I had a free minute and managed to resolve the issue of downloading the firmware from my device to a file.
In addition to the main firmware (version V3.0.1 for HDS2102S, not on the website), I also saved the bootloader.
Results of a little bootloader research:
1) Firmware can consist of three components: main cpu firmware, fpga frimware and configuration block. All firmware I know contain only the first two components. The configuration block is unique for each device, because contains the serial number and calibration parameters.
2) The firmware contains a text string indicating the base model of the device. This line encodes both real hardware features (ADC configuration, presence of a generator, etc.) and some purely software restrictions.
Sample:
HDS2<Freq>2<Generator>_<submodel>
"HDS2" - start signature
Freq - Max osc bandwith:
200MHz model: Model[4]=='2' && Model[5] == '0'
100MHz model: Model[4]=='1' && Model[5] == '0'
70MHz model: Model[4]=='7'
50MHz model: Model[4]=='5'
40MHz model: Model[4]=='4'
Generator: 'S' after "HDS" and before any '_'
The submodel string has a random format (and may not be present at all).
The main firmware analyzes the following signatures:
'E' Model(maybe HDS300?): There is an "E" character anywhere on the line.
ADC LS08D1500: "_LS" after "HDS"
1/S models: "_1" or "_LS" after "HDS"
1/S models - some hardware diff on ADC work.
Update steps:
1) backup config block to ram
2) if set update flag (in config block), set bootloader update flag and reset flag in config block
3) check serial no and reset (if bad):
if ( SerialNumberCode >= 2000000 && SerialNumberCode < 3500000
|| SerialNumberCode >= 20000000 && SerialNumberCode < 35000000
|| SerialNumberCode >= 200000000 && SerialNumberCode < 350000000 )
{
BackupFlashCfgArea();
sprintf_0(BackupCfgArea.SerialNumberString, "%d", SerialNumberCode);
SerialNumberCode = 0xFFFFFFFF;
StartConfigArea.ResetToDefaultReq = 1;
RestoreCfgArea();
}
4) open file "Scope.upp"
5) check header and file CRC
6) compare hw model string (current flash and Scope.upp) if mismatch - stop update
7) check version string (V{aa}.{bb}.{cc}[zz]).
If there are one or two "z's" at the end of the version string, no further version checking is performed.
Main version code (aa) - hardware submodel id. It must match in the file and on the current device.
bb.cc - firmware version. flash firmware version <= file firmware version, else error
check crc and update fpga firmware (if present)
9) check crc and update config block (if present)
10) check crc and update cpu firmware (if present)
11) store new version to config block
12) write config block to flash
13) one beep (100 ms)
14) delete file "Scope.upp"
15) reload
Thus, the first firmware version number is loosely related to the time of its release and only determines the subversion of the hardware platform. Relatively speaking, firmware V8.1.2 may be released earlier than V6.5.7 (all version numbers are random)