-
After reading this thread I got temptation to look into my TLA7AA4 module as well, to unlock some extra memory
I have CS option, which is 2MB of enabled memory with 450MHz rate. There are upper DS and ES (8MB and 32MB).
I looked on board and actually realized that hardware have full memory populated, it's just software disabled.
There are 24 (or 48, don't remember if memory also populated on bottom side) x Micron 128Mbit DDR ICs.
And similar to other Tek machines, there is vxWorks PC in module as well, running on another smaller PCB with MC68360EM25L.
Also RS232 port with console, just like expected, driven by LT1137A converter from SoC.
I guess all calibration/key/option data is stored in DS1230AB, which will become a target after i get PROM programmer in my hands, to backup
original data.
Gotcha some console outputs (attached file) too, lkup command seem to output all possible commands/function calls
Not familiar with vxWorks at all, but I guess there should be a way to read/write NVRAM from console.
After some googling and trying:Code: [Select]temp = malloc(0x8000)
-> sysNvRamGet(temp,0x8000,0)
value = -1 = 0xffffffff
which means error. And temp variable stored nothing meaningful
-
I doubt anyone has ever bothered investigating this one before?
Good luck. -
I have and the options are not in the NVRAM. I'd concentrate on the Powerflex tool for installing module upgrades.
-
I have and the options are not in the NVRAM. I'd concentrate on the Powerflex tool for installing module upgrades.
You sound so sure, yet offer no hints.
Then what would you say the NVRAM is there for?
The problem with using the software upgrade tool, is that (at least for my TLA 614) the 'upgrade kits' (data blobs) are no longer available. According to Tek's web site anyway. So getting the option installer to do its job (so can examine what it does and where the data goes) isn't an easy thing.
Since there's no way in Hell I'm paying money for such a thing anyway, I don't think Tektronix would likely be terribly helpful. Considering my objectives, it's probably better not to even talk to them.
Whether the old Pentium hardware trace units I have will work with the Celeron in my TLA - that's a question to be investigated.
Btw TiN, I didn't get the files yet. Have been too busy procrastinating.
Probably tomorrow.
-
There is only calibration data in the NVRAM. I went down this road; the first thing I tried was erasing the NVRAM and see if the options would dissapear. They didn't so the options are not in the NVRAM.I have and the options are not in the NVRAM. I'd concentrate on the Powerflex tool for installing module upgrades.
You sound so sure, yet offer no hints.
Then what would you say the NVRAM is there for? -
Quote
There is only calibration data in the NVRAM
Well, I got programmer today, so will see. I don't find any other EEPROM/ROM storage except Flash and NVSRAM at first glance.
Of course, Tek could store key data in one of their big ASICs, but that's questionable.
I see few various ways to enable options:
1. Having good key for option (it's not much of a secret, usually it's on sticker @ module label) - fool module ID to match key. PowerFlex tool gives you what is correct module ID for key. To do so need find ID location and alter it's contents.
2. Find "option enabled" flag/storage and alter it to force option enabled, disregarding of ID/key
3. Do some black software magic and reverse correct key for PowerFlex to enable option using known ID
Any vxWorks experts around?
UPDATE:
Got 32M now Don't know how, it just surrender and decided to give me what I want. 
Before:
Now
All I did - removed original Dallas DS1230AB NVRAM, soldered DIP socket on PCB.
Put blank DS1245AB with VCC pin 32 shorted to pin 30 (i had DS1245AB from Keithley 2001, it's 1024k 32-pin, while DS1230 is 256k 28pin)
Assemble module back, put back into TLA714 frame - booted, run Powerflex - reports 32M right away.
Too easy!
P.S. I guess that's same Murphy law which striked Dave's DSA repair project from recent episode. Thanks Dave!
-
Thats weird and interesting. Where did you get that upgrade key code? Maybe the Powerflex tool just did the upgrade regardless of the wrong module serial number.
-
No, it did not.
I just googled TLA7AA4, and after few pages found photo of ES-optioned module.
Key is usually just printed on module sticker. It does not work if module ID does not match key, which is clearly shown on error message.
I tried again put back stock DS1230AB, erased it first on programmer - and guess what, module got 2M again.
Put back DS1245AB - 32M right away, without any other operations/enabling. Is there way to detect DS1245 SRAM? I remember my
Keithley 2001 did same, MEM1 or MEM2 options were directly depends of what SRAM chip installed. But on Keithley there is 32pin DIP socket,
which allows either 28-pin DS1230 or 32-pin DS1245 to be installed. Here - only 28 pin physically, pins 1,2,31 are not connected (32 shorted to 30, to provide VCC).
"modified" DS1245Y and socketed TLA7AA4 board = 32M Depth
Or:
Original DS1230 in socket = 2M Depth
And yes, calibration data was lost when i changed NVRAMs. But since module can recalibrate by user menu - not a problem at all.
Here are also my aquisition board very hi-res photos from both sides. in case someone need it.
Top side, 33MB, 10233x6331 pixels
Bottom side, 34MB, 10156x6352 pixels
Enjoy.
-
I wish someone would do this for a TDS7404, I wont pay 10K for a memory unlock code.
-
IMHO you stumbled upon a bug in the board's firmware. AFAIK the ID of the NVRAMs can be read by a special sequence just like parallel flash memory. Perhaps it jumps into some kind of calibration mode when the wrong NVRAM is installed. You already noticed that a blank (original) NVRAM doesn't do anything to the available options which is consistent with my own findings.
My approach would still be to run the Powerflex utility in a debugger and see whether it sends the upgrade key to the board or the Powerflex utility checks whether the key is right and reconfigures the board. If the latter is the case it shouldn't be hard to bypass the check. -
Quote
IMHO you stumbled upon a bug in the board's firmware.
Even if so, i would not complain. I'm not really a software guy to mess weeks and weeks with debugger
-
[...]
Here are also my aquisition board very hi-res photos from both sides. in case someone need it.
Top side, 33MB, 10233x6331 pixels
Bottom side, 34MB, 10156x6352 pixels
Enjoy.
How did you produce these images? They are fantastic! Hi-Res and sharp.
Did you stitch them together from multiple images? First i would have thought it is just a scan (as in: on a scanner), but some connectors out of focus tell me that this is not the case (i think)...
Greetings,
Chris -
Three shots with macro lens (150mm @ f/14) per each side with 10-20% overlap, then align and stitch them manually in photoshop (5 minutes to do.
You can see gaps if you watch really closely
-
Perhaps you used a Nikon D800.
Cheers. -
Right. Cannot resist of nice high-res hardware beauty.
Now I only wish to get hands on one of those TLA7BBx modules to play with, would be sick to have newer modules working in ancient frame like TLA714. -
Got Nexus DDR3 interposer for TLA
Linked TLA714 with CSA7404 by iView (used regular NI GPIB-USB-HS and BNC cables for trigger in/out and reference)
Works cool, but my TLA7AA4 is too slow
Need 7BB4, but cannot afford it 
DDR3-1067MHz :
-
Hi
I tried to do the same trick to my old TLA7N3 module. I replaced the DS1225 memory with a brand new DS1245.
I lost all the installed options after that so I installed the original memory again and the options were back.
Now I wonder if every TLA7AA module can be hacked this way. -
TiN, what's the firmware revision of your TLA7AA4 module?
-
I had updated 7AA4 to 5.8.001 a while ago (As TLA Ver 5.1 is running in server mode on mainframe itself).
Using it so far with remote TLA Application Ver 6.1.
Later I have plans to source another TLA7AA4 and try more unlocking, maybe AS or DS variant, when get some extra budget for hobby projects
-
I just boght a TLA7AA4-CS module. It has 5.0.002 firmware. I'm going to replace the Dallas chip on it tomorrow.
Do you remember what the firmware revision of your module was at the time you hacked it? -
Same version as my previous post, i updated it long ago from 4.4.
-
Did you have any problems getting TLA server v5.1 to work with TLA client
application v6.1?
I can get client - server configuration to work only if they are both v5.1
-
No, I had no issues, just had all stuff installed on v5.1 first, then just deinstall and install new 5.8 on remote PC, then did same thing with 6.0 and 6.1.
I remember there were issues with 6.x on one of my HDDs, but on another its working fine. Make sure you have NI VISA installed as well (I used it for LabView, but found that some libraries
are being used by Tektronix software as well). -
Thanks for the tip about NI VISA, I only have Tek VISA installed. I thought there were conflicts between Tek software and NI VISA. I'll try it.
-
I installed NI Visa drivers on the client computer. Now I can connect to the server but the client aplication
isn't detecting any modules. Did you install NI Visa on the Tek frame as well?
That's so much for bad news. Good news is that my TLA7AA4-CS is now full option 32M.
Thank you very much TiN.
