Hantek - Tekway - DSO hack - get 200MHz bw for free

[tinhead]

The topic is about how to hack another one Chinese DSO (Tekway/Hantek) up to 200MHz bandwidth.


-short history

When my Tek TDS754D died some time ago i had to find a replacement. At that time (2009) I ordered few
cheap known china DSOs and tested them in detail:
- UNI-T (UT2102CE)
- Rigol (DS1102E)
- Atten (ADS1102CE)
- Tekway (DST1102B)


Finally i decided to take Tekway DST1102B instead of Rigol DS1102E because :
(ATTEN and UNI-T was at that time simply useless crap)

- 7" high quality display (Innolux AT070TN83 V1) with 800 x 480 resolution
- display viewing angle designed for "on a shelf above the workbench" use
- DPO-like functionality
- 2500 wfrms/s update rate
- Linux OS on good known Samsung ARM S3C2440 SoC
- modern firmware with lot of unique (in the <1k USD DSO price class) features

Tekway call these model "Tekway DSO 2.0 Platform", and yes, there was "DSO 1.0 Platform" in 2008-2009
http://www.tekwayins.com/product.asp?ArticleID=7
but that completely different gear (with 2.5k memory depth, 320x240 display resolution and TEK TDS2000 like firmware)

In the meantime there are as well Hantek DSOs/Handhelds using that Tekway DSO 2.0 platform, as well some rebadged
models (some made by Tekway, other by Hantek) from Extech, PCE, Voltcraft, Protek, ICEL, AKIP, Redsea, Zhongce, etc !!!


-what inside Tekway/Hantek

i have reverse-engineered the hardware and made schematics:

 -hw0 (produced from Dec 2009 to Feb 2011)    ready
  http://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg56754/#msg56754
 
 -hw1005 (produced from Feb 2011 to Jun 2011)    ready errata in work
 
 -hw1007 (produced Jun 2011 to xxx 2013 , DSOs and MSOs with S/N < 15000)    ready
  http://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg214613/#msg214613

 -handheld hw1001 (S/N < 15000)    in work
 
 -hw_p_model_DSO    on to do list


- before you hack made a backup
 
It make sense to make backup of whole NAND flash (firmware+setting) before any hack attempt.
I have prepared easy to use "firmware update" files, simply choose your model, download the tool
and read the included Readme.txt to proceed.

For all following "B" model benchtop DSO with S/N < 15000
 - Tekway DST1062B, DST1102B, DST1202B
 - Hantek DSO5062B, DSO5102B, DSO5202B
 - Voltcraft DSO-3062C, DSO-1062D
 - Zhongce DF1202CL, DF1102CL, DF1062CL

http://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg35683/#msg35683


For all following "BM/BMV" models benchtop DSO with S/N < 15000
 - Hantek DSO5062BM, DSO5102BM, DSO5202BM
 - Hantek DSO5062BMV, DSO5102BMV, DSO5202BMV

http://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg111917/


For all following "B" and "D" models benchtop MSO with S/N < 15000
 - Tekway MST1062B, MST1102B, MST1202B
 - Hantek MSO5062D, MSO5102D, MSO5202D
 - Voltcraft MSO5062B, MSO5102B

http://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg185074/#msg185074


For all following "B", "BV" and "S" models handheld DSO with S/N < 15000
 - Hantek DSO1062B, DSO1102B, DSO1202B
 - Hantek DSO1062BV, DSO1102BV, DSO1202BV
 - Hantek DSO1062S, DSO1122S, DSO1152S
 - Extech MS6060, MS6100, MS6200

http://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg86825/#msg86825


For all following "P" models benchtop DSO with S/N > 15000
 - Hantek DSO5072P, DSO5102P, DSO5202P

No backup tool yet, when you have such model and wish to help me(us all) to crete such tool please PM
I look as well for PCB pictures (top and bottom side) of these DSOs !

For all others (not listed above) DSO/MSO/Handhelds  (e.g. with S/N > 15000 or the cute old Tekway
DST1000/DST3000/DST4000, Hantek DSO5000C) please PM me.


