 1999 and doesn't happen again until 2019. The instrument was released sometime around 2002-3. So I kind of thought of that but wrote it off as something else. It's definitely this though, probably the firmware is checking some arbitrary date in the past to decide what GPS epoch it is in, and how many weeks to add. We went past that boundary date, so it think it's pre-1999 again. If anyone's curious, the disassembly of the patched region is:Code:old---0x2122880: 4b 25 85 e2 r2 = r5 + 3145728000x2122884: 15 28 82 e2 r2 = r2 + 13762560x2122888: f6 2d 82 e2 r2 = r2 + 15744new---0x2122880: de 25 85 e2 r2 = r5 + 9311354880x2122884: 3f 28 82 e2 r2 = r2 + 41287680x2122888: f6 2d 82 e2 r2 = r2 + 15744Which adds exactly 1024 weeks to the constant.Nice work on the patch and thanks! I couldn't crack it.

author: kr5j
author_rank: Contributor
timestamp: May 18, 2017, 01:22:25 am
content: I copied the legato.lic file to mnt but it does not appear on the CF card. There were also 2 screen shots in the mnt folder and they are not on the CF card. I did a screenshot and when I opened the CF card on my PC the screenshot was there but nothing else. How do I put the legato.lic file on the CF card? I tried the mount /devf/hdc1/ /mnt command and it said it failed: not a directory.

author: DogP
author_rank: Regular Contributor
timestamp: May 18, 2017, 09:47:57 am
content: You should use the command "mount /dev/hda1 /mnt" (no trailing slash after hda1). On my box the CF is hda, not hdc... but if for some reason yours is hdc, then use that. And I assume "legato.lic" and "/devf/" are just typos in your reply (should be "elgato.lic" and "/dev/" respectively).Pat

author: kr5j
author_rank: Contributor
timestamp: May 18, 2017, 09:03:13 pm
content: Yep the fat finger of fate struck. What are the commands to copy the license file to the CF card and then the modified file back? I think my CF card is hda1. Here is what I get with a df -h command:[root@E749xx /]$df -hFilesystem Size Used Available Use% Mounted onrootfs 7.7M 6.1M 1.2M 83% //dev/root 7.7M 6.1M 1.2M 83% //dev/mtdb3 60.0M 21.6M 38.4M 36% /flashBut none of these is the CF card inserted, since it is a 500 MB card. Not sure what the disks listed are.If I press the Media Manager button from System, it shows the CF card format button highlighted indicating it is recognized by the system.

author: technogeeky
author_rank: Frequent Contributor
timestamp: May 18, 2017, 11:08:48 pm
content: Quote from: kr5j on May 18, 2017, 09:03:13 pmkr5j:File Locations (first the ones you need, second some interesting locations):/dev/hdais, for me, the PCMCIA card's device file./dev/hda1is, for me, the PCMCIA card's first (and only) partition./flash/mnt/pcmciais the directory where the Agilent mounts and then stores screenshots and data./flash/egServer/elgatois theelgato(transponder server) binary. This is where the binary patching happens./flash/egServer/license/elgato.licis the file where the license information is stored./flash/linuxare all of the extra files that Agilent includes, on top of BusyBox (which is a barebones set of Linux commands).As far as the elgato file goes, the following sha256 hashes should tell you if you have the same file or not. Copied fromsha256sumcommand:8f4bfc453ed7aa871bba7ea2301bb29280466c36f78f703302b5348ec44612f0elgato.original5a857ab04ce60f4a149682299bbd860649f36478e29e4693870a8624a4eafad7elgato.nokeysec57d11b6151795ba2c6f6979cb789622dc24c263fef70ca4791780f4525e771elgato(nokeys and clock patch)Tips:dfreports results for each mounted disk. Until you do something with the GUI that will cause a write to the disk (try to save file, save data, or format PCMCIA), the unit won't even mount it. You can manually mount the disk, in its proper location, by typing:mount /dev/hda1 /flash/mnt/pcmciaThen, you can browse to /flash/mnt/pcmcia to read (or copy) files you stored on the device. Picture and data saves will now also work (assuming the device can read your partition).: Again, for me, I formatted it as ext3. You can use fat16, I think. I am not sure about fat32.: Notice they have their own copy of ps, grep. They also have some custom scripts like elgatosleep, diagServer, enable_matrix_kb. And then some are just configuration files, like the files in /etc. do "find ." in /flash/linux to see this stuff.: Since sha256sum isn't included in BusyBox or agilent's files, then you'll have to do this on your desktop or whatever.

author: kr5j
author_rank: Contributor
timestamp: May 19, 2017, 04:57:56 pm
content: I edited the license file with VI and now have all options. Still not clear on how to copy a file to the CF card but will pursue it.Thanks for the help. So now my E7495A has a green GPS indicator and all options.

author: PA0PBZ
author_rank: Super Contributor
timestamp: May 19, 2017, 05:05:32 pm
content: Quote from: kr5j on May 19, 2017, 04:57:56 pmJust for the record, there is no need to edit the license file if you can't work it out. You can use the built in menu to add licenses, just use anything you like for the license key.

author: technogeeky
author_rank: Frequent Contributor
timestamp: May 19, 2017, 06:45:02 pm
content: Quote from: kr5j on May 19, 2017, 04:57:56 pmIf you are using the CF card, insert it, then, for instance to copy the elgato binary:Code:mount /dev/hda1 /flash/mnt/cfcp /flash/egServer/elgato /flash/mnt/cfIf you are using a (CF or SD) to PCMCIA adapter:Code:mount /dev/hda1 /flash/mnt/pcmciacp /flash/egServer/elgato /flash/mnt/pcmciaNote that it might be /dev/hda2.

author: kr5j
author_rank: Contributor
timestamp: May 19, 2017, 08:10:25 pm
content: Ah it was that easy to do! But I had more fun using VI editor

author: technogeeky
author_rank: Frequent Contributor
timestamp: June 21, 2017, 01:57:17 pm
content: Has anyone made any progress on unlocking whatever potential might be in the CW source (or the modulated version, 510)?I'dreallylike to learn if there is potential to extend the frequency range of the output downward. 100kHz would be nice, but even 10 MHz would do just fine.Has anyone ever opened up the CW/mod and taken a guess at what the restriction actually is? I still haven't had the time or courage to open up my E7495a, but I would be happy to do so if it would help someone figure out a starting point to getting lower frequency output.

author: kr5j
author_rank: Contributor
timestamp: July 11, 2017, 08:08:04 pm
content: How to enable the demod option??

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 12, 2017, 08:49:26 am
content: Quote from: kr5j on July 11, 2017, 08:08:04 pmThere's no such option. E7495 demodulation options are limited to cellular phone stuff.

author: TheSteve
author_rank: Unknown
timestamp: July 12, 2017, 04:07:00 pm
content: The N1996A supports AM/FM demod though - so you never know if it can be enabled on the E7495.

author: PA0PBZ
author_rank: Super Contributor
timestamp: July 12, 2017, 05:30:51 pm
content: The option code for the N1996A is AFM so if you have a liberated E7495 just give it a try.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 12, 2017, 07:24:07 pm
content: Quote from: TheSteve on July 12, 2017, 04:07:00 pmHow do you know that I never know?toroServer/Dragonfly/Measurements/KernelBasic/Superfly/Am*toroServer/Dragonfly/Measurements/KernelBasic/Superfly/Fm*toroServer/Dragonfly/Measurements/KernelBasic/Superfly/am.txttoroServer/Dragonfly/Measurements/KernelBasic/Superfly/fm.txtThat DSP stuff looks like AM/FM demodulation code for N1996A, doesn't it?It's not present in egServer. And adding functionality is not just a matter of copying missing files.

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 07, 2018, 04:25:01 am
content: I wanted to bring to attention what I believe is an example of drifting or failing calibration. In a specific sense, none of this matters (because you are probably going tonormalize, which makes the measurement you make relative to the problematic measurement below). It's still interesting, and I'd love to hear speculation on why this is happening. I can make further measurements (such as using a different spectrum analyzer to view the output, or a SDR).The following will tell you the default settings after preset, then show which one or two things to change from the previous. For all tests, the only connection is a 0.5 meter Agilent N-to-N cable.Two Port Insertion Loss(default settings)* 375 MHz - 2.5 GHz* Source LevAuto (10 dBm)* OptimizeAccySo when we go to a preset configuration, we have a sudden downward jump at 1 GHz. In addition, the average insertion loss is genuinely lower than it should be. Substituting a different cable has no effect:If we pick a manual output level, then we can cut down on this effect...* 375 MHz - 2.5 GHz* Source LevManual (0 dBm)* Optimize AccyAnd if we keep reducing the output level, we can eventually make this jump very small:* 375 MHz - 2.5 GHz* Source Lev Manual(-10 dBm)* Optimize AccyIf we change to "Range" mode, this sharp jump effect totally disappears but the insertion loss offsetdoes notchange.* 375 MHz - 2.5 GHz* Source LevAuto (10 dBm)* OptimizeRangeLikewise, if we change to Manual source level and change it to - 10dBm, we get a more or less correct measurement of insertion loss:* 375 MHz - 2.5 GHz* Source Lev Manual (-10 dBm)* OptimizeRangeIn case you think this is an effect which shows up only when you have a large span, it's exactly the same up close:*999 MHz - 1001 MHz* Source LevAuto (10 dBm)* OptimizeRange* Source LevAny thoughts, guesses, or further tests would be appreciated. I have SDRs which I can use to monitor the output from the CW/generator. I can use another spectrum analyzer to view the output. I think I've done this, and I didn't see any sudden jumps at 1GHz exactly. Likewise, when I use another signal generator into this spectrum analyzer (E7495a), I similarly do not see any sudden jump. So this leads me to believe that this effect is from some sort of calibration table that the unit stores for the Two Port Insertion measurement mode specifically.It's worth noting, too, that the procedure for this originally calls for using a two 10dB attenuators (back to back) on the RF out port. Using an attenuator set does, of course, reduce this effect but it's still noticeable.

author: ferdinandkeil
author_rank: Unknown
timestamp: March 10, 2018, 11:11:15 am
content: Quote from: technogeeky on March 07, 2018, 04:25:01 amI can verify this effect with my E7495B. But this is not erroneous behavior: it is caused by the preamp not spanning the complete frequency range (seehttps://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg621126/#msg621126).When do the test with a short cable (RG316) and a 20dB attenuator, the insertion loss measurement is flat to within 2dB. After normalization I get a nice straight line across the whole frequency range. The insertion-loss measurement is probably designed for longer cable runs with significant loss. This would explain the use of the 20dB attenuation when normalizing. So if your cable is quite short and has negligible attenuation the preamp is saturating, thus giving you wrong results.

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 10, 2018, 04:52:01 pm
content: Quote from: ferdinandkeil on March 10, 2018, 11:11:15 amThanks!I had another problem yesterday which I'm sure is new. The display on the unit keeps turning off the backlight, crazy fast. I can actually sometimes catch it saying in the status bar something like "Turning off backlight in 3 seconds" with a countdown.Any ideas where this could be stopped or configured?

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 11, 2018, 06:18:42 am
content: Quote from: technogeeky on March 10, 2018, 04:52:01 pmThis, along with another problem (the network interface not working), just disappeared after I left the unit unplugged for a while (a few hours). So that's good and bad, but more good than bad.I still had practical problems making two port insertion loss measurements (even with 20dB worth of pads) and Auto (+10dBm) output level. I would get sudden burst of uncertainty in the response right after 1GHz, for almost 500MHz. In any case, I managed to make the measurements by going to 0dB.

author: ferdinandkeil
author_rank: Unknown
timestamp: March 11, 2018, 11:24:06 pm
content: Quote from: technogeeky on March 11, 2018, 06:18:42 amGlad to hear that the problem went away on its own.Regarding the insertion loss measurement, 10dBm just might be a little much for the preamp. Did you normalize (aka calibrate) the measurement?

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 12, 2018, 05:23:05 am
content: Quote from: ferdinandkeil on March 11, 2018, 11:24:06 pmYep. I don't believe the 10dBm claim, but that's what it says on the source level of my instrument. I'll take some SDR screenshots (while restraining the tracking generator to a small frequency range). It normalizes fine. But once I make a measurement, and it's still in +10dBm mode, there is a bunch of noise right after 1000 MHz.

author: JessieAMorris
author_rank: Newbie
timestamp: March 14, 2018, 03:55:34 pm
content: Just picked up a working unit off the 'Bay for $300 shipped. Excited to start playing with some RF goodness.

author: walter2
author_rank: Newbie
timestamp: April 15, 2018, 09:54:39 pm
content: I recently got 2 E7495A, both booted and worked. Working with a fellow conspirator here in kelowna, we took his known good PCMCIA/Flash update card with 6.25, and did the flash upgrade to the best unit with 6.24 working on it.the update never completes, it runs for a very long time, gets to anywhere from 70-90% of the flash update, and never goes further. when we transferred the flash card right to the machine (rather than via the pcmcia adaptor), it runs faster, and doesn't complete, but also throws up a strange message "inflate returns -3" repeatedly, then a blosk fo data too fast to read, then stalls again. we tried the normal on-screen update, and the hidden lower right button full refresh, but fail at the end.we have tried all variants of the process, but cannot get to an updated machine. this appears to indicate that the internal flash on the motherboard is bad at some location, and doesn't permit a valid update. is this right? if so, how can I fix the flash on the motherboard.?? does anybody have ANY internal documentation for this unit? I see nothing at hp/agilent/keysite.you can email me directly at walter2 -at- sphere.bc.caI would really like to get this unit working, and am incredibly sorry I tried this update. any help appreciated.regards,walter

author: technogeeky
author_rank: Frequent Contributor
timestamp: April 15, 2018, 10:59:42 pm
content: Quote from: walter2 on April 15, 2018, 09:54:39 pmwalter:Fromhere, inflate() returning -3 is evidently the error Z_DATA_ERROR. This error arises during extraction from a compressed file (hence inflate). Z_DATA_ERROR implies that the source data is missing, invalid, or corrupted. I would get a new or different CF card, or a different CF card to flash adapter.I know the update process is run during boot (it checks to see if a card with an update is present, and asks you if you want to try and install it). Since this is just some command, it should be possible to run this command from the local memory inside the machine. You can telnet in, use FTP to upload the update file/images, and then run the update manually.

author: ogden
author_rank: Super Contributor
timestamp: April 15, 2018, 11:07:31 pm
content: Quote from: technogeeky on April 15, 2018, 10:59:42 pmAlso it is worth checking MD5 checksum of the file(s). It could be so that during download file somehow became corrupted.

author: walter2
author_rank: Newbie
timestamp: April 16, 2018, 02:23:42 pm
content: For "greater clarity" here, I was able to use that SAME update flash card to successfully update my second unit, so there is no question that it works. we also confirmed it was good on three other machines.I would have thought the messages about inflating were just as others suggested, that it is an update source problem after decompression,but it is certain that is not the issue, the problem is at the destination, the internal flash on the motherboard. I believe this message indicates that a checksum failedafter attempted writing, but am not positive. more disturbing is that I have zero info on the mother board. the issue always arises towards the end of the process, which points to a bad or marginal area at the end of the local flash storage.anyone with motherboard info, and how to fix the on-board flash would be greatly appreciated. there is no local flash card or other easily replaceable memory on the card, other than what appears to be a boot ROM.regards,walter

author: TheSteve
author_rank: Unknown
timestamp: April 16, 2018, 04:27:56 pm
content: Is it possible the problem unit had a bunch of user data stored on the internal memory before the upgrade was started so it is running out of space?

author: walter2
author_rank: Newbie
timestamp: April 16, 2018, 09:39:08 pm
content: I don't think that is the case, since the "re-build" option re-does EVERYTHING, including errasing and re-formatting the flash... I suspect the problem is a poor sector of flash on the motherboard, works a bit some times, fails others.since you are in BC, come see us for stuff day next saturday, the 21st! we are in west kelowna.all the details are here, assuming the posting software allows it:http://www.sphere.bc.ca/test/stuffday.htmlif it gets vaporized, google sphere research corp., and look for the stuff day link at the top of /index.html.all the best,walter

author: RCHRDM
author_rank: Regular Contributor
timestamp: May 12, 2018, 10:04:52 pm
content: HelloI will be picking up an Agilent E7495 next week. I am not sure of which options are included.Does anyone have unlock codes for the options for this instrument?Richard

author: technogeeky
author_rank: Frequent Contributor
timestamp: May 13, 2018, 11:57:27 pm
content: Quote from: RCHRDM on May 12, 2018, 10:04:52 pmThere are no codes. The nature of the unlock process is:* patch the binary so that it doesn't check if the unlock code is valid or not* insert any dummy text instead of the code in the license file, for each option you want to enableThis will be easier to understand once you have a device in front of you. The license file will have examples of valid codes that ship with the device, so you will have an example of the structure of each option.

author: RCHRDM
author_rank: Regular Contributor
timestamp: May 17, 2018, 01:12:32 am
content: I got my E7345 today. It has a few cosmetic issues, but it boots up! There is no power meter option.There appears to be a gasket around the LCD that is loose on the left and bottom of the display, so I guess I will have to take the thing apart and replace the plastic screen overlay or cover. I attached a picture. The spectrum analyzer works OK.There is also a missing threaded insert that takes the battery door retaining screw. Would someone mind taking a picture of where the battery door screw threads into the case to hold the door closed?Richard

author: RCHRDM
author_rank: Regular Contributor
timestamp: May 17, 2018, 05:05:01 am
content: Does anyone have a service manual or parts list? I tried Agilent and they said they did not have one...Richard

author: RCHRDM
author_rank: Regular Contributor
timestamp: May 25, 2018, 06:42:18 am
content: I am in the process of hopefully getting some additional parts to replace those missing from y E7495.Could you please step me through the "hacking" process to enable the power meter? I can follow along with the my instrument now.BTW, I have a service manual now if anyone needs one.Richard

author: technogeeky
author_rank: Frequent Contributor
timestamp: May 25, 2018, 08:48:00 pm
content: Quote from: RCHRDM on May 25, 2018, 06:42:18 amWhat do you mean about missing parts?The power meter is not a software option. If it's physically installed, it will be working (I think).You have the real service manual? I'd love to see it. PM me.

author: RCHRDM
author_rank: Regular Contributor
timestamp: May 25, 2018, 09:24:03 pm
content: After I got the E7495 home, I noticed that it was missing the connector for the power meter. (Someone had put tape over the hole, so I could not tell from the auction photos.)I took it apart to repair a problem with the LCD cover and found that the power meter board was installed, but two ribbon cable connections were missing. I assume one of them is for the power meter connector on the case.I also found that there were a few other missing things including the main case gasket, a couple of screws, and the cover for the PCMIA area.There is a guy who has a parts machine, so we are talking about pulling some parts from it.When the instrument is powered up, the power meter button is grayed out, so I assume the option is not activated.Richard

author: kk6ioz
author_rank: Newbie
timestamp: May 28, 2018, 06:36:27 am
content: To extend the lower range, can we build a transverter with a 400MHz LO to cover 0Hz to 400MHz for the VNA measurement? and would a transverter work for SWR measurement.It would be great if a SW hack could be found.

author: jokkydee
author_rank: Newbie
timestamp: June 07, 2018, 05:41:47 am
content: The company I work for have a N1996A and I wanted to enable the stimulus/response N8995A-SR3 option so I contacted Keysight and they said the unit is no longer supported and that I can't even pay to get the option enabled. I mentioned that people have hacked the software to enable options, and they just referred me to their forums and said hopefully I can find someone who can help. So now I have a clear conscience with hacking the firmware to enable options since I tried the formal path. Can anyone explain how I can do this, considering I don't have much experience with Linux? I read over this forum but couldn't get a clear picture of what exactly I need to do. I understand I need to patch the firmware, PA0PBZ mentioned a patch for the E7495 but that uses the elgato process, I don't know what I need to do for the N1996A. Can anyone please help?

author: PA0PBZ
author_rank: Super Contributor
timestamp: June 07, 2018, 07:23:47 am
content: You've got mail.

author: jokkydee
author_rank: Newbie
timestamp: June 07, 2018, 07:34:06 am
content: Thanks PA0PBZ, I'll let you know how it goes. Also, reading the installation note for the TG option,https://literature.cdn.keysight.com/litweb/pdf/N1996-90009.pdf?id=1132460it notes that several adjustments are required after this option is enabled, including TG flatness and return loss calibration. Also they mention some minimum performance checks like freq response and DANL. There's a calibration software that requires a license to use it in order to run these adjustments. I wonder how critical these are. I've contacted Keysight regarding this software to see what they say.

author: PA0PBZ
author_rank: Super Contributor
timestamp: June 07, 2018, 07:56:53 am
content: It's not only the software you need but also the instruments, which is an even larger problem. If you just normalize before your measurement flatness should not be a problem.

author: jokkydee
author_rank: Newbie
timestamp: June 08, 2018, 04:14:26 am
content: I've got the options enabled after the patch, thanks for the help. I take it that normalising will mean for the purposes of doing measurements with the unit itself it should be ok, but if for example, characterising a cable for use in an external system by exporting the insertion loss data, it may not be reliable without those adjustments and checks?

author: PA0PBZ
author_rank: Super Contributor
timestamp: June 08, 2018, 10:36:12 am
content: When normalizing you connect the output of the instrument to the input and the instrument builds a correction table that takes the wrinkles out of the signal generator and the receiver. That way you can do your measurement and it will not be influenced by any anomalies of the instrument.

author: RCHRDM
author_rank: Regular Contributor
timestamp: June 09, 2018, 10:51:18 pm
content: My E7495 works OK, but is missing a few parts. Does anyone have parts they would be willing to sell? The main thing is that the power meter board is installed, but the two ribbon cables (one presumably going to the case-mounted connector) are missing, along with the connector.I also need a main case gasket and the threaded insert that the battery door retaining screw threads into.Thanks.Richard

author: RCHRDM
author_rank: Regular Contributor
timestamp: June 09, 2018, 10:53:28 pm
content: Is there a way to hack the software or firmware in the E7495 so that the lower frequency limit for the one port and two port loss can be set lower than 375 MHz? Being able to cover the ham HF bands would be nice.Richard

author: startronic
author_rank: Contributor
timestamp: June 11, 2018, 08:52:26 pm
content: Hello Friendyou can describe, how to do full options

author: TheSteve
author_rank: Unknown
timestamp: June 12, 2018, 05:45:57 am
content: Quote from: RCHRDM on June 09, 2018, 10:53:28 pmThe lower frequency limit can be changed by editing a text file however I believe it has been documented in this thread that lowering it causes the generator to crash when it boots.

author: kk6ioz
author_rank: Newbie
timestamp: June 13, 2018, 03:38:08 pm
content: in the reply #148:"I played around with the files in/flash/egServer/Dragonfly/Receivers, like E7495A and CPXSRC. You can indeed change things here and sometimes see the effects (e.g. you can change E7495A to have Freq Range be 3000e6, and it makes it possible to enter that value). However, some of these changes will have no effect for other reasons (here, I assume it's because there is actually a filter which sharply cuts off at ~ 2.7GHz). However however, I could not find a way to try and make the signal generator make higher or lower frequency signals"Maybe we should do more experiments with this and document if it works below 375 MHz for the one port and two port measurements.

author: TheSteve
author_rank: Unknown
timestamp: June 13, 2018, 04:26:20 pm
content: I've lowered the gen frequency on its big brother the N1996A and it works fine but I don't have an E7495A to experiment with.

author: RCHRDM
author_rank: Regular Contributor
timestamp: June 13, 2018, 04:41:59 pm
content: That's great! Can you say how you did that?RichardAE6XO

author: kk6ioz
author_rank: Newbie
timestamp: June 13, 2018, 06:28:17 pm
content: Regarding "I've lowered the gen frequency on its big brother the N1996A and it works fine but I don't have an E7495A to experiment with."Could you describe what "it works fine" means? have you done 2-port or 1-port measurements at a lower frequency range (let's say 1MHz or 10MHz) and have you compared the measurement with other VNA?Do you remember what exact file and parameter you have changed?

author: TheSteve
author_rank: Unknown
timestamp: June 13, 2018, 06:46:44 pm
content: Quote from: kk6ioz on June 13, 2018, 06:28:17 pmThe biggest difference is that the N1996A gen out starts at 10 MHz when stock. I lowered it to 1 MHz and it still normalized fine. Its performance was just fine for return loss measurements of HF antennas.

author: PA0PBZ
author_rank: Super Contributor
timestamp: June 13, 2018, 07:26:24 pm
content: Quote from: TheSteve on June 13, 2018, 06:46:44 pmThat. There is a model description file in the N1996A firmware that lists the frequency range of the freq generator. If you change the starting freq from 10 to 1 MHz it will obey.

author: PrenticeManNY
author_rank: Newbie
timestamp: June 17, 2018, 10:10:03 pm
content: Hi everyone. I'm the proud owner of this instrument and recently discovered this thread. I've read through the entire post several times and have learned a great deal thanks to everyone's generous attitudes toward sharing their knowledge and experience.My particular E7495 was running an ancient firmware of 1.60. Thanks to this forum I was able to easily obtain the now scarce 6.25 firmware package and had little trouble installing this once I got my hands on a compact flash card. The next step was dusting off my linux skills which are no where near as developed as the people in this thread but turned out to be adequate to transfer the required binaries and use a hex editor to manipulate them as described. I have hit a snag unfortunately. I have the same problem reported by another user where I am unable to navigate to the second page of system options due to a system hang when the more options soft key is pressed. I understand the cause of this, at least in that other poster's situation was due to his license file having no entries after "SIGN=".I thought the solution for me would be that simple as well but it seems I have a unique problem here. My license file does not contain erroneous entries, in fact it seems to be missing information. I have re-installed the 6.25 firmware 2 times and then tried a third time with the recovery script method. This third time I tried a little experiment and modified the License file by changing the values of the populated features and then using the recovery script after moving the file to /flash/egServer/license/elgato.lic . After the update I checked the file and discovered apparently at least in my case this license file is not touched in the update process as my license file had the changes I had made in a hex editor.I'm not sure how I ended up with what I suspect is a corrupted license file but here I am. I can go to the install license screen when I have a binary with the stock hex values in the 337A7C offset and see all the correct options (i.e. over the air EVDO and so on) but in my original license file these options aren't listed.Can someone here please take the time when convenient to view my transferred License file and maybe share their thoughts on whether a license file from another machine has any hope of being transplanted into mine and confirm that my file is in fact somehow corrupted?Thanks in advance to anyone who can spare some time to read all this and help me out! And if something I've done or tried to explain doesn't make sense then thanks too for your patience. I've attached the file as a .txt to meet the forums attachment requirement.

author: PA0PBZ
author_rank: Super Contributor
timestamp: June 18, 2018, 07:03:06 am
content: Was there a value after the SIGN= in the original file? That is the key to unlock the feature together with the HOST string:FEATURE 503 agilent 1.000 permanent uncounted \HOSTID=ID_STRING=12345678 SIGN=F1CE2A146BC6The HOSTID is the ID of your instrument which is the same as in the file hostid in the same folder, and the SIGN is the key that was entered to activate the option.Sometimes there are some default entries in there that don't have a SIGN so normally they do nothing. But when the patch is applied they all start to work...Also, I see a hex "F0" value behind the sign for option 210 which I'm sure does not belong there, and a lot of hex "00" in every SIGN=Try to put 12 digits (0-F) after every SIGN= and try again.

author: PrenticeManNY
author_rank: Newbie
timestamp: June 18, 2018, 11:21:10 am
content: Thanks for the reply, I just realized I mistakenly uploaded the file I had tried to modify which explains the FO entry you pointed out. I tried entering 00 in the fields after sign and must have missed that one. Just to clarify, any value can exist after these entries? obviously if I screw up the correct formatting by entering information into the wrong field as I've done here that matters. But by putting say 00 A1 B1...etc into the field or all 00 00 00 entries as I tried here that is how I fix the file?Sorry to be dense, I'm struggling a little determining how exactly the file should look....

author: PA0PBZ
author_rank: Super Contributor
timestamp: June 18, 2018, 11:46:05 am
content: Yes you can pick any value(s) for the SIGN= string, the patch disables the check on this value. However, I think that invalid values or length can still do strange things, I don't remember if there was any other checking on this value when I created the patch long ago. In any case, don't use HEX 00 values or other unreadable stuff in there but use 12 characters from '01234567890ABCDEF'.I don't see anything wrong with your license file apart from the fact that the last option (240) is missing the SIGN= entry, this could well be the problem.It looks like it contains the following options:200=CDMA / CDMA 2000 Analyzer210=CDMA Over Air Test220=Channel Scanner240=W-CDMA Analyzer

author: PrenticeManNY
author_rank: Newbie
timestamp: June 18, 2018, 11:41:09 pm
content: I've just edited the elgato.lic file to include the last sign= portion that was missing. Thank you for finding that missing portion and helping me to fix my mistake. This as you likely already knew has fixed the menu option issue and I can now install all options. I've learned a good amount reading this thread and for that I'm forever grateful.

author: TK
author_rank: Super Contributor
timestamp: July 20, 2018, 12:48:30 am
content: Quote from: 9aplus on November 06, 2015, 04:48:09 pmIt is the gasket that sits between the LCD module and a transparent plastic panel that protects the screen. I have not fixed mine yet, but I took the front panel apart and I verified that is the black gasket. It should be easily fixable, no need to purchase a new LCD module. I have seen many units on eBay with the same issue.

author: ua4yhz
author_rank: Regular Contributor
timestamp: July 21, 2018, 03:18:49 pm
content: I have periodically at different levels of brightness blinking display. I had to find a reason. The culprit was the inverter. To eliminate the defect, it is necessary to solder the resistor of 1 mom-2 mom in parallel with the capacitor C20. (Between 4 and 5 pin BA9743A).

author: TK
author_rank: Super Contributor
timestamp: July 22, 2018, 12:20:13 am
content: Quote from: technogeeky on February 28, 2017, 10:19:40 pmThe DC plug is 5.5 x 2.5mm center positive. The most common plug size is 5.5 x 2.1 and it does not fit unless you push it very hard, which can break the DC jack.

author: 9aplus
author_rank: Regular Contributor
timestamp: July 30, 2018, 06:30:41 am
content: Quote from: TK on July 20, 2018, 12:48:30 amTrue... have find out that, when I finally opened the unit to verify LCD type.

author: ncfireman
author_rank: Newbie
timestamp: August 02, 2018, 01:58:52 am
content: Has anyone had any luck using either the serial ports or gpio? I was hoping to get it to spit out useful data on the serial port.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: August 02, 2018, 10:57:54 am
content: Quote from: ncfireman on August 02, 2018, 01:58:52 amThere should be no problem accessing serial port from inside of E7495. What kind of data are you going to spit out?

author: ncfireman
author_rank: Newbie
timestamp: August 05, 2018, 06:22:37 am
content: I'd like to be able to export gps and an average signal level. Something where I could do a rough drive test.

author: 9aplus
author_rank: Regular Contributor
timestamp: November 22, 2018, 06:52:28 pm
content: Today during the boot my E7495B stopped to work. The unit was couple months in storageduring the whole summer.The trouble is localized within PS DC/DC picture with model details in attachment.Looking for that module, designated in service manual like:Power supply interface board A4A4or whole unit E7495 for parts....PM pls, located within EU

author: kirill_ka
author_rank: Frequent Contributor
timestamp: November 22, 2018, 07:37:49 pm
content: Quote from: 9aplus on November 22, 2018, 06:52:28 pmMy E7495A refused to work on battery. Now I regret that I dig into this. It took so much time...The issue that was looking like a component failure appeared to be a pure software thing.There is some SMBUS/Smart battery ugliness. Anyway, now I know quite a lot about this module.I can help with diagnostics and repair.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: November 22, 2018, 07:49:04 pm
content: Here's PIC16F877 pin map to start with. It's not complete and may have some mistakes, but it's at least something.Code:P/N NAME DIR FUNCTION CONNECTIONS1 RC7 I UART RX J10/52 RD4 O BATT LED U103 RD5 O BATT LED U104 RD6 O BATT LED U105 RD7 O BATT LED U106 VSS -7 VDD +8 RB0 I LOBAT(LOW)9 RB1 O 3DM(LOW)10 RB2 O DCIN (HI)11 RB3 O PWR ON LED J20/1012 NC x13 NC x14 RB4 I START OF BATTERY MONITORING? J52/4, R9615 RB5 O BATDIS(LOW)16 RB6 O SUSPEND to ADS? J6/1, J55/217 RB7 O STBY PWR ON (LOW), STDBY LED (LOW) U101, U11 - J20/718 RST R19 RA0 A BATT TEMP20 RA1 A BATT TEMP21 RA2 O BATT TEMP STROBE22 RA3 I CONFIG JUMPER J11/123 RA4 I DCIN DETECT U124 RA5 O BATT TEMP STROBE25 RE0 A 3.3V SENSE 100K - J5/5,626 RE1 I PWR SW U203, J20/927 RE2 I ADS POWER DETECT28 VDD +29 VSS -30 X1 C 4MHz clock in U10031 X2 I NOT USED32 RC0 O CHARGER OFF 100K - CR4, Q13 - Q12 - U8/233 NC x34 NC x35 RC1 O adjusts PROG A of U7 Q11 - 10K - U7/136 RC2 O charger output voltage setting Q14 - ?K - U8/6(Vosense)37 RC3 I/O SCL Q20, J52/338 RD0 O CHGSEL39 RD1 I BACKLIGHT DISABLE? (NOT USED) 100K to Q7, GND40 RD2 O BATSEL41 RD3 O MAIN POWER ON 18K to J5/1042 RC4 I/O SDA Q16, J52/243 RC5 O I2C BATT MULTIPLEX U1344 RC6 O UART TX J10/3Q16, Q19, Q7 = NPN MMBT3904 1AMBCEPNP MMB3906 2ABCEn-MOS 2N7002 702PGDS

author: 9aplus
author_rank: Regular Contributor
timestamp: November 22, 2018, 07:54:59 pm
content: Thank you Kirill,My unit was on approx half OS boot, then went black.The protection on external PS was safe triggered like short circuit.Than I loaded battery on separate load rack and try to power on withbattery, the screen went on for the moment, than black again.Now with all other connectors disconnected from A4A4 on power onred LED goes on for short blink than protection trigg. again to black.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: November 22, 2018, 08:12:10 pm
content: Quote from: 9aplus on November 22, 2018, 07:54:59 pmTry holding the red button. This should hold the PIC in reset state, so we know whether it shorts the supply before or after the firmware starts.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: November 22, 2018, 08:33:44 pm
content: The yellow tantalum in the middle of the picture doesn't look good.Or is it just a shadow?

