Author Topic: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator (Read 559200 times)

Miti · « **Reply #1400 on:** May 18, 2018, 11:37:17 pm »

Talking about jitter, today I checked two generators that we have at work. An Agilent 33220A and a GW Instek SFG-2020. Agilent, no jitter whatsoever at any frequency, any duty cycle. Instek, clean up to 1MHz 50% duty but terrible jitter above 1MHz, or below 1MHz with duty cycle other than 50%.
The output BNC of the Agilent seems to be grounded through 1M.

I've also checked the supply current of the FY6600 with both outputs turned on but unloaded. The results:
5V - less than 360mA.
+/-12V - less than 60mA each.

So I wouldn't go crazy about replacing the power supply. Replacing the input connector with IEC, maybe cleaning it up a bit but replacing it with a big one or with linear, doesn't really make sense.

DaveR · « **Reply #1401 on:** May 18, 2018, 11:42:16 pm »

Quote from: soundtec on May 18, 2018, 11:02:01 pm

Just found the documentation for the 6800 but cant see the software , I'll check for interoperabillity between the 6600/6800 hardware and software tomorrow

The software is in the "User Guide" package on the Feeltech website. Unfortunately, it's got a Chinese installer, and I didn't bother putting it on my PC in case it created lots of files with Chinese characters in the names, which are a pain to delete. Looking at the sample screens shown on Banggood and AliExpress, it's pretty much the same as the previous 6600 version, but with more legible fonts (probably copying fremen's efforts), and I'd be surprised if it doesn't work with both boxes.

I think the last of the 6600s will have already left the factory, and it'll be 6800s only from now on.

I think hi-res pics are out on this forum - 1Mb filesize and 2Mb max per post is just too restrictive - but those you posted eariler were fine for a first look inside the box. I'd love to see what's under that heat sink, though

soundtec · « **Reply #1402 on:** May 19, 2018, 12:02:58 am »

We did find an internal calibration precedure a good while back ,maybe it was before you joined us Dave ,Im not sure .There was a certain hidden key sequence that led to calibration menus I did try it ,but never tweeked anything .Maybe thats whats refered to in the manual .

soundtec · « **Reply #1403 on:** May 19, 2018, 12:21:02 am »

I just tried to fire up the Fy6800 software package ,couldnt access the archive or something ,
After I tried the old V5.5 software and oddly enough there under help in the menu is a pc update option .

Miti · « **Reply #1404 on:** May 19, 2018, 12:50:12 am »

Here's FPGA V3.3 dump using USB Blaster. Device is EPCS16.

DaveR · « **Reply #1405 on:** May 19, 2018, 01:38:07 am »

Hi soundtec - the calibration procedure you mention was for output frequency adjustment only. It works well, but we never did find out if there were any other undocumented adjustments which can be accessed in the 6600. If they are there in the 6800, they are still undocumented (maybe you can find out from Feeltech, now?).

The PC Update option in the control software appears to be only for an online update of the control software itself, not the 6600 or 6800, but even the software update doesn't work.

Try using 7-Zip to extract all the files from the downloaded file and you'll get the new software installer out ok. If you get files full of ?.?.?.?.?.? in the names, you'll be needing the 7-Zip file manager to delete them. I'll try runiing the installer in a VM in the morning to see what it produces, but the fact that the initial installer exe file contains Chinese characters (the ?.?.?.?.?) makes me suspect that Feeltech haven't yet got an English version of the software (or have forgotten to include it in the download package).

bitseeker · « **Reply #1406 on:** May 19, 2018, 01:41:10 am »

Quote from: metrologist on May 18, 2018, 04:05:53 pm

I may order one. where's ebay 25% off sale?

The coupon codes I've been seeing lately now have a pre-defined list of sellers.

DC1MC · « **Reply #1407 on:** May 19, 2018, 08:49:36 am »

Quote from: soundtec on May 18, 2018, 11:29:15 pm

I can try reading the firmware status on the front panel if you link me back to the methodology you used DC1MC, is there any special interface required or will a simple programmer do the job ? If it needs a proper logic probe to do it I could probably get the use of one if needs be.

Hi @soundtec, the same programmer for the "blue pill" should be enough to read the status of the lock bits and eventually the firmware.
You just have to wire it carefully and don't "clean" the chip, or else a new development system is born

, I will dig tough the thread to recover the instructions and come back.

In the meanwhile, here is the first seller shipping in EU that I've found on fleabay, the delivery time is not that bad, I'm waiting for the usual suspects to have some stock in DE, but maybe interests somebody:

https://www.ebay.de/itm/FY6800-DDS-20-60MHz-2-channel-Generateur-de-signaux-de-Fonction-Signal-Generator/112994684205

EDIT:
Here's the (rather cumbersome) way to connect your programmer to the STM on the front panel:
https://www.eevblog.com/forum/testgear/feeltech-fy6600-60mhz-2-ch-vco-function-arbitrary-waveform-signal-generator/msg1355639/#msg1355639

and here the thorough analysis of Cybermaus about being difficult to try the the published paper unlocking method on F0 to the F1:
https://www.eevblog.com/forum/testgear/feeltech-fy6600-60mhz-2-ch-vco-function-arbitrary-waveform-signal-generator/msg1420467/#msg1420467

Cheers,
DC1MC

soundtec · « **Reply #1408 on:** May 19, 2018, 03:34:13 pm »

Thanks for fishing out the links for me DC1MC .
Arrgh ,it does look a bit fiddly ,but do-able none the less ,its a magnifiying glass and tweezers job ,so Id have to ask my buddy for the use of his workshop for an hour or so, maybe next week sometime I can do it .

I want to send Feeltech a mail ,but Im unsure which address to send it .

cybermaus · « **Reply #1409 on:** May 19, 2018, 08:00:35 pm »

Ild argue against that method.
Just use the STlink method. The header is on the Front Panel already, all you need to do is hook up the 4-pin header and use the STlink utility.

No tweezer soldering, and nice graphic tool, so less chance of mistakes.

DaveR · « **Reply #1410 on:** May 20, 2018, 01:37:17 am »

Soundtec - I installed the FY6800 PC Software from the package on the FeelElec / Feeltech website, and the result is as per the screenshot. It's supposed be v5.8, and the header bar and About box clearly show FY6600, but there is no v5.8 released for the FY6600 as yet, as it's still at v5.5 in the latest package online. The only major change appears to be the Sweep panel, which has been changed to accommodate the FY6800's FP controls, but the software still works with the FY6600, as I tested it. They've also tidied up the Help menu option - the Version Information button (as it would be if there were an English version) now brings up the "About" panel instead of the Waveform - Load File window!

ds · « **Reply #1411 on:** May 20, 2018, 06:48:55 am »

There is a hidden menu entry for a Firmware Upgrade in the FY6800 PC Software which should work for the FY6600 too. In fact this hidden command was there for quite a while.

The Firmware Upgrade loads the latest version from the Feeltech website and installs it. The latest version seems to be V 3.4. The firmware file itself seems to be encrypted, at least from a quick look.

If anyone wants to try out the Firmware Upgrade (maybe someone with a broken V3.0 unit) I have attached a patched version of the PC software with the enabled Firmware Upgrade command. The second menu entry in the right most menu is "Firmware Upgrade".

I haven't tried it (no FY6600 yet) so you are on your own and trying it might brake your unit.

DC1MC · « **Reply #1412 on:** May 20, 2018, 06:51:21 am »

Quote from: ds on May 20, 2018, 06:48:55 am

There is a hidden menu entry for a Firmware Upgrade in the FY6800 PC Software which should work for the FY6600 too. In fact this hidden command was there for quite a while.

The Firmware Upgrade loads the latest version from the Feeltech website and installs it. The latest version seems to be V 3.4. The firmware file itself seems to be encrypted, at least from a quick look.

If anyone wants to try out the Firmware Upgrade (maybe someone with a broken V3.0 unit) I have attached a patched version of the PC software with the enabled Firmware Upgrade command. The second menu entry in the right most menu is "Firmware Upgrade".

I haven't tried it (no FY6600 yet) so you are on your own and trying it might brake you unit.

If this is true, than is the news of the year !!!

Cheers,
DC1MC

soundtec · « **Reply #1413 on:** May 20, 2018, 07:06:13 am »

Thats funny Dave ,I tried several methods of un-wrapping the installer and still no go for me . 6800 did work ok with 6600 software via regular usb host connection ,and Fremens 0.7 software did seem to default gracefully enough to 'standard' usb comms mode without the bluepill unit installed.

Seeing as I have the Stm32 V2link board ,I'll opt for the less invasive method of extraction of firmware update status bit , cheers Cyber

So is it the four pin header on the front panel board I need to hook up to?

I think a straight swap between the front panels of 66 and 68 series might be fun to try ,same time I dont want to be going back to Mr Feeltech with egg on my face and a couple of scrambled units ,so if anyone thinks this might be a bad idea speak forth now.

cybermaus · « **Reply #1414 on:** May 20, 2018, 07:30:20 am »

Quote from: DC1MC on May 20, 2018, 06:51:21 am

If this is true, than is the news of the year !!!

Cheers,
DC1MC

There is always hope, and yes, anyone with a broken V3.0 has little to loose.

But since this would have solved a big image problem for Feeltech, they would have mentioned this already.
My guess is it a remand of a feature they started work on, but never completed.
Biggest chance is it will simply not work, but there is a small change it may even break a device, so indeed, be careful to try it.

Anyone has a opp to post the link, or grab the supposed encrypted firmware file, before they remove it after reading this thread?
But do not simply post it as "firmware V3.4" please, to avoid people trying it without understanding the risk.

DC1MC · « **Reply #1415 on:** May 20, 2018, 07:57:25 am »

I have put my FY6600 V 3.1 device on-line, the update menu recognizes the firmware version 3.1 and shows the version 3.4, starts to load something and then comes to a halt with some message about "

? USB

" and stop.

I'll try to see where this program is going by finding a windozian firewall program that shows what connections are open. if someone has better "hacking" skillz, I have a win 7 laptop with the cadaver connected, that I can make accessible by remote, PM if you want access.

Cheers,
DC1MC

ds · « **Reply #1416 on:** May 20, 2018, 08:05:33 am »

Quote from: cybermaus on May 20, 2018, 07:30:20 am

Anyone has a opp to post the link, or grab the supposed encrypted firmware file, before they remove it after reading this thread?
But do not simply post it as "firmware V3.4" please, to avoid people trying it without understanding the risk.

The parts to create the link are in the PC software, they look very similar to the way the
PC software update works. For the firmware file it is the following:

http://www.feeltech.net/software/updata/FY6600/download.php?vison=DDS&name=FY6600-DDS.FYbi

The V3.4 Firmware file is attached, but as I already wrote, there is not much to see as it is most certainly encrypted.

I think that you can use the "Command 3" button of the Firmware Upgrade command to load it directly.

DC1MC · « **Reply #1417 on:** May 20, 2018, 08:13:48 am »

Downloaded it, tried it, same issue, it exits with some intraductible message about USB.
At least there seem to not be any damage to the device.
Now is about to time to look over the serial port traffic

Cheers,
DC1MC

DC1MC · « **Reply #1418 on:** May 20, 2018, 08:29:55 am »

Some little analysis with binwalk:

binwalk -E ./FY6600-DDS.FYbi produces a very flat histogram, that is hinting strongly at some compression being used.

binwalk -X ./FY6600-DDS.FYbi detects a lot "Raw deflate compression stream"

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
187 0xBB Raw deflate compression stream
432 0x1B0 Raw deflate compression stream
466 0x1D2 Raw deflate compression stream
762 0x2FA Raw deflate compression stream
1180 0x49C Raw deflate compression stream
1217 0x4C1 Raw deflate compression stream
... and so on ...

