Tektronics TBS1000B series bandwidth hacks / bw unlock? - Page 1
Forum section: electronics / testgear

author: EduardoLM
author_rank: Contributor
timestamp: April 07, 2025, 01:39:33 am
content: Inspired by the great threadhttps://www.eevblog.com/forum/testgear/tektronix-tds1000b-series-hacks/thread, I would like to propose the same research work for the TBS1000B series. This series is the upgrade to the TBS1000 series, and it seems to be based on the same platform. It still retains the much criticized 2.5Kpoints memory depth, and the majority of features are the same as previous series, but it has a much better LCD. I have the TBS1052B model, which is 50MHz / 1 GS/s, but the series goes up to 200MHz / 2 GS/s scopes.I'm starting the thread showing pictures of the PCB and main components, as asked by Fieroluke. All relevant components are on top. The underside has no chips. If more pictures are needed, just ask! Thanks for all the help.Eduardo

author: EduardoLM
author_rank: Contributor
timestamp: April 07, 2025, 01:44:50 am
content: Adding some close up pics. Some comments:- It seems the firmware is on a BGA chip, which makes things more complicated- Theres a 10 pin IDC male connector that may be for JTAG communication- The white connector (J5) is for the control panel- The metal connector (J2) is for the LCD display, looks like a LVDS connector- The Freescale MCIMX257DJM4A seems to be the main CPU (https://www.nxp.com/docs/en/data-sheet/IMX25CEC.pdf), so it seems I was wrong at assuming it's the same platform of previous models (MC68000)

author: Fieroluke
author_rank: Contributor
timestamp: April 07, 2025, 07:33:04 pm
content: Yea, what I thought:The original TBS1000 series was still based on the 68K, but starting with the TBS1000B/C it’s based on a new platform: new processor, different Flash, etc. So basically square one…

author: EduardoLM
author_rank: Contributor
timestamp: April 27, 2025, 08:54:50 pm
content: Yes, it seems like a lot of work. I'll do some research on this Freescale processor, trying to find out how to disassemble firmware code. Any insight you may have on this, is greatly appreciated, thanks!Eduardo

author: Fieroluke
author_rank: Contributor
timestamp: May 20, 2025, 05:01:57 am
content: Not having seen the new series up close the following is just educated guesses:Since the remaining hardware (except for the display) seems identical, Tek probably just recompiled the software for the new processor. Have you started to check if the „hidden“ menu is still there that lets you examine the memory? Then you could explore a bit without having to remove the Flash. If you have the firmware file maybe from an update you could then also check where the memory blocks are loaded. The model ID is probably near the end of memory again. Maybe you can find the critical segment that‘s well documented in the other thread…

author: EduardoLM
author_rank: Contributor
timestamp: May 20, 2025, 10:50:32 am
content: Thanks for the heads up! Yesterday I also found this interesting thread:https://www.eevblog.com/forum/testgear/tektronix-tbs1000-series-hacking/It seems it's not about TBS1000, but about TBS1000B! And it's full of great info about FW analysis. The tear down pictures and LCD picture make me think it's a B model, it's too similar!And yes, I have downloaded the latest FW, and I'll study both threads in detail to learn how to possibly hack this scope. Many thanks for the help!Eduardo

author: factory
author_rank: Super Contributor
timestamp: May 20, 2025, 07:51:33 pm
content: The start of that thread was about a TBS 1052B-EDU, see the picture of the scope here;https://www.eevblog.com/forum/testgear/test-equipment-anonymous-(tea)-group-therapy-thread/msg3633985/#msg3633985David

author: EduardoLM
author_rank: Contributor
timestamp: May 20, 2025, 10:58:52 pm
content: Exactly, this is also the one I have. It's the same model this thread is about.Eduardo