Fluke/Tektronix Bushealth Code: 192C/196C/199C/215C/225C/190 (I & II)  - Page 1
Forum section: electronics / testgear

author: patpat
author_rank: Contributor
timestamp: October 01, 2024, 06:07:07 pm
content: FlukeBushealth v1.0 2024Provided the Scope SN it creates the Bushealth CodeIt works on Fluke and Tektronix* Scopes with bushealth capable firmwareFluke 192C/196C/199C/215C/225CFluke 190 - 062/102/104/202/204/502/504 (Series I & II)Reaching the Bushealth Install screen:Fluke: USER -> VERSION & CAL -> F1Usage:FlukeBushealth -s SerialNumberExamples:FlukeBushealth -s DM9010124Options:-h, --help Get help-s, --Serial Scopemeter SerialVirusTotal again gives positives,https://www.virustotal.com/gui/file/c715fce191c28dc591854ebf0ec94f0f14ce8349f69e217ec8a177640f40f713but this just came out from my Microsoft VSI tested on my 199C USA w/ firmware 8.04 and it worked w/o issues,if it does not work for you just let me know model, firmware and serial.PatFlukeBushealth_1.0.zip SHA-2 (256) = 3CA7CF5A99A1E36A50262914F3C64314F47AD6F0D69B29A31061F416467CBB41

author: squadchannel
author_rank: Frequent Contributor
timestamp: October 04, 2024, 01:13:13 am
content: hi pat.I hope it works on THS, but I can't find the hidden menu.I was messing around with commands from serial yesterday and found some data dumped by the qc command.It outputs an undocumented command list.qc mean "quality control"? hmm...Code:Universal Host Mask software; UHM V3.0��0123456789ABCDEF����BaudregRead : BR<cr>BaudregWrite : BW<dddd><cr>EXtension cmd : EX<exnr>,<...>Fill Mem Byte : FM<hexAddr>','<hexLen>','<bb><cr>Fill Mem Long : FL<hexAddr>','<hexLen>','<llllllll><cr>Fill Mem Word : FW<hexAddr>','<hexLen>','<wwww><cr>Call program : GO<hexAddr><cr>Get Binary Byte : GB<hexAddr>','<hexLen><cr>Get Binary Long : GL<hexAddr>','<hexLen><cr>Get Binary Word : GW<hexAddr>','<hexLen><cr>IDentity : ID<cr>Put Binary Byte : PB<hexAddr>','<hexLen><cr><B...B><cr>Put Binary Long : PL<hexAddr>','<hexLen><cr><LLLL...LLLL><cr>Put Binary Word : PW<hexAddr>','<hexLen><cr><WW...WW><cr>Reset Instrument: RI<cr>Read hex Byte : RB<hexAddr>','<hexLen><cr>Read hex Long : RL<hexAddr>','<hexLen><cr>Read hex Word : RW<hexAddr>','<hexLen><cr>Write hex Byte : WB<hexAddr>','<hexLen>','<bb...bb><cr>Write hex Long : WL<hexAddr>','<hexLen>','<llllllll...llllllll><cr>Write hex Word : WW<hexAddr>','<hexLen>','<wwww...wwww><cr>��HOI (c) Rob van de SchepopThe dumped data is attached.I also tried to see if I could read the contents of the flash that should have been assigned to $4000 0000 using the RB command, and sure enough, there was data, but not the data I expected.It seems to be different from the contents of the flash. I am not too familiar with CL-PS7111 or arm.MOD:overflowing.enter GO40000000 on UHM, boot from flash. No doubt $4000 0000 would be flash.

author: patpat
author_rank: Contributor
timestamp: October 04, 2024, 04:16:01 pm
content: Hi squadchannel,FlukeBushealth v1.0 has been tested on my Fluke 199C USA and it worked as intended.Looking at the firmware I inferred it should also work on the Fluke 190 and Tektronix THS3000 lines.As you see Tektronix serials are longer numbers and FlukeBushealth 1.0 as-is has a sign issue in this case.I need to see the code a bit more to fix this but first I want to reach Tektronix Bushealth install screen (if possible) but I'm also stuck not finding the way.Regarding serial communication, the codes you found seem they might run in Mask Mode?I tried in regular mode the RB (Read Byte ) command on my THS3024 and it always return error 1.I booted my THS3024 in Mask Mode (Power-on the unit holding the up and right arrows and hearing a soft beep)but then I couldn't establish the serial connection with the scope, are you able to communicate in Mask Mode with your THS3024?Regarding Fluke options alternatively I found the sequence of Serial commands that would enable the following 3 features* Medical* Bushealth* Medical + BushealthThe command sequence is contained in the file cpl.bin within the firmware updater with Bushealth enabled, once decrypted with FlukeFlashTool2txthttps://www.eevblog.com/forum/microcontrollers/fluke-19xbcii-tektronix-ths30143024-flashtool-ini-cpl-bin-deobfuscatorit givesCode:EMMAINTENANCECI 12,0CI 13,confixCI 14,0CI 17,110195CI 18,yCI 320,NRCEOThe line:CI 17,110195 => Enables Bushealthbut alsoCI 17,271267 => Enables MedicalCI 17,161027 => Enables Medical + BushealthNote: It is good to mention that enabling the Medical "software" features on a unit will not improveany electrical feature like CAT Safety Ratings, AFAIK the medical units have higher CAT ratings.CI (Configure Instrument?) is a multi function command, the first number is the function number, followed by a single parameter.The number 17 deals with the scope software options.So far I do not know the rest of commands.This data comes just from looking at the code, I haven't tried myself, sure the CI 17,xxx command might need one or more commands in the sequence to work,I know the code is identical in Tektronix then it could potentially work with the THS3024.BestPat

author: mahi
author_rank: Regular Contributor
timestamp: October 04, 2024, 06:21:57 pm
content: Just tested on a 2009 Fluke 196C with firmware 8.04 and it worked great! The Bushealth feature is now available under the Recorder menu.Thank you!

author: squadchannel
author_rank: Frequent Contributor
timestamp: October 05, 2024, 05:37:05 am
content: hi patpat.can communicate with THS in mask mode by pressing the up button, right button and power button as in fluke, listening for a weak beep, and entering many “X ” at the terminal.trying the commands for several hours.What we know so far is,Code:EM = Engeneering ModeFLUKEUHM = reboot UHM (after EM command)MAINTENANCE = entry calibration mode (after EM command)CI = change instruments? rewrite the value of the QI command.RC = rewrite calibration?EO = ? calibraion menu closes.? engeneering mode closes?CI commands can be used after the EM and MAINTENANCE commands have been executed.RC command is supposed to override the calibration, and EO closes the calibration menu.after entering the EM and MAINTENANCE commands (while entry the calibration menu), the QC command seems to output the calibration data inside flash. but, there is a slight difference compare flash data.CI 17,110195 command, does not change on the THS.although I can indeed see the number change at QI 17.THS3024:CI/QI 10 is model nameCI/QI 11 is serial numberCI/QI 12 is serial number(same #11)CI/QI 13 is board serial numberCI/QI 14 is CI and QI command not allowed.CI/QI 17 ?CI/QI 18 ?CI/QI 320 ?these commands only work UHM mode.QuoteRB commands, for exampleRB40000000,100reads 100 bytes from $4000 0000.

author: patpat
author_rank: Contributor
timestamp: October 05, 2024, 05:02:23 pm
content: Hi squadchannel,I finally connected to the Mask Mode, I forgot the sequence of "X"!I think the pair CI/QI is Configure Instrument, Query instrument.If I call in my THS3024 Firmware V01.02 I correctly getQI 17 -> 1RB44097761,1 -> 00From firmware I see that the commandsCI 17,271267 => Enables MedicalCI 17,110195 => Enables BushealthCI 17,161027 => Enables Medical + BushealthBut they really end up writing a single byte position of flash as follow:44097761 = 00 -> No Options44097761 = 01 -> Medical44097761 = 02 -> Bushealth44097761 = 03 -> Medical+BushealthWhat I do not know if there's any command that Recalculates the Checksum/s after altering the Instrument configuration, probably RC?.I'll be able to check this on my 119C as soon as the adapter for my IR189 adapter comeshttps://www.printables.com/model/1017246-fluke-scopemeter-adapter-for-ir189usb-cableYou did CI 17,110195 in your THS3024?what do you see if you do the following commandsQI 17 ?RB44097761,1 ?I do not have a back up of my config that's why I'm a bit cautious about testing these command,I understand you have one from your repairing thread.The RB command could be a valuable tool for a back up utilityWe need to completely understand the memory map.Best,Pat

author: squadchannel
author_rank: Frequent Contributor
timestamp: October 06, 2024, 02:59:05 am
content: Quote from: patpat on October 05, 2024, 05:02:23 pmI think the addr is different.RC command seems to be accepted in maintenance mode.we want someone who understands ARMv3....

author: patpat
author_rank: Contributor
timestamp: October 07, 2024, 11:32:59 pm
content: These findings are consisting with what I see in firmware:CI 17,0 / QI 17 = 0 => NoneCI 17,271267 / QI 17 = 1 => Enables MedicalCI 17,110195 / QI 17 = 2 => Enables BushealthCI 17,161027 / QI 17 = 3 => Enables Medical + BushealthI think the address of the variable 0x44097761 is the right one.The problem is the command "RB" which reads whatever. So far I couldn't make any sense of what it provides,especially looking at the address 0x40000000+ that is where the known firmware binary is installed.I'm not an ARM "expert" but the problem understanding the code is not the assembler but the complex flow+convoluted code.

author: squadchannel
author_rank: Frequent Contributor
timestamp: October 08, 2024, 12:42:13 am
content: believe that the contents of the flash are assigned to $4000 0000.but, rb to $4000 0000 from the initial state does not seem to get valid data.After the EM and MAINTENANCE commands, data “close to flush” from $4000 0000 can be read.To begin with, does series2 have an option key menu?10/08/24 11:43 am MOD:I found the cause of the difference between the internal flash and the value when using gb.There was a problem with the dump method I was using, I was dumping with stdout in cmd with plink software which can be used on the putty command line, but either plink or stdout specs were dumping with some of the binaries missing.

author: patpat
author_rank: Contributor
timestamp: October 08, 2024, 03:19:28 pm
content: About the read byte command RB this is what I found so far testing on the THS3024 and 199CBooting inMASKmode:The command without a space takes 2 hexadecimal parameters i.e.Code:RB40000000,100Returns just the hexadecimal values.but the readings are not as expected, probably in MASK mode the MMU is not set, hard to tell.Booting inFIRMWAREmode:The command before its first use requires to enter the sequenceCode:EMMAINTENANCEThe command with a space takes 2 "decimal" parameters i.e.Code:RB 1073741824,25Returning hexadecimal values as follow#H112233445566778855555555AAAAAAAA33333333CCCCCCCC0Fwhen finishing using RB we go back sending the sequenceCode:RCEOIn this case the value 1073741824 (decimal) is equivalent to 0x40000000 (hexadecimal C notation) and #H40000000 (hexadecimal Assembler notation)and we get 25 bytes in hexadecimal notation that now perfectly match the first 25 bytes of the firmware imageKnowing all of the above I checked the value ofCode:RB 1141471073,11141471073=0x44097761it should've been 02 (Bushealth) but I got 00 then I need to work on this more.Edit 01: I look further and I stand corrected, the correct address is0x4409B555=1141486933 and correctly holds 0,1,2 or 3 depending on the CI 17,xxxx commandRegarding the Fluke 190-xxx II, I do not know if it has a "Install Bushealth Option" screen, it would be good to know from some reader having one of those.Is anyone out there? The screen can be reached by pressing the User button, then Version & language (F3), then F1 and see if a screen asking for aBushealth code shows up or not. ThanksI just received the optical adapter, I connected to my Fluke 199C which has installed Bushealth with a code and I checkedCode:QI 14and it also returned error 1 like the THS3024The Fluke 199C Bushealth Firmware install sequence sets CI 14,0 but this apparently wouldn't be unnecessary;some involuntary error, or there's some sort of trick here.

author: squadchannel
author_rank: Frequent Contributor
timestamp: October 08, 2024, 06:15:06 pm
content: hi pat.I will read your reply later. I am terribly tired.For now, I am attaching the software to dump flash using the GB command.How to use:Code:gb comport baudrate dump_address dump_size dump_filenameex) gb com3 9600 40000000 1000 dump.binIt is still incomplete. I will resume work when I wake up.I am not sure if it works in all environments. It works on my machine.You should monitor it with doclight and com0com.Note: Do not update firmware while using doclight. It will corrupt the flash.If you just want to dump a few bytes, don't use it.This software is designed for backup purposes.Good night, 3 am in japan.

author: squadchannel
author_rank: Frequent Contributor
timestamp: October 14, 2024, 04:01:43 am
content: Serial communication sniffed at THS/Series2 internal FTDI chip and isolator.460800baud.run firmware update with sniffed.EXTENSION DATA in the .idf of the updater is the binary needed for the update, as has been said before.EXTENSION COMMAND TABLE appears to be a command that can be used after the EXTENSION DATA are loaded.In the sniffed dump data, the CF and PF commands for ENTENSION COMMAND TABLE are used. maybe:Code:CF: Clear Flash?PF: Put Flash?Can only be used in EXTENSION. Cannot be used in normal mode or UHM.EXTENSION DATA should not be run. I broke the flash again.Also:Code:WC: Write Calibrationalso found out new commands.Code:No DiskeeEEFWVMAIN 03.68-324VDPSFRPRG 1.00RD:\>These commands have nothing to do with updaters.communication for USB memory devices is also done via the same serial bus.

author: patpat
author_rank: Contributor
timestamp: October 14, 2024, 06:12:05 pm
content: Interesting data,do you know if it is possible to back up and restore calibration data?if not we'll keep breaking things, I also screw up the 199C cal ;-)I'm still analyzing the THS code, trying to make sense of the NUCLEUS RTOS, it has a pipes, the Keyboard uses pipes, hopefully finding where the keyboard input is handled.I was thinking; do you think THS can run Fluke's 190 II firmware?? The keyboards are not identical the  button is missing.Patching the Fluke updater checking serials and things like that should be a joke.The 190 II firmware has progressed much more than the THS3000.https://www.fluke.com/en-us/support/software-downloads/fluke-190-series-ii-2-and-4-channel-instruments-with-firmware-version-v0900-onwardsTHS' v1.10 corresponds to Fluke's V10.41

author: smaultre
author_rank: Regular Contributor
timestamp: October 15, 2024, 10:33:16 pm
content: My little addition, QI (like a querry ?) and (RI)(like "write on", or maybe WI?) as i remember more than two years ago..So we can read and write serial and models numbers.But changing the models numbers, does not affect on performance GS\s..

author: patpat
author_rank: Contributor
timestamp: October 16, 2024, 12:18:41 am
content: The pair is QI/CI, I thinkQueryInstrument andConfigureInstrumentI have changed Model and Serial w/o issue.QI works on OS modeCI requires the maintenance modeCode:EMMAINTENANCECI xx1,yyy1CI xx2,yyy2...RCEOManually entering commands in maintenance mode is very easy to make mistakes, we need to be careful in this modeBest,Pat

author: smaultre
author_rank: Regular Contributor
timestamp: October 16, 2024, 06:44:19 am
content: Yes! Thank you Pat!!Additionally some data dumps from COM port to explain how application updates firmware Fluke 199 seriesYou can backup and restore cal data and config by QC\WC on Fluke 199Code:00SO1PC 192000IS026696ID0FLUKE 199C;V07.06;2008-01-23;ENGLISH,FRENCH,SPANISH,PORTUGUESEQI 11013150000..00SO1PC 192000IS014408ID0FLUKE 199C;V07.06;2008-01-23;ENGLISH,FRENCH,SPANISH,PORTUGUESEQI 11013150000EM0MAINTENANCE0QI 100199CQC0"HERE CONFIG"EO0EM0FLUKEUHM0XXXXXXXXXXX0WW10000000,4,00020002000200020WB44000000,200,10402DE9000000EB1080BDE810402DE96E0500EB060600EB2D0600EB5C0600EBEB0900EB440A00EB500A00EB1080BDE8104F2DE90080A0E148999FE524C099E500005CE30500000A883088E038C99FE50331A0E10C0093E7140000EB120000EA883088E020C99FE50331A0E10CB093E700A0A0E30B00A0E11F0100EB010050E30100A0030800000A00C99FE58AC18CE004C09CE501A08AE20BB08CE030C099E50C005AE1F2FFFF3A0000A0E3108FBDE8B04F2DE90080A0E1ED0000EAD0289FE503C0C8E3FF10A0E300C082E5FF1881E200108CE500C092E55030A0E300108CE500C092E5053683E200308CE53030A0E300C092E5033683E200308CE5D030A0E300C092E50D3683E200308CE580B0A0E302B58BE200C092E500909CE50B3009E00B0053E1FBFFFF1A4000A0E300108CE500C092E5010580E2000019E100108CE50700001A20E0A0E302E68EE20E0019E10300001A10C0A0E301C68CE20C0019E10100000A0100A0E3E20000EAE00000EA1C289FE503C0C8E3F010A0E300C082E50F1681E200108CE5FF5FE0E300C092E50F5B45E2559FA0E305C00CE0059B89E2AAE0A0E309708CE1AAE88EE200E087E500C092E5AAAFA0E305C00CE05500A0E30AAB8AE20AC08CE1550880E200008CE500C092E580B0A0E305C00CE009708CE102B58BE200B087E500C092E505C00CE009708CE100E087E500C092E505C00C........."HERE FLASH"........RI0.00PC 192000EM0MAINTENANCE0WC0"HERE CONFIG"00RC0CI 10,199C0RC0EO0ID0FLUKE 199C;V08.04;2009-11-05;ENGLISH,FRENCH,SPANISH,PORTUGUESEEM0MAINTENANCE0CI 12,00CI 13,confix0CI 14,00CI 17,1101950CI 18,y0CI 320,N0RC0EO0RD01995,1,1WD 1995,1,10IS024648WD 1995,1,10GD0...And from R&S FSH3 seriesYou can backup and restore cal data and config by QC\WC on R&S FSH3 seriesCode:D@00IS024672EM0maintenance0PC011520001152000IS08289ID0Rohde&Schwarz,03,1340102000,V7.20,2004-08-31 13:39:50,WORLDQI04002QI01101340102000QC0"HERE CONFIG"EM0galaxy0XXXXXXXXXXX0WW10000000,4,00020002000200020WB48000000,200,10402DE91040BDE8FFFFFFEA10402DE9050500EBA00500EBCD0500EBF60500EBD30800EB2A0900EB1040BDE8330900EA00472DE90090A0E1893489E0033189E08331A0E18CC99FE50CC093E700005CE3893089E00331A0E17CC99FE50200000A0C0093E7160000EB140000EA0CA093E70080A0E30A00A0E12F0100EB010050E30100A0030D00000A893489E0033189E08331A0E144299FE502C083E088C18CE028C09CE50AA08CE0018088E21CC082E20CC093E70C0058E1EDFFFF3A0000A0E30087BDE800472DE90080A0E100E0A0E30000A0E3803080E00331A0E1F8189FE5032091E7020058E10B00003A04C081E20CC093E702C08CE00C0058E10400009A08C081E20CC093E702C08CE00C0058E10100008A01E0A0E3010000EA010090E2EBFFFF0A00005EE32800000A2E0200EB020C50E3E50000BAED0000CA2B0000EA03C0C8E398189FE500C081E5FF30A0E3FF3883E200308CE500C091E500308CE55030A0E3053683E200C091E500308CE53030A0E3033683E200C091E500308CE5D030A0E30D3683E200C091E500308CE54C189FE500C091E500209CE58030A0E3023583E2030012E1F8FFFF0AFF30A0E3FF3883E200308CE500C091E500308CE54000A0E3010580E2000012E17300000A0100A0E3040000EA10C0A0E301C68CE20C0012E1F9FFFF1A0000A0E30087BDE803C0C8E3E8179FE500C081E5F030A0E30........."HERE FLASH"........RI0tD00IS024672PC0192000192000EM0maintenance0WC0"HERE CONFIG"WD02020,9,110WT01,28,500ID0Rohde&Schwarz,03,1340102000,V14.0,2011-01-24 09:59:28,WORLDRI0DD00IS024672Maybe we can also enable options on R&S as FSH3 -TV??

author: squadchannel
author_rank: Frequent Contributor
timestamp: October 16, 2024, 09:12:15 am
content: helpful information. Thanks.I am currently working on a flash dump and restore tool for THS.As you know, Fluke's scopemeter series(early. 5-button), Tek's THS3000 and Rohde's FSH(early. 5-button) are based on the Fluke “Spider” chipset.Therefore, it is also obvious that they are equipped with the exact same UHM software.I was convinced when I saw the FSH firmware today. It is exactly the same update tool, Flashtool.ini encryption.wait a little longer.Currently, i know that the adjustment data that can be obtained by the QC command after entering the MAINTENANCE mode is slightly different from the data written by the WC command.The adjustment data sent by the WC command is divided into blocks (3E3h for THS3000), and a header is added to the beginning of each block, and a checksum is added to the end of each block, which is then sent to the scope.The scope side checks the data received by the WC command against the checksum, and if they match, only the "real" adjustment data without the checksum is written.Flashtool.exe also generates a file with a .CAL extension in the Temp folder.In the case of the THS3000 updater, inside you will find the results of QI10, 11, and 12 runs and the adjustment data obtained by the QC command.It will be deleted after the updater is completed, but if you backup it during the update, it will be useful in case something goes wrong.It won't mean anything once the update is done, though.If I go into too much detail, it would get out of the scope of this topic, so I'll leave it at that.Not sure about the options, maybe they can be unlocked via serial commands, like bushhealth on Fluke's C-series.Or if there is a menu to enter a code to unlock an option similar to the Fluke scope, there may be a way to generate a key.I too would like to know how patpat's keygen works.If you don't mind, could you attach the sniffed data? You may exclude the adjustment data.

