Electronics > Repair

[Solved!]Looking for firmware dump for Tek THS3024.(How to repair firmware)

<< < (6/8) > >>

fzabkar:

--- Quote from: squadchannel on June 10, 2024, 02:00:20 pm ---The problem is how to recover the part from $4EC0-$FFFF, which we believe has its serial number and calibration constants written to it.
--- End quote ---
There must be some whitespace between 0x4EC0 and 0x8000. This is so that a firmware update can "grow". Also, both upper and lower ROMs must be corrupt, but not consistently so, otherwise I would not have been able to reconstruct those 4 x 8KiB blocks.


--- Code: ---Offset(h) 00   02   04   06   08   0A   0C   0E

00008000  FFFF 0200 FFFF 0000 FFFF 0000 FFFF DC0D
00008010  FFFF 0044 FFFF 0000 FFFF 0000 FFFF 0000
00008020  FFFF 1348 FFFF 7011 FFFF 0100 FFFF 6900
........
0000A000  0004 FFFF C419 FFFF 0100 FFFF AF6C FFFF
0000A010  7600 FFFF 0000 FFFF 0000 FFFF 0000 FFFF
0000A020  0100 FFFF CE00 FFFF 2000 FFFF 5500 FFFF
--- End code ---

coromonadalix:
can this 2014 FW and flash tool help ?   attached


Firmware v01.02 corrects the problem happened during probe calibration. Before the change, Waveform is not visible during probe calibration when certain languages are selected. Less than 2 divisions are visible due to pop-up window size. Detail …

Firmware | P/N 066136603 | Date: Monday, March 17 2014

fzabkar:
I examined the firmware payload and extracted the metadata for the DATA BLOCKs. I then looked for "holes", ie areas that are not touched by the update.

For example, bytes 0x20dbc2 - 0x20dbc3 are untouched.


--- Code: ---,#H4020c000,#H1000
,#H4020d000,#Hbc2
,#H4020dbc4,#H1000
--- End code ---

This is the corresponding area in dead.bin:


--- Code: ---Offset(h) 00   02   04   06   08   0A   0C   0E

0020DBB0  0000 0000 0000 0000 0000 0000 0000 0000
0020DBC0  0000 FFFF 0000 4902 0000 0944 0000 0000
               ^^^^
0020DBD0  0000 0000 0000 0000 0000 0000 0000 0000
--- End code ---

Is this the original data, or is it now corrupt? Was this area ever programmed, in which case 0xFFFF would be the normal erased state of this word? Have I introduced a red herring?

fzabkar:
Ruby.ldf


--- Code: ---,#H40000000,#H28
,#H40000028,#H4
,#H40000030,#H8
,#H40000040,#H30
,#H40000080,#H1000
--- End code ---

dead.bin


--- Code: ---Offset(h) 00   02   04   06   08   0A   0C   0E

00000000  1122 3344 5566 7788 5555 5555 AAAA AAAA
00000010  3333 3333 CCCC CCCC 0F0F 0F0F F0F0 F0F0
00000020  FF00 FF00 00FF 00FF 3000 0040 FFFF FFFF
00000030  4000 0040 5800 0040 FFFF FFFF FFFF FFFF
00000040  0080 0040 0040 0000 00C0 0040 0040 0000
00000050  0000 0000 0000 0000 0000 3F40 0040 0000
00000060  0040 3F40 0040 0000 0000 0000 0000 0000
00000070  0000 0000 0200 0000 0020 0000 0200 0000
--- End code ---

These words have not been reprogrammed by the update. Are they corrupt?


--- Code: ---Offset(h) 00   02   04   06   08   0A   0C   0E

00000020                                FFFF FFFF
00000030                      FFFF FFFF FFFF FFFF
........
00000070  0000 0000 0200 0000 0020 0000 0200 0000
--- End code ---

squadchannel:
omgggggggggggggggggggggggggggg :) :) :) :) :) :) :) :) :) :) :) :)
I will describe the details later, but it is now recognized when I rewrote it appropriately. I am extremely happy!
We will summarize later, as we do not know how the changes we made in the binary affect it.
We will leave the binary that we were able to launch. It is not the final binary, so please do not try it with your own scope.

I haven't had lunch, so I'm going to go eat.

 :-+ :-+ :-+ :-+ :-+ :-+ :-+ :-+ :-+ :-+ :-+ :-+ :-+ :-+ :-+ :-+ :-+ :-+ :-+ :-+ :-+


Navigation

[0] Message Index

[#] Next page

[*] Previous page

There was an error while thanking
Thanking...
Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod