Author Topic: FNIRSI-1013D "100MHz" tablet oscilloscope  (Read 29469 times)

0 Members and 2 Guests are viewing this topic.

Offline GeorgeOfTheJungle

  • Super Contributor
  • ***
  • !
  • Posts: 2704
  • Country: tr
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #225 on: July 19, 2020, 02:53:07 pm »
Does it come with an SDCard or is the SD slot empty?
The further a society drifts from truth, the more it will hate those who speak it.
 

Offline iscle

  • Contributor
  • Posts: 32
  • Country: es
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #226 on: July 19, 2020, 02:55:27 pm »
Does it come with an SDCard or is the SD slot empty?

It comes with a 2GB SDCard I think.
 

Offline iscle

  • Contributor
  • Posts: 32
  • Country: es
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #227 on: July 19, 2020, 02:59:06 pm »
"F1C100S  XiaoTaoQi  Disk 1.0" inside.

I was just thinking. This could be part of the USB descriptor table. When you plug it in to a PC, it shows up as a USB drive. Anyone with the scope can check it on device manager.
 

Offline rhb

  • Super Contributor
  • ***
  • Posts: 3078
  • Country: us
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #228 on: July 19, 2020, 02:59:41 pm »
pic_system.sys appears to be a touchscreen library by a company call JuTouch.  The server doesn't seem to be accessible, but google had this cached:

Comprehensive system support. Supporting wide variety of operating systems (Linux, Windows, IOS, and Android). pic_system. About JuTouch

Haven't found anything else that looks likely for the other stuff.  It's obviously not a quantum computer nor a video game.  piclist.sys did produce a hit on a Chinese Python library but google translate just briefly showed it in Chinese and then blanked the screen.  I think it's an OCR library though.
 

Online tv84

  • Super Contributor
  • ***
  • Posts: 1814
  • Country: pt
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #229 on: July 19, 2020, 03:00:34 pm »
The F1C100s has no internal memory, only RAM, so it must be in flash. Normally they run Linux, but in this case they must be using something else (somebody suggested XBoot paired with other software). It makes sense as the flash chip is only 2MB, Linux won't fit in there.

So it's a F1C100 proc with all the FW in the SPI mem.

There is no filesystem, outside the SD Card. There is only an app launched by the secondary bootloader (SPL block).

They simplified also by not having to deal with FW upgrades...
 

Offline GeorgeOfTheJungle

  • Super Contributor
  • ***
  • !
  • Posts: 2704
  • Country: tr
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #230 on: July 19, 2020, 03:00:58 pm »
Does it come with an SDCard or is the SD slot empty?
It comes with a 2GB SDCard I think.

Might as well be booting from there, then, no?
The further a society drifts from truth, the more it will hate those who speak it.
 

Offline cliffyk

  • Frequent Contributor
  • **
  • Posts: 284
  • Country: us
    • PaladinMicro
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #231 on: July 19, 2020, 03:02:43 pm »
Personally I can not understand at all why so small amount of noise and ranting is about this "1GSa/s  100MHz" total hoax - fraud. Totally shameful outrageous scam if it is just as in Dave's video and HW is like displayed and if it is true what ADC there is.

Are you in a position to do anything about it?

We're busy hacking it into something useful.

I have written scathing reviews on Amazon, for both the product and the vendors of this and the "bar of soap" ADS 5012 model, however they do not seem to care. Yeapook is a brand name of Shenzhen Yipu Commercial and Trading Co., Ltd however I have not been able to determine if they are indeed the manufacturer of this device. The only contact info I have found is their snail-mail address.

As far as I can determine there is no online support for the product. I have contacted the vendor fom whom i purchased it (Ccfoud-US via Amazon) but have had no response. It was however a "fulfilled by Amazon"item so it can go back if I find it to not meet even my modest needs.

We'll see...

I have also determined that there is no triggered operation at sweeps slower than 10 ms/div. The scroll mode does work at 100ms/div and slower but it is just a non-triggered unsynchronized repetitive left to right sweep that would be of little to no use capturing aperiodic single-shot events unless you were to continuously monitor it and manually stop the capture when you "got one; and IF the event does not occur during the "retrace" period.

To be fair, my Hantek DSO1062B also does not have triggered operation in "scroll mode". The Lecroy WJ 322 does. but that's a $2000 instrument.

It is still "as cute as a bug's ear", but it may be going back...
« Last Edit: July 19, 2020, 03:09:34 pm by cliffyk »
-cliff knight-

paladinmicro.com
 

Offline rhb

  • Super Contributor
  • ***
  • Posts: 3078
  • Country: us
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #232 on: July 19, 2020, 03:03:58 pm »
"F1C100S  XiaoTaoQi  Disk 1.0" inside.

https://linux-sunxi.org/images/b/ba/F1C100s_Datasheet_V1.0.pdf

There is a big part that looks obfuscated (starting around offset 0x184C80).

