Tektronix TBS1000 series hacking - Page 1
Forum section: electronics / testgear

author: bd139
author_rank: Super Contributor
timestamp: August 16, 2021, 07:40:01 pm
content: Has anyone looked at these scopes at all with respect to upgrades? I just landed a TBS1052-EDU for pocket money. Was considering having a poke around at it. I can't even find a teardown.For ref I know these are 2.5kpts garbage but this is merely an arbitrage purchase

author: tautech
author_rank: Super Contributor
timestamp: August 16, 2021, 08:02:46 pm
content: I wouldn't imagine they are any different to TDS models:https://www.eevblog.com/forum/testgear/tektronix-tds1000b-series-hacks/

author: bd139
author_rank: Super Contributor
timestamp: August 16, 2021, 08:18:59 pm
content: Not sure about that. They have completely different interface to the TDS series. I suspect they might have different MCU. I will tear this one down and have a look when it turns up. Also you can flash these off a USB stick apparently.

author: bd139
author_rank: Super Contributor
timestamp: August 16, 2021, 08:25:28 pm
content: Actually tried to download firmware for it to have a poke and get greeted by this fucking turd:Remind me never to do business with Tek professionally

author: tautech
author_rank: Super Contributor
timestamp: August 16, 2021, 08:31:28 pm
content: Bit to do this morning but I'll log in later and get any FW you need.Flick me mail and we'll sort it out.

author: tv84
author_rank: Super Contributor
timestamp: August 16, 2021, 08:34:38 pm
content: Quote from: bd139 on August 16, 2021, 07:40:01 pmDo you have any license? Can you show the license menu?

author: bd139
author_rank: Super Contributor
timestamp: August 16, 2021, 08:41:24 pm
content: Quote from: tautech on August 16, 2021, 08:31:28 pmThanks appreciated. I will ping you when I actually get it. Seller sent it untracked via idiot post.Quote from: tv84 on August 16, 2021, 08:34:38 pmI don’t actually have the scope yet. It’s on its way to me at the moment.I’m fishing for ideas. Slightly hope they canned M68k and moved to ARM for this line if I’m honest.

author: tv84
author_rank: Super Contributor
timestamp: August 16, 2021, 08:53:39 pm
content: Quote from: bd139 on August 16, 2021, 08:41:24 pmSo let's wait.Here. Page 84 helps?

author: bd139
author_rank: Super Contributor
timestamp: August 16, 2021, 09:03:20 pm
content: Interesting. So only thing IDable from that is the Spartan on the main board. Construction isn’t that different to the TDS series. So place your bets: ColdFire or something less deadEdit: jumped on the PC and embiggened the image...I suspect that's the CPU but I don't recognise the vendor logo. It's not NXP ColdFire though...

author: tautech
author_rank: Super Contributor
timestamp: August 16, 2021, 09:21:26 pm
content: Quote from: bd139 on August 16, 2021, 08:41:24 pmSome stuff in your inbox.

author: bd139
author_rank: Super Contributor
timestamp: August 16, 2021, 09:24:34 pm
content: Got it thanks. Already have it open in HxD. It runs Linux by the looks! Definitely ain't M68k any more then. Still trying to ID the CPU arch.Edit: looks like ARM. I'm going to try and extract the ROM FS out of it.

author: tv84
author_rank: Super Contributor
timestamp: August 16, 2021, 09:53:20 pm
content: Quote from: bd139 on August 16, 2021, 09:24:34 pm0000011C Magic: 28CD3D45 CRAMFS MAGIC OK00000120 Size: 01F6100000000124 Flags: 0000000300000128 Future: 000000000000012C Signature: Compressed ROMFS0000013C CRC32: 9646CDC5 [0000011C-01F6111B] CRC OK00000140 Edition: 000000144 Blocks: 1850900000148 Files: 30130000014C Name: CompressedList of the files is attached.

author: bd139
author_rank: Super Contributor
timestamp: August 16, 2021, 10:03:40 pm
content: Nice one. Reading now.I have kernel info from binwalkuImage header, header size: 64 bytes, header CRC: 0x46B780DD, created: 2015-02-10 06:30:58, image size: 1577572 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0x92CFE807, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-2.6.31-203-gee1fdae"Linux kernel ARM boot executable zImage (little-endian)Unfortunately cramfs tools are fecked on debian 11 at the moment.Edit: oh man they left gdb and gdbserver on there and half their SVN repo metadata. Was hoping for straceEdit 2: dropbear ssh server. Uses ADG522 - same capture ASIC IC as the TDS2024 apparently. Possibly 200MHz?Edit 3: UI layer is minigui. Entry point is possibly "tekapp"

author: tv84
author_rank: Super Contributor
timestamp: August 16, 2021, 10:10:57 pm
content: 01FA1DD4 Magic: 27051956 uImage File OK01FA1DD8 Header CRC-32: 46B780DD [01FA1DD4-01FA1E13] CRC OK01FA1DDC Created: 10/02/2015 06:30:5801FA1DE0 Data Size: 0018126401FA1DE4 Data Load Address: 8000800001FA1DE8 Entry Point Address: 8000800001FA1DEC Data CRC-32: 92CFE807 [01FA1E14-02123077] CRC OK01FA1DF0 Operating System: Linux01FA1DF1 CPU Architecture: ARM01FA1DF2 Type: OS Kernel Image01FA1DF3 Compression: None01FA1DF4 Name: Linux-2.6.31-203-gee1fdae01FA1E14 - Image 0 [01FA1E14-02123077] 00181264 bytes------------------------------------------------------------------FPGA .RBF file (experimental parsing):FPGA - RBF/RPD (Raw Binary File) - Filesize: 1 463 520 bits (0002CA9C bytes)02123078 - Start of File (Type 1)[021230C0 02123099]Bit 7 - 1111111111111111111111111111111111111111 FFFFFFFFFFBit 6 - 1111111111111111111111111111111111111111 FFFFFFFFFFBit 5 - 1111111111111111111111111111111111111111 FFFFFFFFFFBit 4 - 1111111111111111111111111111111111111111 FFFFFFFFFFBit 3 - 1111111111111111111111111110011010000000 FFFFFFE680Bit 2 - 0000101010111010100011011000000000111111 0ABA8D803FBit 1 - 1111000000000111100011000000011111111111 F0078C07FFBit 0 - 1111111111111111111111111111111111111111 FFFFFFFFFFBits 0080 - EPCS/EPCQ ID check: EnabledBits 005F - Stream size: 1 406 235 bits (0002AEA4 bytes) Compression Bit ON (+1) Size NOT OKBits 0056 - 0000 0000 : 0x56-0x5DBits 004C - Programming Mode: 1-bit Passive SerialBits 003B - IDCode (Version+Part Number only): 0x020F1 (-> 0x024F1)Bits 0008 - Usercode: FFFFFFFF021230C1 - Header CRC-16_MODBUS: 74EC [02123099-021230C0] CRC OK021230C3 - Data Framesize: 207 [021230C3-02123169]0212316A - 4-byte words: 1260 [0212316A-02124519]02123078 - Stream Size (Uncompressed): 3 034 104 bits0212451A - CRC Framesize: 207+0 # Data Frames: 1779 [0212451A-0217F93E]------------------------------------------------------------------The last part of the file seems to be the programming of a HCS08 FrontPanel MCU (?), starting at 0x0214DF20.

author: bd139
author_rank: Super Contributor
timestamp: August 16, 2021, 10:19:43 pm
content: There's a bunch of certs in there. I bet that's where there's trouble.Edit: and off to bed. Will resume when I receive it

author: tv84
author_rank: Super Contributor
timestamp: August 17, 2021, 02:28:30 pm
content: Some files extracted.

author: bd139
author_rank: Super Contributor
timestamp: August 17, 2021, 02:52:10 pm
content: Nice one. Will have a look after work.

author: tv84
author_rank: Super Contributor
timestamp: August 18, 2021, 08:04:59 pm
content: Full parsing of the .TEK file:Code:00000000 - Header Magic: 01010100 Magic OKOffset Block Version Size Checksum00000004 - Rootfs 4.06 01F61000 FEB8A541 [0000011C-01F6111B] CHKSUM OK0000003C - U-Boot 2009.08-bund-1.03.001 00040CB8 0167CB55 [01F6111C-01FA1DD3] CHKSUM OK00000074 - Kernel 2.6.31-bund-1.03.001 001812A4 0CAC0D96 [01FA1DD4-02123077] CHKSUM OK000000AC - FPGA 0.3 0002AEA8 00AB3E39 [02123078-0214DF1F] CHKSUM OK000000E4 - FrontPanel ufp-mc9-020103 00001BF0 00060D8A [0214DF20-0214FB0F] CHKSUM OK0214FB10 - File Total Checksum: 0D7DE4EE [00000000-0214FB0F] CHKSUM OK

author: bd139
author_rank: Super Contributor
timestamp: August 18, 2021, 08:29:35 pm
content: Nice work. Hopefully receiving it tomorrow so will do some disassembly and take some photos when I get some time in the evening.

author: bd139
author_rank: Super Contributor
timestamp: August 19, 2021, 12:38:05 pm
content: Scope received. Idiot packaging but no serious damage done.Internal photos attached. Looks like JTAG headers all over itCore is i.MX25:https://www.nxp.com/docs/en/data-sheet/IMX25CEC.pdfFPGA is mid-range Cyclone IV part. Cyclone IV E 645 LABs 179 IOs -https://www.mouser.co.uk/datasheet/2/612/cyiv-51001-1299459.pdfAssuming these are the sampling ASICs descended from the old TDS ones based on the miserable 2.5kpts and similar numbering. Can't find any other ref to them.JTAG ports?Power supply shot for completeness - nice Astec unit.Nearly new!Got to complain though - what idiot sends scopes like this... only a couple of dinks fortunately and nothing majorReally Tek did a nice job of this. Just need that entry level spec to go away and be replaced with something better

author: coromonadalix
author_rank: Super Contributor
timestamp: August 19, 2021, 02:27:40 pm
content: for the pcb jtag pads, you can put an 0.1'' header with right angled pinshttps://www.harwin.com/products/M20-8760346/

author: bd139
author_rank: Super Contributor
timestamp: August 24, 2021, 08:49:45 pm
content: Quick update on this. Due to work commitments I haven't had a chance to even look at this properly yet.

author: jgustavoam
author_rank: Regular Contributor
timestamp: November 12, 2022, 09:25:59 pm
content: Hi ,I have a TBS1062 scope (60 MHz - 1 G S/s). I'll start my research to see if it's possible to change the scope's frequency.I created a disassembly procedure for my scope in IFIXIT:https://www.ifixit.com/Guide/TBS1062+Disassembly+-+Tektronix+Oscilloscope/155060

author: jgustavoam
author_rank: Regular Contributor
timestamp: November 12, 2022, 09:38:39 pm
content: TBS1000 Series firmware :https://www.tek.com/en/support/software/firmware/firmware-update-tbs1k-scopesThis software applies to: TBS1062, TBS1042, TBS1102, TBS1152, TBS1022 - The firmware is the same for all models!History-----------------------v26.02 July 22, 20131) support for five TBS1K models: TBS1022, TBS1042, TBS1062, TBS1102, TBS1152.I also think that the model configuration is recorded in the EEPROM.The most likely EEPROM should be this: U902 = ATML H326 2GB 2 2X6399A.I still haven't found the specific datasheet for this chip

author: alexfloca
author_rank: Newbie
timestamp: January 05, 2023, 09:22:38 pm
content: Hello, did anyone make any progress? I recently bought a tbs1052, or status up with a white screen, when i connect it to the pc via usb it identifies itself as tbs1202, did a firmware update using the pc to download the screen information and it keeps saying it is a tbs 1202, the screen does not work, the vertical data aquisition does not work and on the 1khz output in have 3 khz!!! Now i opened it up thinking there is a simple issue with the lcd display, the display works just fine! I can see there are headers installed all over (i suspect someone tried to hack it) also a lot of screws were loose not tighned at all. Also one screw missing and some messy repair work on the front panel cable.Forgot to mention, the scope says, serial number "0" and channel a, b and trigger fail. I asume, there is a difference between 1052b and 1202b at hardware level.Did you make any progress?

author: jgustavoam
author_rank: Regular Contributor
timestamp: January 06, 2023, 12:29:52 pm
content: Hello Alex,Did you use the correct firmware on your scope TBS1052?The correct link is:https://www.tek.com/en/support/software/firmware/tbs1000c-series-firmware-release-v12930

author: simba15
author_rank: Regular Contributor
timestamp: January 06, 2023, 02:55:23 pm
content: I have about 50 of these at my work and we often see issues with the display. ( white or inverted colors.)Generally i just leave it on for a while or do some power cycled an they will come back to normal.We also have this issue with Agilent 33210A when there is no backlight ( again just leave on and self heals)Curious to know if there are any features that can be added.

author: Fieroluke
author_rank: Contributor
timestamp: March 05, 2023, 10:18:02 pm
content: QuoteHi Jgustavoam: This version is still 68K based, has the same JL064 Flash as the TDS2000C series, even the front panel is identical, so I’d bet the firmware is based on the TDS series - at least for the 68K version.TDS2000, TDS2000B and TDS2000C series model ID change

author: luis garcia
author_rank: Regular Contributor
timestamp: May 26, 2023, 02:03:43 pm
content: Had this "upgrade" any success?. I have rescued a couple of units. Both are working 50Mhz.

author: EduardoLM
author_rank: Contributor
timestamp: May 20, 2025, 03:23:31 am
content: Quote from: bd139 on August 19, 2021, 12:38:05 pmAre you sure this is a TBS1000? To me, it looks like a TBS1000B, with higher resolution LCD. TBS1000 LCD is not like this!And the internals look a lot like the TBS1000B, which I too want to hack. Please see the photos of my TBS1000B here:https://www.eevblog.com/forum/testgear/tektronics-tbs1000b-series-bandwidth-hacks-bw-unlockEduardo

author: factory
author_rank: Super Contributor
timestamp: May 20, 2025, 07:18:29 pm
content: You won't get a reply on here, the OP has quit this forum, plus he sold the scope years ago.Edit: It was a TBS 1052B-EDU, more pictures were posted here;https://www.eevblog.com/forum/testgear/test-equipment-anonymous-(tea)-group-therapy-thread/msg3633985/#msg3633985David

author: slava6518
author_rank: Newbie
timestamp: September 11, 2025, 07:05:59 pm
content: hi all! please send me firmware TBS1000B edu.

author: sandorvegh
author_rank: Newbie
timestamp: September 28, 2025, 05:31:39 pm
content: Quote from: slava6518 on September 11, 2025, 07:05:59 pmI requested it for mine, but waiting for procedure.This is a really shitty thing.

author: Chris.Tsai
author_rank: Newbie
timestamp: September 30, 2025, 12:09:50 pm
content: There you gohttps://www.icloud.com/iclouddrive/0b3KU3IT-Z1wwGYt43-z3w_bA#TBS1KB