Tektronix TDS1000B and TDS2000B series hacks - Page 1
Forum section: electronics / testgear

author: KK
author_rank: Regular Contributor
timestamp: June 28, 2014, 07:00:21 pm
content: Anyone know of a way to upgrade bandwidth on the Tek 1000B series scopes?Assuming the hardware is identical on the 40-70-100 MHz units.I want to upgrade a 40mhz 1001B scope I use with iview and a logic analyzer to 100mhz.

author: KK
author_rank: Regular Contributor
timestamp: July 06, 2014, 12:03:02 am
content: Looks like I will dissemble the firmware file to see how to change the identifier.Any tear downs yet on these scopes - TDS1001b/1002b/1012b?Anyone know the main processor offhand?

author: KK
author_rank: Regular Contributor
timestamp: July 17, 2014, 08:01:45 pm
content: Looks like the firmware is common for the TDS1000B/TDS2000B series Oscilloscopes.I'm disassembling it to look at some of the remote commands. I've found some interesting things to look closer at.VXWorks is used as the RTOS, and this scope uses a Freescale 68000 compatible processor.

author: KK
author_rank: Regular Contributor
timestamp: July 17, 2014, 08:02:25 pm
content: DS1339Ci2C Clock

author: KK
author_rank: Regular Contributor
timestamp: July 17, 2014, 08:03:29 pm
content: Firmware flashSpansionS29JL064H64Mbit flash memory 4Mbx16

author: KK
author_rank: Regular Contributor
timestamp: July 17, 2014, 08:04:27 pm
content: DRAM. 64Mbit 512Kx32 in 4 banks.

author: KK
author_rank: Regular Contributor
timestamp: July 17, 2014, 08:05:03 pm
content: NSADG522Can't find info. Must be the A/D.

author: KK
author_rank: Regular Contributor
timestamp: July 17, 2014, 08:06:16 pm
content: Unknown NS chipEE69RD9858-00Another similar chip not pictured isNSEE63RA9857-00

author: KK
author_rank: Regular Contributor
timestamp: July 17, 2014, 08:07:42 pm
content: Highspeed SRAM 128K x 8

author: KK
author_rank: Regular Contributor
timestamp: July 17, 2014, 08:08:44 pm
content: Main ramSRAM 1 Mbit 64K x 16

author: KK
author_rank: Regular Contributor
timestamp: July 17, 2014, 08:09:52 pm
content: Altera Max IIEPM2408K flash

author: KK
author_rank: Regular Contributor
timestamp: July 17, 2014, 08:10:40 pm
content: USB DriverCypress Semi CY7C67300-100AXI

author: nctnico
author_rank: Super Contributor
timestamp: July 17, 2014, 08:15:18 pm
content: Quote from: KK on July 17, 2014, 08:07:42 pmProbably not. The sampling memory (1k points?) is inside the sampling ASIC.

author: tautech
author_rank: Super Contributor
timestamp: July 17, 2014, 08:19:54 pm
content: QuoteNow I'm interested.I have TDS2102B in bits with a corroded pin on the USB chip.I could possibly help if needed.

author: KK
author_rank: Regular Contributor
timestamp: July 17, 2014, 11:14:49 pm
content: Quote from: nctnico on July 17, 2014, 08:15:18 pmYeah, it's only 2.5K points

author: KK
author_rank: Regular Contributor
timestamp: July 17, 2014, 11:22:11 pm
content: Quote from: tautech on July 17, 2014, 08:19:54 pmHere is the latest firmware V22.16 for TDS1000B and TDS2000B series models.The file isn't encrypted or compressed.(too big to attach- download here)http://www.tek.com/oscilloscope/tds1001b-software/firmware-update-tds1000b-and-tds2000b-v2216binwalk hasn't been helpful, but I have it in Ida Pro right now and I can see some interesting routines.There are a bunch of 488.2 commands you can send it over USB using the Tektronix open choice talker/listener app.Some of the undocumented commands from the firmware might allow for a model identifier change (bandwidth) and/or direct bandwidth change.There are some interesting error messages in the firmware like-Number of channels is 2 and you have selected a 4-channel ModelDisplay is MONO and you have selected a COLOR ModelNumber of channels is 4 and you have selected a 2 channel modelDisplay is COLOR and you have selected a MONO modelsuccess!; saving constants ...

author: tinhead
author_rank: Super Contributor
timestamp: July 17, 2014, 11:55:40 pm
content: what you doing is the wrong way, the firmware is for all models, so it does not matter what inside (unless you wish to search the whole firmware for model checks and patch it then). The best way is to patch the model itself, and this has been saved somewhere. The RTC clocke does have some user bytes, but htey can't be used (without special tricks) to store model. Are there any eeproms on the board? i bet the altera cpld is readback protected, but well, just try to dump it. If the model check is really in that cpld (and not eeprom) then it is still possible to change it, e.g. by watching the bus for call just before model check in fw, and then sending the crafted info back. When eepom used, then it will be much easier. Or even simple tricks like some "not populated" parts, TEK did that on other models and one can hack them very easy (which still did't change anything, without calibration mainly useless - and to run cal one need anyway some gears, so ppl who can calobrate have enought money anyways to buy higher TEK models).

author: KK
author_rank: Regular Contributor
timestamp: July 18, 2014, 12:17:01 am
content: Interesting ideas.Is it possible Tektronix made one motherboard for both the model series and then configures them with commands after final assembly to what kind of model it should be. I am pursuing the theory that I can issue a command to change the max bandwidth and/or model.I have other oscilloscopes, this is just used with my tla714 logic analyzer for iview. The type of screen it uses and feature set are mostly irrelevant as I'm looking at the waveform on Windows 7 anyway.Bandwidth matters. I decided to buy the lowest bandwidth model because I figured hacking it up to the max would be possible.

author: KK
author_rank: Regular Contributor
timestamp: July 18, 2014, 05:59:30 am
content: The 'B' series of these scopes introduced a USB port. Amongst the many advantages is that it works with the TLA Logic Analyzer software to overlay the scope signal with the logic analyzer signals and sync the signals.They all have (only) 2.5K points memory. Although that doesn't matter in my application.TDS1000B is a 2-channel monochrome LCD Series-1001B - 40 Mhz / 500 MS/s1002B - 60 Mhz / 1.0 GS/s1012B - 100 Mhz / 1.0 GS/sTDS2000B series is a 2 or 4 channel color LCD series-2 channels-2002B - 60 Mhz / 1.0 GS/s2012B - 100 Mhz / 1.0 GS/s2022B - 200 Mhz / 2.0 GS/s4 channels-2004B - 60 Mhz / 1.0 GS/s2014B - 100 Mhz / 1.0 GS/s2024B - 200 Mhz / 2.0 GS/s

author: KK
author_rank: Regular Contributor
timestamp: July 18, 2014, 05:18:58 pm
content: Quote from: tautech on July 17, 2014, 08:19:54 pmDo you mean TDS2012B ?Is your chipset identical to mine?

author: tautech
author_rank: Super Contributor
timestamp: July 18, 2014, 07:47:32 pm
content: Quote from: KK on July 18, 2014, 05:18:58 pmYes, yes.

author: KK
author_rank: Regular Contributor
timestamp: July 18, 2014, 07:49:57 pm
content: Quote from: tautech on July 18, 2014, 07:47:32 pmDo the two white labeled chips flash & cpld have the same codes printed on them?

author: tautech
author_rank: Super Contributor
timestamp: July 18, 2014, 08:09:00 pm
content: U800, F163. 166600U801, F163. 166100. V21.20In bits ATM.Fails boot.Pin 22 on U900 (USB chip) corroded through.I need to be off grog for a weekto have a steady hand to attempt to solder a very fine wire to the pad.Other option is replacement. Bit nervous about that, but I will just have to man up.Got plenty of other gear, so it's low priority.

author: KK
author_rank: Regular Contributor
timestamp: July 18, 2014, 08:32:58 pm
content: Identical. So the only difference between the 1000B and 2000B 2 channel series is the display module.Perhaps we can get these scopes up to 200Mhz

author: tautech
author_rank: Super Contributor
timestamp: July 18, 2014, 08:53:08 pm
content: Quote from: KK on July 18, 2014, 08:32:58 pmThat would turn heads.I have no gear for any in depth sniffing etc, only a decoding DSO.I will help if I can.The only advice I could offer is to take note oftinhead's interest.

author: KK
author_rank: Regular Contributor
timestamp: July 20, 2014, 04:06:08 am
content: Quote from: tinhead on July 17, 2014, 11:55:40 pmThere is at least one flash. The main flash holds the program code, and maybe some model ID/sn. There are two other unknown chips that may have some memory.I am more of a software guy, and have disassembled 80% of the firmware, because you know the 80/20 rule!I found it interesting because it gives me an overview of what is going on.My random thoughts are-It's more complicated than I would have guessed. They are programming a USB chip, on the fly, to offload tasks.There is a lot of printer driver code embedded. Tons of remote programming code.What's interesting are two specialized menu's that can be enabled.Service ModeEngineering ModeService mode is documented, but doesn't do anything special.Engineering mode, I suspect, will let you change interesting things like serial number and model type. There are error messages that prevent you from enabling 4 channels when the model hardware only has two, and color when the hardware is black & whiite.There are no error messages for bandwidth.Additionally, there is a lot of code for power analysis. It is enabled when a USB key is verified for TBS2PWR1My first thoughts are that the TDS scopes can do the power analysis functions the TBS scope can. Tektronix decided to limit those functions to there TBS series.That series also has similar bandwidth and 2.5K/points memory so I'm thinking the hardware is again identical.The goal of this mission is to enable all bandwidth options fot the TDS1000B/2000B scopes and potentially enable the TBS2PWR1 functions since they are in the same firmware. It's not just a reference I see the entire functions and calculations in my dis assembly.My focus now is to decode how to get into "Engineering Mode" through the front panel. Disassembly helped me find out there is such a thing.

