OpenScope-2C53T
Open-source reverse engineering and firmware development for the FNIRSI 2C53T oscilloscope/multimeter/signal generator
OpenScope 2C53T is a clean-room firmware rewrite for the FNIRSI 2C53T instrument
A GPL-3.0 replacement firmware that reverse-engineers the stock binary to drive the handheld oscilloscope, multimeter, and signal generator.
What the project replaces
OpenScope 2C53T is an open-source replacement firmware for the FNIRSI 2C53T, a handheld instrument that combines an oscilloscope, a multimeter, and a signal generator. The README describes the stock device as a capable 75 dollar handheld 3-in-1 instrument held back by buggy firmware, and this project is a complete clean-room firmware rewrite built by reverse engineering the original binary. The work is explicit that no FNIRSI source code is distributed in the repository. The reverse engineering was done with Ghidra, and the README says the team has identified and named 309 functions, mapped all roughly 40 FPGA commands, fully documented the ADC data format, and traced every hardware pin, with about 98 percent of the stock firmware now understood. A major milestone is recorded as of 2026-08-13: the make guest-coldtrace build cold-boots, configures the Gowin GW1N-UV2 FPGA itself, arms the capture engine, and renders live, probe-responsive waveforms, with no stock firmware, no warm handoff, and no opened case. The README links a devlog entry and an issue thread describing how the FPGA configuration problem, which owned the project's critical path from April to August, was solved. A pull request adds a dual-boot switcher so a user can keep stock firmware and switch between the two.
Current maturity and caveats
The README is blunt that this is development firmware and should not be trusted for real measurements. The scope captures, but it is not yet a usable instrument. There is no timebase control: each hardware sweep is about a microsecond, a 1024 sample snapshot refreshed roughly 34 times a second, so the trace faithfully tracks slow signals as a moving level while anything above about 15 hertz aliases into nonsense. Vertical calibration is a placeholder, with the baseline sitting around 55 and the trace clipping against the top of the plot. The measurement badges on the scope screen are hardcoded strings rather than measurements, so they show fixed values regardless of what is probed. The multimeter works but is treated as unverified on a given unit, because the low ohm calibration factor is per device and currently hardcoded to one bench unit. The project grades every feature on a five stage ladder from S0 written, through S1 wired and S2 measured, to S3 guarded and S4 polished, and states nothing has reached S4. Cold-boot FPGA configuration and live capture on channel one are at S2, reproducible across power cycles on one unit. Channel two is at S1 with one usable attenuator tap. Volts per division and time per division are at S3 with some codes measured and others shown as a dash rather than a guess. FFT, math channels, Bode plot, and protocol decoders are at S0, fed by synthetic sources.
Hardware and how to build
The documented hardware uses an Artery AT32F403A microcontroller, an ARM Cortex-M4F at 240 megahertz with 1 megabyte of flash and 224 kilobytes of SRAM. The display is an ST7789V at 320 by 240 pixels over a 16-bit parallel bus. The FPGA is a Gowin GW1N-UV2 that handles 250 megasample per second ADC sampling, with a dual channel 8-bit 250 megasample per second ADC over FPGA SPI3. The signal generator is a two channel 12-bit DAC. Flash is a Winbond W25Q128 of 16 megabytes for UI assets and calibration. Input is 15 buttons. The first flash requires opening the case to enter the microcontroller's ROM DFU mode, which is the only mode that can write option bytes, after which a USB HID bootloader handles future updates with the case closed. The toolchain is the ARM GNU toolchain and dfu-util, with the firmware depending on two libraries cloned into the firmware directory: the AT32F403A firmware library and the FreeRTOS kernel. Build targets include make for hardware with the HID bootloader, make guest as a guest image under the stock bootloader, make guest-coldtrace as the only build that configures the FPGA and captures, and make emu for an emulator. A Renode emulator and an SDL3 LCD viewer let the firmware run without hardware. The README also documents restoring stock firmware through the device's stock bootloader over USB-C, with a bundled flasher that verifies the stock firmware by SHA-256.
Editorial conclusion
The repository is published under the GPL-3.0 license and its most recent commit was recorded on 2026-08-26. The source lives at https://github.com/DavidClawson/OpenScope-2C53T.
Community notes