Agilent E7495 linux root account

[9aplus]

TNX, must try next week on Win10   

[m6sso]

Not sure if issue on my end but with the remote client I cant use any of the right side buttons.

[pieroc91]

Only one client at the time can control the device and the device itself counts as a client.

To claim control over the device (the right side buttons) you have to press the ESC/LOC button on the app, to recover control on the device press the ESC/Lcl button on the device

The devices that cannon control the buttons will show a Remote text on top of the analizer windows

[ua4yhz]

Hi all,

I have an E7495A that I purchased a few years ago off of eBay used that I've used successfully for one- and two-port measurements, distance to fault, and as a general spectrum analyzer. It has come in very handy for all of these functions. I decided recently to extend its functionality by purchasing a power probe, the Agilent 8481H (-10 to +35dBm), from eBay. The seller claimed that it was working, and seems reputable, however, after running the 'zero' and 'calibrate' functions, this power sensor reads around -19dBm with the power reference turned on (and the sensor hooked directly to the power reference output). From reading the manual, I believe it should read 0dBm (1mW @ 50 Hz is the rated output). It does read very low with the power reference turned off (about -40dBm).

For lack of any other useful instrumentation, I tried measuring the power output using an RTL-SDR and about 39dB of attenuators chained together. The RTL-SDR showed -28.94dB of input power (appearing as a peak at around 50 MHz), which gives +10.09dBm coming out of the '7495A... or 10mW instead of 1mW (a ten-fold increase).

I did do a continuity check of the probe cable, and it seems OK.

For lack of instrumentation to check with (I do not have another power meter or probe), I'd like to check the power sensor reading using not the power reference port, but the E7495A's built in generator (if possible). I am able to telnet into the instrument (thanks to info on this thread). I have seen some of the Java GUI reversing bits on this thread as well, so I was curious to try to find out if there is a back-door way of commanding the power reference on while the spectrum analyzer is running, or likewise turning the generator on when the power meter application is running.

To that end, I found this bit in PowerMeterScreen.class:

Code: [Select]

  MenuItem createPowerRefButton()
  {
    return new MultiStateActuatorButton(PowerMeterMeasurementSettings.instance().getPmRef(), getContextString("powerMeterCalibrate.powerRef"));
  }


If I dig into MultiStateActuatorButton, I can see that the first argument to the constructor is a 'ListActuator' that the MultiStateActuatorButton uses to "do the thing" when the button is pressed:

Code: [Select]

  public MultiStateActuatorButton(ListActuator paramListActuator, String paramString)
  {
    super(paramListActuator.getLabel(), paramString);
    this._actuator = paramListActuator;
    addActionListener(this);
  }
 
  public void actionPerformed(ActionEvent paramActionEvent)
  {
    if (!isFocused()) {
      getMenuPanel().focusButton(this);
    }
    this._actuator.increment();                  <<< The magic
    repaint();
  }


Skipping some in-between stuff, the getPmRef() method returns this:

Code: [Select]

private ListActuator _pmRef = new ListActuator("pwrMeter", "pmRef", Text.SCREEN_POWER_POWER_REF, new Value[] { Value.createValue(Text.ON, 1), Value.createValue(Text.OFF, 0) });


where the ListActuator constructor takes these args:

Code: [Select]

String paramString1, String paramString2, String paramString3, Value[] paramArrayOfValue


I got kind of lost reading through ListActuator, but it looks like ListActuator ultimately sends a command to the elgato server with the send() method of the WebPlugConversion() class.

It looks like WebPlugConversion then uses the Command() class to build a string that it sends:

Code: [Select]

  public static Command makeSetCommand(String paramString)
  {
    Command localCommand = new Command("set");
    if (!paramString.equals("global")) {
      localCommand.addProperty("topic", paramString);
    }
    return localCommand;
  }


I likewise got a little lost trying to figure out what the final command string ends up looking like. However, after digging through this thread some more, I came across reply #126, where user DogP shared some observations:

I also took a look at the remote GUI... [... snip ...]

I was interested in how it communicated, so I sniffed the packets.  It looks like most stuff goes over port 5028.  The commands and acknowledgements go over TCP, and the spectrum display data goes over UDP.  It looks like there’s some status (power, GPS, etc) coming out 1027 as well.

[... snip ...]

The commands going over 5028 don't look to be any standard I'm familiar with.  Some examples are (without the quotes, <\n> is hex 0A): “cmd: local<\n><\n>”, "cmd: set<\n>topic: display.global<\n>printFilter: 0<\n><\n>", etc.  If you dig through the elgato binary, you can see a bunch of available commands (and you can test them out using nc).

Armed with this information (namely, what port to look at), I found that if you telnet into port 5028, pressing buttons on the front panel has the effect of the system echoing on that port these commands. So, if I turn the power meter on through the front panel, I see:

Code: [Select]

cmd: set
topic: pwrMeter
pmRef: 0


get printed to the terminal.

I am able to make the ‘get’ commands work: if I type (for example)

Code: [Select]

cmd: get
topic: spectrum
cf:


the instrument responds with:

Code: [Select]

cmd: set
topic: spectrum
cf: 1955000


However, I can’t seem to get ‘set’ commands to work—attempting to change any parameter causes the instrument to do… nothing.

The only command other than ‘get’ that works is ‘cmd: closeGui’, which causes the connection to be closed by the host (instrument). I’ll note that when I first connect to this port, the instrument prints:

Code: [Select]

cmd: remote

cmd: setActive
meas:

cmd: notifyEvent
event: startupComplete


I was hoping to use Wireshark to capture commands sent by the Java GUI running on my PC, but I can’t seem to get the GUI to work quite 100%. It starts (in a very old Debian Squeeze VM running in a Windows host by way of VirtualBox), but hangs at “Please wait while the measurement is loading…”. It does work insofar as the GUI running on my PC does show the correct instrument mode (i.e., main menu, spectrum analyzer, power meter, etc.). User DogP’s aforementioned post did mention

[…] the remote GUI […] didn't seem to work on Windows with Java 8 (even using the commands further up in the thread).  Rather than dig into it, I installed Java 1.4.2 in a VM, grabbed the jre directory, and explicitly ran RemoteGui.jar using that version of java ("jre\bin\java -jar RemoteGui.jar").  [...] It looks like most stuff goes over port 5028.  The commands and acknowledgements go over TCP, and the spectrum display data goes over UDP. […]

I had to make sure Windows allowed the data through the firewall (without it, the TCP commands would go through, but the UDP data wouldn’t, so the GUI would never show the spectrum).  Also, Windows 7 temporarily goes back to basic graphics (disabling Aero) when you run Java 1.4.2.

I tried installing JRE 1.4.2_20, but invoking the application with the command line given earlier in this thread failed with

Code: [Select]

Exception in thread "main" java.lang.NoClassDefFoundError: elgato/gui/MainWindow


I found that this works instead, though:

Code: [Select]

java.exe -Dserver=192.168.1.186 -DlocalAddress=192.168.1.1 -classpath "./*" elgato.gui.MainWindow


However, clicking around in the Java GUI doesn't do anything. I did try copying over the RemoteGUI.jar file, but this causes its own problems. I am able to change the spectrum analyzer center frequency by pressing the 'up' and 'down' arrows on my computer, and I can sniff out the 'cmd: set' command that are being sent when I do this in Wireshark.

I'll note also that my instrument has a significantly newer version of SW than what's available for download from Keysight's site (A.06.00, from 2006, instead of A.01.60, from 2003).

Anyway, I thought I'd share that progress, and ask a few questions:

• Does anyone know why the power ref output might be generating 10mW instead of 1mW?
• Does anyone already know of a back-door way of doing what I'm trying to accomplish?
• Any ideas why the instrument doesn't like my 'cmd: set' commands?

My power sensor HP8481H also showed -20 dBm, but the power is measured correctly. However, I have long since replaced the E7495A with the GenComm GC746A

I'm sorry, I remembered. With the HP8481H sensor, your device should show 20 dB less. Set the offset to 20 dB and the readings will be correct. This is due to the structure of the sensor itself.

[Velund]

Quick question to gurus.

Does options 500 (CW Gen) and/or 510 (CW gen with CDMA) require some additional hardware or it is just a software option? Here is local offer for 7495B unit with bunch of cables, OSL cal kit, high power 40 dB attenuator (is it really 100W?) and some filter with 2 N-type connectors. Unit does not have 500 or 510 options though. 

[Wallace Gasiewicz]

Velund:

The Attenuator that came with mine is JFW Model 50FH-040-100-3N      40 dB
It is indeed a 100 Watt attenuator.

The filter that came with mine is a 1930-1990 MHz band pass filter, so of limited usefulness.

Unless you want to spend a lot of time maintaining this unit, I would not recommend it.

I cannot see your "local offer" so I do not know it a power sensor is included. They are expensive and easy to break.

Wally

[Velund]

Unless you want to spend a lot of time maintaining this unit, I would not recommend it.

What kind of maintenance this unit require? Will it take more time than "maintaining" GF? 

And no, there is no power sensor head in the offered set, it was sold separately with sensor cable.

The only thing I really worry about - is missing option 500. I suspect that it is will need just software hack to enable, but wish to be sure before purchasing.

[Wallace Gasiewicz]

I had to modify and re install  software to get the GPS to work.
The batteries are a problem and the unit needs frequent recharge even at rest. The rubber around the screen creeps and needs to be fixed, You have to disassemble the thing to do this.
There is no documentation I can find for schematics to fix any problem. There is poor documentation in general. For example: can you find if the freq gen is software or hardware? I guess not.
I really do not remember if it is hardware or not.
Even if you have the freq gen it STARTS at 375 MHz no lower freq available.
GPS disciplining of the frequency standard is not very good, IMHO. No where near a separate GPSDO
Try to read the entire thread to see what problems people have had. Notice the amount of computer code they are talking about.
Depending on what you are going to do with it, there are much better choices, especially if you are going to use it for working on HF radios.
You are not getting the power sensor so....
So essentially you are getting a spectrum analyzer. Minimum span is 1 KHz which is not bad for a service monitor.
I betcha you can get a spectrum analyzer with a tracking generator that meets your needs for whatever the unit is going for. You haven't quoted a price.
The only real advantages to the unit that comes to mind is to actually receive weak signals over the air to look for spurious signals and interference, that is if the antenna is included.
And some antenna analysis. Screen is pretty also.

[Velund]

Got it...

Not a problem for me in a most of points. This will be not the only SA in the shack, and not even second one. I have HP8920A with SA/TG and R&S CMU200 (both bought faulty and restored), so I have no problems with signal generator, power meter and SA coverage while working at workbench.  E7495 looks like good extension of TG capability and SWR measurement over 1 GHz, plus TDR functionality. And it is portable, that is a big plus.

Yes, I know about typical problems with screen, and prepared to recharge batteries and store them separately if unit is not used for some time. And price is relatively good, comparable with current eBay offers if overseas shipping is taken into account.   

[Wallace Gasiewicz]

The only way I was able to update the GPS date was to change the date on a PCMCIA card that contained the entire program  for the unit and update the unit.
If you have trouble with the GPS I can send you a copy, you need a PCMCIA card though. 64 MB is the one I have.
It is pretty simple if you have a card and a computer that can use it.

[technogeeky]

Got it...

Not a problem for me in a most of points. This will be not the only SA in the shack, and not even second one. I have HP8920A with SA/TG and R&S CMU200 (both bought faulty and restored), so I have no problems with signal generator, power meter and SA coverage while working at workbench.  E7495 looks like good extension of TG capability and SWR measurement over 1 GHz, plus TDR functionality. And it is portable, that is a big plus.

Yes, I know about typical problems with screen, and prepared to recharge batteries and store them separately if unit is not used for some time. And price is relatively good, comparable with current eBay offers if overseas shipping is taken into account.

I think the device is worth the roughly $300 shipped I paid for it. $1000 shipped (what I see on ebay now), not so much. Mine did not come with any attenuator or calibration kits or power sensors. Just the unit, the bag, two cables.

It's worth keeping in mind that the 375MHz minimum TG output imposes a hard limitation on the efficacy of the TDR function. If the cable is lossy or if it's short enough (or both) then you just get garbage output.

I remember trying to debug some bnc balun-coax- bnc balun wire (which was used for CCTV cameras, which have an expected bandwidth of 6MHz or so) and being unable to make good measurements for this reason. It's an extreme example, but it's worth keeping in mind that the 375MHz lower bandwidth on this instrument is a limitation that has multiple impacts.


Also, yes, I think the GPS receiver in this unit is (relatively speaking) not good. I originally hoped to use it as a GPSDO but even with wide open skies it loses lock somewhat randomly and if there are even minor obstructions you will get maybe 2 satellites intermittently.


I have also not gotten any other of the features to work to decode e.g. CDMA over air or directly out of a phone or actual base station or something. I don't really understand how it works or if my setups were correct, but to me all of those applications are essentially useless.

Lastly: I am not 100% sure but I think if the unit you are looking at has the two ports populated (RF 1 and RF2) then it should be software hackable to get the TG enabled. I have not ever seen a unit without the ports populated.

[Michael-VK2BEA]

I know this is an old thread but ...   when the term 'telnet' is used here, is this correct?  Telnet implies an IP connection (IP address and port) and AFAIK there is no Ethernet on this device. Does this actually refer to a terminal program (e.g. minicom) connecting to the serial port?

thanks,
   Michael

[DogP]

There is an Ethernet port... it's on the left side behind a flip-down door, next to a CompactFlash card slot, USB ports, etc.  So yes, you're actually using telnet.  A web interface is also available over Ethernet.

DogP

[Michael-VK2BEA]

Doh! Yes I see it!

[imaurente]

Hey guys! I recently got an E7495B but this one has an error, it doesn't fully load the software, I accessed it via RS232 and found that the kernel is apparently ok, however it doesn't finish loading the rest of the system.
I would very much like to recover this unit, it will be very useful for my studies and essays.

Hug!

[mil4898]

Hello Guys,

I know that I am late to the party , but I just acquired a E7495 that does not boot , and would like to get it going if at all possible.
The symptoms are , black screen which flickers a couple of times after the power button is pressed , and that is all .
I have tried to download the service manual and last firmware from page 4 , but the web server is not responding.
Could someone please re-share those files, I would be very grateful.
Best regards
Mil

[ve7xen]

My mirror also posted on page 4 is still up. Does it have what you're looking for?

https://www.gotroot.ca/e7495/

[mil4898]

@ve7xen Much thanks ,

Very grateful for the files .

I have made up a serial cable and can see the boot messages .
I am getting past the memory tests ok , then there is a jump to an address , and after that I have “prefetch abort” message that seems to be looping .
I am thinking about doing a flash recovery using the downloaded firmware file , and just need to get a pcmcia adapter for the compact flash card .
Best Regards
Mil

[GRFixedGear]

Sorry for the other people I spammed with PM's looking for these files. I need to read all the way to the end I guess. 

I really appreciate the change log as well. What is really really curious is that as best I can tell, my unit has a BETA firmware version on it, that correlates to none of these released versions. The good news is my unit came with PCMCIA card with the firmware on it, so if I only had a reader for that stupid card then I could archive that potentially diff it with the latest and gain some insights.

I will followup with the details of what I have later, but I know it is quite different than the latest because the prescribed patch for the GPS problem does not match my binary file on the unit. Not just by address... a search for the first 2 bytes specified in that patch show one promising match, but the remaining bytes do not match at all.

Thanks to all those who have contributed to this over the years. Its a fantastic resource!

[GRFixedGear]

Here is the data returned from the web page (newly liberated after deleting the related web interface password file):
Product Name:   Agilent Technologies Embedded Ethernet Controller
Serial Number:   0000A00000
Firmware Revision:   B.04.20 Arms Beta 1 Build 1
Hardware Name:   elgato
Build Info 1:   060217
Build Info 2:   @(#)Linked: Feb 17 2006 13:23:20
Build Info 3:   @(#)By: stevbell
Ethernet MAC Address:   000102030405

And what is in the version.txt file:
A.04.00 Dev 14

As you can see by the nomenclature and dates, this doesnt appear to be running on released sw at this point. Looking forward to what this thing does after the upgrade to 6.25

[GRFixedGear]

Regarding the screen protector adhesive... mine came off with IPA and some mild elbow grease. No negative impact on the plastic or the glass/stainless of the screen itself. Planning to replace the adhesive with firm vhb tape 1/8" wide since I measure the old crap at 0.5mm after removal which makes the claimed 0.63mm of that tape variety seem just about perfect.

Aside from fixing that sagging adhesive on the screen it seems I need to get into the guts of mine. It shut down yesterday connected to a ac adapter and now even though it will restart the power consumption is higher and the unit has a magic smoke smell to it. Lost a tantalum like Signal Path did, maybe?

[GRFixedGear]

Ouch....
Backside of the primary power board....

[GRFixedGear]

I don't have tantalums to use in that spot, but replaced with 2 1206 X7R 10uF 35V ceramics since they run at 24V and I'm trying to counteract the cap loss at that bias voltage. Putting it all back together.

[Wallace Gasiewicz]

About PCMCIA Card Readers....... 

Old Win 7 Dell Latitude E 6410 has slot.  I bought one for $50 just for this feature.   

I also use it for my EPROM stuff.
It also has Telnet  (which did not help with the 7495), you can Telnet in but you cannot accomplish the change necessary.

[GRFixedGear]

CF worked fine for me. Got a type 2 adapter for an sd card, partitioned a 64GB microSD card for 2GB to make the ancient firmware happy on the device. Put in the upgrade files, popped it in and found my uncle bob.

Working on the patches... GPS patch works a treat, but the published patches for the license file didnt work for me first time. I got a unit that was non-responsive to button pushes, and even lost the soft-key labels / images on the screen when I tried it. Not quite sure how that happened. MAYBE it was just a glitch in the firmware storage in that case. I'll give it another go and see what happens. Worst thing that happens is I remote login and ftp the file back up to my linux box to compare intended contents vs actual in the flash of the 7495a

I've used Ghidra to decompile the elgato binary to understand the patch being applied to the file offset of 0x337a7c appears to be correct. It shows up in a function called "l_good_lic_key". As you can imagine that's  a rather long nested function and not very much fun to read in the assembly or decompiled presentation from Ghidra. The instruction being modified is effectively the first branch in the function, but the suggested edit turns it into a mov/cpy operation from r0 to r0... effectively a nop?! Then the two instructions that follow (seems to have been unused previously so its curious that they are even there) hard codes a 1 return value and jumps to the return at the end of the function. Skips all the gory details in the middle. Genius