Products > Test Equipment
Tektronix TDS1000B and TDS2000B series hacks
vishaldotgupta:
hi
myself is Novice when it come to programming. Here is what i did
i had read flash, manually changed buffer with product id from 0x0D to 0x0B at 0xf0007
and changed the checksum binary from 0x07 to 0x05 (Difference between 0x0D and 0x0B is "0x2) at 0x7f0000
didn't alter any other data relating to Filters etc. so the only data altered is the product ID
on resoldering the scope doesn't boot. green led remains lit, screen is blank. rechecked my soldering. no loose or shorts etc
can you please advise where i am going wrong. Unfortunately i am not good at programming so instead did manually what script was supposed to do.
kind regards
Vishal
vishaldotgupta:
hi
attached is the picture of before and after data buffer of flash ROM
vishaldotgupta:
thanks for the explanation with example. I think i changed checksum at wrong address.
few question
1. as per python script the checksum was supposed to be at 0x7f0000. However the "A" is at different address
2. Position "A" in your example has data 0x28AC
3. so it as per the example it will now be 0x2935
so in my case i am just changing the product id from 0x0D to 0x0B. The difference is 2. so 200A now will be 2008
is my understanding correct. I have 3 Ghz Rigol Sig Gen. Will try to do fresh cal after upgrade. that is why i am not changing the cal data
BG9ICN:
7F0000H is right. The completed checksum is '00 07 28 AC' in this example. The marked zone is just data changed.
And 08>0F is for operate the LPF, it's different from cal data.
vishaldotgupta:
HI
Many thanks for your explanation.
I will try this out and will let you know if i succeed
Navigation
[0] Message Index
[#] Next page
[*] Previous page
Go to full version