Reverse engineering the FNIRSI 1014D

[pcprogrammer]

A member wrote me a personal message with the request for some information about the development of the software for the 1014D as they want to join in. I answer the questions below so others might find it beneficial.

• Can you give me a brief about the the current state.
  The development state is where I left of in this thread. Only the basic scope functionality is implemented, but hardly tested. It is based on the development done for the 1013D, but rewritten to fit the 1014D user interface. It does give a good starting point for further development.
• What loads the fw from SD.
  This is basic functionality of the F1C100s. There is code in ROM that scans for a valid bootloader. It checks the SD card before it heads on to the SPI connected FLASH memory. By having a signature header in the first 32 bytes of sector 16 of the SD card, the code knows that it needs to load the program from the SD card. This bootloader then initializes the DRAM within the F1C100s and other hardware needed for running the main program, before loading the actual firmware to the internal memory. It also allows for starting the original firmware or the FEL mode.
• Why 16meg.
  I assume 16GB is meant as size for the SD card. This is not mandatory. It works with different sizes of SD cards, as long as there is enough free space before the FAT partition. 1MB is sufficient. There is an issue with detecting the card speed though, as can be read in this thread.
• Does the firmware backup file work on the 1014D.
  Yes there is a version made for backing up the original 1014D firmware. It can be found here.
• Does it back up the FPGA.
  No, because this is not possible with the way they implemented it. The FPGA is loaded from a separate FLASH chip and there is no way for the processor to read from that FLASH.
• Does it backup the full flash or a set range?
  The code creates two files. One is a backup of the full FLASH and the other is just of the firmware section of the FLASH. Have not tried it, but I think it is possible to use it in the way a normal firmware upgrade is done on the 1014D.

The message I received stated the below.

I'd like to start with the function gen and a bode plot to get more helpers and support.
Thanks for the hard work you've been putting into this. It opened doors that I couldn't even imagine.

The latest version of the code is in the repository found here.

For the function generator it is necessary to implement the controlling of the clock synthesizer chip. The code so far only initializes it for the needed FPGA main clock and sets the function generator clock to its max of 200MHz. See "clock_synthesizer.c" for more on this.

The function generator is made with a lookup table in the FPGA and the step through is based on the frequency set with the clock synthesizer. I will have to consult my notes on my other system to provide more information on this.

My advice is to fist look into the code in the repository and play with it a bit. For easy testing the FEL mode can be used to load the new code to the internal memory via USB causing less wear on the SD card. Scan the thread about the 1013D to find more information about this.

[Setrandom]

Hello everyone, I swapped the F1C100s for a F1C200s on a broken 1014d (ordered the wrong one ), but the USB doesn't work. I see in the data sheets that there are differences, is there a solution to get the USB to work?

[Postal2]

.... but the USB doesn't work. ....

If it makes you feel better, my USB has never worked since I bought 1014d.

I take screenshots like this:

[Setrandom]

.... but the USB doesn't work. ....

If it makes you feel better, my USB has never worked since I bought 1014d.

I take screenshots like this:

Not really, it worked normally.  There is no 5V on the USB port, no USB sticks work, there is only a connection to a PC. In an emergency, i install a micro SD card extension.

[pcprogrammer]

Hello everyone, I swapped the F1C100s for a F1C200s on a broken 1014d (ordered the wrong one ), but the USB doesn't work. I see in the data sheets that there are differences, is there a solution to get the USB to work?

If I recall correctly, there was a 1014D out there that had the F1C200s factory installed. For as far as I know the only difference between the two is the DRAM size, but have not looked at it that close.

Check the "main" thread about the 1014D on this: https://www.eevblog.com/forum/testgear/new-bench-scope-fnirsi-1014d-7-1gsas/ Or see on the FNIRSI download page if there is a dedicated firmware version for it. They have different versions for the models with different LCD panels, so maybe also for the F1C200s.

[Setrandom]

If I recall correctly, there was a 1014D out there that had the F1C200s factory installed. For as far as I know the only difference between the two is the DRAM size, but have not looked at it that close.

There seem to be a few more differences.

Check the "main" thread about the 1014D on this: https://www.eevblog.com/forum/testgear/new-bench-scope-fnirsi-1014d-7-1gsas/ Or see on the FNIRSI download page if there is a dedicated firmware version for it. They have different versions for the models with different LCD panels, so maybe also for the F1C200s.

That would be great, ok, I'll take a look. THX


I definitely need to back up the FPGA memory (EF2L45L)

[Postal2]

.... it worked normally.  .... there is only a connection to a PC. ...

The connection picture is present, but on the computer either "insert the disk into the drive" or disk io error.

[pcprogrammer]

I definitely need to back up the FPGA memory (EF2L45L)

You will need a JTAG interface for that. Look at this post for more information: https://www.eevblog.com/forum/testgear/fnirsi-1013d-100mhz-tablet-oscilloscope/msg5668099/?topicseen#msg5668099

[pcprogrammer]

Hello everyone, I swapped the F1C100s for a F1C200s on a broken 1014d (ordered the wrong one ), but the USB doesn't work. I see in the data sheets that there are differences, is there a solution to get the USB to work?

Where did you get the datasheets from that show these differences?

When I did the reverse engineering of the 1013D (the knobless version) I found no proper programming information about the USB interface and used code samples I found to determine what was what and got it working on the F1C100s. Part of the samples came from the Linux tree that floats around for the F1C100s. The documents I found are in my repository here: https://github.com/pecostm32/FNIRSI-1013D-1014D-Hack/tree/main/Manuals

I noticed that you also have a Hantek DSO2xxx and have played with the linux of it a bit. The sources for the Linux used in it are available (DavidAlfa has them) and you might be able to see if it actually needs different code for the USB interface.

[Setrandom]

.... it worked normally.  .... there is only a connection to a PC. ...

The connection picture is present, but on the computer either "insert the disk into the drive" or disk io error.

Ok, it worked for me, it was recognized as a data carrier and now with the F1C200s the device is not recognized.

I definitely need to back up the FPGA memory (EF2L45L)

You will need a JTAG interface for that. Look at this post for more information: https://www.eevblog.com/forum/testgear/fnirsi-1013d-100mhz-tablet-oscilloscope/msg5668099/?topicseen#msg5668099

I'll have to take a closer look at this, the available circuit diagram doesn't quite work for me. But I still have to take care of the power supply first anyway, the TPS61041 has also given up, I've already replaced most of the rest.

Where did you get the datasheets from that show these differences?

When I did the reverse engineering of the 1013D (the knobless version) I found no proper programming information about the USB interface and used code samples I found to determine what was what and got it working on the F1C100s. Part of the samples came from the Linux tree that floats around for the F1C100s. The documents I found are in my repository here: https://github.com/pecostm32/FNIRSI-1013D-1014D-Hack/tree/main/Manuals

I noticed that you also have a Hantek DSO2xxx and have played with the linux of it a bit. The sources for the Linux used in it are available (DavidAlfa has them) and you might be able to see if it actually needs different code for the USB interface.

I only have the normal datasheets, F1C200s V1.1, V1.2 and F1C100s V1.0.

Yes, I also have the Hantek  Unfortunately I'm not that good at code, but I'll take a look.

With the FNIRSI I will probably just install an SD extension so that I can access it from the outside.

[Setrandom]

Just for the record, I have the datasheet for the chip, but it's in chinese.

[Postal2]

.... it worked normally.  .... there is only a connection to a PC. ...

The connection picture is present, but on the computer either "insert the disk into the drive" or disk io error.

Ok, it worked for me, it was recognized as a data carrier and now with the F1C200s the device is not recognized.
....

I didn't bother to figure out the reasons, having checked only the cable. However, now I can assume that this is a defect of the chip itself. I saw such a defect on counterfeit stm32f407, out of 4, one of them didn't have a working USB (HS module).

[Setrandom]

.... it worked normally.  .... there is only a connection to a PC. ...

The connection picture is present, but on the computer either "insert the disk into the drive" or disk io error.

Ok, it worked for me, it was recognized as a data carrier and now with the F1C200s the device is not recognized.
....

I didn't bother to figure out the reasons, having checked only the cable. However, now I can assume that this is a defect of the chip itself. I saw such a defect on counterfeit stm32f407, out of 4, one of them didn't have a working USB (HS module).

[pcprogrammer]

Just for the record, I have the datasheet for the chip, but it's in chinese.

The English version is attached here.

[pcprogrammer]

Ok, it worked for me, it was recognized as a data carrier and now with the F1C200s the device is not recognized.

Did you check the signals on the USB connector and the F1C200s. It just might be a hardware problem.

As mentioned before, I remember to have read that they have the same core and peripherals and the only difference it the DRAM size.

A bit of search provided this: https://www.thirtythreeforty.net/posts/2020/02/trying-the-allwinner-f1c200s/

[Setrandom]

Ok, it worked for me, it was recognized as a data carrier and now with the F1C200s the device is not recognized.

Did you check the signals on the USB connector and the F1C200s. It just might be a hardware problem.

As mentioned before, I remember to have read that they have the same core and peripherals and the only difference it the DRAM size.

A bit of search provided this: https://www.thirtythreeforty.net/posts/2020/02/trying-the-allwinner-f1c200s/

I checked it again with a different USB connector and cable, but for whatever reason it doesn't work. Well, not that important.

The JTAG programmer seems to be working so far, a quick guide on how to save the flash without deleting the old content or something like that would be very helpful. 

[pcprogrammer]

The JTAG programmer seems to be working so far, a quick guide on how to save the flash without deleting the old content or something like that would be very helpful. 

I have only used the IDE to load the configuration to an AL3-10 FPGA to test. Can't recall (aging sucks) if I also wrote the external FLASH of my test board with it. (Not the scopes for sure)

The IDE should allow you to both read and write the one you have, if there is no protection used of course.

I have no experience with the ELF2, but I assume you can load a bitstream to the memory of the FPGA without flashing it, just to test if a configuration is working.

You can try the firmware I made, and if the scope itself is working with it, you can assume the configuration in the ELF2 is the same crappy design as in the AL3-10. Although not completely finished I did reverse engineer that part too.

[Setrandom]

The JTAG programmer seems to be working so far, a quick guide on how to save the flash without deleting the old content or something like that would be very helpful. 

I have only used the IDE to load the configuration to an AL3-10 FPGA to test. Can't recall (aging sucks) if I also wrote the external FLASH of my test board with it. (Not the scopes for sure)

The IDE should allow you to both read and write the one you have, if there is no protection used of course.

I have no experience with the ELF2, but I assume you can load a bitstream to the memory of the FPGA without flashing it, just to test if a configuration is working.

You can try the firmware I made, and if the scope itself is working with it, you can assume the configuration in the ELF2 is the same crappy design as in the AL3-10. Although not completely finished I did reverse engineer that part too.

I'll leave it for now, I'm glad the scope is working again. I took a look and apparently you can't get the chip, otherwise you could order one for experiments. The IDE, I don't know exactly how to use it either, the instructions are in chinese.
Of course it could be good that the flash is protected anyway, they always do that normally.

[pcprogrammer]

You can get the chip on Aliexpress.

https://nl.aliexpress.com/w/wholesale-EF2L45LG144B.html?spm=a2g0o.productlist.search.0

Also a development board is available: https://nl.aliexpress.com/item/1005007199557737.html

[Setrandom]

Now with external SD card and working function generator. Not pretty but rare. Everything works again, except the USB.

[pcprogrammer]

Now with external SD card and working function generator. Not pretty but rare. Everything works again, except the USB.

Just today I received a F1C200s from Aliexpress to try and repair a broken FNIRSI 1013D. Soldering QFN is not my forte, but this third try I succeeded. It did not solve the original problem with inverted colors on the display, but I can assure now that the USB on the F1C200s is exactly the same as on the F1C100s. My 1013D with the F1C200s connects without problems to my computer and I can open image files on it.

So you might want to check the traces and solder connections for the USB path on your scope.

For first attempt with a F1C100s see here: https://www.eevblog.com/forum/testgear/fnirsi-1013d-as-much-use-as-a-chocolate-fireguard/msg4652311/#msg4652311

For the second attempt also with a F1C100s see here: https://www.eevblog.com/forum/microcontrollers/f1c100s-dram-problems/msg5741317/#msg5741317

[Setrandom]

Now with external SD card and working function generator. Not pretty but rare. Everything works again, except the USB.

Just today I received a F1C200s from Aliexpress to try and repair a broken FNIRSI 1013D. Soldering QFN is not my forte, but this third try I succeeded. It did not solve the original problem with inverted colors on the display, but I can assure now that the USB on the F1C200s is exactly the same as on the F1C100s. My 1013D with the F1C200s connects without problems to my computer and I can open image files on it.

So you might want to check the traces and solder connections for the USB path on your scope.

For first attempt with a F1C100s see here: https://www.eevblog.com/forum/testgear/fnirsi-1013d-as-much-use-as-a-chocolate-fireguard/msg4652311/#msg4652311

For the second attempt also with a F1C100s see here: https://www.eevblog.com/forum/microcontrollers/f1c100s-dram-problems/msg5741317/#msg5741317

Oh very interesting, thanks for the information. The device had a 230V accident with the USB plugged in. I checked everything several times, but there must still be an error somewhere. It wasn't really easy to solder, it's no fun. 

[Setrandom]

Now with external SD card and working function generator. Not pretty but rare. Everything works again, except the USB.

Just today I received a F1C200s from Aliexpress to try and repair a broken FNIRSI 1013D. Soldering QFN is not my forte, but this third try I succeeded. It did not solve the original problem with inverted colors on the display, but I can assure now that the USB on the F1C200s is exactly the same as on the F1C100s. My 1013D with the F1C200s connects without problems to my computer and I can open image files on it.

So you might want to check the traces and solder connections for the USB path on your scope.

For first attempt with a F1C100s see here: https://www.eevblog.com/forum/testgear/fnirsi-1013d-as-much-use-as-a-chocolate-fireguard/msg4652311/#msg4652311

For the second attempt also with a F1C100s see here: https://www.eevblog.com/forum/microcontrollers/f1c100s-dram-problems/msg5741317/#msg5741317

I modified the power supply for the display slightly, the negative voltage was too high.

[pcprogrammer]

I modified the power supply for the display slightly, the negative voltage was too high.

Thanks, I'm planning on checking every voltage to the display and if needed verify the signals with a logic analyzer to try and solve the problem.

For as far as I know the scope has worked normally for quite a while and started to show problems like the inverted colors and random restarts. The owner checked the voltages and found nothing wrong. Based on that I thought the problem to be the MCU, but clearly I was wrong, unless this new one has the same fault.