Electronics > Repair

[Solved!]Looking for firmware dump for Tek THS3024.(How to repair firmware)

(1/8) > >>

squadchannel:
update 15/06/2024: Problem solved.
https://www.eevblog.com/forum/repair/looking-for-firmware-dump-for-tek-ths3024/msg5542145/#msg5542145

I recently acquired a THS3024. It is, of course, a faulty item.
It arrived. It should have been an easier fix, but I was surprised when it started up and the buzzer "beep" and looped. I was convinced it was a tough job.
I dumped the firmware with TL866.
Oh, the contents are corrupted. I am trying to restore it somehow.
The saving grace is the post below. It is a tool that can generate the contents of the firmware in the flash from the file for update.
https://www.eevblog.com/forum/microcontrollers/fluke-19xbcii-firmware-to-binary-converter/msg1280562

I was able to use this tool to write the generated firmware and boot.
But, of course, the generated file is missing the serial and the data that identifies the 3014/3024.
I know where it is, but when I copy and merge that part from the corrupted dump, it is not recognized. This is because it recognizes it as 3014 when it should be 3024. Bandwidth is limited.
If anyone can help me, I would appreciate it.

fzabkar:
Can you upload the dump and the regenerated flash image? Perhaps someone may know how to edit the missing data.

squadchannel:
Attached.
The generated image has a large "00" chuck. That is where the device-specific data is located. It is not overwritten by the updater, so it is zero-filled.

$4EC0-$0FFF:I was able to confirm the character strings such as serial and model number (THS3024). However, the part that corresponds to the upper ROM has been partially damaged and is now FF. I am not sure if this is normal or not, so I am looking for someone who can read out the ROM.
I have tried merging this section of data with the generated ROM, but it seems to be recognized as corrupt and rewritten.
If it is detected as corrupt, it appears to be initialized with the data in $1C12B0-$1C17FF, described below.
I think there is a checksum something somewhere, but I have no idea.
However, even though it is damaged, it also feels normal. In any case, it is hard to tell without being able to compare.

$1C12B0-$1C17FF:Perhaps initialization? There is data for.
$1C2000-$1C3FFF:PreCal? There is a mode that can calibration without instrumentation, and if you take the difference between before and after the run, it appears to be rewritten.

$384D64: after this is probably the part used as storage for screen captures, etc., so it does not exist. I captured the screen after startup and saved the .bmp. There was a magic number "42 4D".

squadchannel:
Incidentally, the board design is very similar to the Fluke 190 Series II.
components are visually identical, although some of the components used are different.
main chip also says Fluke, so it is a Fluke OEM.

THS3024(flash was removed):




Fluke 190 Series II(from service manual):

fzabkar:
It seems to me that the section from 0xC000 to 0xFFFF should be a copy of the section from 0x8000 to 0xBFFF. Perhaps the solution is to replace the first 16KiB section with the second 16KiB section in your dead.bin dump?

I believe each 16KiB section has two checksums at the end, but I can't make sense of them. Hopefully the second section is not corrupt.


--- Code: ---Offset(h) 00       04       08       0C

0000FFF0  FFFFFFFF FFFFFFFF 9B000000 71FFFFFF
--- End code ---

Edit:

I think both sections are corrupt, but I'm wondering if there is a way to combine the good areas of each?

Edit #2:

Actually, I think there are 4 x 8KiB blocks, each with a pair of checksums at the end. I don't think they are meant to be identical, but it may still be possible to repair one section by using parts of another.

Edit #3:

I think I see the pattern. The 3rd and 4th blocks are constructed from the 1st and 2nd blocks.


--- Code: ---Offset(h) 00   02   04   06   08   0A   0C   0E

00000000  FFFF 0200 FFFF 0000 FFFF 0000 FFFF DC0D   0x8000_9FFF.bin

00000000  0004 FFFF C419 FFFF 0100 FFFF AF6C FFFF   0xA000_BFFF.bin

00000000  0004 0200 C419 0000 0100 0000 D86B 210E   0xC000_DFFF.bin

00000000  FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   0xE000_FFFF.bin
--- End code ---

Navigation

[0] Message Index

[#] Next page

There was an error while thanking
Thanking...
Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod