Hantek - Tekway - DSO hack - get 200MHz bw for free

[derf123]

Thanks tinhead. That is what it looked like to me. Thought maybe I was going nuts - again.

[kallsop]

no it's not, the last available firmware for hw1007 and DSO5000B is the one i patched, DSO-B-custom_2.06.3_130814.1.zip on my OneDrive (in fw, hw1007, custom).

Thanks. That is the version I  already had in the DSO, so no need to upgrade.

[The Doc]

no, he probably missed my post. So yes, if you can made that backup for me.

Alright, I sent a link in a PM.

got them, thanks for support!

Sorry, I missed this. Thanks for sorting it j.sjolund.

I haven't had time to test mine yet but could someone confirm it is necessary to remove the 2 caps on a 5072P, as mentioned in a previous post?

[vvmm]

Hi!
I have never used a DSO, only Analog scopes. As I need to do a lot of digital work stuff lately I decided to purchase a DSO mainly for analyzing Serial data transmission (Serial, USB, I2C, SPI, VGA, Video), various noise, spikes and other signals (cursor measurements, FFT analysis etc.).
I have chosen Hantek DSO5072P taking the price into account, but compared to the 5062B variant I see that there is a storage memory difference of 40K vs 1M. If I purchase the one with 40K of memory will I regret it? Do you think I will need more? I understand that both of them are easily hackable to enable 200Mhz BW. (Can you add more memory?)
Also, does this model know to decode serial data automatically?
I saw in the pictures that there is a possibility to add an Ethernet jack. Did anyone tried adding it? What is it useful for?
Thanks!

[zelea2]

Hi, I've written a little C program to extract and patch the logo in a DSO scope. The logo is stored in the kernel (directly into the framebuffer code) in mtd2. If you save the mtd2 with nanddump you can then extract, modify and patch back the start logo. mtd2 has no filesystem it is just the compressed kernel with a stub to decompress it in memory. The logo is stored as 16bit RGB565 values and one can binary patch the kernel without the need to recompile everything.

'dso-logo mtd2' will create logo.ppm which you can edit with the graphic program of your choice. My little program uses the fact that the first and last lines of the display are white to detect the position of the logo inside the binary. When I recompress the kernel I use 7z instead of gzip because it has a much better compression ratio and you can draw a lot of things on your logo. If you want to load JPEGs on your logo most likely the compressed size will overflow and the patch will fail. The kernel.gz is right at the end of mtd2 followed only by a short structure so there is plenty of space there but if it overflows I'll have to patch a few more addresses in the stub and I didn't want to change too many things.

'dso-logo -w mtd2' will encapsulate the modified logo.ppm and then you can use nandwrite (from your serial console) to overwrite the kernel partition.

I've updated my program for better frame detection because I've purchased since also a HDG2000B function generator and I've been able to change its boot screen too.

Can someone let me know what is the exact procedure to restore my scope in case something goes wrong?
I won't touch mtd0 and mtd1 so the bootloader will be intact. I also have plenty of JTAG tools, memory programmer etc. What's the restore procedure if I accidently botch the kernel (of course I have a full backup)?

 

[Bumblebee]

Hi together..
at first please apologize my english...

I'm a new owner of a DSO5072p and i've hacked it like mentioned on first page.
The DSO is working wonderfull with 200Mhz Bandwith.
I've also removed the two capacitors (47pF) on the topside.

It is now all ok.

System Information like below:

Software 3.40.0 (140208)
hw 1000xffff8103

But now i find an new firmware on hantek site, and i asked myself if it is necessary to update the firmware?
And what is my benefit to do this?

Will i have new functions or new features? Better measurement?

I can't find any informations about the changings.
An must i install the Firmware for the DSO5202p after hacking it?

Regards Manuel

[tinhead]

I can't find any informations about the changings.

there are no official informations, maybe other "P" model users found something.

An must i install the Firmware for the DSO5202p after hacking it?

better yes

[zelea2]

Can someone let me know what is the exact procedure to restore my scope in case something goes wrong?
I won't touch mtd0 and mtd1 so the bootloader will be intact. I also have plenty of JTAG tools, memory programmer etc. What's the restore procedure if I accidently botch the kernel (of course I have a full backup)?

Until I figure out how to do a JTAG dump and restore is it possible to boot an alternative kernel from the bootloader?
At 'vivi' prompt is it possible to load my patched kernel in a zone of FFs on mtd3 (ignoring the UBI filesystem) or somewhere in RAM via xmodem and then use the 'boot' command to load this kernel instead to test it.

Where can I find the pinout of the JTAG connector for this scope (a very recent model DO5000B)? I've searched this thread and I haven't been able to find this info.

[mike105105]

Hey guys.  I ordered myself a new 5102b and was just wondering if there are any hardware mods that I need to do.  I'm excited for this thing to be delivered, I've wanted a new scope for a long time because my old tek 422 just doesn't cut it for me these days.


Thanks,
Mike

[zelea2]

The logo is stored as 16bit RGB565 values and one can binary patch the kernel without the need to recompile everything.

I've discovered that my bootloader allows kernel testing over USB. You can see the new menu in this serial capture.

Code: [Select]

##### EmbedSky BIOS for SKY2416/TQ2416 #####
This Board: SDRAM is 64MB; LCD display size is: 800 X 480
Press Space key to Download Mode.!
SD:File System init failed!

##### Boot for SKY2416/TQ2416 Main Menu #####
#####     EmbedSky USB download mode     #####

[1] Download u-boot or STEPLDR.nb1 or other bootloader to Nand Flash
[2] Download Eboot (eboot.nb0) to Nand Flash
[3] Download Linux Kernel (zImage.bin) to Nand Flash
[4] Download LOGO Picture (logo.bin) to Nand  Flash
[5] Download UBIFS image (root.ubi) to Nand Flash
[6] Download YAFFS image (root.bin) to Nand Flash
[7] Download Program to SDRAM and Run it
[8] Boot the system
[9] Format the Nand Flash
[0] Set the boot parameters
[a] Download User Program
[n] Enter TFTP download mode menu
[r] Reboot u-boot
[t] Test Linux Image (zImage)
Enter your selection: 0

##### Parameter Menu #####
[1] Set NFS boot parameter
[2] Set Yaffs boot parameter for Standard Linux
[3] Set UBIfs boot parameter for Standard Linux
[4] Set parameter
[5] View the parameters
[d] Delete parameter
[s] Save the parameters to Nand Flash
[q] Return main Menu
Enter your selection: 5
Name(enter to view all paramters):
bootargs=noinitrd ubi.mtd=3 root=ubi0:rootfs rootfstype=ubifs init=/linuxrc console=ttySAC0 mem=64M
bootcmd=nand read.jffs2 c0008000 kernel;bootm c0008000
bootdelay=1
baudrate=115200
ethaddr=10:23:45:67:89:ab
ipaddr=192.168.1.6
serverip=192.168.1.8
gatewayip=192.168.1.2
netmask=255.255.255.0
stdin=serial
stdout=serial
stderr=serial
ethact=dm9000
mtdids=nand0=nandflash0
mtdparts=mtdparts=nandflash0:512k@0(bios),512k(params),2048K(logo),4m(kernel),-(root)
partition=nand0,0
mtddevnum=0
mtddevname=bios

##### Boot for SKY2416/TQ2416 Main Menu #####
#####     EmbedSky USB download mode     #####

[1] Download u-boot or STEPLDR.nb1 or other bootloader to Nand Flash
[2] Download Eboot (eboot.nb0) to Nand Flash
[3] Download Linux Kernel (zImage.bin) to Nand Flash
[4] Download LOGO Picture (logo.bin) to Nand  Flash
[5] Download UBIFS image (root.ubi) to Nand Flash
[6] Download YAFFS image (root.bin) to Nand Flash
[7] Download Program to SDRAM and Run it
[8] Boot the system
[9] Format the Nand Flash
[0] Set the boot parameters
[a] Download User Program
[n] Enter TFTP download mode menu
[r] Reboot u-boot
[t] Test Linux Image (zImage)
Enter your selection: t
Now, Please connect to USB cable and USB interface!Once the kernel is tested you may also flash it via the same method.
There is a dnw utility for linux too:

Code: [Select]

git clone https://github.com/changbindu/dnw-linux.gitEnter bootloader by pressing space in console and then use dnw and a USB cable to transfer the new kernel.

So my little C program works and this is my new logo screen of my scope.

[rosasharn]

Great, zelea2.
I can use this method to develop my own logo!

[zelea2]

Where can I find the pinout of the JTAG connector for this scope (a very recent model DO5000B)? I've searched this thread and I haven't been able to find this info.

I don't understand why nobody bothers to reply me. Common guys, you've been playing with this scope for years, I've only had mine for 2 weeks.

Meanwhile I've made some annotated pictures with the JTAG pinouts. I've soldered headers in place for all the connectors. Beware the ARM JTAG and Serial use 2mm spaced headers. Soldering the ground pins of these was challenging because of the massive ground-planes I had to crank up my soldering iron temperature. These headers will allow me to plug in connectors instead of soldering wires directly but I'm still waiting for a 10pin 2mm cable to propely play with JTAG.

Luckily this Samsung SoC is directly supported by openocd so you'll need to start the program as

Code: [Select]

openocd -f target/samsung_s3c2440.cfg
telnet localhost 4444

If you need a cheap JTAG adapter you can buy a Segger clone for some 15$ and either reflash its serial numer (I use 015600xx on mine) or patch the Segger driver to bypass the check for clones.

[Dave_S]

Beware the ARM JTAG and Serial use 2mm spaced headers.

FWIW, apparently not all serial port connection points come unpopulated.  On my Hantek DSO5102P the male headers were already soldered in place and all a I had to do was plug an RC modeling servo cable onto the header to make a convenient place method to connect to the serial port without opening the case.

[RavenSpy]

Hello everybody! This is my first post!! but i m not a newbie in EEVBlog.
I bought a Hantek DSO5072P, and i do the BW hack and i desoldered the two capacitors for full hack.
But now i want to install LAN and SD card if it can support.
Then i read ( or die traying) all the pages of this post, and thats my conclusion.
For LAN i need:
- DM9000AEP (48LQFP)
- 25Mhz quarz crystal
- H1102NL
- RJ45 compatible jack
But what about SD card, i dont see anything in this post ( or im blind).
Some one can confirm my conclusions?
Thx in advice

[tinhead]

I decided to purchase a DSO mainly for analyzing Serial data transmission (Serial, USB, I2C, SPI, VGA, Video), various noise, spikes and other signals (cursor measurements, FFT analysis etc.).
...
Also, does this model know to decode serial data automatically?
...
I have chosen Hantek DSO5072P

no, none of Hantek DSOs is capable of any protocol decoding (not yet, and no iea when). So wen you need it,
you choosed wrong manufacturer

I saw in the pictures that there is a possibility to add an Ethernet jack. Did anyone tried adding it? What is it useful for?

currently, on "P" models, only for data transmitions

[tinhead]

I've discovered that my bootloader allows kernel testing over USB. I've attached the serial capture and you can see the new menu. Once the kernel is tested you may also flash it via the same method.
There is a dnw utility for linux too:

Code: [Select]

git clone https://github.com/changbindu/dnw-linux.gitEnter bootloader by pressing space in console and then use dnw and a USB cable to transfer the new kernel.

right, this is linux version of dnw.exe tool for windows, capable of doing exact the same things.

[tinhead]

I don't understand why nobody bothers to reply me. Common guys, you've been playing with this scope for years,
I've only had mine for 2 weeks.

well, probably because most ppl is using different models and simply don't know anything about JTAG on these DSOs.

Regards the JTAG pinout, i thought i said that already, this is FreindlyArm S3C24xx pinout. On older models
it was regular ARM pinout, now they changed it to save some space.

[tinhead]

there seems to be new firmware for DSO5000B, DSO5000BM, DSO5000BMV and DSO1000B models on the website.

EDIT: DSO5000B, DSO5000BM, DSO5000BMV for hw101 (fw 3.xx), DSO1000B for hw1001 (fw 2.01)

[ElektroQuark]

Are they valid for all hardware versions?

[mike105105]

There seems to be a bug in the new firmware.  Using the pass/fail the unit freezes when it catches a fail and needs to be rebooted.


Mike

[NoNaMeXP]

I just bought a DSO 2 weeks ago   

brand new From local distribution with 3 Year Warranty

Model DSO5062BMT      (T For  Thai language Menu  )
SW Ver. 3.30.0(140902.0)
HW Ver. 1010x5555830F
S/N  016XXXXT

Question is    Is normal or not for  5062BM  can set SEC/DIV down to  2ns , i meen  out of a box no hack no modify

See Att   For 2ns in Working

[tinhead]

yes, it seems so that firmware produced in 2014 have 2ns/DIV enabled by default.

[vvmm]

What do you recommend for me to buy between hantek dso5072p and dso5062b? I understand that B model has more sample memory, but P model has newer hardware and software. Is the software on P model better?

[tinhead]

What do you recommend for me to buy between hantek dso5072p and dso5062b? I understand that B model has more sample memory, but P model has newer hardware and software. Is the software on P model better?

no, this is not anymore the case, currently P and B models does have exact the same SoC and FPGA. Due "more sample memory" the B models does have of course additionally external memory and CPLD necessary to access/control the memory.

[vvmm]

Thank you for reply. Do they both run the same Linux kernel? (3.2) On the website it is stated that the B model runs 2.6.

I just looked at the power supply in the pictures. What voltages does it provide? I wonde if I could make the scope portable with some internal Li-Ion batteries.