Author Topic: Backup Firmware DG1022 (Read 15201 times)

Igor_k · « **on:** January 26, 2016, 12:13:34 pm »

JTAG Blackfin & Altera

Igor_k · « **Reply #1 on:** January 27, 2016, 01:00:02 am »

WIGGLER Blackfin JTAG Altera JTAG
TMS -- TMS -- TMS
TCK -- TCK -- TCK
TDI -- TDI
TDO -- TDI
TDO -------------------- TDO

Igor_k · « **Reply #2 on:** January 27, 2016, 01:03:26 am »

Scheme

Igor_k · « **Reply #3 on:** January 27, 2016, 01:27:03 am »

Windows XP SP3
TopJTAG Flash Programmer

Igor_k · « **Reply #4 on:** January 27, 2016, 01:33:37 am »

JTAG chain

Igor_k · « **Reply #5 on:** January 27, 2016, 02:56:28 pm »

Flash array

Igor_k · « **Reply #6 on:** January 27, 2016, 03:02:58 pm »

Signal pins

Igor_k · « **Reply #7 on:** January 27, 2016, 03:18:32 pm »

Backup Full Flash

Igor_k · « **Reply #8 on:** January 27, 2016, 04:17:42 pm »

=========
Links:
=========
http://www.topjtag.com/flash-programmer/
http://www.analog.com/media/en/simulation-models/bsdl-model-files/ADSP_BF532_LQFP.bsdl.txt
ftp://ftp.altera.com/outgoing/download/bsdl/EP2C8AQ208.BSD

TheSteve · « **Reply #9 on:** January 27, 2016, 07:40:51 pm »

Nice work, thank you for the detailed post. Oh how I miss the parallel port, it was useful for so many things.

Are you also able to erase/program the various memories?

Igor_k · « **Reply #10 on:** January 27, 2016, 08:04:30 pm »

Quote from: TheSteve on January 27, 2016, 07:40:51 pm

Nice work, thank you for the detailed post.

I will be glad if the information will be useful.

Quote from: TheSteve on January 27, 2016, 07:40:51 pm

Oh how I miss the parallel port, it was useful for so many things.

The parallel port has been selected as an example.
TopJTAG Flash Programmer support many USB cables:
Altera USB-Blaster, USB to JTAG interfaces based on FTDI FT2232 chip, e.g.
Olimex ARM-USB-TINY-H, ARM-USB-OCD and ARM-USB-TINY, Digilent JTAG-USB...

Quote from: TheSteve on January 27, 2016, 07:40:51 pm

Are you also able to erase/program the various memories?

Yes.

Kirill S · « **Reply #11 on:** October 31, 2016, 01:07:41 am »

Thanks, Igor, for the detailed instructions. I've managed to flash my Atten ADS1102CAL over JTAG with J-Link cable+topJTAG Flash Programmer. There are some differences. I have Lattice FPGA on the board which controls 3 high address pins of the flash.
Could you explain what is the purpose of configuring static pins of Altera FPGA in topJTAG Flash Programmer Setup?

Paul_Elec · « **Reply #12 on:** March 08, 2017, 09:31:49 pm »

Hi everyone,
I'm bumping this thread in the hope that the owner of an old DG1022 will be able to backup his/her firmware and let me know about it.
I desperately need a firmware PRIOR 00.01.00.04.00.02.07. I think the best one for my equipment is 00.01.00.04.00.02.03
If some one could spare some time doing this, you would make my (and other people in the same boat) day as Rigol last legacy (.ldr) firmware (00.01.00.04.00.02.03) has a bug disabling the channel 1 and they are totally helpless.
Thanks in advance,
Paul

ivi_yak · « **Reply #13 on:** January 03, 2018, 02:18:42 pm »

hi, could it possible to load flash via jtag? i have setup seems to your and can read flash but cant to write and have error

Igor_k · « **Reply #14 on:** January 04, 2018, 10:31:26 am »

Quote from: ivi_yak on January 03, 2018, 02:18:42 pm

hi, could it possible to load flash via jtag? i have setup seems to your and can read flash but cant to write and have error

You can read, erase and write!
Checked personally.

ivi_yak · « **Reply #15 on:** January 04, 2018, 10:53:19 am »

finally i can write some to flash but when i start read after write ist only FFFFF.... in memory (seems empty).

jtag my chain is Altera EP2C5Q208 + BF531+j-linkv8 normally detected by topjtag
Maybe something wrong? If it possible Could you share your mem dump I try to load it?

JimKnopf · « **Reply #16 on:** May 27, 2021, 08:05:47 am »

Hello,

anyone here able to send me a backup of an 00.03.00.08.00.02.08 Version?
I tried to update using the "help" button update procedure with .GEL files. But my DG1022 doesn't stop boot process.
So i tried to update using the .LDR file via menu/recall button for older devices.
Update succeeded, it told me to restart the device. After reboot, the display is dead (illuminated but dark).
Seems the device is bricked.

I found this thread here (after the update failed). I followed the instructions and i'm able to read the flash memory as described by Igor_k.
I need a backup or maybe a unpacked .GEL update-files (bootloader and firmware) and the memory addresses where i have to put this content to.

tv84 · « **Reply #17 on:** May 27, 2021, 12:45:48 pm »

I don't know these equipments BUT if you say you loaded a .GEL as a .LDR file, you messed things big. Because the .LDR is a raw file designed to be loaded in the BF.

A .GEL file is a package that usually contains one or more .LDR files and others.

JimKnopf · « **Reply #18 on:** May 27, 2021, 01:49:44 pm »

@tv84 I read your comments from 2016 and later for the DS1000Z series (very helpful thread by the way). I got a DS1054Z too.
The mentioned tools for the DS1000Z-GEL files does not work with the GEL files for the DG1022 devices.

I don't know why my device did not respond to the help button at boot time. Pressing help button did nothing. The device booted normal when pressing the help button (before the update trial). So i tought it must be one of the older devices that needs the LDR file. I did the update with the LDR file not with a GEL file.

Anyway, it will not start now and i need a backup dump. Otherwise i can try to flash the firmware and the new bootloader separatly. There is a M25X20AV 1Mbit SPI eeprom. I read that content out before i tried to update. I'm not sure if the content from the bootloader file has to be flashed to this SPI eeprom.

tv84 · « **Reply #19 on:** May 27, 2021, 02:10:12 pm »

Jim,

The files from DS are different from DG.

Here is the parsing of the 00.03.01.00.00 DG10x2Update.GEL:

Code: [Select]

00000000 - File Type: RIGOL:DG1:UPDATE FILE ALL
Offset     StartAdd  Size      LoadAddr  CRC16       Rsvd
00000040 - 000002C0  00000000  20000000  0000  0000  00000000
00000054 - 000002C0  0013F95A  20030000  403C  0000  00000000  [000002C0-0013FC19]  CRC NOT OK
00000068 - 0013FC1A  00001194  20208000  1907  0000  00000000  [0013FC1A-00140DAD]  CRC NOT OK
0000007C - 00140DAE  00001194  2020C000  532D  0000  00000000  [00140DAE-00141F41]  CRC NOT OK
00000090 - 00141F42  00004650  20210000  7712  0000  00000000  [00141F42-00146591]  CRC NOT OK
000000A4 - 00146592  00002EE0  20220000  9CD1  0000  00000000  [00146592-00149471]  CRC NOT OK
000000B8 - 00149472  0000EA60  20228000  DC3F  0000  00000000  [00149472-00157ED1]  CRC NOT OK
000000CC - 00157ED2  00007530  20250000  5105  0000  00000000  [00157ED2-0015F401]  CRC NOT OK
000000E0 - 0015F402  000005DC  20260000  1416  0000  00000003  [0015F402-0015F9DD]  CRC NOT OK
000000F4 - 0015F9DE  00070000  20290000  B748  0000  00000000  [0015F9DE-001CF9DD]  CRC NOT OK

It seems that I was never able to recreate the CRC...

Here is the parsing of Bootloader_03 DG10x2Update.GEL:

Code: [Select]

00000000 - File Type: RIGOL:DG1:UPDATE FILE ALL
Offset     StartAdd  Size      LoadAddr  CRC16       Rsvd
00000040 - 000002C0  00019982  20000000  0000  0000  00000000  [000002C0-00019C41]
00000054 - 00019C42  00000000  20030000  0000  0000  00000000  EOF
00000068 - 00019C42  00000000  20208000  0000  0000  00000000  EOF
0000007C - 00019C42  00000000  2020C000  0000  0000  00000000  EOF
00000090 - 00019C42  00000000  20210000  0000  0000  00000000  EOF
000000A4 - 00019C42  00000000  20220000  0000  0000  00000000  EOF
000000B8 - 00019C42  00000000  20228000  0000  0000  00000000  EOF
000000CC - 00019C42  00000000  20250000  0000  0000  00000000  EOF
000000E0 - 00019C42  00000000  20260000  0000  0000  00000000  EOF
000000F4 - 00019C42  00000000  20290000  0000  0000  00000000  EOF

Don't know if this helps you extract the raw parts.

JimKnopf · « **Reply #20 on:** May 27, 2021, 02:40:22 pm »

I just compared the content of the W25X20AV SPI chip with the content i dumped before the update. Seems this content is untouched.

# md5sum W25*.bin
9a2725ee35180f428d517cce2de1718e W25X20AV_2_flashrom_20210527_backup-test.bin
9a2725ee35180f428d517cce2de1718e W25X20AV_flashrom_20210524_backup.bin

Maybe the SPI flash has nothing to do with bootloader. Or the LDR file i flashed has no bootloader update inside.

tv84 · « **Reply #21 on:** May 27, 2021, 04:19:53 pm »

Quote from: JimKnopf on May 27, 2021, 02:40:22 pm

I just compared the content of the W25X20AV SPI chip with the content i dumped before the update. Seems this content is untouched.

# md5sum W25*.bin
9a2725ee35180f428d517cce2de1718e W25X20AV_2_flashrom_20210527_backup-test.bin
9a2725ee35180f428d517cce2de1718e W25X20AV_flashrom_20210524_backup.bin

Maybe the SPI flash has nothing to do with bootloader. Or the LDR file i flashed has no bootloader update inside.

And how do those contents compare with the parts in the .GEL that I parsed?

JimKnopf · « **Reply #22 on:** May 27, 2021, 08:11:49 pm »

I searched for some random content from the SPI dump in the two GEL files you mentioned. But could not find any match.

But, i also searched for longer random content from the two GEL files in my JTAG-NVRAM dump. And bingo, i found a lot of matches. I found nearly every content from the GEL file in my NVRAM-dump.

I attachted the NVRAM-dump. Hope someone with more clue than me can tell me whats wrong with my memory dump.

tv84 · « **Reply #23 on:** May 27, 2021, 08:46:42 pm »

The W25X20AV_flashrom_20210524_backup.bin file is the dump of the Altera FPGA.

Your NVRAM dump is from the BF.

Look at the Load Addresses of my parsings and the blocks I indicate there.

I think you have to load (patch) those blocks into your NVRAM dump. I would start by putting the bootloader in the offset 0x000000.

Remember that the offset 0 of the dump corresponds to 0x20000000 in the addresses table.

JimKnopf · « **Reply #24 on:** May 27, 2021, 09:05:11 pm »

I grabbed the W25X20AV_flashrom_20210524_backup.bin of the eeprom. I desoldered (now 2 times) the eeprom an read it with my RT809H and Batronix BX48II (tried different programmer just so see if there is a different).. Maybe it's code for the Altera processor. But i read it from eeprom.


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: Backup Firmware DG1022 (Read 15201 times)

Share me