[solved + hacked] Bad firmware installed in TDS1001C-EDU - Page 1
Forum section: electronics / repair

author: Silicium81
author_rank: Regular Contributor
timestamp: March 09, 2022, 08:15:19 pm
content: I made the mistake of installing the wrong firmware in a TDS 1001C-EDU... Despite the message "update firmware successful", it no longer starts, there are only 3 leds lit and it is frozen... .Fortunately, I have another identical functional device.Do you think that copying the contents of the flash memory of a functional device into the memory of the patient will put things back in order?To do this, I plan to unsolder the flash memory (29JL064) of a working device, read it with a TL866-2 programmer equipped with the TSOP48 support, then transfer this code to the corrupted memory and put the two memories back in place.

author: fzabkar
author_rank: Super Contributor
timestamp: March 09, 2022, 11:39:19 pm
content: I would dump the patient's flash memory and compare it against the update payload. Perhaps there are unique areas in the flash that must be preserved?

author: Silicium81
author_rank: Regular Contributor
timestamp: March 21, 2022, 11:16:10 am
content: I received the TL866IIplus programmer with the TSOP48 adapter.So I unsoldered the two flash memories and made the transfer of the contents of the scope rom ok to the scope rom whose firmware was corrupt and broken at startup.The operation is a success and the scope restarted normally. An automatic calibration also worked. The serial number is also correct (it must be stored in EEPROM).If it is useful for someone, the contents of the read ROMFLASH is dowload here (8MBytes):https://www.cjoint.com/c/LCvlrexYin2or zipped in pj (remove .txt extension after unzipping)I would like to hack the model to TDS2022B (the hardware is the same) but I can't get the script offered here to work:https://www.eevblog.com/forum/testgear/tektronix-tds1000b-series-hacks/msg1451551/#msg1451551

author: Silicium81
author_rank: Regular Contributor
timestamp: March 22, 2022, 07:10:33 pm
content: Success for hack the scope !!40MHz/500Msp/s to 200MHz/2Gsp/sThe TDS1001C-EDU is transform in TDS2022BTo use the script, you must install python 2.7In pj, the script modify for add TDS1001C-EDU (identify: 0x22)

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: October 04, 2022, 07:48:51 am
content: Hi.I have a tds2002b whose original flash got corrupted while doing upgrade. Can you please share flash dump for tds2002b or of any model in tds2000b 2 channel model. Also share check sum value to make sure data doesn't get corrupted during transmission

author: coromonadalix
author_rank: Super Contributor
timestamp: October 04, 2022, 11:43:28 am
content: @SiliciumNow hack the Tektronix sticker, this one will be hard loll

author: vishaldotgupta
author_rank: Regular Contributor
timestamp: October 04, 2022, 01:39:45 pm
content: nice work.few questions / comments1. your model is having LED backlighted color display? Right2. did you also changed the LED backlighted display. the original B series models support CCFL backlighted display. these display having different data patterns3. can you please share the updated rom file for patch. Mine got corrupted and i do not have a working back up copy. if possible share checksum value of entire bin file to ensure data integrity

author: lern01
author_rank: Regular Contributor
timestamp: October 19, 2023, 02:13:21 pm
content: Thank you very much for your work. Could you please take a picture of sop48 chip connecting to catapult? I don't have sop48 converter base. Programmer only 40 pin socket, how to connect? Thanks again!

author: Silicium81
author_rank: Regular Contributor
timestamp: October 21, 2023, 09:04:23 pm
content: Quote from: lern01 on October 19, 2023, 02:13:21 pmSee here (in french):https://vae-tech.forumactif.org/t268-mauvais-firmware-hack-oscilloscope-tektronix

author: lern01
author_rank: Regular Contributor
timestamp: October 23, 2023, 11:28:32 am
content: Thank you very much, I am TL866CS, read S29JL064H90TFI000 maximum address is only 0x003FFFFF, what is the reason?Thank you for your trouble!

author: Shonky
author_rank: Frequent Contributor
timestamp: October 23, 2023, 11:58:11 am
content: Quote from: lern01 on October 23, 2023, 11:28:32 amIt is displaying it as 16 bits (a word) per address location i.e. 0x000000 to 0x000007 is actually 16 bytes. So for 64Mbit it will only show 4M addresses (of 16 bits). If you save the file it should be 8Mbyte.

author: lern01
author_rank: Regular Contributor
timestamp: October 23, 2023, 01:40:09 pm
content: thanks! How to set it to 8-bit display?

author: lern01
author_rank: Regular Contributor
timestamp: October 23, 2023, 02:12:24 pm
content: Use your firmware, according to your script to modify the firmware, burning error, hope to give guidance, thank you! model number:S29JL064H90TFI00

author: Silicium81
author_rank: Regular Contributor
timestamp: January 18, 2024, 09:31:03 am
content: How did you program the memory?Did you desolder the component?If yes, have the pins of the unsoldered memory been perfectly cleaned?The contacts in the programming support must be of good quality otherwise it is normal to experience programming difficulties!If not, I'm not sure that in situ programming is possible...