author: tautech
author_rank: Super Contributor
timestamp: July 20, 2014, 04:37:50 am
content: I can read all chips #'s on my PCB.Tell me which you need.

author: KK
author_rank: Regular Contributor
timestamp: July 20, 2014, 09:23:17 pm
content: Quote from: tautech on July 20, 2014, 04:37:50 amThey match all the ones in my photos right? I think the main boards are identical.

author: KK
author_rank: Regular Contributor
timestamp: July 20, 2014, 09:29:22 pm
content: Zeroing in on it. Looking at the code that handles the front panel buttons to see the "secret" entry method.The memory map appears to be-0-4MB Main ram4MB-8MB Flash program8MB++ other hardware like usb controller etcThe model id and serial number are stored alongside the factory calibration data. These scopes let you re-calibrate through the service menu. Looking into where that data is stored.Flash holds 4MB and the firmware file leaves about 647K free in the flash. The cal data might be at the end of the flash or it might be stored in some other chip.

author: tautech
author_rank: Super Contributor
timestamp: July 20, 2014, 09:41:45 pm
content: Quote from: KK on July 20, 2014, 09:23:17 pmQuite well.There are minor variations with U502, 400, 301.Looks like revisions.

author: KK
author_rank: Regular Contributor
timestamp: July 23, 2014, 04:51:56 am
content: Whats the chip next to the USB port. I didn't pull the board all the way out of my enclosure so didn't see that one.

author: KK
author_rank: Regular Contributor
timestamp: July 23, 2014, 05:00:02 am
content: Interesting discoveries so far...The service mode can be entered with the following procedure-Power on scopePress MEASURE buttonPress CH1 soft buttonPress and hold SINGLE SEQ buttonPress and hold AUTOSET buttonWait 5 secondsRelease SINGLE SEQ buttonRelease AUTOSET buttonNotice lower left of screen displays "Service mode ON"Press UTILITY buttonPress SERVICE soft buttonPress Service Diag. soft buttonPress Peek/Poke soft buttonIsn't that nice. Tektronix included a way to read or write memory, live. Any location. Right from the front panel.I'm correlating the disassembly with some configuration memory locations in ram. I believe I can test some config changes (changing bandwidth) on the fly. It won't be permanent with this method, but it will let me confirm what part of the code is handling that process.Engineering Mode is entered in a similar, but as of yet unknown way.I believe I see code that lets Tektronix quickly configure models with USB keys. They insert one key to configure the model to a TDS1001B or another to configure it to a TDS1002B with higher bandwidth.Will be looking further into both angles.

author: tautech
author_rank: Super Contributor
timestamp: July 23, 2014, 05:58:34 am
content: Quote from: KK on July 23, 2014, 04:51:56 amSOIC8 Atmel 24C1024W close to front panel USBFrom the Tek Service manual:Enable the Service Menu1. Power on the oscilloscope.2. Push the front-panel MEASURE button to access the MEASURE menu.3. Push the top option button to access the Measure 1 menu.4. Push and hold the front-panel SINGLE SEQ button.5. Push and hold the front-panel AUTOSET button.6. Wait at least two seconds.7. Release the SINGLE SEQ button.8. Release the AUTOSET button. A message appears in the lower left corner ofthe screen stating “Service mode ON.”9. Push the front-panel UTILITY button. The last item in the Utility menu isnow “Service.”At completion of the Adjust procedure disable the “Service” menu through theUTILITY front panel button, the “Service” option button, and the “Service”Mode Off” option button.

author: KK
author_rank: Regular Contributor
timestamp: July 23, 2014, 06:52:31 am
content: 24C1024W serial EEPROM 128K x 8Aha! I wondered why I never spotted a smaller EEPROM even after suspecting there must be one.

author: KK
author_rank: Regular Contributor
timestamp: July 24, 2014, 10:34:19 pm
content: Since yours is already apart, can you read the memory and post it.Meanwhile, I am reverse engineering the front panel code and matching it up to the key identifiers to figure out what key combo will get us into Engineering Mode.The code is interrupt driven and creates jump tables at runtime in ram so it is a mess. The beauty of VXWORKS.

author: tautech
author_rank: Super Contributor
timestamp: July 24, 2014, 11:03:24 pm
content: Sorry I do not have any sniffing gear.Been wondering about getting some, what do you recommend to start with?As far as I can tell, the 3 interconnect leads will have enough length to power up scope disassembled. Just checked, it is no problem for the 3 leads.Then access is easy.You may have to add a GND lead, but probably not for your needs.There is only a few screws and all the knobs just pull off.Service manual describes full dis-assembly. I don't remember it being difficult at all.I can send you the manual, PM me with your email.

author: KK
author_rank: Regular Contributor
timestamp: July 24, 2014, 11:55:14 pm
content: I pulled the knobs and keys but then I noticed I would have to pull all the bnc's mounting hardware off too and just called it a night and pit it back together.I'll work some more on the code angle.The tll866a with an 8 pin soic clip will work without any hassle. It supports the memory and the clip means no wire mods.

author: KK
author_rank: Regular Contributor
timestamp: July 25, 2014, 02:22:23 am
content: Quote from: tinhead on July 17, 2014, 11:55:40 pmHi Tinhead,You have a great reputation here. I appreciate your interest and response.Your thoughts are interesting, especially the parts not installed and patching the device itself.I'm an experienced MC68000 assembly programmer, so I thought it would be fun to dive into the firmware.Not many products use the 68000 these days. But, the fact they used VXWORKS complicates everything. The code is mostly unlabeled and jump tables are obfuscated by VXWORKS, not on purpose I think.There is a small i2c EEPROM. That's where the interesting things are stored. I am working that angle, but enjoyed the disassembly. It brought back old memories of 68K code

author: KK
author_rank: Regular Contributor
timestamp: August 09, 2014, 04:25:18 pm
content: I disassembled the scope again and dumped the i2c eeprom. It contains the boot code for the Cypress USB controller. No config/calibration data.The memory map so far-000000-00FFFF RAM 64K Cypress?010000-010FFF Memory mapped I/O?011000-012FFF Altera Max II CPLD?013000-0FFFFF RAM?100000-1FFFFF Unreadable/Privilege Exception200000-3FFFFF Ram Spansion 48lC2m3202?400000-56BEE4 Flash memory main56BEE5-7FFFFF Empty but is reserved for Flash memory800000-FFFFFF Unreadable/Privilege Exception - End of addressable memoryBeing a 68000, maximum address space is 16MB. But, it appears only the first 8MB has been used.To get into Service mode requires two simultaneous key presses. Engineering mode will likely be similar, as there is code to support two simultaneous key presses, but not three. Although the hardware register shows that it can at least see up to 4 simultaneous presses.Each key is assigned a base code, and the code is +1 if the key is held. Key codes are spaced out by 2.Knobs are memory mapped. The memory locations for each knob (2 channel scopes have 8 knobs) store a #$FF if they are turned to the right and a #$01 if turned to the left.The Altera CPLD has 8K of user flash. It is possible the model config, serial number, and calibration data is stored there. In fact, it is likely. There is some code to suggest the serial number is stored in the ADG522 chip which is totally undocumented. So that is one other place.Getting in through the OS is still the ideal way if possible.Tautech- Can you take Hires photos of your key matrix. Particularly the traces so I can see how the matrix is setup compared to a two channel scope.

author: tautech
author_rank: Super Contributor
timestamp: August 10, 2014, 07:36:50 am
content: KK, image sent to your email(5MB)

author: KK
author_rank: Regular Contributor
timestamp: August 10, 2014, 08:32:12 pm
content: At this point I have documented much of the boot process, and can probably just patch the firmware where it gets the model id, and force a bandwidth upgrade.I will use that option last and would still like to figure out how to enter engineering mode.Making a custom firmware isn't such a bad option though since it would only patch a couple of bytes and these models are long in the tooth now and Tek isn't likely to issue any future firmware updates.

author: nctnico
author_rank: Super Contributor
timestamp: August 10, 2014, 09:14:55 pm
content: If you can force a bandwidth upgrade it would be nice to see if it has any effect. Maybe the board needs some component changes as well.

author: KK
author_rank: Regular Contributor
timestamp: August 10, 2014, 09:20:36 pm
content: Quote from: nctnico on August 10, 2014, 09:14:55 pmIt looks like the boards are identical for bandwidth options and even the 1000B and 2000B series boards appear identical.The display module is color on the 2000B series but the Firmware is identical.

author: tautech
author_rank: Super Contributor
timestamp: August 11, 2014, 08:04:15 am
content: QuoteI wonder if any ex-Tek members could contribute by way of PM?

author: KK
author_rank: Regular Contributor
timestamp: August 12, 2014, 03:18:58 am
content: Quote from: tautech on August 10, 2014, 07:36:50 amThanks for that! It helped me fill in some unknown key codes. Notice the Ref/menu button is silkscreened as Power App. On the TPS series scopes that button is labeled Application.We should be able to activate the power application in these scopes as the code is all there. Of course, the TPS has battery operation so doing some of the measurements would require an isolation transformer on the TDS non-battery operated models.KeycodesBezel 1-43A3C06080A0C Probe check04 Print12 Autorange14 Ref/menu - Power App16 Save/Recall18 Utility1A Measure1C Cursor20 Acquire2C Display2E Help30 Default Setup44 Autoset46 Single Seq48 Run/stop4A Trigger Menu58 Set to 50%5A Force Trigger5C Trigger ViewKnobs08 General purpose09 Ch1 Pos0A Ch2 Pos0B Ch1 Volts0C Ch2 Volts0D Horz0E Horz POS0F Trigger Level

author: tautech
author_rank: Super Contributor
timestamp: August 12, 2014, 04:45:26 am
content: How are the key codes derived from Ch1 Volts, Ch2 Volts, and Horz ?I realize all other buttons/knobs can be pushed, but these 3 can only be rotated L or R.

author: KK
author_rank: Regular Contributor
timestamp: August 12, 2014, 07:59:21 am
content: The key codes come in through a memory mapped register at:0x000A8A04The button id is the value listed or +1 if held. That's why the button ID's are spaced by 2.I should have been clear on the knobs, they are individually memory mapped.The base address is:0x000A8Axx (where xx is the code for the knob)#$FF is stored in that location if the knob is turned to the right#$01 if turned to the leftMight be modified by 1 if (+/-) if pushed and 2 if held. But haven't confirmed that.I don't actually have the key codes for knob presses, but I likely don't care. What I wanted to derive is the Autoset button which your picture helped me get.I need to look in the disassembly where the two key codes #$44 and #$46 are checked because that is how you get into service mode. I expect the code to get into Engineering to be very close to that.The Peek/Poke utility in Service mode is crippled. Peek works, but Poke does not allow writes. Looking in the disassembly there is some way to make Poke work and it gives a warning about "Write enabled, use caution". If you try to use poke, it says "Denied".If I can get into Poke then I could conceivable set the bandwidth flag to give 200mhz bandwidth for that powered session. Not ideal, but it would help speed along where to patch the firmware if I end up going that route.This is one of those projects, where the target is zero'd in on slowly every day or two, with some leaps and then bingo.

author: EduardoLM
author_rank: Contributor
timestamp: October 13, 2015, 05:03:19 pm
content: Sorry to revive this old thread, but I just found it, it's VERY interesting, and I would love to see this puzzle solved. Did you have any progress KK?I own a TDS1001C-30EDU, perhaps the most crippled one on the TDS series: only 30MHz. I can open, take pictures of it and / or make tests to help you on this mission!Hope to hear from you, thanks!Eduardo

author: KK
author_rank: Regular Contributor
timestamp: October 21, 2015, 11:42:25 pm
content: Can't say I made any more progress as other projects caught my attention, but would like to revisit one day for fun as the 68000 CPU is one of my favorites.

author: dav
author_rank: Regular Contributor
timestamp: May 15, 2016, 10:10:19 am
content: If you should find how to entering the engineering mode, please post it on the forum!

author: harm
author_rank: Contributor
timestamp: November 28, 2016, 08:40:57 am
content: Hi,Any more news for TDS1000-2000 series hacks?I've a TDS1002 scope with broken (monochrome) display. I want to replace/install color display. Will it work without 'hacking' the TDS1002 scope to TDS2002 and only wire the color display the right way (18pin mainboard to 15-pin display connector)?Anyone done this before?

author: tautech
author_rank: Super Contributor
timestamp: July 16, 2017, 05:40:30 am
content: Quote from: dav on May 15, 2016, 10:10:19 amIn this new thread:https://www.eevblog.com/forum/testgear/tds-1000-2000-3000-bw-hack/

author: braikin
author_rank: Newbie
timestamp: March 01, 2018, 02:58:54 am
content: The process in that thread didn't work for me (TDS2004B), but I was inspired to try looking at the firmware myself. Here's some of what I found, that might help people still stumbling upon this thread.1. The model id is stored at the end Flash ROM along side the calibration data. Here's a bit of python which would patch the ROM if you're willing to desolder and re-program it. Based on observations others have made about the hardware, and the way the code branches based on model number, this will probably work. I used a TL866 to read the rom, but haven't tried programming (see #2).with open('ROM.BIN', 'rb+') as patchedfw:# Model IDs## 0x0B = TDS2022B# 0x0C = TDS2024B# 0x0D = TDS2002B# 0x0E = TDS2012B# 0x0F = TDS2014B# 0x10 = TDS2022B 1GS/s# 0x11 = TDS1002B# 0x12 = TDS1012B# 0x13 = TDS1001B# 0x14 = TDS2004Bpatchedfw.seek(0x7f0007)# Update model per list above.patchedfw.write(bytearray())# Update Checksumpatchedfw.seek(0x7f0004)data = patchedfw.read(0x9f2)bytes = [ord(b) for b in data]csum = pack(">I", sum(bytes))patchedfw.seek(0x7f0000)patchedfw.write(bytearray(csum))The address references above are the physical addresses in ROM. They're mapped differently by FPGA in firmware. If you want to peek/poke from service menu, nvram starts at 0x002f0000.2. Looking at the code, upgrading from any sample rate to another (e.g. 1GS/s to 2GS/s) will definitely result in an uncalibrated scope. Address 0x42b340 is start method which loads cal data. The very first branch in the method matches 2GS/s models and expects the cal data to be a few bytes longer.I don't have the capability to fix cal, so I'll probably abandon further research like finding a way to do this which doesn't require ROM removed.

author: braikin
author_rank: Newbie
timestamp: March 03, 2018, 12:11:49 am
content: Cal issue is resolved, I'll patch my ROM. If I don't break anything soldering, I'll report back what happens in a couple days.Cal data was organized into blocks. I had a thought autocal probably manages some of these blocks too:[factory addr=0x7f0000 sz=2546 csum=0x48242,spc addr=0x7d652c sz=1564 csum=0x1bc53,trig_fpc addr=0x7d0000 sz=396 csum=0x11750,fiso_fpc addr=0x7d01c2 sz=11088 csum=0x15232b,fiso_fpc_peak_detect_5US addr=0x7c0000 sz=11088 csum=0x14bae7,fiso_fpc_peak_detect_10US addr=0x7c2b8e sz=11088 csum=0x16344a,fiso_fpc_peak_detect_25US addr=0x7c571c sz=11088 csum=0x158a91,fiso_fpc_peak_detect_50US addr=0x7c82aa sz=11088 csum=0x160cb1,fiso_fpc_peak_detect_100US addr=0x7cae38 sz=11088 csum=0x15a601,fiso_ch1_sample_offset addr=0x7d3d54 sz=2673 csum=0x1e307,fiso_ch2_sample_offset addr=0x7d493e sz=2673 csum=0x105c,fiso_ch1_pkdet_offset addr=0x7d2d50 sz=1980 csum=0x3d7d1,fiso_ch2_pkdet_offset addr=0x7d3552 sz=1980 csum=0x325,fiso_ch1_pkdet_lkup_corr addr=0x7d5528 sz=1980 csum=0x3dc38,fiso_ch2_pkdet_lkup_corr addr=0x7d5d2a sz=1980 csum=0x3d71a,trig_fpc_2 addr=0x7e0000 sz=396 csum=0x12bd9,fiso_fpc_2 addr=0x7e01c2 sz=11088 csum=0x129b8a,fiso_fpc_2_peak_detect_5US addr=0x7d6d60 sz=11088 csum=0x132c93,fiso_fpc_2_peak_detect_10US addr=0x7d98ee sz=11088 csum=0x13408d,fiso_fpc_2_peak_detect_25US addr=0x7dc47c sz=11088 csum=0x132590,fiso_fpc_2_peak_detect_50US addr=0x7e6590 sz=11088 csum=0x1307bf,fiso_fpc_2_peak_detect_100US addr=0x7e911e sz=11088 csum=0x12e5b2,fiso_ch3_sample_offset addr=0x7e3d54 sz=2673 csum=0x47bef,fiso_ch4_sample_offset addr=0x7e493e sz=2673 csum=0xf97,fiso_ch3_pkdet_offset addr=0x7e2d50 sz=1980 csum=0x9e6d,fiso_ch4_pkdet_offset addr=0x7e3552 sz=1980 csum=0x184af,fiso_ch3_pkdet_lkup_corr addr=0x7e5528 sz=1980 csum=0x3d78f,fiso_ch4_pkdet_lkup_corr addr=0x7e5d2a sz=1980 csum=0x3f20e]The 4 sections who's size change when upgrading to 2GS/s are `fiso_ch?_sample_offset`. I did an auto cal, and observed checksum changed for those.

author: braikin
author_rank: Newbie
timestamp: March 03, 2018, 10:33:32 pm
content: Success!?Software identifies as a TDS2024B everywhere I could think to check. IthinkI see more HF noise. FFT modes at 2GS/s work. 2.5ns/div works. If there's a test you'd like me to try, and I have the equipment, I don't mind giving it a try.Obviously desoldering the the ROM isn't the easiest solution, but if you'd like to try it:Update to the latest firmware. V22.16. This may not be required, but this is the version I reverse engineered. Earlier firmware may or may not work.Desolder the ROM, dump its contents to a binary file.Keep a backup of the ROM file. If something goes wrong, you can only restore your unit to old firmware if you have a copy.Download the attached patch.py.If you're patching a 2ch model, change rom.write(bytearray()) to rom.write(bytearray()).Don't try to patch to an impossible configuration. You'll be left with a brick and required remove ROM and retry. Don't use a model with a different number of channels, don't user a model with a color display if you have black-white. If you make a mistake, the scope won't boot.Use patch.py to update your firmware, then reprogram.When you boot up the first time, Auto Calibration self test will fail. This isn't a problem. Just Auto Cal the scope, then cycle power.You're done.Tips:Save a backup of old ROM, so you can rollback if needed.Three LEDs in upper left should light up as soon as you power on scope. If they don't maybe ROM isn't soldered well.If you've flashed an incompatible model number, you'll get stuck at the 3 LEDs.

author: braikin
author_rank: Newbie
timestamp: March 04, 2018, 12:51:13 am
content: Last update... unless I find out more. I'm trying to measure rise times to confirm 200mhz. Generously, the best rise times i'm seeing are > 3ns implying < 100mhz.Changing the Product ID doesn't seem to have increased bandwidth but did seem to enable 2GS/s. Maybe there's a small hardware difference in frontend, but that's beyond my skill to figure out. Also, the `factory` section of cal which contains stuff like: model id, serial number, etc, is about 2.5 kbytes. There may be other values that need manipulation. I'll poke around firmware a little more.

author: braikin
author_rank: Newbie
timestamp: March 05, 2018, 02:51:22 am
content: According to the service manual models are required to be calibrated with a sine wave matching their respective bandwidth. Upgrading software doesn't change the fact the hardware is still calibrated to -3db @ 60mhz? Effectively cal data is limiting bandwidth? Seems like tinhead implied this early in the thread?What the software change did do: my scope now expects a 200mhz signal during cal. So, I guess the next step is to recalibrate (if that were possible).If I can get a crude signal source I may try out of curiosity. Calibration is reversible as long as my NVRAM survives another desoldering.

author: texaspyro
author_rank: Super Contributor
timestamp: March 05, 2018, 03:17:34 am
content: Quote from: braikin on March 05, 2018, 02:51:22 amGeeeeeez, put it in a socket!

author: braikin
author_rank: Newbie
timestamp: March 14, 2018, 02:08:59 am
content: Success!I'm now seeing rise times ~2ns which is consistent with 200mhz.Attached is an updated python script to patch more data in NVRAM cal section. This script should work correctly with 2 and 4 channel color models upgrading them to 200mhz 2GS/s. Upgrading non-color models is possible, but not all the way to 200mhz. See my previous post for instructions just use this script instead (and there's no need to edit it).Basically some of the bytes in factory cal section are used to program a low pass filter of some sort. It looks like They're calibrated to get a consistent attenuation across all channels and vertical scales. Instead I just set the filter to max. So... I may get more inconsistency between channels and vert scales, but it works. I think a full cal would be better but after a couple days on ebay I can't find an affordable way to do that.If you're interested; the function `cal_bwl_setup` is defined in FW at addr 0x437230. This function programs the LPF between 20mhz and full bandwidth. The values it writes to the LPF are stored in the factory cal section. Bigger values = more bandwidth. My patch sets them to 0x0f which is the largest allowed value for 200mhz. There's on value per channel and vert scale; and like a say above they vary slightly. My scope probably performs a little less consistent.Good to bring some life back to my old scope! I hope I don't find anymore issues. Digging any further into what the calibration bytes to would be tough.I feel like I'm talking to myself in an 5 year old thread. If you're interested in how this applies to non-color models, or you have some tests I should try... feel free to let me know.

author: Argiros
author_rank: Contributor
timestamp: April 29, 2018, 09:42:54 pm
content: I am glad that you made it! Maybe I give it a try later.I want to say that I make a BW model to a color. I figure out the pinouts and after many search I finaly did it. I saw the red the cyan all the colors.Unfortunately my color lcd had two spots it came with that and I put again my b/w lcd. But I finaly did it. I ordered a new color lcd and finaly i will have a color model!

author: braiden
author_rank: Newbie
timestamp: May 01, 2018, 01:36:52 pm
content: Wow, nice work making the color display work!Its good to know your scope works after the upgrade. It means what I've done here should work for b/w models too. I wasn't sure it would, when I accidentally programmed a model id with a channel count mismatch i got a brick. Sounds like display mismatch is more forgiving.I still haven't been able to find affordable hardware to do a cal, but I did pick up a 500mhz freq synthesizer. Results are: frequency response is not as flat as i'd like. Everything's good through the original 60mhz. After that the sin wave amplitude creeps up (as high as 125%) before coming back to 100% at 350mhz and dropping off pretty sharply after that.If there's interest in what you'll get with the hack I can draw a bode plot. With caveats: I assume my signal source is level (spec is +/- 0.5db). I'm using cheap cabling and termination, maybe that's adding some induction(?).I'd like to play with the attenuation setting in cal more, but the socket i got for rom doesn't fit.

author: braikin
author_rank: Newbie
timestamp: May 15, 2018, 01:07:03 am
content: For what its worth, here's a plot of a nominally 3 VPP sin wave from 1-499mhz. Different test setups result in very different results. I'm using the stock P2220 probe with a BNC tip adapter plugged into a 50passthru terminator connected directly to signal source output.

author: oaba
author_rank: Contributor
timestamp: July 19, 2018, 02:42:16 pm
content: I have an TDS2002. I got the firmware out of flash Am19DL162 . How can I find the model numbers?Hence the different firmware and flash size. Or dou you have firmwares to compare?Thanks in advance.

author: braiden
author_rank: Newbie
timestamp: July 19, 2018, 02:56:59 pm
content: I've only looked at TDS2002B, not the TDS2002 which may be totally different? If you're looking at a non-B model, there is this thread:https://www.eevblog.com/forum/testgear/tds-1000-2000-3000-bw-hack/If its a "B" model, the model id is at 0x7f0007 in the physical ROM dump, and you should expect to find 0x0D corresponding to TDS2002B. Other model numbers are documented in patch_tds1k2kb_rom.py.txt linked above.Within the "B" series there are no firmware differences between modules, they all run the same binary, the only relevant difference is the model and calibration data stored at the end of ROM, 0x7f0000 and 2546 bytes long.

author: vanbac
author_rank: Newbie
timestamp: August 20, 2018, 07:48:23 am
content: Quote from: Argiros on April 29, 2018, 09:42:54 pmhello you.modele: Tds1012b mono.I see you've made a successful switch form screen color can you give me detailed instructions how to do thank you

author: clodnut
author_rank: Newbie
timestamp: September 05, 2018, 06:36:29 pm
content: Thanks for your work on this, braikin.Your efforts have given my aged TDS1001B (Mono, 2 Ch, 40 MHz, 500 MS/s) a new lease of life as a 100 MHz TDS1012B.5 ns/division scaling has become available and FFT mode confirms 1 GS/s acquisition.I tweaked your Python code to handle model ID 0x13 -> 0x12 for the TDS1000B series. Your approach of clearing the LPF settings seems to work for the TDS1000B-series, whose max. bandwith is 100 MHz rather than 200 MHz like the TDS20xxBs.I don't have the kit to measure the new bandwidth properly but the stock probe and a Rasberry Pi outputting a square(ish) wave gives a 2.12 ns rise time, suggesting comfortably over 100 MHz bandwidth.The calibration seems fine by eye (no weird offsets or dodgy scaling cycling through various ranges) but, again, I'm not set up to do a full cal.Thanks again!

author: vanbac
author_rank: Newbie
timestamp: September 09, 2018, 01:56:33 am
content: hello clodnut.Congratulations you've successfully upgraded can you guide me the steps to upgrade on YouTube thank you very much.

author: DogP
author_rank: Regular Contributor
timestamp: October 25, 2018, 09:30:07 am
content: Quote from: tautech on July 16, 2017, 05:40:30 amI didn't see engineering mode in that thread... did I miss it? In the case of the TDS 3000, the TDS3ENG hack is totally different, as it unlocks the available modules. The TDS 1000s and 2000s didn't have those modules, and instead "Engineering Mode" looks to be an option in the menu (similar to Service Mode).Any further progress on any TDS 1K/2K stuff? I used to have one of these on my desk at work, and I just bought a 2024B for home. Not the best scope I've ever used, but nice and doesn't take up a lot of bench space... and the deal was too good to pass up. Since it's already the highest freq/sample rate 2024B, I guess there's no possible "upgrade".I sifted through the firmware binary, and it looks like there are still some interesting mysteries to unlock. Maybe not all of them are important - engineering mode (doesn't look that interesting), the code to enable memory pokes from service mode (again, probably not very useful)... but how about the section with "A:\PAUL", "\GEORGE", "\RINGO", "\JOHN", and "A:\POLLY\LITHIUM". If I create one of those directories does it load up an XY plot of a Beatles or Nirvana album?DogP

author: bootboot
author_rank: Newbie
timestamp: November 06, 2018, 09:45:12 am
content: Hi! Can you share me the backup ROM file?My TDS2022B Can not bootup, it dead at 3 LEDs light.

author: vanbac
author_rank: Newbie
timestamp: December 07, 2018, 02:43:28 pm
content: Hello please help me I want to upgrade the bandwidth but I read data of ROM thank you.

author: clodnut
author_rank: Newbie
timestamp: December 08, 2018, 08:23:06 pm
content: U902 is not the firmware flash -- it's just an I2C EEPROM, apparently containing the boot code for the USB controller (according to thisearlier post).You will need to remove the S29JL064H flash memory chip, typically designated U801.It's the one pictured inthis postearlier in this thread. It's the chip with the label in the top left of the board shown inthis post.Then you need to read the chip, patch it using braikin's Python script and re-solder it into the scope.Good luck!

author: vanbac
author_rank: Newbie
timestamp: December 10, 2018, 04:24:01 pm
content: Thank you for the tutorial, please wait my results.

author: vanbac
author_rank: Newbie
timestamp: January 04, 2019, 06:58:32 am
content: thanks "clodnut" very much, i have upgraded the bandwidth, this is my model.

author: CaptDon
author_rank: Super Contributor
timestamp: May 10, 2020, 06:49:32 pm
content: How would I run the .py script to program the flash device. I have an assortmentof programmers, but none would understand a .py script. It seems I need to unsolderthe flash rom device and insert into a programmer, I am o.k. that far, then what??

author: clodnut
author_rank: Newbie
timestamp: May 23, 2020, 07:41:59 pm
content: Hi CaptDon,Per my earlier message in this thread - you:Remove the chipRead it in a programmer (using whatever software is appropriate for your programmer) and save the firmware image somewhereUse the Python script to patch the imageWrite the altered image back to the chipReinstall the chip.Good luck!

author: prafullshah61
author_rank: Newbie
timestamp: July 11, 2020, 09:56:28 am
content: Can any one help me to solve this issue?I have Tektronix TDS2014BIts shows " USB Controller Failed" ( ID NUM 17 USB Diagnostic Failed) when power up Self test.Some time boot normally ,& some time not booting just black screen appear.

author: tautech
author_rank: Super Contributor
timestamp: July 11, 2020, 09:13:41 pm
content: Quote from: prafullshah61 on July 11, 2020, 09:56:28 amWelcome to the forum.IIRC this is what happened to my TDS2012B.Investigation found corrosion on 1 pin of a 100 pin IC which I determined originated from a spec of debris landing on the edge of the IC as a result of the top case venting of these models that allows debris to fall into the workings of the scope.In this case the pin looked OK but when carefully scratching the black spot away with a fine scalpel found the pin was corroded through. A very difficult repair that I have attempted a few time without success.Yours might be easier to fix IDK.

author: bootboot
author_rank: Newbie
timestamp: September 06, 2020, 03:26:59 am
content: Hi,prafullshah61What's the state of the LEDs on the front when your TDS2014B can not boot normally?My TDS2022B can not bootup with black screen,3 LED light on,and the Probe's frequency is 5KHz.I have checked the USB Controller chip(cy7c67300)'s bus and found the Add/Data works well

author: amindavid11
author_rank: Contributor
timestamp: September 07, 2020, 06:45:55 pm
content: Which IC should I desolder for the hack on the TDS2002B, I am a complete noob on this kind of things... what is the cheapest programmer that would get the job done?

author: biju
author_rank: Newbie
timestamp: September 16, 2020, 09:42:00 am
content: some voltage level IN OK MOTHERBOARD ( Multimeter Used Fluke 179 True RMS)

author: biju
author_rank: Newbie
timestamp: September 16, 2020, 09:50:31 am
content: USB CONTROLLED FAILED show in display PLz check CY7c67300 IC VCC Voltage & FS12.00P

author: bootboot
author_rank: Newbie
timestamp: September 19, 2020, 02:21:37 pm
content: My TDS2022B has different PCB.No U616 between the MC68000 and the FLASH .

author: 66bono
author_rank: Contributor
timestamp: February 14, 2021, 10:29:47 am
content: HelloI have a TDS1001B, I would like to increase its parameters, can I ask for help.I am in satan to read flash I do not know how to use the patch. After changing the bend, could he use signal expres software.Thank you

author: Boroda4
author_rank: Newbie
timestamp: June 02, 2021, 06:32:43 pm
content: HelloAre you read all NOR flash?I can`t use latest version of script, and apply previos version on Win10. I edit version in script, place bin near script with ROM.BIN name and apply script. After applying i compare old and new bin in WinHex to shure of changes in shown addresses.

author: Boroda4
author_rank: Newbie
timestamp: June 02, 2021, 07:05:52 pm
content: Hello to all!Have sombody full dumps of any versions of Tek TDS1000 AND TDS2000? I need both of them.I have both of this Tek (1001B working and 2014C not working with broken Altera) and i think so my programmer TL866 was burned NOR flash chips.AND! I was read Altera config from 1001B via USB blaster from Ali and Quartis II! (Attached, rename type if file to .pof)In my broken 2014C was burned Altera and USB hub. I replace both of them with new, programmed Altera with copy of one from 1001B. I don`t now what differents between Altera from 1000 and 2000, but both of them have one number on sticker. If stickers identical then config may be identical, i think.

author: Silicium81
author_rank: Regular Contributor
timestamp: March 22, 2022, 07:22:34 pm
content: Thank's for the méthod to hack TDS2000BI succeeded with the script to hack a TDS1001C-EDU (40MHz) to a TDS2022B (200MHz)!I unsoldered the flash rom, read then reprogrammed with the content modified with the script. I slightly adapted it to recognize the identifier of the TDS1001C-EDU (0x28).In pj, the modify script

author: @_Lis
author_rank: Contributor
timestamp: June 04, 2022, 05:30:45 am
content: Silicium81,Share the firmware flash S29JL064H90TF100 from TDS1001C-EDU, please?

author: Silicium81
author_rank: Regular Contributor
timestamp: June 05, 2022, 01:43:17 pm
content: See here:https://www.eevblog.com/forum/repair/bad-firmware-installed-in-tds1001c-edu/msg4052302/#msg4052302Or inhttp://www.ko4bb.com/search TDS1001C

author: @_Lis
author_rank: Contributor
timestamp: June 05, 2022, 02:45:38 pm
content: Silicium81,Thank you very much!Best regards!

author: @_Lis
author_rank: Contributor
timestamp: June 07, 2022, 04:12:55 am
content: I had TDS1002C 1002 C-EDU (60 MHz 1GS/s) turning on with a white screen and not booting after incorrect update firmware via USBhttps://www.eevblog.com/forum/repair/tektronix-tds1002c-doesnt-boot/msg890380/#msg890380After flashhttp://www.ko4bb.com/manuals/5.166.55.99/Tektronix_TDS1001C-EDU_scope_40MHz_EPROM_V25.07.BIN.zipthe oscilloscope started to turn on, but TDS 1001C-EDU writes on the screen with a frequency of 40MHz, the serial number has changed.Update firmware from the official website TDS1KC-EDU_V25.11_066123303 did not help, the frequency is still 40 MHzPlease help to restore.Thank you in advance.Sorry for the English:(

author: @_Lis
author_rank: Contributor
timestamp: June 08, 2022, 02:55:40 pm
content: Problem solved, thanksSilicium81

author: mophong
author_rank: Newbie
timestamp: July 15, 2022, 10:15:32 am
content: Hi friends,After changing model, as I can see bandwidth was improved, how about sampling rate? Let's say we change from TDS2002B to TDS2022B, does the sampling rate really change to 2 GS/s?Thanks.

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: September 01, 2022, 05:27:23 pm
content: hii have no easy access to doing patch using python. Instead i can do manually. i have removed flash from TDS2002B, read it on programmer. located the are in data buffer where bits needs to be modified.i need help in locating the address where in Checksum has to be updated and Filter Confing needs be changed. how to manually calculate checksum for upgrading to TDS 2022B. screenshot of programmer data buffer attachedthanks in advance for your support

author: BG9ICN
author_rank: Newbie
timestamp: September 07, 2022, 04:03:19 pm
content: I think you get some ERROES at that patch.pyWhen use python3, you will fail.Try to use this patch fixed in python3 enviroment.

author: BG9ICN
author_rank: Newbie
timestamp: September 07, 2022, 04:42:00 pm
content: Or you really can't use python, this is way to fix the BIN file.Change the model at B , It should be 0B when you want tds2022b.and change marked vaule form something to ‘0F’ in C and D.At last, calculate how many changed you have do. For example, in B, '0E' > '0B' , that's minus 3, and there are 20 '08'>'0F' ,total add 8C, so the change is 8C-3 = 89, Then add 89 at A.

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: September 08, 2022, 02:27:42 pm
content: himyself is Novice when it come to programming. Here is what i didi had read flash, manually changed buffer with product id from 0x0D to 0x0B at 0xf0007and changed the checksum binary from 0x07 to 0x05 (Difference between 0x0D and 0x0B is "0x2) at 0x7f0000didn't alter any other data relating to Filters etc. so the only data altered is the product IDon resoldering the scope doesn't boot. green led remains lit, screen is blank. rechecked my soldering. no loose or shorts etccan you please advise where i am going wrong. Unfortunately i am not good at programming so instead did manually what script was supposed to do.kind regardsVishal

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: September 08, 2022, 02:35:29 pm
content: hiattached is the picture of before and after data buffer of flash ROM

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: September 08, 2022, 02:59:12 pm
content: thanks for the explanation with example. I think i changed checksum at wrong address.few question1. as per python script the checksum was supposed to be at 0x7f0000. However the "A" is at different address2. Position "A" in your example has data 0x28AC3. so it as per the example it will now be 0x2935so in my case i am just changing the product id from 0x0D to 0x0B. The difference is 2. so 200A now will be 2008is my understanding correct. I have 3 Ghz Rigol Sig Gen. Will try to do fresh cal after upgrade. that is why i am not changing the cal data

author: BG9ICN
author_rank: Newbie
timestamp: September 08, 2022, 05:31:04 pm
content: 7F0000H is right. The completed checksum is '00 07 28 AC' in this example. The marked zone is just data changed.And 08>0F is for operate the LPF, it's different from cal data.

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: September 09, 2022, 07:24:41 am
content: HIMany thanks for your explanation.I will try this out and will let you know if i succeed

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: September 10, 2022, 05:51:17 am
content: unfortunately this didn't work for me. scope doesnt boot.i had verified the data buffer twice before programming. no issues with solderingproduct id programmed is 0x0B (for TDS2022B).if for some reason the checsum isn't correct, will the scope boot?

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: September 10, 2022, 05:55:21 am
content: pics of soldering Flash after re programming

author: DogP
author_rank: Regular Contributor
timestamp: September 11, 2022, 05:25:26 am
content: I haven't personally done a firmware upgrade (mine is already a 2024B), so I don't have any personal experience... but looking at the picture, the soldering on pin 2 in particular looks suspect. The pad of pin 1 and/or pin 2 looks like it might be lifted as well (or maybe it's just the solder that makes it look crooked).I guess you could try removing the chip again, reflashing to the stock, and making sure it still works... though of course the pins and pads are delicate, so I'd only try that if you think they're in good enough shape to hold up to the extra soldering cycles.DogP

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: September 12, 2022, 03:58:08 am
content: hi,i did noticed that, and did some touching with no success.i could see some waveforms on it when probed with another scope, which means some bus activity happened in the past.neverthess will check again. the two pins are from address bus. if there is activity on these, it means they are connected

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: September 12, 2022, 07:03:14 am
content: checked with DMM, these are not shorted.just after power on, there is a bus activity on these for few seconds.this means they are connected and main processor is accessing active.something else is not correct.Will give a last attempt of removing rom. Else there is a possibility of loosing some pads thus making board of no use

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: September 12, 2022, 04:43:08 pm
content: hias per python scirpt, there are two different ID for TDS 2022B0x0D and 0x10what is the difference between two?

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: September 13, 2022, 02:07:37 pm
content: i noticed Firmware version is 22.01 .could that be the reason for the hack not working

author: BG9ICN
author_rank: Newbie
timestamp: September 15, 2022, 03:59:29 pm
content: Try to flash back the read-out version.And check what did you changed. If you change another block, system doesn't startup.Two TDS2022, one is 1GSa/s, the other is 2GSa/s.

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: September 16, 2022, 01:49:00 pm
content: i flashed back the original FW and re soldered. its still not booting.there is activity on data bus for few seconds and then it gives up. further the probe compensation signal is at 5 Khz.it seems either the flash is faulty or it was not properly read during the first instance. Though, before saving the original ROM, i ready it for 3 to 4 times. Every time check sum was same.Also noticed that when i remove the flash from board and try to compare it with image ( i copied into) there is a small variation in the check sum between flash contents and image file. it seems that some content changed either by scope or due to faulty flash.had checked with another working unit. There is no signal if flash is missing. soon after power up, it is at 5Khz, then as it boots up, it changes on to finally at 1Khz. as per service manual 1 Khz means booting is okay.now need to get a confirmed working flash from another scope to troubleshoot further.

author: Fieroluke
author_rank: Contributor
timestamp: September 18, 2022, 06:38:57 pm
content: You could get the bin file fromhttp://www.ko4bb.com/(search TDS1001C) and see if that works?Sounds like your flash is damaged or the initial readout failed? Using the file from KO4BB might help…

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: September 19, 2022, 06:29:58 am
content: thanks but i need file for 2 channel B modelC model file may not work

author: Fieroluke
author_rank: Contributor
timestamp: September 28, 2022, 04:24:12 pm
content: I report success changing a TDS2001C (50 MHZ / 500Ms/s) to TDS2022B (200 MHz/2 Gs/s)!The firmware installed was v24.09. The board seemed the same, Flash was also 8M Spansion S29JL064H so I bit the bullet. The model ID is 0x1D, same address 0x7F0007.Since I’m not a Python person I patched directly in the EPROM editor. Filters also started at 0xF700B6, all 05’s in the first block, 05’s and 06’s in second block. Changed them to 0x0F.Checksum is 0x7F0004 to 7F09F9. My programmer (Galep5) could calculate that, so I transferred the new checksum to 0x7F0000.First boot took longer than usual and I thought I killed the board, but then the boot screen reported as 2022B with self cal failure. Self calibrated, and viola: personality change! Strangely the firmware now identifies as v24.26, even though it’s 24.09 that I changed. I don’t know how Tek calculates revision numbers.But bandwith reports 200 MHz, timebase goes down to 2.5 ns. Don’t know where else to check, but it seems to be working!P.S.: Maybe someone wants to update the python script…

author: Fieroluke
author_rank: Contributor
timestamp: September 29, 2022, 06:25:01 pm
content: Interesting information:Tek says the difference between the B and C serieshttps://www.tek.com/-/media/documents/faq6520.pdfis basically a bit more bandwidth for the low end models, a better TFT and a few more Measure and Utility entries, RMS, duty cycle and others.After setting the model code to TDS2022B the big question is: does the scope still have the C-series firmware’s features?The answer is YES, the measure menu now contains all the new entries! So (not owning a 2022B model) apparently v22.16 seems to be the latest firmware for the 2022B, but changing a 2001C to 2022B takes it to v24.26! So maybe Tek just blocked the firmware from loading on older hardware?! Maybe just setting the 2022B’s model code to 0x1D will let you update to v24.09, and then resetting the model code magically transforms the v24.09 to v24.26…?And ideally if we knew the model code for the TDS2022C (probably between 0x15 and 0x27), we could change any 2000c model directly to 2022c…

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: October 04, 2022, 01:22:19 pm
content: hi,this is really interesting to note.there is a hardware difference between B and C series. B series display is CCFL type and C is of LED type. Apart from this C series has a small interface board (with FPGA and led driver) between display and connector on motherboard and actual display.i had once tried to use connect LED display from C series (along with interface board) to B series but it doesnt work. which means the data data from motherboard is different.so i wonder how come the updated b series is now able to drive a LED board? or this could also mean there was a revision in board for B (supporting LED display) as well and the new FW supports B series models as wellfor my board i need a bin file of 2 channel B series model

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: October 04, 2022, 01:30:03 pm
content: just to add here.the fw file have an extension *.tekC series FW file should not work unless it is renamed and "C"at the end is replaced by "B"i did an experiment today. for a C model used a FW file of B model (after replacing C with B)at the end scope said fw update done, press ok. the screen went blank and the scope got bricked.fortunately i have a kept a copy of original ROM to restore it back

author: Fieroluke
author_rank: Contributor
timestamp: October 04, 2022, 02:37:05 pm
content: Don't use the *.TEK files, they don't work. I'm sure they have a block in there.Unsolder your Flash, read it, and modify it by running the Python script (or manually like I did), then solder it back.That way it's YOUR firmware, just a different model ID in the firmware.Apparently the firmware uses the same base software, which switches features based on model ID, and maybe a driver portion, that is custom to the B and C series.Impossible to know without comparing firmwares. Anyway, modifying this ID byte in YOUR SCOPE's firmware removes the limitations in the base firmware and also changes the model ID string associated with it, but keeps the drivers for the ModelB or C series. That would explain it.This is a list from inside the C-Firmware that lists all supported models I guess (I don't know what the -SC models are (school = EDU?)):TDS2002B 0x0DTDS2012B 0x0ETDS2022B 0x0BTDS2004B 0x14TDS2014B 0x0FTDS2024B 0x0CTDS2022B_1G 0x10TDS1001B 0x13TDS1002B 0x11TDS1012B 0x12TDS1001B-SC 0x15TDS1002B-SC 0x16TDS1012B-SC 0x17TDS2002C 0x1ATDS2012C 0x1BTDS2022C 0x18TDS2001C 0x1DTDS2004C 0x1ETDS2014C 0x1CTDS2024C 0x19TDS1001C-SC 0x1FTDS1002C-SC 0x20TDS1012C-SC 0x21Note there’s no apparent order in this list. Ordering by known IDs it seems the “full” version 2024B starts the list, then the most limited 50 MHz 2002B, then 100MHz 2012B, 2014B, next sample limited 200MHz 2022B. Next up are the monochrome versions, but in random order. And at the end of the list come the C models.It looks like the order was determined by chronological order and marketing department, lol.[edited: updated model IDs according to my findings later in this thread]

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: October 12, 2022, 05:12:33 am
content: sucess finally.i used a stock fw from C series 4 channel and replaced the cal data from my original unit.The unit now boots up with model TDS2022B, shows 16 measurements as stated in C model and now supports led type display from C model.Thanks everyone for support

author: Fieroluke
author_rank: Contributor
timestamp: October 12, 2022, 06:33:59 am
content: Awesome news, congratulations!

author: Fieroluke
author_rank: Contributor
timestamp: February 10, 2023, 05:00:17 pm
content: I dug a little deeper into my dumped ROM and I think I deciphered the model code list. The relevant code starts at ROM-Offset 0x30C9FA / address $50C9FA:(this is disassembled by hand, but you get the idea. Use the info below at your own risk!)Code:.org $50C9FA4E56 0000link A6,#0 ;set up stack frame2F0Amove.l A3,-(SP) ;save A3246E 0008move.l A4,8(A6) ;pass parameter to get device ID6100 02F8bsr$2F8(PC);get device ID $50CCFE: CAL_get_instrument_config()72F5moveq.l #$F5,D1;-0x0BD081add.l D1,D0;subtract offset for first ID code7216moveq.l #$16,D1;index 22 is last entry in tableB280cmp.l D1,D0;check overflow6500 0100bcs $100(PC);branch on errorD080add.l D0,D0;double D0 for table index, because we're addressing words303B 0806move.w 6(D0,PC),D0;get jump offset word from table4EFB 0002jmp 2(PC,D0);jump to model codeSo, this part gets a jump offset from the jump table immediately following the code. This jump table determines where to continue the code depending on the model ID. 0x0B is the first model ID and is the first table entry:Code:.org $50CA1Edc.w $42 ;$50CA60 - TDS2022B $0Bdc.w $60 ;$50CA7E - TDS2024B $0Cdc.w $2E ;$50CA4C - TDS2002B $0Ddc.w $38 ;$50CA56 - TDS2012B $0Edc.w $56 ;$50CA74 - TDS2014B $0Fdc.w $6A ;$50CA88 - TDS2022B_1G $10dc.w $7C ;$50CA9A - TDS1002B $11dc.w $84 ;$50CAA2 - TDS1012B $12dc.w $74 ;$50CA92 - TDS1001B $13dc.w $4C ;$50CA6A - TDS2004B $14dc.w $8C ;$50CAAA - TDS1001B-SC $15dc.w $94 ;$50CAB2 - TDS1002B-SC $16dc.w $9C ;$50CABA - TDS1012B-SC $17dc.w $B4 ;$50CAD2 - TDS2022C $18dc.w $D4 ;$50CAF2 - TDS2024C $19dc.w $A4 ;$50CAC2 - TDS2002C $1Adc.w $AC ;$50CACA - TDS2012C $1Bdc.w $CC ;$50CAEA - TDS2014C $1Cdc.w $BC ;$50CADA - TDS2001C $1Ddc.w $C4 ;$50CAE2 - TDS2004C $1Edc.w $DC ;$50CAFA - TDS1001C-SC $1Fdc.w $E4 ;$50CB02 - TDS1002C-SC $20dc.w $EC ;$50CB0A - TDS1012C-SC $21So, this jumptable jumps to the following code, which loads the model ID from a nearby string table:Code:.org $50CA4C24BC 0050C916move.l #$050C916,(A2);TDS2002B6000 00C4bra.w $C4(PC).org $50CA5624BC 0050C91Fmove.l #$050C91F,(A2);TDS2012B6000 00BAbra.w $BA(PC).org $50CA6024BC 0050C928move.l #$050C928,(A2);TDS2022B6000 00B0bra.w $B0(PC).org $50CA6A24BC 0050C931move.l #$050C931,(A2);TDS2004B6000 00A6bra.w $A6(PC).org $50CA7424BC 0050C93Amove.l #$050C93A,(A2);TDS2014B6000 009Cbra.w $9C(PC).org $50CA7E24BC 0050C943move.l #$050C943,(A2);TDS2024B6000 0092bra.w $92(PC).org $50CA8824BC 0050C94Cmove.l #$050C94C,(A2);TDS2022B_1G6000 0088bra.w $88(PC).org $50CA9224BC 0050C958move.l #$050C958,(A2);TDS1001B607Ebra.b $7E(PC).org $50CA9A24BC 0050C961move.l #$050C961,(A2);TDS1002B6076bra.b $76(PC).org $50CAA224BC 0050C96Amove.l #$050C96A,(A2);TDS1012B606Ebra.b $6E(PC).org $50CAAA24BC 0050C973move.l #$050C973,(A2);TDS1001B-SC6066bra.b $66(PC).org $50CAB224BC 0050C97Fmove.l #$050C97F,(A2);TDS1002B-SC605Ebra.b $5E(PC).org $50CABA24BC 0050C98Bmove.l #$050C98B,(A2);TDS1012B-SC6056bra.b $56(PC).org $50CAC224BC 0050C997move.l #$050C997,(A2);TDS2002C604Ebra.b $4E(PC).org $50CACA24BC 0050C9A0move.l #$050C9A0,(A2);TDS2012C6046bra.b $46(PC).org $50CAD224BC 0050C9A9move.l #$050C9A9,(A2);TDS2022C603Ebra.b $3E(PC).org $50CADA24BC 0050C9B2move.l #$050C9B2,(A2);TDS2001C6036bra.b $36(PC).org $50CAE224BC 0050C9BBmove.l #$050C9BB,(A2);TDS2004C602Ebra.b $2E(PC).org $50CAEA24BC 0050C9C4move.l #$050C9C4,(A2);TDS2014C6026bra.b $26(PC).org $50CAF224BC 0050C9CDmove.l #$050C9CD,(A2);TDS2024C601Ebra.b $1E(PC).org $50CAFA24BC 0050C9D6move.l #$050C9D6,(A2);TDS1001C-SC6016bra.b $16(PC).org $50CB0224BC 0050C9E2move.l #$050C9E2,(A2);TDS1002C-SC600Ebra.b $0E(PC).org $50CB0A24BC 0050C9EEmove.l #$050C9EE,(A2);TDS1012C-SC6006bra.b $06(PC).org $50CB1224BC 0050C7E9move.l #$050C7E9,(A2);XYZZY (Interesting!)I have added the strings which the address points to as a comment for your convenience. So, now you can happily chance between model IDs. You're welcome!

author: Fieroluke
author_rank: Contributor
timestamp: February 10, 2023, 05:28:07 pm
content: There's an error in the previous post I think.The checksum is from 0x7F0004 to 0x7F09F5. Make sure you select the correct region and your checksum routine calculates the same value that is at 0x7F0000-0x7F0003 before changing the buffer!

author: TheKellerman
author_rank: Contributor
timestamp: February 16, 2023, 04:47:18 pm
content: Hi,Quote from: vishaldotgupta on October 12, 2022, 05:12:33 amBy "stock fw" you mean a flash dump from a working unit, right? And is the "original unit" a TDS2000B series?I got a TDS2014B with (probably) corrupted FW. At least it shows the typically symptoms, meaning the three green LEDs. I already desoldered the flash and read it out.My expectations were to see mostly 0xFF, but there is nothing obviously wrong in there. So maybe an update was interrupted just before the finish line?Is it possible to take the TDS1001C FW from ko4bb.com and put my cal data in there? Or does someone maybe have a readout from a 2000B series unit?

author: Fieroluke
author_rank: Contributor
timestamp: February 24, 2023, 04:02:02 pm
content: Success again!Changed my TDS2001C from TDS2022B (ID $0B) to TDS2022C (ID $18)

author: 66bono
author_rank: Contributor
timestamp: February 24, 2023, 07:37:49 pm
content: @Use the Python script to patch the imageHow do I use the script, paste on USB and update. I have no idea, I made a copy of U 801

author: TheKellerman
author_rank: Contributor
timestamp: February 24, 2023, 09:42:06 pm
content: Install python 2.7. and runCode:python patch2.py rom.binThis worked for me (I haven't tried the updated pxthon3 script). Then write the flash the same way you read it. You cant put the update on a USB stick.Edit:I now see you have a TDS1001B and the patch2.py does not include that in the model check. To which model you want to update your scope?

author: Fieroluke
author_rank: Contributor
timestamp: February 25, 2023, 08:36:21 am
content: If the scope is a TDS1001B it should be model ID $13 at $7F0007.Changing it to $12 should result in a TDS1012B, which should be all that’s possible upgradewise.

author: 66bono
author_rank: Contributor
timestamp: February 25, 2023, 08:40:02 am
content: TDS1001BI read the batch and soldered the S29JL064H70TFI00 again. The oscilloscope works as before.No idea about programmingI wanted to get the highest possible bandwidth.I also experimented with OpenChoice Talker ListenerI established communication, failed to break the oscilloscope

author: Fieroluke
author_rank: Contributor
timestamp: February 25, 2023, 08:50:25 am
content: The pitbull hack doesn’t work with the B-series scopes.Check location 7F0007 of the file you programmed into the firmware. Which value does it have?If the py-script didn’t recognize your scope, the file didn’t get modified and you programmed the original file again.Which model does the startup screen report? (The „set time and date“-screen)

author: 66bono
author_rank: Contributor
timestamp: February 25, 2023, 09:05:39 am
content: I didn't change the original bin file. I just read it with the programmer and soldered the again

author: Fieroluke
author_rank: Contributor
timestamp: February 25, 2023, 11:59:33 am
content: Don’t look for content 7F0007, look at ADDRESS 7F0007! The part on the left (blue) should be 7F0007 or 7F0000.

author: 66bono
author_rank: Contributor
timestamp: February 25, 2023, 12:39:04 pm
content: 7f0007 not found is 7f0008

author: Silicium81
author_rank: Regular Contributor
timestamp: February 25, 2023, 02:36:01 pm
content: Quote from: 66bono on February 25, 2023, 12:39:04 pmthe content of 7f0007 is here:

author: Fieroluke
author_rank: Contributor
timestamp: February 25, 2023, 03:43:31 pm
content: Perfect. 13 (circled red) means it‘s a TDS1001B. Change it to 12 to make it a TDS1012B.00072CC4 is the checksum. If you change 13 to 12 the checksum needs to change to 00072CC3.But you need to change the filter banks too. It‘s described in reply #94 of this thread.Change the 20 filter values to 0F and adjust the checksum accordingly! If you don’t, it won’t work!

author: 66bono
author_rank: Contributor
timestamp: February 26, 2023, 04:27:04 pm
content: Thanks for explanation.I looked for addresses to change. The obscured area is the serial number.13 is the model we change to 12.Filters are 2x 10 (04) I change to 2x 10 (0F)I can't handle the checksum either.

author: Fieroluke
author_rank: Contributor
timestamp: February 26, 2023, 05:12:11 pm
content: Ok, bear with me…You change the model ID from 13 to 12: -1You change 04 to 0F, 20 times: 20 x $0B = $DCTotal change: $DBSo new checksum should be (try at your own risk): $00072CC4 + $DB=> new checksum should be hex 00 07 2D 9F

author: 66bono
author_rank: Contributor
timestamp: February 26, 2023, 06:37:15 pm
content: I changedI have a copy of the original, if something goes wrong, I can restore the original file.Will there be a brick:)

author: Fieroluke
author_rank: Contributor
timestamp: February 26, 2023, 06:54:24 pm
content: Biting my nails now…Please report the outcome!

author: 66bono
author_rank: Contributor
timestamp: February 26, 2023, 06:58:31 pm
content: I'll try tomorrowThank you foryour help.I compared 2 files and only the values marked in red are changed.

author: 66bono
author_rank: Contributor
timestamp: February 27, 2023, 10:05:25 am
content: He started, thank you very much.LVDS 74MHz

author: Fieroluke
author_rank: Contributor
timestamp: February 27, 2023, 10:51:13 am
content: Reporting success on a TDS2004C turned 2024C! Model ID changed from 1E to 19.First I was sceptical, because the Flash was nowhere to be found, but it’s just on the solder side of the PCB and actually easier to remove.For 4 channels there were four filter banks of 10 values each to change from 07 to 0F, other than that, straightforward. Initially reports self cal fails and clock was reset, but after self calibration and setting time and date, boots smooth as silk :-)

author: Yuriy V.
author_rank: Contributor
timestamp: April 15, 2023, 07:30:39 pm
content: Very, very interesting thread!I have Tek TDS1002B & may be I will try to level up it

author: TheKellerman
author_rank: Contributor
timestamp: June 15, 2023, 02:02:29 pm
content: After repairing and upgrading two scopes I want to point out that -SC is not the same as -EDU. The EDU firmware will only boot if the device ID is EDU (0x28 for TDS1001C-EDU or 0x2A for TDS1012C-EDU) or if the ID is a B model (probably same firmware base?). 0x28 and 0x2A are not listed in the firmware that Fieroluke disassembled, so if you update an EDU model with C Model firmware, the scope wont boot. And I assume that the EDU firmware knows only about EDU and B model IDs, not Regular C models.However, you can put the C firmware in a EDU device, desolder the flash, change the ID to a C model and update the CRC. That way I upgraded a TDS1012C-EDU to TDS2022C.Another way would be to keep the EDU firmware and only changing the ID to TDS2022B, but it looks like the C firmware has more features.And to answer my own question from earlier:https://www.eevblog.com/forum/testgear/tektronix-tds1000b-series-hacks/msg4705982/#msg4705982the EDU FW (like the one found on ko4bb.com) will not work on a B model hardware!

author: lern01
author_rank: Regular Contributor
timestamp: October 21, 2023, 10:56:16 am
content: Hi Fieroluke, I have a tds1012c, can I upgrade to 2024c, can you help me? Thank you very much!

author: Fieroluke
author_rank: Contributor
timestamp: October 21, 2023, 11:54:27 am
content: No, you can‘t change 2 to 4 channels.Changing from b/w to color is said to be possible, but I have no experience with that.So, getting a screen and assorted components from a tds2000c series scope may be possible, but probably cheaper to get a working color model for cheap.And for the monochrome TDS1000 series, your TDS1012C seems as high as it can go.

author: lern01
author_rank: Regular Contributor
timestamp: October 23, 2023, 10:08:51 am
content: Sorry, Is it possible to upgrade to TDS2022C?

author: vdetal
author_rank: Newbie
timestamp: October 23, 2023, 09:59:08 pm
content: Works with monochrome display too.Tested on 2 pcs 1001B.

author: phecap
author_rank: Contributor
timestamp: October 24, 2023, 06:33:06 am
content: I have a Tektronix TDS2024B.Does anyone know if it is possible to upgrade this oscilloscope to TDS2024C?Or is this not possible due to the hardware differences?

author: Fieroluke
author_rank: Contributor
timestamp: October 24, 2023, 06:48:17 am
content: That should work. The main difference is the better LCD I think

author: vdetal
author_rank: Newbie
timestamp: October 27, 2023, 10:16:43 pm
content: You can, it's very simple. Download the latest firmware for the C-series from the Tek website. (this is TDS1K2KC_V24.26_066134800.zip). Unpack. It works for me if I rename the .tek firmware file. Rename the file TDS1K2KC.TEK to file TDS1K2KВ.TEK, write to a USB flash drive (I use 2GB). Well, then insert it into your TDS and follow the instructions.... Here is the result of the update with 2 different versions and it works even on a monochrome display:

author: lern01
author_rank: Regular Contributor
timestamp: December 03, 2023, 01:53:16 pm
content: Quote from: vdetal on October 27, 2023, 10:16:43 pmHas your TDS1001B been upgraded to 2022B?

author: lern01
author_rank: Regular Contributor
timestamp: December 03, 2023, 02:08:11 pm
content: Quote from: Fieroluke on February 24, 2023, 04:02:02 pmHello, I have a TDS2002C， I haven't understood your operation of modifying the checksum. Can you upload the pictures you performed on the eeprom editor? Or send me your 2022C firmware to lern01@outlook.com. Thanks!

author: vdetal
author_rank: Newbie
timestamp: December 03, 2023, 03:07:39 pm
content: 您的TDS1001B升级到了2022B？Yes!

author: lern01
author_rank: Regular Contributor
timestamp: December 24, 2023, 04:01:52 am
content: Congratulations, mine was successful too. Thanks to all netizens for their help.

author: lern01
author_rank: Regular Contributor
timestamp: December 24, 2023, 04:15:36 am
content: However, I encountered a new problem. I have a TDS2014C, which was upgraded to 2024C, but three green lights are always on when I turn it on, and the screen lights up and goes dark for a while. Programmed back to the original 2014C firmware, same fault phenomenon. The flash solder joints were checked under a microscope and everything seemed fine. Measure the square wave output. One moment it is 5KMHz, the next moment it becomes 7.597KMHz, and the cycle repeats.

author: lern01
author_rank: Regular Contributor
timestamp: December 24, 2023, 09:13:31 am
content: This oscilloscope seems to be a new model, as shown in the picture

author: Fieroluke
author_rank: Contributor
timestamp: December 24, 2023, 10:03:56 am
content: Hi,It sounds like the scope crashes during the boot process and is stuck in a reboot loop.Since the problem persists even with the original firmware you have a hardware problem!Either a bad EPROM (verify?) or PCB damage. Torn trace? Damaged via? Short?Sometimes a PCB picks up a piece of solder or wire shorting something.You can try inspecting the upper address lines for a short or unusual waveform, because shorts show (usually you see a third level besides high and low compared to the other address / data lines)!I assume the data bus and lower address lines are probably ok because it seems to run the boot process for a bit before crashing.Good luck

author: lern01
author_rank: Regular Contributor
timestamp: December 25, 2023, 01:48:35 am
content: Quote from: Fieroluke on December 24, 2023, 10:03:56 amThank you very much for your reply. The EPROM is good and the PCB has been checked repeatedly. There is no solder residue or damage. Which "upper address lines" do you mean? Hope to get further guidance. Sorry, I'm a newbie.

author: lern01
author_rank: Regular Contributor
timestamp: December 25, 2023, 04:14:54 am
content: Quote from: Fieroluke on February 27, 2023, 10:51:13 amI suspect that there is something wrong with the 2014C firmware that I dumped earlier because I forgot to verify it after dumping it. Today I used TL866 to read the EPROM again. After reading and verifying, an error occurred. It was the same after repeated several times. Can you send me a copy of the 2024C firmware? grateful! Email:lern01@outlook.com

author: lern01
author_rank: Regular Contributor
timestamp: January 11, 2024, 03:02:50 pm
content: In the process of upgrading TDS2014C to TDS2024C, I have a problem. Please pay special attention to it and upgrade carefully to reprogram the original chip. After I used TL866 to dump the TDS2014C firmware (the firmware dump is absolutely fine and has been verified N times), even if it is not cracked and I use other chips to program the firmware dumped by TDS2014C, the oscilloscope's self-calibration fails, but other functions are normal. The fourth step of the V24.09 version failed, and the first step of the V24.26 version failed. Welded back the original chip (the chip has not been touched, the original firmware), and the oscilloscope passed the self-calibration. It is suspected that something is set in the EPROM chip. Does anyone know how to solve it?

author: Lydia
author_rank: Contributor
timestamp: July 24, 2024, 01:02:00 am
content: BTW, another small discovery: in -SC model machines there's a converter board between the motherboard and the new LED display, it has a FPGA and a LED backlight driver on it. in the early reply of this topic, a friend seems like find that this board has another kind of signal, because he/she cannot use this FPGA board in older Tek scopes which using KCS057 balabala displays. but what I found is, the motherboard outputs the exact same signal, and the -SC model scopes can totaly use older 15pins KCS057 CCFL displays.However, that FPGA board has some very strange behaviors: it won't work if u not connect the backlight power of the FPGA board, this board will just refuse to work, even sometimes turn it on without connetc that will cause some strange damage to the board. Also, this board seems like very fragile, my scope and other some selling broken -SC scopes have these kind of FPGA board, and display some very strange frames, some are like old crts lose their H-sync or V-sync. Dont know how to repair now.

author: lern01
author_rank: Regular Contributor
timestamp: October 12, 2024, 06:39:20 am
content: Hello, today I cracked a TDS2012B and ran the command python patch_tds1k2kb_rom.py TDS2012B.BIN in the python2.7 directory. The error message was:

author: BI3RZF
author_rank: Newbie
timestamp: November 26, 2024, 12:01:18 pm
content: Can you send me a copy of the 2024C firmware? grateful! Email:451418355@QQ.COM

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: December 02, 2024, 06:20:57 am
content: the FPGA board is basically to interface new type of display which is like 6 bit paralled RGB to serial interface.instead of changing the HW on main board, Tek decided to add new FPGA to incorporate a better display.you can still use old displays withoout fpga boards

author: EduardoLM
author_rank: Contributor
timestamp: April 03, 2025, 01:13:19 pm
content: This is a great thread, full of very useful information! I wonder if there's a way to also upgrade the TBS1000B series, which has a bigger and higher resolution display. Does anyone know if it's possible? I think it's based on the same older platform, with just a display upgrade. All the other features seem to be quite similar to older models.I wonder if the sampling / front-end hardware is the same, capable of 2Gsamples/s on all models. If it is, then it might be possible. I particularly have the TBS1052B model, which is 50MHz / 1Gsamples/s, 2ch, and it would be great to upgrade it to higher models, like the TBS1202B (the 200MHz) which is the top model.Thanks!

author: Fieroluke
author_rank: Contributor
timestamp: April 03, 2025, 06:48:55 pm
content: Can you post a pic of the mainboard (both sides)?

author: EduardoLM
author_rank: Contributor
timestamp: April 07, 2025, 01:46:19 am
content: Quote from: Fieroluke on April 03, 2025, 06:48:55 pmThanks for replying, Fieroluke!I just started a new thread, to avoid mixing subjects, and posted several pictures, please see here:https://www.eevblog.com/forum/testgear/tektronics-tbs1000b-series-bandwidth-hacks-bw-unlockMany thanks!Eduardo

author: EduardoLM
author_rank: Contributor
timestamp: May 19, 2025, 11:03:06 pm
content: Does anyone know if the BW unlock procedure would also work on TBS1000 series?Thanks,Eduardo

author: daisizhou
author_rank: Super Contributor
timestamp: September 02, 2025, 11:39:07 am
content: Can TDS2012C be upgraded?

author: Fieroluke
author_rank: Contributor
timestamp: September 02, 2025, 12:39:58 pm
content: Yes, my 2004C worked, your 2012C should work as well

author: daisizhou
author_rank: Super Contributor
timestamp: September 02, 2025, 01:05:02 pm
content: Quote from: Fieroluke on September 02, 2025, 12:39:58 pmHow to operate?Do you have detailed steps?Can it be upgraded to 200M?

author: Fieroluke
author_rank: Contributor
timestamp: September 03, 2025, 08:03:39 am
content: It’s all in this thread.Thoroughly read and understand pages 3 and 5 in particular.Unsolder FlashRead and save dumpGet and run Python script from page 3 or change dump in Hex editor directly using model info from page 5. you basically set a new model info, lift bandwidth limits and change checksum accordingly.Program modified dump back into flashResolder flashPray you didn’t damage anything or make a mistake