When you need to restore previously created backup, check the Readme.txt from backup tools above and/or following links:
http://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg75015/#msg75015
http://www.mikrocontroller.net/articles/Tekway_MSO


- the bandwidth hack

As far i know, all DSO/MSO/Handhelds since 2009 (so yes, even the latest "P" models) can be hacked.
To hack the bandwidth all you need to do is to rename one file in DSO root directory
- when you have 60MHz/70MHz model (no matter if benchtop or handheld) you must rename /dst1062b to /dst1202b
- when you have 100MHz model (no matter if benchtop or handheld) you must rename /dst1102b to /dst1202b
- when you have 150MHz model (no matter if benchtop or handheld) you must rename /dst1152b to /dst1202b

then after second reboot (yes, you have to reboot twice) the new bandwidth (and when you decided to go
up to 200MHz bandwidth the 2ns/DIV timbase as well) will be available.

To do this you can use that tool (then simply choose what bandwidth you wish and click on "Change bandwidth")

http://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg91877/

or that tool (then go to "Shell F2" tab and execute there for example  "mv /dst1062b /dst1202b")

http://peter.dreisiebner.at/dso-usb-tool/

or you can connect via UART to DSOs Linux shell and work from there. You will of course need to open the enclosure
and connect to PC via UART to USB converter (e.g. ebay CP2102 UART to USB etc). For the UART pinout check pictures below.


- the bootlogo hack

you might wish to change the boot screen logo as well (not necessary for bandwidth hack).

For all following "B" model benchtop DSO with S/N < 15000
- Tekway DST1062B, DST1102B, DST1202B
- Hantek DSO5062B, DSO5102B, DSO5202B
- Voltcraft DSO1062D, DSO3062C
- Zhongce DF1202CL, DF1102CL, DF1062CL (i don't have logos from Zhongce)

Download, when missing, all the boot logos
http://www.mikrocontroller.net/attachment/136103/all_logos.zip
and copy to yor DSOs /logo directory

You will have as well to edit /logotype and /logotype.dis files. The best is to use "vi" editor on the DSO shell,
you might as well copy these two file to PC and edit there. All you need is to change the DSO name from
what it is to what you wish to see, e.g. for Hantek DSO5062B you need to change in /logotype the dst1062b to dst1202b
and in /logotype.dis the hantek_DSO5062B to hantek_DSO5202B.

If you have questions - use search, or ask in this thread.


For all other following benchtop and handheld models with S/N < 15000
- Hantek Handheld DSO1062B/BV, DSO1102B/BV, DSO1202B/BV
- Hantek Handheld DSO1062S, DSO1102S, DSO1152S
- Tekway MSO MST1062B, MST1102B, MST1202B
- Hantek MSO MSO5062D, MSO5102D, MSO5202D
- Voltcraft MSO MSO5062D, MSO5102D, MSO5202D
- Hantek DSO DSO5062BV/BMV, DSO5102BV/BMV, DSO5202BV/BMV
- Extech MS6060, MS6100, MS6200
- Hantek DSO5072P, DSO5102P, DSO5202P

you have to edit a specific execuatable (as the logo is compiled into it), all necessary tools are here:
http://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg200040/#msg200040


-bug list

see attached - note, this list is not up to date, i have to work on it :\[/s]


-SDK, LabView, other hardware hacks, tons of other things

simply check the post below

[tinhead]

:ALL OTHER HACKS and INFOS:

If you wish to connect to the UART, check attached pictures


if you wish the run Boundary Scan on your Tekway(all models), Hantek, Extech, Voltcraft DSO/MSO/Handheld, check here
http://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg238484/#msg238484


200Mhz not enough ? Take a look here, and with proper active probes get 250Mhz (or up to 400Mhz with some attenutation)
http://www.eevblog.com/forum/index.php?topic=1571.msg45275#msg45275
http://www.eevblog.com/forum/index.php?topic=1571.msg45649#msg45649

 
You don't like the hot PSU ? Check here how to reduce the heat and reduce riple/noice for ADC supply
http://www.eevblog.com/forum/index.php?topic=1571.msg42363#msg42363


You need russian menu ? Look here
http://www.eevblog.com/forum/index.php?topic=1571.msg39434#msg39434


You wish to have Ethernet (10mbit) adapter for your Hantek/Tekway? Look here
(only for models produced before 1st April 2011 - green main PCB, not blue!)
http://www.eevblog.com/forum/index.php?topic=1571.msg40447#msg40447


If you wish to buy Tekway a bit cheaper from China - with English fron panel sticker, look this shop
http://www.aliexpress.com/fm-store/707178


If you wish to see what inside firmware or build your own look here how to crypt/decrypt
http://www.eevblog.com/forum/index.php?topic=1571.msg23984#msg23984


You destroyed factory calibration or you wish to run it after hardware modifications ?
http://www.eevblog.com/forum/index.php?topic=1571.msg50043#msg50043

and here

http://www.eevblog.com/forum/index.php?topic=1571.msg62991#msg62991


you wish to downgrade your firmware to 2.06.3 110531.1 for whatever reason? Look here
http://www.eevblog.com/forum/index.php?topic=1571.msg63001#msg63001


you wish to know (once again and more detailed) how the firmware update process works internaly? Look here
http://www.eevblog.com/forum/index.php?topic=1571.msg70890#msg70890


you wish to learn how to remote control DSO with own software or even hack over hidden USB/LAN protocol, look here
http://www.eevblog.com/forum/index.php?topic=1571.msg79128#msg79128


you wish to use USB LAN stick, look here for hack and DSO device drivers
http://www.eevblog.com/forum/index.php?topic=1571.msg83370#msg83370


you wish to populate missing parts around RJ45 jack to use it as UART? check this
http://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg95759/#msg95759


your DSO crashed and now after power up is not responding to any key? Check this
http://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg93999/#msg93999


how to hack licensing informations in EEPROM to enable features
http://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg108309/#msg108309


if you bought Hantek handheld DST1xxxxB/BV/S and wish to know more about them look here
http://www.eevblog.com/forum/index.php?topic=1571.msg86367#msg86367


if you wish to change the bootlogo or icons in the status bar and don't know how to convert these
"ico" files to soething known, then look here:
http://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg101338/#msg101338
http://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg101352/#msg101352


If you wish to develop own Capture/remote control software, LabView or MATLab drivers look here for details
how to control these DSOs :
http://www.mikrocontroller.net/articles/Hantek_Protokoll

an english verion here:

http://elinux.org/Das_Oszi_Protocol


If you wish to access your DSO over LAN (etc WLAN USB Adapter, integrated LAN, integrated WLAN) and you don't want to wait
the next 5 years before Hantek/Tekway implements LAN into firmware then check this:
http://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg147256/#msg147256


The GPL sources (for all kind of models based on DSO2.0 platfrom) are here:
http://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg110134/#msg110134


There is also a good tool written based on the "SDK" to communicate
(Remote control, show live waveforms, make screenshots, export data, change hidden function
and so on) on these DSOs. Supported OS - Linux, Windows and MacOSX !!!
http://peter.dreisiebner.at/dso-usb-tool


A nice compare between Hantek Handheld DSO1202B (they im principle equal to the bench models in this thread)
and 600MHz LeCroy WaveRunner Xi - look here
http://www.biasedlogic.com/index.php/hantek-dso1062b-dso1102b-dso1202b-vs-5gss-lecroy-waverunner/


If you wish to know what hw 555583E8 or 555583E9 in the hardware revision means check this
http://www.eevblog.com/forum/chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg170862/#msg170862


If you wish to disable the automatic 20MHz lowpass filter (which can be still the case for some firmware versions)
http://www.eevblog.com/forum/chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg172547/#msg172547


You got error 0xfb during firmare update? Check this
http://www.eevblog.com/forum/chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg206840/#msg206840

[Hypernova]

Nifty, you would think the other vendors have learned a thing or two after the rigol incident.

[cybergibbons]

Thanks - that's really interesting.

As far as I know, both the GW-Instek and Rigol scopes deal with all of the display logic in the FPGA, so have quite limited ability. The UI on these scopes looks a lot more fancy.

[saturation]

Awesome job, tinman and welcome the eevblog, what a great way to start.

Don't know much about tekway, but now its worth looking in to.

[saturation]

I have a sneaking suspicion letting the hack info continue and not be suppressed is actually good for business. 

Consider:

If sales of the Rigol 1052E double, it would compensate for each single lost sale of the 1102E

But If the 1102E is really just a factory hacked 1052E, then the manufacturing cost to make either scopes is equal, so they are not losing any sales at all, just making more.  The excess inventory of 1102E can always have their case stickers changed and firmware reburned to downgrade them into 1052E.  So the only cost to make an 1102E over a 1052E is labor to do the firmware and casing decal changes.

If the owner bricks his scope and asks for factory repair, the unit is not under warranty, and now not only did they make a sale on a scope, they can charge for repair

Rigol now has a bigger reputation, free publicity, more people own it, know its electronics intimately and thus have a better appreciation of its capabilities, and will consider buying their other products now too

So, its a win win.

If you look at the trends in electronics, there is a market of makers and hackers so manufacturers are addressing their wants.  Hakko's new iron, the FX888, Agilent's DMM skins, Hakko 936 skins etc., certainly isn't directed towards professional electronics.







