Tektronix TDS Scope Field Adjustment Software reverse engineering

[m k]

From earlier mentioned fork thread I'd say that TI/NEC chip or register level compatible and equally connected is accepted.
Can't be sure though, but the old card is also practically nothing more than a chip and a ROM, and optional RAM.

Needed drivers can be tested.
Newer CEC/KPC card has ROM disabled by default.
Leave it like that and try using it without drivers.
Then enable ROM to CC00 or so and try again.

If polling method is used then drivers are not needed, sill a bad practice.

Personal488 seems to be NI compatible.
It has more components than CEC so maybe CEC was first and then NI shuffled register addresses of the same chip.
Then others followed former or latter model.
This board's IOT7210 doesn't seem to be very far from the original copy either.

[TERRA Operative]

So I found this while sorting through stuff on my PC, it seems to have some programming examples in various languages.

National Instruments GPIB-PCII/IIA Win95-98 drivers:
https://drive.google.com/file/d/1MUKwPHVAb4Bpsc41y0qHyrL66hzbH0Y9/view?usp=sharing

[m k]

uPD7210 and TMS9914 are not equals nor register compatible.

NI 8bit ISA card
PCII uPD7210C chip, no ROM.
PCII/IIA VLSI or NI ASIC chip with ROM and 7210/9914 and PCII/PCIIA dip switches.
PCII/IIA-R a bit different layout.
PCIIA uPD7210C chip, no ROM.
PCIIB TMS9914A chip, no picture.

NI 16bit ISA card
AT-GPIB/TNT (c)'93 a single chip thing, low DMA settings are missing and last address digit is always zero.
AT-GPIB/TNT (c)'95 dual ASIC thing without manual settings.
AT-GPIB dual ASIC thing with manual settings and ROM.
AT-GPIB (c)'90 PLCC sockets, NI TURBO488 chip, no rom.

DMA is not usually required and 8bit card can set last address digit to zero.

[DC1MC]

Well then,
due to some health shite I could not give 100%, but now that I have a (short) break being poked and prodded and used as a needle pillow  :'(, let's put a bit this show on the road, I have given a first pass over the installed software archive posted by @TERRA.
There are two executable files and on other binaries: libraries, overlays and such, just big fat static executable, the memory management is left to Microsoft C for DOS runtime, which is a pain (see later):

Code: [Select]

14921 Feb 19  1999 ASK3C4C.EXE
783572 Jan 20  2000 TDS700CG.EXE

I have no rotating clue what ASK3C4C.EXE is, but I'm eager to find out, please help here.
So the first victim is TDS700CG.EXE, a big fat 750KB executable, that is quite depressingly large , but there is a silver lining, they didn't use any compressors, obfuscators and shit like that and the organization is pretty logical, in nicely separate modules and it seems that the WHOLE library is liked there, including some of their internal modules with tests that say as an error message: "If you see this call Cathy at 1225342!!!"  .

Actually by just looking at referenced functions it seems that the calibration program front-end for the library actually exposes a very small percentage of the available functions !!!, this could be a false result given by the fact that IdaPro has a gadzillion of fails when I analyze the executable with overlays and the fact that it doesn't know about the Microsoft C for DOS compiler from 1988 (most likely 5.x or 6.x, widely available on net and I'll se if we can get some standard library addresses). . So if you look into the attached file you'll see now and then the "SP Analysis Failed" at end of functions

But it is as it is, I have attached, along with the ASM listing, the IdaPro database, I did already the tedious conversion to ASCII of some messages and corrected some auto-parsing stuff, if someone has a better Ida analyze,please share.

Now let's look at the library, there are 179 modules, if you look into the file listing and in the ASM listing you see that the help files (.HLP) have exactly the same name as the .c module linked in, this is nice, you'll also recognize as the name of the module some famous instrument names, so is most certain that that module deals with that instrument. Most of the names are self explanatory as well, for example a2d_off may or may not deal with Analogue to Digital Offset calibration .

So, IMHO, we need to determine the structure of the modules (humble me I'll try with beep.c, but feel free get more complex ones , as well ass the parser for the "Blenoragic LISP (TM)"  configuration files syntax (qconfig.c module maybe  ?!?).

HELP REQUEST: I can't determine for now, could someone (@TERRA) try to start the calibration program WITHOUT the card driver loaded, I want to see if it's used at all for PCII or PCII/II cards for the callibration process, if it is, I have to see what IOCTLS offers, if not, I will ignore it for the moment.

Later I will try a GHIDRA analyze as well, I'll recover from the tiredness and meds, but now is the moment for the reversers to step in.

Code: [Select]