Let's see what is in this raw deflated things

.

Cheers,
DC1MC

DC1MC · « **Reply #1419 on:** May 20, 2018, 09:09:47 am »

The serial sniffer says:

<PrSTM32_START\r

after which the firmware doesn't reply at all

, it seem the the fw blob has to be decoded, on v3.1 the update procedure seem to not be enabled.

DC1MC

fremen67 · « **Reply #1420 on:** May 20, 2018, 09:22:10 am »

Quote from: ds on May 20, 2018, 06:48:55 am

There is a hidden menu entry for a Firmware Upgrade in the FY6800 PC Software which should work for the FY6600 too. In fact this hidden command was there for quite a while.

The Firmware Upgrade loads the latest version from the Feeltech website and installs it. The latest version seems to be V 3.4. The firmware file itself seems to be encrypted, at least from a quick look.

If anyone wants to try out the Firmware Upgrade (maybe someone with a broken V3.0 unit) I have attached a patched version of the PC software with the enabled Firmware Upgrade command. The second menu entry in the right most menu is "Firmware Upgrade".

I haven't tried it (no FY6600 yet) so you are on your own and trying it might brake your unit.

Quote from: DC1MC on May 20, 2018, 09:09:47 am

The serial sniffer says:

<PrSTM32_START\r

after which the firmware doesn't reply at all , it seem the the fw blob has to be decoded, on v3.1 the update procedure seem to not be enabled.

DC1MC

A lot of interesting things these last days ;-)
I will try to find something too… I am on it

fremen67 · « **Reply #1421 on:** May 20, 2018, 10:32:16 am »

The firmware update protocol is not working with v3.2 but using the bluepill I can try to make the PC Software send the firmware to me ;-)

The protocol starts as follows:

PC: <PrSTM32_START 0x0A
BP: START 0x0A
PC: IAPSTM32_2048_0_62596 0x0A
BP: 0x0A
PC: 2048 binary packet

At the end there should be something like:
PC: <PrSTM32_RST 0x0A
BP: BOOT 0x0A

There is also a command that the PC can send which is <PrSTM32_DO 0x0A. I will see later on.

At the moment I only have the first 2048 bytes but when I find the correct answer, I should receive the remining blocks.
I suppose that we may miss the 4096 remaining bytes of the bootloader at the end so this won't be usable like this. But one step at a time...
More after lunch ;-)

DerKammi · « **Reply #1422 on:** May 20, 2018, 10:48:29 am »

How nice would that be, I see a hex file posted on the forums in short time

ds · « **Reply #1423 on:** May 20, 2018, 12:24:54 pm »

Quote from: fremen67 on May 20, 2018, 10:32:16 am

At the moment I only have the first 2048 bytes but when I find the correct answer, I should receive the remining blocks.
I suppose that we may miss the 4096 remaining bytes of the bootloader at the end so this won't be usable like this. But one step at a time...
More after lunch ;-)

You noticed that the data are just the bytes from the firmware binary file?

The decryption (if my assumption of encrytped data is correct) most certainy takes place inside the STM32 and not in the PC executable.

DC1MC · « **Reply #1424 on:** May 20, 2018, 01:03:15 pm »

I hope we can at least get the offsets and sizes of the encrypted/compressed packages. It will help with the decryption/decompression.

Best of luck and if you need an extra pair of eyes/hands and a sacrificial device, I'm around

.

I'm wondering if the update command doesn't activate when some certain key sequence are pressed on the front panel.

Good luck,
DC1MC


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: FeelTech FY6600 60MHz 2-Ch VCO Function Arbitrary Waveform Signal Generator (Read 559200 times)

Share me