121GW multimeter firmware hack to prevent remembering last mode - Page 1
Forum section: electronics / testgear

author: f36
author_rank: Contributor
timestamp: July 22, 2022, 02:55:17 am
content: Normally, the 121GW will remember the last mode you were in for each range switch setting. This means if you make a measurement in capacitance mode, turn the meter off, then turn the range switch back to ohms, it will go back to capacitance mode. If you want to change back to ohms mode, you have to press the mode button a few times. I find this annoying and prefer the meter to default to the most commonly used mode for each range (i.e. default to DC volts, DC current, ohms, etc), similar to my other meters.I don't see a way to disable this functionality from the menus, so I spent a couple hours figuring out how do hack the firmware. Figured I'd share the process in case anyone else wants to do the same.Download firmware version 2.05 (https://www.eevblog.com/wp-content/uploads/2017/11/EEVBlog2_05.zip) from Dave's website. This patch will likely only work for V2.05.Using the instructions in the manual, update your firmware to V2.05. Remember to rename the file on the SD card toEEVblog.bin. I don't know if the EEPROM data layout is different for other versions so this is just to make sure the following step works.Turn the rotary switch to each position and select the mode you want as default for every position.Open the V2.05 firmware binary file in a hex editor and change bytes starting at address0xB140(45376) from00 F0 C6 FFto00 BF 00 BF.Put this firmware on the SD card and update to it. Now the meter should default to the modes you selected in step 3 every time. If you want to change these default modes, temporarily go back to the unmodified firmware image.This is a very simple patch. The edit simply replaces the function call to the EEPROM write function inside the mode change code with two NOPs. Therefore, the EEPROM is never written to on mode change and it reads the values set in step 3 every time the rotary switch is moved. As a bonus, it'll take you a few extra eternities to wear out the EEPROM's 300k rated cycles.

author: Fenton Bresler
author_rank: Unknown
timestamp: July 22, 2022, 05:25:03 pm
content: Can't wait to try this out. This function gets in my way every day. It always seemed like such a false good idea to me. Thanks!

author: bicycleguy
author_rank: Frequent Contributor
timestamp: July 22, 2022, 07:13:30 pm
content: @f36Nice hack!! Not sure why, but the auto last mode screws me up more often than not with this meter. Curious if this helps or I'm just not careful enough.thanks

author: J-R
author_rank: Super Contributor
timestamp: July 23, 2022, 11:26:53 pm
content: Very nice, this hack shows there is still untapped potential in the 121GW. It's too bad UEi hasn't continued work on the firmware and the custom firmware never took off.I can see both the factory and custom configurations being desirable depending on use case. Given the sheer number of ranges and modes, having a predictable default makes good sense on one hand, but on the flip side if you're frequently jumping between two switch positions this could get annoying quickly.Luckily I have more than one 121GW so I flashed one with the custom firmware and put a note on it so I know which is which. So far I like this hack more than I dislike it.This hack also affects the range setting in each mode. I set mine to Auto for every switch position.I also ran some additional tests. Best I can tell other functions are not affected. You can set the contrast and auto-power-off for example and it still writes those settings correctly.

author: f36
author_rank: Contributor
timestamp: July 28, 2022, 04:16:12 am
content: Quote from: J-R on July 23, 2022, 11:26:53 pmYeah, I agree. Decided to go back at it today and eventually got some handwritten assembly jammed into the firmware. Now it'll store the mode settings in RAM instead of EEPROM so it remembers any changes until you power off the meter. On startup, it loads the settings from EEPROM into RAM, so you can still choose defaults by setting them with the stock firmware.Quick summary of how it works: Changed the NOPs from the previous hack back to a call to a new function that stores the mode values in RAM at around 0x2000A000. Found and replaced all calls to the EEPROM read function that read from addresses I observed change when the mode changed (EEPROM offsets 0x8-0xE) with another new function that read from RAM. Finally, redirected the reset interrupt vector to a new function that copies the 7 bytes from EEPROM to the new location in RAM. 0x2000A000 is in the middle of RAM, so hopefully it'll stay out of global variables and the stack, but I have no way of making sure nothing will read/write from the addresses I chose.Even with the stock firmware, it doesn't remember range settings and always defaults to auto, so IDK how to make it remember those as well.I hope posting the full firmware image here is kosher since this is a bit more than a few bytes changed.Disclaimer: I have no idea what I'm doing and have never done ARM ASM before, so your meter may spontaneously combust.

author: J-R
author_rank: Super Contributor
timestamp: July 29, 2022, 03:00:58 am
content: Ah, yes, I did forget the factory firmware resets the range to auto.Nice to have all these options available depending on preference!It probably is safer to post the edits to the firmware, rather than the full file?

author: bicycleguy
author_rank: Frequent Contributor
timestamp: July 30, 2022, 05:26:31 pm
content: @J-RQuote from: f36 on July 28, 2022, 04:16:12 amWith so many mods posting the full image seems good to me. Pretty good for no idea what your doing!The changes make a big difference on the usability of this complex meter. Now the only remaining annoying issues are the range of each mode defaulting and the log file formatting.Wonder if you could enlighten me on what software and techniques you used to figure this out so quickly.

author: f36
author_rank: Contributor
timestamp: July 30, 2022, 07:33:43 pm
content: Quote from: bicycleguy on July 30, 2022, 05:26:31 pmI used Ghidra to disassemble the firmware. It does a pretty good job at showing equivalent C code for various function calls since it's able to recognize the type of assembly that GCC produces. I also used the "patch instruction" feature to write the hack, which was a bit painful since you can't move code around that easily, but better than writing machine code in a hex editor.To initially figure out which function was doing the writing to the EEPROM, I soldered some wires to the ST-link connector at the top of the board and ran them out the battery compartment. I then used one of those cheap knock off ST-link USB dongles and OpenOCD and gdb to dump the EEPROM before and after the mode changes. From that, I could tell which bytes were changing in the EEPROM, set a watchpoint to halt the CPU on a write to that address, and that gave me the address of the function to start looking at. The fact that they left the debugger hardware enabled and didn't encrypt/sign the firmware made this so much easier.These are the two commands I used to connect to the meter. OpenOCD ships with a config file that seems to work for this MCU.Code:openocd -f board/st_nucleo_l1.cfgarm-none-eabi-gdb -iex "target extended-remote localhost:3333"I suspect it wouldn't be too hard to find the code responsible for the range setting and the file formatting using a similar technique. For the range setting, a good starting point would probably be to dump the RAM a bunch of times and find the locations that are only changed when the range is changed. Add a watchpoint and see what writes to it when you change the mode dial, hoping for some kind of initialization code. For the log file, I'd go for the peripheral registers that seem to be used for comm with the SD card (seems like it might be bit banged based on the schematic? — no common serial HW for pins used), see what writes to them, and work backwards.

author: JDW
author_rank: Frequent Contributor
timestamp: March 02, 2023, 11:00:42 am
content: To be honest, I sort of like the feature, which I call "Mode Memory" (since no one else has dared to properly name it). Here are two ways to greatly improve it...1. Keep Mode Memory ON by default while the meter is active, but don't save it when you switch OFF the meter! That way, you can set, say, Continuity Check Mode, then switch to Voltage, then switch to Current, and then switch back to the Ω dial setting to get Continuity check again. Convenient and not confusing because it's the same testing session! Then when you switch off the meter and then switch it back on again, it should default to to OHMs, not Continuity. Making this change would eliminate a lot of discontent over how Mode Memory works.2. If the firmware can be hacked to eliminate Mode Memory (and it has), why can't the firmware be further hacked to add a new selectable feature? Three possible menu selections would be idea: enable the standard Mode Memory, or change it to the improved version I proposed in (1) above, or Disable it entirely.

author: J-R
author_rank: Super Contributor
timestamp: March 02, 2023, 08:59:45 pm
content: I'm not sure if you missed it, but the firmware was hacked as you are requesting, you just need to apply the firmware that has the option you want:factory -- mode selection persists through selector switch change and power offhack1 -- mode selection is reset with selector switch change and power off (select preferred mode before flashing)hack2 -- mode selection is kept with selector switch change but reset at power off (also select preferred mode before flashing)Adding code to allow the user to select this from a menu is probably not realistic from a "hack" perspective unless someone is really motivated to continue to reverse engineer the code. I'm confident UEi will not be making further changes to the firmware unless there is a major safety issue discovered. They have had many opportunities to make some simple, meaningful changes and have not. Which really seems odd, as it is just not that much work. I think they are motivated to not make further changes in order to save features for their own current/future products.At some point in the future, I expect someone who wants to impress a future employer will pick up the reigns of the open-source firmware project for the 121GW and then things could really take off.

author: JDW
author_rank: Frequent Contributor
timestamp: March 02, 2023, 09:27:33 pm
content: Quote from: J-R on March 02, 2023, 08:59:45 pmThank you for your reply! I indeed "missed that." Well, that is interesting that someone else thought exactly as I did!I understand what you are saying in your closing paragraph, but there have been numerous firmware updates since the 121GW was released. Did UEi initiate those firmware updates on its own, without any feedback or pressure from Dave Jones? I had the understanding the updates came based on user feedback about the meter in this forum. Also, wasn't the meter itself created in close cooperation with Dave, rather than being an off-the-shelf meter that he merely rebadged?The reason I ask these questions is because if the 121GW is indeed a device co-created between Dave and UEi, I don't see why Dave couldn't just ask that they implement the aforementioned changes in the official firmware, such that each new release (bug fix, whatever) of the firmware does not need to subsequently be "hacked" by an end user in this thread. Wouldn't you agree?

author: coromonadalix
author_rank: Super Contributor
timestamp: March 03, 2023, 03:22:33 am
content: Good point not sure Dave could do something or pull some strings ....worth to try ...

author: JDW
author_rank: Frequent Contributor
timestamp: March 03, 2023, 03:27:16 am
content: Quote from: coromonadalix on March 03, 2023, 03:22:33 amAgain, unless I am totally mistaken, the 121GW is the creation of a rather detailed amount of cooperation between Dave Jones and UEi. I see no evidence it was an off-the-shelf device. Furthermore, I don't see anyone else selling a clone of the 121GW under another brand, which gives evidence that Dave has an exclusive EEVBlog contract for the 121GW. As such, Dave is the Supreme Puller of Strings. Not only that, but he has YouTube influence as well. If he asked UEi, he would receive!

author: J-R
author_rank: Super Contributor
timestamp: March 03, 2023, 08:35:36 am
content: The 121GW schematic is "open". I'm not exactly sure what that means, other than it's published.UEi owns the firmware, as it contains their IP.The UEi DM5x5 series has some design similarities to the 121GW, and the Bluetooth & app functionality of the DM525 is similar to the 121GW.We probably need another Kickstarter campaign or similar to develop a clean-room copy of the UEi firmware or new firmware from scratch. Then the community could build upon that with other functionality as desired.

author: JDW
author_rank: Frequent Contributor
timestamp: March 03, 2023, 08:41:51 am
content: Quote from: J-R on March 03, 2023, 08:35:36 amI'm afraid I still don't understand what the problem is. Why is the owner of the IP relevant in light of the fact that the 121GW is at least co-owned by Dave Jones insofar as he worked with UEi to create the meter and therefore retains some level of exclusivity with regard to who can build it and who can buy it from UEi. In other words, only Dave can buy it in order to sell it to us.So with that in mind, regardless of the IP ownership of the firmware, and regardless of meter similarities, because Dave Jones worked with UEi to create the 121GW, I don't see why it is such a formidable problem for him to ask UEi to make a rather small mod to their firmware, which would exclusively be used on the 121GW.Why should UEi do that if Dave asks? Because not only does Dave retain some rights to the 121GW product, he also is their customer. And if that isn't reason enough, it would bode well for UEi to understand that ongoing firmware support shows people this is a great meter and encourages more people to potentially buy it, which in turn benefits both Dave and UEi, not to mention us.

author: J-R
author_rank: Super Contributor
timestamp: March 03, 2023, 09:05:48 am
content: Maybe the original agreement was to provide firmware updates for a certain period of time and then after that it would cost Dave money. Maybe it's the other reason I gave which is that UEi wants to keep any further developments for themselves and their own products. Maybe the reason is somewhere in one of the other 121GW threads...Regardless, the best solution in my opinion is still for Dave to have his own firmware developed. Some killer features could be: more dual display configurations, adjustable update rate/precision, download logged data from the SD card over Bluetooth, and of course adjustable settings for the mode memory as discussed in this thread.

author: coromonadalix
author_rank: Super Contributor
timestamp: March 03, 2023, 03:27:36 pm
content: hum well now the answer is : hack the firmware if UEI doesn't help or Dave cant do nothing, butr IP breach and cease and desist may roseOr create something new for FW point of view, the 121 use a know dmm chip front end ...we may never know the full story if Dave can't talk about this, ask him and see the answer(s) he may give back ??speculations etc ... wont get far.the 786 is now a replacement of some sort .... and sadly the 121 may or will die if no more support is given

author: J-R
author_rank: Super Contributor
timestamp: March 03, 2023, 08:11:11 pm
content: I'm no coder, but I have followed some game reverse engineering and emulation projects over the decades.The current firmware file is only 140k, and there are some sizeable chunks of redundant data, as well as some that is clear text. So reverse engineering the compiled code is probably not a huge task, but would be a landmine legally at some point. So a clean-room process could be a way around that.From what I've seen of general DMM functionality, and especially UEi's DMMs, I just do not see writing new firmware from scratch being a difficult task. There are a specific number of switch positions and modes where you are basically just reading data from hardware. Min/Max/Avg, Hold/AutoHold and some other functions are obviously a bit more involved. But lay the groundwork and the community might latch on and take it from there.

author: JDW
author_rank: Frequent Contributor
timestamp: March 04, 2023, 12:36:11 am
content: I've lived in Japan working for Japan-based employers since 1994 and have cooperated with manufacturers in China and Taiwan for decades. During the years that we have continuously been buying from various factories, the designs created between my employer and the factory (not too dissimilar from the joint effort between Dave and UEi) were never a focus on IP. It was about our ability to keep buying the product and selling in our chosen markets. And while it could be different for Dave, I don't see why it should be, nor do I see any evidence that the 121GW is largely a UEi device. How can it be when the most glaring "IP" of all is Dave's face!Need proof? Open the manual here:https://www.eevblog.com/wp-content/uploads/2017/11/121GW-Manual-5.pdfWhose face is that in the upper left with his hand stuck out? That's not only Dave but "iconic" Dave -- basically his digitally insignia. When anyone sees that, it's like seeing an Apple with a bite out of it or the 4-letters that spell the word SONY. You immediately know the association with the logo and the entity behind it. That alone shows how much of a "Dave Jones" product the 121GW is, especially when you ponder the fact that the word "UEi" is nowhere to be found on the front cover of the manual. If there was a legal landmine ready to explode, you'd think UEi would have insisted on their name appearing on the front cover of the manual. But they didn't. It's not there.I keyword-searched the 121GW manual, but there isn't a single instance of UEI or Kane that I can see. Nope, not even a single line legal disclaimer that associates the 121GW with them!Yes, yes... On the 121GW product page, I see this text...The meter is manufactured by UEI Test Instruments, a reputable US based designer and manufacturer of high quality test gear. The design work was primarily done by UEI, but with a great deal of design input and direction from Dave. The meter is manufactured in South Korea.But that "input and direction" is rather clear. Just pop your meter out off the blue rubber bumper and whose face appears on the inside of the bumper? The president of the company who "primarily designed" and who currently "manufactures" the 121GW? No, we see Dave.This seems a lot like the situation I myself have seen over the years, with a company in Japan working closely with a manufacturer here in Asia (usually Taiwan or China to keep costs lower), with a large part of the design being the factory, and with that same factory building the resulting product, always with significant "design input and direction" from the company in Japan. And when there's an ongoing business relationship of the entity continuously buying the said item, the cooperation continues such that firmware updates happen upon request, and that is often free of charge in light of the ongoing business.How is that possible? Reality. Nothing remains static forever. To keep business alive you must do something, and most factories are realists about that. They know you have to spend money to make money, so making rather insignificant firmware changes to keep customers excited and happy is worth it in the end.Yes, yes... None of us know what the deal is with Dave and UEi, but like I said, I doubt it's a legal landmine. If he asks, he probably shall receive. That encourages more geeks and engineers to buy the meter, just as I did for the first time in January this year. It's good for everyone in the end, and not a single lawyer need be involved.If anyone here is not convinced, perhaps Dave himself can reassure us. Open the 121GW manual and keyword search for "hack" so you can read this...And remember, don't turn it on, take it apart! This meter is hackable, go for it.Have fun.Dave Joneswww.eevblog.comThat kind of wording doesn't indicate a lawyer read to pounce. It is saying: "make changes for the joy and productivity of it!"And while that doesn't necessarily mean Dave will always keep firmware updates alive, I see no evidence to indicate why it would be impossible, time consuming or costly to have Dave prod UEi to implement the ideas of this thread in a new firmware update. The change really is that small, guys -- and yet, oh so wonderful. Hacking around with electronics is what this meter is all about, and to some extent, Dave's Youtube channel too.

author: EEVblog
author_rank: Unknown
timestamp: March 04, 2023, 12:55:11 am
content: Quote from: J-R on March 03, 2023, 08:35:36 amCorrect, the Kane 555 is a spin-off of the 121GWhttp://cn.kanetest.co.kr/shop.php?goPage=GoodDetail&g_code=20220330171318692&cat_no=2They sent me an EEVblog 555 version a long time ago, completely out of the blue, I had no idea they were working on it. You might have seen it make an apperance in several videos.The deal with the 121GW was they they did the development with input from me, and I got to sell it exclusively, but they were free to use the new case design and features developed and spin off their own version(s) and sell to others.But I get the vibe from Kane that they might not manufacture the 121GW forever, as it's quite labour intensive to calibrate. But I did just get another order from them delivered. But I work on the assumption that at any time they will say sorry, we just don't want to make it any more. So doesn't make sense to put effort into custom firmware for a meter that has no guarantee of production.

author: JDW
author_rank: Frequent Contributor
timestamp: March 04, 2023, 01:05:00 am
content: Quote from: EEVblog on March 04, 2023, 12:55:11 amI for one appreciate that information, Dave. Even so, I am proceeding with the filming of my Youtube video review of the 121GW nonetheless. In fact, I recently bought a Probemaster kit for it too! :-)While it has issues (and what meter doesn't?), I still find the 121GW a very appealing, feature-packed meter (even if the firmware isn't updated beyond 2.05), and it would be a shame if the demand for it remains consistently high yet UEi ultimately kills it anyway, only because it is labor-intensive to calibrate. Hopefully, the demand for it continues to convince UEi to keep the device alive.

author: EEVblog
author_rank: Unknown
timestamp: March 04, 2023, 01:14:24 am
content: Quote from: JDW on March 04, 2023, 01:05:00 amI don't know what sales numbers will continue to make it viable for them. But there could be other issues down the line like parts availability etc.I'm sure they'd be happy if I discontinued it and went with their 555 design, but it just doesn't have the same feature set, is way bigger, and is designed more for the industrial market.Maybe I should do a video on the 555, but I'm sure what I've got is an early prototype, the production version might have changed.

author: J-R
author_rank: Super Contributor
timestamp: March 04, 2023, 01:21:15 am
content: So could another company manufacture the 121GW or does UEi own some or all of the hardware design as well???

author: JDW
author_rank: Frequent Contributor
timestamp: March 04, 2023, 01:36:47 am
content: Quote from: J-R on March 04, 2023, 01:21:15 amI am 30 minutes into watching the video Dave linked for us, and based on that I would say the answer to your question is NO when you consider the involvement of UEi in the design and ownership of the case, and the fact the same case is used in other "non-competing" products too. It's a long video, but I would recommend watching it. It answers a lot of questions. I will ultimately link to it when I release my video review of the 121GW because it provides some excellent background on the meter.

author: J-R
author_rank: Super Contributor
timestamp: March 04, 2023, 01:42:01 am
content: I'm not concerned about the case, the big question would be the circuit design.

author: JDW
author_rank: Frequent Contributor
timestamp: March 04, 2023, 01:46:47 am
content: Quote from: J-R on March 04, 2023, 01:42:01 amBased on what I see in Dave's video, again, I would say the answer is NO. And I suspect Dave doesn't know exactly either and couldn't until he spoke to his contacts, but he would probably speculate NO too at this point. Again, that video he linked for us really does answer a lot of questions. It's worthwhile to make time to watch it.I see no need to get too nervous about the meter disappearing. Unless UEi is "losing money" on it, so long as demand exists, it doesn't make a lot of sense for them to kill it without offering a feature-packed substitute. The 121GW is about packing a huge number of features in a very small size, all for a US$200 price point. It's good PR for UEi to keep it alive too, I think.Most likely, what may spell the demise of the 121GW is exactly what Dave said. If too many of the components become unavailable for purchase some day in the future, the meter could not be manufactured anymore without a major redesign or a switch to another meter of similar size, capabilities and price. But that is true of any electronic device you manufacture. Okay, well maybe it's different for Fluke which has been selling the same models for years and years and years. But their prices are rather high, so I suspect they do redesigns to get around problems with parts sourcing. Not sure.

author: EEVblog
author_rank: Unknown
timestamp: March 04, 2023, 02:23:52 am
content: Quote from: J-R on March 04, 2023, 01:42:01 amThe 555 circuit is near idential to the 121GW, but it doesn't have the 15V diode mode, and it adds an ATM90E26 energy measurement chip with SI8441 digital isolator chip. And because the LCD is bigger it uses a separate LCD driver chip.NCV detection and 3 phase motor added.SD card is the same inside the back cover.I'd guess that almost certainly the firmware is near identical aprt form the new energy measurement and other features.

author: EEVblog
author_rank: Unknown
timestamp: March 04, 2023, 02:29:51 am
content: Quote from: JDW on March 04, 2023, 01:46:47 amFluke have made many major design changes on the 80 series for example. They even switched processor to an MSP430.

author: JDW
author_rank: Frequent Contributor
timestamp: March 04, 2023, 02:33:02 am
content: Quote from: EEVblog on March 04, 2023, 02:29:51 amVery interesting!Dave, please forgive this last off-topic question, but I've been searching the EEVBlog Youtube channel in vain for the answer....I see thatBrymen BM235 gold-plated probeswere originally included with the 121GW, as per theKickstarter FAQ; but of course, the probes included today appear to be stainless steel. WHEN was that change made and WHY?

author: EEVblog
author_rank: Unknown
timestamp: March 04, 2023, 02:37:59 am
content: Quote from: JDW on March 04, 2023, 02:33:02 amFor supply and logistics reasons.At some point after the Kickstarter Brymen had a supply issue with the probes, the lead tme was too long, so I had to go with the Kane probes.Also, supplying the Brymen probes was a PITA because I'd have the open every box before shipment and pack the probes in myself. It was just logisticaly a lot easier to keep supplying the Kane probes.