Hantek - Tekway - DSO hack - get 200MHz bw for free

[tinhead]

I inadvertently flashed the wrong BIOS to my DSO5062. I loaded the MSO BIOS by error (dst1kb_2.7.1_15202d_fact130826.0.up).
...
I am honestly confused by all the information I found here about doing a restore, so I am asking (politely) for help in restoring the unit - using the best method - so I do not make things worse.

now honestly, how can one flash MSO firmware to an DSO, and then MSO firmware that need DIFFERENT password than the DSO firmware is using? Post your SN first, then we will see what can be done

[condor]

Sorry i was not clear. Using a memory stick I flashed (dst1kb_2.7.1_15202d_fact130826.0.up) over the existing (dst1kb_2.06.3_15202b_fact(130814.0). At this point I am surprised the DSO accepted it because I thought there was protection. There were no messages. I have done nothing to the scope since since then. The on-screen keys do not show labels and do not seem to function. The unit boots and is alive, I was able to communicate via the USB Tool and get the 256 Byte memory dump.

SN: T 1G/012 005242
Main board SN: T1205242

Thanks

[tinhead]

Sorry i was not clear.

oh yes, you was.

I tell you something, your DSO is hw1007, with max. firmware 2.x, and not 3.x as you said. So that here is wrong

>> The correct BIOS from Hantek looks to be "dso5kb_func_dso5202b20140111.up"

and this corrent:

>> but I also have "dst1kb_2.06.3_15202b_fact(130814.0).up"

The DSO 3.x fw is using "dso5000b" as password, the DSO 2.x fw "0571tekway".

Anyway, MSO - and that means 2.x and 3.x fw - is using "0571tekway" as well. But on Hantek (and as wel Voltcraft website) there are information WHAT fw can be uised on WHAT hardware (talking about MSO). And of course there is absolutely no reason to use MSO firmware on DSO (one can do this only when knowing what to do first, but even then, without mso hardware there is no benefot of using the MSO firmware on DSO. Actually the DSO firmware is better, sure no MSO functionaliuty but DSO is stable).

nothing to the scope since since then.

sure, this is because MSO is using differnet libs, drivers, root fs and kernel. So once installed the dso.exe (from MSO formware) will crash, and even worse, the atchdog (dsod process) might reboot your DSO over and over again (until you kill it).

I need some help! 

oh well, you do. So let's take a look on what the fw update did to your DSO. The "update" script looks like:

[cmd] mv /tmp/tekwayup_client/lcd.ko /dso/driver/

- so you need lcd.ko from an DSO

[cmd] rm /protocol.inf
[cmd] mv /tmp/tekwayup_client/protocol.inf /protocol.inf

- and protocol.inf

[cmd] mv /tmp/tekwayup_client/rcS /etc/init.d/rcS
[cmd] chmod 777 /etc/init.d/rcS

- and rcS

[cmd] mv /tmp/tekwayup_client/dso.exe   /dso.exe

- the dso.exe as well

[cmd] mv /tmp/tekwayup_client/dsod   /dso/app/dsod

- the watchdog executable

[cmd] rm /help.db
[cmd] mv /tmp/tekwayup_client/help.db /

- help files from DSO

[cmd] rm /OurLanguages/*
[cmd] mv /tmp/tekwayup_client/*.lan /OurLanguages/

- language files

[cmd] mv /tmp/tekwayup_client/icon/* /icon/

- and maybe even icons, but normally not.

Now let's take a look what of these files is included in e.g. DSO fw dst1kb_2.06.3_15202b_fact(130814.0):

rcS
dso.exe
dsod
protocol.inf
help.db

and finally folder "OurLangauges" are all withinn that update file. The lcd.ko is missing, but when you look inside rcS you will find out that the lcd.ko is not in use on DSO, but only MSO. So you can ignore it. That said all you have to do is do decrypt/untar/untar/unzip the dst1kb_2.06.3_15202b_fact(130814.0).up file, copy all these files to usb flash drive, insert it into your DSO, connect via UART (yes, you need physical connection here, and of course converter etc. UART<->USB) and then first kill the "dsod" and copy/overwirte all the MSO files with DSO version again. And then finally you have to change permission in root directory to +x, something like "chmod 777 *" is for sure ok. T

That's all .. almost. Now you have to replace the /param/sav/r* file and reboot DSO. Now your DSO should work again.

