Author Topic: FNIRSI-1013D "100MHz" tablet oscilloscope (Read 410287 times)

pcprogrammer · « **Reply #1075 on:** October 18, 2021, 06:12:21 pm »

I have tried it with bigger cards and it does not work with FEL boot. I use 128MB cards. Next one up, I have lying around, is 4GB and that fails.

Your touch panel is an old version one so unfortunately not the one I need.

If you are up for testing new firmware when ready it will be helpful to get a smaller micro sd card.

Managed to fix my new scope by patching the configuration data with the touch panel configuration I created and tested with my version of the code. Still would like to get the original firmware to compare the touch panel configuration, but not a big deal.

On to the next challenge in the project. USB!

pcprogrammer · « **Reply #1076 on:** October 18, 2021, 06:16:28 pm »

Quote from: frenky on October 18, 2021, 06:00:44 pm

And on the big flex cable there is no IC on top or bottom side:

That is correct. Is just for the LCD, which does not do the touch. Interesting to see the part number of it though. Different from both my versions.

frenky · « **Reply #1077 on:** October 18, 2021, 06:21:55 pm »

Good to see you got it working again. I will try to find online 2GB microsd card to have it at hand when you have beta firmware ready.

pcprogrammer · « **Reply #1078 on:** October 18, 2021, 06:28:50 pm »

Here they still seem to provide from small to larger micro sd cards

The 128MB will work for sure.

https://nl.aliexpress.com/item/1005002618854916.html

pcprogrammer · « **Reply #1079 on:** October 19, 2021, 02:57:33 pm »

After an hour or so trying to get an eclipse project for the F1C100s USB, I found on the net, to compile in my netbeans environment, I can see some light in the Allwinner USB darkness.

Documentation for the USB interface in the F1C100s seems to be nonexistent

The programmers manual for it only gives the base address of the registers and a very brief insight in what it is capable of

Luckily the sunxi folk wrote drivers for it, and that is what the project I found is based on, so I have a listing of the registers. Based on this information, I found a block of code in the Ghidra disassembly of the scope firmware that makes use of these addresses. Now I have to see if it matches the sunxi code, and find the device descriptor data.

I have some experience with USB on the STM32F103, for which I wrote a bare metal driver, so at least some idea on what I'm doing

pcprogrammer · « **Reply #1080 on:** October 20, 2021, 08:25:19 am »

Quote from: pcprogrammer on October 17, 2021, 05:28:28 pm

Is it my internet or is EEVBLOG having problems. The last couple of days it takes longer to load a page or start a new post. To get to this one it first timed out and needed a reload to get it open again.

Turns out it was a problem at my provider. Received an email of them yesterday announcing they where going to service things from 23:00 to 6:00 to resolve some problems. This morning I discovered they only made it worse

Internet was up, but the only page I could reach was the login page of the provider itself. No other pages could be reached for as far as I tried.

Now it is still wonky, but the EEVblog is reachable

pcprogrammer · « **Reply #1081 on:** October 20, 2021, 04:08:08 pm »

I'm in luck

They did use the sunxi code to make the USB device. Already matched a lot of the functions. Still to be done is the interrupt handler where a connection with the SD card has to be made. This is not in the eclipse project I found and mentioned earlier, so have to search the FNIRSI code to figure that out.

But there is a good starting point now, and hopefully it will be reversed soon.

When the USB stuff is working I will write a proper solution for the touch panel variations. To safeguard systems I'm thinking of saving the original configuration to a file on the SD card. This way there is a backup in case of problems. Unfortunately I don't see a solution for safeguarding the original firmware without opening the scope and make use of FEL boot or de-soldering the flash chip.

One option that springs to mind is a version of linux on an SD card, that reads the flash to a file on the SD card. I have tested running linux from a 4GB SD card, so the size limit for FEL is not an issue then.

Maybe this is something somebody can try to whip up, as I have already enough to do on getting the thing reversed

pcprogrammer · « **Reply #1082 on:** October 22, 2021, 09:03:50 am »

Found most of the things needed for the reversal of the USB part.

The descriptors turned out to be in the packed data that is unpacked on system startup. They did not clean up the USB code to just be for the mass storage device, so HID, CDC and UVC descriptors are also in there. Not used but there are checks in the code that are a waist of cpu cycles and code space.

One benefit of them being lazy is that the debug strings are still in the code, which made matching with the sunxi source easier to do

Did a search in the Ghidra output to see how many unidentified functions (FUN_8...) are left in there. Still 378 of the 804 functions reported when exporting to C code.

I thought I touched more of it all, but I did skip the display library, so quite a bit of functions can be in there.

Also looked at the size of the code without the bitmaps. Still almost 600KB. My version at the moment is 200KB. With what still needs to be implemented it will grow a bit, but not by that much.

pcprogrammer · « **Reply #1083 on:** October 22, 2021, 05:12:39 pm »

Worked the USB code in to the scope project and cleaned it up a bit (removed the debug prints, since there is no usable uart to send them to) and it compiles.

Implemented the part of the user interface to enable the USB connection and tested that.

Next step is to actually use the USB code. Want to test it first with a CH340 descriptor set and just return received data to see if that works. When that is working change it to the mass storage descriptors and figure out what is needed to get that working. I do have an example project for a STM32H7 mcu, so can peek there.

Funny thing is that the FNIRSI scope uses the STM32 vendor id for its mass storage device

Edit: Why is the image not being showed on the "attachimg=1" location? I used the "Inline full-size image" option.

FNIRSI-1013D "100MHz" tablet oscilloscope

tv84 · « **Reply #1084 on:** October 22, 2021, 06:14:55 pm »

Quote from: pcprogrammer on October 22, 2021, 05:12:39 pm

Edit: Why is the image not being showed on the "attachimg=1" location? I used the "Inline full-size image" option.

Once the FNIRSI is done you can have a peek at the webserver code here in EEVBLOG...

pcprogrammer · « **Reply #1085 on:** October 22, 2021, 06:53:25 pm »

Quote from: tv84 on October 22, 2021, 06:14:55 pm

Once the FNIRSI is done you can have a peek at the webserver code here in EEVBLOG...

No thanks, done that and been there

Embedded programming is more my thing now.

wormey · « **Reply #1086 on:** October 23, 2021, 06:57:49 am »

I may have one of the model you're looking for. It has the recessed BNCs, a wide cable with chip on top going to the display, and an 8GB microSD. And it has the FNIRSI logo on the front.
If there's more identification you need, tell me what to look for.
If this is sufficient, point me to instructions to get the data you need.
Steve

pcprogrammer · « **Reply #1087 on:** October 23, 2021, 08:10:20 am »

Welcome to the forum

Can you post a close up picture of the touch panel ic like @Frenky did on the previous page?

I can then see if the touch panel matches my version. If so I will guide you through getting the firmware out.

wormey · « **Reply #1088 on:** October 23, 2021, 07:05:15 pm »

I see now the chip is not on the big cable. (I was up late last night.)
How is this?

pcprogrammer · « **Reply #1089 on:** October 23, 2021, 07:36:00 pm »

Unfortunately not the same as in mine. It only has 10 sens lines and 16 driver lines connected.

So this seems to be the more common one.

Not a big deal since I got mine working again.

Once I have the USB part working, I'm going to look into a better setup for the touch panel configuration, where it uses the original configuration and only make a change to the resolution as needed. This way the orientation should remain correct.

Also have been thinking about safeguarding the original firmware. Won't try the linux way, but maybe write my own SD card boot that copies both the touch panel configuration as well as the firmware (complete flash) to the SD card, and have USB mass storage enabled so it can easily be copied to a computer.

On the USB front I got the CH340 device, I'm coding as a test case, to be recognized by the host, but the scope freezes, so something is wrong. But I will get there

wormey · « **Reply #1090 on:** October 23, 2021, 07:54:55 pm »

OK. I have enjoyed reading your posts, and had hoped to be able to contribute something back, but oh, well....

What with all the errors I have read about in the FNIRSI software, I'm looking forward to being able to install something that works better.

zildan · « **Reply #1091 on:** October 27, 2021, 01:21:59 pm »

Is good?

pcprogrammer · « **Reply #1092 on:** October 27, 2021, 04:31:13 pm »

Unfortunately also the more standard 10x16 touch panel.

Most likely mine is from a fairly new production run. I bought it this august, so if anyone has bought one after that time there is a bigger change on having the same one.

Still fiddling with the USB. Haven't had a lot of time for it, but once that is done I will try to make a peace of code that, if possible, can be written to the SD card via the scope software and after a reboot makes a copy of the touch panel configuration and the firmware. This way there is no need to open up the scope

Some experimenting is needed for this

Mine has no detachable cable. See the picture below.

jchd · « **Reply #1093 on:** October 29, 2021, 04:00:32 am »

Here's my version.

jchd · « **Reply #1094 on:** October 29, 2021, 04:03:46 am »

The chip on cable.
Second picture with another setting.

jchd · « **Reply #1095 on:** October 29, 2021, 04:07:03 am »

Markings on cable even if you probably figured that out already!

pcprogrammer · « **Reply #1096 on:** October 29, 2021, 05:48:26 am »

Hi jchd, welcome to the forum.

Yours is also the 16x10 version.

As can be seen on the picture it has the sens0-sens9 connected on the left side of the chip (on your picture). To be the same with mine it needs sens0-sens11 connected.

For the driver lines there is a gap between the used lines. The common one has drv0-drv6 and drv15-drv23 connected. Mine has drv0-drv10 and drv12-drv21 connected.

jchd · « **Reply #1097 on:** October 29, 2021, 10:44:45 am »

I bought it from the FNIRSI shop on 09/09/21. Of course it's branded "FNIRSI".

There are sooo many differing cables... Isn't that surprising?

pcprogrammer · « **Reply #1098 on:** October 29, 2021, 11:13:36 am »

I guess it all depends on their, or their production company, purchase and stock policy. With the shortage caused by covid they might have to source from different suppliers and use what they can get. Still have to check the LCD of the new one to see if it is shifted to the right a little. I noticed this when I got the hardware check for the touch panel. This shows four squares in the corners, and I could see that the right squares where shifted to the right onto the left side of the screen.

The different shops on AliExpress probably also have their own stock of complete devices, so you never know what you get

Bought mine here: https://nl.aliexpress.com/item/1005002081018518.html

Now more expensive then what I paid for it

pcprogrammer · « **Reply #1099 on:** October 29, 2021, 11:32:06 am »

Still struggling with the USB code. I found a comment of the sunxi club that the interface is based on the "MENTOR GRAPHICS MUSBMHDRC USB 2.0 MULTI-POINT DUAL-ROLE CONTROLLER". Got the manual of the net and started going through whilst comparing the code to it. It does help a bit

Also using wireshark to monitor the USB communication and fixed some issues with the CH340 device clone I'm using as test code. I can now open the serial device with cutecom, but the scope still hangs in the USB connect screen. Does not respond to touch anymore

I'm now looking at the code in the actual scope and it shows the usual standard of not understanding or laziness. At some part they removed the code for the other possible devices, but in other parts they did not and just added a bit to get the mass storage device to work.

For instance, in the setup phase the host queries the device for information. This can be either for standard, class or vendor specific data. For the mass storage device a query for the number of LUN's is done. This is a class query (0xFE). But instead of removing the HID class queries they added the 0xFE one

Cleanup is needed.


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: FNIRSI-1013D "100MHz" tablet oscilloscope (Read 410287 times)

Share me