To keep things interesting for me I decided to look into the firmware updating.
Reversed the code of the other program (located at address 0x6000) in the flash and it confirms what I thought. It is the code for updating the flash. The input file needs to hold the startup image plus the new firmware code.
The file content is read into memory and written to the flash starting from address 0x13000, which is where the startup image resides. The data is written in 65535 (0xFFFF) byte sized blocks and it does 30 blocks no matter what.
The data is read back from the flash and some checks are performed, and when erroneous the first 1000 bytes of the main program are written again with wrong data. (The start of the bitmap, so I think they forgot to do a memory clear before writing)
On success the firmware upgrade file is deleted and the scope restarts. (Need to check this since it calls one more function at the end I did not yet looked into)
I believe it also displays a progress bar, but I still have to decipher that function
Due to all the knowledge gathered with the reversal of the main program it was an easy job to identify the different functions.
Still have to check on the checks they perform and figure out what a bit of code is for to be able to make my own upgrade file.
Before writing to the flash 12 bytes are copied from location
0x5000 0x14000* in the file data and the source bytes are
cleared erased (0xFF). After writing to the flash these 12 bytes are written to the flash at address 0x27000 (start of the main program), but the flash is not erased before this writing.
When I'm done with the investigation I will upload the Ghidra backup as well as my work files to the repository.
Edit: *The C output showed "DAT_80000f40 + 0x5000" while the assembler shows "add r1,r5,#0x14000"