TEK DPO7104 looking for flash/eeprom content - Page 1
Forum section: electronics / repair

author: kissmu
author_rank: Contributor
timestamp: April 01, 2022, 12:02:34 pm
content: Dear All,I would like to ask any help to go back to full life my half life DPO7054.Currently i completly lost the content of my flash (contains serial number, instrument type number, options number). I have flash error message.I need an original flash of DPO7104 instrument. The serial code, activation code no matter.without flash, i can't install my options e.g:SignalVU options.This is a small lfash chip in the power board: 25p20VpThe flash chip is on the back side of the power board. I attached an picture.

author: kissmu
author_rank: Contributor
timestamp: April 07, 2022, 12:36:26 pm
content: some exta inforamtion:I made same test measurement. The conclusion:The instrument real max bandwidth is 3.5 Ghz!If i let the bandwith limiter in HW mode and i use the channel without PI filter, the bandwidth is at least 3.5 Ghz!I can see the 2.4 Ghz WiFI signal on the FFT without any down convertersion. After 3.7 Ghz the signal power start to decrease. Approx 3dDThe conclusion. Despite of difference of DPO7054,DPO7104 and DPO7254,DPO7354 acquisition board, the bandwidth capable is same.In the original case when my flash was good (DPO7054), the 500Mhz bandwidth limit is limited the instrument capabylities.But in the DPO7104 case only the 1Ghz(DSP) limit the bandwidth to 1GHZ, but the 1GHZ(HW) limit option not limit anything. You can use the instruments capabyliti.I already attached many pictures, but my previous post lost.I will ty again.My plan: open again the whole instrument and read out again the flash.Other success. I found a core2 motherboard wich can work with the original WinXP image. Only one motheboard. Other isn't work. I don't kow why. Core2 processor and ssd combination could increase the performance of orginal P4 + HDD combination.I'm sill looking for a not corrupt DPO7104 flash content.

author: kissmu
author_rank: Contributor
timestamp: April 07, 2022, 01:19:21 pm
content: The eeprom position is in the picture in the red circle.just for fun fact: the eeprom is accessible form the top side of power board too.These pictures was made by thin /xdevs.com

author: TiN
author_rank: Super Contributor
timestamp: April 08, 2022, 05:11:46 am
content: I have few dead DPO7104s I've kept for parts, contact me by email, I'll make a dump for you.I have doubts that there is 3.5GHz bandwidth of 2-ADC boards (e.g. DPO7054 and DPO7104 without 2SR and lesser ADC hardware present).

author: kissmu
author_rank: Contributor
timestamp: April 09, 2022, 07:16:38 pm
content: Hi Tin,I dug in the internet and found some interesting thing.I sent it for you.I found several picture on the internet, and try to compare the the acquisition board pictures and, power board pictures.I found 4 type acquisition board, ad 2 types power boards.You repaired an DPO7104 but the acquisition board seems first generation. My board has much less component. E.g.:half amount of memory chips, but my DPO has same 250Mb memory length.1. first type 1. switch and 4 memory management+Adc2. second. Same then the first type but the half amount of memory chip and management chip is unpopulated3. My version: Half amount of memory, and only 2 ADC/memory management chip. No unpopulated component. Most simple acquisition board. same than attached picture.4. C version board, which seems same than mine. If the picture name was correct.As i see the main difference between the C version and original version is the power board use PCI-e instead of PCI. And the PCI version has dedicated graphic card, the C version uses the motherboards integrated graphic.When i updated the motherboard in my scope, i found that the not C versions scope works almost perfect without the dedicated graphic card. All process work in the background, but you can't see anything on the screen. But i could use the SignalVu software, and i could see everything (and seems faster than the dedicated video card). The Jitter analysis got back correct report despite of i can't see the measurements on the screen.Maybe the non C version are hack-able to C version. The C version software much better then the original one.My acquisition boards seems new version, or reduced one. This is why i surprised at my scope can manage 3.5 Ghz too not only 1 Ghz. It is mean almost all component are same.I attached 2 pictures. My acquisition board is same. And it can manage 3.5 GhzI will post some own pictures, the result of my corrupt flash.But without flash chip the instrument isn't start.Kind regards,Gabor

author: kissmu
author_rank: Contributor
timestamp: April 10, 2022, 04:18:50 pm
content: Here is some pictures abut the bandwidth.I aware of my signal forms not always correct.Because i just remove the PI filter from the signal path. I aware of the transmission line without any filter can make unwanted effect.But I haven't got known fast square shape pulse generator, to check the signal form.1Ghz is square wave the 2 GHz and above sinus.So i listen all opinion.

author: kissmu
author_rank: Contributor
timestamp: April 10, 2022, 04:23:32 pm
content: 700 MHZ square+flash error

author: d37duck
author_rank: Contributor
timestamp: May 02, 2022, 01:36:52 am
content: Hi kissmu,I hope the SPI Bus Flash Memory you mentioned is accessible by executing a script. Whatever the process, please tell me how to read and write it. I'll try to follow the procedure and if it works, I will put the memory contents into an archive file (rar or zip) an email it you. I will post it along with whatever comments I have about how to read it.If it doesn't work, I'll ask questions.Let us hope for data,

author: kissmu
author_rank: Contributor
timestamp: May 05, 2022, 07:32:44 pm
content: Hi s37duck,Thank your effort.I thank you all possible help.You are right this flash can accessible by software, because the tekscope.exe can read, and write it.But I don't know any other option to read it and save without tekscope.exe.I could read this flash with CH341a flash reader. But i use incorrect flash size during reading, so the result isn't correct.I could read this flash with removable clips connector.But if you want to read it in this way you have to tear down the all unit.Kind regards,Gabor

author: charlyd
author_rank: Frequent Contributor
timestamp: December 25, 2022, 10:49:41 am
content: i can also post some picture starting of with a DPO7254 acq board.@kissmu the numbering should be a great one to add.679-1859-03 /655-1859-03more and better will follow here or in a separate post

author: calibrationfixture
author_rank: Regular Contributor
timestamp: December 26, 2022, 07:18:04 am
content: Hi,@ « Reply #4:I think the Chinese(?) Picture of the Board is from an early DPO7054. These early ones were 10 GS/s Boards. In those days you could also order a DPO7054 Option 2SR (20 GS/s). Later (2010) DPO7000 Datasheets don't show Option 2SR for DPO7054 Scopes anymore. Only DPO7104's had this Option. In addition the Sampling Rate of DPO7054's has increased to 20 GS/s. Looking into the 071-1740-02 Service Manual you also see that the Boards of the DPO7054 and DPO7104's have the same PN. In addition: early or late. Look at the production dates of the parts on the boards.Greetings,Calibrationfixture

author: mikehank
author_rank: Regular Contributor
timestamp: December 28, 2022, 09:30:45 pm
content: I cant speak to the BW testing mentioned but I do know the components by the red arrow are compensation networks. A dpo7104 will have different values than a DPO7254 and DPO7354. These networks are coming out of the track&hold to the A2D's. The new DPO7K's removed the T&H altogether but the compensation networks are still present between the preamps and the A2D.

author: kissmu
author_rank: Contributor
timestamp: February 08, 2023, 02:30:37 pm
content: Hi!These are bad news.Exately this is my unit:Board is from an early DPO7054. These early ones were 10 GS/s Boards. In those days you could also order a DPO7054 Option 2SR (20 GS/s).The conclusion is: my unit maximum sampling rate is 20 GS/s as TIN mentioned earlier.I noticed that the 500Mhz limit was software limit in the DPOs. The 1Ghz limit is an hardware PI filter limit.I read the corrupted eeprom, and i noticed that i lost my unit internal serial number. (and maybe another error, but i can't copare it with another one)This serial numer isn't same like the number on the back of the machine.So if i got an other serial numer my unit can be anything. This serial numer is a coded one so i can't geneate new one.Now i haven't got any serial number, therefore the software use tde default settings: DPO7104 20GS/s, without any optionsI use my unit for testing my VNA (try to repair) and lean other RF black magic.So i happy with extra bandwidth. But i need internal serial number for installation usefull software.So i don't worried about different unit numer for example DPO7354/7254/7104. The better would be the 7104.But i would try anything, maybe help.

author: coromonadalix
author_rank: Super Contributor
timestamp: February 08, 2023, 03:03:36 pm
content: Would be fun to extract the fw thru vxwork commands or other tek included software ....i recall theses attached files ... not sure it helps in any wayIt was for the mobo bios dump etc ...I have a 7254 at my job, and did some backups and file copy on a usb key, just can't do an hdd iso

author: kissmu
author_rank: Contributor
timestamp: February 19, 2023, 01:04:31 pm
content: Thank you,I think these are windows base settings.I need the content of this chip:https://www.eevblog.com/forum/index.php?action=dlattach;topic=318913.0;attach=1457488;imageIt contains, the all data of the instrument: Serial number, unit number (e.g.:DPO7104), installed options settings, and so on. It is the real bios of this instrument.Your data maybe good for motherboard replacement.

author: kissmu
author_rank: Contributor
timestamp: March 07, 2023, 08:11:45 pm
content: sorry for the image sizeI already posted this picture earlier:Here is the correct one

author: coromonadalix
author_rank: Super Contributor
timestamp: March 07, 2023, 08:14:46 pm
content: still the wrong size of image, way too small ??

author: kissmu
author_rank: Contributor
timestamp: March 07, 2023, 08:19:07 pm
content: here is the correct link:here is my original post with correct size of pictures:https://www.eevblog.com/forum/repair/tek-dpo7104-looking-for-flasheeprom-content/msg4105765/#msg4105765

author: veegee
author_rank: Newbie
timestamp: April 18, 2023, 07:19:34 am
content: I'm having a hard time comprehending the broken English... But I'm thinking about buying a DPO7054 I found on ebay for a good price. Apparently it's an older model that has the 2SA option installed. The only thing holding me back is not knowing whether or not I can hack it to get at least 1GHz bandwidth.From what I read in this thread so far, this is my understanding:- The 500MHz limit is purely in software and can be removed to get at least 1GHz fairly easily.- Above 1GHz, some hardware modification needs to be done to get higher bandwidths. Apart from the compensation network, what other hardware differences are there between the models?Is this correct?I'm pretty good with hacking software. Not so great with the hardware side of it yet. I'll be glad to help once I get my DPO7054 if someone can confirm my understanding above.

author: kissmu
author_rank: Contributor
timestamp: April 25, 2023, 09:48:55 am
content: Hi veegee,You are almost correct.But the software bandwidth hacking isn't easy. You have to changed your instrument internal identification number.In my case my eeprom was broken, and my unit (DPO7054) became DPO7104 (this is the default setting) . But i lost the all possible options. But i need these option e.g:signalvu.The hardware hacking seems easy: remove PI filter.The instrument internal id was encoded. So you have to find the way to decoded id. After change the unit name you have to encode it again, and write into the eeprom.

author: veegee
author_rank: Newbie
timestamp: April 29, 2023, 09:57:34 am
content: If the firmware is available, it should be possible to decompile and find the subroutine that encodes/decodes the eeprom data. From there, it's trivial to write whatever we want into the eeprom.As far as the licence keys go, we should also be able to dig into their code and trace the subroutines which map serial numbers to features and other things like IDs. Is it possible to install third party software like IDA pro on the scope itself? That would make debugging far easier since we can get a live view of what's going on.

author: kissmu
author_rank: Contributor
timestamp: May 01, 2023, 01:59:29 pm
content: The option codes was cracked already.The scope software is avaiable separately. The eeprom contains only the option list, the instruments id and instruments number e.g.:dpo7104 or dpo7054 ...The cope calibration data is in different eeprom.I think the coded instrument number use similar code type than the option code.The optyon finder source code is avaiable. It is an 2.7 python code.Tin already collected huge amount software for this scope.I think not nevessary disassembling the whole code just the instrument code.

author: lecatron07
author_rank: Newbie
timestamp: June 26, 2023, 04:49:26 pm
content: hello alli will try to get the flash content for youwould you show me where is the tool that generate option keys because i couldn't find itmy scope have a problem all channels work nice except the last channel it show this weird noise in it but when i push gently under the scope the noise disappear any idea of what should i dohow to fix it

author: calibrationfixture
author_rank: Regular Contributor
timestamp: July 01, 2023, 11:27:37 am
content: Hi lecatron07,Your "Problem" resembles:https://www.eevblog.com/forum/repair/tektronix-dpo-6ghz-scope-issue-broken-bga-ball-connection/Fixing it could be a difficult.Succes,Calibrationfixture

author: lecatron07
author_rank: Newbie
timestamp: July 03, 2023, 06:42:47 pm
content: yes i was going to send my scope to reball the adc chips but im scared it will create bigger problem since the board size is big and not every one have a big heating plate for this type of boardbut i got an idea from a friend to put something that will keep pressure on the chip as it is mentioned in the post you provided . this will be more convince because my scope need a light touch to make the channel work perfectlywhat do you think ?>do you have any idea or someone you trust to re-ball the chips im in michigan USAim open to any idea

author: calibrationfixture
author_rank: Regular Contributor
timestamp: July 04, 2023, 07:30:24 am
content: Hi lecatron07,I should contact mikehank (maybe you have done it allready).Succes,Calibrationfixture

author: charlyd
author_rank: Frequent Contributor
timestamp: February 28, 2024, 06:15:36 pm
content: Hi what about collecting info on the errors i mean to say write up a post here with the solution you did related to the ACQ error number. from the picture.i myself have a board with error 343 ADC inputs. and a board with 321 paDMA ?and i saw error 361 and 362

author: calibrationfixture
author_rank: Regular Contributor
timestamp: February 29, 2024, 06:51:54 am
content: Hi charlyd,I assume you read this Post:https://www.eevblog.com/forum/testgear/mso70404-spc-failure/msg4519094/#msg4519094Member dxl (not very active, but many Thanks) succeeded in partly fixing HW Errors without soldering! Wow.Calibrationfixture