Author Topic: [solved + hacked] Bad firmware installed in TDS1001C-EDU  (Read 2276 times)

0 Members and 1 Guest are viewing this topic.

Online Silicium81Topic starter

  • Regular Contributor
  • *
  • Posts: 73
  • Country: fr
    • Technical forum
[solved + hacked] Bad firmware installed in TDS1001C-EDU
« on: March 09, 2022, 08:15:19 pm »
I made the mistake of installing the wrong firmware in a TDS 1001C-EDU... Despite the message "update firmware successful", it no longer starts, there are only 3 leds lit and it is frozen... .
Fortunately, I have another identical functional device.
Do you think that copying the contents of the flash memory of a functional device into the memory of the patient will put things back in order?
To do this, I plan to unsolder the flash memory (29JL064) of a working device, read it with a TL866-2 programmer equipped with the TSOP48 support, then transfer this code to the corrupted memory and put the two memories back in place.
« Last Edit: March 22, 2022, 07:14:51 pm by Silicium81 »
Electronic engineer with a passion for mechanics
https://vae-tech.forumactif.org/
 

Offline fzabkar

  • Super Contributor
  • ***
  • Posts: 2189
  • Country: au
Re: Bad firmware installed in TDS1001C-EDU
« Reply #1 on: March 09, 2022, 11:39:19 pm »
I would dump the patient's flash memory and compare it against the update payload. Perhaps there are unique areas in the flash that must be preserved?
 

Online Silicium81Topic starter

  • Regular Contributor
  • *
  • Posts: 73
  • Country: fr
    • Technical forum
Re: Bad firmware installed in TDS1001C-EDU
« Reply #2 on: March 21, 2022, 11:16:10 am »
I received the TL866IIplus programmer with the TSOP48 adapter.
So I unsoldered the two flash memories and made the transfer of the contents of the scope rom ok to the scope rom whose firmware was corrupt and broken at startup.
The operation is a success and the scope restarted normally. An automatic calibration also worked. The serial number is also correct (it must be stored in EEPROM).
If it is useful for someone, the contents of the read ROMFLASH is dowload here (8MBytes): https://www.cjoint.com/c/LCvlrexYin2 or zipped in pj (remove .txt extension after unzipping)

I would like to hack the model to TDS2022B (the hardware is the same) but I can't get the script offered here to work: https://www.eevblog.com/forum/testgear/tektronix-tds1000b-series-hacks/msg1451551/#msg1451551


« Last Edit: March 22, 2022, 07:10:59 pm by Silicium81 »
Electronic engineer with a passion for mechanics
https://vae-tech.forumactif.org/
 
The following users thanked this post: coromonadalix

Online Silicium81Topic starter

  • Regular Contributor
  • *
  • Posts: 73
  • Country: fr
    • Technical forum
Re: Bad firmware installed in TDS1001C-EDU
« Reply #3 on: March 22, 2022, 07:10:33 pm »
Success for hack the scope !!
40MHz/500Msp/s to 200MHz/2Gsp/s  :popcorn:
The TDS1001C-EDU is transform in TDS2022B

To use the script, you must install python 2.7

In pj, the script modify for add TDS1001C-EDU (identify: 0x22)

Electronic engineer with a passion for mechanics
https://vae-tech.forumactif.org/
 

Offline vishaldotgupta

  • Contributor
  • Posts: 45
  • Country: in
Re: [solved + hacked] Bad firmware installed in TDS1001C-EDU
« Reply #4 on: October 04, 2022, 07:48:51 am »
Hi.

