Author Topic: FNIRSI-1013D "100MHz" tablet oscilloscope  (Read 389542 times)

engineer.r152, Gennady111 and 6 Guests are viewing this topic.

Offline pcprogrammer

  • Super Contributor
  • ***
  • Posts: 3623
  • Country: nl
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #850 on: June 10, 2021, 07:51:54 pm »
Found a bug in my core code. The UMULL instruction was not correct. The upper 32 bits were always zero. Unfortunately the delays have longer duration so it is slower, but the "touch" does lead to changing the color of a button. Did not solve all the problems, because when "touch" is removed the color of the button stays changed and nothing else happens  :-//

Offline iscle

  • Regular Contributor
  • *
  • Posts: 60
  • Country: es
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #851 on: June 10, 2021, 07:59:11 pm »
That's great progress 👍🏻

While you are working on the simulator, I've ported the latest u-boot source code to the scope, and made it silent (it prints to uart0 but the pins are disabled by the pinmux).

It works perfectly, does not output anything to the lcd since I found it quite useless, and it starts booting linux right away.

The port is based on Icenowy's work, with SD-card support.

The patch to disable the uart is here: https://github.com/Iscle/u-boot-1013d/blob/081c12b95757eec06ea63be8999260da1df51bb3/arch/arm/mach-sunxi/board.c#L91

I'll proceed with booting the latest linux version now, and adding touchscreen drivers and an LVGL test app.
 
The following users thanked this post: pcprogrammer

Offline pcprogrammer

  • Super Contributor
  • ***
  • Posts: 3623
  • Country: nl
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #852 on: June 11, 2021, 11:09:33 am »
I'll proceed with booting the latest linux version now, and adding touchscreen drivers and an LVGL test app.

Hi iscle,

when you start to work on the touch be aware that the touch panel configuration set by the scope is based on 1024x600 pixels. In the scope code this is divided down to 800x480 pixels. A bit strange why they did this, because the display is only 800x480 and the touch panel can be set to this resolution.

So maybe make it such that you write your own configuration to the touch panel with the correct resolution and x/y directions.

Offline pcprogrammer

  • Super Contributor
  • ***
  • Posts: 3623
  • Country: nl
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #853 on: June 11, 2021, 04:10:03 pm »
Solved some problems around the "touch" of the scope.

Again made a copy, paste not edit error.
The mouse up event was send to the mouse down handler, so the scope once touched did not get a "no touch" message.

This still did not solve the problem, because it turned out I misinterpreted the working of the touch panel.
On removal of touch it seems it still needs to send an activity status, but with zero points of touch.
I just signaled touch with one touch point when the mouse was down and no status when the mouse was released. Changed that and now it is working.

Made a short video, in which I found that there are still some problems |O, but one can find it here:  https://youtu.be/rJAYoyNg9T0

Edit: The problem is the slowness. :-DD The trigger menu that looks like it is not working in the video does work, but needs a longer touch. :palm:

The emulator is not very fast, and I removed the delay functions from the scope code to overcome this a bit. The modified binary is in the folder of the scope emulator.

Now the investigation of the FPGA commands can begin :)

As usual the changes can be found in the repository (https://github.com/pecostm32/FNIRSI-1013D-Hack)
« Last Edit: June 11, 2021, 04:25:55 pm by pcprogrammer »
 
The following users thanked this post: tttonyyy

Offline pcprogrammer

  • Super Contributor
  • ***
  • Posts: 3623
  • Country: nl
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #854 on: June 12, 2021, 11:16:32 am »
Turns out that the special ic connected to the FPGA is not used for parameter storage.

The block of data at 0x001FD000 in the flash is where the parameters are stored. Apparently the scope writes the parameters back to flash. Not sure at what point in the code this is done and if it is only done when the power is turned off, but this means that the flash might fail after so many power cycles.

Changed some settings on my real scope and read the flash after a power cycle. Copied the data block to my emulator flash file (with the patched out SD support and  delays) and ran the program. The screen now shows the same setup as the real thing.

This means the special ic is used as some sort of translation or sequence device. I already identified what some of the id's used do, like 0x10 is for translating the 8 bit brightness setting to the 16 bits the FPGA wants for command 0x38.

0x0C is used to get the signal read command for channel 1, and 0x0D for channel 2. Not sure if they always return the same number.

