Products > Test Equipment
TDS3000C series BW & sampling hack
sicco:
I’ve lost track on what version is in the pictures that you’re referencing.
I think your prime interest now is to diagnose the scope via the BDM interface. And that you’re ok to keep using the original RTC DS1742W in your scope, likely with a new battery in/on it. If so, then what might work for you also is a FT4232H mini module (https://www.tme.eu/nl/details/ft4232hq-module/usb-modules/ftdi/ft4232h-mini-module/?brutto=1¤cy=EUR&gclid=EAIaIQobChMIobm7zc6w_QIVhOF3Ch2SAA1NEAQYASABEgKWu_D_BwE) and maybe a 100 pin connector.
This alternative is described in https://www.eevblog.com/forum/repair/tds3014-adventures-(seeking-75-75mhz-oscillator)/msg3628994/#msg3628994
You can use the same PC software to access/edit the TDS3K RAM, Flash ROMs, RTC, I2C EEPROM option modules etc.
The 100 pin connector is a TE / AMP 1-1734099-0. But you can also solder the wires. Be aware of inconsistent pin numberings, edge connector counts differently as these AMPs.
sicco:
I finally have my first TDS 3034C. Eager to see if my 'second life' RTC fix board also works, and curious to see if the bandwidth can be edited to 600 MHz equivalent.
On that' I'm making progress with the PC program for BDM backdoor entry into the TDS3K models. That hardware that does the trick for the -b and the -no suffix models still fits in nicely in the -c model, and BDM mode works for controlling the CPU and accessing the DS1742W etc. But PC FT4232H USB BDM PPC software needed several tweaks because ROM and RAM sizes have doubled in the-c model. And there's yet another flash ROM for the USB drivers and probably more.
I can now read and reflash the larger ROMs. And read/write the larger system RAM. And single step the PowerPC.
I have the ROM images on my PC now. I can edit these. With the earlier models (up to and including firmware 3.41) I could edit a keyword in the ROM image that ASCII shows and acts as the model number (and thus the bandwidth on offer), and then the TDS3034 became a TDS3064. The TDS3014C ROM image (v4.31 firmware) gets me the same keyword on a comparable location. I think it is part of a text file in the VxWorks internal file system in flash ROM. As before with the older models. But now after changing the 3 to a 6, it is a TDS 3014C on the next reboot. Luckily it becomes TDS 3034C again when setting the relevant rom byte back to 3.
So I think I am really close, but that there's just one last extra hurdle added. Possibly a conscious Tek protection. Or possibly just some file integrity in the VxWorks flash rom file system that got added.
What I'm curious about now is what model it will become if I load my flash ROMs with the exact 8Mbit image of a genuine TDS 3024C or TDS 3044C or TDS 3054C or TDS 3064C ROM. My thinking is that it will then accept the model change. Because the extra last hurdle is just some hash or crc or checksum that also resides in the same rom image.
So I'm looking for volunteers to share such an image with me.
To get the image, the procedure is to insert my board in the 100pin scope expansion connector, USB connect to a Windows laptop, read the code, and share the file.
Anyone?
sicco:
Managed to upgrade my TDS3034C to TDS3054C :)
Via the old style method that was PASSWORD PITBULL and MCONFIG TDS30*** that worked on the -B and -no suffix models up to firmware 3.31 or so.
For the -C model (with FW4.31), it was password INTEKRITY and mconfig tds3054c that did the trick.
This password I found elsewhere in EEVBLOG forum in a 2015 post on the later scope models, Re: DPO3000 Hacks, « Reply #3 on: April 23, 2015, 08:53:40 am.
the keywords password and mconfig appear to be case insensitive. But the model name tds3054c had to be lower case for it to work for me.
I'd not be surprised if the FW3.41 in -b models also accepts this other password.
What's weird though is that I can only go to tds3054c. Not to tds3064c, or down to tds3044c or tds3024c or so.
update next day: that’s not weird because TDS3024C, TDS3044C and TDS3064C were never Tektronix products.
Mkpirulo:
Hi sicco,
Has the been confirmed by others to work?
Can you revert back to 3012C?
Does it only work for fw:3.41?
I’m ready to try it on mine, thanks for any info.
sicco:
Hi Mkpirulo,
Has the been confirmed by others to work? yes (it, or this. Not the)
Can you revert back to 3012C? yes i would expect so. i only have experience with 4 channel -c units. Obviously you cannot change 30x4c into 30y2c. And you cannot change -b into a -c.
Does it only work for fw:3.41? that’s typically -b and -no suffix firmware, but yes it also works there. For earlier fw on those models it’s the other password (PITBULL) The -c models have higher firmware models, and for those INTEKRITY is the key to success.
I’m ready to try it on mine, thanks for any info.
Navigation
[0] Message Index
[#] Next page
[*] Previous page
Go to full version