Hantek - Tekway - DSO hack - get 200MHz bw for free

[n8ddd]

i'm playing with your firmware mod for the p models,a bit.if u want me to test something.......wow,last year didn't knew nothing about the scopes,but i'd like to learn more decrypted then encrypted with dso5000b passwd and renamed in dso5kb*.up changed the model name too
here is an screenshot

and after rebooted dso(don't know how many times)there is an error
what should i do next?
btw,witch files i should restore to go back to 3.30?

[n8ddd]

from 800ns to80ms is acting like this,in 20k and 40 k mem,i dont't have anymore option for 512,1M

[tinhead]

well, what do you expect? Honestly, it will be not better when you playing the whole time with firmware for different models, THEY are different !!! So wwhat the reason to play?

[n8ddd]

ok,may i turn back now on 3.30?

[tinhead]

sure, when you copy back the 3.30 binaries and revert all the changes (in sys.inf, calibration files, EEPROM, i2c.log) made by the "P" model firmware. Don't forget, it is not only the update script, the dso.exe as well might chaneg things on your DSO.

Sys.inf is easy part, calibration files, well let'S forget them for a moment. The EEPROM content might be different already, show me your /i2c.log file.

[n8ddd]

this is. Ihave boot.bin kernel.bin and logo.bin -made it previously with nandump.didn't have root.bin
chk pm please.  btw in /have 2 files OurLanguages_bk and dso.exe_bk1

[tinhead]

ok, i will answer via PM

[Blitzbirnep]

Cause this topic is a few years old, it would be helpful if someone could summ up all the important information.
What is the actuall FW of Voltcraft/Hantek/Tekway?
Is there a new Hack Version? If Yes, where can i download this?
Do I have to downgrade for example a Voltcraft DSO 1062D for Hacking?
Is this method of Hacking actuall?

At this point I'd liked to say that this is a really great Work!! And tanks for the active developers for this way of improving our DSO's!!

[n8ddd]

thank you Tinhead,you're a great Man
you should make a guide

[MichaelK]

Hi,

I'm new here reading through this tread since hours... completely confused meanwhile

My problem is I bought a Voltcraft 1062D DSO with hw 1010x5555830f and still don't know if it is possible to hack this thing or not?

Can anyone verify that this will work and if so what do I need (as far as I understand meanwhile the typical FPGAs for the e8/e9 hardwares won't work).

Thanks a lot for your answers

[tinhead]

I'm new here reading through this tread since hours... completely confused meanwhile

hmm, it should be enought to read the very first posting ...

Can anyone verify that this will work and if so what do I need (as far as I understand meanwhile the typical FPGAs for the e8/e9 hardwares won't work).

hmm, where i wrote that "typical FPGA won't work"

My problem is I bought a Voltcraft 1062D DSO with hw 1010x5555830f and still don't know if it is possible to hack this thing or not?

as mentioned above, check the first page of this thread, very first posting, you will find out that:
- backup with a backtup tool is not (yet) possible (which is not a big deal, you can save files manually)
- bandwidth hack is possible
- logo hack is not (yet) possible (but who cares about boot logo), unless you compile new frame buffer driver with new logo

[sunsina]

Today I unboxed my HanTek MSO5102D mixed oscilloscope, every thing looks and works fine except I hear an annoying high pitch whistle noise as soon as the screen shows probe reading.

This noise never stops and I think is due to capacitance discharging and charging or something similar.

Has any one realised similar high pitch audio noise?
I am really interested to replace the part that makes the noise, since I can not tolerate it  - So I would be happy if any one tell me what is the noisy component on my scope board and how can I replace it (with better or similar component).

Thanks

[tinhead]

Today I unboxed my HanTek MSO5102D mixed oscilloscope, every thing looks and works fine except I hear an annoying high pitch whistle noise as soon as the screen shows probe reading.

This noise never stops and I think is due to capacitance discharging and charging or something similar.

is it something like this?

(link to video from user)
http://tinyurl.com/ocpm575

[sunsina]

@tihead
Sorry  I can not open the Video link, is it possible to upload it on other website.
Thanks

[sunsina]

@tinhead
I played a little with scope display contrast,
I understood that if slide the contrast to min or max it will stop making noise.
Anyway my scope hanged after my first try, it seems I have to upgrade the firmware
My system status says:
model:MSO5102D
sw version:3.2.35 (130506.0)
hw version:1010x55558340

I am wondering if this scope is hack ready, if so what you recommend?
Thanks a lot

[tinhead]

@tihead
Sorry  I can not open the Video link, is it possible to upload it on other website.
Thanks

http://www.eedownload.com:2108/

there is the video

[ADZ]

If anybody want to sell mso pcb i will listen you deals or somebody knows where to buy it. If you interesting write me to PM

[tinhead]

If anybody want to sell mso pcb i will listen you deals or somebody knows where to buy it. If you interesting write me to PM

send this guy PM

http://www.mikrocontroller.net/topic/311924

[MichaelK]

as mentioned above, check the first page of this thread, very first posting, you will find out that:
- backup with a backtup tool is not (yet) possible (which is not a big deal, you can save files manually)
- bandwidth hack is possible
- logo hack is not (yet) possible (but who cares about boot logo), unless you compile new frame buffer driver with new logo

Thanks for this tip, i didn't start read on the first page because this would have been taken days to read the thread up to the end

I read the very first postings as you suggested and found "For all others (not listed above) ... please PM me." what I've done but didn't get an answer but this isn't a problem I simply try it here again:
I have a DSO1062D from Voltcraft with hw 1010x5555830f, serial is > 15000 and sw 3.30.0. I learned that 1062D doesn't mean 1062D... so at least the hw confuses me a little bit because most solutions that I found seems to be for 1005 and 1007.

Backup manually means I need a console on the device... you meant "which is not a big deal"... what would be the easiest way for this? Where the uart has to be connected to is only described for hw1005 and hw1007 but not for hw1010 or is there an even easier way for doing this?

By the way any idea where I can get a logic analyzer board to make a DSO5xx out of the scope, will this work and what will it cost?

Thanks,
Michael

[ADZ]

tinhead
Big thanks for advice.

[n8ddd]

as mentioned above, check the first page of this thread, very first posting, you will find out that:
- backup with a backtup tool is not (yet) possible (which is not a big deal, you can save files manually)
- bandwidth hack is possible
- logo hack is not (yet) possible (but who cares about boot logo), unless you compile new frame buffer driver with new logo

Thanks for this tip, i didn't start read on the first page because this would have been taken days to read the thread up to the end

I read the very first postings as you suggested and found "For all others (not listed above) ... please PM me." what I've done but didn't get an answer but this isn't a problem I simply try it here again:
I have a DSO1062D from Voltcraft with hw 1010x5555830f, serial is > 15000 and sw 3.30.0. I learned that 1062D doesn't mean 1062D... so at least the hw confuses me a little bit because most solutions that I found seems to be for 1005 and 1007.

Backup manually means I need a console on the device... you meant "which is not a big deal"... what would be the easiest way for this? Where the uart has to be connected to is only described for hw1005 and hw1007 but not for hw1010 or is there an even easier way for doing this?

By the way any idea where I can get a logic analyzer board to make a DSO5xx out of the scope, will this work and what will it cost?

Thanks,
Michael

used that photo to connect the uart adapter
https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg282850/#msg282850

[tinhead]

I have to smile a little bit, 3 yrs ago Hantek posted on their website "incl. second design", which is nothing else than a SDK, with sample app, libs/headers, etc. Of course they never ever released anything, later they even deleted that "second design" from delivery list. Not that i really need it, we know the communication protocol already (Yes, with Hantek help) but hey, finally seems that (probably Extech pushed them) they released something - look at this link:

hxxp://www.hantek.com/Product/DSO1000B/DSO1000B_SDK.zip

This is SDK (beta1 - and this is why i have to smile, 3 years to get first beta version) for Hantek handhelds, but it does works as well with DSO/MSO hw0 to hw1007. With hw101 (so the very last hardware) i haven't tested, but probably it will work as well.

The sample app and documenation are very basic (yet), but yeah, it is beta.

[vmpn]

Unit:

DSO5062BM with

SN > 15000
soft version: 3.30.0(130709.0)
fpga version:0x5555830f

Executive Summary:

When trying to make a backup I ran into issue where nanddump was running indefinitely when dumping the rootfs. The issue seems to be due to faulty logic in nanddump when dealing with bad blocks and the fact that "-b" parameter to skip those is not honored.

P.S. I noticed that data layout seems to match that of the DSO5000P mentioned in https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg264194/#msg264194 which I used as cross check against my manual backup methods.

Details:


The NAND chip is Samsung K9F1G08U0D, data layout is:

Creating 4 MTD partitions on "NAND":
0x000000000000-0x000000100000 : "Bootloader"
0x000000100000-0x000000300000 : "LOGO"
0x000000300000-0x000000700000 : "Kernel"
0x000000700000-0x000008000000 : "ROOTFS"

The busybox version

BusyBox v1.20.2 (2013-03-15 09:24:06 CST) multi-call binary.

The logic for nanddump is implemented in the miscutils/nandwrite.c file. I used corresponding git tag (https://github.com/vmpn/busybox/tree/1_20_2) as baseline when analyzing the code. The following commits in the busybox repo fixes some of the issues:

https://github.com/vmpn/busybox/commit/da0200a1e50b3b4335757086a7426495eaacb31b - Fixed the logic related to bad block dumps
https://github.com/vmpn/busybox/commit/98f6b2d399e5fc02989390a04bd6c955b309cf7d - Until this is applied "-b      Omit bad block from the dump" does not take effect in all code branches
https://github.com/vmpn/busybox/commit/3aeb870b2284713a5f206bc40910b86da7d26966 - !!! Flips the meaning of "-o" flag.  So if you use this version omit "-o" where you specified it before

Plus few more commits that are not relevant to this issue.  Once I built busybox master (https://github.com/vmpn/busybox/commit/80f8cdf04ad0e8b37c20aed883b6cbfd6636dbc3) copy of compiled binaries are at: https://drive.google.com/folderview?id=0B7ub0wf4MMSIVWl5TVZPSm50d0U&usp=sharing I was able to create dumps when using "-b" flag. But dumps without "-b" were still running forever.  So I found a bug report https://bugs.busybox.net/show_bug.cgi?id=4856 that was relevant. Once patches from the report were applied (https://github.com/vmpn/busybox/commit/b778dc96269f391260649bd74a2bad0e49c534aa) and using the resulting busybox binary (https://drive.google.com/folderview?id=0B7ub0wf4MMSIQ05lMDNEdXdNS2s&usp=sharing) the dump works even without "-b" option

While I did not fully confirm this as fully working, I think there is 80%+ chance that this is right and I much rather share this info with others where it could be useful

[tinhead]

that looks very promising, it would be good if affected poeple here could download the bin and test the new busybox (or simply nanddump command. It hin the best is test both with and without -b option, without bad sectors is easier to restore via jtag).

Any volunteers ?

[n8ddd]

just tried,copied busybox over /bin/busybox then tried this  nanddump -o -b -l 0x8000000 -f /mnt/udisk/dump/root.bin /dev/mtd3
  and it worked,i think,  the root.bin have 124mb
tried 3th time to be sure...