Author Topic: Tektronix TDS1000B and TDS2000B series hacks (Read 90453 times)

prafullshah61 · « **Reply #75 on:** July 11, 2020, 09:56:28 am »

Can any one help me to solve this issue?
I have Tektronix TDS2014B
Its shows " USB Controller Failed" ( ID NUM 17 USB Diagnostic Failed) when power up Self test.
Some time boot normally ,& some time not booting just black screen appear.

tautech · « **Reply #76 on:** July 11, 2020, 09:13:41 pm »

Quote from: prafullshah61 on July 11, 2020, 09:56:28 am

Can any one help me to solve this issue?
I have Tektronix TDS2014B
Its shows " USB Controller Failed" ( ID NUM 17 USB Diagnostic Failed) when power up Self test.
Some time boot normally ,& some time not booting just black screen appear.

Welcome to the forum.

IIRC this is what happened to my TDS2012B.

Investigation found corrosion on 1 pin of a 100 pin IC which I determined originated from a spec of debris landing on the edge of the IC as a result of the top case venting of these models that allows debris to fall into the workings of the scope.

In this case the pin looked OK but when carefully scratching the black spot away with a fine scalpel found the pin was corroded through. A very difficult repair that I have attempted a few time without success.

Yours might be easier to fix IDK.

bootboot · « **Reply #77 on:** September 06, 2020, 03:26:59 am »

Hi,prafullshah61

What's the state of the LEDs on the front when your TDS2014B can not boot normally?
My TDS2022B can not bootup with black screen,3 LED light on,and the Probe's frequency is 5KHz.
I have checked the USB Controller chip(cy7c67300)'s bus and found the Add/Data works well

amindavid11 · « **Reply #78 on:** September 07, 2020, 06:45:55 pm »

Which IC should I desolder for the hack on the TDS2002B, I am a complete noob on this kind of things... what is the cheapest programmer that would get the job done?

biju · « **Reply #79 on:** September 16, 2020, 09:42:00 am »

some voltage level IN OK MOTHERBOARD ( Multimeter Used Fluke 179 True RMS)

biju · « **Reply #80 on:** September 16, 2020, 09:50:31 am »

USB CONTROLLED FAILED show in display PLz check CY7c67300 IC VCC Voltage & FS12.00P

bootboot · « **Reply #81 on:** September 19, 2020, 02:21:37 pm »

My TDS2022B has different PCB.No U616 between the MC68000 and the FLASH .

66bono · « **Reply #82 on:** February 14, 2021, 10:29:47 am »

Hello
I have a TDS1001B, I would like to increase its parameters, can I ask for help.
I am in satan to read flash I do not know how to use the patch. After changing the bend, could he use signal expres software.
Thank you

Boroda4 · « **Reply #83 on:** June 02, 2021, 06:32:43 pm »

Hello
Are you read all NOR flash?
I can`t use latest version of script, and apply previos version on Win10. I edit version in script, place bin near script with ROM.BIN name and apply script. After applying i compare old and new bin in WinHex to shure of changes in shown addresses.

Boroda4 · « **Reply #84 on:** June 02, 2021, 07:05:52 pm »

Hello to all!

Have sombody full dumps of any versions of Tek TDS1000 AND TDS2000? I need both of them.

I have both of this Tek (1001B working and 2014C not working with broken Altera) and i think so my programmer TL866 was burned NOR flash chips.

AND! I was read Altera config from 1001B via USB blaster from Ali and Quartis II! (Attached, rename type if file to .pof)

In my broken 2014C was burned Altera and USB hub. I replace both of them with new, programmed Altera with copy of one from 1001B. I don`t now what differents between Altera from 1000 and 2000, but both of them have one number on sticker. If stickers identical then config may be identical, i think

.

Silicium81 · « **Reply #85 on:** March 22, 2022, 07:22:34 pm »

Thank's for the méthod to hack TDS2000B

I succeeded with the script to hack a TDS1001C-EDU (40MHz) to a TDS2022B (200MHz)!
I unsoldered the flash rom, read then reprogrammed with the content modified with the script. I slightly adapted it to recognize the identifier of the TDS1001C-EDU (0x28).
In pj, the modify script

@_Lis · « **Reply #86 on:** June 04, 2022, 05:30:45 am »

Silicium81,
Share the firmware flash S29JL064H90TF100 from TDS1001C-EDU, please?

Silicium81 · « **Reply #87 on:** June 05, 2022, 01:43:17 pm »

See here: https://www.eevblog.com/forum/repair/bad-firmware-installed-in-tds1001c-edu/msg4052302/#msg4052302

Or in http://www.ko4bb.com/ search TDS1001C

@_Lis · « **Reply #88 on:** June 05, 2022, 02:45:38 pm »

Silicium81,
Thank you very much!
Best regards!

@_Lis · « **Reply #89 on:** June 07, 2022, 04:12:55 am »

I had TDS1002C 1002 C-EDU (60 MHz 1GS/s) turning on with a white screen and not booting after incorrect update firmware via USB
https://www.eevblog.com/forum/repair/tektronix-tds1002c-doesnt-boot/msg890380/#msg890380
After flash http://www.ko4bb.com/manuals/5.166.55.99/Tektronix_TDS1001C-EDU_scope_40MHz_EPROM_V25.07.BIN.zip
the oscilloscope started to turn on, but TDS 1001C-EDU writes on the screen with a frequency of 40MHz, the serial number has changed.
Update firmware from the official website TDS1KC-EDU_V25.11_066123303 did not help, the frequency is still 40 MHz
Please help to restore.
Thank you in advance.
Sorry for the English:(

@_Lis · « **Reply #90 on:** June 08, 2022, 02:55:40 pm »

Problem solved, thanks Silicium81

mophong · « **Reply #91 on:** July 15, 2022, 10:15:32 am »

Hi friends,
After changing model, as I can see bandwidth was improved, how about sampling rate? Let's say we change from TDS2002B to TDS2022B, does the sampling rate really change to 2 GS/s?
Thanks.

vishaldotgupta · « **Reply #92 on:** September 01, 2022, 05:27:23 pm »

hi

i have no easy access to doing patch using python. Instead i can do manually. i have removed flash from TDS2002B, read it on programmer. located the are in data buffer where bits needs to be modified.

i need help in locating the address where in Checksum has to be updated and Filter Confing needs be changed. how to manually calculate checksum for upgrading to TDS 2022B. screenshot of programmer data buffer attached

thanks in advance for your support

BG9ICN · « **Reply #93 on:** September 07, 2022, 04:03:19 pm »

I think you get some ERROES at that patch.py
When use python3, you will fail.
Try to use this patch fixed in python3 enviroment.

BG9ICN · « **Reply #94 on:** September 07, 2022, 04:42:00 pm »

Or you really can't use python, this is way to fix the BIN file.
Change the model at B , It should be 0B when you want tds2022b.
and change marked vaule form something to ‘0F’ in C and D.
At last, calculate how many changed you have do. For example, in B, '0E' > '0B' , that's minus 3, and there are 20 '08'>'0F' ,total add 8C, so the change is 8C-3 = 89, Then add 89 at A.

vishaldotgupta · « **Reply #95 on:** September 08, 2022, 02:27:42 pm »

hi

myself is Novice when it come to programming. Here is what i did

i had read flash, manually changed buffer with product id from 0x0D to 0x0B at 0xf0007

and changed the checksum binary from 0x07 to 0x05 (Difference between 0x0D and 0x0B is "0x2) at 0x7f0000

didn't alter any other data relating to Filters etc. so the only data altered is the product ID

on resoldering the scope doesn't boot. green led remains lit, screen is blank. rechecked my soldering. no loose or shorts etc

can you please advise where i am going wrong. Unfortunately i am not good at programming so instead did manually what script was supposed to do.

kind regards

Vishal

vishaldotgupta · « **Reply #96 on:** September 08, 2022, 02:35:29 pm »

hi
attached is the picture of before and after data buffer of flash ROM

vishaldotgupta · « **Reply #97 on:** September 08, 2022, 02:59:12 pm »

thanks for the explanation with example. I think i changed checksum at wrong address.

few question

1. as per python script the checksum was supposed to be at 0x7f0000. However the "A" is at different address
2. Position "A" in your example has data 0x28AC
3. so it as per the example it will now be 0x2935

so in my case i am just changing the product id from 0x0D to 0x0B. The difference is 2. so 200A now will be 2008

is my understanding correct. I have 3 Ghz Rigol Sig Gen. Will try to do fresh cal after upgrade. that is why i am not changing the cal data

BG9ICN · « **Reply #98 on:** September 08, 2022, 05:31:04 pm »

7F0000H is right. The completed checksum is '00 07 28 AC' in this example. The marked zone is just data changed.
And 08>0F is for operate the LPF, it's different from cal data.

vishaldotgupta · « **Reply #99 on:** September 09, 2022, 07:24:41 am »

HI

Many thanks for your explanation.

I will try this out and will let you know if i succeed


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: Tektronix TDS1000B and TDS2000B series hacks (Read 90453 times)

Share me