author: TheSteve
author_rank: Unknown
timestamp: November 22, 2018, 08:41:07 pm
content: Quote from: kirill_ka on November 22, 2018, 08:33:44 pmIt does look like there is a chunk of it missing.

author: 9aplus
author_rank: Regular Contributor
timestamp: November 22, 2018, 08:51:26 pm
content: True, that tantalum is blown... Thank you for remote troubleshooting.

author: 9aplus
author_rank: Regular Contributor
timestamp: November 22, 2018, 09:09:50 pm
content: So tomorrow morning I am in chase for 10 uF 35V tantalum.Will report further development when replaced

author: kirill_ka
author_rank: Frequent Contributor
timestamp: November 23, 2018, 09:19:22 am
content: Do you have a PIC programmer? Maybe you could download the firmware from your PSU board? I'd like to check if they fixed the SMBus code in newer revisions.

author: 9aplus
author_rank: Regular Contributor
timestamp: November 23, 2018, 01:17:27 pm
content: No PIC programmer at the moment. But can find one when done with this trouble...Today browse through 3 local shops, some tantalum procured, but not the right one SMD 10 uF 35 VSo trial with:SMD 4,7uF 50VorPin through 10uF 35VMust decide after removing of the blown one...

author: kirill_ka
author_rank: Frequent Contributor
timestamp: November 23, 2018, 01:45:57 pm
content: I'd stack two 4,7uF

author: 9aplus
author_rank: Regular Contributor
timestamp: November 23, 2018, 05:22:40 pm
content: Stacking was not feasible operation, therefore classic wire through component replacement.Unit tested, red LED lit... looks good.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: November 23, 2018, 08:18:52 pm
content: Good. If you'd be so kind to grab the firmware, the programming header (2mm pitch) pinout is as follows:1. PGD (PIC pin 17)2. PGC (PIC pin 16)4. MCLR (PIC pin 18)6. VDD (PIC pin 7)8. VSS (PIC pin 6)Please, double check the connections before trying.In my E7495A PIC pin 17 is connected to the header through 10K resistor, so I had to connect the PICkit to the pin 17 directly.Other than that I had no problems reading the firmware with the board powered off.

author: 9aplus
author_rank: Regular Contributor
timestamp: November 24, 2018, 08:25:41 am
content: Locally can find only:"Vellman VM203PICKit™2 Development Programmer is very versatile.It features on board sockets for many types of PIC® microcontrollers.Also provided is an ICSP connector, to program your onboard device.https://www.velleman.eu/downloads/0/modules/usermanual_vm203.pdf"On A4A4 ISCP is marked like "PIC PGM PORT J55"Do you know the layout?Or you have some tool to clamp on PIC 16F877 directly ?Do you have any picture how did you manage to read out that PIC

author: kirill_ka
author_rank: Frequent Contributor
timestamp: November 24, 2018, 09:49:49 am
content: Quote from: 9aplus on November 24, 2018, 08:25:41 amIt should work. However, if it's becoming too complex, please, don't waste your time on this.Quote from: 9aplus on November 24, 2018, 08:25:41 amYes, I noted it above. 1. 2. 4. 6. 8. are the pin numbers of J55.Quote from: 9aplus on November 24, 2018, 08:25:41 amNo.Quote from: 9aplus on November 24, 2018, 08:25:41 amUnfortunately no, my unit is assembled already. I made an adapter to connect PICkit 3 to the J55. Then I cut the trace going to J55 pin 1 and added a bodge wire to connect J55 pin 1 directly to the pin 17 of PIC. That's because I wanted to program it many times. If you do it once, you may just solder wires directly to the pins of PIC16 (U201).

author: 9aplus
author_rank: Regular Contributor
timestamp: November 24, 2018, 12:04:08 pm
content: @kirill ok on allIt seems that my unit will remain open for some timeAfter reassemblyPower on, green LED ON, no sign on LCD screen, after couple of seconds green LED offtested on internal BAT and external PSIt seems that some voltages are missing...The puzzle is that initially with blown tantalum, unit was able to blink LCD powered from BAT...Possible that I mix some interconnections, but I followed instructions from bellow DOC.All ideas or experience is more than welcome.Regarding documentation have only:Service GuideAgilent Technologies E7495A/BBase Station Test SetAny other available?To be continued...

author: 9aplus
author_rank: Regular Contributor
timestamp: November 24, 2018, 12:26:00 pm
content: UPDATE:For sure some voltage was missing, on recheck have find out one grey wire setrouting from A4A4 to CPU A4A1 board not fitted properly.Now all good.Unit boot OKJust must finish assembly to perform proper test

author: 9aplus
author_rank: Regular Contributor
timestamp: November 24, 2018, 02:53:08 pm
content: All in order...Have used the opportunity to clear the LCD screen, from that black internal seal,the glue is nasty thing to handle. Some minor damage on lexan remains after cleaning.Pictured with RLB, procured on line recently for some SDR play.The price was to good, to be true (45 GPB).On the end RLB OK, and E7495B OK after allLike to thank You all for kind assistance

author: jofre
author_rank: Newbie
timestamp: December 24, 2018, 08:57:53 pm
content: can anyone help me with user and web password inteface?thanks

author: ddcc
author_rank: Regular Contributor
timestamp: February 23, 2019, 09:28:52 pm
content: Quote from: Urs42 on February 22, 2015, 09:08:27 pmI picked up an E7495A recently, and have been poking around the Java remote GUI feature. I ended up patching the bytecode in the main v6.25 egclient.jar to fix a couple of annoying bugs, so hopefully this is useful:elgato.infrastructure.util.RuntimeConfiguration.isEmbeddedUsingInstance(): This is used to determine if the keypad should be shown in the remote GUI, but it implements this by checking if the runtime system architecture string contains "86". However, on a 64-bit system, the check will fail, and the keypad won't be displayed. I've modified it to check for "arm" instead.elgato.infrastructure.util.Platform.createPlatform(): This is used to determine which JVM wrapper should be instantiated, either Skelmir's CEE-J or Sun's JVM, but it implements this by checking if the current JVM version string contains 1.4, 1.5, or 1.6. This is part of the reason why egClient.jar doesn't work with JRE > 6. The other part is that the "CEEJPlatform" is referenced statically, whereas the "Java14Platform" is instantiated dynamically, which can cause a ClassNotFoundException at runtime if the CEE-J runtime classes aren't available. I've modified this by swapping the two so that "CEEJPlatform" is dynamically instantiated, and changed the version check to perform a vendor check instead. This should allow the GUI to work on any modern JRE, though I've only tested with JRE 8.Link:https://www.dcddcc.com/blog/e7495a/egclient.jar

author: ddcc
author_rank: Regular Contributor
timestamp: March 24, 2019, 06:15:06 am
content: So it turns out that on my unit, the spectrum analyzer, signal generator, and two-port insertion loss features seem to work fine, but the one-port insertion loss and return loss measurements give incorrect results. Since there's no block diagram available, I ended up taking apart and reverse engineering the receiver board, shown below. I don't have much previous RF experience, so corrections/suggestions are welcome!It seems that this unit is a superheterodyne receiver using double conversion, with the 1st LO at 1.5 - 3 GHz, the 2nd LO at ~3 GHz, and a final IF at ~135 MHz. The unit seems to have two separate receiver bands, one for < 2.7 GHz, and the other for 2.7 - 4 GHz ??. There are 2x 5-bit (<= 31 dBm) digital attenuators on the input path, and a 0 - 90 dBm electronic attenuator on the output, although the module seems capable of up to 130 dbm attenuation.Since this unit is designed for portable operation, the internal cables are short and the assemblies are all stacked on top of one another, making it difficult to probe the receiver board with the unit running. I ended up removing the connection panel and flipping the receiver board, which gave me access to its top side. Since the spectrum analyzer and signal generator features work independently, I'm guessing that the fault probably lies on the feedback path from the source output on to the input path, which runs from the coupler through some filters and SPDT switches (from D to A on the annotated image). Interestingly enough, some rework seems to have already been performed on the filters on this path, probably by the factory?Next, I plan to probe this path while operating the unit in return loss mode, but this will be a bit tricky because I only have a 100 MHz scope, and no other spectrum analyzers or high-frequency probes. However, I do have a RTL-SDR and a LimeSDR, so I can probably make do, and just need to compile the software stack on my laptop.

author: PA0PBZ
author_rank: Super Contributor
timestamp: March 24, 2019, 07:57:44 am
content: This is the block diagram of the RF part for the N1996A, the bigger brother. It could help because they are very similar.

author: 9aplus
author_rank: Regular Contributor
timestamp: March 24, 2019, 07:59:03 am
content: @ddccThank You for that picture, during my unit PS repair I was wondering what is inside that boxMember here Wolfgang made nice FET probe which can be of good use during your repair ->https://electronicprojectsforfun.wordpress.com/2018/08/03/a-homebrew-fet-probe-to-1-5ghz/Good luck with the rest of your repair journey.

author: ddcc
author_rank: Regular Contributor
timestamp: March 24, 2019, 06:04:35 pm
content: Quote from: 9aplus on March 24, 2019, 07:59:03 amThanks for the link, looks useful!Quote from: PA0PBZ on March 24, 2019, 07:57:44 amThanks, I saw the reference to the N1996A earlier in the thread. Some parts are a bit similar; e.g. the four 1st LO filter banks, and two mixers for the 1st and 2nd converters. But otherwise, a lot seems to be different; for example, there doesn't seem to be a 3rd converter, the LO/IF frequencies are different, the attenuator values/positions are different, and the intermediate filters also seem different, although most aren't labeled on the PCB. I'm also not sure why there's a 2.7 - 4 GHz high band on the E7495A, since the instrument is only rated up to 2.7 GHz.

author: Wallace Gasiewicz
author_rank: Super Contributor
timestamp: March 26, 2019, 07:43:30 pm
content: Has anyone resolved the GPS lock issue where the yellow triangle stays on and there is no green "lock" on the time/frequency base?Wally

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 27, 2019, 04:10:46 am
content: Quote from: ddcc on March 24, 2019, 06:15:06 amThanks for posting this. I've been waiting a long time to see this (since my unit doesn't have problems, I didn't want to open it).Can we also get the same picture without annotations -- for A/B comparison to see your notes?Also, can we get some shots from a low angle (say, 30 degrees up from the plane of the board) so we can see the size and configuration of RF gaskets and such.Thanks!

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 27, 2019, 04:37:37 am
content: Quote from: ddcc on March 24, 2019, 06:15:06 amI'm like you and I don't have much RF experience, my initial reaction to looking at this picture carefully is that I would be surprised that this is factory rework. Upon reading your comment and looking at the path involved (along with your statements about what works and what doesn't), I think we have a repair attempt.It looks like all of the reworked items are passives, too.My first guess would be to check the SPDT switch that comes out on the right side of the board at A.

author: Wallace Gasiewicz
author_rank: Super Contributor
timestamp: March 28, 2019, 10:35:12 am
content: I think I am almost ready to do the 6.25 upgrade then the clock/freq hack.I have the 6.25 filesI have putty and telnetI have a PCMCIA card and a computer with a working PCMCIA port and windows 7The PCMCIA card has an old 6.14 upgrade on it.My new 7495 works fine at present with the exception of the Freq/time issue, yellow triangle, tracks satellites .Questions:Can I use telnet to do the upgrade? Or do I copy the old 6.4 to my computer and save it, wipe the card and addegclient.jar and full 6.25 upgrade to the card? Then use the card in the 7495?I do not have a Hex reader at present, any recommendations? I have Minipro programmer and have used it several times in the past to work with EPROM. Just converted 8713 to 8714, I have an extra unit if anyone is interested.I would like to make the hack changes to the files before I upgrade the 7495, are the binary addresses the same?Can I do that?I know the hack will not work on my present OS because the binary addresses are not the same. I guess I could look for the lines of code though.Any help would be appreciated, Wally

author: kirill_ka
author_rank: Frequent Contributor
timestamp: March 28, 2019, 01:07:45 pm
content: Quote from: Wallace Gasiewicz on March 28, 2019, 10:35:12 amHi Wally,Make sure the hash for the resulting binary is correct. This is a reliable way to know you did the right thing. I'm not sure if it's easy to apply the patch to the upgrade package,but you can always telnet to E7495 and replace the binary after the upgrade.See here for sha256 hashes:https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg1212269/#msg1212269

author: kirill_ka
author_rank: Frequent Contributor
timestamp: March 28, 2019, 01:30:15 pm
content: Does anyone know, how to disable HW options? For instance, I removed the power meter board to add a second channel to the E4418B power meter.I hacked some "registry" files to make it boot, but the power meter option is still there. I want to remove it cleanly.

author: darnelld
author_rank: Newbie
timestamp: March 28, 2019, 09:02:22 pm
content: root login.. I just picked up this great little box to use a spec an for TRP measurements. For the life of me I can't log in as root. I looked at the securetty file (file contents below) and noticed that I according this, I am not allowed to log in as root over telnet because the ttyp0 and ttyp1 are not allowed. Any ideas how I can get around this?Thanks![guest@E749xx /etc]$cat securetty# /etc/securetty: list of terminals on which root is allowed to login.# See securetty(5) and login(1).## Include ttyp0, ttyp1, etc to allow telnet access. *NOT RECOMMENDED*tty1tty2ttyS0ttyS1ttyS2ttyS3ttyS4ttyS5pts/0pts/1pts/2pts/3pts/4pts/5[guest@E749xx /etc]$

author: kirill_ka
author_rank: Frequent Contributor
timestamp: March 29, 2019, 09:53:17 am
content: pts/? serves the same purpose as ttyp?. I think the comment about ttyp is obsolete. Have you upgraded to 6.25?

