Agilent E7495 linux root account

[ke6iyc]

What is the 7495 calling the PCMCIA card?

Thanks,

Brian

[kr5j]

I did the patch but it didn't seem to fix the GPS. I went to the adjustment screen to sync the unit with GPS but GPS icon stayed yellow. I also added the license patch but when rebooted it didn't show any new options. So I thought I would try it again and now the unit boots up and hangs on the Copyrights screen. How can I recover?

Thanks
kr5j

[technogeeky]

I did the patch but it didn't seem to fix the GPS. I went to the adjustment screen to sync the unit with GPS but GPS icon stayed yellow. I also added the license patch but when rebooted it didn't show any new options. So I thought I would try it again and now the unit boots up and hangs on the Copyrights screen. How can I recover?

Thanks
kr5j

You need to replace the elgato binary with the original, and start over. The only thing I can think if the patches didn't work, is you started with the wrong version of the binary (e.g. you did not upgrade the firmware first).

[kr5j]

Whew! Found a copy of A.06.25 FW, put it on a CF card and installed it and the unit is back to original performance. So the patches did not appear to work for me. I went back and installed just the license one but no new options appeared. If I do the GPS one, unit appears normal but if I try to go to the GPS adjustment screen, it hangs. But I did see the GPS icon go green at one point! I was using the date command to set the time/date and maybe that got it to go green but as soon as the FW changed the time it went yellow. the saga continues...

[technogeeky]

Whew! Found a copy of A.06.25 FW, put it on a CF card and installed it and the unit is back to original performance. So the patches did not appear to work for me. I went back and installed just the license one but no new options appeared. If I do the GPS one, unit appears normal but if I try to go to the GPS adjustment screen, it hangs. But I did see the GPS icon go green at one point! I was using the date command to set the time/date and maybe that got it to go green but as soon as the FW changed the time it went yellow. the saga continues...

Let's focus on one thing at a time.

Remember, for the license hack, you have to also modify the license file for each license you wish to add. The trick that the patch provides is that the key isn't ever read, so it doesn't need to be valid. Perhaps you are not doing this step.


Once you have done the GPS patch, you do not want to be setting the date/time manually. The date/time will be set properly by the GPS. At the very least, you can use the web interface to set the date/time once, using the date/time of the PC you are browsing to it from. If you ever have the green circle, then you are in a state where you can do the timebase calibration. Note you probably want to have the unit on for some 30 minutes plus, and you want to make sure you have at least 5 or 6 satellites locked.

[ke6iyc]

@kr5j

You also need to "install" the options, done on the unit itself.

They do not automatically appear...

Brian

[kr5j]

I started with A.06.25 FW then did the GPS patch. I rebooted and the GPS patch appears to have worked, now the GPS info has the current UTC time. Also the GPS icon turns green! Then I did the license patch and it appears to have worked but cannot access the screen to see installed options. Also cannot get to the GPS adjustment screen. The problem that is once the unit boots up, I select System then press More 2 of 2 to get to Page 2. Unit takes a few seconds then all the button labels on the left side of the screen disappear. Unit stays in this condition and does not respond to any button presses. I have to reboot to get the unit operational again. Why would either patch affect it this way?

[DogP]

I had that same problem: https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg1053888/#msg1053888 .  You need to modify the /flash/egServer/license/elgato.lic file and add a SIGN value (like SIGN=000000000000 ) to any that don't already have a SIGN.

Pat

[ve7xen]

So this is quite odd, since Linux itself has no trouble with the current date, but the egServer process seems to be rolling it over zero to 'less than the minimum'. I guess egServer must be internally representing the time in a nonstandard way. Maybe just patching the comparison would make it work again?

No. What we see here is "GPS week rollover" problem.
http://www.npl.co.uk/reference/faqs/when-and-what-is-the-gps-week-rollover-problem-(faq-time)
The message doesn't show the time which is "less than minimum". I verified that it's current time minus 1024 weeks.
So GPS subsystem adjusts system clock and then it's immediately reset to "minimum time".

Curious, because rollover last happened in 1999 and doesn't happen again until 2019. The instrument was released sometime around 2002-3. So I kind of thought of that but wrote it off as something else. It's definitely this though, probably the firmware is checking some arbitrary date in the past to decide what GPS epoch it is in, and how many weeks to add. We went past that boundary date, so it think it's pre-1999 again. If anyone's curious, the disassembly of the patched region is:

Code: [Select]

old
---
0x2122880: 4b 25 85 e2   r2 = r5 + 314572800                                                                                                                                                                   
0x2122884: 15 28 82 e2   r2 = r2 + 1376256
0x2122888: f6 2d 82 e2   r2 = r2 + 15744

new
---
0x2122880: de 25 85 e2   r2 = r5 + 931135488                                                                                                                                                                   
0x2122884: 3f 28 82 e2   r2 = r2 + 4128768
0x2122888: f6 2d 82 e2   r2 = r2 + 15744

Which adds exactly 1024 weeks to the constant.

Nice work on the patch and thanks! I couldn't crack it.

[kr5j]

I copied the legato.lic file to mnt but it does not appear on the CF card. There were also 2 screen shots in the mnt folder and they are not on the CF card. I did a screenshot and when I opened the CF card on my PC the screenshot was there but nothing else. How do I put the legato.lic file on the CF card? I tried the mount /devf/hdc1/ /mnt command and it said it failed: not a directory.

[DogP]

You should use the command "mount /dev/hda1 /mnt" (no trailing slash after hda1).  On my box the CF is hda, not hdc... but if for some reason yours is hdc, then use that.  And I assume "legato.lic" and "/devf/" are just typos in your reply (should be "elgato.lic" and "/dev/" respectively).

Pat

[kr5j]

Yep the fat finger of fate struck. What are the commands to copy the license file to the CF card and then the modified file back? I think my CF card is hda1. Here is what I get with a df -h command:

[root@E749xx /]$df -h

Filesystem                Size      Used Available Use% Mounted on
rootfs                    7.7M      6.1M      1.2M  83% /
/dev/root                 7.7M      6.1M      1.2M  83% /
/dev/mtdb3               60.0M     21.6M     38.4M  36% /flash

But none of these is the CF card inserted, since it is a 500 MB card. Not sure what the disks listed are.

If I press the Media Manager button from System, it shows the CF card format button highlighted indicating it is recognized by the system.

[technogeeky]

Yep the fat finger of fate struck. What are the commands to copy the license file to the CF card and then the modified file back? I think my CF card is hda1. Here is what I get with a df -h command:

[root@E749xx /]$df -h

Filesystem                Size      Used Available Use% Mounted on
rootfs                    7.7M      6.1M      1.2M  83% /
/dev/root                 7.7M      6.1M      1.2M  83% /
/dev/mtdb3               60.0M     21.6M     38.4M  36% /flash

But none of these is the CF card inserted, since it is a 500 MB card. Not sure what the disks listed are.

If I press the Media Manager button from System, it shows the CF card format button highlighted indicating it is recognized by the system.

kr5j:


File Locations (first the ones you need, second some interesting locations):

• /dev/hda is, for me, the PCMCIA card's device file.
• /dev/hda1 is, for me, the PCMCIA card's first (and only) partition.^[a]
• /flash/mnt/pcmcia is the directory where the Agilent mounts and then stores screenshots and data.
• /flash/egServer/elgato is the elgato (transponder server) binary. This is where the binary patching happens.
• /flash/egServer/license/elgato.lic is the file where the license information is stored.
• /flash/linux are all of the extra files that Agilent includes, on top of BusyBox (which is a barebones set of Linux commands). ^[2]

As far as the elgato file goes, the following sha256 hashes should tell you if you have the same file or not. Copied from sha256sum command^[c]:

• 8f4bfc453ed7aa871bba7ea2301bb29280466c36f78f703302b5348ec44612f0  elgato.original
• 5a857ab04ce60f4a149682299bbd860649f36478e29e4693870a8624a4eafad7  elgato.nokeys
• ec57d11b6151795ba2c6f6979cb789622dc24c263fef70ca4791780f4525e771  elgato (nokeys and clock patch)

Tips:

df reports results for each mounted disk. Until you do something with the GUI that will cause a write to the disk (try to save file, save data, or format PCMCIA), the unit won't even mount it. You can manually mount the disk, in its proper location, by typing:

mount /dev/hda1 /flash/mnt/pcmcia

Then, you can browse to /flash/mnt/pcmcia to read (or copy) files you stored on the device. Picture and data saves will now also work (assuming the device can read your partition).


^[a]: Again, for me, I formatted it as ext3. You can use fat16, I think. I am not sure about fat32.
^[2]: Notice they have their own copy of ps, grep. They also have some custom scripts like elgatosleep, diagServer, enable_matrix_kb. And then some are just configuration files, like the files in /etc. do "find ." in /flash/linux to see this stuff.
^[c]: Since sha256sum isn't included in BusyBox or agilent's files, then you'll have to do this on your desktop or whatever.

[kr5j]

I edited the license file with VI and now have all options. Still not clear on how to copy a file to the CF card but will pursue it.
Thanks for the help. So now my E7495A has a green GPS indicator and all options.

[PA0PBZ]

I edited the license file with VI and now have all options.

Just for the record, there is no need to edit the license file if you can't work it out. You can use the built in menu to add licenses, just use anything you like for the license key.

[technogeeky]

I edited the license file with VI and now have all options. Still not clear on how to copy a file to the CF card but will pursue it.
Thanks for the help. So now my E7495A has a green GPS indicator and all options.

If you are using the CF card, insert it, then, for instance to copy the elgato binary:

Code: [Select]

mount /dev/hda1 /flash/mnt/cf
cp /flash/egServer/elgato /flash/mnt/cf

If you are using a (CF or SD) to PCMCIA adapter:

Code: [Select]

mount /dev/hda1 /flash/mnt/pcmcia
cp /flash/egServer/elgato /flash/mnt/pcmcia


Note that it might be /dev/hda2.

[kr5j]

Ah it was that easy to do! But I had more fun using VI editor

[technogeeky]

Has anyone made any progress on unlocking whatever potential might be in the CW source (or the modulated version, 510)?

I'd really like to learn if there is potential to extend the frequency range of the output downward. 100kHz would be nice, but even 10 MHz would do just fine.

Has anyone ever opened up the CW/mod and taken a guess at what the restriction actually is? I still haven't had the time or courage to open up my E7495a, but I would be happy to do so if it would help someone figure out a starting point to getting lower frequency output.

[kr5j]

How to enable the demod option??

[kirill_ka]

How to enable the demod option??

There's no such option. E7495 demodulation options are limited to cellular phone stuff.

[TheSteve]

The N1996A supports AM/FM demod though - so you never know if it can be enabled on the E7495.

[PA0PBZ]

The option code for the N1996A is AFM so if you have a liberated E7495 just give it a try.

[kirill_ka]

The N1996A supports AM/FM demod though - so you never know if it can be enabled on the E7495.

How do you know that I never know?
toroServer/Dragonfly/Measurements/KernelBasic/Superfly/Am*
toroServer/Dragonfly/Measurements/KernelBasic/Superfly/Fm*
toroServer/Dragonfly/Measurements/KernelBasic/Superfly/am.txt
toroServer/Dragonfly/Measurements/KernelBasic/Superfly/fm.txt
That DSP stuff looks like AM/FM demodulation code for N1996A, doesn't it?
It's not present in egServer. And adding functionality is not just a matter of copying missing files.

[technogeeky]

I wanted to bring to attention what I believe is an example of drifting or failing calibration. In a specific sense, none of this matters (because you are probably going to normalize, which makes the measurement you make relative to the problematic measurement below). It's still interesting, and I'd love to hear speculation on why this is happening. I can make further measurements (such as using a different spectrum analyzer to view the output, or a SDR).