[condor]

Thank you Tinhead. I will follow your advise and report back. Your instructions seem clear but then again I am an idiot. Yes, I understand the 2.xx issue now..

[tinhead]

oh well, shit happens. It is good that these DSO/MSO are linux-loaded and more or less easy to fix.

[condor]

Tinhead:
Good news I was able to accomplish the steps you suggested using dst1kb_2.7.1_15202d_fact130826.0
Bad news: Stuck at Logo Screen dso does not start but Linux shell is live and well. Boot message: /etc/init.d/rcS: line:60 /dso.exe not found. But dso.exe is sitting there in / (?)

[tinhead]

when you copied that proper version from the update to / then do as well

chmod 777 *

when in / dir. You can then check with

cd /
/dso.exe

if the fw is running.

[condor]

So Tinhead, impatient me messed up further.
First, as far as I know I had executed" chmod 777 *" in root before sending the prior message.

Before receiving your last message however, my bright idea was to replace /etc/init.d/rcS with a fresh copy of rcS from my extracted archive. Bad idea. Now I have a loop that repeats "can't open /dev/ttyS0: No such file or directory" forever. I am unable to break the operation with any terminal program I have tried. I have attached the boot log.

This is a big mess and I am sad.

[tinhead]

This is a big mess and I am sad.

right, it looks like you have now rc from MSO again, error like e.g.:

  /etc/init.d/rcS: line 41: /sendspi-la: not found

are confirmation of that (as sendspi-la is only on MSO). Wondering only why you copied version from MSO (ahh i see, you haven't read my post and thought "if already mso files copied why not copy rcS as well").

Can you still open console? i doubt no :\ If yes, try to copy /etc/init.d/rcS~ to /etc/init.d/rcS

Not sure if there is a way to tell supervivi to not load rcS, or if linux 2.6.13 can do this (in principle there should be the old file still there ( /etc/init.d/rcS~ ), which maybe can be loaded with different bootloader params). Maybe you will have to use different bootloader to do this. But if not, then you can only re-flash the whole NAND (and you have made backups before hack .. right?).

[condor]

What I see in the terminal session is, like the log shows:
"can't open /dev/ttyS0: No such file or directory" repeated over and over. I do not know how to stop the process loop or halt the boot before this happens (ignores ^c and kill). But the terminal session is happy as can be, but the DSO seems to not respond to my sent messages or even eventually timing out, as I would hope.
As for backups - maybe, but I have a bad feeling.

Time for deep thoughts.

[rosasharn]

Hantek seems to be more and more weird ... the MSO5074F(G) is gone from product page, there is MSO5054F(G) instead. There are no 2M point in the specs anymore but 1M (ok, at leat this has been fixed). The bandwidth is now specified as 40MHz (where one could think xx5x means 50MHz, hmm) instead of 70MHz. On chinese website there are still 5074F(G) listed, and of couse one can still buy them (but no sign of MSO5054F(G)). On OneDrive there is as well only MSO5054F(G) stuff, no sign of MSO5074F(G). This is all already weird, but check that : in the user manual, from MSO5054FG, there is picture showing MSO5054FG but with "70MHz / 1GSs" sticker on it. And now? What bw/numbering is real and what PS-made?

Does it mean Hantek implements sales policy that sell different models for different markets? i.e. for oversea, MSO5054F(G); for China, MSO5074F(G).

[rosasharn]

Another thing - they specified 4k <-> 1M as Logoc Anayzer Depth. So exact the same as on MSO5000D. However, due firmware bug there is always only 4k available on MSO5000D. Since 1.5yrs ... My question is - how is that working on MSO50x4F(G) ?

When only open logic Analyer, its max. depth can achieve 1M.
See the attached picture.