author: patpat
author_rank: Contributor
timestamp: October 16, 2024, 10:40:21 pm
content: @smaultreNot having the units connected now, then you sayQC/WCQueryCalibration /WriteCalibrationQC and WC deal with pure ASCII or a binary blob? knowing this correctly is critical for developing a good Calibration BackupDo you know links to current firmware for the R&S FHS3/6 family?Edit01: Found it.@squadchannelI agree with you about the same firmware but to be 100% certain we should compare bothTHS3000_FW_v0102_Installer.zipFlash_190II_V10_41.exeboth versions are "symmetric" because both fix the same "Safety Notice and Recall" of the previous FW version where the voltagereading could've been wrong by a factor of 10.We have THS3000_FW_v0102_Installer.zip; so far I couldn't findFlash_190II_V10_41.exe(archive.org is down)The differences between whatQCgives andWCtakes are critical for developing any serious back-up software.I think there should be a binary oriented pair of commands just taking a binary blob, that's what I think we need to find and it seems QC/WC is not the answer.Do you know if WC takes a binary blob? dividing it in 0x3E3 chunks and adding checksums makes sense in order to validate the unreliable serial connection.I do not know if this segmentation is also valid for the Fluke 199C family.BTW when you say -adjustment data- you mean "Calibration Data" right?About options on the THS3000, I already tried using the serial approach with CI 17, and the rest of CIs commands found encrypted in the cpl file for the 199C family updater but they did not work.I emailed people owning Fluke190-204 II and they also "cannot" find the Bushealth Code screen, then things are challenging.Now I'm looking at assembler, I found some phone fw image using a similar version of Nucleus Plus (RTOS) that had debug info on it then that helped a bitfinding the keyboard pipe, function handlers etc, much better than before but still pretty cryptic, let's see.The point today is understanding if the Bushealth Code screen is reachable or the access is removed in the 190/THS3000 familyAlso if there's some other CI command that is necessary not only the CI 17, for the serial approach to work in this caseWhat "sniffer" data do you need? you can send me PM (I think).Best,Pat

author: squadchannel
author_rank: Frequent Contributor
timestamp: October 17, 2024, 03:46:47 pm
content: I would like to see the entire sniffing data that smaultre posted. It would be helpful if you could attach it.Because the commands in the updater only use 2 (CF,PF) of the 7 EXTENSION COMMAND that are defined.know if this is only the case for THS3000.I tried writing the 190II_V11_46 binary to the THS3024. It works fine.I also tried writing the calibration data to the 11.46'ed 3024. It is recognized normally. No error also appears.It is safe to assume that the pcb are exactly the same. However, the keypad layout is different from 190II. It is not usable.At present, are in a situation where I can analyze the data without worrying.It is no longer necessary to go to the trouble of soldering a flash to write. Everything can be solved with serial commands.The waybackmachine is provisionally available.was available to some extent from the archived fluke site., but could not get the 10.41 updater.11.10 was available, which is the next oldest after 10.41.The updater I was able to obtain is attached.Difference between data in qc and wc:Code:23 30 80 03 E3is added at the beginning.Code:03 E3is the chunk size.Then, for each chunk,Code:?? ?? 0D 30 0D 23 30 80 03 E3continues to the end. The last chunk has a different size.I believe that the two bytes indicated by "?" are calculated with some kind of checksum. It is different for each chunk.The updater adds 0D for each completed transmit(each chunk).This is the same behavior as when writing to flash with the EXTENSION command.Code:30 0Dis not relevant. I believe it is a ACKN response from the scope.The way I dumped it, I put TX and RX in an AND gate and receive with a separate USB serial adapter. So all data sent and received is sniffed.Also, the firmware of the internal PIC microcontroller was found to be included in the flash dumps and LDFs.there seems to have been an update to that in V11.20.The comma-separated first part of the subversions shown in the scope's VER&CAL is the firmware version of the PIC microcontroller; the second is the firmware version of the FTDI VNC1L.Just to be safe, I dumped the firmware of the PIC microcontroller with TL866 before applying 11.46 to THS. attaching it in case it fails, but can probably extract it from the updater LDF file.

author: patpat
author_rank: Contributor
timestamp: October 17, 2024, 11:13:08 pm
content: @squadchannelYou uploaded 190II_V11_46 binary to THS3024:How did you do it? burning Flash or serial?Remember editing the flashtool.ini of the 190II_V11_46.exe with the decrypting toolshould be enough for flashing the scope in the regular way.You say that the THS with Fluke FWis unusable: why?wouldn't be just like using a Fluke 190 only in "Scope" mode (No Meter Button)?I carefully tried understanding the format of the packet but it is not clear, do you have WC command capture to attach?In your sniffing capture you should seeCode:WC20...0Dsome ASCII to remember0D Carriage Return20 Space23 #30 031 132 2...39 9Now could you please describe the  and the thanks@smaultreI looked at the FHS code I clearly see the following features1 DEMO2 B13 K24 K15 K36 K217 K228 K49 K60A K15It seems each pin is also a 10 digit number, different pins should enable different feature always based on SN of course,Are you able to reach the Feature Pin window?Best,Pat

author: squadchannel
author_rank: Frequent Contributor
timestamp: October 18, 2024, 12:24:45 am
content: Quote from: patpat on October 17, 2024, 11:13:08 pmSerial. can write by using EXTENSION COMMAND.I have tried the write commands available in UHM mode, such as PB and WB, but they do not seem to work for flash areas.0 is returned for ACKN, which seems to be normal, but when I read it in RB, it is not written.Quote from: patpat on October 17, 2024, 11:13:08 pmit will work if I rewrite flashtool.ini, but the EXTENSION COMMAND is different for the 190II and THS.Since we do not know how this will affect the scope, used the THS one for EXTENSION COMMAND and the 190II one for the data to be written.Quote from: patpat on October 17, 2024, 11:13:08 pmAs mentioned, the keypad layout is different.It can be used to some extent, but the lower buttons(v) on the trigger level serve a different purpose.If the keypad layout can be changed, it can be used.Waveform acquisition is working fine, as is saving, etc. Calibration data can also be used without modification from THS.WC and RC data is attached in #18.https://www.eevblog.com/forum/testgear/fluketektronix-bushealth-code-192c196c199c215c225c190-(i-ii)-ths3000/msg5680847/#msg5680847If it is all data, it is in #11.https://www.eevblog.com/forum/testgear/fluketektronix-bushealth-code-192c196c199c215c225c190-(i-ii)-ths3000/msg5677207/#msg5677207

author: patpat
author_rank: Contributor
timestamp: October 18, 2024, 01:32:04 am
content: This is the WC command format in hexwhere each chunk is of the form...nnnn=payload sizexxyy=some sort of checksumEdit01The capture not making distinction between TX and RX bytes makes me think that the previous Trailermight include an ACK from the scope then could be{Scope ACK}{0D300D}...{0D300D}

author: squadchannel
author_rank: Frequent Contributor
timestamp: October 18, 2024, 08:33:58 am
content: In 190II firmware, BUSHEALTH can be enabled with the CI 17 command; Medical does not seem to be enabled.However, when in BUSHEALTH mode, the screen whiteouts. it is possible to turn BUSHEALTH off with the F4 key.It appears to be an incomplete mode.The CI 14 command rewrites $4000816C by 2bytes.I tested this on a V11.46'ed THS3024. Not sure how it works with the real 190II.mains voltage in japan.It is unfortunate that the METER mode is not available in THS firmware.CI 14 is a command that can limit the languages that can be selected. $4000816C 2bytes change.THS uses a different language list than 190II. (not available S.CHINESE and T.CHINESE in 190II)the CI 60 can change the input type of the scope.0=4ch1=2ch+DMM2=4chCI 60 command rewrites $400080BF by 1bytes.2ch+DMM is a model with both DMM and scope functions.set to CI 60,1 (2ch+DMM), the DMM mode can be used in THS.I could not measure the resistance, but it beeps in Continuous mode.I immediately put it back in because I think I will break the frontend if I go too deep. (THS is 0.)

author: patpat
author_rank: Contributor
timestamp: October 18, 2024, 01:56:26 pm
content: Good Findings,ConfirmedCI 17,110195is the way to activate Bushealth in Fluke both 199C and 190 families,I wonder if THS having a different UI even has the option available or it was never included.When is the blank screen triggered? does it on its own or after some keyboard interaction?I can also confirm that the "Medical" option does not work on 199CIn THS there's not  button but I wonder if there's not Serial commands controlling the UIBest,Pat

author: squadchannel
author_rank: Frequent Contributor
timestamp: October 18, 2024, 02:14:47 pm
content: The Meter button unfortunately resides in a key matrix that is not assigned in THS.The red text is where it differs from THS.When BUSHEALTH enters the mode, it automatically starts the diagnostics.The program for that diagnostic screen seems to be incomplete and appears to be a white screen.It seems that the screen is only white, but the keys can be operated, and pressing the F4 key to turn it off will return the screen to its original state.Also, the scope gets stuck when WIRING INFO is pressed. Overall bushealth mode seems to be an incomplete program.

author: patpat
author_rank: Contributor
timestamp: October 18, 2024, 03:35:32 pm
content: I remember the complete sequence for the bushealth feature on 199C wasCode:EMMAINTENANCECI 12,0CI 13,confixCI 14,0CI 17,110195CI 18,yCI 320,NRCEOdid you try the whole sequence and see if the feature behaves correctly?Now we'd need to know of a real Fluke 190 owner running the sequenceand see if they get a healthy Bushealth or not.

author: squadchannel
author_rank: Frequent Contributor
timestamp: October 18, 2024, 04:18:09 pm
content: Unfortunately, it does not work. It remains with a white screen.Is the firmware, a lot of diversion of the previous model 190C, or is it incomplete? I wonder.It seems that even the print menu are left.v11.10, doesnt work.

author: asis
author_rank: Frequent Contributor
timestamp: October 19, 2024, 06:52:41 pm
content: Hi,@squadchanne@patpatI'm watching your work with interest.Quote from: patpat on October 18, 2024, 01:56:26 pmIn the list of remote control commands there is KY (KEYBOARD mode).In combination with digital values ​​(KY space xx) it can be useful.The meaning of the commands KY0 -- KY35.... is too extensive to describe everything.-FLK 199C/225C V08.04COM x_1200_Non_8_1-For example:KY 0 - turns on/off SCOPEMETER.KY 17 - reduces the sensitivity of the input signal of channel A (down 1KV -> 20mV) in MANUAL mode.KY 35 - switches READINGS ON/OFF; channel A input ON/OFF.If you have activated SW FlukeView SW90W_5.4, you can control the scope via the Remote Control function.FlukeView is also very helpful in creating current reports.

author: FlexibleMammoth
author_rank: Regular Contributor
timestamp: October 19, 2024, 08:04:09 pm
content: Quote from: patpat on October 08, 2024, 03:19:28 pmI have one, there is no Bushealth installation screen. At the specified location, there ist the "Battery Information" screen.

author: patpat
author_rank: Contributor
timestamp: October 19, 2024, 09:45:25 pm
content: @FlexibleMammothThanks, if you feel confident you could add the feature using the console access by running:Code:EMMAINTENANCECI 12,0CI 13,confixCI 14,0CI 17,110195CI 18,yCI 320,NRCEOPlease consider it seems Bushealth in the 190 could be an "unfinished" feature, we are not totally sure,squadchannel tested it only on a THS3024 with Fluke Firmware but we do not know what happens on a real 190 unit@asisI knew that feature should've been there ;-) if you got the whole mapping of the 35 keyboardcommands could you past them here?@squadchannelI took a bit of time and I saw the code of the FlashTool.exe both Fluke 19xC and Tektronix from last versionsFlashTool_19xC_2xC_V804.exeTHS3000_FW_v0102_Installer.zipI have to check 190 updater but I bet is like TektronixI looked after the WC command: Tektronix splits the data in packets as you saw in your capture, Fluke does not.I saw the CRC routine, everything is there and I could code a back up app but I did something faster.I patched Tektronix FlashTool.exe into Tektronix FlashTool Cal.exe.This new exe saves the calibration file SerialNumber.CAL not under Windows Temp but in the same directory where theflashtool.exe resides plus it saves the CAL file as ReadOnlyThen when the application tries to delete the calibration file at the end of a firmware upgrade it will fail leaving the file there.When the application is run again sees that the cal file is present and it'll understand there was a failed firmware upgrade beforeand it will resend the CAL file to the instrument.This way we have a Calibration back up FlashTool application.This is a bit theoretical just seeing the code, I did not test it myself, if you test it working I can do also the same for the FlashTools of 19xC and 190 Fluke families.Best,Pat

author: FlexibleMammoth
author_rank: Regular Contributor
timestamp: October 20, 2024, 04:11:08 pm
content: Quote from: patpat on October 19, 2024, 09:45:25 pmThanks for the code, at the moment I am looking to sell my Fluke so I'd rather not ruin itIf it does not sell, maybe I will. I still really hope it sells though, since I cannot justify having 2 handheld oscilloscopes.

author: zrq
author_rank: Frequent Contributor
timestamp: October 20, 2024, 06:56:48 pm
content: Have anyone looked into possibilites of bandwidth upgrades?

author: patpat
author_rank: Contributor
timestamp: October 21, 2024, 12:32:36 am
content: CI/QI 10 is model nameCI/QI 11 is serial numberCI/QI 12 is serial number(same #11)CI/QI 13 is board serial numberQI Query instrumentCI Configure Instrument (this command requires entering into the "Maintenance" mode.I've changed them w/o issue but I never measured the bandwidth.if you have a 192C change the model to 199C and check the bandwidth..The bandwidth could also be encoded somewhere else like SN or board SNBest,Pat

author: squadchannel
author_rank: Frequent Contributor
timestamp: October 21, 2024, 12:28:02 pm
content: hi patpat.if you have a SG that can output up to 200MHz, I have something I would like you to test.I found a QI25 command that I think is related to bandwidth, but it caused a problem with my THS.if set it shorter than 40ns at 500mV and input more than 150MHz, the scope crashes.I am trying to determine if this also occurs with patpat's THS (firmware problem), if there is a problem with my recovered calibration data, broke it with a QI25 command, or if there is a hardware failure.Also attached is a scope meter tool that is under development.Drag and drop dumpcal.cfg to SCMTool.exe. cal data will be dumped.The serial port can be set in the cfg.You can delete the serial number, and it would be helpful if you attach the dump data.Others should not use it yet.uploading to xdevs etc. is also prohibited.MOD: one hour later...I found the cause of the crash.It seems that the crash (low voltage?) occurs when the battery is not connected and only the adapter is used, possibly due to power consumption.When the battery is connected, it works without any problem.bug found. attached file replace.

author: patpat
author_rank: Contributor
timestamp: October 21, 2024, 03:10:29 pm
content: I do not think a limiting bandwidth software restriction would be selective of amplitude andsure not lead to a crash when triggered. This smells a hardware related issue.I kept reading and I'm now glad you found the culprit.About your SCMTool.exe not clear what it does,does it download a CAL file from the instrument? does it upload it?, just for THS or Fluke too?I lookead at QI/CI 25 they read/write the same memory position, ooks like it takes just a number,but so far I couldn't find any relationship with bandwidth; why do you think is related to it?Best,Pat

author: squadchannel
author_rank: Frequent Contributor
timestamp: October 21, 2024, 04:01:29 pm
content: It is designed for THS, but can be used for other models by rewriting the cfg.You can dump the flash with the attached cfg.Drag and drop the .cfg into the .exe and it should dump automatically.I have not tested fluke and I don't think it works.Just enter UHM mode and execute the GB command.I don't think it will corrupt anything, etc.It takes time because it reads and saves one byte at a time.dumpcal.cfg: Just the cal data backup takes less than a minute.dumpflash.cfg: Backing up the entire flash takes longer, about 5 minutes.It can be write flash, and there is a cfg, but I will publish it after some more research.The reason for CI25 is that the firmware has data that is initialized and loaded when the checksum of the cal data does not match.In the case of THS firmware, the THS3014 data is loaded (maybe. because Model Number for VER&CAL is THS3014).After comparing that data with the 3024 data, we found that CI25 and CI90 are different.CI90 rewrites $4000819C by 2 bytes. Little endian; 1229 for THS3024 and 1230 for THS3014, but what that means is not known.CI25 rewrites $400080C4 by 1 byte; seems to accept 0-3, 2 for THS3024, 1 for THS3014.Tried 0-3, same settings for SG, 250MHz, -20db, forgot to install the 50 ohm terminator.I think 0=60MHz, 1=100MHz, 2=200MHz, 3=500MHz.I forgot to get an image at ci 25,0, almost the same as at ci 25,1.The attenuation will change, but other than that, I can't say for sure. It is very likely that the cal data does not fit either.I also tried CI 25,3 (500MHz?) but nothing changes, it can't reach 500MHz, it is attenuated and completely flat.In order CI 25 1, 2, 3.

author: patpat
author_rank: Contributor
timestamp: October 21, 2024, 08:44:47 pm
content: OK I understand how you program works, you can use GL or GW instead of GB (whatever gives you the most bytes),remember is little-endian, and that should double or quadruple the transfer speed.You can also invoke the UHM mode programmatically by calling:EMFLUKEUHMXXXXXXXXXXXXXXX <<< Send them one a loop one at the time, waiting 20 tickcounts checking for the instrument answer "0"Do your GB/GL/GW stuffetc.that's how FlashTool.exe Does it.About the Cal transfer there are 2 modes specified in the FlashTool.ini fileCAL_TYPE=BLOCKS (default sends blocks as you saw)orCAL_TYPE=Normal (sends w/o blocks)I'll try to see CI25 and CI90 and see if I get any data.Best,Pat

author: patpat
author_rank: Contributor
timestamp: October 23, 2024, 11:08:43 pm
content: I polished a bit the Calibration Backup and Restore tool,.--This tool is able to Backup and Restore Tektronix THS3024/3014 Calibration data.Put all its components under an empty directory and run FlashTool.exe the tool will createin the same directory a read only file named <SN>.CAL i.e. 404025132786.CAL (7Kb for a THS3024).Save your backup file in more than one place.To restore the Calibration data just run FlashTool.exe in the presence of the .CAL file and it’ll beuploaded to the instrument.To get another CAL file just erase the CAL file and run again FlashTool.exeThis tool is just a patched FlashTool.exe preventing the erase of the CAL file at the end of its joband a special FlashTool.ini preventing the upload of any new firmware.I'm also attaching my THS3024 CAL file

author: jds_dapi
author_rank: Newbie
timestamp: June 29, 2025, 01:53:21 am
content: Hi patpat.Along with greeting you, I'd like to let you know that I downloaded the attached .exe to get the code for my Fluke... and it doesn't work on my PC.I'm attaching my device's information so you can send me the code, please.Serial number: DM9390229Model: 199CVersion: 8.04Greetings.

author: ua4yhz
author_rank: Regular Contributor
timestamp: June 29, 2025, 09:24:48 am
content: Quote from: asis on October 19, 2024, 06:52:41 pmThese key codes do not work in Fluke 199 (no letters). Scope returns to terminal - 1

author: patpat
author_rank: Contributor
timestamp: June 30, 2025, 02:47:43 pm
content: Quote from: jds_dapi on June 29, 2025, 01:53:21 amHi, I just downloaded the zip file and the exe works without issue.I just added its SHA-2 (256) to the main post.Please try again.If you wonder about virustotal false positives I already explained that on my first post,If you wonder about the exe's "suspicious" big size (267K), well, the exe is statically linked preventing Microsoft's runtime dlls dependencies.Best

author: asis
author_rank: Frequent Contributor
timestamp: June 30, 2025, 11:46:51 pm
content: Hi,@ua4yhzTry connecting an external power adapter and PM9080 or OC4USB.All operands are entered in the terminal program through a "space" KY (space) 0......35.-The exchange rate in the terminal program must be selected COM xx:1200,N,8,1.If you have changed the exchange rate (PC - PROGRAM COMMUNICATION 2400~57600), then after the end of the current session (switching off), the scope switchesto the default speed (1200b/s) and before starting a new session, you must adjust the terminal program.

author: squadchannel
author_rank: Frequent Contributor
timestamp: July 01, 2025, 01:34:59 am
content: KY command is based on the actual keypad matrix. check the previous posts for 190II and THS3000.

author: ua4yhz
author_rank: Regular Contributor
timestamp: July 05, 2025, 08:36:59 am
content: Quote from: asis on June 30, 2025, 11:46:51 pmOn the 199 (without letter) scope don't work this command. On the 199C work no problem.

author: Twitchy
author_rank: Newbie
timestamp: July 06, 2025, 07:33:58 pm
content: Quote from: patpat on October 18, 2024, 03:35:32 pmI'm a little late to the party, but I spent the last few hours tinkering on my Fluke 190-202 II trying to add Bushealth functionality .(scope is around 2013 vintage) (upgraded to FW 11.46) My 190 also has the battery info menu where the code input would be for the F1 key. I ran the whole sequence above after writing down my QI values for 12,13,14 (I forgot to note my original 18, and 320 values before going through the sequence) and the bushealth menu now shows up, but it also only shows a white screen when you try to launch any of the bushealth items. So the white screen is definitely not limited to the THS3000.

author: squadchannel
author_rank: Frequent Contributor
timestamp: July 07, 2025, 03:22:27 am
content: Yes, the same thing happens when I put the 190II firmware on my THS3000.Although the hardware differs from 190C and B, there are many similarities in the firmware.The code exists and can be enabled, but it does not work because the firmware has not been rebuilding.