How to hack app modules on MDO4000B?

[AlexBorro]

Hi folks,

I'm new here on this forum. I've digged it for hours looking for an application modules hack for a Tek MDO4054B-6.

I came across the threads [MDO3000 Hacking] and [Someone has hacked MDO4000C?], but could not find a way to enable the applications on -B series, just the -C one.

I found a doc in [MDO3000 Hacking] showing how to access manufacturer mode on -B but nothing about enabling extra applications. I'm interested on enabling  protocol decoders for LA.

Any hint on that?

Cheers.

Alex.

Enviado de meu SM-G930F usando o Tapatalk

[andyturk]

I'm interested on enabling  protocol decoders for LA.

Any hint on that?

It's pretty easy if you don't mind building a tiny board that impersonates the $$$ modules from Tek.

Order this board from OSHPark: https://oshpark.com/shared_projects/pE9Ff8iu

and then follow these instructions: https://www.scribd.com/doc/236065278/Cloning-Tektronix-Application-Modules-pdf

[AlexBorro]

Thanks @andyturk

I've saw this project for MSO2000, but I was not aware it is compatible to MDO4000B series. I found nothing about such use on internet.

Cheers.

Alex.

[andyturk]

Thanks @andyturk

I've saw this project for MSO2000, but I was not aware it is compatible to MDO4000B series. I found nothing about such use on internet.

Cheers.

Alex.

Seems like not that many people hack the MDO4 series, but those modules are signal compatible with earlier scopes. The DPO4BND and MDO4TRIG options should unlock everything on the scope.

[AlexBorro]

That's awesome.

I saw in other post you have (or had) a MDO4034B. Did you unlock these app features using this "board" hack?

By the way, reading the project, it says to write the SKU in the EEPROM but didn't mention the offset. Should I just write "DPO4EMBD" starting on address 0x00?

Cheers.

Alex.

[andyturk]

Yes, I have a fully unlocked MDO4034B-3 which now operates as a MDO4104B-3 (with all the software options).

It's been a while since I programmed the "module" I built, but now that I look at my notes, I think I followed these instructions (more or less):
http://forum.tsebi.com/viewtopic.php?f=4&t=113

[Howardlong]

Google seems to hide the following thread, which is referred to earlier. It’s essential reading if you’ve stumbled on this thread.

https://www.eevblog.com/forum/testgear/someone-has-hacked-mdo4000c/msg1464991/#msg1464991

[analogRF]

Yes, I have a fully unlocked MDO4034B-3 which now operates as a MDO4104B-3 (with all the software options).

It's been a while since I programmed the "module" I built, but now that I look at my notes, I think I followed these instructions (more or less):
http://forum.tsebi.com/viewtopic.php?f=4&t=113

would you mind saying how you upgraded the BW from 350MHz to 1GHz?

[Neuro]

Here is a hex-file for an M24C16-based unit for a DPO4000. It can unlock 4 options.
In my case I've unlocked the DPO4AUTO, DPO4LMT, DPO4PWR and DPO4USB options in my DPO4054.