Hi everyone.

Simon found than small IC placed near laser diode and APD photodiode is Si5351. It is dual PLL clock generator, controlled by I2C bus. It can generate two different frequencies from 8 kHz to 160 MHz.

I think that si5351 generates two high (>100 Mhz) but close frequencies. One of them is used to modulate laser, another - to modulate APD photodiode power.

These two frequencies are mixed at APD and the resulting low frequency is amplified by sgm8592 IC. The amplified signal (there were photos of this signal at oscilloscope) is analysed by MCU.

So, I think that it is possible to capture I2C signals and calculate used frequencies. After that it is possible to write new firmware for STM32, which would analyse resulting signal. That way can give an advantage - it is possible to create less accurate (~10 mm) but faster (>10 Hz) rangefinder.

Now I'm waiting for delivery of Chinese rangefinder module, it's construction is very similar to UT390+ (it has si5351 installed).

I want to do it's full reverse engineering, and write my own code for rangefinder's STM32.

I hope that code will be suitable for UT390+ too.