It is interesting to see that FNIRSI used yet another FPGA in a bunch of 1013D's. The tear down
https://www.cnx-software.com/2022/11/16/fnirsi-1013d-teardown-and-mini-review-a-portable-oscilloscope-based-on-allwinner-cpu-anlogic-fgpa/ shows a clear picture of the PCB and that they did not remove the marking on the chip in this one.
The question is if this is a newer revision then the one with the AL3-10. Don't think the firmware will be any different going by the screenshots.
But this is about the 1014D and your intentions to play with it.
About the JTAG for the FPGA. In the 1014D there is provisions for a 2.54mm double row header as shown in the schematic, so easy enough to do direct uploads to test new designs. I modified my 1013D with some wires soldered to the components to get access to the JTAG. Morris6 went a bit further and did an impressive job in adding a header and some additional LED's to his scope.
There is also a design based on a bluepill and unfortunately closed firmware for a JTAG programmer for the Anlogic IDE.
https://github.com/pecostm32/Lichee_Nano/tree/main/Hardware/Anlogic_JTAG_ProgrammerYou mention the different FPGA's as complicating things, and that is true when the road of designing a new setup for it, is taken. You would need access to all types to make it work for every scope out there. Not really optimal to say the least, but not a lot of people might be interested in upgrading the FPGA flash, which could mean the stock firmware won't work anymore. (You would need to adapt your design to be backward compatible)
In a similar way there is the usage of the different LCD modules with shifted screens as a result. I solved that with a separate configuration file, where as the manufacturer choose to supply different versions of the firmware. Also had to do this for the touch panel on the 1013D, which also has different configurations out there leading to swapped x and or y coordinates.
You mention not having success in reading the FPGA FLASH ic. The trick here is to do it with the scope up and running. Only connect the SPI signals and the ground, not the 3V3 power. The FPGA screws with the signals when not powered up. So even though there is the diode in the FLASH supply chain it did not work for me until I powered up the scope.
There is indeed some development environment I created for the 1013D, and the repository you found modified it to use the QEMU instead of my own ARM emulator I wrote just for this reverse engineering task. I have not tried it. You can try to adapt it to make a 1014D version. But don't forget that all this code is unfinished and wrote up just to aid me during development.
About the 1014D firmware backup I wrote. It is a copy of the one I wrote for the 1013D, but lacks the touch panel configuration backup. For the rest it is practically the same. It writes a full backup of the FLASH for the F1C100s to the SD card and also a separate backup of the firmware part with the needed check bytes to be able to reload the firmware based on the update procedure the manufacturer uses.
After I f...ed up my second 1013D with that procedure, I decided to pursue the SD card firmware route.
And finally, yes, like I wrote before, a good starting point for you to make something for the 1014D would be to further reverse engineer the firmware of the user interface controller. Knowing the commands send to the F1C100s is the first step in to being able to mod the 1013D firmware.
And now the fun starts