Author Topic: TDS 1000,2000,3000 BW Hack  (Read 69708 times)

0 Members and 2 Guests are viewing this topic.

Offline Arn

  • Newbie
  • Posts: 7
  • Country: gb
Re: TDS 1000,2000,3000 BW Hack
« Reply #100 on: December 24, 2020, 05:32:03 pm »
I forgot to post the pinout for the 100-way connector...here it is

Arn.
 
The following users thanked this post: giosif

Offline Arn

  • Newbie
  • Posts: 7
  • Country: gb
Re: TDS 1000,2000,3000 BW Hack
« Reply #101 on: January 14, 2021, 07:19:45 am »
Here's an update on my TDS30xx upgrade project.

I rebuilt the pulse generator I'd thrown together, this time taking a little more care to ensure that all component lead lengths were as short as I could make them.
 
I also substituted a 2n3904 in place of the 2n222a.

The screen capture shown is taken from the new generator layout.

I get ~500ps risetime which I guess equates to a bandwidth of ~690MHz
 

Offline daveyk

  • Frequent Contributor
  • **
  • Posts: 413
  • Country: us
Re: TDS 1000,2000,3000 BW Hack
« Reply #102 on: January 14, 2021, 08:04:18 pm »
"I tested but no success. The TDS3032C I only have the 4.25 as oldest firmware. Has anyone a model C with older fw where the hack could work?"

I can not find any messages that note success.  Did you figure it out?  Quite frankly, 300MHz is good enough for what I use it for, but it would be cool to have it as a TDS3054C 8-)

Dave
 

Offline daveyk

  • Frequent Contributor
  • **
  • Posts: 413
  • Country: us
Re: TDS 1000,2000,3000 BW Hack
« Reply #103 on: January 14, 2021, 08:07:24 pm »
"Has anybody a schematic for this TDS3032C model?"

Interesting looking at your picture.  The C version still used that Dallas Battery memory?  I though by the C version they would have replaced that.

Dave
 

Offline rauldm

  • Regular Contributor
  • *
  • Posts: 155
  • Country: mx
Re: TDS 1000,2000,3000 BW Hack
« Reply #104 on: February 10, 2021, 08:25:07 pm »
I bought a used TDS3012B, I hacked it correctly, is necessary run the autocalibration for delete DC offset, the Firmware update can be work from ethernet?, exists also a disk emulator for USB, anyone tested this for firwmare update?
Regards.
 

Offline rauldm

  • Regular Contributor
  • *
  • Posts: 155
  • Country: mx
Re: TDS 1000,2000,3000 BW Hack
« Reply #105 on: March 02, 2021, 05:38:27 am »
Fortunately I found a new box with 10 floppy disks, I revive my old desktop pc with win 10 and works very fine the floppy driver, I updated to 3.41 firmware without lost  the new bandwidth. I don't found an adventaje over 3.35 firmware with my scope comes. I need buy a FFT  (is more cheap) module for programing the firmware applications unlocks, actually I have DSO-X 2002A unlocked, but I love this old  scope, the 500 MHz and 5 GSa/s really are true improvement to my bench equipment, for example my agilent comes with traning signals like "glitchs" on clock signals, with Pulse trigger I found more easy the glitch with TDS 3012B than my dso-x2002a, is incredible.
Regards
 

Offline Shiv

  • Regular Contributor
  • *
  • Posts: 56
  • Country: es
Re: TDS 1000,2000,3000 BW Hack
« Reply #106 on: March 03, 2021, 09:22:36 am »
Hi all!

I´m trying to do this hack on TDS210 just for fun, but it only half works.

With "PASSWORD PITBULL" + "MODEL TDS220"
*IDN? says I have a TDS 220 until reboot or when entering the service menu.

Can do the trick if you send the commands once you are in service menu.

BUT:
when doing the internal calibration routine, it fails on step 39 (100 MHz for TDS220)
Equipment is not the problem (9500 + 9530 doing the job)
When fails, it shows the signal and it´s around 3.8 div (should be >4.2, what it gets at 60 MHz)

Anybody knows where to find schematics for this scope? Just to see if there are any input capacitor limiting bandwith.

Thank you in advice.
 

Offline amindavid11

  • Contributor
  • Posts: 13
  • Country: ve
Re: TDS 1000,2000,3000 BW Hack
« Reply #107 on: March 05, 2021, 03:43:14 pm »
Not Working on the TDS 2002B

IDN works
putting the password wrong does not give any errors
Tried using TDS 2022B and TDS2022B
Tried calibrating before shutdown
Does not work for me 22.16 |O
 

Offline Alexe2

  • Newbie
  • Posts: 3
  • Country: ru
Re: TDS 1000,2000,3000 BW Hack
« Reply #108 on: April 03, 2021, 03:55:20 pm »
Hi!
Somehow can backup the firmware.
I have a non-standard firmware.
 

Offline james_s

  • Super Contributor
  • ***
  • Posts: 21611
  • Country: us
Re: TDS 1000,2000,3000 BW Hack
« Reply #109 on: April 04, 2021, 05:15:52 am »
What's non-standard about it?
 

Offline Alexe2

  • Newbie
  • Posts: 3
  • Country: ru
Re: TDS 1000,2000,3000 BW Hack
« Reply #110 on: April 04, 2021, 07:03:35 am »
Yes, you are right, this is an old firmware.
 

Offline Alexe2

  • Newbie
  • Posts: 3
  • Country: ru
Re: TDS 1000,2000,3000 BW Hack
« Reply #111 on: April 11, 2021, 08:41:38 pm »
What voltages and signals are needed to calibrate the oscilloscope?
 

Offline giosif

  • Frequent Contributor
  • **
  • Posts: 877
  • Country: gb
Re: TDS 1000,2000,3000 BW Hack
« Reply #112 on: April 17, 2021, 02:55:24 pm »
I forgot to post the pinout for the 100-way connector...here it is
Arn.

Many thanks for the pinout!
I built the board from the Hackaday site and used the pin numbers on that board.
However, the scope wouldn't boot with the card inserted and I just couldn't understand what I had done wrong.
But then found your pinout here and realized the pin numbering used on the Hackaday board is different/wrong.
After resoldering the wires using your drawing, everything worked like a charm.

For everyone's reference, the "tabs" I've used on the Hackaday board are:
U1 - pin 1 -----> board tab #63
U1 - pin 11 ---> board tab #64
U1 - pin 12 ---> board tab #67
U1 - pin 13 ---> board tab #68
U1 - pin 14 ---> board tab #71
U1 - pin 15 ---> board tab #75
U1 - pin 16 ---> board tab #76
U1 - pin 17 ---> board tab #79
U1 - pin 18 ---> board tab #80
U1 - pin 19 ---> board tab #59
 

Offline JiriB

  • Contributor
  • Posts: 13
  • Country: cz
Re: TDS 1000,2000,3000 BW Hack
« Reply #113 on: November 04, 2021, 04:26:37 pm »
Hi,

Pitbullized 3054B --> 3064B
 

Offline Arn

  • Newbie
  • Posts: 7
  • Country: gb
Re: TDS 1000,2000,3000 BW Hack
« Reply #114 on: December 17, 2021, 07:19:48 am »
Hi everyone,

I finally got round to buying one of leo Bodnar's pulsers.

I get around 550pS risetime on my modified TDS3012 which equates to 638MHz BW.

I can therefore confirm that the upgrade procedure is working

Arn
« Last Edit: December 17, 2021, 07:24:27 am by Arn »
 

Offline Arn

  • Newbie
  • Posts: 7
  • Country: gb
Re: TDS 1000,2000,3000 BW Hack
« Reply #115 on: December 17, 2021, 09:02:22 am »
Quote from: paulber0303
Hi, I plan to update my TDS3012 scope and like you I have no communications ports. I'm looking at how you did it and wonder why you connected ports on the bus (the DX) and not just used the RS232 pinout.

Thank you.
Paul
in
Hi Paul,

For this hack to work, you need to 'fool' the scope that an official Tek interface card has been inserted into the slot; the real card signals to the scope with a word written to the bus which unlocks the serial capability

Arn
 

Offline Arn

  • Newbie
  • Posts: 7
  • Country: gb
Re: TDS 1000,2000,3000 BW Hack
« Reply #116 on: December 17, 2021, 09:49:00 am »
I've been thinking about this hack and wondering if there might be a simpler way of achieving serial capability.

You might be able to just solder 8 10k resistors on the appropriate bus pins  and pull them up/down.

(you need to pullup the CD pin (pin 24) on the bus as well to signal hardware presence)

This might work - although my guess is that the bus might need to be written to at the appropriate  time -i.e bus pin 79 goes high, then the word is written to the bus.

But for the cost of a few resistors it has to be worth a shot.

Arn

« Last Edit: December 17, 2021, 09:56:48 am by Arn »
 

Online sicco

  • Regular Contributor
  • *
  • Posts: 165
  • Country: nl
Re: TDS 1000,2000,3000 BW Hack
« Reply #117 on: December 17, 2021, 10:14:00 am »
More background in attached pdf's.
After this I did a 'budget' plugin board that has only the USB-FT4232 FTDI, with the two serial ports, optional ESP32 plus optional DS1744W and BDM interface over USB for editing TDS3000 flash rom, ram, RTC and its I2C 'option' modules. See 3rd pdf.

Pulling up/down the relevant 8 bits of the PowerPC databus is not what I'd go for. Better invest in a 74xx245-ish tri-state buffer and set the module identifier bits with that when /CE2 goes low. If you're desperate, then maybe do it with 8 diodes: diodes pull down the 8 bits of the databus when CE2 goes low (cathodes all on CE/2, 8 anodes on 8 databits).

 
The following users thanked this post: hardcoreman, ymrfei

Offline hardcoreman

  • Contributor
  • Posts: 23
  • Country: sk
Re: TDS 1000,2000,3000 BW Hack
« Reply #118 on: March 05, 2022, 02:13:42 pm »
can you share ethernet expansion module flash content for ethernet ? :) i installed 10mbit phy about 2 years ago, trace pins, info was from cpu datasheet... i want see it working. thanks


 

Online sicco

  • Regular Contributor
  • *
  • Posts: 165
  • Country: nl
Re: TDS 1000,2000,3000 BW Hack
« Reply #119 on: March 05, 2022, 07:33:35 pm »
The flash rom is empty (reads 0xff for all bytes) except for the first ~18. Those hold the MAC address, coded as readable hex characters with colons in between.
As in 01:02:03:04:05:06 in ASCII bytes if the MAC address was 0x010203040506.

However,
1 the first three bytes must be the Tektronix/Sony reserved bytes, as per https://mac.lc/company/sony-tektronix-corp, 00:00:95. If not then it just does not work.
2 it is vital that the NVRAM (DS1742W) has all its Ethernet related bytes set properly. A recovered DS1742/1744 that has had battery dead once, will have lost these CMOS RAM settings, and contrary to other scope settings, a recovery attempt (hold down B TRIG during reboot) will not restore these network settings.

 

Online sicco

  • Regular Contributor
  • *
  • Posts: 165
  • Country: nl
Re: TDS 1000,2000,3000 BW Hack
« Reply #120 on: March 06, 2022, 04:52:28 pm »
Correction: the MAC address must be 08:00:11:xx:xx:xx. So not 00:00:95:xx:xx:xx as I stated yesterday.
The xx:xx:xx you can pick freely.

See also https://maclookup.app/macaddress/080011

In the binary file I also had put a zero as string terminator, that is byte 17 when starting counting at 0, after the last nibble.

Here is some C code that makes a valid MAC address as a string:

unsigned char random_bytes[6];
int i;

                srand(time(0));

                random_bytes[0] = 0x08;     // Tektronix Inc MAC addresses must start with 080011
                random_bytes[1] = 0x00;
                random_bytes[2] = 0x11;

                for (i=3; i<6; i++)
                    random_bytes = rand() & 0xff;

                for (i=0; i<6; i++)
                {
                    printf ("%02x", random_bytes);
                    if (i<5)
                        printf (":");
                }
                printf("\n");

                F = fopen (TDS3EM_FlashRomFileName, "wt");
                for (i=0; i<6; i++)
                {
                    fprintf (F, "%02x", random_bytes);
                    if (i<5)
                        fprintf (F, ":");
                }
                fprintf (F, "%c", 0);
                i = 12+5+1;
                while (i++ < 32)
                {
                    fprintf (F, "%c", 0xff);
                }
                fclose (F);
                printf ("new file %s is created - but not yet programmed!\n", TDS3EM_FlashRomFileName );

                printf ("copy it to NVRAM? (y/n)");
                ch = getch();
                printf ("%c\n", ch);
                if (ch == 'y')
                {
                    copy_MAC_to_NVRAM (random_bytes);
                }


plus here is how to also load it into the NVRAM. That's mostly for the -b and -c TDS3000 versions that do not work with a TDS3EM because it has the Ethernet PHY chip inside the scope. But this code only works with the BDM interface - that's a backdoor into the tds3000 over the 100 pins connector - details shared before elsewhere on this forum. With that adapter and a Windows PC with USB port you can also re-initialise the DS1742 in-situ so that Ethernet works again.

#define MAC_ADDRESS_IN_NVRAM    0x06F0
void copy_MAC_to_NVRAM (uint8_t *six_bytes)
{
    int i;
    uint32_t address = MAC_ADDRESS_IN_NVRAM;

    printf ("old values: ");
    for (i=0; i<6; i++)
        printf ("%02x:", GetDS1742W (address++));
    printf ("\nnew values: ");
    address -= 6;

    for (i=0; i<6; i++)
        SetDS1742W (address++, *six_bytes++);

    address -= 6;
    for (i=0; i<6; i++)
        printf ("%02x:", GetDS1742W (address++));
    printf ("\n");


}

And also note that if you try to recreate a TDS3EM module, then the module identifier must say it's a TDS3EM. That module identifier byte is read with CE2(?) on the 100 pins connector, typically using a 74XX245 buffer. Details in the circuit diagram of my first 'TDS3k second life board' - that's the one with Ethernet PHY, USB serial, DS1744 NVRAM, ESP32 etc, but without the BDM interface. Details on entry 41 attached pdf in https://www.eevblog.com/forum/repair/reverse-engineer-dallas-ds1742w/25/

If you hardwire the 8 bits for TDS3EM then a TDS3000-b or -c will reject it.


« Last Edit: March 06, 2022, 05:43:51 pm by sicco »
 

Offline whatboy

  • Regular Contributor
  • *
  • Posts: 51
  • Country: mx
Re: TDS 1000,2000,3000 BW Hack
« Reply #121 on: March 14, 2022, 04:43:31 pm »
went from 3032B to 3012B, how do you upgrade firmware from 3.35 to 3.39???
 

Online sicco

  • Regular Contributor
  • *
  • Posts: 165
  • Country: nl
Re: TDS 1000,2000,3000 BW Hack
« Reply #122 on: March 14, 2022, 05:39:33 pm »
went from 3032B to 3012B, how do you upgrade firmware from 3.35 to 3.39???

Why go from 3032b to 3012b? Why not go 3052b, or, because you have a -b model, why not go 3062b?

To upgrade firmware, the most common option is 5 floppy disks, the binaries for those have been posted as a zip several times in this forum.
Another way to change firmware is to get my BDM interface, connect Windows laptop via USB, and erase and reprogram the flash roms.
 

Offline whatboy

  • Regular Contributor
  • *
  • Posts: 51
  • Country: mx
Re: TDS 1000,2000,3000 BW Hack
« Reply #123 on: March 14, 2022, 07:23:04 pm »
>>Why go from 3032b to 3012b? Why not go 3052b, or, because you have a -b model, why not go 3062b?

Good question, but I did what this thread on the first comment said, and it went down instead of up... WTF???

PASSWORD PITBULL
MCONFIG TDS3054

and that was it... went down instead of up!!!!
 

Online sicco

  • Regular Contributor
  • *
  • Posts: 165
  • Country: nl
Re: TDS 1000,2000,3000 BW Hack
« Reply #124 on: March 14, 2022, 07:29:53 pm »
>>Why go from 3032b to 3012b? Why not go 3052b, or, because you have a -b model, why not go 3062b?

Good question, but I did what this thread on the first comment said, and it went down instead of up... WTF???

PASSWORD PITBULL
MCONFIG TDS3054

and that was it... went down instead of up!!!!

try this:

PASSWORD PITBULL
MCONFIG TDS3054B

(since you have a -b, you must add the B)
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf