Fnirsi Dso-tc2 Firmware -

Abstract — The FNIRSI DSO-TC2 is a low-cost, dual-channel portable oscilloscope and component tester. While its hardware specifications are well-documented, its proprietary firmware remains a closed-source black box. This paper presents a methodology for extracting, analyzing, and modifying the firmware of the DSO-TC2. We detail the hardware platform (Arm Cortex-M7), identify the firmware storage mechanism (external SPI flash), and demonstrate a full dump and reassembly process. We also analyze the firmware’s security posture, including the absence of read-out protection and potential for bricking. Finally, we discuss the implications for hobbyist modification, bug fixes, and supply chain trust. Our results show that while the device is functionally capable, its firmware lacks basic integrity protection, making it vulnerable to malicious reprogramming and cloning.

Keywords — FNIRSI DSO-TC2, firmware reverse engineering, embedded security, oscilloscope, STM32, JTAG, SPI flash.

The stock firmware on the TC2 is often criticized for slow user interface response and minor bugs.

| Version | Known Improvements | Remaining Issues | |-----------|------------------------------------------|--------------------------------------| | 1.2.0 | Initial release – unstable | Crashes in LCR mode | | 1.3.3 | Fixed display corruption, better autoset | Trigger hysteresis too high | | 1.3.5 | Slightly faster waveform refresh | Single-shot broken, no saving of user cal | fnirsi dso-tc2 firmware

A rogue firmware could:

The PCB exposes SWDIO and SWCLK pads (unpopulated header). Using a J-Link or ST-Link, we connected:

| Pad | Signal | |------|--------| | VCC | 3.3V | | SWDIO| Data | | SWCLK| Clock | | GND | Ground | Abstract — The FNIRSI DSO-TC2 is a low-cost,

Result: The MCU has no Read-Out Protection (RDP) enabled (RDP level 0). This allows full read via STM32CubeProgrammer.

If a firmware update fails and your DSO-TC2 shows a black screen or a static "FNIRSI" logo, it's bricked. Do not throw it away. Here’s how to revive it:

You need an ST-Link V2 programmer (about $10 on Amazon) and a soldering iron (or fine probes). | Version | Known Improvements | Remaining Issues

Recovery steps (abbreviated):

Full tutorials exist on EEVblog and YouTube. This is for advanced users only.

To understand the firmware drama, you have to appreciate the hardware. The TC2 uses an STM32F103 microcontroller (or one of its many Chinese clones). It’s a capable but aging chip.

The "interesting" part of the stock firmware is how it manages resources. To display two distinct modes—oscilloscope and component tester—the device has to effectively "reboot" or context-switch its entire operating logic. Early versions of the stock firmware were notoriously buggy. Users reported jittery waveforms, calibration drift, and a user interface that felt like it was held together with digital duct tape.