what you doing is the wrong way, the firmware is for all models, so it does not matter what inside (unless you wish to search the whole firmware for model checks and patch it then). The best way is to patch the model itself, and this has been saved somewhere. The RTC clocke does have some user bytes, but htey can't be used (without special tricks) to store model. Are there any eeproms on the board? i bet the altera cpld is readback protected, but well, just try to dump it. If the model check is really in that cpld (and not eeprom) then it is still possible to change it, e.g. by watching the bus for call just before model check in fw, and then sending the crafted info back. When eepom used, then it will be much easier. Or even simple tricks like some "not populated" parts, TEK did that on other models and one can hack them very easy (which still did't change anything, without calibration mainly useless - and to run cal one need anyway some gears, so ppl who can calobrate have enought money anyways to buy higher TEK models).
There is at least one flash. The main flash holds the program code, and maybe some model ID/sn. There are two other unknown chips that may have some memory.
I am more of a software guy, and have disassembled 80% of the firmware, because you know the 80/20 rule!
![Cheesy :D](https://www.eevblog.com/forum/Smileys/default/xcheesy.gif.pagespeed.ic.KPzuH4J-TG.png)
I found it interesting because it gives me an overview of what is going on.
My random thoughts are-
It's more complicated than I would have guessed. They are programming a USB chip, on the fly, to offload tasks.
There is a lot of printer driver code embedded. Tons of remote programming code.
What's interesting are two specialized menu's that can be enabled.
Service Mode
Engineering Mode
Service mode is documented, but doesn't do anything special.
Engineering mode, I suspect, will let you change interesting things like serial number and model type. There are error messages that prevent you from enabling 4 channels when the model hardware only has two, and color when the hardware is black & whiite.
There are no error messages for bandwidth.
Additionally, there is a lot of code for power analysis. It is enabled when a USB key is verified for TBS2PWR1
My first thoughts are that the TDS scopes can do the power analysis functions the TBS scope can. Tektronix decided to limit those functions to there TBS series.
That series also has similar bandwidth and 2.5K/points memory so I'm thinking the hardware is again identical.
The goal of this mission is to enable all bandwidth options fot the TDS1000B/2000B scopes and potentially enable the TBS2PWR1 functions since they are in the same firmware. It's not just a reference I see the entire functions and calculations in my dis assembly.
My focus now is to decode how to get into "Engineering Mode" through the front panel. Disassembly helped me find out there is such a thing.