As i'm not able to fix the ADC failure (neither have BGA soldering equipment nor a replacement chip), i decided to go a different way. The problem with the scope is that SPC fails and reverts all the SPC data to defaults. This renders the scope useless, because all the level/timing calibration data is gone. This is especially bad at the 12.5GS/s and 25GS/s sampling rates, because it uses more than one ADC. Without calibration you basically get 8 traces on the screen, because interleaving isn't calibrated.
So what i did now: I modified the Tek software so that it will just ignore errors during SPC. This makes CH1 + CH2 full usable, CH3 is still broken (of course), and CH4 works almost ok until you reach 12.5GS/s. So i have at least a working 4GHz dual channel scope

Of course that's not suitable for production use, but who cares if it's just for hobby use.
I used a python script to patch all those SPC routines, because it were really a lot of changes...
import shutil
def change_bytes(f, pos, old, new):
if len(old) != len(new):
print("old and new differ in size")
return
f.seek(pos - 0x400c00)
tmp = f.read(len(old))
if tmp != old:
print("doesnt match")
print("addr ", hex(pos))
print("old", old)
print("tmp", tmp)
return
f.seek(pos - 0x400c00)
f.write(new)
shutil.copyfile("scope.exe.ori", "scope.exe")
f = open("scope.exe", "rb+")
# change_bytes(f, 0x870301, bytes([ 0xff, 0xff, 0xff, 0xff ]), bytes([ 0x00, 0x00, 0x00, 0x00 ]))
# skip power up diags (doesn't work, crashes app)
# change_bytes(f, 0x917ffa, bytes([ 0x0f, 0x85, 0xba, 0x00, 0x00, 0x00 ]), bytes([ 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 ]))
# change_bytes(f, 0x914a19, bytes([ 0xff, 0x55, 0xfc ]), bytes([ 0x33, 0xc0, 0x90 ]))
# ignore SPC errors and don't revert spc data
change_bytes(f, 0x8aed6a, bytes([ 0x75, 0x1d ]), bytes([ 0x90, 0x90 ]))
# ignore retry error in a2DPhaseCal
change_bytes(f, 0x9aac63, bytes([ 0x89, 0x45, 0xf8, 0x8b, 0x45, 0xf8 ]), bytes([ 0x33, 0xc0, 0x90, 0x90, 0x90, 0x90 ]))
# ignore 'failed to get good crossing'
change_bytes(f, 0x8d8a44, bytes([ 0x75, 0x27 ]), bytes([ 0x90, 0x90 ]))
# skip crossing checks in calibratePhaseCal
change_bytes(f, 0x8d90ab, bytes([ 0x3d, 0xe8, 0x03, 0x00, 0x00, 0x7f, 0x17, 0x3d, 0x18, 0xfc, 0xff, 0xff, 0x7c, 0x10 ]),
bytes([ 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 ]))
# addition cross checking ignore
change_bytes(f, 0x8d9217, bytes([ 0x81, 0xf9, 0xe8, 0x03, 0x00, 0x00, 0x0f, 0x8f, 0xa5, 0x02, 0x00, 0x00, 0x81, 0xf9, 0x18, 0xfc, 0xff, 0xff, 0x0f, 0x8c, 0x99, 0x02, 0x00, 0x00 ]),
