Author Topic: Hacking the DSO2X1X  (Read 133577 times)

0 Members and 5 Guests are viewing this topic.

Offline DavidAlfa

  • Super Contributor
  • ***
  • Posts: 5835
  • Country: es
Re: Hacking the DSO2X1X
« Reply #250 on: July 14, 2021, 02:24:22 pm »
Nice, updated  :-+.
Hantek DSO2x1x            Drive        FAQ          DON'T BUY HANTEK! (Aka HALF-MADE)
Stm32 Soldering FW      Forum      Github      Donate
 

Offline DavidAlfa

  • Super Contributor
  • ***
  • Posts: 5835
  • Country: es
Re: Hacking the DSO2X1X
« Reply #251 on: July 14, 2021, 10:59:05 pm »
BTW carlosedp, you also missed the decoder icons! :-DD
It would be great to find a way to quickly preview them without having to manually import each one in Gimp.

I've been digging into the strings and the pointers to them, modifying the addresses so I can put my own strings without overwriting existing program code.
Seems to be working well, that way I can ex. make longer custom printf strings. For example:
« Last Edit: July 14, 2021, 11:03:00 pm by DavidAlfa »
Hantek DSO2x1x            Drive        FAQ          DON'T BUY HANTEK! (Aka HALF-MADE)
Stm32 Soldering FW      Forum      Github      Donate
 

Offline carlosedp

  • Contributor
  • Posts: 12
  • Country: br
Re: Hacking the DSO2X1X
« Reply #252 on: July 14, 2021, 11:39:26 pm »
You mean the small "S" beside the decoder name (that is currently magenta)? I'll look for it and change to Cyan as soon as I can :)

Changing the decoder to show Hex and Ascii chars is awesome! Is it already updated in the patcher pack? Can't wait to try!

 

Offline DavidAlfa

  • Super Contributor
  • ***
  • Posts: 5835
  • Country: es
Re: Hacking the DSO2X1X
« Reply #253 on: July 15, 2021, 12:58:27 am »
Is not as easy. The original printf is "%02X", so I can simply patch it with "%c" to show ascii, as there's enough space.
But to show more, there's no space. So I have to find "caves", empty spaces in the binary where to insert my strings.
Then find the pointer and change it. Very tedious and not easy to automate, if that's possible at all.
These programs help a lot. Only cavefinder worked for me.

https://github.com/Antonin-Deniau/cave_miner
https://github.com/jacopodl/CaveFinder

Also it wouldn't be easy (at least for me) to modify the printf calls to add more variables, so I took a linux advantage.
The "$" parameter allows to use any input variable multiple times or in any order.
1$ means "Use the first input parameter". That way I can print the same value in HEX, Char, Decimal... But strings become much longer.

"%1$02X\t%1$c" does "41 A"
"%1$02X\t%1$03u\t%1$c" does "41 065 A"
« Last Edit: July 15, 2021, 01:10:01 am by DavidAlfa »
Hantek DSO2x1x            Drive        FAQ          DON'T BUY HANTEK! (Aka HALF-MADE)
Stm32 Soldering FW      Forum      Github      Donate
 

Offline DavidAlfa

  • Super Contributor
  • ***
  • Posts: 5835
  • Country: es
Re: Hacking the DSO2X1X
« Reply #254 on: July 15, 2021, 04:44:37 pm »
Regarding the terrible english fonts. I disassembled lan_english.ko. It has 3 fonts, and exports 4 font pointers.
- Arial 13. For?
- Arial black 22. For Wavegen label text
- Arial black 20. For Measures and cursor text
- Arial black 20. For Gui, menu, decoders...
- Arial 25. For??

I patched the ldr instructions to load arial 13 instead arial 20 black, worked.
Much cleaner interface, although a bit small. Regular Arial 20 would be perfect.
The proper way would be to patch phoenix where it configures the fonts. Yet to be discovered!


« Last Edit: July 15, 2021, 04:49:55 pm by DavidAlfa »
Hantek DSO2x1x            Drive        FAQ          DON'T BUY HANTEK! (Aka HALF-MADE)
Stm32 Soldering FW      Forum      Github      Donate
 

Offline carlosedp

  • Contributor
  • Posts: 12
  • Country: br
Re: Hacking the DSO2X1X
« Reply #255 on: July 15, 2021, 05:10:44 pm »
That is pretty cool and much better looking. Maybe Arial 13 black would look good too if possible to be replaced.

Also what about having the UART decode hex values in parenthesis.. like: "H (48)" or prefixed as "H (0x48)".
 

Offline DavidAlfa

  • Super Contributor
  • ***
  • Posts: 5835
  • Country: es
Re: Hacking the DSO2X1X
« Reply #256 on: July 15, 2021, 05:29:47 pm »
Don't take it bad! But I'm not taking personal suggestions when doing my own research. Specially "It would be nice" and "I'd like" ones.
Also, such obvious one. So I spent hours reversing the binaries, trying a lot of things, and don't you think I already tried that?  :-DD
The field size is not linked it's contents, so it's always the same. Larger strings simply overlaps over the next field.



Hantek DSO2x1x            Drive        FAQ          DON'T BUY HANTEK! (Aka HALF-MADE)
Stm32 Soldering FW      Forum      Github      Donate
 

Offline carlosedp

  • Contributor
  • Posts: 12
  • Country: br
Re: Hacking the DSO2X1X
« Reply #257 on: July 15, 2021, 06:55:08 pm »
Hey, sorry. I never meant to ask or suggest anything in any way... just giving out some pointers to improvements that could or not be done by people that know it like you do and would make the scope a better product... things that "should" be done by Hantek themselves.

I'm trying to contribute with the best I know and be part of the community.

Again, sorry...
 

Offline DavidAlfa

  • Super Contributor
  • ***
  • Posts: 5835
  • Country: es
Re: Hacking the DSO2X1X
« Reply #258 on: July 16, 2021, 01:54:54 pm »
Oh, I said don't take it badly! Maybe I'm not expressing correctly as english is not my native language.
Not angry in any way, I was just saying something lik "really??" ironically.
I mean, why do I lose my time hacking these things if not for trying to replace the fonts and improve things? :-DD
Hantek DSO2x1x            Drive        FAQ          DON'T BUY HANTEK! (Aka HALF-MADE)
Stm32 Soldering FW      Forum      Github      Donate
 

Offline Mark5Topic starter

  • Contributor
  • Posts: 29
  • Country: fr
Re: Hacking the DSO2X1X
« Reply #259 on: July 19, 2021, 09:21:44 am »
Wow, there's been quite a lot of progress since I last came here.
Kudos to DavidAlfa and all the other participating in improving that scope.

Now I have a question : how safe/recommended/advisable is it to update the firmware ?
My 2C15 (so no AWG) is currently running FW 3000.

Same question about the platform tools. Is it safe to use any platform tools version ?
 

Offline AndrewBCN

  • Frequent Contributor
  • **
  • Posts: 571
  • Country: fr
Re: Hacking the DSO2X1X
« Reply #260 on: July 19, 2021, 10:19:59 am »
...
Now I have a question : how safe/recommended/advisable is it to update the firmware ?
My 2C15 (so no AWG) is currently running FW 3000.

...

I started a thread that answers very specifically this question: https://www.eevblog.com/forum/testgear/hantek-dso2x1x-firmware-updates-and-best-use-practices/

If you don't feel the need to update your firmware I would suggest waiting until Hantek publishes an official update that works well on all hardware versions. If you decide to go ahead I would suggest reading David Alfa's post in that thread, as it condenses all the points spread around various different posts.

 
The following users thanked this post: eevbstedt

Offline DavidAlfa

  • Super Contributor
  • ***
  • Posts: 5835
  • Country: es
Re: Hacking the DSO2X1X
« Reply #261 on: July 23, 2021, 04:19:05 pm »
Some details I forgot and could be useful:

To make modprobe working:
Code: [Select]
mkdir /lib/modules/5.2.0-licheepi-nano

Kernel debug is unmonted by default, it gives a lot of valueable info:
Code: [Select]
mount -t debugfs debugfs /sys/kernel/debug

To make it permanent, edit /etc/fstab and add this line:
Code: [Select]
debugfs /sys/kernel/debug debugfs defaults 0 0
« Last Edit: April 17, 2022, 12:40:07 pm by DavidAlfa »
Hantek DSO2x1x            Drive        FAQ          DON'T BUY HANTEK! (Aka HALF-MADE)
Stm32 Soldering FW      Forum      Github      Donate
 

Offline DavidAlfa

  • Super Contributor
  • ***
  • Posts: 5835
  • Country: es
Re: Hacking the DSO2X1X
« Reply #262 on: July 24, 2021, 07:25:49 pm »
Compiling the kernel.


Initial steps
Don't use Ubuntu newer than 18.x or Debian 10.x
arm-gcc cross-compiler works right away from apt-get in these versions. In newers, all you'll get is problems.

Install required dependencies (Linux crashes/breaks so easily that I have this saved in a text file :D)
Code: [Select]
sudo apt update
sudo apt install -y wget unzip build-essential rsync git bc swig libncurses-dev libacl1-dev libpython3-dev libssl-dev python3-distutils git cmake autoconf u-boot-tools bison flex linux-headers-$(uname -r)

The image names may change depending on the buildroot used. I'm using buildroot-tiny200
(Remove [ url] tags, it's a forum error)
Code: [Select]
git clone --recursive [url]https://github.com/aodzip/buildroot-tiny200[/url]

Download hantek.tar.gz.zip (Rename to .tar.gz):
Code: [Select]
cd buildroot-tiny200
tar -xvf hantek.tar.gz


Building steps
Also run this command whenever any of the upper files are modified.
(This will overwrite any custom config, ex. in menuconfig)
Code: (Load the config) [Select]
make dso2c10_defconfig
Code: (Edit buildroot options) [Select]
make menuconfig
Code: (Edit uboot options) [Select]
make uboot-menuconfig
Code: (Edit linux options) [Select]
make linux-menuconfig
Code: (Build: (Adjust 9 to your CPU cores+1)) [Select]
make -sj9

Default rootfs files can be found here: (They complement each other)
board/allwinner/generic/rootfs
board/allwinner/suniv-f1c100s/rootfs
board/hantek/dso2c10/rootfs (This is what you should modify to add you custom stuff)

Avoid using "make clean" when possible, as it will re-build everything, taking ages.
So after the initial and slow build, you should only need this:
Code: (Quickly rebuild after making any code/files modifications) [Select]
rm -rf output/target
find output/ -name ".stamp_target_installed" | xargs rm -rf
make -sj9 uboot-rebuild linux-rebuild all

Helper script
I made a very simple script to provide some aiding, so much typing is tiresome!
Code: (build.sh) [Select]
[ "$1" == "clean" ] && (echo "Cleaning"; make clean >/dev/null)
([ "$1" == "clean" ]  || [ "$1" == "init" ] ) && (echo "Reloading config";make sipeed_lichee_nano_defconfig)
rm -rf output/target
find output/ -name ".stamp_target_installed" | xargs rm -rf
make -sj9 uboot-rebuild linux-rebuild all >/dev/null
Code: [Select]
./build.sh clean   -> Cleans everything, reloads the config and builds
./build.sh init    -> Reloads the config and builds
./build.sh         -> Re-builds

RAM Booting
- Download sunxi-fel.
- Copy these files from output/images and place them in sunxi-fel folder:
    - devicetree.dtb
    - uImage
    - rootfs.cpio.uboot
    - u-boot-sunxi-with-spl.bin

Boot the system in FEL mode (Check the FAQ for more info)
Code: (Boot procedure) [Select]
sunxi-fel -p uboot u-boot-sunxi-with-spl.bin write 0x80008000 uImage write 0x80C00000 devicetree.dtb write 0x80D00000 rootfs.cpio.uboot

Moments later, you should see the system booting:
Quote
U-Boot SPL 2020.07 (Jul 24 2021 - 21:03:14 +0200)
DRAM: 64 MiB
Trying to boot from FEL


U-Boot 2020.07 (Jul 24 2021 - 21:03:14 +0200) Allwinner Technology

CPU:   Allwinner F Series (SUNIV)
Model: Allwinner F1C100s Generic Device
DRAM:  64 MiB
MMC:   mmc@1c0f000: 0, mmc@1c10000: 1
Setting up a 800x480 lcd console (overscan 0x0)
In:    serial
Out:   serial
Err:   serial
Allwinner mUSB OTG (Peripheral)
Hit any key to stop autoboot:  0
## Loading init Ramdisk from Legacy Image at 80d00000 ...
   Image Name:
   Image Type:   ARM Linux RAMDisk Image (uncompressed)
   Data Size:    4514773 Bytes = 4.3 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Flattened Device Tree blob at 80c00000
   Booting using the fdt blob at 0x80c00000
   Loading Ramdisk to 813b1000, end 817ff3d5 ... OK
   Loading Device Tree to 813aa000, end 813b098d ... OK
Cannot setup simplefb: node not found

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 5.4.92 (user@user-VirtualBox) (gcc version 8.4.0 (Buildroot -g9c78493)) #1 Sat Jul 10 09:35:14 CEST 2021
[    0.000000] CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=0005317f
[    0.000000] CPU: VIVT data cache, VIVT instruction cache
[    0.000000] OF: fdt: Machine model: Sipeed Lichee Nano
[    0.000000] Memory policy: Data cache writeback
[    0.000000] cma: Reserved 16 MiB at 0x83000000
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS0,115200 earlyprintk rootwait init=/preinit root=/dev/mtdblock2 rootfstype=squashfs overlayfsdev=/dev/mtdblock3 net.ifnames=0 vt.global_cursor_default=0
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 34324K/65536K available (6144K kernel code, 248K rwdata, 1676K rodata, 1024K init, 225K bss, 14828K reserved, 16384K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000000] random: get_random_bytes called from start_kernel+0x254/0x444 with crng_init=0
[    0.000050] sched_clock: 32 bits at 24MHz, resolution 41ns, wraps every 89478484971ns
[    0.000138] clocksource: timer: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 79635851949 ns
[    0.000866] Console: colour dummy device 80x30
[    0.000973] Calibrating delay loop... 203.16 BogoMIPS (lpj=1015808)
[    0.070260] pid_max: default: 32768 minimum: 301
[    0.070798] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.070841] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.072792] CPU: Testing write buffer coherency: ok
[    0.074917] Setting up static identity map for 0x80100000 - 0x80100058
[    0.076236] devtmpfs: initialized
[    0.087878] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.087943] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.092204] pinctrl core: initialized pinctrl subsystem
[    0.094874] NET: Registered protocol family 16
[    0.098652] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.101131] cpuidle: using governor menu
[    0.145398] SCSI subsystem initialized
[    0.145764] usbcore: registered new interface driver usbfs
[    0.145921] usbcore: registered new interface driver hub
[    0.146119] usbcore: registered new device driver usb
[    0.146601] mc: Linux media interface: v0.10
[    0.146732] videodev: Linux video capture interface: v2.00
[    0.146847] pps_core: LinuxPPS API ver. 1 registered
[    0.146865] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.146954] PTP clock support registered
[    0.148036] ion_parse_dt_heap_common: id 4 type 4 name cma align 1000
[    0.149068] Advanced Linux Sound Architecture Driver Initialized.
[    0.151717] clocksource: Switched to clocksource timer
[    0.183917] thermal_sys: Registered thermal governor 'step_wise'
[    0.184680] NET: Registered protocol family 2
[    0.186251] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.186328] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.186387] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.186443] TCP: Hash tables configured (established 1024 bind 1024)
[    0.186768] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.186832] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.187383] NET: Registered protocol family 1
[    0.189565] Unpacking initramfs...
[    1.679161] Freeing initrd memory: 4412K
[    1.679789] NetWinder Floating Point Emulator V0.97 (double precision)
[    1.681852] Initialise system trusted keyrings
[    1.682507] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[    1.704906] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.705536] jffs2: version 2.2. (NAND) (SUMMARY)  © 2001-2006 Red Hat, Inc.
[    1.822323] Key type asymmetric registered
[    1.822363] Asymmetric key parser 'x509' registered
[    1.822554] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 249)
[    1.822579] io scheduler mq-deadline registered
[    1.822598] io scheduler kyber registered
[    1.825305] sun4i-usb-phy 1c13400.phy: Couldn't request ID GPIO
[    1.837907] suniv-f1c100s-pinctrl 1c20800.pinctrl: initialized sunXi PIO driver
[    1.863557] Serial: 8250/16550 driver, 8 ports, IRQ sharing disabled
[    1.869824] suniv-f1c100s-pinctrl 1c20800.pinctrl: 1c20800.pinctrl supply vcc-pe not found, using dummy regulator
[    1.871225] printk: console [ttyS0] disabled
[    1.891564] 1c25000.serial: ttyS0 at MMIO 0x1c25000 (irq = 27, base_baud = 6250000) is a 16550A
[    2.339563] printk: console [ttyS0] enabled
[    2.349332] suniv-f1c100s-pinctrl 1c20800.pinctrl: 1c20800.pinctrl supply vcc-pd not found, using dummy regulator
[    2.369983] panel-simple panel: panel supply power not found, using dummy regulator
[    2.379683] SCSI Media Changer driver v0.25
[    2.385619] suniv-f1c100s-pinctrl 1c20800.pinctrl: 1c20800.pinctrl supply vcc-pc not found, using dummy regulator
[    2.398485] spi-nor spi0.0: unrecognized JEDEC id bytes: ff ef aa 21 00 00
[    2.406077] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    2.412716] ehci-platform: EHCI generic platform driver
[    2.418346] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    2.424662] ohci-platform: OHCI generic platform driver
[    2.430389] usbcore: registered new interface driver usb-storage
[    2.438101] i2c /dev entries driver
[    2.442385] suniv-f1c100s-pinctrl 1c20800.pinctrl: 1c20800.pinctrl supply vcc-pd not found, using dummy regulator
[    2.456546] sunxi-wdt 1c20ca0.watchdog: Watchdog enabled (timeout=16 sec, nowayout=0)
[    2.466510] suniv-f1c100s-pinctrl 1c20800.pinctrl: 1c20800.pinctrl supply vcc-pf not found, using dummy regulator
[    2.504629] sunxi-mmc 1c0f000.mmc: initialized, max. request size: 16384 KB
[    2.514070] usbcore: registered new interface driver usbhid
[    2.519644] usbhid: USB HID core driver
[    2.523921] sunxi-cedar 1c0e000.video-codec: sunxi cedar version 0.01alpha
[    2.531127] sunxi-cedar 1c0e000.video-codec: cedar-ve the get irq is 20
[    2.537848] random: fast init done
[    2.546507] debugfs: Directory '1c23c00.codec' with parent 'F1C100s Audio Codec' already present!
[    2.560372] sun4i-codec 1c23c00.codec: Codec <-> 1c23c00.codec mapping ok
[    2.577004] NET: Registered protocol family 17
[    2.581565] Key type dns_resolver registered
[    2.587141] Loading compiled-in X.509 certificates
[    2.607167] sun4i-drm soc:display-engine: bound 1e00000.display-frontend (ops 0xc073b278)
[    2.616228] sun4i-drm soc:display-engine: bound 1e60000.display-backend (ops 0xc073aab8)
[    2.625829] sun4i-drm soc:display-engine: bound 1c0c000.lcd-controller (ops 0xc0739658)
[    2.634410] sun4i-drm soc:display-engine: bound 1c0a000.tv-encoder (ops 0xc073a378)
[    2.642187] [drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
[    2.648790] [drm] No driver support for vblank timestamp query.
[    2.656940] [drm] Initialized sun4i-drm 1.0.0 20150629 for soc:display-engine on minor 0
[    2.665989] [drm] kms: can't enable cloning when we probably wanted to.
[    2.722238] Console: switching to colour frame buffer device 60x34
[    2.745448] sun4i-drm soc:display-engine: fb0: sun4i-drmdrmfb frame buffer device
[    2.754648] usb_phy_generic usb_phy_generic.0.auto: usb_phy_generic.0.auto supply vcc not found, using dummy regulator
[    2.766637] musb-hdrc musb-hdrc.1.auto: MUSB HDRC host driver
[    2.772615] musb-hdrc musb-hdrc.1.auto: new USB bus registered, assigned bus number 1
[    2.783000] hub 1-0:1.0: USB hub found
[    2.786923] hub 1-0:1.0: 1 port detected
[    2.793566] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[    2.851892] cfg80211: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[    2.858633] ALSA device list:
[    2.861615]   #0: F1C100s Audio Codec
[    2.865892] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[    2.874644] cfg80211: failed to load regulatory.db
[    2.884546] Freeing unused kernel memory: 1024K
[    2.889446] Run /init as init process
Starting syslogd: OK
Starting klogd: OK
Running sysctl: OK
Populating /dev using udev: [    3.398494] udevd[81]: starting version 3.2.9
[    3.407856] random: udevd: uninitialized urandom read (16 bytes read)
[    3.416644] random: udevd: uninitialized urandom read (16 bytes read)
[    3.423696] random: udevd: uninitialized urandom read (16 bytes read)
[    3.477705] udevd[82]: starting eudev-3.2.9
[    4.961875] tsc2007 0-0048: i2c io error: -6
[    4.966174] tsc2007 0-0048: Failed to setup chip: -6
done
Saving random seed: [    5.617278] random: dd: uninitialized urandom read (512 bytes read)
OK
Starting haveged: haveged: listening socket at 3
OK
Starting network: OK
Starting uMTPrd: [    7.073858] file system registered
[    7.308165] read descriptors
[    7.311118] read strings
OK

Welcome to Hantek DSO2x1x f1c200s
Hantek-dso2x1x-f1c200s login:



Misc
The decompiled DTB from the original system is also attached.
« Last Edit: February 13, 2024, 03:28:18 am by DavidAlfa »
Hantek DSO2x1x            Drive        FAQ          DON'T BUY HANTEK! (Aka HALF-MADE)
Stm32 Soldering FW      Forum      Github      Donate
 
The following users thanked this post: eevbstedt, morgan_flint, Andrew_Debbie

Offline AndrewBCN

  • Frequent Contributor
  • **
  • Posts: 571
  • Country: fr
Lichee Pi Nano
« Reply #263 on: August 05, 2021, 09:41:48 am »
Just received a Lichee Pi Nano, probably the smallest and cheapest  (€9 shipping included) Linux development board in the world, and which uses the F1C100s SOC (the same as in the Hantek DSO but with 32MB instead of 64MB RAM).

I'll be working on it in the coming weeks, to develop a small Linux distribution for the DSO2X1X series.
 
The following users thanked this post: eevbstedt

Offline juanmrodrigues

  • Newbie
  • Posts: 1
  • Country: pt
Re: Hacking the DSO2X1X
« Reply #264 on: August 06, 2021, 03:59:50 pm »
Hi all,
First of all Thank You for sharing all this precious information.

I just received my DSO2D10. It came with SW 20210416.
I've gone to the Hantek site and the latest SW at their site is exactly the same version that I already have. However, I downloaded it and applied the procedure for hacking the DSO to 150MHz.
Everything looks OK but the hack doesn't work. Looks like even when showing the update progrress and reaching 100% nothing is done because the versions are the same. So no upgrade is done.

Is there any other way to apply the hack? Would the script launcher from @DavidAlfa do it?
Is it enough to run the script "do_other_update(Edit Model-Serial-Hardware)" renaming it and putting the right data inside?

Thanks in advance.

EDIT: I used DavidAlfa script launcher and it looks like it worked. At least the model shown in the sysinfo is 2D15. Serial number and PCB version are correct also.
« Last Edit: August 06, 2021, 09:41:31 pm by juanmrodrigues »
 

Offline AndrewBCN

  • Frequent Contributor
  • **
  • Posts: 571
  • Country: fr
Re: Hacking the DSO2X1X
« Reply #265 on: August 29, 2021, 10:44:56 am »
Hi,
Just a quick update on my tests using the Lichee Pi Nano: I have managed to compile and boot u-boot and the Linux kernel using FEL mode on the Lichee Pi Nano and the Nano provides a console through the USB OTG serial (ttyGS0), in other words, the same cable that is used by FEL mode to load u-boot and the kernel in RAM can also be used to communicate with the host machine, there is no need for a separate serial interface. My last remaining hurdle is creating a root filesystem small enough that it will fit in the very limited 32MB RAM of the F1C100S of the Lichee Pi Nano and still leave enough space for the kernel to do its work. That of course should be less of a problem in the DSO2X1X since it uses an F1C200S with 64MB RAM. I can already load the root filesystem from SD card on the Lichee Pi Nano, but that is not an option on the Hantek DSO without some surgery which I have been avoiding until now.  :-BROKE
In the coming days I should be able to shrink a minimal root filesystem and when this works on the Lichee Pi Nano DONE!, I'll begin testing on my Hantek DSO2C10. I'll upload the files to DavidAlfa's repository when this is ready and of course I'll update the GitHub repository too.
« Last Edit: August 29, 2021, 03:34:28 pm by AndrewBCN »
 
The following users thanked this post: tv84, eevbstedt, Andrew_Debbie, pcprogrammer

Offline AndrewBCN

  • Frequent Contributor
  • **
  • Posts: 571
  • Country: fr
Re: Hacking the DSO2X1X
« Reply #266 on: August 29, 2021, 09:27:10 pm »
OK, so I am beginning testing my minimal Linux distribution on my Hantek DSO2C10.

These are the steps:
1. Install the sunxi-tools-f1c100s package on your Linux laptop/PC/workstation host. I have not tested this on a Windows host, but similar steps apply.
2. Connect the supplied USB cable from the Hantek DOS2X1X to your Linux laptop/PC/workstation host.
3. Press and hold the FEL button on the bottom of your Hantek DOS2X1X and power it on. All the buttons should light up but the DSO will not boot, because it is actually booted in FEL mode at this stage.
4. On your host machine, execute the following command which will transfer the bootloader (u-boot), the Linux kernel, the device tree and the minimal root filesystem to the DSO:
Code: [Select]
andrew@andrew-ThinkPad-T420:~/Development/Hantek_DSO_hacking/buildroot-tiny200$ sudo sunxi-fel -p -v uboot ./output/images/u-boot-sunxi-with-spl.bin write 0x80008000 ./output/images/zImage write 0x80700000 ./output/images/devicetree.dtb write 0x80800000 ./output/images/rootfs.cpio.uboot
Stack pointers: sp_irq=0x00002000, sp=0x00005E08
MMU is not enabled by BROM
=> Executing the SPL... done.
Writing image "U-Boot 2020.07 for sunxi board", 398730 bytes @ 0x81700000.
100% [================================================]  3552 kB,  358.7 kB/s
100% [================================================]    15 kB,  348.9 kB/s
100% [================================================]  1310 kB,  359.5 kB/s
Starting U-Boot (0x81700000).


After the files are transferred, Linux boots in two seconds!
5. At this stage a new ACM serial device is detected by your host machine, we can connect to the DSO using any serial communications program (minicom, screen, etc). I am using screen: sudo screen /dev/ttyACM0

Code: [Select]
Welcome to Sipeed Lichee Nano
lichee-nano login: root
Password:
# dmesg
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 5.4.92-andrew-04 (andrew@andrew-ThinkPad-T420) (gcc version 9.3.0 (Buildroot -g9c78493-dirty)) #1 Sun Aug 29 01:42:24 CEST 2021
[    0.000000] CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=0005317f
[    0.000000] CPU: VIVT data cache, VIVT instruction cache
[    0.000000] OF: fdt: Machine model: Sipeed Lichee Nano
[    0.000000] Memory policy: Data cache writeback
[    0.000000] cma: Reserved 16 MiB at 0x83000000
[    0.000000] On node 0 totalpages: 16384
[    0.000000]   Normal zone: 128 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS0 earlyprintk net.ifnames=0 vt.global_cursor_default=0
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 38512K/65536K available (5120K kernel code, 226K rwdata, 1420K rodata, 1024K init, 215K bss, 10640K reserved, 16384K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000000] random: get_random_bytes called from start_kernel+0x258/0x458 with crng_init=0
[    0.000047] sched_clock: 32 bits at 24MHz, resolution 41ns, wraps every 89478484971ns
[    0.000138] clocksource: timer: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 79635851949 ns
[    0.000813] Console: colour dummy device 80x30
[    0.000915] Calibrating delay loop... 203.16 BogoMIPS (lpj=1015808)
[    0.070256] pid_max: default: 32768 minimum: 301
[    0.070776] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.070818] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.072660] CPU: Testing write buffer coherency: ok
[    0.074655] Setting up static identity map for 0x80100000 - 0x80100058
[    0.075900] devtmpfs: initialized
[    0.086291] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.086353] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.090451] pinctrl core: initialized pinctrl subsystem
[    0.092982] NET: Registered protocol family 16
[    0.096178] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.098310] cpuidle: using governor menu
[    0.138588] SCSI subsystem initialized
[    0.138955] usbcore: registered new interface driver usbfs
[    0.139104] usbcore: registered new interface driver hub
[    0.139250] usbcore: registered new device driver usb
[    0.139759] pps_core: LinuxPPS API ver. 1 registered
[    0.139784] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.139845] PTP clock support registered
[    0.142312] clocksource: Switched to clocksource timer
[    0.172778] thermal_sys: Registered thermal governor 'step_wise'
[    0.173510] NET: Registered protocol family 2
[    0.174927] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.175009] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.175066] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.175114] TCP: Hash tables configured (established 1024 bind 1024)
[    0.175401] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.175462] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.176022] NET: Registered protocol family 1
[    0.176817] Unpacking initramfs...
[    0.523103] Freeing initrd memory: 1280K
[    0.523395] NetWinder Floating Point Emulator V0.97 (double precision)
[    0.525131] Initialise system trusted keyrings
[    0.525799] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[    0.663186] Key type asymmetric registered
[    0.663225] Asymmetric key parser 'x509' registered
[    0.663397] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 250)
[    0.663424] io scheduler mq-deadline registered
[    0.663441] io scheduler kyber registered
[    0.666046] sun4i-usb-phy 1c13400.phy: Couldn't request ID GPIO
[    0.677941] suniv-f1c100s-pinctrl 1c20800.pinctrl: initialized sunXi PIO driver
[    0.701279] Serial: 8250/16550 driver, 8 ports, IRQ sharing disabled
[    0.707448] suniv-f1c100s-pinctrl 1c20800.pinctrl: 1c20800.pinctrl supply vcc-pe not found, using dummy regulator
[    0.708778] printk: console [ttyS0] disabled
[    0.729097] 1c25000.serial: ttyS0 at MMIO 0x1c25000 (irq = 27, base_baud = 6250000) is a 16550A
[    5.608822] printk: console [ttyS0] enabled
[    5.664525] suniv-f1c100s-pinctrl 1c20800.pinctrl: 1c20800.pinctrl supply vcc-pd not found, using dummy regulator
[    5.798082] panel-simple panel: panel supply power not found, using dummy regulator
[    5.891737] SCSI Media Changer driver v0.25
[    5.944574] suniv-f1c100s-pinctrl 1c20800.pinctrl: 1c20800.pinctrl supply vcc-pc not found, using dummy regulator
[    6.070256] spi-nor spi0.0: unrecognized JEDEC id bytes: ff ef aa 21 00 00
[    6.153405] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    6.231773] ehci-platform: EHCI generic platform driver
[    6.294867] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    6.369090] ohci-platform: OHCI generic platform driver
[    6.432382] usbcore: registered new interface driver usb-storage
[    6.505683] udc-core: couldn't find an available UDC - added [g_serial] to list of pending drivers
[    6.613609] i2c /dev entries driver
[    6.656182] suniv-f1c100s-pinctrl 1c20800.pinctrl: 1c20800.pinctrl supply vcc-pd not found, using dummy regulator
[    6.783119] sunxi-wdt 1c20ca0.watchdog: Watchdog enabled (timeout=16 sec, nowayout=0)
[    6.879126] suniv-f1c100s-pinctrl 1c20800.pinctrl: 1c20800.pinctrl supply vcc-pf not found, using dummy regulator
[    7.030208] sunxi-mmc 1c0f000.mmc: initialized, max. request size: 16384 KB
[    7.116266] usbcore: registered new interface driver usbhid
[    7.183183] usbhid: USB HID core driver
[    7.229929] NET: Registered protocol family 17
[    7.283398] Key type dns_resolver registered
[    7.335961] Loading compiled-in X.509 certificates
[    7.408854] sun4i-drm soc:display-engine: bound 1e00000.display-frontend (ops 0xc063f118)
[    7.507821] sun4i-drm soc:display-engine: bound 1e60000.display-backend (ops 0xc063e95c)
[    7.606328] sun4i-drm soc:display-engine: bound 1c0c000.lcd-controller (ops 0xc063d4fc)
[    7.702941] sun4i-drm soc:display-engine: bound 1c0a000.tv-encoder (ops 0xc063e21c)
[    7.794886] [drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
[    7.874233] [drm] No driver support for vblank timestamp query.
[    7.947471] [drm] Initialized sun4i-drm 1.0.0 20150629 for soc:display-engine on minor 0
[    8.045493] [drm] kms: can't enable cloning when we probably wanted to.
[    8.174791] Console: switching to colour frame buffer device 60x34
[    8.265939] sun4i-drm soc:display-engine: fb0: sun4i-drmdrmfb frame buffer device
[    8.357380] usb_phy_generic usb_phy_generic.0.auto: usb_phy_generic.0.auto supply vcc not found, using dummy regulator
[    8.488277] g_serial gadget: Gadget Serial v2.4
[    8.542756] g_serial gadget: g_serial ready
[    8.599424] Freeing unused kernel memory: 1024K
[    8.654103] Run /init as init process
[    8.863744] random: fast init done
[    9.118443] g_serial gadget: high-speed config #2: CDC ACM config
[    9.191595] gs_console_connect: port num [0] is not support console
[    9.397083] random: dd: uninitialized urandom read (512 bytes read)
[   38.882382] vcc3v0: disabling
[   38.918018] vcc3v3: disabling
[   38.953638] vcc5v0: disabling
# free             
              total        used        free      shared  buff/cache   available
Mem:          57200        4536       49836        2828        2828       48796
Swap:             0           0           0
# uptime
 00:10:24 up 10 min,  load average: 0.00, 0.01, 0.00


(the password is nano)

I achieved my initial objective: to boot non-destructively a Linux distribution through the USB interface on the back of the DSO, and communicate with it using the same USB interface.  :phew:

Of course this does not in any way void the warranty on the DSO.  :-BROKE

I'll be uploading UPLOADED the binary files to DavidAlfa's Drive repository (in Writable/AndrewBCN_Linux_binaries) and the source files to the GitHub repository (soon, as I am still cleaning up the code/configuration files). https://github.com/AndrewBCN/Hantek_DSO2x1x_Linux

This minimal Linux distribution is intended as a tool to explore the Hantek DSO2X1X hardware and software, but right now I have just included the minimal BusyBox utilities. I can add MicroPython, strace, ltrace and many other programs, so suggestions are welcome.
« Last Edit: August 30, 2021, 12:01:28 am by AndrewBCN »
 

Offline DavidAlfa

  • Super Contributor
  • ***
  • Posts: 5835
  • Country: es
Re: Hacking the DSO2X1X
« Reply #267 on: August 29, 2021, 11:19:10 pm »
The main reason of this was to read/write the flash for backup/restore purposes.
But what gives booting a system with just a console? You either want:
- Enable the console in the original system
- Enable flash access in the ram boot system.

I dropped this due few reasons.
My intention was to provide direct access to the host, so it would see it as a storage device, allowing simple access with dd, fdisk and such tools.
After adding spi-nand partitions in the kernel DTS, it recogniced it. But that was the easy part.
The usb storage gadget can't directly access storage devices, you can only bind files to it. So it's a shame.
MTP can't access system devices either.
Also I found that it doesn't allow multiple gadgets at once.
So you can run MTP, mass storage, ECM, ACM... but not two at the same time.
However you can make multiple instances for the same type, ex. 2x serial ports, or 2 mass storage devices.
The linux theory says it's possible, the ***** Allwinner kernel support seems to say the opposite.

The only workaround coming to my mind is using a daemon-based method and MTP.
So you write anything to /tmp, ex. "boot.bin", and after that a "run.sh" file with the commands to be remotely executed by the daemon.
But got more more issues. dd was extremely slow and didn't write correctly.
mtd was much faster, but also gave some problems which I don't remember. Furthermore, it can't write applyong an offset, so you can't write to big partitions in multiple chunks..
A workaround would be to split the nand in 16MB partitions (in DTS config), so you'll have 8 partitions, and no problem to that size in the ram.
You don't really care about the partitions (They will not be mounted), it's just a cheap method to split the nand in more manageable sizes.
But I lost my patience some weeks ago. Maybe I'll give another try some day...

I've also used Z-modem extensively with this system, to transfer small files when compiling or testing patches, much faster than removing the drive/plug into the host, copy the file, plug back...
The serial port works nicely up to 3Mbit. But my ESP8266 serial-wifi bridge loses packets at that speed when you flood it with data.
When stopping the phoenix process, it works nice up to 2Mbits, which is actually pretty fast (10MB takes 1minute), but when it's running, the hantek can't keep up with the incoming data, in that case only 460.800bps works reliably.


The screen is another crap from hell thing!

So good luck!  :-DD
« Last Edit: February 16, 2022, 01:55:18 am by DavidAlfa »
Hantek DSO2x1x            Drive        FAQ          DON'T BUY HANTEK! (Aka HALF-MADE)
Stm32 Soldering FW      Forum      Github      Donate
 

Offline AndrewBCN

  • Frequent Contributor
  • **
  • Posts: 571
  • Country: fr
Re: Hacking the DSO2X1X
« Reply #268 on: August 29, 2021, 11:52:36 pm »

Also I found that it doesn't allow multiple gadgets at once.
So you can run MTP, mass storage, ECM, ACM... but not two at the same time.
...

Actually, yes you can. I have tested having the serial and mass storage gadgets combination enabled, and it works fine. It's called composite gadget in the Linux kernel, check it out.
And you can easily transfer files to/from the host and read/write them from/to the onboard NAND flash.
 

Offline DavidAlfa

  • Super Contributor
  • ***
  • Posts: 5835
  • Country: es
Re: Hacking the DSO2X1X
« Reply #269 on: August 30, 2021, 12:02:41 am »
Libcomposite was deprecated some time ago, usb gadget use configfs now.
Maybe your kernel has better support, maybe I did something wrong.
But if I enabled any gadget, the others would drop a busy error when trying to enable them.

Spent some days trying every example over internet. No way!

Also, Hantek is not including ECM support in their kernel, so it sucks. A new kernel is needed.
« Last Edit: August 30, 2021, 12:05:27 am by DavidAlfa »
Hantek DSO2x1x            Drive        FAQ          DON'T BUY HANTEK! (Aka HALF-MADE)
Stm32 Soldering FW      Forum      Github      Donate
 

Offline AndrewBCN

  • Frequent Contributor
  • **
  • Posts: 571
  • Country: fr
Re: Hacking the DSO2X1X
« Reply #270 on: August 30, 2021, 12:57:47 am »
Libcomposite was deprecated some time ago, usb gadget use configfs now.
...

You are confusing two things. I never mentioned libcomposite and never used it. Composite gadgets are defined inside the kernel and can be configured at kernel module load time (by just passing the configuration parameters to the kernel module) or through configfs (if configfs is enabled in the kernel). I tested configuring the composite serial + mass storage gadget at module load time and that method works fine.

...
The usb storage gadget can't directly access storage devices, you can only bind files to it.
...

 :palm:

Of course it can.
« Last Edit: August 30, 2021, 02:46:00 pm by AndrewBCN »
 

Offline nic@nicwilson.com

  • Newbie
  • Posts: 2
  • Country: au
Re: Hacking the DSO2X1X
« Reply #271 on: August 30, 2021, 04:20:47 am »
I received my DSO2C15 today (Aug 2021) from an Australian supplier and I checked the mainboard,  which had printed on it  "DSO2D15_V1.7  2021.1.14", so its a fairly recent board,  and not only is it named a DSO2D15 it also had all components on it including the ones noted in this thread,  U18, U35, X1.    So I attempted the hack and I am delighted to say that it worked fine,  the Wave Gen now lights and is functional and the System Info shows it as a DSO2D15.

See attached picture of the unit with the system info.  So many thanks to everyone in this thread for this information, its very much appreciated,  if i can buy you a beer or a coffee then please let me know how.

cheers
NicW
 
The following users thanked this post: eevbstedt, Andrew_Debbie, ars_ha3hz

Offline DavidAlfa

  • Super Contributor
  • ***
  • Posts: 5835
  • Country: es
Re: Hacking the DSO2X1X
« Reply #272 on: August 31, 2021, 11:15:00 am »
Libcomposite was deprecated some time ago, usb gadget use configfs now.
...

You are confusing two things. I never mentioned libcomposite and never used it. Composite gadgets are defined inside the kernel and can be configured at kernel module load time (by just passing the configuration parameters to the kernel module) or through configfs (if configfs is enabled in the kernel). I tested configuring the composite serial + mass storage gadget at module load time and that method works fine.

...
The usb storage gadget can't directly access storage devices, you can only bind files to it.
...

 :palm:

Of course it can.

Then I'm waiting! :-DD
Hantek DSO2x1x            Drive        FAQ          DON'T BUY HANTEK! (Aka HALF-MADE)
Stm32 Soldering FW      Forum      Github      Donate
 

Offline AndrewBCN

  • Frequent Contributor
  • **
  • Posts: 571
  • Country: fr
Re: Hacking the DSO2X1X
« Reply #273 on: August 31, 2021, 01:11:16 pm »
...
Then I'm waiting! :-DD

From the Linux kernel documentation:
https://www.kernel.org/doc/html/latest/usb/mass-storage.html

Quote
The mass storage gadget accepts the following mass storage specific module parameters:

file=filename[,filename…]

This parameter lists paths to files or block devices used for backing storage for each logical unit. There may be at most FSG_MAX_LUNS (8) LUNs set. If more files are specified, they will be silently ignored. See also “luns” parameter.

Is there something you still don't understand?
 

Offline DavidAlfa

  • Super Contributor
  • ***
  • Posts: 5835
  • Country: es
Re: Hacking the DSO2X1X
« Reply #274 on: August 31, 2021, 04:02:21 pm »
Oh I didn't meant that. I'm no longer losing my time with this, so I'm waiting for you do do it! :popcorn:
Yeah I read all that, tried hundreds of examples... no way.
Just good luck!
« Last Edit: August 31, 2021, 04:04:59 pm by DavidAlfa »
Hantek DSO2x1x            Drive        FAQ          DON'T BUY HANTEK! (Aka HALF-MADE)
Stm32 Soldering FW      Forum      Github      Donate
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf