Firmware update for ATTEN ADS1102CAL+ oscilloscope

[darist]

Hello all

I have recently bought an ATTEN ADS1102CAL+ oscilloscope. During the short time I've been using it, I have noticed many bugs that are most probably related to the ancient firmware version (see attached screenshot). I have been trying to update to the latest firmware (5.01.02.13 according to www.atten.eu) without any success. Here is what I have done so far:

a) From a discussion in https://www.eevblog.com/forum/beginners/atten-oscilloscope-firmware/ I understood that my oscilloscope model shares the same firmware with the corresponding Siglent SDS 1000CNL oscilloscope. Thus I downloaded the firmware from http://www.siglent.com/en/product/detail.aspx?id=100000004399111&nodecode=119008001 and tried to install it. I formatted a USB drive (FAT32) and copied the update files in the root directory. When I connect the USB in the front panel port of the oscilloscope and try to update the firmware according to instructions, I get the message: "Firmware update failed, error 0xFE. No upgrade files detected on USB device!". BTW the "SINGLE" button did not respond while trying to update (contrary to the update instructions), I only got a 'Confirm' and 'Cancel' option. Furthermore, the USB drive works OK because I can successfully save and load waveform data using the oscilloscope.
b) I downloaded an older firmware (3.01.01.31R16) from a link in http://www.cube.co.za/~tva/workbench/atten-ads1102cml/atten-ads-1102cml-review.xhtml. I tried the same procedure as above with the exact same failed result.
c) I have written a mail to both info@atten.eu and sales@atten.com.cn but without any answer yet.
d) It seems that the oscilloscope expects exactly a filename format of the firmware update file. I have been trying to rename the file using various combinations (ex. ADS1000CNL*.ADS) but without any success.

Any help would be greatly appreciated!
Thank you in advance

[nctnico]

Atten.eu is a reseller. Did you buy from them? If yes, they are the party to contact. If not, try contacting the seller.

[darist]

I bought the oscilloscope from ebay. I have already contacted the seller but I don't really expect much of a help from him. Maybe an email of a contact person in atten at the most.

I found out that the serial number of my device matches with some Hantek devices, as there are several references on the internet for Hantek oscilloscopes with s/n (T 1G /012...) . I figured out that maybe the real hardware of my oscilloscope is from Hantek, so I tried to use the latest firmware of Hantek DSO5102P that has common characteristics with my device. Unfortunately, during the firmware update process I bumped into this 0xFE error message once more.

I'm pretty sure that it is a filename format issue. Only God (and maybe a couple of atten engineers somewhere in China) knows what this filename needs to be...

[tautech]

Here is the format for current Siglent SDS1000 series firmware:
SDS1000CNL_SSP_V100R005B01D02P13.ADS
(exactly as copied from filename)

This is not the only file that comes in the downloaded firmware. (.rar package)
Also a .cfg file and a readme
Make sure they are all on the USB stick.

[darist]

There is a lot of information in this forum! The more I dig in the more I find:
https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg375590/#msg375590

This screenshot matches exactly to the characteristics of my oscilloscope (sw & hw version, serial). It seems that my oscilloscope is a new model with Tekway/Hantek hardware inside. According to a post from tinhead, the firmware is from Hantek DSO5000P series specialized for ATTEN.
https://www.eevblog.com/forum/testgear/new-atten-dso-discovered/msg264137/#msg264137
However, as I said before I tried to use the firmware for Hantek DSO5102P (dso5kp_func_dso5102p20140208.up) without success.

@tinhead: Do you have any update regarding this new model of ATTEN? I am willing to upload pictures if you are willing to take a look.

[nctnico]

Try to format the USB stick with FAT16. Maybe the firmware upload only works with FAT16.

[darist]

I finally got an answer from atten.com.cn (basically gratten.cn, as atten is now dealing with soldering stations & power supplies).
Anyway they sent me the new firmware v.1.90.0(140724.0) for my oscilloscope type. I already installed it successfully.
This firmware exists nowhere on the internet, so I thought it would be a good idea to upload it:
https://mega.co.nz/#!XF0CURDL!PZkuQdwuWxgt5A6XRbBvaxHU3WhZQtqyMslxKT4TCO4

Here is the oscilloscope status after the update:
[Model]                  ADS1102CAL+
[sw version]           1.90.0(140724.0)
[hw version]           1100xfff8106
[serial number]       T 1G/ 013 000418
[lcd.front.ts]           0.0.0

[Theboel]

are new firmware solve the bugs problem ?

[Kevin Liu]

I finally got an answer from atten.com.cn (basically gratten.cn, as atten is now dealing with soldering stations & power supplies).
Anyway they sent me the new firmware v.1.90.0(140724.0) for my oscilloscope type. I already installed it successfully.
This firmware exists nowhere on the internet, so I thought it would be a good idea to upload it:
https://mega.co.nz/#!XF0CURDL!PZkuQdwuWxgt5A6XRbBvaxHU3WhZQtqyMslxKT4TCO4

Here is the oscilloscope status after the update:
[Model]                  ADS1102CAL+
[sw version]           1.90.0(140724.0)
[hw version]           1100xfff8106
[serial number]       T 1G/ 013 000418
[lcd.front.ts]           0.0.0

I am also need this firmware, Can you send a backup to me?
Thanks.

