Enabling options on Agilent ESA series E4402B E4404B E4405B E4407B

[suj]

I found a debug interface command that is undocumented. Pressing "F4" had the effect shown below. I can't interpret it, but it might mean something.
(Firmware still A14.01, probably until Monday ...)

[smgvbest]

This dump is exactly Sandra's ESAFW with 8 bytes different (in the middle of the code  ).

The problem is that you didn't run the app before taking the dump. We need the dump after the app has run/is running. Because all the rest of the mem is 0x00s.

Got it, didn't quite grasp what the issue was before. The application was definitely not running when I created the new dump.

Looking forward to seeing Sandra's results

still dumping,  it's up to 0x040Dxxxx and it's all zero's in this area

i'm trying to figure our device addressing
the max address is 0x07FFFFFF  only ADDRESS BIT 0..27 are used
21,22,23 are used to address the FLASH memory (thru a 74138)

U55 controls the addressing which is the communications controller which goes to the enable pin on the 74138

Ok here's my 2 dumps

one is from ESALOADER
second is after normal boot,  entering a license, getting a fail.  hit reset into ESALOADER then dump memory

[tv84]

Ok here's my 2 dumps

Binary form.

[smgvbest]

SIMM Repaired

the simm that caused the processor board to blow has been repaired.   it apparently was upgraded from 4M to 12M of flash and the soldering was , um poor
I removed all flash and caps.   tested all of the them.   flash was read, erased, programmed, read, erased and read for each of the 3 flash memories.
checked caps and replaced all.

also started work on the processor board.   FWIW,
On J3 you can supply 5v @ 1.3A to 3rd (of the longer) pin from right side and on P7 for GND and youv'e got power.
it does need more voltages but Boots with just 5V

[smgvbest]

Ok here's my 2 dumps

Binary form.

what tool(s) did you use to do that?

[tv84]

what tool(s) did you use to do that?

I use UltraEdit in "Column Mode" which allows me to strip the left and right columns of text. Then do a Select All and paste it in HxD (in the binary zone). It's very simple and doesn't require any scripting and/or custom programming.

It's the same as selecting/copying just the binary dump bytes (in UltraEdit's "Column Mode") and paste them in HxD. See image.

[smgvbest]

I use UltraEdit in "Column Mode" which allows me to strip the left and right columns of text. Then do a Select All and paste it in HxD (in the binary zone). It's very simple and doesn't require any scripting and/or custom programming.

It's the same as selecting/copying just the binary dump bytes (in UltraEdit's "Column Mode") and paste them in HxD. See image.

And here I was thinking it was some python or other script to do it
Ultraedit I have,  ever since V1,  love it.

That's it!    Please send the other options.

I will get other options today,   some take awhile to dump

[tv84]

I will get other options today,   some take awhile to dump

Sandra, repeat also your ESAFW dump because yours is incomplete. You didn't dump from 0x0401 1000 up to 0x0490 0000.

[smgvbest]

I will get other options today,   some take awhile to dump

Sandra, repeat also your ESAFW dump because yours is incomplete. You didn't dump from 0x0401 1000 up to 0x0490 0000.

Yeh, think power died on the surface tablet before it finished

I’ll do again with power plugged in this time


edit:
Here's all the Debug menu options with thier output
I edited to show the option selected as its not echoed normally

ESAFW dump is running,   tablet is plugged in this time
I entered 2 licenses
AYZ 888888888888
IDS 999999999999

[smgvbest]

ok it took many hours to dump that amount of memory but here's the "complete" dump this time

[suj]

I just finished the firmware upgrade, I have the A14.06 version installed now. I have SA open, if necessary, I can disassemble the controller card and boot it on the table. I can make a memory dump, please just write me according to the procedure from which post 

EDIT
https://www.eevblog.com/forum/testgear/enabling-options-on-agilent-esa-series-e4402b-e4404b-e4405b-e4407b/msg3228528/#msg3228528
should I do according to this description (post #120 written by Sandra)?
As I understand it, reset is a shorting of the pins of connector J14.

[tv84]

EDIT
https://www.eevblog.com/forum/testgear/enabling-options-on-agilent-esa-series-e4402b-e4404b-e4405b-e4407b/msg3228528/#msg3228528
should I do according to this description (post #120 written by Sandra)?

That method is what she has just tried and doesn't work. It dumps the ESALOADR environment. The reset crushes all the ESAFW previous state.

[suj]

OK, I get it. It would be best to have access to hardware ICE. I checked on ebay, there is no one unnecessary, dusty, complete Lauterbach ICE32_LA-6780_LA-6782_LA-6786. There is also no HP 64783A/B with the HP 9000 series 300 included. Anyway, none of them would cost $ 200... 
As a last resort, I see a solution in the ICE type. The board between the PGA socket and the processor. There is an additional uC on it. After system boots up, it stops MC68EC040 and reads memory and sends via its own serial port. Dynamic memory refresh is handled by the MC68EN360, but there can be tons of bus arbitration issues. It's just a rather complicated project ...

[smgvbest]

EDIT
https://www.eevblog.com/forum/testgear/enabling-options-on-agilent-esa-series-e4402b-e4404b-e4405b-e4407b/msg3228528/#msg3228528
should I do according to this description (post #120 written by Sandra)?

That method is what she has just tried and doesn't work. It dumps the ESALOADR environment. The reset crushes all the ESAFW previous state.

yeh it was worth a try but its a no-go
it looks like we need to find out who to get the monitor menu from a normal boot.
You mention though that CTRL+C is disabled in the BootRom?  or is it disabled in the ESAFW?
would it be hard to patch to enable that function?

the other thing is SCPI,   There's suppose to be a debug interface (but undocumented) via SCPI and it may be faster than the serial interface.

Any recommendations on how to proceed?

[tv84]

Any recommendations on how to proceed?

I don't know if the Bootrom is somewhat old and maps the ^C jump address in a memory place that the ESALOADR A.05.00 knows where to find but the ESAFW A.14.06 doesn't (I've seen that both use different addresses, I think). Just a guess... I've tried to discover that to force the jump but... arghhh. damn language...

The way to proceed is to try a patch.

Please test if you can flash a patched FW (or live patch the ESAFW). You can test with a string used in any message onscreen.

If you are successful, I think I can craft a special patch.

[andrew9875]

Any recommendations on how to proceed?

Has anyone looked at the service information for these analyzers? Maybe another vector we can explore:

DRAM and flash EPROM can be erased by flipping switches on S1 or holding down front panel buttons during boot. Maybe there's some hidden features there...

[smgvbest]

Any recommendations on how to proceed?

I don't know if the Bootrom is somewhat old and maps the ^C jump address in a memory place that the ESALOADR A.05.00 knows where to find but the ESAFW A.14.06 doesn't (I've seen that both use different addresses, I think). Just a guess... I've tried to discover that to force the jump but... arghhh. damn language...

The way to proceed is to try a patch.

Please test if you can flash a patched FW (or live patch the ESAFW). You can test with a string used in any message onscreen.

If you are successful, I think I can craft a special patch.

If you know the address where the ctrl+c code is then I think in the debug menu the gu address command will jump to that address???

Maybe we can force it there?

[smgvbest]

The HOSTID is based on the PROCESSOR board.   so if you change processor boards you do change the hostid
you are correct in that flash has nothing to do with it.

I have tried all the DIP switches but not all combinations.   most seem to do nothing.   SW2/SW3 erase SRAM/FLASH

if you load any software you don't get a running version of the ESAFW into DRAM and thats' what we need.  We need it running

edit:
The Keys are stored on the FLASH SIMM according to the Security Manual
The Processor is a 68LC040.   kind of old

[smgvbest]

Before actually re-flashing my SA I thought I would try just changing the ESALOADR and after I changed some text the ESALOADR would not load,  it just skipped it and booted normally.
I watched the serial port and saw nothing special there

can someone else try this on the loader disc and change some text and see if you get same result?

I know we're not after the loader for this but its a test before going thru a full re-flash,   I only cried 9 times

[andrew9875]

can someone else try this on the loader disc and change some text and see if you get same result?

I can try it out tomorrow, just change a few bytes in the ESALOADR image?

But, I have the feeling that it will fail. The boot ROM indicates that it calculates a checksum on flash before attempting to boot, and I have the feeling it does the same before booting from floppy.

[smgvbest]

can someone else try this on the loader disc and change some text and see if you get same result?

I can try it out tomorrow, just change a few bytes in the ESALOADR image?

But, I have the feeling that it will fail. The boot ROM indicates that it calculates a checksum on flash before attempting to boot, and I have the feeling it does the same before booting from floppy.

This is to find out if we can patch the FW ultimately.   this was just a test using the esaloader.   i'm using a USB floppy drive and I have had problems writting disc so I want to see it its that causing my problem and not a checksum problem.   I dont 'think it is. 

[suj]

Be extremely careful! I just partially bricked my unit. In the first step, I made a little modification to the ESALOADR file (ESALOADR_1.PNG, ESALOADR_2.PNG). I restarted SA from FDD and it loaded. It showed a message to insert a second floppy disk, I was able to enter the monitor etc. Then I tried larger modifications to the ESALOADR file (shortened, more characters changed in the texts etc.). But after such modifications, he no longer wanted to load. At this point, I noticed that my options are not working and the maximum upper frequency is 6.78 GHz instead of 26.5 GHz. The options (1D5, 1DR, AYZ) could be restored by retyping the keys that are displayed on the licensing screen. But with maximum frequency there is a problem. Factory preset doesn't help. Only when I load my previous "User Preset" the frequency range is up to 26.5 GHz, but the following messages are displayed: LO Unlock, LO Unlevel.
In the evening I will look at the problem in more detail. 

[suj]

OK, I'm changing the level from DEFCON1 to DEFCON5. In the service menu, it's possible to limit the upper frequency to 6.7 or 13.2 GHz (Initialize Instrument/Max Freq). After switching to 26.5 GHz, rebooting and full align, everything returned to the normal state.
Be careful!

[tv84]

Please don't do changes in the ESALOADR. Try them in the ESAFW.

[smgvbest]

Be extremely careful! I just partially bricked my unit. In the first step, I made a little modification to the ESALOADR file (ESALOADR_1.PNG, ESALOADR_2.PNG). I restarted SA from FDD and it loaded. It showed a message to insert a second floppy disk, I was able to enter the monitor etc. Then I tried larger modifications to the ESALOADR file (shortened, more characters changed in the texts etc.). But after such modifications, he no longer wanted to load. At this point, I noticed that my options are not working and the maximum upper frequency is 6.78 GHz instead of 26.5 GHz. The options (1D5, 1DR, AYZ) could be restored by retyping the keys that are displayed on the licensing screen. But with maximum frequency there is a problem. Factory preset doesn't help. Only when I load my previous "User Preset" the frequency range is up to 26.5 GHz, but the following messages are displayed: LO Unlock, LO Unlevel.
In the evening I will look at the problem in more detail. 

The issue is you changed the base identifier for the SA.    while E4407B is the specific model.  E4401 is the line of SA and which almost all use to identify parts.
when doing these tests I would advise against changing E4401 to anything else.  change other TEXT