| General > General Technical Chat |
| The Rigol DS1052E |
| << < (139/166) > >> |
| slburris:
Someone was talking about looking for JTAG connections a while ago -- did that ever pan out? Presumably these are manufactured with blank flash soldered in, then they are programmed via JTAG. I suppose you could pre-program the surface mount flash in an adapter, but that seems wrong, since you need to do a final test anyway -- might as well program the flash at that step. So if someone figures out the JTAG and images their flash, then the bricked scopes should be recoverable. Scott |
| Cheshyr:
--- Quote from: slburris on August 12, 2010, 02:34:53 pm ---Someone was talking about looking for JTAG connections a while ago -- did that ever pan out? Presumably these are manufactured with blank flash soldered in, then they are programmed via JTAG. I suppose you could pre-program the surface mount flash in an adapter, but that seems wrong, since you need to do a final test anyway -- might as well program the flash at that step. So if someone figures out the JTAG and images their flash, then the bricked scopes should be recoverable. Scott --- End quote --- Ok, I've attempted to RMA my first scope, and I've purchased a second one. If the RMA gets refused, I'll dissect the bricked scope and see if I can find a way for other people to recover their bricks. On projects I've worked on in the past, the entire board was manufactured, and the flash was programmed after first-pass electrical test and AOI. If they were using a ROM of some sort, I'd think they would program the device prior to manufacturing. They're using Flash, which implies they had a reason to want to flash it after assembly, and that there's a mechanism to accomplish this. That said, it might not be a straight-forward procedure. On the same project I mentioned above, we wrote a custom bootloader, and encrypted our firmware. The bootloader would decrypt it, verify a hashcode to ensure the firmware wasn't corrupt, and then dump the firmware in it's appropriate location. (Branding requirements are always fun.) With regard to our specific problem, I think the easier solution is to get a complete dump of a working flash, and overwrite the entire chip. Preferably, a working flash from a DS1052D or E that's already been modded, or one that is running 2.02. In theory, this should bypass any potential weird bootloader issues, and get us into a state where we can go about fixing the serial number, model number, and updating the firmware accordingly. |
| shirsch:
--- Quote from: polossatik on August 11, 2010, 06:14:09 pm --- --- Quote from: shirsch on August 11, 2010, 02:41:04 pm --- At the risk of belaboring the point, has anyone verified that a DS1052E shipped with 00.02.04.00.03 can be successfully "downgraded" to 00.02.02 SP2 ? --- End quote --- I just updated the guide for this --- End quote --- Thanks much! Chalk up another successful mod :) Went just as advertised. This unit had a calibration date of June 8, 2010 and shipped with firmware 00.02.04.00.03. |
| drieg:
@lynx @Meiner I could be of any help reconstructing your FLASH content. The vital data seems to be OK in both cases. Could tell me the HW version (e.g. "DEM07") and the PCB version (e.g. "0941") of your scopes? |
| Meiner:
Hi everybody, sorry for my late reply, I`ve been busy with other topics... also, I've ordered another new DS1052E to desolder the working spansion and read the content. But on the other hand, I need a scope right now and this one's working... I will continue my repair trials in some weeks. --- Quote from: lynx on July 25, 2010, 03:54:28 pm ---But I have yet to experiment further until the ZIF socket and spare spansions I have ordered arrive. --- End quote --- @lynx: could you pls tell me where you ordered a ZIF? This would help me a lot. Thanks --- Quote from: bushing on July 26, 2010, 07:04:41 am ---Please double-check this; I measured BMODE0/1 and got completely different results, see https://www.eevblog.com/forum/index.php?topic=30.msg2824#msg2824. (I also put the JTAG pinout there.) The purpose of the ROM is to read those BMODE pins and fetch the rest of the code from the appropriate source ... if the datasheet says it's ROM, it's doubtful that Rigol can reprogram it. --- End quote --- @bushing: I can check this at the end of next week, since the open PCB is not here right now. --- Quote from: shafri on August 12, 2010, 11:17:30 am ---we found another "bricker"! maybe rigol has take more evasive action for this hack! can anybody point me to where i can get Spansion Flash cheaper? i need a spare for my rigol and for testing. --- End quote --- @shafri: I got my spansion at www.mouser.com: 797-S29GL064N90TFI04 (EUR 4.60) --- Quote from: drieg on August 18, 2010, 07:08:39 am ---@lynx @Meiner I could be of any help reconstructing your FLASH content. The vital data seems to be OK in both cases. Could tell me the HW version (e.g. "DEM07") and the PCB version (e.g. "0941") of your scopes? --- End quote --- @drieg: Thanks for your offer, next possibility to get the version is end of next week. Thanks Meiner |
| Navigation |
| Message Index |
| Next page |
| Previous page |