bytes([ 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 ]))
# force ret = 0 in calibratePhaseCal
change_bytes(f, 0x8d910d, bytes([ 0x83, 0xc8, 0xff ]), bytes([ 0x33, 0xc0, 0x90 ]))
# force interleavecal
change_bytes(f, 0x86a450, bytes([ 0x0f, 0x8f, 0x51, 0xf7, 0xff, 0xff ]), bytes([ 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 ]))
# force ret = 0
change_bytes(f, 0x8d6b79, bytes([ 0x83, 0xc8, 0xff ]), bytes([ 0x33, 0xc0, 0x90 ]))
# force ret = 0
change_bytes(f, 0x8d71bf, bytes([ 0x83, 0xc8, 0xff ]), bytes([ 0x33, 0xc0, 0x90 ]))
# ignore error in deskewChannels
change_bytes(f, 0x8d9f1e, bytes([ 0xff, 0xff, 0xff, 0xff ]), bytes([ 0x00, 0x00, 0x00, 0x00 ]))
# ignore error in Hfd200Balance
change_bytes(f, 0x9ac15b, bytes([ 0x75, 0x2f ]), bytes([ 0xeb, 0x2f ])) # 10mV
change_bytes(f, 0x9ac241, bytes([ 0x75, 0x2f ]), bytes([ 0xeb, 0x2f ])) # 20mV
change_bytes(f, 0x9ac328, bytes([ 0x75, 0x2c ]), bytes([ 0xeb, 0x2c ])) # 50mV
# force ret = 0 in calLinearity
change_bytes(f, 0x88c489, bytes([ 0x83, 0xc8, 0xff ]), bytes([ 0x33, 0xc0, 0x90 ]))
# ignore error in calNullInput
change_bytes(f, 0x9cf803, bytes([ 0x7a, 0x40 ]), bytes([ 0xeb, 0x40 ]))
change_bytes(f, 0x9cf879, bytes([ 0x75, 0x3d ]), bytes([ 0xeb, 0x3d ]))
# ignore error in calVarigainHfd200
change_bytes(f, 0x8811eb, bytes([ 0x7a, 0x59 ]), bytes([ 0xeb, 0x59 ]))
change_bytes(f, 0x8812a5, bytes([ 0x74, 0x59 ]), bytes([ 0xeb, 0x59 ]))
change_bytes(f, 0x88136c, bytes([ 0x74, 0x59 ]), bytes([ 0xeb, 0x59 ]))
change_bytes(f, 0x88141f, bytes([ 0x7a, 0x59 ]), bytes([ 0xeb, 0x59 ]))
change_bytes(f, 0x8814ec, bytes([ 0x74, 0x59 ]), bytes([ 0xeb, 0x59 ]))
change_bytes(f, 0x8815b3, bytes([ 0x74, 0x59 ]), bytes([ 0xeb, 0x59 ]))
change_bytes(f, 0x881720, bytes([ 0x7a, 0x5c ]), bytes([ 0xeb, 0x5c ]))
change_bytes(f, 0x8817d1, bytes([ 0x74, 0x5c ]), bytes([ 0xeb, 0x5c ]))
change_bytes(f, 0x8818d9, bytes([ 0x7a, 0x5c ]), bytes([ 0xeb, 0x5c ]))
change_bytes(f, 0x881a71, bytes([ 0x7a, 0x59 ]), bytes([ 0xeb, 0x59 ]))
change_bytes(f, 0x881b2b, bytes([ 0x74, 0x59 ]), bytes([ 0xeb, 0x59 ]))
change_bytes(f, 0x881bf2, bytes([ 0x74, 0x59 ]), bytes([ 0xeb, 0x59 ]))
change_bytes(f, 0x881ca5, bytes([ 0x7a, 0x59 ]), bytes([ 0xeb, 0x59 ]))
change_bytes(f, 0x881d72, bytes([ 0x74, 0x59 ]), bytes([ 0xeb, 0x59 ]))
change_bytes(f, 0x881e39, bytes([ 0x74, 0x59 ]), bytes([ 0xeb, 0x59 ]))
change_bytes(f, 0x881fa6, bytes([ 0x7a, 0x5c ]), bytes([ 0xeb, 0x5c ]))
change_bytes(f, 0x882057, bytes([ 0x74, 0x5c ]), bytes([ 0xeb, 0x5c ]))
change_bytes(f, 0x88215f, bytes([ 0x7a, 0x5c ]), bytes([ 0xeb, 0x5c ]))
change_bytes(f, 0x8822f7, bytes([ 0x7a, 0x59 ]), bytes([ 0xeb, 0x59 ]))
change_bytes(f, 0x8823b1, bytes([ 0x74, 0x59 ]), bytes([ 0xeb, 0x59 ]))
change_bytes(f, 0x882478, bytes([ 0x74, 0x59 ]), bytes([ 0xeb, 0x59 ]))
change_bytes(f, 0x88252e, bytes([ 0x7a, 0x59 ]), bytes([ 0xeb, 0x59 ]))
change_bytes(f, 0x8825fb, bytes([ 0x74, 0x59 ]), bytes([ 0xeb, 0x59 ]))
change_bytes(f, 0x8826c2, bytes([ 0x74, 0x59 ]), bytes([ 0xeb, 0x59 ]))
change_bytes(f, 0x88282f, bytes([ 0x7a, 0x5c ]), bytes([ 0xeb, 0x5c ]))
change_bytes(f, 0x8828e0, bytes([ 0x74, 0x5c ]), bytes([ 0xeb, 0x5c ]))
change_bytes(f, 0x8829e8, bytes([ 0x7a, 0x59 ]), bytes([ 0xeb, 0x59 ]))
# ignore error in calVarigainHfd200
change_bytes(f, 0x8806d9, bytes([ 0x7a, 0x43 ]), bytes([ 0xeb, 0x43 ]))
change_bytes(f, 0x88074d, bytes([ 0x74, 0x43 ]), bytes([ 0xeb, 0x43 ]))
change_bytes(f, 0x8807d9, bytes([ 0x7a, 0x43 ]), bytes([ 0xeb, 0x43 ]))
change_bytes(f, 0x88084d, bytes([ 0x74, 0x43 ]), bytes([ 0xeb, 0x43 ]))
change_bytes(f, 0x8809a6, bytes([ 0x7a, 0x47 ]), bytes([ 0xeb, 0x47 ]))
change_bytes(f, 0x880a1a, bytes([ 0x74, 0x47 ]), bytes([ 0xeb, 0x47 ]))
# ignore error in calA2D
change_bytes(f, 0x87f740, bytes([ 0x7e, 0x18 ]), bytes([ 0x90, 0x90 ]))
change_bytes(f, 0x87f748, bytes([ 0x7e, 0x10 ]), bytes([ 0x90, 0x90 ]))
change_bytes(f, 0x87f750, bytes([ 0x7d, 0x08 ]), bytes([ 0x90, 0x90 ]))
change_bytes(f, 0x87f758, bytes([ 0x7c, 0x3d ]), bytes([ 0xeb, 0x3d ]))
# ignore error in calA2Disee
change_bytes(f, 0x87ebc7, bytes([ 0x74, 0x19 ]), bytes([ 0xeb, 0x19 ]))
change_bytes(f, 0x87e8ee, bytes([ 0x74, 0x0d ]), bytes([ 0xeb, 0x0d ]))
# ignore error in calStepgainHFD200
change_bytes(f, 0x883ac0, bytes([ 0x74, 0x2f ]), bytes([ 0xeb, 0x2f ]))
change_bytes(f, 0x883c1e, bytes([ 0x74, 0x2f ]), bytes([ 0xeb, 0x2f ]))
change_bytes(f, 0x883d7a, bytes([ 0x74, 0x2f ]), bytes([ 0xeb, 0x2f ]))
# ignore error in measureGainOffsetHFD200
change_bytes(f, 0x882d1a, bytes([ 0x74, 0x44 ]), bytes([ 0xeb, 0x44 ]))
change_bytes(f, 0x882f8b, bytes([ 0x74, 0x4d ]), bytes([ 0xeb, 0x4d ]))
change_bytes(f, 0x883360, bytes([ 0x74, 0x35 ]), bytes([ 0xeb, 0x35 ]))
change_bytes(f, 0x8832c7, bytes([ 0x74, 0x35 ]), bytes([ 0xeb, 0x35 ]))
change_bytes(f, 0x8835d9, bytes([ 0x74, 0x35 ]), bytes([ 0xeb, 0x35 ]))
change_bytes(f, 0x88353e, bytes([ 0x74, 0x35 ]), bytes([ 0xeb, 0x35 ]))
# ignore error in calDigPosition
change_bytes(f, 0x9a99ee, bytes([ 0x7a, 0x38 ]), bytes([ 0xeb, 0x38 ]))
change_bytes(f, 0x9a9a84, bytes([ 0x75, 0x38 ]), bytes([ 0xeb, 0x38 ]))
f.close()
Note that this will only work with Scope.exe Version: 5.3.5 Build 22, md5sum acd94445d1d886f2858de53be05c5e0b