Hantek - Tekway - DSO hack - get 200MHz bw for free

[DC1MC]

Thank you for answer.
I did exactly as you said.
After your post, I tried with other USB sticks, the result is the same.
Firmware failed.

Well, here I only have one advice and then I'm out of ideas, try to shorten the file name to something like ds5000.up.
If this doesn't work as well, then it could be that the scope installed firmware is the same and it rejects it. Because the latest is from 2013, that is 10 years ago !!!

 Cheers,
 DC1MC

[Gologan]

Thank you both for your replies.  @ DC1MC I'm going to try this afternoon to rename the file to be updated, but I think it won't help because when it starts running, the update bar appears with the green line and in a very short time it gives the error.

[DC1MC]

Thank you both for your replies.  @ DC1MC I'm going to try this afternoon to rename the file to be updated, but I think it won't help because when it starts running, the update bar appears with the green line and in a very short time it gives the error.

It could then be that it checks and the version is already installed.

[An-162]

Gologan, If I were you, I would contact Hantek support. 

[Gologan]

Thank you , god ideea.
I will rwite them.

[vladi552]

Sorry for me, if this is look like a 'FAQ' question. I have difficult problem with my DSO5202BM (PCB v1.01 2013/1/4) device. It is not booted up and H-JTAG (and also OpenOCD) cannot read NAND ID (0x00 returned). Unfortunately, J801 UART connector also does not work. The K9F1G08U0E NAND is dead and I want to replace it with new one. I have T56 programmer (NAND supported) and can do this job, but full dump needed (~132Mb) for DSO5202BM. Can anybody help me, please...

[sinco]

Hello, I would like to create a complete backup of 8 files for the DSO 5072P. On a flash drive I have dumpbad.txt , dso5kp_backuptool2.up and obb.txt. But probably failed, tried 2* different flash drive. Where is my problem. thank you

[mike168]

Hi
I bought a 5202B about 9 years ago.  Recently I downloaded dso5kb_func_dso5202b20190830.up from Hantek to upgrade the firmware.  Immediately after the upgrade, the scope can't start.  See attached.  Unfortunately I didn't backup the original firmware nor take a screen shot of the version.  Can you help?

My serial number is T 1G/012 018406
Thanks.

[mike168]

So I still haven't received a working solution from Hantek, despite a perfectly operating 5202B frozen after updating the firmware from the official site.  Although my DSO is not a hacked one, I have followed some of the instructions from this thread to try to solve the problem.  The current status is as seen from below.  Any help would be appreciated.

▒▒*** Warning - bad CRC or NAND, using default environment


##### EmbedSky BIOS for SKY2416/TQ2416 #####
This Board: SDRAM is 64MB; LCD display size is: 800 X 480
Press Space key to Download Mode.!
SD:File System init failed!
Start Linux ...

NAND read: device 0 offset 0x300000, size 0x400000
Skipping bad block 0x00000000
 4194304 bytes read: OK
Boot with zImage

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 3.2.35 (root@zgt) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-176) ) #4 PREEMPT Thu Dec 26 00:49:29 CST 2013
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: SMDK2416
Memory policy: ECC disabled, Data cache writeback
CPU S3C2416/S3C2450 (id 0x32450003)
S3C24XX Clocks, Copyright 2004 Simtec Electronics
CPU: MPLL on 800.000 MHz, cpu 400.000 MHz, mem 133.333 MHz, pclk 66.666 MHz
CPU: EPLL on 96.000 MHz, usb-bus 48.000 MHz
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: noinitrd ubi.mtd=3 root=ubi0:rootfs rootfstype=ubifs init=/linuxrc console=ttySAC0 mem=64M
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 64MB = 64MB total
Memory: 59024k/59024k available, 6512k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    vmalloc : 0xc4800000 - 0xf6000000   ( 792 MB)
    lowmem  : 0xc0000000 - 0xc4000000   (  64 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .text : 0xc0008000 - 0xc03e9000   (3972 kB)
      .init : 0xc03e9000 - 0xc0409000   ( 128 kB)
      .data : 0xc040a000 - 0xc05a2840   (1635 kB)
       .bss : 0xc05a2864 - 0xc05bfb3c   ( 117 kB)
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:99
irq: clearing subpending status 00000002
Calibrating delay loop... 198.45 BogoMIPS (lpj=496128)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
S3C2416: Initializing architecture
S3C2416: IRQ Support
S3C24XX DMA Driver, Copyright 2003-2006 Simtec Electronics
DMA channel 0 at c4804000, irq 88
DMA channel 1 at c4804100, irq 89
DMA channel 2 at c4804200, irq 90
DMA channel 3 at c4804300, irq 91
DMA channel 4 at c4804400, irq 92
DMA channel 5 at c4804500, irq 93
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
s3c-i2c s3c2410-i2c: slave address 0x10
s3c-i2c s3c2410-i2c: bus frequency set to 9 KHz
s3c-i2c s3c2410-i2c: i2c-0: S3C I2C adapter
Advanced Linux Sound Architecture Driver Version 1.0.24.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
s3c-adc s3c24xx-adc: attached adc driver
msgmni has been set to 115
io scheduler noop registered (default)
io scheduler cfq registered
s3c-fb s3c-fb: window 0: fb
s3c-fb s3c-fb: LCD type is TN83 800*480, default_bpp=16, pixclock=5
s3c2440-uart.0: ttySAC0 at MMIO 0x50000000 (irq = 70) is a S3C2440
console [ttySAC0] enabled
s3c2440-uart.1: ttySAC1 at MMIO 0x50004000 (irq = 73) is a S3C2440
s3c2440-uart.2: ttySAC2 at MMIO 0x50008000 (irq = 76) is a S3C2440
s3c2440-uart.3: ttySAC3 at MMIO 0x5000c000 (irq = 94) is a S3C2440
loop: module loaded
S3C24XX NAND Driver, (c) 2004 Simtec Electronics
info->cpu_type=3, tacls_max=8
s3c24xx-nand s3c2416-nand: Tacls=3, 22ns Twrph0=7 52ns, Twrph1=3 22ns
s3c24xx-nand s3c2416-nand: System booted from NAND
s3c24xx-nand s3c2416-nand: NAND ECC disabled
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
NAND_ECC_NONE selected by board driver. This is not recommended!
Scanning device for bad blocks
Bad eraseblock 31 at 0x0000003e0000
Bad eraseblock 776 at 0x000006100000
Bad eraseblock 915 at 0x000007260000
Creating 4 MTD partitions on "NAND":
0x000000000000-0x000000100000 : "Bootloader"
0x000000100000-0x000000300000 : "LOGO"
0x000000300000-0x000000700000 : "Kernel"
0x000000700000-0x000008000000 : "ROOTFS"
UBI: attaching mtd3 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: max. sequence number:       2062
UBI: attached mtd3 to ubi0
UBI: MTD device name:            "ROOTFS"
UBI: MTD device size:            121 MiB
UBI: number of good PEBs:        966
UBI: number of bad PEBs:         2
UBI: number of corrupted PEBs:   0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     1
UBI: available PEBs:             0
UBI: total number of reserved PEBs: 966
UBI: number of PEBs reserved for bad PEB handling: 9
UBI: max/mean erase counter: 4/2
UBI: image sequence number:  0
UBI: background thread "ubi_bgt0d" started, PID 307
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
s3c2410-ohci s3c2410-ohci: S3C24XX OHCI
s3c2410-ohci s3c2410-ohci: new USB bus registered, assigned bus number 1
s3c2410-ohci s3c2410-ohci: irq 42, io mem 0x49000000
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
usbcore: registered new interface driver usblp
usbcore: registered new interface driver uas
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
g_serial gadget: Gadget Serial v2.4
g_serial gadget: g_serial ready
s3c-hsudc s3c-hsudc: bound driver g_serial
samsung-ts s3c2416-ts: driver attached, registering input device
input: S3C24XX TouchScreen as /devices/virtual/input/input0
S3C24XX RTC, (c) 2004,2006 Simtec Electronics
s3c-rtc s3c2410-rtc: rtc disabled, re-enabling
s3c-rtc s3c2410-rtc: rtc core: registered s3c as rtc0
s3c-rtc s3c2410-rtc: warning: invalid RTC value so initializing it
i2c /dev entries driver
S3C2410 Watchdog Timer, (c) 2004 Simtec Electronics
s3c2410-wdt s3c2410-wdt: watchdog inactive, reset disabled, irq disabled
sdhci: Secure Digital Host Controller Interface driver
sdhci: Copyright(c) Pierre Ossman
s3c-sdhci s3c-sdhci.1: clock source 0: hsmmc (133333333 Hz)
s3c-sdhci s3c-sdhci.1: clock source 1: hsmmc (133333333 Hz)
s3c-sdhci s3c-sdhci.1: clock source 2: hsmmc-if (24000000 Hz)
mmc0: SDHCI controller on samsung-hsmmc [s3c-sdhci.1] using ADMA
S3C24XX_UDA134X SoC Audio driver
UDA134X SoC Audio Codec
asoc: uda134x-hifi <-> s3c24xx-iis mapping ok
ALSA device list:
  #0: S3C24XX_UDA134X
TCP cubic registered
NET: Registered protocol family 17
Registering the dns_resolver key type
s3c-rtc s3c2410-rtc: setting system clock to 2000-01-01 00:00:00 UTC (946684800)
UBIFS: recovery needed
usb 1-1: new full-speed USB device number 2 using s3c2410-ohci
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 0, name "rootfs"
UBIFS: file system size:   119611392 bytes (116808 KiB, 114 MiB, 942 LEBs)
UBIFS: journal size:       9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  0 bytes (0 KiB)
VFS: Mounted root (ubifs filesystem) on device 0:10.
Freeing init memory: 128K
scsi0 : usb-storage 1-1:1.0
dso-iobank: install ok
adc init
TQ2416 ADC driver
0x505
gpio_major_n = 5, io_minor_n = 5, output 0
0x603
gpio_major_n = 6, io_minor_n = 3, output 0
0x70a
gpio_major_n = 7, io_minor_n = 10, output 0
0x408
gpio_major_n = 4, io_minor_n = 8, output 1
dso5000b fpga configure init
fpga0:status: 0x0
scsi 0:0:0:0: Direct-Access     Lexar    USB Flash Drive  1100 PQ: 0 ANSI: 0 CCS
sd 0:0:0:0: [sda] 7831552 512-byte logical blocks: (4.00 GB/3.73 GiB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] No Caching mode page present
sd 0:0:0:0: [sda] Assuming drive cache: write through
sd 0:0:0:0: [sda] No Caching mode page present
sd 0:0:0:0: [sda] Assuming drive cache: write through
 sda: sda1 sda2
sd 0:0:0:0: [sda] No Caching mode page present
sd 0:0:0:0: [sda] Assuming drive cache: write through
sd 0:0:0:0: [sda] Attached SCSI removable disk
FPGA0 CONFIGURE DATA DOWN finish.
FPGA0 CONFIGURE Ok.
0x8090
0x1
fpga bank 11811dso-fpga: install ok
bkl tq2416-backlight initialized done...
close beep now
dso-buzzer s3c2416-beep initialized done...
--------------------------------------------------------------------------------
start
--------------------------------------------------------------------------------

Please press Enter to activate this console. dso5kb_func_dso5202b20160106.up
ls: /mnt/udisk/system*.up: No such file or directory
dso5kb_func_dso5202b20160106.up
ls: /mnt/udisk/system*.up: No such file or directory
dso5kb_func_dso5202b20160106.up
ls: /mnt/udisk/system*.up: No such file or directory
dso5kb_func_dso5202b20160106.up
ls: /mnt/udisk/system*.up: No such file or directory
^Ckdso5kb_func_dso5202b20160106.up
ils: /mnt/udisk/system*.up: No such file or directory
lldso5kb_func_dso5202b20160106.up
ls: /mnt/udisk/system*.up: No such file or directory
 4dso5kb_func_dso5202b20160106.up
5ls: /mnt/udisk/system*.up: No such file or directory
5
[root@Hantek ~]# dso5kb_func_dso5202b20160106.up
ls: /mnt/udisk/system*.up: No such file or directory
dso5kb_func_dso5202b20160106.up
ls: /mnt/udisk/system*.up: No such file or directory

[root@Hantek ~]# kdso5kb_func_dso5202b20160106.up
ils: /mnt/udisk/system*.up: No such file or directory
ll dso5kb_func_dso5202b20160106.up
ls: /mnt/udisk/system*.up: No such file or directory
455
[root@Hantek ~]# ls -l /mnt/udisk
total 3344
-rwxrwxrwx    1 root     root       3423999 Apr 26  2016 dso5kb_func_dso5202b20160106.up
[root@Hantek ~]#

[hranatybraska]

Hello,
after update firmware my Hantek DSO1202BV scope didn’t boot succesfully.

I have connected to internal USART and i find that machine is alive.
Only the YAFFS2 filesystem is corrupted.

Could you send me anybody a backup or factory file please?
Thanks

[Merlin11]

Is there a way to hack the Hantek DSO2D10 to go to 200MHz? I've looked here but don't see the how to or any files for a Hantek DSO2D10. Thanks

[tgeehobby]

Hi, new member, just joined.

I have the same error 0xfe on my Hantek DSO5102b... I see Tinhead's note re (I think) downloading some stuff from his OneDrive ??  Have no idea how to do this.
Any other help re firmwar failure with the 0xfe error appreciated.

Thanks.

[Gregorio]

Hello everyone:
I have purchased a Hantek DSO5202P. When power on it does not show anything on the screen, only some buttons light up. I have connected it via USB to serial to a computer, and I have been able to see that it tries to boot and I share the last lines that it executes:
..........
..........
NAND read: device 0 offset 0x400000, size 0x400000
4194304 bytes read: OK
Boot with zImage

Starting kernel ...

Uncompressing Linux... done, booting the kernel.

It stays on the previous line and does not continue.

I have almost everything to load the fw_backup.bin file, although I am missing the supervivi.bin and/or vivi.bin files

Could someone share them?
I would be very grateful

Greetings to all

[morris6]

Hello Gregorio,

A few days ago I stumbled over your post. It's long ago I followed this thread. Sorry.

Are you still needing the requested supervivi and vivi files for the restore of your scope? I found them on the old Windows machine I used at the time, around 2012, for updating the Hantek (Conrad) DSO. (5202 B series).

Attached here an archive with both requested files.

Have fun,

Maurits

[Gregorio]

Muchas gracias Morris
Saludos, Gregorio

[Gregorio]

I thought those files were applications. I'll have to look into using them. Do you know the application that handles them?
Thanks a lot Morris6.

[Gregorio]

I thought those files were applications. I'll have to look into using them. Do you know the application that handles them?
Thanks a lot Morris6.

[morris6]

This post of member Tinhead is about restoring the firmware. AFAIK The supervivi bootloader is used here to be able to use USB serial in stead of a JTAG connection to upload a complete image. It's a slow process, some nail biting and finger crossing needed.

How to restore original firmware/NAND

imagine you screwed something up and wish to restore the firmware to the original version
(which you of course saved before wth the backup tools from this thread ... you don't? Well do it now.
If it's already too late then send me PM, i can help you to restore your DSO)

There are two ways :
- over JTAG
- over UART/USB

As most ppl don't have a nice H-JTAG USB (or whatever ARM JTAG) i will skip here the restore over JTAG part,
because if you have one you know how to use it
(all you need in principle is to flash in raw mode, so with OOB blocks the combined backup file fw_backup.bin and reboot)

Restore over UART/USB
You need some tools:
- dnw.exe
- supervivi.bin
- vivi.bin (just in case, see later why)