[benjamin545]

the hantek MSO5074FG is down to about $500 USD on aliexpress. its really tempting since this is a ton of features for the price it seems. i do see the MSO5084BLG on there too and i know ive asked before what the differences are, but its like $400-$500 more, and im not too sure how if you would feel much difference between the two. would its double sample rate make much difference when using it? i recognize that the 5074 line probably has a 200mhz hackable bandwidth like other similar products by hantek have, and the 5084 lie shows a possible 300mhz, but does that justify the extra almost double price? the logic analyzer portion doubles the speed between the two, i could see how thats worth it i guess. don't really know if i would ever find that a barrier.

im not really all that experienced with oscilloscopes, when im looking at these, im not looking at them as if i have some specific need for certain specs, im looking at the price and finding it affordable, and when comparing all the features on the box for these models against other models out there, it seems you can get very basic scopes for about $300 but all you get is 2 analog channels, so obviously for the extra $200 you seem to get your money's worth with the 4 analog channels, 8 logic channels, and function generator. and similar offerings at the $500 mark from other manufacturers seem to not give anywhere near the features these hantek models have, they mostly are just basic 2 channel scopes, just a little bit better build quality than the hantek 2 channel models. so if trying to get the most for your money while still staying within a small budget like what a home hobbyist would have, it really looks like the MSO5074FG is a no brainer choice in the matter. i guess ultimately what my question is, am i missing out on any worthwhile feature that the MSO5084BLG has if i just get the MSO5074FG? does having 500M/s logic channels shut the door on anything that the 1g/s logic channels would give you? is there something that 300mgz will give you that 200mhz wont? the function gen between the two is the same, and the 5074 actually has 1M sample depth in its favor vs the 32k of the 5084BLG, if that really makes much difference.

[rosasharn]

Where to buy MSO5084BLG?

[benjamin545]

http://www.aliexpress.com/item/H099-Hantek-MSO7084BLG-4-Channel-Oscilloscope-8-Channel-Logic-Analyzer-25MHz-Arb-Waveform-Generator-2Gsa-s/1857299072.html

aliexpress

[rosasharn]

Ahh, it's DSO7084BLG.
Thank you for the link!

After checking the specification, it seems the main difference is MSO5074FG sampling rate 1GSa/s, memory depth 1M, and DSO7084BLG sampling rate 2GSa/s, memory depth 32k.
If it doesn't matter for you, I think MSO5074FG seemed the better deal.

[AE9K]

Firmware upgrade difficulties with a Hantek DSO5202B

I have a DSO5202B (hw ver 0x555583e8, fw ver 2.06.3(110225.0)) and am at wits end trying to upgrade firmware.  I get 0xf7, 0xfb and 0xfe errors depending on what firmware file I'm using and what I rename the file to.

I worked with Hantek support in China last year and got nowhere.  After we tried a bunch of non-firmware .up files that logged diagnostic data to the USB drive, they couldn't get any version to work and told me to return the scope to the factory.

Using info on this lengthy thread I was able to gpg decrypt, un-tar, un-gzip, etc. to get to the files that comprise the dst1kb_2.06.3__130814.1_.up firmware update.  The size is 7.7 MB.  When doing a 'df' on the scope, I have 7.7 MB free on the root filesystem.  Last year it was 9.5 MB so maybe free space wasn't the issue then but it's certainly suspect now. 

My thought was to move the /help.db file which is 1.3 MB to USB (/mnt) or /tmp, attempt the upgrade and put the help.db file back (if it fits).  I'm using the shell within DSO-USB-Tool via libusb0 as I don't have a JTAG or similar connection.  That shell won't allow me to do a "mv  help.db  /mnt" possibly because the file's in use but that shell is pretty limited so who knows why.

• What's the best way to free up space on the root filesystem?
  
  
• Can I plant the firmware 'tekwayup_client' directory and 'upend' file on the scope's tmp filesystem and run it from there?  If so, how does one launch the upgrade script once these are in place?
  
  
• Can this be done via the shell in DSO-USB-Tool or do I need a JTAG type connection or do I just need to terminate the dso process to allow the files to be moved around?
  
  
• What's the latest firmware supported by my 0x555583e8 hardware?  The file currently available for this model on the Hantek site (dso5kb_func_dso5202b20140111.up) doesn't gpg decrypt with the 0571tekway passphrase.
  

Thanks,

Dan
AE9K 
 

[astraios]

@AE9K

You have an old hardware version scope (hw0).
The firmware on Hantek site is only for newer hardware versions, it's not compatible with your scope.
Your scope supports 2.6x firmware versions.

In my case I have a hw0 DSO5102B (100MHz bandwidth).
I downloaded the firmware from https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg294175/#msg294175
Then I renamed it from dst1kb_2.06.3__130814.1_.up to dst1kb_2.06.3_15102b_fact(130814.1).up and I performed the upgrade.
You probably need to rename it to:  dst1kb_2.06.3_15202b_fact(130814.1).up

However keep in mind that I have DSO5102B and you have DSO5202B.
This firmware most likely works for your scope too, but I can't be 100% sure.

[benjamin545]

oh, yes, sorry, i forgot messed up the model number.

thats what im thinking too, that the 5074FG is overall a better deal atm. when i posted that link, i actually found the 7084BLG for ~$750 so that makes it a better comparison to the 5074FG. but still, i just dont know if the extra sample rate would translate to a better experience with the scope. as a matter of fact, if they just use the same main CPU as they usually do, would the extra bandwidth and sample rate bog it down more?

 i do like the logic plug system it uses, the 5074FG just has a pin socket array with kinda short logic leads. the 7084BLG uses the same as the old model MSO's and has a 25 pin header with a cable out to a box with the leads coming out of that, seems a lot nicer when you keep the scope a couple feet away from the test points. but, is it worth loosing the memory depth? was that memory depth useful to begin with? is it worth the extra $250? if you wait a couple months will it be down to $550 or $600? will the 5074FG be down in price? im not looking to buy right now, im looking at what i might want to get in a few months time when i feel like ive learned enough to deserve a real scope. i just want to see what it is i would be looking for at that time.

[AE9K]

astraios,

Thanks ... been there, done that.  Did it again just to be sure....0xfb error. 

I've done this process with this and the earlier versions of firmware Hantek support provided:
dst1kb_2.06.3_15202b_fact(130814.1).up
dst1kb_2.06.3_15202b_fact(130413.0).up
dst1kb_2.06.3_15202b_fact(130306.0).up

Given a 0xfb is a failure to decompress, I'm back to thinking I need to free up space on the root filesystem since this version of firmware expands to 7.7 MB and I have exactly that free.

df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                61.7M     54.0M      7.7M  88% /
none                      30.4M         0        30.4M   0% /tmp
none                      30.4M         0        30.4M   0% /var

Is root filesystem space a likely cause of my 0xfb errors? 

Or, given I have version hw0 hardware should I just cut my losses and trade up for something newer/better and stop wasting time on this one? 

Thanks,

Dan

[astraios]

Is root filesystem space a likely cause of my 0xfb errors?

Did you read/try this?: https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg206840/#msg206840

Or, given I have version hw0 hardware should I just cut my losses and trade up for something newer/better and stop wasting time on this one?

Actually according tinhead:

the hw0 was actually the best hw, the cost reduction was applied later. However i/o port on hw0 was not giving so many possibilities (like LA or DDS or even 100Mbit ethernet - only 10Mbit was available). So as long you using it as is, it's everything ok. Sure, you can add 10Mbit ethernet, but that's all then.

[walt]

Did it again just to be sure....0xfb error. 

Will do something

https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg94364/#msg94364

With newest firmware, copies of screenshots still stay in /mnt directory on DSO flash after extract usb storage.
But   /mnt directory  is empty, if you looked via console. Why? Dont know.
If manually copy files from older firmware (link above), reboot DSO with older firmware, and open /mnt directory via console, you see all earlier saved screenshots.
Delete all of it, and  upgrade the firmware again.

[pezibaer]

another Curios Problem on my hantek Handheld 1062b

i already bought 300mhz 100x Probe

So messuring AC 230V Inverter

Scale 50V PKPK 588V
Scale >=51V PKPK 750V

using 10X probe @ max Range 50V.. messuring is fine .. buw using 100x 51V- max Scale 500V messuring is completly  wrong

So .. this would really be a little bit stupid for using 100X Probe with scale 100-200V

See Pictures.. any ideas?

[Elektrongeek]

Hi i have recently bought my first scope and it is an Hantek DSO5072P i want to know what kind of hack can i do on it   ,

in the system info menu i have

Sw version 3.40.0(140208.0)
Hw version 1000xffff8103
Serial  T1G/03501139

[AE9K]

astraios and walt,

Big thanks...cleaning out the (unmounted) /mnt directory got me 32 MB of free space on the root filesystem and the firmware update worked.  I didn't even have to bother with the unnecessary files in /sbin and /usr/bin.  THANK YOU!

Odd result - my serial number went from 0030xx to 0330xx.

Upside - FFT response is much flatter and now I have FFT tracking mode cursors. Nice!


Dan