New Zoyi multimeter+oscilloscopes - ZT-70xS, up to 50MHz/250MSps (nov 2022)

[ajar171]

Hi everyone!

long time lurker here. Could not help myself and bought this instrument, although I have way too many test equipment.

The bugs are really annoying, so maybe there would be interest here, to make an open source firmware for this scopemeter?

After a quick check of the PCB, here is what I know:
MCU: STM32H7B0V <- confirmed with a JTAG ID scan
ADC: can only make out "2088", maybe MXT2088 (an AD9288 clone) <- MSPS and pinout does not really make sense here, so I am probably wrong MXT2088 it is... 
SPI Flash: PY25Q128HA (confirmed via SPI readout)
DMM chip: DTM0660L
Two shift registers as port expanders: HC595
Analog switches: 4051

MCU readout protection is enabled, but SWD is still enabled, so finding an exploit to read back the internal flash should work. Voltage glitching of the ST bootloader should also be an option.
The firmware updates are encrypted, but it does not look like a proper encryption after a quick check.

Attached is a screenshot of the internal RAM content, showing the framebuffer

Edit: ADC confirmed

[ajar171]

Some information on the firmware update file format (ZTK):

16 bytes header:
0 to 3: file length - 16 (header length)
4 to 7: unknown, looks like 16 bit uint (bytes 6 and 7 always 0), maybe checksum
8 to 15: always "OSC7EF91"

starting at byte 16 is the firmware

The encryption looks like taking 8 byte blocks. It is not a real block cipher as statisctical analysis reveals, that the bytes
87 D0 A9 A6 1A D6 2A 78 decrypt to 0, when they are in the position 0 to 7 or 8 to 15 respectively

Simple XOR with byte swapping did not bring any usable result

edit: my assumption above, about the block cipher is probably wrong, as the 8 bytes above almost alway appear in the exact order.
The MCU supports DES, 3DES, AES in hardware, because of the 8 byte blocks, DES and 3DES are possible candidates

[nikbry]

Some information on the firmware update file format (ZTK):

16 bytes header:
0 to 3: file length - 16 (header length)
4 to 7: unknown, looks like 16 bit uint (bytes 6 and 7 always 0), maybe checksum
8 to 15: always "OSC7EF91"

starting at byte 16 is the firmware

The encryption looks like taking 8 byte blocks. It is not a real block cypher as statisctical analysis reveals, that the bytes
87 D0 A9 A6 1A D6 2A 78 are 0, when they are in the position 0 to 7 or 8 to 15 respectively

Simple XOR with byte swapping did not bring any usable result

Thank you for trying to get the ball rolling...
Hopefully, someone can help  in getting the project gain momentum.

Sadly, I'm thoroughly ignorant and useless in all matters regarding firmware development. But if any "monkey" tasks should arise, I'd be more than happy to contribute my share.

[ajar171]

Maybe @tv84 could take a look at the encryption of the update file

I have unfortunately killed my SPI programmer, so can not read the contents of the SPI flash (hopefully there is some patchable code there) until a new one arrives.
Using the original bootloader would be the easiest way to put a different firmware on this meter.

[spikey1973]

I still have the meter here, as AE is very much not responding ont the return issue.
This is new to me, as my earlier experience has always been good to moderate, but now not so much.

Anyway, I believe I have a chip reader lying around. maybe I can help reading the SPI (with some help)

I will look into what I have later today, and make pictures / response to see if it is of any value.

Kind greats, Matthieu

Addition:

I have an:
* AVRdude compatible device, USB AVR programmer / SPI interface. (well if I can find this one)

* AVR USBASP programmer (https://stackoverflow.com/questions/16615640/using-usbasp-programmer-for-spi-communication)

* USB ISP programmer (same thing i believe, but got it with something)
https://nl.aliexpress.com/item/1289376766.html?spm=a2g0o.productlist.main.21.656e3ccak0V4NQ&algo_pvid=94913f6c-c923-434e-91e9-8da5841ae19f&algo_exp_id=94913f6c-c923-434e-91e9-8da5841ae19f-10&pdp_npi=4%40dis%21EUR%214.39%214.39%21%21%214.56%214.56%21%402103846917315105423918075e8df0%2158746620936%21sea%21NL%21706585505%21X&curPageLogUid=EDoHT7iZXxmw&utparam-url=scene%3Asearch%7Cquery_from%3A

* Bus Pirate -> this seems to me the best available option..

and a bunch of matching (flat)cables.

so if there is something here that I can use to read the SPI with your help, let me know.
 

[apollo11fan]

Does anyone have any information on Zoyi's commitment to continue to release firmware updates for the 702 and 703 models? When I made an inquiry via their website, there have been nothing but crickets since. 

[indman]

Does anyone have any information on Zoyi's commitment to continue to release firmware updates for the 702 and 703 models? When I made an inquiry via their website, there have been nothing but crickets since. 

Similar to famous FNIRSI, wait for the new version of ZT-704/705 from ZOYI to appear sooner
Have you not understood the strategy of these Chinese firms - they are not interested in supporting outdated models, it is more profitable for them to produce something new and raw!

[apollo11fan]

This is apparent. Sad. Wasn't the ANENG hardware the same? Maybe they've produced a new version of the firmware that's compatible?

[IAmBack]

For time base slower than 100 ms (it means 200ms +) triggering mode can be only set to auto.
Pity, as slow tb is useful with single mode.

[xKertx]

wait for the new version of ZT-704/705 from ZOYI to appear sooner
Have you not understood the strategy of these Chinese firms - they are not interested in supporting outdated models, it is more profitable for them to produce something new and raw!

Really?
There has been several updates, released approximately every 2-3 months.

[Atlan]

Nice, but not working corectly

[spikey1973]

Hello to all,

As mentioned before, I had decided on sending my 703 back under the free return clause.
Unfortunately AE or the seller were being difficult and did not agree. Anyway..
The end of the story is that I have received a refund for the majority and didn't need te send it back, so I agreed
I unpacked it again and started fiddling with it this evening and I bumped into an issue I bumped into before but I believe it is nothing I have not read about here.

The issue is the signal-generator menu under F1.
The menu under F4, works, I can do anything there and it works.
Under F1, I can change everything but non of the changes seem to stick/have an effect.
That includes the turning off of the signal generator. I can not seem to turn it off.
In F1 I put it on "off", but when Exit it is still on, does anyone else have this issue with FW 1.4.2?
and or / Is there any different way to turn the signal gen off? 

(I did read the manual, to see it there in a not-so-intuitive manner, but it seems like I did it all as should) 

So currrently I am planning to flash the firmware but am not sure which version to choose for.
If it not an issue that is common I can try to reflash 1.4.2. but I can also for an older one. 1.3.2 / 1.3.8 / 1.3.9 .The latter one is a version I haven't read much on besides it being slow. and I read that 1.3.8  allready has the bad auto range. but I also believe that most people here still use. 1.3.8, but I could be wrong.
1 have read positive comment on both 1.3.8 and 1.3.2. but am not sure if there is any consensus on which would be the least bad of these two.
The only thing I know is that @nikbry seems to stick to 1.32. but it also seems like most still use 1.38.
At least untill they create the superb FW version.. if it will ever comes (sure hope so).

Anyway, thoughts are appreciated.

Additionally is there still links to either version 1.32 and 1.38

[chebo]

ZT-703S, FW1.39 (last). The error with determining the minimum and maximum values ​​has not been fixed.
A little experiment. I generate the input pulse manually from the power supply. The voltmeter BM789 is in the Crest mode (we will check this mode at the same time).

[suntide]

The issue is the signal-generator menu under F1.
The menu under F4, works, I can do anything there and it works.
Under F1, I can change everything but non of the changes seem to stick/have an effect.

I found this, it seems a firmware bug. Press “Default" and confirm, it will close the signal-generator output.

[xKertx]

ZT-703S, FW1.39 (last). The error with determining the minimum and maximum values ​​has not been fixed.
A little experiment. I generate the input pulse manually from the power supply. The voltmeter BM789 is in the Crest mode (we will check this mode at the same time).
(Attachment Link) (Attachment Link) (Attachment Link)

Latest FW is 1.42

[chebo]

Latest FW is 1.42

Oh! You are right! I'll download, install and double-check.

[spikey1973]

Additionally is there still links to either version 1.32 and 1.38

I have searched throught the thread, but didn't find a download link for either of them, I believe I prefer 1.32 but wpuld love to have them both.
Does anyone have the fila available (preferrably with a checksum to make sure the file is oke after the download. )

Kind greats

Matthieu

[indman]

You were looking poorly or in the wrong place. Here is the link on page 20 of this topic
https://www.eevblog.com/forum/testgear/new-zoyi-multimeteroscilloscopes-zt-70xs-up-to-50mhz250msps-(nov-2022)/msg5585305/#msg5585305

[chebo]

Latest FW is 1.42

I have installed the latest version of the software.

But I wouldn't say that anything has changed much.

[csuhi17]

It only doesn't work with Single trigger?
Does it measure well in Normal and Auto mode?

[ajar171]

Finally I had time to investigate further into this scopemeter.

First of all, the SPI flash is only used for data storage (mass storage USB mode), nothing of value is on it. They did not even bother to connect it via quad-SPI...
 
My assumption about the ADC being an MXT2088 (AD9288 clone) seems to be correct. All the signals measured are located there, where they should be according to the datasheet.
So this scopemeter has only 100MSPS in normal mode (verified the 100MHz clock on the ENC pins with a real scope ), the high speed mode is overclocking the ADC to 140MHz (MCU fmax/2)

I was wondering the whole time, how they got the advertised amount of data into an MCU with an fmax of 280MHz without using an FPGA. Well they did not... It is probably even sampling the two channels alternating, but did not bother to check this, as the 100MSPS is already a dealbreaker for me (bought it for measuring high-ish speed RS485 comms waveforms in the field)
Just another datapoint: when running at 100MSPS, the ADC is running 100 times a second with 100MHz bursts, so max 100 wafeforms/s, if the sampling is alternating, then 50 wfrms/s.

If there is interest, we could still make an open source firmware from scratch for this meter, but nobody knows how long this meter will be on the market. As already mentioned here, chinese manufacturers are quick to abandon products...
Since there are no magic tricks used to get 280MSPS / channel of data into the MCU here, I dont really care about the stock firmware anymore, and the PCB is simple enough to reverse...

Triggering is also only in software. With the low waveform/s count, I could set up the scopemeter with an AWG in a way it never triggered. I guess I got, what I paid for.

Edit: high speed mode clock measured

[koks1960]

Finally I had time to investigate further into this scopemeter.

First of all, the SPI flash is only used for data storage (mass storage USB mode), nothing of value is on it. They did not even bother to connect it via quad-SPI...
 
My assumption about the ADC being an MXT2088 (AD9288 clone) seems to be correct. All the signals measured are located there, where they should be according to the datasheet.
So this scopemeter has only 100MSPS in normal mode (verified the 100MHz clock on the ENC pins with a real scope ), the high speed mode is overclocking the ADC to 140MHz (MCU fmax/2)

This device is made according to the ARM+ADC scheme, whereas most other manufacturers use the FPGA+ARM+ADC scheme. Therefore, this device does not work well. And the new firmware won't do anything.

[ajar171]

This device is made according to the ARM+ADC scheme, whereas most other manufacturers use the FPGA+ARM+ADC scheme. Therefore, this device does not work well. And the new firmware won't do anything.

Exactly.

It could be made better, but it will never be a proper oscilloscope.

The only question is, it worth the time, to make a proper firmware for this device, or just wait for a scopemeter with at least an FPGA in it 

[chebo]

It could be made better, but it will never be a proper oscilloscope.

What compact proper oscilloscope would you recommend?

[black6host]

I just picked up a Zeeweii dso3d12 scope/meter.  I'm liking it so far but I'm afraid I'm too new to scopes to put it through it's paces.  Maybe something to look at?

Edit:  From the specs it appears the Zeeweii is a better scope.  The Zoyi is the better DMM.  Again, from the specs.  I've not tested the two in practice yet...