[daro-1]

I've got the ATTEN ADS 1102CAL that I brought secondhand from a local ham radio fest for $275 and I was warned about some of the original firmware issues as it had vers 301.01.01.213 installed when I got it and then I decided to upgrade the firmware based on what I was reading on this forum post and a similar one on this site and upgraded mine to Siglent SDS1102CNL vers 5.01.02.29 which works a treat when you follow the instructions of flashing the firmware first then reboot and then cfg file and reboot again and then do self calibration of the unit, so mine now is basically a Siglent SDS1102CNL and I can't use the original ATTEN ADS 2202CAL USB drivers as it has also upgraded USB flash EEPROM and now identifies itself as an SDS1102CNL when it's plugged into a Windows 7 or 10 based PC, is there anyway I can use this DSO on a PC because there is no known USB drivers for the SDS1102CNL to be able to use this with EasyScope vers 3?

[tautech]

I've got the ATTEN ADS 1102CAL that I brought secondhand from a local ham radio fest for $275 and I was warned about some of the original firmware issues as it had vers 301.01.01.213 installed when I got it and then I decided to upgrade the firmware based on what I was reading on this forum post and a similar one on this site and upgraded mine to Siglent SDS1102CNL vers 5.01.02.29 which works a treat when you follow the instructions of flashing the firmware first then reboot and then cfg file and reboot again and then do self calibration of the unit, so mine now is basically a Siglent SDS1102CNL and I can't use the original ATTEN ADS 2202CAL USB drivers as it has also upgraded USB flash EEPROM and now identifies itself as an SDS1102CNL when it's plugged into a Windows 7 or 10 based PC, is there anyway I can use this DSO on a PC because there is no known USB drivers for the SDS1102CNL to be able to use this with EasyScope vers 3?

Welcome to the forum.

You'll need this version of EasyScopeX:
http://www.siglentamerica.com/USA_website_2014/Firmware&Software/Software/EasyScopeX.rar

You need to install NI VISA and the drivers are contained within.
It's a big package, 500 MB + and you can't let Windows decide which driver to use.
I attach a doc I prepared and have on file to help. Extract the info from it that you need to point Windows to the listed driver and you should be OK.

[daro-1]

Thanks, I've got it all going under Windows 10 now. 

UPDATE: The latest firmware for the Siglent SDS1102CNL is ver 5.01.02.32 and I found it on here:

http://www.siglentamerica.com/USA_website_2014/Firmware&Software/firmware/SDS1000CNL_SSP_V100R005B01D02P32%20(3).rar

Also I don't think too highly of  EasyScopeX as the interface looks very cheap so I opted to use the Teledyne LeCroy version which they call WaveStudio which looks more polished and professional then EasyScopeX and works quite well with my DSO.

Download WaveStudio and NI VISA downloader from here:

https://drive.google.com/drive/folders/0Bx1eYdyyMol2ZHNsOXpTTTR3SEE?usp=sharing

[darist]

I have re-uploaded the firmware of my ATTEN ADS1102CAL+ oscilloscope at:

https://www.dropbox.com/s/arkkiw84a1480hp/ATTEN_ADS1102CAL%2BFirmware.zip?dl=0

I remind you that this was the only firmware that worked for this oscilloscope model, as all other firmware versions that I tried to update just didn't work:

Model]                  ADS1102CAL+
[sw version]           1.90.0(140724.0)
[hw version]           1100xfff8106
[serial number]       T 1G/ 013 000418
[lcd.front.ts]           0.0.0

[tv84]

Parsing SDS1000CML_SSP_V100R005B01D02P32.ADS:

Code: [Select]

File Header Size: 00000048
00000000 - File Checksum: F554D6CF [000004-EOF] (with only the File Header decrypted)  CKSM OK
00000004 - File Size: 001730FB (without 0x48 bytes of the File Header)
00000008 - N. of Blocks: 0000881C
0000000C - Blocks Area: 000F698B [0007C770-001730FA]
00000026 - Vendor/Content:     The help info
0000003A - Version:     ISP1763
****************************************************
Decrypting the 0x2800 and 0x1400 blocks...
Reversing file...
XORing with 0xFF (incrementing pattern)...
XORing with 0xFF from 0x000B987E until 0x001730FA
****************************************************
00000000 - Section Checksum: FCE1FD30  [00000004-0007C76D]  CKSM OK
00000004 --- 0007C76D  ***** Unknown Section ??? *****
****************************************************
0007C770 - Removing block encapsulations from Block Area [0007C770-001730FA]

Total bytes extracted (from the blocks): 000CC0E5    Block area processed OK

Buffer Size: 00006DEA bytes (after converting from 16 to 8 bits)

0x00000000  DXE 0000 (Data Size: 00006DD4) [00000000-00006DE1]
Processor Type: ADSP-BF533/534/536/537/538/539 (boot address: 0xFFA00000)
Orig Offset:    Offset:         Block:  Target Add:     Byte Count:     Flags:  [  start -   end  ]
00000000 ---    0x00000000      0000    FF800040        00000004        0012    [0000000A-0000000D]  resvect ignore
0000001C ---    0x0000000E      0001    FF800000        000022B0        0002    [00000018-000022C7]  resvect
00004590 ---    0x000022C8      0002    FF8022B0        00000010        0003                         zero-fill resvect
000045A4 ---    0x000022D2      0003    FF8022C0        00000010        0002    [000022DC-000022EB]  resvect
000045D8 ---    0x000022EC      0004    FF8022D0        0000029E        0002    [000022F6-00002593]  resvect
00004B28 ---    0x00002594      0005    FF80256E        0000000E        0003                         zero-fill resvect
00004B3C ---    0x0000259E      0006    FF80257C        000009BA        0002    [000025A8-00002F61]  resvect
00005EC4 ---    0x00002F62      0007    FF802F36        000000AA        0003                         zero-fill resvect
00005ED8 ---    0x00002F6C      0008    FF802FE0        0000000C        0002    [00002F76-00002F81]  resvect
00005F04 ---    0x00002F82      0009    FF902000        00000004        0002    [00002F8C-00002F8F]  resvect
00005F20 ---    0x00002F90      000A    FF902004        00000068        0003                         zero-fill resvect
00005F34 ---    0x00002F9A      000B    FFA00000        00003E32        0002    [00002FA4-00006DD5]  resvect
0000DBAC ---    0x00006DD6      000C    FFA00000        00000002        000A    [00006DE0-00006DE1]  resvect init

0000DBC4 --- ZLIB Decompressed Size: 001EEE90
0000DBCC --- ZLIB Compressed Block Size: 000BE511 [0000DBD4-000CC0E4]
****************************************************
  File Processed OK

Parsing ADS1000CML_V100R003B01D01P31R16.ADS:

Code: [Select]

File Header Size: 00000048
00000000 - File Checksum: F55933E4 [000004-EOF] (with only the File Header decrypted)  CKSM OK
00000004 - File Size: 0018790A (without 0x48 bytes of the File Header)
00000008 - N. of Blocks: 0000936D
0000000C - Blocks Area: 0010B19A [0007C770-00187909]
00000026 - Vendor/Content:     The help info
0000003A - Version:     2.0.3.10
****************************************************
Decrypting the 0x2800 and 0x1400 blocks...
Reversing file...
XORing with 0xFF (incrementing pattern)...
XORing with 0xFF from 0x000C3C85 until 0x00187909
****************************************************
00000000 - Section Checksum: FD8543B6  [00000004-0007C76D]  CKSM OK
00000004 --- 0007C76D  ***** Unknown Section ??? *****
****************************************************
0007C770 - Removing block encapsulations from Block Area [0007C770-00187909]

Total bytes extracted (from the blocks): 000DD05D    Block area processed OK

Buffer Size: 00006DEA bytes (after converting from 16 to 8 bits)

0x00000000  DXE 0000 (Data Size: 00006DD4) [00000000-00006DE1]
Processor Type: ADSP-BF533/534/536/537/538/539 (boot address: 0xFFA00000)
Orig Offset:    Offset:         Block:  Target Add:     Byte Count:     Flags:  [  start -   end  ]
00000000 ---    0x00000000      0000    FF800040        00000004        0012    [0000000A-0000000D]  resvect ignore
0000001C ---    0x0000000E      0001    FF800000        000022B0        0002    [00000018-000022C7]  resvect
00004590 ---    0x000022C8      0002    FF8022B0        00000010        0003                         zero-fill resvect
000045A4 ---    0x000022D2      0003    FF8022C0        00000010        0002    [000022DC-000022EB]  resvect
000045D8 ---    0x000022EC      0004    FF8022D0        0000029E        0002    [000022F6-00002593]  resvect
00004B28 ---    0x00002594      0005    FF80256E        0000000E        0003                         zero-fill resvect
00004B3C ---    0x0000259E      0006    FF80257C        000009BA        0002    [000025A8-00002F61]  resvect
00005EC4 ---    0x00002F62      0007    FF802F36        000000AA        0003                         zero-fill resvect
00005ED8 ---    0x00002F6C      0008    FF802FE0        0000000C        0002    [00002F76-00002F81]  resvect
00005F04 ---    0x00002F82      0009    FF902000        00000004        0002    [00002F8C-00002F8F]  resvect
00005F20 ---    0x00002F90      000A    FF902004        00000068        0003                         zero-fill resvect
00005F34 ---    0x00002F9A      000B    FFA00000        00003E32        0002    [00002FA4-00006DD5]  resvect
0000DBAC ---    0x00006DD6      000C    FFA00000        00000002        000A    [00006DE0-00006DE1]  resvect init

0000DBC4 --- ZLIB Decompressed Size: 001FCDE4
0000DBCC --- ZLIB Compressed Block Size: 000CF489 [0000DBD4-000DD05C]
****************************************************
  File Processed OK

File ads1K40K_func_ads1102cal+20140724.up, uploaded in the last post, is a typical Hantek firmware update file (encrypted with PGP):

Code: [Select]

00000000  Symmetric-Key Encrypted Session Key Packet
00000001        Packet Length: 13
00000003        Algorithm: CAST5
00000004        S2K: Iterated and Salted
00000005        Hash Algorithm: SHA-1
00000006        Salt: 9B806DF6879F0DAC
0000000E        Count: 65536
0000000F  Symmetrically Encrypted Data Packet
00000010        Partial Data: 00002000 bytes  [00000011-00002010]
00002011        Partial Data: 00002000 bytes  [00002012-00004011]
00004012        Partial Data: 00002000 bytes  [00004013-00006012]
00006013        Partial Data: 00002000 bytes  [00006014-00008013]
00008014        Partial Data: 00002000 bytes  [00008015-0000A014]
0000A015        Partial Data: 00002000 bytes  [0000A016-0000C015]
0000C016        Partial Data: 00002000 bytes  [0000C017-0000E016]
0000E017        Partial Data: 00002000 bytes  [0000E018-00010017]
00010018        Partial Data: 00002000 bytes  [00010019-00012018]
00012019        Partial Data: 00002000 bytes  [0001201A-00014019]
0001401A        Partial Data: 00002000 bytes  [0001401B-0001601A]
0001601B        Partial Data: 00002000 bytes  [0001601C-0001801B]
0001801C        Partial Data: 00002000 bytes  [0001801D-0001A01C]
0001A01D        Partial Data: 00002000 bytes  [0001A01E-0001C01D]
0001C01E        Partial Data: 00002000 bytes  [0001C01F-0001E01E]
0001E01F        Partial Data: 00002000 bytes  [0001E020-0002001F]
00020020        Partial Data: 00002000 bytes  [00020021-00022020]
00022021        Partial Data: 00002000 bytes  [00022022-00024021]
00024022        Partial Data: 00002000 bytes  [00024023-00026022]
00026023        Partial Data: 00002000 bytes  [00026024-00028023]
00028024        Partial Data: 00002000 bytes  [00028025-0002A024]
0002A025        Partial Data: 00002000 bytes  [0002A026-0002C025]
0002C026        Partial Data: 00002000 bytes  [0002C027-0002E026]
0002E027        Partial Data: 00002000 bytes  [0002E028-00030027]
00030028        Partial Data: 00002000 bytes  [00030029-00032028]
00032029        Partial Data: 00002000 bytes  [0003202A-00034029]
0003402A        Partial Data: 00002000 bytes  [0003402B-0003602A]
0003602B        Partial Data: 00002000 bytes  [0003602C-0003802B]
0003802C        Partial Data: 00002000 bytes  [0003802D-0003A02C]
0003A02D        Partial Data: 00002000 bytes  [0003A02E-0003C02D]
0003C02E        Partial Data: 00002000 bytes  [0003C02F-0003E02E]
0003E02F        Partial Data: 00002000 bytes  [0003E030-0004002F]
00040030        Partial Data: 00002000 bytes  [00040031-00042030]
00042031        Partial Data: 00002000 bytes  [00042032-00044031]
00044032        Partial Data: 00002000 bytes  [00044033-00046032]
00046033        Partial Data: 00002000 bytes  [00046034-00048033]
00048034        Partial Data: 00002000 bytes  [00048035-0004A034]
0004A035        Partial Data: 00002000 bytes  [0004A036-0004C035]
0004C036        Partial Data: 00002000 bytes  [0004C037-0004E036]
0004E037        Partial Data: 00002000 bytes  [0004E038-00050037]
00050038        Partial Data: 00002000 bytes  [00050039-00052038]
00052039        Partial Data: 00002000 bytes  [0005203A-00054039]
0005403A        Partial Data: 00002000 bytes  [0005403B-0005603A]
0005603B        Partial Data: 00002000 bytes  [0005603C-0005803B]
0005803C        Partial Data: 00002000 bytes  [0005803D-0005A03C]
0005A03D        Partial Data: 00002000 bytes  [0005A03E-0005C03D]
0005C03E        Partial Data: 00002000 bytes  [0005C03F-0005E03E]
0005E03F        Partial Data: 00002000 bytes  [0005E040-0006003F]
00060040        Partial Data: 00002000 bytes  [00060041-00062040]
00062041        Partial Data: 00002000 bytes  [00062042-00064041]
00064042        Partial Data: 00002000 bytes  [00064043-00066042]
00066043        Partial Data: 00002000 bytes  [00066044-00068043]
00068044        Partial Data: 00002000 bytes  [00068045-0006A044]
0006A045        Partial Data: 00002000 bytes  [0006A046-0006C045]
0006C046        Partial Data: 00002000 bytes  [0006C047-0006E046]
0006E047        Partial Data: 00002000 bytes  [0006E048-00070047]
00070048        Partial Data: 00002000 bytes  [00070049-00072048]
00072049        Partial Data: 00002000 bytes  [0007204A-00074049]
0007404A        Partial Data: 00002000 bytes  [0007404B-0007604A]
0007604B        Partial Data: 00002000 bytes  [0007604C-0007804B]
0007804C        Partial Data: 00002000 bytes  [0007804D-0007A04C]
