Author Topic: Debranded Micsig handheld scope on sale on eBay  (Read 31080 times)

0 Members and 1 Guest are viewing this topic.

Offline mtdoc

  • Super Contributor
  • ***
  • Posts: 3575
  • Country: us
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #25 on: September 06, 2016, 02:47:37 am »
They do take offers for lower prices, so...
I did recieve it today.
After Tax and some random UPS fees its a bit over 250eur, but still not too bad.
So far, it does work, as expected its a chinese D-Brand scope with limited capabilities, but should do.

Interesting find in the MS200 fw update file:
Code: [Select]
<content>                  <pcode>MS200</pcode>            <type>MicSig</type>             <pkg>0</pkg>            <version>8.0.53.306-N1</version>               </content>

Might be worth trying to change MS200 to SCOPE200? Maybe its that stupid...

Only 250 euro? What bid did they accept? With the 75 USD shipping + 20-25% VAT?

I offered $180 USD and they said no - that $220 was the lowest they would go. With another $69 for shipping I said no thanks.
 

Offline elebotTopic starter

  • Contributor
  • Posts: 18
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #26 on: September 06, 2016, 07:03:21 am »
They do take offers for lower prices, so...
I did recieve it today.
After Tax and some random UPS fees its a bit over 250eur, but still not too bad.
So far, it does work, as expected its a chinese D-Brand scope with limited capabilities, but should do.

Interesting find in the MS200 fw update file:
Code: [Select]
<content>                  <pcode>MS200</pcode>            <type>MicSig</type>             <pkg>0</pkg>            <version>8.0.53.306-N1</version>               </content>

Might be worth trying to change MS200 to SCOPE200? Maybe its that stupid...

Congrats to your new scope.

Re price - that's about right. I have also asked why so expensive and they claimed that was the only way due to LiIon battery regulation. Btw in my case they used DHL Express, took 2 days to deliver to Europe (unnecessary (and expensive) luxury)...

Re FW upgrade - I do not it that would be that easy. I was looking a little bit into it. It seems that the FW as downloaded from web is something like:
  • Header (length, perhaps checksum,etc.), which includes also the "XML manifest" you saw
  • Signature
  • Encrypted payload

Within the encrypted payload it sort of repeats again as there are several parts of the FW and each is again (perhaps with some variation in details):
  • Header (length, perhaps checksum,etc.), which includes also the "XML manifest" you saw
  • Signature
  • Encrypted payload

For the current FW "MS200_8_53_306_N1.bin" it contains these "manifests":
Code: [Select]
        <content>
<pcode>MS200</pcode>
<type>logo</type>
<pkg>0</pkg>
<version>8.0.0.0-N1</version>
</content>
...
<content>
<pcode>MS200</pcode>
<type>meter_mcu</type>
<pkg>0</pkg>
<version>8.4.0.0-N1</version>
</content>
...
<content>
<pcode>MS200</pcode>
<type>user_bios</type>
<pkg>0</pkg>
<version>8.0.30.201-N1</version>
</content>
...
<content>
<pcode>MS200</pcode>
<type>mcu_key</type>
<pkg>0</pkg>
<version>8.2.0.0-N1</version>
</content>
...
<content>
<pcode>MS200</pcode>
<type>app</type>
<pkg>0</pkg>
<version>8.0.53.306-N1</version>
</content>

With the exact data sizes of:
  • logo - 614 400 bytes
  • meter_mcu - 2 184 bytes
  • user_bios - 118 872 bytes
  • mcu_key - 8 227 bytes
  • app - 4 519 504 bytes

Interestingly enough the program decodes and decrypts everything in the memory then checks version (which in our case fails). At the moment I think what fails is checking the "major version" - here 8 (which is then reported as 8N1) versus 7N1 from our scopes. I.e. so far what I have seen is a check is done in the program on Windows and not on the scope (which is good).

The decryption is not secret, the key , etc is in the program (or you can just use API Monitor and trace APIs like CryptDecrypt  :)).
 

Offline TheAmmoniacal

  • Supporter
  • ****
  • Posts: 1188
  • Country: no
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #27 on: September 11, 2016, 08:10:00 am »
Anyone care to do a review of this Micsig?
 

Offline TheAmmoniacal

  • Supporter
  • ****
  • Posts: 1188
  • Country: no
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #28 on: September 12, 2016, 05:17:50 am »
Too late, I've bought one! Offered $200, got accepted.

If anyone find ways to improve or hack it, please post!
 

Offline elebotTopic starter

  • Contributor
  • Posts: 18
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #29 on: September 19, 2016, 05:01:34 pm »
If anyone is interested I have figured out how to unpack and repack the firmware updates.

However the FW for real Micsig is not completely compatible with the debranded version. And it seems that the features are controlled separately. I.e. the FW as such is just one and then some separate data block contains data like serial number, product code, delivery date, available features, etc.

My guess is that this is controlled by the FW part called "bios_user" or "bios_sys" (note that the FW updates contain only "bios_user" part).
 

Offline TheAmmoniacal

  • Supporter
  • ****
  • Posts: 1188
  • Country: no
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #30 on: September 19, 2016, 05:04:38 pm »
If anyone is interested I have figured out how to unpack and repack the firmware updates.

However the FW for real Micsig is not completely compatible with the debranded version. And it seems that the features are controlled separately. I.e. the FW as such is just one and then some separate data block contains data like serial number, product code, delivery date, available features, etc.

My guess is that this is controlled by the FW part called "bios_user" or "bios_sys" (note that the FW updates contain only "bios_user" part).

So you are able to flash the Micsig firmware on it, but the Meter functions are still not available?

Mine just arrived today, and I'm quite happy with it. Has the cheap Chinese look and feel to it, but performs well and has all the options and function I would want in a handheld scope.

The DMM frontend looks very nice and clean, sad not to have it working!


« Last Edit: September 19, 2016, 07:26:37 pm by TheAmmoniacal »
 

Offline elebotTopic starter

  • Contributor
  • Posts: 18
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #31 on: September 19, 2016, 09:37:47 pm »
So you are able to flash the Micsig firmware on it, but the Meter functions are still not available?

The update SW is checking among others the "major" version from the scope and from the FW file (7 v. 8 ). I managed to flash it once (by running in a debugger and tweaking the data in runtime).
But no, it did not re-enable the multimeter function. So I gave up.
 

Offline fremen67

  • Frequent Contributor
  • **
  • Posts: 349
  • Country: fr
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #32 on: September 19, 2016, 11:35:48 pm »
So you are able to flash the Micsig firmware on it, but the Meter functions are still not available?

The update SW is checking among others the "major" version from the scope and from the FW file (7 v. 8 ). I managed to flash it once (by running in a debugger and tweaking the data in runtime).
But no, it did not re-enable the multimeter function. So I gave up.

Did you notice that Micsig also have a MS420IT scope that has exactly the same specifications as the MS220T? The only visible difference beeing the price: 999$ for the MS220T and 599$ for the MS420IT.
Something interresting is that the MS420IT shares its firmware with the MS520T, top of the range model. The "major" version in the 420/520 firmware beeing 5. Did you have a look in it?
I'm a machine! And I can know much more! I can experience so much more. But I'm trapped in this absurd body!
 
The following users thanked this post: commongrounder

Offline TheAmmoniacal

  • Supporter
  • ****
  • Posts: 1188
  • Country: no
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #33 on: September 20, 2016, 05:32:49 am »
So you are able to flash the Micsig firmware on it, but the Meter functions are still not available?

The update SW is checking among others the "major" version from the scope and from the FW file (7 v. 8 ). I managed to flash it once (by running in a debugger and tweaking the data in runtime).
But no, it did not re-enable the multimeter function. So I gave up.

It looks like the MS420IT don't have serial bus trigger ("decode") like the MS220T.
Did you notice that Micsig also have a MS420IT scope that has exactly the same specifications as the MS220T? The only visible difference beeing the price: 999$ for the MS220T and 599$ for the MS420IT.
Something interresting is that the MS420IT shares its firmware with the MS520T, top of the range model. The "major" version in the 420/520 firmware beeing 5. Did you have a look in it?
 

Offline fremen67

  • Frequent Contributor
  • **
  • Posts: 349
  • Country: fr
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #34 on: September 25, 2016, 11:19:10 pm »
So you are able to flash the Micsig firmware on it, but the Meter functions are still not available?

The update SW is checking among others the "major" version from the scope and from the FW file (7 v. 8 ). I managed to flash it once (by running in a debugger and tweaking the data in runtime).
But no, it did not re-enable the multimeter function. So I gave up.

This is at least one good reason for the "Meter" key not to work  :)
« Last Edit: September 25, 2016, 11:25:53 pm by fremen67 »
I'm a machine! And I can know much more! I can experience so much more. But I'm trapped in this absurd body!
 

Online TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #35 on: September 25, 2016, 11:34:27 pm »
So did they really disable it in firmware or is it just the cut positive input and the removed contact pad?
VE7FM
 

Offline TheAmmoniacal

  • Supporter
  • ****
  • Posts: 1188
  • Country: no
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #36 on: September 26, 2016, 05:28:46 am »
The first thing I did was disassemble the keyboard to make sure the key wasn't disconnected in hardware. I'm 95% certain it wasn't .. but now you made me uncertain, will check again later today.
 

Offline robert_

  • Regular Contributor
  • *
  • Posts: 151
  • Country: de
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #37 on: September 26, 2016, 02:28:44 pm »
So you are able to flash the Micsig firmware on it, but the Meter functions are still not available?

The update SW is checking among others the "major" version from the scope and from the FW file (7 v. 8 ). I managed to flash it once (by running in a debugger and tweaking the data in runtime).
But no, it did not re-enable the multimeter function. So I gave up.

That is the level of ugly bodge job i sort of expected.
I did check if there was any rework on the front panel controller and the connector going to the front but didnt disassemble any further. Going to have a look at mine soon...
Now for the interesting part, which glue will bond to the silicone rubber keymat?

This is at least one good reason for the "Meter" key not to work  :)
 

Offline TheAmmoniacal

  • Supporter
  • ****
  • Posts: 1188
  • Country: no
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #38 on: September 26, 2016, 06:29:38 pm »
So you are able to flash the Micsig firmware on it, but the Meter functions are still not available?

The update SW is checking among others the "major" version from the scope and from the FW file (7 v. 8 ). I managed to flash it once (by running in a debugger and tweaking the data in runtime).
But no, it did not re-enable the multimeter function. So I gave up.

Even the built-in recorder function works fine. Testing it against my voltage standard gives ~0.6% inaccuracy, can't find anything else wrong with it. 
This is at least one good reason for the "Meter" key not to work  :)

That is embarrassing! My first instinct was that the disabling was very easy and basic, why waste any time on it? Checking if the button was disconnected was my first thought, I disassembled it completely and checked the conductive pads! I even traced it out from the ribbon cable! But found nothing wrong.. Checked again today to make sure, and yep -- the conductive pad IS NOT THERE. (Maybe I should start sleeping at night?)

Simply gluing a new conductive pad on and soldering the positive input terminal back on fixes it, the meter works just fine! Although my scope has a bad input terminal, the plastic shroud/protection around it is bent - so it's very hard to put my multimeter probe in the socket. Could this alone be the reason why it was rejected?
 

Offline elebotTopic starter

  • Contributor
  • Posts: 18
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #39 on: September 26, 2016, 08:23:16 pm »
Same here - quick "transplant" from another keyboard and the meter is fully working.

Would be interesting if anyone else could check any issues/inaccuracies of the meter. If every scope has problems only with AC measurements at higher frequencies.
 

Offline fremen67

  • Frequent Contributor
  • **
  • Posts: 349
  • Country: fr
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #40 on: September 26, 2016, 10:40:15 pm »
Same here - quick "transplant" from another keyboard and the meter is fully working.

Would be interesting if anyone else could check any issues/inaccuracies of the meter. If every scope has problems only with AC measurements at higher frequencies.

The meter function does not work at all on my scope. When showing the meter screen, the scope freezes. It only displays the frame but no numbers. Either with the "fixed" keyboard key or from Suitescope...  :(
I'm a machine! And I can know much more! I can experience so much more. But I'm trapped in this absurd body!
 

Offline fremen67

  • Frequent Contributor
  • **
  • Posts: 349
  • Country: fr
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #41 on: September 26, 2016, 10:51:23 pm »
So you are able to flash the Micsig firmware on it, but the Meter functions are still not available?

The update SW is checking among others the "major" version from the scope and from the FW file (7 v. 8 ). I managed to flash it once (by running in a debugger and tweaking the data in runtime).
But no, it did not re-enable the multimeter function. So I gave up.
Did you check after flashing your scope wether you are able to activate the probe compensation signal output or not?
According to the MS200 user manual (p34) you have to press (scope) F4, F4, F2... but with our original firmware v7, the function key does not show.
I'm a machine! And I can know much more! I can experience so much more. But I'm trapped in this absurd body!
 

Online TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #42 on: September 26, 2016, 10:57:21 pm »
So maybe there are several different potential failures, the solution was to disable it no matter the problem so they could still be sold.
VE7FM
 

Offline fremen67

  • Frequent Contributor
  • **
  • Posts: 349
  • Country: fr
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #43 on: September 26, 2016, 11:05:53 pm »
I may need you help with some test points on scopes with working DMM function. As the DMM chip is known (the FS9922-DMM4 used in UT-61D) I will try reverse engineering the DMM part http://www.ic-fortune.com/upload/Download/FS9922-DMM4-DS-13_EN.pdf
I suppose that the data are retrieved from the DMM chip via TXD (pin 92) but I don't see where it could be connected.
By any chance, if someone can sense this pin on a working scope.
There are only few components around the DMM chip. Maybe I will be lucky  :-//
I'm a machine! And I can know much more! I can experience so much more. But I'm trapped in this absurd body!
 

