EEVblog Electronics Community Forum
Products => Test Equipment => Topic started by: rafik23 on December 20, 2019, 07:46:29 am
-
hi
please can any one has idea about hacking eeprom DT1106EN and for manual range ? example
in data 80H and BFh i found some function what is 2Xh and 3Xh and more DCA and ACA 6 60 600 6000A , i try to anlyse this dump
Offset 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
===============================================
00000080: 00 00 24 01 00 22 1A 19 09 0A 0B 21 0C 31 29 2A
00000090: 06 05 04 2E 03 30 2C 2B 18 17 16 15 14 1F 1C 1D
000000A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000000B0: 00 00 00 00 00 00 00 00 00 00 00 00 13 20 00 1E
it for pm18C manual range only HZ/% , Capacitor and temperature are in auto ranging , i compare it to bside adm08a without temperature mesuring i see that the 13 at BCh is remplaced by 00h and replace at adresse 9Eh
Offset 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
===============================================
00000080: 05 00 00 24 01 00 22 1A 19 09 0A 0B 21 0C 31 29
00000090: 2A 06 05 04 2E 03 30 2C 2B 18 17 16 15 14 13 1C
000000A0: 1D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000000B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
is there another functions implemented ? we see here 2xh and 3xh format data what are they function assignment ?
when i expand data 08h-BFh to 32 we see this
00 00 24 01 00 22 1A 19 09 0A 0B 21 0C 31 29 2A 06 05 04 2E 03 30 2C 2B 18 17 16 15 14 1F 1C 1D
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 20 00 1E
there are 3 gear switch position what have 2 function red
and for bside adm08A (which is the same only w/o °c/°f )
00 00 24 01 00 22 1A 19 09 0A 0B 21 0C 31 29 2A 06 05 04 2E 03 30 2C 2B 18 17 16 15 14 13 1C 1D
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1E
We can SAY 13 h Continuty 14h for measuring diode and 1F is for °C and 20H for °F
in document of DTM0660 the 14h function is hFE and in this case has two function on gear that conclude for DTM1106 is implemented with another function number
who has a dump for AN8008 old and NEW or dump for PM18A ?
switch gear for pm18C[attach=2]
For Bside ADM08A[attach=1]
to be continued
NB: the DMM is not between my hands
-
After going home i take the multimeter it is a PROSKit MT 1706 and start reading again and again on forums so I decide to teardown it and make an analysis of data stored in eeprom and hack it EEprom from originaly dump appears like this
[attach=1]
we see on its dump no thing extra or strange so i decide to make an excel file to analyse data stored in eeprom
i take an hexa from editer and past it on data in excel and i see the max range , and all data relative to manufactor
[attach=3]
I take my old programmer type CH341A and its onboard IC clamp, after more reprise it didnt success reading then i went to solder on PCB
[attach=4]
and starting reading and modifing data function from 01H to 40H like we see on my older post there is function above 30H
and the result is
RANGE Code Func position Hex
---------------------------------------
600 mVDC 01 08 03
60 VAC 0A 08 09
600 VAC 0B 08 0A
750 VAC 0C 08 0C
60 mA DC 29 08 0E 0F AUTO 11
600 mA DC 2A 08 0F
60K OHM 17 09 09
600 OHM 15 09 0B
NCV 22 08 05
6 VAC 09 08 08H
Live 24 08 0D
Hz 1D 8 0F
Cont 14 8 1C
1000VDC 06 9 00
600 VDC 05 9 01
60 VDC 04 9 02
60 A DC 2E 9 03
6 VDC 03 9 04
60 A AC 30 9 05
600mA AC 2C 9 06
6 M OHMS 19 9 07
600KOHMS 18 9 08
6K OMM 16 9 0A
° C 1F 9 0D
Hfe 21 9 0E
Diode 13 9 1C
600 mVAC 08 7 AUTO 33
60MOHM 1A
600MOHMS 1B
Cap 1C
% 1E
°F 20
600 uA DC 25 0D AUTO
6 mA DC 26
600 uA AC 27 0E AUTO
6 mA AC 28
60 mA AC 2B 10 AUTO
6 A DC 2D 11 AUTO
6 A AC 2F 12 AUTO 36
60 uA DC 31
60 uA AC
INFO the function is mentioned in right is the same range in AUTO mode
after this i change max range to 9999 count and over range OL is 10000
[attach=5]
after this i try to add some button like REL/RS232 and other but nothing hapened when switching.
I think for automatic ranging there is something added on data in the header of eeprom
Example : we see
[attach=7]
[attach=8]
it not described on DTM0660 datasheet
so i add on some range the same range in automode but i discover only Amper range can be in auto mode ( no volt no Ohms )
here is structure of 80h and BFh
0x80H 00 00 24 01 00 22 1a 19 09 0a 0b 21 0c 31 29 2a 06 05 04 2e 03 30 2c 2b 18 17 16 15 14 1f 1c 1d
0xA0H 00 00 00 07 00 00 00 00 00 00 00 00 00 0d 0f 00 00 00 00 00 00 00 00 10 00 00 00 00 13 20 00 1e
I have added
600mvAC on 600mvDC (not modified but ADDED)
60mADC AUTO on 60 mA DC
60mADC AUTO on 60 mA DC
600µADC AUTO on 60µA DC
that's all
any other suggestions ?