0007A04D        Partial Data: 00002000 bytes  [0007A04E-0007C04D]
0007C04E        Partial Data: 00002000 bytes  [0007C04F-0007E04E]
0007E04F        Partial Data: 00002000 bytes  [0007E050-0008004F]
00080050        Partial Data: 00002000 bytes  [00080051-00082050]
00082051        Partial Data: 00002000 bytes  [00082052-00084051]
00084052        Partial Data: 00002000 bytes  [00084053-00086052]
00086053        Partial Data: 00002000 bytes  [00086054-00088053]
00088054        Partial Data: 00002000 bytes  [00088055-0008A054]
0008A055        Partial Data: 00002000 bytes  [0008A056-0008C055]
0008C056        Partial Data: 00002000 bytes  [0008C057-0008E056]
0008E057        Partial Data: 00002000 bytes  [0008E058-00090057]
00090058        Partial Data: 00002000 bytes  [00090059-00092058]
00092059        Partial Data: 00002000 bytes  [0009205A-00094059]
0009405A        Partial Data: 00002000 bytes  [0009405B-0009605A]
0009605B        Partial Data: 00002000 bytes  [0009605C-0009805B]
0009805C        Partial Data: 00002000 bytes  [0009805D-0009A05C]
0009A05D        Partial Data: 00002000 bytes  [0009A05E-0009C05D]
0009C05E        Partial Data: 00002000 bytes  [0009C05F-0009E05E]
0009E05F        Partial Data: 00002000 bytes  [0009E060-000A005F]
000A0060        Partial Data: 00002000 bytes  [000A0061-000A2060]
000A2061        Partial Data: 00002000 bytes  [000A2062-000A4061]
000A4062        Partial Data: 00002000 bytes  [000A4063-000A6062]
000A6063        Partial Data: 00002000 bytes  [000A6064-000A8063]
000A8064        Partial Data: 00002000 bytes  [000A8065-000AA064]
000AA065        Partial Data: 00002000 bytes  [000AA066-000AC065]
000AC066        Partial Data: 00002000 bytes  [000AC067-000AE066]
000AE067        Partial Data: 00002000 bytes  [000AE068-000B0067]
000B0068        Partial Data: 00002000 bytes  [000B0069-000B2068]
000B2069        Partial Data: 00002000 bytes  [000B206A-000B4069]
000B406A        Partial Data: 00002000 bytes  [000B406B-000B606A]
000B606B        Partial Data: 00002000 bytes  [000B606C-000B806B]
000B806C        Partial Data: 00002000 bytes  [000B806D-000BA06C]
000BA06D        Partial Data: 00002000 bytes  [000BA06E-000BC06D]
000BC06E        Partial Data: 00002000 bytes  [000BC06F-000BE06E]
000BE06F        Partial Data: 00002000 bytes  [000BE070-000C006F]
000C0070        Partial Data: 00002000 bytes  [000C0071-000C2070]
000C2071        Partial Data: 00002000 bytes  [000C2072-000C4071]
000C4072        Partial Data: 00002000 bytes  [000C4073-000C6072]
000C6073        Partial Data: 00002000 bytes  [000C6074-000C8073]
000C8074        Partial Data: 00002000 bytes  [000C8075-000CA074]
000CA075        Partial Data: 00002000 bytes  [000CA076-000CC075]
000CC076        Partial Data: 00002000 bytes  [000CC077-000CE076]
000CE077        Partial Data: 00002000 bytes  [000CE078-000D0077]
000D0078        Partial Data: 00002000 bytes  [000D0079-000D2078]
000D2079        Partial Data: 00002000 bytes  [000D207A-000D4079]
000D407A        Partial Data: 00002000 bytes  [000D407B-000D607A]
000D607B        Partial Data: 00002000 bytes  [000D607C-000D807B]
000D807C        Partial Data: 00002000 bytes  [000D807D-000DA07C]
000DA07D        Partial Data: 00002000 bytes  [000DA07E-000DC07D]
000DC07E        Partial Data: 00002000 bytes  [000DC07F-000DE07E]
000DE07F        Partial Data: 00002000 bytes  [000DE080-000E007F]
000E0080        Partial Data: 00002000 bytes  [000E0081-000E2080]
000E2081        Partial Data: 00002000 bytes  [000E2082-000E4081]
000E4082        Partial Data: 00002000 bytes  [000E4083-000E6082]
000E6083        Partial Data: 00002000 bytes  [000E6084-000E8083]
000E8084        Partial Data: 00002000 bytes  [000E8085-000EA084]
000EA085        Partial Data: 00002000 bytes  [000EA086-000EC085]
000EC086        Partial Data: 00002000 bytes  [000EC087-000EE086]
000EE087        Partial Data: 00002000 bytes  [000EE088-000F0087]
000F0088        Partial Data: 00002000 bytes  [000F0089-000F2088]
000F2089        Partial Data: 00002000 bytes  [000F208A-000F4089]
000F408A        Partial Data: 00002000 bytes  [000F408B-000F608A]
000F608B        Partial Data: 00002000 bytes  [000F608C-000F808B]
000F808C        Partial Data: 00002000 bytes  [000F808D-000FA08C]
000FA08D        Partial Data: 00002000 bytes  [000FA08E-000FC08D]
000FC08E        Partial Data: 00002000 bytes  [000FC08F-000FE08E]
000FE08F        Partial Data: 00002000 bytes  [000FE090-0010008F]
00100090        Partial Data: 00002000 bytes  [00100091-00102090]
00102091        Partial Data: 00002000 bytes  [00102092-00104091]
00104092        Partial Data: 00002000 bytes  [00104093-00106092]
00106093        Partial Data: 00002000 bytes  [00106094-00108093]
00108094        Partial Data: 00002000 bytes  [00108095-0010A094]
0010A095        Partial Data: 00002000 bytes  [0010A096-0010C095]
0010C096        Partial Data: 00002000 bytes  [0010C097-0010E096]
0010E097        Partial Data: 00002000 bytes  [0010E098-00110097]
00110098        Partial Data: 00002000 bytes  [00110099-00112098]
00112099        Partial Data: 00002000 bytes  [0011209A-00114099]
0011409A        Partial Data: 00002000 bytes  [0011409B-0011609A]
0011609B        Partial Data: 00002000 bytes  [0011609C-0011809B]
0011809C        Partial Data: 00002000 bytes  [0011809D-0011A09C]
0011A09D        Partial Data: 00002000 bytes  [0011A09E-0011C09D]
0011C09E        Partial Data: 00002000 bytes  [0011C09F-0011E09E]
0011E09F        Partial Data: 00002000 bytes  [0011E0A0-0012009F]
001200A0        Partial Data: 00002000 bytes  [001200A1-001220A0]
001220A1        Partial Data: 00002000 bytes  [001220A2-001240A1]
001240A2        Partial Data: 00002000 bytes  [001240A3-001260A2]
001260A3        Partial Data: 00002000 bytes  [001260A4-001280A3]
001280A4        Partial Data: 00002000 bytes  [001280A5-0012A0A4]
0012A0A5        Partial Data: 00002000 bytes  [0012A0A6-0012C0A5]
0012C0A6        Partial Data: 00002000 bytes  [0012C0A7-0012E0A6]
0012E0A7        Partial Data: 00002000 bytes  [0012E0A8-001300A7]
001300A8        Partial Data: 00002000 bytes  [001300A9-001320A8]
001320A9        Partial Data: 00002000 bytes  [001320AA-001340A9]
001340AA        Partial Data: 00002000 bytes  [001340AB-001360AA]
001360AB        Partial Data: 00002000 bytes  [001360AC-001380AB]
001380AC        Partial Data: 00002000 bytes  [001380AD-0013A0AC]
0013A0AD        Partial Data: 00002000 bytes  [0013A0AE-0013C0AD]
0013C0AE        Partial Data: 00002000 bytes  [0013C0AF-0013E0AE]
0013E0AF        Partial Data: 00002000 bytes  [0013E0B0-001400AF]
001400B0        Partial Data: 00002000 bytes  [001400B1-001420B0]
001420B1        Partial Data: 00002000 bytes  [001420B2-001440B1]
001440B2        Partial Data: 00002000 bytes  [001440B3-001460B2]
001460B3        Partial Data: 00002000 bytes  [001460B4-001480B3]
001480B4        Partial Data: 00002000 bytes  [001480B5-0014A0B4]
0014A0B5        Partial Data: 00002000 bytes  [0014A0B6-0014C0B5]
0014C0B6        Partial Data: 00002000 bytes  [0014C0B7-0014E0B6]
0014E0B7        Partial Data: 00002000 bytes  [0014E0B8-001500B7]
001500B8        Partial Data: 00002000 bytes  [001500B9-001520B8]
001520B9        Partial Data: 00002000 bytes  [001520BA-001540B9]
001540BA        Partial Data: 00002000 bytes  [001540BB-001560BA]
001560BB        Partial Data: 00002000 bytes  [001560BC-001580BB]
001580BC        Partial Data: 00002000 bytes  [001580BD-0015A0BC]
0015A0BD        Partial Data: 00002000 bytes  [0015A0BE-0015C0BD]
0015C0BE        Partial Data: 00002000 bytes  [0015C0BF-0015E0BE]
0015E0BF        Partial Data: 00002000 bytes  [0015E0C0-001600BF]
001600C0        Partial Data: 00002000 bytes  [001600C1-001620C0]
001620C1        Partial Data: 00002000 bytes  [001620C2-001640C1]
001640C2        Partial Data: 00002000 bytes  [001640C3-001660C2]
001660C3        Partial Data: 00002000 bytes  [001660C4-001680C3]
001680C4        Partial Data: 00002000 bytes  [001680C5-0016A0C4]
0016A0C5        Partial Data: 00002000 bytes  [0016A0C6-0016C0C5]
0016C0C6        Partial Data: 00002000 bytes  [0016C0C7-0016E0C6]
0016E0C7        Partial Data: 00002000 bytes  [0016E0C8-001700C7]
001700C8        Partial Data: 00002000 bytes  [001700C9-001720C8]
001720C9        Partial Data: 00002000 bytes  [001720CA-001740C9]
001740CA        Partial Data: 00002000 bytes  [001740CB-001760CA]
001760CB        Partial Data: 00002000 bytes  [001760CC-001780CB]
001780CC        Partial Data: 00002000 bytes  [001780CD-0017A0CC]
0017A0CD        Partial Data: 00002000 bytes  [0017A0CE-0017C0CD]
0017C0CE        Partial Data: 00002000 bytes  [0017C0CF-0017E0CE]
0017E0CF        Partial Data: 00002000 bytes  [0017E0D0-001800CF]
001800D0        Partial Data: 00002000 bytes  [001800D1-001820D0]
001820D1        Partial Data: 00002000 bytes  [001820D2-001840D1]
001840D2        Partial Data: 00002000 bytes  [001840D3-001860D2]
001860D3        Partial Data: 00002000 bytes  [001860D4-001880D3]
001880D4        Partial Data: 00002000 bytes  [001880D5-0018A0D4]
0018A0D5        Partial Data: 00002000 bytes  [0018A0D6-0018C0D5]
0018C0D6        Partial Data: 00002000 bytes  [0018C0D7-0018E0D6]
0018E0D7        Partial Data: 00002000 bytes  [0018E0D8-001900D7]
001900D8        Partial Data: 00002000 bytes  [001900D9-001920D8]
001920D9        Partial Data: 00002000 bytes  [001920DA-001940D9]
001940DA        Partial Data: 00002000 bytes  [001940DB-001960DA]
001960DB        Partial Data: 00002000 bytes  [001960DC-001980DB]
001980DC        Partial Data: 00002000 bytes  [001980DD-0019A0DC]
0019A0DD        Partial Data: 00002000 bytes  [0019A0DE-0019C0DD]
0019C0DE        Partial Data: 00002000 bytes  [0019C0DF-0019E0DE]
0019E0DF        Partial Data: 00002000 bytes  [0019E0E0-001A00DF]
001A00E0        Partial Data: 00002000 bytes  [001A00E1-001A20E0]
001A20E1        Partial Data: 00002000 bytes  [001A20E2-001A40E1]
001A40E2        Partial Data: 00002000 bytes  [001A40E3-001A60E2]
001A60E3        Partial Data: 00002000 bytes  [001A60E4-001A80E3]
001A80E4        Partial Data: 00002000 bytes  [001A80E5-001AA0E4]
001AA0E5        Partial Data: 00002000 bytes  [001AA0E6-001AC0E5]
001AC0E6        Partial Data: 00002000 bytes  [001AC0E7-001AE0E6]
001AE0E7        Partial Data: 00002000 bytes  [001AE0E8-001B00E7]
001B00E8        Partial Data: 00002000 bytes  [001B00E9-001B20E8]
001B20E9        Partial Data: 00002000 bytes  [001B20EA-001B40E9]
001B40EA        Partial Data: 00002000 bytes  [001B40EB-001B60EA]
001B60EB        Partial Data: 00002000 bytes  [001B60EC-001B80EB]
001B80EC        Partial Data: 00002000 bytes  [001B80ED-001BA0EC]
001BA0ED        Partial Data: 00002000 bytes  [001BA0EE-001BC0ED]
001BC0EE        Partial Data: 00002000 bytes  [001BC0EF-001BE0EE]
001BE0EF        Partial Data: 00002000 bytes  [001BE0F0-001C00EF]
001C00F0        Partial Data: 00002000 bytes  [001C00F1-001C20F0]
001C20F1        Partial Data: 00002000 bytes  [001C20F2-001C40F1]
001C40F2        Partial Data: 00002000 bytes  [001C40F3-001C60F2]
001C60F3        Partial Data: 00002000 bytes  [001C60F4-001C80F3]
001C80F4        Partial Data: 00002000 bytes  [001C80F5-001CA0F4]
001CA0F5        Partial Data: 00002000 bytes  [001CA0F6-001CC0F5]
001CC0F6        Partial Data: 00002000 bytes  [001CC0F7-001CE0F6]
001CE0F7        Partial Data: 00002000 bytes  [001CE0F8-001D00F7]
001D00F8        Partial Data: 00002000 bytes  [001D00F9-001D20F8]
001D20F9        Partial Data: 00002000 bytes  [001D20FA-001D40F9]
001D40FA        Partial Data: 00002000 bytes  [001D40FB-001D60FA]
001D60FB        Partial Data: 00002000 bytes  [001D60FC-001D80FB]
001D80FC        Partial Data: 00002000 bytes  [001D80FD-001DA0FC]
001DA0FD        Partial Data: 00002000 bytes  [001DA0FE-001DC0FD]
001DC0FE        Partial Data: 00002000 bytes  [001DC0FF-001DE0FE]
001DE0FF        Partial Data: 00002000 bytes  [001DE100-001E00FF]
001E0100        Partial Data: 00002000 bytes  [001E0101-001E2100]
001E2101        Partial Data: 00002000 bytes  [001E2102-001E4101]
001E4102        Partial Data: 00002000 bytes  [001E4103-001E6102]
001E6103        Partial Data: 00002000 bytes  [001E6104-001E8103]
001E8104        Partial Data: 00002000 bytes  [001E8105-001EA104]
001EA105        Partial Data: 00002000 bytes  [001EA106-001EC105]
001EC106        Partial Data: 00002000 bytes  [001EC107-001EE106]
001EE107        Partial Data: 00002000 bytes  [001EE108-001F0107]
001F0108        Partial Data: 00002000 bytes  [001F0109-001F2108]
001F2109        Partial Data: 00002000 bytes  [001F210A-001F4109]
001F410A        Partial Data: 00002000 bytes  [001F410B-001F610A]
001F610B        Partial Data: 00002000 bytes  [001F610C-001F810B]
001F810C        Partial Data: 00002000 bytes  [001F810D-001FA10C]
001FA10D        Partial Data: 00002000 bytes  [001FA10E-001FC10D]
001FC10E        Partial Data: 00002000 bytes  [001FC10F-001FE10E]
001FE10F        Partial Data: 00001000 bytes  [001FE110-001FF10F]
001FF110        Partial Data: 00000800 bytes  [001FF111-001FF910]
001FF912        Partial Data: 00000140 bytes  [001FF913-001FFA52]
    File processed OK


[tv84]

Attached are the decompressed blackfin sections of both these fw:

SDS1000CNL_SSP_V100R005B01D02P13.ADS
SDS1000CML_SSP_V100R005B01D02P32.ADS

In the 2nd file is visible the following strings:

LeCroy Digital Oscilloscopes
Siglent Digital Oscilloscopes
ATTEN Digital Oscilloscopes
BK Digital Oscilloscopes
AKIP Digital Oscilloscopes
AKTAKOM Digital Oscilloscopes
KD Digital Oscilloscopes

[darist]

In my latest communication with ATTEN they told me that the ADS1102CAL+ oscilloscope type is no longer supported, so they have no firmware update later than 1.90.0(140724.0). However, HANTEK does have a new firmware (dso5kp_func_dso5102p20170318.up) for the DSO5102P model, which as I understand shares the same h/w with my ADS1102CAL+.

In the past I tried to update using the HANTEK firmware without success. The sizes of ATTEN and HANTEK firmware files are quite different (~2K and ~1.5K  respectively). Maybe I need to encrypt the HANTEK firmware using PGP before using it on ATTEN, as tv84 suggests? Can anybody please provide some info how to do this?

The final question is: can I use the HANTEK DSO5102P firmware in my ATTEN ADS1102CAL+ oscilloscope?

[tv84]

Maybe you can decrypt/decompress the Hantek fw and see if you recognize anything inside.

Use in linux:

gpg  --passphrase dso5000p dso5kp_func_dso5102p20170318.up > dso5kp_func_dso5102p20170318.tar.gz

[darist]

Thank you for the answer.

I decrypted the file as you suggested (attached) but I'm not quite sure what to look for. I also don't know how to re-encrypt the package in a format that my oscilloscope can load. I'm willing to give it a try but I need some instructions (or links) how to do it. Maybe other people can also benefit from this, as HANTEK frequently updates the firmware/drivers/software for their models, whereas ATTEN has completely abandoned them.

P.S. In case of firmware update failure, is there a (relatively) easy way of restoring the original firmware?

[tv84]

Darist,

I would guess that you need to know the atten pgp password, that they use in the fw you flashed.

I've been unable to find it in the web so the best option would be for you to retrieve it from your scope. I think that the decrypting script could still be present and you could read the password directly from the script. Look at hantek example.

Are you able to get to the linux prompt of your scope?

Without decrypting the fw that you currently have flashed, I would not try to flash anything else because of the risk involved.

If you can get me dumps of your scope, then I can help.

[darist]

No, I haven't tried to get a linux prompt yet, as in my understanding this requires to open up the scope and connect some pin headers (GND, TXD, RXD) to the PC USB port via a  CP2102 USB-to-serial TTL adapter. Is there any other way by just using the USB port of the oscilloscope?

You are right, I will not try to flash anything just yet. I will try to get a full backup of my scope using the guide below:
https://marcowuen.wordpress.com/2013/09/01/dso-hacking-quick-guide-voltcraft-dso3062c-hantek-dso5062b-tekway-dst1062b/
I haven't been able to find any guide specialized for atten, so this will be my best shot. However, I suspect that the "dst1kb_b_backup_tool.up" script has been compressed using the HANKEK passphrase, so in this case I'm back to zero. The other idea I have is to try to brute-force the pgp passphrase from my latest firmware. Do I really need a linux prompt in case of firmware update failure? If so, I will try to do it.

I will let you know of the results when I have something.

[tv84]

Is there any other way by just using the USB port of the oscilloscope?

You must open it.

I will try to get a full backup of my scope using the guide below:

If you are able to run that fw that would be a progress. Cracking the pgp is near impossible...

I guess that fw is surely encrypted with one of the Hantek passwords (I'm away from PC so can't test it) but your scope may be able to decrypt it (or not...).

In case your scope can't decryot that fw, I think there won't be any major consequences from trying.

[darist]

I finally found some time to open my oscilloscope, connect to the UART (connector 901) with a USB-TTL adapter and get access to the linux command line. After getting a full backup, I tried to manually perform a firmware update, using the latest unencrypted firmware for Hantek DSO5102P (which supposedly shares the same h/w with my ATTEN). The update completed successfully, so when I restarted the scope I could see the new firmware version in the system information window (see attached).

However, when testing the new firmware I noticed the following problems:
* Some scope keys did not respond correctly. Ex. when I pressed the "Measure" button the "CH1" menu opened instead.
* Self calibration failed with an error code 0x802

For the above reasons I rolledback to the original firmware from ATTEN (again with the linux command line). My best guess is that my scope model is very close to the corresponding Hantek model, but with minor differences. If someone has an idea how to correct the errors listed above I can retry to use the Hantek firmware.

BTW, I managed to extract the gpg passphrase for my scope model, which is "ads1000_40k". This was hard-copied in the dso.exe file, so I used a hex editor to extract it. I have kept full backup of the NAND memory and the complete filesystem, so anyone who wants anything can PM me.

[tv84]

BTW, I managed to extract the gpg passphrase for my scope model, which is "ads1000_40k". This was hard-copied in the dso.exe file, so I used a hex editor to extract it. I have kept full backup of the NAND memory and the complete filesystem, so anyone who wants anything can PM me.

So, the mistery is finally solved! And the password of the famous Atten ads1K40K_func_ads1102cal+20140724.up firmware (v1.90.0) is "ads1000_40k"!!

Great job!

All this time it was also in the name of the file...     Security by "non-obscurity"!!