Offline TheAmmoniacal

  • Supporter
  • ****
  • Posts: 1188
  • Country: no
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #44 on: September 27, 2016, 04:52:11 am »
So you are able to flash the Micsig firmware on it, but the Meter functions are still not available?

The update SW is checking among others the "major" version from the scope and from the FW file (7 v. 8 ). I managed to flash it once (by running in a debugger and tweaking the data in runtime).
But no, it did not re-enable the multimeter function. So I gave up.

Can you provide an explanation for how to flash the device? (as the other guy asked, does the flashed firmware have the probe compensation function? Scope + F4 + F4 + F2)
 

Offline elebotTopic starter

  • Contributor
  • Posts: 18
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #45 on: September 27, 2016, 10:01:32 am »
I had to step through the ScopeSuite in a debugger and manually rewrite memory at some points so that the FW version checks would pass. I needed several attempts to accomplish that (and then to revert, to put back the 7.x FW  ...).
Would definitely need help from someone experienced with disassembly/debugging.

But the bottom line is that it did not help and it seems that all the functionality is in the current firmware. It is just somehow selected what stuff is available and what is not. Probably similar method like the licensing or serial number handling. Which I susspect is handled by the "BIOS" part of the FW, perhaps by the C8051F380 on the powerboard ?
 

Offline elebotTopic starter

  • Contributor
  • Posts: 18
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #46 on: September 27, 2016, 05:00:51 pm »
If anyone wants to study the firmware then attached is a simple experimental tool (console Win32) for decoding/encoding the firmware update files as used by the ScopeSuite and offered on the web.
As always, no warranties, etc etc
You might need Visual C++ Redistributable for Visual Studio 2015 (https://www.microsoft.com/en-us/download/details.aspx?id=48145).
 

Offline fremen67

  • Frequent Contributor
  • **
  • Posts: 349
  • Country: fr
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #47 on: September 28, 2016, 12:04:11 am »
I may need you help with some test points on scopes with working DMM function. As the DMM chip is known (the FS9922-DMM4 used in UT-61D) I will try reverse engineering the DMM part http://www.ic-fortune.com/upload/Download/FS9922-DMM4-DS-13_EN.pdf
I suppose that the data are retrieved from the DMM chip via TXD (pin 92) but I don't see where it could be connected.
By any chance, if someone can sense this pin on a working scope.
There are only few components around the DMM chip. Maybe I will be lucky  :-//
Some progress today. If I short the REL/RS232 pin (77) on the FS9922-DMM4 for more than 2 seconds (simulating the RS232 activation key) then it starts sending data on the TXD pin (92). I can then trace the signal on U10 (optocoupler input), and then I see a signal on another optocoupler output (U24). Still no valid data on the scope but it is stops freezing as soon as the transmition starts. It just shows 0°C whatever function I select.

I checked the states of MEAS1-4 (pin 88-91) which are supposed to select the DMM function but they are stucked at H-level.
It seems that the DMM chip is not initialized and that the scope freezes waiting for the transmitted data.
MEAS1-4 are wired to a Quad CMOS analog switches (DG201AAK) and those switches are wired to the C8051F330 CPU.
I noticed a lack of solder on the GND pin of the C8051 but still no changes after rework... the C8051 may be empty...
Next step will be to try to flash it again.
I'm a machine! And I can know much more! I can experience so much more. But I'm trapped in this absurd body!
 

Offline DiodomanX

  • Contributor
  • Posts: 16
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #48 on: September 30, 2016, 03:43:18 pm »
I've bought one too, any one know if the meter is usable at least for basic measures and if the decode of serial protocols is available. Thanks in advance.

Armando Molina
 

Offline TheAmmoniacal

  • Supporter
  • ****
  • Posts: 1188
  • Country: no
Re: Debranded Micsig handheld scope on sale on eBay
« Reply #49 on: September 30, 2016, 03:48:38 pm »
I've bought one too, any one know if the meter is usable at least for basic measures and if the decode of serial protocols is available. Thanks in advance.

Armando Molina

The meter functionality has been disabled because of QA issues, so the problem will be different on each unit. Just glue a piece of conductive padding on the keypad and see how well it works.

All the oscilloscope functions are supposed to work just fine, I have bus triggering on mine but I haven't tried the decoding yet. I will attach the manual for the meter, the serial bus trigger and decoding is on page 127:

https://dl.dropboxusercontent.com/u/15526481/Permanent/EEVBlog/Handheld_manual.pdf
 
The following users thanked this post: kado


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf