TH2830 vs TH2832

[nctnico]

Time to dump the contents of the flashes and (if possible) the LPC1788... Or find firmwage images so these can be compared.

I don't know how to do that.

I do have a TH2830 hex firmware file. I haven't had any luck finding the TH2832 firmware yet to compare them.

Can you post (or provide a link to) the firmware you have so people can analyse it?

[KungFuJosh]

I'll just attach this random hex file here and take no responsibility for whatever may or may not happen with it. 😇

[KungFuJosh]

Anybody out there with a TH2832 that has received or could request a firmware file?

[nctnico]

Sure enough it mentions TH2830 and TH2832 as text. It shouldn't be super hard to figure out what is going on and see what selects the operating mode.

[KungFuJosh]

Sure enough it mentions TH2830 and TH2832 as text. It shouldn't be super hard to figure out what is going on and see what selects the operating mode.

It also mentions a bunch of others. Here's line 215's plain text:

TH2831  ST2831  XTD4510 DHK6200 TX6200  AMM3044 TH2830  ST2830  SM6023  DHK6100 JCX860  TX6100  TH7830  TH2816D OCT1010 TH2830HY    LCR2100 LN2020A H920    GT2830T JCX8603 H9803   JCX8610 ^. `. Wrong Firmware!       Illegal Firmware!

It's interesting that they also mention the other branded versions like the ST2830. I don't know how to do anything useful with this information though. If we had a TH2832 firmware file to compare with, that would be much easier.

[KungFuJosh]

Here's totally random thought.

If you're looking for an awesome lab grade LCR meter, the 2830 or 2832 are both great devices. The hardware and build quality are well done.

However, I've had two very different experiences when it comes to support and communication. Tonghui's support was slow, if they responded at all (and they usually did not). They also ignored any requests for firmware of either version, including the version I already have with their name on it. On the other hand, Sourcetronic got back within 1 business day every time I emailed them, and they responded to my first request for the firmware, with the firmware. What I'm saying is, if you have the choice between purchasing the ST2832 or TH2832, I would get the Sourcetronic version without hesitation. You can simply expect better support.

On a totally unrelated note, see the random file attached. 😉

[KungFuJosh]

My first experiment was an expected successful fail. 😉

When the LCR first starts up, hold down the TRIG button to enter setup.

I renamed the firmware file as CURRENTMODEL.SEC (th2830.sec), and loaded it on a USB stick inserted on the front of the meter.


Select option A: for Firmware Update:


And, sadly, as expected, it shows the "Wrong Firmware!" warning I copied from the hex code above:



To revert it back, I renamed the original th2830.sec file with the  "other" model's number, and that restored my TH2830 back to normal.


I'm guessing we might find success if somebody can figure out the hardware IDs inside the firmware.

[nctnico]

Can you also get the ST2830 firmware?

[Martin72]

Ah, not bad thought...

Could ask sourcetronic if there is firmware for our ST2830 avaible*...

*)Asked them for a service manual..no way.

[KungFuJosh]

Can you also get the ST2830 firmware?

Once again, the ST people win. I just asked and they sent it. Weird.

[Martin72]

Wow 

[KungFuJosh]

Wow 

Yeah. Not only that, the ST firmware loads no problem on my TH unit. I renamed the st prefix to th, and then updated the firmware. Still 2830, but doesn't say Tonghui anymore lol.



So it looks like we can probably ignore the th firmware, and just focus on the st stuff.

[KungFuJosh]

It's pretty weird that all the firmwares say ver1.0 with different dates:

TH2830 2021-10-14
TH2832 2020-01-13
ST2830 2020-04-16
ST2832 2019-04-23

[Martin72]

And, somewhat conspiracy theory, the ones for the larger models are older, which could indicate that the 2830s are actually limited only by the software.

[KungFuJosh]

Good point! Where's my tin foil hat?

[KungFuJosh]

Can somebody else with a 2830 and somebody with a 2832 check what hardware version shows on the firmware upgrade screen? I'm just curious.

Thanks,
Josh

[Martin72]

ST2830 ?
No problem, tomorrow...

[nctnico]

Firmware looks like some kind of archive. The first 24 bytes are some kind of header which may contain a length. After that, there is a typical Cortex Mx firmware image with the first 4 bytes containing the stack pointer (in the LPC1788's SRAM) and the reset vector. So if you load this into a debugger which can find how texts are referenced, it should be easy to find out how the model type is being determined. Flash / code read protection seems to be disabled (not used) so you should be able to attached a debugger to the JTAG pins and read the memory content & step through the code.

[KungFuJosh]

Anybody with tools and skills to do that? I might have a debugger, but I've never tried that before (I've only used it for programming).


One thing to note (useful or not, I dunno) is that the meter accepts whatever ID you want, but that doesn't make the firmware work.

For example, I flashed TH2830 model to ST2830 firmware (rename ST2830.ext to TH2830.ext), now I have to use an ST2830 filename to change to anything else. ST2830 firmware works fine. If I rename ST2832.ext to ST2830.ext, that will flash but give the "Wrong Firmware!" warning. To flash it to something else, the new firmware file has to be named ST2832.ext.

Note: ext = .sec

[Martin72]

ST2830 ?
No problem, tomorrow...

Here it is..

[KungFuJosh]

Here it is..

Interesting. Ours have different hardware version numbers, but we're both running the same firmware now. So that's cool.

Do you know how to do what @nctnico was asking?

[Martin72]

Hi,

Ours have different hardware version numbers, but we're both running the same firmware now.

In these times I am not surprised, due to the ongoing component shortage/obsolescence many manufacturers have to change parts of their installed hardware to be able to deliver, so for example Siglent Scopes.

Do you know how to do what @nctnico was asking?

Only partially, this is an area where I am still learning.
I had bought such a debugger / programmer tool to flash the Uni-T current clamp, also worked.
With this, the readout should also go, provided that the tool recognizes the controller type and supports.

[Martin72]

I had a look again on one of your pictures, with a LPC1788 and the EPM570 on board.
From my "halfknowledge" point of view you will have to re-program both to get a TH2832 model.
(Or maybe re-programming the mcu is enough, while the CPLD leave untouched).
and you need a TH2832 owner..
If there´s no read/write protection enabled, reading out the files and comparing them with the files of the 2830 MCU/CPLD.
Or just re-programm it...

Here two links..
https://www.engineersgarage.com/getting-started-with-the-arm-cortex-m3-lpc1768-part-1-21/



It shows you at least what you need to handle these chips.

At work we´re using PLDs and µCs for our control electronics for our inverter/converter.

Maybe the forum member ludee could read out the files from his TH2832, that would help a lot.

[nctnico]

First step is to seperate the firmware images into seperate files (shouldn't be hard), load these into a debugger for analysis and look at difference in usage of text. The 2830 firmware doesn't seem to have the wrong firmware message so the spot where that is referenced is the place to start looking. You'd need a fancy debugger that can do analysis like IDA or a free alternative that supports the ARM thumb2 (IIRC) instruction set. Note that debuggers come in two varieties: the ones that are intended to debug known code (like GDB) and the ones that are intended for reverse engineering (like IDA).

It looks like the firmware image has 3 chunks and these are seperated by a header containing a text string 'B9FZI'

[Martin72]

What do you think about simply overwriting the contents of the chips with the ones from a 2832 ?