Enabling options for R&S test equipment

[goaty]

For FSH3, I looked into the update file which contains GALAXY.ldf, GALAXY2M.ldf and GALAXY3G.ldf.

Seems there is an easteregg there:

"
Mines left: %d
Time: %3d
Best time: %3d
Lives: %d
Score: %d
HighScore: %d
Waiting for opponent...
Congratulations, you won!!
Ouch, you lost!!
Your fleet
Opponents fleet
Drop bomb...
Watch out for incoming...
Expose a part of one of your ships...
Watch out for incoming...
"

[fisafisa]

HI
I have got an AMIQ waveform generator.
I tried with the options generator but no luck.
Looking at the manual it would seem that the options here are only 8 characters long.
Anybody has an example of option code (together with the serial number)
Maybe it is possible to figure out the algorithm.

Thanks
 

[sky2city]

Hey Guys,

I have a ZVR, SN is 835068/005. and I found the SW sn  \R_S\INSTR\INI\OPTOIN.INI
Is't anyone know how to decode it?

--------------------------------------------------------
4056071223; EMBED DEEMBED
0436723430; TIME DOMAIN
1234299954; CONVERTER 4 CHAN
--------------------------------------------------------

[sky2city]

K4 I don't know. The device I had was too old and didn't support that option. Just try them one after another and you'll probably find it.

Let me try clarify some things  (although I don't know much about this).

The list of options extracted from FSP firmware v4.50 API.DLL is the following:

Code: [Select]

K5     GSM/EDGE Application                 GSM K5 ANALYZER               FSPSpectrumAnalyzerLI   
K7     FM Demodulator                       FM DEMODULATOR                FSPSpectrumAnalyzerLI   
       #1                                   
       #2                                   
K84    1xEV-DO BTS                          1X EV DATA ONLY BTS           FSPSpectrumAnalyzerLI           
K85    1xEV-DO MS                           1X EV DATA ONLY MS            FSPSpectrumAnalyzerLI           
K90      FSQ WLAN 802.11a                   WLAN                          FSQ-Wlan(LI)                   
K72      WCDMA 3GPP FDD BTS                 WCDMA BTS ANALYZER            FSPSpectrumAnalyzerLI           
K74      WCDMA HSDPA BTS                    WCDMA HSDPA BTS               FSPSpectrumAnalyzerLI           
K75      WCDMA HSDPA MS                     WCDMA HSDPA MS                FSPSpectrumAnalyzerLI           
K9     Power Meter                          POWER METER                   FSPSpectrumAnalyzerLI           
K73      WCDMA 3GPP FDD MS                  WCDMA MS ANALYZER             FSPSpectrumAnalyzerLI           
K90      FSP WLAN 802.11a                   FSP WLAN                      FSP_Wlan(LI)                   
K90UP    FSQ WLAN 802.11a,b,g               WLAN UPGRADE                                                 
K76    TD-SCDMA BTS                         TD-SCDMA BTS ANALYZER         FSPSpectrumAnalyzerLI           
K77    TD-SCDMA MS                          TD-SCDMA     MS ANALYZER      FSPSpectrumAnalyzerLI           
K30    Noise Figure                         NOISE MEASURE                 FSx-Noise(LI)                   
K82    CDMA2000 BTS                         CDMA2000 BTS                  FSPSpectrumAnalyzerLI           
K83    CDMA2000 MS                          CDMA2000 MS                   FSPSpectrumAnalyzerLI           
K8     Bluetooth                            BLUETOOTH                     FSPSpectrumAnalyzerLI           
K40    Phase Noise Measurement              PHASE NOISE MEASURE           FSx-PNoise(LI)                 
K70    Vector Signal Analysis               VECTOR SIGNAL ANALYSIS        FSPSpectrumAnalyzerLI           
       #3                                       
K50    Triggered Coverage Meas              TRIGGERED COVERAGE MEAS                                       
K51    Synchronized Stepped Sweep           SYNCHRONIZED FREQ LISTS                                       
       %d days remaining trial period       TRIAL PERIOD 180 HRS                                         
K0     %d days remaining trial period       TRIAL PERIOD 2000 HRS                                         
K91      FSQ WLAN 802.11a,b,g               WLAN ABG                      FSQ-WlanExtension(LI)           
       #5                                   FREQ LIMIT 31 GHZ                                             
B%s    Frequency Extension                  FREQ NO LIMIT                                                 
K92      FSQ 802.16                         FSQ 802_16                    FSQ-Wman(LI)                   
K52    Transducer Set                       REG_TP                                                       
K53    FFT Scan                             FFT SCAN                                                     
K901   %d days remaining trial period       TRIAL PERIOD 2500 HRS                                         
K902   %d days remaining trial period       TRIAL PERIOD 3000 HRS                                         
K92UP    FSQ 802.16e                        FSQ 802_16 UPGRADE                                           
K93      FSQ 802.16e                        FSQ 802_16E                   FSQ-WmanExtension(LI)           
K903   %d days remaining trial period       TRIAL PERIOD 3500 HRS                                         
K904   %d days remaining trial period       TRIAL PERIOD 4000 HRS                                         
K100     LTE FDD Downlink                   LTE FDD DOWNLINK              FSx-LTE FSx-LTE(LI)             
K101     LTE FDD Uplink                     LTE FDD UPLINK                FSx-LTE FSx-LTE(LI)             
B29    Frequency Extension 20Hz             FREQ EXT 20HZ                                                 
K15    Avionics Demodulator                 AVIONICS DEMODULATOR          FSPSpectrumAnalyzerLI           
K91N   FSQ WLAN 802.11n                     WLAN 802 11N UPGRADE          FSQ-Wlan80211n(LI)             
K94    FSQ 802.16e MIMO                     FSQ 802_16 Mimo UPGRADE       FSQ-WmanMimo(LI)               
K102     LTE Downlink MIMO                  LTE DOWNLINK MIMO             FSx-LTE FSx-LTE(LI)             
K103     LTE Uplink MIMO                    LTE UPLINK MIMO               FSx-LTE FSx-LTE(LI)             
K96    OFDM-VSA                             OFDM-VSA                                                     
K74+     WCDMA HSPA+ BTS                    WCDMA HSPA+ BTS                                               
       #4                                             
K400   RFEX-F Launcher                      RFEX-F                                                       
K17    EX IQ Box                            EX IQBOX                      FSx-ExIqBox(LI)                 
K110   TETRA 2                              TETRA2                        FSQ-Tetra2(LI)                 
K10      GSM/EDGE/EDGE Evolution            GSM/EDGE ANALYZER             FSx-Gsm(LI)                     
K73+     WCDMA HSPA+ MS                     WCDMA HSPA+ MS                                               
K104     LTE TDD Downlink                   LTE TDD DOWNLINK              FSx-LTE(LI)                     
K105     LTE TDD Uplink                     LTE TDD UPLINK                FSx-LTE(LI)                     
K106   LTE TDD/FDD Upgrade                  LTE TDD/FDD UPGRADE                                           
K5UP     GSM K5 Upgrade to K10              GSM K5 ANALYZER UPGRADE       FSx-Gsm(LI)                     
K150   Support for User Calibration         USER CAL SUPPORT                                             


They are ordered according to the seeds table (used in the prog to generate licenses).

Also, in that .DLL we can extract a more complete seed (uint32) table than the one used in the original prog (post #7). I attach it below.

Those that are using the program should add the new seeds because they may be needed to enable other Options.

The FSH Option names can be extracted from the FSH firmware's API.DLL. If anyone sends me a current FSH API.DLL I might extract the complete list of Options.

When adding the Option seeds you should also make them TRUE so that all possibilities are calculated.

Hi tv84,

I attached a API.DLL form a ZVR.  could you decode the option from it?

[carver]

Hey Guys,

I have a ZVR, SN is 835068/005. and I found the SW sn  \R_S\INSTR\INI\OPTOIN.INI
Is't anyone know how to decode it?

--------------------------------------------------------
4056071223; EMBED DEEMBED
0436723430; TIME DOMAIN
1234299954; CONVERTER 4 CHAN
--------------------------------------------------------

maybe
feat_0 = 'HARMONIC MEAS', 'B3', 'Harmonic Measurements'
feat_1 = 'MIXER MEAS', 'B4', 'Mixer Measurements'
feat_2 = 'NONLINEAR MEAS', 'B5', 'Nonlinear Measurements'
feat_3 = 'REF MIXER PORTS', 'B6', 'Reference Mixer Ports'
feat_4 = 'POWER CALIBRATION', 'B7', 'Power Calibration'
feat_5 = '4 PORT MEAS', 'B99', '4-Port Measurements'
feat_6 = 'QUARTZ MEAS', 'BXX', 'Quartz Measurements'

This is an old public algorithm.
test Feat_2+, if all OK - test b3-b4 too,
in newer devices - these numbers(0 or 1) used for demo.


now r&s used new long key.
many know how to create new too,
but no one wants to share it to public ))

Code: [Select]

sn: 835068.005  id: 00 option key: 1542267991  desc: feat_0
sn: 835068.005  id: 01 option key: 2797899109  desc: feat_1
sn: 835068.005  id: 02 option key: 2277388772  desc: feat_2
sn: 835068.005  id: 03 option key: 2328386865  desc: feat_3
sn: 835068.005  id: 04 option key: 0302356071  desc: feat_4
sn: 835068.005  id: 05 option key: 3024766616  desc: feat_5
sn: 835068.005  id: 06 option key: 4252011699  desc: feat_6
sn: 835068.005  id: 07 option key: 4056071223  desc: TIME DOMAIN, B2, Time Domain Measurements
sn: 835068.005  id: 08 option key: 0436723430  desc: CONVERTER 4 CHAN, C4C, 4 Channel Converter
sn: 835068.005  id: 09 option key: 1234299954  desc: EMBED DEEMBED, K9, Virtual Embedding Networks
sn: 835068.005  id: 10 option key: 0493488890  desc: feat_A

[tv84]

Hi tv84,

I attached a API.DLL form a ZVR.  could you decode the option from it?

I don't think so. Do you have examples of options for that equipment?

[sky2city]

Hi tv84,

I attached a API.DLL form a ZVR.  could you decode the option from it?

I don't think so. Do you have examples of options for that equipment?

I double checked with ZVR manual, the only K option for ZVR is K9 only, there is nothing to do with this unit.

So I am looking in another one, FSEA30. the datasheet say the K option for FSEA is:
---------------------------------------------------------------
FSE-K4  Phase Noise Measurement Software,
FSE-K3  Noise Measurement Software
FSE-K10 GSM Test Software, Mobile
FSE-K11 GSM Test Software, Base Station
FSE-K20 GSM Test Software, Edge Mobile
FSE-K21 GSM Test Software, EDGE Base Station
FSE-K30 GSM Test Software, 850 GHz band Mobile
FSE-K31 GSM Test Software, 850 GHz band Base Station
----------------------------------------------------------------

Just decoded the SN using "Rohde & Schwarz FSP option generator".

Notice: that I decode all  seeds, the comment "Kx  xxxx Application Firmware" is not correct, it's for FSP
--------------------------------------------------------------------------
3780795724 - K5  - GSM/EDGE Application Firmware
0284552823 - K7  - AM/FM/PM Measurement Demodulator
4196994763 - B17 - IQ Online
0684125256 - None
1514211661 - K84 - 1xEV-DO BTS Application Firmware
0579586646 - K84 - 1xEV-DO MS  Application Firmware
3285910640 - None
1332515167 - FSP-B15 FSP-B70 FS-K7
1746004935 - K72 prior K74
0425836556 - None
3914572062 - K9  - Power Meter
0367944746 - FSP-B15 FS-K7
0178533596 - None
0084427020 - None
0973137605 - K76 - 3GPP TD-SCDMA BTS Application Firmware
4058089560 - K77 - 3GPP TD-SCDMA MS  Application Firmware
2816669065 - K30 - Noise Figure Measurament
0774785927 - K82 - CDMA2000 BTS Application Firmware
1251526595 - K83 - CDMA2000 MS  Application Firmware
0364322959 - K8  - Bluetooth Application Firmware
3912188941 - K40 - Phase Noise Measurament
2043795852 - None
2216559242 - None
3509799288 - None
0667766505 - None
2179962388 - 31 days trial period
4232888520 - 78 days trial period
1998016984 - None
1665344687 - None
0081926458 - Frequency Extension
1876889287 - None
2554963261 - Trasducer Set
0989643314 - None
1367083121 - None
2589261327 - None
3754352886 - None
2349723378 - None
2713318677 - None
0242151735 - None
3807482493 - None
2651669256 - None
0586577237 - None
3525044770 - None
0034228987 - None
1143727560 - None
2616543767 - None
1636617207 - None
0959025083 - None
1318982380 - None
2600577035 - None
--------------------------------------------------------------------------
compare with the options.ini in my FSEA. the fisrt line is the "FSE-K10 GSM Test Software, Mobile".

------------------------------------------------------
Options file in my FSEA:
3780795724; GSM MTS ANALYZER
------------------------------------------------------

My question is which line of the SN is for other option?
-------------------------------------------------------------------
FSE-K4  Phase Noise Measurement Software,           
FSE-K3  Noise Measurement Software                     ??
FSE-K10 GSM Test Software, Mobile                       3780795724
FSE-K11 GSM Test Software, Base Station
FSE-K20 GSM Test Software, Edge Mobile
FSE-K21 GSM Test Software, EDGE Base Station
FSE-K30 GSM Test Software, 850 GHz band Mobile
FSE-K31 GSM Test Software, 850 GHz band Base Station
-------------------------------------------------------------------

another thing I found is that there is no API.dll in my FSEA30. I search all *.ll in hard disk, it seems that "FSEFPNL.DLL" is the suspect one.

[sky2city]

Hey Guys,

I have a ZVR, SN is 835068/005. and I found the SW sn  \R_S\INSTR\INI\OPTOIN.INI
Is't anyone know how to decode it?

--------------------------------------------------------
4056071223; EMBED DEEMBED
0436723430; TIME DOMAIN
1234299954; CONVERTER 4 CHAN
--------------------------------------------------------

maybe
feat_0 = 'HARMONIC MEAS', 'B3', 'Harmonic Measurements'
feat_1 = 'MIXER MEAS', 'B4', 'Mixer Measurements'
feat_2 = 'NONLINEAR MEAS', 'B5', 'Nonlinear Measurements'
feat_3 = 'REF MIXER PORTS', 'B6', 'Reference Mixer Ports'
feat_4 = 'POWER CALIBRATION', 'B7', 'Power Calibration'
feat_5 = '4 PORT MEAS', 'B99', '4-Port Measurements'
feat_6 = 'QUARTZ MEAS', 'BXX', 'Quartz Measurements'

This is an old public algorithm.
test Feat_2+, if all OK - test b3-b4 too,
in newer devices - these numbers(0 or 1) used for demo.


now r&s used new long key.
many know how to create new too,
but no one wants to share it to public ))

Code: [Select]

sn: 835068.005  id: 00 option key: 1542267991  desc: feat_0
sn: 835068.005  id: 01 option key: 2797899109  desc: feat_1
sn: 835068.005  id: 02 option key: 2277388772  desc: feat_2
sn: 835068.005  id: 03 option key: 2328386865  desc: feat_3
sn: 835068.005  id: 04 option key: 0302356071  desc: feat_4
sn: 835068.005  id: 05 option key: 3024766616  desc: feat_5
sn: 835068.005  id: 06 option key: 4252011699  desc: feat_6
sn: 835068.005  id: 07 option key: 4056071223  desc: TIME DOMAIN, B2, Time Domain Measurements
sn: 835068.005  id: 08 option key: 0436723430  desc: CONVERTER 4 CHAN, C4C, 4 Channel Converter
sn: 835068.005  id: 09 option key: 1234299954  desc: EMBED DEEMBED, K9, Virtual Embedding Networks
sn: 835068.005  id: 10 option key: 0493488890  desc: feat_A

Got it. thanks for your reply.

[sky2city]

I have a R&S ZVB8 2 port Vector Network Analyzer, but I can't see any options file (SWOPT.DAT or similar). Under 'Info', no files are loaded that indicate which file it could be.

I could really use the ZVAB-K2 Time Domain option - does anyone have any good suggestions? The serial-number is 6-digits.

To be honest, I can't even see where I would load a valid software option key.

Hi Jacod,
I don't have the ZVB yet. I download the firmware  form RS and than extract all files.
there is a DLL file "OptionKeyServices.dll", I guess this Dll is work for the option key.

for the SW option key, you should search *option*.* or *opt*.* in D disk. in my ZVR, it's "Option.ini".

and check the serial-number on "info" hard key manu.

[sky2city]

I have a R&S ZVB8 2 port Vector Network Analyzer, but I can't see any options file (SWOPT.DAT or similar). Under 'Info', no files are loaded that indicate which file it could be.

I could really use the ZVAB-K2 Time Domain option - does anyone have any good suggestions? The serial-number is 6-digits.

To be honest, I can't even see where I would load a valid software option key.

Hi Jacod,
I don't have the ZVB yet. I download the firmware  form RS and than extract all files.
there is a DLL file "OptionKeyServices.dll", I guess this Dll is work for the option key.

for the SW option key, you should search *option*.* or *opt*.* in D disk. in my ZVR, it's "Option.ini".

and check the serial-number on "info" hard key manu.

I went through the "OptionKeyServices.dll", it seems that some fuction is base on OpenSSL 0.95 lib.

But I can't find the where the key hidden.

Stuck here ....

[sky2city]

I have a R&S ZVB8 2 port Vector Network Analyzer, but I can't see any options file (SWOPT.DAT or similar). Under 'Info', no files are loaded that indicate which file it could be.

I could really use the ZVAB-K2 Time Domain option - does anyone have any good suggestions? The serial-number is 6-digits.

To be honest, I can't even see where I would load a valid software option key.

 I did some Reverse Engineering of OptionKeyServices.dll. it show that the OptionKeyServices.dll always access the Register table of windows.
Maybe the Option key is store in register table.

Pls. check reg table on:
HKEY_LOCAL_MACHINE\SOFTWEARE\Rohde&Schwarz\......

[vk3st]

Hi all,
Still frustrated trying to get several option running on our radio club ZVH.
Really wanting to activate K1, K9 and K39.
I did have a contact with a guy in Russia but the expected cost was way way beyond the budget by many orders of magnitude and was probably more based on a commercial proposition.
Have tried all the options with variations mentioned in these pages to no avail.
If someone does have a key gen stored away and can provide me with activation codes for Ser No 102660/24 I would be prepared to pay a fee or donate a suitable sum not being a kings ransom for the service.
If there is such a person, pm me at vk3st@ian-foster.com please.

[carver]

as I wrote above,
many have access to R&S tools, me too.
but no one wants to share this tool to public, as R&S too.

[mbirth]

Quote from: vk3st on Yesterday at 08:49:02

Have tried all the options with variations mentioned in these pages to no avail.

Did you also try the tool from comment #7 but with only the first part of your serial number? (Have to edit the serial number in the source code, then compile and run. Make sure to also set all the options in the source code to TRUE first.)

[vk3st]

Hi, can you pm me with RS tool info please?
Info@ian-foster.com

[vk3st]

I looked. At it and could not seem to get it to compile without error.
What is recommended compiler please and sorry but has been many years since compiling scripts etc so am a bit slow in this area.

[larry42]

I've been reading through this thread - anyone know the situation with the more modern series of R&S equipment (e.g. RTE / RTO series of scopes).

R&S seem to base their designs on a couple of platforms, with occasional "mid-life" upgrades of the underlying HW (and OS - usually embedded Windows of some kind). The RTE / RTO platform is common and Win7 / Win10 embedded. with license key support for temporary and time limited licenses as well as portable licenses and license de-activation.

Anyone confirm whether these can be played with?

[carvalhoatx]

Hello Folks, anyone who has working with RTO scope oscilloscope (model 10 24 ) ? If so, could you help me. I tried to save the x-y axis waveform in .csv.
When I tried it, only the y-axis (voltage was salved). I need also, the Time axis. How to set to both ? I tried to find that "basic" info with manual, but there is no it....
Or it doesnt work to that Oscilloscope? kind regards  for comments,

[little.tesla]

Hello,

did anybody try to enable options for signal generators like SMIQ, SME?
I did try different combinations on a SME which expects a 6-digit activation key without luck. The serial number is same as the others xxxxxx/xxx.

Any hints are highly appreciated.

BR,
 Dimce

[darkstar49]

I've been reading through this thread - anyone know the situation with the more modern series of R&S equipment (e.g. RTE / RTO series of scopes).

R&S seem to base their designs on a couple of platforms, with occasional "mid-life" upgrades of the underlying HW (and OS - usually embedded Windows of some kind). The RTE / RTO platform is common and Win7 / Win10 embedded. with license key support for temporary and time limited licenses as well as portable licenses and license de-activation.

Anyone confirm whether these can be played with?

to my knowledge, no one has succeeded so far hacking any recent R&S scope (incl. RTO's, which have their crypto stuff on a smart card inside the scope, btw), although I'd like to be wrong ! RTB & RTA firmware files/updates are encrypted, and I've never seen anything able to decrypt those either... (which would be a starting point for further 'research'...)

[KaneTW]

Yeah, I have a RTB2004 but it's a fully optioned 5k instrument. Not touching that unless someone has a spare with a busted frontend or something and I can experiment with it.

[analogRF]

Hello,

did anybody try to enable options for signal generators like SMIQ, SME?
I did try different combinations on a SME which expects a 6-digit activation key without luck. The serial number is same as the others xxxxxx/xxx.

Any hints are highly appreciated.

BR,
 Dimce

may I ask what options on SMIQ/SME you want to enable? I don't know how it can be done but if there is any useful option that can be hacked
I would be very interested to do it. As I remember most of the 'good' options are hardware options for which you need a HW module. Software options were not many and they didn't seem very interesting to me at least

[little.tesla]

I have here at the moment only a SME where I would like to play a bit with the POCSAG Protocol (pagers) option SME-B42. The required hardware options are available. There are as well B41 and B43 software options which are at the moment not of interest for me.
As far as I can tell for the SMIQ the options >B42 (Digital Standard IS-95 CDMA) and >K11 (Digital Standard IS-95 CDMA) are software options. I think they just require the modulation coder/data generator and memory.
How good is your i960 assembly?

[EEngo]

does anyone know how to enable options for a DVRG? I have two of them, but one of them is missing one of the previously installed options after a HDD crash 

I have all the HDD images, but couldn't find something key-related.

-ingo-

[Pattymorr]

Newbie here for everything.

Got 2 old units FSH3, one is fully operational type 13 from 2005 (with tracking generator SN103585 Firmware V10.00),  the other one is from 2004 (base model 03 with preamp SN 102121)  which seems to have a corrupt Firmware V7.20 cause the frequency range shows random numbers i.e Center -1.656726599e+181; despite all keys and menus are functional the only response I got for the instrument is for Manual BW to 1Mhz  and Span 0hz,  all others shows Out of Range. 

I had try to look for firmware update and found a file on R&S site for the new version with TV features which I am not sure if it will be suitable for the old units. Furthermore, I had not been able to find the Optical Rs232 cable interface  neither the software tools needed to perform the update, I guess there is plenty of this items stocked at R&S at considerable price.

After reading this post I downloaded the file on post #7. Unfortunately,  I wont have access to the files until I have a way to communicate with the units. Does anyone know what is the pinout / transceiver configuration for the optical rs232?

Thanks in advance for help

Sincerely

Patty.