'$Id: a2d_off.c,v 1.1 1994/08/02 22:44:13 claudr Exp $',0
'$Id: accoupl.c,v 1.4 1999/05/27 16:09:26 nucats Exp $',0
'$Id: acqrate.c,v 1.2 1995/04/13 21:36:53 rona Exp $',0
'$Id: at5010.c,v 7.3 1994/09/13 21:49:38 catsos Exp $',0
'$Id: atten.c,v 1.2 1999/02/02 22:21:16 nucats Exp $',0
'$Id: beginend.c,v 1.12 1999/07/04 02:25:47 dougro Exp $',0
'$Id: bitslo.c,v 1.2 1995/04/13 21:37:05 rona Exp $',0
'$Id: btl_pms.c,v 1.11 1999/07/02 16:26:26 michaelp Exp $',0
'$Id: busywait.c,v 1.2 1995/04/13 21:37:12 rona Exp $',0
'$Id: bwlimit.c,v 1.4 1999/05/27 16:10:36 nucats Exp $',0
'$Id: calstat.c,v 1.37 1999/11/24 22:12:00 claudr Exp $',0
'$Id: cg5001.c,v 7.0 1992/10/12 22:26:26 stefanus Exp $',0
'$Id: cg.c,v 7.1 1992/10/12 22:51:59 stefanus Exp $',0
'$Id: chaniso.c,v 1.6 2000/01/11 21:21:20 aaronan Exp $',0
'$Id: chkspec.c,v 1.9 1999/07/01 20:53:27 nucats Exp $',0
'$Id: clkacc.c,v 1.5 1999/07/05 05:47:47 nucats Exp $',0
'$Id: cntl_interface.c,v 7.4 1997/04/04 17:14:06 catsos Exp $',0
'$Id: cntl_lex.c,v 7.2 1994/10/27 19:57:08 catsos Exp $',0
'$Id: cntl_misc.c,v 7.1 1994/10/27 19:57:10 catsos Exp $',0
'$Id: cntl_parse_1.c,v 7.1 1992/10/12 22:54:23 stefanus Exp $',0
'$Id: cntl_parse_2.c,v 7.1 1992/10/12 22:55:19 stefanus Exp $',0
'$Id: cntl_parse_3.c,v 7.1 1992/10/12 22:56:25 stefanus Exp $',0
'$Id: cntl_parse_4.c,v 7.3 1994/09/13 21:50:49 catsos Exp $',0
'$Id: cntl_parse_5.c,v 7.3 1995/02/10 21:16:34 catsos Exp $',0
'$Id: cntl_par_seq.c,v 7.1 1992/10/12 22:53:18 stefanus Exp $',0
'$Id: coldstar.c,v 1.3 1994/10/06 22:44:58 claudr Exp $',0
'$Id: config.c,v 1.3 1999/02/02 22:21:16 nucats Exp $',0
'$Id: constant.c,v 1.2 1995/04/13 21:37:20 rona Exp $',0
'$Id: counter.c,v 1.1 1998/01/19 19:26:25 catsos Exp $',0
'$Id: curvetov.c,v 1.2 1995/04/13 21:37:26 rona Exp $',0
'$Id: cvrcal.c,v 1.9 1999/06/23 21:56:56 michaelp Exp $',0
'$Id: datetime.c,v 1.3 1999/05/27 17:30:17 nucats Exp $',0
'$Id: dc5010.c,v 7.8 1998/01/19 19:37:40 catsos Exp $',0
'$Id: dc.c,v 1.3 1999/02/02 22:21:16 nucats Exp $',0
'$Id: delay.c,v 1.8 1999/05/06 22:17:47 nucats Exp $',0
'$Id: diags.c,v 1.5 1999/06/15 18:06:57 loch Exp $',0
'$Id: diffnonl.c,v 1.7 1999/07/05 02:08:02 nucats Exp $',0
'$Id: dm5110.c,v 1.3 1999/11/10 21:58:51 nucats Exp $',0
'$Id: dm.c,v 1.1 1999/01/07 17:12:14 nucats Exp $',0
'$Id: dp8200.c,v 7.1 1996/07/18 21:10:16 catsos Exp $',0
'$Id: drvr_gio.c,v 1.6 1999/08/31 20:22:52 nucats Exp $',0
'$Id: drvr_misc.c,v 7.4 1994/09/13 22:02:25 catsos Exp $',0
'$Id: drvr_parse.c,v 7.1 1994/10/27 19:57:15 catsos Exp $',0
'$Id: drvr_util.c,v 7.2 1994/10/27 19:57:16 catsos Exp $',0
'$Id: dutgpib.c,v 1.4 1999/10/06 19:07:51 nucats Exp $',0
'$Id: dutintfc.c,v 1.2 1999/11/11 16:05:43 nucats Exp $',0
'$Id: dutio.c,v 1.2 1999/08/31 20:22:52 nucats Exp $',0
'$Id: effbits.c,v 1.2 1999/07/05 05:47:47 nucats Exp $',0
'$Id: eisnum.c,v 7.2 1994/09/13 22:33:03 catsos Exp $',0
'$Id: errlog.c,v 1.5 1995/03/23 00:23:07 claudr Exp $',0
'$Id: fg5010.c,v 7.2 1998/01/19 19:37:40 catsos Exp $',0
'$Id: fg.c,v 7.4 1998/01/19 19:25:16 catsos Exp $',0
'$Id: fl6060a.c,v 7.3 1997/01/16 19:49:02 catsos Exp $',0
'$Id: fl8840a.c,v 7.3 1997/11/10 19:12:27 catsos Exp $',0
'$Id: fltosi.c,v 7.1 1992/10/12 23:03:34 stefanus Exp $',0
'$Id: flushsrq.c,v 1.2 1995/04/13 21:37:45 rona Exp $',0
'$Id: getbits.c,v 1.3 1995/04/13 21:37:51 rona Exp $',0
'$Id: getchan.c,v 1.7 2000/01/18 17:18:59 aaronan Exp $',0
'$Id: getinsid.c,v 1.12 1999/08/06 18:05:30 datt Exp $',0
'$Id: getsn.c,v 1.11 1999/05/27 17:31:52 nucats Exp $',0
'$Id: globals.c,v 7.5 1996/09/11 15:20:50 catsos Exp $',0
'$Id: hfcal.c,v 1.26 1999/12/07 18:09:44 aaronan Exp $',0
'$Id: hyd.c,v 7.1 1993/09/22 16:22:29 catsos Exp $',0
'$Id: initdut.c,v 1.6 1999/05/27 17:32:38 nucats Exp $',0
'$Id: init_instr.c,v 7.22 1998/01/19 19:26:25 catsos Exp $',0
'$Id: inittgl.c,v 1.5 1999/07/01 20:53:27 nucats Exp $',0
'$Id: inputr.c,v 1.10 1999/06/21 23:21:44 datt Exp $',0
'$Id: intglnonl.c,v 1.6 1998/06/19 20:49:16 nucats Exp $',0
'$Id: intradj.c,v 1.12 1999/11/24 21:20:53 claudr Exp $',0
'$Id: intrleav.c,v 1.25 1999/11/24 21:10:05 claudr Exp $',0
'$Id: intrmisc.c,v 1.16 1999/11/24 21:15:36 claudr Exp $',0
'$Id: intrpipe.c,v 1.13 1999/11/24 22:10:08 claudr Exp $',0
'$Id: iosig.c,v 1.7 1999/10/19 18:59:31 claudr Exp $',0
'$Id: iscalqc.c,v 1.4 1999/07/01 20:53:27 nucats Exp $',0
'$Id: Logce.c,v 7.4 1995/11/08 16:41:54 catsos Exp $',0
'$Id: Logd.c,v 1.3 1999/08/12 15:44:55 nucats Exp nucats $',0
'$Id: Logmisc.c,v 1.2 1999/02/02 22:21:16 nucats Exp nucats $',0
'$Id: Logsf.c,v 1.2 1999/08/12 15:45:50 nucats Exp $',0
'$Id: Logsh.c,v 1.2 1999/02/02 22:21:16 nucats Exp nucats $',0
'$Id: Logtf.c,v 1.4 1999/08/31 20:04:59 nucats Exp nucats $',0
'$Id: Logth.c,v 1.3 1999/08/12 15:48:01 nucats Exp nucats $',0
'$Id: manint.c,v 1.7 1999/06/23 22:52:01 michaelp Exp $',0
'$Id: manroute.c,v 1.5 1999/06/23 22:57:20 michaelp Exp $',0
'$Id: menu_bclear.c,v 7.1 1992/10/12 23:18:25 stefanus Exp $',0
'$Id: menu_benter.c,v 7.1 1994/09/14 15:14:22 catsos Exp $',0
'$Id: menu_binst.c,v 7.0 1992/10/12 22:27:57 stefanus Exp $',0
'$Id: menu_binter.c,v 7.1 1992/10/12 23:19:21 stefanus Exp $',0
'$Id: menu_bmsg.c,v 7.1 1992/10/12 23:20:04 stefanus Exp $',0
'$Id: menu_bscroll.c,v 7.2 1994/10/27 19:57:31 catsos Exp $',0
'$Id: menu_bsel.c,v 7.4 1995/08/18 16:39:06 catsos Exp $',0
'$Id: menu_bstr.c,v 7.0 1992/10/12 22:28:08 stefanus Exp $',0
'$Id: menu_bwarn.c,v 7.0 1992/10/12 22:28:09 stefanus Exp $',0
'$Id: menu_foot.c,v 7.2 1994/10/27 19:57:34 catsos Exp $',0
'$Id: menu_head.c,v 7.1 1992/10/12 23:20:56 stefanus Exp $',0
'$Id: menu_init.c,v 7.2 1994/10/27 19:57:34 catsos Exp $',0
'$Id: menu_inp.c,v 7.2 1998/03/02 20:36:46 catsos Exp $',0
'$Id: menu_pwarn.c,v 7.2 1994/10/27 19:57:36 catsos Exp $',0
'$Id: multigpi.c,v 1.7 1999/07/01 20:53:27 nucats Exp $',0
'$Id: multitxt.c,v 1.4 1999/07/01 20:53:27 nucats Exp $',0
'$Id: oa5000.c,v 1.3 1998/08/27 18:04:08 catsos Exp $',0
'$Id: oa.c,v 1.2 1997/03/19 17:39:58 catsos Exp $',0
'$Id: operset.c,v 1.1 1994/06/28 17:18:02 claudr Exp $',0
'$Id: os_active.c,v 7.6 1997/03/18 16:40:53 catsos Exp $',0
'$Id: os_chg_control.c,v 7.3 1998/02/23 20:05:28 catsos Exp $',0
'$Id: os_color.c,v 7.1 1994/10/27 19:57:38 catsos Exp $',0
'$Id: os_endmenu.c,v 7.2 1998/03/20 16:41:43 catsos Exp $',0
'$Id: os_env.c,v 1.2 1999/08/31 20:22:52 nucats Exp $',0
'$Id: os_err.c,v 7.1 1992/10/12 23:22:43 stefanus Exp $',0
'$Id: os_fileio.c,v 7.6 1995/06/22 13:38:36 catsos Exp $',0
'$Id: os_help.c,v 7.1 1993/09/22 16:23:11 catsos Exp $',0
'$Id: os_hlpdisplay.c,v 7.2 1994/10/27 19:57:41 catsos Exp $',0
'$Id: os_hlpmisc.c,v 7.2 1994/09/14 15:58:51 catsos Exp $',0
'$Id: os_interrupt.c,v 7.3 1994/10/27 19:57:43 catsos Exp $',0
'$Id: os_main.c,v 1.5 1999/08/31 20:22:52 nucats Exp $',0
'$Id: os_misc.c,v 7.4 1997/02/14 23:01:03 catsos Exp $',0
'$Id: os_pctime.c,v 7.1 1994/10/27 19:57:48 catsos Exp $',0
'$Id: os_route.c,v 7.1 1994/10/27 19:57:49 catsos Exp $',0
'$Id: os_route_init.c,v 7.1 1994/10/27 19:57:51 catsos Exp $',0
'$Id: os_run_proc.c,v 7.1 1998/03/20 16:40:59 catsos Exp $',0
'$Id: os_sel_dut.c,v 1.2 1999/08/31 20:22:52 nucats Exp $',0
'$Id: os_sel_mode.c,v 7.4 1998/01/19 19:24:35 catsos Exp $',0
'$Id: os_sel_proc.c,v 7.5 1998/05/20 16:49:33 catsos Exp $',0
'$Id: os_sel_test.c,v 7.0 1992/10/12 22:28:44 stefanus Exp $',0
'$Id: overload.c,v 1.6 1999/07/05 02:08:02 nucats Exp $',0
'$Id: pcompcal.c,v 1.7 1999/06/24 16:40:46 michaelp Exp $',0
'$Id: pcompchk.c,v 1.6 1999/06/02 20:11:22 michaelp Exp $',0
'$Id: pfcheck.c,v 1.2 1996/04/24 16:17:50 datt Exp $',0
'$Id: pg.c,v 1.1 1998/01/19 19:25:16 catsos Exp $',0
'$Id: pgsetup.c,v 1.2 1995/04/13 21:38:08 rona Exp $',0
'$Id: pipebal.c,v 1.3 1999/06/02 20:22:33 michaelp Exp $',0
'$Id: pmeasure.c,v 1.5 1999/07/02 14:47:51 nucats Exp $',0
'$Id: pnpltcal.c,v 1.3 1997/06/30 14:41:11 michaelp Exp $',0
'$Id: presult.c,v 1.5 1999/09/21 14:52:45 nucats Exp $',0
'$Id: ps.c,v 7.7 1998/02/04 21:48:06 catsos Exp $',0
'$Id: psDmISet.c,v 1.2 1998/05/19 03:24:30 michaelp Exp $',0
'$Id: ps_man.c,v 1.1 1997/07/10 18:11:36 cats Exp nucats $',0
'$Id: pwr_cycl.c,v 1.3 1994/08/26 22:37:28 claudr Exp $',0
'$Id: qconfig.c,v 1.3 1999/07/04 05:16:59 dougro Exp $',0
'$Id: rdutlib.c,v 1.6 1995/04/13 21:38:28 rona Exp $',0
'$Id: resultsm.c,v 1.6 1999/07/01 20:28:16 nucats Exp $',0
'$Id: ringbell.c,v 1.16 1999/03/03 15:48:04 nucats Exp $',0
'$Id: rndnoise.c,v 1.3 1999/05/27 16:29:09 nucats Exp $',0
'$Id: rrcvrcal.c,v 1.14 1999/06/08 22:09:47 danmc Exp $',0
'$Id: rt.c,v 7.9 1998/01/19 19:24:35 catsos Exp $',0
'$Id: scaleuni.c,v 1.5 1999/07/01 20:53:27 nucats Exp $',0
'$Id: selsec.c,v 1.5 1999/07/14 20:46:26 michaelp Exp $',0
'$Id: seq_pf.c,v 7.1 1992/10/12 23:48:50 stefanus Exp $',0
'$Id: setnvram.c,v 1.2 1995/04/13 21:38:36 rona Exp $',0
'$Id: setupdut.c,v 1.13 1999/05/27 17:35:14 nucats Exp $',0
'$Id: sg5030.c,v 7.3 1998/01/19 19:37:40 catsos Exp $',0
'$Id: sg.c,v 7.16 1998/10/27 22:28:05 catsos Exp $',0
'$Id: shipdoc.c,v 1.14 1999/07/02 00:23:44 dougro Exp $',0
'$Id: si5020.c,v 7.5 1998/10/27 22:28:05 catsos Exp $',0
'$Id: snvalflg.c,v 1.2 1996/05/07 17:14:55 rona Exp $',0
'$Id: spc.c,v 1.3 1996/04/24 16:19:00 datt Exp $',0
'$Id: srchmisc.c,v 1.6 1999/05/26 18:53:13 nucats Exp $',0
'$Id: startend.c,v 1.19 1999/05/27 19:45:00 nucats Exp $',0
'$Id: stenmisc.c,v 1.12 1999/07/01 20:28:16 nucats Exp $',0
'$Id: stubremoveDut.c,v 1.1 1996/04/09 19:40:46 catsos Exp $',0
'$Id: t_acc.c,v 1.3 1998/06/03 17:45:30 jimk Exp $',0
'$Id: t_dsens.c,v 1.2 1999/05/27 16:30:18 nucats Exp $',0
'$Id: t_gacc.c,v 1.1 1994/06/28 17:18:48 claudr Exp $',0
'$Id: th.c,v 7.2 1993/09/22 16:24:20 catsos Exp $',0
'$Id: t_jitter.c,v 1.2 1999/05/27 16:32:01 nucats Exp $',0
'$Id: tmode.c,v 1.5 1999/07/01 20:53:27 nucats Exp $',0
'$Id: t_msens.c,v 1.2 1999/05/27 16:33:36 nucats Exp $',0
'$Id: t_pacc.c,v 1.1 1999/06/09 22:02:47 loch Exp $',0
'$Id: tposcal.c,v 1.15 1999/08/13 20:15:54 sonn Exp $',0
'$Id: tposchk.c,v 1.8 1998/07/30 15:18:26 danmc Exp $',0
'$Id: trigsens.c,v 1.3 1995/11/28 23:55:57 claudr Exp $',0
'$Id: tsterror.c,v 1.4 1999/07/01 20:53:27 nucats Exp $',0
'$Id: tstmaloc.c,v 1.5 1999/07/01 20:53:27 nucats Exp $',0
'$Id: util_sleep.c,v 1.4 1999/11/02 22:20:00 nucats Exp $',0
'$Id: v_bal.c,v 1.3 1999/06/16 23:49:19 datt Exp $',0
'$Id: v_bw.c,v 1.6 1998/04/23 23:42:49 michaelp Exp $',0
'$Id: v_gain.c,v 1.7 1999/05/27 16:37:44 nucats Exp $',0
'$Id: v_hfstep.c,v 1.6 1999/09/14 17:47:26 claudr Exp $',0
'$Id: v_lfstep.c,v 1.6 1998/05/25 22:26:12 danmc Exp $',0
'$Id: v_off.c,v 1.7 1999/07/07 00:09:06 datt Exp $',0


[TERRA Operative]

Good work!

I'm off to Canada for a week or so to stare at the aurora borealis and buy some western clothes and shoes that fit me.... But when I'm back in Japan, I'll have time to poke at things and play around.

[m k]

I read somewhere that first run is nagging if driver is missing.
But can't really remember where that was, possibly a Q&A section of something.


Other thing, and maybe a parallel and more hardware route,
somewhere between DOS and W10 is a level where old programs can run without a major hassle.
Maybe that's a suitable middle man/partial level for this.
It can possibly also be easier level for old ISA card to USB adapter porting.
It requires an IA-32 x86 system but can eventually do without ISA with directly ISA controlling software.

With old system old style Virtual Mode Extensions are also available and manipulating them does not need programming, only configuration of the selected VME.
It seems that nowadays DOSBox is sort of a de facto environment but earlier Windows versions may have better solutions.
If this is untested area then with some luck some version can support some needed software.
With FAS the key here is to give running VME full IOPL stuff access, but high speed will probably remain to be a dream.

NI card software seems to be much more complex than KPC stuff, but since both TI and NEC chips are pretty simple I guess replacing ISA card is simpler.
One possible direction is setting one of NI PCI cards to be a PCIIA compatible, maybe the setting is even available already, at least that one ISA card has settings for that direction.
Other possibility is to do a PCIe proto board with uPD7210 support and desired I/O address space, that would also be optimal for current FAS, and no secrets are needed to reveal, but driver is needed and PCIe is possibly going to drop the whole I/O system, no doubt it's old and slow, many architectures are missing it completely and memory mapped way has a bit more space.

Version 2.1.1 of gpib.com of GD-GPIB is doing I/O out things quite similarly with CEC ROM.
I wouldn't be very surprised if some of these cards and drivers were swapable.

[fenugrec]

Metrology-grade coax cables are so affordable

Haha exactly. Spending as much on cables as the scope itself just didn't appeal to me ...
Of course I'm aware that the T-adapter was a bit of an RF crime, but I reasoned it should be fairly symmetrical in its ugliness. And I think I still proved that a 500 MHz cal is doable with B-team equipment !

don't know if the TEK software uses  CEC488/KPC488.2 drivers

I don't believe so, unless it was statically linked and I didn't recognize object file names / strings when sifting through the disasm a few years ago. I vaguely recall the GPIB IO was quite low-level, writing 7210 regs directly, and sprinkled in a bunch of different funcs. It didn't strike me as a structured API I would expect from a general-purpose library. I mean NI has been providing a DOS SDK since forever, and TEK was specifying NI PCII cards, so if anything, they would've used the NI drivers, not those from CEC. I may also be 100% wrong.

I think also FAS doesn't work if you load the NI drivers that stay resident, they interfere with the FAS ? Didn't test this exhaustively.

To clarify : there's a few ways to talk to a GPIB instrument if it's 1992 and you're coding for DOS :

- use the NI drivers that are loaded and resident in memory. Provides a nice high-level API
- statically link NI drivers into FAS; same API
- go full-on hackerman and write 7210 regs directly, because 1992.

I think TEK went with #3, which I cannot explain. If performance was critical why not enforce DMA ? (IIRC it's optional) Also I like to believe the NI drivers would provide some kind of way to benefit from DMA, so how much performance would be gained from going low-level ? And if it's not about performacne then why even bother ? Beats me.
I think there's some CVS (or RCS ?) $Id lines in the .exe with some developper names, it would be interesting to track them down and see what they remember.


RE : that's cool and all, but I think most people wildly underestimate the amount of work involved in reversing software.

In 2017, ghidra wasn't a thing yet, and IDA couldn't (probably still can't, but I haven't renewed since 7.4) digest the MS C overlays found in tds700. I tried a late-90's disasm ("sourcer" something), with better but still disappointing results.

I then made this https://github.com/fenugrec/overlazy to "unfold" the overlays into something IDA could process. Mostly successful, if a bit janky and with serious limitations. It served its purpose (figuring out which parts to hack to support a different-yet-similar ISA card, AT-GPIB) and I haven't developed it further.

Starting today if I had the energy or the motivation (I have neither) I would 100% look instead at processing overlays natively in ghidra. I think it has almost all the mechanisms to support this, just needs some legwork to make it happen. I know there's been a few people who expressed interest for such a thing in various tickets in the ghidra repo but not sure if anything ever came of it.

But maybe a better goal would be to continue where dxl / Sven left off, with a custom build of qemu where you can hook into the IO layer and emulate the 7210. But maybe not viable, depending on the API you plan on using with  modern GPIB hw ? As I said FAS is very low-level. I had started down that QEMU path independently before hearing of Sven's work; hacked at it for a few weeks, then gave up for various reasons.

At some point I was also considering making a thin wrapper around an FPGA-based GPIB adapter based on Frank M. Hess's 7210-compatible core : https://github.com/fmhess/fmh_gpib_core but also didn't pursue that.

[DC1MC]

@fenugrec welcome, you're most awaited person  , being the most advanced with reversing.

With the NI TSR driver I'm a bit confused as well, the @TERRA autoexec.bat seem to load it, but I can make sense if is used or not , this overlay shite really screws IDA, the attached listing is without overlays, it produces credible results, but something doesn't smell right, I have seen this used as an anti-reversing measure and always wondered why the DOS loader is not crashing and how the memory map may look like.

Do you think is there some way to unwrap this executable and make it right ?

I personally don't think that intercepting the I/O port access doing, an emulator for the card and staying with the old DOS shite is the best way to go, so far, AFAIK, nobody tackled this seriously, there were some attempts, look at the overlay issues, have the brain shut down looking at the listing and then abandoning, "naaah, is too complicated" 

But health permitting is still a better way to keep me entertained than the idiot box or cross-words .

I think once the structure of the modules is clarified the progress will speed up exponentially, MSC library is available and I attempt to steal some symbols for the math functions, I don't want to go into math instructions.

Well, I hope this effort will not fizzle out as well, the number of people that even know the insides of MSDOS is dwindling rapidly  :'(
 
I've tracked a number of the original developers, one of them is even active in a senior management position at Tek, but I think he'll be fired immediately if even suggest publishing the 30yrs code with the anti-repair trend nowadays, also not hot on divulging PI and I'm rather sure that none will want to help in any meaningful way, their pension may be in danger  .

Cheers,
DC1MC

[Zoli]

...
I think once the structure of the modules is clarified the progress will speed up exponentially, MSC library is available and I attempt to steal some symbols for the math functions, I don't want to go into math instructions.
...

To chime in: typically the calibration procedure is to collect readings; calculate the best fit(that's the heavy math; see LINEST() spreadsheet function in calc, excel etc.), upload calibration constants, verify/validate calibration.
If there's interest, I can throw together a spreadsheet to demonstrate the linear/polynomial principles.

[TERRA Operative]

I've tracked a number of the original developers, one of them is even active in a senior management position at Tek, but I think he'll be fired immediately if even suggest publishing the 30yrs code with the anti-repair trend nowadays, also not hot on divulging PI and I'm rather sure that none will want to help in any meaningful way, their pension may be in danger  .

Cheers,
DC1MC

Maybe it can' hurt to ask? These scopes are looonnggg out of Tek's catalogue, and they don't mind people doing the Artek thing with  selling copies of their manuals...
At the very least, maybe someone can give us a few sneaky hints if not a full source code dump.


In hardware related news, I got a delivery today..
A Tyan Tiger 100 motherboard. It has dual ISA so once I get a working second NI GPIB-PCII/IIA card (And the rest of the PC, need a case etc), I'll be able to start playing with the automation side of tests.

Then I'll take a look at getting some sort of 16 channel logic analyzer, something cheap to work with Sigrock to sniff the GPIB busses.


I'm wondering if trying to port the DOS software across to another platform or modify it to use other GPIB cards is the harder way to do it?
If we can find those algorithms used in the adjustment procedure, we can then use them in an OS and GPIB adapter agnostic application of our own making right?

[PA0PBZ]

If we can find those algorithms used in the adjustment procedure, we can then use them in an OS and GPIB adapter agnostic application of our own making right?

I think that is the way to go. It looks like the .CON files are a description of how the tests are done, so once there is a full understanding of the descriptive language in there nothing stops you from doing the communication with the TDS any way you like, it even tells you the commands (I think?):

Code: [Select]

TEXT = MF_SET_GLO (
":SELECT:CH1 OFF;CH2 OFF;CH3 OFF;CH4 OFF"
":SELECT:CH2 ON"
":CH2:BANDWIDTH TWENTY"
":TRIGGER:MAIN:EDGE:SOURCE LINE"
":HORIZONTAL:SCALE 1E-3"
":HORIZONTAL:RECORDLENGTH 5000"
":ACQUIRE:MODE HIRES"
":PASSWORD PITBULL"
)
I also tried to load the code in IDA but it pukes out most of the code because of the overlayed nature and Ghidra was not much better.

[fenugrec]

but something doesn't smell right, I have seen this used as an anti-reversing measure

In this case overlays are simply a way to use less memory at runtime. With a horrible penalty everytime an overlay is swapped but hey, those were the days of "RAMdisks" too... The MS 5.1 compiler docs have a good chapter on overlays, how & why to use them.

always wondered why the DOS loader is not crashing and how the memory map may look like.

What do you mean by DOS loader crashing ?

As for the memory map, in the 'overlazy' docs I have some ASCII graphs attempting to show the memory map.

MSC library is available and I attempt to steal some symbols for the math functions

I think I managed to generate signatures for MSC libs but I had trouble with PDCurses. I'm fairly certain they're using PDCurses 1.4, but I wasn't able to figure out the correct compiler switches to generate binary-identical functions. PDC has some .asm modules, and those eventually produced signatures that IDA was able to identify in the .exe. Less luck with the C functions. Here's an excerpt from my notes trying different compiler flags :

Code: [Select]

comparing update.c::Putchar() , tests :

0 "CFLAGS=-M$(MODEL) -c -Ox -W2" ; missing _chkstack, doesn't use opcode "cwb"
1 "CFLAGS=-M$(MODEL) -c -Oails -W2" : chkstack ok; uses sar ? wtf. Also missing pushpop si+di
2 "CFLAGS=-M$(MODEL) -c -Oail -W2" : sar, but cwb ! Almost. No si+di
3 CFLAGS=-M$(MODEL) -c -W2 : same
4 CFLAGS=-M$(MODEL) -c -G2 -W2 : same
5 CFLAGS=-M$(MODEL) -c -Od -W2 : lol : again sar, but SI+DI !
That said, as I recall the pdc functions are all next to each other and should be fairly recognizable; it's a beginner-friendly task to manually map them by hand. Signatures would definitely have been nice though...
If you want to port the software, I think it would save work to keep the same UI for now, since there are still plenty of curses implementations (including pdcurses) with probably all the same/similar API. This means TEK's in-house "CATS-OS" layer can be re-compiled mostly as-is, without needing to re-design it from scratch.

Do you think is there some way to unwrap this executable and make it right ?

Yes, the 'overlazy' tool I linked previously does exactly that. It will create an unwrapped, but non-executable, .exe file.

sniff the GPIB busses.

Remember you could also sniff the register accesses to the 7210 IC directly - IIRC it's 3 address lines, a few R/W and misc control lines, and one 8-bit data port. This may give more information than just a bus capture.

I'm wondering if trying to port the DOS software across to another platform or modify it to use other GPIB cards is the harder way

It's a good question. Doing a full port of the software is a massive undertaking. Judging by the amount of soft-float functions in there, it's possibly also doing some DSP stuff to process acquisitions, it's not just reading a script.

But please, people, use a decompiler, don't just stare at 700kB of x86 asm trying to understand everything. You will never finish.

PS - I have found forum threads to be a mediocre medium for collaborating on substantial RE efforts, where sub-discussions branch out a lot, sometimes go dormant for a while, etc... For general discussions and progress reports, sure, but for in-depth technical stuff, not great.
For documenting findings and technical details, a wiki can be an alternative. Else, some kind of git-versioned, categorized text files might also work.

One thing I'd be curious to try someday is using ghidra with a shared server (e.g. https://www.ghidra-server.org/ ) to collaborate on a single db. Though I would probably want to run ghidra in a sandbox / VM before doing that.

[m k]

TDS700CG.EXE from TERRA's ZIP

0xac1c jbe +6

How that area should be disassembled?


Same file and I found only one I/O out that is not floating point something.

Code: [Select]

                             **************************************************************
                             *                          FUNCTION                          *
                             **************************************************************
                             undefined FUN_379e_1b08(undefined2 param_1, undefined1 p
                               assume CS = 0x379e
             undefined         AL:1           <RETURN>
             undefined2        Stack[0x4]:2   param_1                                 XREF[1]:     379e:1b0b(*) 
             undefined1        Stack[0x6]:1   param_2                                 XREF[1]:     379e:1b0e(*) 
                             FUN_379e_1b08                                   XREF[70]:    FUN_239c_01fc:239c:0223(c),
                                                                                          FUN_239c_01fc:239c:0232(c),
                                                                                          FUN_239c_01fc:239c:0241(c),
                                                                                          FUN_239c_01fc:239c:0263(c),
                                                                                          FUN_239c_01fc:239c:02c9(c),
                                                                                          FUN_359a_0008:359a:0068(c),
                                                                                          FUN_35ad_0000:35ad:0063(c),
                                                                                          FUN_35ad_0000:35ad:00b3(c),
                                                                                          FUN_35e3_0002:35e3:0130(c),
                                                                                          FUN_35e3_0002:35e3:014a(c),
                                                                                          FUN_35e3_0002:35e3:017f(c),
                                                                                          FUN_35e3_0002:35e3:0198(c),
                                                                                          FUN_3601_0008:3601:02cf(c),
                                                                                          FUN_3601_0008:3601:0366(c),
                                                                                          FUN_3601_0008:3601:037f(c),
                                                                                          FUN_3601_0008:3601:0398(c),
                                                                                          FUN_3601_0008:3601:03bb(c),
                                                                                          FUN_3601_0008:3601:03d5(c),
                                                                                          FUN_3601_0008:3601:03ef(c),
                                                                                          FUN_3601_0008:3601:0409(c), [more]
       379e:1b08 55              PUSH       BP
       379e:1b09 8b ec           MOV        BP,SP
       379e:1b0b 8b 56 06        MOV        DX,word ptr [BP + param_1]
       379e:1b0e 8a 46 08        MOV        AL,byte ptr [BP + param_2]
       379e:1b11 ee              OUT        DX,AL
       379e:1b12 b4 00           MOV        AH,0x0
       379e:1b14 5d              POP        BP
       379e:1b15 cb              RET


This one NI GPIB.COM I checked used mainly double indirect I/O port addressing.
That is many bytes compared to fixed address or memory mapped I/O.

Maybe creating a memory mapped filter driver between forked and fixed address GPIB.COM and what ever GPIB hardware is also a possibility.
(if that GPIB.COM is actually used)
*.COM file can be extended easily and remapping double indirect I/O ports to memory locations should be also pretty easy.

Filter driver can also export stuff to where ever.

Code: [Select]

       2000:1f1f b8 02 00        MOV        AX,0x2
       2000:1f22 8b 57 06        MOV        DX,word ptr [BX + 0x6]
       2000:1f25 83 c2 05        ADD        DX,0x5
       2000:1f28 ee              OUT        DX,AL
...
       2000:2a3a 25 1f 00        AND        AX,0x1f
       2000:2a3d 8b 1e 00 bc     MOV        BX,word ptr [0xbc00]
       2000:2a41 8b 57 0c        MOV        DX,word ptr [BX + 0xc]
       2000:2a44 03 16 e6 ae     ADD        DX,word ptr [0xaee6]
       2000:2a48 ee              OUT        DX,AL
...
       2000:2a83 b8 e0 00        MOV        AX,0xe0
       2000:2a86 8b 1e 00 bc     MOV        BX,word ptr [0xbc00]
       2000:2a8a 8b 57 0c        MOV        DX,word ptr [BX + 0xc]
       2000:2a8d 03 16 e6 ae     ADD        DX,word ptr [0xaee6]
       2000:2a91 ee              OUT        DX,AL


[m k]

Some possible IRQ specials, 2F0-2F7.

[vaualbus]

Amazing thread! I too original decomp the software just to get the list of instruments that there were mentioned.
Anyway in respect to the user told us that he add a contact inside Tek what would be amazing to get is the repair software that allows to run board specific test to the scope.
(Basically the one that allow to execute all the tests that the repair manuals told).
To my knowledge it has never been released. The software apparently download some kind of FW to the scope that than execute the tests )via the debug/console port that the CPU has)
Any way I really hope we will eventually be able to make a software that work with any GPIB adapter and not just 16bit ISA one one for which we do not have drivers for NT system as NI never made the 32bit driver. 

[TERRA Operative]

Alrighty, I have got almost all the parts for my PC (enough to have it running DOS and the FAS), including two NI ISA GPIB cards to allow for auto or semi auto calibration.
I have to wrestle with the thing to get the two cards working in the FAS. So far I have one card recognised in the NI diagnostic software, but not in the FAS. I'll have to keep poking away to find the magic combination of settings.

I plan to hook up my SG5030 so the FAS can automatically set the levels and frequencies while I watch to see what's going on. I have a few questions about some instructions (like do I set the signal level to be a specified number of vertical divisions at the sine wave generator amplitude settings, or as displayed on the screen of the scope? etc)

I also got an ebay module that works with Sigrok to use as a 16 channel logic analyzer. I'll make up an adapter so I can sniff the GPIB bus and hopefully see what commands are flying back and forth.

[fenugrec]

So far I have one card recognised in the NI diagnostic software, but not in the FAS

As I mentioned somewhere, my understanding is that the resident NI drivers ( that you're loading from autoexec.bat or manually), will interfere with the FAS' low-level access. I could be wrong, but suggest eliminating this possibility.Once basic tests with NI ibdiag etc. succesfully prove that your ISA cards are good, DIP switch or jumpers properly configured etc., you should probably reboot and not load NI's drivers at all.

(like do I set the signal level to be a specified number of vertical divisions

I assume you've seen my video ? For a manual cal, you adjust the amplitude to obtain visually 6 divisions peak-to-peak. Don't forget my comments re RG58 losses at high frequencies too.

I would also suggest running a simple setup first with no automation, maybe just 1 ISA card, to make sure the FAS runs fine and can control the scope.

[TERRA Operative]

It's weird as on my previous setup (Dell Precision 410, but only one ISA slot) I had the NI drivers loaded and it all worked fine. This PC is set up identically besides the motherboard and a few other PCI cards and it doesn't work.
I have two ISA slots for the two GPIB cards, but I'm only running one for the tests.
I'll prevent the drivers from loading at boot and see what happens. I bet it's something simple like you say, there can't be too much going on to mess things up.


With the test signal level, if setting the amplitude to a number of on-screen divisions, then how does the automated test do it? And why the call for leveled sinewave generators? I read the instruction the same way (set the sinewave level to 6 on-screen divisions) but then the automated test would need a way to view the screen right? Unless it's doing something with waveform capture and checking that?

[fenugrec]

It's weird as on my previous setup (Dell Precision 410, but only one ISA slot) I had the NI drivers loaded and it all worked fine.

Ah, good to know. Still a pretty easy thing to eliminate from the equation. I had freeDOS configured to give me an extra bootmenu entry to load with/without NI drivers so I never really bothered to test the interaction between both, I would just reboot.

how does the automated test do it? And why the call for leveled sinewave generators?

The leveling head of course compensates for cable loss. But I agree it's a silly requirement to be setting the amplitude visually, because if you mess it up, the FAS tells you immediately e.g. "measured 505 MHz, amplitude 6.4 divisions". I would guess the automated test just sets the expected amplitude, measure (either via the scope with a :MEAS command, or it dumps the waveform and does an FFT + amplitude calc), then apply a correction.

[pivous]

FAS asks user to apply test signal to scope -> User applies signal and hits <return> -> FAS directs scope to take measurements -> FAS acquires data and calculates offsets -> FAS loads offsets into scope EEPROM

As TERRA operative, mentioned in the first post, could you please confirm if the process of recording the measured correction values into the TDS occurs after every measurement or if it occurs only after the completion of a certain measurement sequence? If it occurs after the sequence, do you happen to know where these sequences start and end? I am wondering if I need to repeat the entire measurement from the beginning in case of an error, or if it is enough to repeat only a part of it. Thank you.

[charlyd]

Hello great topic this one.. i was curious if we could relate or join forces when it comes to FAS and that also for future units like  TDS7000 series.
i will add the link to the topic. i my self did many Field cals with different TDSXXX series and have a setup ready to test  ( dos-pc PCII card and more.)

https://www.eevblog.com/forum/testgear/does-anyone-have-a-fluke-(wavetek)-9500-and-5-9530-heads-adjustiment-tds7104/msg4868576/#msg4868576

extra intresting link maybe?  http://www.hakanh.com/dl/TDS_pv.htm

[TERRA Operative]

I am stepping closer to having my adjustment gear all set up...

I have confirmed that my HP 437B with 8481A Power Sensor pretty much agrees with my Tek SG5030 and SG503 Levelled Sinewave Generators, so that's nice.
I'll have to keep an eye out for an 8482A power sensor so I can measure down to 100KHz (the 8481A ranges from 10MHz to 18GHz, the 8482A ranges from 100kHz to 4.2GHz)

I also recently got another SG504 Levelled Sinewave Generator which I'll need to poke at a bit (my other one is playing silly games and not levelling..) so far it seems pretty ok throughout its range besides a slight unlevelling issue above 1035MHz, but I'll do a bit of an overhaul and spit-polish before I put it to use.

Still have to get the ISA cards working on the Tyan Tiger 100 motherboard, but will keep chipping away at that too.

[fenugrec]

could you please confirm if the process of recording the measured correction values into the TDS occurs after every measurement or if it occurs only after the completion of a certain measurement sequence?

I'm pretty sure it's only updated after a successful sequence. I was dumping the EEPROM after each sequence for comparison purposes, and after a partly failed CH1 HF CAL (some steps were OK), the contents had not changed.

[oh2erk]

Ghidra does not seem to handle dos interrupts really good at the moment so disassembly is quite a mess. I need to do similar calibration software for the 2782 spectrum analyzer once I get it fixed. It uses same era software where most of the test information is already plain text. Probably the easiest thing to do is just to re-implement the test sequences with modern programming/scripting language. Then you don't have to worry about old ISA GPIB cards etc and can utilize more modern hardware.

[vaualbus]

Hey all, have you made any progress since than?
I still hope that someday we can have a newer software to calib this instrument!