[solved + hacked] Bad firmware installed in TDS1001C-EDU

[Silicium81]

I made the mistake of installing the wrong firmware in a TDS 1001C-EDU... Despite the message "update firmware successful", it no longer starts, there are only 3 leds lit and it is frozen... .
Fortunately, I have another identical functional device.
Do you think that copying the contents of the flash memory of a functional device into the memory of the patient will put things back in order?
To do this, I plan to unsolder the flash memory (29JL064) of a working device, read it with a TL866-2 programmer equipped with the TSOP48 support, then transfer this code to the corrupted memory and put the two memories back in place.

[fzabkar]

I would dump the patient's flash memory and compare it against the update payload. Perhaps there are unique areas in the flash that must be preserved?

[Silicium81]

I received the TL866IIplus programmer with the TSOP48 adapter.
So I unsoldered the two flash memories and made the transfer of the contents of the scope rom ok to the scope rom whose firmware was corrupt and broken at startup.
The operation is a success and the scope restarted normally. An automatic calibration also worked. The serial number is also correct (it must be stored in EEPROM).
If it is useful for someone, the contents of the read ROMFLASH is dowload here (8MBytes): https://www.cjoint.com/c/LCvlrexYin2 or zipped in pj (remove .txt extension after unzipping)

I would like to hack the model to TDS2022B (the hardware is the same) but I can't get the script offered here to work: https://www.eevblog.com/forum/testgear/tektronix-tds1000b-series-hacks/msg1451551/#msg1451551

[Silicium81]

Success for hack the scope !!
40MHz/500Msp/s to 200MHz/2Gsp/s 
The TDS1001C-EDU is transform in TDS2022B

To use the script, you must install python 2.7

In pj, the script modify for add TDS1001C-EDU (identify: 0x22)

[vishaldotgupta]

Hi.

I have a tds2002b whose original flash got corrupted while doing upgrade.  Can you please share flash dump for tds2002b or of any model in tds2000b 2 channel model.  Also share check sum value to make sure data doesn't get corrupted during transmission

[coromonadalix]

@Silicium

Now  hack the Tektronix sticker,  this one will be hard  loll   

[vishaldotgupta]

nice work.

few questions / comments

1. your model is having LED backlighted color display? Right
2. did you also changed the LED backlighted display.  the original B series models support CCFL backlighted display.   these display having different data patterns
3. can you please share the updated rom file for patch.  Mine got corrupted and i do not have a working back up copy.  if possible share checksum value of entire bin file to ensure data integrity

[lern01]

Thank you very much for your work. Could you please take a picture of sop48 chip connecting to catapult? I don't have sop48 converter base. Programmer only 40 pin socket, how to connect? Thanks again!

[Silicium81]

Thank you very much for your work. Could you please take a picture of sop48 chip connecting to catapult? I don't have sop48 converter base. Programmer only 40 pin socket, how to connect? Thanks again!

See here (in french): https://vae-tech.forumactif.org/t268-mauvais-firmware-hack-oscilloscope-tektronix

[lern01]

Thank you very much, I am TL866CS, read S29JL064H90TFI000 maximum address is only 0x003FFFFF, what is the reason?Thank you for your trouble!

[Shonky]

Thank you very much, I am TL866CS, read S29JL064H90TFI000 maximum address is only 0x003FFFFF, what is the reason?Thank you for your trouble!

It is displaying it as 16 bits (a word) per address location i.e. 0x000000 to 0x000007 is actually 16 bytes. So for 64Mbit it will only show 4M addresses (of 16 bits). If you save the file it should be 8Mbyte.

[lern01]

thanks! How to set it to 8-bit display?

[lern01]

Use your firmware, according to your script to modify the firmware, burning error, hope to give guidance, thank you! model number:S29JL064H90TFI00

[Silicium81]

How did you program the memory?
Did you desolder the component?
If yes, have the pins of the unsoldered memory been perfectly cleaned?
The contacts in the programming support must be of good quality otherwise it is normal to experience programming difficulties!

If not, I'm not sure that in situ programming is possible...