Thanks for that! This was very helpful!
So, I just wanted to let everyone know the outcome.
Firstly, following 'ManMan's instructions, I managed to upload a new firmware via the 'Wiggler' JTAG interface that I built ("In-Air-Technology"). It was horribly SLOW, literally taking me DAYS to complete (in sections), with very unstable clock & data signals on the output of the LPT (jitter), and the software utilizing 100% of my CPU on every computer that I tried. Probably an issue with this 'TopJTAG Flash Programmer' software (which is great otherwise). So I can't recommend the simple Wiggler interface, it was a real pain. Later I tried with a cheap 'Altera' USB Blaster interface from China, but that wouldn't work either as it lost connection to the JTAG everytime after a few seconds. Blame it on this chinese interface as it did the same on another device's JTAG.
So I first dumped the orignal FLASH content of 8MB. Did that a few times and run MD5 hashes until I had enough files that had the same hash, so I could be confident that what I dumped has actually been read successfully several times (I did produce many dumps with errors). The reading from Flash took 1174min (19.5 hours !!!) for 8MB each time (see screenshot), although later I noticed that only the first 2.5MB were occupied with data, so I limited to address range for subsequent reading/writing. Next, the FLASH needs to be erased. The software doesn't allow you to erase the first sector (which fails otherwise), so you need to untick it (screenshot). Then, after writing ManMan's dump to the FLASH and by reading it back again, I confirmed it to be 100% identical to the input file (by MD5 hash) - so the writing was confirmed to be successful. However, the problem
REMAINED the same
I had then tried flashing various other (suitable) Firmware versions via JTAG, but with all of them the problem didn't go away. This whole process took me a few WEEKS to complete as of the slow speed of the wiggler interface and this software. The highest possible clock speed meassured on the LPT was only 22 kHz, no matter the setting in the software (limited by CPU power?).
So I went back troubleshooting the hardware again. I confirmed earlier that the power supply was ok, output voltages were all correct, stable and ripple-free. Then I went on to take several other measurements with another scope and multimeter. Here's what I found out: The 3 AD-Converter ICs on top (and 2 on the bottom) with their writing removed were identified to be most likely AD9288 - at least the pinout matches everything on this PCB. So, probing those ones, I noticed that there are no CLOCK signals on ENC
A (Pin 47) and ENC
B (Pin 14) - no matter the Time/Div setting. It was hard to follow the copper trails, but I believe the one clock signal (fed into the 5 ADCs via 5x2 1kOhm resistors) comes from the big CYCLONE IV FPGA
At this point I gave up. Maybe the FPGA got fried when someone flashed the wrong firmware onto this device? It is however still possible that NONE of the Firmware versions that I tried matched this scope's hardware, who knows.
Hope this helps some of you guys out there who would like to troubleshoot further. I have given up. You can't always win.
MERRY CHRISTMAS !