Topics

TDS694C nvram and tektool


Ragnar S
 

Hi Gudjon,

(I tried to reply using the Web interface some hours ago, but for some reason that didn’t work. If it later does, I am sorry for the double replies.)

Do I need to flip the nvram protection switch to read the content?
At least I have to boot them with the nvram protection switch flipped on 694C:s with FW v6.3e and v6.4e.
Note that they then get address 29.
Also note that the scope appears more or less dead in this mode, but it responds to GPIB.
I have found versions of tektool that have the address 1 coded in, so maybe on some models or firmware versions they work with the scope booted normally.

I actually just recently modified tekfwtool (and tektool and getcaldata) to work on Linux (and ARM), and published it this morning.
It should be quite possible to make it work on MacOS too, perhaps using macosx_gpib_lib, but I haven’t tried.

You can find it here:
https://github.com/ragges/tektools

Let me know if you need any assistance, or debug output, or something. I have the setup rigged up in front of me, and can test things if you want to.

In my testing, it was quite sensitive to extra commands. For example, a “*IDN?” in NVRAM unprotected mode screwed up the communication.

Best regards,

Ragnar


Ragnar S
 

Hi Gudjon,

This is really funny - I have too played around with tektool (and tekfwtool, getcaldata and tdsNvramFloppyTool) on Linux just the last days, working on TDS 694C:s.

So reading the NVRAM and firmware actually works for you when the scope is booted normally (without having flipped the NVRAM protection rocker switch), on GPIB address 1?
Does writing work too?

I have so far only gotten it to work in unprotected mode (which also sets the GPIB address to 29).

Also, if I leave the "*IDN?" request in the tektool program, it will not work in unprotected mode, so I have commented that out.
I have firmware version v6.3e and v6.4e.

Here is a link to my versions of the programs:
https://github.com/ragges/tektools

Best regards,
Ragnar


Gudjon Gudjonsson
 

Hi all

Thanks for the answers.

On Tue, Dec 31, 2019 at 1:01 PM John Miles <john@...> wrote:

The TDS 694C's in-house code name is reported to be SCREAMER, but that password didn't work when I tried it, either

Also, there are various structs that appear to be used to access hardware fields at specific offsets, but there is no packing applied. I added #pragma pack (1) just as a guess.
I added pragma pack but it doesn't change the hexdump and it is
consistent with the cmd structures with and without the pragma.

George has the program working on a Win98 machine. I asked him to send
me the the debug (-dd) output and I hope that will solve the problem
or
at least give a hint.

Do I need to flip the nvram protection switch to read the content?

Do you know if the the commands used in the program are documented anywhere?

Regards
Gudjon


Stephen Hanselman
 

I looked at my alignment software and that what called out as PASSWORD. I have files for 5xx,6xx, 7xx so I think you’re correct

Regards,

Stephen Hanselman
Datagate Systems, LLC

On Dec 31, 2019, at 01:12, satbeginner <@satbeginner> wrote:

As far as I know,the password is "PITBULL"

Un saludo,

Leo



John Miles
 

Hmm, the image didn't make it (not that it's especially interesting, just a copy of your program's output). Link below:

http://www.ke5fx.com/694.PNG

-- john

I just tried compiling it under Windows, #defining BYTE_ORDER as
LITTLE_ENDIAN. Results seem to match what you obtained:


John Miles
 

I just tried compiling it under Windows, #defining BYTE_ORDER as LITTLE_ENDIAN. Results seem to match what you obtained:







The TDS 694C's in-house code name is reported to be SCREAMER, but that password didn't work when I tried it, either



I did notice that the code has a few rough edges that might merit closer inspection. I had to clear the buffer to zero before I could read the model ID string above, for instance, without a lot of junk characters being appended. Wouldn't be surprised if that were necessary elsewhere.



Also, there are various structs that appear to be used to access hardware fields at specific offsets, but there is no packing applied. I added #pragma pack (1) just as a guess.



I'm a bit short on time at the moment but will try to look into it a bit tomorrow. I definitely wouldn't try to issue any write operations with this code without a very careful review, just a word to the wise.



-- john, KE5FX

Hi again list
A little bit more info, the debug parameter gives a bit of info :)
Running the program gives the following:
./tektool -r nvram.bin -b 0x04000000 -l 0xA0000 -dd
Device Id: TEKTRONIX,TDS 694C,0,CF:91.1CT FV:v6.2e
6D 7B 00 08 04 00 00 00 00 00 02 00
read_memory: response reading failed 1
The hex string seems to be correct but the start address may just be wrong.
Regards
Gudjon


Gudjon Gudjonsson
 

Hi again list

A little bit more info, the debug parameter gives a bit of info :)

Running the program gives the following:
./tektool -r nvram.bin -b 0x04000000 -l 0xA0000 -dd
Device Id: TEKTRONIX,TDS 694C,0,CF:91.1CT FV:v6.2e
6D 7B 00 08 04 00 00 00 00 00 02 00
read_memory: response reading failed 1

The hex string seems to be correct but the start address may just be wrong.

Regards
Gudjon


satbeginner
 

As far as I know,the password is "PITBULL"

Un saludo,

Leo


Gudjon Gudjonsson
 

Hi list

I got inspired by Georges attempts to fix his TDS694C scope and found
the program "tektool" to read the NVRAM content and added it to my
GitHub page.

https://github.com/GauiStori/tekprogs/tree/master/tds694/tektool

I have tested it and it works half way on my Linux computer with
linux-gpib. It should
compile and work just as well/badly on any OS.

I guess that either the password is wrong.
ibwrt (Dev, "PASSWORD PITBULL", 17L);
or the data structure is not aligned on my 64 bit computer.
struct cmd_hdr
{
uint8_t cmd;
uint8_t csum;
uint16_t len;
};

struct memory_read_cmd
{
struct cmd_hdr hdr;
uint32_t addr;
uint32_t len;
};

struct memory_write_cmd
{
struct cmd_hdr hdr;
uint32_t addr;
uint32_t len;
uint8_t buf[1024];
};

I don't have time to debug it now but if anyone knows the answer
please drop a line.

Regards
Gudjon