| Electronics > Repair |
| Agilent 34461A corrupted flash |
| << < (4/41) > >> |
| dc101:
Thank you! I had looked at the bk.bin for the 53220a, and compared it to the nand flash on mine and noticed there was quite a difference, this certainly explains things. I'll definitely look into that. I just finished installing VS 2005 and CE 6.0 on an XP VM so I'll take a look in there. I messed around with WinCE 6.0 when the FLIR C3 was released a few years back, but haven't touched it since then, so I've forgetting almost everything. |
| dc101:
This makes SSOOOO much more sense now. I've been scratching my head all day trying to figure out why it seemed so easy when I loaded the FLIR C3 nk.bin in platform builder, but it just wasn't working with the 34461a firmware until after I decompressed it with the file you mentioned. Sure enough, it was in one of the WinCE directories. Once I decompressed it, I just added it to a project in WinCE like any other file and it opened right up. I'm uploading it to my meter now via ymodem, so I've got some time to kill before it finished uploading. For whatever reason I never got u-boot to recognize any USB storage devices. |
| dc101:
Sooo.... I'm going to call this a win. A quick test of a dead 3V coin cell battery and shorting the probes. It definitely works, but the serial number and model number are gone and I'm not exactly sure how to restore them. Also the firmware update fails. I'll have to read the DSO2000/3000 scope thread as I'm wondering if this issue has come up before. The service manual for the meter warns against swapping the front panel with another unit, so I'm assuming the serial/model number is stored some place in the ARM processor or in the NAND flash. This correlates to some of the output on saw on the serial port while the unit was booting: --- Code: ---Inguard Bootup Complete -- OK InguardBootup Buffered Test Signal detected serialNumberW = 0000000000 rtnCode = 0 serialNumberW = 0000000000 rtnCode = 0 serialNumberW = 0000000000 rtnCode = 0 serialNumberW = 0000000000 rtnCode = 0 serialNumberW = 0000000000 rtnCode = 0 --- End code --- |
| TheSteve:
The master model/serial # is in the front panel. It is also stored on the mainboard. If you were to buy a new front panel it would be initialized such that when it was first connected it would read the model/serial from your mainboard. It would then be stored in the front panel and can no longer be changed. There are also SCPI commands to set them, but it is unlikely they will work. Still worth a shot: diag:ofinit "SERIAL", "MODEL" |
| dc101:
I did some more digging and found an interesting u-boot command factory. --- Code: ---p510> help factory factory - factory - program factory data into NAND memory Usage: factory <address> - the first 2K of RAM <address> will be written to NAND at the appropriate block p510> --- End code --- Interestingly, it only takes one argument, the ram address to read from. This means that the NAND address must be hard coded in the function. Sure enough, a few minutes of IDA and we find that the hardcoded NAND address is 0x80000. We also find something that's probably a little more interesting. An undocumented argument. Looking at the pseudo code in IDA, it first checks the number if arguments passed to factory. If that number is equal to 2, it checks to see if the word list is contained in the argument. Following the code, you'll see that passing list will print the factory data stored in NAND. If list is not found it assumes you passed an address and will write the first 2K of the specified address to the NAND address 0x80000 --- Code: ---p510> factory list Manufacturing Data MAC: XX-XX-XX-XX-XX-XX GUID: XXXXXXXX-XXXX-XXXX-XXXXXXXXXXXXXXXX SN: MY99999999 p510> --- End code --- This should help us understand the exact format the data needs to be in, and allow anyone to reprogram their serial number. Still a little fuzzy on the model number though, unless it is somehow related to the GUID? |
| Navigation |
| Message Index |
| Next page |
| Previous page |