Author Topic: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)  (Read 31992 times)

0 Members and 1 Guest are viewing this topic.

Online TiN

  • Super Contributor
  • ***
  • Posts: 4045
  • Country: tw
  • xDevs.com/live - 24/7 lab feed
    • xDevs.com
TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« on: September 22, 2013, 07:34:01 am »
After reading this thread I got temptation to look into my TLA7AA4 module as well, to unlock some extra memory  >:D

I have CS option, which is 2MB of enabled memory with 450MHz rate. There are upper DS and ES (8MB and 32MB).
I looked on board and actually realized that hardware have full memory populated, it's just software disabled.



There are 24 (or 48, don't remember if memory also populated on bottom side) x Micron 128Mbit DDR ICs.
And similar to other Tek machines, there is vxWorks PC in module as well, running on another smaller PCB with MC68360EM25L.
Also RS232 port with console, just like expected, driven by LT1137A converter from SoC.



I guess all calibration/key/option data is stored in DS1230AB, which will become a target after i get PROM programmer in my hands, to backup
original data.

Gotcha some console outputs (attached file) too, lkup command seem to output all possible commands/function calls :)

Not familiar with vxWorks at all, but I guess there should be a way to read/write NVRAM from console.
After some googling and trying:

Code: [Select]
temp = malloc(0x8000)
-> sysNvRamGet(temp,0x8000,0)
value = -1 = 0xffffffff

which means error. And temp variable stored nothing meaningful  :-X
 
« Last Edit: September 23, 2013, 05:54:21 pm by TiN »
YouTube | Chat room | Live-cam | Have documentation to share? Upload here! No size limit, firmware dumps, photos.
 

Offline EEVblog

  • Administrator
  • *****
  • Posts: 29656
  • Country: au
    • EEVblog
Re: TLA hacks :)
« Reply #1 on: September 22, 2013, 08:00:46 am »
I doubt anyone has ever bothered investigating this one before?
Good luck.
 

Online nctnico

  • Super Contributor
  • ***
  • Posts: 17623
  • Country: nl
    • NCT Developments
Re: TLA hacks :)
« Reply #2 on: September 22, 2013, 11:22:16 am »
I have and the options are not in the NVRAM. I'd concentrate on the Powerflex tool for installing module upgrades.
« Last Edit: September 22, 2013, 11:28:26 am by nctnico »
There are small lies, big lies and then there is what is on the screen of your oscilloscope.
 

Offline TerraHertz

  • Super Contributor
  • ***
  • Posts: 3565
  • Country: au
  • Why shouldn't we question everything?
    • It's not really a Blog
Re: TLA hacks :)
« Reply #3 on: September 22, 2013, 03:24:50 pm »
I have and the options are not in the NVRAM. I'd concentrate on the Powerflex tool for installing module upgrades.

You sound so sure, yet offer no hints.
Then what would you say the NVRAM is there for?

The problem with using the software upgrade tool, is that (at least for my TLA 614) the 'upgrade kits' (data blobs) are no longer available. According to Tek's web site anyway. So getting the option installer to do its job (so can examine what it does and where the data goes) isn't an easy thing.

Since there's no way in Hell I'm paying money for such a thing anyway, I don't think Tektronix would likely be terribly helpful. Considering my objectives, it's probably better not to even talk to them.

Whether the old Pentium hardware trace units I have will work with the Celeron in my TLA - that's a question to be investigated.

Btw TiN, I didn't get the files yet. Have been too busy procrastinating.  ;D  Probably tomorrow.
Collecting old scopes, logic analyzers, and unfinished projects. http://everist.org
 

Online nctnico

  • Super Contributor
  • ***
  • Posts: 17623
  • Country: nl
    • NCT Developments
Re: TLA hacks :)
« Reply #4 on: September 22, 2013, 04:52:37 pm »
I have and the options are not in the NVRAM. I'd concentrate on the Powerflex tool for installing module upgrades.

You sound so sure, yet offer no hints.
Then what would you say the NVRAM is there for?
There is only calibration data in the NVRAM. I went down this road; the first thing I tried was erasing the NVRAM and see if the options would dissapear. They didn't so the options are not in the NVRAM.
There are small lies, big lies and then there is what is on the screen of your oscilloscope.
 

Online TiN

  • Super Contributor
  • ***
  • Posts: 4045
  • Country: tw
  • xDevs.com/live - 24/7 lab feed
    • xDevs.com
Re: TLA hacks :)
« Reply #5 on: September 23, 2013, 11:17:39 am »
Quote
There is only calibration data in the NVRAM

Well, I got programmer today, so will see. I don't find any other EEPROM/ROM storage except Flash and NVSRAM at first glance.
Of course, Tek could store key data in one of their big ASICs, but that's questionable.
I see few various ways to enable options:

1. Having good key for option (it's not much of a secret, usually it's on sticker @ module label) - fool module ID to match key. PowerFlex tool gives you what is correct module ID for key. To do so need find ID location and alter it's contents.

2. Find "option enabled" flag/storage and alter it to force option enabled, disregarding of ID/key

3. Do some black software magic and reverse correct key for PowerFlex to enable option using known ID :)

Any vxWorks experts around?  ::)

UPDATE:

Got 32M now :) Don't know how, it just surrender and decided to give me what I want.  :-DD

Before:



Now



All I did - removed original Dallas DS1230AB NVRAM, soldered DIP socket on PCB.
Put blank DS1245AB with VCC pin 32 shorted to pin 30 (i had DS1245AB from Keithley 2001, it's 1024k 32-pin, while DS1230 is 256k 28pin)
Assemble module back, put back into TLA714 frame - booted, run Powerflex - reports 32M right away.

Too easy!  :wtf:

P.S. I guess that's same Murphy law which striked Dave's DSA repair project from recent episode. Thanks Dave! :D
« Last Edit: September 23, 2013, 02:31:50 pm by TiN »
YouTube | Chat room | Live-cam | Have documentation to share? Upload here! No size limit, firmware dumps, photos.
 

Online nctnico

  • Super Contributor
  • ***
  • Posts: 17623
  • Country: nl
    • NCT Developments
Re: TLA hacks :)
« Reply #6 on: September 23, 2013, 04:34:03 pm »
Thats weird and interesting. Where did you get that upgrade key code? Maybe the Powerflex tool just did the upgrade regardless of the wrong module serial number.
There are small lies, big lies and then there is what is on the screen of your oscilloscope.
 

Online TiN

  • Super Contributor
  • ***
  • Posts: 4045
  • Country: tw
  • xDevs.com/live - 24/7 lab feed
    • xDevs.com
Re: TLA hacks :)
« Reply #7 on: September 23, 2013, 05:33:26 pm »
No, it did not.
I just googled TLA7AA4, and after few pages found photo of ES-optioned module.
Key is usually just printed on module sticker. It does not work if module ID does not match key, which is clearly shown on error message.

I tried again put back stock DS1230AB, erased it first on programmer - and guess what, module got 2M again.
Put back DS1245AB - 32M right away, without any other operations/enabling. Is there way to detect DS1245 SRAM? I remember my
Keithley 2001 did same, MEM1 or MEM2 options were directly depends of what SRAM chip installed. But on Keithley there is 32pin DIP socket,
which allows either 28-pin DS1230 or 32-pin DS1245 to be installed. Here - only 28 pin physically, pins 1,2,31 are not connected (32 shorted to 30, to provide VCC).



"modified" DS1245Y and socketed TLA7AA4 board = 32M Depth



Or:



Original DS1230 in socket = 2M Depth

And yes, calibration data was lost when i changed NVRAMs. But since module can recalibrate by user menu - not a problem at all.

Here are also my aquisition board very hi-res photos from both sides. in case someone need it.

Top side, 33MB, 10233x6331 pixels
Bottom side, 34MB, 10156x6352 pixels

Enjoy.
« Last Edit: September 23, 2013, 05:42:11 pm by TiN »
YouTube | Chat room | Live-cam | Have documentation to share? Upload here! No size limit, firmware dumps, photos.
 

Offline leafi

  • Regular Contributor
  • *
  • Posts: 67
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #8 on: September 23, 2013, 06:17:21 pm »
I wish someone would do this for a TDS7404, I wont pay 10K for a memory unlock code.
 

Online nctnico

  • Super Contributor
  • ***
  • Posts: 17623
  • Country: nl
    • NCT Developments
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #9 on: September 23, 2013, 06:39:09 pm »
IMHO you stumbled upon a bug in the board's firmware. AFAIK the ID of the NVRAMs can be read by a special sequence just like parallel flash memory. Perhaps it jumps into some kind of calibration mode when the wrong NVRAM is installed. You already noticed that a blank (original) NVRAM doesn't do anything to the available options which is consistent with my own findings.

My approach would still be to run the Powerflex utility in a debugger and see whether it sends the upgrade key to the board or the Powerflex utility checks whether the key is right and reconfigures the board. If the latter is the case it shouldn't be hard to bypass the check.
There are small lies, big lies and then there is what is on the screen of your oscilloscope.
 

Online TiN

  • Super Contributor
  • ***
  • Posts: 4045
  • Country: tw
  • xDevs.com/live - 24/7 lab feed
    • xDevs.com
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #10 on: September 23, 2013, 11:35:25 pm »
Quote
IMHO you stumbled upon a bug in the board's firmware.
Even if so, i would not complain. I'm not really a software guy to mess weeks and weeks with debugger  :-/O
YouTube | Chat room | Live-cam | Have documentation to share? Upload here! No size limit, firmware dumps, photos.
 

Offline mamalala

  • Supporter
  • ****
  • Posts: 777
  • Country: de
Re: TLA hacks :)
« Reply #11 on: September 23, 2013, 11:54:31 pm »
[...]
Here are also my aquisition board very hi-res photos from both sides. in case someone need it.

Top side, 33MB, 10233x6331 pixels
Bottom side, 34MB, 10156x6352 pixels

Enjoy.

How did you produce these images? They are fantastic! Hi-Res and sharp.

Did you stitch them together from multiple images? First i would have thought it is just a scan (as in: on a scanner), but some connectors out of focus tell me that this is not the case (i think)...

Greetings,

Chris
 

Online TiN

  • Super Contributor
  • ***
  • Posts: 4045
  • Country: tw
  • xDevs.com/live - 24/7 lab feed
    • xDevs.com
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #12 on: September 24, 2013, 12:34:59 am »
Three shots with macro lens (150mm @ f/14) per each side with 10-20% overlap, then align and stitch them manually in photoshop (5 minutes to do :).
You can see gaps if you watch really closely  :-DMM
YouTube | Chat room | Live-cam | Have documentation to share? Upload here! No size limit, firmware dumps, photos.
 

Offline Carrington

  • Super Contributor
  • ***
  • Posts: 1201
  • Country: es
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #13 on: September 24, 2013, 12:36:16 am »
Perhaps you used a Nikon D800.
Cheers.
My English can be pretty bad, so suggestions are welcome. ;)
Space Weather.
Lightning & Thunderstorms in Real Time.
 

Online TiN

  • Super Contributor
  • ***
  • Posts: 4045
  • Country: tw
  • xDevs.com/live - 24/7 lab feed
    • xDevs.com
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #14 on: September 24, 2013, 12:41:47 am »
Right. Cannot resist of nice high-res hardware beauty.

Now I only wish to get hands on one of those TLA7BBx modules to play with, would be sick to have newer modules working in ancient frame like TLA714.
YouTube | Chat room | Live-cam | Have documentation to share? Upload here! No size limit, firmware dumps, photos.
 

Online TiN

  • Super Contributor
  • ***
  • Posts: 4045
  • Country: tw
  • xDevs.com/live - 24/7 lab feed
    • xDevs.com
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #15 on: October 16, 2013, 07:19:45 pm »
Got Nexus DDR3 interposer for TLA :)
Linked TLA714 with CSA7404 by iView (used regular NI GPIB-USB-HS and BNC cables for trigger in/out and reference)

Works cool, but my TLA7AA4 is too slow :( Need 7BB4, but cannot afford it  :'(

DDR3-1067MHz :







 :scared:
YouTube | Chat room | Live-cam | Have documentation to share? Upload here! No size limit, firmware dumps, photos.
 

Offline jgorsk

  • Contributor
  • Posts: 44
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #16 on: November 03, 2013, 07:22:13 pm »
Hi

I tried to do the same trick to my old TLA7N3 module. I replaced the DS1225 memory with a brand new DS1245.
I lost all the installed options after that so I installed the original memory again and the options were back.
Now I wonder if every TLA7AA module can be hacked this way.
 

Offline jgorsk

  • Contributor
  • Posts: 44
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #17 on: November 23, 2013, 07:53:01 pm »
TiN, what's the firmware revision of your TLA7AA4 module?
 

Online TiN

  • Super Contributor
  • ***
  • Posts: 4045
  • Country: tw
  • xDevs.com/live - 24/7 lab feed
    • xDevs.com
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #18 on: November 24, 2013, 03:56:19 am »
I had updated 7AA4 to 5.8.001 a while ago (As TLA Ver 5.1 is running in server mode on mainframe itself).
Using it so far with remote TLA Application Ver 6.1.

Later I have plans to source another TLA7AA4 and try more unlocking, maybe AS or DS variant, when get some extra budget for hobby projects :)
YouTube | Chat room | Live-cam | Have documentation to share? Upload here! No size limit, firmware dumps, photos.
 

Offline jgorsk

  • Contributor
  • Posts: 44
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #19 on: November 24, 2013, 12:11:17 pm »
I just boght a TLA7AA4-CS module. It has 5.0.002 firmware. I'm going to replace the Dallas chip on it tomorrow.
Do you remember what the firmware revision of your module was at the time you hacked it?
 

Online TiN

  • Super Contributor
  • ***
  • Posts: 4045
  • Country: tw
  • xDevs.com/live - 24/7 lab feed
    • xDevs.com
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #20 on: November 24, 2013, 12:47:03 pm »
Same version as my previous post, i updated it long ago from 4.4.
YouTube | Chat room | Live-cam | Have documentation to share? Upload here! No size limit, firmware dumps, photos.
 

Offline jgorsk

  • Contributor
  • Posts: 44
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #21 on: November 24, 2013, 09:19:36 pm »
Did you have any problems getting TLA server v5.1 to work with TLA client
application v6.1?

I can get client - server configuration to work only if they are both v5.1

 

Online TiN

  • Super Contributor
  • ***
  • Posts: 4045
  • Country: tw
  • xDevs.com/live - 24/7 lab feed
    • xDevs.com
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #22 on: November 25, 2013, 05:01:52 am »
No, I had no issues, just had all stuff installed on v5.1 first, then just deinstall and install new 5.8 on remote PC, then did same thing with 6.0 and 6.1.
I remember there were issues with 6.x on one of my HDDs, but on another its working fine. Make sure you have NI VISA installed as well (I used it for LabView, but found that some libraries
are being used by Tektronix software as well).
YouTube | Chat room | Live-cam | Have documentation to share? Upload here! No size limit, firmware dumps, photos.
 

Offline jgorsk

  • Contributor
  • Posts: 44
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #23 on: November 25, 2013, 10:44:07 am »
Thanks for the tip about NI VISA, I only have Tek VISA installed. I thought there were conflicts between Tek software and NI VISA. I'll try it.
 

Offline jgorsk

  • Contributor
  • Posts: 44
Re: TLA7xxx hacks (32M Depth on TLA7AA4CS enabled successful) :)
« Reply #24 on: November 27, 2013, 03:18:40 pm »
I installed NI Visa drivers on the client computer. Now I can connect to the server but the client aplication
isn't detecting any modules. Did you install NI Visa on the Tek frame as well?

That's so much for bad news. Good news is that my TLA7AA4-CS is now full option 32M.

Thank you very much TiN.   :-+
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf