Secrets of the JDSU (Now Viavi) HST-3000 - Page 1
Forum section: electronics / testgear

author: kc7gr-15
author_rank: Contributor
timestamp: December 25, 2022, 11:38:55 pm
content: This post is aimed mainly at those who are into telephony (both POTS and digital) and other telecommunications modes, such as T1/T3, though it will also cover some of the network-testing capabilities of the HST3K. JDSU, according to the unit's data sheet, described it as a "Triple-Play Network Access Tester" and it certainly seems to live up to that. Even its product name contains a hint (HST = Handheld Services Tester).It's my hope the info offered here will help keep the instruments useful (at least to hobbyists) far beyond its 2018 discontinuance.SO WHAT IS IT?In short: This is a multifunction test set designed to handle, depending on which module's plugged in and which software options are enabled, just about any kind of standard testing for copper POTS lines, SIP-based VoIP, T1/T3 circuits, DSL/ADSL/VDSL, Ethernet (fiber and copper), BERT (Bit Error Rate Testing) and TIMS (Transmission Impairment Measuring Set).THE GUTS AND THE OPTIONSViavi does still support these units as of the date of this post, at least for calibration and best-effort repairs, but they never published any publicly-available data on what goes on in the guts of the thing. So, after having been (somewhat rudely) told, "Oh, we don't allow our end users command-line access" I decided to do a little digging of my own.The unit (at least for the only hardware revision worth messing with, the ACE-II) runs on an Intel PXA270 series CPU clocked at around 500MHz. It uses a Spansion 29GL01GP13 FLASH memory chip to hold its firmware, and a Dallas/AD DS2433 One-Wire EEPROM (8-pin SOIC) to hold version and option info (which is preserved across firmware updates).It's OS is a shrunken-down Linux core, using Busybox to conserve memory space. All HST-3000's come with a base unit Ethernet port which shares duties between circuit testing and remote access. See page 14 in the Base Unit User's Guide (attached).The Linux CLI in the unit can be easily accessed by:Assigning an IP address to the base unit's Ethernet port, either manually or through DHCP.Establish a standard Telnet connection to whatever IP the unit got assigned on your network.At the login prompt, give it the user name root and the password is phantom4Explore to your heart's content, but, if you value your unit, be bloody careful about changing anything! I have no idea what will happen if you damage the base OS, nor do I have any idea how to recover it -- outside of unsoldering the BGA FLASH chip from a known-working unit, reading it, copying that load into another chip and re-soldering it to the target unit's board!As far as digging into the hardware goes, have a look at the photos SplitView and 1-wire. In SplitView, you can see there are six machine screws which need to be removed (from the back) to get the thing open. You may have to do some gentle prying, along the perimeter, since the units are weatherproofed with silicone sealant at the factory, but they separate pretty easily once the stuff gives.SplitView shows the front cover and display assembly on the left, CPU and mezzanine boards in the base unit on the right. Note the unused socket on the backside of the keypad PCB. I'm told this was to accommodate an optional 802.11 WiFi card, though darned if I've ever seen one in that form factor. There's also another version of the front assembly (see the photo bt) which has Bluetooth hardware. Note that it was either one or the other with these sets. I've never heard of, or seen, one with both WiFi and Bluetooth.Take a closer look at the base unit on the right. Specifically, the photo 1-wire zooms in on the Dallas 2433 chip. To enable all available options, it's best to desolder this one from the board and manipulate its contents with a device programmer (I made use of the Reveltronics Revelprog IS).Here's the best news: To enable everything, you only have to change ONE byte in the EEPROM. Specifically, at address 0x2C, you'll usually find the hex byte 0D. Change this to anything you want, from 00 to FF (I prefer 42, just to be silly), reprogram the chip and solder it back in. You're good to go!There is, however, a caveat: Enabling all the software options does not magically make the test set do things it doesn't have the hardware to do. As one example, they don't all come with copper testing capability. While you can certainly turn on options like 'Copper Expert' in software, it won't change a thing if the proper mezzanine board (to actually execute those tests) isn't installed.Another example is the 802.11 WiFi. I've yet to see a unit which is equipped with the radio module to handle that. It won't hurt anything if the option's enabled in the software, but neither will it start trying to use the nearest WiFi access point if the radio's missing.I welcome questions or comments. I have a lot more information on these units than I had room to post here.Happy tweaking.

author: BTO
author_rank: Frequent Contributor
timestamp: February 14, 2024, 04:02:53 pm
content: Hi mate,I realize its been a while since you posted this topicNow, you and me seem to have a lot in common1. Both interested in Electronics2. Both Liney's (Difference being, You're in the U.S.A. , I'm in Australia)3. However, i think it is JUST that advantage that we need when dealing with JDSU and VIAVII understand why no one has replied to you, i mean how often do you get a Telecomm's linesman showing up HERE of all places.then, How many of them actually give a stuff to know this stuff? Not often i can tell you that.Now, a bit of background on meI'm 50, Been in electronics since i was 6 and it all went from there.I'm a Telstra Linesman (ISGM) From back in the day before Dial Up came in.Back when we were working with the LTS-2 , Aegis CZ-3000 MkII and then III , the P.E.T. 's and all that.Here in Australia, we have the P.O.T.S network as well, we had the C.A.N. (Customer Access Network) and the I.E.N. (Inter Exchange Network), not sure if you called them the same thing in the states. although it looks like we both carried over the POTS thing.all those acronyms come from the P.M.G (Post Master General) Days, but again... PMG is an Australian thing to my knowledge.so mate...Are you still into this JDSU HST-3000 Unlocking thingy ?I don't have a HST-3000 ALTHOUGHi do have ONX-580'sAnd ONX-620Now.. I'm wondering if... All the options get unlocked in the same way that they do on the HST-3000i have a ONX-580 that was purchased from the states (Kentucky) i think it wasfrom a pawn broker that wanted to get rid of it ,Later it was revealed by the company that owned the meter (and i found this out by contacting viavi) that the meter was ISSUED by not givento an employee of that companyit seems he left the platform and took the meter with him and sold it to a pawn shop.the company then locked the meter from Strata syncI'm told from viavi that this lock cannot be removed unless the strata sync account holder removes itNOW... i also have a strata sync accountand... i know that if i'm able to sync it with my strata sync i can unlock it, TAKE OWNERSHIP in strata sync and it's doneNow i did contact the company , to be fairspoke to this bloke, can't remember his name, we were in contact and then he left the company, they haven't answered since.for what i figure.. the meter is mineand it'd be nice if they unlocked it since i paid for itnow they did say , they'd buy the meter off me for the price that i paid for it.. which is fine.but then they didn't answer the calls anymore,i told themeither i give the meter back to you and you reimburse meori keep the meter and you unlock it from your endthey did neither.so... i figure we can have fun unlocking this thingand i have several ONX-620so.. Are you still interested in all this.I've pulled them all apart, i have photo'sI've looked into JTAG (However my dad passed and that got put on hold)I repair Telecomm's electronics for the tech's so i'm very familiar with the inner workings of these things.it's funny, even calibration is all done in software, there aren't even POTS that you can adjust to do a CALi'd be really interested to do a few thingsthe first thing would be , you know when it boots up with the viavi logo,i would like to put a METALLICA - MASTER OF PUPPETS ALBUM Photo on that screen LOLor perhaps a business logo i imagine it'd be a matter of changing the jpeg currently in theirso what are your thoughts mate ?Also i think it's good having someone in the states that knows this stuff as well, God knows like i feel like i'm the only one here in Australia that knows this stuff.

author: kc7gr-15
author_rank: Contributor
timestamp: February 26, 2024, 08:52:13 pm
content: Actually, I've done a bit of experimenting with the ONX580 myself. The 'yank the EEPROM' trick does NOT work with it, which tells me Viavi became aware of the bug in the HST's and took steps to correct it in the new instruments.With that said -- I have discovered, by comparing the two ONX580's I've been able to get hold of so far, that the only difference in their EEPROM contents is a 12-byte long hex string. Since they have different options enabled, I have assumed this string controls said options. I don't think it has anything to do with the instrument's serial number, since I also think Viavi started using the MAC address for that.I'm hoping to pick back up with it either later this year or May of next year (when I finally retire from my day job).I'm very much surprised by what you experienced, though. I had no idea it was even possible to lock an instrument up remotely. That's disturbing, and I will make it a point to make sure never to connect to anything other than my own equipment if I decide to play with StrataSync.I would be very curious to see the contents of the EEPROM in your unit. Do you have the capability to safely unsolder the EEPROM and read it in a device programmer? I could also try sending you the BIN file of my known-working EEPROM to try programming into yours, see if it'll kill the lockout.No matter what happens, rest assured you're not alone in this. I firmly believe in the first-sale doctrine of 'you bought it, you own it, you can do whatever you bloody well want to with it.'Happy tweaking.

author: johnmosborneuk
author_rank: Newbie
timestamp: May 04, 2024, 02:13:05 pm
content: Thank-you for this, I've finally got the VoIP features on my HST-3000 and deleted all the custom scripts from the previous telco which were no good to meI did have an issue with mine; after I changed the magic byte to FF and reassembled the unit, it all booted fine with the features enabled however after I shut it down it wouldn't start up again (it looked dead, power switch didn't work at all). I thought that it must by a dodgy solder joint on the EEPROM as that was the only thing I'd touched so reflowed it but still deadOut of desperation I briefly shorted the onboard backup battery to clear the NVRAM and the unit booted up again...but just the once, again after a shutdown the unit was dead.I tried shorting the battery again, this time after boot up I done a factory reset and the unit has been fine since then.I also got the 802.11 WiFi working but with one big caveat that it only supports a handful of USB WiFi dongles and they're all 802.11GThe Base manual states "To use the wireless features, you must have an external 802.11 adapter (“dongle”)." after poking through the file system I found modules.alias and noticed all the USB vendor strings for the "rt73usb" driver.I got hold of a Linksys WUSB54GC which works perfectly.Here is a list of the USB WiFi devices listed in the modules.alias, I hope it helps someone else:It's also worth mentioning that some manufacturers (Linksys, D-Link and Belkin come to mind) often use the same model numbers but use different chipsets so the version numbers are important too.Code:VID_0586&PID_3415 ZyXEL Communications Corp. G-210HVID_0CDE&PID_001C Z-Com 802.11b/g Wireless Network AdapterVID_2019&PID_AB50 GW-US54Mini2VID_2019&PID_AB01 GW-US54HPVID_0471&PID_200A Philips (or NXP) Wireless Network AdapterVID_6933&PID_5001 (Vendor name unknown) (Device name unknown)VID_0769&PID_31F3 Surecom Technology Corp. RT2573VID_0DF6&PID_9712 Sitecom Europe B.V. WL-113 rev 2 Wireless Network USB AdapterVID_0DF6&PID_90AC Sitecom Europe B.V. WL-172 Wireless Network USB Adapter 54g TurboVID_0DF6&PID_002F Sitecom Europe B.V. (Device name unknown)VID_0DF6&PID_0027 Sitecom Europe B.V. (Device name unknown)VID_0DF6&PID_0024 Sitecom Europe B.V. (Device name unknown)VID_1740&PID_7100 Senao (Device name unknown)VID_04E8&PID_4471 Samsung Electronics Co., Ltd (Device name unknown)VID_18E8&PID_6238 Qcom (Device name unknown)VID_18E8&PID_6229 Qcom RT2573VID_18E8&PID_6196 Qcom RT2573VID_148F&PID_2671 Ralink Technology, Corp. RT2601/RT2671 Wireless AdapterVID_148F&PID_2573 Ralink Technology, Corp. RT2501/RT2573 Wireless AdapterVID_04BB&PID_093D I-O Data Device, Inc. (Device name unknown)VID_0DB0&PID_A874 Micro Star International RT2573VID_0DB0&PID_A861 Micro Star International RT2573VID_0DB0&PID_6874 Micro Star International RT2573VID_0DB0&PID_6877 Micro Star International RT2573VID_13B1&PID_0028 Linksys WUSB200 802.11g Adapter [Ralink RT2671]VID_13B1&PID_0023 Linksys WUSB54GRVID_13B1&PID_0020 Linksys WUSB54GC v1 802.11g Adapter [Ralink RT73]VID_06F8&PID_E020 Guillemot Corp. (Device name unknown)VID_06F8&PID_E010 Guillemot Corp. HWGUSB2-54-LBVID_1472&PID_0009 Huawei-3Com Aolynk WUB320gVID_1044&PID_800A Chu Yuen Enterprise Co., Ltd GN-WI05GSVID_1044&PID_8008 Chu Yuen Enterprise Co., Ltd GN-WB01GSVID_15A9&PID_0004 Gemtek WUBR-177G [Ralink RT2571W]VID_1740&PID_3701 Senao EUB-3701 EXT 802.11g Wireless Adapter [Ralink RT2571W]VID_7392&PID_7618 Edimax Technology Co., Ltd (Device name unknown)VID_7392&PID_7318 Edimax Technology Co., Ltd (Device name unknown)VID_07D1&PID_3C07 D-Link System DWA-110 Wireless G Adapter(rev.A1) [Ralink RT2571W]VID_07D1&PID_3C06 D-Link System DWA-111 802.11bg Wireless Adapter [Ralink RT2571W]VID_07D1&PID_3C04 D-Link System WUA-1340VID_07D1&PID_3C03 D-Link System AirPlus G DWL-G122 Wireless Adapter(rev.C1) [Ralink RT2571W]VID_07AA&PID_002E Corega K.K. CG-WLUSB2GPX [Ralink RT2571W]VID_14B2&PID_3C22 Ralink Technology, Corp. Conceptronic C54RU v3 802.11bg Wireless Adapter [Ralink RT2571W]VID_1371&PID_9032 CNet Technology Inc. CWD-854 rev FVID_1371&PID_9022 CNet Technology Inc. CWD-854 VID_0411&PID_0119 BUFFALO INC. (formerly MelCo., Inc.) (Device name unknown)VID_0411&PID_0116 BUFFALO INC. (formerly MelCo., Inc.) (Device name unknown)VID_0411&PID_00F4 BUFFALO INC. (formerly MelCo., Inc.) (Device name unknown)VID_0411&PID_00D8 BUFFALO INC. (formerly MelCo., Inc.) WLI-U2-SG54HPVID_08DD&PID_0120 Billionton Systems, Inc. (Device name unknown)VID_1631&PID_C019 Good Way Technology RT2573VID_050D&PID_905C Belkin Components F5D9050 Wireless G+ MIMO Network Adapter v4000 [Ralink RT2573]VID_050D&PID_905B Belkin Components F5D9050 Wireless G+ MIMO Network Adapter v3000 [Ralink RT2573]VID_050D&PID_705A Belkin Components F5D7050 Wireless G Adapter v3000 [Ralink RT2571W]VID_050D&PID_7050 Belkin Components F5D7050 Wireless G Adapter v1000/v2000 [Intersil ISL3887]VID_0B05&PID_1724 ASUSTek Computer, Inc. RT2573VID_0B05&PID_1723 ASUSTek Computer, Inc. WL-167G v2 802.11g Adapter [Ralink RT2571W]VID_1690&PID_0722 Askey Computer Corp.  RT2573VID_18C5&PID_0002 AMIT Technology, Inc. CG-WLUSB2GOVID_0EB0&PID_9021 NovaTech RT2573VID_148F&PID_9021 Ralink Technology, Corp. RT2501USB Wireless AdapterVID_14B2&PID_3C10 Ralink Technology, Corp. (Device name unknown)VID_07B8&PID_B21F AboCom Systems Inc WUG2700VID_07B8&PID_B21E AboCom Systems Inc RT2573VID_07B8&PID_B21D AboCom Systems Inc RT2573VID_07B8&PID_B21C AboCom Systems Inc RT2573VID_07B8&PID_B21B AboCom Systems Inc HWU54DM

author: rik215
author_rank: Newbie
timestamp: October 13, 2024, 11:20:03 pm
content: kc7gr-15 Are you still around. I am trying to achieve the same thing you did but I have a lot less experience with programming chips. Would love to jog your brain if you ever had time.

author: pateanatale
author_rank: Contributor
timestamp: April 14, 2025, 01:17:43 pm
content: Hi,i have two JDSU MSAM Module with MTS-8000 mainframe.1° MSAM Module has more additional option enable2° MSAM Module has more additional option disablemy question is this:can i clone the license key of eeprom from 1° MSAM to 2° MSAM?which eeprom are they installed in?can i enable new additional options?On the main board there are two JTAG connections, one 4pin and one 6pin.do you know this kind of form? i can send some photos.thanks for your support.