I did not find the string in the datasheet.  The apparently obfuscated part may be the FPGA bitstream.  However, there is a string "Encrypt" in the image.

 

Offline cliffyk

  • Frequent Contributor
  • **
  • Posts: 284
  • Country: us
    • PaladinMicro
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #233 on: July 19, 2020, 03:05:02 pm »
Does it come with an SDCard or is the SD slot empty?

It comes with a 2GB SDCard I think.

Mine came with a SanDisk 1 GB card...
-cliff knight-

paladinmicro.com
 
The following users thanked this post: iscle

Offline iscle

  • Contributor
  • Posts: 32
  • Country: es
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #234 on: July 19, 2020, 03:06:15 pm »
It comes with a 2GB SDCard I think.

Might as well be booting from there, then, no?

I still don't have the scope with me, but I did read somewhere that the SDCard only contained the screenshots and saved data.
 

Offline iscle

  • Contributor
  • Posts: 32
  • Country: es
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #235 on: July 19, 2020, 03:08:32 pm »
The F1C200s is the same as F1C100s, but with double the RAM. All the registers are the same, so this user manual applies to our chip too:
https://www.thirtythreeforty.net/posts/2020/02/trying-the-allwinner-f1c200s/Allwinner_F1C200s_User_Manual_V1.1.pdf

It contains all the CPU and Peripherals registers and descriptions about them. Might be useful to use with Ghidra.
 

Online tv84

  • Super Contributor
  • ***
  • Posts: 1814
  • Country: pt
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #236 on: July 19, 2020, 03:09:43 pm »
I did not find the string in the datasheet.  The apparently obfuscated part may be the FPGA bitstream.  However, there is a string "Encrypt" in the image.

Reg, the string is in the FW. Some guys call "encrypt" to simple obfuscation methods. The pattern that I refer to doesn't seem to be a "standard" encryption output. But...

Yes, I also noticed that there is no "clear" FPGA block in the FW.

Does the scope have any FPGA? Which?
 

Online tv84

  • Super Contributor
  • ***
  • Posts: 1814
  • Country: pt
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #237 on: July 19, 2020, 03:11:04 pm »
The F1C200s is the same as F1C100s, but with double the RAM. All the registers are the same, so this user manual applies to our chip too:
https://www.thirtythreeforty.net/posts/2020/02/trying-the-allwinner-f1c200s/Allwinner_F1C200s_User_Manual_V1.1.pdf

It contains all the CPU and Peripherals registers and descriptions about them. Might be useful to use with Ghidra.

https://linux-sunxi.org/F1C100s

http://www.allwinnertech.com/index.php?c=product&a=index&id=73

Allwinner's in-house operating system Melis 2.00

This guy managed to insert linux OS on a machine running Melis OS (and with a Allwinner F1C500S chip).
« Last Edit: July 19, 2020, 03:23:17 pm by tv84 »
 
The following users thanked this post: GeorgeOfTheJungle

Offline GeorgeOfTheJungle

  • Super Contributor
  • ***
  • !
  • Posts: 2704
  • Country: tr
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #238 on: July 19, 2020, 03:13:01 pm »
Does it come with an SDCard or is the SD slot empty?

It comes with a 2GB SDCard I think.

Mine came with a SanDisk 1 GB card...

Does it boot w/o the card? Can you have a look and tell us what's in the card? Ideally, partitions, filesystem types, and start blocks too :-)
« Last Edit: July 19, 2020, 03:15:00 pm by GeorgeOfTheJungle »
The further a society drifts from truth, the more it will hate those who speak it.
 

Online tv84

  • Super Contributor
  • ***
  • Posts: 1814
  • Country: pt
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #239 on: July 19, 2020, 03:14:14 pm »
Does it boot w/o the card? Can you have a look and tell us what's in the card?

It has to. The card is extra.
 

Offline rhb

  • Super Contributor
  • ***
  • Posts: 3078
  • Country: us
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #240 on: July 19, 2020, 03:16:15 pm »
The FPGA is an Altera part, but I don't recall the version from Dave's video.

I found this in the image at two different locations.  Does anyone recognize the byte pattern?

rhb@Hipster:/export/home/rhb/Downloads/fnirsi$ head bb bbb
==> bb <==
0060000 006  \0  \0 352   e   G   O   N   .   E   X   E  \0  \0  \0  \0
0060020  \0   t  \0  \0   E   X   E   C  \0  \0  \0  \0  \0  \0  \0  \0
0060040 333 360   ! 343   X   П  ** 345 327 360   ! 343   T   П  ** 345
0060060 322 360   ! 343   P   П  ** 345 321 360   ! 343   L   П  ** 345
0060100 337 360   ! 343   H   П  ** 345 323 360   ! 343   D   П  ** 345
0060120 020 017 021 356 002  \n 300 343 020 017 001 356   8  \0 237 345
0060140 020   / 021 356 002   * 022 342  \0 020 240 003   , 020 237 025

==> bbb <==
0470000 006  \0  \0 352   e   G   O   N   .   E   X   E  \0  \0  \0  \0
0470020  \0   2 031  \0   E   X   E   C  \0  \0  \0  \0  \0  \0  \0  \0
0470040 333 360   ! 343   X   П  ** 345 327 360   ! 343   T   П  ** 345
0470060 322 360   ! 343   P   П  ** 345 321 360   ! 343   L   П  ** 345
0470100 337 360   ! 343   H   П  ** 345 323 360   ! 343   D   П  ** 345
0470120 020 017 021 356 002  \n 300 343 020 017 001 356   8  \0 237 345
0470140 020   / 021 356 002   * 022 342  \0 020 240 003   , 020 237 025

 

Online tv84

  • Super Contributor
  • ***
  • Posts: 1814
  • Country: pt
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #241 on: July 19, 2020, 03:19:08 pm »
It has 4 blocks:

00000000 - SPL (secondary bootloader)
00006000 - 1st executable (OS part that deals with the SD card)
00013000 - bitmap
00027000 - 2nd executable (main app)

My best guesses ATM.
« Last Edit: July 19, 2020, 03:28:38 pm by tv84 »
 
The following users thanked this post: iscle

Offline rhb

  • Super Contributor
  • ***
  • Posts: 3078
  • Country: us
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #242 on: July 19, 2020, 03:36:17 pm »
It has 4 blocks:

00000000 - SPL (secondary bootloader)
00006000 - 1st executable (OS part that deals with the SD card)
00013000 - bitmap
00027000 - 2nd executable (main app)

My best guesses ATM.

ATM?  I shudder to think what google will return for that.  Can you explain?
 

Offline iscle

  • Contributor
  • Posts: 32
  • Country: es
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #243 on: July 19, 2020, 03:37:08 pm »
Function at 0x00042830 seems to be an init/hardware check function. It calls a function related to the FPGA, which if it fails, prints "FPGA Failed" through the serial port or some sort of log file.
 

Offline iscle

  • Contributor
  • Posts: 32
  • Country: es
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #244 on: July 19, 2020, 03:38:41 pm »
It has 4 blocks:

00000000 - SPL (secondary bootloader)
00006000 - 1st executable (OS part that deals with the SD card)
00013000 - bitmap
00027000 - 2nd executable (main app)

My best guesses ATM.

ATM?  I shudder to think what google will return for that.  Can you explain?

ATM = At The Moment ;P
 
The following users thanked this post: tv84

Online UniSoft

  • Regular Contributor
  • *
  • Posts: 87
  • Country: kz
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #245 on: July 19, 2020, 03:38:52 pm »
...I think something is missing...
Something what? there is no another flash... that is a full dump of SPI flash...

Does anyone recognize the filesystem?
this is a plain binary file... not filesystem...
at start executing standard initialization... stack pointers for different modes... initializing ram.. etc

There is a big part that looks obfuscated (starting around offset 0x184C80).
it is not obfuscated... it is some table... note values coming in ascending order.
it looks more as a map, unicode characters conversion table.
 

Online tv84

  • Super Contributor
  • ***
  • Posts: 1814
  • Country: pt
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #246 on: July 19, 2020, 03:43:15 pm »
it is not obfuscated... it is some table... note values coming in ascending order.
it looks more as a map, unicode characters conversion table.

No way, it looks obfuscated. There are very few "clear" strings...
 

Offline rhb

  • Super Contributor
  • ***
  • Posts: 3078
  • Country: us
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #247 on: July 19, 2020, 03:44:56 pm »
Can someone post a disassembly?  I should be able to identify all the function and variable addresses with a bit of awk.  That will also tell us if the "obfuscated" section is a bitstream.
 

Online tv84

  • Super Contributor
  • ***
  • Posts: 1814
  • Country: pt
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #248 on: July 19, 2020, 03:48:51 pm »
Can someone post a disassembly?

I'm away from my dev station...
 

Online UniSoft

  • Regular Contributor
  • *
  • Posts: 87
  • Country: kz
Re: FNIRSI-1013D "100MHz" tablet oscilloscope
« Reply #249 on: July 19, 2020, 03:53:52 pm »
Does it come with an SDCard or is the SD slot empty?
Yep, 1GB... I've tried 32GB (FAT32) working!
without card if you try to save anything, device will hang...

...I did read somewhere that the SDCard only contained the screenshots and saved data.
Yep, only for screenshots and saved data.

Does it boot w/o the card? Can you have a look and tell us what's in the card? Ideally, partitions, filesystem types, and start blocks too :-)
Yep, working without SD... but hangs if you try to save.

No way, it looks obfuscated. There are very few "clear" strings...
My 20 years of experience in reverse engineering tells me that this is a table, not a code. But I will know for sure only when I reach that place.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf