Products > Test Equipment
Tektronix TDS Scope Field Adjustment Software reverse engineering
<< < (3/11) > >>
TERRA Operative:

--- Quote from: DC1MC on February 19, 2023, 11:54:01 am ---
--- Quote from: PA0PBZ on February 19, 2023, 11:01:18 am ---Subscribed!  :popcorn:

I don't have a TDS but experience with reverse engineering so maybe I can help out. I also found a thread here on the forum that contains some interesting information, it looks like some people already started on the same problem: https://www.eevblog.com/forum/testgear/automating-tektronix-field-adjustment-software-for-tds-oscilloscopes/

--- End quote ---

Well, I do have an limping TDS744 (three channels only, one ceramic section physically broken  :'( ), but no sw for it, so if GitHub is not OK with you TERRA (you don't actually need to concern with versions and commits, you only need to use it as a file storage and eventually just use the web interface) and experience in reversing.
So if GitHub is not OK, then Google Drive, Dropbox or whatever online storage that is not totally ephemeral.



--- End quote ---

I don't mind using github, but I'm not proficient enough to be in charge of it. If someone else is good with it, they can take the reigns there.

Also, PM me, I have a sneaky spare hybrid module. We can't have your scope limping if you are going to be involved with this project. ;)
TERRA Operative:

--- Quote from: DC1MC on February 19, 2023, 01:22:25 pm ---User M K das posted some stuff in the TEA thread, I really don't know if the TEK software uses  CEC488/KPC488.2 drivers and libraries, but if yes, here is where you could download your copy of them for dos, as far as I culd find, this is the latest version for DOS and with development software on it, if you new of a similar but newer one, please post it here:

 CEC488/KPC488.2 SDK
https://www.tek.com/en/support/software/driver/cec488-driver-ver-70-gpib-cards-kpci-488-kpc-4882-kpc-4882at-v70-use-isa-bus-interfaces-and

--- End quote ---

On my DOS PC, I just installed the NI drivers for the PCII/IIA card and it just worked. I'm not sure if the Tek FAS is using the drivers or doing some direct access magic though.
m k:
[rerouted from TEA thread]


--- Quote ---Well, besides not having any clue what program is that from

--- End quote ---

It's CEC488/KPC488.2 8bit ISA card ROM.
The support disk image I found should have had headers but none were present.
Github had something, but icpdas ftp has more.

If Keithley's ISA card has a ROM chip then it's most likely backwards compatible.
But by default newer cards have ROM disabled so default test fails if ROM is needed.
CEC is noting that only oldies from '80s are using the ROM.

It's a very old construction so it should be known by many.
I guess it would be close to easiest 1st level, a controller construction that supports old software.
After that the 2nd level, the new application software, would be much easier.

Emulating TI/NEC chip registers and their addresses is clearly minimum for FAS.

ROM functions,
"short" is a len parameter length of one byte, must be from PC/XT era and for backwards compatibility.


--- Code: ---00 init
03 transmit "short"
06 receive "short"
09 send "short"
0c spoll
0f ppoll
12 init 2
15 ? "short"
18 in base+4, test 2
1b in base+4, test 4
1e transmit
21 receive
24 send
27 enter
2a DMA?

c8 tarray (cache RAM)
cb rarray (cache RAM)
ce dma2

--- End code ---

ROM code has a fixed I/O address.


--- Code: ---       c800:0000 e9 dd 00        JMP        LAB_c800_00e0
...
       c800:0062 b8 02           dw         2B8h
...
                             LAB_c800_00e0                                   XREF[1]:     c800:0000(j) 
       c800:00e0 55              PUSH       BP
       c800:00e1 8b ec           MOV        BP,SP
       c800:00e3 50              PUSH       AX
       c800:00e4 52              PUSH       DX
       c800:00e5 b0 02           MOV        AL,0x2
       c800:00e7 2e 8b 16        MOV        DX,word ptr CS:[0x62]
                 62 00
       c800:00ec 83 c2 05        ADD        DX,0x5
       c800:00ef ee              OUT        DX,AL

--- End code ---

From CEC's ieee-c.h
Push parameters to stack from left to right.


--- Code: ---#define initialize(addr,level)          ieee488_initialize(addr,level)
...
#define transmit(cmd,status)            ieee488_transmit((char  *) (cmd),0xFFFF,(long int  *) status)
#define receive(s,maxlen,len,status)    ieee488_receive((char  *) (s),maxlen,(unsigned long  *) len,(long int  *) status)
#define send(addr,s,status)             ieee488_send(addr,(char  *) (s),0xFFFF,(long int  *) status)
#define enter(s,maxlen,len,addr,status) ieee488_enter((char  *) (s),maxlen,(unsigned long  *) len,addr,(long int  *) status)
#define spoll(addr,poll,status)         ieee488_spoll(addr,(char  *) poll,(long int  *) status)
#define ppoll(poll)                     ieee488_ppoll((char  *) poll)
#define tarray(d,count,eoi,status)      ieee488_tarray((void  *) d,count,eoi,(long int  *) status)
#define rarray(d,count,len,status)      ieee488_rarray((void  *) d,count,(unsigned long  *) len,(long int  *) status)
...
#define transmit(cmd,status)            ieee488_transmit((char far *) (cmd),0xFFFF,(int far *) status)
#define receive(s,maxlen,len,status)    ieee488_receive((char far *) (s),maxlen,(unsigned int far *) len,(int far *) status)
#define send(addr,s,status)             ieee488_send(addr,(char far *) (s),0xFFFF,(int far *) status)
#define enter(s,maxlen,len,addr,status) ieee488_enter((char far *) (s),maxlen,(unsigned int far *) len,addr,(int far *) status)
#define spoll(addr,poll,status)         ieee488_spoll(addr,(char far *) poll,(int far *) status)
#define ppoll(poll)                     ieee488_ppoll((char far *) poll)
#define tarray(d,count,eoi,status)      ieee488_tarray((void far *) d,count,eoi,(int far *) status)
#define rarray(d,count,len,status)      ieee488_rarray((void far *) d,count,(unsigned int far *) len,(int far *) status)

#define srq                             ieee488_srq
#define setport(bd,io)                  ieee488_setport(bd,io)
#define boardselect(bd)                 ieee488_boardselect(bd)
#define dmachannel(c)                   ieee488_dmachannel(c)
#define settimeout(t)                   ieee488_settimeout(t)
#define setoutputEOS(e1,e2)             ieee488_setoutputEOS(e1,e2)
#define setinputEOS(e)                  ieee488_setinputEOS(e)
#define enable_488ex(e)                 ieee488_enable_488ex(e)
#define enable_488sd(e,t)               ieee488_enable_488sd(e,t)
#define listener_present(a)             ieee488_listener_present(a)
#define gpib_board_present              ieee488_board_present
#define gpib_feature                    ieee488_feature

--- End code ---

BTW,
I had a rude awakening once.
My cli/sti test was very slow, then I bought the Unauthorized Win95 by A. Schulman.

Back in the day there were exceptions, can't remember how many.
Maybe virtual DOS can have a filter driver for ins and outs.
That driver could also create logs and so be a sniffer.
DC1MC:
@M K & all: I keep hearing about "the driver" that does this and that (including sniffing/logging !!), also contradictory stuff about the calibration program needing or not needing some DOS driver.

Could finally enlighten me on the following topics:

 1) What is the infrastructure needed to run a calibration operation:
- what DOS and with what configuration of the upper memory (HIMEM.sys parameters) ?
- is there any device driver that must installed in config.sys and with what parameters or the the program must run on bare DOS ?
- what are the program(s) need to be run, in which configuration and where can they be found ?

Because I have a feeling that I'm a bit unfocused, I have a coupe of hours of time and I wold happily disassemble/reverse something but without a plan is just wasted time.
DC1MC:
To summarize, the "One True GPIB Card" that TEK crapoholic software supports is one of the CEC488 also sold as KPC488.2, of which datasheet and programmers manual I have attached here and a message above and the SDK link from TEK I've posted above ?
Anybody can 100% confirm this ?

Please have a look on the files and let me know where I can download the actual software, I want to see if CEC library is linked in.

P.S> BLOODY EXPENSIVE POS  :wtf: :wtf: :wtf: I've looked for how much they're offered, in between 300-500USD !!!, it has to be this one, or else nobody will pay this shitload of money !!!
Navigation
Message Index
Next page
Previous page
There was an error while thanking
Thanking...

Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod