Fluke/Tektronix Bushealth Code: 192C/196C/199C/215C/225C/190 (I & II) THS3000

[patpat]

FlukeBushealth v1.0 2024

 Provided the Scope SN it creates the Bushealth Code
 It works on Fluke and Tektronix* Scopes with bushealth capable firmware
  Fluke 192C/196C/199C/215C/225C
  Fluke 190 - 062/102/104/202/204/502/504 (Series I & II)
  Tektronix THS3014/3024

 Reaching the Bushealth Install screen:
  Fluke: USER -> VERSION & CAL -> F1
  Tektronix: TBD*


Usage:
        FlukeBushealth -s SerialNumber

        Examples:
        FlukeBushealth -s DM9010124


Options:
-h, --help     Get help
-s, --Serial   Scopemeter Serial


Tektronix uses the same firmware than 190-XXX II and includes bushealth support but at the moment I couldn't find
how to trigger the "Install Bushealth Option" screen




VirusTotal again gives positives,
https://www.virustotal.com/gui/file/c715fce191c28dc591854ebf0ec94f0f14ce8349f69e217ec8a177640f40f713
but this just came out from my Microsoft VS

I tested on my 199C and it worked w/o issues, if it does not work
for you just let me know model and serial
Pat
 

[squadchannel]

hi pat.
I hope it works on THS, but I can't find the hidden menu.

I was messing around with commands from serial yesterday and found some data dumped by the qc command.
It outputs an undocumented command list.

qc mean "quality control"? hmm...

Code: [Select]

Universal Host Mask software; UHM V3.0��0123456789ABCDEF����BaudregRead     : BR<cr>
BaudregWrite    : BW<dddd><cr>
EXtension cmd   : EX<exnr>,<...>
Fill Mem Byte   : FM<hexAddr>','<hexLen>','<bb><cr>
Fill Mem Long   : FL<hexAddr>','<hexLen>','<llllllll><cr>
Fill Mem Word   : FW<hexAddr>','<hexLen>','<wwww><cr>
Call program    : GO<hexAddr><cr>
Get Binary Byte : GB<hexAddr>','<hexLen><cr>
Get Binary Long : GL<hexAddr>','<hexLen><cr>
Get Binary Word : GW<hexAddr>','<hexLen><cr>
IDentity        : ID<cr>
Put Binary Byte : PB<hexAddr>','<hexLen><cr><B...B><cr>
Put Binary Long : PL<hexAddr>','<hexLen><cr><LLLL...LLLL><cr>
Put Binary Word : PW<hexAddr>','<hexLen><cr><WW...WW><cr>
Reset Instrument: RI<cr>
Read hex Byte   : RB<hexAddr>','<hexLen><cr>
Read hex Long   : RL<hexAddr>','<hexLen><cr>
Read hex Word   : RW<hexAddr>','<hexLen><cr>
Write hex Byte  : WB<hexAddr>','<hexLen>','<bb...bb><cr>
Write hex Long  : WL<hexAddr>','<hexLen>','<llllllll...llllllll><cr>
Write hex Word  : WW<hexAddr>','<hexLen>','<wwww...wwww><cr>
��HOI (c) Rob van de Schepop

The dumped data is attached.

I also tried to see if I could read the contents of the flash that should have been assigned to $4000 0000 using the RB command, and sure enough, there was data, but not the data I expected.
It seems to be different from the contents of the flash. I am not too familiar with CL-PS7111 or arm.

MOD:
overflowing.



enter GO40000000 on UHM, boot from flash. No doubt $4000 0000 would be flash.

[patpat]

Hi squadchannel,

FlukeBushealth v1.0 has been tested on my Fluke 199C USA and it worked as intended.

Looking at the firmware I inferred it should also work on the Fluke 190 and Tektronix THS3000 lines.

As you see Tektronix serials are longer numbers and  FlukeBushealth 1.0 as-is has a sign issue in this case.
I need to see the code a bit more to fix this and reach Tektronix Bushealth install screen (if possible) but I'm also stuck not finding the way.

Regarding serial communication, the codes you found seem they might run in Mask Mode?
I tried in regular mode the RB (Read Byte ) command on my THS3024 and it always return error 1.
I booted my THS3024 in Mask Mode (Power-on the unit holding the up and right arrows and hearing a soft beep)
but then I couldn't establish the serial connection with the scope, are you able to communicate in Mask Mode with your THS3024?

Regarding Fluke options I found the sequence of Serial commands that would enable the following 3 features
* Medical 
* Bushealth          
* Medical + Bushealth

The command sequence is contained in the file cpl.bin from the firmware updater which once decrypted with FlukeFlashTool2txt 
https://www.eevblog.com/forum/microcontrollers/fluke-19xbcii-tektronix-ths30143024-flashtool-ini-cpl-bin-deobfuscator
it gives

Code: [Select]

EM
MAINTENANCE
CI 12,0
CI 13,confix
CI 14,0
CI 17,110195
CI 18,y
CI 320,N
RC
EO
The line:

CI 17,110195   => Enables Bushealth
but also
CI 17,271267   => Enables Medical 
CI 17,161027   => Enables Medical + Bushealth

CI (Configure Instrument?) is a multi function command, the first number is the function number, followed by a single parameter.
The number 17 deals with the scope software options.
So far I do not know the rest of commands.

This data comes just from looking at the code, I haven't tried myself, sure the CI command might need one or more commands in the sequence to work,
I know the code is identical in Tektronix then it could potentially work with the THS2024.

Best
Pat