when you like this hack scroll up and give me 5 stars
The topic is about how to hack another one Chinese DSO (Tekway/Hantek) up to 200MHz bandwidth.-
why TekwayAs my private Tek TDS754D dies some time ago i had to find a replacement.
I ordered few cheap known china DSOs - UNI-T (UT2102CE), Rigol (DS1102E) , Atten (ADS1102CE) and finally Tekway (DST1102B)
and tested them detailed. Finally decided to take the Tekway DST1102B, it was the best combination of quality/performance/price.
The device itself, compared to Rigol DS1102E, is in my opinion a "bit" better :
- 7" 800 x 480 pix display
- "real" 100Mhz ADCs (yes, exact the same AD9288 but 100MHz rated)
- 2500 wfrms/s (Rigol E 800 wfrms/s)
- Screen refresh 30/40/50 frames/sec (Rigol ?)
- DPO-like functionality (waveform persistent for 0.2sec-> 8.0sec)
- dedicated good known application SOC and Linux OS
EDIT : As few users asked why not UNI-T or ATTEN:
- UNI-T UT2102CE is a piece of crap (i got blind with this cheap LCD, 25k sample memory only)
- ATTEN ADS1102CE nice sample rate but 18k sample memory.
Today i would probably test UT2102CEL or ATTEN ADS1102CML (inistead of C/CE models), but honestly UNI-T did changed display (but still same crap sample memory), but they cheating with resolution. Each "visible" pixel is combination of 4 display pixels, so you have 400x240 and not 800x480 resolution. Additionaly the ADCs used in UNI-T are cheap once from no-name manufacturer.
ATTEN ADS1102CML is for sure better than the one i tested, internaly looks like Rigol E,
but it does have only 480x234 pix resoltion so still no compare to HanTekway.-
what inside Tekway DST1xxxB4 x AD9288 ADCs (yes, for 1GSs overclocked to 125MHz in 8ns, 4ns and 2ns time base - like Instek GDS1102A)
2 x AD8370 amps (750MHz bw - input stage like Rigol)
2 x LMH6552 amps (1.5GHz bw - input stage like Rigol)
ADCMP562 ECL comparator (for trigger)
Altera Cyclone III FPGA (ADC sampling control and data acquisition)
Altera Max II CPLD (long/short memory management - copy protected)
Samsung S3C2440 (user i/o, UI interface, TFT control)
EEPROM with s/n
some NAND, SRAM and SDRAM memory and of course bunch of other things (no cheap parts which is good)
The Samsung S3C2440 is well known ARM SOC, (just google for mini2440 or friendlyarm).
On OS level there is Linux 2.6.13 running, so many nice hacks/tricks possible - e.g. you can test your hacks of the
Tekway DSO firmware on your mini2440 with 7" screen connected.
-
The hackThere are two ways:
- pre-hacked firmware - not working since fw 2.6.x
- via
JTAG/UART
pre-hacked firmwareYou will have FIRST to update the firmware to 2.05 (http://www.tekwayins.net/pic/dst1kb_2.05.0_cli(100317.0).up)
If you don't know how to use JTAG/UART just use the attached firmware (fw-hack.zip). There are 3 directories inside:
-Dst1062b (use this if you wish to downgrade to 60MHz)
-Dst1102b (use this if you wish to downgrade/upgrade to 100MHz)
-Dst1202b (use this if you wish to upgrade to 200MHz)
copy the specific firmware file *.up to USB stick and upgrade/downgrade your device like with Tekway original firmware.
After reboot the DSO will be already hacked to whatever you choose.
For prehacked firmware check this posting (I did updated all):http://www.eevblog.com/forum/index.php?topic=1571.msg24564#msg24564Hack via JTAG/UARTIf you have ARM JTAG or wish to play/do more with the firmware i recommend to make a backup of the original firmware!
Tekway/Hantek is using custom vivi bootloader, so you will have first to replace it by a bootloader which supports USB firmware backup/restore.
I'm working with H-JTAG wiggler and H-Flasher, however you can use whatever tools you like, j-link or arm open ocd are good as well.
1. Connect your PC to DSO ARM JTAG port (attached picture)
2. make a copy of your bootloader (first 128k of the NAND memory), if you miss this step i attached my copy (vivi.bin)
3. flash attached supervivi.bin. It is special version which matches the NAND partitions. Don't flash any other versions if you don't know what NAND partitions are good for.
4. connect your PC to the DSO UART0 (attached picture) and run your fav. terminal emulation. Settings are 115200 8n1.
5. restart the DSO while hiting a key in your terminal emulation window - to stop the bootloader.
6. run the supervivi menu (type menu)
7. connect your PC via USB to the DSO and run dnw.exe on your PC. You will need device driver, I’m not attaching them, just google for "dnw.exe usb driver friendlyarm"
8. chose backup "Backup NAND Flash to HOST through USB(upload)" from supervivi menu and "USB Port -> Backup NandFlash to file" from dnw.exe menu.
9. after the backup is ready restore the original bootloader (vivi.bin) - this step is optional but recommended,
the device works good with supervivi.bin however you never know what customized inside the original bootloader.This seems to be too "high" for most users, use the fw3dump tool to dump fw via USBhttp://www.eevblog.com/forum/index.php?topic=1571.msg35683#msg35683Why do a backup when factory calibration is known?Here another one reason:
http://www.eevblog.com/forum/index.php?topic=1571.msg62941#msg62941Once you ready with the backup you can disconnect JTAG / USB from the DSO and reboot it. As soon the Linux started you should be able to terminate the DSO UI application (ctrl+c) in your fav. terminal app to get the linux shell.After you made a fw backup with the fw3dump tool connect your PC to the DSO UART0 (attached picture)
and run terminal emulation (e.g. putty or hyperterm). Settings are 115200 8n1.
Important - the DSO UART is not RS232, so use something like USB UART converter, just ebay for it, CP2102 or FT232 based
converters are what you looking for.
To hack the device, you will have to do few things in the linux shell (here for DST1102B device,
similar for other Tekway/Hantek models)
mv dst1102b dst1202b
vi /sys.inf
vi /tmpdst
vi /logotype
vi /logotype.dis (only for fw 2.6.xx and higher)
and replace all DST1102B by DST1202B
In principle if you only do mv xxxxxx xxxxxxx and reboot twice your DSO, everything else will get updated automatically,
but i think it is better to change manually - just in case somethign will get changed in the future in the firmware.
That's all, after a reboot your DSO will startup as DST1202B and the 200MHz will be enabled.
-
Where to get Tekway
in NA afaik only www.electrolab.com
in EU (germany) afaik only www.pinsonne-elektronik.de
or of course ebay/taobao and so on.
There are some rumors about Tekway/Hantek, some ppl mentioned Hantek bought Tekway, some other said "no, Tekway is producing for Hantek".
In principle it didn't really matter, the fact is Hantek have two new DSO series and they are 100% Tekway inside
If you buy from china:
Hantek DSO5202M = Tekway DST1202B = Protek 3210
Hantek DSO5102M = Tekway DST1102B = Protek 3110
Hantek DSO5062M = Tekway DST1062B
If you buy from Hantek distributor:
Hantek DSO5202B = Tekway DST1202B = Protek 3210
Hantek DSO5102B = Tekway DST1102B = Protek 3110
Hantek DSO5062B = Tekway DST1062B
No clue why Hantek is using different model names for Chinese and international market, but i assume the Chinese versions will have NO English UI.
If you get such device please let me know, there is a way to "enable English" ... but that's a different topic.
There is another Hantek series (N or C), they "100% Tekway inside" too but not the DST1xxxB familiy !
Hantek DSO5102N, DSO5102C = Tekway DST4102B = Protek 3010
Hantek DSO5062N, DSO5062C = Tekway DST4062B = Protek 3006
These devices are only 500MSs, you can of course use the JTAG/UART to hack DST4062B to DST4102B but that's all.
The PCB is a bit different, so you can't just use the attached DST1xxxB firmware to "update" the DSO, so don't try!ups ... today we know that there are no 500MSs models, they actually 1GSs with different logo,
see here:
http://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg93384/#msg93384The Tekway DST3xxxB familiy is even slower, not recommended anyway (250MSs), so don't buy it
For now you can get the Hantek devices on ebay or
www.goodluckbuy.com,
i asked some Hantek distributors but they have no stock for now.
-
what else? The Tekway DSO is very hack-friendly. As already mentioned it is using the Samsung S3C2440.
There is for example touch screen connector on the PCB, you will have to buy a touch (the LCD is AT070TN83 V1).
The firmware itself is currently not supporting touch, but it is Linux, so you can develop own GUI to e.g. choose between
DSO and whatever ... lol, don't android. You have to use 2.6.13 just because of the precompiled modules.
Another one possible hack is Ethernet card. There is I/O port, Tekway even already precompiled cs8900 module. All what we need
is the pinout. I already reversed all Address/Data pins, only few control pins still open.
All the JTAG ports on the PCB have standard pinout. UART port have TTL level, you will have to use RS232 or USB converter.
I have made tons of PCB pictures, just in case something broken. let me know if you need them.
-
final note The 200MHz hacked device is working since months without any issues.
I posted a small notice in another forum some time ago so there are already other ppl using the hack.
I can't guarantee that your device will not get damaged if you use the pre-hacked firmware, i tested it on two DSOs multiple times
with no issues. After all these "tests" i decided to make it public.
If you have any questions, pls let me know before you damage something.
happy hacking
tinman
:OTHER UPDATES: Firmware backup tool (for Tekway DST1xxxB, Hantek DSO5xxxB, Voltcraft DSO 3062C and DSO1062D, some PCE models)http://www.eevblog.com/forum/index.php?topic=1571.msg35683#msg35683200Mhz not enough ? Take a look here, and with proper active probes get 250Mhz (or up to 400Mhz with some attenutation)http://www.eevblog.com/forum/index.php?topic=1571.msg45275#msg45275http://www.eevblog.com/forum/index.php?topic=1571.msg45649#msg45649You don't like the hot PSU ? Check here how to reduce the heat and reduce riple/noice for ADC supplyhttp://www.eevblog.com/forum/index.php?topic=1571.msg42363#msg42363You need russian menu ? Look herehttp://www.eevblog.com/forum/index.php?topic=1571.msg39434#msg39434You wish to have Ethernet (10mbit) adapter for your Hantek/Tekway? Look here
(only for models produced before 1st April 2011 - green main PCB, not blue!)http://www.eevblog.com/forum/index.php?topic=1571.msg40447#msg40447You bought Tekway from China and need English fron panel sticker? ask "Pioneer Huang" from Aliexpress
If you wish to buy Tekway a bit cheaper from China - with English fron panel sticker, look this shop http://www.aliexpress.com/fm-store/707178If you wish to see what inside firmware or build your own look here how to crypt/decrypthttp://www.eevblog.com/forum/index.php?topic=1571.msg23984#msg23984You destroyed factory calibration or you wish to run it after hardware modifications ? http://www.eevblog.com/forum/index.php?topic=1571.msg50043#msg50043and here
http://www.eevblog.com/forum/index.php?topic=1571.msg62991#msg62991If you need to repair or learn how your DSO works, look here for full schematics (hw 1.0.2 / hw 1.0.3)http://www.eevblog.com/forum/index.php?topic=1571.msg56754#msg56754[/url]
you looking for latest firmware versions for your Hantek/Tekway, look herehttp://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg128527/#msg128527you think a pimped up firmware is good for you, look hereehm, always the latest will be pimped up if possible ... so link removed.
However some older fw versions are still available in the thread. I will create later
website wit all historical versions .. just in case someone need it.
you wish to downgrade your firmware to 2.06.3 110531.1 for whatever reason? Look herehttp://www.eevblog.com/forum/index.php?topic=1571.msg63001#msg63001you wish to know (once again and more detailed) how the firmware update process works internaly? Look herehttp://www.eevblog.com/forum/index.php?topic=1571.msg70890#msg70890you wish to restore your firmware backup (made with the backup tools from this thread), look herehttp://www.eevblog.com/forum/index.php?topic=1571.msg75015#msg75015you wish to learn how to remote control DSO with own software or even hack over hidden USB/LAN protocol, look herehttp://www.eevblog.com/forum/index.php?topic=1571.msg79128#msg79128you wish to use USB LAN stick, look here for hack and DSO device drivershttp://www.eevblog.com/forum/index.php?topic=1571.msg83370#msg83370you wish to populate missing parts around RJ45 jack to use it as UART? check thishttp://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg95759/#msg95759your DSO crashed and now after power up is not responding to any key? Check thishttp://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg93999/#msg93999how to hack licensing informations in EEPROM to enable featureshttp://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg108309/#msg108309if you bought Hantek handheld DST1xxxxB/BV/S and wish to know more about them look herehttp://www.eevblog.com/forum/index.php?topic=1571.msg86367#msg86367Firmware backup tool for Hantek Handheld DST1xxxxB/BV/S modelshttp://www.eevblog.com/forum/index.php?topic=1571.msg86825#msg86825Firmware backup tool for Hantek DSO5xxxxBM/BMV modelshttp://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg111917/#msg111917
if you bought Voltcraft 500MSs 60MHz DSO3062C you luck girl/guy! these scopes are in reality 1GSs and can be
of course hacked to 200MHz bandwidth as well!!! Look here for funny story:
http://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg93384/#msg93384
if you wish to change the bootlogo or icons in the status bar and don't know how to convert these
"ico" files to soething known, then look here:http://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg101338/#msg101338http://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg101352/#msg101352If you wish to develop own Capture/remote control software, LabView or MATLab drivers look here for details
how to control these DSOs :http://www.mikrocontroller.net/articles/Hantek_Protokollan english verion here:http://elinux.org/Das_Oszi_ProtocolIf you wish to access your DSO over LAN (etc WLAN USB Adapter, integrated LAN, integrated WLAN) and you don't want to wait
the next 5 years before Hantek/Tekway implements LAN into firmware then check this:http://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg147256/#msg147256The GPL sources (for all kind of models based on DSO2.0 platfrom) are here:http://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg110134/#msg110134There is also a good tool written based on the "SDK" to communicate
(Remote control, show live waveforms, make screenshots, export data, change hidden function
and so on) on these DSOs. Supported OS - Linux, Windows and MacOSX !!!http://peter.dreisiebner.at/dso-usb-toolBELOW ATTACHED BUG LIST(S), I WILL UPDATE IT FROM TIME TO TIME
Home
Help
Search
Login
Register