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 29, 2019, 10:42:33 am
content: Quote from: kirill_ka on March 28, 2019, 01:30:15 pmI suppose I have a similar question about the T1 analyzer.As far as I know, the only way to stop the (very) long T1 analyzer initialization process from going is to disconnect the hardware. Anyone else know a way to stop it while leaving the hardware unchanged?

author: kirill_ka
author_rank: Frequent Contributor
timestamp: March 29, 2019, 11:33:50 am
content: Quote from: technogeeky on March 29, 2019, 10:42:33 amWhen I disconnected the power meter board, it didn't start. So I'm not sure if this is an option with the T1.The service guide mentions some serial number editing utility which is used to enable HW options...

author: ogden
author_rank: Super Contributor
timestamp: March 29, 2019, 12:09:35 pm
content: Quote from: technogeeky on March 29, 2019, 10:42:33 amTry removing hardware option from elgato.lic. The very beginning of this thread is about adding/hacking software options, maybe removal works same way..

author: darnelld
author_rank: Newbie
timestamp: March 29, 2019, 09:51:33 pm
content: Quote from: kirill_ka on March 29, 2019, 09:53:17 amActually no, let me give that a try... just got a compact flash to install from

author: technogeeky
author_rank: Frequent Contributor
timestamp: March 29, 2019, 11:29:57 pm
content: Quote from: ogden on March 29, 2019, 12:09:35 pmI should have said I tried this; this does not work.

author: Wallace Gasiewicz
author_rank: Super Contributor
timestamp: March 30, 2019, 01:30:18 pm
content: I just did an apparently successful upgrade to 6.25.However, I cannot do the time/frequency patchThere is no egServer file nor any elgato that I can find anywhere.[root@Linux /root]$cd /flash goes to [root@Linux /flash]$cd /egServer : No such file or directoryAny suggestions?Wally

author: Wallace Gasiewicz
author_rank: Super Contributor
timestamp: March 30, 2019, 06:39:25 pm
content: OK I did copy Telnet copy elgato to my computer, Linux is new to me, taking a while to comprehend.However the binary (HEX) address 0x0122880: does not look like 4b2585e2152882e2 in the very least. I am using Frhed. I replaced it with de2585e23f2882e2 anyway and the e7495 boot stopped at the copywrite screen.Had to reinstall 6.25 from PCMCIA. e7405 works fine . Yellow triangle still present. Date is 2004Why is my code different?UPDATEI did update to 6.25I got several copies of the zip all were 23104 KBunzipped,put on PCMCIA CardRebooted the e7495 with the cardSeemed to work fine,Copied elgatomy copy is 5224025 bytesanother person on this site quoted his file was 5195908 byesObviously I cannot do the time/freq patch since I cannot find the correct hex to modifyupgrade files on the PCMCIA are:xImage version reloadFFS ramdisk.gzand folders upgrade and firmware_upgradewhat am I doing that is wrong???what am I missing???

author: ddcc
author_rank: Regular Contributor
timestamp: March 30, 2019, 09:49:46 pm
content: Quote from: technogeeky on March 27, 2019, 04:10:46 amHere's the base image.Quote from: technogeeky on March 27, 2019, 04:10:46 amAttached are some more images. The gasket seems to just be a separate layer of metal foil that is sandwiched between the PCB and the metal enclosure; I lined it up with the metal walls as shown in the photo.

author: ddcc
author_rank: Regular Contributor
timestamp: March 30, 2019, 09:57:12 pm
content: I plan to do a writeup with some more photos once (if) I manage to fix this receiver. The odd part about this problem is that the loss measurements are consistently too high, and they don't seem to be affected by whatever is connected to the source port. Today, I had a 10db attenuator connected, so I'd expect around 20db of return loss, but the measurements hit -10db!The generator definitely seems to be working though, when set to a frequency sweep for 1.5 GHz to 1.5001 GHz return loss measurements, I see the correct signal at the coupled port. I also see some weird reflections at the transmitted port, I'm not sure if this is normal? But I don't think the problem is with any of the switches, because I see the signal all the way back on the analyzer input path (although the signal is radiating enough that I can see it without even probing the board), and because I'd expect the measurements to be super low if the switches failed, since there'd probably still be a bit of parasitic coupling? I'm wondering now if the rework performed on my unit might have something to do with this problem.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: April 01, 2019, 12:14:55 pm
content: Quote from: Wallace Gasiewicz on March 30, 2019, 06:39:25 pmIt was definitely LF -> CR-LF converted. FTP transfer in text mode I guess. Switch FTP to binary mode.

author: darnelld
author_rank: Newbie
timestamp: April 01, 2019, 03:52:10 pm
content: Quote from: darnelld on March 29, 2019, 09:51:33 pmunfortunately after a clean install and upgrade to 6.25, I am still having the same issues. I am typing (See me image)supassword: wh1skers

author: TK
author_rank: Super Contributor
timestamp: April 01, 2019, 03:59:08 pm
content: Quote from: darnelld on April 01, 2019, 03:52:10 pmIsn't it "root" instead of "su" ?

author: darnelld
author_rank: Newbie
timestamp: April 01, 2019, 04:04:52 pm
content: Quote from: TK on April 01, 2019, 03:59:08 pmI think they are the same.. unless I should use the tinylogin?

author: ogden
author_rank: Super Contributor
timestamp: April 01, 2019, 04:08:27 pm
content: Quote from: TK on April 01, 2019, 03:59:08 pmSure. Username is "root". Su is *command* which w/o arguments defaults to username "root".http://man7.org/linux/man-pages/man1/su.1.html

author: TK
author_rank: Super Contributor
timestamp: April 01, 2019, 04:53:17 pm
content: Sorry, I didn't see the tinylogin part.

author: darnelld
author_rank: Newbie
timestamp: April 01, 2019, 09:18:56 pm
content: Quote from: darnelld on April 01, 2019, 04:04:52 pmDid another clean install and I am in! Now only if I can find how to save data remotely onto my CF card

author: ogden
author_rank: Super Contributor
timestamp: April 01, 2019, 09:55:09 pm
content: Quote from: darnelld on April 01, 2019, 09:18:56 pmEverything you need to know about CF is in thisthread.in short: 1) format CF using E7495 GUI (fat32) 2) save spectrum image to CF - then it is automagically mounted as /mnt (if I remember it right) 3) copy files to/from /mnt (thus CF) as you wish

author: Wallace Gasiewicz
author_rank: Super Contributor
timestamp: April 02, 2019, 05:30:53 pm
content: I thought I should provide some conclusion to my problem.I finally solved the time/freq problemMany thanks to all of you especially Technogeeky and KirillKaI put the de2585e23f2882e2 code into the full625 on the PCMCIA card and booted the e7495I have a nice green light and can do the time base adjustment.I suppose the new Full625 (with the time/freq change) that I now have may be helpful to some of you.If anyone wants it I believe I can supply it.I can supply particulars as to the specific file and location if anyone is interested and want to modify the file themselvesI put the file on Groups.io HP Agilent Keysight Equipment GroupGo to the group and Search for e7495, easier to find post this wayZipped file is an attachment to my last postWally

author: darnelld
author_rank: Newbie
timestamp: April 04, 2019, 08:05:15 pm
content: Quote from: kirill_ka on January 11, 2017, 10:49:17 amI have read through this thread a few times... I am looking to be able to send scpi commands to save the spec an trace...a LOT of traces (18*36) for a single TRP measurement. This entry says that it repsponds to SCPI and looks healthy, but I haven't seen anyone comment further. If this is the case, any specifics (other than the 6 stop process below) on how to get it done over TCP/IP. This is the only function I am using the device for, so any other suggestions are welcome if SCPI over TCP/IP doesn't work! ...Either that or I am going to have some very sore fingers from typing in those file names...

author: kirill_ka
author_rank: Frequent Contributor
timestamp: April 05, 2019, 09:15:40 am
content: Quote from: darnelld on April 04, 2019, 08:05:15 pmThat was an attempt to run N1996A software on E7495A. The linux part mostly works but I couldn't get anything useful out of it, because it was not able to properly start the spectrum analyser task inside the RF board. The RF board seem to use the Analog Devices' SHARC DSP which is unknown beast to me. If someone could reverse engineer the DSP code, it would definitely take E7495A hacking to the next level.

author: HandBuilt
author_rank: Newbie
timestamp: April 11, 2019, 06:14:10 pm
content: Hello all,Thanks for all the info and help on this great unit.Well I found out fixing the gasket creep on the screen is an easy fix! Took the front key panel off, removed a ton of small screws to get to the back of the LCD. More screws to get the bezel removed and out came the LCD display.The plastic panel on the front is 170mmx225mm / 6.7"x 8.85" X.065" 1.7mm thick lexan.They attached it to the LCD with a rectangular stamped double side black tape or gasket. it pulls in with age and heat I'd guess.I ordered some precut 1/16 lexan from Ebay and reattached it with clear 3M tape.Its perfect now!Cheers

author: ddcc
author_rank: Regular Contributor
timestamp: April 23, 2019, 06:40:29 am
content: I made some more measurements on my E7495A, but unfortunately nothing on the one-port RF path appears to be obviously broken. Since this thread is getting a little long, I've made a separatepost.

author: jujun
author_rank: Regular Contributor
timestamp: November 09, 2019, 11:08:28 pm
content: Hello,Is there a way to allow measurements (S11 and S21) under 375Mhz ?It seems that nobody reported a working hack.Thank you

author: 9aplus
author_rank: Regular Contributor
timestamp: November 10, 2019, 10:50:20 pm
content: Here doing that in old fashion (no hack & Max Hold on) way... with external RLB (S21) and signal generators (S21/S11).RLB Eagle N5A 5-3000 MHzSigGen ERASynth or MorFeus

author: ogden
author_rank: Super Contributor
timestamp: November 10, 2019, 10:56:58 pm
content: Quote from: jujun on November 09, 2019, 11:08:28 pmSuch hack is impossible because hardware of the signal source is limiting factor here.

author: jujun
author_rank: Regular Contributor
timestamp: November 13, 2019, 10:42:22 am
content: Well, it's still a very useful toolIf somebody in Europe owns an optional signal generator assembly and wants to sell it, PM me.thank you

author: jordi
author_rank: Contributor
timestamp: July 05, 2020, 10:47:38 am
content: I'm very impressed with the worldwide collaboration here, thanks for the hard work. I got my hands on an "E7495B", but on arrival, I noticed the front label said "L4600A". I turned it on and it has a lot of the basic functions of the "E7495B", after some digging I find out that this unit is the military version (and has some tools to test their FM COM radios). The only item missing is the Power Meter, and I would like to know if I can activate it (and maybe apply the GPS patch). I'm happy to dump the entire flash here, as soon as my CF arrives. I'm attaching the technical overview of the L4600A and my version of my binary file of "elgato", which is different, my version seems to be newer? A07.24 Dev 6. All the offsets to apply the patches that are described here have different data. =(I wonder what they used to figure out the patching locations, IDA Pro?

author: PA0PBZ
author_rank: Super Contributor
timestamp: July 05, 2020, 11:04:29 am
content: Hi jordi,It looks like the offset you are looking for in your elgato file is 0x0033E57C, replace 01 00 00 EA with 00 00 A0 E1. No warranties whatsoever but let us know if it worked.And yes, IDA

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 05, 2020, 11:57:05 am
content: Quote from: jordi on July 05, 2020, 10:47:38 amThe power meter feature requires at least 2 physical boards and 2 connectors (power reference and sensor). Do you have them?Quote from: jordi on July 05, 2020, 10:47:38 amPlease, do so. L4600A seems to have some useful signal generator features. It's likely that they can be used on the E7495.Quote from: jordi on July 05, 2020, 10:47:38 amIn my case (GPS patch) I don't remember actuallyMaybe just objdump -d or gdb running on the device or IDA...

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 05, 2020, 12:12:26 pm
content: Quote from: jordi on July 05, 2020, 10:47:38 amCode:$ bgrep "4b 25 85 e2 15 28 82 e2 f6 2d 82 e2" elgatoelgato: 00123c4c^^^^^^^^So this should be the offset for the GPS patch.

author: jordi
author_rank: Contributor
timestamp: July 06, 2020, 01:11:10 am
content: I wanted to take the credit but you guys are faster! I did use my HEX editor, search for the strings, and reached the same offsets:0x033E57C for .lic trick.. and0x0123C4C...to fix the GPS. I will report my results.Thanks a lot!

author: jordi
author_rank: Contributor
timestamp: July 06, 2020, 04:00:17 am
content: So I went ahead and applied the patches. Seems like the modules are now activated, so I can confirm it works.I went "options spree" and activated everything I could (check the picture attached). Power Meter -Option 600- hangs the device during boot, so I went and dig a little and find out I need am extra hardware module, it can be installed tough (I saw a few on eBay).The GPS fix seems to work (at least it didn't crash or hang the device). But I'm not sure how to test it. If I go to and try to do the time base adjustment, it won't allow me (I press start and it doesn't do anything), maybe I need to have a GPS fix before activating?So I noticed a lot of people here had some Linux difficulties, so whoever is trying to patch the elgato in the future, in either device version please read this:I did run into a problem when I was updating elgato via FTP (which as curiosity detail it means "The Cat" in Spanish, I assume the guy is obsessed with cats, hint: check at the password), somehow after rebooting it will get stuck on the Disclaimer section (I got a little white). I was lucky to spot during the boot sequence the words "not enough access privileges elgato" So I typed on my telnet terminal "ls -l" and I noticed the Linux permissions were not set correctly:-rw-r--r--1 root root 5224820 May 31 20:12 elgato <------Patched-rwxr-xr-x1 root root 5224820 May 27 14:35 elgato.original <------Original backupI easily fixed it by giving the same file permissions and allow for execution, so type this from the same folder the elgato file is located (via telnet):chmod u+rwx elgatochmod go+rx elgatoor all at once (I didn't try it):chmod 755 elgatoIf anyone wants to learn more about permissions please go herehttps://www.pluralsight.com/blog/it-ops/linux-file-permissionsThen I reboot and problem solved.

author: jordi
author_rank: Contributor
timestamp: July 06, 2020, 04:19:50 am
content: kirill_ka:No, I don't have the two boards and the 2 connectors. I wonder if the boards can be replicated? Not sure about the connectors, maybe eBay them.Yes, I can confirm after activation (290) it has now the option to generate a custom waveform, you must create such files on MatLab put them on the CF and run them. No further details, we need to figure it out. If you send me a waveform I can try to run it.I will try to record some video next week of the menu and GUI, but the "military suite" has an interesting automated tool that can be customized, saved, and loaded them from your external memory (and share them). You select a set of frequencies, Gain, and tolerances and it will tell you if it passes or not. It would be very useful for manufacturing testing or if you happen to test the same devices over and over or you want to let somebody else do it and you have time for advanced training.Still waiting for my CF to arrive, <2GB cards are not very common anymore and are overpriced. But if you know a trick to just dump the entire "hard drive" via FTP, so I don't do it one by one, please let me know.

author: DogP
author_rank: Regular Contributor
timestamp: July 06, 2020, 06:04:18 am
content: That's really cool! The part that's most intriguing to me is option 520 (Low Frequency Extension for Source). While the E7495 stock sig gen does 375 MHz - 2.5 GHz, it looks like the stock L4600A does 30 MHz - 1 GHz, with options to extend down to 2 MHz and up to 2.5 GHz. So, if the hardware is actually the same, I guess that means the E7495 can support sig gen down to 2 MHz w/ the L4600A software.BTW, regarding custom waveforms... I posted this:https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg1054142/#msg1054142andhttps://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg1054570/?topicseen#msg1054570for making custom waveforms to replace the existing ones. I'd suspect that the option 290 uses the same arbitrary waveform format (16-bit I/Q), but allows the file to be specified rather than having to replace built-in files (curious what the size limitations are though). As I mentioned in one of those posts though... the arbitrary waveform generator doesn't suppress the LO or image, so its usefulness is somewhat limited.DogP

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 06, 2020, 07:35:53 am
content: Quote from: jordi on July 06, 2020, 04:19:50 amAre you sure you are desperate enough? It may be well cheaper and easier just to buy a standalone power meter.I used the measurement board from my E7495 to populate a second channel in a E4418 power meter.The board from E7495 has it's own power reference while the E4418 doesn't have the power reference on the measurement board.That's the only difference I see.The remaining hw stuff you might be missing:1. Power reference connector.2. Sensor connector.3. Power meter interface board.4. Sensor cable.5. The sensor itself.6. Ribbon cables.Plus you need to connect all the stuff and enable the option correctly.If you still want to go this route, I can afford you some parts I have leftover.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 06, 2020, 10:45:29 am
content: Quote from: jordi on July 06, 2020, 04:19:50 amI think I have 4GB card in my E7495 (can't check it now). Maybe you can use a smaller partition on a bigger card.Quote from: jordi on July 06, 2020, 04:19:50 amThere are some advanced FTP clients such as lftp or Filezilla. Possibly you need to do some tricks to allow FTP to access the whole filesystem.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 06, 2020, 11:26:28 am
content: Quote from: jordi on July 06, 2020, 04:00:17 amDo you have a GPS antenna connector (as pictured in the datasheet)? If not, you might be missing a receiver module.No, the fix is not required. You should be able to set GPS as a frequency reference. When it's locked (needs an external antenna), you should see a green circle and time/date synchronized with the GPS.I've extracted and comapred strings from E7495 and L4600A versions of the elgato.The following looks like new options appeared on the L4600A:FM Analyzer & Signal GeneratorLow Frequency Extension for SourcePCMCIA IQ Modulation for Signal GeneratorGPS ReceiverFM Audio Output Connector

author: jordi
author_rank: Contributor
timestamp: July 06, 2020, 11:26:06 pm
content: Quote from: DogP on July 06, 2020, 06:04:18 amVery, very cool, I will give it a look on my next weekend. Thanks for sharing!

author: jordi
author_rank: Contributor
timestamp: July 06, 2020, 11:31:15 pm
content: Quote from: kirill_ka on July 06, 2020, 07:35:53 amNo, you are right, I don't even have the internal hardware. I purchased another E7495B which has the port, maybe I will fool with it a little. PM the stuff you have.I need an accurate power meter to calibrate my radios at ISM bands between 1Watts to 1.5Watts.

author: jordi
author_rank: Contributor
timestamp: July 06, 2020, 11:38:55 pm
content: Quote from: kirill_ka on July 06, 2020, 11:26:28 amNiet, I'm ordering an active antenna, the one I have here uses 3.3V, intended for an uBlox module. I might have blown it, the E7595 GPS SMA port is outputting 5V (bias). I will report on that.Whoever, on the bottom left of the main screen I see "GPS Unlocked", and on the bottom right of the main screen is a green dot with "Int Ref" label. So even without fixing any sats, it is capable to grab the clocks? Interesting.Thanks!

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 07, 2020, 07:06:09 am
content: Quote from: jordi on July 06, 2020, 11:38:55 pmInt Ref means the internal TXCO. Unfortunately I can't provide you with screenshots this time.Anyway, you need to get the GPS receiver locked first. Take a look into the "Displaying Location Information Using GPS" section of the "E7495A/B Measurement Guide".

author: jordi
author_rank: Contributor
timestamp: July 07, 2020, 08:25:11 am
content: Quote from: kirill_ka on July 07, 2020, 07:06:09 amI got GPS fix! Unfortunately, it won't let me do the time base adjustment, I press the button and it will not allow me to continue, it doesn't say anything. I restored the elgato, but resulted in the same issue. The seller gave me the option to exchange it for a real "E7495B", I will probably do so (after I dump the drive).

author: DogP
author_rank: Regular Contributor
timestamp: July 07, 2020, 09:38:15 am
content: Quote from: jordi on July 07, 2020, 08:25:11 amI wouldn't exchange it! It seems like the L4600A is a better unit all around (better freq. range, better options, etc)... unless you can confirm that the L4600A software will truly turn the E7495 into an L4600A.DogP

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 07, 2020, 10:05:19 am
content: Quote from: jordi on July 07, 2020, 08:25:11 amMaybe you need to set clock reference to the GPS before you do the adjustment.L4600A seems to be a newer hardware, I wouldn't exchange it too.It looks like they at least fixed very fragile PCB RF connections:https://www.ebay.com/itm/Agilent-L4600A-Board-Assembly-ATO-70067-Sr-no-US48120110-AS-IS-Untested/124245776467

author: jordi
author_rank: Contributor
timestamp: July 07, 2020, 07:51:57 pm
content: All right I will keep it then, thanks for the advice. My CF arrived, but I'm having problems copying some of the files, a few of them I can't even copy to Windows because the name is supposedly very long, but they are not (I will switch to Linux).Also, it was funny to copy mnt into mnt, I didn't catch the loop.With that said, what are the most important folders that should focus to rescue? Besides the flash folder of course. I already got out the easy ones: bin, etc, and home folder.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 07, 2020, 08:55:44 pm
content: Approach 1:It seems that the firmware contains gnu tar (maybe it's located in elgato/utils).You can check what filesystems you have with "mount"or "cat /proc/mounts"Then dump them individually withtar --one-file-system cvfz /mnt/fs1.tgz /fs1_mount_pointWhere /fs1_mount_point is the mount point you see in the list of mounts above.Skip virtual and temporary filesystems such as /proc.Approach 2:cp /dev/mtdsomething /mnt/mtdsomething.rawThis way you can get a raw flash images (of individual flash partitions or the whole flash chip).The device names (mtdsomething) you can get from the list of mounts as described above.I suggest you do both, because the latter approach is good for backup and replication.The former one gets the files easily accessible.I can give you the exact commands in a week or so when I return to home.Or just PM me the output ofcat /proc/mtdcat /proc/mountstar --versiongzip --versionls -lR /dmesgRedirect command outputs to files with "> filename"

author: jordi
author_rank: Contributor
timestamp: July 07, 2020, 10:30:40 pm
content: Here is the L4600A dump.https://j07m.s3-us-west-1.amazonaws.com/Public/L4600A_dump.zipIf you see something else interesting please let me know.Now, I would like to know why the Time Based Calibration doesn't work. =(

author: jordi
author_rank: Contributor
timestamp: July 07, 2020, 10:38:27 pm
content: Yes, the second approach is the good one, I will try it. Here are my outputs:Code:[root@Linux /root]$cat /proc/mtddev: size erasesize namemtd0: 04000000 00040000 "Physically mapped flash"mtd1: 00100000 00040000 "zImage"mtd2: 00300000 00040000 "ramdisk.gz"mtd3: 03c00000 00040000 "User FS"[root@Linux /root]$cat /proc/mountsrootfs / rootfs rw 0 0/dev/root / ext2 rw 0 0/proc /proc proc rw 0 0none /dev/pts devpts rw 0 0/dev/mtdb3 /flash jffs2 rw 0 0[root@Linux /root]$tar --versiontar: unrecognized option `--version'BusyBox v0.60.3 (2002.06.05-19:04+0000) multi-call binaryUsage: tar - [--exclude FILE] [-X FILE][-f TARFILE] [-C DIR] [FILE(s)] ...Create, extract, or list files from a tar file.Options:c createx extractt listFile selection:f name of TARFILE or "-" for stdinO extract to stdoutexclude file to excludeX file with names to excludeC change to directory DIR before operationv verbosely list files processed[root@Linux /root]$gzip --version gzip: invalid option -- -BusyBox v0.60.3 (2002.06.05-19:04+0000) multi-call binaryUsage: gzip ... FILECompress FILE with maximum compression.When FILE is '-', reads standard input. Implies -c.Options:-c Write output to standard output instead of FILE.gz-d decompress[root@Linux /root]$ls IR /ls: IR: No such file or directory/:bin etc home linuxrc mnt proc root tmp vardev flash lib lost+found nfs rd sbin usr xdrive[root@Linux /root]$dmesg360K data, 88K init)Dentry cache hash table entries: 8192 (order: 4, 65536 bytes)Inode cache hash table entries: 4096 (order: 3, 32768 bytes)Mount-cache hash table entries: 1024 (order: 1, 8192 bytes)Buffer-cache hash table entries: 4096 (order: 2, 16384 bytes)Page-cache hash table entries: 16384 (order: 4, 65536 bytes)POSIX conformance testing by UNIFIXLinux NET4.0 for Linux 2.4Based upon Swansea University Computer Society NET3.039Initializing RT netlink socketsa1111_pcibuf: initializing SA-1111 DMA workaroundSA1111 Microprocessor Companion Chip: silicon revision 1, metal revision 1Starting kswapdJFFS version 1.0, (C) 1999, 2000 Axis Communications ABJFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.ttyS0 at I/O 0xf0100000 (irq = 50) is a 16550AttyS1 at I/O 0xf0120000 (irq = 51) is a 16550AttyS2 at I/O 0xf0140000 (irq = 52) is a 16550AttyS3 at I/O 0xf0160000 (irq = 54) is a 16550AttySA0 at MEM 0x80050000 (irq = 17) is a SA1100ttySA1 at MEM 0x80010000 (irq = 15) is a SA1100ttySA2 at MEM 0x80030000 (irq = 16) is a SA1100Console: switching to colour frame buffer device 80x30initialize_kbd: Keyboard reset failed, no ACKKeyboard timed outkeyboard: Timeout - AT keyboard not present?Keyboard timed outkeyboard: Timeout - AT keyboard not present?pty: 256 Unix98 ptys configuredUCB1200 generic module installeducb1200 touch screen driver initializeducb1200 adc driver initializedUCB1200 audio driver version 2.2 initializedUCB1200 audio driver Click-Avoid patch: TT <tthaele@papenmeier.de>UCB1200 Mixer driver version 0.1 initialized. TT <tthaele@papenmeier.de>smartio driver initialized. version 1.10, date:28-Jun-2002SmartIO ID : 0x5002Device Version : 5(0x35)Device Type : 0x8535SA1100 Real Time Clock driver v1.00Uniform Multi-Platform E-IDE driver Revision: 6.31ide: Assuming 50MHz system bus speed for PIO modes; override with idebus=xxsmc9194.c:v0.14 12/15/00 by Erik Stahlman (erik@vt.edu)eth0: SMC91C96(r:9) at 0xf00e0000 IRQ:58 INTF:TP MEM:6144b ADDR: 00:60:0c:01:37:05RAMDISK driver initialized: 16 RAM disks of 8192K size 1024 blocksizeloop: loaded (max 8 devices)PPP generic driver version 2.4.2Sound: SA1111 UDA1341: dsp id 3 mixer id 0SA1111 audio out: SA-1111 SAC DMA channel 6 in useDMA request for SAC output failedphysmap flash device: 4000000 at 8000000Physically mapped flash: Found 2 x16 devices at 0x2000000 in 32-bit mode0: offset=0x0,size=0x40000,blocks=1281: offset=0x2000000,size=0x40000,blocks=128Using buffer write methodSA1100 flash: probing 32-bit flash busSA1100 flash: Found 2 x16 devices at 0x2000000 in 32-bit mode0: offset=0x0,size=0x40000,blocks=1281: offset=0x2000000,size=0x40000,blocks=128Using buffer write methodUsing static partition definitionCreating 3 MTD partitions on "SA1100 flash":0x00000000-0x00100000 : "zImage"0x00100000-0x00400000 : "ramdisk.gz"0x00400000-0x04000000 : "User FS"Linux Kernel Card Services 3.1.22options: SA-1100 PCMCIA (CS release 3.1.22)usb.c: registered new driver usbdevfsusb.c: registered new driver hubhcd/ohci-sa1111.c: starting SA-1111 OHCI USB Controllerhcd/ohci-sa1111.c: ohci-hcd (SA-1111) at 0xf4000400, irq 109usb.c: new USB bus registered, assigned bus number 1hub.c: USB hub foundhub.c: 1 port detectedusb.c: registered new driver hiddevusb.c: registered new driver hidhid-core.c: v1.8.1 Andreas Gal, Vojtech Pavlik <vojtech@suse.cz>hid-core.c: USB HID support driversmice: PS/2 mouse device common for all miceNET4: Linux TCP/IP 1.0 for NET4.0IP Protocols: ICMP, UDP, TCPIP: routing cache hash table of 512 buckets, 4KbytesTCP: Hash tables configured (established 4096 bind 4096)NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.NetWinder Floating Point Emulator V0.95 (c) 1998-1999 Rebel.comRAMDISK: Compressed image found at block 0Freeing initrd memory: 3072KEXT2-fs warning: checktime reached, running e2fsck is recommendedVFS: Mounted root (ext2 filesystem).Freeing init memory: 88Khub.c: USB new device connect on bus1/1, assigned device number 2hub.c: USB hub foundhub.c: 4 ports detectedenable_irq(115) unbalanced from c032558cTrying to free nonexistent resource <ce8b7000-ce8b700f>hda: CF Card, ATA DISK driveide0 at 0xce8b7000-0xce8b7007,0xce8b700e on irq 115hda: task_no_data_intr: status=0x51 { DriveReady SeekComplete Error }hda: task_no_data_intr: error=0x04 { DriveStatusError }hda: 3902976 sectors (1998 MB) w/1KiB Cache, CHS=242/255/63Partition check:hda: hda1ide_cs: hda: Vcc = 3.3, Vpp = 0.0VFS: Can't find ext2 filesystem on dev ide0(3,1).cramfs: wrong magicVFS: Can't find ext2 filesystem on dev ide0(3,1).cramfs: wrong magicAVR driver initialized. version 1.1, date:Aug 6 2004VFS: Can't find ext2 filesystem on dev ide0(3,0).cramfs: wrong magicFAT: bogus logical sector size 64543VFS: Can't find a valid FAT filesystem on dev 03:00.JFFS: Trying to mount a non-mtd device.jffs2: attempt to mount non-MTD device 03:00VFS: Can't find ext2 filesystem on dev ide0(3,1).cramfs: wrong magic

author: jordi
author_rank: Contributor
timestamp: July 07, 2020, 11:08:27 pm
content: I used DD, not sure if it will work:Code:[root@Linux /]$dd if=/dev/mtdb3 of=/mnt/mtdb3.img bs=321966080+0 records in1966080+0 records out[root@Linux /]$ls -l /mnt-rwxr-xr-x 1 root root 62914560 Jul 7 23:06 mtdb3.img-rwxr-xr-x 1 root root 157280 Jul 7 22:54 printScreen.png

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 08, 2020, 07:16:23 am
content: Quote from: jordi on July 07, 2020, 11:08:27 pmThanks for the dump!Yes, dd suites better for the task. I thought there's no dd there.03c00000 = 62914560 so the size of mtdb3.img is correct.It would be a good idea to dump the whole flash (mtd0) so you have a whole image if something goes wrong (and, please, share it too).You may want to set bs=1024 or something so it would go faster.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 08, 2020, 07:21:08 am
content: QuoteIt's a crippled busybox version.Gnu tar is at /flash/elgato/utils/tar

author: jordi
author_rank: Contributor
timestamp: July 10, 2020, 12:18:27 am
content: Do you think it got corrupted after the transfer? I can dump it again for you or just go straight for the raw dump.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 10, 2020, 02:15:12 pm
content: Quote from: jordi on July 10, 2020, 12:18:27 amNo, I think all the needed files are copied ok. A bit of inconvenience is that unix permissions are not saved. But if you do a raw flash dump I should be able to extract them.I noted the version of tar as the backup procedure I described as "Approach 1" requires GNU tar.

author: jordi
author_rank: Contributor
timestamp: July 11, 2020, 07:21:11 pm
content: kirill_ka,Here is the image generated with the DD command from above:https://j07m.s3-us-west-1.amazonaws.com/Public/mtdb3.img

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 11, 2020, 08:49:38 pm
content: For the very unlikely case someone wants to reverse engineer DSP code for the E7495,I want to share my findings about the format of DSP .bin files.The DSP is Analog Devices SHARC 21160M.egServer/Dragonfly/Measurements/UserCode/*.binlength of blob1 (32bit, LE)blob1 (SHARC code)length of blob2 (32bit, LE)blob2 (unknown)length of blob3 (32bit, LE)blob3 (unknown)blob4 (unknown)egServer/Dragonfly/Firmware/E7495A/run.binegServer/Dragonfly/Firmware/E7495A/setu.binegServer/Dragonfly/Firmware/CPXSRC/run.binegServer/Dragonfly/Firmware/CPXSRC/setu.bin12 byte header or some setup codeflash imageThe flash image starts from SHARC code in a weird byte order.I used unidasm utility from the MAME project to look at the SHARC assembly.The unidasm doesn't get all the opcodes from 21160M right, but most of the code looks ok.I'm attaching Tcl script I use to prepare code for unidasm.Here's how to call it for Firmware:Code:./reord.tcl 12 12 '2 3 0 1 6 7 p p 4 5 10 11 8 9 p p' run.bin tmp.bin./unidasm -arch sharc tmp.binAnd for UserCode:Code:./reord.tcl 4 6 '5 4 3 2 1 0 p p' demod.bin tmp.bin./unidasm -arch sharc tmp.binbloblist.tcl is for splitting UserCode files.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 11, 2020, 09:27:34 pm
content: Quote from: jordi on July 11, 2020, 07:21:11 pmThank you very much! The image is good.Could you dump mtdb0 as well?

author: jordi
author_rank: Contributor
timestamp: July 11, 2020, 10:19:13 pm
content: QuoteSure, I have it in my office. I'll try on Monday.May I ask you, do you know where the piece of code to do the GPS timebase calibration lives? I got a real E7495B and the calibration option works fine. Seems like the files might be corrupted or missing on my L4600A.Warmly

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 12, 2020, 07:19:50 am
content: Quote from: jordi on July 11, 2020, 10:19:13 pmIt won't be localized in one particular place. It should start from GUI then elgato executable and then downstream to the hardware. I think it's a good idea to check the clock externally (what goes on if you change the reference). It may be well possible that the L4600A does the adjustment automatically.If the code from L4600 runs on my E7495A, I'd check what happens to the time adjustment function.

author: jordi
author_rank: Contributor
timestamp: July 13, 2020, 08:38:51 pm
content: Quotehttps://j07m.s3-us-west-1.amazonaws.com/Public/mtdb1.imghttps://j07m.s3-us-west-1.amazonaws.com/Public/mtdb2.imgI thought I dumped all of them, but I realize mtdb0 is missing, I need to take the machine back home. Hope mtdb1 and 2 might also be useful.Warmly,

author: jordi
author_rank: Contributor
timestamp: July 14, 2020, 06:56:05 pm
content: Code:[root@Linux /dev]$dd if=/dev/mtdb0 of=mtdb0.img bs=1024dd: /dev/mtdb0: No such deviceIt didn't allow me.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: July 17, 2020, 03:35:22 pm
content: Quote from: jordi on July 14, 2020, 06:56:05 pmThanks, it should be just a concatenation of other three images. It's not needed as you posted the other ones.Now I played with the L4600 software for some time.Good things:* It does run on the E7495* FM modulation is working.* User-defined modulation files should work (I haven't tried it yet).* FM analyzer is working.* Source Level adjustment in the "Two port insertion loss" mode adjusts the amplitude smoothly above -25dBm.Bad things:* The calibration is off.* The generator is not working below 375MHz.* GPS can't be used as a frequency reference (it's not even listed). I think it's the same problem jordi has on the L4600A.

author: eplpwr
author_rank: Regular Contributor
timestamp: September 04, 2020, 12:23:20 pm
content: Quote from: kirill_ka on November 22, 2018, 07:37:49 pmI have an E7495B that refuses to work on batteries. I bought brand new batteries - 2 pcs Inspired Energy, type NI2040ED29 - from accutronics.co.uk . (The batteries were more expensive than the E7495B.)When running on external power, everything works fine; the batteries are identified and charged - the battery information screen looks just fine with charging status and voltages correctly presented. The problem is, when booting up on battery power it passes the initial BIOS screens and then just powers off itself. Any information on how/where to rectify this would be most welcome.Best regards,eplpwr

author: kirill_ka
author_rank: Frequent Contributor
timestamp: September 04, 2020, 01:31:35 pm
content: Quote from: eplpwr on September 04, 2020, 12:23:20 pmYes, the symptoms are very similar to what I have seen. However that's not enough to be sure.Do you see any glitches while charging? For example, something's like incorrect charge % or battery leds change unexpectedly.What happens to the leds while booting on battery?

author: m6sso
author_rank: Newbie
timestamp: September 12, 2020, 10:52:08 pm
content: Hello all,Im pretty new to Linux hacking and i have a Agilent E7495A that i am trying to do the licence hack on. Is there a pre-made file with all options enabled. Currently I have these options installed200-cdmaOne/CDMA 2000 Analyzer210 cdmaOne/CDMA 200 Over air test220 Channel scanner510 CW & Complex modulation signal Generator600 Power Meter700 T1 analyserI have pulled off the Elgato file from egServer.hope someone can help.TIA

author: jordi
author_rank: Contributor
timestamp: September 14, 2020, 03:30:58 am
content: Quote from: m6sso on September 12, 2020, 10:52:08 pmHello Tia,No, I don't think there is a premade file (we all had to mod ours). If you upload it, we can verify if is correct. When el gato is modified correctly (and installed), you must manually add the licenses by modifying the other file (forgot the name).

author: m6sso
author_rank: Newbie
timestamp: September 14, 2020, 01:45:40 pm
content: Quote from: jordi on September 14, 2020, 03:30:58 amI've uploaded the original .lic file, the modded version i made and the current version of elgato that is installed on the device. They are inside the zip file.all files are untouched apart from the modded .lic file.

author: m6sso
author_rank: Newbie
timestamp: September 14, 2020, 05:18:36 pm
content: Just though I'd add this for you lot if you dont have the calibration kit (50Ohm open, Load and short) there is a cheap set on flebay that works great.https://www.ebay.com/itm/3pcs-DC-3GHz-Network-Analyzer-Sitemaster-Calibrator-OPEN-SHORT-LOAD-N-Male-40db/274117305821?_trksid=p2485497.m4902.l9144

author: 9aplus
author_rank: Regular Contributor
timestamp: September 14, 2020, 08:06:24 pm
content: Quote from: tv84 on September 14, 2020, 03:01:20 pmCan try to do on 7495B in case you have no luck with A

author: kirill_ka
author_rank: Frequent Contributor
timestamp: September 15, 2020, 08:09:41 am
content: Quote from: tv84 on September 14, 2020, 03:01:20 pmI don't think it's that easy. /dev/mem is not the RAM representation. It gives access to a physicaladdress space. It's not contiguous and may not be safe to access. I think that "cp /dev/ram" would just fail.https://superuser.com/questions/71389/what-is-dev-memIf you're interested in one particular application (process), you would need acorefile.

author: tv84
author_rank: Super Contributor
timestamp: September 27, 2020, 08:04:44 am
content: For options you don't need to continue patching the "the cat" file.Here.

author: 9aplus
author_rank: Regular Contributor
timestamp: February 28, 2021, 10:46:45 pm
content: Hi Eric,following your progress, but no time to test on my unit.Usually using Anaren DBM to extend range up to 4 GHz by mixing

author: 9aplus
author_rank: Regular Contributor
timestamp: March 15, 2021, 06:36:15 am
content: Great work, congratulateAssuming you gained full functions as described:http://rltechnical.com/_sample_files/sample_indesign/L4600A_technical_overview.pdfExcept hardware option -> L4600A-530 5-pin Connector with FM Audio Demodulation Out (Voice Out)Top limit in document is still 2,7 GHz?Do you have now signal generator functionality from 2 MHz to 2,5 GHz ?In case of all answers are YES, just need one step by step instruction set for dummies to run up my E7495BRegardsDjani

author: 9aplus
author_rank: Regular Contributor
timestamp: March 17, 2021, 08:03:28 am
content: Looking from the side,the only real gain is that (for E7495B) additional FM modulation option?

author: TheSteve
author_rank: Unknown
timestamp: March 26, 2021, 07:33:11 pm
content: The big brother N1996A only required an edit of text based files to extend the gen frequency range. Is there a block diagram of the entire 7495 - that should show us if hardware is present to gen below 375 MHz.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: March 30, 2021, 08:10:07 pm
content: Hi Eric,I can imagine two ways to recover the DSP firmware.1) To dig into the bootstrap procedure for the SHARC. Maybe this can be done by reverse engineering the replaceTrashedRunCode. Also it might be possible to find some clues in the SHARC manuals.2) To recover the DSP flash directly. I'm pretty sure there should be a JTAG connector on the DSP board which can be used to access the flash.Here's the picture of the board:https://www.ebay.com/itm/Agilent-E7495-63015-E7495-20015-990075-101602-REV-103-Board-Assembly/284074186099I don't understand what you mean by "mounting" serial ports. "mount" is the term which is only used for filesystems.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: March 31, 2021, 10:59:15 am
content: Quote from: kirill_ka on March 30, 2021, 08:10:07 pmAh, right. The link above should be the "Complex source board". I was fooled because it also contains a similar ADSP processor. Note the similarities between the boards.If you are not fluent with reverse engineering linux/arm code, I think that your best bet is to identify the JTAG connector. Once you can extract the flash image, I might be able to help with recovery.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: April 01, 2021, 09:45:09 pm
content: Eric,Why ever you think that the logic analyser's giving you wrong numbers and 2403 should be read as 230400?I'd say it's pointless to assume that replaceTrashedRunCode /which is designed to run on different hardware of N1996A/ will magically recover your E7495.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: April 01, 2021, 10:17:31 pm
content: Quote from: Ericmax on April 01, 2021, 09:53:04 pmIn Russian this is called "searching at well lit placebut not the place where you've lost the thing"I don't know an English equivalent for the phrase.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: April 02, 2021, 08:27:17 am
content: Quote from: Ericmax on April 02, 2021, 03:06:28 amAs you restored the ARM board firmware, there's no reason to think that something's wrong with the configuration of the "CPU board".The serial port speed is normally set by an application to whatever it wants. So I assume that replaceTrashedRunCode does what it's supposed to do. It may be just incompatible.

author: kirill_ka
author_rank: Frequent Contributor
timestamp: April 03, 2021, 10:28:18 pm
content: Code:USAGE: replaceTrashedRunCode [-r <rev>]where: -r <rev> = revision to be replacedIf the help text doesn't lie, you need to specify the revisionto be replaced, but not the revision you are going to replace with.

author: pieroc91
author_rank: Contributor
timestamp: June 14, 2021, 11:14:18 pm
content: Amazing all you guys hacked on this thing... on my device i got stuck at the Copyright screen and does not respond to anything, i've updated the firmware, replaced the elgato binary modified licences and still can't pass that screen, had anyone came across this problem and might have a clue on how to fix it?Thanks!

author: kirill_ka
author_rank: Frequent Contributor
timestamp: June 15, 2021, 12:06:57 pm
content: Quote from: pieroc91 on June 14, 2021, 11:14:18 pmThe symptom is not specific. It's probably the "elgato" fails to initialize (possibly due to some hardware problem). Try to gather more information (messages, logs, diagnostic web pages* ). Despite the UI is not started the device still can be accessed through the Ethernet and console ports.* The ones you gеt by accessing the device via http.

author: pieroc91
author_rank: Contributor
timestamp: June 15, 2021, 01:54:37 pm
content: Hi @kirill_ka yes, i can access via telnet without a problem, the web interface is unstable for me, sometimes work, sometimes doesn't and when it works it does not log in.if i give it a ps aux i get thisCode:[root@Linux /root]$ps auxUSER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMANDroot 1 2.0 0.8 1384 544 ? S 14:40 0:07 initroot 2 0.0 0.0 0 0 ? SW 14:40 0:00 root 3 0.0 0.0 0 0 ? SWN 14:40 0:00 root 4 0.0 0.0 0 0 ? SW 14:40 0:00 root 5 0.0 0.0 0 0 ? SW 14:40 0:00 root 6 0.0 0.0 0 0 ? SW 14:40 0:00 root 7 0.0 0.0 0 0 ? SW 14:40 0:00 root 8 0.0 0.0 0 0 ? SW 14:40 0:00 root 40 0.0 0.0 0 0 ? SWN 14:40 0:00 root 54 0.0 1.1 1480 732 ? S 14:40 0:00 /sbin/cardmgr -froot 574 0.0 1.0 1568 648 ? S 14:40 0:00 dhcpcd -DH -t 10root 597 0.0 0.8 1680 544 ? S 14:40 0:00 syslogd -m 0bin 623 0.0 0.7 1456 444 ? S 14:40 0:00 root 653 0.0 1.0 1592 644 ? S 14:40 0:00 inetdroot 666 0.0 0.8 1704 544 ? S 14:40 0:00 /bin/sh /etc/rc.d/rc3.d/S51timeUpdate.sh startroot 667 0.0 1.2 1788 772 ? S 14:40 0:00 /bin/bash /flash/elgato/utils/keepTimeUpdatedroot 668 0.0 0.5 1672 336 ? S 14:40 0:00 sleep 1200root 697 0.0 0.7 1572 476 tty1 S 14:41 0:00 /sbin/getty 38400 tty1root 698 0.0 0.7 1572 484 ttyS/ttySA0 S 14:41 0:00 /sbin/getty -L ttyS0 38400 vt100root 699 0.0 1.2 1796 808 ? S 14:41 0:00 /bin/bash /root/catch_sleep.shroot 732 2.2 12.1 12060 7624 tty2 S 14:41 0:07 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jarroot 734 0.0 12.1 12060 7624 tty2 S 14:41 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jarroot 735 0.0 12.1 12060 7624 tty2 S 14:41 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jarroot 736 0.0 12.1 12060 7624 tty2 S 14:41 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jarroot 737 0.0 12.1 12060 7624 tty2 S 14:41 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jarroot 738 0.2 12.1 12060 7624 tty2 S 14:41 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jarroot 739 0.0 12.1 12060 7624 tty2 S 14:41 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jarroot 740 0.0 12.1 12060 7624 tty2 S 14:41 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jarroot 741 0.0 12.1 12060 7624 tty2 S 14:41 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jarroot 742 0.0 12.1 12060 7624 tty2 S 14:41 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jarroot 743 0.0 4.2 18604 2660 ? S 14:42 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 744 0.4 1.3 1956 848 ? S 14:46 0:00 in.telnetdroot 745 0.5 1.4 1816 928 pts/0 S 14:46 0:00 -bashroot 757 0.0 1.3 2712 852 pts/0 R 14:46 0:00 ps auxif a dmesg i cant get a clear error from the elgato serverCode:jffs2_scan_inode_node(): Data CRC failed on node at 0x032efdfc: Read 0xe6bf2df9, calculated 0xb90b73e0jffs2_scan_eraseblock(): Node at 0x032f0884 {0x1985, 0xe001, 0x00000b28) has invalid CRC 0xe5525c47 (calculated 0x63c62ee9)jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f0888: 0x0b28 insteadjffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f088c: 0x5c47 insteadjffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f0890: 0x02a9 insteadjffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f0894: 0x01c8 insteadjffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f0898: 0x8124 insteadjffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f08a0: 0x8000 insteadjffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f08a4: 0x22ff insteadjffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f08a8: 0x22ff insteadjffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f08ac: 0x22ff insteadFurther such events for this erase block will not be printedAVR driver initialized. version 1.1, date:Aug 6 2004elgato: unhandled page fault at pc=0x40136f9c, lr=0x02540590 (bad address=0x6765723b, code -1)pc : [<40136f9c>] lr : [<02540590>] Not taintedsp : beffe654 ip : 000003a0 fp : beffe6a4r10: 401e61a0 r9 : 00000170 r8 : 401e5498r7 : 0000004d r6 : 72747369 r5 : 6765722f r4 : 00000510r3 : 000003a1 r2 : 02540700 r1 : 401e56f8 r0 : 401e5700Flags: nzCv IRQs on FIQs on Mode USER_32 Segment userControl: C08A717F Table: C08A717F DAC: 00000015i'm running it almost barebones, without the A3 board on it.still with the A3 board on it the ps aux isCode:[root@Linux /root]$ps auxUSER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMANDroot 1 8.4 0.8 1384 544 ? S 14:40 0:07 initroot 2 0.0 0.0 0 0 ? SW 14:40 0:00 root 3 0.0 0.0 0 0 ? SWN 14:40 0:00 root 4 0.0 0.0 0 0 ? SW 14:40 0:00 root 5 0.0 0.0 0 0 ? SW 14:40 0:00 root 6 0.0 0.0 0 0 ? SW 14:40 0:00 root 7 0.0 0.0 0 0 ? SW 14:40 0:00 root 8 0.0 0.0 0 0 ? SW 14:40 0:00 root 40 0.0 0.0 0 0 ? SWN 14:40 0:00 root 54 0.0 1.1 1480 732 ? S 14:40 0:00 /sbin/cardmgr -froot 574 0.0 1.0 1568 644 ? S 14:40 0:00 dhcpcd -DH -t 10root 597 0.0 0.8 1680 544 ? S 14:40 0:00 syslogd -m 0bin 623 0.0 0.7 1456 444 ? S 14:40 0:00 root 653 0.0 1.0 1592 644 ? S 14:40 0:00 inetdroot 666 0.0 0.8 1704 544 ? S 14:40 0:00 /bin/sh /etc/rc.d/rc3.d/S51timeUpdate.sh startroot 667 0.0 1.2 1788 772 ? S 14:40 0:00 /bin/bash /flash/elgato/utils/keepTimeUpdatedroot 668 0.0 0.5 1672 336 ? S 14:40 0:00 sleep 1200root 688 2.8 4.2 15520 2636 ? S 14:40 0:01 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 697 0.0 0.7 1572 476 tty1 S 14:41 0:00 /sbin/getty 38400 tty1root 698 0.0 0.7 1572 484 ttyS/ttySA0 S 14:41 0:00 /sbin/getty -L ttyS0 38400 vt100root 699 0.0 1.2 1796 808 ? S 14:41 0:00 /bin/bash /root/catch_sleep.shroot 711 0.0 4.2 15520 2636 ? S 14:41 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 712 0.0 4.2 15520 2636 ? S 14:41 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 713 0.0 4.2 15520 2636 ? S 14:41 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 714 0.0 4.2 15520 2636 ? S 14:41 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 717 0.0 4.2 15520 2636 ? S 14:41 0:00 /flash/egServer/elgato -xaemon -o /dev/ttyS0 -e /dev/ttyS0root 732 17.5 11.6 11032 7328 tty2 S 14:41 0:07 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jarroot 734 0.0 11.6 11032 7328 tty2 S 14:41 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jarroot 735 0.0 11.6 11032 7328 tty2 S 14:41 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jarroot 736 0.0 11.6 11032 7328 tty2 S 14:41 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jarroot 737 0.1 11.6 11032 7328 tty2 S 14:41 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jarroot 738 2.6 11.6 11032 7328 tty2 S 14:41 0:01 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jarroot 739 0.0 11.6 11032 7328 tty2 S 14:41 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jarroot 740 0.0 11.6 11032 7328 tty2 S 14:41 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jarroot 741 0.0 11.6 11032 7332 tty2 S 14:41 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jarroot 742 0.0 11.6 11032 7332 tty2 S 14:41 0:00 /flash/siege/bin/_siege -Xmx23m -DlocalAddress=127.0.0.1 -Dserver=127.0.0.1 -DLogger.level=2 -jar egclient.jarroot 743 1.1 1.3 1956 856 ? S 14:41 0:00 in.telnetdroot 744 0.8 1.4 1816 928 pts/0 S 14:41 0:00 -bashroot 757 0.0 1.3 2716 856 pts/0 R 14:42 0:00 ps auxand the dmesg isCode:[root@Linux /root]$dmesgLinux version 2.4.19-rmk7-ads5 (sreynard@elgato2.soco.agilent.com) (gcc version 2.95.2 19991024 (release)) #30 Wed Apr 28 13:36:58 UTC 2004CPU: StrongARM-1110 revision 9Machine: ADS GraphicsMasterWarning: bad configuration page, trying to continueOn node 0 totalpages: 8192zone(0): 256 pages.zone(1): 7936 pages.zone(2): 0 pages.On node 1 totalpages: 8192zone(0): 256 pages.zone(1): 7936 pages.zone(2): 0 pages.Kernel command line: console=tty1 mem=32m@0xC0000000 mem=32m@0xC8000000 rw ramdisk_size=8192 initrd=0xC0800000,3m root=/dev/ram sa1100_pcmcia_opts=sock:0(speed_io:100,fast_mode),sock:1(speed_io:80)Relocating machine vectors to 0xffff0000Console: colour dummy device 80x30Calibrating delay loop... 137.21 BogoMIPSMemory: 32MB 32MB = 64MB totalMemory: 59552KB available (1716K code, 360K data, 88K init)Dentry cache hash table entries: 8192 (order: 4, 65536 bytes)Inode cache hash table entries: 4096 (order: 3, 32768 bytes)Mount-cache hash table entries: 1024 (order: 1, 8192 bytes)Buffer-cache hash table entries: 4096 (order: 2, 16384 bytes)Page-cache hash table entries: 16384 (order: 4, 65536 bytes)POSIX conformance testing by UNIFIXLinux NET4.0 for Linux 2.4Based upon Swansea University Computer Society NET3.039Initializing RT netlink socketsa1111_pcibuf: initializing SA-1111 DMA workaroundSA1111 Microprocessor Companion Chip: silicon revision 1, metal revision 1Starting kswapdJFFS version 1.0, (C) 1999, 2000 Axis Communications ABJFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.ttyS0 at I/O 0xf0100000 (irq = 50) is a 16550AttyS1 at I/O 0xf0120000 (irq = 51) is a 16550AttyS2 at I/O 0xf0140000 (irq = 52) is a 16550AttyS3 at I/O 0xf0160000 (irq = 54) is a 16550AttySA0 at MEM 0x80050000 (irq = 17) is a SA1100ttySA1 at MEM 0x80010000 (irq = 15) is a SA1100ttySA2 at MEM 0x80030000 (irq = 16) is a SA1100Console: switching to colour frame buffer device 80x30initialize_kbd: Keyboard reset failed, no ACKKeyboard timed outkeyboard: Timeout - AT keyboard not present?Keyboard timed outkeyboard: Timeout - AT keyboard not present?pty: 256 Unix98 ptys configuredUCB1200 generic module installeducb1200 touch screen driver initializeducb1200 adc driver initializedUCB1200 audio driver version 2.2 initializedUCB1200 audio driver Click-Avoid patch: TT <tthaele@papenmeier.de>UCB1200 Mixer driver version 0.1 initialized. TT <tthaele@papenmeier.de>smartio driver initialized. version 1.10, date:28-Jun-2002SmartIO ID : 0x5002Device Version : 6(0x36)Device Type : 0x8535SA1100 Real Time Clock driver v1.00Uniform Multi-Platform E-IDE driver Revision: 6.31ide: Assuming 50MHz system bus speed for PIO modes; override with idebus=xxsmc9194.c:v0.14 12/15/00 by Erik Stahlman (erik@vt.edu)eth0: SMC91C96(r:9) at 0xf00e0000 IRQ:58 INTF:TP MEM:6144b ADDR: 00:60:0c:00:f5:28RAMDISK driver initialized: 16 RAM disks of 8192K size 1024 blocksizeloop: loaded (max 8 devices)PPP generic driver version 2.4.2Sound: SA1111 UDA1341: dsp id 3 mixer id 0SA1111 audio out: SA-1111 SAC DMA channel 6 in useDMA request for SAC output failedphysmap flash device: 4000000 at 8000000Physically mapped flash: Found 2 x16 devices at 0x2000000 in 32-bit mode0: offset=0x0,size=0x40000,blocks=1281: offset=0x2000000,size=0x40000,blocks=128Using buffer write methodSA1100 flash: probing 32-bit flash busSA1100 flash: Found 2 x16 devices at 0x2000000 in 32-bit mode0: offset=0x0,size=0x40000,blocks=1281: offset=0x2000000,size=0x40000,blocks=128Using buffer write methodUsing static partition definitionCreating 3 MTD partitions on "SA1100 flash":0x00000000-0x00100000 : "zImage"0x00100000-0x00400000 : "ramdisk.gz"0x00400000-0x04000000 : "User FS"Linux Kernel Card Services 3.1.22options: SA-1100 PCMCIA (CS release 3.1.22)usb.c: registered new driver usbdevfsusb.c: registered new driver hubhcd/ohci-sa1111.c: starting SA-1111 OHCI USB Controllerhcd/ohci-sa1111.c: ohci-hcd (SA-1111) at 0xf4000400, irq 109usb.c: new USB bus registered, assigned bus number 1hub.c: USB hub foundhub.c: 1 port detectedusb.c: registered new driver hiddevusb.c: registered new driver hidhid-core.c: v1.8.1 Andreas Gal, Vojtech Pavlik <vojtech@suse.cz>hid-core.c: USB HID support driversmice: PS/2 mouse device common for all miceNET4: Linux TCP/IP 1.0 for NET4.0IP Protocols: ICMP, UDP, TCPIP: routing cache hash table of 512 buckets, 4KbytesTCP: Hash tables configured (established 4096 bind 4096)NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.NetWinder Floating Point Emulator V0.95 (c) 1998-1999 Rebel.comRAMDISK: Compressed image found at block 0Freeing initrd memory: 3072KEXT2-fs warning: checktime reached, running e2fsck is recommendedVFS: Mounted root (ext2 filesystem).Freeing init memory: 88Khub.c: USB new device connect on bus1/1, assigned device number 2hub.c: USB hub foundhub.c: 4 ports detectedjffs2_scan_inode_node(): Data CRC failed on node at 0x032efdfc: Read 0xe6bf2df9, calculated 0x7e418cdbjffs2_scan_eraseblock(): Node at 0x032f0884 {0x1985, 0xe001, 0x00000b28) has invalid CRC 0xe5525c47 (calculated 0x63c62ee9)jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f0888: 0x0b28 insteadjffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f088c: 0x5c47 insteadjffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f0890: 0x02a9 insteadjffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f0894: 0x01c8 insteadjffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f0898: 0x8124 insteadjffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f08a0: 0x8000 insteadjffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f08a4: 0x22ff insteadjffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f08a8: 0x22ff insteadjffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x032f08ac: 0x22ff insteadFurther such events for this erase block will not be printedAVR driver initialized. version 1.1, date:Aug 6 2004[root@Linux /root]$but the fault is still the same. device stuck at copyright screen, no web interface and no remote access app response.Thanks

author: pieroc91
author_rank: Contributor
timestamp: June 15, 2021, 01:56:25 pm
content: Oh also this is the user manual for the computer running the device, there are descripted all the jumpers and yes, it does have two Ps/2 ports for keyboard and mousehttps://support.eurotech-inc.com/developers/documents/110110-9001B_GM_Manual.pdfIn case my box is completely dead i'm using it to run Doom.

author: pieroc91
author_rank: Contributor
timestamp: June 15, 2021, 02:16:55 pm
content: well on a closer look running elgato via telnet i found that i have license problems of which my elgato.lic is completely missing, replacing with a generic one from this post does not help since my hostID is other. is there a way to recover the hostID?Code:ElgatoManager::ElgatoManager instanceName elgatoMgrWelcome to the DMC Shell. Type 'quit' or 'bye' to exit.> DragonflyIO::waitForCTS() 5000 ms timeout: readyLevel=Open, ms elapsed since last write: 10711, read: 10711DflyIO::write(buf=0xbffff8b0, length=4) waitForCTS() failed with error=0x810000ElgatoManager::waitForLicenseReady() !!!!! Dragonfly expected but not found on port 4 after 90 secondsElgatoManager::initialize() !!!! waitForLicenseReady() timeout #1, trying again ...ElgatoManager::waitForLicenseReady() !!!!! Dragonfly expected but not found on port 4 after 90 secondsElgatoManager::initialize() !!!! waitForLicenseReady() timeout #2, trying again ...

author: kirill_ka
author_rank: Frequent Contributor
timestamp: June 15, 2021, 02:31:03 pm
content: Hi,There's no reason in trying to start elgato without all modules connected.In my case removing just the power meter board will cause it to stuck at the copyright screen.Unfortunately I don't have time to prepare any clear directions for you (enabling log, etc.). You should be able to find some clues in the thread.As I remember, you can access web pages by removing entry in the egServer/passwd (or you need to remove the file as whole, I don't remember).

author: pieroc91
author_rank: Contributor
timestamp: June 15, 2021, 03:13:42 pm
content: Thanks for your reply, i will check my modules to see if anything is faulty, it has already some bodge wires running along which don't seem original ones. Still do you know if there's a way to recover the Host ID? my license folder is completely empty.Thanks

author: kirill_ka
author_rank: Frequent Contributor
timestamp: June 15, 2021, 04:01:48 pm
content: Quote from: pieroc91 on June 15, 2021, 02:16:55 pmAha, that's something. I don't think that the hostid is a problem here. It just fails to communicate with the DSP board.All the device identification (IDs, HW options) are stored on the DSP board. So no surprise that license functions are trying to communicate with the "dragonfly" first.

author: pieroc91
author_rank: Contributor
timestamp: June 15, 2021, 08:05:43 pm
content: Sucess!! one of the serial cables that goes to the A3 board was misconnected on a previous repair, now it booted fine but with no options, still now on the menu i can look my host ID an i can create a new elgato.lic with the correct data!

author: 9aplus
author_rank: Regular Contributor
timestamp: June 17, 2021, 06:37:35 am
content: Any of the members here ever in need of ISO calibration for your E7495 ?I was surprised with price of calibration within EU/Germany...Agilent E7495traceable ISO calibration(CW signals only; no digital modulation) 1.800 euroAny suggestions ?

author: nsd_c
author_rank: Contributor
timestamp: August 11, 2021, 05:58:14 pm
content: Hi all,I have an E7495A that I purchased a few years ago off of eBay used that I've used successfully for one- and two-port measurements, distance to fault, and as a general spectrum analyzer. It has come in very handy for all of these functions. I decided recently to extend its functionality by purchasing a power probe, the Agilent 8481H (-10 to +35dBm), from eBay. The seller claimed that it was working, and seems reputable, however, after running the 'zero' and 'calibrate' functions, this power sensor reads around -19dBm with the power reference turned on (and the sensor hooked directly to the power reference output). From reading the manual, I believe it should read 0dBm (1mW @ 50 Hz is the rated output). Itdoesread very low with the power reference turned off (about -40dBm).For lack of any other useful instrumentation, I tried measuring the power output using an RTL-SDR and about 39dB of attenuators chained together. The RTL-SDR showed -28.94dB of input power (appearing as a peak at around 50 MHz), which gives +10.09dBm coming out of the '7495A... or 10mW instead of 1mW (a ten-fold increase).I did do a continuity check of the probe cable, and it seems OK.For lack of instrumentation to check with (I do not have another power meter or probe), I'd like to check the power sensor reading using not the power reference port, but the E7495A's built in generator (if possible). I am able to telnet into the instrument (thanks to info on this thread). I have seen some of the Java GUI reversing bits on this thread as well, so I was curious to try to find out if there is a back-door way of commanding the power reference on while the spectrum analyzer is running, or likewise turning the generator on when the power meter application is running.To that end, I found this bit in PowerMeterScreen.class:Code:MenuItem createPowerRefButton(){return new MultiStateActuatorButton(PowerMeterMeasurementSettings.instance().getPmRef(), getContextString("powerMeterCalibrate.powerRef"));}If I dig into MultiStateActuatorButton, I can see that the first argument to the constructor is a 'ListActuator' that the MultiStateActuatorButton uses to "do the thing" when the button is pressed:Code:public MultiStateActuatorButton(ListActuator paramListActuator, String paramString){super(paramListActuator.getLabel(), paramString);this._actuator = paramListActuator;addActionListener(this);}public void actionPerformed(ActionEvent paramActionEvent){if (!isFocused()) {getMenuPanel().focusButton(this);}this._actuator.increment(); <<< The magicrepaint();}Skipping some in-between stuff, the getPmRef() method returns this:Code:private ListActuator _pmRef = new ListActuator("pwrMeter", "pmRef", Text.SCREEN_POWER_POWER_REF, new Value[] { Value.createValue(Text.ON, 1), Value.createValue(Text.OFF, 0) });where the ListActuator constructor takes these args:Code:String paramString1, String paramString2, String paramString3, Value[] paramArrayOfValueI got kind of lost reading through ListActuator, but it looks like ListActuator ultimately sends a command to the elgato server with the send() method of the WebPlugConversion() class.It looks like WebPlugConversion then uses the Command() class to build a string that it sends:Code:public static Command makeSetCommand(String paramString){Command localCommand = new Command("set");if (!paramString.equals("global")) {localCommand.addProperty("topic", paramString);}return localCommand;}I likewise got a little lost trying to figure out what the final command string ends up looking like. However, after digging through this thread some more, I came acrossreply #126, where user DogP shared some observations:QuoteArmed with this information (namely, what port to look at), I found that if you telnet into port 5028, pressing buttons on the front panel has the effect of the system echoing on that port these commands. So, if I turn the power meter on through the front panel, I see:Code:cmd: settopic: pwrMeterpmRef: 0get printed to the terminal.I am able to make the ‘get’ commands work: if I type (for example)Code:cmd: gettopic: spectrumcf:the instrument responds with:Code:cmd: settopic: spectrumcf: 1955000However, I can’t seem to get ‘set’ commands to work—attempting to change any parameter causes the instrument to do… nothing.The only command other than ‘get’ that works is ‘cmd: closeGui’, which causes the connection to be closed by the host (instrument). I’ll note that when I first connect to this port, the instrument prints:Code:cmd: remotecmd: setActivemeas:cmd: notifyEventevent: startupCompleteI was hoping to use Wireshark to capture commands sent by the Java GUI running on my PC, but I can’t seem to get the GUI to work quite 100%. It starts (in a very old Debian Squeeze VM running in a Windows host by way of VirtualBox), but hangs at “Please wait while the measurement is loading…”. It does work insofar as the GUI running on my PC does show the correct instrument mode (i.e., main menu, spectrum analyzer, power meter, etc.). User DogP’s aforementioned post did mentionQuoteI tried installing JRE 1.4.2_20, but invoking the application with the command line given earlier in this thread failed withCode:Exception in thread "main" java.lang.NoClassDefFoundError: elgato/gui/MainWindowI found that this works instead, though:Code:java.exe -Dserver=192.168.1.186 -DlocalAddress=192.168.1.1 -classpath "./*" elgato.gui.MainWindowHowever, clicking around in the Java GUI doesn't do anything. I did try copying over the RemoteGUI.jar file, but this causes its own problems. Iamable to change the spectrum analyzer center frequency by pressing the 'up' and 'down' arrows on my computer, and I can sniff out the 'cmd: set' command that are being sent when I do this in Wireshark.I'll note also that my instrument has a significantly newer version of SW than what's available for download from Keysight's site (A.06.00, from 2006, instead of A.01.60, from 2003).Anyway, I thought I'd share that progress, and ask a few questions:Does anyone know why the power ref output might be generating 10mW instead of 1mW?Does anyone already know of a back-door way of doing what I'm trying to accomplish?Any ideas why the instrument doesn't like my 'cmd: set' commands?

author: kirill_ka
author_rank: Frequent Contributor
timestamp: August 12, 2021, 06:51:53 am
content: Hi, lets proceed with one problem at a timeI suspect RTL-SDR is not a reliable tool to do power measurements.Try enabling power ref as I described here:https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg1169477/#msg1169477Then measure the reference using E7495 itself (don't forget to add some attenuators!).

author: kirill_ka
author_rank: Frequent Contributor
timestamp: August 12, 2021, 08:48:10 am
content: Quote from: nsd_c on August 11, 2021, 05:58:14 pmMy understanding is that HP8481H = HP8481A + 20dB attenuator.So it could be a bug with handling this particular type of sensor.Though, I don't know where -19dBm comes from. Maybe the calibration fails?Or maybe HP8481H is supposed to have 19dB attenuator?What's the actual reading? Is it exact -19.00 dBm?

author: Ick
author_rank: Newbie
timestamp: August 29, 2021, 07:20:40 am
content: Pieroc91,From the logs it seems you have a problem with a corrupt file system ( the lose serial cable you have fixed already); all the jffs2 error messages.You need to reinstall the firmware and recreate the filesystem.This is done the following way:- insert the firmware to preferably PCMCIA slot(CF card in PCMCIA adapter). On my unit the upgrade from CF slot would not work properly.- start/ reboot the unit- on the upgrade screen with the continue yes button, press the LOWER RIGHT soft button next to the LCD instead. Yes, there is no marking, description or hint on the upgrade screen that this button has a function. Press this lower right soft key and the complete flash will be erased, file system re-created and firmware files newly written.It seems a backup of the license file is automatically been made, I would save it in advance anyway.I had the similar issues with my unit - file system errors with same message. That caused all kind of odd behaviour, e.g could not properly access CF slot and FS anymore , no dhcp, no upgrade possible (needed to go via dip switches on the COU board)After the new filesystem created, all was hunky dory. Error messages were gone during boot and all properly working.BR ick

author: pieroc91
author_rank: Contributor
timestamp: October 25, 2021, 05:00:50 pm
content: Hi everyone!For anyone fighting with the Remote GUI i've made a package with two executables to easily connect to the device.They are just batchs converted to exeThe automatic local IP code is:Code:color 17echo offfor /f "tokens=1-2 delims=:" %%a in ('ipconfig^|find "IPv4"') do set ip=%%bset ip=%ip:~1%clsset /p AgilentIP=E7495 IP Address:rem echo %AgilentIP%echo Local IP Address: %ip% (Autodetected)echo.echo Press any key to connectpause>nuljre\1_8_0\bin\java.exe -Dserver=%AgilentIP% -DlocalAddress=%ip% -classpath "./egclient" elgato.gui.MainWindowAnd the manual Local IP is:Code:color 17echo offclsset /p AgilentIP=E7495 IP Address:rem echo %AgilentIP%set /p ip=Local IP Address:echo.echo Press any key to connectpause>nuljre\1_8_0\bin\java.exe -Dserver=%AgilentIP% -DlocalAddress=%ip% -classpath "./egclient" elgato.gui.MainWindowIt's also bundled a version of JRE 1.8.0 that works with Windows 7 and 10 without a problem.It's available to download from here:https://drive.google.com/file/d/1MNUHC3evNMRjFCOC_0AetulkUSO1vfGo/view?usp=sharing

author: 9aplus
author_rank: Regular Contributor
timestamp: October 30, 2021, 06:03:23 pm
content: TNX, must try next week on Win10

author: m6sso
author_rank: Newbie
timestamp: January 19, 2022, 09:56:18 pm
content: Not sure if issue on my end but with the remote client I cant use any of the right side buttons.

author: pieroc91
author_rank: Contributor
timestamp: February 10, 2022, 08:36:52 pm
content: Only one client at the time can control the device and the device itself counts as a client.To claim control over the device (the right side buttons) you have to press the ESC/LOC button on the app, to recover control on the device press the ESC/Lcl button on the deviceThe devices that cannon control the buttons will show a Remote text on top of the analizer windows

author: ua4yhz
author_rank: Regular Contributor
timestamp: April 19, 2022, 05:59:06 am
content: Quote from: nsd_c on August 11, 2021, 05:58:14 pmMy power sensor HP8481H also showed -20 dBm, but the power is measured correctly. However, I have long since replaced the E7495A with the GenComm GC746AI'm sorry, I remembered. With the HP8481H sensor, your device should show 20 dB less. Set the offset to 20 dB and the readings will be correct. This is due to the structure of the sensor itself.

author: Velund
author_rank: Regular Contributor
timestamp: October 14, 2022, 12:14:35 am
content: Quick question to gurus.Does options 500 (CW Gen) and/or 510 (CW gen with CDMA) require some additional hardware or it is just a software option? Here is local offer for 7495B unit with bunch of cables, OSL cal kit, high power 40 dB attenuator (is it really 100W?) and some filter with 2 N-type connectors. Unit does not have 500 or 510 options though.

author: Wallace Gasiewicz
author_rank: Super Contributor
timestamp: October 14, 2022, 12:35:58 pm
content: Velund:The Attenuator that came with mine is JFW Model 50FH-040-100-3N 40 dBIt is indeed a 100 Watt attenuator.The filter that came with mine is a 1930-1990 MHz band pass filter, so of limited usefulness.Unless you want to spend a lot of time maintaining this unit, I would not recommend it.I cannot see your "local offer" so I do not know it a power sensor is included. They are expensive and easy to break.Wally

author: Velund
author_rank: Regular Contributor
timestamp: October 15, 2022, 12:29:49 am
content: Quote from: Wallace Gasiewicz on October 14, 2022, 12:35:58 pmWhat kind of maintenance this unit require? Will it take more time than "maintaining" GF?And no, there is no power sensor head in the offered set, it was sold separately with sensor cable.The only thing I really worry about - is missing option 500. I suspect that it is will need just software hack to enable, but wish to be sure before purchasing.

author: Wallace Gasiewicz
author_rank: Super Contributor
timestamp: October 15, 2022, 08:19:38 pm
content: I had to modify and re install software to get the GPS to work.The batteries are a problem and the unit needs frequent recharge even at rest. The rubber around the screen creeps and needs to be fixed, You have to disassemble the thing to do this.There is no documentation I can find for schematics to fix any problem. There is poor documentation in general. For example: can you find if the freq gen is software or hardware? I guess not.I really do not remember if it is hardware or not.Even if you have the freq gen it STARTS at 375 MHz no lower freq available.GPS disciplining of the frequency standard is not very good, IMHO. No where near a separate GPSDOTry to read the entire thread to see what problems people have had. Notice the amount of computer code they are talking about.Depending on what you are going to do with it, there are much better choices, especially if you are going to use it for working on HF radios.You are not getting the power sensor so....So essentially you are getting a spectrum analyzer. Minimum span is 1 KHz which is not bad for a service monitor.I betcha you can get a spectrum analyzer with a tracking generator that meets your needs for whatever the unit is going for. You haven't quoted a price.The only real advantages to the unit that comes to mind is to actually receive weak signals over the air to look for spurious signals and interference, that is if the antenna is included.And some antenna analysis. Screen is pretty also.

author: Velund
author_rank: Regular Contributor
timestamp: October 15, 2022, 10:38:16 pm
content: Got it...Not a problem for me in a most of points. This will be not the only SA in the shack, and not even second one.I have HP8920A with SA/TG and R&S CMU200 (both bought faulty and restored), so I have no problems with signal generator, power meter and SA coverage while working at workbench. E7495 looks like good extension of TG capability and SWR measurement over 1 GHz, plus TDR functionality. And it is portable, that is a big plus.Yes, I know about typical problems with screen, and prepared to recharge batteries and store them separately if unit is not used for some time. And price is relatively good, comparable with current eBay offers if overseas shipping is taken into account.

author: Wallace Gasiewicz
author_rank: Super Contributor
timestamp: October 15, 2022, 11:02:00 pm
content: The only way I was able to update the GPS date was to change the date on a PCMCIA card that contained the entire program for the unit and update the unit.If you have trouble with the GPS I can send you a copy, you need a PCMCIA card though. 64 MB is the one I have.It is pretty simple if you have a card and a computer that can use it.

author: technogeeky
author_rank: Frequent Contributor
timestamp: October 16, 2022, 09:50:02 pm
content: Quote from: Velund on October 15, 2022, 10:38:16 pmI think the device is worth the roughly $300 shipped I paid for it. $1000 shipped (what I see on ebay now), not so much. Mine did not come with any attenuator or calibration kits or power sensors. Just the unit, the bag, two cables.It's worth keeping in mind that the 375MHz minimum TG output imposes a hard limitation on the efficacy of the TDR function. If the cable is lossy or if it's short enough (or both) then you just get garbage output.I remember trying to debug some bnc balun-coax- bnc balun wire (which was used for CCTV cameras, which have an expected bandwidth of 6MHz or so) and being unable to make good measurements for this reason. It's an extreme example, but it's worth keeping in mind that the 375MHz lower bandwidth on this instrument is a limitation that has multiple impacts.Also, yes, I think the GPS receiver in this unit is (relatively speaking) not good. I originally hoped to use it as a GPSDO but even with wide open skies it loses lock somewhat randomly and if there are even minor obstructions you will get maybe 2 satellites intermittently.I have also not gotten any other of the features to work to decode e.g. CDMA over air or directly out of a phone or actual base station or something. I don't really understand how it works or if my setups were correct, but to me all of those applications are essentially useless.Lastly: I am not 100% sure but I think if the unit you are looking at has the two ports populated (RF 1 and RF2) then it should be software hackable to get the TG enabled. I have not ever seen a unit without the ports populated.

author: Michael-VK2BEA
author_rank: Regular Contributor
timestamp: May 12, 2023, 01:57:20 am
content: I know this is an old thread but ... when the term 'telnet' is used here, is this correct? Telnet implies an IP connection (IP address and port) and AFAIK there is no Ethernet on this device. Does this actually refer to a terminal program (e.g. minicom) connecting to the serial port?thanks,Michael

author: DogP
author_rank: Regular Contributor
timestamp: May 12, 2023, 03:03:24 am
content: There is an Ethernet port... it's on the left side behind a flip-down door, next to a CompactFlash card slot, USB ports, etc. So yes, you're actually using telnet. A web interface is also available over Ethernet.DogP

author: Michael-VK2BEA
author_rank: Regular Contributor
timestamp: May 12, 2023, 03:51:59 am
content: Doh! Yes I see it!

author: imaurente
author_rank: Contributor
timestamp: September 08, 2023, 06:28:36 pm
content: Hey guys! I recently got an E7495B but this one has an error, it doesn't fully load the software, I accessed it via RS232 and found that the kernel is apparently ok, however it doesn't finish loading the rest of the system.I would very much like to recover this unit, it will be very useful for my studies and essays.Hug!

author: mil4898
author_rank: Newbie
timestamp: January 05, 2024, 09:47:39 am
content: Hello Guys,I know that I am late to the party , but I just acquired a E7495 that does not boot , and would like to get it going if at all possible.The symptoms are , black screen which flickers a couple of times after the power button is pressed , and that is all .I have tried to download the service manual and last firmware from page 4 , but the web server is not responding.Could someone please re-share those files, I would be very grateful.Best regardsMil

author: ve7xen
author_rank: Super Contributor
timestamp: January 05, 2024, 06:57:01 pm
content: My mirror also posted on page 4 is still up. Does it have what you're looking for?https://www.gotroot.ca/e7495/

author: mil4898
author_rank: Newbie
timestamp: January 07, 2024, 12:03:22 am
content: @ve7xen Much thanks ,Very grateful for the files .I have made up a serial cable and can see the boot messages .I am getting past the memory tests ok , then there is a jump to an address , and after that I have “prefetch abort” message that seems to be looping .I am thinking about doing a flash recovery using the downloaded firmware file , and just need to get a pcmcia adapter for the compact flash card .Best RegardsMil

author: GRFixedGear
author_rank: Contributor
timestamp: March 15, 2024, 01:45:17 pm
content: Sorry for the other people I spammed with PM's looking for these files. I need to read all the way to the end I guess.I really appreciate the change log as well. What is really really curious is that as best I can tell, my unit has a BETA firmware version on it, that correlates to none of these released versions. The good news is my unit came with PCMCIA card with the firmware on it, so if I only had a reader for that stupid card then I could archive that potentially diff it with the latest and gain some insights.I will followup with the details of what I have later, but I know it is quite different than the latest because the prescribed patch for the GPS problem does not match my binary file on the unit. Not just by address... a search for the first 2 bytes specified in that patch show one promising match, but the remaining bytes do not match at all.Thanks to all those who have contributed to this over the years. Its a fantastic resource!

author: GRFixedGear
author_rank: Contributor
timestamp: March 16, 2024, 01:35:12 pm
content: Here is the data returned from the web page (newly liberated after deleting the related web interface password file):Product Name: Agilent Technologies Embedded Ethernet ControllerSerial Number: 0000A00000Firmware Revision:B.04.20 Arms Beta 1 Build 1Hardware Name: elgatoBuild Info 1: 060217Build Info 2: @(#)Linked: Feb 17 2006 13:23:20Build Info 3: @(#)By: stevbellEthernet MAC Address:000102030405And what is in the version.txt file:A.04.00 Dev 14As you can see by the nomenclature and dates, this doesnt appear to be running on released sw at this point. Looking forward to what this thing does after the upgrade to 6.25

author: GRFixedGear
author_rank: Contributor
timestamp: March 16, 2024, 05:21:23 pm
content: Regarding the screen protector adhesive... mine came off with IPA and some mild elbow grease. No negative impact on the plastic or the glass/stainless of the screen itself. Planning to replace the adhesive with firm vhb tape 1/8" wide since I measure the old crap at 0.5mm after removal which makes the claimed 0.63mm of that tape variety seem just about perfect.Aside from fixing that sagging adhesive on the screen it seems I need to get into the guts of mine. It shut down yesterday connected to a ac adapter and now even though it will restart the power consumption is higher and the unit has a magic smoke smell to it. Lost a tantalum like Signal Path did, maybe?

author: GRFixedGear
author_rank: Contributor
timestamp: March 17, 2024, 04:18:37 am
content: Ouch....Backside of the primary power board....

author: GRFixedGear
author_rank: Contributor
timestamp: March 17, 2024, 04:29:39 pm
content: I don't have tantalums to use in that spot, but replaced with 2 1206 X7R 10uF 35V ceramics since they run at 24V and I'm trying to counteract the cap loss at that bias voltage. Putting it all back together.

author: Wallace Gasiewicz
author_rank: Super Contributor
timestamp: March 17, 2024, 07:27:19 pm
content: About PCMCIA Card Readers.......Old Win 7 Dell Latitude E 6410 has slot. I bought one for $50 just for this feature.I also use it for my EPROM stuff.It also has Telnet (which did not help with the 7495), you can Telnet in but you cannot accomplish the change necessary.

author: GRFixedGear
author_rank: Contributor
timestamp: March 24, 2024, 01:34:34 am
content: CF worked fine for me. Got a type 2 adapter for an sd card, partitioned a 64GB microSD card for 2GB to make the ancient firmware happy on the device. Put in the upgrade files, popped it in and found my uncle bob.Working on the patches... GPS patch works a treat, but the published patches for the license file didnt work for me first time. I got a unit that was non-responsive to button pushes, and even lost the soft-key labels / images on the screen when I tried it. Not quite sure how that happened. MAYBE it was just a glitch in the firmware storage in that case. I'll give it another go and see what happens. Worst thing that happens is I remote login and ftp the file back up to my linux box to compare intended contents vs actual in the flash of the 7495aI've used Ghidra to decompile the elgato binary to understand the patch being applied to the file offset of 0x337a7c appears to be correct. It shows up in a function called "l_good_lic_key". As you can imagine that's a rather long nested function and not very much fun to read in the assembly or decompiled presentation from Ghidra. The instruction being modified is effectively the first branch in the function, but the suggested edit turns it into a mov/cpy operation from r0 to r0... effectively a nop?! Then the two instructions that follow (seems to have been unused previously so its curious that they are even there) hard codes a 1 return value and jumps to the return at the end of the function. Skips all the gory details in the middle. Genius

author: GRFixedGear
author_rank: Contributor
timestamp: March 24, 2024, 02:05:18 am
content: Yeah... really weird. Made the fix again, uploaded, pushed the elgato binary up via ftp and compared... no diffs from intended.At first all the mode menu stuff worked fine, but if I tried to go to System and hit the button for the second page, it just froze with that soft button indicated as pressed, but I could get back to the mode menu stuff and click around for a bit. After a few minutes the soft buttons disappeared again and there is nothing more you can do to the unit. Really really strangeAnd... previously reported and fixedhere

author: GRFixedGear
author_rank: Contributor
timestamp: March 24, 2024, 02:40:03 am
content: In other news. They aint jokin in the service manual when they warn you about the fragillity of the N connector ports for the signal generator and spectrum analyzer. Even having moved the rf connector panel away, I broke off the output side when the beast RF assembly slipped out of my hands during disassembly to go find a burned tantalum on the back of the primary power board. Good news... with some very careful excavating of the covering copper and ceramic substrate you CAN fix one of these. Its definitely not perfect but holy crap it works.Attachments:- 160/400/800 grit polished end of the bit that broke off. Did the equivalent to the part still attached to the RF assembly- Propped up the RF assembly consistently all around and then found stuff to support the backside "patch" of 0.1mm copper (pre-tinned) that was tacked in place before rigging up the broken piece for soldering- Closeup of how I excavated down into the ceramic and tinned the signal trace for eventual solderingSoldermask removed with 400/800 grit then polished up with a fiberglass scratcher pencilThe backside cover was soldered to the main bit with SAC alloy for some heat resistanceJunk ceramic resistor body used to support the whole assembly during workLOTS of excess solder added around the sides and bottom to try to get connection across the "shield" at the breakCenter conductor was bridged with a single strand of 36-ish AWG tinned copperAfter bridging the pit was treated with drops of super corona dope. Not a good substitute for real dielectric but best I could doTop side was again bridged with 0.1mm pre-tinned copper. Then the sides of the board around the break were liberally reinforced with more solderInitial tests looking at the output of the generator with a TinySA showed output was working at expected level. Im sure its not up to factory performance but good enough for who its for

author: maurit
author_rank: Contributor
timestamp: June 11, 2025, 04:46:04 pm
content: Hello,I was given an E7495B in very bad cosmetic condition, with several dents and a broken LCD.After a lot of "bodywork" and replacing the LCD with the NL6448BC33-53,I successfully updated the firmware to version 06.25 (thanks Wallace).Now the problem of Options remains.I think I understand the method, but I don't have the necessary knowledge and unfortunately I can't even get started.All advice is welcome,especially the trivial and obvious ones.Many thanks.Mauriziomaurinot AT libero DOT it

author: PA0PBZ
author_rank: Super Contributor
timestamp: June 11, 2025, 06:49:41 pm
content: Hi Maurizio,It's been a while since I was active in this thread, but I think we moved on from patching the software to generating the correct keys. Can you post the HOSTID of your E7495B and the options you want to activate?

author: maurit
author_rank: Contributor
timestamp: June 14, 2025, 02:39:25 pm
content: Hi Paul,thank you very much !!!I reply to you a PM.Have a nice day.maurizio