Reward $50 for HP/Agilent E4916A Upgrade/Firmware/Software

[gamalot]

For the options, what about those small switches at the top and bottom of your picture?
You could check where they connect to and try the different positions, only 256 combinations to do 

Best regards

The service manual says there are no jumpers or switches that depend on any options.

[free_electron]

I think I should be able to read the flash memory directly... But I like the path of trying to find the commands for upgrading the unit through GPIB itself. But even then, the actual code would need to be discovered which is a function of the serial number...

since this is the same lineage of the LCR bridge most likely it is simply a flag in the flash. you don't need the code or the key generation , simply set the flag.
in the lcr bridge there is no "key check" , only a flag check.

[Hugoneus]

First step would be to get the Flash from the instrument.

I’ll try it.

[Aiy]

Hello,
I've had a look around the archive.org "ftp site boneyard" filelistings for ftp.keysight.com 2015-04-04
https://archive.org/download/ftp.keysight.com/
https://ia600504.us.archive.org/28/items/ftp.keysight.com/2015.03.ftp.keysight.com.tar.txt

And ftp.agilent.com 2014-06-15
https://archive.org/download/ftp.agilent.com
https://archive.org/download/ftp.agilent.com/2014.06.ftp.agilent.com.tar.txt

searching for "E4915_16.exe" mentioned in the service manual, as well as other keywords I could think of. No luck.

The archives are >2010 so about ten years too recent

Best regards,

[Hugoneus]

Hello,
I've had a look around the archive.org "ftp site boneyard" filelistings for ftp.keysight.com 2015-04-04
https://archive.org/download/ftp.keysight.com/
https://ia600504.us.archive.org/28/items/ftp.keysight.com/2015.03.ftp.keysight.com.tar.txt

And ftp.agilent.com 2014-06-15
https://archive.org/download/ftp.agilent.com
https://archive.org/download/ftp.agilent.com/2014.06.ftp.agilent.com.tar.txt

searching for "E4915_16.exe" mentioned in the service manual, as well as other keywords I could think of. No luck.

The archives are >2010 so about ten years too recent

Best regards,

Thank you for trying... Still no luck.

[free_electron]

i have an older archive from the FTP site when they still were HP. found the harddisk yesterday. will check.

[Hugoneus]

i have an older archive from the FTP site when they still were HP. found the harddisk yesterday. will check.

Thanks!

[vaualbus]

Could you put that too on archive.org is a too bad job to upload what I imagine is a big HDD of data?

[Miek]

Could you try querying ":TEST:INSTR:INFO:DATA?" over GPIB and see what comes back?

[gamalot]

Could you try querying ":TEST:INSTR:INFO:DATA?" over GPIB and see what comes back?

Here is mine, nothing but the model number, serial number, and zeros.

[Miek]

Excellent, thanks, that's the result I was hoping for

In theory, you should be able to send back ":TEST:INSTR:INFO:DATA E4916A,JP1KD00868,010,000,000,000" (ie: just swapping the first 000 to 010) to enable the LCR option.

A few caveats:
I'm basing this on reverse engineering the v2.13 firmware linked above. It's unlikely, but your version could behave differently.
The firmware does a bunch of checks on the string sent to verify the option strings, however it does let you overwrite the model (to either "E4916A" or "E4915A") and the serial number so type carefully.
There could be side effects I haven't noticed, so it's probably best to have a backup of any flash in there for minimal risk.

[gamalot]

Excellent, thanks, that's the result I was hoping for

In theory, you should be able to send back ":TEST:INSTR:INFO:DATA E4916A,JP1KD00868,010,000,000,000" (ie: just swapping the first 000 to 010) to enable the LCR option.

A few caveats:
I'm basing this on reverse engineering the v2.13 firmware linked above. It's unlikely, but your version could behave differently.
The firmware does a bunch of checks on the string sent to verify the option strings, however it does let you overwrite the model (to either "E4916A" or "E4915A") and the serial number so type carefully.
There could be side effects I haven't noticed, so it's probably best to have a backup of any flash in there for minimal risk.

Thank you very much!

Looks like this command doesn't work here, it beeps and shows "GPIB ERROR: -148" every time I send it to my E4916A.

[Miek]

Hmm, I guess the value might need to be in quotes, so:

Code: [Select]

:TEST:INSTR:INFO:DATA "E4916A,JP1KD00868,010,000,000,000"

[gamalot]

Hmm, I guess the value might need to be in quotes, so:

Code: [Select]

:TEST:INSTR:INFO:DATA "E4916A,JP1KD00868,010,000,000,000"

I tried adding quotes after the first failure, unfortunately it didn't work and caused "-102 Syntax error". 

[Miek]

I tried adding quotes after the first failure, unfortunately it didn't work and caused "-102 Syntax error". 

Ah, OK, thanks for trying it.
I had a closer look and it seems to be treating them all as separate arguments, so quoting each individually might work:

Code: [Select]

:TEST:INSTR:INFO:DATA "E4916A","JP1KD00868","010","000","000","000"

[gamalot]

I tried adding quotes after the first failure, unfortunately it didn't work and caused "-102 Syntax error". 

Ah, OK, thanks for trying it.
I had a closer look and it seems to be treating them all as separate arguments, so quoting each individually might work:

Code: [Select]

:TEST:INSTR:INFO:DATA "E4916A","JP1KD00868","010","000","000","000"

THANK YOU !!! IT WORKS!!!

[Miek]

Nice! Glad I could help

[picburner]

Well done! Now all that remains is to be able to update to firmware Rev.02.13

[TheSteve]

Nice! Glad I could help

Absolutely fantastic work!

[RolandK]

This is really great. Just tried the command on a 4263b to get options 001 and 002, but it doesn't seem to work.

The 4263b has the hex-code read out in this thread: https://www.eevblog.com/forum/testgear/i_ve-got-a-hacking-challenge-for-you-guys!/

There they just copy the content of the eeprom to get the options, but overwrite the serial number.

@Miek: what did you use for the reengineering? disassembler?

[Miek]

@Miek: what did you use for the reengineering? disassembler?

Yep, Ghidra specifically.

[Hugoneus]

Thank you everyone! Awesome work.

Someone sent me the commands for enabling the LCR meter but they didn't want a $50. So I donated it instead.