FNIRSI-1013D "100MHz" tablet oscilloscope

[pcprogrammer]

Only rewrite data in flash.  PEter C would know where and what to rewrite. Or, theoretically, it would be possible to upload the original firmware there, which has the image shifted correctly.  Just be careful not to overwrite the data in the touch chip

PC: I can't find where the error is in the flash, I have to switch to 100mV, the signal values ​​are displayed badly.  To make a payment to fix some one bit?  By writing to flash. FNIRSI firmware

Sorry Atlan, but I have no idea what you are writing about here.

If it is about the shifted display problem of cats-shadow, then see my previous post.

[Atlan]

Now I have a question: after replacing the screen, the image was shifted to the right.
After flashing FNIRSI 1013D alternative firmware v0.025u and correcting timings  (from "1013D version 3" to the "1013D version 1" like described in the https://github.com/pecostm32/FNIRSI_1013D_Firmware/blob/main/configuration_file.txt) the image returned to the correct position.

But when rebooting to the original firmware (via boot menu) the image is shifted again.
Can anyone suggest how to fix the situation? I would like to be able to work normally both with the original firmware and with alternative firmware.

Hi cats-shadow,

welcome to the forum.

Your problem confuses me a bit. I'm trying to figure why it would be shifted out of position when booting to the original firmware.

I have not looked at the code that Atlan wrote for the boot menu, so can't tell what is done at what point in the process.

If Atlan is willing to do this, a solution that springs to mind is to instead of starting the original firmware directly by loading the code from FLASH address 0x27000, run the original boot loader by loading the code from FLASH address 0x00000. It will then use the full original code including the displaying of the FNIRSI image and should have the display working with the correct parameters, and thus with the proper aligning.

He replaced the display with another one.

[E212]

Hello everyone. I have such a problem that when I turn on the T-cursor or V-cursor, no lines appear on the screen.

[Atlan]

PC watch this
https://www.youtube.com/watch?si=NA9qLyLHLgkCcEhO&v=SOcpTE37Cys&feature=youtu.be

Only 50mV and switch short to long fnirsi problem

[pcprogrammer]

He replaced the display with another one.

  Oops did not read his post correctly then.

I looked back and now it makes sense.

So forget about what I opted and you are correct that the values in the FLASH need to be corrected to set the screen in the right spot. This is something I will have to look in my notes for. Will get back on this.

[pcprogrammer]

PC watch this
https://www.youtube.com/watch?si=NA9qLyLHLgkCcEhO&v=SOcpTE37Cys&feature=youtu.be

Only 50mV and switch short to long fnirsi problem

So the problem is that when the original firmware switches to the long time base mode (which is kind of a roll mode) the amplitude shown on screen is halved, when set to the highest sensitivity of 50mV/div.

This is a known issue of the original firmware, where they forgot to multiply the samples by two when on 50mV/div. Correcting that requires patching the original firmware and that is doable but it needs some fiddling with assembly to get it done. A subroutine needs to be made where a check is done on the volts per division setting and if on the lowest setting the samples are multiplied by two. The this subroutine needs to be called from the right spot.

It will be possible to find it in the Ghidra project I made when I was doing the reverse engineering. A lot of the functions are named and might also have noted somewhere at which address the volts per division setting resides. But is it worth putting time into it? Not for me that is for sure.

[pcprogrammer]

Hello everyone. I have such a problem that when I turn on the T-cursor or V-cursor, no lines appear on the screen.

Hi E212,

welcome to the forum.

Please provide some more details, like are you using the original firmware, or the open source firmware, and if so which version number. Take some pictures of the screen, or even better make a video and post it on youtube and provide the link here.

[cats-shadow]

So forget about what I opted and you are correct that the values in the FLASH need to be corrected to set the screen in the right spot. This is something I will have to look in my notes for. Will get back on this.

Thanks!

[pcprogrammer]

I looked in my notes and there is not a fixed location of where the display settings are, but they are almost unique. The display setup is done in two parts, the boot loader and the actual firmware. The boot loader might use a different set of settings than the firmware, but when you search for the possible settings you either find it once or twice. Only the ones in the address region of 0x04xxxx actually matter. (I found them at location 0x04F350 in one file and at location 0x4E918 in an other)

So get a binary (hexadecimal) file editor and search for the setting bytes in little endian format.

