Total Pageviews

Friday, 22 December 2017

Quick comparison: Agilent/Keysight E4403B - Siglent SSA3021X - Rohde & Schwarz CRTU


I have a loaned Keysight E4403B, so I used the opportunity to play a little with it.

Here are three Youtube videos, that show the same CATV signal on:
  • Keysight E4403B
  • Siglent SSA3021X
  • Rohde & Schwarz CRTU
The "test" was just to compare the refresh/sweep rate between the three devices. I fed my CATV signal and set all three devices as such:
  • Start Frequency = 50 MHz
  • End Frequency = 850 MHz
  • Span = 800 MHz
  • RBW = 1 MHz and 0.1 MHz
  • RBW/VBW = 0.1
The E4403B is labeled as "Keysight", but he same model has been previously produced by Agilent, which then comes historically from an HP design.

An intersting fact, at least to me: on the third video, if you increase volume, you will hear a chirping from the E4403B right in the beginning. Then I turn off the AUTO ALIGNMENT and the chirping is gone. Turns out that this is a normal behaviour and what you are hearing is the RF Frontend aligning itself at the end of each sweep, which results in relays clicking.

More info about this: Why is there a "chirping" noise coming out of my ESA Series Spectrum Analyzer?

I mention it, because it was driving me crazy - I feared that after repairing the PSU, there was some other fault...

Part 1

Part 2

Part 3

Well, nothing too spectacular to be seen, but I thought it might be interesting for some to see the live spectrum being rendered on the E4403B, SSA3021X and CRTU.


Tuesday, 12 December 2017

NOS (former TV Cabo) finally released their DVB-C bouquet in FTA!

Yesterday I received some good news for a change! I got an e-mail from NOS, who are better known as "TV Cabo", telling me that my TV could now render more than 110 channels.

After a quick reading, the issue was crystal clear: NOS has come to senses and removed their encryption on the base bouquet! This means that any TV equipped with a DVB-C tuner will be able to show all 110 channels of the base bouquet.

Before, you needed to rent an official NOS DVB-C receiver, but you could only have up to three and they cost extra money, of course. Well in a home like mine, we have 5+ permanent TV sets installed (not to mention my shack, which has at least another TV, if not more).

I always wondered why they would encrypt ALL their DVB-C channels (except a few international channels, which are FTA on satellite - I think for DRM reasons NOS had to keep them FTA when retransmitting them in their network).

Here are two pictures grabbed from my Emitor Megalook, which I managed to repair after studying the fault over 4 months... More info about that journey at EEV-Blog:

The complete CATV spectrum as used by NOS

Constellation diagram of transponder at 354MHz, using QAM256

Update on 10/01/2018:
Yesterday NOS changed the channel plan once again,
so the following list is not correct anymore!

Here is the channel list for PORTO area:
  • 121500 kHz QAM256 SR6.000 kBaud/s
  • 184500 kHz QAM128 SR6.000 kBaud/s
  • 170500 kHz QAM256 SR6.000 kBaud/s
  • 219500 kHz QAM256 SR6.000 kBaud/s
  • 240500 kHz QAM256 SR6.000 kBaud/s
  • 247500 kHz QAM128 SR6.000 kBaud/s
  • 254500 kHz QAM256 SR6.000 kBaud/s
  • 261500 kHz QAM256 SR6.000 kBaud/s
  • 306000 kHz QAM256 SR6.875 kBaud/s
  • 314000 kHz QAM256 SR6.875 kBaud/s
  • 322000 kHz QAM256 SR6.875 kBaud/s
  • 330000 kHz QAM256 SR6.875 kBaud/s
  • 354000 kHz QAM256 SR6.875 kBaud/s
  • 362000 kHz QAM256 SR6.875 kBaud/s
  • 386000 kHz QAM256 SR6.875 kBaud/s
  • 426000 kHz QAM256 SR6.875 kBaud/s
  • 474000 kHz QAM256 SR6.875 kBaud/s
  • 490000 kHz QAM256 SR6.875 kBaud/s
  • 562000 kHz QAM128 SR6.875 kBaud/s
  • 570000 kHz QAM128 SR6.875 kBaud/s
  • 602000 kHz QAM256 SR6.875 kBaud/s
  • 626000 kHz QAM128 SR6.875 kBaud/s
  • 634000 kHz QAM128 SR6.875 kBaud/s
  • 658000 kHz QAM256 SR6.875 kBaud/s
  • 674000 kHz QAM256 SR6.875 kBaud/s
  • 690000 kHz QAM256 SR6.875 kBaud/s
  • 714000 kHz QAM64  SR6.875 kBaud/s
It is now debatable if it wouldn't have been a better choice to distribute these channels with DVB-T modulation, instead, as the required DVB-T receivers are more common and cheaper (thanks to the TDT - "Terrestrial Digital Television"). But that would of course mean a significant investment for NOS, to change all equipment.

So at the end of the day, yes, I am happy. No more noisy analogue pictures, welcome to the digital TV on ALL screens of the house.

The final question is: Will NOS keep the analogue channels? Or will they be shut off after a given transition period? What would the free frequency ranges be used for?


Monday, 4 December 2017

Teaser: VMA Simple Spectrum Analyzer for HackRF One


As you know, I am a spectrum freak. There are two implementations already for the HackRF One:
  • qspectrumanalyzer - works well under Linux, but crashes right away under Windows
  • hackrf-spectrum-analyzer - works on Windows, but crasshes frequently when changing settings
Both are fairly limited in terms of functionality, but they show something impressive: the HackRF One is capabale to show a very high resolution spectrum over the whole supported frequency range (1MHz-6GHz). And the speed is incredible!

This motivated me to do a preliminary hack to see if the HackRF One could be used with my VMA Simple Spectrum Analyser software and the results are very promising:

Live spectrum (10MHz to 1000MHz)

Average Trace

Live, Min and Max Traces

Solid render of Live Trace

3D spectrum mode

The implementation is totally hacked and with errors:

  • I am not reading out the data correctly and there is some unfixed bug, which is why there is a blank on the right side of the spectrum in the above images
  • The frequency values are wrong
  • The frequency range cannot be set, nor can any other setting, as I have not implemented the protocol, yet

However, all other measurement functionality works and speed is fantastic! This could be a dream come true.

But there is a LOT of work required to get this to work and sadly I won't be able to manage it by myself.

First things first - the TODO list:
  • Better understand the hackrf_sweep protocol
  • Implement correct start/end frequency setting
  • Implement correct bin_width setting (FFT frequency resolution)
  • Implement num_samples setting (number of samples per frequency)
  • Implement interpretation of sweep output
  • Implement way to change current start/end frequency and other parameters (*)
(*) This is the crucial part: as it is, the hackrf_sweep.exe needs to be stopped with CTRL+C and restarted with new settings. This is not ideal, as it causes a significant pause.

Worse than that, under Windows, every CTRL+C crashes the HackRF One and a resume requires to press the physical RESET button.

Instead of having a hackrf_sweep.exe tool running in a shell outputting the sweep data to the console (from where I am reading it right now), I would prefer a TCP/IP communication to receive the sweep data and to send any new setting.

Unfortunately this requires to change the C++ sources of the hackrf_tools, something I am not literate to do.

If you know how to program VC++ and are interested in this project, please contact me!


Friday, 24 November 2017

Using HackRF One and GNU Radio on Windows 10


So finally I got my very own HackRF One!

While I was waiting for the order to arrive, I started to learn about how to use the HackRF One and all instructions I found online pointed to one basic fact: you need to have Linux to fully use the HackRF One.

The problem is that I currently have only Windows 10 installed on my computers, because most programs I use, are only available for this operating system.

For the casual Linux use, I droped having a dedicated Linux partition and instead started to use Ubuntu inside a virtual machine. Using the free VirtualBox has been a great experience, as it works really well.

However, I discovered that for HackRF One, the bandwidth of the virtual USB port is simply not enough. While you can in fact use the HackRF inside a virtual Linux box, performance is not ideal. It does work, but don't expect to TX/RX the full 20MHz.

I tried my luck with Pentoo, a Linux distribution on DVD that has everything radio related pre-installed. It does work, but again there was a slight annoyance: I am used to my SSD, which is really fast and I use three monitors to have plenty of desktop space. With Pengoo, everything loads from DVD and that is really slow! Also, all three monitors show the same content with a lower resolution that would be possible.

And so I ended up giving GNU Radio for Windows a shot and guess what: it works actually amazingly well!

How to set it up? Look here:

And yes, you get FULL HackRF One support, commands like "hackrf_transfer" are available and work.

I did a first test with my new HackRF One and this image shows the capture of a few seconds of just 2MHz:

Soon I ended up recording 20MHz bandwidth (basically the whole FM band in one go) and then transmitted it at 160MHz centre frequency... Why? Because I can!

The spectrum analyzer shows how it looks like...

...and my Uniden Bearcat UBC9000XLT could perfectly receive the relayed FM stations! Simply amazing!

Now I need to learn more about GNU Radio - it is an amazing piece of software!

So here is a prrof of concept that you can use the HackRF One with Windows, as opposed to basically all quick start instructions I have found.


Saturday, 4 November 2017

Hacking the Schwaiger SPG101 into an analogue satellite modulator


Last year I posted about a curious device, the Schwaiger SPG101 "LNB tester":

I finished my review with the thought that it should be easy to hack this device, to show a composite image instead of the test image with a grid.

Well, today I had some free time and so I finally looked at how to hack this device. I found the trace that transports the video signal from the generator and I interrupted it. Three wires were quickly soldered: one with the generated grid video signal before the trace interruption, one wire from a chinch connector I fitted to the case and a third soldered right after the trace interruption.

The idea is to switch between the external composite video input on the chinch connector and the internal video generator.

The results are promising, but not perfect:

There is a nice spot on the case, where a CHINCH connector fits in nicely!

Just place the modified SPG101 somewhere near the LNB.

 Tune the Satlook Digital Color to 11.288MHz.

And look at the video in analogue mode.
This is the original test pattern produced by the internal ZNZ234E.

Changing the jumpers and feeding some composite video on the CHINCH connector, we get a "real" satellite transponder on 11.228MHz. Best of all: it is in colour!

The problem is that the video signal from the generator is still visible over the external composite video signal. Just interrupting the trace is not enough. Because there is no space left for better shielding, I decided to cut another trace: the trace that powers the ZNA234E video pattern generator. Vcc is on pin 7, but naturally I got it wrong in the first attempt and cut the trace of the CROSS HATCH output on pin 14...

So I had to retrace that one, first. No harm done, as I am considering getting a switchable knob with 5 positions, since this video pattern generator can actually produce horizontal lines, vertical lines, grid, dots and a gray scale!

Because I did not have any switches at hand, for now I used two jumpers: one is to select between external or internal video, the other powers the pattern generator on or off.

Hopefully I can find a suitable switch to replace these two jumpers.

Now I can not only test if an LNB is working, I can actually broadcast video on 11.288MHz!

This is useful to test analogue SAT receivers, prior to modding them for ATV use. Another application is to test and/or review satellite field meters which still have an analogue mode, like my Satlook Digital Color.


Saturday, 21 October 2017

Can it be real: A DVB-S modulator and transmitter each for under 25 Euro?


A DVB-S modulator and transmitter for under 25 Euro?

A DVB-S receiver and demodulator for under 25 Euro?

See this video and find out:

You need:

  1. Raspberry Pi
  2. RTL2832U dongle
That's all!

Does it work great?

No. If you want an amazing modulator for your tests, this is what you need:

Is it amazing?

Hell yes. I learned a lot trying to get it to work!


Friday, 20 October 2017

Why not use a RTL2832U dongle for a faster spectrum refresh rate?


The RTL2832U dongles are very popular for a cheap entry to SDR (Software Defined Radio).

People who used SDR# (sdrsharp), are amazed by the super fast beyond real time refresh rate of the spectrum - not to mention the high resolution!

Why not use such an SDR dongle as a spectrum analyser? What is the advantage of the SMA/NWT devices?

Well, first off, some quick explanation: the cheap RTL2832U SDR dongles will digitize 2.4MSPS (Mega Samples per Second) and then perform a Fast Fourrier Transformation (FFT) to convert the discrete samples obtained in TIME DOMAIN (signal level in time) into FREQUENCY DOMAIN (signal level in frequency). Because 2.4MSPS are used, this will allow for a span of aproximately 2MHz.

The SMA/NWT devices, however, will capture samples across the frequency range specified, efectively sweeping the band, which is why they are SSA (Sweep Spectrum Analysers) - well sort of, as they are much simpler than "real" spectrum analyser.

Anyway, they manage to get 500 samples in 1-2 seconds. Considering that you can well display a span of 1GHz in 500 pixels, this gives a refresh rate of 1-2 frames per second.

Now, I am surely not the first who thought about using the FFT in 2MHz steps to eventually conver a broader span.

This is what you can do with QSPectrumAnalyzer, a Linux implementation for SDR devices.

Here is the result:

Note that each screen refresh takes about 70 seconds! The reason is fairly simple: a 1GHz range requires 500 2MHz steps for the FFT operation - there goes the fantastic speed...

Here the same signal rendered with the SMA/NWT device using my software:

In this case, the screen refresh takes around 1 second!

My intention is by no means to bash the RTL2832U devices - I love them! I just wanted to explain the difference.

Some notes of interest:

  1. If you look closely at the first image, you will notice that I use Ubuntu with a VirtualBox virtual machine under Windows 10 and it sees the RTL2832U dongle just fine!
  2. Don't buy the cheapest RTL2832U dongles you can find on eBay. Some will suffer from frequent crashes, which will really take any fun of using them.
  3. I just bought the NooElec Smart Premium.It is reasonably priced (around 25 $/£/€) and features a propper design.
  4. The first stop for any RTL-SDR related information is of course:
  5. Need some guidance for RTL-SDR under Linux? Look here:

Sunday, 15 October 2017

VMA Simple Spectrum Analyser: How to remove the Google Maps warning on the "Log on Maps" function


Perhaps you may have noticed that some time ago Google Maps started to complain about the no longer supported browser version when using the "Log on Maps" function.

If you have no complaints - ignore the rest of this message!

This is what pops up (sorry for the Portuguese message - I am using a Portuguese Windows 10 version, but you certainly get the idea):

Though you can click away this message for now, it is annoying and it was worrying me that one day it would no longer work. So I tried to understand what was going on.

The answer is simple: my software uses the browser control provided by Visual Studio. It will emulate by default an old Internet Explorer version and Google Maps correctly flagged this version as not secure anymore.

The fix consists in adding a new entry to the Registry, telling the Browser Control to emulate the latest Microsoft Internet Explorer 11 browser:

  1. Open regedit.exe
  2. Go to: Computer\HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
  3. Add a new DWORD and name it "VMA Simple Spectrum Analyser.exe"
  4. Set its value to "11000" in decimal mode
  5. Restart the the VMA Simple Spectrum Analyser application
That's it!

Atrernatively, you can copy the following green text to Notepad and save it with any name and the *.reg file extention (i.e. "vma.reg"):

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"VMA Simple Spectrum Analyser.exe"=dword:00002af8

Then double-click on the file and allow importing it to the Registry.

The "Log on Maps" function should now run again without any warning message.


Friday, 13 October 2017

Some considerations about the limitations of the ADF4350/ADF4351/MAX2870

Regarding the SMA and NWT devices, I often receive these questions:

  • Why is there a "notch" in the spectrum?
  • Why does the spectrum look different than expected?
  • I compared the spectrum of the NWT4000 with the spectrum of my professional spectrum analyser and it looks much different... Why?
  • ...
First of all a disclaimer: I did not develop the hardware and I don't sell the hardware! Because I did not like the included software I wrote my own.

For example, this is how my local FM radio band looks like, when using my "SMA Simple Spectrum Analyzer" with ADF4351:

Here is the same spectrum rendered on my Siglent SSA3021X:

The frequency range is exactly the same (88MHz - 108MHz), but the difference is due to the fact that the Siglent SSA3021X is rendering the spectrum with a RBW of 30kHz, while the ADF4351 probably uses a RBW of more than 300kHz.

To explain the concept, here is the a signal captured with different RBW values:

RBW = 1 MHz

RBW = 100kHz

RBW = 30kHz

The Siglent SSA3021X is a "real" Sweeped Spectrum Analyser (hence the "SSA" in the name) and it allows to set the RBW as required. Imagine the RBW to be a window: the sample you grab is the average of what you see through the window. The narrower the windows, the higher the resolution, but the sweep will take longer.

In case of the SMA/NWT devices, we don't have a user configurable RBW. You can only determine a start frequency, a frequency step and the amount of samples you want to capture. The device will then sweep the frequencies - but at a constant RBW.

This GIF tries to show how the detector sweeps the RF spectrum:

The detector will AVERAGE the power level within its window. Unfortunatly, the way the device and its IC's were designed, it has a "blind spot" in the centre frequency of the detector. This is the culprit of the notches on signals with a narrow bandwidth.

When the detector is exactly in the middle of the signal, the blind spot will mask a significant part of the signal, which causes the sample to actually have a smaller power level than the neighbouring samples.

Note that the “blind spot” is not in the centre of the frequency span you are seeing on the screen, but in the middle of the detector used to measure the power level in each sample!

When the narrow band signal is narrower than the RBW of the SMA/NWT device, the samples that completely contain the signal will measure a smaller power level, than the samples where the signal is not completely contained inside the detector window.

Here some extra information on spectrum analysis:

FFT - Fast Fourrier Transformation

In this case, the device will digitize a given amount of samples in TIME DOMAIN. This is much like a digital oscilloscope: you digitize for example 2000 points in one second.

Imagine the signal is a sine at 100MHz (in other words, the period of the signal is 1/100000000 seconds). Capturing 2000 points will allow you to calculate the sine function matching the samples through FFT math. You can then render the function in FREQUENCY DOMAIN, as you know the amplitude (signal level) and frequency.

This is how SDR# works for the RTL2830 based DVB-T dongles.

Advantage: very fast spectrum rendering
Disadvantage: limited span and you need a fast processor to do the maths!

SSA - Sweeped Spectrum Analysis

Here you take the input signal and convert it down to your BAND PASS FILTER. In a good device, the appearture of the filter is configurable (i.e. 10kHz, 100kHz, 1MHz). The filter always operates at a fixed frequency span, so instead of sweeping the filter across the frequency span, the frequency is downconverted accordingly (in the animation of my blog entry, the detector is fixed and it is the frequency ranges that moves).
Next comes the detector: it measures the signal power of the signal leaving the band pass filter.

So the very simplified schematic would be:


Please note that my explanations are very simplified!

Interested in a deeper insight? Make sure you read this great document from Keysight, a manufacturer of premium spectrum analysers:

Final word:

The SMA/NWT are great devices, considering their prices - no doubts about it. One just has to accept the limitations...


Thursday, 12 October 2017

VMA Simple Spectrum Analyser - Reflectometer Measurement


In the past I wrote two blog entries about a reflectometer measurement with the SMA device:

Since then I wanted to implement this as an automatic measurement function within the VMA Simple Spectrum Analyser software and, well, here it is!

Cycle through the measurement screens until you reach Measurements - Reflectometer:

Activate the Reflectometer and select the used Cable Type. The Distance to fault will show the a value in meter: this is the length of the unterminated cable or the distance to the fault in a terminated cable.

The cable type is important, as the propagation speed of the electric signal depends on the medium. In vaccum, the speed would be the sped of light, but in a medium with a foam dielectric, it may only reach 82% of that speed!

The manufacturer of the cable should normally indicate the propagation speed of the cable. This parameter is called VoP (Velocity of Propagation) or v/c (ratio of the propagation speed in the cable and the speed of light).

What if you don't know the VoP of your cable? Well, you can measure it yourself. Just take a cable of the same type and measure it, in order to know its length in meter. Click the "Calculate v/c" button and let the software determnine the VoP of your cable!

The software looks for a file called "Reflectometer VoP.ini", which contains pre-configured cable types. You can edit this file, so that your cables are listed. The default cable type is always the first in this list. Of course, if you determine the VoP as described above, you can select to have it added to the list automatically.

What do you need to carry out reflectometer measurements?

Apart from the obvious (SMA/NWT device and the VMA Simple Spectrum Analyser software), you need a "T" connector and in case of the SMA devices with only one ADF4350/ADF4351/MAX2870, you need a noise generator. NWT users can use the OUT connector.

Interested in further reading about reflectometer measurements?

Here are some links:


Saturday, 7 October 2017

VMA Simple Spectrum Analyser - Finally corrected the MEM trace resolution!


Finally I had time to think about how to correct something that has been bothering me for a long time: when using the MEM trace (clicking the one of the small buttons under the TRACE buttons), the MEM trace would store the respective trace, but with less resolution.

As a consequence, the MATH trace would operate with this lesser resolution MEM trace, too.

It worked, but with less precision than possible and it looked kind of weird.

Well, I have fixed that and you can now benefit from increased MEM and MATH resolution:

You don't need to change anything or operate the software in any different way. Just keep using it as always and benefit from improved resolution!

By the way, did you notice that you can now customize the colours in the main spectrum window? Head on to the SETUP tab and click the "Set Spectrum Colours" button in the "Customization" field.

All configured colours will be stored in the Registry.


Sunday, 1 October 2017

VMA Simple Spectrum Analyser - New version with support to render pre-definied transponder names


I just uploaded a new version that will show transponder names.

When a file named “transponder names.txt” is present in the same folder as the executable and if the checkbox to "Show transponder names" is enabled in the Settings tab, then the spectrum will show the transponder names.

The format of the “transponder names.txt” file is very simple:

Frequency, Name


754.000 MHz, Porto DVB-T
97.7 MHz, Radio Comercial
104.1 MHz, RFM
105.3 MHz, TSF

Please note that the frequencies have to be entered in MHz.

You can put as many items in the file as you want and the software will render the ones that are within the frequency range. Here the above four entries in action:

This image shows my local FM radio stations.

This images shows the local DVB-T transponder, using the same "transponder names.txt" file. Note that only the names of transponders within the selected frequency range are shown.

There is no further “intelligence” built in! The names are shown in absence of signal, too! And if you show the whole supported frequency range, all set transponder names will be shown, which may look confusing. Yet, I think this is the correct way to do it.

 Don't forget to activate or deactivate this new function as needed in the Setup tab. This setting will be stored in the Registry.

You can use the Recognize Transponder funcion to create the template for the "transponder names.txt" file.

Here I am getting the transponders of the NOS CATV digital transponders:

In order to increase the quality of the recognition algorithm, I reduzed the frequency range in order to first scan 250MHz-500MHz and then 500MHz-750MHz. I exported both transponder lists separately and then merged them together in Notepad++:

This gave me a full digital transponder list in seconds - none of my field meter is able to do such a quick scan!

I could now add a comma and a description for each transponder frequency, for instance the name of the main channels contained in each transponder.

