New handheld scope+DMM, Fnirsi 2C23T, 2ch, 10MHz/50MSps (Nov 2023)

[tunk]

- claimed 10MHz bandwidth, 50MSps
- 2 channels
- 20mV/div - 10V/div
- 50ns - 10s
- 2.8" screen, 320x240
- size 167x89x35mm
- function generator, 1Hz-2MHz, 0.1-3.3V
- 10000 count multimeter
- around $75 on Aliexpress: https://www.aliexpress.com/item/1005006144235719.html

[tunk]

The manual is now out (English on page 28):
https://img.wqdres.com/res/0/20231109/6d4d7a710da1422bacd13524ecc6bc81.pdf

[axantas]

Just out of curiosity I ordered one. Looking at the specs, it does not try to sell something, it cannot be. Particularly the oscilloscope: It is 10 MHz, not a high value, it can not do properly. Not that I would need another one, but you know, like to have a deeper look at it. Sounds interesting.

[Marc_NL]

I have ordered one today.
Noticed that there is already a new firmware for it (V2.0.1), dunno with what it will be shipped, but here it is anyway -- it's from November 7th, so it's still hot!

https://img.wqdres.com/res/0/20231110/e2c24bc0cb7b4cdeb5333fb8c15eabf1.rar

According to Google Translate, this is the change log:

1. Fix the problem of incorrect calculation of high duty cycle frequency of square wave on oscilloscope
2. Fix the abnormal problem of multimeter range bar
3. Fix some translation display abnormalities

I could not find any reviews of it on AliExpress or the other Chinese webshops, we are the guinea pigs!

[Biosfix666]

Hello from a newbie 

Yesterday i ordered two of them.
As i can see i can do temperature measurement with it.
But, where is the probe to do the mesurement?

Do i need such a probe as it´s in the Zotek Zoyi ZT-702S set?
https://www.amazon.de/XEAST-Oszilloskop-Multimeter-Professional-Auto-Kalibrierungsfunktion/dp/B0C1SLST75/ref=sr_1_1?__mk_de_DE=%C3%85M%C3%85%C5%BD%C3%95%C3%91&crid=1OTKNS26FN6BA&keywords=zoyi%2Bzt702s&qid=1700211269&s=diy&sprefix=zoyi%2Bzt702s%2Cdiy%2C374&sr=1-1&th=1

greets from Germany

[axantas]

It just arrived today. First impression - see photos. I expected the usual brick, but got a compact thing, that fits in my pocket...

First impression, as I do not like RTFM: Astonishing logical menues, guiding you chosing the correct function. Do not read the manual, just use it. I like that.
I am doing a lot of "old tech" projects, usually using tools that exceed my needs a lot. No, not the brick on the right side, this is just used as a size comparsion... Siglent usually does the job.

It just fits the old tech needs. I am just somewhat impressed. It does not claim to do 100MHz - it does 10 - almost, but it can do it.

@Biosfix666: Just tested one of the usual temperature probes - they do their job. You might have to exchange the plugs of the probe to connect it to com and "red"

In my case it was shipped with V2.0 - just upgraded it to 2.01 - dankjewel Marc_NL.

BTW: It comes with a nice P6100 probe - or two - depending on the package.

[Biosfix666]

@axantas

Thank you for testing and the information

greets

[dibu]

does anyone know what the small 1837 marked fpga might be? I'm expecting some chinese one, gowin or the like
also anyone interested in reversing this, making an open source sw for it

I have this on order, i already like it as it is, but having an open source sw for it, it would greatly increase its value.

I don't get it why they bother to laser off chips, it is not like it contains leading edge tech, it has off the shelf parts, and the specs are just ok, nothing impressive.

[dougie]

Got mine few days ago and noticed:

Firmware 2.0.2 is already available on FNIRSI Server.  https://img.wqdres.com/res/0/20231130/27604f59f32c4e22801b61c528475962.rar

Change Log:
1. Boot LOGO analysis is missing
2. LIVE FireWire gear picture position offset
3. The buzzer sound in the on-off position is set to the maximum and is not affected by the system volume adjustment.

However: single trigger event does not work for me.

Especially at low speeds (eg. 50ms/div) it seems when drawing a new line, measurment starts at zero and then jumps to the measured value (5V in my case and trigger set to 4V).
By this a trigger event ALWAYS occurs each time a new line is drawn. Someone able to confirm my experience?

Also my device seems quite inaccurate. Measured a signal in Scope Mode at 4,6V while the same Probe connected to my Tek shows 5,2V 
Thats an Error of 13%

[ph_66]

... Measured a signal in Scope Mode at 4,6V while the same Probe connected to my Tek shows 5,2V 
Thats an Error of 13%

Just my 2 cents: you properly compensated the probe each time you changed, ideally with the same square wave (probably that of the Tek)? I'm asking because I stumbled over this once, too.

Cheers, Peter

[dougie]

... yes I did ... however I don't think compensation will have an influence when measuring DC 

[lizard]

Got mine, echo most of the comments here re. accuracy etc.  Unfortunately I decided to upgrade the firmware to 2.0.2.  Bad move!  Bootloader made it to 99% and screen went blank.  I can get back in to the bootloader (reset pin, then hold menu while powering on), but not much else.  I downloaded the firmware from the FNIRSI site so I presume it's OK.  Contacted FNIRSI support who sent me a direct link, but no joy.  Waiting for a refund from Banggood.  Since I got to keep the non-functioning brick, I'll try diddling with the flash ROM when I get some free time.  Sigh.  At least it was cheap

[dibu]

you could try flash the firmware directly via jtag/swd

the swd pins are routed to a unpopulated header near the reset button, the interface is not locked (at least not on my device), only flash is protected, so you will loose the original firmware together with the loader if you unlock it.
i also tried diddling with the firmware file, it looks like it is complete firmware (without the loader part?) contains also the unknown fpga bitstream.
Maybe you could loose something critical i'm not sure.

you will need to make a minimalist dummy loader to jump to the application reset and adjust the vtor

the main chip is at32 something i can look up the exact part number i don't remember exactly basically a stm32 clone (cortex m4)
i could look up more details if you want to try this, i'm not sure it will work, i haven't tried it, but if it is bricked anyway, what do you have to loose.

i'm still trying to figure out what the fpga and the multimeter chip is.
Also looking for others interested in reversing this.

[lizard]

Thanks.  Was able to pull the documentation for the MCU.  There's also a serial flash (25Q64) adjacent to the MCU - bootloader maybe?  Should be easy to remove and take a look at the contents.

[dibu]

the serial flash is just used to realize the filesystem used to store screen captures, also this is what you see when you connect via usb as usb mass storage. it uses elmchan fatfs. there is nothing interesting/hidden there

[fecus]

I bought this equipment too. I tried upgrade too. It is bricked. Where is the reset pin? Thanks.

[latcakir]

not have xy mode

[KHROMV]

to restore the device to revision 0.4, the firmware version is used  https://drive.google.com/file/d/12FHIXT3cF5Pw5OSnOaCDYWjMch264Il5/view?usp=sharing

[ivgu]

Got mine few days ago and noticed:

Firmware 2.0.2 is already available on FNIRSI Server.  https://img.wqdres.com/res/0/20231130/27604f59f32c4e22801b61c528475962.rar

Change Log:
1. Boot LOGO analysis is missing
2. LIVE FireWire gear picture position offset
3. The buzzer sound in the on-off position is set to the maximum and is not affected by the system volume adjustment.

However: single trigger event does not work for me.

Especially at low speeds (eg. 50ms/div) it seems when drawing a new line, measurment starts at zero and then jumps to the measured value (5V in my case and trigger set to 4V).
By this a trigger event ALWAYS occurs each time a new line is drawn. Someone able to confirm my experience?

Also my device seems quite inaccurate. Measured a signal in Scope Mode at 4,6V while the same Probe connected to my Tek shows 5,2V 
Thats an Error of 13%

Hi,
I am experiencing the same problem with single trigger on the falling edge. It triggers immediately after arming, and starts from 2 squares (4V on 2V per square). I am still at 2.0.1. Did you manage to identify and solve the problem? Thanks a lot!

[dibu]

the fpga is AG1KLPQ48 apparently this is commonly used in similar products, also was mentioned here in other threads

[Kaluluka]

Hi!
I just got one and it has HW:04 but Firmware shows 2.1.0, not 2.0.1....

[pilatomic]

Hello,

So I've been playing around with this device for a few days, and even if it certainly has its flaws, I quite like it as a cheap device I can move around.
The single shot bug was a deal-breaker for me, so I took a look at the firmware in Ghidra in an attempt to fix it.

First, I found a few features that missing from the manual  :
- There is a scope calibration function (DC offset nulling ?) engaged by long pressing "AUTO" in scope mode.
- Long pressing the center button in scope mode moves the traces to their default position.
- Long pressing CH1 and CH2 in multimeter modes enter some calibration mode (didnt try it, I dont want to mess the calibration on mine)

Then I was able to locate the issue with the single mode trigger :
Where I was expecting some sort of indexing issue, I found out they actively zero the sampling buffer before the trigger point !! (see attached picture)
Not sure what they had in mind when they wrote that, but I was able to make the code jump over that "feature" with a single byte change in the firmware.
I also changed the version string from 2.0.2 to P2.0.3 to make it clear what firmware the device is running

You'll find the patched firmware attached to this message, along with 2 screenshots showing the change of behavior from Fnirsi original firmware (2.0.2) to my patched version (P2.0.3)
TRY IT AT YOUR OWN RISK. I am not responsible for any bricked device.
It still doesnt make the single trigger mode perfect, as it samples a relatively low percentage of the time, so it easily misses the trigger point.
I might be able to prevent it to trigger entirely if the trigger point is not in the sampling buffer, but I feel it might look misleading.

To install the new firmware, hold the MENU button before pressing the POWER button (bootloader mode), then plug the device to a PC, and drop the firmware in the newly found USB disk.
If anything goes wrong, you can insert a pin in the hole on the side to reset it, re-enter the bootloader mode, and flash the original firmware back.

Feel free to leave any feedback !

[dibu]

Nice found, i'm interested in making a completely open source firmware for it, it looks like you have more of the SW decoded, more functions, variables, i still have many functions like osci_channel_something, and only very few variables decoded. I would be very interested in your ghidra project if you want to share it.

[tunk]

Nice found, i'm interested in making a completely open source firmware for it, it looks like you have more of the SW decoded, more functions, variables, i still have many functions like osci_channel_something, and only very few variables decoded. I would be very interested in your ghidra project if you want to share it.

EEVblog user pcprogrammer has created alternative firmware for the 1013d and
1014d. If the hardware is similar, then you might use his firmware as a starting point:
https://www.eevblog.com/forum/projects/reverse-engineering-the-fnirsi-1014d/
https://github.com/pecostm32/FNIRSI_1013D_Firmware

[dibu]

i know about this project, and plan to buy the 1013d also at some point, just for the open sw, however i think these are very different from from a hw point of view, this scope-mm is much more limited, tiny cortex-m4 mcu and tiny fpga. But some SW components could be similar, both use ChaN FatFs, graphic lib is somewhat similar, font handling maybe, low level stuff here is from the AT32 HAL, it would be a good starting point overall.