One puzzle more or less solved. Many more to go |O

Offline pcprogrammer

  • Super Contributor
  • ***
  • Posts: 3623
  • Country: nl
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #855 on: June 12, 2021, 06:07:02 pm »
Tried to convert bianchifan's capture of the "I2C" communication between the FPGA and the special ic, but there are still errors. The first couple of packets are converted and then it misses starts and makes rubbish out of the data. Not sure why this happens.

To verify what is returned for parameter 0x0D (channel 2 data) I need a capture of a scope where channel 2 is enabled.

Looking at the output of the emulator makes me believe that e_Johny's scope has channel 2 disabled and he wrote that his problem with the touch panel is in that region.

So if anyone with a scope and a logic analyzer that works with the saleae software (https://www.saleae.com/downloads/) is willing to supply a capture with both channels enabled that would be appreciated.

Offline pcprogrammer

  • Super Contributor
  • ***
  • Posts: 3623
  • Country: nl
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #856 on: June 12, 2021, 07:33:40 pm »
The FPGA inner working is slowly being revealed.

Found the commands for the analog input controls.

Code: [Select]
Channel 1 settings
0x32  Is some sort of offset. Changes when the trace on the screen is moved up or down.
0x33  Select the input scaling (V/div). See table below
0x34  Select ac or dc coupling. 0x00 is ac coupling. 0x01 is dc coupling.

The offset is also changed when the V/div is changed.

         Scale        Screen offset
V/div    0x33         0x32
500mV    0x05         0x02 0xE0    //Uses the same setting as 1V/div. Scaling is done in software
1V       0x05         0x02 0xE0
2V       0x04         0x02 0xE7
5V       0x03         0x02 0xD3
10V      0x02         0x02 0xDA
25V      0x01         0x02 0xB9
50V      0x00         0x02 0xB9

Code: [Select]
Channel 2 settings
0x35  Is some sort of offset. Changes when the trace on the screen is moved up or down.
0x36  Select the input scaling (V/div). See table below
0x37  Select ac or dc coupling. 0x00 is ac coupling. 0x01 is dc coupling.

The offset is also changed when the V/div is changed.

V/div    0x36         0x35
500mV    0x05         0x04 0x99    //Uses the same setting as 1V/div. Scaling is done in software
1V       0x05         0x04 0x99
2V       0x04         0x04 0x9F
5V       0x03         0x04 0x96
10V      0x02         0x04 0x9C
25V      0x01         0x04 0x8B
50V      0x00         0x04 0x8D

Need to investigate the offset further to find the limits and to figure out what the FPGA does with them.

Offline e_Johny

  • Contributor
  • Posts: 12
  • Country: hu
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #857 on: June 12, 2021, 07:48:13 pm »

Rarely, I can switch ON the Ch2.
The "open CH" and the "open FFT" buttons sometimes works,
but "coupling" and "probe mode" never. They are stay in "AC" and "100X".

Can I help you (~capture) with this conditions?
 

Offline pcprogrammer

  • Super Contributor
  • ***
  • Posts: 3623
  • Country: nl
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #858 on: June 12, 2021, 07:57:16 pm »
Hi e_Johny,

All I need is an enabled channel 2, the rest of the settings don't matter :)

So if you can get the channel working and do a capture that would be great. :-+

Offline e_Johny

  • Contributor
  • Posts: 12
  • Country: hu
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #859 on: June 13, 2021, 09:11:40 am »
I made some "state-variant" captures.
(Details in the file names...)
 
The following users thanked this post: pcprogrammer

Offline pcprogrammer

  • Super Contributor
  • ***
  • Posts: 3623
  • Country: nl
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #860 on: June 13, 2021, 09:55:56 am »
I made some "state-variant" captures.
(Details in the file names...)

Hi e_Johny, thanks for the data. :-+

Things are getting clearer. Identified more of the FPGA commands. Now looking at how the trigger system works. It looks like some of it is done in software and some in the FPGA.
Getting some interesting signals out of it when switched down to 10nS/div :-DD

Inputting the same square wave since it is hard coded in the program, but getting a sine wave out of it :-//

The second channel, on which the trigger is enabled, slowly changes to the sine wave in the second image.

Offline pcprogrammer

  • Super Contributor
  • ***
  • Posts: 3623
  • Country: nl
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #861 on: June 13, 2021, 10:48:31 am »
The capture with both channels enabled confirmed what I expected. The id 0x0D returns 0x22.

Code: [Select]
{ 0x00, 0xCB, 0x7B, 0xEA, 0x57, 0xA8, 0x08, 0x9D },{ 0x00, 0xF5, 0x45, 0xD4, 0x69, 0x96, 0x36, 0xA3 },  //Checksum ok  Data: 0x000036A3  Id: 0x11  Len: 1
{ 0x01, 0xC2, 0x67, 0x38, 0x54, 0xAB, 0x3E, 0x51 },{ 0x01, 0x3D, 0x5A, 0x05, 0x69, 0x96, 0x03, 0x6C },  //Checksum ok  Data: 0x0000036C
{ 0x00, 0xE3, 0x0D, 0xD0, 0x54, 0xAB, 0xA4, 0x3D },{ 0x00, 0xDE, 0x30, 0xED, 0x69, 0x96, 0x99, 0x00 },  //Checksum ok  Data: 0x00000000  Id: 0x0C  Len: 0
{ 0x01, 0x77, 0xDD, 0x1D, 0xE1, 0x1E, 0x11, 0xA8 },{ 0x01, 0x88, 0x55, 0x95, 0x69, 0x96, 0x99, 0x20 },  //Checksum ok  Data: 0x00000020
{ 0x00, 0x06, 0xA4, 0x44, 0xE1, 0x1E, 0x11, 0x8A },{ 0x00, 0x8E, 0x2C, 0xCC, 0x69, 0x96, 0x99, 0x02 },  //Checksum ok  Data: 0x00000002  Id: 0x0B  Len: 0
{ 0x01, 0x24, 0x8E, 0xA7, 0xB2, 0x4D, 0x42, 0x6F },{ 0x01, 0xDB, 0x55, 0x7C, 0x69, 0x96, 0x99, 0xB4 },  //Checksum ok  Data: 0x000000B4
{ 0x00, 0x7E, 0xEF, 0x89, 0xB2, 0x4D, 0x42, 0xDB },{ 0x00, 0xA5, 0x34, 0x52, 0x69, 0x96, 0x99, 0x00 },  //Checksum ok  Data: 0x00000000  Id: 0x0D  Len: 0
{ 0x01, 0x64, 0xCE, 0x31, 0xF2, 0x0D, 0x02, 0xB9 },{ 0x01, 0x9B, 0x55, 0xAA, 0x69, 0x96, 0x99, 0x22 },  //Checksum ok  Data: 0x00000022
{ 0x00, 0x6E, 0xB7, 0xBF, 0xF2, 0x0D, 0x02, 0x99 },{ 0x00, 0xF5, 0x2C, 0x24, 0x69, 0x96, 0x99, 0x02 },  //Checksum ok  Data: 0x00000002  Id: 0x0B  Len: 0
{ 0x01, 0x84, 0x2E, 0x67, 0x12, 0xED, 0xE2, 0xCF },{ 0x01, 0x7B, 0x55, 0x1C, 0x69, 0x96, 0x99, 0xB4 },  //Checksum ok  Data: 0x000000B4

The scope reads the signal data from the FPGA with the command numbers returned from the special chip. When the time-base is lowered the scope either switches to or uses both (this happens in the emulator) to the command numbers 0x21 and 0x23. (In the emulator it reads them in sequence 0x20, 0x21, 0x22, 0x23)

So it would be interesting to see what the communication between the FPGA and the special ic is when the time base is set to 10nS/div.

e_Johny, are you willing to do this capture for me? (Both channels enabled, time base 10nS/div, trig mode auto)

Offline e_Johny

  • Contributor
  • Posts: 12
  • Country: hu
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #862 on: June 13, 2021, 11:36:54 am »
Of course.  :-+
« Last Edit: June 13, 2021, 11:40:52 am by e_Johny »
 
The following users thanked this post: pcprogrammer

Offline pcprogrammer

  • Super Contributor
  • ***
  • Posts: 3623
  • Country: nl
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #863 on: June 13, 2021, 12:18:50 pm »
It looks like that the data returned stays the same. Guess this means that the scope reads two buffers of data per channel when in 25nS and 10nS per div mode. For the settings 50nS - 50mS it seems to read a single buffer per channel and for the settings 100mS - 50S it switches to reading data from command 0x24 and 0x26. Tracing showed 10 bytes per read.

The interfacing with the FPGA for the data and triggering is some sequence of commands that need some more exploration, but most of it is revealed.

For the trigger setting it seems to use two commands 0x0E for the lower settings and 0x0D for the higher settings.

Code: [Select]
Trigger time / div settings
0x0E  is written with four data bytes

time / div     Command 0x0E bytes
10nS           0x00 0x06 0x45 0xDC     (Read data from 0x20, 0x22 and 0x21, 0x23)
25nS           0x00 0x06 0x45 0xDC     (Read data from 0x20, 0x22 and 0x21, 0x23)
50nS           0x00 0x06 0x45 0xDC
100nS          0x00 0x06 0x45 0xDC
250nS          0x00 0x06 0x45 0xDC
500nS          0x00 0x06 0x45 0xDC
1uS            0x00 0x03 0x25 0xDC
2uS            0x00 0x01 0x45 0xDC
5uS            0x00 0x00 0x55 0xDC
10uS           0x00 0x00 0x55 0xDC
20uS           0x00 0x00 0x25 0xDC
50uS           0x00 0x00 0x15 0xDC
100uS          0x00 0x00 0x0B 0xB8
200uS          0x00 0x00 0x09 0xC4
500uS          0x00 0x00 0x09 0xC4
1mS            0x00 0x00 0x09 0xC4
2mS            0x00 0x00 0x09 0xC4
5mS            0x00 0x00 0x09 0xC4
10mS           0x00 0x00 0x07 0x08
20mS           0x00 0x00 0x03 0x20
50mS           0x00 0x00 0x03 0x20

From here on it seems that the FPGA switches to 0x0D for time base setting and the data is read with 0x24 and 0x26, 10 bytes per read.
time / div     Command 0x0D bytes
100mS          0x00 0x00 0x07 0xD0
200mS          0x00 0x00 0x07 0xD0
500mS          0x00 0x00 0x07 0xD0
1S             0x00 0x00 0x07 0xD0
2S             0x00 0x00 0x07 0xD0
5S             0x00 0x00 0x07 0xD0
10S            0x00 0x00 0x07 0xD0
20S            0x00 0x00 0x07 0xD0
50S            0x00 0x00 0x07 0xD0

This means it is possible to write one owns software for the scope :)

After I found the actual sequencing of commands I will make a document of it and upload it to the repository.

Offline bianchifan

  • Regular Contributor
  • *
  • Posts: 94
  • Country: de
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #864 on: June 13, 2021, 01:07:22 pm »
a logic analyzer that works with the saleae software
no chance with me :(
If you still need some data and trouble wih he sigrok format I can try to compress one or more of SRs supportet logical binary formats (SaLEAE isn't supported as output) as there are: raw binary logic or digits logic.

This means it is possible to write one owns software for the scope :)
Until last night I had no idea of the F1C100 SOC, I only knew "Allwinner" from my Orange Pis.
Last night I must learn F1C..crap be ing based on a more than 20ys old ARM design.. |O |O |O |O :-DD :-DD :-DD
No GPU..no FPU!!

Really worth?
For a frontend with 50mV/div best if you can solve the trigger shit for signals below 200mV?
 
The following users thanked this post: e_Johny

Offline bianchifan

  • Regular Contributor
  • *
  • Posts: 94
  • Country: de
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #865 on: June 13, 2021, 01:36:49 pm »
 
The following users thanked this post: e_Johny

Offline pcprogrammer

  • Super Contributor
  • ***
  • Posts: 3623
  • Country: nl
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #866 on: June 13, 2021, 02:05:15 pm »
a logic analyzer that works with the saleae software
no chance with me :(
If you still need some data and trouble wih he sigrok format I can try to compress one or more of SRs supportet logical binary formats (SaLEAE isn't supported as output) as there are: raw binary logic or digits logic.

This means it is possible to write one owns software for the scope :)
Until last night I had no idea of the F1C100 SOC, I only knew "Allwinner" from my Orange Pis.
Last night I must learn F1C..crap be ing based on a more than 20ys old ARM design.. |O |O |O |O :-DD :-DD :-DD
No GPU..no FPU!!

Really worth?
For a frontend with 50mV/div best if you can solve the trigger shit for signals below 200mV?

Sure it is an old processor, but it works and it is being used in other cheap Chinese scopes.

I have all the capture data I need for now.

To solve the trigger problems with the scope will involve making a new FPGA implementation. Doable, but will take some time. For now it still is fun to unveil all the secrets of the scope. For me that is hobby :)

Offline pcprogrammer

  • Super Contributor
  • ***
  • Posts: 3623
  • Country: nl
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #867 on: June 14, 2021, 01:01:42 pm »
Added a new directory to the repository: https://github.com/pecostm32/FNIRSI-1013D-Hack/tree/main/FPGA%20explained

Most of the commands are now known and I believe it is possible to use the information to create a working scope.

Need to make some extra sequence traces for the different time base settings, because there are differences in how the scope reads signal data from the FPGA.

The file (Startup and signal data read sequence.txt) that is there now shows the working for 20uS/div and is valid for the range from 50nS to 50mS.

For the FPGA I will make a c source with what is needed for the communication with the special IC.

Offline pcprogrammer

  • Super Contributor
  • ***
  • Posts: 3623
  • Country: nl
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #868 on: June 14, 2021, 07:06:25 pm »
Guess this is it for now. :=\

Found most of the FPGA functions and added several trace files of the sequences for reading data from the FPGA to the repository. Also created a new directory with the c source for the FPGA functions https://github.com/pecostm32/FNIRSI-1013D-Hack/tree/main/Test%20code/FPGA_functions

Did not test the functions for communicating with the special IC yet, but most of that code has been tested in the code I made for decrypting the capture data and in the emulator itself were it returns the correct data to the scope code. It also needs a delay function. In the comments within the code it is indicated where this is needed.

I will continue with trying to fully reverse the original source code, but that will take a it's time. 8)

Offline voltsandjolts

  • Supporter
  • ****
  • Posts: 2281
  • Country: gb
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #869 on: June 14, 2021, 07:46:25 pm »
Guess this is it for now. :=\

...enjoy your very well earned rest! :-+
 

Offline tv84

  • Super Contributor
  • ***
  • Posts: 3212
  • Country: pt
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #870 on: June 14, 2021, 08:23:16 pm »
Guess this is it for now. :=\

You've been awake all this time??  :clap:
 

Offline pcprogrammer

  • Super Contributor
  • ***
  • Posts: 3623
  • Country: nl
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #871 on: June 15, 2021, 04:41:57 am »
Guess this is it for now. :=\

You've been awake all this time??  :clap:

If so I would have needed a coffin smiley :-DD

It was to indicate that there won't be any new updates about the reverse engineering for a while :-X might have been a better smiley for it.

Offline pickle9000

  • Super Contributor
  • ***
  • Posts: 2438
  • Country: ca
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #872 on: June 21, 2021, 07:11:44 pm »
Super enjoyable thread.
 
The following users thanked this post: pcprogrammer

Offline DavidAlfa

  • Super Contributor
  • ***
  • Posts: 5835
  • Country: es
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #873 on: June 21, 2021, 07:40:17 pm »
If the Hantek thread had only 1/10 the interest I see here!  :-DD Nice reverse engineering
Hantek DSO2x1x            Drive        FAQ          DON'T BUY HANTEK! (Aka HALF-MADE)
Stm32 Soldering FW      Forum      Github      Donate
 
The following users thanked this post: pcprogrammer

Offline pcprogrammer

  • Super Contributor
  • ***
  • Posts: 3623
  • Country: nl
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #874 on: June 22, 2021, 10:19:26 am »
Just to let everybody know I'm still at it.

Found a bit more about how the display part of the code works. It is quite the puzzle but I identified the fonts being used. There are 7 fonts in the flash.

Edit: I missed one. There are 8 fonts.
Edit: It looks like some of the fonts share data and some are for single byte characters and some look to be for 2 byte characters (UTF-8 / UTF-16 or something like that)

Code: [Select]
FONT addresses
0x8018A380
0x8018A3A4
0x8018AC58       (Used for the channel menus)
0x8018B738       (Used for error messages)
0x8018C1C0
0x8018D558
0x8018F508        (Edit: Missed this one)
0x801913B0

Also mapped parts of the structures being used to hold the data. Having done some work in the graphics industry (writing drivers for large inkjet and other kind of printers) I know a bit about what comes into play, and can make some educated guesses about what a variable is for, but still it ain't easy :palm:

The story keeps going on :popcorn:
« Last Edit: June 22, 2021, 12:03:33 pm by pcprogrammer »
 
The following users thanked this post: luma


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf