Author Topic: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)  (Read 31097 times)

0 Members and 1 Guest are viewing this topic.

Online TiN

  • Super Contributor
  • ***
  • Posts: 3949
  • Country: tw
  • xDevs.com/live - 24/7 lab feed
    • xDevs.com
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #25 on: November 28, 2013, 02:55:17 am »
No, I did not mess much with mainframe software.

But had issues with modules not detected by ver6 client on remote machine. That's why I rolled back to v5.8 and used it for a year or so. Only recently I tried ver6 and 6.1 as v5.8 had some crashing problems with Nexus DDR3 support module, and it worked well, detecting module and
doing all stuff. Maybe just play around with various versions and see if anything changes.

So dallas NVRAM replacement to 1245 did magic to you too? What's is your module FW version?

I notice also that all TLA apps have memory management issues on my Win2008R2 64bit. If i used more than 8-10GB of memory on remote machine, and try run TLA app - it gives "not enough memory" error and refuse to work. Probably some addressing or resource allocation in TLA app was not done quite right, as i have lots of free memory still available (64GB total RAM)
YouTube | Chat room | Live-cam | Have documentation to share? Upload here! No size limit, firmware dumps, photos.
 

Offline jgorsk

  • Contributor
  • Posts: 44
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #26 on: November 28, 2013, 03:36:52 am »
My module's firmware is 5.0. I used DS1245AB-100+

I tried to modify TLA7N3 module before and that didn't work.
I tied A15 to VCC then, I'm not sure about A16. This time I left
them both floating. I'm not sure if that matters. In theory
floating address pins may be giving problems but I don't think
I'll test this hack with A15/16 inputs of the DS1245 pulled up
or down uless it stops working properly.

I'm not using any Tek Apps but I'm going to write my own
plugins using TPI.Net when I get some time.

Thanks again.
 

Offline KK

  • Regular Contributor
  • *
  • Posts: 99
  • Country: us
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #27 on: June 27, 2014, 05:40:47 am »
I can confirm the hack works. Modified two TLA7AA4cs modules that now have full memory support.

Used a DS1245AB-100

Tied a15 and a16 high. Desoldering, soldering a socket and installing chip was simple and quick.

Modules work great.

Using TLA5.8 on remote Windoze 7 machine and 5.1 locally on the TLA714.
« Last Edit: June 27, 2014, 05:47:25 am by KK »
 

Offline dxl

  • Regular Contributor
  • *
  • Posts: 99
  • Country: de
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #28 on: June 28, 2014, 11:32:40 pm »
I dissassembled the Firmware in 2009 to upgrade the Module. You can use the NI VISA Talk/Listen Utility for this. It's been a while, but i think the procedure was:

Enable Special Upgrade Mode (Get Firmware Version from IDN query)
Code: [Select]
SYST:PASS:INST:PASS Pitbull<FirmwareVersion>

Set Parameters
Code: [Select]
SYST:CONF:MAX:DEPTH <Bytes>
SYST:CONF:SPEED <Speed>

Save Parameters:
Code: [Select]
SYST:PASS:INST:UPD <UnixTimeStamp>

This worked on TLA7AA4 and TLA7N4 at least.

Have fun
 

Offline nctnico

  • Super Contributor
  • ***
  • Posts: 16920
  • Country: nl
    • NCT Developments
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #29 on: June 29, 2014, 04:47:59 am »
What do you fill in for the Unix timestamp?
There are small lies, big lies and then there is what is on the screen of your oscilloscope.
 

Offline dxl

  • Regular Contributor
  • *
  • Posts: 99
  • Country: de
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #30 on: June 29, 2014, 05:34:47 am »
It think it  was the standard unix time stamp which means the current time in seconds since 1/1/1970.
 

Offline KK

  • Regular Contributor
  • *
  • Posts: 99
  • Country: us
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #31 on: June 29, 2014, 06:59:10 am »
I dissassembled the Firmware in 2009 to upgrade the Module. You can use the NI VISA Talk/Listen Utility for this. It's been a while, but i think the procedure was:

Enable Special Upgrade Mode (Get Firmware Version from IDN query)
Code: [Select]
SYST:PASS:INST:PASS Pitbull<FirmwareVersion>

Set Parameters
Code: [Select]
SYST:CONF:MAX:DEPTH <Bytes>
SYST:CONF:SPEED <Speed>

Save Parameters:
Code: [Select]
SYST:PASS:INST:UPD <UnixTimeStamp>

This worked on TLA7AA4 and TLA7N4 at least.

Have fun

Interesting! I'll give this a go on my TLA7N4 and report back.
 

Offline KK

  • Regular Contributor
  • *
  • Posts: 99
  • Country: us
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #32 on: June 29, 2014, 02:50:03 pm »
Sending those commands are not working at all. I am researching the TLA command structure, but I've tried multiple variations of the listed commands and they are not working.

Will look further into this tomorrow. It is likely a minor syntax issue.

SYST:PASS:INST:PASS Pitbull 5.8.001
6/28/2014 9:53 PM 42.233     0.0001s     VXI1::2::INSTR     Error - The specified operation or request timed out     Error-Read    

6/28/2014 9:44 PM 21.457     0.0001s     WDTC-LAB     SYST:CONF:MAX:DEPTH?
     Write    
6/28/2014 9:44 PM 21.469     0.0001s     VXI1::2::INSTR     Error - The specified operation or request timed out     Error-Read    
« Last Edit: June 29, 2014, 02:56:43 pm by KK »
 

Offline dxl

  • Regular Contributor
  • *
  • Posts: 99
  • Country: de
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #33 on: June 29, 2014, 04:53:49 pm »
Those are not Queries, you need to just write them to the unit with NI-VISA. There are different buttons in VISA: Write, Read, Query. I think there should also be no space between the "pitbull" password and the firmware version number. It's just one string concatenated as password.
« Last Edit: June 29, 2014, 04:55:52 pm by dxl »
 

Offline nctnico

  • Super Contributor
  • ***
  • Posts: 16920
  • Country: nl
    • NCT Developments
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #34 on: June 29, 2014, 07:13:34 pm »
Maybe put the password between ""?
There are small lies, big lies and then there is what is on the screen of your oscilloscope.
 

Offline KK

  • Regular Contributor
  • *
  • Posts: 99
  • Country: us
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #35 on: June 30, 2014, 02:17:50 am »
Those are not Queries, you need to just write them to the unit with NI-VISA. There are different buttons in VISA: Write, Read, Query. I think there should also be no space between the "pitbull" password and the firmware version number. It's just one string concatenated as password.

I tried them as writes also and no space between pitbull and firmware version. But just to be clear, are you saying each of these lines should be performed as individual write commands and no status is ever read at the end or return results from any of the lines. Just all lines as blind writes then at the end close the VISA and check with powerflex if the options have been enabled? What about the "Set Parameters" and "Code: [Select]" lines are those also supposed to be issued as writes or are those return results?

I will try them all as writes and see what happens, but I thought I did that and got an error returned at some point.

SYST:PASS:INST:PASS Pitbull<FirmwareVersion>

Set Parameters
Code: [Select]
SYST:CONF:MAX:DEPTH <Bytes>
SYST:CONF:SPEED <Speed>

Save Parameters:
Code: [Select]
SYST:PASS:INST:UPD <UnixTimeStamp>
« Last Edit: June 30, 2014, 02:19:49 am by KK »
 

Offline KK

  • Regular Contributor
  • *
  • Posts: 99
  • Country: us
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #36 on: June 30, 2014, 03:22:17 am »
Attempted it verbatim to the posted instructions. Issued "blind" writes, but at the end checked with poweflex and no options installed.

The TLA7N4 goes as high as 4M memory and 200Mhz. I used 4096 for memory depth and 200 for speed. I will try so other numbers like 4M to see if that works.

First attempt log-

6/29/2014 9:56 AM 02.118     0.0086s     TCPIP::192.168.0.144::vxi0,2::INSTR TEKTRONIX,TLA7N4,B011582,SCPI:94.0 FVER:5.5.001     Read
    
6/29/2014 9:56 AM 38.294     0.0083s     WIN-330I86GF26R     SYST:PASS:INST:PASS Pitbull5.5.001  Write    
6/29/2014 9:56 AM 49.822     0.0083s     WIN-330I86GF26R     Set Parameters  Write    
6/29/2014 9:57 AM 01.070     0.0083s     WIN-330I86GF26R     Code: [Select]  Write    
6/29/2014 9:58 AM 38.787     0.0081s     WIN-330I86GF26R     SYST:CONF:MAX:DEPTH 4194304  Write    
6/29/2014 9:59 AM 12.170     0.0079s     WIN-330I86GF26R     SYST:CONF:SPEED 200  Write    
6/29/2014 9:59 AM 26.366     0.0086s     WIN-330I86GF26R     Save Parameters:  Write    
6/29/2014 9:59 AM 36.631     0.0078s     WIN-330I86GF26R     Code: [Select]  Write    
6/29/2014 10:01 AM 47.904     0.0085s     WIN-330I86GF26R     SYST:PASS:INST:UPD 1404025200  Write    
« Last Edit: June 30, 2014, 03:25:19 am by KK »
 

Offline KK

  • Regular Contributor
  • *
  • Posts: 99
  • Country: us
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #37 on: June 30, 2014, 03:27:26 am »
Powerflex shows the following options that are valid for this TLA7N4 Module-
Serial number/ID info is redacted as not relevant.

 ######################################################################
 ######################################################################
 #
 #      TLA PowerFlex Upgrade Information File
 #
 # This file contains information needed when ordering a TLA PowerFlex
 # upgrade kit. Contact your local Tektronix representative for pricing
 # and ordering information. When ordering an upgrade, include a hard
 # copy of this file with your order.
 #
 #          June 29, 2014
 #
 ######################################################################
 ######################################################################

Current Configuration:

   Product Type:         TLA7N4
   Serial Number:         XXX
   Unique ID:         XXX
   Memory Depth:         64K
   State Speed:         100 MHz
   Extension:         NA
   Timing Speed:         2 GHz / 250 MHz
   Channels:         136
   PowerFlex Software Version:   5.6.754.0
   TLA Software Version:      5.6.754.0
   Module Firmware Version:   5.5.001


Upgrade Option Selected:

   - No Upgrade Selected -


Possible Upgrades:

   Upgrade Kit & Option   Memory Depth   State Speed   Extension
   TLA7F14 Opt 01      256K      100 MHz
   TLA7F14 Opt 02      1M      100 MHz
   TLA7F14 Opt 03      4M      100 MHz
   TLA7F14 Opt 04      64K      200 MHz
   TLA7F14 Opt 05      256K      200 MHz
   TLA7F14 Opt 06      1M      200 MHz
   TLA7F14 Opt 07      4M      200 MHz
   
 

Offline KK

  • Regular Contributor
  • *
  • Posts: 99
  • Country: us
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #38 on: June 30, 2014, 03:32:40 am »
OK, these commands give status that makes sense-

6/29/2014 10:29 AM 45.238     0.0084s     WIN-330I86GF26R     SYST:CONF:SPEED?
     Write    
6/29/2014 10:29 AM 45.270     0.0162s     TCPIP::192.168.0.144::vxi0,2::INSTR     100     Read    

6/29/2014 10:30 AM 55.937     0.0104s     WIN-330I86GF26R     SYST:CONF:MAX:DEPTH?
     Write    
6/29/2014 10:30 AM 55.952     0.0118s     TCPIP::192.168.0.144::vxi0,2::INSTR     4194304     Read    

Looks like memory is showing 4MB. Maybe the modules need to be power cycled and rebooted to show new options. I'll give that a go. Speed is still stuck at 100mhz state though. Will issue the speed command again.
 

Offline dxl

  • Regular Contributor
  • *
  • Posts: 99
  • Country: de
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #39 on: June 30, 2014, 03:38:54 am »
What does a "SYST:ERR?" Query show after the Password command?
 

Offline KK

  • Regular Contributor
  • *
  • Posts: 99
  • Country: us
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #40 on: June 30, 2014, 03:44:27 am »
Hmm. Something has happened now.

After going through the commands a second time, without power cycling yet, Powerflex only show the module and serial number with all other fields blank, and text at the bottom of the window saying- "Update complete successfully."

So Tek uses Chinglish too :D

I'm starting up the TLA Application now to see what it says about memory depth-

No, still shows a max of 64K. I'll reboot the TLA and see what happens.
 

Offline KK

  • Regular Contributor
  • *
  • Posts: 99
  • Country: us
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #41 on: June 30, 2014, 03:46:13 am »
What does a "SYST:ERR?" Query show after the Password command?

6/29/2014 10:45 AM 40.336     0.0201s     TCPIP::192.168.0.144::vxi0,2::INSTR     -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P"     Read    
 

Offline KK

  • Regular Contributor
  • *
  • Posts: 99
  • Country: us
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #42 on: June 30, 2014, 03:48:36 am »
If I try it another way and put the Pitbull5.5.001 in quotes I get this error after  a SYST:ERR? query. It doesn't appear to want quotes.

6/29/2014 10:47 AM 21.830     0.0199s     TCPIP::192.168.0.144::vxi0,2::INSTR     -224,"Illegal parameter value; Password not valid; ASS:INST:PASS ""Pitbull5.5.001""\n"     Read    
 

Offline KK

  • Regular Contributor
  • *
  • Posts: 99
  • Country: us
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #43 on: June 30, 2014, 03:59:14 am »
I've tried the SYST:PASS:INST:PASS several ways now. It is definitely a recognized command, but it is rejecting the password.

6/29/2014 10:45 AM 24.767     0.0130s     WIN-330I86GF26R     SYST:PASS:INST:PASS Pitbull5.5.001
     Write    
6/29/2014 10:45 AM 40.304     0.0084s     WIN-330I86GF26R     SYST:ERR?
     Write    
6/29/2014 10:45 AM 40.336     0.0201s     TCPIP::192.168.0.144::vxi0,2::INSTR     -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P"     Read    


6/29/2014 10:47 AM 05.482     0.0084s     WIN-330I86GF26R     SYST:PASS:INST:PASS "Pitbull5.5.001"
     Write    
6/29/2014 10:47 AM 21.799     0.0080s     WIN-330I86GF26R     SYST:ERR?
     Write    
6/29/2014 10:47 AM 21.830     0.0199s     TCPIP::192.168.0.144::vxi0,2::INSTR     -224,"Illegal parameter value; Password not valid; ASS:INST:PASS ""Pitbull5.5.001""\n"     Read
    

6/29/2014 10:50 AM 52.348     0.0078s     WIN-330I86GF26R     SYST:PASS:INST:PASS Pitbull5.5.001
     Write    
6/29/2014 10:50 AM 55.188     0.0078s     WIN-330I86GF26R     SYST:ERR?
     Write    
6/29/2014 10:50 AM 55.203     0.0133s     TCPIP::192.168.0.144::vxi0,2::INSTR     -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P"     Read    

 
6/29/2014 10:51 AM 10.522     0.0085s     WIN-330I86GF26R     SYST:PASS:INST:PASS pitbull5.5.001
     Write    
6/29/2014 10:51 AM 13.455     0.0076s     WIN-330I86GF26R     SYST:ERR?
     Write    
6/29/2014 10:51 AM 13.471     0.0212s     TCPIP::192.168.0.144::vxi0,2::INSTR     -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS p"     Read    


6/29/2014 10:51 AM 58.445     0.0081s     WIN-330I86GF26R     SYST:PASS Pitbull5.5.001
     Write    
6/29/2014 10:52 AM 00.972     0.0082s     WIN-330I86GF26R     SYST:ERR?
     Write    
6/29/2014 10:52 AM 01.004     0.0127s     TCPIP::192.168.0.144::vxi0,2::INSTR     -113,"Undefined header; Command not found; SYST:PASS "     Read

   
6/29/2014 10:52 AM 16.338     0.0082s     WIN-330I86GF26R     SYST:PASS:INST:PASS
     Write    
6/29/2014 10:52 AM 19.786     0.0077s     WIN-330I86GF26R     SYST:ERR?
     Write    
6/29/2014 10:52 AM 19.801     0.0204s     TCPIP::192.168.0.144::vxi0,2::INSTR     -109,"Missing parameter; Unexpected termination detected; SYST:PASS:INST:PASS\n"     Read    

 
6/29/2014 10:53 AM 32.637     0.0109s     WIN-330I86GF26R     SYST:PASS:INST:PASS Pitbull<5.5.001>
     Write    
6/29/2014 10:53 AM 35.274     0.0079s     WIN-330I86GF26R     SYST:ERR?
     Write    
6/29/2014 10:53 AM 35.305     0.0226s     TCPIP::192.168.0.144::vxi0,2::INSTR     -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P"     Read    


6/29/2014 10:54 AM 00.218     0.0078s     WIN-330I86GF26R     SYST:PASS:INST:PASSPitbull5.5.001
     Write    
6/29/2014 10:54 AM 02.854     0.0081s     WIN-330I86GF26R     SYST:ERR?
     Write    
6/29/2014 10:54 AM 02.870     0.0188s     TCPIP::192.168.0.144::vxi0,2::INSTR     -110,"Command header error; Illegal character in header; SYST:PASS:INST:PASSPitbull5."     Read

   
6/29/2014 10:54 AM 24.943     0.0118s     WIN-330I86GF26R     SYST:PASS:INST:PASS [Pitbull5.5.001]
     Write    
6/29/2014 10:54 AM 27.689     0.0080s     WIN-330I86GF26R     SYST:ERR?
     Write    
6/29/2014 10:54 AM 27.720     0.0144s     TCPIP::192.168.0.144::vxi0,2::INSTR     -101,"Invalid character; Unexpected character found; SYST:PASS:INST:PASS ["     Read    


6/29/2014 10:55 AM 06.065     0.0089s     WIN-330I86GF26R     SYST:PASS:INST:PASS Pitbull
     Write    
6/29/2014 10:55 AM 08.264     0.0085s     WIN-330I86GF26R     SYST:ERR?
     Write    
6/29/2014 10:55 AM 08.295     0.0182s     TCPIP::192.168.0.144::vxi0,2::INSTR     -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P"     Read    


6/29/2014 10:55 AM 34.737     0.0101s     WIN-330I86GF26R     SYST:PASS:INST:PASS Pitbull55001
     Write    
6/29/2014 10:55 AM 37.405     0.0080s     WIN-330I86GF26R     SYST:ERR?
     Write    
6/29/2014 10:55 AM 37.436     0.0252s     TCPIP::192.168.0.144::vxi0,2::INSTR     -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P"     Read    
 

Offline dxl

  • Regular Contributor
  • *
  • Posts: 99
  • Country: de
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #44 on: June 30, 2014, 04:03:15 am »
My TLA7AA4 wants "PitBull" with upper case "B". Can you check whether that works?
 

Offline KK

  • Regular Contributor
  • *
  • Posts: 99
  • Country: us
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #45 on: June 30, 2014, 04:04:03 am »
Power cycling the instrument and using Powerflex shows no options installed and the fields are all populated again showing 64K memory depth and 100mhz state.

Not surprising, since it appears the password line isn't working yet. Hopefully we can figure out what it wants.
 

Offline dxl

  • Regular Contributor
  • *
  • Posts: 99
  • Country: de
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #46 on: June 30, 2014, 04:05:10 am »
Did you try "PitBull5.5.001"?
 

Offline KK

  • Regular Contributor
  • *
  • Posts: 99
  • Country: us
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #47 on: June 30, 2014, 04:07:19 am »
My TLA7AA4 wants "PitBull" with upper case "B". Can you check whether that works?

I'm doing this on a TLA7N4. But, i also have a TLA7AA4 that I can try it on (of course it has already been "upgraded" with a new flash).

I used "PitBull" with the TLA7N4, still no go-

6/29/2014 11:05 AM 08.499     0.0305s     WIN-330I86GF26R     SYST:PASS:INST:PASS PitBull5.5.001
     Write    
6/29/2014 11:05 AM 17.438     0.0108s     WIN-330I86GF26R     SYST:ERR?
     Write    
6/29/2014 11:05 AM 17.469     0.0265s     TCPIP::192.168.0.144::vxi0,2::INSTR     -104,"Data type error; Unrecognized string data; SYST:PASS:INST:PASS P"     Read    





« Last Edit: June 30, 2014, 04:10:04 am by KK »
 

Offline KK

  • Regular Contributor
  • *
  • Posts: 99
  • Country: us
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #48 on: June 30, 2014, 04:28:59 am »
Did you try "PitBull5.5.001"?

Didn't work on the 7N4 as posted above. Will check my 7AA4 shortly.

Did you ever get it to work with a 7N4 or just the the 7AA4?

When you disassembled the firmware, did you disassemble the firmware file distributed by tektronix or did you have to pull it out of the module itself. Was the PitBull password plain text in the firmware?

 

Offline dxl

  • Regular Contributor
  • *
  • Posts: 99
  • Country: de
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #49 on: June 30, 2014, 04:34:29 am »
Data type error; Unrecognized string data - i think youre missing the quotes around the password.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf