¿ªÔÆÌåÓý

  1. HP-Agilent-Keysight-Equipment
  2. Messages
Single Messages Topics Expanded

Re: Dead 54720D

 

Basically just from spending lots of time staring at the disassembly in Ghidra and making educated guesses about what the code is doing.

I've attached a screenshot of the relevant parts of the code. In it there's a function that updates the serial number of a plug-in module - it checks that the module is present & unprotected, updates the serial number field in a struct in RAM, calls a function to re-calculate the checksum, then wakes the module interface task to do the write.
The checksum calculation function sets the byte at 0x48 to 0 & sets the byte at 0x49 to 1 (because it's accessed as a uint16), sums up all the bytes, then writes the negation of the sum to 0x48 (making everything add to 0).

It would be great to get a firmware copy from the eeprom, but it may be too much hassle. In my machine the firmware is spread across 16 eeproms that are all soldered down and I think the 54720 uses the same mainboard.
Another option could be dumping it via GPIB - there are some undocumented memory peek/poke commands so with a bit of scripting they can be used to dump the whole flash.


On Mon, 17 Jan 2022 at 16:22, Arkadiusz Gibes via <arkadiusz.gibes=[email protected]> wrote:
Mike, could you explain how did you figure out that checksum bytes are at 0x48 and 0x7a ? Do you have any knowledge what thay represent ? Im preparing HW to get flash content from my 75412A and 75421A plugins to make sure that the patterns are correct. If that would be usefull for you, i could also try to get firmware directly from mainframe eeprom/flash, it would be good for me also to have backup because i don't have instalation disk. About serial bit at 0x07 byte, in 54721A it's 0x0c, which represents last two digits of model number - maybe that's the pattern ?. I will verify when i will have 54721 firmware image.??


Thanks
Arek
W poniedzia?ek, 10 stycznia 2022, 09:49:07 UTC, Mike Walters <mike@...> napisa?(-a):


Yeah, it would be helpful to compare the EEPROM image from two units.
Though I was thinking more about the actual firmware that runs on the
mainframe, I could reverse engineer that and figure it out.

I do have a firmware image from my 83480A (aka 54750A) which I expect
to be very similar and I've worked out the EEPROM format/checksums
that it uses:

The first two bytes are a (big-endian) uint16 denoting the total
length of the data.
The first checksum is verified by summing the first 0x7A bytes and
checking that the result is zero, and the checksum byte itself is at
0x48
The second checksum is verified by summing bytes over the whole image
(using the length field), and that checksum byte is at 0x7A.
Both of these schemes validate correctly on the 54712A image posted above.

Another thing to note is that the byte at 0x07 is a sort-of model ID
and it needs to match what the firmware expects for the model string
just after. Without a 54720 firmware image I can't tell what it's
supposed to be, though it could be guessed in maybe 10-20 tries if
someone's keen to do a bit of tedious work? :)

Cheers,
Mike

On Wed, 5 Jan 2022 at 15:44, Arkadiusz Gibes via
<arkadiusz.gibes=[email protected]> wrote:
>
> I was thinking about exactly the same. Do you want to compare to see where the check sume is stored ?
>
> W ?roda, 5 stycznia 2022, 03:26:37 UTC, Mike Walters <mike@...> napisa?(-a):
>
>
> Does anyone have a copy of the 54720 or 54710 firmware disk? If I
> could take a look at that, I can probably figure out how to make a
> 54717a eeprom image for you.
>
> On Tue, 4 Jan 2022 at 16:55, Arkadiusz Gibes via
> <arkadiusz.gibes=[email protected]> wrote:
> >
> > I already found the 54712 eeprom image that you shared. Do you have any possibility, to download same firmware from the other unit ? I would like to compare. I have one 54712 unit, but still don't have programmer.
> >
> > W wtorek, 4 stycznia 2022, 16:46:54 UTC, Ovidiu Popa [Business] <ovidiu.popa@...> napisa?(-a):
> >
> >
> > Sorry, no, I gave up and wrote off the 54720D. I have too many scopes anyway, from 100MHz to 50GHz, not enough incentive to spend more time on this. Meantime, watching for a 54717A, ideally someone owning one could dump the EEPROM. I know if I'd get one, this would be the first thing I'd do, this HP money grabbing calibration abomination has to end.
> >
> > If someone wants to pick up, I can forward the 54712A EEPROM binary.
> >
>
>
>
>
>
>





83480a_module_checksums.png

Join [email protected] to automatically receive all group messages.