To find 0x041E0044 look for the byte sequence 0x44, 0x00, 0x1E, 0x04.
The second setting directly follows the first one, so your firmware may have 0x44, 0x00, 0x1E, 0x04, 0x17, 0x00, 0x1A, 0x04 in that order.

Change the bytes to what they need to be and write these changes to the FLASH.

The values I have found in both the 1013D and 1014D are listed below.

Code: [Select]

  //1014D new version 0x041E0043, 0x041A0019
  //1014D old version 0x041E006D, 0x041A0022
  //1013D version 1   0x041E0044, 0x041A0017
  //1013D version 2   0x041E004A, 0x041A0017
  //1013D version 3   0x041E0072, 0x041A001F


[Zombie47]

I have added a video tutorial (russian) on flashing Frinsi1013D from Windows:
https://youtu.be/wnGIBlvVNUg?si=SmY5gkdCmm7ExayB
I think this will be useful for people like me.

[Zombie47]

And some comparison test.
https://youtu.be/jdds0RfGmpU?si=-sSOWTZHwT2ibJSf
Fnirsi cant hold this signal on this scan (1ms) but DSO3D12 can.
on 2ms all ok.
version 0.025u

[Atlan]

You have not calibrated the oscilloscope, read the instructions. Try the trigger in NORMAL mode.
It might need a holoff to run the tiger.

[cats-shadow]

Change the bytes to what they need to be and write these changes to the FLASH.

Ok.
In need to get some gear (CH341a programmer) first.
Thank you!

[Zombie47]

You have not calibrated the oscilloscope, read the instructions. Try the trigger in NORMAL mode.
It might need a holoff to run the tiger.

I don't understand what I need to calibrate. I turned on the oscilloscope, waited 10-20 minutes, then pressed "baseline calibration". Then it said "set 300 mV" what??? how do I set 300 mV? do I need to find the reference voltage of the power supply 300 mV or what does this mean?
Then I go to the DC offset, and press some values. As I understand it, the first two offsets just move the graph, and the third sets 0. But it is not very clear whether to set zero if setting zero I get oscillations from 0 to -200 mV for example. At what sweep do I do this? At 50 mV / div or at 5 V / div?
At 50 mV / div I have from 3 mV to -4 mV, and at 5 V / div I have from -200 mV to 300 mV on one

[Atlan]

https://youtu.be/KK51iftmdVU?si=P0jG_81L_xmlqLu2

https://youtu.be/rAgULKzP3MU?si=uM9Zq37CR0gbBXlK

[Zombie47]

https://youtu.be/KK51iftmdVU?si=P0jG_81L_xmlqLu2

I don't know how to get this menu (300mv and others) again. Because the menu doesn't appear anymore.
Resetting calibration does not help.

[Atlan]

It would be appropriate to finally read the instructions for the firmware, there is a link a few pages back.

[pcprogrammer]

Change the bytes to what they need to be and write these changes to the FLASH.

Ok.
In need to get some gear (CH341a programmer) first.
Thank you!

Make sure to check the SPI signal voltages when you get a CH341a programmer. There are versions that allow the supply voltage to the target to be switched between 5V and 3.3V, but the CH341a remains on 5V and thus the SPI signals are also on 5V. This can destroy your FLASH chip. I'm talking from own experience. Had to get a new FLASH for my 1013D after killing it with the CH341a programmer I bought on Aliexpress. https://nl.aliexpress.com/item/32263275388.html (In January 2021 it was 3,65 euro, now 5,69 euro with a ridiculous shipping cost of 30,47 euro  )

Edit: Found this video about it.

[E212]

Hello everyone. I have such a problem that when I turn on the T-cursor or V-cursor, no lines appear on the screen.

Hi E212,

welcome to the forum.

Please provide some more details, like are you using the original firmware, or the open source firmware, and if so which version number. Take some pictures of the screen, or even better make a video and post it on youtube and provide the link here.

good evening. I took a video. I turn on the cursors on it and nothing appears, but there should be green stripes. The firmware is native, I did not change anything.https://youtube.com/shorts/d3UBldaaHPM?si=r-rtBDjGM81xz2yM

[pcprogrammer]

good evening. I took a video. I turn on the cursors on it and nothing appears, but there should be green stripes. The firmware is native, I did not change anything.https://youtube.com/shorts/d3UBldaaHPM?si=r-rtBDjGM81xz2yM

Strange. It is clear that the cursors are being enabled due to the measurements appearing in the top left of the screen.

Can you estimate the position of the cursors based on the values shown and try moving them. Hold the spot you think the cursor is on and move it which should change the measurement values.

Another thing that springs to mind is that the cursors are outside the screen. The positions are stored in FLASH and on power down the settings are saved, so maybe due to some glitch wrong values have been saved. I can't read the values shown in the measurements on your video, so hard to say if the above is the case.

[E212]

good evening. I took a video. I turn on the cursors on it and nothing appears, but there should be green stripes. The firmware is native, I did not change anything.https://youtube.com/shorts/d3UBldaaHPM?si=r-rtBDjGM81xz2yM

Strange. It is clear that the cursors are being enabled due to the measurements appearing in the top left of the screen.

Can you estimate the position of the cursors based on the values shown and try moving them. Hold the spot you think the cursor is on and move it which should change the measurement values.

Another thing that springs to mind is that the cursors are outside the screen. The positions are stored in FLASH and on power down the settings are saved, so maybe due to some glitch wrong values have been saved. I can't read the values shown in the measurements on your video, so hard to say if the above is the case.

you were right. I turned on the T-cursor and it was at the edge of the display. but it was not visible. I just dragged it towards it and it is already there. but the V-cursor never appeared.

[E212]

good evening. I took a video. I turn on the cursors on it and nothing appears, but there should be green stripes. The firmware is native, I did not change anything.https://youtube.com/shorts/d3UBldaaHPM?si=r-rtBDjGM81xz2yM

Strange. It is clear that the cursors are being enabled due to the measurements appearing in the top left of the screen.

Can you estimate the position of the cursors based on the values shown and try moving them. Hold the spot you think the cursor is on and move it which should change the measurement values.

Another thing that springs to mind is that the cursors are outside the screen. The positions are stored in FLASH and on power down the settings are saved, so maybe due to some glitch wrong values have been saved. I can't read the values shown in the measurements on your video, so hard to say if the above is the case.

you were right. I turned on the T-cursor and it was at the edge of the display. but it was not visible. I just dragged it towards it and it is already there. but the V-cursor never appeared.

but still, you can see in the photo that only one green line appeared, and there should be two lines for the T-cursor. And I already tried to pull it out from all corners

[pcprogrammer]

but still, you can see in the photo that only one green line appeared, and there should be two lines for the T-cursor. And I already tried to pull it out from all corners

Yes there should be two. Same for the volt cursors. They will be somewhere off screen. The location of the settings in the FLASH are known, but I have to look for my notes on where and which is which. Will get back to you on this.

[E212]

but still, you can see in the photo that only one green line appeared, and there should be two lines for the T-cursor. And I already tried to pull it out from all corners

Yes there should be two. Same for the volt cursors. They will be somewhere off screen. The location of the settings in the FLASH are known, but I have to look for my notes on where and which is which. Will get back to you on this.

thank you.telegram-@inok_entii

[pcprogrammer]

I searched my data and found that I did not write it up in a nice straight forward manner, but there is this file here: https://github.com/pecostm32/FNIRSI-1013D-1014D-Hack/blob/main/Software%20reverse%20engineering/C%20analysis/Startup/restore_config_data.c

It is the Ghidra function output of the original code that loads the settings from the FLASH and copies it to the used locations in memory.

In the FLASH at location 0x001FD000 there are 500 bytes that are the settings of the scope.

At address 0x001FD144 the 16 bit position of the first time cursor is stored. (Little endian format, so low byte is stored first) The next two bytes are the position of the second time cursor.

At address 0x001FD14A the 16 bit position of the first volt cursor is stored. The next two bytes are the position of the second volt cursor.

The position is set in pixels, if I remember correctly. For the time cursor a value of 360 should be in the middle of the screen. For the volt cursor a value of 240 might be the middle of the screen.

Hope this helps.