The following will tell you the default settings after preset, then show which one or two things to change from the previous. For all tests, the only connection is a 0.5 meter Agilent N-to-N cable.

Two Port Insertion Loss (default settings)

* 375 MHz - 2.5 GHz
* Source Lev Auto (10 dBm)
* Optimize Accy

So when we go to a preset configuration, we have a sudden downward jump at 1 GHz. In addition, the average insertion loss is genuinely lower than it should be. Substituting a different cable has no effect:



If we pick a manual output level, then we can cut down on this effect...

* 375 MHz - 2.5 GHz
* Source Lev Manual (0 dBm)
* Optimize Accy


And if we keep reducing the output level, we can eventually make this jump very small:

* 375 MHz - 2.5 GHz
* Source Lev Manual (-10 dBm)
* Optimize Accy


If we change to "Range" mode, this sharp jump effect totally disappears but the insertion loss offset does not change.

* 375 MHz - 2.5 GHz
* Source Lev Auto (10 dBm)
* Optimize Range


Likewise, if we change to Manual source level and change it to - 10dBm, we get a more or less correct measurement of insertion loss:

* 375 MHz - 2.5 GHz
* Source Lev Manual [/b](-10 dBm)[/b]
* Optimize Range


In case you think this is an effect which shows up only when you have a large span, it's exactly the same up close:

* 999 MHz - 1001 MHz
* Source Lev Auto (10 dBm)
* Optimize Range
* Source Lev




Any thoughts, guesses, or further tests would be appreciated. I have SDRs which I can use to monitor the output from the CW/generator. I can use another spectrum analyzer to view the output. I think I've done this, and I didn't see any sudden jumps at 1GHz exactly. Likewise, when I use another signal generator into this spectrum analyzer (E7495a), I similarly do not see any sudden jump. So this leads me to believe that this effect is from some sort of calibration table that the unit stores for the Two Port Insertion measurement mode specifically.

It's worth noting, too, that the procedure for this originally calls for using a two 10dB attenuators (back to back) on the RF out port. Using an attenuator set  does, of course, reduce this effect but it's still noticeable.

[ferdinandkeil]

I wanted to bring to attention what I believe is an example of drifting or failing calibration. In a specific sense, none of this matters (because you are probably going to normalize, which makes the measurement you make relative to the problematic measurement below). It's still interesting, and I'd love to hear speculation on why this is happening. I can make further measurements (such as using a different spectrum analyzer to view the output, or a SDR).

The following will tell you the default settings after preset, then show which one or two things to change from the previous. For all tests, the only connection is a 0.5 meter Agilent N-to-N cable.


...

Any thoughts, guesses, or further tests would be appreciated. I have SDRs which I can use to monitor the output from the CW/generator. I can use another spectrum analyzer to view the output. I think I've done this, and I didn't see any sudden jumps at 1GHz exactly. Likewise, when I use another signal generator into this spectrum analyzer (E7495a), I similarly do not see any sudden jump. So this leads me to believe that this effect is from some sort of calibration table that the unit stores for the Two Port Insertion measurement mode specifically.

It's worth noting, too, that the procedure for this originally calls for using a two 10dB attenuators (back to back) on the RF out port. Using an attenuator set  does, of course, reduce this effect but it's still noticeable.

I can verify this effect with my E7495B. But this is not erroneous behavior: it is caused by the preamp not spanning the complete frequency range (see https://www.eevblog.com/forum/testgear/agilent-e7495-linux-root-account/msg621126/#msg621126).

When do the test with a short cable (RG316) and a 20dB attenuator, the insertion loss measurement is flat to within 2dB. After normalization I get a nice straight line across the whole frequency range. The insertion-loss measurement is probably designed for longer cable runs with significant loss. This would explain the use of the 20dB attenuation when normalizing. So if your cable is quite short and has negligible attenuation the preamp is saturating, thus giving you wrong results.