Which prompted Fluke to make this ad:

http://register.fluke.com/globalforms/goyellow/index.html

Nifty, you would think the other vendors have learned a thing or two after the rigol incident.

[Hypernova]

I have a sneaking suspicion letting the hack info continue and not be suppressed is actually good for business. 

Consider:

If sales of the Rigol 1052E double, it would compensate for each single lost sale of the 1102E

But If the 1102E is really just a factory hacked 1052E, then the manufacturing cost to make either scopes is equal, so they are not losing any sales at all, just making more.  The excess inventory of 1102E can always have their case stickers changed and firmware reburned to downgrade them into 1052E.  So the only cost to make an 1102E over a 1052E is labor to do the firmware and casing decal changes.

If the owner bricks his scope and asks for factory repair, the unit is not under warranty, and now not only did they make a sale on a scope, they can charge for repair

Rigol now has a bigger reputation, free publicity, more people own it, know its electronics intimately and thus have a better appreciation of its capabilities, and will consider buying their other products now too

So, its a win win.

If you look at the trends in electronics, there is a market of makers and hackers so manufacturers are addressing their wants.  Hakko's new iron, the FX888, Agilent's DMM skins, Hakko 936 skins etc., certainly isn't directed towards professional electronics.

Nifty, you would think the other vendors have learned a thing or two after the rigol incident.

Well, that certainly reminds me of the conspiracy theory that Microsoft was loose on copy protection in the early years to ensure that they get the market share in first.

[PsI-On]

Hi tinman,

Can you post some more pictures please?

Looks like I'll be picking one of these up in China next month ;o)

Thanks.

[Mechatrommer]

cant find it in ebay, just the 200MHz version. maybe they are pulling all 100MHz back to upgrade to 2.04.SP1 FW? just speculation, not related to anyone who is still live or dead.

[PsI-On]

They're listed on www.taobao.com

Be warned, checking prices on taobao.com will leave you feeling sick every time!

-P

[tinhead]

cant find it in ebay, just the 200MHz version. maybe they are pulling all 100MHz back to upgrade to 2.04.SP1 FW? just speculation, not related to anyone who is still live or dead.

a month ago electrolab.com had some 100MHz versions. It can have something to do with the rumoured Hantek/Tekway deal,
but it can be just whatever. The distributor in Germany have still enough in stock, and of course taobao is full of sellers anyway.

Nifty, you would think the other vendors have learned a thing or two after the rigol incident.

Well, there are many competitors on low cost DSO market. That why probably every company have to reduce the costs.
You can hack almost all low cost DSOs, the question for me was only "which SOC/µC inside, which OS".

With Samsung S3C2440 and Linux 2.6.13 was easy thing, much easier than with TI DSP or pure FPGA based DSOs.

[tinhead]

maybe they are pulling all 100MHz back to upgrade to 2.04.SP1 FW?

i don't think that they will every try. By design the DSO is using these few config files, as this is Linux these can be always changed.
Of course Tekway/Hantek can try to disable UART port, JTAG can't be disabled. But even if, you will be still able to make backup
of the firmware via JTAG, to "patch" it on your mini2440 board and to restore it back to DSO.

The only chance is to change the PCB (the low pass filter around AD8370), which costs more money.
EDIT: Actually there are some differences between model,  however a hacked 60Mhz DSO can be still good up to 180MHz (-3db)
which is i think good value.

[slburris]

Any idea if Tekway makes Hantek's handheld oscilloscopes too?

Do you know if the Hantek DSO-1060 could be modified to be
a DSO-1200?  This would change a 60Mhz scope into a 200Mhz scope.

Great information, I bet there's going to be tons of discussion
about this topic!

Scott

[tinhead]

Hi tinman,

Can you post some more pictures please?

Looks like I'll be picking one of these up in China next month ;o)

Thanks.

sure, some PCB pics attached. As you can see the PCB is very nice routed, these guys did good job

For the outside pics check the tekway/hantek websites.

Btw, the DSO is fanless, which is good.

[tinhead]

Any idea if Tekway makes Hantek's handheld oscilloscopes too?

Do you know if the Hantek DSO-1060 could be modified to be
a DSO-1200?  This would change a 60Mhz scope into a 200Mhz scope.

Great information, I bet there's going to be tons of discussion
about this topic!

Scott

the other Hantek DSOs are made by Hantek itself (or others), but definitely not by Tekway.

Tekway started to made DSOs 3years ago and they never had handheld based devices.