These tools are attached already here:
https://www.eevblog.com/forum/index.php?action=dlattach;topic=1571.0;attach=4153

The dnw.exe need a device driver and inf file, you can find them here:
(from http://www.friendlyarm.net/downloads page)
http://www.friendlyarm.net/dl.php?file=usb-downloaddr-setup_20090421.zip
http://www.friendlyarm.net/dl.php?file=usb-downloaddr_20090421.zip

The first one is complette setup program, the second just inf/device drive, use the one you like, both works
For Win64 users: i know there are some dnw.exe/drivers out there for Win64, search for them or use Win32 to restore

Now the first step is to create a complette restore file, the backup tool from this thread is creating 3 dumps:
boot.bin
kernel.bin
root.bin

They are only MTD partitions backups (with NAND OOB blocks), what missing is some empty space
which has been not saved during backup and NAND MTD endblock.
You can find them here:

(https://www.eevblog.com/forum/index.php?topic=1571.msg26930#msg26930)

https://www.eevblog.com/forum/index.php?action=dlattach;topic=1571.0;attach=4903
https://www.eevblog.com/forum/index.php?action=dlattach;topic=1571.0;attach=4904

Download these two files, put them into a folder with boot.bin, root.bin and kernel.bin
and run from dos prompt following:
copy /B boot.bin + blank.bin + kernel.bin + root.bin + mizi_tag.bin fw_backup.bin

The resulting fw_backup.bin is the full backup wich we need to proceed with restore.

Now connect your DSO over UART to your PC, open the terminal application, connect to whatever com port your
DSO is connected to (set 115200, 8n1) and power up your DSO.

While powering up try multiple times to hit space key, if the boot process have not stopped at following screen power off DSO
and try again until you see something like that :



This is the bootload prompt. Unfortunately the original Tekway/Hantek bootloader have NO USB support
so we have first to upload another one bootloader (with USB support) - that's the supervivi.bin

IMPORTANT: use only the supervivi.bin provided by me, if you use different version the restore might not work properly
or you screw up the MTD patritions.

To do this type in the bootloader prompt following:

load flash vivi x

and click enter. Now in your terminal application (i'm using hyperterm, sure not the best solution but it works)
chose "Transfer->send file", select the supervivi.bin, select Xmodem as protocol
(the x in what you typed in bootloader prompt means Xprotocol too).

Now you should see somehing like this picture:



After this step reboot your DSO, hit again during boot multiple times space key until the DSO stop at such screen:





The next step is to connect the DSO over USB and to install the device drivers to allow dnw.exe to communicate
with DSO. After you installed drivers run the dnw.exe, if everything worked you should see
in the dnw.exe top status line something like USB:OK



If you see this you can continue with fw/NAND restore, if not close dnw.exe, reconnect USB cable and try again.

Now type in the supervivi bootloader menu "r" - this means restore, immediately after that in dnw.exe menu
chose "Usb Port->Transmit/Restore" and chose the previously created full backup fw_backup.bin
Don't wait too long, dnw.exe is sometimes really bitchy with timeouts.

You should see now in the dnw.exe and your terminal application the transfer/flashing progress:






After the supervivi bootloader flashed the NAND with your fw_backup.bin the menu will be shown again, just
scroll back to see the flashing status, here my example (note, my NAND have one bad block, not a bog deal):



That's all, now close dnw.exe, disconnect USB cable from DSO and reboot DSO - you will have
now your original firmware restored.


Note: if you have too many bad NAND sectors the restore might not work, then you will have to buy new empty NAND chip,
solder it and repalce the broken one and of course use ARM JTAG to program the NAND backup (or at least the bootloader).

Extra note: after restore the bootloader is again the original HanTekway vivi.bin (the same as the attached),
if you lazy you can remove it of course by the supervivi.bin - the DSO will still work and you will have
nice way (over USB/dnw.exe) to backup/restore NAND (if you hacking often and have no JTAG cable this is the fastest way)