Dim OLED Screen replacement for Agilent Keysight U1253A U1253B U1273A U1273AX

[DavidAlfa]

Make sure this is a mod issue!
Flash original and try again, same cap, same conditions.

If working, then I'll have a look.

[Tarloth]

@Tarloth

Is the capacitor in circuit, or out of circuit?

What is the expected capacitor value? Is it within the measurement range of your meter (see specs)?

Hi voltsandjolts, as seen in the attached image, the capacitor is a small electrolytic of 10uF fixed to the multimeter test leads. The values it's aprox to the center of multimeter range.

[Tarloth]

Make sure this is a mod issue!
Flash original and try again, same cap, same conditions.

If working, then I'll have a look.

Hi David, attach the image, with the original firmware works ok, Thanks for your effort

[voltsandjolts]

@Tarloth

Is the capacitor in circuit, or out of circuit?

What is the expected capacitor value? Is it within the measurement range of your meter (see specs)?

Hi voltsandjolts, as seen in the attached image, the capacitor is a small electrolytic of 10uF fixed to the multimeter test leads. The values it's aprox to the center of multimeter range.

Ahh, ooops, I just looked at the thumbnail and didn't notice the capacitor, my bad.

[Tarloth]

No problem, most of the time I don't even see the pictures!

I suspect the bug is the same one that fbpicsous reported a while ago for the U1253B.

Anyway I am more than grateful for the work they took to produce this firmware, it's amazing!

[DavidAlfa]

Okey! I'll try to find what's breaking that, probably some pattern search & replace that went too far.
This will only be fixed if you're willing to perform plenty of tests flashing different firmwares, until the place causing the bug is found.

About that previous bug report, he never came back, I can fix nothing that way, lazy people should just buy the $100 display.

[Tarloth]

David, count on me for do as many tests as necessary, it is the least that I can do to honor the effort that you have made.

---------

David, cuenta conmigo para la cantidad de pruebas que sean necesarias, es lo mínimo que puedo hacer para honrar el esfuerzo que ustedes hicieron.


THANKS

[DavidAlfa]

I moved the routines elsewhere (To 0x7C00), made different tests replacing only certain calls.
Try in the same order as the filenames (1, 2, 3...).
The display won't look correct on most of them, ignore that, find the first one causing the capacitance bug.

Code: [Select]

                                                ################################
sub_7c00:                                       <<--- NEW OLED INIT ROUTINE
    call !sub_04f5          ;7c00  9a f5 04     <<--- Call original init
    movw ax,#0x00a1         ;7c03  10 a1 00     <<--- Segment remap cmd (Y-mirror)
    call !sub_05d1          ;7c06  9a d1 05     <<--- Send cmd
    movw ax,#0x00c0         ;7c09  10 c0 00     <<--- Scan direction cmd (X-mirror)
    call !sub_05d1          ;7c0c  9a d1 05     <<--- Send cmd
    ret                     ;7c0f  af           <<--- Return
   
                                                ################################
sub_7c10:                                       <<--- NEW OLED POSITION ROUTINE
    push hl                 ;7c10  b7     
    push ax                 ;7c11  b1     
    movw ax,sp              ;7c12  89 1c   
    movw hl,ax              ;7c14  d6     
    mov a,[hl]              ;7c15  87     
    xch a,x                 ;7c16  30     
    mov a,[hl+0x06]         ;7c17  ae 06   
    movw hl,ax              ;7c19  d6     
    mov a,#0xb0             ;7c1a  a1 b0        <<--- Row cmd 
    or a,l                  ;7c1c  61 6e   
    mov x,#0x00             ;7c1e  a0 00   
    xch a,x                 ;7c20  30     
    call !sub_05d1          ;7c21  9a d1 05     <<--- Send cmd
    mov a,h                 ;7c24  67           <<--- Move column value to reg A
    cmp a,!mem_7c2e         ;7c25  48 2e 7c     <<--- Compare with subtract value at 0x7c2e
    bnc lab_7c2d            ;7c28  9d 03        <<--- If carry set, load A with subtract value so it becomes 0 when subtracting
    mov a,!mem_7eca         ;7c2a  8e 2e 7c

lab_7c2d:
    sub a,#0x02             ;7c2d  1d 02        <<--- Subtract 2 to column value.
    mov h,a                 ;7c2f  77           <<--- Update H reg for later use in lower column cmd
    and a,#0x0f             ;7c30  5d 0f        <<--- Isolate lower column data
    mov x,#0x00             ;7c32  a0 00   
    xch a,x                 ;7c34  30     
    call !sub_05d1          ;7c35  9a d1 05     <<--- Send cmd
    mov a,h                 ;7c38  67           <<--- Move column value to reg A
    ror a,1                 ;7c39  24           <<--- Rotate 4 bits to the left to get higher column bits
    ror a,1                 ;7c3a  24     
    ror a,1                 ;7c3b  24     
    ror a,1                 ;7c3c  24     
    and a,#0x0f             ;7c3d  5d 0f        <<--- Isolate higher column data
    or a,#0x10              ;7c3f  6d 10        <<--- High column cmd
    mov x,#0x00             ;7c41  a0 00   
    xch a,x                 ;7c43  30     
    call !sub_05d1          ;7c44  9a d1 05     <<--- Send cmd
    pop ax                  ;7c47  b0     
    pop hl                  ;7c48  b6     
    ret                     ;7c49  af           <<--- Done, return

                                                ################################
sub_7c4a:                                       <<--- NEW OLED DRAW ROUTINE
    push hl                 ;7c4a  b7           <<--- Same as original function
    push ax                 ;7c4b  b1     
    push ax                 ;7c4c  b1     
    movw ax,sp              ;7c4d  89 1c   
    movw hl,ax              ;7c4f  d6     
    mov a,[hl+0x0a]         ;7c50  ae 0a   
    inc a                   ;7c52  41     
    mov [hl+0x0a],a         ;7c53  be 0a   
    mov x,#0x00             ;7c55  a0 00   
    xch a,x                 ;7c57  30     
    push ax                 ;7c58  b1     
    mov a,[hl+0x08]         ;7c59  ae 08   
    mov x,#0x00             ;7c5b  a0 00   
    xch a,x                 ;7c5d  30     
    call !sub_7c10          ;7c5e  9a 10 7c     <<--- Call new oled position function
    br !lab_0643            ;7c61  9b 43 06     <<--- Continue in original function


[Tarloth]

Starting the tests, I would like to point out that the files are identified by Windows Defender as a serious virus. I have ignored it but it may cause problems in the future.

[DavidAlfa]

No idea why (But not imposible, I could be infected), here's Virustotal report for the file downloaded from the forum:

https://www.virustotal.com/gui/file/fc30981c573c42b18c7cd09bb6a76236332ee36d935caecb8fefceb01b9ec226?nocache=1

[Tarloth]

The tests was completed, lamentably the multimeter it's a brick now, any suggestion to unblock it?

File 1: screen inverted, Capacitance ok
File 2: Screen ok, capacitance Ok
File 3: Garbage in screen, a musical scale it's played, multimeter not respond to any successive upgrade, everything fails.

Link to video shown the fail https://drive.google.com/file/d/1SJMNOnMH57Hq_H5YWvAYYFderRuczy_d/view?usp=sharing

[Tarloth]

Hi David, file 2,3 an 4 are reported in defender as Trojan:Win32/Wacatac.B!ml

[DavidAlfa]

Must be a false positive, the files are identical except the areas of the firmware.
Upload them to VirusTotal and see.

Sorry -  made a stupid mistake  Swapped the addresses of oled position and oled draw... so the DMM will crash.
I checked it four times before uploading to avoid something like this, but I was tired and didn't realize about my mistake.

Please run the unbricking procedure.

Attached the corrected files - Also for the U1253B.

These tests uses again 0x7F60 - only, leaving 0x7EE6 and 0x7EAC areas untouched.
Let's see if the capacitance keeps working! (I don't think so)

Edit: It's working now, files removed, updated main post.

[Tarloth]

Don't worry David, these things happen when you experiment, it's the price of doing new things!

I'm finishing some things and I'm already trying the unlocker, Thanks

[Tarloth]

DavidAlfa:

Is the JP2 you mentioned in the  https://www.eevblog.com/forum/microcontrollers/8-bit-78k0-d78f0547-help-with-firmware-modification/msg5288164/#msg5288164 the one named JP12 in top of the board in U1253? I edit this message because I located all the signals and pinout.

[Per Hansson]

Maybe you already found it but the pinout is shown in this post for JP12:
https://www.eevblog.com/forum/microcontrollers/8-bit-78k0-d78f0547-help-with-firmware-modification/msg5293273/#msg5293273

[Tarloth]

Thanks Per Hansson, yes, I found it, connect pin FLDM0 to AVRef (+3V) GND to USB-USART GND and cross rx and tx between multimeter and USB-USART . Execute the command but obtain an error
(I have the USB-USART in com3 too)

Code: [Select]

PS ....Agilent> python flash-util.py -e -b 127 -p COM3
specified block:  127
setting port to:  COM3
NEC Programmer v1.0
written by Martin Jansson

Requesting serial port and resetting chip...
error: Length less than 2

Erasing block 127 ...

Sending erase block command..
error: Length less than 2
error: Did not receive ACK, returning...
Any idea?

[DavidAlfa]

Something must be wrong.
Please re-read and make sure your usb-serial adapter is working by bridging RX and TX and typing something in the terminal.
The adapter  should be  TTL level, not RS232!

1. RX (To cable TX)
2. TX (To cable RX)
3. GND
4. VDD
5. RESET
6. FLMD0

Measure reset and FLMD0 voltages after powering the meter.
Likely, reset=VDD and fldm0=gnd.

1. Connect Rx and TX to the adapter, but don't connect it to the PC yet (Might cause voltage going to the mcu, powering it up).

2. Make sure meter is off. Short FLMD0 to VDD, better through a 100R-1K resistor (Just in case).

3. Turn on meter. Optional: Connect RESET to gnd for a fraction of a second to force a reset, leave unconnected. Shouldn't be necessary as the mcu has just been powered up.

4. Connect to PC.

5. Run the 78k0-flash-utility

[Tarloth]

Good news!

Flash-Util never workd BUT I try to use the updater (the exe program) and after several on-off detects the multimeter and update to the original firmware, using the same usb-serie adapter and cables that fail with the flash-util utility.

Yes, the usb-serie it's TTL level and I use it frequently to read usart in microcontroller boards and works ok. Something was wrong with the FLDM0 I think (I did double check 3 volt level). 

After that I update to the last mod that you attach few messages ago using the BT adapter, update perfect, restart with the screen correct, but few minutes after begin to test the multimeter, the battery exhausts and self shut down.

It was abnormal because the battery was not depleted, but after a full charge I will test it again.

When I have any news I wrote again! THANKS

[Tarloth]

I did change the battery, I found a new one in my desk.

Everything seems perfect!!! I test Capacitance and the other functions and seems ok, BRAVO!!!!!

I use the file in this message https://www.eevblog.com/forum/microcontrollers/8-bit-78k0-d78f0547-help-with-firmware-modification/msg5600941/#msg5600941

[DavidAlfa]

Great! I updated the files for U1253A/B in the main post.

[Tarloth]

Thanks again David!

[msquared]

Recent update fixed the capacitor function on my 1253A. 

Thank you David

[DavidAlfa]

I'm trying to unify the mod so it's almost the same for all, same code, same areas, except few specific bootloader addresses.

Someone with U1273A(X) - and able to unbrick something goes wrong - please try this!

- Display init: sub_7f60:

Code: [Select]

    sub_7f60:
    call !sub_0994          ;7f60  9a 94 09         <<<--- Call original function
    movw ax,#0x00a1         ;7f63  10 a1 00         <<<--- Segment remap cmd (Y-mirror)
    call !sub_05d1          ;7f66  9a d1 05         <<<--- Send cmd
    movw ax,#0x00c0         ;7f69  10 c0 00         <<<--- Scan direction cmd (X-mirror)
    call !sub_05d1          ;7f6c  9a d1 05         <<<--- Send cmd
    ret                     ;7f6f  af               <<<--- Return

- Set position: sub_7f70:

Code: [Select]

sub_7f70:
    push hl                 ;7f70  b7               <<<--- Same as original function
    push ax                 ;7f71  b1     
    movw ax,sp              ;7f72  89 1c   
    movw hl,ax              ;7f74  d6     
    mov a,[hl]              ;7f75  87     
    xch a,x                 ;7f76  30     
    mov a,[hl+0x06]         ;7f77  ae 06   
    movw hl,ax              ;7f79  d6     
    mov a,#0xb0             ;7f7a  a1 b0            <<<--- Row cmd   
    or a,l                  ;7f7c  61 6e   
    mov x,#0x00             ;7f7e  a0 00   
    xch a,x                 ;7f80  30     
    call !sub_05d1          ;7f81  9a 68 0A         <<<--- Send cmd
    mov a,h                 ;7f84  67               <<<--- Move column value to reg A
    cmp a,!mem_7f8e         ;7f85  48 8e 7f         <<<--- Compare with subtract value at 0x7f8e
    bnc lab_7f8d            ;7f88  9d 03            <<<--- If carry set,
    mov a,!mem_7f8e         ;7f8a  8e 8e 7f         <<<--- Load A with subtract value at 0x7f8e so it becomes 0 when subtracting

lab_7f8d:
    sub a,#0x02             ;7f8d  1d 02            <<<--- Subtract 2 to column value
    mov h,a                 ;7f8f  77               <<<--- Update H reg for later use in lower column cmd
    and a,#0x0f             ;7f90  5d 0f            <<<--- Isolate lower column data
    mov x,#0x00             ;7f92  a0 00   
    xch a,x                 ;7f94  30     
    call !sub_05d1          ;7f95  9a 68 0A         <<<--- Send cmd
    mov a,h                 ;7f98  67               <<<--- Move column value to reg A
    ror a,1                 ;7f99  24               <<<--- Rotate 4 bits to the left to get higher column bits
    ror a,1                 ;7f9a  24     
    ror a,1                 ;7f9b  24     
    ror a,1                 ;7f9c  24     
    and a,#0x0f             ;7f9d  5d 0f            <<<--- Isolate higher column data
    or a,#0x10              ;7f9f  6d 10            <<<--- High column cmd
    mov x,#0x00             ;7fa1  a0 00   
    xch a,x                 ;7fa3  30     
    call !sub_05d1          ;7fa4  9a 68 0A         <<<--- Send cmd
    pop ax                  ;7fa7  b0     
    pop hl                  ;7fa8  b6     
    ret                     ;7fa9  af               <<<--- Done, return

- Drawing: sub_7faa:

Code: [Select]

sub_7faa:
    push hl                 ;7faa  b7               <<<--- Same as original function
    push ax                 ;7fab  b1     
    push ax                 ;7fac  b1     
    movw ax,sp              ;7fad  89 1c   
    movw hl,ax              ;7faf  d6     
    mov a,[hl+0x0a]         ;7fb0  ae 0a   
    inc a                   ;7fb2  41     
    mov [hl+0x0a],a         ;7fb3  be 0a   
    mov x,#0x00             ;7fb5  a0 00   
    xch a,x                 ;7fb7  30     
    push ax                 ;7fb8  b1     
    mov a,[hl+0x08]         ;7fb9  ae 08   
    mov x,#0x00             ;7fbb  a0 00   
    xch a,x                 ;7fbd  30     
    call !sub_7f70          ;7fbe  9a 70 7f         <<<--- Call new oled position function
    br !lab_0ad9            ;7fc1  9b d9 0a         <<<--- Continue in original function

Hex bytes:

Code: (0x7F60) [Select]

9A 94 09 10 A1 00 9A 68 0A 10 C0 00 9A 68 0A AF B7 B1 89 1C D6 87 30 AE 06 D6 A1 B0 61 6E A0 00 30 9A 68 0A 67 48 8E 7F 9D 03 8E 8E 7F 1D 02 77 5D 0F A0 00 30 9A 68 0A 67 24 24 24 24 5D 0F 6D 10 A0 00 30 9A 68 0A B0 B6 AF B7 B1 B1 89 1C D6 AE 0A 41 BE 0A A0 00 30 B1 AE 08 A0 00 30 9A 70 7F 9B D9 0A

Because the entire firmware can't be disassembled, a manual pattern search and replace was performed:

Code: [Select]

- INIT: "9A 94 09" (call !sub_0994) -> "9A 60 7F" (call !sub_7f60)
- POSITION: "9A 20 0B" (call !sub_0b20) -> "9A 70 7F" (call !sub_7f70)
- DRAW: "9A C2 0A" (call !sub_0ac2) -> "9A AA 7F" (call !sub_7faa)

Patching offsets: ( .AG file in updater format, not reversed)

Code: [Select]

Address        Value               Function
0x18095        0x0C / 0x8C         X-mirror off / on
0x1809B        0x0A / 0x1A         Y-mirror off / on
0x18071        0x00-0xFF           X-offset subtract value, nibble-swapped, so 0x00 / 0x10 / 0x20 for 0/-1/-2 pixel offset (Subtracted to the default 2 offset)

If for whatever reason, instead subtracting you want to increase the column address, patch as following:

Code: [Select]

0x18072        Replace   [D1 F7 E8 E8 30 D9 F7 E8 84]   with   [D0 00 00 00 00 00 00 00 00].

Address        Value               Function
0x18071        0x00-0xFF           X-offset add value, nibble-swapped, so 0x00 / 0x10 / 0x20 for 0/+1/+2 pixel offset (Added to the default 2 offset)


[fbpicsous]

I just tested this last firmware today (U1253B).
It works really well ! Capacitive measurement also !

Many, many thanks for all your work!