Hantek - Tekway - DSO hack - get 200MHz bw for free

[Terry01]

If your machine is showing the 2ns out the box the 200MHz upgrade is already done. I got my 5102p from Amazon around a month ago and it was already done from the factory. I have seen quite a few others the same.

Enjoy! 

[JohnBee]

>

Quote from: Terry01 on Yesterday at 06:26:43 PM

If your machine is showing the 2ns out the box the 200MHz upgrade is already done. I got my 5102p from Amazon around a month ago and it was already done from the factory. I have seen quite a few others the same.

Enjoy! 

Very interesting.
I don't know if this matters or not, but after checking the FW, it would appear that it is using the 5072P according to the Hantek website.

[Terry01]

Check here 

https://youtu.be/JzfYSBwshyo

I don't know enough to know how it is worked out but the guys here do. It seems that Hantek have been doing the upgrade straight from the factory for a while. There are quite a few videos showing how to do it manually too so I think it's quite easy.   

[tinhead]

Questions:
1: Does DSO4072C have all functionalities DSO5072P have, plus a function generator?
2: Can DSO4072C be hacked to get 200Mhz bandwidth?
3: Are there any reverse engineering data for DSO4072C/DSO4102C/DSO4202C?

the DSO4xxxC series is completely different, sure there is a chance that it can be hacked as well, but i do now own one nor ever tested it.

[Jiggerypook]

Hello everyone, I am new here. This is my first post.


First, I have to say that this is my favorite electronics forum. I'm amazed at the amount of information available here. And the knowledge driving it. I've just spent three nights reading every post in 118 pages about the Hantek - Tekway DSO hack. Some stuff I understand but my days were on the 6502 chip,1984, so not so much. Maybe 1%. lol! But you guys rock!!

Anyhow, to the point. I know that someone has hacked the Hantek 6022 BE  20Mhz PC DSO and written a new GUI for it. My question is, has anyone attempted to do the same for the 6052 BE 50Mhz PC DSO? I haven't been able to find any information on it, just the 6022. The GUI and hack are not compatible with the 6052 (unfortunately), because the factory GUI is horrible.
1. Is it possible to access the FW with a JATG like the ones in this post?
2. If I  post photos of it's internal workings would that be enough to determine whether it is even possible to overclock?
3. And would anyone else on this forum have such a scope and a desire to modify the GUI to make it more user friendly?

It's way over my head (BASIC don't cut it) and I don't have a JTAG but will get one if there is a need.  (Too old to learn C++) It was hard enough to try linux' Red hat, then Ubuntu. Bahh. Stuck with Windblows. Would need assistance with Linux command line if it was required, and I could re install Ubuntu. (I could do the work with guidance) if there was a taker.

P.S.   I hope that it's ok that I posted this here. The thread didn't look dead, but maybe the topic is?

[ruba777]

Hi everyone! Sorry for bad english, in advance!
Like a many people at last pages of this topic, i bought DSO5102p with precense 2ns/div and HW 1010. When i attempt to reduce frequency range to 200 MHz nothing happend out!
Here my act sequence:

Connect UART 115200 8n1 and open terminal
mv dst1102b dst1202b
vi logotype, in it dst1102b change to dst1202b, wq - if after that reboot files dont changes but oscilloscope name remains the same

vi logotype.dis, in it hantek_DSO5102P change to hantek_DSO5202P, wq
reboot

All modified files after reboot coming back to  its initial condition. In system information nothing changes, of course.

At youtube video dude killed /dso/app/dsod processes, i try - nothing change.

When i flash firmware 20140208 occurs bootloop, after recovery firmware is 2017... so the 2014... fw not support hw1010 i think...

My question: is somewhere 200Mhz hack for hv1010 and  Is there any reason for it?


Any ideas?

[alpuy]

Thank you very much for your quick reply! I guess I will save 100 pounds By the way is there any advantage of buying the 200mhz version apart of keeping your warranty (which anyway I guess is useless since I am buying the scope from China) ?

The 60MHz and 100MHz models come with 150MHz probes. I expect the 200MHz models will come with 200MHz probes.

Apart from that ...

all current 60 and 100MHz models are using not that great (for hacking over 100MHz bw) combination of resistors in input stage.
When hacked to 200MHz, there is up to +5dB overshoot at 150MHz (depends on probe type and termination kind)

I've made tons of measurments on current models (and where to modify):

http://www.mikrocontroller.net/attachment/173049/mod_input_circuit.pdf

of my old Tekway DST1202B
http://www.mikrocontroller.net/topic/249628?page=8#3092292

of how bad the frequency response is on current60/100MHz DSO hacked to 200MHz
http://www.mikrocontroller.net/topic/249628?page=8#3098757

and how it can be improved to near perfect (don't forget, this is flat-response DSO, this overshoot need to be there)
http://www.mikrocontroller.net/topic/249628?page=8#3093970

Short said, by replacing the 4x22R resistor arrays in inputt stage the frequency response is already better (or on what it was on original 200MHZ DSO).

This can be however even more improved :
RX1_1 = RX1_2 = RX1_3 = RX1_4 = change all to 270R 0.1% (digikey 4 x P270DBCT-ND)
RX2_1 = RX2_2 = RX2_3 = RX2_4 = change all to 270R 0.1% (digikey 4 x P270DBCT-ND)
RA01_1 = RA01_2 = change all to 4 x 33R 1% (digikey 2 x CRA6E833.0ACT-ND)
RA02_1 = RA02_2 = change all to 4 x 33R 1% (digikey 2 x CRA6E833.0ACT-ND)
R01_25, R02_25 = change to 49R9 0.1% (digikey 2 x P49.9DBCT-ND)
R01_27, R02_27 = change to 120R 0.1% (digikey 2 x A103149CT-ND)
R01_29, R02_29 = change to 1R (what so ever 1206 resistors)

As the original probes are anyway not so good (oh well, they good up to 100MHz, for sure) it might change them to different models as well,
in my measurments you can see the original probe results (PP-150), some better chinese probes from Texas (TX250 -simply ebay "texas probes")
and more expensive 500MHz passive probes from Testec (HF-512).

Is the frontend modification needed for the DSO5072P model with HW 1010? I saw in the main page that models with SN < 15000 need the modification but i dont know where to get the SN. Does this apply to this model of Hantek?

Thanks

[kris_gor]

Hello.

I have updated the DSO1062D oscilloscope software (http://voltcraftdownload.info/UpdateFiles/file/180312231346419648501.zip), but it has failed. How do I fix my oscilloscope? I have access to the Linux console.


If I try to run the dso.exe file, I receive a message saying that there is no libgstream-1.0.so library.

1. Where can I find a flash image?
2. Which script corresponds to which upgrade?
3. I can try to upgrade it manually again. The flash drive is mounted correctly.

Krzysztof

[kwalter]

Hello,
need help!

My DSO-1062D gave up its ghost, as I could find out
the NAND device K9F1G08U0D-SCB0 was defective.

I could exchange this, but now I face the problem that I have
somehow the firmware must get into the NAND pure.

Have an OLIMEX ARM-USB-OCD-H JTAG Flasher and OpenOCD as
JTAG software.

Can anyone give me a guide to flashing the K9F1G08U0D-SCB0 and the
to to give necessary firmware?

Must flash about JTAG, since I have no Bootloader in the new K9F1G08U0D-SCB0
and thus transferred the firmware via the serial Interface is not working!

Kind regards
kwalter

[schufti]

Hi tinhead,
good to see you back again ... a while ago you posted

for older hardware, there is still hidden direkt link

http://www.hantek.com/Product/DSO5000/DSO5202B_Firmware.zip

where for new hardware, and that link is on Hantek's webpage, is

http://www.hantek.com/Product/DSO5000/DSO5202B_Firmware2.zip

some question:
are the links correct? Ist the first "for old hw" valid for e.g. Voltcraft DSO-3062C?
because content of both is file starting dso5kb_ ... only different datecode (shouldnt it be dso1kb_ for old hw?).

Also in https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg1047681/#msg1047681
someone mentioned http://www.hantek.ru/products/dso5202B/dst1kb_2.06.3_15202b_fact(140211.0).up firmware, do you have some info about it? From datecode it looks like the most recent lurking around.

apreciating any answer,
schufti

[HenningS]

Hello DSO experts,

sorry to "misuse" this running thread for my own request... @MOD: In case it doesnt fit here, please feel free to move it to a better location...
 
Some days ago I bought a used "bricked" Voltcraft DSO-1062D, with the intention to get it up and running again... Hardware looks pretty good, the S/N is "T1G 012 0172xx".

Error description:
The Linux system boots and displays the bootlogo on the TFT, but the DSO firmware doesn't start. The front panel is w/o key feedback, so the standard firmware upgrade method via *.UP file on the USB stick doesn't work.

I can connect PuTTY to the serial console and operate Linux. The serial console tells this version info:
  Linux version 3.2.35 (root@cjh-ubuntu) (gcc version 4.3.3
   (Sourcery G++ Lite 2009q1-176) ) #31 PREEMPT Tue Jul 16 16:02:21 CST 2013
  CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
  Machine: SMDK2416

I also can enter the bootloader (hitting SPC during startup), telling me:
  #####    Boot for SKY2416/TQ2416 Main Menu      #####
  #####     EmbedSky USB download mode     #####

The system boot stops with these error messages:
  /dso/app/dsod: /lib/libc.so.6: version `GLIBC_2.1.3' not found (required by /lib/libiconv.so.2)
  /dso/app/dsod: /lib/libc.so.6: version `GLIBC_2.1' not found (required by /lib/libiconv.so.2)
  /dso/app/dsod: /lib/libc.so.6: version `GLIBC_2.0' not found (required by /lib/libiconv.so.2)

What I tried already to restore the DSO:
Deleting /param/save/run1kb*
--> No change

The front USB mounts storage devices as /mnt/udisk. So I manually unPGP-unZIP-unTAR-unTARed the latest HANTEK "dso1kb_*.up" firmware and tried to restore the system step-by-step via console (according to the "update" script included in the decompressed .UP file).
--> No change

Assuming that "repair" actions by the previous owner mixed up the library files, I copied several versions of the library files included in *.UP files into the /lib folder of the DSO.
--> No change


So I assume, the content of standard "firmware upgrade" files is not sufficient to restore my DSO, possibly even the installed linux is not consistent anymore to operate DSO.EXE.

Could any expert help me please to find suitable files to restore my DSO?
  a) linux image and
  b) "complete DSO firmware" file

As I understand, with the included bootloader these could be flashed directly into the NAND flash then...
For further info, I attach the console bootlog and some system info as separate text files.

Thanks in advance for any hint!

Kind regards,
  Henning
 

[llg]

Hi kwalter

Have an OLIMEX ARM-USB-OCD-H JTAG Flasher and OpenOCD as
JTAG software.

Can anyone give me a guide to flashing the K9F1G08U0D-SCB0 and the
to to give necessary firmware?

I can provide some info about writing with openocd.

Now I assume you already know how to connect your jtag interface to your dso and have at least
some familiarity with openocd.
If not, see post #2877 for a pinout, there are other earlier posts in the thread as well.
Below is the openocd config I used:

Code: [Select]

set CHIPNAME s3c2416
set CPUTAPID 0x07926f0f

source [find target/samsung_s3c2416.cfg]

adapter_khz 1000

adapter_nsrst_delay 100
jtag_ntrst_delay 100
reset_config trst_and_srst

scan_chain

nand device $_CHIPNAME.nand s3c2412 $_TARGETNAME
I have a dso5202p I think that's hw1.0 it has s3c2416 CPU, I do not know exactly what CPU
is on DSO-1062D, but I think you can locate that info in this thread as well.
So be advised you will have to slightly update your openocd config, rest of the steps are similar.
I used a jlink interface to connect to jtag you have to substitute olimex settings (see interface/arm-jtag-ew.cfg in openocd homedir)

The steps to restore using openocd:

I call open ocd like this:

Code: [Select]

openocd -f interface/jlink.cfg -f smdk.cfg -c init -c halt
I force init/halt from command line as I wasn't sure cpu was properly halted by settings in the config file.

telnet openocd console and try to probe nand flash model:

Code: [Select]

nand probe 0
if everything went fine it should detect your model and size.

NAND 128MiB 3.3V 8-bit (Samsung)

Here's an output from my openocd console:

Open On-Chip Debugger 0.10.0
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
adapter speed: 1000 kHz
adapter_nsrst_delay: 100
jtag_ntrst_delay: 100
trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain connect_deassert_srst
   TapName             Enabled  IdCode     Expected   IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
 0 s3c2416.cpu            Y     0x00000000 0x07926f0f     4 0x01  0x0f
Info : No device selected, using first device.
Info : J-Link ARM V8 compiled May 27 2009 17:31:22
Info : Hardware version: 8.00
Info : VTarget = 2.154 V
Info : clock speed 1000 kHz
Info : JTAG tap: s3c2416.cpu tap/device found: 0x07926f0f (mfg: 0x787 (<unknown>), part: 0x7926, ver: 0x0)
Info : Embedded ICE version 6
Info : s3c2416.cpu: hardware has 2 breakpoint/watchpoint units
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x800000d3 pc: 0xc3e06ba4
MMU: enabled, D-Cache: disabled, I-Cache: enabled
Info : accepting 'telnet' connection on tcp/4444
NAND flash device 'NAND 128MiB 3.3V 8-bit (Samsung)' found

You will need a uboot partition image made previously with nanddump. I initially couldn't find my own image,
so I used an bin uboot image from an archive tinhead posted here sometime ago containing hantek sources files which
among other things contained some compiled code as well and luckily it worked.

The zip file is: DSO5000P.zip and the file is DSO5000P/src/uboot-2009.11/u-boot.bin
In case you need this file I can provide it but I have no idea if it will work for your DSO version.


Now to burn image:

Code: [Select]

nand erase 0
this is important as I couldn't get anything working until I erased nand flash before writing operation.
You could try to erase only the first few blocks but you have to compute the exact values and depends on your nand chip geometry.

next enable raw access in order to skip OOB writting.

Code: [Select]

nand raw_access 0 enable
finally, write the actual file:

Code: [Select]

nand write 0 uboot.bin 0
depending on your interface speed this can take some time but it should be done in a reasonable amount of time (half an hour or so).

If everything went fine you can now connect your serial and have uboot menu output.
I believe you know the drill from this further.

One piece of advice I can give you - keep in mind you cannot transfer the root image via usb bulk transfer (dnw) if image size exceeds the size of DSO's RAM.
My dso has 64M my root image was about 70M or so.
You could try to shrink root image to the size of the available memory, but it could be pretty difficult (it's an ubifs)
what I've done instead: as I had sdcard socket installed and busybox, ubitools, nandtools cross built on the sd card,
I forced a custom built kernel to boot and load busybox directly from sdcard.
Then I copied root image to sdcard and wrote it via ubiformat, you could try to use nandtools (flasherase/nandwrite) but I got it misaligned each time and ubi rootfs badly corrupted.

[kwalter]

Hi llg,
Thanks for your answer, that has helped me a bit, the bootloader I have to run again.

Card Initialization failed.

##### EmbedSky BIOS for SKY2416/TQ2416 #####
This Board: SDRAM is 64MB; LCD display size is: 640 X 480
Press Space key to Download Mode.!
SD:File System init failed!
Start Linux ...

NAND read: device 0 offset 0x300000, size 0x400000
 4194304 bytes read: OK
Wrong Image Format for bootm command
ERROR: can't get kernel image!

#####    Boot for SKY2416/TQ2416 Main Menu      #####
#####     EmbedSky USB download mode     #####

1 Download u-boot or STEPLDR.nb1 or other bootloader to Nand Flash
2 Download Eboot (eboot.nb0) to Nand Flash
3 Download Linux Kernel (zImage.bin) to Nand Flash
4 Download LOGO Picture (logo.bin) to Nand  Flash
5 Download UBIFS image (root.ubi) to Nand Flash
6 Download YAFFS image (root.bin) to Nand Flash
7 Download Program to SDRAM and Run it
8 Boot the system
9 Format the Nand Flash
0 Set the boot parameters
a Download User Program
c Choice lcd type.
n Enter TFTP download mode menu
r Reboot u-boot
t Test Linux Image (zImage)
Enter your selection:

Which image should take to restore the device?

I have no SD Card socket on the Board, this is not equipped!
Could you please help me?

Kind regards
kwalter

[llg]

hey,

you need to restore kernel image (option 2) and root image (option 5) at least.

You need to connect to your DSO usb cable on the  back of the device and you'll need dnw download tool
(https://github.com/changbindu/dnw-linux)
I believe there is an earlier post in this thread somewhere that somewhat describes this procedure.
You'll need to compile a kernel module, load it, and run dnw tool to upload your images.
Keep in mind the RAM limitations I told you about a post ago.
Cheers!

[kwalter]

Hello llg,

Thanks again for the help.

Then I'll look for the description, the DNW tool I have!

Kind regards
kwalter

[krisfromhell]

hi

ist it possible to get the dump file for the "voltcraft dso 1062d". i need to restore it. it stays at the boot logo 

[Harvey17]

Just had a peek inside my DSO5102P and was pleasently surprised to see the SD Card holder already in place 

Unfortunately, I don't seem to be able to lift the cover up to try it  It slides back and forwards, but don't want to lift up, unless Hantak expect us to slide the card in? Do they make flexible micro-sd??

[Harvey17]

A few questions:

I've just updated to the lastest firmware  - 3.40.0(180120.0) and notice a few issues/bugs/things:

1] There is still a small phase difference between the channels, but it seems improved from the video posted above, annoying all the same.

2] Using single seq. mode with timebase > 40ms works, but any attempt to scroll through the resulting capture makes the waveform vanish. Should this work like this?

3] The PSU is somewhat squeeky, not in a 'its gonna blow' way, just annoying. Has anyone attempted to quieten these?

4] Is it normal on a DSO for the scope to 'hold' the captured image when disconnecting a probe? e.g. when displaying probe check and disconnecting the probe, half the time the waveform stays on screen for a second or so. To me this seems odd.

[Ringmodulator]

Hi,

I am looking for a copy of the bootlogo files for a Voltcraft DSO-1202d.

They can be copied with the USB tool from this thread, so opening the scope and connecting to the uart is not neccesary.

Any help is appreciated.

Kind regards
Chris

[fscsi81]

Pleas upload, link to DSO-USB-TOOL..
Thx..

[SRRGEY42]

Hello! Can you please tell me why you need a slot for micro SD CARD? Thank you!

[Ringmodulator]

Pleas upload, link to DSO-USB-TOOL..
Thx..

Check the very first post in this thread from Tinhead.

On the bottom, the second link to his OneDrive is still working.

Under "Software", you will find the USB-Tool.

[freetz]

Hi everyone,

first of all a huge thank you to tinhead and all the others providing such valuable insights into this matter, I really learned a lot so far already!
I have also managed to solder a HC-05 Bluetooth Serial adapter to my MSO5102D scope and connecting to it works and I get to see the bootup messages. However, it stops at one point and stays there with no possibility to enter the shell, neither by hitting ENTER nor CTRL+C. These are the final lines:

Code: [Select]

dm9000 Ethernet Driver, V1.31
dm9000 dm9000: read wrong id 0x2b2a2928
dm9000 dm9000: read wrong id 0x2b2a2928
dm9000 dm9000: read wrong id 0x2b2a2928
dm9000 dm9000: read wrong id 0x2b2a2928
dm9000 dm9000: read wrong id 0x2b2a2928
dm9000 dm9000: read wrong id 0x2b2a2928                                         
dm9000 dm9000: read wrong id 0x2b2a2928                                         
dm9000 dm9000: read wrong id 0x2b2a2928                                         
dm9000 dm9000: wrong id: 0x2b2a2928                                             
dm9000 dm9000: not found (-19).                                                 
bkl tq2416-backlight initialized done...                                       
close beep now                                                                 
dso-buzzer s3c2416-beep initialized done...                                     
hub 1-0:1.0: Cannot enable port 2.  Maybe the USB cable is bad?                 
ifconfig: SIOCSIFADDR: No such device                                           
mkdir: can't create directory '/param': File exists                             
mkdir: can't create directory '/param/sav': File exists                         
open_serial_device:open serial success                                         
Langu_Init() <opt/language.c,220>:      read img languID=87                     
Langu_Init() <opt/language.c,226>:      set locale1=1                           
Langu_Init() <opt/language.c,235>:      set domain1=1                           
Langu_Init:Dso_GetLanguageID = 0                                               
hub 1-0:1.0: Cannot enable port 2.  Maybe the USB cable is bad?                 
hub 1-0:1.0: Cannot enable port 2.  Maybe the USB cable is bad?                 
hub 1-0:1.0: Cannot enable port 2.  Maybe the USB cable is bad?                 
hub 1-0:1.0: unable to enumerate USB device on port 2
Can anybody help me here?

Thanks a lot!

F.

[hardycious]

Good job! Thanks.

[SRRGEY42]

Hello! So no one answered why there is a slot on the motherboard of the oscilloscope Hantek dso 5102p? Thank you!