I have a tds2002b whose original flash got corrupted while doing upgrade.  Can you please share flash dump for tds2002b or of any model in tds2000b 2 channel model.  Also share check sum value to make sure data doesn't get corrupted during transmission
 

Offline coromonadalix

  • Super Contributor
  • ***
  • Posts: 5701
  • Country: ca
Re: [solved + hacked] Bad firmware installed in TDS1001C-EDU
« Reply #5 on: October 04, 2022, 11:43:28 am »
@Silicium

Now  hack the Tektronix sticker,  this one will be hard  loll   :-DD
 

Offline vishaldotgupta

  • Contributor
  • Posts: 45
  • Country: in
Re: [solved + hacked] Bad firmware installed in TDS1001C-EDU
« Reply #6 on: October 04, 2022, 01:39:45 pm »
nice work.

few questions / comments

1. your model is having LED backlighted color display? Right
2. did you also changed the LED backlighted display.  the original B series models support CCFL backlighted display.   these display having different data patterns
3. can you please share the updated rom file for patch.  Mine got corrupted and i do not have a working back up copy.  if possible share checksum value of entire bin file to ensure data integrity
 

Offline lern01

  • Regular Contributor
  • *
  • Posts: 68
  • Country: cn
Re: [solved + hacked] Bad firmware installed in TDS1001C-EDU
« Reply #7 on: October 19, 2023, 02:13:21 pm »
Thank you very much for your work. Could you please take a picture of sop48 chip connecting to catapult? I don't have sop48 converter base. Programmer only 40 pin socket, how to connect? Thanks again!
 

Online Silicium81Topic starter

  • Regular Contributor
  • *
  • Posts: 73
  • Country: fr
    • Technical forum
Re: [solved + hacked] Bad firmware installed in TDS1001C-EDU
« Reply #8 on: October 21, 2023, 09:04:23 pm »
Thank you very much for your work. Could you please take a picture of sop48 chip connecting to catapult? I don't have sop48 converter base. Programmer only 40 pin socket, how to connect? Thanks again!

See here (in french): https://vae-tech.forumactif.org/t268-mauvais-firmware-hack-oscilloscope-tektronix
Electronic engineer with a passion for mechanics
https://vae-tech.forumactif.org/
 

Offline lern01

  • Regular Contributor
  • *
  • Posts: 68
  • Country: cn
Re: [solved + hacked] Bad firmware installed in TDS1001C-EDU
« Reply #9 on: October 23, 2023, 11:28:32 am »
Thank you very much, I am TL866CS, read S29JL064H90TFI000 maximum address is only 0x003FFFFF, what is the reason?Thank you for your trouble!
 

Offline Shonky

  • Frequent Contributor
  • **
  • Posts: 290
  • Country: au
Re: [solved + hacked] Bad firmware installed in TDS1001C-EDU
« Reply #10 on: October 23, 2023, 11:58:11 am »
Thank you very much, I am TL866CS, read S29JL064H90TFI000 maximum address is only 0x003FFFFF, what is the reason?Thank you for your trouble!
It is displaying it as 16 bits (a word) per address location i.e. 0x000000 to 0x000007 is actually 16 bytes. So for 64Mbit it will only show 4M addresses (of 16 bits). If you save the file it should be 8Mbyte.
« Last Edit: October 23, 2023, 11:59:57 am by Shonky »
 

Offline lern01

  • Regular Contributor
  • *
  • Posts: 68
  • Country: cn
Re: [solved + hacked] Bad firmware installed in TDS1001C-EDU
« Reply #11 on: October 23, 2023, 01:40:09 pm »
thanks! How to set it to 8-bit display?
 

Offline lern01

  • Regular Contributor
  • *
  • Posts: 68
  • Country: cn
Re: [solved + hacked] Bad firmware installed in TDS1001C-EDU
« Reply #12 on: October 23, 2023, 02:12:24 pm »
Use your firmware, according to your script to modify the firmware, burning error, hope to give guidance, thank you! model number:S29JL064H90TFI00
 

Online Silicium81Topic starter

  • Regular Contributor
  • *
  • Posts: 73
  • Country: fr
    • Technical forum
Re: [solved + hacked] Bad firmware installed in TDS1001C-EDU
« Reply #13 on: January 18, 2024, 09:31:03 am »
How did you program the memory?
Did you desolder the component?
If yes, have the pins of the unsoldered memory been perfectly cleaned?
The contacts in the programming support must be of good quality otherwise it is normal to experience programming difficulties!

If not, I'm not sure that in situ programming is possible...
« Last Edit: January 18, 2024, 09:35:35 am by Silicium81 »
Electronic engineer with a passion for mechanics
https://vae-tech.forumactif.org/
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf