East Tester ET4410&ET4510 Desktop LCR Meter

[w.v.s.]

Did you try it it the directory with the .exe and the .hex?

Yes. I even tried by putting the .exe inside the system32 folder

Only the .ocx should go there, not the .exe. Better keep everything in the same folder like the .exe and rename the folders to non-chinese names of your personal taste.

[james38]

Now in the update package there is a directory that contains a file called mscomm32.ocx.

Some programs need so-called runtime libraries to work.
The update tool here needs, among other things,
the mscomm32.ocx to communicate with the serial interface.

So that the program knows where it is and can access it,
it must be registered and you do this with the Windows tool regsvr32.exe


But there are a few things to note here.
If you register the library, the path where it is is also saved.
If you remove the file, delete the directory or rename something, there will be problems.

The correct way to do it is to copy it into the Windows system directory and register it there.
The update program is a 32-bit application, so the mscomm32.ocx goes
in the Windows/SYSWOW64 directory.

Under no circumstances in the System32 directory, this is only for 64-bit applications!

If a version already exists there, you do not need to carry out the registration process.

If the file did not exist there, register as follows:
regsvr32.exe c:\windows\syswow64\mscomm32.ocx

[pope]

Thank you gents,

I will try a bit longer.

Just to double-check... this is the foldr/files we are talking about, right?

https://www.eevblog.com/forum/testgear/east-tester-et4410-desktop-lcr-meter/msg5522296/#msg5522296

I have a 4510 so I will use the .hex that Martin supplied instead of the one included in the folder.

[pope]

Success!!!

james38's comment solved the issue.


It's 20% at the moment but I had to do it twice as Martin suggested. The screen is black but I think this is to be expected (?)

We shall see but it looks promising 

[w.v.s.]

To be more specific: The \windows\syswow64 path finally made the difference on windows10?

[james38]

The screen is black but I think this is to be expected (?)

Yes it is expected that the Screen went black on a running update.

As I mentioned in step 6 ;-)
https://www.eevblog.com/forum/testgear/east-tester-et4410-desktop-lcr-meter/msg5524615/#msg5524615

[Martin72]

In a hour or two, I could show how this is to be done.

Has probably settled....
Anyway, now I've made the effort, I'll post it too, maybe that's something for others in the future.

[pope]

It works!!!

Many thanks to all of you. Much appreciated!

Martin, I sort it out but thank you for your post. I'm sure it'll help other people in the future 

[Martin72]

After trying....Could be a too stupid idea.

Was a stupid idea...
I had hoped that the jumpers on the frontboard would decide which model is the meter.
This is not the case and furthermore, both frontboards, from the ET4410 and ET4510, are absolutely identical.

[w.v.s.]

So you say display boards are identical, main boards are identical. Then it is all about rubber-like keys and memory content, right?

[Martin72]

Exactly...
I'll take pictures of the two boards at the weekend, I'll have to mark them so that I don't mix them up when I reinstall them...
The secret could lie in the bootloader, the firmware probably leaves the part out.

[w.v.s.]

Is it the black-to-blue flat cable, which is connecting those two boards?

[Martin72]

Yes.
The cable carries the power supply for the front board and the data connection to the chip on the signal board, separated via optocouplers on the signalboard.

[thm_w]

The log is clipped and non-printing characters are shown as '.'. But it seems that the software selects option one from the bootloader menue. I'm afraid the Bootloader will talk Chinese, too.

Thats my fault, you have to setup portmon settings first: https://www.mathworks.com/matlabcentral/answers/103079-how-can-i-use-portmon-to-monitor-my-serial-port
If you want the full capture, I think its everything, in hex its attached.

It is in chinese, translation below

Code: [Select]

杭州中创 - Hangzhou Zhongchuang (easttester)
Bootloader Ver:3.00

----------------------
[1]下载程序  - Download the program
[2]运行程序 - Run the program
[?]帮助      - Help (just shows this screen)
----------------------
Flash is deleted after choosing 1 which is why we see black screen:

Code: [Select]

删除Flash... Deleting Flash
删除完成!  Deletion Complete
准备接收文件... Ready to receive files
--hex transferred here--
下载成功! Download successful


[james38]

This is not the case and furthermore, both frontboards, from the ET4410 and ET4510, are absolutely identical.

Really identical?

When I look at the pictures of an ET4410 and a 4510, I see that the rubber studs are in different places and also have different names.
Take a look at the pictures or has that changed in the meantime?


If I understand correctly, you swapped the front panels but the model recognition remained the same, right?
Did you check to see if the firmware version changed, assuming you hadn't already flashed both with the same one?

That would at least detect that the Nation chip on the display board is being flashed.
From this we can conclude that the basic parameters such as serial number and model are somewhere on the board.
I haven't been able to identify all of the chips,
but I think that the 2nd Nation chip on the mainboard could contain the necessary information.

It would also be interesting to know if both received an update when flashing,
although as far as I know older boards had an STM32F103 on them.

That sounds rather unlikely because the firmware would also have to detect the chip separately.

[Martin72]

Really identical?

Same board number and version.

[w.v.s.]

If you want the full capture, I think its everything, in hex its attached.

It is in chinese, translation below
...

Code: [Select]

杭州中创 - Hangzhou Zhongchuang (easttester)
Bootloader Ver:3.00
...


Great, thank you! So no documented feature of the Bootloader to read from addresses. But the main firmware is deleted during update. So the risk to upload a patched firmware seems minor. An interesting one could modify an scpi command to poll data from memory.[/code]

[w.v.s.]

I was wondering, why the code was first uploaded and than run. If it was directly written into the flash, it would run automatically after the next reset. So I looked into the datasheet, which type of memory there is at 0x40800, where we assume the firmware is written to. The answer of the datasheet is roughly "can be anything":
[qoute]Aliased to Flash, system
memory or SRAM
depending on BOOT pins[/qoute]
There are two pins BOOT0 and BOOT1 and three boot options in the datasheet. Let us know, if you observe anything related to these pins.

[w.v.s.]

Here is a application note on booting this µC:
https://www.st.com/resource/en/application_note/an2606-stm32-microcontroller-system-memory-boot-mode-stmicroelectronics.pdf

What is written in 4.7 "ExitSecureMemory feature" might make things harder.

[w.v.s.]

I think the firmware checks for the model type in the 32bit memory location 0x200000b8. This happens quite often.

[Martin72]

I have now built myself a 5-pole cable that is long enough to connect the front of one to the signal board of the other without having to take everything apart.
Results will follow.

[james38]

Here is a application note on booting this µC:
https://www.st.com/resource/en/application_note/an2606-stm32-microcontroller-system-memory-boot-mode-stmicroelectronics.pdf

What is written in 4.7 "ExitSecureMemory feature" might make things harder.

But that's a datasheet for an STM32.

As far as I know, it was in older models.
The new ones only have MCU from Nation.

So in mine there's an N32G455 on the mainboard
and an N32G457 on the frontboard.

Do you have an STM32 in there?

Datasheet N32G457:
https://www.nationstech.com/en/N32G457d/

Datasheet N32G455:
https://www.nationstech.com/en/N32G455MCUs/

[w.v.s.]

Does not seem to make a big difference, neither the core, nor the general booting concept.

2.5 Boot mode
At BOOT time, the BOOT mode after reset can be selected with the BOOT0/1 pin.

[Martin72]

I have an N32G455 in both cases.
This is on the signal board AND the front panel.
I have just connected the front panel of the ET4410 to the rest of the ET4510....
It's still an ET4410, as we suspected it's up to the front panel whether you have an ET45 or ET44.
And I discovered something else, but first take pictures.

[w.v.s.]

I did some firmware-digging and I think I've found a reason for the next possible update:

Code: [Select]

ub_80515b0 calls sub_8040612 with the model-number-string as second parameter
sub_80515b0 is called by:
sub_805148c
in this context
sub_8054b62
sub_8040980(r0_18, &data_80515d8) // 00 00 00 00
sub_8040980(r0_18, &data_80515e0) // "MEASUREMENT"
->sub_8040980(r0_18, sub_80515b0) // model number
sub_8040980(r0_18, &data_80515ec) // "COMP"
sub_8040980(r0_18, &data_80515f4) // "COMPSET"
sub_8040980(r0_18, &data_80515bc) // "COMPset"
sub_8040980(r0_18, &data_80515fc) // "SYST"
sub_8040980(r0_18, &data_8051604) // "SYSTEM"
!!sub_8040980(r0_18, &data_80515c4) // "STSTem"
sub_8040980(r0_18, &data_80515cc) // "LIST"

*(uint32_t*)0x20000114 = 4;
*(uint32_t*)0x2000142f = 1;
goto label_80515a2;
*(uint32_t*)0x20000114 = 1;
goto label_80515a2;
*(uint32_t*)0x20000114 = 2;
goto label_80515a2;

According to this, I would assume, that the device reacts on "SYST", "SYSTEM" and  "STSTem" but not on "SYSTem" via SCPI  . The model-number-string-subroutine is also fed into the same subroutine as these  SCPI-command-strings. So it might be worth trying how the devices react on model-name-commands.