If you add the frequency, but don't add the comma and the name, the software will just show the freqeuncy value:

Again, if you create a big transponder names list and render the whole freqeuncy range, things will look a bot chaotic:

In this case it is better to turn of the display of transponder names in the Settings tab.

Other changes of this new version include:
  • Bug fix: the transponder list is now saved correctly with three decimal places. It can be used as a template for the "transponder names.txt" file
  • Improvement: all pop-up windows now appear in the middle of the main application form
  • Improvement: frequencies could already be entered with the keyboard, but now you can accept the form with the m/M (MHz) or k/K (KHz) keys. In case of the percentage input form, you can use a/A (Accept)

Tuesday, 29 August 2017

Emitor Megalook - Interesting discovery!


I asked HERE for manuals and firmware files for the Emitor Megalook. I meanwhile found what seems to have ever been made available, so thank you all for your help.

Now, why did I search for these files? Because I bought two such devices from a nice chap in Singapore!

I actually bought one at eBay and then got offered a second unit for a unrefusable price, so I ended up with two.

Well, that was two and a half months ago. The seller sent me the package on the next day, it took one week to arrive in Lisbon and then it took our portuguese post office (CTT) a whopping month to pass it on to customs. There it took another month for them to ask me for the purchase documentation! Then another week for them to clear the device from customs and finally one week for the post office to finally ship it to me. Lesson learned: never ever purchase anything outside EU, except:

1) Cheap chinese stuff (is usually not sent to customs)!
2) If purchasing outside EU, use a propper parcel service, never official post office!

So was it worth it? Was it worth the money I spend (was a good deal, but still not exactly little money)?

Yes it was! I received two brand new looking Emitor Megalook in perfect working condition, except for the batteries, which is understandable. Including the original accessories.

Later on, I will probably sell one unit, as it makes no sense keeping both. Interested? Drop me a message (vma at norcam dot pt).

My collection now includes from Emitor:

  • Satlook AB
  • Satlook Mark III
  • Satlook Digital NIT
  • Satlook Digital Color
  • Megalook
  • Digiair Blue

I just opened the Megalook, mainly to see the kind of battery used (it's a NiMH cell) and made an amazing discovery: believe it or not, inside the Megalook there is not one, but two complete satellite receiver boards, with CI-Interface, Composite-Video/Audio connectors, Power Connector and Serial Port!!!


To my knowledge these two bords are not being used by the current firmware. I *THINK* the purpose would have been to implement something similar to the Emitor Satlook MARK IV FTA, but that has not been completed. Both boards look totally identical and they are connected to a PCB which has connectors to Video and Power for each board, providing the RF signal, too. It may be, that one board has a DVB-C tuner, while the other has a DVB-S tuner. The shield on both boards' tuners are the same size, so I am not sure.

Why on hell is this not active? (After some use of the device, the ST processor on both boards was still cool and I tried to connect directly to the video connector, but got no signal).

Why did they spend money in putting these boards there?


If I had MPEG2 demodulation capabilities on this device, it would be a dream device!

Any info is greatly appreciated.

Update - 1:

I figured out what those two boards are...

They are two DVB-C/T receivers based on ST chipset, which is basically a SOC (System On Chip). Emitor must have bought these PCB's as bulk and then they changed the firmware to a custom firmware.

The boards are only connected by the tuner and through RS232! When you enter the digital DVB-C or DVB-T mode, the corresponding board is turned on and receives the instructions from the main Emitor board. In return it prints out the constellation diagram, NIT information, MER/BER and the channels list.

If you connect a the composite video output to a monitor, you will see the EMITOR logo and board version number for a few seconds. Then everything remains black.

It's a shame they didn't implement the remaining receiver software, especially because there is even a CI slot on each board.

Update - 2:

Thinking further about this, it actually does make sense. Emitor had developed their own DVB-S Digital board and NIT board.

Considering how much development goes into such hardware, it is actually quite tempting to just take a standard SoC design for satellite receivers and program the required firmware based on the included SDK and sample firmware implementation.

You can purchase complete DVB-T receivers for distribution at less than 8 Euro (this was what I was told on ANGA 2015). In this case, Emitor only needed the PCB without case, remote, transformer, packaging. Probably they paid like 5 Euro per board. This is certainly much cheaper than any inhouse development.

Still, it bugs me that they could have made use of the MPEG2 decoder of the SoC...


Unaohm EP-2500: Upgrading the firmware without activation key


One of the last field meters added to my collection is the Unaohm EP-2500. I bought it at eBay and got kind of lucky, as the device arrived with more than I bargained for!

It came with three extra options:
  • QAM
  • MPEG2
Nice surprise, as the seller did not mention these options in the auction.

The firmware was fairly recent: W3_2

After a lot of online searching and with some help from fellow mate "Channel Hopper" at the forum, who seem to be an expert in searching on, I found the following collection of firmware upgrade files:
  • W2_2
  • W3_2
  • W3_2_1
  • W4_0
After some extra search, I found the firmware uploader software, also, called "Unaohm UpLoader".

👉This is a tool that is designed for basically all older Unaohm field meter (EP-2200, EP-2500, EP-3000 and probably many others). So read on, even if your Unaohm is a different model!

Great, I thought, let's upgrade this to W4_0 for additional satisfaction!

Not so fast: it seems that Unaohm does like to keep charging customers and to my surprise, you need an key code matching the serial number of the field meter, in order to upgrade the firmware!

Of course I tried some random codes, but naturally none worked.

Because the uploader seems to have been programmed in some version of Visual Basic, I decompiled it, but to no conclusion.

Last hacking attempt: notice how the "AUTO" button is deactivated. Well, I used a cool tool that let's you edit the controls of a compiled software, so I enabled this button! Unfortunatly, the programmer of the uploader software was well awake when programming it and included a specific instruction de deactivate the button. Otherwise that would have been a cool hack...

So, next solution was to search for the IC holding the firmware. It didn't take long to figure out that the EP-2500 uses a Z80 CPU for the user interface and next to it is a socket containing an ST M29F040B Flash/Eeprom in PLCC32 package.

I didn't have any chip of that sort in my stock nor did I have the suitable PLCC32 adapter for my Genius G540 programmer. No big deal: is your friend!

I got the chips for about 8 Euro with free shipping (two of them, just in case) and the adapter cost me around 2 Euro with free shipping. Of course, coming from China, it took about 2 weeks for both orders to arrrive.

When they did, I setup my gear: I connected the Genius G540 to my main computer running Windows 10 and... I couldn't program or read the newly arrived IC's. After spending around an hour, figuring out why, I found the reason. The main computer is simply too recent, Windows 10 at 64 bit is not properly supported. While it works for smaller eeproms, it didn't work for this one.

No problem: I keep my old HP laptop with a Pentium III running Windows XP 32bit for a reason! It has RS232, parallel port and is compatible with all hacking gear I need (including OBDM stuff for messing with my BMW). Always keep yourself an old working Windows XP machine!

So, now I could program and read the chip. Time to dump the chip from the EP-2500. This produces a 512kb file. The firmware upgrade file is only 448kb.

Why? Easy: because the dump includes the bootloader, which is missing from the upgrade file!

Looking at both in an hex editor, I quickly found that the memory is devides as such:

&H00000-&H6FFFF - firmware
&H70000-&H7FFFF - bootloader

So I snipped the firmware part of the dump and replaced it with the firmware of the W4_0 file.

Programmed one of the new IC with this file, replaced it in the field meter and...


I now have W4_0 installed.

Looking at the HEX dump of the bootloader, I noticed this:

It seems that the firmware is just uploaded using 1K XMODEM protocol. I will try that out, when possible. This would make firmware upgrade on older Unaohm field meter much easier, as one would simply circumvent the Unaohm UpLoader software and just use plain Hyperterminal! (Did I mention to keep an old PC with Windows XP - it includes Hyperterminal)